@opengsd/gsd-pi 1.1.1-dev.b2556262 → 1.2.0-dev.0b870afa

package/src/resources/extensions/gsd/tests/parse-project-milestone-bridge.test.ts

@@ -0,0 +1,77 @@
+// gsd-pi / parseProject MILESTONE_LINE_RE bridging regression
+//
+// Guards against a silent data-integrity bug: MILESTONE_LINE_RE used `\s+`
+// around its separator, and `\s` matches newlines. A milestone line lacking a
+// valid internal separator could therefore "bridge" onto the NEXT bullet's
+// `- `, consuming it as the separator and swallowing the following well-formed
+// milestone. The separator gaps are now horizontal-whitespace-only so a line
+// can never span a newline.
+import { describe, test } from "node:test";
+import assert from "node:assert/strict";
+
+import { parseProject } from "../schemas/parsers.ts";
+
+function milestoneSection(...lines: string[]): string {
+  return ["# Project", "", "## Milestone Sequence", "", ...lines, ""].join("\n");
+}
+
+describe("parseProject milestone bridging", () => {
+  test("a malformed milestone line does not swallow the following well-formed one", () => {
+    // M001 uses an invalid " : " separator; M002 is canonical. Before the fix
+    // this returned a SINGLE match (M001 with oneLiner "[ ] M002: Baz — qux"),
+    // dropping M002 entirely.
+    const content = milestoneSection(
+      "- [ ] M001: Foo : bar",
+      "- [ ] M002: Baz — qux",
+    );
+
+    const { milestones } = parseProject(content);
+
+    // M002 must survive intact — it must NOT be consumed as M001's one-liner.
+    const m002 = milestones.find(m => m.id === "M002");
+    assert.ok(m002, "M002 must be registered, not swallowed by the malformed M001 line");
+    assert.equal(m002!.title, "Baz", "M002 title parsed cleanly");
+    assert.equal(m002!.oneLiner, "qux", "M002 one-liner parsed cleanly");
+
+    // No milestone may have bridged the M002 bullet into its own one-liner.
+    assert.ok(
+      !milestones.some(m => m.oneLiner.includes("M002")),
+      "no milestone may bridge across the newline and consume the M002 bullet",
+    );
+
+    // M001 has no valid separator, so it is skipped — consistent with the
+    // empty-parse hard-fail in execute-summary-save-empty-project.test.ts.
+    // The fixture therefore yields exactly the one well-formed milestone.
+    assert.deepEqual(milestones.map(m => m.id), ["M002"], "only the well-formed milestone parses");
+  });
+
+  test("two well-formed milestones on adjacent lines both parse", () => {
+    const content = milestoneSection(
+      "- [x] M001: Foo — bar",
+      "- [ ] M002: Baz — qux",
+    );
+
+    const { milestones } = parseProject(content);
+    assert.deepEqual(
+      milestones.map(m => ({ id: m.id, title: m.title, oneLiner: m.oneLiner, done: m.done })),
+      [
+        { id: "M001", title: "Foo", oneLiner: "bar", done: true },
+        { id: "M002", title: "Baz", oneLiner: "qux", done: false },
+      ],
+      "adjacent canonical milestone lines are parsed independently",
+    );
+  });
+
+  test("a trailing malformed line cannot bridge onto a following bullet of any kind", () => {
+    // The last milestone is malformed and is followed by a non-milestone list
+    // bullet. The malformed line must be skipped without consuming the bullet.
+    const content = milestoneSection(
+      "- [ ] M001: Foo — bar",
+      "- [ ] M002: Baz : qux",
+      "- some unrelated bullet",
+    );
+
+    const { milestones } = parseProject(content);
+    assert.deepEqual(milestones.map(m => m.id), ["M001"], "malformed M002 is skipped, not bridged onto the unrelated bullet");
+  });
+});

package/src/resources/extensions/gsd/tests/parsers-legacy-importers.test.ts

@@ -0,0 +1,138 @@
+// Structural invariant: parsers-legacy is banned from decision paths (ADR-017).
+//
+// The DB is the single source of truth; `.gsd/*.md` files are projections.
+// Dispatch/gate/completion code must read state via gsd-db queries (e.g.
+// getMilestoneSliceSummaries), never by parsing markdown projections.
+//
+// Two assertions:
+// 1. Decision-path modules must NOT import parsers-legacy (hard ban).
+// 2. Every other importer must be on the explicit allowlist below, each with
+//    a one-line justification. When this test fails, do not extend the
+//    allowlist for a decision path — add/extend a query in db/queries.ts and
+//    read the DB instead.
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync, readdirSync } from "node:fs";
+import { join, relative } from "node:path";
+
+const extensionsDir = join(process.cwd(), "src/resources/extensions");
+
+// Modules that make dispatch/gate/completion decisions. Importing
+// parsers-legacy here is always a violation, allowlist or not.
+const BANNED_DECISION_PATHS = new Set([
+  "gsd/auto-direct-dispatch.ts",
+  "gsd/dispatch-guard.ts",
+  "gsd/auto-verification.ts",
+  "gsd/auto-dispatch.ts",
+  "gsd/auto-post-unit.ts",
+  "gsd/milestone-closeout.ts",
+  "gsd/auto/phases.ts",
+  "gsd/auto/orchestrator.ts",
+  "gsd/auto/loop.ts",
+  "gsd/tools/complete-slice.ts",
+]);
+
+// Legitimate importers. Each entry carries its justification; anything not
+// listed here (and not under a tests/ directory) fails the test.
+const ALLOWED_IMPORTERS = new Set([
+  // migration/import: parses markdown to populate the DB
+  "gsd/md-importer.ts",
+  "gsd/workflow-migration.ts",
+  "gsd/migration-auto-check.ts",
+  // drift detection: compares markdown projection against DB by design
+  "gsd/state-reconciliation/drift/roadmap.ts",
+  // stale-render detection + render verification helpers over rendered output
+  "gsd/markdown-renderer.ts",
+  // pre-migration fallback: deriveState must work before the DB exists
+  "gsd/state.ts",
+  // explicit degraded-mode fallback when DB has no task rows (warns on use)
+  "gsd/reactive-graph.ts",
+  // recovery path: explicit pre-migration/DB-unavailable fallback branches
+  "gsd/auto-recovery.ts",
+  // diagnostics-only surfaces: report on projections, make no dispatch decisions
+  "gsd/doctor.ts",
+  // display/telemetry-only surfaces
+  "gsd/workspace-index.ts",
+  "gsd/visualizer-data.ts",
+  // prompt context text (display strings injected into unit prompts)
+  "gsd/auto-prompts.ts",
+  // cold-path maintenance command (branch cleanup messaging)
+  "gsd/commands-maintenance.ts",
+  // display-only GitHub issue/PR body sync
+  "github-sync/sync.ts",
+]);
+
+const IMPORT_RE = /from\s+["'][^"']*parsers-legacy(?:\.js)?["']|import\(\s*["'][^"']*parsers-legacy(?:\.js)?["']\s*\)|require\(\s*["'][^"']*parsers-legacy(?:\.js)?["']\s*\)/;
+
+function walkTsFiles(root: string): string[] {
+  const out: string[] = [];
+  const stack: string[] = [root];
+
+  while (stack.length > 0) {
+    const dir = stack.pop()!;
+    let entries;
+    try {
+      entries = readdirSync(dir, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const ent of entries) {
+      const full = join(dir, ent.name);
+      if (ent.isDirectory()) {
+        if (ent.name === "tests" || ent.name === "node_modules") continue;
+        stack.push(full);
+        continue;
+      }
+      if (!ent.isFile()) continue;
+      if (!ent.name.endsWith(".ts")) continue;
+      if (ent.name.startsWith(".")) continue;
+      if (ent.name.endsWith(".test.ts")) continue;
+      out.push(full);
+    }
+  }
+  return out;
+}
+
+function findImporters(): string[] {
+  const importers: string[] = [];
+  for (const file of walkTsFiles(extensionsDir)) {
+    const rel = relative(extensionsDir, file).split("\\").join("/");
+    if (rel === "gsd/parsers-legacy.ts") continue; // the module itself
+    const content = readFileSync(file, "utf-8");
+    if (IMPORT_RE.test(content)) importers.push(rel);
+  }
+  return importers.sort();
+}
+
+test("decision-path modules do not import parsers-legacy (ADR-017)", () => {
+  const violations = findImporters().filter((rel) => BANNED_DECISION_PATHS.has(rel));
+  assert.deepEqual(
+    violations,
+    [],
+    `Decision-path modules must read the DB (db/queries.ts, e.g. getMilestoneSliceSummaries), ` +
+      `not parse .gsd/*.md projections. Violations:\n  ${violations.join("\n  ")}`,
+  );
+});
+
+test("every parsers-legacy importer is on the explicit allowlist", () => {
+  const unexpected = findImporters().filter((rel) => !ALLOWED_IMPORTERS.has(rel));
+  assert.deepEqual(
+    unexpected,
+    [],
+    `New parsers-legacy importer(s) detected:\n  ${unexpected.join("\n  ")}\n` +
+      `If this is migration/drift/display-only code, add it to ALLOWED_IMPORTERS ` +
+      `with a one-line justification. If it makes dispatch/gate/completion ` +
+      `decisions, read the DB instead (db/queries.ts).`,
+  );
+});
+
+test("allowlist has no stale entries", () => {
+  const importers = new Set(findImporters());
+  const stale = [...ALLOWED_IMPORTERS].filter((rel) => !importers.has(rel));
+  assert.deepEqual(
+    stale,
+    [],
+    `Allowlist entries no longer import parsers-legacy — remove them:\n  ${stale.join("\n  ")}`,
+  );
+});

package/src/resources/extensions/gsd/tests/phases-terminal-complete-idempotent.test.ts

@@ -0,0 +1,242 @@
+/**
+ * phases-terminal-complete-idempotent.test.ts — Regression test for the
+ * milestone-completion double-closeout guard in `runPreDispatch`.
+ *
+ * When `runPreDispatch` observes that the active milestone (or the last one
+ * the session was working on) has already been closed by another session,
+ * the loop must exit cleanly with `{ action: "break", reason:
+ * "milestone-complete" }` and must NOT replay merge, desktop / cmux
+ * notifications, unit closeout, or `stopAuto`.
+ *
+ * There are two `deriveState` shapes the guard must cover, and both are
+ * exercised below because the canonical one is easy to miss:
+ *
+ *   1. `state.phase === "complete"` with `activeMilestone` set, so the
+ *      loop computes a non-null `mid` from `state.activeMilestone.id`.
+ *
+ *   2. `state.phase === "complete"` with `activeMilestone: null` — the
+ *      canonical "all milestones complete" return from `deriveState`
+ *      (state.ts:613, state.ts:1293). `mid` is undefined here, so the
+ *      guard must consult `s.currentMilestoneId` (the milestone this
+ *      session was working on) instead. Without coverage for this case,
+ *      a guard that only inspects `mid` is unreachable in production and
+ *      the loop replays `_runMilestoneMergeOnceWithStashRestore`,
+ *      `sendDesktopNotification("All milestones complete!")`,
+ *      `logCmuxEvent`, and `stopAuto` — exactly the duplicate side
+ *      effects this fix exists to prevent.
+ *
+ * Both fire-paths of the guard (`completionStopInProgress` and a
+ * DB-already-closed milestone) are exercised against each shape.
+ */
+
+import { createTestContext } from "./test-helpers.ts";
+import { runPreDispatch } from "../auto/phases.ts";
+import {
+  openDatabase,
+  closeDatabase,
+  insertMilestone,
+  isDbAvailable,
+} from "../gsd-db.ts";
+
+const { assertTrue, report } = createTestContext();
+
+type SideEffect = string;
+
+interface ScenarioOverrides {
+  completionStopInProgress: boolean;
+  sideEffects: SideEffect[];
+  notifications: Array<{ message: string; level?: string }>;
+  // When `null`, deriveState returns activeMilestone: null (canonical
+  // all-complete path). Otherwise, returns an activeMilestone with this id.
+  activeMilestone: { id: string; title: string } | null;
+}
+
+function makeIterationContext(overrides: ScenarioOverrides): any {
+  const basePath = "/tmp/gsd-test-terminal-complete";
+  const recordSideEffect = (label: string) => {
+    overrides.sideEffects.push(label);
+  };
+  return {
+    ctx: {
+      ui: {
+        notify(message: string, level?: string) {
+          overrides.notifications.push({ message, level });
+        },
+      },
+    },
+    pi: {},
+    s: {
+      basePath,
+      originalBasePath: basePath,
+      canonicalProjectRoot: basePath,
+      resourceVersionOnStart: "test",
+      // Critical for the `!mid` canonical path: even when deriveState returns
+      // activeMilestone: null, the session still remembers the milestone it
+      // was working on, and we use that to look up DB status.
+      currentMilestoneId: "M001",
+      currentUnit: null,
+      milestoneMergedInPhases: false,
+      completionStopInProgress: overrides.completionStopInProgress,
+    },
+    prefs: undefined,
+    iteration: 1,
+    flowId: "test-flow",
+    nextSeq: () => 1,
+    deps: {
+      checkResourcesStale() {
+        return null;
+      },
+      invalidateAllCaches() {},
+      async preDispatchHealthGate() {
+        return { proceed: true, fixesApplied: [] };
+      },
+      async deriveState() {
+        return {
+          phase: "complete",
+          activeMilestone: overrides.activeMilestone,
+          activeSlice: null,
+          activeTask: null,
+          // Registry says M001 is complete and no other milestones exist, so
+          // `incomplete.length === 0 && state.registry.length > 0` evaluates
+          // true in the `!mid` branch.
+          registry: [{ id: "M001", status: "complete" }],
+          nextAction: "complete",
+        };
+      },
+      syncCmuxSidebar() {},
+      setActiveMilestoneId() {},
+      reconcileMergeState() {
+        return "clean";
+      },
+      // Anything below this point MUST NOT be reached when the guard fires.
+      preflightCleanRoot() {
+        recordSideEffect("preflight");
+        return { ok: true, stashPushed: false, stashMarker: null };
+      },
+      postflightPopStash() {
+        recordSideEffect("postflight");
+        return { ok: true, needsManualRecovery: false };
+      },
+      lifecycle: {
+        exitMilestone() {
+          recordSideEffect("merge");
+          return { ok: true };
+        },
+      },
+      sendDesktopNotification() {
+        recordSideEffect("desktop-notify");
+      },
+      logCmuxEvent() {
+        recordSideEffect("cmux-event");
+      },
+      async closeoutUnit() {
+        recordSideEffect("closeout-unit");
+      },
+      buildSnapshotOpts() {
+        return {};
+      },
+      async stopAuto(_ctx: unknown, _pi: unknown, reason?: string) {
+        recordSideEffect(`stop:${reason ?? ""}`);
+      },
+      async pauseAuto() {
+        recordSideEffect("pause");
+      },
+      emitJournalEvent() {
+        recordSideEffect("journal-event");
+      },
+    },
+  };
+}
+
+async function runScenario(opts: {
+  label: string;
+  completionStopInProgress: boolean;
+  activeMilestone: { id: string; title: string } | null;
+  // When true, the test opens an in-memory DB and inserts M001 with status
+  // "complete" so the DB-closed branch of the guard can fire.
+  dbAlreadyClosed: boolean;
+}): Promise<void> {
+  if (isDbAvailable()) {
+    closeDatabase();
+  }
+  if (opts.dbAlreadyClosed) {
+    openDatabase(":memory:");
+    insertMilestone({ id: "M001", title: "Milestone one", status: "complete" });
+  }
+
+  try {
+    const sideEffects: SideEffect[] = [];
+    const notifications: Array<{ message: string; level?: string }> = [];
+    const ic = makeIterationContext({
+      completionStopInProgress: opts.completionStopInProgress,
+      sideEffects,
+      notifications,
+      activeMilestone: opts.activeMilestone,
+    });
+
+    const result = await runPreDispatch(ic, {
+      recentUnits: [],
+      stuckRecoveryAttempts: 0,
+      consecutiveFinalizeTimeouts: 0,
+    });
+
+    assertTrue(
+      result.action === "break",
+      `${opts.label}: returns break instead of next`,
+    );
+    if (result.action === "break") {
+      assertTrue(
+        result.reason === "milestone-complete",
+        `${opts.label}: reason is milestone-complete (got "${result.reason}")`,
+      );
+    }
+    assertTrue(
+      sideEffects.length === 0,
+      `${opts.label}: no closeout side effects replayed (saw [${sideEffects.join(", ")}])`,
+    );
+    assertTrue(
+      notifications.length === 0,
+      `${opts.label}: no user notifications emitted (saw ${notifications.length})`,
+    );
+  } finally {
+    if (isDbAvailable()) {
+      closeDatabase();
+    }
+  }
+}
+
+console.log("\n=== Terminal complete is idempotent across both observer paths ===");
+
+// ── state.phase === "complete" branch (activeMilestone non-null) ────────────
+await runScenario({
+  label: "phase=complete + mid set + completionStopInProgress",
+  completionStopInProgress: true,
+  activeMilestone: { id: "M001", title: "Milestone one" },
+  dbAlreadyClosed: false,
+});
+
+await runScenario({
+  label: "phase=complete + mid set + DB closed",
+  completionStopInProgress: false,
+  activeMilestone: { id: "M001", title: "Milestone one" },
+  dbAlreadyClosed: true,
+});
+
+// ── Canonical !mid "all milestones complete" sub-branch ────────────────────
+// deriveState returns phase: "complete" with activeMilestone: null. The
+// session's s.currentMilestoneId (M001) is what the guard consults.
+await runScenario({
+  label: "phase=complete + activeMilestone=null + completionStopInProgress",
+  completionStopInProgress: true,
+  activeMilestone: null,
+  dbAlreadyClosed: false,
+});
+
+await runScenario({
+  label: "phase=complete + activeMilestone=null + DB closed",
+  completionStopInProgress: false,
+  activeMilestone: null,
+  dbAlreadyClosed: true,
+});
+
+report();

package/src/resources/extensions/gsd/tests/plan-milestone.test.ts

@@ -347,3 +347,48 @@ test('handlePlanMilestone updates depends_on when a queued milestone row already
     cleanup(base);
   }
 });
+
+// Regression #566: bracket-wrapped slice ID in depends should be rejected
+test('handlePlanMilestone rejects bracket-wrapped depends like ["[S01]"]', async () => {
+  const base = makeTmpBase();
+  const dbPath = join(base, '.gsd', 'gsd.db');
+  openDatabase(dbPath);
+
+  try {
+    const params = validParams();
+    // Simulate the LLM sending "[S01]" (the markdown fragment) instead of "S01"
+    const corruptSlices = [
+      params.slices[0],
+      { ...params.slices[1], depends: ['[S01]'] },
+    ];
+    const result = await handlePlanMilestone({ ...params, slices: corruptSlices }, base);
+    assert.ok('error' in result, 'should return an error for bracket-wrapped depends');
+    assert.match(result.error, /slices\[1\]\.depends must be an array of valid slice IDs/,
+      'error should mention invalid slice ID format');
+    assert.equal(getMilestoneSlices('M001').length, 0, 'no slices should persist on validation failure');
+  } finally {
+    cleanup(base);
+  }
+});
+
+// Regression #566: unknown slice ID in depends should be rejected
+test('handlePlanMilestone rejects depends referencing a slice not in the same milestone', async () => {
+  const base = makeTmpBase();
+  const dbPath = join(base, '.gsd', 'gsd.db');
+  openDatabase(dbPath);
+
+  try {
+    const params = validParams();
+    const corruptSlices = [
+      params.slices[0],
+      { ...params.slices[1], depends: ['S99'] },
+    ];
+    const result = await handlePlanMilestone({ ...params, slices: corruptSlices }, base);
+    assert.ok('error' in result, 'should return an error for unknown depends slice');
+    assert.match(result.error, /references unknown slice "S99"/,
+      'error should name the unknown slice');
+    assert.equal(getMilestoneSlices('M001').length, 0, 'no slices should persist on validation failure');
+  } finally {
+    cleanup(base);
+  }
+});

package/src/resources/extensions/gsd/tests/plan-slice-prompt.test.ts

@@ -76,8 +76,10 @@ test("plan-slice prompt: compact planning gates survive template substitution",
   assert.ok(result.includes("Bias toward \"roadmap is fine.\""), "roadmap reassessment brake should remain visible");
   assert.ok(result.includes("Self-audit before finishing"), "self-audit gate should remain visible");
   assert.ok(result.includes("Quality gates: non-trivial slices/tasks include specific Q3-Q7 coverage where applicable."));
-  assert.ok(result.includes("C:\\Users\\Test\\.gsd\\agent\\extensions\\gsd\\templates\\plan.md"));
-  assert.ok(result.includes("C:\\Users\\Test\\.gsd\\agent\\extensions\\gsd\\templates\\task-plan.md"));
+  assert.ok(result.includes("Use the inlined Output Template sections already present in this prompt."));
+  assert.ok(result.includes("Do not read template files from disk."));
+  assert.ok(!result.includes("C:\\Users\\Test\\.gsd\\agent\\extensions\\gsd\\templates\\plan.md"));
+  assert.ok(!result.includes("C:\\Users\\Test\\.gsd\\agent\\extensions\\gsd\\templates\\task-plan.md"));
   assert.ok(!result.includes("{{templatesDir}}/plan.md"));
   assert.ok(!result.includes("{{templatesDir}}/task-plan.md"));
   assert.ok(!result.includes("{{"));
@@ -135,6 +137,7 @@ test("skillActivation default leaves no unresolved placeholder", () => {
     carryForwardSection: "Carry forward",
     resumeSection: "Resume",
     priorTaskLines: "- (no prior tasks)",
+    onDemandContext: "",
     templatesDir: join(fixtureRoot, "templates"),
     taskSummaryPath: join(fixtureRoot, ".gsd", "milestones", "M001", "slices", "S01", "tasks", "T01-SUMMARY.md"),
     inlinedTemplates: "Template",
@@ -161,6 +164,7 @@ test("custom skillActivation is substituted into execute-task", () => {
     carryForwardSection: "Carry forward",
     resumeSection: "Resume",
     priorTaskLines: "- (no prior tasks)",
+    onDemandContext: "",
     templatesDir: join(fixtureRoot, "templates"),
     taskSummaryPath: join(fixtureRoot, ".gsd", "milestones", "M001", "slices", "S01", "tasks", "T01-SUMMARY.md"),
     inlinedTemplates: "Template",

package/src/resources/extensions/gsd/tests/planning-crossval.test.ts

@@ -15,6 +15,7 @@ import {
   insertTask,
   getMilestoneSlices,
   getSliceTasks,
+  _getAdapter,
 } from '../gsd-db.ts';
 import {
   renderRoadmapFromDb,
@@ -423,4 +424,48 @@ console.log('\n=== planning-crossval Test 6: ROADMAP descriptor projection dir =
   }
 }
 
+// ═══════════════════════════════════════════════════════════════════════════
+// Test 7: Renderer strips bracket-wrapped depends from corrupt DB rows (#566)
+// ═══════════════════════════════════════════════════════════════════════════
+// Simulates a DB that was corrupted before the insertSlice validation guard
+// was added (issue #566). The renderer must recover "[S01]" → "S01" rather
+// than silently dropping the dependency and rendering depends:[].
+
+console.log('\n=== planning-crossval Test 7: renderer recovers bracket-wrapped depends (#566) ===');
+{
+  const base = realpathSync(createFixtureBase());
+  const dbPath = join(base, '.gsd', 'gsd.db');
+  openDatabase(dbPath);
+  try {
+    scaffoldDirs(base, 'M001', ['S01', 'S02']);
+
+    insertMilestone({
+      id: 'M001',
+      title: 'Bracket Recovery',
+      status: 'active',
+      planning: { vision: 'Recover bracket-wrapped depends from corrupt DB.' },
+    });
+
+    insertSlice({ id: 'S01', milestoneId: 'M001', title: 'Foundation', status: 'pending', risk: 'low', depends: [], demo: 'Foundation done.', sequence: 1 });
+    insertSlice({ id: 'S02', milestoneId: 'M001', title: 'Build', status: 'pending', risk: 'medium', depends: [], demo: 'Build done.', sequence: 2 });
+
+    // Bypass insertSlice validation to simulate pre-fix corrupt DB state
+    // (insertSlice now rejects bracket-wrapped IDs, but old DBs may have them)
+    _getAdapter()?.prepare('UPDATE slices SET depends = ? WHERE id = ? AND milestone_id = ?')
+      .run('["[S01]"]', 'S02', 'M001');
+
+    const rendered = await renderRoadmapFromDb(base, 'M001');
+    const content = readFileSync(rendered.roadmapPath, 'utf-8');
+    const parsed = parseRoadmapSlices(content);
+
+    assertEq(parsed.length, 2, 'T7: 2 slices parsed');
+    assertEq(parsed[1]?.depends.length, 1, 'T7: S02 has 1 dependency after bracket recovery');
+    assertEq(parsed[1]?.depends[0], 'S01', 'T7: recovered dependency is "S01", not "[S01]"');
+    assertTrue(content.includes('`depends:[S01]`'), 'T7: S02 renders with recovered depends:[S01] not empty depends:[]');
+  } finally {
+    closeDatabase();
+    cleanup(base);
+  }
+}
+
 report();

package/src/resources/extensions/gsd/tests/post-exec-retry-bypass.test.ts

@@ -145,7 +145,7 @@ function createBasicTask(): void {
   });
 }
 
-function createTaskWithoutVerify(): void {
+function createTaskWithoutVerify(status = "pending"): void {
   insertMilestone({ id: "M001" });
   insertSlice({
     id: "S01",
@@ -159,7 +159,7 @@ function createTaskWithoutVerify(): void {
     sliceId: "S01",
     milestoneId: "M001",
     title: "Task without host verification",
-    status: "pending",
+    status,
     planning: {
       description: "Task intentionally missing runnable verification",
       estimate: "1h",
@@ -558,6 +558,32 @@ describe("Post-execution blocking failure retry bypass", () => {
     assert.equal(pauseAutoMock.mock.callCount(), 1);
     assert.equal(s.pendingVerificationRetry, null);
 
+    const notifyMessages = ctx.ui.notify.mock.calls.map((c: { arguments: unknown[] }) =>
+      String(c.arguments[0])
+    );
+    assert.ok(
+      notifyMessages.some(
+        (m: string) =>
+          m.includes(".gsd/PREFERENCES.md") &&
+          m.includes("task-plan Verify command") &&
+          m.includes("/gsd next")
+      ),
+      "no-host-checks notification should guide the user to add verification and resume",
+    );
+
+    const pauseCalls = pauseAutoMock.mock.calls as Array<{ arguments: unknown[] }>;
+    const pauseCallArgs = pauseCalls[0]?.arguments[2] as
+      | { message?: string }
+      | undefined;
+    assert.ok(
+      pauseCallArgs?.message?.includes(".gsd/PREFERENCES.md"),
+      "pause reason should include the project verification configuration path",
+    );
+    assert.ok(
+      pauseCallArgs?.message?.includes("/gsd next"),
+      "pause reason should tell the user how to resume",
+    );
+
     const evidencePath = join(tempDir, ".gsd", "milestones", "M001", "slices", "S01", "tasks", "T01-VERIFY.json");
     const evidence = JSON.parse(readFileSync(evidencePath, "utf-8"));
     assert.equal(evidence.passed, false);
@@ -566,6 +592,41 @@ describe("Post-execution blocking failure retry bypass", () => {
     assert.ok(!("maxRetries" in evidence), "no-host-checks evidence must not include maxRetries");
   });
 
+  test("completed browser-facing execute-task with no host-owned verification continues toward browser UAT", async () => {
+    createTaskWithoutVerify("complete");
+    writeFileSync(join(tempDir, "index.html"), "<!doctype html><button>Import</button>", "utf-8");
+
+    const ctx = makeMockCtx();
+    const pi = makeMockPi();
+    const pauseAutoMock = mock.fn(async () => {});
+    const s = makeMockSession(tempDir, { type: "execute-task", id: "M001/S01/T01" });
+
+    const result = await runPostUnitVerification({ s, ctx, pi }, pauseAutoMock);
+
+    assert.equal(result, "continue");
+    assert.equal(pauseAutoMock.mock.callCount(), 0);
+    assert.equal(s.pendingVerificationRetry, null);
+
+    const notifyMessages = ctx.ui.notify.mock.calls.map((c: { arguments: unknown[] }) =>
+      String(c.arguments[0])
+    );
+    assert.ok(
+      notifyMessages.some(
+        (m: string) =>
+          m.includes("browser-facing task") &&
+          m.includes("slice UAT") &&
+          m.includes("browser tools")
+      ),
+      "completed web tasks without task-level commands should explain browser UAT handoff",
+    );
+
+    const evidencePath = join(tempDir, ".gsd", "milestones", "M001", "slices", "S01", "tasks", "T01-VERIFY.json");
+    const evidence = JSON.parse(readFileSync(evidencePath, "utf-8"));
+    assert.equal(evidence.passed, false);
+    assert.equal(evidence.discoverySource, "none");
+    assert.ok(!("retryAttempt" in evidence), "browser-UAT handoff evidence must not request a task retry");
+  });
+
   test("auto-discovered package.json verification failure retries instead of continuing", async () => {
     createTaskWithoutVerify();
     writeFileSync(