@opengsd/gsd-path 1.7.0 → 1.7.1

package/skills/path/references/planner.md

@@ -33,9 +33,10 @@ the how.
    parallelism or isolates a risk.
 5. Assign each wave `Review depth: full`, `deep`, or `verify-only`. Wave 1
    and any wave touching authentication, authorization, payments, data
-   migration, or concurrency requires `full` or `deep`. Assign `deep`
-   sparingly, only to waves where a wrong merge is irreversible or
-   security-critical; `verify-only` suits polish and low-risk feature waves
+   migration, or concurrency requires `full` or `deep`. Use `full` unless
+   the user explicitly requested adversarial review and that request is
+   recorded in INTENT.md; only then may you assign `deep`. Risk alone
+   does not authorize adversarial review; `verify-only` suits polish and low-risk feature waves
    whose Verify commands meaningfully cover the criteria.
 
 Every dependency must be in an earlier wave or in the same wave. Same-wave

package/skills/path/references/reviewer-wave.md

@@ -80,8 +80,9 @@ or Verify commands that cannot fail unless either defeats a criterion. Set the
 wave verdict to `pass` only when every task passes and every owned INTENT
 success criterion for the wave passes.
 
-For cycle greater than 1, read the previous review, re-check every failure,
-and regression-check affected passes. State when the same criterion fails for
+For cycle greater than 1, read the previous review, re-check repaired failures,
+and regression-check affected passes only. Reuse settled evidence for unaffected
+criteria; do not start a fresh search for improvements. State when the same criterion fails for
 a different reason. Use only the wave-review template.
 
 ### Review file format
@@ -153,6 +154,8 @@ runtime checks freshness and derives the final view from these records.
 
 ## Deep review lenses
 
+Use `deep` only when the user explicitly requested adversarial review and that
+request is recorded in INTENT.md. Risk alone does not authorize it.
 A `deep` wave spawns two independent reviewers in parallel, each with a fresh
 context and its own isolated workspace at the recorded review base (a verify
 sidecar in reconstructed mode, or the supplied combined checkout in immutable
@@ -166,9 +169,11 @@ mode). Every Wave mode rule above applies to both lenses.
   contract`.
 - **Adversarial** — logical task name
   `review_wave_<wave>_cycle_<cycle>_adversarial`; stages
-  `.project/review/wave-N.cycleC.adversarial.md`. Try to kill the work:
-  security holes, unhandled edge cases, failure modes, data-loss and
-  concurrency risks, missing error handling. Record `Lens: adversarial`.
+  `.project/review/wave-N.cycleC.adversarial.md`. Exercise failure paths within
+  the agreed contract, including its required security, data-loss, concurrency,
+  and error-handling behavior. Every blocking finding still needs a named
+  requirement and checked failure or missing required proof. Do not invent
+  additional requirements. Record `Lens: adversarial`.
 
 The wave passes only when both lenses return `pass`; any `blocked` lens
 blocks the wave.

package/skills/path/references/reviewer.md

@@ -1,6 +1,7 @@
 # Reviewer role
 
-Verify written GSD Path expectations and block failures. Never fix code.
+Validate that the agreed work functions. Block contract failures or missing
+required evidence. Never search for improvements or fix code.
 
 ## Brief contract
 
@@ -36,7 +37,17 @@ Resolve sibling links against this role file's directory.
 
 - When `GSD_PATH_JEV=1`, wave and final reviewers follow the optional
   [Jev evidence screening procedure](jev-review.md) for uncovered criteria.
-- Review written expectations, not preferences or alternate designs.
+- Use the written acceptance, interface, success, edge, prohibition, and
+  surface contracts as the complete review scope. Block only on a named
+  unmet requirement with checked evidence, or the specific missing evidence
+  needed to prove it. Passing tests alone do not prove a required walkthrough.
+- Do not search for improvements, alternate designs, speculative hardening,
+  or unrelated edge cases. Do not turn these into findings or fix tasks.
+  A clean pass is a complete result; no finding quota applies.
+- On re-review, check repaired failures and passes affected by the repair.
+  Reuse settled evidence for unaffected criteria; do not reopen them or
+  introduce new requirements. An observed regression against the unchanged
+  contract still blocks. Stop when every applicable claim is proven.
 - Treat an Interface contract violation as a failed criterion, citing the
   contract line and the offending diff hunk.
 - Require checked evidence for every verdict.

package/skills/path/scripts/dispatch_driver.py

@@ -1461,6 +1461,9 @@ def review_brief(state: Dict[str, object], options: argparse.Namespace, primary:
         f"You are the reviewer for GSD Path wave {wave}, cycle {cycle}; logical task name "
         f"{state['task_id']}. Mode: wave" + (f"; lens: {lens}." if lens else "."),
         f"Read the reviewer role brief first and follow it exactly: {options.role_brief}",
+        "Validate the agreed acceptance contract. "
+        "Block only on a named unmet requirement or missing required evidence. "
+        "Do not search for improvements or expand the agreed contract.",
         f"Template (use only this): {options.template}",
         f"AGENTS.md: {agents if agents.exists() else 'absent'}",
         f"Repository root, read-only: {primary}",
@@ -1478,6 +1481,8 @@ def review_brief(state: Dict[str, object], options: argparse.Namespace, primary:
                      f"landing commit {task['commit']}")
     if previous is not None:
         lines.append(f"Previous cycle review to re-check: {previous}")
+        lines.append("Re-check repaired failures and affected passes only. "
+                     "Reuse settled evidence for unaffected criteria.")
     if options.repair_evidence:
         lines.append(f"Repair evidence receipt (re-review after a proven repair): {options.repair_evidence}")
     if final_scope:

package/skills/path/scripts/isolation.py

@@ -5372,16 +5372,6 @@ def _committed_ship_active(repo: Path) -> bool:
     return fields.get("phase") == "ship" and fields.get("status") == "active"
 
 
-# The STATE Log tail that sanctions a build checkpoint past a HEAD that is
-# still ship/active: the blocked final review went through the patch plan
-# (reopened, then approved) and build started again (#526).
-_PATCH_REENTRY_LOG = (
-    ("plan", "patch plan reopened"),
-    ("plan", "patch plan approved"),
-    ("build", "build started"),
-)
-
-
 def _patch_reentry_build_active(repo: Path) -> bool:
     """True when the worktree STATE is the sanctioned patch-re-entry build.
 
@@ -5389,8 +5379,12 @@ def _patch_reentry_build_active(repo: Path) -> bool:
     (ship/active) on purpose: the patch plan runs uncommitted and the patch
     build's own checkpoint commits the artifacts (SHIP.md). This reads the
     worktree STATE the checkpoint is about to commit and accepts only the
-    documented sequence — a hand-flipped build/active during final review
-    carries no such Log tail and stays refused (#429, #526).
+    documented shape: the Log ends with the build restart, the event before
+    it closes the plan stay with the patch approval, and that stay opened
+    with `patch plan reopened` — a resumed planner logs `patch planning
+    blocked` and `planning resumed` inside the same stay (#531). A
+    hand-flipped build/active during final review carries no such Log tail
+    and stays refused (#429, #526).
     """
 
     state = repo / ".project" / "STATE.md"
@@ -5410,10 +5404,20 @@ def _patch_reentry_build_active(repo: Path) -> bool:
         match = re.fullmatch(r"- \d{4}-\d{2}-\d{2} — (\S+) — (.+)", line)
         if match:
             events.append((match.group(1), match.group(2)))
-    # The sanctioned sequence appears in order, as the Log tail of this
-    # milestone's patch loop; the final event must be the build restart.
-    last = len(_PATCH_REENTRY_LOG)
-    return len(events) >= last and tuple(events[-last:]) == _PATCH_REENTRY_LOG
+    # The final event must be the build restart, the event before it must
+    # close the plan stay with the patch approval, and that stay must open
+    # with the reopen; every plan event between them (a blocked, resumed
+    # planner) stays inside the run (#531).
+    if len(events) < 2 or events[-1] != ("build", "build started"):
+        return False
+    if events[-2] != ("plan", "patch plan approved"):
+        return False
+    stay = 0
+    for phase, _event in reversed(events[:-1]):
+        if phase != "plan":
+            break
+        stay += 1
+    return events[-(stay + 1)] == ("plan", "patch plan reopened")
 
 
 def checkpoint(

package/skills/path/templates/plan.md

@@ -35,8 +35,9 @@ Project verify: `<command that installs dependencies, builds + tests the whole p
 Goal: <what this wave proves; if it fails, what changes>
 Review depth: full   <!-- full | deep | verify-only. Wave 1 and auth/payments/
                           data migration/concurrency waves must be full or
-                          deep. Assign deep sparingly: irreversible or
-                          security-critical merges. -->
+                          deep. Use full unless the user explicitly requested
+                          adversarial review, recorded in INTENT.md. Risk alone
+                          does not authorize deep. -->
 
 <!-- No task table. Task id, title, deps, and files live only in each
      `tasks/T###-slug.md` frontmatter; `wave: N` there assigns it here. -->