@opengsd/gsd-core 1.9.1 → 1.11.0

package/gsd-core/bin/lib/review-reviewer-selection.cjs

@@ -27,12 +27,14 @@
  * three-namespace trap (`id` must be kebab; `slug` keeps the shipped roster's
  * snake form).
  *
- * `runtime.hostBehaviors.reviewerCli: true` survives as a DERIVED LEGACY ALIAS
- * for one release (D9): a capability that only sets the flag (no `reviewer`
- * body yet) still contributes its capability id as a slug, exactly as before
- * this phase. Where a capability carries BOTH a declared body and the alias,
- * the BODY WINS — that capability contributes only the body's slug, never
- * both. Alias removal is a named later phase (#2801), not done here.
+ * `runtime.hostBehaviors.reviewerCli` is GONE (Phase 7, #2801). It survived one
+ * release as a derived legacy alias — a capability setting only the flag
+ * contributed its capability id as a slug — and that window closed when 1.10.0
+ * shipped after Phase 5a's 1.9.0. A declared `reviewer` body is now the ONLY
+ * route onto the roster. A manifest still carrying the key contributes no lane
+ * and is told so: `collectReviewerWarnings`
+ * (`gsd-core/bin/lib/capability-validator.cjs`) emits a removal notice on both
+ * the build-time registry generation and the third-party overlay load path.
  *
  * Before this phase the five non-runtime reviewers (`gemini`, `coderabbit`,
  * `ollama`, `lm_studio`, `llama_cpp`) had no `capabilities/<id>/` descriptor at
@@ -59,19 +61,17 @@ exports.resolveReviewerSelection = resolveReviewerSelection;
  *
  * Reads `registry.capabilities` — every declared capability regardless of
  * role — because a `role: "reviewer"` lane-only capability is never stored in
- * `registry.runtimes` (that map is role:"runtime" only). Per capability: a
- * declared `reviewer.slug` wins outright (D9) and the capability contributes
- * ONLY that slug; only when there is no body does the legacy
- * `hostBehaviors.reviewerCli` alias contribute the capability id instead. The
+ * `registry.runtimes` (that map is role:"runtime" only). A capability
+ * contributes exactly one slug — its declared `reviewer.slug` — or none. The
  * result is collected into a Set (so a slug can never appear twice, even if
  * two distinct capabilities somehow named the same one) and returned as a
- * SORTED array, so the roster's order never depends on `Object.entries()`
+ * SORTED array, so the roster's order never depends on `Object.values()`
  * iteration / registry build order.
  */
 function deriveReviewerSlugs(registry) {
     const capabilities = registry.capabilities || {};
     const slugs = new Set();
-    for (const [capId, cap] of Object.entries(capabilities)) {
+    for (const cap of Object.values(capabilities)) {
         // Trim before the emptiness test: `length > 0` alone admits a whitespace-only
         // slug ("   ") verbatim into the roster, where it can never match a real lane
         // but still occupies a roster entry. Unreachable through the checked-in
@@ -79,13 +79,8 @@ function deriveReviewerSlugs(registry) {
         // other validation, so it should not depend on its caller's hygiene.
         const rawSlug = cap?.reviewer?.slug;
         const declaredSlug = typeof rawSlug === 'string' ? rawSlug.trim() : '';
-        if (declaredSlug.length > 0) {
+        if (declaredSlug.length > 0)
             slugs.add(declaredSlug);
-            continue; // the body wins — never ALSO add this capability's alias below.
-        }
-        if (cap?.runtime?.hostBehaviors?.reviewerCli === true) {
-            slugs.add(capId);
-        }
     }
     return [...slugs].sort();
 }

package/gsd-core/bin/lib/roadmap-command-router.cjs

@@ -24,6 +24,15 @@ const { planningDir } = planningWorkspace;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const configLoaderMod = require("./config-loader.cjs");
 const { loadConfig } = configLoaderMod;
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const cliExitMod = require("./cli-exit.cjs");
+const { ExitError } = cliExitMod;
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const roadmapParserMod = require("./roadmap-parser.cjs");
+const { extractCurrentMilestoneScoped } = roadmapParserMod;
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const planningScopeMod = require("./planning-scope.cjs");
+const { SCOPE } = planningScopeMod;
 // ─── W021 Implementation ──────────────────────────────────────────────────────
 /**
  * Check each phase entry in a milestone-prefixed ROADMAP.md for W021 violations.
@@ -106,16 +115,72 @@ function routeRoadmapCommand({ roadmap, args, cwd, raw, error }) {
         handlers: {
             'get-phase': () => roadmap.cmdRoadmapGetPhase(cwd, args[2], raw),
             analyze: () => roadmap.cmdRoadmapAnalyze(cwd, raw),
+            // #3262: read-only milestone-window identity probe — the capture/compare
+            // signal for the edit-phase workflow's write-time milestone-scope guard.
+            'milestone-scope': () => roadmap.cmdRoadmapMilestoneScope(cwd, raw),
             'update-plan-progress': () => roadmap.cmdRoadmapUpdatePlanProgress(cwd, args[2], raw),
             'annotate-dependencies': () => roadmap.cmdRoadmapAnnotateDependencies(cwd, args[2], raw),
             'validate': () => {
                 const roadmapPath = node_path_1.default.join(planningDir(cwd), 'ROADMAP.md');
-                let roadmapContent = '';
+                const warnings = [];
+                // #2978: structural validation. A verb named "validate" that cannot
+                // produce a negative result provides false assurance. Before the
+                // opt-in milestone-prefix check, verify the file is structurally a
+                // roadmap at all.
+                let roadmapContent;
                 try {
                     roadmapContent = node_fs_1.default.readFileSync(roadmapPath, 'utf8');
                 }
                 catch {
-                    // ROADMAP.md missing — return empty warnings
+                    // ROADMAP.md missing — not silent success.
+                    warnings.push({ code: 'V001', message: 'ROADMAP.md not found or unreadable' });
+                    const result = { warnings };
+                    process.stdout.write(raw ? JSON.stringify(result) : JSON.stringify(result, null, 2));
+                    throw new ExitError(1);
+                }
+                // Empty or whitespace-only.
+                if (roadmapContent.trim() === '') {
+                    warnings.push({ code: 'V002', message: 'ROADMAP.md is empty' });
+                }
+                // Malformed frontmatter — a `---` opener with no matching closer.
+                // Tolerate a leading BOM (#3057) before the fence.
+                const contentAfterBom = roadmapContent.replace(/^\uFEFF/, '');
+                if (contentAfterBom.startsWith('---')) {
+                    const closeMatch = contentAfterBom.slice(3).match(/\r?\n---\s*(\r?\n|$)/);
+                    if (!closeMatch) {
+                        warnings.push({ code: 'V003', message: 'ROADMAP.md frontmatter is malformed (unterminated --- fence)' });
+                    }
+                }
+                // No recognizable phase structure — at least one `### Phase N:` heading.
+                // Mirrors the phase-heading pattern used across roadmap-parser.cts.
+                const hasPhaseEntry = /^#{2,4}\s*Phase\s+\S/im.test(roadmapContent);
+                if (!hasPhaseEntry && !warnings.some((w) => w.code === 'V002')) {
+                    warnings.push({ code: 'V004', message: 'ROADMAP.md contains no recognizable phase entries (no "### Phase N:" headings)' });
+                }
+                // #3263: a whole-document phase check (V004 above) is satisfied by a
+                // document whose phase entries live OUTSIDE the active milestone's
+                // resolved window — e.g. an intervening version-bearing heading closes
+                // the window before its own `### Phase N:` sections. That truncation
+                // is exactly what the #3184 scope discriminator classifies, so ask
+                // the single owner (never re-derive the window shape here —
+                // lint-milestone-window-drift bans local copies) and surface a
+                // non-COMPLETE-but-not-empty verdict. TRUNCATED only: a genuinely
+                // phase-less milestone classifies COMPLETE (V004 owns that case) and
+                // an unscoped/unreadable window is a different failure mode with a
+                // different remediation, deliberately not warned here.
+                try {
+                    const scoped = extractCurrentMilestoneScoped(contentAfterBom, cwd);
+                    if (scoped.scope === SCOPE.TRUNCATED) {
+                        warnings.push({
+                            code: 'V005',
+                            message: 'Active milestone window is truncated: phase entries exist in ROADMAP.md but are excluded from the ' +
+                                'active milestone\'s resolved window (check for a heading between the milestone heading and its "### Phase N:" sections)',
+                        });
+                    }
+                }
+                catch {
+                    // The classifier is best-effort here — a throw must not mask the
+                    // structural warnings already collected above.
                 }
                 // W021 only fires when phase_id_convention is explicitly 'milestone-prefixed'.
                 // Authoritative source: .planning/config.json (set by the upgrade command).
@@ -141,14 +206,16 @@ function routeRoadmapCommand({ roadmap, args, cwd, raw, error }) {
                         }
                     }
                 }
-                const warnings = (convention === 'milestone-prefixed')
-                    ? checkW021(roadmapContent)
-                    : [];
+                if (convention === 'milestone-prefixed') {
+                    warnings.push(...checkW021(roadmapContent));
+                }
                 const result = { warnings };
-                if (raw)
-                    process.stdout.write(JSON.stringify(result));
-                else
-                    process.stdout.write(JSON.stringify(result, null, 2));
+                process.stdout.write(raw ? JSON.stringify(result) : JSON.stringify(result, null, 2));
+                // #2978: exit non-zero on any warning, per the documented contract
+                // ("exits non-zero on any error or warning").
+                if (warnings.length > 0) {
+                    throw new ExitError(1);
+                }
             },
             'upgrade': () => {
                 const dryRun = !args.includes('--apply');