@opengsd/gsd-core 1.4.3 → 1.5.0-rc.1

package/scripts/lint-regression-test-names.allowlist.json

@@ -0,0 +1,269 @@
+[
+  "bug-10-semver-policy-consolidation.test.cjs",
+  "bug-130-finishinstall-opencode-testmode.test.cjs",
+  "bug-131-release-tarball-smoke-explicit-home.test.cjs",
+  "bug-14-progress-auto-flag-dropped.test.cjs",
+  "bug-167-query-meta-command.test.cjs",
+  "bug-17-askuserquestion-option-cap.test.cjs",
+  "bug-170-workflow-fallback-install-hint.test.cjs",
+  "bug-1736-local-install-commands.test.cjs",
+  "bug-1754-js-hook-guard.test.cjs",
+  "bug-1817-sh-hook-guard.test.cjs",
+  "bug-1818-unknown-flags.test.cjs",
+  "bug-1826-phases-clear-confirm.test.cjs",
+  "bug-1829-inherit-model-profile.test.cjs",
+  "bug-1834-sh-hooks-installed.test.cjs",
+  "bug-1891-file-resolution.test.cjs",
+  "bug-190-bridge-collapse.test.cjs",
+  "bug-1906-hook-relative-paths.test.cjs",
+  "bug-1908-uninstall-manifest.test.cjs",
+  "bug-1924-preserve-user-artifacts.test.cjs",
+  "bug-1967-cache-invalidation.test.cjs",
+  "bug-1974-context-exhaustion-record.test.cjs",
+  "bug-2002-offer-next-context.test.cjs",
+  "bug-2004-pr-branch-milestone.test.cjs",
+  "bug-21-state-md-template-frontmatter.test.cjs",
+  "bug-211-launcher-home-fallback.test.cjs",
+  "bug-2136-sh-hook-version.test.cjs",
+  "bug-214-phase-researcher-write-truncation-contract.test.cjs",
+  "bug-214-writer-agents-write-truncation-contract.test.cjs",
+  "bug-222-research-synthesizer-write-contract.test.cjs",
+  "bug-224-pick-stdout-capture.test.cjs",
+  "bug-2248-local-install-statusline.test.cjs",
+  "bug-2256-model-overrides-transport.test.cjs",
+  "bug-2268-parallel-discuss.test.cjs",
+  "bug-2344-read-guard-claudecode-env.test.cjs",
+  "bug-2346-agent-read-loop-guards.test.cjs",
+  "bug-2351-intel-kilo-layout.test.cjs",
+  "bug-2376-opencode-windows-home-path.test.cjs",
+  "bug-2384-post-merge-deletion-audit.test.cjs",
+  "bug-2388-plan-phase-no-branch-rename.test.cjs",
+  "bug-2396-makefile-test-priority.test.cjs",
+  "bug-2399-commit-docs-plan-phase.test.cjs",
+  "bug-2410-stream-checkpoint-heartbeats.test.cjs",
+  "bug-2418-antigravity-bare-path.test.cjs",
+  "bug-2419-project-researcher-agent.test.cjs",
+  "bug-2421-planner-grep-gate-hygiene.test.cjs",
+  "bug-2424-reapply-patches-baseline-detection.test.cjs",
+  "bug-2432-quick-plan-predispatch-commit.test.cjs",
+  "bug-2451-context-monitor-over-report.test.cjs",
+  "bug-2470-update-md-claude-path.test.cjs",
+  "bug-2492-context-coverage-gate.test.cjs",
+  "bug-2501-resurrection-detection.test.cjs",
+  "bug-2502-insert-phase-state-update.test.cjs",
+  "bug-2504-uat-foundation-phases.test.cjs",
+  "bug-2506-settings-profile-nonclaude-warning.test.cjs",
+  "bug-2516-inherit-model-execute-phase.test.cjs",
+  "bug-2520-read-guard-hook-subprocess-env.test.cjs",
+  "bug-2523-quick-deferred-items.test.cjs",
+  "bug-2530-valid-config-keys.test.cjs",
+  "bug-2543-gsd-slash-namespace.test.cjs",
+  "bug-2545-copilot-unreplaced-paths.test.cjs",
+  "bug-2549-2550-2552-discuss-phase-context.test.cjs",
+  "bug-2554-decimal-phase-filter.test.cjs",
+  "bug-2557-gemini-local-hook-paths.test.cjs",
+  "bug-2559-stale-search-year.test.cjs",
+  "bug-260-worktree-path-guard.test.cjs",
+  "bug-2601-inherit-model-profile.test.cjs",
+  "bug-261-worktree-force-add-guard.test.cjs",
+  "bug-2630-state-frontmatter-milestone-switch.test.cjs",
+  "bug-2638-sub-repos-canonical-location.test.cjs",
+  "bug-2643-skill-frontmatter-name.test.cjs",
+  "bug-2659-audit-open-crash.test.cjs",
+  "bug-2660-one-liner-extraction.test.cjs",
+  "bug-2661-roadmap-sync-parallel.test.cjs",
+  "bug-2686-review-fix-worktree.test.cjs",
+  "bug-2698-crlf-install.test.cjs",
+  "bug-2760-codex-install-defensive.test.cjs",
+  "bug-2769-requirements-header-variants.test.cjs",
+  "bug-2770-annotate-deps-int-coerce.test.cjs",
+  "bug-2771-user-profile-manifest.test.cjs",
+  "bug-2772-gitmodules-path-intersection.test.cjs",
+  "bug-2784-update-cache-clear-path.test.cjs",
+  "bug-279-codex-agent-mapping.test.cjs",
+  "bug-2794-opencode-model-profile-overrides.test.cjs",
+  "bug-2798-context-window-config-key.test.cjs",
+  "bug-2801-ingest-docs-handler.test.cjs",
+  "bug-2808-skill-hyphen-name.test.cjs",
+  "bug-2831-opencode-home-path-prefix.test.cjs",
+  "bug-2836-audit-open-summary-uat-drift.test.cjs",
+  "bug-2838-summary-rescue-gitignored-planning.test.cjs",
+  "bug-2839-review-fix-transactional-cleanup.test.cjs",
+  "bug-2851-workflow-bare-gsd-tools.test.cjs",
+  "bug-2866-codex-strip-no-trailing-newline.test.cjs",
+  "bug-2876-skill-frontmatter-quote.test.cjs",
+  "bug-2911-audit-open-output-shape.test.cjs",
+  "bug-2912-progress-context-authority.test.cjs",
+  "bug-2916-handle-branching-default-base.test.cjs",
+  "bug-2942-detect-custom-skills.test.cjs",
+  "bug-2943-config-get-context-window-default.test.cjs",
+  "bug-2948-spike-wrap-up-dispatch.test.cjs",
+  "bug-2949-sketch-wrap-up-dispatch.test.cjs",
+  "bug-2950-stale-command-refs.test.cjs",
+  "bug-2954-help-md-slash-command-stubs.test.cjs",
+  "bug-2957-claude-global-postinstall-message.test.cjs",
+  "bug-2969-verify-reapply-patches.test.cjs",
+  "bug-2973-profile-user-skills-path.test.cjs",
+  "bug-2979-hook-absolute-node.test.cjs",
+  "bug-2986-config-schema-mutation-killers.test.cjs",
+  "bug-2990-code-fixer-worktree-branch.test.cjs",
+  "bug-2992-check-latest-version.test.cjs",
+  "bug-2994-verify-reapply-patches-installed-path.test.cjs",
+  "bug-2995-post-install-script-paths.test.cjs",
+  "bug-2998-pristine-dir-populated.test.cjs",
+  "bug-3017-codex-hook-absolute-node.test.cjs",
+  "bug-3018-codex-discuss-fallback.test.cjs",
+  "bug-3019-help-passthrough.test.cjs",
+  "bug-3037-gemini-duplicate-commands.test.cjs",
+  "bug-3050-update-backup-eacces-nonfatal.test.cjs",
+  "bug-3054-stale-gsd-next-references.test.cjs",
+  "bug-3072-optional-sketch-findings-guard.test.cjs",
+  "bug-3083-resume-route-clear.test.cjs",
+  "bug-3086-git-create-tag-config-gate.test.cjs",
+  "bug-3087-planner-directive-language.test.cjs",
+  "bug-3096-ai-integration-phase-parallel-race.test.cjs",
+  "bug-3097-3099-executor-worktree-path-safety.test.cjs",
+  "bug-3120-secure-phase-empty-register.test.cjs",
+  "bug-3126-global-skills-base-runtime-path.test.cjs",
+  "bug-3127-state-begin-phase-idempotent.test.cjs",
+  "bug-3128-roadmap-plan-count-slug-layout.test.cjs",
+  "bug-3129-validate-commit-git-bypass.test.cjs",
+  "bug-3130-update-npx-robust-invocation.test.cjs",
+  "bug-3135-capture-backlog-workflow.test.cjs",
+  "bug-3150-stats-json-decimal-phase-gaps.test.cjs",
+  "bug-3156-plan-phase-opencode-dispatch.test.cjs",
+  "bug-3163-codex-agents-md.test.cjs",
+  "bug-3168-task-to-agent-rename.test.cjs",
+  "bug-3181-node-cellar-path.test.cjs",
+  "bug-3195-quick-resurrection-guard.test.cjs",
+  "bug-3197-gsd-tools-config-whitelist.test.cjs",
+  "bug-321-config-defaults-clone-strategy.test.cjs",
+  "bug-3212-execute-phase-stall-safe-resume.test.cjs",
+  "bug-3227-config-set-model-overrides.test.cjs",
+  "bug-3236-capture-seed-one-shot.test.cjs",
+  "bug-3242-state-update-progress-trample.test.cjs",
+  "bug-3243-dotted-command-form.test.cjs",
+  "bug-3245-codex-toml-floats.test.cjs",
+  "bug-3257-nested-plans-undercount.test.cjs",
+  "bug-3258-no-stale-gsd-intel-references.test.cjs",
+  "bug-3275-fmstr-non-string-scalars.test.cjs",
+  "bug-3285-codex-hooks-state-allowed.test.cjs",
+  "bug-3286-state-write-routing.test.cjs",
+  "bug-3288-model-catalog-install-path.test.cjs",
+  "bug-3290-intel-updater-layout-block.test.cjs",
+  "bug-33-settings-model-profile-adaptive.test.cjs",
+  "bug-3320-planner-deep-work-rules.test.cjs",
+  "bug-3321-verifier-runs-probes.test.cjs",
+  "bug-3346-codex-aot-toml-key.test.cjs",
+  "bug-3357-codex-legacy-hooks-json-migration.test.cjs",
+  "bug-3360-codex-execute-phase-worktrees.test.cjs",
+  "bug-338-local-install-settings-local-json.test.cjs",
+  "bug-3381-verify-work-workstream.test.cjs",
+  "bug-3384-secondary-defects.test.cjs",
+  "bug-3407-pristine-stale-content.test.cjs",
+  "bug-3413-shell-command-projection.test.cjs",
+  "bug-3418-progress-flag-routing.test.cjs",
+  "bug-3426-codex-windows-hooks.test.cjs",
+  "bug-3427-3433-codex-install-shape.test.cjs",
+  "bug-3430-planner-phase-contract.test.cjs",
+  "bug-3431-debug-command-yaml.test.cjs",
+  "bug-3441-path-action-projection.test.cjs",
+  "bug-3442-codex-legacy-hooks-json-migration.test.cjs",
+  "bug-3442-shim-projection-drift-guard.test.cjs",
+  "bug-3446-resume-continue-here-discovery.test.cjs",
+  "bug-3454-state-dollar-backreference-growth.test.cjs",
+  "bug-3489-complete-phase-idempotent.test.cjs",
+  "bug-3491-nested-git-worktree.test.cjs",
+  "bug-3509-path-spaces.test.cjs",
+  "bug-3516-reapply-patches-gsd-update-filter.test.cjs",
+  "bug-3521-quick-cleanup-cwd-pin.test.cjs",
+  "bug-3523-cjs-loadconfig-branching-strategy-warning.test.cjs",
+  "bug-3537-padded-id-against-unpadded-roadmap.test.cjs",
+  "bug-3541-installer-migration-prompt-user-resolution.test.cjs",
+  "bug-3542-executor-git-stash-prohibition.test.cjs",
+  "bug-3562-codex-install-skill-surface.test.cjs",
+  "bug-3566-codex-hooks-feature-canonical-key.test.cjs",
+  "bug-3571-configuration-manifest-install-path.test.cjs",
+  "bug-3582-codex-skills-materialized.test.cjs",
+  "bug-3584-runtime-slash-emitters.test.cjs",
+  "bug-3584-runtime-slash-formatter.test.cjs",
+  "bug-3588-npm-audit-clean.test.cjs",
+  "bug-3599-roadmap-get-phase-project-code-prefix.test.cjs",
+  "bug-3605-stale-research-insert-phase-agent-refs.test.cjs",
+  "bug-3608-antigravity-update-runtime-classification.test.cjs",
+  "bug-3610-installer-migration-bundled-hooks-classification.test.cjs",
+  "bug-3628-bundled-hook-classifier-whitelist.test.cjs",
+  "bug-3631-router-raw-flag.test.cjs",
+  "bug-3657-verify-reapply-patches-pristine-drift.test.cjs",
+  "bug-3659-applysurface-prune-skill-dirs.test.cjs",
+  "bug-3668-workflow-runtime-resolution.test.cjs",
+  "bug-3670-cursor-local-install-migration-lock.test.cjs",
+  "bug-3677-agent-colon-namespace-leak.test.cjs",
+  "bug-3678-executor-commit-docs-respect.test.cjs",
+  "bug-3683-command-colon-namespace-leak.test.cjs",
+  "bug-3683-command-cross-reference-invariant.test.cjs",
+  "bug-3683-workflow-colon-namespace-leak.test.cjs",
+  "bug-3689-resume-glob-nomatch.test.cjs",
+  "bug-3691-annotate-deps-plans-block-variants.test.cjs",
+  "bug-3706-ui-safety-gate-false-positives.test.cjs",
+  "bug-3707-locked-worktree-cleanup.test.cjs",
+  "bug-3727-code-review-fix-flag-dispatch.test.cjs",
+  "bug-3735-profiles-core-includes-surface.test.cjs",
+  "bug-3739-gap-checker-padded-prefix-context.test.cjs",
+  "bug-376-claude-js-hook-gsd-rewriter.test.cjs",
+  "bug-378-update-check-scoped-name.test.cjs",
+  "bug-3784-gsd-settings-model-profile-ui-omits-adaptive.test.cjs",
+  "bug-3805-fast-md-log-to-state-schema.test.cjs",
+  "bug-3808-codex-adapter-text-mode-fallback.test.cjs",
+  "bug-3810-no-gsd-sdk-runtime-refs.test.cjs",
+  "bug-384-agents-runtime-aware.test.cjs",
+  "bug-397-state-preserve-executor-authored.test.cjs",
+  "bug-410-install-defaults-test-mode-guard.test.cjs",
+  "bug-416-archive-dir-null.test.cjs",
+  "bug-442-config-dir-equals-in-path.test.cjs",
+  "bug-444-resolver-local-claude-install.test.cjs",
+  "bug-447-gap-analysis-phase-req-ids.test.cjs",
+  "bug-474-clock-seam-date-determinism.test.cjs",
+  "bug-492-effort-manifest-fallback.test.cjs",
+  "bug-500-planned-phase-progress-corruption.test.cjs",
+  "bug-501-flat-phase-details-milestone-leak.test.cjs",
+  "bug-503-update-agent-antigravity-detection.test.cjs",
+  "bug-505-remove-dead-sdk-verification.test.cjs",
+  "bug-549-total-phases-overcounts-with-phase-section-heading.test.cjs",
+  "bug-557-details-summary-milestone-strip.test.cjs",
+  "bug-570-codex-leak-scanner.test.cjs",
+  "bug-571-doc-writer-fix-mode-edit-only.test.cjs",
+  "bug-580-local-sh-hook-bash-wrapper.test.cjs",
+  "bug-619-codebase-drift-gate-shim.test.cjs",
+  "bug-621-plan-phase-gap-analysis-gsd-run.test.cjs",
+  "bug-622-graphify-optional-graph-html.test.cjs",
+  "bug-630-wave-cleanup-orchestrator-root.test.cjs",
+  "bug-637-workflow-no-hardcoded-home-tool.test.cjs",
+  "bug-641-files-from-suite-token.test.cjs",
+  "bug-663-redos-roadmap-phase-parsing.test.cjs",
+  "bug-685-windowshide-spawn.test.cjs",
+  "bug-687-agy-timeout.test.cjs",
+  "bug-704-codex-launcher-path-corruption.test.cjs",
+  "bug-730-milestone-phase-details-scope.test.cjs",
+  "bug-782-cline-skills-emission.test.cjs",
+  "bug-783-kilo-global-skills-base.test.cjs",
+  "bug-851-codex-quick-adapter-agent-type-fallback.test.cjs",
+  "bug-853-bg-dispatch-runtime-gating.test.cjs",
+  "bug-866-profile-pipeline-temp-root.test.cjs",
+  "bug-891-non-claude-runtime-home-fallback.test.cjs",
+  "bug-892-validate-checklist-roadmap-phases.test.cjs",
+  "bug-905-state-syncstatefrontmatter-preserve-scalars.test.cjs",
+  "bug-924-claude-flat-skill-layout.test.cjs",
+  "bug-925-context-monitor-hook-event-name.test.cjs",
+  "bug-936-no-nested-spawner-wrap.test.cjs",
+  "bug-941-managed-hooks-registry-manifest.test.cjs",
+  "bug-947-hermes-gsd-prefix.test.cjs",
+  "bug-948-state-noop-write-guard.test.cjs",
+  "bug-950-quick-summary-status-complete.test.cjs",
+  "bug-967-verify-key-links-strict-paths.test.cjs",
+  "bug-969-test-infra-flake-hardening.test.cjs",
+  "bug-974-graphify-budget-missing-value.test.cjs",
+  "bug-977-fnm-multishell-path.test.cjs",
+  "bug-978-milestone-complete-force.test.cjs",
+  "bug-983-trae-windsurf-claude-path-leak.test.cjs"
+]

package/scripts/lint-regression-test-names.cjs

@@ -0,0 +1,117 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * lint-regression-test-names.cjs — ban NEW top-level bug-NNNN test files.
+ *
+ * ## Why
+ *
+ * The 2026-06 CI audit found 244 one-off `tests/bug-NNNN-*.test.cjs` files —
+ * ~38% of the suite. `node --test` spawns one child process per FILE, so file
+ * count (not test count) is the unit of CI overhead, and it is worst on the
+ * Windows lanes where every spawn is Defender-scanned. Each regression test
+ * belongs in the owning module's main test file as a regression case (e.g. a
+ * `describe('regressions')` block in `tests/<module>.test.cjs`), where it
+ * costs zero additional processes.
+ *
+ * ## What this enforces
+ *
+ * Identity ratchet (scripts/lib/allowlist-ratchet.cjs) over basenames matching
+ * /^bug-\d+.*\.test\.cjs$/ in tests/:
+ *   - A NEW bug-* file (not in the allowlist) fails: fold the regression into
+ *     the owning module's test file instead.
+ *   - A REMOVED bug-* file with a stale allowlist entry also fails: prune the
+ *     entry from scripts/lint-regression-test-names.allowlist.json so the
+ *     baseline only ever shrinks.
+ *
+ * ## --update (allowlist drift repair)
+ *
+ * `node scripts/lint-regression-test-names.cjs --update` regenerates the
+ * allowlist from the files currently in tests/ and reports what changed.
+ * Use it when the failure is INHERITED drift, not your own new file — e.g.
+ * the base branch merged bug-* files without feeding the allowlist (the
+ * #947/#948/#950 race after the ratchet landed), or after a rebase. The
+ * allowlist is a snapshot artifact: regenerate it AFTER rebasing, never
+ * carry a pre-rebase copy through.
+ *
+ * See docs/TESTING-SUITES.md ("Regression tests") for the placement policy.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const { assertWithinAllowlist } = require('./lib/allowlist-ratchet.cjs');
+const { ExitError, runMain } = require('./lib/cli-exit.cjs');
+
+const ROOT = path.join(__dirname, '..');
+// Env overrides exist for the lint's own tests only (sandbox fixture dirs).
+const TESTS_DIR = process.env.GSD_LINT_REGRESSION_TESTS_DIR || path.join(ROOT, 'tests');
+const ALLOWLIST_PATH =
+  process.env.GSD_LINT_REGRESSION_ALLOWLIST ||
+  path.join(__dirname, 'lint-regression-test-names.allowlist.json');
+
+const BUG_FILE_RE = /^bug-\d+.*\.test\.cjs$/;
+
+function main() {
+  const args = process.argv.slice(2);
+  const update = args.includes('--update');
+  const unknown = args.filter(a => a !== '--update');
+  if (unknown.length > 0) {
+    throw new ExitError(2, `lint-regression-test-names: unknown argument(s): ${unknown.join(', ')}`);
+  }
+
+  const current = fs
+    .readdirSync(TESTS_DIR)
+    .filter(f => BUG_FILE_RE.test(f))
+    .sort();
+  const known = JSON.parse(fs.readFileSync(ALLOWLIST_PATH, 'utf8'));
+
+  if (update) {
+    const knownSet = new Set(known);
+    const currentSet = new Set(current);
+    const added = current.filter(f => !knownSet.has(f));
+    const pruned = known.filter(f => !currentSet.has(f));
+    if (added.length === 0 && pruned.length === 0) {
+      console.log(`lint-regression-test-names --update: allowlist already in sync (${current.length} entries)`);
+      return;
+    }
+    fs.writeFileSync(ALLOWLIST_PATH, JSON.stringify(current, null, 2) + '\n');
+    console.log(
+      `lint-regression-test-names --update: ${known.length} -> ${current.length} entries` +
+      (added.length ? ` | grandfathered: ${added.join(', ')}` : '') +
+      (pruned.length ? ` | pruned: ${pruned.join(', ')}` : '')
+    );
+    console.log('Commit the regenerated allowlist with your change.');
+    return;
+  }
+
+  const failures = [];
+  const { novel } = assertWithinAllowlist({
+    label: 'regression-test-names',
+    current,
+    known,
+    fail: msg => failures.push(msg),
+    pruneHint: 'edit scripts/lint-regression-test-names.allowlist.json',
+  });
+
+  if (failures.length > 0) {
+    for (const msg of failures) console.error(msg);
+    if (novel.length > 0) {
+      console.error(
+        '\nIf this PR added the file(s) above: new bug-NNNN test files are not ' +
+        "accepted — add the regression case to the owning module's test file " +
+        "(e.g. a describe('regressions') block in tests/<module>.test.cjs) instead.\n" +
+        'If the file(s) came from the base branch (inherited allowlist drift, ' +
+        'e.g. after a rebase): run ' +
+        '`node scripts/lint-regression-test-names.cjs --update` and commit the ' +
+        'regenerated allowlist. See docs/TESTING-SUITES.md.'
+      );
+    }
+    throw new ExitError(1);
+  }
+
+  console.log(
+    `ok lint-regression-test-names: ${current.length} grandfathered bug-* file(s), no novel offenders`
+  );
+}
+
+runMain(main);

package/scripts/lint-test-file-count.allowlist.json

@@ -1,8 +1,9 @@
 {
-  "_doc": "Baseline of modules currently exceeding the 2-test-file limit. Each entry locks in TODAY's exact test filenames as the allowlisted set (identity ratchet). Adding a NEW test file to a capped module fails (novel). Removing one requires pruning this list (stale, ratchet-down). When a cluster drops to ≤ 2, remove its entry entirely. New entries require justification in PR description.",
+  "_doc": "Baseline of modules currently exceeding the 2-test-file limit. Each entry locks in TODAY's exact test filenames as the allowlisted set (identity ratchet). Adding a NEW test file to a capped module fails (novel). Removing one requires pruning this list (stale, ratchet-down). When a cluster drops to \u2264 2, remove its entry entirely. New entries require justification in PR description.",
   "modules": {
     "audit": {
       "files": [
+        "audit-command-cutover.test.cjs",
         "audit-fix-command.test.cjs",
         "bug-2659-audit-open-crash.test.cjs",
         "bug-2836-audit-open-summary-uat-drift.test.cjs",
@@ -26,7 +27,9 @@
     "graphify": {
       "files": [
         "bug-622-graphify-optional-graph-html.test.cjs",
-        "graphify-auto-update.test.cjs",
+        "bug-974-graphify-budget-missing-value.test.cjs",
+        "graphify-auto-update.slow.test.cjs",
+        "graphify-command-cutover.test.cjs",
         "graphify-query.test.cjs",
         "graphify-visualization.test.cjs",
         "graphify.test.cjs"
@@ -37,6 +40,7 @@
       "files": [
         "bug-2351-intel-kilo-layout.test.cjs",
         "bug-3290-intel-updater-layout-block.test.cjs",
+        "intel-command-cutover.test.cjs",
         "intel.test.cjs"
       ],
       "issue": "TBD"
@@ -44,6 +48,7 @@
     "milestone": {
       "files": [
         "bug-730-milestone-phase-details-scope.test.cjs",
+        "bug-978-milestone-complete-force.test.cjs",
         "milestone-archive.test.cjs",
         "milestone-helper.test.cjs",
         "milestone-prefixed-convention.test.cjs",
@@ -82,8 +87,8 @@
     },
     "security": {
       "files": [
-        "security-prompt-injection.test.cjs",
-        "security-scan.test.cjs",
+        "security-prompt-injection.security.test.cjs",
+        "security-scan.security.test.cjs",
         "security.test.cjs"
       ],
       "issue": "TBD"
@@ -98,6 +103,7 @@
         "bug-3454-state-dollar-backreference-growth.test.cjs",
         "bug-397-state-preserve-executor-authored.test.cjs",
         "bug-905-state-syncstatefrontmatter-preserve-scalars.test.cjs",
+        "bug-948-state-noop-write-guard.test.cjs",
         "state-acquirestatelock-non-eexist.test.cjs",
         "state-prune.test.cjs",
         "state.test.cjs"
@@ -110,6 +116,7 @@
         "bug-2994-verify-reapply-patches-installed-path.test.cjs",
         "bug-3381-verify-work-workstream.test.cjs",
         "bug-3657-verify-reapply-patches-pristine-drift.test.cjs",
+        "bug-967-verify-key-links-strict-paths.test.cjs",
         "verify-health.test.cjs",
         "verify-mvp-uat.test.cjs",
         "verify-npm-publish.test.cjs",
@@ -124,6 +131,7 @@
         "bug-410-install-defaults-test-mode-guard.test.cjs",
         "enh-776-install-gemini-hook-events.test.cjs",
         "install-minimal-hooks.test.cjs",
+        "install-nested-layout.test.cjs",
         "install-path-detection.test.cjs",
         "install-regressions.test.cjs",
         "install-runtime-artifacts.test.cjs",

package/scripts/prompt-injection-scan.sh

@@ -69,15 +69,15 @@ ALLOWLIST=(
   'scripts/prompt-injection-scan.sh'
   'scripts/base64-scan.sh'
   'scripts/secret-scan.sh'
-  'tests/security-scan.test.cjs'
+  'tests/security-scan.security.test.cjs'
   'tests/security.test.cjs'
-  'tests/prompt-injection-scan.test.cjs'
+  'tests/prompt-injection-scan.security.test.cjs'
   'tests/verify.test.cjs'
   'gsd-core/bin/lib/security.cjs'
   'hooks/gsd-prompt-guard.js'
   'hooks/gsd-read-injection-scanner.js'
-  'tests/read-injection-scanner.test.cjs'
-  'tests/security-prompt-injection.test.cjs'
+  'tests/read-injection-scanner.security.test.cjs'
+  'tests/security-prompt-injection.security.test.cjs'
   'tests/fixtures/adversarial/security/'
   'SECURITY.md'
   # These files contain intentional injection examples / security-model prose

package/scripts/run-tests.cjs

@@ -20,7 +20,7 @@
 // See docs/TESTING-SUITES.md for full grouping policy.
 'use strict';
 
-const { readdirSync, existsSync } = require('fs');
+const { readdirSync } = require('fs');
 const { join } = require('path');
 const { execFileSync } = require('child_process');
 const { ExitError, runMain } = require('./lib/cli-exit.cjs');
@@ -31,21 +31,84 @@ const SUITES = ['all', 'unit', 'integration', 'install', 'security', 'slow'];
 // src/*.cts and gitignored, so on a clean checkout (fresh CI, before any build)
 // the artifact is absent — yet test files require it. This is the universal
 // chokepoint every test path funnels through (test:unit, --files-from, direct
-// invocation), so build the artifact here if missing. It is a no-op once built
-// (dev, pretest, a prior run in the same job), which keeps the harness test's
-// spawned invocations side-effect-free. Paths resolve from __dirname (not cwd),
-// so it works regardless of GSD_TEST_DIR / temp-dir cwd. NOTE: the sentinel is
-// the pilot module; revisit (or switch to an unconditional quiet build) as more
-// modules migrate into src/.
-function ensureBuiltArtifacts() {
-  const root = join(__dirname, '..');
-  const sentinel = join(root, 'gsd-core', 'bin', 'lib', 'semver-compare.cjs');
-  if (existsSync(sentinel)) return;
+// invocation), so build the artifact here.
+//
+// Strategy (incremental + re-emit-on-missing, closes both #969 failure modes):
+//   1. Run tsc incrementally (fast ~380ms no-op when sources unchanged).
+//   2. Verify every src/*.cts (non-.d.cts) maps to a non-empty gsd-core/bin/lib/*.cjs.
+//   3. If any expected .cjs is missing or zero-bytes (persistent-mirror scenario:
+//      tsc no-ops because tsbuildinfo looks current even though the file was deleted),
+//      delete the tsbuildinfo and run tsc ONCE MORE (clean re-emit), then re-verify.
+//
+// Common case: fast incremental no-op. Stale/deleted-output case: detected by
+// the cheap existsSync loop and force-rebuilt. Paths resolve from __dirname so
+// it works regardless of GSD_TEST_DIR / temp-dir cwd.
+function ensureBuiltArtifacts(overrides = {}) {
+  const { existsSync, readdirSync, statSync, unlinkSync } = require('fs');
+  const root = overrides.root || join(__dirname, '..');
+  const srcDir = overrides.srcDir || join(root, 'src');
+  const outDir = overrides.outDir || join(root, 'gsd-core', 'bin', 'lib');
+  const tsBuildInfoPath = overrides.tsBuildInfoPath || join(root, 'tsconfig.build.tsbuildinfo');
+  const tsconfigPath = overrides.tsconfigPath || join(root, 'tsconfig.build.json');
   const tscBin = require.resolve('typescript/bin/tsc');
-  execFileSync(process.execPath, [tscBin, '-p', join(root, 'tsconfig.build.json')], {
-    cwd: root,
-    stdio: 'inherit',
-  });
+  const tscArgs = [tscBin, '-p', tsconfigPath];
+
+  // Build the 1:1 map of expected output paths from src/*.cts sources.
+  // Excludes *.d.cts (declaration-only files that produce no output).
+  // Handles subdirectories (e.g. src/installer-migrations/*.cts → gsd-core/bin/lib/installer-migrations/*.cjs).
+  function gatherExpectedOutputs() {
+    const expected = [];
+    function scan(dir, relBase) {
+      for (const entry of readdirSync(dir, { withFileTypes: true })) {
+        if (entry.isDirectory()) {
+          scan(join(dir, entry.name), relBase ? `${relBase}/${entry.name}` : entry.name);
+        } else if (entry.name.endsWith('.cts') && !entry.name.endsWith('.d.cts')) {
+          const stem = entry.name.slice(0, -'.cts'.length);
+          const rel = relBase ? `${relBase}/${stem}.cjs` : `${stem}.cjs`;
+          expected.push(join(outDir, rel));
+        }
+      }
+    }
+    scan(srcDir, '');
+    return expected;
+  }
+
+  function checkMissingOutputs(expectedPaths) {
+    return expectedPaths.filter(p => !existsSync(p) || statSync(p).size === 0);
+  }
+
+  // #996 placed the tsbuildinfo inside gsd-core/bin/ (a copied/shipped tree), which
+  // raced install-test copies. It now lives at the repo root. Best-effort purge any
+  // stale bin-local copy so persistent workspaces/mirrors self-heal (no-op on a temp
+  // override root or a clean checkout).
+  const legacyTsBuildInfo = join(root, 'gsd-core', 'bin', 'tsconfig.build.tsbuildinfo');
+  try { if (existsSync(legacyTsBuildInfo)) unlinkSync(legacyTsBuildInfo); } catch { /* best-effort */ }
+
+  // Step 1: incremental build (fast no-op when sources unchanged).
+  execFileSync(process.execPath, tscArgs, { cwd: root, stdio: 'inherit' });
+
+  // Step 2: verify expected outputs.
+  const expected = gatherExpectedOutputs();
+  const missing = checkMissingOutputs(expected);
+
+  // Step 3: if any output is missing/zero-bytes, force a clean re-emit.
+  // This handles the persistent-mirror case where tsc's incremental no-op left
+  // a deleted .cjs unregenerated (tsbuildinfo recorded it as up-to-date).
+  if (missing.length > 0) {
+    if (existsSync(tsBuildInfoPath)) {
+      unlinkSync(tsBuildInfoPath);
+    }
+    execFileSync(process.execPath, tscArgs, { cwd: root, stdio: 'inherit' });
+    // Re-verify after clean re-emit; surface any remaining gaps loudly.
+    const stillMissing = checkMissingOutputs(expected);
+    if (stillMissing.length > 0) {
+      const names = stillMissing.map(p => require('path').basename(p)).join(', ');
+      throw new Error(
+        `ensureBuiltArtifacts: tsc clean re-emit still missing outputs: ${names}. ` +
+        `Check src/ for compilation errors.`
+      );
+    }
+  }
 }
 const MARKED_SUITES = ['integration', 'install', 'security', 'slow'];
 
@@ -320,4 +383,4 @@ if (require.main === module) {
   runMain(main);
 }
 
-module.exports = { suiteOf };
+module.exports = { suiteOf, ensureBuiltArtifacts };

package/scripts/secret-scan.sh

@@ -218,9 +218,9 @@ should_skip_file() {
   # Skip the scan scripts themselves and test files
   case "$file" in
     */secret-scan.sh) return 0 ;;
-    */secret-scan-lint.test.cjs) return 0 ;;
-    */security-scan.test.cjs) return 0 ;;
-    */security-prompt-injection.test.cjs) return 0 ;;
+    */secret-scan-lint.security.test.cjs) return 0 ;;
+    */security-scan.security.test.cjs) return 0 ;;
+    */security-prompt-injection.security.test.cjs) return 0 ;;
     tests/fixtures/adversarial/security/*|*/tests/fixtures/adversarial/security/*) return 0 ;;
   esac
   return 1