@opengsd/gsd-core 1.5.0-rc.4 → 1.5.0

package/gsd-core/workflows/verify-phase.md

@@ -70,7 +70,17 @@ Aggregate all must_haves across plans for phase-level verification.
 **Prohibitions (`must_haves.prohibitions`, ADR-550 D3 — the must-NOT sibling block):** When a plan carries `must_haves.prohibitions`, extract each `{ statement, status, verification }` item and route it by `verification` tier in verdict assembly (ADR-550 D4, "B-with-guard", 2026-06-12 maintainer decision). These are NEGATIVE checks (the must-NOT must NOT have happened), distinct from positive `truths`:
 
 - **judgment-tier → mode-dependent soft-gate.** Interactive verify defers each item to the end-of-phase human checkpoint (`human_verify_mode: end-of-phase`). Autonomous verify records a NON-AUTHORITATIVE LLM-judge verdict + a prominent `unverified-prohibition — human review recommended` flag (autonomous completion reads "complete with N flagged prohibitions"). NEVER a silent pass; NEVER a hard halt of an AFK run.
-- **test-tier → FAIL CLOSED (accept-and-flag).** Accept the `verification: test` value (the SPEC↔must_haves.prohibitions projection contract holds — no forced schema change later), but a well-formed test-tier item reaching verify with NO wired enforcement disposes as UNVERIFIED, flagged like an unresolved judgment item, NEVER green. The deterministic fail-closed default is `dispositionForProhibition()` in probe-core (`status: 'unverified'`, `flagged: true` on empty `enforcementEvidence`). The real fail-first negative-test enforcement MECHANISM defers to a follow-up PR (#644's corpus is entirely judgment-tier; a contrived test-tier fixture here would be the gold-plating failure mode).
+- **test-tier → ENFORCED via `check prohibition-enforcement` (green on pass, hard-gate on miss/fail).** Accept the `verification: test` value (the SPEC↔must_haves.prohibitions projection contract holds — no forced schema change later). For each test-tier item, the verifier builds `request.check` **DETERMINISTICALLY from the projected descriptor** — it does NOT invent `{ kind, target, rule }`. Read the flat scalar keys `check_kind` / `check_target` / `check_rule` / `check_violation_fixture` off the `must_haves.prohibitions` item and reconstruct the `CheckDescriptor` via the `descriptorFromProjection` adapter in `prohibition-enforcement` (`descriptorFromProjection(projectedItem)` → `{ kind: check_kind, target: check_target, rule?: check_rule, violationFixture?: check_violation_fixture }`). The `violationFixture` (a path to a KNOWN-BAD subject) is the field that gates **green** and it is **now projected** (`check_violation_fixture`, #1346) — so a prohibition authored with all four scalars greens through the projection alone, **zero hand-authoring at verify time**. Do NOT rely on `failFirst`: it is DEMOTED (#1279) and greens nothing on its own; an item with no projected fixture hard-gates fail-closed. Invoke the producer (CLI surface unchanged):
+
+  ```bash
+  gsd_run check prohibition-enforcement <request.json>
+  ```
+
+  where `<request.json>` carries `{ prohibition, check, mode }` — `check` being the wired mechanical-check descriptor `{ kind: 'node-test' | 'lint-rule', target, rule?, violationFixture, failFirst? }`, with `kind`/`target`/`rule`/`violationFixture` now sourced from the projected `check_*` scalars (not author/verifier invention — #1278 + #1346). For `node-test`, `target` (from `check_target`) is the negative-test file path; for `lint-rule`, `target` is the PATH to lint and `rule` (from `check_rule`) is the eslint rule id (e.g. `local/no-source-grep`) — both required (a lint-rule without `rule` is not a valid wired check). `violationFixture` (from `check_violation_fixture`) is the path to a KNOWN-BAD subject the producer runs the check against to **machine-prove fail-first** (for `node-test`, injected via the `GSD_PROHIB_SUBJECT` env convention — #1279); `failFirst` is a DEMOTED, non-authoritative hint kept only for backward route-JSON shape (no path greens on it alone — FF-08). The producer LOCATES the wired check from the projection, **machine-proves it is fail-first** by running it against the violation and confirming it goes RED, RUNS it for a genuine non-vacuous pass, builds `enforcementEvidence`, and emits the `dispositionForProhibition()` verdict (#1259 + #1278 + #1279, ADR-550 D5d). Fail-first is **machine-proven, not caller-attested** — absent a provable violation the producer fails closed, never falling back to attestation. Route the result by its typed fields:
+  - **`status: 'green'`, `flagged: false`** (a genuinely-passing wired negative test / lint rule, `located: true`, non-empty `evidence`) → the item is satisfiable → it can reach **passed**.
+  - **missing, non-attested, or genuinely-non-passing check** (`located: false` OR `status: 'unverified'`, `flagged: true`) → **hard-gate**: disposes flagged-unverified, NEVER green, routing to `gaps_found` in BOTH interactive and autonomous modes (a failing mechanical check blocks even AFK; ADR-550 D4 / D3). The deterministic fail-closed default backing every miss/fail is `dispositionForProhibition()` in probe-core (`status: 'unverified'`, `flagged: true` on empty `enforcementEvidence`).
+
+  > **Descriptor source — deterministic locate + machine-proof compose (#1278 + #1346, DELIVERED).** The `check` descriptor's `{ kind, target, rule, violationFixture }` is now sourced **deterministically from the projected `check_kind` / `check_target` / `check_rule` / `check_violation_fixture` scalars** on the `must_haves.prohibitions` item (authored at `/gsd:spec-phase`, projected by `projectProhibitions`, read back via the `descriptorFromProjection` adapter). So both halves close with **zero manual descriptor authoring** — the verifier neither invents the locate (#1278) nor hand-supplies the violation fixture (#1346): a prohibition authored with all four scalars machine-proves fail-first and greens end-to-end through the projection alone (removing the spoofable invent-at-verify-time surface; ADR-857 §147 exogenous grading). **Fail-closed is preserved:** an item with NO projected descriptor, a PARTIAL one (e.g. a `lint-rule` missing `check_rule`), OR a descriptor with **no `check_violation_fixture`** makes `descriptorFromProjection` return `null` / an under-specified or fixture-less descriptor, which falls through to the producer's fail-closed paths (`located: false`, or located-but-unprovable) → flagged-unverified, NEVER green, in BOTH modes. `failFirst` is demoted and greens nothing on its own (#1279, FF-08). Residual (tracked **#1346**): the node-test proof confirms the fixture exists and the check goes RED, but cannot generically prove the red was *caused by* the subject's content vs the env merely being set.
 
 **Option B: Use Success Criteria from ROADMAP.md**
 
@@ -101,10 +111,12 @@ If no must_haves in frontmatter AND no Success Criteria in ROADMAP:
 <step name="verify_truths">
 For each observable truth, determine if the codebase enables it.
 
-**Status:** ✓ VERIFIED (all supporting artifacts pass) | ✗ FAILED (artifact missing/stub/unwired) | ? UNCERTAIN (needs human)
+**Status:** ✓ VERIFIED (all supporting artifacts pass — and, for a behavior-dependent truth, a behavioral test exercises the asserted behavior) | ⚠️ PRESENT_BEHAVIOR_UNVERIFIED (present + wired, but a state transition or cancellation/cleanup/ordering invariant is exercised by no test — routes to human verification, excluded from the score) | ✗ FAILED (artifact missing/stub/unwired) | ? UNCERTAIN (needs human)
 
 For each truth: identify supporting artifacts → check artifact status → check wiring → determine truth status.
 
+**Behavior-dependent truths:** when a truth asserts a state transition or a cancellation/cleanup/ordering invariant, symbol presence + wiring is necessary but not sufficient — the code can be present and wired yet still leak state on the path the invariant covers. Mark such a truth ✓ VERIFIED only when a pre-existing test exercises the transition/invariant and passes (one named test, never the full suite); otherwise mark it ⚠️ PRESENT_BEHAVIOR_UNVERIFIED, emit a human-verification item, and exclude it from the verified score.
+
 **Example:** Truth "User can see existing messages" depends on Chat.tsx (renders), /api/chat GET (provides), Message model (schema). If Chat.tsx is a stub or API returns hardcoded [] → FAILED. If all exist, are substantive, and connected → VERIFIED.
 </step>
 
@@ -440,13 +452,14 @@ Infrastructure and foundation phases — code foundations, database schema, inte
 - Mark human verification as **N/A** with rationale: "Infrastructure/foundation phase — no user-facing elements to test manually."
 - Set `human_verification: []` and do **not** produce a `human_needed` status solely due to lack of user-facing features.
 - Only add human verification items if the phase goal or success criteria explicitly describe something a user would interact with (UI, CLI command output visible to end users, external service UX).
+- **Exception — behavior-unverified truths still count.** A truth marked ⚠️ PRESENT_BEHAVIOR_UNVERIFIED (a state transition or a cancellation/cleanup/ordering invariant with no test exercising it) is a behavioral-evidence gap, not an artificial user-facing step. Record it in `behavior_unverified_items` and emit a human-verification item for it **even on an infrastructure/foundation phase** — these invariants are exactly where infra phases hide runtime state leaks. Such a truth drives `human_needed`; the auto-pass-UAT shortcut applies only to the absence of user-facing UX, never to a behavior-unverified invariant.
 
 **How to determine if a phase is infrastructure/foundation:**
 - Phase goal or name contains: "foundation", "infrastructure", "schema", "database", "internal API", "data model", "scaffolding", "pipeline", "tooling", "CI", "migrations", "service layer", "backend", "core library"
 - Phase success criteria describe only technical artifacts (files exist, tests pass, schema is valid) with no user interaction required
 - There is no UI, CLI output visible to end users, or real-time behavior to observe
 
-**If the phase IS infrastructure/foundation:** auto-pass UAT — skip the human verification items list entirely. Log:
+**If the phase IS infrastructure/foundation:** auto-pass UAT — skip the human verification items list entirely, **except any ⚠️ PRESENT_BEHAVIOR_UNVERIFIED truth (see exception above), which still emits a human-verification item and drives `human_needed`.** Log:
 
 ```markdown
 ## Human Verification
@@ -471,19 +484,21 @@ Classify status using this decision tree IN ORDER (most restrictive first):
    → **gaps_found**
 
 2. IF any `must_haves.prohibitions` item disposes as flagged-unverified (ADR-550 D4):
-   - **test-tier, fail-closed** (no wired enforcement — `dispositionForProhibition()` returns `status: 'unverified'`, `flagged: true`): → **gaps_found** (never green; the unwired test-tier item is an unverified gap).
+   - **test-tier, fail-closed when the wired check is MISSING OR FAILS** (now run via `check prohibition-enforcement` — `located: false`, or `dispositionForProhibition()` returns `status: 'unverified'`, `flagged: true`): → **gaps_found** in both interactive and autonomous modes (never green; a missing/failing mechanical check is an unverified gap). A test-tier item whose wired check PASSES disposes `status: 'green'`, `flagged: false` and is NOT a gap — it can reach **passed**.
    - **judgment-tier, autonomous run** (non-authoritative LLM-judge verdict): emit the `unverified-prohibition — human review recommended` flag and classify → **human_needed** (autonomous completion reads "complete with N flagged prohibitions"; never a silent pass, never a hard halt).
    - **judgment-tier, interactive run**: route to the end-of-phase human checkpoint → **human_needed**.
 
-3. IF the previous step produced ANY human verification items:
-   → **human_needed** (even if all truths VERIFIED and score is N/N)
+3. IF the previous step produced ANY human verification items — this includes every ⚠️ PRESENT_BEHAVIOR_UNVERIFIED truth:
+   → **human_needed** (even if all other truths VERIFIED)
 
 4. IF all checks pass AND no human verification items AND no flagged prohibitions:
    → **passed**
 
 **passed is ONLY valid when no human verification items AND no flagged prohibitions exist.** A prohibition (must-NOT) can never be silently absorbed into a `passed` verdict — that is the core failure mode ADR-550 D4 forbids.
 
-**Score:** `verified_truths / total_truths`
+A ⚠️ PRESENT_BEHAVIOR_UNVERIFIED truth is never FAILED and never VERIFIED: it does not trigger gaps_found (the code is present and wired) and is not counted as verified (its runtime behavior was not exercised). It routes through the existing human_needed sink — no new overall status.
+
+**Score:** `verified_truths / total_truths` — `verified_truths` counts ✓ VERIFIED truths plus PASSED (override) truths; ⚠️ PRESENT_BEHAVIOR_UNVERIFIED truths are the only ones excluded, reported separately as the `behavior_unverified` count. A headline N/N therefore certifies behavioral evidence for every behavior-dependent truth, not merely symbol presence.
 </step>
 
 <step name="filter_deferred_items">

package/hooks/dist/gsd-worktree-path-guard.js

@@ -71,6 +71,17 @@ process.stdin.on('end', () => {
       process.exit(0); // main repo, submodule, or separate-git-dir — no-op
     }
 
+    // #1342: Only enforce inside a GSD-managed isolated executor worktree. Those
+    // are always on a `worktree-agent-*` branch (the positive allow-list enforced
+    // by worktree-branch-check.md, #2924). A manually-created linked worktree (plain
+    // non-GSD work, e.g. Claude Code plan-mode) is on the user's own branch, so the
+    // guard must be a no-op there. Detached HEAD / error → not GSD-managed → no-op.
+    const branchResult = git(['symbolic-ref', '--short', 'HEAD'], cwd);
+    const branch = branchResult.status === 0 && branchResult.stdout ? branchResult.stdout.trim() : '';
+    if (!/^worktree-agent-[A-Za-z0-9._/-]+$/.test(branch)) {
+      process.exit(0); // not a GSD-managed executor worktree — no-op
+    }
+
     // Get the raw --show-toplevel output for the worktree (cwd).
     // We keep it raw (not path.resolve'd) to compare directly with the
     // file's toplevel — same git binary, same format, no normalization needed.
@@ -110,15 +121,9 @@ process.stdin.on('end', () => {
 
     if (!checkDir) {
       // Walked to root without finding any directory — path is synthetic.
-      // Block conservatively.
-      const output = {
-        decision: 'block',
-        reason:
-          `Worktree path guard: '${filePath}' has no existing ancestor directory — ` +
-          `cannot verify it is inside the worktree '${wtTopRaw}'. Use a relative path instead.`,
-      };
-      process.stdout.write(JSON.stringify(output));
-      process.exit(2);
+      // A path with no existing ancestor is not the #260 main-repo vector;
+      // #260 is caught by the different-git-root branch below. Fail open. (#1342)
+      process.exit(0);
     }
 
     // Ask git for the toplevel of the file's location.
@@ -130,15 +135,26 @@ process.stdin.on('end', () => {
     const fileTopResult = git(['rev-parse', '--show-toplevel'], checkDir);
 
     if (fileTopResult.status !== 0 || !fileTopResult.stdout) {
-      // checkDir is not inside any git repo → cannot be inside the worktree.
-      const output = {
-        decision: 'block',
-        reason:
-          `Worktree path guard: '${filePath}' is not inside any git repository — ` +
-          `it cannot be inside the worktree at '${wtTopRaw}'. Use a relative path instead.`,
-      };
-      process.stdout.write(JSON.stringify(output));
-      process.exit(2);
+      // The target's location is not a git work tree. Two sub-cases:
+      //  - Inside a .git directory (e.g. /main-repo/.git/config or .git/hooks/*)
+      //    → an absolute write into a repository's internals; still a #260-class
+      //    escape (and dangerous) → BLOCK.
+      //  - Truly outside all git repositories (e.g. ~/.claude/plans/) → not the
+      //    main-repo vector → fail open. (#1342)
+      const insideGitDir = git(['rev-parse', '--is-inside-git-dir'], checkDir);
+      if (insideGitDir.status === 0 && insideGitDir.stdout && insideGitDir.stdout.trim() === 'true') {
+        const output = {
+          decision: 'block',
+          reason:
+            `Worktree path guard: '${filePath}' is inside a git internal (.git) directory, ` +
+            `not the active worktree at '${wtTopRaw}'. Writing to repository internals via an ` +
+            `absolute path is not permitted from an isolated executor worktree. Use a relative path.`,
+        };
+        process.stdout.write(JSON.stringify(output));
+        process.exit(2);
+      }
+      // Outside all git repositories — fail open (#1342).
+      process.exit(0);
     }
 
     const fileTopRaw = fileTopResult.stdout.trim();

package/hooks/gsd-worktree-path-guard.js

@@ -71,6 +71,17 @@ process.stdin.on('end', () => {
       process.exit(0); // main repo, submodule, or separate-git-dir — no-op
     }
 
+    // #1342: Only enforce inside a GSD-managed isolated executor worktree. Those
+    // are always on a `worktree-agent-*` branch (the positive allow-list enforced
+    // by worktree-branch-check.md, #2924). A manually-created linked worktree (plain
+    // non-GSD work, e.g. Claude Code plan-mode) is on the user's own branch, so the
+    // guard must be a no-op there. Detached HEAD / error → not GSD-managed → no-op.
+    const branchResult = git(['symbolic-ref', '--short', 'HEAD'], cwd);
+    const branch = branchResult.status === 0 && branchResult.stdout ? branchResult.stdout.trim() : '';
+    if (!/^worktree-agent-[A-Za-z0-9._/-]+$/.test(branch)) {
+      process.exit(0); // not a GSD-managed executor worktree — no-op
+    }
+
     // Get the raw --show-toplevel output for the worktree (cwd).
     // We keep it raw (not path.resolve'd) to compare directly with the
     // file's toplevel — same git binary, same format, no normalization needed.
@@ -110,15 +121,9 @@ process.stdin.on('end', () => {
 
     if (!checkDir) {
       // Walked to root without finding any directory — path is synthetic.
-      // Block conservatively.
-      const output = {
-        decision: 'block',
-        reason:
-          `Worktree path guard: '${filePath}' has no existing ancestor directory — ` +
-          `cannot verify it is inside the worktree '${wtTopRaw}'. Use a relative path instead.`,
-      };
-      process.stdout.write(JSON.stringify(output));
-      process.exit(2);
+      // A path with no existing ancestor is not the #260 main-repo vector;
+      // #260 is caught by the different-git-root branch below. Fail open. (#1342)
+      process.exit(0);
     }
 
     // Ask git for the toplevel of the file's location.
@@ -130,15 +135,26 @@ process.stdin.on('end', () => {
     const fileTopResult = git(['rev-parse', '--show-toplevel'], checkDir);
 
     if (fileTopResult.status !== 0 || !fileTopResult.stdout) {
-      // checkDir is not inside any git repo → cannot be inside the worktree.
-      const output = {
-        decision: 'block',
-        reason:
-          `Worktree path guard: '${filePath}' is not inside any git repository — ` +
-          `it cannot be inside the worktree at '${wtTopRaw}'. Use a relative path instead.`,
-      };
-      process.stdout.write(JSON.stringify(output));
-      process.exit(2);
+      // The target's location is not a git work tree. Two sub-cases:
+      //  - Inside a .git directory (e.g. /main-repo/.git/config or .git/hooks/*)
+      //    → an absolute write into a repository's internals; still a #260-class
+      //    escape (and dangerous) → BLOCK.
+      //  - Truly outside all git repositories (e.g. ~/.claude/plans/) → not the
+      //    main-repo vector → fail open. (#1342)
+      const insideGitDir = git(['rev-parse', '--is-inside-git-dir'], checkDir);
+      if (insideGitDir.status === 0 && insideGitDir.stdout && insideGitDir.stdout.trim() === 'true') {
+        const output = {
+          decision: 'block',
+          reason:
+            `Worktree path guard: '${filePath}' is inside a git internal (.git) directory, ` +
+            `not the active worktree at '${wtTopRaw}'. Writing to repository internals via an ` +
+            `absolute path is not permitted from an isolated executor worktree. Use a relative path.`,
+        };
+        process.stdout.write(JSON.stringify(output));
+        process.exit(2);
+      }
+      // Outside all git repositories — fail open (#1342).
+      process.exit(0);
     }
 
     const fileTopRaw = fileTopResult.stdout.trim();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengsd/gsd-core",
-  "version": "1.5.0-rc.4",
+  "version": "1.5.0",
   "description": "GSD Core is a meta-prompting, context engineering, and spec-driven development system for AI coding agents.",
   "bin": {
     "gsd-core": "bin/install.js",
@@ -50,7 +50,7 @@
   },
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "^0.2.84",
-    "ws": "8.20.1"
+    "ws": "^8.21.0"
   },
   "devDependencies": {
     "@eslint/js": "^9.39.4",
@@ -62,7 +62,7 @@
     "eslint-plugin-no-only-tests": "^3.4.0",
     "fast-check": "^4.8.0",
     "globals": "^16.5.0",
-    "js-yaml": "^4.1.1",
+    "js-yaml": "^4.2.0",
     "typescript": "^6.0.3",
     "typescript-eslint": "^8.60.0"
   },

package/scripts/ci-prepare-test-scope.cjs

@@ -16,13 +16,37 @@ const path = require('path');
 
 const { ExitError, runMain } = require('./lib/cli-exit.cjs');
 
-const scope = process.env.TEST_SCOPE || '';
-const targeted = process.env.TARGETED_TESTS || '';
-const windows = process.env.WINDOWS_TESTS || '';
+// Suite sentinels understood by run-tests.cjs (scripts/run-tests.cjs SUITES).
+// A sentinel resolves to its live file set at run time, so — unlike an explicit
+// filename — it can never reference a since-deleted test file.
+const SUITE_SENTINELS = ['all', 'unit', 'integration', 'install', 'security', 'slow'];
 
-const FALLBACK = 'tests/command-contract.test.cjs tests/commands.test.cjs tests/core.test.cjs tests/package-manifest.test.cjs';
+// Fast smoke set used when scope detection yields no targeted tests. Each entry
+// MUST resolve via run-tests.cjs: an existing repo-relative test file or a
+// SUITE_SENTINELS token. A stale filename here (a test deleted by a refactor)
+// is exactly what broke CI in #1329 — `tests/core.test.cjs`, deleted in #1291,
+// was still listed and crashed every scoped lane that hit this fallback. The
+// parity guard in tests/bug-641-files-from-suite-token.test.cjs fails the
+// moment an entry stops resolving; resolveSelection() filters at write time so
+// a stale entry degrades instead of crashing the lane.
+const FALLBACK = [
+  'tests/command-contract.test.cjs',
+  'tests/commands.test.cjs',
+  'tests/package-manifest.test.cjs',
+];
 
-function main() {
+// Last-resort selector when every FALLBACK entry has been deleted: the whole
+// unit suite, resolved live by run-tests.cjs (the #408/#641 sentinel path).
+const FALLBACK_SENTINEL = 'unit';
+
+// An entry is runnable if it is a suite sentinel or an existing file under root.
+function isResolvable(entry, root) {
+  return SUITE_SENTINELS.includes(entry) || fs.existsSync(path.join(root, entry));
+}
+
+// Resolve the scoped test selection for the lane. Pure (no I/O beyond the
+// existence probe under `root`) so it can be unit-tested directly.
+function resolveSelection({ scope, targeted, windows, root }) {
   let selected;
   if (scope === 'windows') {
     selected = windows;
@@ -32,20 +56,38 @@ function main() {
     throw new ExitError(1, `::error::Unknown test scope: ${scope}`);
   }
 
-  // Trim and fall back to default set if empty.
-  if (!selected.trim()) {
-    selected = FALLBACK;
+  // Detected list passes through verbatim: affected-tests-lib.cjs already filters
+  // deleted files, and the list may legitimately carry a suite sentinel.
+  const detected = (selected || '').split(/\s+/).filter(Boolean);
+  if (detected.length > 0) {
+    return detected;
   }
 
-  // Split on whitespace, filter blanks, join with newlines.
-  const lines = selected.split(/\s+/).filter(Boolean);
-  const content = lines.join('\n') + '\n';
+  // Empty detection → smoke fallback, existence-filtered so a stale entry can
+  // never crash the scoped lane (#1329). If nothing survives, use the unit
+  // sentinel, which run-tests.cjs always resolves.
+  const survivors = FALLBACK.filter((f) => isResolvable(f, root));
+  return survivors.length > 0 ? survivors : [FALLBACK_SENTINEL];
+}
 
-  const outPath = path.join(process.cwd(), '.ci-selected-tests.txt');
-  fs.writeFileSync(outPath, content, 'utf-8');
+function main() {
+  const root = process.cwd();
+  const lines = resolveSelection({
+    scope: process.env.TEST_SCOPE || '',
+    targeted: process.env.TARGETED_TESTS || '',
+    windows: process.env.WINDOWS_TESTS || '',
+    root,
+  });
+
+  const content = lines.join('\n') + '\n';
+  fs.writeFileSync(path.join(root, '.ci-selected-tests.txt'), content, 'utf-8');
 
   process.stdout.write('Scoped tests:\n');
   process.stdout.write(content);
 }
 
-runMain(main);
+if (require.main === module) {
+  runMain(main);
+}
+
+module.exports = { FALLBACK, FALLBACK_SENTINEL, SUITE_SENTINELS, resolveSelection, main };

package/scripts/diff-touches-shipped-paths.cjs

@@ -12,11 +12,10 @@
  *   - package.json (always included by `npm pack`, regardless of `files`)
  *   - every entry in package.json `files`, treated as either an exact
  *     file match or a directory prefix (matching `npm pack` semantics).
- *   - CI-gating test paths: `tests/<anything>` plus
- *     `sdk/src/<anything>/<name>.test.<ts|cjs|mjs|js>` and `.spec.` variants
- *     — these don't ship in the tarball, but they gate the hotfix-branch
- *     test job. A test fixture update that aligns with a cherry-picked
- *     production fix MUST be pickable or CI fails on the hotfix run.
+ *   - CI-gating test paths: `tests/<anything>` — these don't ship in the
+ *     tarball, but they gate the hotfix-branch test job. A test fixture
+ *     update that aligns with a cherry-picked production fix MUST be
+ *     pickable or CI fails on the hotfix run.
  *     #3621 — root cause of the v1.42.3 hotfix red CI.
  *
  * `package-lock.json` is intentionally NOT considered shipped — `npm pack`
@@ -65,12 +64,7 @@ function loadShipPrefixes(pkgPath) {
 // in hotfix.yml, this lets `test(####):` fixture-alignment commits be
 // cherry-picked alongside their production counterparts.
 function isCiGating(diffPath) {
-  if (diffPath.startsWith('tests/')) return true;
-  // SDK vitest specs live next to source. Production source ships via
-  // sdk/dist/ (already in package.json `files`); the test files are what's
-  // missing from that surface.
-  if (diffPath.startsWith('sdk/src/') && /\.(test|spec)\.(ts|cjs|mjs|js)$/.test(diffPath)) return true;
-  return false;
+  return diffPath.startsWith('tests/');
 }
 
 function isShipped(diffPath, shipPrefixes) {

package/scripts/gen-capability-registry.cjs

@@ -542,6 +542,32 @@ function validateFeatureBody(cap) {
     }
   }
 
+  // activationKey: optional string naming the dotted config key that gates this capability.
+  // If present: must be a non-empty string that is declared in this capability's own config slice.
+  if (cap.activationKey !== undefined) {
+    if (typeof cap.activationKey !== 'string' || cap.activationKey.length === 0) {
+      errors.push(
+        'capability "' + (cap.id || '(unknown)') + '" activationKey must be a non-empty string (got: ' +
+        JSON.stringify(cap.activationKey) + ')',
+      );
+    } else if (cap.activationKey === '__proto__' || cap.activationKey === 'constructor' || cap.activationKey === 'prototype') {
+      // Prototype-pollution guard (inline literal, CodeQL barrier)
+      errors.push(
+        'capability "' + (cap.id || '(unknown)') + '" activationKey "' + cap.activationKey +
+        '" is a reserved JavaScript property name and cannot be used as an activationKey',
+      );
+    } else if (
+      typeof cap.config !== 'object' ||
+      cap.config === null ||
+      !Object.prototype.hasOwnProperty.call(cap.config, cap.activationKey)
+    ) {
+      errors.push(
+        'capability "' + (cap.id || '(unknown)') + '" activationKey "' + cap.activationKey +
+        '" is not declared in this capability\'s config slice — add it to the "config" object or use a key that is declared there',
+      );
+    }
+  }
+
   return errors;
 }
 
@@ -586,7 +612,7 @@ const VALID_HOOK_EVENTS = new Set(['claude', 'gemini', 'opencode-subset']);
 const VALID_SANDBOX_TIERS = new Set(['none', 'codex-agent-sandbox']);
 const VALID_ARTIFACT_KIND_NAMES = new Set(['commands', 'agents', 'skills', 'kimi-agents']);
 const VALID_ARTIFACT_NESTINGS = new Set(['flat', 'nested']);
-const FEATURE_FIELDS_FORBIDDEN_ON_RUNTIME = ['skills', 'agents', 'steps', 'contributions', 'gates', 'hooks'];
+const FEATURE_FIELDS_FORBIDDEN_ON_RUNTIME = ['skills', 'agents', 'steps', 'contributions', 'gates', 'hooks', 'activationKey'];
 const VALID_INSTALL_SURFACES = new Set(['settings-json', 'codex-toml', 'copilot-instructions', 'cline-rules', 'cursor-hooks-json', 'profile-marker-only']);
 const VALID_PERMISSION_WRITERS = new Set(['opencode', 'kilo']);
 const VALID_EXTENDED_HOOK_EVENTS = new Set(['SubagentStop', 'Stop', 'PreCompact', 'FileChanged', 'BeforeAgent', 'AfterAgent', 'BeforeModel']);

package/scripts/lint-allow-test-rule-refs.allowlist.json

@@ -152,8 +152,6 @@
   "tests/context-enrichment.test.cjs :: source-text-is-the-product",
   "tests/contributor-standards.test.cjs :: source-text-is-the-product",
   "tests/copilot-install.test.cjs :: integration-test-input",
-  "tests/core.test.cjs :: architectural-invariant",
-  "tests/core.test.cjs :: structural-regression-guard",
   "tests/cursor-hooks.test.cjs :: source-text-is-the-product",
   "tests/cursor-reviewer.test.cjs :: source-text-is-the-product",
   "tests/debug-session-management.test.cjs :: source-text-is-the-product",

package/scripts/research-profiles.cjs

@@ -24,7 +24,7 @@ const PROFILES = [
       'Researches domain ecosystem before roadmap creation. Produces files in .planning/research/ consumed during roadmap creation. Spawned by /gsd:new-project or /gsd:new-milestone orchestrators.',
     color: 'cyan',
     tools:
-      'Read, Write, Bash, Grep, Glob, Skill, WebSearch, WebFetch, mcp__context7__*, mcp__firecrawl__*, mcp__exa__*, mcp__tavily__*, mcp__ref__*, mcp__jina__*',
+      'Read, Write, Bash, Grep, Glob, Skill, WebSearch, WebFetch, mcp__context7__*, mcp__firecrawl__*, mcp__exa__*, mcp__tavily__*, mcp__ref__*, mcp__jina__*, mcp__perplexity__*',
     requiredIncludes: [
       '@~/.claude/gsd-core/references/research-documentation-lookup.md',
       '@~/.claude/gsd-core/references/research-philosophy.md',
@@ -46,7 +46,7 @@ const PROFILES = [
       'Researches how to implement a phase before planning. Produces RESEARCH.md consumed by gsd-planner. Spawned by /gsd:plan-phase orchestrator.',
     color: 'cyan',
     tools:
-      'Read, Write, Edit, Bash, Grep, Glob, Skill, WebSearch, WebFetch, mcp__context7__*, mcp__firecrawl__*, mcp__exa__*, mcp__tavily__*, mcp__ref__*, mcp__jina__*',
+      'Read, Write, Edit, Bash, Grep, Glob, Skill, WebSearch, WebFetch, mcp__context7__*, mcp__firecrawl__*, mcp__exa__*, mcp__tavily__*, mcp__ref__*, mcp__jina__*, mcp__perplexity__*',
     requiredIncludes: [
       '@~/.claude/gsd-core/references/research-documentation-lookup.md',
       '@~/.claude/gsd-core/references/research-philosophy.md',

package/scripts/run-tests.cjs

@@ -461,6 +461,7 @@ function main() {
   // them so the local runner matches CI; tests that need them set them explicitly.
   delete process.env.GSD_PROJECT;
   delete process.env.GSD_WORKSTREAM;
+  delete process.env.CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS;
 
   // Log selected files to stderr for CI / harness-test visibility.
   // node:test default reporter doesn't echo filenames, so this gives