@opengsd/gsd-core 1.5.0 → 1.6.0-rc.2

package/gsd-core/bin/lib/phase-lifecycle.cjs

@@ -42,13 +42,22 @@ function deriveProgressFromRoadmap(roadmapContent) {
         completedPhases = completeMatches ? completeMatches.length : null;
         // Count total phase rows in the progress table.
         // Identify the table by looking for Phase|...|Status|...|Completed header.
-        const progressTableMatch = roadmapContent.match(/\|\s*Phase\s*\|[^|]*\|[^|]*Status[^|]*\|[^|]*Completed[^|]*\|[\s\S]*?(?=\n\n|\n##|$)/i);
+        const progressTableMatch = roadmapContent.match(
+        // allow-adhoc-markdown: table-scoped regex with heading lookahead as stop; table parsing, out of seam scope; pending #1372
+        /\|\s*Phase\s*\|[^|]*\|[^|]*Status[^|]*\|[^|]*Completed[^|]*\|[\s\S]*?(?=\n\n|\n##|$)/i);
         if (progressTableMatch) {
             const tableText = progressTableMatch[0];
-            // Count data rows (rows starting with pipe then a phase number)
-            const dataRowPattern = /^\|\s*\d+/gm;
-            const dataRows = tableText.match(dataRowPattern);
-            totalPhases = dataRows ? dataRows.length : null;
+            // Count data rows (rows starting with pipe then a phase number),
+            // excluding 999.x backlog phases. Mirrors init.cts /^999(?:\.|$)/ filter.
+            const dataRowPattern = /^\|\s*(\d+[^|]*)\|/gm;
+            let dataRowCount = 0;
+            let drm;
+            while ((drm = dataRowPattern.exec(tableText)) !== null) {
+                if (/^999\b/.test(drm[1].trim()))
+                    continue;
+                dataRowCount++;
+            }
+            totalPhases = dataRowCount > 0 ? dataRowCount : null;
         }
         // Sum plan counts from M/N columns in progress table
         let totalPlansSum = 0;

package/gsd-core/bin/lib/phase.cjs

@@ -32,7 +32,7 @@ const coreUtilsMod = require("./core-utils.cjs");
 const { toPosixPath, generateSlugInternal, readSubdirectories } = coreUtilsMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports -- phase-id.cjs is an export= CommonJS module
 const phaseIdMod = require("./phase-id.cjs");
-const { escapeRegex, normalizePhaseName, phaseMarkdownRegexSource, comparePhaseNum, phaseTokenMatches } = phaseIdMod;
+const { escapeRegex, normalizePhaseName, phaseMarkdownRegexSource, comparePhaseNum, phaseTokenMatches, OPTIONAL_PROJECT_CODE_PREFIX_SOURCE, } = phaseIdMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports -- phase-locator.cjs is an export= CommonJS module
 const phaseLocatorMod = require("./phase-locator.cjs");
 const { findPhaseInternal, getArchivedPhaseDirs } = phaseLocatorMod;
@@ -167,7 +167,7 @@ function cmdPhaseNextDecimal(cwd, basePhase, raw) {
             const entries = node_fs_1.default.readdirSync(phasesDir, { withFileTypes: true });
             const dirs = entries.filter((e) => e.isDirectory()).map((e) => e.name);
             baseExists = dirs.some((d) => phaseTokenMatches(d, normalized));
-            const dirPattern = new RegExp(`^(?:[A-Z]{1,6}-)?${escapeRegex(normalized)}\\.(\\d+)`);
+            const dirPattern = new RegExp(`^${OPTIONAL_PROJECT_CODE_PREFIX_SOURCE}${escapeRegex(normalized)}\\.(\\d+)`);
             for (const dir of dirs) {
                 const match = dir.match(dirPattern);
                 if (match)
@@ -310,7 +310,7 @@ function cmdFindPhase(cwd, phase, raw) {
             const match = dirs.find((d) => phaseTokenMatches(d, normalized));
             if (!match)
                 continue;
-            const dirMatch = match.match(/^(?:[A-Z]{1,6}-)(\d+[A-Z]?(?:\.\d+)*)-?(.*)/i) ||
+            const dirMatch = match.match(new RegExp(`^${OPTIONAL_PROJECT_CODE_PREFIX_SOURCE}(\\d+[A-Z]?(?:\\.\\d+)*)-?(.*)`, 'i')) ||
                 match.match(/^(\d+[A-Z]?(?:\.\d+)*)-?(.*)/i);
             const phaseNumber = dirMatch ? dirMatch[1] : normalized;
             const phaseName = dirMatch && dirMatch[2] ? dirMatch[2] : null;
@@ -756,7 +756,7 @@ function cmdPhaseInsert(cwd, afterPhase, description, raw) {
         try {
             const entries = node_fs_1.default.readdirSync(phasesDir, { withFileTypes: true });
             const dirs = entries.filter((e) => e.isDirectory()).map((e) => e.name);
-            const decimalPattern = new RegExp(`^(?:[A-Z]{1,6}-)?${escapeRegex(normalizedBase)}\\.(\\d+)`);
+            const decimalPattern = new RegExp(`^${OPTIONAL_PROJECT_CODE_PREFIX_SOURCE}${escapeRegex(normalizedBase)}\\.(\\d+)`);
             for (const dir of dirs) {
                 const dm = dir.match(decimalPattern);
                 if (dm)
@@ -1430,6 +1430,34 @@ function cmdPhaseUatPassed(cwd, phaseNum, raw, opts = {}) {
     const report = evaluateUatPassed(phaseFullDir, { policy: opts.policy });
     output({ phase: phaseNum, ...report }, raw);
 }
+// #1437 — phase.list-plans: list plan files for a given phase number.
+// Returns the full scan result from scanPhasePlans so callers can read plan
+// paths without re-discovering the phase directory themselves.
+// eslint-disable-next-line @typescript-eslint/no-require-imports -- plan-scan.cjs is an export= CommonJS module
+const planScanMod = require("./plan-scan.cjs");
+const { scanPhasePlans } = planScanMod;
+function cmdPhaseListPlans(cwd, phaseNum, raw) {
+    if (!phaseNum) {
+        error('phase number required for phase list-plans');
+    }
+    const phaseInfo = findPhaseInternal(cwd, phaseNum);
+    if (!phaseInfo) {
+        output({ phase: phaseNum, plan_count: 0, has_plans: false, plans: [], phase_dir: null }, raw);
+        return;
+    }
+    const phaseDir = node_path_1.default.join(cwd, phaseInfo['directory']);
+    const scan = scanPhasePlans(phaseDir);
+    const phaseRel = phaseInfo['directory'];
+    // Build absolute-usable relative paths for each plan file.
+    const plans = scan.planFiles.map((f) => toPosixPath(node_path_1.default.join(phaseRel, f)));
+    output({
+        phase: phaseNum,
+        phase_dir: phaseRel,
+        plan_count: scan.planCount,
+        has_plans: scan.planCount > 0,
+        plans,
+    }, raw);
+}
 module.exports = {
     cmdPhasesList,
     cmdPhaseNextDecimal,
@@ -1442,5 +1470,6 @@ module.exports = {
     cmdPhaseRemove,
     cmdPhaseComplete,
     cmdPhaseUatPassed,
+    cmdPhaseListPlans,
     computeDependencyLevels,
 };

package/gsd-core/bin/lib/probe-core.cjs

@@ -288,6 +288,13 @@ function projectProhibitions(items) {
             if (typeof p.check_violation_fixture === 'string' && p.check_violation_fixture.trim() !== '') {
                 entry.check_violation_fixture = String(p.check_violation_fixture);
             }
+            // `check_clean_fixture` (#1346) rides BOTH kinds — the KNOWN-CLEAN control subject the prover
+            // requires to stay GREEN (content-dependence proof). Emit ONLY a non-empty fixture (blank ->
+            // absent so no control runs; the documented residual remains). Like the violation fixture it is
+            // meaningless without the descriptor, so it lives inside this well-formed-descriptor branch.
+            if (typeof p.check_clean_fixture === 'string' && p.check_clean_fixture.trim() !== '') {
+                entry.check_clean_fixture = String(p.check_clean_fixture);
+            }
         }
         out.push(entry);
     }

package/gsd-core/bin/lib/prohibition-enforcement.cjs

@@ -79,8 +79,9 @@ const probe_core_cjs_1 = require("./probe-core.cjs");
  *   - `null`/`undefined`/non-object input -> `null`.
  *   - `check_kind` ABSENT -> `null` (no descriptor -> producer locates nothing -> fail-closed).
  *   - `check_kind` present -> `{ kind: check_kind, target: check_target }`, adding `rule: check_rule`
- *     ONLY when `check_rule` is a non-empty string, and `violationFixture: check_violation_fixture`
- *     ONLY when that scalar is a non-empty string (#1346 — composes #1278 locate with #1279 proof).
+ *     ONLY when `check_rule` is a non-empty string, `violationFixture: check_violation_fixture`
+ *     ONLY when that scalar is a non-empty string (composes #1278 locate with #1279 proof), and
+ *     `cleanFixture: check_clean_fixture` ONLY when that scalar is non-empty (#1346 causation control).
  *   - `failFirst` is NEVER sourced from the projection — it stays a verify-time caller attestation
  *     (#1279 machine-proves it; out of scope here). The returned descriptor carries no `failFirst`.
  *   - The adapter does NOT strictly validate kind/target/rule: it faithfully reconstructs whatever
@@ -118,6 +119,13 @@ function descriptorFromProjection(projected) {
     const fixture = scalar(projected.check_violation_fixture);
     if (fixture.trim().length > 0)
         descriptor.violationFixture = fixture;
+    // `cleanFixture` (#1346) rides BOTH kinds — reconstruct it from `check_clean_fixture` so the
+    // causation control runs end-to-end: when present the prover also requires the check to stay GREEN
+    // against this known-clean subject (proving the violation RED is content-dependent). Absent/blank ->
+    // no control (the documented residual remains; backward-compatible with the #1314 compose path).
+    const clean = scalar(projected.check_clean_fixture);
+    if (clean.trim().length > 0)
+        descriptor.cleanFixture = clean;
     return descriptor;
 }
 /** node --test argv. Forces the TAP reporter so the summary counts are parseable + version-stable;
@@ -360,6 +368,31 @@ const CHECK_MAX_BUFFER = 16 * 1024 * 1024;
 function posTimeout(timeoutMs, def) {
     return typeof timeoutMs === 'number' && timeoutMs > 0 ? timeoutMs : def;
 }
+/**
+ * Spawn the negative `node --test` against a single subject (set via the `GSD_PROHIB_SUBJECT`
+ * convention, #1279) and return its TAP output. Reuses the bounded-subprocess machinery
+ * (`process.execPath`, arg arrays → no shell, `childEnv`, bounded `timeout`/`maxBuffer`) and NEVER
+ * throws — a RED run exits non-zero, so the partial TAP (with the `# fail` summary) is recovered from
+ * the thrown error's `stdout`. The prover calls this once per subject: the KNOWN-BAD violation fixture
+ * (expect RED) and, for the #1346 causation control, the KNOWN-CLEAN control subject (expect GREEN).
+ */
+function runNodeTestWithSubject(check, cwd, subject, timeoutMs) {
+    try {
+        return (0, node_child_process_1.execFileSync)(process.execPath, buildNodeTestArgs(check), {
+            cwd,
+            encoding: 'utf-8',
+            stdio: ['ignore', 'pipe', 'pipe'],
+            windowsHide: true,
+            env: { ...childEnv(), GSD_PROHIB_SUBJECT: subject },
+            timeout: posTimeout(timeoutMs, NODE_TEST_TIMEOUT_MS),
+            maxBuffer: CHECK_MAX_BUFFER,
+        });
+    }
+    catch (e) {
+        const stdout = e && typeof e === 'object' && 'stdout' in e ? e.stdout : '';
+        return typeof stdout === 'string' ? stdout : '';
+    }
+}
 function defaultRunCheck(check, cwd, timeoutMs) {
     try {
         if (check.kind === 'node-test') {
@@ -482,36 +515,36 @@ function defaultProveFailFirst(check, cwd, timeoutMs) {
             // a setup crash, not from the prohibition firing. Requiring the fixture to exist before spawning
             // closes the realistic typo/stale-path case (#1279 review, Major 1).
             //
-            // KNOWN RESIDUAL (documented, fail-open direction, tracked follow-up #1346): existence is
-            // necessary but not sufficient — a deliberately deceptive negative test that reds merely BECAUSE
-            // `GSD_PROHIB_SUBJECT` is set (rather than because the subject's CONTENT violates the must-NOT)
-            // is still accepted. Proving "the red was CAUSED BY the violation" cannot be done generically for
-            // an arbitrary author-supplied test, so it is recorded as a constraint, not silently implied-solved.
+            // CAUSATION (#1346): existence + a non-vacuous red is necessary but not sufficient — a deceptive
+            // negative test that reds merely BECAUSE `GSD_PROHIB_SUBJECT` is set (rather than because the
+            // subject's CONTENT violates the must-NOT) would otherwise be accepted. The OPTIONAL `cleanFixture`
+            // control below proves content-dependence when supplied (red on bad AND green on clean). When NO
+            // clean fixture is authored the control cannot run, so the residual remains a documented constraint
+            // for that case (an author opts into the stronger proof by supplying a known-clean control subject).
             // Resolve the fixture against `cwd` (NOT the verify process's cwd): the spawned test reads
             // `GSD_PROHIB_SUBJECT` and resolves a relative subject against `cwd`, so the existence check must
             // use the SAME base or it could pass here yet ENOENT in the child (re-opening the fail-open hole).
             if (!fixture || !node_fs_1.default.existsSync(node_path_1.default.resolve(cwd, fixture)))
                 return { provenFailFirst: false };
-            let out = '';
-            try {
-                out = (0, node_child_process_1.execFileSync)(process.execPath, buildNodeTestArgs(check), {
-                    cwd,
-                    encoding: 'utf-8',
-                    stdio: ['ignore', 'pipe', 'pipe'],
-                    windowsHide: true,
-                    // CONVENTION (#1279): the negative test reads its subject-under-test from this env var.
-                    env: { ...childEnv(), GSD_PROHIB_SUBJECT: fixture },
-                    timeout: posTimeout(timeoutMs, NODE_TEST_TIMEOUT_MS),
-                    maxBuffer: CHECK_MAX_BUFFER,
-                });
-            }
-            catch (e) {
-                // A negative test that goes RED exits non-zero; the partial TAP (with the `# fail` summary)
-                // is on stdout. Parse what we have: a real failure here is the PROOF the test is fail-first.
-                const stdout = e && typeof e === 'object' && 'stdout' in e ? e.stdout : '';
-                out = typeof stdout === 'string' ? stdout : '';
+            // Run the negative test against the KNOWN-BAD subject and require a NON-VACUOUS red.
+            const redOut = runNodeTestWithSubject(check, cwd, fixture, timeoutMs);
+            if (!isNonVacuousNodeTestRed(redOut, check.target))
+                return { provenFailFirst: false, method: 'violation-fixture' };
+            // #1346 CAUSATION CONTROL (optional): if a clean control subject is supplied, run the SAME test
+            // against it and require it to stay GREEN. This proves the red above was caused by the subject's
+            // CONTENT — a deceptive test that reds merely because GSD_PROHIB_SUBJECT is SET reds here too →
+            // not content-dependent → not proven. Absent → no control (documented residual; backward-compat).
+            const clean = check.cleanFixture;
+            if (clean) {
+                // A supplied-but-missing/typo'd control path can't run the control → fail-closed, symmetric
+                // with the violation-fixture existence guard (resolve against the SAME `cwd` as the child).
+                if (!node_fs_1.default.existsSync(node_path_1.default.resolve(cwd, clean)))
+                    return { provenFailFirst: false, method: 'violation-fixture' };
+                const cleanOut = runNodeTestWithSubject(check, cwd, clean, timeoutMs);
+                if (!isNonVacuousNodeTestPass(cleanOut, check.target))
+                    return { provenFailFirst: false, method: 'violation-fixture' };
             }
-            return { provenFailFirst: isNonVacuousNodeTestRed(out, check.target), method: 'violation-fixture' };
+            return { provenFailFirst: true, method: 'violation-fixture' };
         }
         // Unknown kind — defensive; the LOCATE guard already rejects it.
         return { provenFailFirst: false };

package/gsd-core/bin/lib/project-root.cjs

@@ -1,11 +1,12 @@
 "use strict";
 /**
  * Project-Root Resolution Module — resolves a project root from a starting
- * directory by walking the ancestor chain and applying four heuristics:
+ * directory by walking the ancestor chain and applying five heuristics:
  *   (0) own .planning/ guard (#1362)
  *   (1) parent .planning/config.json sub_repos
  *   (2) legacy multiRepo: true + ancestor .git
  *   (3) .git heuristic with parent .planning/
+ *   (4) nearest ancestor .planning/ (#1414, Resolution Provenance P1)
  * Bounded by FIND_PROJECT_ROOT_MAX_DEPTH ancestors. Sync I/O.
  *
  * ADR-457 build-at-publish: the hand-written bin/lib/project-root.cjs
@@ -17,6 +18,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.findProjectRoot = findProjectRoot;
+exports.consentProjectRoot = consentProjectRoot;
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const node_os_1 = __importDefault(require("node:os"));
@@ -107,13 +109,98 @@ function findProjectRoot(startDir) {
             }
             if (matched)
                 return parent;
-            // Heuristic: parent has .planning/ and we're inside a git repo.
+            // Heuristic (3): parent has .planning/ and we're inside a git repo.
+            // Before returning, check if any further ancestor has sub_repos that explicitly
+            // claims our startDir — explicit sub_repos config takes precedence over the
+            // implicit .git signal. (#1422)
             if (isInsideGitRepo(parent)) {
+                // Lookahead: walk ancestors above `parent` to find a sub_repos claim.
+                let ancestor = node_path_1.default.dirname(parent);
+                let ancestorDepth = 0;
+                while (ancestor !== fsRoot && ancestor !== home && ancestorDepth < FIND_PROJECT_ROOT_MAX_DEPTH) {
+                    const ancestorPlanning = ancestor + node_path_1.default.sep + '.planning';
+                    try {
+                        if (node_fs_1.default.existsSync(ancestorPlanning) && node_fs_1.default.statSync(ancestorPlanning).isDirectory()) {
+                            const ancestorConfig = ancestor + node_path_1.default.sep + '.planning' + node_path_1.default.sep + 'config.json';
+                            const rawA = node_fs_1.default.readFileSync(ancestorConfig, 'utf-8');
+                            const cfgA = JSON.parse(rawA);
+                            const subReposValueA = cfgA['sub_repos'] ??
+                                (cfgA['planning'] && typeof cfgA['planning'] === 'object'
+                                    ? cfgA['planning']['sub_repos']
+                                    : undefined);
+                            const subReposA = Array.isArray(subReposValueA) ? subReposValueA : [];
+                            if (subReposA.length > 0) {
+                                const relPathA = node_path_1.default.relative(ancestor, resolvedStart);
+                                const topSegmentA = relPathA.split(node_path_1.default.sep)[0];
+                                if (subReposA.includes(topSegmentA)) {
+                                    return ancestor;
+                                }
+                            }
+                        }
+                    }
+                    catch {
+                        // ignore — config missing or unparseable, keep walking
+                    }
+                    const nextAncestor = node_path_1.default.dirname(ancestor);
+                    if (nextAncestor === ancestor)
+                        break;
+                    ancestor = nextAncestor;
+                    ancestorDepth += 1;
+                }
                 return parent;
             }
         }
         dir = parent;
         depth += 1;
     }
+    // Heuristic (4): nearest ancestor .planning/ — last resort before fallback.
+    // Runs only after heuristics (1)–(3) have been exhausted without a match,
+    // ensuring sub_repos / multiRepo / .git-based resolution always wins when
+    // applicable. Walks upward again within the same FIND_PROJECT_ROOT_MAX_DEPTH
+    // bound; returns the nearest ancestor directory that contains a .planning/
+    // subdirectory so config resolves correctly when invoked from a plain
+    // descendant of a single-repo project. (#1414)
+    let dir2 = resolvedStart;
+    let depth2 = 0;
+    while (dir2 !== fsRoot && depth2 < FIND_PROJECT_ROOT_MAX_DEPTH) {
+        const parent2 = node_path_1.default.dirname(dir2);
+        if (parent2 === dir2)
+            break;
+        try {
+            const candidatePlanning = parent2 + node_path_1.default.sep + '.planning';
+            if (node_fs_1.default.existsSync(candidatePlanning) && node_fs_1.default.statSync(candidatePlanning).isDirectory()) {
+                return parent2;
+            }
+        }
+        catch {
+            // ignore fs errors and continue walking
+        }
+        if (parent2 === home)
+            break;
+        dir2 = parent2;
+        depth2 += 1;
+    }
     return startDir;
 }
+/**
+ * #1459 (IC-01 / CB-4): THE single canonical derivation of the PROJECT ROOT used to bind/lookup a
+ * project-scope consent record. Install (the CLI/lifecycle RECORD site), the loader (the LOOKUP
+ * site), and `trust revoke` (CB-4) MUST all derive the consent root through this one helper so the
+ * recorded key always matches the looked-up key — otherwise installing from a SUBDIR records consent
+ * at `realpath(subdir)` while the loader looks it up at `realpath(findProjectRoot)` and the freshly
+ * installed cap is immediately INACTIVE (install-then-inactive).
+ *
+ * The rule: `realpath(findProjectRoot(cwd))` (findProjectRoot is total — it returns `cwd` itself when
+ * no project root is found, so there is no null branch), falling back to `path.resolve(cwd)` when the
+ * resolved root cannot be realpath'd (e.g. it does not exist yet). The consent store realpaths
+ * whatever it is given, so passing the SAME logical root from every site is what guarantees the match.
+ */
+function consentProjectRoot(cwd) {
+    const root = findProjectRoot(cwd);
+    try {
+        return node_fs_1.default.realpathSync(root);
+    }
+    catch {
+        return node_path_1.default.resolve(root);
+    }
+}

package/gsd-core/bin/lib/resolution.cjs

@@ -0,0 +1,26 @@
+"use strict";
+/**
+ * Resolution Convention — canonical shape for config-interpreting read verbs.
+ *
+ * Extracted as the anchor for ADR-1411 P3 (Resolution Provenance, #1416).
+ * Exports the `Resolution<T>` envelope used when a verb reads and interprets
+ * configuration (e.g. agent-skills). Not used by mutation verbs (see
+ * capability-writer's `SetCapabilityStateResult` for the mutation shape) or
+ * plain read verbs (see capability-state's `ResolveCapabilityRuntimeStateResult`).
+ *
+ * This is a pure types+builder leaf — no other src/ imports.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.makeResolution = makeResolution;
+// ─── Builder ──────────────────────────────────────────────────────────────────
+/**
+ * Construct a `Resolution<T>` envelope from a value and its provenance fields.
+ */
+function makeResolution(value, opts) {
+    return {
+        value,
+        configured: opts.configured,
+        reason: opts.reason,
+        warnings: opts.warnings,
+    };
+}

package/gsd-core/bin/lib/roadmap-command-router.cjs

@@ -150,10 +150,23 @@ function routeRoadmapCommand({ roadmap, args, cwd, raw, error }) {
             },
             'upgrade': () => {
                 const dryRun = !args.includes('--apply');
-                const convention = args.find((_a, i) => args[i - 1] === '--convention') || 'milestone-prefixed';
+                // Parse `--convention <value>` and `--convention=<value>`. When the flag is
+                // absent entirely, default to the only supported convention; when present
+                // with a missing/unsupported value, fall through to the rejection below
+                // (fail-closed — never silently run a migration the user did not request).
+                let convention = 'milestone-prefixed';
+                const conventionFlagIdx = args.findIndex((a) => a === '--convention' || a.startsWith('--convention='));
+                if (conventionFlagIdx !== -1) {
+                    const token = args[conventionFlagIdx];
+                    convention = token.includes('=')
+                        ? token.slice(token.indexOf('=') + 1)
+                        : (args[conventionFlagIdx + 1] ?? '');
+                }
                 if (convention !== 'milestone-prefixed') {
-                    process.stderr.write('Only --convention milestone-prefixed is supported\n');
-                    process.exit(1);
+                    // No-throw hub contract (ADR-0012): a hub-dispatched handler must not call
+                    // process.exit. Throw instead — the hub converts this to HandlerFailure and
+                    // the adapter routes it through the injected error() boundary.
+                    throw new Error('Only --convention milestone-prefixed is supported');
                 }
                 const plan = roadmapUpgrade.computeMigrationPlan(cwd);
                 roadmapUpgrade.applyMigration(cwd, plan, { dryRun });