@opengsd/gsd-path 1.3.0 → 1.4.0

package/skills/gsd-path-docs-audit/scripts/path_config.py

@@ -174,13 +174,13 @@ def set_value(repo, scope, key, value, reset=False):
     if scope == 'project':
         state, _, _ = sibling('pipeline_state').load_state(repo)
         branch = subprocess.run(['git', '-C', str(repo), 'branch', '--show-current'],
-                                capture_output=True, text=True)
+                                capture_output=True, encoding="utf-8", errors="replace")
         if branch.returncode or not state.branch or branch.stdout.strip() != state.branch:
             raise ValueError('Run the router to bind the project branch before editing settings.')
         head = subprocess.run(['git', '-C', str(repo), 'rev-parse', '--verify', 'HEAD'], capture_output=True)
         if head.returncode == 0:
             closed = subprocess.run([sys.executable, '-B', str(Path(__file__).with_name('git_guard.py')),
-                                     'closed-milestone'], cwd=repo, capture_output=True, text=True)
+                                     'closed-milestone'], cwd=repo, capture_output=True, encoding="utf-8", errors="replace")
             if closed.returncode:
                 raise ValueError(closed.stderr.strip() or 'Cannot verify the milestone branch is open.')
     if scope == 'project' and key == 'integration':

package/skills/gsd-path-docs-audit/scripts/pipeline_git.py

@@ -23,10 +23,13 @@ sys.dont_write_bytecode = True
 from pathlib import Path
 from typing import Optional, Sequence
 
-try:
-    import _common
-except ImportError:  # pragma: no cover - package import used by tests
-    from scripts import _common
+if __package__:
+    from . import _common
+else:
+    try:
+        import _common
+    except ImportError:  # pragma: no cover - package import used by tests
+        from scripts import _common
 
 
 ARCHIVE_NAME_RE = re.compile(r"^(\d{3,})-([a-z0-9][a-z0-9-]*)$")
@@ -123,8 +126,24 @@ def is_integrate_subject(subject: str, archive_name: str, default_branch: str) -
     }
 
 
-def ship_commit_body(archive_path: str, reviewed_head: str) -> str:
-    return f"Archive: {archive_path}\nReviewed-HEAD: {reviewed_head}\n"
+MEMBER_SHIP_ROW = re.compile(
+    r"(?m)^Member-Reviewed-HEAD: (?P<name>[^@\s]+)@(?P<reviewed_head>[0-9a-f]{40})\n"
+    r"Member: (?P=name) (?P<merge>[0-9a-f]{40}) (?P<tag>\S+)$"
+)
+
+
+def ship_member_rows(body: str) -> list:
+    """Closed-member rows named by a ship body; callers compare the rebuilt body exactly."""
+    return [match.groupdict() for match in MEMBER_SHIP_ROW.finditer(body)]
+
+
+def ship_commit_body(archive_path: str, reviewed_head: str, members: Sequence[dict] = ()) -> str:
+    """The ship body; a multi-repo milestone adds each closed member in lock order."""
+    return f"Archive: {archive_path}\nReviewed-HEAD: {reviewed_head}\n" + "".join(
+        f"Member-Reviewed-HEAD: {row['name']}@{row['reviewed_head']}\n"
+        f"Member: {row['name']} {row['merge']} {row['tag']}\n"
+        for row in members
+    )
 
 
 def integrate_commit_body(
@@ -200,7 +219,7 @@ def _run_git(
     result = subprocess.run(
         ["git", "-C", str(repo), *args],
         capture_output=True,
-        text=True,
+        encoding="utf-8", errors="replace",
     )
     if check and result.returncode != 0:
         detail = result.stderr.strip() or result.stdout.strip()
@@ -319,7 +338,7 @@ def _validated_shipped_state(repo: Path) -> dict[str, object]:
             str(repo),
         ],
         capture_output=True,
-        text=True,
+        encoding="utf-8", errors="replace",
     )
     if result.returncode != 0:
         detail = result.stderr.strip() or result.stdout.strip()
@@ -446,19 +465,16 @@ def _write_bind_next_journal(path: Path, value: dict[str, object]) -> None:
         raise PipelineGitError(f"bind-next journal temporary path exists: {temporary}")
     descriptor: Optional[int] = None
     try:
-        descriptor = os.open(temporary, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
-        with os.fdopen(descriptor, "w", encoding="utf-8") as handle:
+        descriptor = os.open(
+            temporary, os.O_WRONLY | os.O_CREAT | os.O_EXCL | _common.O_BINARY, 0o600
+        )
+        with os.fdopen(descriptor, "wb") as handle:
             descriptor = None
-            json.dump(value, handle, indent=2, sort_keys=True)
-            handle.write("\n")
+            handle.write((json.dumps(value, indent=2, sort_keys=True) + "\n").encode("utf-8"))
             handle.flush()
             os.fsync(handle.fileno())
-        os.replace(temporary, path)
-        directory = os.open(path.parent, os.O_RDONLY)
-        try:
-            os.fsync(directory)
-        finally:
-            os.close(directory)
+        _common.replace(temporary, path)
+        _common.fsync_directory(path.parent)
     finally:
         if descriptor is not None:
             os.close(descriptor)
@@ -473,10 +489,13 @@ def _initial_binding_snapshot(repo: Path) -> Optional[tuple]:
         return None
     if dirty != "?? .project/STATE.md\0":
         raise PipelineGitError("primary worktree is not clean")
-    try:
-        import pipeline_state
-    except ImportError:  # pragma: no cover - package import used by tests
-        from scripts import pipeline_state
+    if __package__:
+        from . import pipeline_state
+    else:
+        try:
+            import pipeline_state
+        except ImportError:  # pragma: no cover - package import used by tests
+            from scripts import pipeline_state
 
     project = repo / ".project"
     path = project / "STATE.md"
@@ -635,6 +654,25 @@ def retire_previous_branch(
         _run_git(repo, "branch", "-d", previous_branch)
 
 
+def _retire_members(repo: Path, ship_sha: str) -> None:
+    """Retire each member the ship commit names; each step is idempotent for a resumed bind-next."""
+    message = _run_git(repo, "show", "-s", "--format=%B", ship_sha).stdout
+    rows = ship_member_rows(message)
+    if not rows:
+        return
+    if __package__:
+        from . import integration
+    else:
+        import integration
+    archive = re.search(r"(?m)^Archive: (\S+)$", message)
+    try:
+        for row in rows:
+            integration.retire_member(repo, row["name"], archive.group(1), row["reviewed_head"],
+                                      row["merge"], row["tag"])
+    except integration.ArchiveError as error:
+        raise PipelineGitError(f"member retirement failed: {error}") from error
+
+
 def bind_next_milestone_branch(
     repo: Path,
     branch: str,
@@ -868,6 +906,7 @@ def bind_next_milestone_branch(
             allow_remote_absent or journal["stage"] in {"switched", "retired"}
         ),
     )
+    _retire_members(repo, ship_sha)
     journal["stage"] = "retired"
     _write_bind_next_journal(journal_path, journal)
     return {

package/skills/gsd-path-docs-audit/scripts/pipeline_state.py

@@ -27,25 +27,35 @@ from datetime import date
 from pathlib import Path, PurePosixPath
 from typing import Iterator, Mapping, Optional, Sequence
 
-try:
-    from isolation import (
+if __package__:
+    from .isolation import (
         IsolationError,
         authorized_task_worktree,
         checkpoint as isolation_checkpoint,
         collect_artifact_recoveries,
     )
-    import _common
-    import roadmap
-except ModuleNotFoundError as error:  # pragma: no cover - package imports used by tests
-    if error.name not in {"isolation", "_common", "roadmap"}:
-        raise
-    from scripts.isolation import (
-        IsolationError,
-        authorized_task_worktree,
-        checkpoint as isolation_checkpoint,
-        collect_artifact_recoveries,
-    )
-    from scripts import _common, roadmap
+    from . import _common
+    from . import roadmap
+else:
+    try:
+        from isolation import (
+            IsolationError,
+            authorized_task_worktree,
+            checkpoint as isolation_checkpoint,
+            collect_artifact_recoveries,
+        )
+        import _common
+        import roadmap
+    except ModuleNotFoundError as error:  # pragma: no cover - package imports used by tests
+        if error.name not in {"isolation", "_common", "roadmap"}:
+            raise
+        from scripts.isolation import (
+            IsolationError,
+            authorized_task_worktree,
+            checkpoint as isolation_checkpoint,
+            collect_artifact_recoveries,
+        )
+        from scripts import _common, roadmap
 
 try:  # pragma: no cover - exercised only on Windows
     import fcntl
@@ -66,6 +76,8 @@ PHASES = (
     "shipped",
 )
 STATUSES = ("active", "done", "blocked")
+PRE_APPROVAL_KINDS = ("intent", "plan")
+PRE_APPROVAL_MARKER = "pre-approval: "
 STATE_FIELDS = (
     "pipeline",
     "project",
@@ -184,7 +196,7 @@ def _run_git(
     result = subprocess.run(
         ["git", "-C", str(repo), *arguments],
         capture_output=True,
-        text=True,
+        encoding="utf-8", errors="replace",
     )
     if check and result.returncode != 0:
         detail = result.stderr.strip() or result.stdout.strip()
@@ -410,14 +422,17 @@ def undo_transaction(repo: Path) -> Optional[dict[str, object]]:
         "archive_fingerprint",
         "discussion",
     }
+    if value.get("kind") == "member-task":
+        # A member landing undo also names the member reset it performs first.
+        expected |= {"member", "landing", "member_parent"}
     if set(value) != expected or value.get("schema") != UNDO_TRANSACTION_SCHEMA:
         raise PipelineStateError("undo transaction has invalid fields")
     if value.get("repo") != str(resolved):
         raise PipelineStateError("undo transaction belongs to another worktree")
     kind = value.get("kind")
-    if kind not in {"checkpoint", "uncommitted-archive"}:
+    if kind not in {"checkpoint", "uncommitted-archive", "member-task"}:
         raise PipelineStateError("undo transaction has invalid kind")
-    for field in ("expected_head", "parent"):
+    for field in ("expected_head", "parent") + (("landing", "member_parent") if kind == "member-task" else ()):
         field_value = value.get(field)
         if not isinstance(field_value, str) or not re.fullmatch(
             r"[0-9a-f]{40,64}", field_value
@@ -433,10 +448,12 @@ def undo_transaction(repo: Path) -> Optional[dict[str, object]]:
         raise PipelineStateError("undo transaction has invalid worktree fingerprint")
     archive = value.get("archive")
     archive_fingerprint = value.get("archive_fingerprint")
-    if kind == "checkpoint" and (
+    if kind in {"checkpoint", "member-task"} and (
         archive is not None or archive_fingerprint is not None
     ):
-        raise PipelineStateError("checkpoint undo transaction cannot name an archive")
+        raise PipelineStateError(f"{kind} undo transaction cannot name an archive")
+    if kind == "member-task" and not isinstance(value.get("member"), str):
+        raise PipelineStateError("member-task undo transaction has invalid member")
     if kind == "uncommitted-archive" and (
         not isinstance(archive, str) or ARCHIVE_RE.fullmatch(archive) is None
     ):
@@ -563,12 +580,15 @@ def _pending_answers(repo: Path) -> tuple[list[dict[str, str]], Optional[str]]:
     if not answers.exists() and not answers.is_symlink():
         return [], None
     try:
-        try:
-            from discussion_records import DiscussionError, pending_records
-        except ModuleNotFoundError as error:  # pragma: no cover - package imports used by tests
-            if error.name != "discussion_records":
-                raise
-            from scripts.discussion_records import DiscussionError, pending_records
+        if __package__:
+            from .discussion_records import DiscussionError, pending_records
+        else:
+            try:
+                from discussion_records import DiscussionError, pending_records
+            except ModuleNotFoundError as error:  # pragma: no cover - package imports used by tests
+                if error.name != "discussion_records":
+                    raise
+                from scripts.discussion_records import DiscussionError, pending_records
     except ModuleNotFoundError as error:
         if error.name not in {"scripts", "scripts.discussion_records"}:
             raise
@@ -624,6 +644,29 @@ def _completion_status(repo: Path, state: Mapping[str, object], project_dir: str
     return {"status": "verified", "proof": proof}
 
 
+def _member_status(repo: Path, state: Mapping[str, object]) -> Optional[list]:
+    """Locked members and their ship close, when this milestone has a member lock."""
+    if __package__:
+        from scripts import members
+    else:
+        import members
+    archive = state.get("archive")
+    locks = [repo / ".project" / "build" / "members.json"]
+    if isinstance(archive, str) and archive not in {"", "null"}:
+        locks.insert(0, repo / archive.rstrip("/") / "build" / "members.json")
+    lock = next((path for path in locks if path.is_file()), None)
+    if lock is None:
+        return None
+    closed = {}
+    match = re.fullmatch(r"gsd-path/M(\d{3,})", str(state.get("branch") or ""))
+    if match is not None:
+        common = Path(_run_git(repo, "rev-parse", "--path-format=absolute", "--git-common-dir").stdout.strip())
+        closed = {row["name"]: row.get("status") for row in members.milestone_member_close(common, int(match.group(1)))}
+    entries = json.loads(lock.read_text(encoding="utf-8"))["members"]
+    return [{"name": entry["name"], "branch": entry["branch"], "close": closed.get(entry["name"])}
+            for entry in entries]
+
+
 def status_state(repo: Path, project_dir: str = ".project") -> dict[str, object]:
     """Report owned state, route, and git facts without advancing a phase."""
     resolved = _repo_root(repo)
@@ -658,7 +701,8 @@ def status_state(repo: Path, project_dir: str = ".project") -> dict[str, object]
         "collect_artifact": None,
     }
     completion = _completion_status(resolved, state, project_dir)
-    return {
+    member_rows = _member_status(resolved, state) if has_git and project_dir == ".project" else None
+    result = {
         "schema": STATUS_SCHEMA,
         "advance": False,
         "completion": completion,
@@ -688,6 +732,9 @@ def status_state(repo: Path, project_dir: str = ".project") -> dict[str, object]
         "next_skill": _next_skill(route if isinstance(route, dict) else {}),
         "handoff": phase_handoff(state, route, _track_root(resolved, project_dir) / "STATE.md", completion),
     }
+    if member_rows is not None:
+        result["members"] = member_rows
+    return result
 
 
 def phase_handoff(state: Mapping[str, object], route: Mapping[str, object], path: Path,
@@ -759,7 +806,7 @@ def _valid_patch_findings(repo: Path) -> bool:
             str(repo),
         ],
         capture_output=True,
-        text=True,
+        encoding="utf-8", errors="replace",
     )
     return result.returncode == 0
 
@@ -791,6 +838,8 @@ def _selected_initial_branch(project: Path, state: PipelineState) -> str:
         if archive.is_symlink() or not archive.is_dir():
             raise PipelineStateError(f"archive root must be a real directory: {archive}")
         for child in archive.iterdir():
+            if _common.is_ignored_junk(child):
+                continue
             match = re.fullmatch(r"(\d{3,})-[a-z0-9][a-z0-9-]*", child.name)
             if (
                 child.is_symlink()
@@ -1381,8 +1430,11 @@ def _append_event(
 
 @contextlib.contextmanager
 def _state_lock(project: Path) -> Iterator[None]:
-    if fcntl is None:  # pragma: no cover - Windows CI is not used
-        raise PipelineStateError("state locking is unavailable on this platform")
+    if fcntl is None:
+        # Windows cannot flock a directory.
+        with _common.directory_mutex(project):
+            yield
+        return
     descriptor = os.open(project, os.O_RDONLY)
     try:
         fcntl.flock(descriptor, fcntl.LOCK_EX)
@@ -1408,27 +1460,21 @@ def _atomic_write(path: Path, content: str) -> None:
             and os.path.samestat(path_status, temporary_status)
         ):
             temporary.unlink()
-            directory = os.open(path.parent, os.O_RDONLY)
-            try:
-                os.fsync(directory)
-            finally:
-                os.close(directory)
+            _common.fsync_directory(path.parent)
     if temporary.exists() or temporary.is_symlink():
         raise PipelineStateError(f"atomic-write temporary path already exists: {temporary}")
     descriptor: Optional[int] = None
     try:
-        descriptor = os.open(temporary, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o666)
-        with os.fdopen(descriptor, "w", encoding="utf-8") as handle:
+        descriptor = os.open(
+            temporary, os.O_WRONLY | os.O_CREAT | os.O_EXCL | _common.O_BINARY, 0o666
+        )
+        with os.fdopen(descriptor, "wb") as handle:
             descriptor = None
-            handle.write(content)
+            handle.write(content.encode("utf-8"))
             handle.flush()
             os.fsync(handle.fileno())
-        os.replace(temporary, path)
-        directory = os.open(path.parent, os.O_RDONLY)
-        try:
-            os.fsync(directory)
-        finally:
-            os.close(directory)
+        _common.replace(temporary, path)
+        _common.fsync_directory(path.parent)
     finally:
         if descriptor is not None:
             os.close(descriptor)
@@ -1668,12 +1714,6 @@ def transition_state(
         if recovery_context and recovery_context["active"]:
             if (state.milestone, state.branch, state.archive) != (after.milestone, after.branch, after.archive):
                 raise PipelineStateError("build recovery must preserve milestone identity")
-        if state.phase == "build" and after.phase in {"define", "plan"}:
-            recovery = _build_recovery().begin(resolved, state, after, event)
-            rendered = _append_event(
-                rendered, after.phase,
-                _build_recovery().MARKER + json.dumps(recovery, sort_keys=True),
-            )
         if after.status != "blocked":
             reason = _pending_discussion_block(
                 resolved, after.phase if after.status == "active" else None
@@ -1683,10 +1723,13 @@ def transition_state(
         if state.phase in {"research", "decide"} and (
             after.phase != state.phase or after.status == "done"
         ):
-            try:
-                import check_handoffs
-            except ImportError:  # pragma: no cover - package imports used by tests
-                from scripts import check_handoffs
+            if __package__:
+                from . import check_handoffs
+            else:
+                try:
+                    import check_handoffs
+                except ImportError:  # pragma: no cover - package imports used by tests
+                    from scripts import check_handoffs
             validator = {
                 "research": check_handoffs.validate_research_artifacts,
                 "decide": check_handoffs.validate_decide_artifacts,
@@ -1695,6 +1738,15 @@ def transition_state(
                 validator(resolved, project_dir)
             except check_handoffs.HandoffError as error:
                 raise PipelineStateError(f"{state.phase} handoff failed: {error}") from error
+        if (project_dir == ".project" and (state.phase, state.status) == ("plan", "done")
+                and (after.phase, after.status) == ("build", "active")):
+            _lock_build_members(resolved)
+        if state.phase == "build" and after.phase in {"define", "plan"}:
+            recovery = _build_recovery().begin(resolved, state, after, event)
+            rendered = _append_event(
+                rendered, after.phase,
+                _build_recovery().MARKER + json.dumps(recovery, sort_keys=True),
+            )
         _atomic_write(path, rendered)
     return {
         "schema": STATE_SCHEMA,
@@ -1705,6 +1757,17 @@ def transition_state(
     }
 
 
+def _lock_build_members(repo: Path) -> None:
+    if __package__:
+        from scripts import members
+    else:
+        import members
+    try:
+        members.lock_build_members(repo)
+    except members.MembersError as error:
+        raise PipelineStateError(f"build start: {error}") from error
+
+
 def _build_recovery():
     if __package__:
         from scripts import build_recovery
@@ -1776,6 +1839,55 @@ def configure_integration(
     }
 
 
+def _log_events(text: str) -> list[str]:
+    return [line.split(" — ", 2)[-1] for line in text.splitlines()
+            if line.startswith("- ") and " — " in line]
+
+
+def pre_approve(repo: Path, grant: Optional[str], use: Optional[str]) -> dict[str, object]:
+    """Record an owner's pre-approval grant, or record one granted gate's use."""
+    resolved = _repo_root(repo)
+    project = _track_root(resolved, ".project")
+    with _state_lock(project):
+        state, text, path = load_state(resolved)
+        if grant is not None:
+            kinds = grant.split(",")
+            if not kinds or len(set(kinds)) != len(kinds) or not set(kinds) <= set(PRE_APPROVAL_KINDS):
+                raise PipelineStateError(
+                    f"pre-approval kinds must be distinct values from: {', '.join(PRE_APPROVAL_KINDS)}"
+                )
+            if state.milestone is not None:
+                raise PipelineStateError("pre-approval is granted only before milestone intent approval")
+            event = PRE_APPROVAL_MARKER + json.dumps({"kinds": kinds}, sort_keys=True)
+        else:
+            events = _log_events(text)
+            starts = [index for index, event in enumerate(events) if event.startswith(PRE_APPROVAL_MARKER)]
+            if not starts:
+                raise PipelineStateError("no pre-approval grant is recorded")
+            try:
+                recorded = json.loads(events[starts[-1]][len(PRE_APPROVAL_MARKER):])
+                kinds = recorded["kinds"]
+            except (ValueError, TypeError, KeyError) as error:
+                raise PipelineStateError("invalid pre-approval record") from error
+            if not isinstance(kinds, list):
+                raise PipelineStateError("invalid pre-approval record")
+            if (_build_recovery().context(resolved, text) or {}).get("active") or (project / "review/PATCH-FINDINGS.md").exists():
+                raise PipelineStateError("pre-approval never covers build recovery or patch planning")
+            if use not in kinds:
+                raise PipelineStateError(f"pre-approval does not grant {use}")
+            # The canonical approval event, not this record, consumes the grant.
+            approvals = events[starts[-1] + 1:].count("milestone intent approved")
+            expected = {"intent": ("define", "active", 0), "plan": ("plan", "active", 1)}[use]
+            if (state.phase, state.status, approvals) != expected or (
+                (state.milestone is None) != (use == "intent")
+            ):
+                raise PipelineStateError(f"pre-approval for {use} is used or out of scope")
+            event = f"pre-authorized approval: {use}"
+        rendered = _append_event(text, state.phase, event)
+        _atomic_write(path, rendered)
+    return {"schema": STATE_SCHEMA, "status": "recorded", "event": event, "state": state.json()}
+
+
 def _shipment_roadmap(text: str, state: PipelineState, archive: str) -> str:
     if state.milestone is None or state.branch is None:
         raise PipelineStateError("shipment state must name milestone and branch")
@@ -2016,7 +2128,8 @@ def _commit_message(subject: str, body_fields: Mapping[str, str]) -> str:
 def _validate_next_layout(next_root: Path, state: PipelineState) -> None:
     phase_index = LOOKAHEAD_PHASES.index(state.phase)
     for path in next_root.rglob("*"):
-        relative = path.relative_to(next_root)
+        # POSIX form: a WindowsPath never equals the PurePosixPath layout below.
+        relative = PurePosixPath(path.relative_to(next_root).as_posix())
         if path.is_symlink():
             raise PipelineStateError(f"lookahead artifacts must not be symlinks: {path}")
         if path.is_dir():
@@ -2028,6 +2141,8 @@ def _validate_next_layout(next_root: Path, state: PipelineState) -> None:
             continue
         if not path.is_file():
             raise PipelineStateError(f"lookahead has unsafe artifact: {path}")
+        if _common.is_ignored_junk(path):
+            continue
         artifact = relative.as_posix()
         required_phase = LOOKAHEAD_FIXED_ARTIFACTS.get(artifact)
         if required_phase is None and LOOKAHEAD_EVIDENCE_RE.fullmatch(artifact):
@@ -2112,6 +2227,11 @@ def parse_args(argv: Optional[Sequence[str]] = None) -> argparse.Namespace:
     configure.add_argument("--project-dir", default=".project")
     configure.add_argument("--scope", required=True, choices=("default", "milestone"))
     configure.add_argument("--mode", required=True, choices=INTEGRATION_MODES)
+    pre = subparsers.add_parser("pre-approve")
+    pre.add_argument("--repo", required=True, type=Path)
+    pre_mode = pre.add_mutually_exclusive_group(required=True)
+    pre_mode.add_argument("--grant")
+    pre_mode.add_argument("--use", choices=PRE_APPROVAL_KINDS)
     shipment = subparsers.add_parser("record-shipment")
     shipment.add_argument("--repo", required=True, type=Path)
     shipment.add_argument("--archive", required=True)
@@ -2200,6 +2320,8 @@ def main(argv: Optional[Sequence[str]] = None) -> int:
                 base,
                 landing,
             )
+        elif args.command == "pre-approve":
+            result = pre_approve(args.repo, args.grant, args.use)
         elif args.command == "record-shipment":
             result = record_shipment(args.repo, args.archive, args.event)
         elif args.command == "configure-integration":

package/skills/gsd-path-docs-audit/scripts/promote_lookahead.py

@@ -205,7 +205,7 @@ def select_fetched_base(
     resolved = subprocess.run(
         ["git", "-C", str(root), "rev-parse", "--verify", f"{remote_default}^{{commit}}"],
         capture_output=True,
-        text=True,
+        encoding="utf-8", errors="replace",
         check=False,
     )
     if resolved.returncode != 0 or resolved.stdout.strip() != base:

package/skills/gsd-path-docs-audit/scripts/review_panel.py

@@ -470,7 +470,7 @@ def merge_artifacts(
         lines.append(artifact["text"].rstrip())
         lines.append("")
     output.parent.mkdir(parents=True, exist_ok=True)
-    output.write_text("\n".join(lines).rstrip() + "\n", encoding="utf-8")
+    output.write_bytes(("\n".join(lines).rstrip() + "\n").encode("utf-8"))
     return {
         "output": str(output.resolve()),
         "families": families,