@opengsd/gsd-core 1.9.1 → 1.11.0

package/scripts/lib/alias-drift-families.cjs

@@ -0,0 +1,46 @@
+'use strict';
+
+/**
+ * Single source of truth for the command-alias drift surface.
+ *
+ * Two parallel surfaces consume this: `scripts/check-alias-drift.cjs`, which
+ * validates the built alias artifacts, and `.githooks/pre-commit`, which decides
+ * when to run that validation. Until #2725 the hook's watched-path list had
+ * drifted from the checker's family table until every pattern named either the
+ * retired `sdk/` tree (ADR-0174) or a gitignored build output, so the guard was
+ * silently inert. Both surfaces derive from this list now, and
+ * `tests/precommit-alias-drift-hook.test.cjs` fails if they diverge again.
+ */
+
+/**
+ * Alias families the drift check validates. `router` is the module basename,
+ * shared by the `src/<router>.cts` source and the `gsd-core/bin/lib/<router>.cjs`
+ * artifact it compiles to.
+ */
+const FAMILIES = Object.freeze([
+  { commandAliases: 'STATE_COMMAND_ALIASES', subcommands: 'STATE_SUBCOMMANDS', router: 'state-command-router' },
+  { commandAliases: 'VERIFY_COMMAND_ALIASES', subcommands: 'VERIFY_SUBCOMMANDS', router: 'verify-command-router' },
+  { commandAliases: 'INIT_COMMAND_ALIASES', subcommands: 'INIT_SUBCOMMANDS', router: 'init-command-router' },
+  { commandAliases: 'PHASE_COMMAND_ALIASES', subcommands: 'PHASE_SUBCOMMANDS', router: 'phase-command-router' },
+  { commandAliases: 'PHASES_COMMAND_ALIASES', subcommands: 'PHASES_SUBCOMMANDS', router: 'phases-command-router' },
+  { commandAliases: 'VALIDATE_COMMAND_ALIASES', subcommands: 'VALIDATE_SUBCOMMANDS', router: 'validate-command-router' },
+  { commandAliases: 'ROADMAP_COMMAND_ALIASES', subcommands: 'ROADMAP_SUBCOMMANDS', router: 'roadmap-command-router' },
+  { commandAliases: 'EVAL_COMMAND_ALIASES', subcommands: 'EVAL_SUBCOMMANDS', router: 'eval-command-router' },
+].map(Object.freeze));
+
+/** Basename of the generated alias table every family is checked against. */
+const ALIAS_TABLE = 'command-aliases';
+
+/**
+ * Repo-relative TRACKED sources whose edit should re-run the drift check.
+ *
+ * Deliberately the `src/*.cts` sources, never the `gsd-core/bin/lib/*.cjs`
+ * build outputs they compile to: those are gitignored, so
+ * `git diff --cached --name-only` can never list them and a pre-commit guard
+ * keyed on them can never fire (#2725).
+ */
+function stagedSourcePaths() {
+  return [`src/${ALIAS_TABLE}.cts`, ...FAMILIES.map((family) => `src/${family.router}.cts`)];
+}
+
+module.exports = { FAMILIES, ALIAS_TABLE, stagedSourcePaths };

package/scripts/lib/drift-scan.cjs

@@ -0,0 +1,278 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * Shared anti-divergence scanner machinery (epic #3180, ADR-3180 Decision 4).
+ *
+ * Extracted from `scripts/lint-plan-count-drift.cjs` (#3183) so that
+ * `scripts/lint-milestone-window-drift.cjs` (#3184) and any future
+ * `scripts/lint-<derivation>-drift.cjs` guard consume ONE tree-walk /
+ * root-confinement / literal-tokenizer / sanitizer implementation instead of
+ * each copying it verbatim — the exact generative-fix-divergence class this
+ * epic exists to remove, now applied to the guards themselves (see
+ * `.gsd/phase/refactor-3184-milestone-window-single-owner/40-design.md`,
+ * "Rejected: let the new drift guard copy Phase 1's tree-walk /
+ * root-confinement / sanitizer").
+ *
+ * `lint-plan-count-drift.cjs` re-exports every symbol it exported before this
+ * extraction (`readRegexLiteralAt`, `MAX_REGEX_LITERAL_LEN`, `isInsideRoot`,
+ * `sanitizeForReport`), so `tests/plan-count-single-owner.test.cjs` — the
+ * ReDoS and root-confinement regression net for this exact machinery —
+ * continues to pass unchanged and is the regression net for this move too.
+ */
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+// Longest regex literal this scanner will consider, in characters. Real
+// plan/summary filename filters (and milestone-window regex literals) are far
+// shorter; the bound is what keeps the scan linear. The tokenizer restarts at
+// every `/` on the line (so that a literal preceded by a stray unpaired `/`
+// is still found, matching the previous regex's "find anywhere" behaviour),
+// which without a per-literal bound would be quadratic on a pathological
+// line. With it the whole-line cost is O(n * MAX_REGEX_LITERAL_LEN) with no
+// backtracking at all.
+const MAX_REGEX_LITERAL_LEN = 400;
+
+// Directory names this scanner never descends into or reports out of —
+// `.git` (repo internals, e.g. a persisted CI token in `.git/config`),
+// `node_modules` (thousands of third-party files, none of them authored
+// source), `dist` (build output). Named once and used at BOTH skip sites
+// below: the cheap `entry.name` fast path in `walk`, and the resolved-path
+// component check in `isUnderSkippedDir` — a symlink whose OWN name is not
+// in this set but whose target resolves through a directory that IS (e.g.
+// `src/g -> ../.git`, `src/nm -> ../node_modules`) must still be skipped, or
+// the name-only check is a trivial bypass.
+const SKIP_DIR_NAMES = new Set(['node_modules', 'dist', '.git']);
+
+/**
+ * Read the JS regex literal starting at `line[start]` (which must be `/`).
+ * Returns `{ text, end }` — `text` includes the delimiters and any trailing
+ * flags, `end` is the index one past the literal — or null if no literal
+ * closes within MAX_REGEX_LITERAL_LEN characters.
+ *
+ * Single left-to-right pass, no backtracking. It models the two constructs a
+ * backtracking pattern gets wrong, which is why this is a tokenizer and not a
+ * regex:
+ *   - `\x` escapes consume BOTH characters, so an escaped `\/` never
+ *     terminates the literal;
+ *   - inside a `[...]` character class a bare `/` does NOT terminate, so
+ *     `/PLAN[\\/].*\.md$/` is one literal rather than two fragments. The
+ *     previous regex silently MISSED every re-derivation using a
+ *     cross-platform path-separator class for exactly this reason.
+ */
+function readRegexLiteralAt(line, start) {
+  if (line[start] !== '/') return null;
+  const limit = Math.min(line.length, start + MAX_REGEX_LITERAL_LEN);
+  let inClass = false;
+  for (let i = start + 1; i < limit; i++) {
+    const ch = line[i];
+    if (ch === '\\') {
+      i++; // escape consumes the next character, whatever it is
+      continue;
+    }
+    if (ch === '\r' || ch === '\n') return null; // a literal cannot span lines
+    if (ch === '[') {
+      inClass = true;
+    } else if (ch === ']') {
+      inClass = false;
+    } else if (ch === '/' && !inClass) {
+      // Trailing flags are bounded by the SAME `limit` as the literal body
+      // itself (not `line.length`) — a literal followed by an unbounded run
+      // of lowercase letters must not make `text` grow past
+      // MAX_REGEX_LITERAL_LEN either.
+      let end = i + 1;
+      while (end < limit && line[end] >= 'a' && line[end] <= 'z') end++;
+      return { text: line.slice(start, end), end };
+    }
+  }
+  return null;
+}
+
+// Symlinks report `isDirectory()`/`isFile()` as false on the Dirent from
+// `readdirSync`, so a symlinked `.cts` (or a symlinked directory containing
+// one) was previously invisible to this scanner — an evasion of a guard
+// whose stated design principle (ADR-3180 Decision 4a) is whole-repo
+// discovery with no allowlist. Resolve each entry with `fs.statSync` (which
+// follows symlinks) to classify it, skipping broken links. `ctx.visitedRealDirs`
+// guards against a symlink cycle sending `walk` into infinite recursion.
+//
+// Every sibling drift guard in `scripts/` that does NOT import this module
+// (`lint-phase-id-drift.cjs`, `lint-package-identity-drift.cjs`,
+// `lint-portable-timeout.cjs`, `lint-test-file-count.cjs`,
+// `lint-allow-test-rule-refs.cjs`) uses the `Dirent` classification straight
+// off `readdirSync` and does NOT follow symlinks at all. This scanner follows
+// them so a symlinked source file cannot evade ADR-3180 Decision 4a's
+// whole-repo discovery — root confinement (`isInsideRoot` below) is the price
+// of doing so: without it, a symlink planted anywhere under a scan directory
+// could walk this scanner out to read and report arbitrary files elsewhere on
+// disk.
+//
+// DIRECTORY vs FILE symlinks are confined to two DIFFERENT roots, tracked as
+// `ctx.scanDirRoot` (the realpath of the current top-level scan-dir entry,
+// e.g. `<realRoot>/src`) vs `ctx.realRoot` (the whole repo):
+//   - a DIRECTORY symlink is descended ONLY if its resolved realpath is
+//     inside `ctx.scanDirRoot` — NOT merely inside `ctx.realRoot`. Without
+//     this, `src/up -> ..` (or `-> <realRoot>`) resolves inside the repo
+//     root and `walk` descends the ENTIRE repo, reporting violations under
+//     paths like `tests/not-src.cts` or `docs/other.cts` — files the caller's
+//     scan-dir list scopes it OUT of. This is a deliberate, fail-CLOSED
+//     trade-off: a directory symlink pointing elsewhere INSIDE the repo (but
+//     outside the scan directory) is simply not followed. The alternative —
+//     descending it — is exactly the whole-repo sweep this rule exists to
+//     prevent, and a fork PR could use that sweep to redden `lint:ci` on
+//     files this guard was never meant to read. The narrower rule is worth
+//     more than the missed edge case.
+//   - a FILE symlink is still scanned if its resolved realpath is inside
+//     `ctx.realRoot` (the whole repo, not just the scan directory) — this is
+//     what keeps `src/alias.cts -> vendor/real.cts` covered (test (f)): an
+//     aliased file genuinely is part of the compiled surface even when its
+//     real target lives outside `src/`, and it is still reported under its
+//     canonical (real) path.
+//
+// A resolved path is inside a root only if it IS that root or begins with
+// root + separator — a plain `startsWith(root)` would also accept a sibling
+// directory whose name merely starts with the root's name (`/repo-evil`).
+function isInsideRoot(realPath, realRoot) {
+  return realPath === realRoot || realPath.startsWith(realRoot + path.sep);
+}
+
+// True when `realPath` (already confirmed inside `realRoot` by `isInsideRoot`)
+// resolves THROUGH a skip-list directory anywhere along its path relative to
+// the root — not just when `realPath` itself IS one. This is what closes the
+// symlink bypass the `entry.name` fast path alone cannot: `walk` tests
+// `entry.name` (the symlink's OWN name in its parent directory), but a
+// symlink named something innocuous can still RESOLVE into `.git` /
+// `node_modules` / `dist` (`src/g -> ../.git`, `src/leak.cts ->
+// ../.git/config`, `src/nm -> ../node_modules`) — `isInsideRoot` alone admits
+// all three, because every one of those real paths is still under the root.
+function isUnderSkippedDir(realPath, realRoot) {
+  const rel = path.relative(realRoot, realPath);
+  return rel.split(path.sep).some((segment) => SKIP_DIR_NAMES.has(segment));
+}
+
+// `ctx.scanExt` is a `Set` of file extensions (e.g. `.cts`/`.ts`/`.mts`) the
+// caller wants reported — threaded through `ctx` rather than as a positional
+// parameter so recursive `walk(full, acc, ctx)` calls stay unchanged.
+function walk(dir, acc, ctx) {
+  let entries;
+  try {
+    entries = fs.readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return acc;
+  }
+  for (const entry of entries) {
+    const full = path.join(dir, entry.name);
+    if (SKIP_DIR_NAMES.has(entry.name)) continue; // cheap fast path
+    let stat;
+    try {
+      stat = entry.isSymbolicLink() ? fs.statSync(full) : entry;
+    } catch {
+      continue; // broken symlink target
+    }
+    let realPath;
+    try {
+      realPath = fs.realpathSync(full);
+    } catch {
+      continue; // broken symlink target (race, or a link stat() followed but realpath cannot)
+    }
+    if (stat.isDirectory()) {
+      // Directories (symlinked or real) are confined to the CURRENT scan
+      // directory root, not merely the repo root — see the comment above
+      // `isInsideRoot` for why (`src/up -> ..` whole-repo sweep).
+      if (!isInsideRoot(realPath, ctx.scanDirRoot)) continue;
+      if (isUnderSkippedDir(realPath, ctx.realRoot)) continue; // symlink resolves through a skipped dir
+      if (ctx.visitedRealDirs.has(realPath)) continue; // symlink cycle guard
+      ctx.visitedRealDirs.add(realPath);
+      walk(full, acc, ctx);
+    } else if (stat.isFile() && ctx.scanExt.has(path.extname(entry.name))) {
+      // Files are confined to the whole repo root — a symlinked FILE whose
+      // real target lives outside the scan directory but inside the repo
+      // (e.g. `src/alias.cts -> vendor/real.cts`) is still part of the
+      // compiled surface and must be scanned.
+      if (!isInsideRoot(realPath, ctx.realRoot)) continue;
+      if (isUnderSkippedDir(realPath, ctx.realRoot)) continue; // symlink resolves through a skipped dir
+      if (ctx.visitedRealFiles.has(realPath)) continue; // two symlinks, same real file
+      ctx.visitedRealFiles.add(realPath);
+      acc.push(realPath);
+    }
+  }
+  return acc;
+}
+
+/**
+ * Whole-repo tree-walk driver shared by every `lint-<derivation>-drift.cjs`
+ * guard. Resolves `root`, walks each of `scanDirs` filtered to `scanExt`
+ * (symlink-following, root-confined, cycle-guarded — see `walk` above), reads
+ * each discovered file, and calls `onFile(relPath, text)` for it — `relPath`
+ * is repo-relative and already the file's canonical (real) path, so a
+ * per-file exemption keyed on `relPath` matches consistently regardless of
+ * which symlink reached it.
+ *
+ * `onFile` returns an array of violation objects (or an empty array / null /
+ * undefined for "no violations in this file"); `scanTree` flattens them all
+ * into one returned array. Pure I/O orchestration — detection logic lives
+ * entirely in the caller's `onFile`.
+ */
+function scanTree({ root, scanDirs, scanExt, onFile }) {
+  const violations = [];
+  let realRoot;
+  try {
+    realRoot = fs.realpathSync(root);
+  } catch {
+    return violations; // root itself does not exist / is unreadable
+  }
+  for (const dir of scanDirs) {
+    const scanDirPath = path.join(root, dir);
+    let scanDirRoot;
+    try {
+      scanDirRoot = fs.realpathSync(scanDirPath);
+    } catch {
+      continue; // scan directory itself does not exist / is unreadable
+    }
+    const ctx = { realRoot, scanDirRoot, scanExt, visitedRealDirs: new Set(), visitedRealFiles: new Set() };
+    for (const file of walk(scanDirPath, [], ctx)) {
+      const rel = path.relative(realRoot, file);
+      let text;
+      try {
+        text = fs.readFileSync(file, 'utf8');
+      } catch {
+        continue;
+      }
+      const found = onFile(rel, text);
+      if (found && found.length > 0) violations.push(...found);
+    }
+  }
+  return violations;
+}
+
+// A reported fragment AND a reported file path are both attacker-controlled
+// source text on a fork PR (a repo can legally track a filename containing
+// control bytes, so the path is exactly as attacker-controlled as the
+// fragment), and both are written straight to a CI log. Replace C0/C1
+// control bytes (ANSI escapes included) with a visible \xNN, AND the
+// non-Latin-1 formatting/bidi/line-separator codepoints below with \uNNNN, so
+// a crafted literal or filename cannot rewrite the terminal rendering of the
+// report or hide/reorder its own text:
+//   - U+200B-U+200F: zero-width space/joiners and directional marks
+//   - U+2028/U+2029: Unicode LINE SEPARATOR / PARAGRAPH SEPARATOR (line
+//     breaks a `\n`-only log scan would not catch)
+//   - U+202A-U+202E: bidi embedding/override controls (RLO etc.)
+//   - U+2066-U+2069: bidi isolate controls
+function sanitizeForReport(text) {
+  return text
+    // eslint-disable-next-line no-control-regex -- the control range IS the target
+    .replace(/[\x00-\x1f\x7f-\x9f]/g, (c) => '\\x' + c.charCodeAt(0).toString(16).padStart(2, '0'))
+    .replace(/[\u200B-\u200F\u2028\u2029\u202A-\u202E\u2066-\u2069]/g, (c) => '\\u' + c.charCodeAt(0).toString(16).padStart(4, '0'));
+}
+
+module.exports = {
+  SKIP_DIR_NAMES,
+  isInsideRoot,
+  isUnderSkippedDir,
+  walk,
+  readRegexLiteralAt,
+  MAX_REGEX_LITERAL_LEN,
+  sanitizeForReport,
+  scanTree,
+};

package/scripts/lint-allow-test-rule-refs.allowlist.json

@@ -1,8 +1,7 @@
 [
-  "tests/agent-classification-parity.test.cjs :: runtime-contract-is-the-product — docs/AGENTS.md section layout + docs/INVENTORY.md table ARE the classification surface being validated",
+  "tests/agent-classification-parity.test.cjs :: source-text-is-the-product",
   "tests/agent-frontmatter.test.cjs :: source-text-is-the-product",
   "tests/agent-required-reading-consistency.test.cjs :: source-text-is-the-product",
-  "tests/agent-size-budget.test.cjs :: source-text-is-the-product",
   "tests/agent-skills-awareness.test.cjs :: source-text-is-the-product",
   "tests/ai-evals.test.cjs :: source-text-is-the-product",
   "tests/analyze-dependencies.test.cjs :: source-text-is-the-product",
@@ -15,25 +14,19 @@
   "tests/autonomous-interactive.test.cjs :: source-text-is-the-product",
   "tests/autonomous-to-flag.test.cjs :: source-text-is-the-product",
   "tests/chain-flag-plan-phase.test.cjs :: source-text-is-the-product",
-  "tests/changeset-cli.test.cjs :: reads a product workflow .md file (not CJS source) to verify",
-  "tests/check-update-config-dir.test.cjs :: structural-regression-guard",
-  "tests/ci-test-scope.test.cjs :: CLI usage banner presence is a user-facing contract.",
-  "tests/ci-test-scope.test.cjs :: CLI usage failure text is user-facing contract for this parser guard.",
+  "tests/changeset-cli.test.cjs :: source-text-is-the-product",
   "tests/claude-md.test.cjs :: source-text-is-the-product",
-  "tests/claude-skills-migration.test.cjs :: source-text-is-the-product",
   "tests/cleanup-branch-pruning.test.cjs :: source-text-is-the-product",
   "tests/cline-install.test.cjs :: source-text-is-the-product",
   "tests/cline-support.test.cjs :: source-text-is-the-product",
-  "tests/clock-seam.test.cjs :: line 159 reads the STATE.md temp file written by readModifyWriteStateMd — this is a runtime output file assertion, not a source-grep; the API returns void so a file read-back is the only way to verify the transform was applied",
   "tests/code-review-agent-skills.test.cjs :: source-text-is-the-product",
   "tests/code-review-command.test.cjs :: source-text-is-the-product",
   "tests/code-review-pipeline-regression.test.cjs :: source-text-is-the-product",
   "tests/code-review.test.cjs :: source-text-is-the-product",
   "tests/codebuddy-install.test.cjs :: source-text-is-the-product",
   "tests/codex-config.test.cjs :: source-text-is-the-product",
-  "tests/command-contract.test.cjs :: source-text-is-the-product — commands/gsd/*.md files ARE the",
+  "tests/command-contract.test.cjs :: source-text-is-the-product",
   "tests/commands.test.cjs :: source-text-is-the-product",
-  "tests/concurrency-safety.test.cjs :: source-text-is-the-product",
   "tests/config-field-docs.test.cjs :: docs-parity",
   "tests/context-enrichment.test.cjs :: source-text-is-the-product",
   "tests/contributor-standards.test.cjs :: source-text-is-the-product",
@@ -41,24 +34,16 @@
   "tests/cursor-hooks.test.cjs :: source-text-is-the-product",
   "tests/cursor-reviewer.test.cjs :: source-text-is-the-product",
   "tests/debug-session-management.test.cjs :: source-text-is-the-product",
-  "tests/discuss-all-flag.test.cjs :: source-text-is-the-product",
   "tests/discuss-checkpoint.test.cjs :: source-text-is-the-product",
-  "tests/discuss-mode.test.cjs :: structural-implementation-guard",
   "tests/discuss-phase-power.test.cjs :: source-text-is-the-product",
   "tests/docs-parity-live-registry.test.cjs :: source-text-is-the-product",
   "tests/drift-detection.test.cjs :: source-text-is-the-product",
-  "tests/edge-probe-docs-fixtures.test.cjs :: runtime-contract-is-the-product — the rendered reference/SPEC/ADR vocab surfaces are the runtime contract; this pins their bijection to the code (docs-parity)",
-  "tests/edge-probe-planner-contract.test.cjs :: runtime-contract-is-the-product — plan-phase.md's planner prompt is the deployed runtime contract under assertion",
-  "tests/edge-probe-spec-phase-contract.test.cjs :: runtime-contract-is-the-product — spec-phase.md Step 5.5 is the deployed workflow runtime contract under assertion",
+  "tests/edge-probe-docs-fixtures.test.cjs :: source-text-is-the-product",
+  "tests/edge-probe-planner-contract.test.cjs :: source-text-is-the-product",
+  "tests/edge-probe-spec-phase-contract.test.cjs :: source-text-is-the-product",
   "tests/edit-phase.test.cjs :: source-text-is-the-product",
-  "tests/eslint-rules.test.cjs :: <source-grep reason> must still error",
-  "tests/eslint-rules.test.cjs :: pending migration",
-  "tests/eslint-rules.test.cjs :: source-text-is-the-product",
   "tests/execute-phase-active-flags.test.cjs :: source-text-is-the-product",
   "tests/execute-phase-step-5-5-deviation-doc.test.cjs :: source-text-is-the-product",
-  "tests/execute-phase-wave.test.cjs :: behavioral — calls gsd-tools and asserts structured output",
-  "tests/execute-phase-wave.test.cjs :: behavioral — exercises config-set validation, not source text",
-  "tests/execute-phase-wave.test.cjs :: behavioral — exercises gsd-tools wave-defaulting logic",
   "tests/execute-phase-wave.test.cjs :: source-text-is-the-product",
   "tests/execute-phase-worktree-artifacts.test.cjs :: source-text-is-the-product",
   "tests/explore-command.test.cjs :: source-text-is-the-product",
@@ -66,35 +51,21 @@
   "tests/forensics.test.cjs :: source-text-is-the-product",
   "tests/frontmatter-cli.test.cjs :: source-text-is-the-product",
   "tests/gates-taxonomy.test.cjs :: source-text-is-the-product",
-  "tests/git-base-branch.test.cjs :: runtime-contract-is-the-product",
-  "tests/git-base-branch.test.cjs :: runtime-contract-is-the-product — the workflow .md content IS",
-  "tests/gsd-check-update-worker-platform-gate.test.cjs :: structural assertion on spawn-options shape; the behavior",
+  "tests/git-base-branch.test.cjs :: source-text-is-the-product",
+  "tests/gsd-check-update-worker-platform-gate.test.cjs :: structural-regression-guard",
   "tests/gsd-researcher-app-aware.test.cjs :: source-text-is-the-product",
   "tests/gsd-researcher-flow-diagram.test.cjs :: source-text-is-the-product",
   "tests/gsd-settings-advanced.test.cjs :: source-text-is-the-product",
-  "tests/gsd2-import.test.cjs :: source-text-is-the-product",
+  "tests/helpers/live-command-registry.cjs :: source-text-is-the-product",
   "tests/hermes-skills-migration.test.cjs :: source-text-is-the-product",
   "tests/import-command.test.cjs :: source-text-is-the-product",
   "tests/ingest-docs.test.cjs :: source-text-is-the-product",
   "tests/inline-plan-threshold.test.cjs :: source-text-is-the-product",
-  "tests/install-minimal-hooks.test.cjs :: source-text-is-the-product",
   "tests/install-nested-layout.test.cjs :: source-text-is-the-product",
   "tests/install-runtime-artifacts.test.cjs :: source-text-is-the-product",
-  "tests/install.test.cjs :: runtime-contract-is-the-product",
-  "tests/install.test.cjs :: source-text-is-the-product",
-  "tests/intel.test.cjs :: source-text-is-the-product — agents/gsd-intel-updater.md IS the",
-  "tests/intel.test.cjs :: source-text-is-the-product — readFileSync assertions target API-SURFACE.md, which is the generated product of intelApiSurface; asserting on its text content is the only way to verify correct generation.",
-  "tests/inventory-headings-countfree.test.cjs :: runtime-contract-is-the-product — INVENTORY.md heading format is the shipped doc surface being locked",
+  "tests/intel.test.cjs :: source-text-is-the-product",
+  "tests/inventory-headings-countfree.test.cjs :: source-text-is-the-product",
   "tests/ios-scaffold-safety.test.cjs :: source-text-is-the-product",
-  "tests/issue-2639-codex-toml-neutralization.test.cjs :: source-text-is-the-product",
-  "tests/issue-429-comment-text-gate.test.cjs :: source-text-is-the-product",
-  "tests/issue-498-update-backup-runtime-dir.test.cjs :: structural assertion on the deployed update.md backup bash;",
-  "tests/issue-57-runtime-install-no-drift.test.cjs :: delegation-presence guard. Catches wholesale removal of the registry",
-  "tests/issue-57-runtime-install-no-drift.test.cjs :: structural guard over bin/install.js source. Behavioral assertions",
-  "tests/issue-607-installer-dry-run.install.test.cjs :: integration-test-input",
-  "tests/issue-607-legacy-cleanup.test.cjs :: integration-test-input",
-  "tests/issue-787-cline-hooks-agents.test.cjs :: source-text-is-the-product",
-  "tests/issue-815-update-next-channel.test.cjs :: reads product workflow/command markdown to verify the --next RC channel contract — not a source-grep test",
   "tests/locking-bugs-1909-1916-1925-1927.test.cjs :: architectural-invariant",
   "tests/mcp-tool-inheritance.test.cjs :: source-text-is-the-product",
   "tests/milestone-summary.test.cjs :: source-text-is-the-product",
@@ -103,15 +74,11 @@
   "tests/next-safety-gates.test.cjs :: source-text-is-the-product",
   "tests/next-up-clear-order.test.cjs :: source-text-is-the-product",
   "tests/no-hardcoded-home-gsd-tools.test.cjs :: source-text-is-the-product",
-  "tests/opencode-permissions.test.cjs :: architectural-invariant",
-  "tests/orphan-worktree-detection.test.cjs :: architectural-invariant",
   "tests/orphaned-hooks.test.cjs :: structural-regression-guard",
   "tests/package-legitimacy-gate.test.cjs :: source-text-is-the-product",
   "tests/parallel-dependent-plans.test.cjs :: source-text-is-the-product",
   "tests/path-replacement.test.cjs :: source-text-is-the-product",
-  "tests/phase-dependency-levels.test.cjs :: source-text-is-the-product",
   "tests/phase.test.cjs :: source-text-is-the-product",
-  "tests/phase.test.cjs :: state-md-is-the-runtime-contract — regression tests for",
   "tests/phase6-capability-docs.test.cjs :: source-text-is-the-product",
   "tests/phase6-capstone-conformance.test.cjs :: source-text-is-the-product",
   "tests/phase6-planning-capabilities.test.cjs :: source-text-is-the-product",
@@ -127,9 +94,7 @@
   "tests/product-name-purity.test.cjs :: source-text-is-the-product",
   "tests/profile-output.test.cjs :: source-text-is-the-product",
   "tests/progress-forensic.test.cjs :: source-text-is-the-product",
-  "tests/prompt-budget-cli.test.cjs :: prompt-content-is-the-product",
   "tests/prompt-thinning.test.cjs :: source-text-is-the-product",
-  "tests/quick-session-management.test.cjs :: source-text-is-the-product",
   "tests/qwen-skills-migration.test.cjs :: source-text-is-the-product",
   "tests/read-guard.test.cjs :: source-text-is-the-product",
   "tests/reapply-patches.test.cjs :: source-text-is-the-product",
@@ -137,12 +102,10 @@
   "tests/release-coverage-scope.test.cjs :: source-text-is-the-product",
   "tests/release-tarball-smoke-workflow.test.cjs :: source-text-is-the-product",
   "tests/release-tarball-smoke.install.test.cjs :: integration-test-input",
-  "tests/research-agent-profiles.test.cjs :: <runtime-contract-is-the-product> research agent .md content is the governed surface",
-  "tests/review-default-reviewers-workflow.test.cjs :: source-text-is-the-product",
+  "tests/research-agent-profiles.test.cjs :: source-text-is-the-product",
   "tests/roadmap.test.cjs :: source-text-is-the-product",
-  "tests/run-tests-harness.test.cjs :: run-tests.cjs is a CLI test harness whose only IR is its",
-  "tests/runtime-launcher-parity.test.cjs :: structural parity/drift guard — asserts literal presence/absence of the canonical gsd_run launcher and the retired $GSD_SDK / `/gsd-tools` tokens across workflow markdown; there is no typed IR for \"this source file does not contain substring X\".",
-  "tests/runtime-name-policy.test.cjs :: runtime-contract-is-the-product — FALLBACK_ALIASES source text IS the",
+  "tests/runtime-launcher-parity.test.cjs :: structural-regression-guard",
+  "tests/runtime-name-policy.test.cjs :: source-text-is-the-product",
   "tests/scan-command.test.cjs :: source-text-is-the-product",
   "tests/secret-scan-lint.security.test.cjs :: source-text-is-the-product",
   "tests/secure-phase.test.cjs :: source-text-is-the-product",
@@ -153,12 +116,10 @@
   "tests/settings-jsonc.test.cjs :: structural-regression-guard",
   "tests/skill-frontmatter-contract.test.cjs :: source-text-is-the-product",
   "tests/spawn-liveness-banner.test.cjs :: source-text-is-the-product",
-  "tests/state-acquirestatelock-non-eexist.test.cjs :: architectural-invariant",
   "tests/state.test.cjs :: source-text-is-the-product",
   "tests/subagent-timeout.test.cjs :: source-text-is-the-product",
   "tests/template.test.cjs :: source-text-is-the-product",
   "tests/thinking-partner.test.cjs :: source-text-is-the-product",
-  "tests/thread-session-management.test.cjs :: source-text-is-the-product",
   "tests/ultraplan-phase.test.cjs :: source-text-is-the-product",
   "tests/verify-health.test.cjs :: source-text-is-the-product",
   "tests/verify-test-quality.test.cjs :: source-text-is-the-product",
@@ -167,7 +128,7 @@
   "tests/workflow-compat.test.cjs :: source-text-is-the-product",
   "tests/workflow-guard-registration.test.cjs :: structural-regression-guard",
   "tests/workflow-maintainer-skip.test.cjs :: source-text-is-the-product",
-  "tests/workflow-shell-pinning.test.cjs :: file-scope prefilter, not a test assertion — we need to",
+  "tests/workflow-shell-pinning.test.cjs :: source-text-is-the-product",
   "tests/workflow-size-budget.test.cjs :: source-text-is-the-product",
   "tests/workspace.test.cjs :: source-text-is-the-product",
   "tests/worktree-cleanup.test.cjs :: source-text-is-the-product",

package/scripts/lint-allow-test-rule-refs.effective-ceiling.json

@@ -0,0 +1,4 @@
+{
+  "maxSites": 10,
+  "grace": 2
+}

package/scripts/lint-allow-test-rule-refs.unverified-ceiling.json

@@ -0,0 +1,3 @@
+{
+  "maxFiles": 280
+}

package/scripts/lint-canary-version-leak.cjs

@@ -0,0 +1,73 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * Canary-version-leak lint (DEFECT.CANARY-VERSION-LEAK, CONTEXT.md).
+ *
+ * `package.json` `.version` on `main` must never carry a `-canary.<N>`
+ * suffix — that suffix is a dev-branch/prerelease marker. Nothing published
+ * depends on the string at runtime, but every consumer of the version
+ * metadata (release flow, install banners, statusline) surfaces the
+ * dev-channel label as if it were the shipped release. The 2026-05-16 audit
+ * found `origin/main` at `"version": "1.50.0-canary.0"`, landed by a fix PR
+ * that accidentally carried a version bump from a dev-branch base (commit
+ * 2d32ad82, #3206).
+ *
+ * Modeled on scripts/lint-package-identity-drift.cjs / scripts/lint-table-schema-drift.cjs:
+ * a standalone node script (not a node:test), exit 0 clean / exit 1 + message
+ * on a leaked canary version. Wired to run only for PRs targeting `main`
+ * (.github/workflows/version-gate.yml) — a canary version is expected and
+ * harmless on every other branch.
+ */
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const CANARY_RE = /-canary\.\d+/;
+
+/**
+ * Pure: does this version string carry a `-canary.<N>` suffix?
+ * @param {string} version
+ * @returns {boolean}
+ */
+function isCanaryVersion(version) {
+  return typeof version === 'string' && CANARY_RE.test(version);
+}
+
+/**
+ * Read `<root>/package.json` and return its `.version`, or null if the file
+ * is missing/unreadable/unparsable.
+ * @param {string} root
+ * @returns {string|null}
+ */
+function readPackageVersion(root) {
+  try {
+    const raw = fs.readFileSync(path.join(root, 'package.json'), 'utf8');
+    const pkg = JSON.parse(raw);
+    return typeof pkg.version === 'string' ? pkg.version : null;
+  } catch {
+    return null;
+  }
+}
+
+function main() {
+  const root = path.join(__dirname, '..');
+  const version = readPackageVersion(root);
+  if (version == null) {
+    process.stderr.write('canary-version-leak: could not read/parse package.json .version\n');
+    process.exitCode = 1;
+    return;
+  }
+  if (!isCanaryVersion(version)) {
+    process.stdout.write(`ok canary-version-leak: package.json version '${version}' carries no -canary.<N> suffix\n`);
+    return;
+  }
+  process.stderr.write(`canary-version-leak: package.json version '${version}' carries a -canary.<N> suffix (DEFECT.CANARY-VERSION-LEAK).\n`);
+  process.stderr.write('A -canary.<N> version must never land on main. Reset .version to the canonical\n');
+  process.stderr.write('pre-canary stable before merging — see CONTEXT.md DEFECT.CANARY-VERSION-LEAK.\n');
+  process.exitCode = 1;
+}
+
+if (require.main === module) main();
+
+module.exports = { isCanaryVersion, readPackageVersion, CANARY_RE };