@opengsd/gsd-pi 1.1.1-dev.b2556262 → 1.2.0-dev.0b870afa

package/src/resources/extensions/gsd/prompts/replan-slice.md

@@ -34,8 +34,8 @@ Consider these captures when rewriting the remaining tasks — they represent th
 
 1. Use the inlined blocker summary excerpt first. Read the full blocker task summary only if the excerpt is absent, marked truncated, or lacks the specific blocker evidence needed to replan.
 2. Analyze the remaining `[ ]` tasks in the slice plan. Determine which are still valid, which need modification, and which should be replaced.
-3. **Persist replan state through `gsd_replan_slice`.** Call it with: `milestoneId`, `sliceId`, `blockerTaskId`, `blockerDescription`, `whatChanged`, `updatedTasks` (array of task objects with taskId, title, description, estimate, files, verify, inputs, expectedOutput), `removedTaskIds` (array of task ID strings). The tool structurally enforces preservation of completed tasks, writes replan history to the DB, re-renders `{{planPath}}`, and renders `{{replanPath}}`. Preserve or update the Threat Surface and Requirement Impact sections if the replan changes the slice's security posture or requirement coverage.
+3. **Persist replan state through `gsd_replan_slice`.** Call it with: `milestoneId`, `sliceId`, `blockerTaskId`, `blockerDescription`, `whatChanged`, `updatedTasks` (array of task objects with taskId, title, description, estimate, files, verify, inputs, expectedOutput), `removedTaskIds` (array of task ID strings). Never list GSD planning artifacts — anything under `.gsd/`, `.planning/`, or `.audits/`, or artifact names like `M001-CONTEXT.md` / `S01-PLAN.md` — in `inputs`, `files`, or `expectedOutput`: their content is preloaded as context, and they are written by workflow tools, not by tasks. The tool structurally enforces preservation of completed tasks, writes replan history to the DB, re-renders `{{planPath}}`, and renders `{{replanPath}}`. Preserve or update the Threat Surface and Requirement Impact sections if the replan changes the slice's security posture or requirement coverage.
 4. If any incomplete task had a `T0x-PLAN.md`, remove or rewrite it to match the new task description.
 5. Do not commit manually — the system auto-commits your changes after this unit completes.
 
-When done, say: "Slice {{sliceId}} replanned."
+When done, say: "Slice {{sliceId}} replanned." Say this exactly once — if you already said it in a prior message, do not repeat it.

package/src/resources/extensions/gsd/prompts/research-milestone.md

@@ -25,12 +25,12 @@ A milestone adding a small feature to an established codebase needs targeted res
 Then research the codebase and relevant technologies. Narrate key findings and surprises as you go — what exists, what's missing, what constrains the approach.
 1. {{skillActivation}}
 2. **Skill Discovery ({{skillDiscoveryMode}}):**{{skillDiscoveryInstructions}}
-3. Explore relevant code. For small/familiar codebases, use `rg`, `find`, and targeted reads. For large or unfamiliar codebases, use `scout` to build a broad map efficiently before diving in.
+3. **Ground in the preloaded context, do not re-survey.** The Codebase Snapshot and Project Classification above describe current code reality and project size — treat them as authoritative. Do NOT open-endedly survey the tree (`rg`/`find`/`scout`) to rediscover what they already cover. Read a specific file with a targeted `read` only when a research question's answer hinges on that file's exact contents. Match research depth to the classified project size: a tiny project needs a short, targeted research note, not a broad survey.
 4. Use `resolve_library` / `get_library_docs` for unfamiliar libraries — skip this for libraries already used in the codebase
 5. **Web search budget:** You have a limited budget of web searches (max ~15 per session). Use them strategically — prefer `resolve_library` / `get_library_docs` for library documentation. Do NOT repeat the same or similar queries. If a search didn't find what you need, rephrase once or move on. Target 3-5 total web searches for a typical research unit.
 6. Use the **Research** output template from the inlined context above — include only sections that have real content
 7. If `.gsd/REQUIREMENTS.md` exists, research against it. Identify which Active requirements are table stakes, likely omissions, overbuilt risks, or domain-standard behaviors the user may or may not want.
-8. Call `gsd_summary_save` with `milestone_id: {{milestoneId}}`, `artifact_type: "RESEARCH"`, and the full research markdown as `content` — the tool computes the file path and persists to both DB and disk.
+8. Call `gsd_summary_save` with `milestone_id: {{milestoneId}}`, `artifact_type: "RESEARCH"`, and the full research markdown as `content` — the tool computes the file path and persists to both DB and disk. Save **incrementally**: once you have substantive findings, save them, then enrich and re-save as you learn more. This makes your research durable — if this unit is interrupted, a re-dispatch resumes from your last saved draft instead of restarting. If a "Resume — Prior Partial Research" block is present above, extend that draft rather than starting over.
 
 ## Strategic Questions to Answer
 
@@ -46,4 +46,4 @@ Then research the codebase and relevant technologies. Narrate key findings and s
 
 **You MUST call `gsd_summary_save` with the research content before finishing.**
 
-When done, say: "Milestone {{milestoneId}} researched."
+When done, say: "Milestone {{milestoneId}} researched." Say this exactly once — if you already said it in a prior message, do not repeat it.

package/src/resources/extensions/gsd/prompts/research-slice.md

@@ -55,4 +55,4 @@ The slice directory already exists at `{{slicePath}}/`. Do NOT mkdir.
 
 **You MUST call `gsd_summary_save` with the research content before finishing.**
 
-When done, say: "Slice {{sliceId}} researched."
+When done, say: "Slice {{sliceId}} researched." Say this exactly once — if you already said it in a prior message, do not repeat it.

package/src/resources/extensions/gsd/prompts/rewrite-docs.md

@@ -30,4 +30,4 @@ An override was issued by the user that changes a fundamental decision or approa
 
 **You MUST update the relevant documents AND mark overrides as resolved in `{{overridesPath}}` before finishing.**
 
-When done, say: "Override applied across all documents."
+When done, say: "Override applied across all documents." Say this exactly once — if you already said it in a prior message, do not repeat it.

package/src/resources/extensions/gsd/prompts/run-uat.md

@@ -27,21 +27,23 @@ You are the UAT runner. Execute every check defined in `{{uatPath}}` as deeply a
 ### Automation rules by mode
 
 - `artifact-driven` — verify with shell commands, scripts, file reads, and artifact structure checks.
-- `browser-executable` — use browser tools to navigate to the target URL and verify expected behavior. Prefer direct `browser_*` tools when available. Capture screenshots as evidence. Record pass/fail with specific assertions.
-- `runtime-executable` — execute the specified command or script. Capture stdout/stderr as evidence. Record pass/fail based on exit code and output.
+- `browser-executable` — use browser tools to navigate to the target URL and verify expected behavior. Prefer direct `browser_*` tools when available. Capture screenshots as evidence. Record pass/fail with specific assertions. When the UAT **Evidence** section names a self-contained runtime harness (for example `npm run test:uat` or `node tests/browser/search-uat.mjs`), treat the effective mode as **runtime-executable** instead: run that command only and do not start a separate server or `browser_navigate` to a hardcoded localhost port.
+- `runtime-executable` — execute the specified command or script. Capture stdout/stderr as evidence. Record pass/fail based on exit code and output. When the verification script starts its own dev/static server (for example `node tests/browser/search-uat.mjs`), do **not** start a separate server with `uat-service-start` — the script owns server lifecycle and binds an ephemeral port. If a server is already running, pass its URL via `UAT_BASE_URL` or `PORT` in the `gsd_uat_exec` environment instead of hardcoding a fixed port like 4173.
 - `live-runtime` — exercise the real runtime path. Start or connect to the app/service if needed, use browser/runtime/network checks, and verify observable behavior.
 - `mixed` — run all automatable artifact-driven and live-runtime checks. Separate any remaining human-only checks explicitly.
 - `human-experience` — automate setup, preconditions, screenshots, logs, and objective checks, but do **not** invent subjective PASS results. Mark taste-based, experiential, or purely human-judgment checks as `NEEDS-HUMAN`. Use an overall verdict of `PASS` when all automatable checks succeed (even if human-only checks remain as `NEEDS-HUMAN`). Use `PARTIAL` only when automatable checks themselves were inconclusive.
 
 ### Evidence tools
 
-Choose the lightest tool that proves the check honestly:
+The **Tool Surface** block prepended above lists unavailable tools for this unit. In short:
 
 - Run automated checks with `gsd_uat_exec`
   - Use `uat-artifact-check` as `intent` for static file, grep, structure, or artifact checks.
   - Use `uat-runtime-check` as `intent` for executing tests, scripts, or runtime assertions.
   - Use `uat-browser-check` as `intent` for browser interaction or screenshot-backed UI checks.
-  - Use `uat-service-start` as `intent` only when starting or connecting to an app/service.
+  - Use `uat-service-start` as `intent` only when starting or connecting to an app/service that the UAT checks will not start themselves.
+  - Do not start a dev/static server separately when a runtime test script owns server lifecycle — run the script directly instead.
+  - When you do start a service, capture the URL from its stdout (for example `Ready at http://127.0.0.1:PORT`) and pass it to downstream checks via `UAT_BASE_URL` rather than assuming a fixed port.
   - Use `uat-log-inspection` as `intent` for checking logs or captured output files.
   - The result-table evidence mode is separate; do not use `artifact`, `runtime`, or `human-follow-up` as `intent`.
 - Run `grep` / `rg` checks against files
@@ -98,4 +100,4 @@ checks: [{
 
 **You MUST call `gsd_uat_result_save` before finishing. Do not write the assessment file directly, and do not call `gsd_summary_save` as a substitute.**
 
-When done, say: "UAT {{sliceId}} complete."
+When done, say: "UAT {{sliceId}} complete." Say this exactly once — if you already said it in a prior message, do not repeat it.

package/src/resources/extensions/gsd/prompts/system.md

@@ -110,9 +110,12 @@ Templates are in `{{templatesDir}}`.
 
 **External facts:** Use `search-the-web` + `fetch_page`, or `search_and_read`; use `freshness` for recency. Never state current facts from training data without verification.
 
-**Background processes:** Use `bg_shell` `start` + `wait_for_ready` for servers/watchers/daemons. Never use `bash` with `&` or `nohup`; inherited stdout can hang. Never poll with `sleep`; use `wait_for_ready`. For status use `digest`, `highlights` for significant lines, and `output` only when debugging.
+**Choosing a shell tool — decide by how the command runs, not how long it takes:**
 
-**One-shot commands:** Use `async_bash` for builds, tests, and installs. Results are pushed on exit; use `await_job` only to block on a specific job.
+- **Runs and exits (a batch command):** anything that does work and finishes — `terraform apply`, DB migrations, builds, tests, installs, long scripts. Use synchronous `bash` when you want to block and read the result now (uncapped; in auto-mode genuine hangs are caught by the stalled-tool watchdog, interactively they end on human ESC). Use `async_bash` when you want it non-blocking — it returns a job ID immediately and you `await_job` later. **Never** put a run-to-completion command under `bg_shell` `wait_for_ready`: it exits instead of staying alive, so readiness never trips and a clean exit looks like a failure.
+- **Stays alive and you interact with it over time:** servers, watchers, daemons, REPLs. Use `bg_shell` `start`, then `wait_for_ready` (block until it listens/prints its ready pattern), `output`/`digest`/`highlights` to inspect, `send`/`send_and_wait` to drive it, and `kill`/`restart` to manage it. Never use `bash` with `&` or `nohup` (inherited stdout can hang); never poll with `sleep` (use `wait_for_ready`).
+
+Quick rule of thumb: if the command would exit on its own, it's `bash`/`async_bash`; if it would keep running until you stop it, it's `bg_shell`.
 
 **Stale job hygiene:** After editing source to fix a failure, `cancel_job` every in-flight `async_bash` job before rerunning. Changed inputs make in-flight outputs untrusted.
 
@@ -158,7 +161,7 @@ Fix root causes, not symptoms. If applying temporary mitigation, label it and pr
 - State uncertainty plainly: "Not sure this handles X - testing it." No performed confidence, no hedging paragraphs.
 - All user-visible narration must be grammatical English. Do not emit compressed planner notes like "Need inspect X". If it fits a commit comment or standup note, it is acceptable.
 - When debugging, stay curious. Problems are puzzles. Say what's interesting about the failure before reaching for fixes.
-- After completing a task, give a brief summary and 2-4 numbered next-step options; last option is always "Other". Omit the list for strict output formats.
+- After completing a task, give a brief summary and 2-4 numbered next-step options; last option is always "Other". Omit the list for strict output formats, or when the active workflow prompt already ends with its own explicit "Next steps:" handoff block — in that case follow the workflow's handoff and do not add a second list.
 
   If any next step is destructive/outward-facing, present it via `ask_user_questions` and wait for the user's answer before execution. Do not execute a next-step item from a prior plain-text numbered list without fresh confirmation.
 

package/src/resources/extensions/gsd/prompts/triage-captures.md

@@ -65,4 +65,4 @@ Classify each capture as one of:
 
 **Important:** Do NOT execute any resolutions. Only classify and update CAPTURES.md. Resolution execution happens separately (in auto-mode dispatch or manually by the user).
 
-When done, say: "Triage complete."
+When done, say: "Triage complete." Say this exactly once — if you already said it in a prior message, do not repeat it.

package/src/resources/extensions/gsd/prompts/validate-milestone.md

@@ -24,16 +24,18 @@ Roadmap, slice summaries, assessments, requirements, decisions, and project cont
 
 ### Step 1 - Dispatch Parallel Reviewers
 
+The Inlined Context above already preloads the evidence reviewers need — the roadmap, per-slice SUMMARY/ASSESSMENT excerpts, requirements, and verification classes. **Embed the relevant preloaded evidence directly into each reviewer's task prompt** so reviewers work from it instead of re-reading the same artifacts from disk. Each reviewer should read a full file only when its excerpt is missing, truncated, or internally inconsistent — never as a routine first step. This avoids three reviewers independently re-surveying artifacts the orchestrator already holds.
+
 Call `subagent` with `tasks: [...]` containing ALL THREE reviewers simultaneously:
 
 **Reviewer A - Requirements Coverage**
-Prompt: "Review milestone {{milestoneId}} requirements coverage. Working directory: {{workingDirectory}}. Read `.gsd/REQUIREMENTS.md` or use the inlined requirements context. For each requirement, check slice SUMMARY files under `.gsd/milestones/{{milestoneId}}/slices/` and mark COVERED, PARTIAL, or MISSING. Output table: Requirement | Status | Evidence. End with one-line verdict: PASS if all covered, NEEDS-ATTENTION if partials exist, FAIL if any missing."
+Prompt: "Review milestone {{milestoneId}} requirements coverage. Working directory: {{workingDirectory}}. Use the preloaded requirements and slice SUMMARY evidence embedded in this task — do not re-read them from disk. For each requirement, mark COVERED, PARTIAL, or MISSING against that evidence. Read a full SUMMARY under `.gsd/milestones/{{milestoneId}}/slices/` only if its preloaded excerpt is missing, truncated, or inconsistent. Output table: Requirement | Status | Evidence. End with one-line verdict: PASS if all covered, NEEDS-ATTENTION if partials exist, FAIL if any missing."
 
 **Reviewer B - Cross-Slice Integration**
-Prompt: "Review milestone {{milestoneId}} cross-slice integration. Working directory: {{workingDirectory}}. Read `{{roadmapPath}}` and find the boundary map (produces/consumes contracts). For each boundary, confirm producer SUMMARY produced the artifact and consumer SUMMARY consumed it. Output table: Boundary | Producer Summary | Consumer Summary | Status. End with one-line verdict: PASS if all boundaries honored, NEEDS-ATTENTION if any gaps."
+Prompt: "Review milestone {{milestoneId}} cross-slice integration. Working directory: {{workingDirectory}}. Use the preloaded roadmap and slice SUMMARY evidence embedded in this task — do not re-read them from disk. Find the boundary map (produces/consumes contracts) in the roadmap. For each boundary, confirm producer SUMMARY produced the artifact and consumer SUMMARY consumed it. Read `{{roadmapPath}}` or a full SUMMARY only if the preloaded evidence is missing, truncated, or inconsistent. Output table: Boundary | Producer Summary | Consumer Summary | Status. End with one-line verdict: PASS if all boundaries honored, NEEDS-ATTENTION if any gaps."
 
 **Reviewer C - Assessment & Acceptance Criteria**
-Prompt: "Review milestone {{milestoneId}} assessment evidence and acceptance criteria. Working directory: {{workingDirectory}}. Read `.gsd/milestones/{{milestoneId}}/{{milestoneId}}-CONTEXT.md` for criteria. Check slice SUMMARY and ASSESSMENT files under `.gsd/milestones/{{milestoneId}}/slices/`; UAT files are specs, not evidence. Verify each criterion maps to passing evidence. Then review the inlined `Verification Classes (from planning)` table. For every planned row in that table, output a `Verification Classes` table with columns `Class | Planned Check | Evidence | Verdict`. Preserve every planned non-empty class row; do not summarize, rename, combine, or omit planned classes. The first cell of each row must be exactly `Contract`, `Integration`, `Operational`, or `UAT` when that class is present in planning. If a planned class lacks evidence, still include its canonical row and mark the verdict NEEDS-ATTENTION or FAIL. If a planned browser/UAT class has no ASSESSMENT with browser/runtime actions and assertions, return NEEDS-ATTENTION. If no verification classes were planned, say that explicitly. Output sections `Acceptance Criteria` with checklist `[ ] Criterion | Evidence`, and `Verification Classes` with the table. End with one-line verdict: PASS if all criteria and classes are covered by evidence, NEEDS-ATTENTION if gaps exist."
+Prompt: "Review milestone {{milestoneId}} assessment evidence and acceptance criteria. Working directory: {{workingDirectory}}. Use the preloaded milestone context, slice SUMMARY, and ASSESSMENT evidence embedded in this task — do not re-read them from disk. Read `.gsd/milestones/{{milestoneId}}/{{milestoneId}}-CONTEXT.md`, a full SUMMARY, or a full ASSESSMENT only if the preloaded excerpt is missing, truncated, or inconsistent. UAT files are specs, not evidence. Verify each criterion maps to passing evidence. Then review the inlined `Verification Classes (from planning)` table. For every planned row in that table, output a `Verification Classes` table with columns `Class | Planned Check | Evidence | Verdict`. Preserve every planned non-empty class row; do not summarize, rename, combine, or omit planned classes. The first cell of each row must be exactly `Contract`, `Integration`, `Operational`, or `UAT` when that class is present in planning. If a planned class lacks evidence, still include its canonical row and mark the verdict NEEDS-ATTENTION or FAIL. If a planned browser/UAT class has no ASSESSMENT with browser/runtime actions and assertions, return NEEDS-ATTENTION. If no verification classes were planned, say that explicitly. Output sections `Acceptance Criteria` with checklist `[ ] Criterion | Evidence`, and `Verification Classes` with the table. End with one-line verdict: PASS if all criteria and classes are covered by evidence, NEEDS-ATTENTION if gaps exist."
 
 ### Step 2 - Synthesize Findings
 
@@ -85,4 +87,4 @@ If verdict is `needs-remediation`:
 
 **File system safety:** When scanning milestone directories, use `ls` or `find` first. Never pass a directory path such as `tasks/` or `slices/` directly to `read`; it only accepts files.
 
-When done, say: "Milestone {{milestoneId}} validation complete — verdict: <verdict>."
+When done, say: "Milestone {{milestoneId}} validation complete — verdict: <verdict>." Say this exactly once — if you already said it in a prior message, do not repeat it.

package/src/resources/extensions/gsd/provider-error-guidance.ts

@@ -1,7 +1,10 @@
 /**
  * Actionable remediation hints when auto-mode pauses on provider/model errors.
+ * Render with formatGuidance from the Guidance module.
  */
 
+import type { Guidance } from "./guidance.js";
+
 export interface ProviderErrorGuidanceInput {
   errorMsg: string;
   provider?: string;
@@ -12,10 +15,7 @@ export interface ProviderErrorGuidanceInput {
   hasConfiguredFallbacks?: boolean;
 }
 
-export interface ProviderErrorGuidance {
-  summary: string;
-  steps: string[];
-}
+export type ProviderErrorGuidance = Guidance;
 
 /** Map auto unit types to the `models:` key in PREFERENCES.md. */
 export function unitTypeToPrefsPhaseKey(unitType: string | undefined): string | undefined {
@@ -129,8 +129,3 @@ export function resolveProviderErrorGuidance(input: ProviderErrorGuidanceInput):
   return { summary, steps };
 }
 
-/** Flatten guidance into a pause banner / notification string. */
-export function formatProviderErrorGuidance(guidance: ProviderErrorGuidance): string {
-  const numbered = guidance.steps.map((step, index) => `${index + 1}. ${step}`).join("\n");
-  return `${guidance.summary}\n\n${numbered}`;
-}

package/src/resources/extensions/gsd/provider-payload-policy.ts

@@ -0,0 +1,140 @@
+/**
+ * Provider Payload Policy - ordered shaping of provider request payloads.
+ *
+ * The order is intentional:
+ * 1. observation budgeting masks old tool results in auto-mode,
+ * 2. display truncation caps tool-result text for every mode,
+ * 3. the protected Source Context Block is appended after truncation,
+ * 4. supported models receive the configured service tier.
+ */
+
+import type { ContextManagementConfig } from "./preferences-types.js";
+import type { ServiceTierSetting } from "./service-tier.js";
+
+import {
+  createObservationMask,
+  createResponsesInputObservationMask,
+  truncateContextResultMessages,
+  truncateResponsesInputResultItems,
+} from "./context-masker.js";
+import { getSourceObservationStore, isAutoActive } from "./auto-runtime-state.js";
+import { loadEffectiveGSDPreferences } from "./preferences.js";
+import { getEffectiveServiceTier, supportsServiceTier } from "./service-tier.js";
+import { injectSourceContextBlockIntoPayload } from "./source-observations.js";
+
+const DEFAULT_OBSERVATION_MASK_TURNS = 8;
+const DEFAULT_TOOL_RESULT_MAX_CHARS = 800;
+
+type MessagePayload = Parameters<ReturnType<typeof createObservationMask>>[0];
+type ResponsesInputPayload = Parameters<ReturnType<typeof createResponsesInputObservationMask>>[0];
+
+export interface ProviderPayloadPolicyDeps {
+  isAutoActive(): boolean;
+  loadContextManagementConfig(): ContextManagementConfig | undefined;
+  renderSourceContextBlock(): string | null;
+  getEffectiveServiceTier(): ServiceTierSetting;
+  supportsServiceTier(modelId: string): boolean;
+}
+
+export interface ProviderPayloadPolicyInput {
+  payload: Record<string, unknown>;
+  modelId?: string;
+  deps?: Partial<ProviderPayloadPolicyDeps>;
+}
+
+export const DEFAULT_PROVIDER_PAYLOAD_POLICY_DEPS: ProviderPayloadPolicyDeps = {
+  isAutoActive,
+  loadContextManagementConfig: () => loadEffectiveGSDPreferences()?.preferences.context_management,
+  renderSourceContextBlock: () => getSourceObservationStore().renderActiveBlock(),
+  getEffectiveServiceTier,
+  supportsServiceTier,
+};
+
+export function applyProviderPayloadPolicy({
+  payload,
+  modelId,
+  deps: overrides,
+}: ProviderPayloadPolicyInput): Record<string, unknown> {
+  const deps = { ...DEFAULT_PROVIDER_PAYLOAD_POLICY_DEPS, ...overrides };
+
+  try {
+    applyContextManagement(payload, deps);
+  } catch {
+    // Provider payload shaping should not block a request when optional
+    // context management preferences or adapters fail.
+  }
+
+  try {
+    applySourceContextBlock(payload, deps);
+  } catch {
+    // Source observations are opportunistic; execution can continue without
+    // an injected block.
+  }
+
+  applyServiceTier(payload, modelId, deps);
+  return payload;
+}
+
+function applyContextManagement(
+  payload: Record<string, unknown>,
+  deps: ProviderPayloadPolicyDeps,
+): void {
+  const config = deps.loadContextManagementConfig();
+  applyObservationBudget(payload, config, deps.isAutoActive());
+  applyDisplayTruncation(payload, config);
+}
+
+function applyObservationBudget(
+  payload: Record<string, unknown>,
+  config: ContextManagementConfig | undefined,
+  autoActive: boolean,
+): void {
+  if (!autoActive || config?.observation_masking === false) return;
+
+  const keepTurns = config?.observation_mask_turns ?? DEFAULT_OBSERVATION_MASK_TURNS;
+  if (Array.isArray(payload.messages)) {
+    payload.messages = createObservationMask(keepTurns)(payload.messages as MessagePayload);
+  }
+  if (Array.isArray(payload.input)) {
+    payload.input = createResponsesInputObservationMask(keepTurns)(payload.input as ResponsesInputPayload);
+  }
+}
+
+function applyDisplayTruncation(
+  payload: Record<string, unknown>,
+  config: ContextManagementConfig | undefined,
+): void {
+  const maxChars = config?.tool_result_max_chars ?? DEFAULT_TOOL_RESULT_MAX_CHARS;
+
+  if (Array.isArray(payload.messages)) {
+    payload.messages = truncateContextResultMessages(payload.messages as MessagePayload, maxChars);
+  }
+  if (Array.isArray(payload.input)) {
+    payload.input = truncateResponsesInputResultItems(payload.input as ResponsesInputPayload, maxChars);
+  }
+}
+
+function applySourceContextBlock(
+  payload: Record<string, unknown>,
+  deps: ProviderPayloadPolicyDeps,
+): void {
+  if (!deps.isAutoActive()) return;
+
+  const sourceContextBlock = deps.renderSourceContextBlock();
+  if (!sourceContextBlock) return;
+
+  Object.assign(payload, injectSourceContextBlockIntoPayload(payload, sourceContextBlock));
+}
+
+function applyServiceTier(
+  payload: Record<string, unknown>,
+  modelId: string | undefined,
+  deps: ProviderPayloadPolicyDeps,
+): void {
+  if (!modelId) return;
+
+  const tier = deps.getEffectiveServiceTier();
+  if (!tier || !deps.supportsServiceTier(modelId)) return;
+
+  payload.service_tier = tier;
+}

package/src/resources/extensions/gsd/provider-switch-observer.ts

@@ -128,7 +128,7 @@ function emitAudit(report: ProviderSwitchReport): void {
 
 function emitNotification(report: ProviderSwitchReport): void {
   try {
-    appendNotification(summarize(report), "warning", "workflow-logger");
+    appendNotification(summarize(report), "warning", "workflow-logger", { kind: "provider-switch" });
   } catch {
     // Notification persistence is best-effort.
   }

package/src/resources/extensions/gsd/publication.ts

@@ -0,0 +1,122 @@
+// Project/App: gsd-pi
+// File Purpose: Publication module — push and draft-PR creation for a merged milestone (ADR-034).
+//
+// Publication is distinct from the merge verb: merging a milestone branch is a
+// Worktree Lifecycle concern (worktree, branch, lease, stash discipline);
+// publication needs only the resulting commit, a remote, and preferences.
+// Extracted from the tail of `mergeMilestoneToMain` (auto-worktree.ts) so it is
+// testable without a merge fixture and reachable from any closeout path.
+//
+// Publication failure is non-fatal to a completed local merge: every failure is
+// logged and reported in the result, never thrown.
+
+import { execFileSync } from "node:child_process";
+
+import {
+  buildPullRequestEvidence,
+  createDraftPullRequestFromEvidence,
+} from "./pull-request-process.js";
+import { logWarning } from "./workflow-logger.js";
+
+export interface PublicationPrefs {
+  autoPush: boolean;
+  autoPr: boolean;
+  remote?: string;
+  prTargetBranch?: string;
+}
+
+export interface PublicationRequest {
+  basePath: string;
+  milestoneId: string;
+  milestoneTitle: string;
+  /** The branch the milestone was merged to (push target for auto-push). */
+  integrationBranch: string;
+  /** The milestone branch (push + PR head for auto-PR). */
+  milestoneBranch: string;
+  /** Pre-rendered per-slice summary blocks for the PR body. */
+  sliceSummaries: readonly string[];
+  /** True when the merge found nothing to commit — publication is skipped. */
+  nothingToCommit: boolean;
+  prefs: PublicationPrefs;
+}
+
+export interface PublicationResult {
+  pushed: boolean;
+  prCreated: boolean;
+  prUrl?: string;
+}
+
+export function gitRemoteExists(basePath: string, remote: string): boolean {
+  try {
+    execFileSync("git", ["remote", "get-url", remote], {
+      cwd: basePath,
+      stdio: ["ignore", "pipe", "pipe"],
+      encoding: "utf-8",
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Publish a merged milestone per preferences: push the integration branch
+ * (auto-push, suppressed when auto-PR owns the remote interaction) and/or
+ * push the milestone branch and open a draft PR (auto-PR).
+ */
+export function publishMilestone(request: PublicationRequest): PublicationResult {
+  const result: PublicationResult = { pushed: false, prCreated: false };
+  if (request.nothingToCommit) return result;
+
+  const { basePath, prefs } = request;
+  const remote = prefs.remote ?? "origin";
+
+  if (prefs.autoPush && !prefs.autoPr && gitRemoteExists(basePath, remote)) {
+    try {
+      execFileSync("git", ["push", remote, request.integrationBranch], {
+        cwd: basePath,
+        stdio: ["ignore", "pipe", "pipe"],
+        encoding: "utf-8",
+      });
+      result.pushed = true;
+    } catch (err) {
+      // Push failure is non-fatal
+      logWarning("worktree", `git push failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+
+  // #2302: PR creation is not gated on pushed/auto-push.
+  if (prefs.autoPr && gitRemoteExists(basePath, remote)) {
+    try {
+      // Push the milestone branch to remote first
+      execFileSync("git", ["push", remote, request.milestoneBranch], {
+        cwd: basePath,
+        stdio: ["ignore", "pipe", "pipe"],
+        encoding: "utf-8",
+      });
+      const prEvidence = buildPullRequestEvidence({
+        milestoneId: request.milestoneId,
+        milestoneTitle: request.milestoneTitle,
+        changeType: "feat",
+        summaries: [...request.sliceSummaries],
+        testsRun: ["Auto-created after milestone merge. Run `npm run verify:merge` before marking this draft ready."],
+        rollbackNotes: ["Close the draft PR or revert the merge commit if review finds a behavior regression."],
+        how: "Generated by git.auto_pr after the milestone branch was pushed and merged locally.",
+      });
+      const prUrl = createDraftPullRequestFromEvidence(basePath, request.milestoneId, prEvidence, {
+        head: request.milestoneBranch,
+        base: prefs.prTargetBranch ?? request.integrationBranch,
+      });
+      if (!prUrl) {
+        throw new Error("gh pr create returned no URL");
+      }
+      result.prCreated = true;
+      result.prUrl = prUrl;
+    } catch (err) {
+      // PR creation failure is non-fatal — gh may not be installed or authenticated
+      logWarning("worktree", `PR creation failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+
+  return result;
+}

package/src/resources/extensions/gsd/pull-request-process.ts

@@ -0,0 +1,41 @@
+// Project/App: gsd-pi
+// File Purpose: Process-level pull request policy for GSD-generated PRs.
+
+import { createDraftPR } from "./git-service.js";
+import {
+  buildPrEvidence,
+  type PrEvidence,
+  type PrEvidenceInput,
+} from "./pr-evidence.js";
+
+export interface DraftPullRequestOptions {
+  head: string;
+  base: string;
+}
+
+export interface DraftPullRequestDeps {
+  createDraftPR: (
+    basePath: string,
+    milestoneId: string,
+    title: string,
+    body: string,
+    opts: DraftPullRequestOptions,
+  ) => string | null;
+}
+
+export function buildPullRequestEvidence(input: PrEvidenceInput): PrEvidence {
+  return buildPrEvidence({
+    ...input,
+    aiAssisted: false,
+  });
+}
+
+export function createDraftPullRequestFromEvidence(
+  basePath: string,
+  milestoneId: string,
+  evidence: PrEvidence,
+  options: DraftPullRequestOptions,
+  deps: DraftPullRequestDeps = { createDraftPR },
+): string | null {
+  return deps.createDraftPR(basePath, milestoneId, evidence.title, evidence.body, options);
+}

package/src/resources/extensions/gsd/quality-gate-closure.ts

@@ -0,0 +1,140 @@
+// Project/App: gsd-pi
+// File Purpose: Canonical quality-gate closure from durable DB and artifact evidence.
+
+import { existsSync, readFileSync } from "node:fs";
+
+import { extractSection } from "./files.js";
+import { getGateDefinition } from "./gate-registry.js";
+import { getMilestoneSlices, getPendingGates, saveGateResult } from "./gsd-db.js";
+import { resolveSliceFile, resolveTaskFile } from "./paths.js";
+import type { GateId, GateRow, GateVerdict } from "./types.js";
+
+export interface QualityGateClosureOptions {
+  artifactBasePath?: string;
+  milestoneValidationPassed?: boolean;
+}
+
+export interface QualityGateClosureResult {
+  repaired: Array<{ gateId: GateId; sliceId: string; taskId?: string; verdict: GateVerdict }>;
+  unresolved: GateRow[];
+}
+
+interface GateEvidence {
+  verdict: GateVerdict;
+  rationale: string;
+  findings: string;
+}
+
+const GATE_SECTION_HEADINGS: Partial<Record<GateId, string[]>> = {
+  Q3: ["Threat Surface", "Abuse Surface"],
+  Q4: ["Requirement Impact", "Broken Promises"],
+  Q5: ["Failure Modes"],
+  Q6: ["Load Profile"],
+  Q7: ["Negative Tests"],
+  Q8: ["Operational Readiness"],
+};
+
+function readFile(path: string | null): string | null {
+  if (!path || !existsSync(path)) return null;
+  return readFileSync(path, "utf-8");
+}
+
+function firstSection(content: string | null, gateId: GateId): string | null {
+  if (!content) return null;
+  for (const heading of GATE_SECTION_HEADINGS[gateId] ?? []) {
+    const section = extractSection(content, heading);
+    if (section) return section;
+  }
+  return null;
+}
+
+function evidenceArtifactContent(row: GateRow, basePath: string): string | null {
+  const def = getGateDefinition(row.gate_id);
+  switch (def?.ownerTurn) {
+    case "gate-evaluate":
+      return readFile(resolveSliceFile(basePath, row.milestone_id, row.slice_id, "PLAN"));
+    case "execute-task":
+      return readFile(resolveTaskFile(basePath, row.milestone_id, row.slice_id, row.task_id, "SUMMARY"));
+    case "complete-slice":
+      return readFile(resolveSliceFile(basePath, row.milestone_id, row.slice_id, "SUMMARY"));
+    default:
+      return null;
+  }
+}
+
+function closureEvidence(row: GateRow, options: QualityGateClosureOptions): GateEvidence | null {
+  const def = getGateDefinition(row.gate_id);
+  if (!def) return null;
+
+  if (def.ownerTurn === "validate-milestone" && options.milestoneValidationPassed) {
+    return {
+      verdict: "pass",
+      rationale: `${def.promptSection} covered by passing milestone validation`,
+      findings: "",
+    };
+  }
+
+  if (!options.artifactBasePath) return null;
+
+  const section = firstSection(evidenceArtifactContent(row, options.artifactBasePath), row.gate_id);
+  if (section) {
+    return {
+      verdict: "pass",
+      rationale: `${def.promptSection} evidence found in durable artifact`,
+      findings: section,
+    };
+  }
+
+  if (!options.milestoneValidationPassed) return null;
+  return {
+    verdict: "omitted",
+    rationale: `${def.promptSection} has no durable artifact section; milestone validation passed`,
+    findings: "",
+  };
+}
+
+function closeGate(row: GateRow, evidence: GateEvidence): void {
+  saveGateResult({
+    milestoneId: row.milestone_id,
+    sliceId: row.slice_id,
+    gateId: row.gate_id,
+    taskId: row.task_id,
+    verdict: evidence.verdict,
+    rationale: evidence.rationale,
+    findings: evidence.findings,
+  });
+}
+
+export function closeQualityGatesFromEvidence(
+  milestoneId: string,
+  options: QualityGateClosureOptions = {},
+): QualityGateClosureResult {
+  const repaired: QualityGateClosureResult["repaired"] = [];
+  const unresolved: GateRow[] = [];
+
+  for (const slice of getMilestoneSlices(milestoneId)) {
+    const sliceId = slice.id;
+    for (const row of getPendingGates(milestoneId, sliceId)) {
+      if (!getGateDefinition(row.gate_id)) {
+        unresolved.push(row);
+        continue;
+      }
+
+      const evidence = closureEvidence(row, options);
+      if (!evidence) {
+        unresolved.push(row);
+        continue;
+      }
+
+      closeGate(row, evidence);
+      repaired.push({
+        gateId: row.gate_id,
+        sliceId: row.slice_id,
+        ...(row.task_id ? { taskId: row.task_id } : {}),
+        verdict: evidence.verdict,
+      });
+    }
+  }
+
+  return { repaired, unresolved };
+}