@opengsd/gsd-core 1.7.0-rc.2 → 1.7.0-rc.3

package/gsd-core/bin/lib/gate-predicate-evaluator.cjs

@@ -0,0 +1,151 @@
+"use strict";
+/**
+ * Gate Predicate Evaluator — issue #2008 / ADR-2008
+ *
+ * Pure, deps-injected evaluator for capability gate `check.predicate` blocks.
+ *
+ * Background: the loop-resolver renders active gate hooks (carrying their
+ * `check.predicate` declarations) but, prior to #2008, nothing EVALUATED a
+ * declared predicate for non-built-in capabilities — `check.query` was the only
+ * enforced shape (dispatched via `gsd_run check <query>`), and `check.predicate`
+ * was declaration-only. This module is the generic evaluation path.
+ *
+ * The workflow gate-dispatch calls this evaluator (via the `gsd_run check predicate`
+ * subcommand in check-command-router) for any gate whose `check` carries a
+ * `predicate` instead of a `query`. The evaluator dispatches by `predicate.kind`
+ * and returns the existing `{ block, message }` gate contract. A THROWN error
+ * (malformed predicate / unknown kind) is mapped by the CLI wrapper to a
+ * non-zero check-command exit, which the workflow's two-step gate contract treats
+ * as a step-1 command failure (routed per the gate's `onError`).
+ *
+ * Built-in kind (v1): `command-exit-zero` — run a declared command in a bounded
+ * `sh -c` subprocess at the project root, inheriting the process env; exit 0 =>
+ * pass, non-zero => block, timeout => block. The production runBoundedShell
+ * binding is shell-command-projection.execTool (bounded spawnSync). See ADR-2008
+ * for the full sandbox contract.
+ *
+ * This is a leaf pure module: no fs, no child_process, no config — the subprocess
+ * seam is injected so the evaluator is trivially testable without spawning.
+ */
+// ─── Public constants ─────────────────────────────────────────────────────────
+/** Default command timeout for `command-exit-zero` (30s). Matches execTool default. */
+const COMMAND_EXIT_ZERO_DEFAULT_TIMEOUT_MS = 30_000;
+/** Hard cap on the stderr/stdout tail embedded in the gate `message`. */
+const COMMAND_MAX_OUTPUT_CHARS = 2000;
+/** Hard cap on the declared command length (defense-in-depth against ARGV overflow / abuse). */
+const COMMAND_MAX_LENGTH = 4096;
+/** Predicate kinds this evaluator recognises (extensible — add to KIND_TABLE). */
+const EVALUATOR_KINDS = Object.freeze(['command-exit-zero']);
+/** Placeholders interpolated into a declared command, in addition to sh's own vars. */
+const INTERPOLATION_VAR_NAMES = Object.freeze(['PHASE_NUMBER', 'PHASE_DIR', 'PHASE_REQ_IDS']);
+// ─── Helpers ──────────────────────────────────────────────────────────────────
+const INTERPOLATION_RE = /\$\{(PHASE_NUMBER|PHASE_DIR|PHASE_REQ_IDS)\}/g;
+/** Replace the three known ${PHASE_*} placeholders with context values (undefined => ''). */
+function interpolate(command, ctx) {
+    return command.replace(INTERPOLATION_RE, (_whole, name) => {
+        if (name === 'PHASE_NUMBER')
+            return ctx.phaseNumber ?? '';
+        if (name === 'PHASE_DIR')
+            return ctx.phaseDir ?? '';
+        if (name === 'PHASE_REQ_IDS')
+            return ctx.phaseReqIds ?? '';
+        return '';
+    });
+}
+/** Cap a string at COMMAND_MAX_OUTPUT_CHARS so gate messages stay context-bounded. */
+function trimToMax(s) {
+    return s.length > COMMAND_MAX_OUTPUT_CHARS ? s.slice(0, COMMAND_MAX_OUTPUT_CHARS) : s;
+}
+function isNonEmptyString(v) {
+    return typeof v === 'string' && v.trim().length > 0;
+}
+// ─── Kind: command-exit-zero ──────────────────────────────────────────────────
+function evaluateCommandExitZero(predicate, ctx, deps) {
+    const command = predicate['command'];
+    if (!isNonEmptyString(command)) {
+        throw new Error('command-exit-zero predicate requires a non-empty string "command"');
+    }
+    if (command.length > COMMAND_MAX_LENGTH) {
+        throw new Error(`command-exit-zero predicate "command" exceeds max length ${COMMAND_MAX_LENGTH}`);
+    }
+    let timeoutMs = COMMAND_EXIT_ZERO_DEFAULT_TIMEOUT_MS;
+    const rawTimeout = predicate['timeout'];
+    if (rawTimeout !== undefined) {
+        if (typeof rawTimeout !== 'number' || !Number.isFinite(rawTimeout) || rawTimeout <= 0) {
+            throw new Error('command-exit-zero predicate "timeout" must be a positive finite number (seconds)');
+        }
+        timeoutMs = Math.floor(rawTimeout * 1000);
+    }
+    const interpolated = interpolate(command, ctx);
+    const res = deps.runBoundedShell({ command: interpolated, cwd: ctx.cwd, timeoutMs });
+    if (res.timedOut) {
+        return {
+            block: true,
+            message: trimToMax(`command timed out after ${Math.round(timeoutMs / 1000)}s: ${res.stderr || interpolated}`),
+            details: { kind: 'command-exit-zero', timedOut: true, signal: res.signal },
+        };
+    }
+    if (res.exitCode === 0) {
+        return {
+            block: false,
+            message: 'command exited 0',
+            details: { kind: 'command-exit-zero', exitCode: 0 },
+        };
+    }
+    // Non-zero (incl. null exit from a signal kill) => block. Surface code + stderr/stdout tail.
+    const code = res.exitCode === null ? '<none>' : String(res.exitCode);
+    const tail = trimToMax(res.stderr || res.stdout || '');
+    const message = tail ? `command exited ${code}: ${tail}` : `command exited ${code}`;
+    return {
+        block: true,
+        message: trimToMax(message),
+        details: { kind: 'command-exit-zero', exitCode: res.exitCode, signal: res.signal },
+    };
+}
+// ─── Kind dispatch table ──────────────────────────────────────────────────────
+const KIND_TABLE = {
+    'command-exit-zero': evaluateCommandExitZero,
+};
+// ─── Public entry point ───────────────────────────────────────────────────────
+/**
+ * Evaluate a capability gate `check.predicate`.
+ *
+ * Returns `{ block, message }` for any successfully-recognised predicate.
+ * THROWS for a malformed predicate, missing context/deps, or unknown `kind` —
+ * the CLI wrapper converts a throw into a non-zero check-command exit so the
+ * workflow's `onError` (step-1) contract applies. This keeps the gate fail-closed
+ * without conflating an evaluator bug with a legitimate gate-block decision.
+ */
+function evaluatePredicate(predicate, context, deps) {
+    if (!predicate || typeof predicate !== 'object' || Array.isArray(predicate)) {
+        throw new Error('predicate must be an object');
+    }
+    const ctx = context;
+    if (!ctx || typeof ctx.cwd !== 'string' || ctx.cwd.length === 0) {
+        throw new Error('predicate context requires a non-empty "cwd"');
+    }
+    const d = deps;
+    if (!d || typeof d.runBoundedShell !== 'function') {
+        throw new Error('predicate deps require a "runBoundedShell" function');
+    }
+    const pred = predicate;
+    const kind = pred['kind'];
+    if (typeof kind !== 'string' || kind.length === 0) {
+        throw new Error('predicate.kind must be a non-empty string');
+    }
+    const handler = KIND_TABLE[kind];
+    if (!handler) {
+        throw new Error(`Unknown predicate kind: "${kind}". Known kinds: ${EVALUATOR_KINDS.join(', ')}`);
+    }
+    return handler(pred, ctx, d);
+}
+module.exports = {
+    evaluatePredicate,
+    evaluateCommandExitZero,
+    interpolate,
+    COMMAND_EXIT_ZERO_DEFAULT_TIMEOUT_MS,
+    COMMAND_MAX_OUTPUT_CHARS,
+    COMMAND_MAX_LENGTH,
+    EVALUATOR_KINDS,
+    INTERPOLATION_VAR_NAMES,
+};

package/gsd-core/bin/lib/graphify.cjs

@@ -261,6 +261,29 @@ function countCommitsBetween(cwd, from, to) {
     const n = parseInt(r.stdout.trim(), 10);
     return Number.isFinite(n) ? n : null;
 }
+// ─── Graph location resolution (#1825) ───────────────────────────────────────
+//
+// `graphify.graph_path` (in .planning/config.json) lets one umbrella-level graph
+// serve multiple sibling projects without a per-project mirror. When set, query /
+// status / diff read the configured graph, and the diff snapshot travels with it
+// (alongside graph.json). When unset/blank/non-string, behaviour is byte-identical
+// to the historical `<planningDir>/graphs/graph.json`.
+const GRAPH_FILENAME = 'graph.json';
+const SNAPSHOT_FILENAME = '.last-build-snapshot.json';
+/**
+ * Resolve the absolute graph.json location. Honors `graphify.graph_path` in
+ * config.json (resolved relative to the project root, `cwd`); falls back to the
+ * default `<planningDir>/graphs/graph.json` when unset/blank/non-string.
+ */
+function resolveGraphLocation(cwd, planningDir) {
+    const config = safeReadJson(node_path_1.default.join(planningDir, 'config.json'));
+    const graphify = (config && config['graphify']);
+    const configuredValue = graphify && graphify['graph_path'];
+    if (typeof configuredValue === 'string' && configuredValue.trim().length > 0) {
+        return { graphPath: node_path_1.default.resolve(cwd, configuredValue), configured: true };
+    }
+    return { graphPath: node_path_1.default.join(planningDir, 'graphs', GRAPH_FILENAME), configured: false };
+}
 /**
  * Query the knowledge graph for nodes matching a term, with optional budget cap.
  * Uses seed-then-expand BFS traversal (D-01).
@@ -269,9 +292,11 @@ function graphifyQuery(cwd, term, options = {}) {
     const planningDir = node_path_1.default.join(cwd, '.planning');
     if (!isCapabilityActive('graphify', cwd))
         return disabledResponse();
-    const graphPath = node_path_1.default.join(planningDir, 'graphs', 'graph.json');
+    const { graphPath, configured } = resolveGraphLocation(cwd, planningDir);
     if (!node_fs_1.default.existsSync(graphPath)) {
-        return { error: 'No graph built yet. Run graphify build first.' };
+        return { error: configured
+                ? `Configured graph not found at ${graphPath}. Set graphify.graph_path or run /gsd:graphify build.`
+                : 'No graph built yet. Run graphify build first.' };
     }
     const graph = safeReadJson(graphPath);
     if (!graph) {
@@ -303,9 +328,11 @@ function graphifyStatus(cwd) {
     const planningDir = node_path_1.default.join(cwd, '.planning');
     if (!isCapabilityActive('graphify', cwd))
         return disabledResponse();
-    const graphPath = node_path_1.default.join(planningDir, 'graphs', 'graph.json');
+    const { graphPath, configured } = resolveGraphLocation(cwd, planningDir);
     if (!node_fs_1.default.existsSync(graphPath)) {
-        return { exists: false, message: 'No graph built yet. Run graphify build to create one.' };
+        return { exists: false, message: configured
+                ? `Configured graph not found at ${graphPath}. Set graphify.graph_path or run /gsd:graphify build.`
+                : 'No graph built yet. Run graphify build to create one.' };
     }
     const stat = node_fs_1.default.statSync(graphPath);
     const graph = safeReadJson(graphPath);
@@ -360,8 +387,8 @@ function graphifyDiff(cwd) {
     const planningDir = node_path_1.default.join(cwd, '.planning');
     if (!isCapabilityActive('graphify', cwd))
         return disabledResponse();
-    const snapshotPath = node_path_1.default.join(planningDir, 'graphs', '.last-build-snapshot.json');
-    const graphPath = node_path_1.default.join(planningDir, 'graphs', 'graph.json');
+    const { graphPath } = resolveGraphLocation(cwd, planningDir);
+    const snapshotPath = node_path_1.default.join(node_path_1.default.dirname(graphPath), SNAPSHOT_FILENAME);
     if (!node_fs_1.default.existsSync(snapshotPath)) {
         return { no_baseline: true, message: 'No previous snapshot. Run graphify build first, then build again to generate a diff baseline.' };
     }
@@ -405,7 +432,11 @@ function graphifyBuild(cwd) {
     if (!installed.installed)
         return { error: installed.message };
     const version = checkGraphifyVersion();
-    // Ensure output directory exists (D-05)
+    // Ensure output directory exists (D-05). Build stays project-scoped: the build
+    // skill cp's artifacts into `<planningDir>/graphs/` regardless of graph_path, so
+    // graphs_dir reflects that real destination (not the configured read location).
+    // A shared umbrella graph is built in the umbrella project; sub-projects only
+    // READ it via graphify.graph_path (#1825).
     const graphsDir = node_path_1.default.join(planningDir, 'graphs');
     node_fs_1.default.mkdirSync(graphsDir, { recursive: true });
     // Read build timeout from config -- default 300s per D-02
@@ -428,7 +459,8 @@ function graphifyBuild(cwd) {
  * using platformWriteSync for crash safety.
  */
 function writeSnapshot(cwd) {
-    const graphPath = node_path_1.default.join(cwd, '.planning', 'graphs', 'graph.json');
+    const planningDir = node_path_1.default.join(cwd, '.planning');
+    const { graphPath } = resolveGraphLocation(cwd, planningDir);
     const graph = safeReadJson(graphPath);
     if (!graph)
         return { error: 'Cannot write snapshot: graph.json not parseable' };
@@ -438,7 +470,7 @@ function writeSnapshot(cwd) {
         nodes: graph.nodes || [],
         edges: graph.edges || graph.links || [],
     };
-    const snapshotPath = node_path_1.default.join(cwd, '.planning', 'graphs', '.last-build-snapshot.json');
+    const snapshotPath = node_path_1.default.join(node_path_1.default.dirname(graphPath), SNAPSHOT_FILENAME);
     (0, shell_command_projection_cjs_1.platformWriteSync)(snapshotPath, JSON.stringify(snapshot, null, 2));
     return {
         saved: true,

package/gsd-core/bin/lib/milestone.cjs

@@ -263,7 +263,13 @@ function cmdMilestoneComplete(cwd, version, options, raw) {
     // Archive REQUIREMENTS.md
     if (node_fs_1.default.existsSync(reqPath)) {
         const reqContent = node_fs_1.default.readFileSync(reqPath, 'utf-8');
-        const archiveHeader = `# Requirements Archive: ${version} ${milestoneName}\n\n**Archived:** ${today}\n**Status:** SHIPPED\n\nFor current requirements, see \`.planning/REQUIREMENTS.md\`.\n\n---\n\n`;
+        // Derive the display path from the same source the writer uses (reqPath), so a
+        // workstream archive header points at `.planning/workstreams/<ws>/REQUIREMENTS.md`
+        // instead of the hardcoded root path (#1993). Root case is byte-identical.
+        // Normalize to POSIX separators so the header is cross-platform (Windows
+        // path.relative yields backslashes; the original literal was forward-slash).
+        const reqDisplay = node_path_1.default.relative(cwd, reqPath).split(node_path_1.default.sep).join('/');
+        const archiveHeader = `# Requirements Archive: ${version} ${milestoneName}\n\n**Archived:** ${today}\n**Status:** SHIPPED\n\nFor current requirements, see \`${reqDisplay}\`.\n\n---\n\n`;
         (0, shell_command_projection_cjs_1.platformWriteSync)(node_path_1.default.join(archiveDir, `${version}-REQUIREMENTS.md`), archiveHeader + reqContent);
     }
     // Archive audit file if exists

package/gsd-core/bin/lib/phase.cjs

@@ -1135,7 +1135,10 @@ function cmdPhaseComplete(cwd, phaseNum, raw) {
                 const checkboxPattern = new RegExp(`(-\\s*\\[)[ ](\\]\\s*.*Phase\\s+${phaseEscaped}${OPTIONAL_PHASE_TAG_SOURCE}[:\\s][^\\n]*)`, 'i');
                 roadmapContent = roadmapContent.replace(checkboxPattern, `$1x$2 (completed ${today})`);
                 const tableRowPattern = new RegExp(`^(\\|\\s*${phaseEscaped}\\.?\\s[^|]*(?:\\|[^\\n]*))$`, 'im');
-                roadmapContent = roadmapContent.replace(tableRowPattern, (fullRow) => {
+                // Scope the Progress-row search to the ## Progress section so the regex
+                // doesn't bind to an earlier table (e.g. | Phase | Requirements | Count |)
+                // whose rows also start with the phase number. (#2012)
+                const updateProgressRow = (fullRow) => {
                     const cells = fullRow.split('|').slice(1, -1);
                     const dateShape = /^\d{4}-\d{2}-\d{2}$/;
                     if (cells.length === 5) {
@@ -1153,7 +1156,16 @@ function cmdPhaseComplete(cwd, phaseNum, raw) {
                         cells[3] = dateShape.test(existingDate4) ? cells[3] : ` ${today} `;
                     }
                     return '|' + cells.join('|') + '|';
-                });
+                };
+                const progressIdx = roadmapContent.indexOf('## Progress');
+                if (progressIdx >= 0) {
+                    const beforeProgress = roadmapContent.slice(0, progressIdx);
+                    const progressSection = roadmapContent.slice(progressIdx);
+                    roadmapContent = beforeProgress + progressSection.replace(tableRowPattern, updateProgressRow);
+                }
+                else {
+                    roadmapContent = roadmapContent.replace(tableRowPattern, updateProgressRow);
+                }
                 const planCountPattern = new RegExp(`(#{2,4}\\s*Phase\\s+${phaseEscaped}[\\s\\S]*?\\*\\*Plans:\\*\\*\\s*)[^\\n]+`, 'i');
                 roadmapContent = roadmapContent.replace(planCountPattern, `$1${summaryCount}/${planCount} plans complete`);
                 const phaseInfoSummaries = phaseInfo['summaries'];

package/gsd-core/bin/lib/plan-scan.cjs

@@ -9,6 +9,9 @@
  */
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const coreUtils = require("./core-utils.cjs");
+const { countMatchedSummaries } = coreUtils;
 // Excluded derivative files
 const PLAN_OUTLINE_RE = /-OUTLINE\.md$/i;
 const PLAN_PRE_BOUNCE_RE = /\.pre-bounce\.md$/i;
@@ -72,7 +75,12 @@ function scanPhasePlans(phaseDir) {
     const planFiles = rootPlanFiles.concat(nestedPlanFiles);
     const summaryFiles = rootSummaryFiles.concat(nestedSummaryFiles);
     const planCount = planFiles.length;
-    const summaryCount = summaryFiles.length;
+    // Count only summaries that are the PLAN→SUMMARY partner of an existing plan
+    // (#1988): stray non-plan summaries (e.g. 30-FIX-CR02-SUMMARY.md,
+    // 30-GAPCLOSURE-SUMMARY.md) must not inflate summary_count or flip a phase to
+    // Complete when plans are still missing summaries. summaryFiles (the array)
+    // still holds every summary on disk for callers that read/list them.
+    const summaryCount = countMatchedSummaries(planFiles, summaryFiles);
     return {
         planCount,
         summaryCount,

package/gsd-core/bin/lib/profile-output.cjs

@@ -1024,7 +1024,7 @@ function cmdGenerateClaudeMd(cwd, options, raw) {
         // project-instruction-file`). Previously this was a codex-only override
         // (#3163) that left AGENTS-native runtimes (opencode/kilo/kimi) emitting
         // CLAUDE.md; copilot now resolves to .github/copilot-instructions.md, and
-        // antigravity/gemini to GEMINI.md. GSD_RUNTIME env var takes precedence
+        // antigravity to GEMINI.md. GSD_RUNTIME env var takes precedence
         // over config.runtime, mirroring detectRuntime().
         //
         // Non-claude runtimes always win over a stale `claude_md_path` (the #3163

package/gsd-core/bin/lib/prohibition-enforcement.cjs

@@ -515,12 +515,12 @@ function defaultProveFailFirst(check, cwd, timeoutMs) {
             // a setup crash, not from the prohibition firing. Requiring the fixture to exist before spawning
             // closes the realistic typo/stale-path case (#1279 review, Major 1).
             //
-            // CAUSATION (#1346): existence + a non-vacuous red is necessary but not sufficient — a deceptive
-            // negative test that reds merely BECAUSE `GSD_PROHIB_SUBJECT` is set (rather than because the
-            // subject's CONTENT violates the must-NOT) would otherwise be accepted. The OPTIONAL `cleanFixture`
-            // control below proves content-dependence when supplied (red on bad AND green on clean). When NO
-            // clean fixture is authored the control cannot run, so the residual remains a documented constraint
-            // for that case (an author opts into the stronger proof by supplying a known-clean control subject).
+            // CAUSATION (#1346; MANDATORY as of #1906): existence + a non-vacuous red is necessary but not
+            // sufficient — a deceptive negative test that reds merely BECAUSE `GSD_PROHIB_SUBJECT` is set
+            // (rather than because the subject's CONTENT violates the must-NOT) would otherwise be accepted.
+            // The `cleanFixture` control below proves content-dependence (red on bad AND green on clean) and is
+            // now REQUIRED for the node-test kind: absent it, the check is un-provable (fail-closed), not
+            // accepted under the weaker violation-only proof (#1906 supersedes #1346's opt-in; ADR-1606 D4).
             // Resolve the fixture against `cwd` (NOT the verify process's cwd): the spawned test reads
             // `GSD_PROHIB_SUBJECT` and resolves a relative subject against `cwd`, so the existence check must
             // use the SAME base or it could pass here yet ENOENT in the child (re-opening the fail-open hole).
@@ -530,20 +530,22 @@ function defaultProveFailFirst(check, cwd, timeoutMs) {
             const redOut = runNodeTestWithSubject(check, cwd, fixture, timeoutMs);
             if (!isNonVacuousNodeTestRed(redOut, check.target))
                 return { provenFailFirst: false, method: 'violation-fixture' };
-            // #1346 CAUSATION CONTROL (optional): if a clean control subject is supplied, run the SAME test
-            // against it and require it to stay GREEN. This proves the red above was caused by the subject's
-            // CONTENT — a deceptive test that reds merely because GSD_PROHIB_SUBJECT is SET reds here too →
-            // not content-dependent → not proven. Absent → no control (documented residual; backward-compat).
+            // #1906 CAUSATION CONTROL (MANDATORY for node-test — supersedes #1346's opt-in, ADR-1606 D4): the
+            // clean control subject is REQUIRED. Run the SAME test against it and require it to stay GREEN,
+            // proving the red above was caused by the subject's CONTENT — a deceptive test that reds merely
+            // because GSD_PROHIB_SUBJECT is SET reds here too → not content-dependent → not proven. ABSENT →
+            // the control cannot run → un-provable → fail-closed (NOT accepted under the weaker violation-only
+            // proof). This is the one behavior change vs #1346: absent `cleanFixture` was previously proven.
             const clean = check.cleanFixture;
-            if (clean) {
-                // A supplied-but-missing/typo'd control path can't run the control → fail-closed, symmetric
-                // with the violation-fixture existence guard (resolve against the SAME `cwd` as the child).
-                if (!node_fs_1.default.existsSync(node_path_1.default.resolve(cwd, clean)))
-                    return { provenFailFirst: false, method: 'violation-fixture' };
-                const cleanOut = runNodeTestWithSubject(check, cwd, clean, timeoutMs);
-                if (!isNonVacuousNodeTestPass(cleanOut, check.target))
-                    return { provenFailFirst: false, method: 'violation-fixture' };
-            }
+            if (!clean)
+                return { provenFailFirst: false, method: 'violation-fixture' };
+            // A supplied-but-missing/typo'd control path can't run the control → fail-closed, symmetric
+            // with the violation-fixture existence guard (resolve against the SAME `cwd` as the child).
+            if (!node_fs_1.default.existsSync(node_path_1.default.resolve(cwd, clean)))
+                return { provenFailFirst: false, method: 'violation-fixture' };
+            const cleanOut = runNodeTestWithSubject(check, cwd, clean, timeoutMs);
+            if (!isNonVacuousNodeTestPass(cleanOut, check.target))
+                return { provenFailFirst: false, method: 'violation-fixture' };
             return { provenFailFirst: true, method: 'violation-fixture' };
         }
         // Unknown kind — defensive; the LOCATE guard already rejects it.

package/gsd-core/bin/lib/roadmap.cjs

@@ -32,8 +32,14 @@ const { planningPaths, withPlanningLock, findContextMdIn } = planningWorkspace;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const scanPhasePlans = require("./plan-scan.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
+const coreUtils = require("./core-utils.cjs");
+const { countMatchedSummaries } = coreUtils;
+// eslint-disable-next-line @typescript-eslint/no-require-imports
 const frontmatter = require("./frontmatter.cjs");
 const { extractFrontmatter, parseMustHavesBlock } = frontmatter;
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const verificationMod = require("./verification.cjs");
+const { readVerificationStatus } = verificationMod;
 // ─── coerceTruthToString ──────────────────────────────────────────────────────
 /**
  * Coerce an arbitrary YAML scalar/object into a string for cross-cutting
@@ -410,12 +416,21 @@ function cmdRoadmapUpdatePlanProgress(cwd, phaseNum, raw) {
         error(`Phase ${phaseNum} not found`);
     }
     const planCount = phaseInfo.plans.length;
-    const summaryCount = phaseInfo.summaries.length;
+    // Count only summaries that pair with a real plan (#1988): stray non-plan
+    // summaries (30-FIX-CR02-SUMMARY.md, 30-GAPCLOSURE-SUMMARY.md, …) must not
+    // inflate summary_count and silently flip the phase to Complete.
+    const summaryCount = countMatchedSummaries(phaseInfo.plans, phaseInfo.summaries);
     if (planCount === 0) {
         output({ updated: false, reason: 'No plans found', plan_count: 0, summary_count: 0 }, raw, 'no plans');
         return;
     }
-    const isComplete = summaryCount >= planCount;
+    // Verification gate (#2022): do NOT check the phase checkbox or stamp a
+    // completion date until the phase's verification status is 'passed', matching
+    // cmdPhaseComplete's gate (phase.cts:1436). Previously the checkbox fired the
+    // moment the last plan summary landed — before gsd-verifier had verified.
+    const phaseDir = node_path_1.default.join(cwd, phaseInfo.directory);
+    const verificationPassed = readVerificationStatus(phaseDir).status === 'passed';
+    const isComplete = summaryCount >= planCount && verificationPassed;
     const status = isComplete ? 'Complete' : summaryCount > 0 ? 'In Progress' : 'Planned';
     const today = clock_cjs_1.realClock.today();
     if (!node_fs_1.default.existsSync(roadmapPath)) {

package/gsd-core/bin/lib/runtime-hooks-surface.cjs

@@ -1039,7 +1039,7 @@ function applySettingsJsonHooks(settings, opts) {
         // Configure PreToolUse hook for prompt injection detection
         // ADR-857 phase 5f-2: drive dialect from opts.hookEvents (registry descriptor).
         // hookEvents='gemini' → BeforeTool; all others → PreToolUse.
-        // Equivalence: hookEvents='gemini' iff runtime∈{gemini,antigravity} (same as old check).
+        // Equivalence: hookEvents='gemini' iff runtime===antigravity (same as old check).
         const preToolEvent = hookEvents === 'gemini' ? 'BeforeTool' : 'PreToolUse';
         if (!settings.hooks[preToolEvent]) {
             settings.hooks[preToolEvent] = [];
@@ -1312,9 +1312,14 @@ function applySettingsJsonHooks(settings, opts) {
             }
         }
         // ── end SubagentStop / Stop / PreCompact events ────────────────────────────
-        // ── Gemini-only extended hook events (#776) ───────────────────────────────
-        // Gemini CLI exposes several hook events beyond BeforeTool/AfterTool that
-        // gsd previously did not register.  Three high-value events are added here:
+        // ── Extended hook events (#776; Gemini runtime removed #1928) ──────────────
+        // The Gemini-3-backend dialect exposes several hook events beyond
+        // BeforeTool/AfterTool. These were added for the now-removed Gemini CLI
+        // runtime (#776). No currently supported runtime declares them —
+        // Antigravity's descriptor carries `extendedHookEvents: []` — so this loop
+        // is an inert, descriptor-driven seam: it no-ops for every present runtime
+        // and re-activates automatically if a future runtime declares any of them.
+        // Three high-value events would be wired here:
         //
         //   BeforeAgent  — fires after user submits a prompt, before the agent
         //                  plans.  Wire gsd-context-monitor for context headroom
@@ -1335,15 +1340,15 @@ function applySettingsJsonHooks(settings, opts) {
         // gsd hook use case at this time; deferred to a follow-on issue.
         //
         // Guard is now descriptor-driven: only events present in extendedEvents are wired.
-        for (const geminiEvent of ['BeforeAgent', 'AfterAgent', 'BeforeModel']) {
-            if (!extendedEvents.includes(geminiEvent))
+        for (const extendedEvent of ['BeforeAgent', 'AfterAgent', 'BeforeModel']) {
+            if (!extendedEvents.includes(extendedEvent))
                 continue;
-            if (!Array.isArray(settings.hooks[geminiEvent])) {
-                settings.hooks[geminiEvent] = [];
+            if (!Array.isArray(settings.hooks[extendedEvent])) {
+                settings.hooks[extendedEvent] = [];
             }
-            const alreadyHasContextMonitor = settings.hooks[geminiEvent].some((entry) => entry.hooks && entry.hooks.some((h) => referencesHook(h, 'gsd-context-monitor')));
+            const alreadyHasContextMonitor = settings.hooks[extendedEvent].some((entry) => entry.hooks && entry.hooks.some((h) => referencesHook(h, 'gsd-context-monitor')));
             if (!alreadyHasContextMonitor && node_fs_1.default.existsSync(contextMonitorFile) && contextMonitorCommand) {
-                settings.hooks[geminiEvent].push({
+                settings.hooks[extendedEvent].push({
                     hooks: [
                         {
                             type: 'command',
@@ -1352,13 +1357,13 @@ function applySettingsJsonHooks(settings, opts) {
                         }
                     ]
                 });
-                console.log(`  ${green}✓${reset} Configured ${geminiEvent} context monitor hook (Gemini)`);
+                console.log(`  ${green}✓${reset} Configured ${extendedEvent} context monitor hook`);
             }
             else if (!alreadyHasContextMonitor && !node_fs_1.default.existsSync(contextMonitorFile)) {
-                console.warn(`  ${yellow}⚠${reset}  Skipped ${geminiEvent} hook — gsd-context-monitor.js not found at target`);
+                console.warn(`  ${yellow}⚠${reset}  Skipped ${extendedEvent} hook — gsd-context-monitor.js not found at target`);
             }
         }
-        // ── end Gemini-only extended hook events ──────────────────────────────────
+        // ── end Antigravity-only extended hook events ──────────────────────────────
         // ── FileChanged hook: hot-reload gsd config on .planning/config.json edits ─
         // Claude Code fires FileChanged when a watched file changes on disk.  Wire
         // gsd-config-reload.js to reload the gsd config context whenever the user

package/gsd-core/bin/lib/runtime-name-policy.cjs

@@ -29,7 +29,6 @@ const FALLBACK_ALIASES = {
     claude: ['claude', 'claude-code', 'claude-cli'],
     opencode: ['opencode', 'open-code', 'opencode-cli'],
     kilo: ['kilo', 'kilo-cli'],
-    gemini: ['gemini', 'gemini-cli', 'gemini-code'],
     codex: ['codex', 'codex-app', 'codex-cli', 'codex_desktop', 'codex-desktop'],
     copilot: ['copilot', 'copilot-cli', 'github-copilot'],
     antigravity: ['antigravity', 'antigravity-cli', 'antigravity-agent'],
@@ -114,7 +113,7 @@ function resolveRuntimeNameFromCandidates(...candidates) {
  *   claude                      → .claude/CLAUDE.md
  *   codex, opencode, kilo, kimi → AGENTS.md
  *   copilot                     → .github/copilot-instructions.md
- *   antigravity, gemini         → GEMINI.md
+ *   antigravity                 → GEMINI.md
  *   unknown / future runtimes   → AGENTS.md (safe cross-agent default)
  *
  * Source-of-truth references for each runtime's read path:
@@ -126,7 +125,9 @@ function resolveRuntimeNameFromCandidates(...candidates) {
  *     'copilot-instructions' writes the same `.github/copilot-instructions.md`.)
  *   - codex/opencode/kilo/kimi: AGENTS.md is the documented cross-agent
  *     instruction file (agentsmd/agents.md convention).
- *   - antigravity/gemini: GEMINI.md is Gemini CLI's contextFileName.
+ *   - antigravity: GEMINI.md is Antigravity CLI's contextFileName (the Gemini
+ *     CLI runtime that historically shared this file was removed — #1928;
+ *     Google sunset Gemini CLI 2026-06-18 and Antigravity CLI is its successor).
  *
  * Aliases are normalized via `canonicalizeRuntimeName` first, so inputs like
  * `codex-cli` resolve to `codex` → `AGENTS.md`. Replaces the prior codex-only
@@ -139,7 +140,7 @@ function getProjectInstructionFile(runtime) {
         return '.claude/CLAUDE.md';
     if (canonical === 'copilot')
         return '.github/copilot-instructions.md';
-    if (canonical === 'antigravity' || canonical === 'gemini')
+    if (canonical === 'antigravity')
         return 'GEMINI.md';
     // codex, opencode, kilo, kimi, AND unknown/future runtimes all default to
     // root AGENTS.md (the safe cross-agent instruction file).
@@ -180,7 +181,7 @@ function getDirName(runtime) {
  *
  * Voice: these are the SHORT UI labels, intentionally distinct from the
  * descriptor `title` (the long product name — e.g. "OpenAI Codex CLI",
- * "GitHub Copilot", "Gemini CLI") which serves documentation/registry display,
+ * "GitHub Copilot") which serves documentation/registry display,
  * not the install console. A future slice may relocate this to a
  * `runtime.label` descriptor field; until then this table is the source.
  *
@@ -195,7 +196,6 @@ function getDirName(runtime) {
 const RUNTIME_LABELS = {
     claude: 'Claude Code',
     opencode: 'OpenCode',
-    gemini: 'Gemini',
     kilo: 'Kilo',
     codex: 'Codex',
     copilot: 'Copilot',
@@ -231,7 +231,7 @@ function getRuntimeLabel(runtime) {
  * bin/install.js (ADR-1239 Phase B / #1679, AC2 slice 2) — the add-a-host tax:
  * a new runtime meant remembering to add a branch here. Values are preserved
  * BYTE-FOR-BYTE from the prior chain; golden install parity asserts generated
- * hook output is unchanged across all 16 runtimes.
+ * hook output is unchanged across all 15 runtimes.
  *
  * Two runtimes are intentionally absent (handled by the caller, NOT this table):
  *   - `claude`     → the default; falls through to `DEFAULT_FRAGMENT`.
@@ -244,7 +244,6 @@ const DEFAULT_CONFIG_HOME_FRAGMENT = "'.claude'";
 const GLOBAL_CONFIG_HOME_FRAGMENTS = {
     copilot: "'.copilot'",
     opencode: "'.config', 'opencode'",
-    gemini: "'.gemini'",
     kilo: "'.config', 'kilo'",
     codex: "'.codex'",
     cursor: "'.cursor'",
@@ -277,7 +276,7 @@ function getGlobalConfigHomeFragment(runtime) {
  * removes).
  */
 const RUNTIME_FLAG_IDS = Object.freeze([
-    'opencode', 'kilo', 'gemini', 'codex', 'copilot', 'antigravity', 'cursor',
+    'opencode', 'kilo', 'codex', 'copilot', 'antigravity', 'cursor',
     'windsurf', 'augment', 'trae', 'qwen', 'hermes', 'codebuddy', 'cline', 'kimi',
 ]);
 /**
@@ -303,7 +302,6 @@ function runtimeFlags(runtime) {
  */
 const DEFAULT_NEW_PROJECT_COMMAND = '/gsd-new-project';
 const RUNTIME_NEW_PROJECT_COMMANDS = {
-    gemini: '/gsd:new-project',
     codex: '$gsd-new-project',
     cursor: 'gsd-new-project (mention the skill name)',
     kimi: '/skill:gsd-new-project',

package/gsd-core/bin/lib/shell-command-projection.cjs

@@ -56,16 +56,20 @@ const node_child_process_1 = __importDefault(require("node:child_process"));
  * runtime/shell combination.
  *
  * Current evidence-backed policy:
- * - Gemini on Windows requires `& ` for quoted node/bash runners.
- * - Claude Code on Windows does NOT: its hook commands execute under bash/Git
- *   Bash and `& ` breaks there (#3413).
+ * - Claude Code on Windows does NOT need it: its hook commands execute under
+ *   bash/Git Bash and `& ` breaks there (#3413).
+ * - #1928: Gemini CLI — the ONLY runtime with a verified need for the `& `
+ *   prefix on Windows — was removed (Google sunset it 2026-06-18). No currently
+ *   supported runtime has a verified need, so this seam is now inert. It is
+ *   retained (not deleted) so a future runtime with a verified need is a
+ *   one-line re-enable, per the conservative policy below. Note: Antigravity —
+ *   the Gemini-backend successor — never matched the old `runtime === 'gemini'`
+ *   check, so its behavior (no prefix) is unchanged.
  *
  * Keep the policy conservative until another runtime has a verified need.
  */
-function hookCommandNeedsPowerShellCallOperator(opts = {}) {
-    const platform = opts.platform || process.platform;
-    const runtime = opts.runtime || 'generic';
-    return platform === 'win32' && runtime === 'gemini';
+function hookCommandNeedsPowerShellCallOperator(_opts = {}) {
+    return false;
 }
 /**
  * Project a fully-assembled hook command string for the target runtime.
@@ -121,7 +125,7 @@ function formatManagedHookScriptToken(scriptPath, opts = {}) {
 function projectLocalHookPrefix({ runtime = 'claude', dirName }) {
     if (!dirName)
         return dirName;
-    return (runtime === 'gemini' || runtime === 'antigravity')
+    return (runtime === 'antigravity')
         ? dirName
         : `"$CLAUDE_PROJECT_DIR"/${dirName}`;
 }