@opengsd/gsd-core 1.7.0-rc.5 → 1.7.0

package/gsd-core/bin/lib/surface.cjs

@@ -305,8 +305,8 @@ function applySurface(runtimeConfigDir, layout, manifest, clusterMap, registry,
     // surface-path agents lack path-prefix rewrites and Co-Authored-By trailers,
     // diverging from a fresh install.
     const _homedirFn = opts?.homedir ?? (() => node_os_1.default.homedir());
-    const _resolvedTarget = node_path_1.default.resolve(layout.configDir).replace(/\\/g, '/');
-    const _homeDir = _homedirFn().replace(/\\/g, '/');
+    const _resolvedTarget = (0, shell_command_projection_cjs_1.posixNormalize)(node_path_1.default.resolve(layout.configDir));
+    const _homeDir = (0, shell_command_projection_cjs_1.posixNormalize)(_homedirFn());
     const _isGlobal = (layout.scope ?? 'global') === 'global';
     const _isOpencode = layout.runtime === 'opencode';
     const _isWindowsHost = (opts?.platform ?? process.platform) === 'win32';
@@ -472,10 +472,14 @@ function _syncGsdDir(stagedDir, destDir, kind, manifest, runtime) {
     // Normalize: allow legacy string context for backward-compat with internal callers
     const kindName = (typeof kind === 'string') ? kind : kind.kind;
     const kindPrefix = (typeof kind === 'object' && kind !== null) ? kind.prefix : 'gsd-';
-    // #1575: copilot agents are renamed .md -> .agent.md at copy time, mirroring
-    // the inline agent loop in bin/install.js (line ~9118). Other runtimes keep
-    // the staged filename verbatim.
-    const isCopilotAgents = runtime === 'copilot' && kindName === 'agents';
+    // #1575 / #2103: agent files are renamed .md -> <agentFileExtension> at copy
+    // time when the runtime's descriptor declares hostBehaviors.agentFileExtension
+    // (e.g. copilot's '.agent.md'), mirroring install-engine.cts's staged-copy
+    // loop (`_copyStaged`) — ONE descriptor read shared by both surfaces instead
+    // of a duplicated hardcoded `runtime === 'copilot'` literal. Other runtimes
+    // (no agentFileExtension declared) keep the staged filename verbatim.
+    const _agentExt = runtime ? runtimeArtifactConversion.agentFileExtensionFor(runtime) : undefined;
+    const isRenamedAgents = !!_agentExt && kindName === 'agents';
     if (kindName === 'skills') {
         // Skills kind: work with directories, not files.
         // Each staged entry is a directory named ${prefix}${stem}.
@@ -510,8 +514,8 @@ function _syncGsdDir(stagedDir, destDir, kind, manifest, runtime) {
         const stagedFiles = node_fs_1.default.readdirSync(stagedDir).filter(f => f.endsWith('.md'));
         const stagedDestNames = new Set();
         for (const file of stagedFiles) {
-            const destName = isCopilotAgents
-                ? file.replace(/\.md$/, '.agent.md')
+            const destName = isRenamedAgents
+                ? file.replace(/\.md$/, _agentExt)
                 : (kindName === 'agents' || namespacedByDir)
                     ? file
                     : `${kindPrefix}${file.slice(0, -3)}.md`;

package/gsd-core/bin/lib/template.cjs

@@ -11,6 +11,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
+const clock_cjs_1 = require("./clock.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const ioMod = require("./io.cjs");
 const { output, error } = ioMod;
@@ -85,7 +86,7 @@ function cmdTemplateFill(cwd, templateType, options, raw) {
         return;
     }
     const padded = normalizePhaseName(options.phase);
-    const today = new Date().toISOString().split('T')[0];
+    const today = clock_cjs_1.realClock.localToday();
     const phaseName = options.name || phaseInfo.phase_name || 'Unnamed';
     const phaseSlug = phaseInfo.phase_slug || generateSlugInternal(phaseName);
     const phaseId = `${padded}-${phaseSlug}`;

package/gsd-core/bin/lib/uat.cjs

@@ -21,6 +21,9 @@ const { output, error } = io;
 const markdownSectionizer = require("./markdown-sectionizer.cjs");
 const { collectSection, tokenizeHeadings } = markdownSectionizer;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
+const markdownTable = require("./markdown-table.cjs");
+const { splitTableRow } = markdownTable;
+// eslint-disable-next-line @typescript-eslint/no-require-imports
 const roadmapParser = require("./roadmap-parser.cjs");
 const { getMilestonePhaseFilter } = roadmapParser;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
@@ -292,24 +295,67 @@ function parseVerificationItems(content, status) {
         // Use the seam to locate the ## Human Verification section (ADR-1372 T5).
         const hvSection = collectSection(content, (h) => /^human\s+verification/i.test(h.text) && h.level === 2, { levelBounded: true });
         if (hvSection) {
+            // #2245 review Fix 3: reverted to the pre-Phase-4 (HEAD 2cbf18642)
+            // implementation. The live Human Verification section is NOT a strict
+            // GFM table — the planner/verifier templates mix table rows, numbered
+            // items, and bullet items in the same section (and a `### N.` heading
+            // format is common too), so a table-XOR-list read (parse a table, and
+            // if it parses, suppress numbered/bullet items entirely) silently
+            // dropped items on any mixed or malformed section: a malformed
+            // `| N | … |` table with no valid header/delimiter yielded ZERO items
+            // instead of reading the rows positionally. This per-line scan reads
+            // table rows AND numbered items AND bullet items as a UNION (whichever
+            // pattern a given line matches), exactly like OLD, and reads
+            // `| N | desc |` rows even without a valid table header/delimiter.
+            //
+            // #2245 audit: the table-row branch's CELL SPLIT is name/position-
+            // addressed via `splitTableRow` (escape-aware, canonical) instead of a
+            // hand-rolled pipe regex — candidacy itself is decided WITHOUT a table
+            // regex (a leading `|` plus a purely-numeric first cell), so this no
+            // longer needs an allow-adhoc-markdown suppression at all.
             const lines = hvSection.body.split('\n');
             for (const line of lines) {
-                // Match table rows: | N | description | ... |
-                const tableMatch = line.match(/\|\s*(\d+)\s*\|\s*([^|]+)/);
+                const trimmedLine = line.trim();
+                // Match table rows: | N | description | ... — candidacy requires a
+                // leading pipe and a purely-numeric first cell (mirrors what the old
+                // regex effectively required: a "|digit|" cell immediately followed
+                // by more content), with at least 2 physical cells so a bare "| N |"
+                // with nothing after it is NOT treated as a row.
+                //
+                // #2245 review Fix 9: this is NOT the same as OLD for a row whose
+                // ONLY content past the digit cell is trailing whitespace (e.g.
+                // "| N | ", no second delimiting `|`). OLD's `([^|]+)` regex ran
+                // against the RAW (untrimmed) line and its `\s*` would backtrack to
+                // let `[^|]+` swallow that trailing whitespace, so OLD matched and
+                // pushed an item with an EMPTY (`.trim()`-collapsed) name. Here,
+                // `trimmedLine = line.trim()` strips that trailing whitespace BEFORE
+                // `splitTableRow` ever sees it, collapsing the line to a single cell
+                // (`candidateCells.length === 1`), which fails the `>= 2` check —
+                // the item is silently dropped instead. A real, acceptable behaviour
+                // change (an empty-named UAT item is not useful either way), but the
+                // two implementations are NOT equivalent on this input.
+                let tableCells = null;
+                if (trimmedLine.startsWith('|')) {
+                    const candidateCells = splitTableRow(trimmedLine);
+                    if (candidateCells.length >= 2 && /^\d+$/.test(candidateCells[0])) {
+                        tableCells = candidateCells;
+                    }
+                }
                 // Match bullet items: - description
                 const bulletMatch = line.match(/^[-*]\s+(.+)/);
                 // Match numbered items: 1. description
                 const numberedMatch = line.match(/^(\d+)\.\s+(.+)/);
-                if (tableMatch) {
+                if (tableCells) {
                     // Skip rows that already have a passing result (PASS, pass, resolved, etc.)
-                    const rowRemainder = line.slice(tableMatch.index + tableMatch[0].length);
-                    const cellValues = rowRemainder.split('|').map(c => c.trim());
-                    const hasPassResult = cellValues.some(c => /^pass$/i.test(c) || /^resolved$/i.test(c));
+                    // — checked over every cell AFTER the description column, mirroring
+                    // OLD's rowRemainder scan (which only ever saw cells past the
+                    // description, the description itself having already been consumed).
+                    const hasPassResult = tableCells.slice(2).some(c => /^pass$/i.test(c) || /^resolved$/i.test(c));
                     if (hasPassResult)
                         continue;
                     items.push({
-                        test: parseInt(tableMatch[1], 10),
-                        name: tableMatch[2].trim(),
+                        test: parseInt(tableCells[0], 10),
+                        name: tableCells[1] ?? '',
                         result: 'human_needed',
                         category: 'human_uat',
                     });

package/gsd-core/bin/lib/ui-consideration-probe.cjs

@@ -0,0 +1,249 @@
+"use strict";
+/**
+ * UI-consideration probe — the THIRD adapter of the probe-core resolution model
+ * (ADR-457 build model; ADR-550 Decision 7 seam; #1867).
+ *
+ * The generic resolution lifecycle, the status×verification re-cut, `validateResolution`,
+ * `validateRequirement`, the `analyzeCoverage` merge/rollup/orphan-reject engine, and the
+ * `runProbeCli` scaffold all live in `src/probe-core.cts`. This module keeps ONLY the
+ * UI-specific cluster: the six element kinds, the closed 8-category shape-rooted UI state
+ * taxonomy, element classification, consideration proposal, and the `{ explicit, backstop }`
+ * verification validators — mirroring `edge-probe` on the UI element/state axis.
+ *
+ * MIXED-axis boundary (spike verdict, ADR-550 pattern): this compiled taxonomy covers ONLY the
+ * finite, project-independent shape-rooted *content/robustness* states (empty/loading/error/…).
+ * Open, domain-specific UX considerations (real-time/offline, deep a11y/WCAG breadth, i18n/RTL
+ * depth, emerging interaction paradigms) are prose-owned in `references/domain-probes.md`, NOT
+ * here — forcing them into a closed compiled taxonomy is the wrong model.
+ *
+ * Authored as strict TypeScript (`src/ui-consideration-probe.cts`) and compiled by
+ * `tsc -p tsconfig.build.json` to the gitignored runtime artifact
+ * `gsd-core/bin/lib/ui-consideration-probe.cjs`. Do NOT hand-write the `.cjs`; it is emitted.
+ * Tests `require()` the built artifact; `pretest` runs `build:lib` first.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UI_VALIDATORS = exports.UNCLASSIFIED_CATEGORY = exports.UI_TAXONOMY = exports.VALID_ELEMENT_KINDS = exports.UI_CUES = void 0;
+exports.classifyElement = classifyElement;
+exports.applicableCategories = applicableCategories;
+exports.validateRequirement = validateRequirement;
+exports.validateResolution = validateResolution;
+exports.proposeConsiderations = proposeConsiderations;
+exports.analyzeCoverage = analyzeCoverage;
+exports.proposeElements = proposeElements;
+exports.autoResolve = autoResolve;
+const probe_core_cjs_1 = require("./probe-core.cjs");
+/**
+ * Word-boundary cues mapping element prose -> UI element kind.
+ * Heuristic and intentionally lossy; an authored `elements` array overrides it. Every pattern is a
+ * flat linear `\b(a|b|c)\b` alternation with NO nested/overlapping quantifiers (no catastrophic
+ * backtracking — mirrors SHAPE_CUES).
+ */
+exports.UI_CUES = {
+    'form': /\b(forms?|inputs?|fields?|submit|validation|validate|password|email|checkbox|radio|textarea)\b/i,
+    'list-collection': /\b(lists?|listing|tables?|grids?|collections?|rows?|items?|cards?|feed|results?)\b/i,
+    'nav': /\b(nav|navigation|menus?|tabs?|breadcrumbs?|pagination|sidebars?)\b/i,
+    'media': /\b(images?|img|videos?|avatars?|thumbnails?|photos?|gallery|icons?)\b/i,
+    'interactive-control': /\b(buttons?|toggles?|switch|switches|dropdowns?|sliders?|controls?|pickers?)\b/i,
+    'static-content': /\b(labels?|headings?|titles?|paragraphs?|copy|descriptions?|text)\b/i,
+};
+/** The locked element vocabulary — exactly the keys of UI_CUES (single source of truth). */
+exports.VALID_ELEMENT_KINDS = new Set(Object.keys(exports.UI_CUES));
+/** Detect which element kinds a description's prose matches (heuristic). */
+function classifyElement(text) {
+    const kinds = [];
+    const subject = String(text == null ? '' : text);
+    for (const kind of Object.keys(exports.UI_CUES)) {
+        if (exports.UI_CUES[kind].test(subject))
+            kinds.push(kind);
+    }
+    return kinds;
+}
+/**
+ * Closed taxonomy of 8 shape-rooted UI *content/robustness* state categories. `elements` lists
+ * which element kinds make the category relevant. These ids are the CLOSED/compiled subset — the
+ * open UX subset (real-time/offline, deep a11y, i18n/RTL depth) is prose-owned in
+ * `references/domain-probes.md` and deliberately absent here (D-02).
+ */
+exports.UI_TAXONOMY = [
+    { id: 'empty', name: 'Empty / no data', elements: ['form', 'list-collection', 'media'], consideration: 'What is shown when there is no data — zero items, an unfilled form, or absent media?' },
+    { id: 'loading', name: 'Loading / in-flight', elements: ['form', 'list-collection', 'media', 'nav'], consideration: 'What is shown while data or content is still loading (skeleton, spinner, progressive reveal)?' },
+    { id: 'error', name: 'Error / failure', elements: ['form', 'list-collection', 'media', 'nav'], consideration: 'What is shown when the load or submit fails (message, retry affordance, partial fallback)?' },
+    { id: 'populated', name: 'Populated / happy path', elements: ['list-collection', 'media'], consideration: 'What does the normal populated (happy-path) state look like at a typical volume of content?' },
+    { id: 'partial', name: 'Partial / incomplete', elements: ['form', 'list-collection'], consideration: 'What is shown for partial or incomplete data — some fields or rows present, others missing?' },
+    { id: 'overflow', name: 'Overflow / truncation', elements: ['list-collection', 'nav', 'static-content'], consideration: 'What happens when content exceeds its container — scroll, clip, wrap, or truncate?' },
+    { id: 'zero-one-many', name: 'Zero / one / many', elements: ['list-collection'], consideration: 'How does the layout read at zero, one, and many items (singular vs plural copy, spacing)?' },
+    { id: 'long-text', name: 'Long text', elements: ['form', 'static-content', 'interactive-control', 'nav'], consideration: 'What happens with unusually long text — truncation, wrapping, ellipsis, or reflow?' },
+];
+/** Return taxonomy category ids whose applicable element kinds intersect the input set. */
+function applicableCategories(kinds) {
+    const set = new Set(kinds);
+    return exports.UI_TAXONOMY.filter((c) => c.elements.some((k) => set.has(k))).map((c) => c.id);
+}
+/**
+ * Pseudo-category for an element whose prose matched NO element cue (#1110). It is a soft
+ * "review manually" signal, NOT a 9th taxonomy category: it stays out of `UI_TAXONOMY` (the closed
+ * eight) and only joins `UI_VALIDATORS.categories` so `analyzeCoverage` accepts the item.
+ */
+exports.UNCLASSIFIED_CATEGORY = 'unclassified';
+const UNCLASSIFIED_PROBE = 'unclassified — review manually';
+/**
+ * The UI adapter's injected runtime validators (ADR-550 #5). `categories` is the closed taxonomy
+ * plus the unclassified soft-signal; both verification tiers require a non-empty `resolution` so
+ * plan-phase has a criterion to lift. NOTE the probe-core Validators field is `verification`
+ * (SINGULAR); CONTEXT.md D-05's `verifications` is a paraphrase typo, not the real field name.
+ */
+exports.UI_VALIDATORS = {
+    categories: [...exports.UI_TAXONOMY.map((c) => c.id), exports.UNCLASSIFIED_CATEGORY],
+    verification: ['explicit', 'backstop'],
+    requiredFieldsByVerification: { explicit: ['resolution'], backstop: ['resolution'] },
+};
+/**
+ * Validate a single element — the generic id/text checks (probe-core) plus the UI adapter's
+ * `elements`-must-be-an-array check. The `text` prose is REQUIRED (it is the classification
+ * signal), so reject a missing/empty `text` when no authored `elements` override is present.
+ * Without this, a `{ id }` element classifies to zero kinds → zero considerations → it is silently
+ * DROPPED from coverage. An explicit `elements` array (including `[]` for "no applicable
+ * categories") is the legitimate way to opt out of prose classification.
+ */
+function validateRequirement(element) {
+    (0, probe_core_cjs_1.validateRequirement)(element);
+    const r = element;
+    if (r.elements != null && !Array.isArray(r.elements)) {
+        throw new Error(`element ${element.id} elements must be an array when present`);
+    }
+    if (r.elements == null && !(typeof r.text === 'string' && r.text.trim())) {
+        throw new Error(`element ${element.id} text must be a non-empty string when no elements override is provided`);
+    }
+}
+/** Validate a UI-consideration resolution against the UI verification vocabulary (delegated, D-06). */
+function validateResolution(resolution) {
+    return (0, probe_core_cjs_1.validateResolution)(resolution, exports.UI_VALIDATORS);
+}
+/**
+ * Propose candidate considerations for an element. Uses authored `elements` when present, else
+ * classifies from prose. Every proposed consideration starts unresolved (verification null); the
+ * taxonomy entry's `consideration` question is carried in the item's `probe` field.
+ */
+function proposeConsiderations(element) {
+    validateRequirement(element);
+    let kinds;
+    if (Array.isArray(element.elements)) {
+        // Fail closed: an authored array must contain only locked element kinds. A non-empty but
+        // invalid array would otherwise intersect no category and silently suppress every probe — the
+        // gate reads green while nothing was checked. An empty array stays a valid "no applicable
+        // categories" override (silent opt-out).
+        for (const k of element.elements) {
+            if (typeof k !== 'string' || !exports.VALID_ELEMENT_KINDS.has(k)) {
+                throw new Error(`invalid element kind ${JSON.stringify(k)} for element ${element.id} — must be one of: ${[...exports.VALID_ELEMENT_KINDS].join(', ')}`);
+            }
+        }
+        kinds = element.elements;
+    }
+    else {
+        kinds = classifyElement(element.text);
+        if (kinds.length === 0) {
+            // Prose present but no element cue matched. Do NOT silently drop it (#1110): a UI element
+            // whose phrasing missed every cue would otherwise vanish from coverage with no signal — the
+            // exact blind spot this probe exists to catch. Surface ONE soft, dismissible "unclassified —
+            // review manually" candidate. The explicit `elements: []` opt-out (above) stays silent.
+            return [{
+                    requirement_id: element.id,
+                    category: exports.UNCLASSIFIED_CATEGORY,
+                    status: 'unresolved',
+                    verification: null,
+                    resolution: null,
+                    reason: null,
+                    probe: UNCLASSIFIED_PROBE,
+                }];
+        }
+    }
+    return applicableCategories(kinds).map((catId) => {
+        const cat = exports.UI_TAXONOMY.find((c) => c.id === catId);
+        return {
+            requirement_id: element.id,
+            category: catId,
+            status: 'unresolved',
+            verification: null,
+            resolution: null,
+            reason: null,
+            probe: cat ? cat.consideration : '',
+        };
+    });
+}
+/**
+ * Propose considerations for every element (deterministic propose), then delegate the
+ * merge/rollup/orphan-reject to probe-core. UI-specific pre-checks: elements must be an array,
+ * element ids must be unique. Throws on any invalid resolution.
+ */
+function analyzeCoverage(elements, resolutions = []) {
+    if (!Array.isArray(elements)) {
+        throw new Error('elements must be an array');
+    }
+    const items = [];
+    const seenIds = new Set();
+    for (const el of elements) {
+        validateRequirement(el);
+        if (seenIds.has(el.id)) {
+            throw new Error(`duplicate element id ${JSON.stringify(el.id)}`);
+        }
+        seenIds.add(el.id);
+        for (const consideration of proposeConsiderations(el))
+            items.push(consideration);
+    }
+    return (0, probe_core_cjs_1.analyzeCoverage)(items, resolutions, exports.UI_VALIDATORS);
+}
+/**
+ * Build the propose-then-confirm view for every element (WIRE-01). Deterministic: a pure function
+ * of the input array (no Date/random/iteration-order surprise), so re-running the probe on an
+ * unchanged UI-SPEC yields byte-identical rows (the idempotency substrate WIRE-02 relies on). An
+ * aggregating VIEW over the existing Phase-1 functions — it adds no new classification logic.
+ *
+ * `unclassified` is true ONLY when prose classified to zero cues (#1110); an explicit `elements: []`
+ * opt-out stays silent (`unclassified: false`, empty considerations), matching proposeConsiderations.
+ */
+function proposeElements(elements) {
+    return elements.map((el) => {
+        validateRequirement(el);
+        const considerations = proposeConsiderations(el);
+        const kinds = Array.isArray(el.elements)
+            ? el.elements // already validated inside proposeConsiderations
+            : classifyElement(el.text);
+        const unclassified = !Array.isArray(el.elements) && kinds.length === 0;
+        const categories = unclassified ? [] : applicableCategories(kinds);
+        return { id: el.id, kinds, categories, considerations, unclassified };
+    });
+}
+/**
+ * The deterministic `--auto` resolution FLOOR (WIRE-01, SC2). For each proposed consideration:
+ *   - an `unclassified` item stays `unresolved` — NEVER auto-backstopped (a missing cue is not
+ *     evidence a consideration applies, #1110);
+ *   - every applicable item auto-resolves to a conservative `backstop` (carrying the taxonomy
+ *     question as its `resolution` so probe-core's "backstop requires a resolution" check passes).
+ *   - it NEVER emits `dismissed` under any branch — a wrong auto-dismissal is the exact silent
+ *     failure this probe eliminates (the never-dismiss invariant, asserted on the typed return).
+ *
+ * This is the CODE floor only. It mirrors spec-phase.md Step 5.5's prose `--auto` rule
+ * (auto-`covered` where a defensible acceptance criterion can be written, else auto-`backstop`,
+ * never auto-`dismiss`) but deliberately keeps the covered-vs-backstop JUDGMENT in the ui-phase
+ * workflow (an LLM MAY upgrade an item to `explicit`/covered when it can write a real acceptance
+ * criterion). Encoding the never-dismiss FLOOR in code is what makes the invariant unit-testable;
+ * the covered-upgrade stays prose because "a defensible criterion exists" is not a code predicate.
+ * Keep the two in sync: if spec-phase's `--auto` policy changes, revisit this floor.
+ */
+function autoResolve(items) {
+    return items.map((item) => {
+        if (item.category === exports.UNCLASSIFIED_CATEGORY) {
+            return { requirement_id: item.requirement_id, category: item.category, status: 'unresolved', verification: null, resolution: null, reason: null };
+        }
+        return { requirement_id: item.requirement_id, category: item.category, status: 'resolved', verification: 'backstop', resolution: item.probe, reason: null };
+    });
+}
+/*
+ * CLI entry (invokable surface): `ui-consideration-probe.cjs <elements.json> [resolutions.json]`.
+ * The generic I/O plumbing (parse, fail-closed exit 2, pretty-JSON out) lives in probe-core's
+ * `runProbeCli`; this adapter supplies its `analyzeCoverage`. Guarded by `require.main === module`
+ * so it runs only when the compiled `.cjs` is executed directly.
+ */
+if (require.main === module) {
+    (0, probe_core_cjs_1.runProbeCli)((elements, resolutions) => analyzeCoverage(elements, resolutions), { usage: 'ui-consideration-probe.cjs <elements.json> [resolutions.json]' });
+}

package/gsd-core/bin/lib/ui-safety-gate.cjs

@@ -67,14 +67,36 @@ function checkUiPresence(text) {
     }
     // Normalise CRLF so the pattern sees consistent line boundaries.
     const normalised = text.replace(/\r\n/g, '\n');
+    // #2150: an explicit `**UI hint**: yes|no` metadata line is the author's
+    // authoritative declaration of whether the phase has a UI surface — progress.md
+    // and new-project.md already parse this line (`UI hint.*yes`). The bare token
+    // `UI` in the line itself must not count as a UI indicator, and the declaration
+    // overrides token-sniffing. Line-anchored (`m`) so a mid-line prose mention is
+    // not treated as the metadata line; word-boundary on the value so `nope`/`not`
+    // do not match `no`.
+    const hintMatch = normalised.match(/^\s*\*\*UI hint\*\*\s*:\s*(yes|no)\b/im);
+    const hint = hintMatch ? hintMatch[1].toLowerCase() : null;
+    // Strip ANY `**UI hint**:` line before token-sniffing so a hint without a
+    // recognised yes/no (or one we did not short-circuit on) cannot false-positive
+    // on the bare `UI` token.
+    const sniffable = normalised
+        .split('\n')
+        .filter((line) => !/^\s*\*\*UI hint\*\*\s*:/i.test(line))
+        .join('\n');
     const found = new Set();
-    for (const line of normalised.split('\n')) {
+    for (const line of sniffable.split('\n')) {
         // Reset lastIndex before each line so the global pattern restarts from 0.
         UI_GATE_PATTERN_GLOBAL.lastIndex = 0;
         for (const m of line.matchAll(UI_GATE_PATTERN_GLOBAL)) {
             found.add(m[2].toLowerCase());
         }
     }
+    if (hint === 'no') {
+        return { hasUI: false, tokens: [] };
+    }
+    if (hint === 'yes') {
+        return { hasUI: true, tokens: [...found] };
+    }
     return { hasUI: found.size > 0, tokens: [...found] };
 }
 // ── CLI entry point ─────────────────────────────────────────────────────────

package/gsd-core/bin/lib/verify.cjs

@@ -13,6 +13,7 @@ const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const node_os_1 = __importDefault(require("node:os"));
 const validate_cjs_1 = require("./validate.cjs");
+const clock_cjs_1 = require("./clock.cjs");
 const validate_cjs_2 = require("./validate.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports -- planning-workspace.cjs is an export= CommonJS module
 const planningWorkspace = require("./planning-workspace.cjs");
@@ -1049,7 +1050,7 @@ function cmdValidateConsistency(cwd, raw) {
                 .sort();
             for (const dir of dirs) {
                 const phasePath = node_path_1.default.join(phaseRoot, dir);
-                const phaseLabel = node_path_1.default.relative(planBase, phasePath).replace(/\\/g, '/');
+                const phaseLabel = (0, shell_command_projection_cjs_1.posixNormalize)(node_path_1.default.relative(planBase, phasePath));
                 const phaseFiles = node_fs_1.default.readdirSync(phasePath);
                 const plans = phaseFiles.filter((f) => f.endsWith('-PLAN.md')).sort();
                 const planNums = plans
@@ -1591,7 +1592,7 @@ function cmdValidateHealth(cwd, options, raw) {
                         stateContent += `**Current phase:** (determining...)\n`;
                         stateContent += `**Status:** Resuming\n\n`;
                         stateContent += `## Session Log\n\n`;
-                        stateContent += `- ${new Date().toISOString().split('T')[0]}: STATE.md regenerated by ${slash('health')} --repair\n`;
+                        stateContent += `- ${clock_cjs_1.realClock.localToday()}: STATE.md regenerated by ${slash('health')} --repair\n`;
                         writeStateMd(statePath, stateContent, cwd);
                         repairActions.push({ action: repair, success: true, path: 'STATE.md' });
                         break;
@@ -1647,7 +1648,7 @@ function cmdValidateHealth(cwd, options, raw) {
                     case 'backfillMilestones': {
                         if (!options['backfill'] && !options['repair'])
                             break;
-                        const today = new Date().toISOString().split('T')[0];
+                        const today = clock_cjs_1.realClock.localToday();
                         let backfilled = 0;
                         for (const ver of missingFromRegistry) {
                             try {

package/gsd-core/bin/lib/workstream.cjs

@@ -17,6 +17,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
+const clock_cjs_1 = require("./clock.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const io = require("./io.cjs");
 const { output, error } = io;
@@ -154,7 +155,7 @@ function cmdWorkstreamCreate(cwd, name, options, raw) {
     }
     (0, shell_command_projection_cjs_1.platformEnsureDir)(wsDir);
     (0, shell_command_projection_cjs_1.platformEnsureDir)(node_path_1.default.join(wsDir, 'phases'));
-    const today = new Date().toISOString().split('T')[0];
+    const today = clock_cjs_1.realClock.localToday();
     const stateContent = [
         '---',
         `workstream: ${slug}`,
@@ -264,7 +265,7 @@ function cmdWorkstreamComplete(cwd, name, options, raw) {
     if (active === name)
         setActiveWorkstream(cwd, null);
     const archiveDir = node_path_1.default.join(root, 'milestones');
-    const today = new Date().toISOString().split('T')[0];
+    const today = clock_cjs_1.realClock.localToday();
     let archivePath = node_path_1.default.join(archiveDir, `ws-${name}-${today}`);
     let suffix = 1;
     while (node_fs_1.default.existsSync(archivePath)) {

package/gsd-core/bin/lib/worktree-safety.cjs

@@ -440,7 +440,7 @@ function rescueSummaryArtifacts(worktreePath, repoRoot, deps) {
         // relPath is the path relative to the worktree root (e.g. ".planning/q1-SUMMARY.md")
         // Normalize to forward slashes so the Set comparison against `git status --porcelain`
         // output works on Windows too (git always emits forward slashes in porcelain output).
-        const relPath = absPath.slice(worktreePath.length).replace(/^[/\\]/, '').replace(/\\/g, '/');
+        const relPath = (0, shell_command_projection_cjs_1.posixNormalize)(absPath.slice(worktreePath.length).replace(/^[/\\]/, ''));
         // #706: skip rescue when the SUMMARY is already committed on the branch.
         // Use `git cat-file -e HEAD:<relPath>` (not `ls-files --error-unmatch`) so
         // the check is against the committed tree, not the index.  ls-files also

package/gsd-core/bin/lib/write-set.cjs

@@ -0,0 +1,38 @@
+"use strict";
+/**
+ * Write-Set — shared fail-loud parse `Result` and per-surface write-set
+ * contracts (ADR-2143, epic #2143). Pure, Node built-ins only, no I/O.
+ * Compiled by tsc to gsd-core/bin/lib/write-set.cjs.
+ *
+ * ADR-2143 §5 (fail-loud parsing, no null-swallow): seam parse operations
+ * and document-model accessors return a typed `Result<T>` — never a bare
+ * `null` a caller can mistake for "empty but fine." This is the same
+ * `{ ok: true; value: T } | { ok: false; reason: string }` shape
+ * `markdown-table.cts` already defined for `parseMarkdownTable` /
+ * `appendQuickTaskRow`; this module is now the single source of truth for
+ * it and `markdown-table.cjs` re-exports the type so existing importers of
+ * `Result` from that module keep working unchanged.
+ *
+ * NOTE: deliberately distinct from command-routing-hub's dispatch `Result`
+ * (`{ok,data}|{ok:false,kind}`) — the two never mix (different modules,
+ * different shapes, different purposes).
+ *
+ * ADR-2143 §6 (write-set results for multi-surface commands, no
+ * OR-into-one-flag): a command that mutates more than one surface returns
+ * an explicit per-surface write-set — `{ surface, applied }` outcomes — and
+ * its top-level "did this fully succeed" signal is true only if EVERY
+ * surface in the set applied. ORing independent surfaces into a single
+ * boolean is the direct anti-pattern that let a checkbox-only partial
+ * write (#2140) report full success.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.writeSetComplete = writeSetComplete;
+/**
+ * True only if the write-set is non-empty AND every surface in it applied.
+ * An empty write-set is never "complete" — there is nothing to be complete
+ * about, so treating it as vacuously true would let a no-op masquerade as
+ * a full success (the same OR-into-one-flag class ADR-2143 §6 prohibits).
+ */
+function writeSetComplete(ws) {
+    return ws.length > 0 && ws.every((o) => o.applied);
+}

package/gsd-core/bin/shared/config-schema.manifest.json

@@ -71,6 +71,8 @@
     "workflow.context_coverage_gate",
     "statusline.show_last_command",
     "statusline.context_position",
+    "statusline.show_context_tokens",
+    "statusline.show_git",
     "workflow.max_discuss_passes",
     "features.thinking_partner",
     "context",

package/gsd-core/bin/shared/model-catalog.json

@@ -38,9 +38,9 @@
       "haiku": { "model": "anthropic/claude-haiku-4-5" }
     },
     "kilo": {
-      "opus": null,
-      "sonnet": null,
-      "haiku": null
+      "opus": { "model": "anthropic/claude-opus-4-8" },
+      "sonnet": { "model": "anthropic/claude-sonnet-5" },
+      "haiku": { "model": "anthropic/claude-haiku-4-5" }
     },
     "cline": {
       "opus": null,
@@ -86,6 +86,11 @@
       "opus": null,
       "sonnet": null,
       "haiku": null
+    },
+    "pi": {
+      "opus": { "model": "claude-opus-4-8" },
+      "sonnet": { "model": "claude-sonnet-5" },
+      "haiku": { "model": "claude-haiku-4-5" }
     }
   },
   "providerPresets": {

package/gsd-core/references/checkpoints.md

@@ -9,6 +9,18 @@ Plans execute autonomously. Checkpoints formalize interaction points where human
 3. **User only does what requires human judgment** - Visual checks, UX evaluation, "does this feel right?"
 4. **Secrets come from user, automation comes from Claude** - Ask for API keys, then Claude uses them via CLI
 5. **Auto-mode bypasses verification/decision checkpoints** — When `workflow._auto_chain_active` or `workflow.auto_advance` is true in config: human-verify auto-approves, decision auto-selects first option, human-action still stops (auth gates cannot be automated)
+6. **`gate="blocking-human"` is never auto-approved** — a checkpoint carrying this gate stops for a human in *every* mode, including auto-mode, regardless of its type. Rule 5 does not apply to it.
+
+**The `gate` attribute:**
+
+| Value | Auto-mode behavior | Use for |
+|-------|--------------------|---------|
+| `gate="blocking"` | Bypassed per rule 5 (human-verify auto-approves, decision auto-selects) | The default. Post-hoc verification and implementation choices that are safe to take the recommended path on when unattended. |
+| `gate="blocking-human"` | **Never bypassed.** Stops for a human in auto-mode too. | Irreversible or trust-establishing steps a human must actually see: package-legitimacy verification before install, and any decision whose default answer would be wrong to assume. |
+
+Reach for `gate="blocking-human"` whenever auto-approving the checkpoint would defeat its purpose. If the checkpoint exists because a human must *decide* something, `blocking` is the wrong gate — auto-mode will decide it for them.
+
+The gate spans two layers, and both must honor it. `gsd-executor` refuses to auto-approve a `gate="blocking-human"` checkpoint and escalates it via `checkpoint_return_format` precisely so a human sees it; `execute-phase`'s `checkpoint_handling` step then decides what the user is actually shown. An orchestrator that dispatches on checkpoint *type* alone would auto-approve the very checkpoint the executor just refused to auto-approve, nullifying that refusal one layer up and letting an unattended `--auto` / `--chain` run install a package no human ever vetted.
 </overview>
 
 <checkpoint_types>