@opengsd/gsd-pi 1.1.1-dev.a5a2de8 → 1.1.1-dev.b2556262

package/src/resources/extensions/gsd/planner-handoff.ts

@@ -0,0 +1,149 @@
+// Project/App: gsd-pi
+// File Purpose: Optional gsd-planner handoff after milestone planning.
+
+import { spawn as spawnChild, type ChildProcess, type SpawnOptions } from "node:child_process";
+import { existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import { gsdRoot } from "./paths.js";
+
+export const PLANNER_HANDOFF_RULE_NAME = "planning review handoff -> gsd-planner";
+export const GSD_PLANNER_COMMAND = "gsd-planner";
+
+export interface GsdPlannerSpawnPlan {
+  command: string;
+  args: string[];
+  cwd: string;
+}
+
+export interface GsdPlannerLaunchInput {
+  basePath: string;
+  milestoneId?: string | null;
+  extraArgs?: string[];
+}
+
+export type GsdPlannerLaunchResult =
+  | { status: "launched"; plan: GsdPlannerSpawnPlan }
+  | { status: "failed"; plan: GsdPlannerSpawnPlan; error: Error };
+
+type SpawnLike = (
+  command: string,
+  args: readonly string[],
+  options: SpawnOptions,
+) => ChildProcess;
+
+export interface GsdPlannerLaunchDeps {
+  spawn?: SpawnLike;
+}
+
+function handoffDir(basePath: string): string {
+  return join(gsdRoot(basePath), "runtime", "planner-handoffs");
+}
+
+function safeMilestoneFileSegment(milestoneId: string): string {
+  return milestoneId.replace(/[^A-Za-z0-9._-]/g, "_") || "unknown";
+}
+
+function handoffMarkerPath(basePath: string, milestoneId: string): string {
+  return join(handoffDir(basePath), `${safeMilestoneFileSegment(milestoneId)}.json`);
+}
+
+export function hasPlannerHandoffBeenOffered(basePath: string, milestoneId: string): boolean {
+  return existsSync(handoffMarkerPath(basePath, milestoneId));
+}
+
+export function markPlannerHandoffOffered(
+  basePath: string,
+  milestoneId: string,
+  source: "auto" | "command" = "auto",
+): void {
+  mkdirSync(handoffDir(basePath), { recursive: true });
+  writeFileSync(
+    handoffMarkerPath(basePath, milestoneId),
+    JSON.stringify({
+      milestoneId,
+      source,
+      offeredAt: new Date().toISOString(),
+    }, null, 2) + "\n",
+    "utf-8",
+  );
+}
+
+export function buildGsdPlannerSpawnPlan(input: GsdPlannerLaunchInput): GsdPlannerSpawnPlan {
+  const args = ["--project", input.basePath];
+  const milestoneId = input.milestoneId?.trim();
+  if (milestoneId) args.push("--milestone", milestoneId);
+  args.push(...(input.extraArgs ?? []));
+  return {
+    command: GSD_PLANNER_COMMAND,
+    args,
+    cwd: input.basePath,
+  };
+}
+
+function quoteArg(arg: string): string {
+  return /^[A-Za-z0-9_./:=@+-]+$/.test(arg) ? arg : JSON.stringify(arg);
+}
+
+export function formatGsdPlannerCommand(plan: GsdPlannerSpawnPlan): string {
+  return [plan.command, ...plan.args].map(quoteArg).join(" ");
+}
+
+export async function launchGsdPlanner(
+  input: GsdPlannerLaunchInput,
+  deps: GsdPlannerLaunchDeps = {},
+): Promise<GsdPlannerLaunchResult> {
+  const plan = buildGsdPlannerSpawnPlan(input);
+  const spawn = deps.spawn ?? spawnChild;
+
+  let child: ChildProcess;
+  try {
+    child = spawn(plan.command, plan.args, {
+      cwd: plan.cwd,
+      detached: true,
+      stdio: "ignore",
+      windowsHide: true,
+    });
+  } catch (err) {
+    return {
+      status: "failed",
+      plan,
+      error: err instanceof Error ? err : new Error(String(err)),
+    };
+  }
+
+  return new Promise((resolve) => {
+    let settled = false;
+    const settle = (result: GsdPlannerLaunchResult) => {
+      if (settled) return;
+      settled = true;
+      resolve(result);
+    };
+
+    child.once("error", (err) => {
+      settle({
+        status: "failed",
+        plan,
+        error: err instanceof Error ? err : new Error(String(err)),
+      });
+    });
+    child.once("spawn", () => {
+      child.unref();
+      settle({ status: "launched", plan });
+    });
+  });
+}
+
+export function formatPlannerHandoffPauseReason(milestoneId: string): string {
+  return [
+    `Milestone ${milestoneId} is planned. Review or customize the plan before implementation if needed.`,
+    `Run /gsd planner to launch ${GSD_PLANNER_COMMAND}, or run /gsd auto to continue without planner changes.`,
+  ].join(" ");
+}
+
+export function formatPlannerLaunchUnavailable(plan: GsdPlannerSpawnPlan, error: Error): string {
+  return [
+    `Could not launch ${GSD_PLANNER_COMMAND}: ${error.message}`,
+    `Install ${GSD_PLANNER_COMMAND} or run it manually: ${formatGsdPlannerCommand(plan)}`,
+  ].join("\n");
+}

package/src/resources/extensions/gsd/planning-path-scope.ts

@@ -18,6 +18,13 @@ function isInsideAnyBase(bases: string[], candidate: string): boolean {
   return bases.some((base) => isInsideBase(base, candidate));
 }
 
+function resolvesInsideRoot(root: string, candidate: string): boolean {
+  const resolvedCandidate = isAbsolute(candidate)
+    ? resolve(candidate)
+    : resolve(root, candidate);
+  return isInsideBase(root, resolvedCandidate);
+}
+
 /**
  * Planning IO fields are execution contracts. Absolute paths are only safe when
  * they stay inside the active working directory; in worktree mode, an absolute
@@ -37,13 +44,24 @@ export function validatePlanningPathScope(
       if (!shouldValidatePlanningPathReference(trimmed)) continue;
 
       const candidate = normalizePlannedFileReference(raw);
-      const resolvedCandidate = isAbsolute(candidate)
-        ? resolve(candidate)
-        : resolve(basePath, candidate);
-      if (isInsideAnyBase(absoluteRoots, resolvedCandidate)) continue;
+      if (isAbsolute(candidate)) {
+        if (isInsideAnyBase(absoluteRoots, resolve(candidate))) continue;
+      } else if (absoluteRoots.some((root) => resolvesInsideRoot(root, candidate))) {
+        continue;
+      }
       return `${field} contains path outside allowed repository roots: ${candidate}. Use a path within one of: ${absoluteRoots.join(", ")}.`;
     }
   }
 
   return null;
 }
+
+export function validatePathOnlyPlanningFields(fields: PlanningPathScopeField[]): string | null {
+  for (const { field, values } of fields) {
+    for (const raw of values) {
+      if (shouldValidatePlanningPathReference(raw)) continue;
+      return `${field} must contain only file paths; invalid entry: ${raw}`;
+    }
+  }
+  return null;
+}

package/src/resources/extensions/gsd/pre-execution-checks.ts

@@ -469,6 +469,13 @@ export function shouldValidatePlanningPathReference(raw: string): boolean {
   return shouldValidateInputAsPath(raw);
 }
 
+export function extractPlanningPathReference(raw: string): string | null {
+  const trimmed = raw.trim();
+  if (!trimmed || NON_PATH_SENTINEL_RE.test(trimmed)) return null;
+  if (!shouldValidateInputAsPath(trimmed)) return null;
+  return extractPathFromAnnotation(trimmed);
+}
+
 function shouldValidateInputAsPath(raw: string): boolean {
   const trimmed = raw.trim();
   if (!trimmed) return false;
@@ -483,7 +490,8 @@ function shouldValidateInputAsPath(raw: string): boolean {
   if (URL_SCHEME_PATTERN.test(candidate)) return false;
   if (SCP_PATTERN.test(candidate)) return false;
 
-  if (/^`+[^`]+`+/.test(trimmed)) {
+  const explicitlyWrappedPath = /^`+[^`]+`+/.test(trimmed) || /^(["'])([^"']+)\1$/.test(trimmed);
+  if (explicitlyWrappedPath && looksLikePathOrUrl(candidate)) {
     return true;
   }
 
@@ -496,7 +504,6 @@ function shouldValidateInputAsPath(raw: string): boolean {
     candidate.startsWith("./") ||
     candidate.startsWith("../") ||
     candidate.startsWith("~/") ||
-    /[\\/]/.test(candidate) ||
     /[*?[\]{}]/.test(candidate)
   );
 }

package/src/resources/extensions/gsd/preferences-models.ts

@@ -19,6 +19,9 @@ import type {
   GSDPreferences,
   GSDModelConfigV2,
   GSDPhaseModelConfig,
+  GSDThinkingLevel,
+  GSDModelPhaseKey,
+  GSDThinkingConfig,
   ResolvedModelConfig,
   AutoSupervisorConfig,
 } from "./preferences-types.js";
@@ -37,82 +40,103 @@ export function resolveModelForUnit(unitType: string): string | undefined {
 }
 
 /**
- * Resolve model and fallbacks for a given auto-mode unit type.
- * Returns the primary model and ordered fallbacks, or undefined if not configured.
+ * Ordered phase-bucket chain a unit type resolves against, most-specific
+ * first. The first chain entry with a configured value wins; later entries
+ * are siblings the unit falls back to (e.g. `discuss → planning`).
  *
- * Supports both legacy string format and extended object format:
- * - Legacy: `planning: claude-opus-4-6`
- * - Extended: `planning: { model: claude-opus-4-6, fallbacks: [glm-5, minimax-m2.5] }`
+ * Single source of truth for the unit-type → phase mapping, shared by model
+ * resolution (`resolveModelWithFallbacksForUnit`) and thinking resolution
+ * (`resolveThinkingLevelForUnit`) so the two never drift (ADR-026).
  */
-export function resolveModelWithFallbacksForUnit(unitType: string): ResolvedModelConfig | undefined {
-  const prefs = loadEffectiveGSDPreferences(undefined, { availableModelIds: [] });
-  const models = prefs?.preferences?.models;
-  if (!models) return undefined;
-  const m = models as GSDModelConfigV2;
-
-  let phaseConfig: string | GSDPhaseModelConfig | undefined;
+export function phaseChainForUnit(unitType: string): GSDModelPhaseKey[] | undefined {
   switch (unitType) {
     case "research-milestone":
     case "research-slice":
-      phaseConfig = m.research;
-      break;
+    // Deep-mode project research orchestrator. Reads PROJECT.md / REQUIREMENTS.md
+    // and fans out research subagents. Routes to the research bucket.
+    case "research-project":
+      return ["research"];
     case "plan-milestone":
     case "plan-slice":
     case "refine-slice":
     case "replan-slice":
-      phaseConfig = m.planning;
-      break;
+      return ["planning"];
+    // Deep-mode project-level discussion units route to the same model bucket
+    // as milestone-level discussion (interactive interview style). Workflow
+    // preferences and research-decision are tiny ask_user_questions style units
+    // that share the discuss bucket because they are conversational. All fall
+    // back to planning when no `discuss` bucket is set.
     case "discuss-milestone":
     case "discuss-slice":
-    // Deep-mode project-level discussion units route to the same model
-    // bucket as milestone-level discussion (interactive interview style).
     case "discuss-project":
     case "discuss-requirements":
-    // Workflow preferences and research-decision are tiny ask_user_questions
-    // style units; they share the discuss bucket because they are
-    // conversational rather than research/execution. Falling back to planning
-    // when no `discuss` bucket is set keeps parity with the milestone units.
     case "workflow-preferences":
     case "research-decision":
-      phaseConfig = m.discuss ?? m.planning;
-      break;
-    // Deep-mode project research orchestrator. Reads PROJECT.md / REQUIREMENTS.md
-    // and fans out research subagents. Routes to the research bucket so it
-    // gets the research-tier model when one is configured.
-    case "research-project":
-      phaseConfig = m.research;
-      break;
+      return ["discuss", "planning"];
     case "execute-task":
     case "reactive-execute":
-      phaseConfig = m.execution;
-      break;
+      return ["execution"];
     case "execute-task-simple":
-      phaseConfig = m.execution_simple ?? m.execution;
-      break;
+      return ["execution_simple", "execution"];
     case "complete-slice":
     case "complete-milestone":
     case "worktree-merge":
-      phaseConfig = m.completion;
-      break;
+      return ["completion"];
     case "run-uat":
-      phaseConfig = m.uat ?? m.completion;
-      break;
+      return ["uat", "completion"];
     case "reassess-roadmap":
     case "rewrite-docs":
     case "gate-evaluate":
     case "validate-milestone":
-      phaseConfig = m.validation ?? m.planning;
-      break;
+      return ["validation", "planning"];
     default:
       // Subagent unit types (e.g., "subagent", "subagent/scout")
       if (unitType === "subagent" || unitType.startsWith("subagent/")) {
-        phaseConfig = m.subagent;
-        break;
+        return ["subagent"];
       }
       return undefined;
   }
+}
 
-  if (!phaseConfig) return undefined;
+/**
+ * Find the phase bucket whose `models` entry wins the chain for a unit, plus
+ * that entry. Returns undefined when no phase in the chain is configured.
+ */
+function resolveWinningPhase(
+  models: GSDModelConfigV2 | undefined,
+  chain: GSDModelPhaseKey[],
+): { phase: GSDModelPhaseKey; config: string | GSDPhaseModelConfig } | undefined {
+  if (!models) return undefined;
+  for (const key of chain) {
+    const config = models[key];
+    // Falsy check (not `!= null`) so an empty-string model is treated as
+    // unconfigured and the chain falls through — matches the pre-refactor
+    // switch, which bailed via `if (!phaseConfig)`.
+    if (!config) continue;
+    // An object entry only "wins" if it provides a usable model. A model-less
+    // object (e.g. `{ provider: x }`, or `{}` left after stripping an invalid
+    // `thinking`) must not shadow sibling fallback or yield `{ primary: undefined }`.
+    if (typeof config === "object" && !config.model) continue;
+    return { phase: key, config };
+  }
+  return undefined;
+}
+
+/**
+ * Resolve model and fallbacks for a given auto-mode unit type.
+ * Returns the primary model and ordered fallbacks, or undefined if not configured.
+ *
+ * Supports both legacy string format and extended object format:
+ * - Legacy: `planning: claude-opus-4-6`
+ * - Extended: `planning: { model: claude-opus-4-6, fallbacks: [glm-5, minimax-m2.5] }`
+ */
+export function resolveModelWithFallbacksForUnit(unitType: string): ResolvedModelConfig | undefined {
+  const prefs = loadEffectiveGSDPreferences(undefined, { availableModelIds: [] });
+  const chain = phaseChainForUnit(unitType);
+  if (!chain) return undefined;
+  const winner = resolveWinningPhase(prefs?.preferences?.models as GSDModelConfigV2 | undefined, chain);
+  if (!winner) return undefined;
+  const phaseConfig = winner.config;
 
   // Normalize: string -> { model, fallbacks: [] }
   if (typeof phaseConfig === "string") {
@@ -131,6 +155,51 @@ export function resolveModelWithFallbacksForUnit(unitType: string): ResolvedMode
   };
 }
 
+/**
+ * Resolve the explicitly configured reasoning effort for a unit type (ADR-026).
+ *
+ * Thinking travels with the model. The chain is walked most-specific-first up to
+ * and including the phase whose model won; at each level inline
+ * `models.<phase>.thinking` is preferred, then the same phase's `thinking` block
+ * entry. This means:
+ * - a more-specific block key (`thinking.execution_simple`) surfaces even when
+ *   the model only resolves on a less-specific sibling (`models.execution`);
+ * - inline thinking is honored even on a model-less `models.<phase>` entry
+ *   (e.g. `{ thinking: "high" }` with no `model`);
+ * - a unit that claimed its own model bucket never borrows a *less*-specific
+ *   sibling's thinking (the walk stops at the winning phase).
+ * When no model is configured anywhere in the chain, the walk spans the full
+ * chain so inline thinking and the `thinking` block both resolve on their own
+ * sibling chain.
+ *
+ * Returns undefined when nothing explicit is configured — the dispatch path
+ * then falls back to the session/default level and applies the code-writing
+ * floor. Session level, defaults, the floor, and capability clamping are NOT
+ * applied here.
+ */
+export function resolveThinkingLevelForUnit(unitType: string): GSDThinkingLevel | undefined {
+  const prefs = loadEffectiveGSDPreferences(undefined, { availableModelIds: [] })?.preferences;
+  if (!prefs) return undefined;
+  const chain = phaseChainForUnit(unitType);
+  if (!chain) return undefined;
+
+  const models = prefs.models as GSDModelConfigV2 | undefined;
+  const block = prefs.thinking as GSDThinkingConfig | undefined;
+
+  // Walk most-specific-first, up to and including the winning model phase (or
+  // the full chain when no model is configured), checking inline then block.
+  const winner = resolveWinningPhase(models, chain);
+  const limit = winner ? chain.indexOf(winner.phase) + 1 : chain.length;
+  for (let i = 0; i < limit; i++) {
+    const key = chain[i];
+    const entry = models?.[key];
+    if (typeof entry === "object" && entry?.thinking) return entry.thinking; // inline (incl. model-less)
+    const blockLevel = block?.[key];
+    if (blockLevel) return blockLevel;                                       // block
+  }
+  return undefined;
+}
+
 /**
  * Resolve the default session model from GSD preferences.
  *
@@ -372,6 +441,7 @@ export function resolveAutoSupervisorConfig(): AutoSupervisorConfig {
     soft_timeout_minutes: configured.soft_timeout_minutes ?? 20,
     idle_timeout_minutes: configured.idle_timeout_minutes ?? 10,
     hard_timeout_minutes: configured.hard_timeout_minutes ?? 30,
+    stalled_tool_timeout_minutes: configured.stalled_tool_timeout_minutes ?? 5,
     ...(configured.model ? { model: configured.model } : {}),
   };
 }

package/src/resources/extensions/gsd/preferences-types.ts

@@ -99,6 +99,7 @@ export const KNOWN_PREFERENCE_KEYS = new Set<string>([
   "skill_rules",
   "custom_instructions",
   "models",
+  "thinking",
   "skill_discovery",
   "skill_staleness_days",
   "auto_supervisor",
@@ -198,6 +199,28 @@ export interface GSDSkillRule {
   avoid?: string[];
 }
 
+/**
+ * Reasoning effort levels. Mirrors `ThinkingLevel` in `@gsd/pi-agent-core`;
+ * declared locally so preference parsing/validation does not import the agent
+ * core package. `xhigh` is only honored by models whose `thinkingLevelMap`
+ * advertises it — unsupported levels are clamped at dispatch (ADR-026).
+ */
+export type GSDThinkingLevel = "off" | "minimal" | "low" | "medium" | "high" | "xhigh";
+
+/** The nine model-routing phase buckets. */
+export const GSD_MODEL_PHASE_KEYS = [
+  "research",
+  "planning",
+  "discuss",
+  "execution",
+  "execution_simple",
+  "completion",
+  "validation",
+  "subagent",
+  "uat",
+] as const;
+export type GSDModelPhaseKey = (typeof GSD_MODEL_PHASE_KEYS)[number];
+
 /**
  * Model configuration for a single phase.
  * Supports primary model with optional fallbacks for resilience.
@@ -209,8 +232,22 @@ export interface GSDPhaseModelConfig {
   provider?: string;
   /** Fallback models to try in order if primary fails (e.g., rate limits, credits exhausted) */
   fallbacks?: string[];
+  /**
+   * Reasoning effort for this phase (ADR-026). Travels with the model: an
+   * explicit value here bypasses the `execute-task` thinking floor and is
+   * capability-clamped to the resolved model at dispatch. Takes precedence
+   * over a same-phase entry in the separate `thinking` block.
+   */
+  thinking?: GSDThinkingLevel;
 }
 
+/**
+ * Separate per-phase reasoning-effort block (ADR-026). An alternative to
+ * inline `models.<phase>.thinking` that lets thinking be pinned without
+ * pinning a model. Same nine phase keys as `models`.
+ */
+export type GSDThinkingConfig = Partial<Record<GSDModelPhaseKey, GSDThinkingLevel>>;
+
 /**
  * Legacy model config -- simple string per phase.
  * Kept for backward compatibility; will be migrated to GSDModelConfigV2 on load.
@@ -256,6 +293,14 @@ export interface AutoSupervisorConfig {
   soft_timeout_minutes?: number;
   idle_timeout_minutes?: number;
   hard_timeout_minutes?: number;
+  /**
+   * Dedicated budget for a single in-flight tool call before it is treated as
+   * hung. Distinct from `idle_timeout_minutes`: a genuinely stuck tool should
+   * be recovered in minutes rather than waiting out the full idle window. A
+   * long-but-progressing session is not idle, so it must not share the hung-tool
+   * threshold.
+   */
+  stalled_tool_timeout_minutes?: number;
 }
 
 export interface RemoteQuestionsConfig {
@@ -364,6 +409,8 @@ export interface GSDPreferences {
   skill_rules?: GSDSkillRule[];
   custom_instructions?: string[];
   models?: GSDModelConfig | GSDModelConfigV2;
+  /** Per-phase reasoning effort, separate from `models` (ADR-026). */
+  thinking?: GSDThinkingConfig;
   skill_discovery?: SkillDiscoveryMode;
   skill_staleness_days?: number;  // Skills unused for N days get deprioritized (#599). 0 = disabled. Default: 60.
   auto_supervisor?: AutoSupervisorConfig;

package/src/resources/extensions/gsd/preferences-validation.ts

@@ -12,18 +12,30 @@ import type { DynamicRoutingConfig } from "./model-router.js";
 import { isAbsolute } from "node:path";
 import { VALID_BRANCH_NAME } from "./git-service.js";
 import { normalizeStringArray } from "../shared/format-utils.js";
+import { getGateIdsForTurn } from "./gate-registry.js";
 
 import {
   KNOWN_PREFERENCE_KEYS,
   KNOWN_UNIT_LABELS,
+  GSD_MODEL_PHASE_KEYS,
 
   SKILL_ACTIONS,
   type WorkflowMode,
   type GSDPreferences,
   type GSDSkillRule,
+  type GSDThinkingLevel,
 } from "./preferences-types.js";
 
 const VALID_TOKEN_PROFILES = new Set<TokenProfile>(["budget", "balanced", "quality", "burn-max"]);
+const VALID_THINKING_LEVELS = new Set<GSDThinkingLevel>([
+  "off",
+  "minimal",
+  "low",
+  "medium",
+  "high",
+  "xhigh",
+]);
+const KNOWN_MODEL_PHASE_KEYS = new Set<string>(GSD_MODEL_PHASE_KEYS);
 const VALID_UOK_TURN_ACTIONS = new Set<"commit" | "snapshot" | "status-only">([
   "commit",
   "snapshot",
@@ -37,6 +49,7 @@ const VALID_POST_UNIT_HOOK_ON_BLOCK_ACTIONS = new Set([
   "queue-slice",
   "pause",
 ]);
+const VALID_GATE_EVALUATE_SLICE_GATES = new Set<string>(getGateIdsForTurn("gate-evaluate"));
 
 export function validatePreferences(preferences: GSDPreferences): {
   preferences: GSDPreferences;
@@ -390,12 +403,66 @@ export function validatePreferences(preferences: GSDPreferences): {
   // ─── Models ─────────────────────────────────────────────────────────
   if (preferences.models !== undefined) {
     if (preferences.models && typeof preferences.models === "object") {
-      validated.models = preferences.models;
+      // Static check for inline per-phase thinking (ADR-026). The resolved
+      // model isn't known until dispatch, so capability is clamped there; here
+      // we warn on illegal level strings AND strip them, so a typo can't reach
+      // resolveThinkingLevelForUnit and be treated as explicit configuration.
+      const sanitizedModels: Record<string, unknown> = {};
+      for (const [phase, entry] of Object.entries(preferences.models as Record<string, unknown>)) {
+        if (entry && typeof entry === "object" && "thinking" in entry) {
+          const level = (entry as { thinking?: unknown }).thinking;
+          if (level !== undefined && !VALID_THINKING_LEVELS.has(level as GSDThinkingLevel)) {
+            warnings.push(
+              `models.${phase}.thinking "${String(level)}" is not a valid thinking level ` +
+              `(off, minimal, low, medium, high, xhigh) — ignored`,
+            );
+            const { thinking: _ignored, ...rest } = entry as Record<string, unknown>;
+            // If stripping the bad thinking leaves no usable model, drop the
+            // phase entirely rather than storing a hollow `{}` / `{ provider }`
+            // entry that resolveWinningPhase would otherwise treat as configured.
+            if (rest.model) {
+              sanitizedModels[phase] = rest;
+            }
+            continue;
+          }
+        }
+        sanitizedModels[phase] = entry;
+      }
+      validated.models = sanitizedModels as GSDPreferences["models"];
     } else {
       errors.push("models must be an object");
     }
   }
 
+  // ─── Thinking (separate per-phase block, ADR-026) ───────────────────
+  if (preferences.thinking !== undefined) {
+    if (preferences.thinking && typeof preferences.thinking === "object" && !Array.isArray(preferences.thinking)) {
+      const validatedThinking: Record<string, GSDThinkingLevel> = {};
+      for (const [phase, level] of Object.entries(preferences.thinking as Record<string, unknown>)) {
+        if (!KNOWN_MODEL_PHASE_KEYS.has(phase)) {
+          warnings.push(
+            `unknown thinking phase "${phase}" — must be one of: ` +
+            `${[...KNOWN_MODEL_PHASE_KEYS].join(", ")} — ignored`,
+          );
+          continue;
+        }
+        if (!VALID_THINKING_LEVELS.has(level as GSDThinkingLevel)) {
+          warnings.push(
+            `thinking.${phase} "${String(level)}" is not a valid thinking level ` +
+            `(off, minimal, low, medium, high, xhigh) — ignored`,
+          );
+          continue;
+        }
+        validatedThinking[phase] = level as GSDThinkingLevel;
+      }
+      if (Object.keys(validatedThinking).length > 0) {
+        validated.thinking = validatedThinking;
+      }
+    } else {
+      errors.push("thinking must be an object");
+    }
+  }
+
   // ─── Auto Supervisor ────────────────────────────────────────────────
   if (preferences.auto_supervisor !== undefined) {
     if (preferences.auto_supervisor && typeof preferences.auto_supervisor === "object") {
@@ -907,7 +974,14 @@ export function validatePreferences(preferences: GSDPreferences): {
       }
       if (ge.slice_gates !== undefined) {
         if (Array.isArray(ge.slice_gates) && ge.slice_gates.every((g: unknown) => typeof g === "string")) {
-          validGe.slice_gates = ge.slice_gates;
+          const invalid = ge.slice_gates.filter((g) => !VALID_GATE_EVALUATE_SLICE_GATES.has(g));
+          if (invalid.length === 0) {
+            validGe.slice_gates = ge.slice_gates;
+          } else {
+            errors.push(
+              `gate_evaluation.slice_gates must contain only gate-evaluate slice gates: ${[...VALID_GATE_EVALUATE_SLICE_GATES].join(", ")}`,
+            );
+          }
         } else {
           errors.push("gate_evaluation.slice_gates must be an array of strings");
         }

package/src/resources/extensions/gsd/preferences.ts

@@ -86,6 +86,8 @@ export function resolveSkillStalenessDays(basePath?: string): number {
 export {
   resolveModelForUnit,
   resolveModelWithFallbacksForUnit,
+  resolveThinkingLevelForUnit,
+  phaseChainForUnit,
   getNextFallbackModel,
   isTransientNetworkError,
   validateModelId,
@@ -437,6 +439,9 @@ function mergePreferences(base: GSDPreferences, override: GSDPreferences): GSDPr
     skill_rules: [...(base.skill_rules ?? []), ...(override.skill_rules ?? [])],
     custom_instructions: mergeStringLists(base.custom_instructions, override.custom_instructions),
     models: { ...(base.models ?? {}), ...(override.models ?? {}) },
+    thinking: (base.thinking || override.thinking)
+      ? { ...(base.thinking ?? {}), ...(override.thinking ?? {}) }
+      : undefined,
     skill_discovery: override.skill_discovery ?? base.skill_discovery,
     skill_staleness_days: override.skill_staleness_days ?? base.skill_staleness_days,
     auto_supervisor: { ...(base.auto_supervisor ?? {}), ...(override.auto_supervisor ?? {}) },

package/src/resources/extensions/gsd/prompts/gate-evaluate.md

@@ -38,7 +38,7 @@ You are evaluating **quality gates in parallel** for this slice. Each gate is an
 3. **Verify each gate wrote its result** by checking that `gsd_save_gate_result` was called for each gate ID.
    - Call it **directly** — do **not** use `ToolSearch` (it is not available in GSD).
    - Inside Claude Code use the active MCP-scoped workflow name for `gsd_save_gate_result`; otherwise use `gsd_save_gate_result`.
-   - Always pass all required fields (camelCase): `milestoneId`, `sliceId`, `gateId`, `verdict`, `rationale`. Never call with an empty `{}` object.
+   - Always pass all required fields (camelCase): `milestoneId`, `sliceId`, `gateId`, `verdict`, `rationale`, and `findings` (empty string if none). Never call with an empty `{}` object.
 4. **Report the batch outcome** — which gates passed, which flagged concerns, and which were omitted as not applicable.
 
 Gate agents may return `verdict: "omitted"` if the gate question is not applicable to this slice (e.g., no auth surface for Q3, no existing requirements touched for Q4). This is expected for simple slices.