@opengsd/gsd-path 1.3.1 → 1.4.0

package/scripts/runtime_store.py

@@ -8,6 +8,7 @@ from pathlib import Path
 import shutil
 import shlex
 import tempfile
+import time
 from contextlib import contextmanager
 
 try:
@@ -22,10 +23,33 @@ RUNTIME_FILES = (
     "review_panel.py", "_common.py", "worktree_paths.py", "build_recovery.py",
     "state_checkpoint.py", "state_promote.py", "discussion_validate.py", "integration.py",
     "build_state.py", "lean_verification.py", "check_docs_audit.py",
-    "path_config.py", "model_policy.py", "loop_run.py",
+    "path_config.py", "model_policy.py", "loop_run.py", "members.py",
 )
 GUARDS = ("guard_hook.py", "git_guard.py")
 
+# Access denied and sharing violation: on Windows a scanner or indexer that
+# briefly opens a freshly written file blocks renaming the directory holding it.
+_WINDOWS_BUSY_ERRORS = (5, 32)
+_RENAME_ATTEMPTS = 20
+
+
+def _rename_directory(source, destination):
+    """Path.rename, retried while Windows briefly holds a file inside ``source``."""
+    if os.name != "nt":
+        source.rename(destination)
+        return
+    for attempt in range(_RENAME_ATTEMPTS):
+        try:
+            source.rename(destination)
+            return
+        except PermissionError as error:
+            # Never retry onto a directory that appeared meanwhile.
+            if (getattr(error, "winerror", None) not in _WINDOWS_BUSY_ERRORS
+                    or os.path.lexists(destination)
+                    or attempt == _RENAME_ATTEMPTS - 1):
+                raise
+            time.sleep(min(0.01 * 2 ** attempt, 0.25))
+
 
 def guard_launcher(name):
     if name not in GUARDS:
@@ -41,7 +65,7 @@ def guard_launcher(name):
 
 
 def source_manifest(source):
-    version = json.loads((source / "package.json").read_text())["version"]
+    version = json.loads((source / "package.json").read_text(encoding="utf-8"))["version"]
     files = {}
     for name in (*RUNTIME_FILES, *GUARDS, "status_runtime.py"):
         path = source / "scripts" / name
@@ -107,7 +131,7 @@ def publish(source, *, expected=None, dry_run=False, repair=False):
             shutil.copyfile(source / "scripts" / name, staging / name)
             if hashlib.sha256((staging / name).read_bytes()).hexdigest() != digest:
                 raise ValueError(f"runtime source changed while installing: {name}")
-        (staging / "manifest.json").write_text(pin_text(manifest), encoding="utf-8")
+        (staging / "manifest.json").write_bytes(pin_text(manifest).encode("utf-8"))
         # Serialize publication/repair, including two explicit restorations.
         previous = Path(temporary) / "previous"
         with publication_lock(parent, pin["digest"]):
@@ -118,13 +142,13 @@ def publish(source, *, expected=None, dry_run=False, repair=False):
                 except ValueError:
                     if not repair:
                         raise
-                    destination.rename(previous)
+                    _rename_directory(destination, previous)
             try:
-                staging.rename(destination)
+                _rename_directory(staging, destination)
                 status_runtime.validate_runtime(pin)
             except BaseException:
                 if previous.exists() and not destination.exists():
-                    previous.rename(destination)
+                    _rename_directory(previous, destination)
                 raise
     return pin
 
@@ -167,7 +191,7 @@ def recover_migration(project):
         return
     if journal.is_symlink():
         raise ValueError(f"unsafe runtime migration journal: {journal}")
-    data = json.loads(journal.read_text())
+    data = json.loads(journal.read_text(encoding="utf-8"))
     recorded_project = data.get("project")
     if (data.get("schema") != "gsd-path/runtime-migration/v1"
             or not isinstance(recorded_project, str)
@@ -208,8 +232,10 @@ def operate(source, project, action, *, dry_run=False):
         pin = publish(source, dry_run=dry_run)
         if not dry_run:
             launcher = project / ".gsd-path/status_runtime.py"
-            original = launcher.read_text(encoding="utf-8")
-            replacement = (source / "scripts/status_runtime.py").read_text(encoding="utf-8")
+            # Exact bytes: read_text() would turn CRLF into LF, leaving the
+            # launcher unequal to the runtime's byte-for-byte copy.
+            original = launcher.read_bytes().decode("utf-8")
+            replacement = (source / "scripts/status_runtime.py").read_bytes().decode("utf-8")
             # Both launchers understand the same declaration schema. Publishing
             # the compatible launcher first leaves the old selection usable.
             if replacement != original:

package/scripts/skill-resources.json

@@ -55,6 +55,7 @@
     "scripts/integration.py",
     "scripts/archive_milestone.py",
     "scripts/bootstrap_repository.py",
+    "scripts/members.py",
     "scripts/detect_project.py",
     "scripts/promote_lookahead.py",
     "scripts/discussion_records.py",
@@ -100,6 +101,7 @@
   "phase_resources": {
     "gsd-path-build": [
       "references/runtime-selection.md",
+      "references/operating-rules.md",
       "references/build-recovery.md",
       "references/build-native.md",
       "references/build-abandon.md",
@@ -120,11 +122,13 @@
     ],
     "gsd-path-discuss": [
       "references/runtime-selection.md",
+      "references/operating-rules.md",
       "templates/answers.md",
       "templates/dialogue.md"
     ],
     "gsd-path-docs-audit": [
       "references/runtime-selection.md",
+      "references/operating-rules.md",
       "references/dispatch.md",
       "references/model-policy.md",
       "references/docs-auditor.md",
@@ -132,6 +136,7 @@
     ],
     "gsd-path-define": [
       "references/runtime-selection.md",
+      "references/operating-rules.md",
       "references/build-recovery.md",
       "templates/charter.md",
       "templates/intent.md",
@@ -139,6 +144,7 @@
     ],
     "gsd-path-inspect": [
       "references/runtime-selection.md",
+      "references/operating-rules.md",
       "references/codebase-mapper.md",
       "references/dispatch.md",
       "references/model-policy.md",
@@ -148,17 +154,21 @@
       "templates/state.md"
     ],
     "gsd-path-forensics": [
-      "references/runtime-selection.md"
+      "references/runtime-selection.md",
+      "references/operating-rules.md"
     ],
     "gsd-path-migrate": [
-      "references/runtime-selection.md"
+      "references/runtime-selection.md",
+      "references/operating-rules.md"
     ],
     "gsd-path-loop": [
       "references/runtime-selection.md",
+      "references/operating-rules.md",
       "templates/loop.md"
     ],
     "gsd-path-plan": [
       "references/runtime-selection.md",
+      "references/operating-rules.md",
       "references/build-recovery.md",
       "references/dispatch.md",
       "references/model-policy.md",
@@ -170,6 +180,7 @@
     ],
     "gsd-path-research": [
       "references/runtime-selection.md",
+      "references/operating-rules.md",
       "references/dispatch.md",
       "references/model-policy.md",
       "references/researcher.md",
@@ -178,6 +189,7 @@
     ],
     "gsd-path-roadmap": [
       "references/runtime-selection.md",
+      "references/operating-rules.md",
       "references/dispatch.md",
       "references/model-policy.md",
       "references/roadmapper.md",
@@ -185,6 +197,7 @@
     ],
     "gsd-path-ship": [
       "references/runtime-selection.md",
+      "references/operating-rules.md",
       "references/dispatch.md",
       "references/model-policy.md",
       "references/reviewer.md",
@@ -202,13 +215,15 @@
     ],
     "gsd-path-decide": [
       "references/runtime-selection.md",
+      "references/operating-rules.md",
       "references/dispatch.md",
       "references/model-policy.md",
       "references/decider.md",
       "templates/synthesis.md"
     ],
     "gsd-path-undo": [
-      "references/runtime-selection.md"
+      "references/runtime-selection.md",
+      "references/operating-rules.md"
     ]
   },
   "script_targets": [
@@ -259,6 +274,16 @@
     ["scripts/discussion_validate.py", "skills/gsd-path-ship/scripts/discussion_validate.py"],
     ["scripts/integration.py", "skills/gsd-path-ship/scripts/integration.py"],
     ["scripts/bootstrap_repository.py", "skills/gsd-path/scripts/bootstrap_repository.py"],
+    ["scripts/members.py", "skills/gsd-path/scripts/members.py"],
+    ["scripts/members.py", "skills/gsd-path-build/scripts/members.py"],
+    ["scripts/members.py", "skills/gsd-path-decide/scripts/members.py"],
+    ["scripts/members.py", "skills/gsd-path-define/scripts/members.py"],
+    ["scripts/members.py", "skills/gsd-path-docs-audit/scripts/members.py"],
+    ["scripts/members.py", "skills/gsd-path-inspect/scripts/members.py"],
+    ["scripts/members.py", "skills/gsd-path-plan/scripts/members.py"],
+    ["scripts/members.py", "skills/gsd-path-research/scripts/members.py"],
+    ["scripts/members.py", "skills/gsd-path-roadmap/scripts/members.py"],
+    ["scripts/members.py", "skills/gsd-path-ship/scripts/members.py"],
     ["scripts/detect_project.py", "skills/gsd-path/scripts/detect_project.py"],
     ["scripts/detect_project.py", "skills/gsd-path-define/scripts/detect_project.py"],
     ["scripts/detect_project.py", "skills/gsd-path-inspect/scripts/detect_project.py"],

package/scripts/state_checkpoint.py

@@ -17,12 +17,15 @@ from datetime import date
 from pathlib import Path, PurePosixPath
 from typing import Mapping, Optional, Sequence
 
-try:
-    from isolation import IsolationError, checkpoint as isolation_checkpoint, require_commit, require_full_sha, PROJECT_ENTRIES
-except ModuleNotFoundError as error:  # pragma: no cover - package imports used by tests
-    if error.name != "isolation":
-        raise
-    from scripts.isolation import IsolationError, checkpoint as isolation_checkpoint, require_commit, require_full_sha, PROJECT_ENTRIES
+if __package__:
+    from .isolation import IsolationError, checkpoint as isolation_checkpoint, require_commit, require_full_sha, PROJECT_ENTRIES
+else:
+    try:
+        from isolation import IsolationError, checkpoint as isolation_checkpoint, require_commit, require_full_sha, PROJECT_ENTRIES
+    except ModuleNotFoundError as error:  # pragma: no cover - package imports used by tests
+        if error.name != "isolation":
+            raise
+        from scripts.isolation import IsolationError, checkpoint as isolation_checkpoint, require_commit, require_full_sha, PROJECT_ENTRIES
 
 
 if __package__:
@@ -66,6 +69,11 @@ def _sha256(content: str) -> str:
     return hashlib.sha256(content.encode("utf-8")).hexdigest()
 
 
+def _is_junk_file(path: Path) -> bool:
+    # Drift digests skip OS junk by name: Finder rewrites it whatever its ignore status.
+    return path.name in pipeline_state._common.OS_JUNK_NAMES and path.is_file() and not path.is_symlink()
+
+
 def _tree_digest(path: Path, excluded: Sequence[str] = ()) -> str:
     if path.is_symlink() or not path.is_dir():
         raise PipelineStateError(f"promotion path must be a real directory: {path}")
@@ -74,7 +82,7 @@ def _tree_digest(path: Path, excluded: Sequence[str] = ()) -> str:
         if child.is_symlink():
             raise PipelineStateError(f"promotion path contains a symlink: {child}")
         relative = child.relative_to(path).as_posix()
-        if PurePosixPath(relative).parts[0] in excluded:
+        if PurePosixPath(relative).parts[0] in excluded or _is_junk_file(child):
             continue
         if child.is_dir():
             digest.update(f"d\0{relative}\0".encode())
@@ -87,15 +95,15 @@ def _tree_digest(path: Path, excluded: Sequence[str] = ()) -> str:
 
 
 def _checkpoint_artifact_digest(project: Path, mutable_paths: set[str]) -> str:
-    """Hash every approval artifact except the helper-owned metadata files."""
+    """Hash approval artifacts except helper-owned metadata and OS junk."""
     digest = hashlib.sha256()
     for child in sorted(project.rglob("*")):
         if child.is_symlink():
             raise PipelineStateError(f"checkpoint path contains a symlink: {child}")
         relative = child.relative_to(project).as_posix()
-        # Unsupported entries (OS junk) are refused by the checkpoint itself; leaving them
-        # out lets a refused approval resume after the owner removes them.
-        if relative in mutable_paths or relative.split("/", 1)[0] not in PROJECT_ENTRIES:
+        # Finder can rewrite OS junk during approval; it must not cause artifact drift.
+        if (relative in mutable_paths or relative.split("/", 1)[0] not in PROJECT_ENTRIES
+                or _is_junk_file(child)):
             continue
         if child.is_dir():
             digest.update(f"d\0{relative}\0".encode())
@@ -333,11 +341,7 @@ def _converge_checkpoint_file(path: Path, before: str, after: str, label: str) -
 
 def _unlink_checkpoint_journal(path: Path) -> None:
     path.unlink()
-    descriptor = os.open(path.parent, os.O_RDONLY)
-    try:
-        os.fsync(descriptor)
-    finally:
-        os.close(descriptor)
+    pipeline_state._common.fsync_directory(path.parent)
 
 
 def _resume_checkpoint_locked(
@@ -439,41 +443,103 @@ def _validate_plan_briefs(repo: Path, kind: str, project_dir: str) -> None:
     if head.returncode != 0:
         # Pre-Git approval defers base-dependent checks to build.
         return
-    try:
-        from check_task_briefs import BriefError, validate_task_briefs
-    except ModuleNotFoundError as error:  # pragma: no cover - package imports
-        if error.name != "check_task_briefs":
-            raise
-        from scripts.check_task_briefs import BriefError, validate_task_briefs
-    try:
-        import check_handoffs
-    except ModuleNotFoundError as error:
-        if error.name != "check_handoffs":
-            raise
-        from scripts import check_handoffs
+    if __package__:
+        from .check_task_briefs import BriefError, _member_bases, validate_task_briefs
+    else:
+        try:
+            from check_task_briefs import BriefError, _member_bases, validate_task_briefs
+        except ModuleNotFoundError as error:  # pragma: no cover - package imports
+            if error.name != "check_task_briefs":
+                raise
+            from scripts.check_task_briefs import BriefError, _member_bases, validate_task_briefs
+    if __package__:
+        from . import check_handoffs
+    else:
+        try:
+            import check_handoffs
+        except ModuleNotFoundError as error:
+            if error.name != "check_handoffs":
+                raise
+            from scripts import check_handoffs
     try:
         tasks, dependency_files = check_handoffs.plan_brief_inputs(repo, project_dir)
         landed_bases = {}
+        member_base = _member_bases(repo)
         for task_id, text in tasks.items():
             if check_handoffs._task_scalar(text, task_id, "status") != "done":
                 continue
             agent = check_handoffs._task_scalar(text, task_id, "agent")
             if agent in {"", "null"}:
                 raise BriefError(f"{task_id} landed task has no recorded agent")
+            member = check_handoffs._strict_frontmatter(text, task_id).get("repo")
+            base_repo = repo
+            if member is not None:
+                located = member_base(member) if isinstance(member, str) and member else None
+                if located is None:
+                    raise BriefError(f"repo: names no member in MEMBERS.md: {member}")
+                base_repo = located[0]
             recorded_base = check_handoffs._task_scalar(text, task_id, "base")
             try:
-                landed_bases[task_id] = require_commit(repo, require_full_sha(recorded_base))
+                landed_bases[task_id] = require_commit(base_repo, require_full_sha(recorded_base))
             except IsolationError as error:
                 raise BriefError(f"{task_id} landed task has invalid historical base: {error}") from error
             dependency_files[task_id] = set()
         validate_task_briefs(
             repo, head.stdout.strip(), f"{project_dir}/tasks",
             dependency_files=dependency_files, landed_bases=landed_bases,
+            member_base=member_base,
         )
+        if project_dir == ".project/next":
+            # Promotion checks lookahead member tasks from the bases their briefs were checked at.
+            named = {
+                str(check_handoffs._strict_frontmatter(text, task_id).get("repo"))
+                for task_id, text in tasks.items()
+                if check_handoffs._strict_frontmatter(text, task_id).get("repo")
+                and check_handoffs._task_scalar(text, task_id, "status") != "done"
+            }
+            if named:
+                bases = {name: member_base(name)[1] for name in sorted(named)}
+                milestone = pipeline_state.load_state(repo, project_dir)[0].milestone
+                path = _lookahead_member_bases_path(repo, str(milestone))
+                path.parent.mkdir(parents=True, exist_ok=True)
+                pipeline_state._common.atomic_write(path, json.dumps(
+                    {"schema": LOOKAHEAD_MEMBER_BASES_SCHEMA, "milestone": milestone, "bases": bases},
+                    indent=2, sort_keys=True) + "\n")
     except (BriefError, check_handoffs.HandoffError) as error:
         raise PipelineStateError(f"task brief validation failed: {error}") from error
 
 
+LOOKAHEAD_MEMBER_BASES_SCHEMA = "gsd-path/lookahead-member-bases/v1"
+
+
+def _lookahead_member_bases_path(repo: Path, milestone: str) -> Path:
+    common = pipeline_state._run_git(repo, "rev-parse", "--path-format=absolute", "--git-common-dir").stdout.strip()
+    return Path(common) / "gsd-path" / "lookahead-member-bases" / f"{milestone}.json"
+
+
+def _lookahead_member_bases(repo: Path, milestone: str) -> Optional[dict]:
+    path = _lookahead_member_bases_path(repo, milestone)
+    if not path.is_file():
+        return None
+    value = json.loads(path.read_text(encoding="utf-8"))
+    if value.get("schema") != LOOKAHEAD_MEMBER_BASES_SCHEMA or value.get("milestone") != milestone:
+        return None
+    return value.get("bases")
+
+
+def _shipped_member_merges(repo: Path, landing: str) -> dict:
+    """Member merges named by the ship commit the integration landing merged."""
+    if __package__:
+        from .pipeline_git import ship_member_rows
+    else:
+        from pipeline_git import ship_member_rows
+    ship = pipeline_state._run_git(repo, "rev-parse", "--verify", "--quiet", f"{landing}^2", check=False)
+    if ship.returncode != 0:
+        return {}
+    message = pipeline_state._run_git(repo, "show", "-s", "--format=%B", ship.stdout.strip()).stdout
+    return {row["name"]: row["merge"] for row in ship_member_rows(message)}
+
+
 def checkpoint_approval(
     repo: Path,
     kind: str,
@@ -1027,6 +1093,46 @@ def _classify_plan_drift(
         }
     approved = _approved_task_contracts(repo, checkpoint)
     current = _task_contracts_at(repo, revision)
+    if __package__:
+        from . import check_handoffs
+    else:
+        import check_handoffs
+    # Member task paths live in member repos: compare each member from the base its brief
+    # was checked at to the member merge the shipped milestone made (both fixed commits).
+    task_repos = {
+        task_id: str(check_handoffs._strict_frontmatter(contract.text, contract.path).get("repo") or "")
+        for task_id, contract in approved.items()
+    }
+    active_member_tasks = {
+        task_id for task_id, name in task_repos.items()
+        if name and check_handoffs._task_scalar(approved[task_id].text, task_id, "status") != "done"
+    }
+    active_members = {task_repos[task_id] for task_id in active_member_tasks}
+    member_changes: dict[str, list] = {}
+    if active_members:
+        bases = _lookahead_member_bases(repo, str(state.milestone)) or {}
+        if any(name not in bases for name in active_members):
+            return {
+                "class": "unverifiable",
+                "checkpoint": checkpoint,
+                "task_ids": [],
+                "changed_paths": [],
+                "contract_paths": [],
+                "member_tasks": True,
+                "reason": "member bases were not recorded at plan approval",
+            }
+        if __package__:
+            from . import members
+        else:
+            import members
+        checkouts = {item["name"]: Path(item["checkout"]) for item in members.read_members(repo)}
+        merges = _shipped_member_merges(repo, landing or revision)
+        for name in active_members:
+            member_changes[name] = [
+                item for item in pipeline_state._run_git(
+                    checkouts[name], "diff", "--no-renames", "--name-only", "-z", bases[name], merges[name]
+                ).stdout.split("\0") if item
+            ] if name in merges else []
 
     contract_paths: set[str] = set()
     flagged_ids: set[str] = set()
@@ -1050,9 +1156,12 @@ def _classify_plan_drift(
 
     product_paths: set[str] = set()
     for task_id, contract in approved.items():
+        member = task_repos.get(task_id)
+        if member and task_id not in active_member_tasks:
+            continue
         matches = sorted(
-            changed_path
-            for changed_path in changed
+            (f"{member}:{changed_path}" if member else changed_path)
+            for changed_path in (member_changes[member] if member else changed)
             if any(
                 changed_path == path
                 or changed_path.startswith(f"{path.rstrip('/')}/")

package/scripts/state_promote.py

@@ -82,6 +82,8 @@ def _promotion_event(
         if isinstance(task_ids, list) and task_ids:
             return f"{prefix}; plan drift flagged tasks {', '.join(task_ids)}"
         return f"{prefix}; plan contract changed after approval"
+    if drift_class == "unverifiable" and drift.get("member_tasks"):
+        return f"{prefix}; plan drift unverifiable because member bases were not recorded at plan approval"
     if drift_class == "unverifiable":
         return f"{prefix}; plan drift unverifiable because approval checkpoint is missing"
     return prefix

package/scripts/status_runtime.py

@@ -29,7 +29,7 @@ def process_identity(pid: int):
     else:
         command = ["ps", "-o", "lstart=", "-p", str(pid)]
     try:
-        result = subprocess.run(command, capture_output=True, text=True, check=False)
+        result = subprocess.run(command, capture_output=True, encoding="utf-8", errors="replace", check=False)
     except OSError:
         return None
     value = result.stdout.strip()
@@ -45,11 +45,39 @@ def runtime_identity(runtime: Path):
 
 
 def process_alive(pid: int) -> bool:
+    """Whether pid names a running process, without signalling it.
+
+    Windows os.kill(pid, 0) sends CTRL_C_EVENT, so Windows asks the kernel.
+    status_runtime and install carry verbatim copies (they cannot import this
+    module); tests/test_common_platform.py keeps them identical.
+    """
+    if pid <= 0:
+        return False
+    if os.name != "nt":
+        try:
+            os.kill(pid, 0)
+        except OSError as error:
+            return error.errno == errno.EPERM
+        return True
+    import ctypes
+    from ctypes import wintypes
+
+    kernel32 = ctypes.WinDLL("kernel32", use_last_error=True)
+    kernel32.OpenProcess.restype = wintypes.HANDLE
+    kernel32.OpenProcess.argtypes = (wintypes.DWORD, wintypes.BOOL, wintypes.DWORD)
+    kernel32.GetExitCodeProcess.argtypes = (wintypes.HANDLE, ctypes.POINTER(wintypes.DWORD))
+    kernel32.CloseHandle.argtypes = (wintypes.HANDLE,)
+    handle = kernel32.OpenProcess(0x1000, False, pid)  # PROCESS_QUERY_LIMITED_INFORMATION
+    if not handle:
+        # ERROR_ACCESS_DENIED: a protected process exists but refuses the query.
+        return ctypes.get_last_error() == 5
     try:
-        os.kill(pid, 0)
-    except OSError as error:
-        return error.errno == errno.EPERM
-    return True
+        code = wintypes.DWORD()
+        if not kernel32.GetExitCodeProcess(handle, ctypes.byref(code)):
+            return True
+        return code.value == 259  # STILL_ACTIVE
+    finally:
+        kernel32.CloseHandle(handle)
 
 
 def install_lock_active(lock: Path) -> bool:
@@ -196,7 +224,9 @@ def main(argv: Sequence[str] = sys.argv[1:]) -> int:
         return 2
     if args.runtime_path:
         try:
-            print(resolve_runtime(args.repo.resolve()))
+            # Forward slashes: agents paste this into Git Bash on Windows, where
+            # unquoted backslashes are escapes.
+            print(resolve_runtime(args.repo.resolve()).as_posix())
             return 0
         except (OSError, ValueError) as error:
             print(str(error), file=sys.stderr)

package/scripts/sync_skill_resources.py

@@ -129,8 +129,8 @@ def divergence_warning(source: Path, destination: Path, root: Path) -> Optional[
     if destination.stat().st_mtime > source.stat().st_mtime:
         return (
             f"generated resource diverges from canonical and is newer "
-            f"(possible wrong-direction edit; edit {source.relative_to(root)} "
-            f"instead): {destination.relative_to(root)}"
+            f"(possible wrong-direction edit; edit {source.relative_to(root).as_posix()} "
+            f"instead): {destination.relative_to(root).as_posix()}"
         )
     return None
 
@@ -166,9 +166,9 @@ def mismatches(root: Path) -> Sequence[str]:
         problems.append("package.json files do not match manifest package_files")
     for source, destination in resource_pairs(root):
         if not source.is_file():
-            problems.append(f"missing canonical resource: {source.relative_to(root)}")
+            problems.append(f"missing canonical resource: {source.relative_to(root).as_posix()}")
         elif not destination.is_file():
-            problems.append(f"missing generated resource: {destination.relative_to(root)}")
+            problems.append(f"missing generated resource: {destination.relative_to(root).as_posix()}")
         else:
             try:
                 expected = materialized_resource_bytes(source, destination)
@@ -181,10 +181,10 @@ def mismatches(root: Path) -> Sequence[str]:
                     problems.append(warning)
                 else:
                     problems.append(
-                        f"stale generated resource: {destination.relative_to(root)}"
+                        f"stale generated resource: {destination.relative_to(root).as_posix()}"
                     )
     for path in package_metadata(root):
-        problems.append(f"unexpected package metadata: {path.relative_to(root)}")
+        problems.append(f"unexpected package metadata: {path.relative_to(root).as_posix()}")
     return problems
 
 
@@ -216,7 +216,8 @@ def synchronize(root: Path) -> int:
     package_path = root / "package.json"
     package = json.loads(package_path.read_text(encoding="utf-8"))
     package["files"] = list(PACKAGE_FILES)
-    package_path.write_text(json.dumps(package, indent=2) + "\n", encoding="utf-8")
+    # Bytes, so Windows text mode never writes CRLF.
+    package_path.write_bytes((json.dumps(package, indent=2) + "\n").encode("utf-8"))
     print(
         json.dumps(
             {

package/scripts/token_budget.py

@@ -10,12 +10,16 @@ import json
 import sys
 from pathlib import Path
 
-try:
-    from _common import atomic_write
-    from loop_run import log_lock
-except ModuleNotFoundError:  # pragma: no cover - package imports
-    from scripts._common import atomic_write
-    from scripts.loop_run import log_lock
+if __package__:
+    from ._common import atomic_write
+    from .loop_run import log_lock
+else:
+    try:
+        from _common import atomic_write
+        from loop_run import log_lock
+    except ModuleNotFoundError:  # pragma: no cover - package imports
+        from scripts._common import atomic_write
+        from scripts.loop_run import log_lock
 
 
 SCHEMA = "gsd-path/token-budget/v1"
@@ -97,14 +101,14 @@ def operate(args):
                       "task_limit": args.task_limit, "session_limit": args.session_limit,
                       "authority": args.authority}
             if ledger.exists():
-                data = json.loads(ledger.read_text())
+                data = json.loads(ledger.read_text(encoding="utf-8"))
                 if any(data.get(key) != value for key, value in policy.items()):
                     raise ValueError("existing session policy differs; configuration cannot reset usage")
             else:
                 data = {**policy, "observations": {}}
                 atomic_write(ledger, json.dumps(data, indent=2) + "\n")
             return {"status": "configured", "hard_cap_supported": False}
-        data = json.loads(ledger.read_text())
+        data = json.loads(ledger.read_text(encoding="utf-8"))
         if data.get("schema") != SCHEMA or data.get("host") != "codex-cli":
             raise ValueError("unsupported budget ledger")
         if args.action == "record":