@opengsd/gsd-core 1.5.0 → 1.6.0-rc.1

package/gsd-core/bin/lib/capability-writer.cjs

@@ -24,7 +24,13 @@
  */
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const ioMod = require("./io.cjs");
-const { output: coreOutput, error: coreError } = ioMod;
+const { output: coreOutput } = ioMod;
+// ExitError (NOT process.exit) is how every gsd-tools command signals a non-zero exit: runMain
+// translates it to process.exitCode so buffered stdout flushes first. Calling process.exit() here
+// truncates a just-written --raw JSON payload before the reader sees it (a real silent-output bug).
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const cliExitMod = require("./cli-exit.cjs");
+const { ExitError } = cliExitMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const capabilityStateMod = require("./capability-state.cjs");
 const { resolveCapabilityRuntimeState, _resolveManifest, _resolveCommandsGsdDir } = capabilityStateMod;
@@ -322,7 +328,8 @@ function cmdCapabilitySet(cwd, runtimeConfigDir, capId, options, raw) {
         // Do NOT print human stderr lines — raw consumers parse the JSON.
         coreOutput({ capabilities: result.capabilities, warnings: result.warnings, errors: result.errors }, true);
         if (result.errors.length > 0) {
-            process.exit(1);
+            // Throw (don't process.exit) so the JSON written just above flushes before the process ends.
+            throw new ExitError(1);
         }
         return;
     }
@@ -333,10 +340,12 @@ function cmdCapabilitySet(cwd, runtimeConfigDir, capId, options, raw) {
     for (const e of result.errors) {
         process.stderr.write(`capability set: error: ${e}\n`);
     }
-    // Exit non-zero if any errors (hard failures — requested action was not realized).
+    // Exit non-zero if any errors (hard failures — requested action was not realized). The per-error
+    // lines were already written to stderr above; signal the exit code via ExitError (not process.exit)
+    // so any pending stdout/stderr flushes — runMain maps it to process.exitCode.
     if (result.errors.length > 0) {
-        coreError(`capability set: ${String(result.errors.length)} error(s) — see above`);
-        return; // unreachable — coreError calls process.exit(1)
+        process.stderr.write(`Error: capability set: ${String(result.errors.length)} error(s) — see above\n`);
+        throw new ExitError(1);
     }
     // Human-readable summary: focus on the target capability
     const cap = result.capabilities.find((c) => c.id === capId);

package/gsd-core/bin/lib/check-command-router.cjs

@@ -22,6 +22,7 @@ const { planningDir } = planningWorkspaceMod;
 const phaseLocatorMod = require("./phase-locator.cjs");
 const { findPhaseInternal } = phaseLocatorMod;
 const decisions_cjs_1 = require("./decisions.cjs");
+const markdown_sectionizer_cjs_1 = require("./markdown-sectionizer.cjs");
 const ui_safety_gate_cjs_1 = require("./ui-safety-gate.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const verifyModule = require("./verify.cjs");
@@ -128,10 +129,11 @@ function loadPlanContents(phaseDir) {
 const DESIGNATED_HEADINGS_RE = /^#{1,6}\s+(?:must[_ ]haves?|truths?|tasks?|objective)\b/i;
 const XML_DECISION_TAGS_RE = /<(?:objective|tasks?|action)(?:\s[^>]*)?>([\s\S]*?)<\/(?:objective|tasks?|action)>/gi;
 function stripCommentsAndFences(text) {
-    return text
-        .replace(/<!--[\s\S]*?-->/g, ' ')
-        .replace(/```[\s\S]*?```/g, ' ')
-        .replace(/~~~[\s\S]*?~~~/g, ' ');
+    // HTML-comment stripping stays caller-side (the seam does not strip HTML comments).
+    const htmlStripped = text.replace(/<!--[\s\S]*?-->/g, ' ');
+    // Fenced-code stripping: delegate to the canonical CommonMark-correct seam.
+    // replaces the prior independent regex copy (```` ``` ``` ````  + `~~~ ~~~`).
+    return (0, markdown_sectionizer_cjs_1.stripFencedCode)(htmlStripped).text;
 }
 function extractYamlBlock(frontmatter, key) {
     const match = frontmatter.match(new RegExp(`^${key}\\s*:(.*)$`, 'm'));
@@ -169,18 +171,19 @@ function extractPlanDesignatedSections(planContent) {
         if (block)
             parts.push(block);
     }
+    // Replace hand-rolled split(/\r?\n/) + heading walk with the seam's collectSections.
+    // stopPredicate fires on EVERY heading (collectSections needs to start a section at
+    // each heading), then we filter to designated ones — same semantics as the prior
+    // inDesignated flag: emit the heading line + body only when DESIGNATED_HEADINGS_RE matches.
+    const sections = (0, markdown_sectionizer_cjs_1.collectSections)(body, () => true);
     const bodyParts = [];
-    let inDesignated = false;
-    for (const line of body.split(/\r?\n/)) {
-        const heading = /^#{1,6}\s+/.test(line);
-        if (heading) {
-            inDesignated = DESIGNATED_HEADINGS_RE.test(line);
-            if (inDesignated)
-                bodyParts.push(line);
-            continue;
+    for (const section of sections) {
+        const headingLine = '#'.repeat(section.heading.level) + ' ' + section.heading.text;
+        if (DESIGNATED_HEADINGS_RE.test(headingLine)) {
+            bodyParts.push(headingLine);
+            if (section.body)
+                bodyParts.push(section.body);
         }
-        if (inDesignated)
-            bodyParts.push(line);
     }
     parts.push(bodyParts.join('\n'));
     parts.push(extractXmlTagBodies(cleaned));
@@ -213,8 +216,12 @@ function buildVerifyMessage(notHonored) {
         'This is a soft warning - verification status is unchanged.',
     ].join('\n');
 }
-function loadTrackableDecisions(contextPath) {
-    return (0, decisions_cjs_1.parseDecisions)(readIfExists(contextPath)).filter((decision) => decision.trackable);
+function loadDecisionExtraction(contextPath) {
+    const extraction = (0, decisions_cjs_1.extractDecisions)(readIfExists(contextPath));
+    return {
+        trackable: extraction.decisions.filter((d) => d.trackable),
+        outcome: extraction.outcome,
+    };
 }
 function cmdDecisionCoveragePlan(projectDir, args, raw) {
     const phaseDir = args[2] ? resolvePath(args[2], projectDir) : '';
@@ -227,7 +234,31 @@ function cmdDecisionCoveragePlan(projectDir, args, raw) {
         output({ passed: true, skipped: true, reason: 'CONTEXT.md missing', total: 0, covered: 0, uncovered: [], message: 'No CONTEXT.md - nothing to check.' }, raw, undefined);
         return;
     }
-    const decisions = loadTrackableDecisions(contextPath);
+    const { trackable: decisions, outcome } = loadDecisionExtraction(contextPath);
+    // #1365 fail-loud gate: any could-not-parse outcome must NOT silently pass —
+    // even when some decisions were extracted (e.g. D-01 valid but D-02 malformed).
+    // A parse-miss on ANY bullet means the gate cannot certify full coverage.
+    // Fire independent of decisions.length so a partial-parse still blocks.
+    if (outcome === 'could-not-parse') {
+        const partialParse = decisions.length > 0;
+        output({
+            passed: false,
+            skipped: false,
+            reason: 'could-not-parse',
+            total: decisions.length,
+            covered: 0,
+            uncovered: [],
+            message: partialParse
+                ? 'Decision coverage gate: decisions could not be fully parsed — one or more ' +
+                    '`- **D-NN ...**` bullets appear malformed (missing `:` or ` — ` separator). ' +
+                    'Fix the bullet format so all D-NN decisions can be read before re-running the gate.'
+                : 'Decision coverage gate: could not parse decisions — possible format mismatch. ' +
+                    'The CONTEXT.md appears to be decision-shaped (has a <decisions> block, a decisions heading, ' +
+                    'or D- tokens) but no D-NN bullets could be extracted. Check the formatting of the decisions ' +
+                    'block and ensure bullets follow the `- **D-NN:** text` or `- **D-NN — title** body` form.',
+        }, raw, undefined);
+        return;
+    }
     if (decisions.length === 0) {
         output({ passed: true, skipped: true, reason: 'no trackable decisions', total: 0, covered: 0, uncovered: [], message: 'No trackable decisions in CONTEXT.md.' }, raw, undefined);
         return;
@@ -305,7 +336,27 @@ function cmdDecisionCoverageVerify(projectDir, args, raw) {
         output({ skipped: true, blocking: false, reason: 'CONTEXT.md missing', total: 0, honored: 0, not_honored: [], message: 'No CONTEXT.md - nothing to check.' }, raw, undefined);
         return;
     }
-    const decisions = loadTrackableDecisions(contextPath);
+    const { trackable: decisions, outcome: decisionOutcome } = loadDecisionExtraction(contextPath);
+    // Mirror could-not-parse surface for verify (non-blocking advisory WARN).
+    // Fire independent of decisions.length — a parse-miss on any bullet must surface,
+    // even when some decisions were partially extracted (#1365 fix-parity with plan gate).
+    if (decisionOutcome === 'could-not-parse') {
+        const partialParse = decisions.length > 0;
+        output({
+            skipped: false,
+            blocking: false,
+            reason: 'could-not-parse',
+            total: decisions.length,
+            honored: 0,
+            not_honored: [],
+            message: partialParse
+                ? 'Decision coverage verify (warning): decisions could not be fully parsed — one or more ' +
+                    '`- **D-NN ...**` bullets appear malformed. Fix the bullet format in the CONTEXT.md decisions block.'
+                : 'Decision coverage verify (warning): could not parse decisions — possible format mismatch. ' +
+                    'Check the formatting of the CONTEXT.md decisions block.',
+        }, raw, undefined);
+        return;
+    }
     if (decisions.length === 0) {
         output({ skipped: true, blocking: false, reason: 'no trackable decisions', total: 0, honored: 0, not_honored: [], message: 'No trackable decisions in CONTEXT.md.' }, raw, undefined);
         return;

package/gsd-core/bin/lib/command-aliases.cjs

@@ -444,6 +444,14 @@ exports.PHASE_COMMAND_ALIASES = [
         ],
         "subcommand": "scaffold",
         "mutation": true
+    },
+    {
+        "canonical": "phase.list-plans",
+        "aliases": [
+            "phase list-plans"
+        ],
+        "subcommand": "list-plans",
+        "mutation": false
     }
 ];
 exports.PHASES_COMMAND_ALIASES = [

package/gsd-core/bin/lib/config-loader.cjs

@@ -45,6 +45,10 @@ const federatedConfigModule = require("./federated-config.cjs");
 const { mergeFederatedConfig } = federatedConfigModule;
 // The capability-registry.cjs is generated and lives in the same gsd-core/bin/lib/ output dir.
 // Both config-loader.cjs and capability-registry.cjs land in gsd-core/bin/lib/ at build time.
+// This is the FROZEN first-party registry — used as the test-seam default and the
+// fallback. Overlay (installed third-party) config-key federation is cwd-dependent
+// and composed PER loadConfig CALL by _federatedConfigSchema(cwd) below (ADR-1244 D2),
+// never eagerly at module load.
 // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
 const _capabilityRegistryReal = require('./capability-registry.cjs');
 // Module-level registry reference. Defaults to the real generated registry.
@@ -324,8 +328,32 @@ function _applyFederatedValues(obj, values, validKeys) {
  * When validKeys is non-empty, applies values into a shallow clone to avoid
  * mutating shared CONFIG_DEFAULTS/module constants.
  */
-function _applyFederatedOverlay(baseConfig, userConfig) {
-    const _fedRegistrySchema = _capabilityRegistry.configSchema;
+// Resolve the federated capability config-schema for a project (ADR-1244 D2).
+// A test override (via _setFederatedRegistryForTests) wins; otherwise, when a
+// project cwd is available, compose the installed overlay for THAT project —
+// LAZILY (never at module load, so a bare require never scans the filesystem and
+// the result is never cached for the wrong cwd) — falling back to the frozen
+// first-party schema when there is no cwd or the loader is unavailable.
+function _federatedConfigSchema(cwd) {
+    if (_capabilityRegistry !== _capabilityRegistryReal) {
+        return _capabilityRegistry.configSchema; // explicit test override
+    }
+    if (typeof cwd === 'string' && cwd) {
+        try {
+            // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
+            const loaderMod = require('./capability-loader.cjs');
+            // #1459 IC-04: thread the consent home explicitly so a consented project cap's federated config
+            // key resolves at the SAME user-owned home that gated its activation (never the wrong home).
+            const schema = loaderMod.loadRegistry({ includeInstalled: true, cwd, gsdHome: process.env['GSD_HOME'] }).configSchema;
+            if (schema && typeof schema === 'object')
+                return schema;
+        }
+        catch { /* fall back to first-party */ }
+    }
+    return _capabilityRegistryReal.configSchema;
+}
+function _applyFederatedOverlay(baseConfig, userConfig, cwd) {
+    const _fedRegistrySchema = _federatedConfigSchema(cwd);
     if (!_fedRegistrySchema || typeof _fedRegistrySchema !== 'object')
         return baseConfig;
     const _fedOverlay = mergeFederatedConfig({
@@ -341,26 +369,39 @@ function _applyFederatedOverlay(baseConfig, userConfig) {
     _applyFederatedValues(cloned, _fedOverlay.values, _fedOverlay.validKeys);
     return cloned;
 }
-function loadConfig(cwd, options = {}) {
+/**
+ * loadConfigResolved — provenance-aware config loading (#1415, ADR-1411 P2).
+ *
+ * Identical to loadConfig in every observable way except it returns
+ * { config, source, degraded } instead of just the config object.
+ * loadConfig now delegates to this function (byte-identical back-compat).
+ *
+ * Branch → source/degraded mapping:
+ *   A1: ws set + ws config.json found → source:'workstream', degraded:false
+ *   A2: ws null + config.json found   → source:'root',       degraded:false
+ *   B:  catch + .planning/ + rootParsed set (ws fallback) → source:'root', degraded:true
+ *   C:  catch + .planning/ + rootParsed null (federated defaults) → source:'builtin-defaults', degraded:false
+ *   D:  catch + no .planning/ + ~/.gsd/defaults.json readable → source:'global-defaults', degraded:false
+ *   E:  catch + no .planning/ + no global → source:'builtin-defaults', degraded:false
+ */
+function loadConfigResolved(cwd, options = {}) {
+    // NOTE: loadConfigResolved resolves from cwd AS-IS (no walk-up).
+    // Callers that need ancestor-anchoring (e.g. cmdAgentSkills) must do so
+    // themselves via findProjectRoot() before calling this function.
+    // This preserves back-compat for the ~30 other loadConfig callers (#1415).
     const activeWorkstream = Object.prototype.hasOwnProperty.call(options, 'workstream')
         ? options['workstream']
         : (options['workstreamContext'] && Object.prototype.hasOwnProperty.call(options['workstreamContext'], 'ws'))
             ? options['workstreamContext']['ws']
             : (process.env['GSD_WORKSTREAM'] || null);
-    // When GSD_WORKSTREAM is set, load root config first so workstream config
-    // can inherit from it. This prevents users from duplicating model_overrides,
-    // workflow.*, etc. across every workstream config (#2714).
     const ws = typeof activeWorkstream === 'string' ? activeWorkstream : (activeWorkstream === null ? null : null);
-    // #315 — per-call lazy memo: all three detection sites inside this loadConfig
-    // call operate on the same cwd and the subrepo set cannot change mid-call, so
-    // a single scan is sufficient. The memo is scoped to THIS call (not module-level)
-    // so separate loadConfig invocations each get a fresh scan.
+    // wsRequested: true when caller explicitly requested a non-empty workstream.
+    // Used for source labeling (Fix 4) and early absent-dir intercept (Fix 2).
+    const wsRequested = ws != null && ws !== '';
     let cachedSubRepos;
     const getDetectedSubRepos = () => {
         if (cachedSubRepos === undefined)
             cachedSubRepos = detectSubRepos(cwd);
-        // Return a copy: original detectSubRepos returned a fresh array per call,
-        // so each site must keep an independent array (avoid cross-site aliasing).
         return cachedSubRepos.slice();
     };
     let rootParsed = null;
@@ -371,10 +412,8 @@ function loadConfig(cwd, options = {}) {
             if (raw === null)
                 throw new Error('missing');
             rootParsed = JSON.parse(raw);
-            // Cycle 4: delegate all legacy-key normalization to the Configuration Module.
             const { parsed: rootNormalized, normalizations: rootNorms } = (0, configuration_cjs_1.normalizeLegacyKeys)(rootParsed);
             if (rootNorms.length > 0) {
-                // Resolve filesystem-dependent normalizations (multiRepo → planning.sub_repos)
                 for (const norm of rootNorms) {
                     if (norm.requiresFilesystem && !rootNormalized.planning?.['sub_repos']) {
                         const detected = getDetectedSubRepos();
@@ -406,22 +445,14 @@ function loadConfig(cwd, options = {}) {
         const raw = (0, shell_command_projection_cjs_1.platformReadSync)(configPath);
         if (raw === null)
             throw new Error('missing');
-        // `fileData` is the parsed content of the config.json file on disk — used
-        // for migrations and writes so we never persist merged values back to disk.
         const fileData = JSON.parse(raw);
-        // Cycle 4: Single normalizeLegacyKeys call replaces all four inline migration
-        // blocks (depth→granularity, multiRepo→planning.sub_repos, sub_repos→planning.sub_repos,
-        // branching_strategy→git.branching_strategy). The Module is pure (no I/O); disk
-        // writeback is handled below with the existing platformWriteSync pattern.
         let configDirty = false;
         {
             const { parsed: normalized, normalizations } = (0, configuration_cjs_1.normalizeLegacyKeys)(fileData);
             if (normalizations.length > 0) {
-                // Merge normalized values back into fileData (mutation-in-place for legacy code below)
                 Object.keys(fileData).forEach(k => delete fileData[k]);
                 Object.assign(fileData, normalized);
                 configDirty = true;
-                // Resolve filesystem-dependent normalizations (multiRepo → planning.sub_repos).
                 for (const norm of normalizations) {
                     if (norm.requiresFilesystem && !fileData.planning?.['sub_repos']) {
                         const detected = getDetectedSubRepos();
@@ -435,7 +466,6 @@ function loadConfig(cwd, options = {}) {
                 }
             }
         }
-        // Keep planning.sub_repos in sync with actual filesystem
         const currentSubRepos = fileData.planning?.['sub_repos'] || [];
         if (Array.isArray(currentSubRepos) && currentSubRepos.length > 0) {
             const detected = getDetectedSubRepos();
@@ -449,36 +479,24 @@ function loadConfig(cwd, options = {}) {
                 }
             }
         }
-        // Persist sub_repos changes (migration or sync) — write only the on-disk
-        // file contents, never the merged result, to avoid polluting workstream configs.
         if (configDirty) {
             try {
                 (0, shell_command_projection_cjs_1.platformWriteSync)(configPath, JSON.stringify(fileData, null, 2));
             }
             catch { /* ignore */ }
         }
-        // Now apply root→workstream inheritance. `parsed` is the effective config
-        // used for value extraction below; fileData is kept for disk writes only.
         const parsed = rootParsed
             ? (_deepMergeConfig(rootParsed, fileData) ?? fileData)
             : fileData;
-        // Warn about unrecognized top-level keys so users don't silently lose config.
         const KNOWN_TOP_LEVEL = new Set([
-            // Extract top-level key names from dot-notation paths (e.g., 'workflow.research' → 'workflow')
             ...[...VALID_CONFIG_KEYS].map((k) => k.split('.')[0]),
-            // Dynamic-pattern top-level containers (e.g. review, model_profile_overrides)
             ...DYNAMIC_KEY_PATTERNS.map(p => p.topLevel),
-            // Internal keys loadConfig reads but config-set doesn't expose
             'model_overrides', 'context_window', 'resolve_model_ids', 'claude_md_path', 'effort', 'fast_mode',
-            // Deprecated keys (still accepted for migration, not in config-set)
             'depth', 'multiRepo', 'branching_strategy', 'research',
         ]);
-        // FIX 3: Compute federated overlay BEFORE the unknown-key warning, so that
-        // federated top-level keys are added to KNOWN_TOP_LEVEL before the check runs.
-        // This is hoisted out of the try-catch below so validKeys are available here.
         let _preWarningFedValidKeys = [];
         try {
-            const _fedRegistrySchemaEarly = _capabilityRegistry.configSchema;
+            const _fedRegistrySchemaEarly = _federatedConfigSchema(cwd);
             if (_fedRegistrySchemaEarly && typeof _fedRegistrySchemaEarly === 'object') {
                 const _earlyOverlay = mergeFederatedConfig({
                     configSchema: _fedRegistrySchemaEarly,
@@ -495,7 +513,7 @@ function loadConfig(cwd, options = {}) {
             }
         }
         catch {
-            // Defensive: if registry access fails here, proceed without pre-warning keys
+            // Defensive
         }
         const unknownKeys = Object.keys(parsed).filter(k => !KNOWN_TOP_LEVEL.has(k));
         if (unknownKeys.length > 0) {
@@ -505,7 +523,6 @@ function loadConfig(cwd, options = {}) {
                 process.stderr.write(`gsd-tools: warning: unknown config key(s) in .planning/config.json: ${unknownKeys.join(', ')} — these will be ignored\n`);
             }
         }
-        // #2517 — Validate runtime/tier values
         _warnUnknownProfileOverrides(parsed, '.planning/config.json');
         const get = (key, nested) => {
             if (parsed[key] !== undefined)
@@ -530,11 +547,8 @@ function loadConfig(cwd, options = {}) {
             model_profile: get('model_profile') ?? defaults.model_profile,
             commit_docs: (() => {
                 const explicit = get('commit_docs', { section: 'planning', field: 'commit_docs' });
-                // If explicitly set in config, respect the user's choice
                 if (explicit !== undefined)
                     return explicit;
-                // Auto-detection: when no explicit value and .planning/ is gitignored,
-                // default to false instead of true
                 if (isGitIgnored(cwd, '.planning/'))
                     return false;
                 return defaults.commit_docs;
@@ -565,22 +579,14 @@ function loadConfig(cwd, options = {}) {
             project_code: get('project_code') ?? defaults.project_code,
             subagent_timeout: get('subagent_timeout', { section: 'workflow', field: 'subagent_timeout' }) ?? defaults.subagent_timeout,
             model_overrides: (parsed['model_overrides']) || null,
-            // #3023 — per-phase-type model map.
             models: (parsed['models']) || null,
-            // #68 — top-level granularity
             granularity: parsed['granularity'] !== undefined ? parsed['granularity'] : null,
-            // #68 — per-phase-type granularity map.
             granularities: (parsed['granularities']) || null,
-            // #68 — planning sub-object
             planning: (parsed['planning']) || null,
-            // #3024 — dynamic routing block.
             dynamic_routing: (parsed['dynamic_routing']) || null,
-            // #2517 — runtime-aware profiles.
             runtime: (parsed['runtime']) || null,
             model_profile_overrides: (parsed['model_profile_overrides']) || null,
-            // #49 — provider-neutral model policy presets.
             model_policy: (parsed['model_policy']) || null,
-            // #443 — effort/fast_mode
             effort: (parsed['effort']) || null,
             fast_mode: (parsed['fast_mode']) || null,
             agent_skills: (parsed['agent_skills']) || {},
@@ -590,57 +596,53 @@ function loadConfig(cwd, options = {}) {
             claude_md_path: get('claude_md_path') || null,
             claude_md_assembly: (parsed['claude_md_assembly']) || null,
         };
-        // ─── ADR-857 phase 3b: federated config overlay ───────────────────────────
-        // FIX 2: Use the pre-computed _preWarningFedValidKeys (from the FIX 3 block above)
-        // plus a fresh overlay call to get values. The KNOWN_TOP_LEVEL was already updated.
-        // TODAY: every UI key is still in the central config-schema, so isCentralKey()
-        // returns true for all of them → validKeys is empty → _baseConfig is returned UNCHANGED
-        // (true no-op: no clone, no reorder, byte-identical output).
-        // This becomes a live channel once a key is atomically removed from the central schema.
+        // ADR-857 phase 3b: federated config overlay
         try {
             if (_preWarningFedValidKeys.length > 0) {
-                // There are actual federated values — re-use the already-computed overlay
-                // (we run mergeFederatedConfig again here to get the values map; the validKeys
-                //  are guaranteed identical since it's the same inputs).
-                const _fedRegistrySchema = _capabilityRegistry.configSchema;
+                const _fedRegistrySchema = _federatedConfigSchema(cwd);
                 if (_fedRegistrySchema && typeof _fedRegistrySchema === 'object') {
                     const _fedOverlay = mergeFederatedConfig({
                         configSchema: _fedRegistrySchema,
                         isCentralKey: (key) => _isCentralConfigKeyFn(key),
                         userConfig: parsed,
                     });
-                    // Apply dotted-path values (e.g. "workflow.ui_phase" → _baseConfig.workflow.ui_phase)
-                    // WITHOUT clobbering existing keys. N-level nesting supported.
                     _applyFederatedValues(_baseConfig, _fedOverlay.values, _fedOverlay.validKeys);
                 }
             }
-            // Pending-migration warnings are suppressed at load time to avoid noisy output on
-            // every loadConfig call. They are surfaced at registry-generation time (--check/--write).
         }
         catch {
-            // Defensive: if the federated overlay throws for any reason, return the base config unchanged.
-            // This keeps loadConfig's no-throw contract intact regardless of capability registry state.
+            // Defensive: keep no-throw contract
         }
-        return _baseConfig;
+        // A1 vs A2: disambiguate by whether a real workstream was requested.
+        // Fix 4: empty-string ws ('') resolves the root path → source:'root'.
+        const source = wsRequested ? 'workstream' : 'root';
+        return { config: _baseConfig, source, degraded: false };
     }
     catch {
-        // Fall back to ~/.gsd/defaults.json only for truly pre-project contexts (#1683)
+        // Fix 2: Early intercept — workstream requested but ws config.json absent (or dir absent)
+        // AND root config was loaded. Covers BOTH "dir exists, no config.json" AND "dir absent".
+        // This delivers the #1366 acceptance criterion: nonexistent GSD_WORKSTREAM yields root, degraded.
+        if (wsRequested && rootParsed) {
+            const fb = loadConfigResolved(cwd, { workstream: null });
+            return { config: fb.config, source: 'root', degraded: true };
+        }
+        // Branch B, C, D, E
         if (node_fs_1.default.existsSync(planningDir(cwd, ws))) {
             if (rootParsed) {
-                // Workstream has no config.json: re-parse using root config as the sole source.
-                // (FIX 2: overlay is applied recursively in the re-entrant loadConfig call)
-                return loadConfig(cwd, { workstream: null });
+                // Branch B: workstream requested but ws config.json absent; root config present.
+                // (Only reached when wsRequested is false — e.g. ws='' with .planning/workstreams//config.json)
+                const fb = loadConfigResolved(cwd, { workstream: null });
+                return { config: fb.config, source: 'root', degraded: true };
             }
-            // FIX 2: Apply the federated overlay on the no-config path.
-            // Migrated Capability keys are surfaced from the generated registry even
-            // when the project has no config.json, so schema defaults still apply.
+            // Branch C: .planning/ exists but no config.json and no root config — federated/builtin defaults
             try {
-                return _applyFederatedOverlay(defaults, {});
+                return { config: _applyFederatedOverlay(defaults, {}, cwd), source: 'builtin-defaults', degraded: false };
             }
             catch {
-                return defaults;
+                return { config: defaults, source: 'builtin-defaults', degraded: false };
             }
         }
+        // Branch D or E: no .planning/
         try {
             const home = process.env['GSD_HOME'] || node_os_1.default.homedir();
             const globalDefaultsPath = node_path_1.default.join(home, '.gsd', 'defaults.json');
@@ -675,29 +677,35 @@ function loadConfig(cwd, options = {}) {
                 agent_skills: (globalDefaults['agent_skills']) || {},
                 response_language: (globalDefaults['response_language']) || null,
             };
-            // FIX 2: Apply federated overlay on global-defaults path.
-            // With the current registry this is a true no-op (returns _globalBaseCfg unchanged).
+            // Branch D: global-defaults
             try {
-                return _applyFederatedOverlay(_globalBaseCfg, globalDefaults);
+                return { config: _applyFederatedOverlay(_globalBaseCfg, globalDefaults, cwd), source: 'global-defaults', degraded: false };
             }
             catch {
-                return _globalBaseCfg;
+                return { config: _globalBaseCfg, source: 'global-defaults', degraded: false };
             }
         }
         catch {
-            // FIX 2: Apply federated overlay on the final fallback path.
-            // With the current registry this is a true no-op (returns `defaults` unchanged).
+            // Branch E: no global defaults
             try {
-                return _applyFederatedOverlay(defaults, {});
+                return { config: _applyFederatedOverlay(defaults, {}, cwd), source: 'builtin-defaults', degraded: false };
             }
             catch {
-                return defaults;
+                return { config: defaults, source: 'builtin-defaults', degraded: false };
             }
         }
     }
 }
+/**
+ * loadConfig — backwards-compatible config loading, now a thin wrapper over loadConfigResolved.
+ * Returns the config object only; for provenance metadata use loadConfigResolved.
+ */
+function loadConfig(cwd, options = {}) {
+    return loadConfigResolved(cwd, options).config;
+}
 module.exports = {
     loadConfig,
+    loadConfigResolved,
     isGitIgnored,
     CONFIG_DEFAULTS,
     _getConfigDefault,

package/gsd-core/bin/lib/config-schema.cjs

@@ -16,15 +16,34 @@
  * the prior hand-written .cjs; only types are added.
  */
 const configuration_cjs_1 = require("./configuration.cjs");
+// Frozen first-party capability config-schema — the fallback when no project cwd
+// is available (cwd-agnostic call sites).
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const capabilityRegistry = require('./capability-registry.cjs');
-function isCapabilityConfigKey(keyPath) {
+// Resolve the capability config-schema for a project (ADR-1244 D2). When a cwd is
+// supplied, compose installed overlay capabilities for THAT project — LAZILY (never
+// at module load: a bare require of this module never scans the filesystem) —
+// falling back to the frozen first-party schema. Without a cwd, first-party only.
+function _capabilityConfigSchema(cwd) {
+    if (typeof cwd === 'string' && cwd) {
+        try {
+            // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
+            const loaderMod = require('./capability-loader.cjs');
+            // #1459 IC-04: thread the consent home explicitly so a consented project cap's config key
+            // federates at the SAME user-owned home that gated its activation.
+            const schema = loaderMod.loadRegistry({ includeInstalled: true, cwd, gsdHome: process.env['GSD_HOME'] }).configSchema;
+            if (schema && typeof schema === 'object')
+                return schema;
+        }
+        catch { /* fall back to first-party */ }
+    }
+    const fp = capabilityRegistry.configSchema;
+    return fp && typeof fp === 'object' ? fp : {};
+}
+function isCapabilityConfigKey(keyPath, cwd) {
     if (typeof keyPath !== 'string')
         return false;
-    const schema = capabilityRegistry.configSchema;
-    if (!schema || typeof schema !== 'object')
-        return false;
-    return Object.prototype.hasOwnProperty.call(schema, keyPath);
+    return Object.prototype.hasOwnProperty.call(_capabilityConfigSchema(cwd), keyPath);
 }
 /**
  * Returns true for keys owned by the central schema adapter rather than a
@@ -43,10 +62,10 @@ function isCentralConfigKey(keyPath) {
  * Returns true if keyPath is a valid central, runtime-state, dynamic, or
  * federated Capability config key.
  */
-function isValidConfigKey(keyPath) {
+function isValidConfigKey(keyPath, cwd) {
     if (isCentralConfigKey(keyPath))
         return true;
-    return isCapabilityConfigKey(keyPath);
+    return isCapabilityConfigKey(keyPath, cwd);
 }
 module.exports = {
     VALID_CONFIG_KEYS: configuration_cjs_1.VALID_CONFIG_KEYS,

package/gsd-core/bin/lib/config.cjs

@@ -505,7 +505,7 @@ function cmdConfigSet(cwd, keyPath, value, raw) {
     const kp = keyPath;
     const val = value;
     validateKnownConfigKeyPath(kp);
-    if (!isValidConfigKey(kp)) {
+    if (!isValidConfigKey(kp, cwd)) {
         error(`Unknown config key: "${kp}". Valid keys: ${[...VALID_CONFIG_KEYS].sort().join(', ')}, agent_skills.<agent-type>, features.<feature_name>`, ERROR_REASON.CONFIG_INVALID_KEY);
     }
     // Parse value (handle booleans, numbers, and JSON arrays/objects)