@opengsd/gsd-path 1.4.0 → 1.6.0

package/scripts/skill-resources.json

@@ -10,7 +10,8 @@
     "cursor": {"local_root": ".cursor/skills", "guard_tier": "native-fail-closed", "child_apis": ["Task"]},
     "zed": {"local_root": ".agents/skills", "guard_tier": "git-only", "invocation_prefix": "/", "child_apis": ["spawn_agent"]},
     "kiro": {"local_root": ".kiro/skills", "guard_tier": "git-only", "child_apis": ["invoke_sub_agent"]},
-    "kimi": {"local_root": ".kimi-code/skills", "guard_tier": "git-only", "child_apis": ["Agent"]}
+    "kimi": {"local_root": ".kimi-code/skills", "guard_tier": "git-only", "child_apis": ["Agent"]},
+    "muse": {"local_root": ".agents/skills", "guard_tier": "git-only", "invocation_prefix": "/", "child_apis": ["muse.subagent_spawn"]}
   },
   "skills": [
     "gsd-path",
@@ -96,7 +97,9 @@
     "skills/",
     "platforms/",
     "AGENTS.md",
-    "WORKFLOW.md"
+    "WORKFLOW.md",
+    "!**/__pycache__/**",
+    "!**/*.pyc"
   ],
   "phase_resources": {
     "gsd-path-build": [
@@ -114,6 +117,7 @@
       "references/reviewer-skeptic.md",
       "references/reviewer-final.md",
       "references/reviewer-panel.md",
+      "references/spec-probes.md",
 
       "templates/task.md",
       "templates/wave-review.md",
@@ -138,6 +142,7 @@
       "references/runtime-selection.md",
       "references/operating-rules.md",
       "references/build-recovery.md",
+      "references/spec-probes.md",
       "templates/charter.md",
       "templates/intent.md",
       "templates/state.md"
@@ -173,6 +178,7 @@
       "references/dispatch.md",
       "references/model-policy.md",
       "references/planner.md",
+      "references/spec-probes.md",
       "templates/patch-findings.md",
       "templates/plan.md",
       "templates/plan-panel.md",
@@ -206,6 +212,7 @@
       "references/reviewer-skeptic.md",
       "references/reviewer-final.md",
       "references/reviewer-panel.md",
+      "references/spec-probes.md",
 
       "templates/archive-manifest.md",
       "templates/final-review.md",

package/scripts/state_checkpoint.py

@@ -18,14 +18,14 @@ from pathlib import Path, PurePosixPath
 from typing import Mapping, Optional, Sequence
 
 if __package__:
-    from .isolation import IsolationError, checkpoint as isolation_checkpoint, require_commit, require_full_sha, PROJECT_ENTRIES
+    from .isolation import IsolationError, checkpoint as isolation_checkpoint, PROJECT_ENTRIES
 else:
     try:
-        from isolation import IsolationError, checkpoint as isolation_checkpoint, require_commit, require_full_sha, PROJECT_ENTRIES
+        from isolation import IsolationError, checkpoint as isolation_checkpoint, PROJECT_ENTRIES
     except ModuleNotFoundError as error:  # pragma: no cover - package imports used by tests
         if error.name != "isolation":
             raise
-        from scripts.isolation import IsolationError, checkpoint as isolation_checkpoint, require_commit, require_full_sha, PROJECT_ENTRIES
+        from scripts.isolation import IsolationError, checkpoint as isolation_checkpoint, PROJECT_ENTRIES
 
 
 if __package__:
@@ -164,9 +164,16 @@ def _approval_details(
     raise PipelineStateError(f"unsupported approval kind: {kind}")
 
 
-def _reslice_roadmap(before: str, candidate: str, state: PipelineState, selected: str) -> str:
+def _reslice_roadmap(
+    repo: Path, before: str, candidate: str, state: PipelineState, state_text: str, selected: str,
+) -> str:
+    # Define may amend its active entry until intent approval. A return to
+    # define after that approval always leaves an active recovery record.
+    amend_active = state.phase == "define" and not (
+        pipeline_state._build_recovery().context(repo, state_text) or {}
+    ).get("active")
     try:
-        return roadmap.reslice(before, candidate, state.phase, selected)
+        return roadmap.reslice(before, candidate, state.phase, selected, amend_active)
     except roadmap.RoadmapError as error:
         raise PipelineStateError(str(error)) from error
 
@@ -223,6 +230,10 @@ def _approval_journal(repo: Path, journal: Mapping[str, object]) -> dict[str, ob
         expected_keys.add("baseline_before")
         if not isinstance(journal.get("baseline_before"), str):
             raise PipelineStateError("checkpoint journal has an invalid re-slice baseline")
+    if "recovery_reviews" in journal:
+        expected_keys.add("recovery_reviews")
+        if journal.get("kind") != "plan" or not isinstance(journal["recovery_reviews"], dict):
+            raise PipelineStateError("checkpoint journal has an invalid recovery review report")
     if set(journal) != expected_keys:
         raise PipelineStateError("checkpoint journal has invalid fields")
     if journal.get("schema") != CHECKPOINT_SCHEMA or journal.get("repo") != str(repo):
@@ -307,7 +318,8 @@ def _approval_journal(repo: Path, journal: Mapping[str, object]) -> dict[str, ob
         if journal["roadmap_path"] != ".project/ROADMAP.md":
             raise PipelineStateError("checkpoint journal has an invalid ROADMAP path")
         expected_roadmap = _reslice_roadmap(
-            str(journal["baseline_before"]), str(journal["roadmap_before"]), before, str(selected),
+            repo, str(journal["baseline_before"]), str(journal["roadmap_before"]), before,
+            str(journal["state_before"]), str(selected),
         ) if journal["kind"] == "roadmap-reslice" else _activate_roadmap_milestone(
             str(journal["roadmap_before"]),
             str(selected),
@@ -423,7 +435,7 @@ def _resume_checkpoint_locked(
         raise PipelineStateError("approval checkpoint returned the wrong commit")
     _unlink_checkpoint_journal(journal_path)
     state = pipeline_state._state_from_text(str(transaction["state_after"]))
-    return {
+    approved: dict[str, object] = {
         "schema": CHECKPOINT_SCHEMA,
         "status": "approved",
         "kind": transaction["kind"],
@@ -432,6 +444,9 @@ def _resume_checkpoint_locked(
         "paths": committed.get("paths"),
         "state": state.json(),
     }
+    if "recovery_reviews" in transaction:
+        approved["recovery_reviews"] = transaction["recovery_reviews"]
+    return approved
 
 
 def _validate_plan_briefs(repo: Path, kind: str, project_dir: str) -> None:
@@ -444,14 +459,14 @@ def _validate_plan_briefs(repo: Path, kind: str, project_dir: str) -> None:
         # Pre-Git approval defers base-dependent checks to build.
         return
     if __package__:
-        from .check_task_briefs import BriefError, _member_bases, validate_task_briefs
+        from .check_task_briefs import BriefError, _member_bases, plan_validation_bases, validate_task_briefs
     else:
         try:
-            from check_task_briefs import BriefError, _member_bases, validate_task_briefs
+            from check_task_briefs import BriefError, _member_bases, plan_validation_bases, validate_task_briefs
         except ModuleNotFoundError as error:  # pragma: no cover - package imports
             if error.name != "check_task_briefs":
                 raise
-            from scripts.check_task_briefs import BriefError, _member_bases, validate_task_briefs
+            from scripts.check_task_briefs import BriefError, _member_bases, plan_validation_bases, validate_task_briefs
     if __package__:
         from . import check_handoffs
     else:
@@ -462,28 +477,10 @@ def _validate_plan_briefs(repo: Path, kind: str, project_dir: str) -> None:
                 raise
             from scripts import check_handoffs
     try:
-        tasks, dependency_files = check_handoffs.plan_brief_inputs(repo, project_dir)
-        landed_bases = {}
         member_base = _member_bases(repo)
-        for task_id, text in tasks.items():
-            if check_handoffs._task_scalar(text, task_id, "status") != "done":
-                continue
-            agent = check_handoffs._task_scalar(text, task_id, "agent")
-            if agent in {"", "null"}:
-                raise BriefError(f"{task_id} landed task has no recorded agent")
-            member = check_handoffs._strict_frontmatter(text, task_id).get("repo")
-            base_repo = repo
-            if member is not None:
-                located = member_base(member) if isinstance(member, str) and member else None
-                if located is None:
-                    raise BriefError(f"repo: names no member in MEMBERS.md: {member}")
-                base_repo = located[0]
-            recorded_base = check_handoffs._task_scalar(text, task_id, "base")
-            try:
-                landed_bases[task_id] = require_commit(base_repo, require_full_sha(recorded_base))
-            except IsolationError as error:
-                raise BriefError(f"{task_id} landed task has invalid historical base: {error}") from error
-            dependency_files[task_id] = set()
+        tasks, dependency_files, landed_bases = plan_validation_bases(
+            repo, project_dir, member_base, initial=True
+        )
         validate_task_briefs(
             repo, head.stdout.strip(), f"{project_dir}/tasks",
             dependency_files=dependency_files, landed_bases=landed_bases,
@@ -581,7 +578,10 @@ def checkpoint_approval(
             f"{expected_head}^{{commit}}",
         ).stdout.strip()
         if resolved_head != expected_head:
-            raise PipelineStateError("expected-head must be an exact full commit SHA")
+            raise PipelineStateError(
+                "expected-head must be an exact full commit SHA; "
+                "resolve a ref or a short SHA with git rev-parse first"
+            )
         if pipeline_state._run_git(resolved, "rev-parse", "HEAD").stdout.strip() != expected_head:
             raise PipelineStateError("approval must start at expected-head")
         active_state, _, _ = pipeline_state.load_state(resolved)
@@ -596,8 +596,9 @@ def checkpoint_approval(
         state, state_before, state_path = pipeline_state.load_state(resolved, project_dir)
         changes, event, subject, body = _approval_details(kind, state, selected_milestone)
         _validate_plan_briefs(resolved, kind, project_dir)
+        recovery_reviews = None
         if kind == "plan" and project_dir == ".project":
-            pipeline_state._build_recovery().restore_unchanged_reviews(resolved)
+            recovery_reviews = pipeline_state._build_recovery().restore_unchanged_reviews(resolved)
         expected = {
             "phase": state.phase,
             "status": state.status,
@@ -629,7 +630,7 @@ def checkpoint_approval(
             if kind == "roadmap-reslice":
                 baseline_before = pipeline_state._read_real_file(project / "ROADMAP.before-reslice.md", "re-slice baseline")
             roadmap_after = _reslice_roadmap(
-                baseline_before, roadmap_before, state, selected_milestone,
+                resolved, baseline_before, roadmap_before, state, state_before, selected_milestone,
             ) if kind == "roadmap-reslice" else _activate_roadmap_milestone(
                 roadmap_before,
                 selected_milestone,
@@ -659,6 +660,8 @@ def checkpoint_approval(
         }
         if baseline_before is not None:
             journal["baseline_before"] = baseline_before
+        if recovery_reviews is not None:
+            journal["recovery_reviews"] = recovery_reviews
         pipeline_state._write_json(journal_path, journal)
         return _resume_checkpoint_locked(resolved, project, journal_path, journal)
 
@@ -740,8 +743,8 @@ def defer_approval(
             if kind == "roadmap-reslice":
                 baseline = project / "ROADMAP.before-reslice.md"
                 roadmap_after = _reslice_roadmap(
-                    pipeline_state._read_real_file(baseline, "re-slice baseline"),
-                    roadmap_before, state, selected_milestone,
+                    resolved, pipeline_state._read_real_file(baseline, "re-slice baseline"),
+                    roadmap_before, state, state_before, selected_milestone,
                 )
             else:
                 roadmap_after = _activate_roadmap_milestone(roadmap_before, selected_milestone)

package/scripts/state_promote.py

@@ -377,17 +377,22 @@ def _prepare_promotion(
     head = pipeline_state._run_git(repo, "rev-parse", "HEAD").stdout.strip()
     if head != base:
         raise PipelineStateError(f"promotion must start at base SHA: {head} != {base}")
-    remote = pipeline_state._run_git(repo, "rev-parse", "--verify", "origin/main^{commit}").stdout.strip()
+    active_state, active_text, _ = pipeline_state.load_state(repo)
+    remote_default = f"origin/{active_state.default_branch}"
+    remote = pipeline_state._run_git(
+        repo, "rev-parse", "--verify", f"{remote_default}^{{commit}}"
+    ).stdout.strip()
     if remote != base:
         raise PipelineStateError(
-            f"base SHA is not current origin/main: {base} != {remote}"
+            f"base SHA is not current {remote_default}: {base} != {remote}"
         )
     if not pipeline_state._is_ancestor(repo, landing, base):
-        raise PipelineStateError("landing is not an ancestor of the current main base")
+        raise PipelineStateError(
+            f"landing is not an ancestor of the current {active_state.default_branch} base"
+        )
     if pipeline_state._run_git(repo, "status", "--porcelain", "--untracked-files=all").stdout:
         raise PipelineStateError("promotion must start from a clean worktree")
 
-    active_state, active_text, _ = pipeline_state.load_state(repo)
     if active_state.phase != "shipped" or active_state.status != "done":
         raise PipelineStateError("promotion requires active STATE shipped/done")
     if active_state.milestone is None:
@@ -456,6 +461,12 @@ def _prepare_promotion(
         raise PipelineStateError(
             "lookahead integration_default does not match the active project"
         )
+    if next_state.default_branch != active_state.default_branch:
+        raise PipelineStateError(
+            "lookahead default_branch does not match the active project: copy "
+            f"`default_branch: {active_state.default_branch}` from .project/STATE.md "
+            "into .project/next/STATE.md"
+        )
     if next_state.milestone != milestone:
         raise PipelineStateError(
             f"requested milestone {milestone} != next STATE milestone {next_state.milestone}"

package/scripts/status_runtime.py

@@ -6,6 +6,7 @@ import hashlib
 import errno
 import json
 import os
+import stat
 import subprocess
 import sys
 import time
@@ -151,7 +152,17 @@ def validate_runtime(data: dict) -> Path:
             path = root / name
             if path.is_symlink() or hashlib.sha256(path.read_bytes()).hexdigest() != expected:
                 raise ValueError(f"runtime file changed: {name}")
-        if set(p.name for p in root.iterdir()) != set(files) | {"manifest.json"}:
+        runtime_entries = set()
+        for path in root.iterdir():
+            if path.name == "__pycache__":
+                if not stat.S_ISDIR(path.lstat().st_mode):
+                    raise ValueError("unexpected runtime files")
+                for cached in path.iterdir():
+                    if cached.suffix != ".pyc" or not stat.S_ISREG(cached.lstat().st_mode):
+                        raise ValueError("unexpected runtime files")
+                continue
+            runtime_entries.add(path.name)
+        if runtime_entries != set(files) | {"manifest.json"}:
             raise ValueError("unexpected runtime files")
     except (OSError, ValueError, TypeError) as error:
         raise ValueError(hint + f" ({error})") from error
@@ -167,8 +178,13 @@ def run_guard(repo: Path, name: str) -> None:
     root = resolve_runtime(repo)
     sys.dont_write_bytecode = True
     sys.path.insert(0, str(root))
-    code = compile((root / name).read_bytes(), str(root / name), "exec")
-    exec(code, {"__name__": "__main__", "__file__": str(repo / ".gsd-path" / name)})
+    previous_pycache_prefix = sys.pycache_prefix
+    sys.pycache_prefix = str(root / "manifest.json")
+    try:
+        code = compile((root / name).read_bytes(), str(root / name), "exec")
+        exec(code, {"__name__": "__main__", "__file__": str(repo / ".gsd-path" / name)})
+    finally:
+        sys.pycache_prefix = previous_pycache_prefix
 
 
 def launch(repo: Path) -> int:
@@ -179,7 +195,9 @@ def launch(repo: Path) -> int:
         except (OSError, ValueError) as error:
             print(str(error), file=sys.stderr)
             return 2
-        return subprocess.call([sys.executable, "-B", str(runtime), "status", "--repo", str(repo)],
+        return subprocess.call([sys.executable, "-B", "-X",
+                                f"pycache_prefix={runtime.parent / 'manifest.json'}",
+                                str(runtime), "status", "--repo", str(repo)],
                                env={**os.environ, "GIT_OPTIONAL_LOCKS": "0"})
     runtime = parent / "runtime" / "pipeline_state.py"
     lock = repo / ".gsd-path-install-lock"

package/scripts/task_context.py

@@ -1,23 +1,27 @@
 #!/usr/bin/env python3
+# gsd-path project runtime
 """Render a read-only coder intent view from the approved task and intent."""
 
 import argparse
 import hashlib
 import re
 import sys
+sys.dont_write_bytecode = True
 from pathlib import Path
 
 try:
     from scripts import check_handoffs as contracts
+    from scripts import _common
 except ImportError:
     import check_handoffs as contracts
+    import _common
 
 
 def render(repo: Path, task: Path) -> str:
     intent_path = repo.resolve() / '.project/intent/INTENT.md'
     task = task.resolve()
-    intent = intent_path.read_bytes().decode('utf-8')
-    task_text = task.read_bytes().decode('utf-8')
+    intent = _common.read_user_text(intent_path)
+    task_text = _common.read_user_text(task)
     owned = contracts._owned_criteria(task_text, task.stem)
     criteria = contracts._success_criteria(intent)
     unknown = set(owned) - set(criteria)
@@ -40,7 +44,14 @@ def render(repo: Path, task: Path) -> str:
         if simple:
             before, after = intent[:section.start('body')], intent[section.end('body'):]
             # Corrections and task interfaces can explicitly refer to another SC.
-            required = set(owned) | set(re.findall(r'\bSC\d+\b', before + after + task_text))
+            # The spec-probe tables name every SC by design, so they select nothing.
+            scanned = re.sub(r'(?ms)^## (?:Edge coverage|Prohibitions)[ \t]*\n.*?(?=^## |\Z)', '',
+                             before + after)
+            required = set(owned) | set(re.findall(r'\bSC\d+\b', scanned + task_text))
+            # An owned criterion's edge or prohibition ruled into another SC needs that SC's text.
+            for rows in (contracts.edge_coverage(intent, criteria), contracts.prohibitions(intent, criteria)):
+                required |= {row['target'] for row in (rows or {}).values()
+                             if row['target'] and row['criterion'] in owned}
             selected = ''.join(chunk for item, chunk in zip(items, chunks) if f'SC{item[1]}' in required)
             projected = before + '\n' + (selected or '- No criteria assigned.\n\n') + after
             mode = 'owned-criteria'

package/scripts/wizard.mjs

@@ -15,6 +15,7 @@ export const HOST_LABELS = {
   zed: "Zed",
   kiro: "Kiro",
   kimi: "Kimi Code",
+  muse: "Muse Code",
 };
 
 // ponytail: hand-drawn block letters; no figlet dependency.

package/scripts/workflow_run.py

@@ -77,7 +77,7 @@ def run_workflow(repo: Path, action: str, project_dir: str, expected_head: str =
         head = subprocess.run(["git", "rev-parse", "--verify", "HEAD"],
                               cwd=repo, capture_output=True, encoding="utf-8", errors="replace", check=True).stdout.strip()
         step("check_task_briefs.py", "--repo", str(repo), "--base", head,
-             "--tasks-dir", f"{project_dir}/tasks")
+             "--tasks-dir", f"{project_dir}/tasks", "--project-dir", project_dir)
         panel = ["validate-plan", "--plan", str(repo / project_dir / "plan/PLAN.md"),
                  "--intent", str(repo / project_dir / "intent/INTENT.md")]
         charter = repo / ".project/CHARTER.md"
@@ -199,7 +199,7 @@ def run_workflow(repo: Path, action: str, project_dir: str, expected_head: str =
             head = subprocess.run(["git", "rev-parse", "--verify", "HEAD"],
                                   cwd=repo, capture_output=True, encoding="utf-8", errors="replace", check=True).stdout.strip()
             step("check_task_briefs.py", "--repo", str(repo), "--base", head,
-                 "--tasks-dir", f"{project_dir}/tasks")
+                 "--tasks-dir", f"{project_dir}/tasks", "--project-dir", project_dir)
             step("check_handoffs.py", "plan", *common)
         elif action == "prepare-task" and _task_member(repo, project_dir, task_id):
             # A member task works in a sidecar of its member; its Verify runs there at finish.
@@ -210,8 +210,14 @@ def run_workflow(repo: Path, action: str, project_dir: str, expected_head: str =
                         "--base", expected_head, "--task-id", task_id,
                         "--round-size", str(round_size))
             if task["mode"] == "serial":
+                name = f"task-{task_id.lower()}-verify"
+                stale = isolation.sidecar_root(repo, "verify", name)
+                if os.path.lexists(stale / ".git"):
+                    # An earlier prepare-task left this sidecar. Only one that is proven untouched is replaced.
+                    steps.append({"script": "isolation.py", "result": isolation.retire_stale_verify(
+                        repo, stale, isolation.verify_branch_name(name))})
                 step("isolation.py", "isolate-verify", "--repo", str(repo),
-                     "--base", expected_head, "--name", f"task-{task_id.lower()}-verify")
+                     "--base", expected_head, "--name", name)
         elif action == "build-evidence":
             proof = step("build_state.py", "verify-landed", *common, "--head", expected_head)
             # The landing proof has one canonical home; lean final-review reuse allows only this path.
@@ -257,6 +263,9 @@ def run_workflow(repo: Path, action: str, project_dir: str, expected_head: str =
                         ruled.add(row[0])
                 if any(len(row) == 6 and row[4] == "NEEDS-USER" and row[0] not in ruled for row in queue):
                     raise StepFailed("DOCS-AUDIT.md has NEEDS-USER rows without a user ruling")
+            if kind == "intent":
+                # Malformed or incomplete spec-probe tables are not a pre-approvable draft.
+                step("check_handoffs.py", "intent", *common)
             if kind == "plan":
                 if gate_plan()["mode"] != "off":
                     raise StepFailed("pre-approval requires review_panel off")
@@ -275,7 +284,8 @@ def run_workflow(repo: Path, action: str, project_dir: str, expected_head: str =
             if action == "approve-plan":
                 step("pipeline_state.py", "approve", *common, "--kind", "plan",
                      "--expected-head", expected_head)
-    except (StepFailed, OSError, subprocess.CalledProcessError, ValueError, KeyError, TypeError) as error:
+    except (StepFailed, isolation.IsolationError, OSError, subprocess.CalledProcessError,
+            ValueError, KeyError, TypeError) as error:
         return {"status": "blocked", "reason": str(error), "steps": steps,
                 "next": next_step}
     return {"status": "complete", "steps": steps, **outputs}

package/scripts/worktree_paths.py

@@ -22,6 +22,27 @@ else:
         from scripts import _common
 
 
+def _worktree_list_porcelain(primary: Path) -> tuple[str, bool]:
+    try:
+        if __package__:
+            from . import pipeline_git as pg
+        else:
+            from scripts import pipeline_git as pg
+    except ImportError:
+        try:
+            import pipeline_git as pg
+        except ImportError:
+            pg = None
+    if pg is not None:
+        return pg.worktree_list_porcelain(primary)
+    try:
+        output = _git(primary, "worktree", "list", "--porcelain", "-z")
+        return output, True
+    except ValueError:
+        output = _git(primary, "worktree", "list", "--porcelain")
+        return output, False
+
+
 def _git(primary: Path, *args: str) -> str:
     result = _common.run_git(primary, *args)
     if result.returncode:
@@ -82,6 +103,33 @@ def _workspace(primary: Path, pin: bool) -> Path:
     return workspace
 
 
+def release_workspace(primary: Path) -> bool:
+    """Forget the pinned placement receipt once no linked worktrees remain.
+
+    Lets GSD_PATH_WORKTREE_ROOT (or a new default) apply again at the next
+    milestone's first allocation. Returns True when a receipt was removed;
+    any remaining linked worktree (including one only still registered) keeps
+    the pin.
+    """
+    primary = primary.resolve()
+    common = Path(_git(primary, "rev-parse", "--git-common-dir"))
+    common = (primary / common).resolve()
+    receipt = common / "gsd-path" / "workspaces" / f"{_identity(primary)}.json"
+    if not receipt.is_file():
+        return False
+    output, nul_separated = _worktree_list_porcelain(primary)
+    records = output.split("\0\0") if nul_separated else [
+        block for block in output.strip().split("\n\n") if block.strip()
+    ]
+    for record in records:
+        fields = record.split("\0") if nul_separated else record.splitlines()
+        for field in fields:
+            if field.startswith("worktree ") and Path(field[len("worktree "):]).resolve() != primary:
+                return False
+    receipt.unlink()
+    return True
+
+
 def worktree_path(primary: Path, kind: str, name: str, *, pin: bool = False) -> Path:
     primary = primary.resolve()
     if kind not in {"task", "verify", "integrate", "bound"} or not name or Path(name).name != name or name in {".", ".."}:
@@ -91,9 +139,13 @@ def worktree_path(primary: Path, kind: str, name: str, *, pin: bool = False) ->
     legacy = (primary.parent / f".{primary.name}-gsd-path-integrate-{name}"
               if kind == "integrate" else primary.parent / f"{primary.name}.gsd-path" / kind / name)
     branch = f"refs/heads/gsd-path-{kind}/{name}"
-    records = _git(primary, "worktree", "list", "--porcelain", "-z").split("\0\0")
+    output, nul_separated = _worktree_list_porcelain(primary)
+    if nul_separated:
+        records = output.split("\0\0")
+    else:
+        records = [block for block in output.strip().split("\n\n") if block.strip()]
     for record in records:
-        fields = record.split("\0")
+        fields = record.split("\0") if nul_separated else record.splitlines()
         # Compare as paths: git prints forward slashes on Windows.
         worktrees = [Path(field[len("worktree "):]) for field in fields if field.startswith("worktree ")]
         if legacy in worktrees and f"branch {branch}" in fields:

package/skills/gsd-path/DEFINE.md

@@ -100,6 +100,10 @@ Obtain a confident answer in every area before finishing:
    give every named surface at least one success criterion observable
    there. A criterion satisfied by a passing test alone does not cover a
    surface.
+9. **Edges and prohibitions** — once the success criteria are drafted, run
+   the [spec-reach probes](references/spec-probes.md): every applicable edge
+   and every kept prohibition gets the user's ruling in INTENT.md
+   `## Edge coverage` and `## Prohibitions`.
 
 ## Program mode
 
@@ -149,7 +153,10 @@ State ownership. There is no re-interview of charter or roadmap scope:
    `Lane: milestone`, `Surfaces:` copied verbatim from the entry, and
    `Review panel:` copied from CHARTER.md (default
    the configured preference when CHARTER omits it). The confirmation may override the copied
-   panel value; do not invent `detected` or a named list. When brownfield,
+   panel value; do not invent `detected` or a named list. Run the
+   [spec-reach probes](references/spec-probes.md) over the derived criteria
+   and draft `## Edge coverage` and `## Prohibitions` with recommended
+   rulings. When brownfield,
    fill `## Current state` from the map, record doc-vs-code rulings as in
    Brownfield mode, and add protected existing behavior under Scope out.
    Write Ground truth paths from the track root: `.project` normally, or
@@ -157,10 +164,16 @@ State ownership. There is no re-interview of charter or roadmap scope:
    active `research/` paths.
 3. Present one confirmation, not an interview: playback the derivation (and
    brownfield ground truth when present), link the resolved absolute INTENT.md
-   path, and ask approve or adjust. A requested change that contradicts the
+   path, and ask approve or adjust. The confirmation lists each proposed edge
+   and prohibition ruling for the user to accept or change; it never rules on
+   them silently. A requested change that contradicts the
    charter or the resolved roadmap entry is a scope change — this phase never
-   edits the roadmap; surface it to the user for a `$gsd-path-roadmap` re-slice
-   at the next milestone boundary.
+   edits the roadmap; surface it to the user for a `$gsd-path-roadmap`
+   re-slice. Before intent approval, that re-slice keeps `define/active` and
+   can change the scope of this milestone's `active` entry; after its
+   approval, draft INTENT.md again from the changed entry. In `corrections`
+   mode the intent is already approved, so the re-slice waits for the next
+   milestone boundary.
 4. On approval, finalize per the Output contract, setting `milestone` to the
    resolved entry's slug. The router continues with milestone-scoped research
    when the entry lists open questions, otherwise planning.
@@ -254,7 +267,15 @@ question. The rules change for every primary mode:
    the brownfield map already established. Milestone mode skips this step.
 5. Stop when coverage is complete or the user says `enough`. Record remaining
    uncertainty under `## Open questions` with `RESEARCH` or `NEEDS-USER`.
-6. Classify the proposed milestone lane before writing the approval draft.
+   `enough` does not skip the next step.
+6. In standard mode, run the [spec-reach probes](references/spec-probes.md)
+   over the drafted success criteria: one question round for edges, then one
+   for kept prohibitions, each with a recommended ruling first. A ruling
+   observable where the user sees the work becomes or amends a success
+   criterion; write every ruling into `## Edge coverage` and
+   `## Prohibitions`. Program mode skips this step (each milestone runs it
+   in milestone mode); milestone mode runs it inside its confirmation.
+7. Classify the proposed milestone lane before writing the approval draft.
    Milestone mode keeps `Lane: milestone` and skips this classification.
    Program mode writes CHARTER.md instead of INTENT.md. Otherwise choose
    `quick` when scope fits at most two deliverable-sized tasks (project
@@ -275,6 +296,11 @@ question. The rules change for every primary mode:
 ## Output contract
 
 At approval, retain the already reviewed `Lane:` value and its one-line reason.
+Before every approval question on INTENT.md, run the bundled `python3
+<absolute-bundled-script> intent --repo <absolute-root>` helper
+(`scripts/check_handoffs.py`, plus `--project-dir .project/next` in
+lookahead). It checks the success criteria, Surfaces, and both probe tables;
+fix a failure in the draft before asking. It approves nothing.
 Before presenting an approval draft without a CHARTER or explicit panel choice,
 read `settings.review_panel.value` from the selected runtime's `path_config.py
 show --repo <absolute-root>` (bundle for legacy projects; off for older selected
@@ -302,5 +328,8 @@ Use the executable phase handoff in AGENTS.md for the next action.
 - In brownfield mode, state mapped facts for correction; never re-ask them.
 - Treat solution-shaped problems as hypotheses and uncover the underlying pain.
 - Preserve vetoes and corrections verbatim.
+- Never rule on an edge's behavior or a prohibition yourself; recommend,
+  then record the user's ruling. An edge the user has not ruled on is a
+  required answer, including under pre-approval.
 - Wrap up when every coverage-checklist area is answered or the user signals
   done, and tag remaining gaps.

package/skills/gsd-path/PLAN.md

@@ -115,9 +115,13 @@ as stated in Lookahead mode.
      In patch mode, tasks already `done` keep their landed metadata; only
      the appended patch tasks must start clean.
    - Require every dependency id to exist, forbid later-wave dependencies,
-     detect cycles, and forbid file overlap between planned tasks in the same
-     wave. Same-wave dependency chains are allowed only when their files do
-     not overlap; the build executes them in dependency layers.
+     detect cycles, and forbid unordered file overlap between planned tasks
+     in the same wave. Same-wave tasks may share files only when one
+     transitively depends on the other through `deps`; the build executes
+     them in dependency layers.
+   - Require an optional `supersedes` field to be a list of different task
+     ids; each one names an existing task of an earlier wave, in the same
+     repo, that shares a declared file with the task.
    - Reject a declared dependency that carries neither data nor a prerequisite
      effect. A `deps` edge is valid only when the dependent consumes a symbol,
      signature, schema, endpoint, file format, or path named in that
@@ -157,6 +161,13 @@ as stated in Lookahead mode.
      command's output — not an internal unit test.
      Require the surface to land in the same wave as the capability behind
      it, never in a later polish wave.
+   - When INTENT.md has `## Edge coverage`, require a PLAN.md
+     `## Held-out checks` row for every `held-out` edge and for no other
+     edge. The named test is in that task's `files`, the task's Verify runs
+     it, and the task's Acceptance criteria state the edge id and its ruling
+     (see [spec-reach probes](references/spec-probes.md)). An edge or
+     prohibition ruled `criterion SCn` needs no extra row; it is covered as
+     SCn. Put each `judgment` prohibition in its owning task's Approach.
    - Prove every intent constraint and synthesis decision is covered, that no
      scope-out veto appears in a task, and that `Project verify` is a real,
      non-placeholder command in PLAN.md. Every Verify — task and project —

package/skills/gsd-path/RESEARCH.md

@@ -84,6 +84,17 @@ settled brownfield input.
    template before dispatch. Record every standard dimension exactly once as
    `dispatched` or `skipped` with a reason, and assign every research question
    to at least one dispatched dimension. No question may remain unassigned.
+   Copy each question to exactly one `Question assignments` row. Assign one or
+   more dispatched dimension slugs there, each in its own code span and
+   separated by commas, as in:
+
+   ```md
+   - `[RESEARCH] Which approach is viable?` → `stack`, `pitfalls`
+   ```
+
+   List a dimension only once per row. Every dispatched dimension must own at
+   least one question, and its evidence file must answer every question
+   assigned to it. Use `- none` only when there are no research questions.
 2. Decide which standard dimensions have work: dispatch a dimension only when
    it has at least one assigned `RESEARCH` question from INTENT.md or
    CHARTER.md. Unsettled choices and risks need that source question before