@opengsd/gsd-path 1.5.0 → 1.6.1

package/scripts/discussion_records.py

@@ -7,6 +7,7 @@ import json
 import os
 import shutil
 import sys
+import traceback
 
 # Runtime helpers must not modify their immutable installation.
 sys.dont_write_bytecode = True
@@ -33,7 +34,7 @@ def _load_pipeline_modules():
     try:
         from scripts import archive_milestone, pipeline_state, _common
         return _common, archive_milestone, pipeline_state
-    except ModuleNotFoundError as error:
+    except ImportError as error:  # a foreign `scripts` package
         if error.name not in {
             "scripts",
             "scripts.archive_milestone",
@@ -41,6 +42,13 @@ def _load_pipeline_modules():
             "scripts._common",
         }:
             raise
+        # A plain ImportError raised while a `scripts` module loaded is not a
+        # foreign package. A missing module falls back, as before.
+        if not isinstance(error, ModuleNotFoundError) and any(
+            frame.f_globals.get("__name__", "").startswith("scripts.")
+            for frame, _ in traceback.walk_tb(error.__traceback__)
+        ):
+            raise
         shared_scripts = Path(__file__).resolve().parents[2] / "gsd-path" / "scripts"
         sys.path.insert(0, str(shared_scripts))
         import archive_milestone

package/scripts/discussion_validate.py

@@ -507,7 +507,8 @@ def archived_intent_criteria(archive: Path) -> dict[int, str]:
         criteria = check_handoffs._success_criteria(text)
     except check_handoffs.HandoffError as error:
         raise ArchiveError(str(error)) from error
-    return {int(key[2:]): " ".join(value.split()) for key, value in criteria.items()}
+    # Each value keeps the form without sub-bullet markers that quotes_criterion reads.
+    return {int(key[2:]): value for key, value in criteria.items()}
 
 
 def parse_final_review(archive: Path) -> tuple:
@@ -563,7 +564,7 @@ def _final_review(archive: Path) -> tuple:
     if len(headings) != len(intent_criteria):
         raise ArchiveError("FINAL.md success criteria do not exactly cover INTENT.md")
     for _, number, criterion in headings:
-        if " ".join(criterion.split()) != intent_criteria[number]:
+        if not _common.quotes_criterion(criterion, intent_criteria[number]):
             raise ArchiveError(
                 f"FINAL.md SC{number} heading text differs from archived INTENT.md"
             )
@@ -951,10 +952,10 @@ def validate_wave_review(
             (index, match.group(1), " ".join(match.group(2).split()), match.group(3))
         )
     actual = [(sc_id, text) for _, sc_id, text, _ in criterion_headings]
-    normalized_expected_criteria = [
-        (sc_id, " ".join(text.split())) for sc_id, text in expected_criteria
-    ]
-    if actual != normalized_expected_criteria:
+    if len(actual) != len(expected_criteria) or any(
+        sc_id != expected_id or not _common.quotes_criterion(text, expected)
+        for (sc_id, text), (expected_id, expected) in zip(actual, expected_criteria)
+    ):
         raise ArchiveError(
             f"{path.name} Intent coverage does not match its owned success criteria"
         )

package/scripts/dispatch_driver.py

@@ -27,7 +27,7 @@ import tempfile
 import time
 from datetime import datetime, timezone
 from pathlib import Path
-from typing import BinaryIO, Callable, Dict, List, Optional
+from typing import BinaryIO, Callable, Dict, List, Optional, Tuple
 
 try:
     from scripts import (_common, archive_milestone, build_state, discussion_validate, isolation,
@@ -77,6 +77,9 @@ STOP_ERRORS = (DriverStop, isolation.IsolationError, build_state.BuildStateError
                pipeline_state.PipelineStateError, archive_milestone.ArchiveError, model_policy.PolicyError)
 _RUNTIME_ACTIVATION_ORDER = (
     "_common",
+    "roadmap",
+    "review_panel",
+    "loop_run",
     "pipeline_git",
     "worktree_paths",
     "build_recovery",
@@ -87,11 +90,16 @@ _RUNTIME_ACTIVATION_ORDER = (
     "build_state",
     "check_handoffs",
     "task_context",
+    # discussion_validate and archive_milestone import each other: the second
+    # reload binds the reloaded ArchiveError that STOP_ERRORS catches.
+    "discussion_validate",
     "archive_milestone",
+    "discussion_validate",
     "review_findings",
     "model_policy",
 )
 RECOVERY_BLOCKED = "recovery blocked"
+LEFTOVER_ISOLATE = "task {} is landed; remove its leftover isolate: {}"
 # The stops the build contract answers with build/blocked when the round raises them (steps 1 and 2);
 # the same stops from review, panel, or skeptics stay with the parent.
 BLOCKING_STOPS = {"dependency-deadlock": "dependency deadlock", RECOVERY_BLOCKED: "blocked recovery"}
@@ -109,9 +117,21 @@ def _refresh_stop_errors() -> None:
                    model_policy.PolicyError)
 
 
+# The selected Project runtime directory once _reload_pinned_modules ran; None keeps bundled helpers.
+_RUNTIME_ROOT: Optional[Path] = None
+
+
+def helper_script(name: str) -> Path:
+    """A subprocess helper from the selected runtime when it ships one, else the bundled sibling."""
+    if _RUNTIME_ROOT is not None and (_RUNTIME_ROOT / name).is_file():
+        return _RUNTIME_ROOT / name
+    return Path(__file__).resolve().parent / name
+
+
 def _reload_pinned_modules(runtime_root: Path) -> None:
     global isolation, build_state, task_context, contracts, pipeline_state
-    global archive_milestone, review_findings, model_policy
+    global archive_milestone, review_findings, model_policy, _RUNTIME_ROOT
+    _RUNTIME_ROOT = runtime_root
     if _bundled_helpers():
         path = str(runtime_root)
         if path not in sys.path:
@@ -640,6 +660,15 @@ def run_verify(command: str, cwd: Path) -> Dict[str, object]:
     return {"exit_code": completed.returncode, "stdout": completed.stdout, "stderr": completed.stderr}
 
 
+def landing_verify(command: str, regressions: List[Dict[str, object]],
+                   cwd: Path) -> Tuple[Dict[str, object], List[Dict[str, object]]]:
+    """The task's own Verify, then every regression Verify when the own one passes."""
+    execution = run_verify(command, cwd)
+    if execution["exit_code"]:
+        return execution, []
+    return execution, [{**item, **run_verify(str(item["command"]), cwd)} for item in regressions]
+
+
 def state_from_task(primary: Path, task_id: str) -> Dict[str, object]:
     """A finish-able state derived from the task frontmatter alone, for coders dispatched by hand."""
     tasks_dir = primary / ".project/tasks"
@@ -693,6 +722,22 @@ def state_from_task(primary: Path, task_id: str) -> Dict[str, object]:
 
 def finish_task(primary: Path, state: Dict[str, object]) -> Dict[str, object]:
     """Verify in the isolate, land, record the ledger, retire. Returns the landing receipt."""
+    landing = land_task(primary, state)
+    try:
+        if state["mode"] == "member":
+            isolation.retire_member_task(primary, str(state["member"]), str(state["task_id"]))
+        else:
+            isolation.retire(primary, Path(str(state["worktree"])), state.get("task_branch") or None, False)
+    except isolation.IsolationError as error:
+        # The landing is proven, so a failed removal is a warning; Round.recover checks the isolate again.
+        landing["cleanup_warning"] = (f"{error}; the task is landed, but its isolate was not removed. The next "
+                                      "round or finish checks the isolate again and stops if the isolate is "
+                                      "still there")
+    return landing
+
+
+def land_task(primary: Path, state: Dict[str, object]) -> Dict[str, object]:
+    """Verify in the isolate, land, record the ledger. Returns the landing receipt."""
     worktree = Path(str(state["worktree"]))
     task_id = str(state["task_id"])
     task_file = str(state["task_file"])
@@ -701,6 +746,11 @@ def finish_task(primary: Path, state: Dict[str, object]) -> Dict[str, object]:
     command = _common.task_verify_command(task_path.read_text(encoding="utf-8"))
     if not command:
         raise DriverStop("task has no Verify command", task=task_id)
+    # A later task can break an earlier task that shares a file; that task's Verify also decides this landing.
+    regressions = build_state.regression_verifies(primary, task_id, command)
+    # A plan-approved `supersedes` retires an earlier Verify; the receipt and the Log show each one.
+    retired = build_state.retired_verifies(primary, task_id)
+    superseded = {"retired": retired} if retired else {}
     if state["mode"] == "serial":
         sidecar = state["sidecar"]
         ensured = isolation.ensure_verify_sidecar(primary, base, str(sidecar["branch"]))
@@ -710,30 +760,45 @@ def finish_task(primary: Path, state: Dict[str, object]) -> Dict[str, object]:
             isolation.reproduce_verify_sidecar(sidecar_path, tree)
         except isolation.IsolationError as error:
             raise DriverStop(str(error), task=task_id) from error
-        execution = run_verify(command, sidecar_path)
+        execution, reruns = landing_verify(command, regressions, sidecar_path)
         location = f"sidecar {sidecar['branch']}"
         isolation.clean_verify(primary, sidecar_path, base, str(sidecar["branch"]))
         isolation.retire(primary, sidecar_path, str(sidecar["branch"]), False)
     else:
-        execution = run_verify(command, worktree)
+        execution, reruns = landing_verify(command, regressions, worktree)
         location = f"isolate {state['task_branch']}"
     passed = execution["exit_code"] == 0
+    broken = [item for item in reruns if item["exit_code"]]
     execution.update({"worktree": str(worktree), "location": location})
     evidence_dir = (Path(str(state["_path"])).parent if state.get("_path")
                     else records_root(primary) / task_id / f"manual-{now().replace(':', '')}")
     evidence_dir.mkdir(parents=True, exist_ok=True)
     _common.atomic_write(evidence_dir / "verify.json",
-                         json.dumps(execution, indent=2, sort_keys=True) + "\n")
+                         json.dumps({**execution, "regressions": reruns, **superseded},
+                                    indent=2, sort_keys=True) + "\n")
     execution["evidence"] = str(evidence_dir / "verify.json")
-    output = "\n".join(f"  {line}" for line in tail(execution["stdout"] + execution["stderr"]).splitlines())
-    append_log(task_path, f"- {now()[:10]} — orchestrator Verify ({location}): "
-                          f"{'pass' if passed else 'fail'}, exit {execution['exit_code']}"
-                          + (f"; output tail:\n  ```\n{output}\n  ```" if output else ""))
-    if not passed:
+    # The Verify of a superseding task runs in the place of the retired Verify: the label names both.
+    for label, run in [("Verify", execution),
+                       *((f"regression Verify of {', '.join(item['tasks'])}"
+                          + (f" (supersedes {', '.join(item['supersedes'])})" if item.get("supersedes") else ""),
+                          item) for item in reruns)]:
+        output = "\n".join(f"  {line}" for line in tail(run["stdout"] + run["stderr"]).splitlines())
+        append_log(task_path, f"- {now()[:10]} — orchestrator {label} ({location}): "
+                              f"{'fail' if run['exit_code'] else 'pass'}, exit {run['exit_code']}"
+                              + (f"; output tail:\n  ```\n{output}\n  ```" if output else ""))
+    for item in retired:
+        part = f": part of {item['part']}" if item.get("part") else ""
+        append_log(task_path, f"- {now()[:10]} — orchestrator regression Verify of {item['task']}{part} retired: "
+                              f"superseded by {item['superseded_by']}")
+    if not passed or broken:
         if state["mode"] == "parallel":
             isolation.deactivate_task(worktree, task_id, str(state["task_branch"]))
         elif state["mode"] == "member":
             isolation.deactivate_member_task(primary, str(state["member"]), task_id)
+        if passed:
+            names = ", ".join(name for item in broken for name in item["tasks"])
+            raise DriverStop(f"regression Verify of {names} failed in the isolate", task=task_id,
+                             execution=execution, regressions=broken)
         raise DriverStop("Verify failed in the isolate", task=task_id, execution=execution)
     if state["mode"] == "member":
         member = str(state["member"])
@@ -744,9 +809,9 @@ def finish_task(primary: Path, state: Dict[str, object]) -> Dict[str, object]:
         ledger = isolation.git_output(worktree, "rev-parse", f"{landing}^") == str(state["member_base"])
         if ledger:
             build_state.verify_record(str(primary), command, landing, "pass", execution=execution, member=member)
-        isolation.retire_member_task(primary, member, task_id)
         return {"task": task_id, "commit": str(landed["commit"]), "mode": "member",
-                "landing": landing, "verify": execution, "ledger": ledger}
+                "landing": landing, "verify": execution, "regressions": reruns, **superseded,
+                "ledger": ledger}
     landed = isolation.land(primary, worktree, base, task_id, str(state["title"]), task_file,
                             list(state["files"]))
     commit = str(landed["commit"])
@@ -754,9 +819,8 @@ def finish_task(primary: Path, state: Dict[str, object]) -> Dict[str, object]:
     ledger = isolation.git_output(primary, "rev-parse", f"{commit}^") == base
     if ledger:
         build_state.verify_record(str(primary), command, commit, "pass", execution=execution)
-    isolation.retire(primary, worktree, state.get("task_branch") or None, False)
     return {"task": task_id, "commit": commit, "mode": landed["mode"], "verify": execution,
-            "ledger": ledger}
+            "regressions": reruns, **superseded, "ledger": ledger}
 
 
 # --- shared by round and review --------------------------------------------
@@ -772,6 +836,11 @@ def recover_report(primary: Path, project_dir: str, receipt: Dict[str, object])
     report = isolation.recover(primary, Path(project_dir) / "tasks")
     receipt["steps"].append({"script": "isolation.py recover", "result": report})
     if report["verdict"] == "block":
+        blocked = [task for task in report["tasks"] if task["verdict"] == "block"]
+        if blocked and all(task.get("leftover") for task in blocked):
+            # Every blocked task is landed: the stop names only the isolates to remove, and the build stays active.
+            raise DriverStop("; ".join(LEFTOVER_ISOLATE.format(task["task_id"], task["leftover"])
+                                       for task in blocked), recover=blocked)
         raise DriverStop(RECOVERY_BLOCKED, recover=report)
     return report
 
@@ -907,7 +976,7 @@ class Round:
             self.receipt["steps"].append({"script": "isolation.recover_member_landing", "task": journal.stem,
                                           "result": result})
             if result["state"] == "landed":
-                isolation.retire_member_task(self.primary, str(result["member"]), journal.stem)
+                self.retire_member(str(result["member"]), journal.stem, str(result["landing"]))
                 retired_members.add(journal.stem)
         report = recover_report(self.primary, self.project_dir, self.receipt)
         for task in report["tasks"]:
@@ -924,7 +993,7 @@ class Round:
                 diagnose = shlex.join([
                     sys.executable,
                     "-B",
-                    str(Path(__file__).with_name("pipeline_diagnose.py")),
+                    str(helper_script("pipeline_diagnose.py")),
                     "diagnose",
                     "--repo",
                     str(self.primary),
@@ -936,16 +1005,36 @@ class Round:
                     recover=task,
                 )
             if verdict == "recovered" and task.get("member") and task.get("task_id") not in retired_members:
-                isolation.retire_member_task(self.primary, str(task["member"]), str(task["task_id"]))
+                self.retire_member(str(task["member"]), str(task["task_id"]), str(task["landing"]))
             if verdict == "recovered" and worktree and worktree["clean"] and task.get("task_branch"):
                 isolation.retire(self.primary, Path(str(worktree["path"])),
                                  str(task["task_branch"]), False)
-            elif (verdict == "recovered" and worktree is None and task.get("task_branch")) or (
-                    verdict == "resume" and (task.get("landing_retry") or task.get("dispatch_retry"))):
-                # ponytail: interrupted retirements and retries stay with the parent's documented
+            elif verdict == "recovered" and worktree is None and task.get("task_branch"):
+                # The isolate is gone and the landing is proven: retire proves the branch, then deletes it.
+                isolation.retire(self.primary, None, str(task["task_branch"]), True, str(task["commit"]))
+            elif verdict == "resume" and (task.get("landing_retry") or task.get("dispatch_retry")):
+                # ponytail: interrupted retries stay with the parent's documented
                 # procedure; failed/blocked reconciliation surfaces through ready's typed error.
                 raise DriverStop(f"task {task.get('task_id')} needs recovery: {verdict}", recover=task)
 
+    def retire_member(self, member: str, task_id: str, landing: str) -> None:
+        """Retire a landed member task's sidecar; a proven leftover of it is a stop that names only its path."""
+        checkout, project, _ = isolation._member_context(self.primary, member)
+        sidecar = isolation.sidecar_root(checkout, "task", f"{project}-{task_id}")
+        branch = f"refs/heads/{isolation.TASK_BRANCH_PREFIX}{project}-{task_id}"
+        tip = isolation.run_git(checkout, "rev-parse", "--verify", "--quiet", branch)
+        commits = [landing, *tip.stdout.split()]
+        try:
+            isolation.retire_member_task(self.primary, member, task_id)
+        except isolation.RemovalError as error:
+            # Missing files are a removal that stopped part way; every other state keeps the refusal.
+            if not (isolation.only_missing_files(sidecar)
+                    or isolation.holds_only_landed_files(checkout, sidecar, commits)):
+                raise
+            raise DriverStop(LEFTOVER_ISOLATE.format(task_id, sidecar), cleanup_error=str(error))
+        if isolation.holds_only_landed_files(checkout, sidecar, commits):
+            raise DriverStop(LEFTOVER_ISOLATE.format(task_id, sidecar))
+
     # settle exited children ---------------------------------------------
 
     def isolate_live(self, state: Dict[str, object]) -> bool:
@@ -1231,7 +1320,7 @@ class Round:
                 continue
             prepared = self.runner("prepare-task", head, task["id"], round_size)
             isolate = prepared[0]["result"]
-            sidecar = prepared[1]["result"] if len(prepared) > 1 else None
+            sidecar = prepared[-1]["result"] if len(prepared) > 1 else None  # the isolate-verify step is last
             worktree = Path(str(isolate["worktree"]))
             isolation.activate_task(worktree, head, task["id"], f"build_{task['id'].lower()}",
                                     task["task_file"], isolate["task_branch"])
@@ -1600,8 +1689,8 @@ class Review:
 
 
 def helper_json(receipt: Dict[str, object], script: str, *arguments: str, cwd: Path) -> Dict[str, object]:
-    """Run a bundled helper and return its JSON stdout; a non-zero exit is a typed stop."""
-    command = [sys.executable, "-B", str(Path(__file__).resolve().parent / script), *arguments]
+    """Run a helper (runtime-selected, else bundled) and return its JSON stdout; a non-zero exit is a typed stop."""
+    command = [sys.executable, "-B", str(helper_script(script)), *arguments]
     completed = subprocess.run(command, cwd=cwd, capture_output=True, encoding="utf-8", errors="replace")
     step = {"script": script, "command": command, "exit_code": completed.returncode,
             "stdout": completed.stdout, "stderr": completed.stderr}
@@ -2007,6 +2096,23 @@ def next_task_id(tasks_dir: Path) -> str:
     return f"T{max(numbers, default=0) + 1:03d}"
 
 
+def replaced_review_base(primary: Path, project_dir: str, wave: int, cycle: int) -> Optional[str]:
+    """The recovery base when this cycle's review replaces the one a build recovery set aside, else None."""
+    recovery = pipeline_state._build_recovery().context(primary)
+    if not recovery:
+        return None
+    relative = f"{project_dir}/review/wave-{wave}.cycle{cycle}.md"
+    before = isolation.run_git(primary, "show", f"{recovery['base']}:{relative}")
+    current = primary / relative
+    # Plan approval restores the review of an unchanged wave before its checkpoint, so no commit
+    # since the base touches that file. A set-aside review is deleted by that checkpoint.
+    rewritten = isolation.run_git(primary, "log", "-1", "--format=%H", f"{recovery['base']}..HEAD", "--", relative)
+    if (not rewritten.stdout.strip() and before.returncode == 0 and current.is_file()
+            and current.read_text(encoding="utf-8") == before.stdout):
+        return None  # the restored review keeps its repairs
+    return recovery["base"]
+
+
 def fix_tasks(primary: Path, options: argparse.Namespace) -> Dict[str, object]:
     """Step 7: one fix task per findings batch, carrying failed criteria and observations verbatim."""
     receipt: Dict[str, object] = {"status": None, "wave": options.wave, "cycle": options.cycle,
@@ -2015,14 +2121,32 @@ def fix_tasks(primary: Path, options: argparse.Namespace) -> Dict[str, object]:
         project = primary / options.project_dir
         tasks_dir = project / "tasks"
         repairs = []
+        pending = []
         for path in sorted(tasks_dir.glob("*-fix-wave-*-cycle-*.md")):
             text = path.read_text(encoding="utf-8")
             fields, _ = isolation.task_frontmatter(text)
             repairs.append({"task": fields["id"], "path": path.relative_to(primary).as_posix(),
-                            "wave": int(fields["wave"]), "locators": re.findall(r"(?m)^### (.+)$", _common.section_body(text, "Review findings") or "")})
+                            "wave": int(fields["wave"]), "locators": re.findall(r"(?m)^### (.+)$", _common.section_body(text, "Review findings") or ""),
+                            **({"repo": fields["repo"]} if fields.get("repo") else {})})
+            if fields["status"] != "done":
+                pending.append(repairs[-1])
         suffix = f"-fix-wave-{options.wave}-cycle-{options.cycle}.md"
-        existing = [item for item in repairs if item["path"].endswith(suffix)]
-        carried = {locator for item in repairs if item not in existing for locator in item["locators"]}
+        # A build recovery restarts a changed wave at cycle 1, so the repairs and the PLAN heading
+        # of the review it set aside carry the same names. They belong to that review, not this one.
+        replaced = replaced_review_base(primary, options.project_dir, options.wave, options.cycle)
+
+        def of_replaced_review(relative: str) -> bool:
+            if not replaced or isolation.run_git(primary, "show", f"{replaced}:{relative}").returncode != 0:
+                return False
+            return not isolation.run_git(primary, "log", "--diff-filter=AD", "--format=%H",
+                                         f"{replaced}..HEAD", "--", relative).stdout.strip()
+
+        stale = [item for item in repairs if item["path"].endswith(suffix) and of_replaced_review(item["path"])]
+        existing = [item for item in repairs if item["path"].endswith(suffix) and item not in stale]
+        # A landed repair no longer carries its finding: a repeat proves that fix failed and needs the next one.
+        # Two repos can carry the same locator, so a repair carries a finding only in its own repo.
+        carried = {(item.get("repo"), locator) for item in pending if not item["path"].endswith(suffix)
+                   for locator in item["locators"]}
         findings = review_findings.compute(primary, options.project_dir, options.wave, options.cycle)
         receipt["findings"] = findings
         escalation = [key for key in ("structural_blockers", "skeptic_groups", "cap_reached", "all_refuted")
@@ -2043,8 +2167,10 @@ def fix_tasks(primary: Path, options: argparse.Namespace) -> Dict[str, object]:
         repair_waves = {item["wave"] for item in existing}
         if len(repair_waves) > 1:
             raise DriverStop("repair tasks for this cycle disagree on their wave")
-        repair_heading = re.search(
+        stale_waves = {item["wave"] for item in stale}
+        repair_heading = next((heading for heading in re.finditer(
             rf"(?m)^## Wave (\d+) — fix wave {options.wave} cycle {options.cycle} review findings$", plan_text)
+            if int(heading.group(1)) not in stale_waves), None)
         if repair_waves:
             fix_wave = next(iter(repair_waves))
         elif repair_heading:
@@ -2055,9 +2181,10 @@ def fix_tasks(primary: Path, options: argparse.Namespace) -> Dict[str, object]:
             raise DriverStop("repair tasks disagree with the PLAN repair wave")
         receipt["existing"] = existing
         for batch in findings["fix_batches"]:
-            if any(set(batch["locators"]) <= set(item["locators"]) for item in existing):
+            repo = batch.get("repo")  # a member name, or None for the coordinator
+            if any(item.get("repo") == repo and set(batch["locators"]) <= set(item["locators"]) for item in existing):
                 continue
-            if all(locator in carried for locator in batch["locators"]):
+            if all((repo, locator) in carried for locator in batch["locators"]):
                 receipt["carried"].append(batch)
                 continue
             batch_groups = [groups[locator] for locator in batch["locators"]]
@@ -2065,9 +2192,15 @@ def fix_tasks(primary: Path, options: argparse.Namespace) -> Dict[str, object]:
             for source in sources:
                 if source not in texts:
                     raise DriverStop(f"fix batch names unknown task {source}")
+            # One task changes one repo: the fix depends on, and runs the Verify of, the source tasks of its repo.
+            sources = [source for source in sources if isolation.task_frontmatter(texts[source])[0].get("repo") == repo]
+            # A repeat builds on the landed repairs of its finding: repair-evidence links them by this dependency.
+            deps = sources + [item["task"] for item in repairs
+                              if item not in pending and item.get("repo") == repo
+                              and f"-fix-wave-{options.wave}-cycle-" in item["path"] and not item["path"].endswith(suffix)
+                              and set(item["locators"]) & set(batch["locators"])]
             task_id = next_task_id(tasks_dir)
-            verify = "set -e\n" + "\n".join(  # each source Verify in its own subshell
-                f"(\n{command}\n)" for command in dict.fromkeys(_common.task_verify_command(texts[source]) for source in sources))
+            verify = _common.fix_verify(_common.task_verify_command(texts[source]) for source in sources)
             heavy = any(re.search(r"(?m)^Heavy:\s*yes", texts[source]) for source in sources)
             criteria = "\n".join(f"{index}. {criterion}" for index, criterion in
                                  enumerate(dict.fromkeys(group["criterion"] for group in batch_groups), 1))
@@ -2075,18 +2208,19 @@ def fix_tasks(primary: Path, options: argparse.Namespace) -> Dict[str, object]:
                 f"### {group['locator']}\nCriterion: {group['criterion']}\n"
                 + "\n".join(f"- {item['text']}" for item in group["observations"]) for group in batch_groups)
             files = "\n".join(f"  - {path}" for path in batch["files"])
+            member = f"repo: {repo}\n" if repo else ""  # the task template puts `repo:` before `files:`
             title = f"Fix wave {options.wave} cycle {options.cycle} review findings in {', '.join(sources)}"
             text = f"""---
 id: {task_id}
 title: {title}
 wave: {fix_wave}
-deps: [{', '.join(sources)}]
+deps: [{', '.join(deps)}]
 status: pending
 agent: null
 base: null
 worktree: null
 task_branch: null
-files:
+{member}files:
 {files}
 ---
 
@@ -2135,8 +2269,8 @@ Heavy: {'yes' if heavy else 'no'}
             path = tasks_dir / f"{task_id}-fix-wave-{options.wave}-cycle-{options.cycle}.md"
             _common.atomic_write(path, text)
             receipt["created"].append({"task": task_id, "path": path.relative_to(primary).as_posix(),
-                                       "wave": fix_wave, "deps": sources, "files": batch["files"],
-                                       "locators": batch["locators"]})
+                                       "wave": fix_wave, "deps": deps, "files": batch["files"],
+                                       "locators": batch["locators"], **({"repo": repo} if repo else {})})
         rows = []
         for item in [*existing, *receipt["created"]]:
             fields, _ = isolation.task_frontmatter((primary / item["path"]).read_text(encoding="utf-8"))
@@ -2168,7 +2302,7 @@ Heavy: {'yes' if heavy else 'no'}
         if plan_changed:
             _common.atomic_write(plan_path, updated)
         receipt["plan_wave"] = fix_wave
-        lint = subprocess.run([sys.executable, "-B", str(Path(__file__).resolve().parent / "check_task_briefs.py"),
+        lint = subprocess.run([sys.executable, "-B", str(helper_script("check_task_briefs.py")),
                                "--repo", str(primary), "--base", isolation.current_sha(primary),
                                "--tasks-dir", f"{options.project_dir}/tasks",
                                "--project-dir", options.project_dir], capture_output=True, encoding="utf-8", errors="replace")
@@ -2421,6 +2555,10 @@ def main(argv=None) -> int:
                 if native and native["base"] != records[0].get("base"):
                     records = []
                 else:
+                    if (native and records[0]["outcome"] == "blocked" and records[0].get("native")
+                            and not records[0].get("command")):
+                        # A failed finish leaves a host-dispatched task active at its base: finish may run again.
+                        update_state(records[0], outcome=None, reason=None)
                     native = None
             if arguments.task_id in current.proven:
                 commit = current.proven[arguments.task_id]

package/scripts/git_guard.py

@@ -19,9 +19,10 @@ _HERE = Path(__file__).resolve().parent
 sys.path.insert(0, str(_HERE / "runtime" if (_HERE / "runtime" / "isolation.py").is_file() else _HERE))
 sys.dont_write_bytecode = True  # a hook must not leave __pycache__ in the worktree
 try:
-    from isolation import BOOKKEEPING_PREFIXES, NULL_SHA, _landing_state, task_frontmatter
+    from isolation import BOOKKEEPING_PREFIXES, NULL_SHA, _landing_state, task_frontmatter, undeclared_paths
     from pipeline_git import is_ship_subject, ship_body_matches, ship_commit_body, task_commit_body
     from pipeline_state import _completion_status
+    from _common import valid_default_branch
     import members
 except ImportError as error:  # pragma: no cover - broken install
     print(
@@ -68,6 +69,11 @@ PUBLICATION_HINT = (
     "(STATE shipped/done) through archive_milestone.py integrate; findings during "
     "ship reopen through the patch plan (see SHIP.md)"
 )
+AUTHORIZED_PUSH_HINT = (
+    "an owner-approved push of one exact commit to a branch other than the bound "
+    "or default branch needs refs/gsd-path/authorizations/<project>/push/<ref> "
+    "at that commit (see HOOKS.md)"
+)
 LEGACY_STATE_FIELDS = {
     "pipeline",
     "project",
@@ -240,7 +246,10 @@ def frontmatter_of(content, label):
 
 
 def strict_ship_state(state, archive):
-    fields = frozenset(state)
+    # default_branch is optional beside each accepted field set.
+    if "default_branch" in state and not valid_default_branch(state["default_branch"]):
+        return False
+    fields = frozenset(state) - {"default_branch"}
     if fields not in {
         frozenset(LEGACY_STATE_FIELDS),
         frozenset(INTEGRATION_STATE_FIELDS),
@@ -509,7 +518,7 @@ def product_commit_violations(entries, subject, body):
         if error:
             problems.append(error)
         if contract_paths is not None:
-            stray = sorted(set(staged) - contract_paths)
+            stray = undeclared_paths(repo_root(), base, set(staged), contract_paths)
             if stray:
                 problems.append("undeclared paths: " + ", ".join(stray))
         if body != task_commit_body(task_file, staged, base).strip():
@@ -559,8 +568,10 @@ def member_pre_push_violations(lines, role):
     """Member mode: the member's own STATE is ignored; coordinator refs need authorization."""
     checkout, project = repo_root(), role["project"]
     reserved = members.member_ref_prefixes(project)
-    members.require_origin_main(checkout)
-    exclude = ["--not", "refs/remotes/origin/main"]
+    # The coordinator's MEMBERS.md records this member's default branch.
+    default = members.member_default_branch(role["coordinator"], role["name"])
+    members.require_origin_branch(checkout, default)
+    exclude = ["--not", f"refs/remotes/origin/{default}"]
     member_work = None
     found = []
     for _, local_sha, remote_ref, remote_sha in _push_updates(lines):
@@ -615,14 +626,25 @@ def pre_push_violations(lines):
             continue
         state = state_at(local_sha)
         owed = unshipped_bound_branch(state) if state is not None else None
-        if owed is not None:
+        if owed is not None and not authorized_publication(state, remote_ref, local_sha):
             found.append(
                 f"{remote_ref} <- {local_sha[:12]} carries unshipped {owed} work "
-                f"({state.get('phase')}/{state.get('status')}); {PUBLICATION_HINT}"
+                f"({state.get('phase')}/{state.get('status')}); {PUBLICATION_HINT}; "
+                f"{AUTHORIZED_PUSH_HINT}"
             )
     return found
 
 
+def authorized_publication(state, remote_ref, sha):
+    """The owner authorized this exact commit on this one non-default branch."""
+    project = state.get("project")
+    if not isinstance(project, str) or not members.NAME_RE.fullmatch(project):
+        return False
+    if not remote_ref.startswith("refs/heads/") or remote_ref == f"refs/heads/{default_branch()}":
+        return False
+    return members.authorized(repo_root(), project, "push", remote_ref, sha)
+
+
 def is_ship_commit(subject):
     return bool(subject and subject.strip().casefold().startswith("ship:"))
 
@@ -641,7 +663,20 @@ def abandon_contract_violations(subject, body, abandon):
     return []
 
 
+def recorded_default_branch():
+    """STATE default_branch in the worktree: main without the field; None without a readable STATE."""
+    try:
+        content = (repo_root() / ".project" / "STATE.md").read_text(encoding="utf-8")
+        name = frontmatter_of(content, "STATE.md").get("default_branch", "main")
+    except (OSError, ValueError, subprocess.CalledProcessError):
+        return None
+    return name if valid_default_branch(name) else None
+
+
 def default_branch():
+    recorded = recorded_default_branch()
+    if recorded:
+        return recorded
     origin_head = subprocess.run(
         ["git", "symbolic-ref", "--quiet", "--short", "refs/remotes/origin/HEAD"],
         capture_output=True,