@opengsd/gsd-pi 1.10.0 → 1.11.0

package/src/resources/extensions/gsd/tests/workflow-authority-fixture.ts

@@ -0,0 +1,141 @@
+import { mkdirSync, mkdtempSync, realpathSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import {
+  closeDatabase,
+  insertMilestone,
+  insertSlice,
+  insertTask,
+  openDatabase,
+  transaction,
+} from "../gsd-db.ts";
+import { saveDecisionToDb, saveRequirementToDb } from "../db-writer.ts";
+import { invalidateStateCache } from "../state.ts";
+
+export interface WorkflowAuthorityFixture {
+  root: string;
+  dbPath: string;
+  ids: {
+    milestone: string;
+    completedSlice: string;
+    readySlice: string;
+    completedTask: string;
+    readyTask: string;
+    requirement: string;
+    decision: string;
+  };
+  reopen(): void;
+  cleanup(): void;
+}
+
+function openFixtureDatabase(dbPath: string): void {
+  if (!openDatabase(dbPath)) {
+    throw new Error(`Could not open workflow authority fixture database: ${dbPath}`);
+  }
+}
+
+export async function createWorkflowAuthorityFixture(): Promise<WorkflowAuthorityFixture> {
+  const root = realpathSync(mkdtempSync(join(tmpdir(), "gsd-workflow-authority-")));
+  const dbPath = join(root, ".gsd", "gsd.db");
+  let cleanedUp = false;
+
+  mkdirSync(join(root, ".gsd"), { recursive: true });
+  openFixtureDatabase(dbPath);
+
+  try {
+    transaction(() => {
+      insertMilestone({ id: "M001", title: "Authority Fixture", status: "active" });
+      insertSlice({
+        id: "S01",
+        milestoneId: "M001",
+        title: "Completed prerequisite",
+        status: "complete",
+        risk: "low",
+        depends: [],
+        sequence: 1,
+      });
+      insertSlice({
+        id: "S02",
+        milestoneId: "M001",
+        title: "Ready dependent slice",
+        status: "pending",
+        risk: "medium",
+        depends: ["S01"],
+        sequence: 2,
+      });
+      insertTask({
+        id: "T01",
+        milestoneId: "M001",
+        sliceId: "S01",
+        title: "Completed task",
+        status: "complete",
+        sequence: 1,
+      });
+      insertTask({
+        id: "T01",
+        milestoneId: "M001",
+        sliceId: "S02",
+        title: "Ready task",
+        status: "pending",
+        sequence: 1,
+      });
+    });
+
+    const requirement = await saveRequirementToDb(
+      {
+        class: "core-capability",
+        status: "active",
+        description: "SQLite is authoritative",
+        why: "Readable projections must not control workflow state.",
+        source: "workflow-authority-fixture",
+        primary_owner: "M001/S02",
+        validation: "DB-derived state remains canonical",
+      },
+      root,
+    );
+    const decision = await saveDecisionToDb(
+      {
+        when_context: "M001/S02",
+        scope: "architecture",
+        decision: "Choose the workflow authority",
+        choice: "SQLite is authoritative",
+        rationale: "Projections may lag without losing saved intent.",
+        revisable: "No",
+        made_by: "human",
+        source: "discussion",
+      },
+      root,
+    );
+
+    return {
+      root,
+      dbPath,
+      ids: {
+        milestone: "M001",
+        completedSlice: "S01",
+        readySlice: "S02",
+        completedTask: "T01",
+        readyTask: "T01",
+        requirement: requirement.id,
+        decision: decision.id,
+      },
+      reopen() {
+        closeDatabase();
+        openFixtureDatabase(dbPath);
+        invalidateStateCache();
+      },
+      cleanup() {
+        if (cleanedUp) return;
+        cleanedUp = true;
+        closeDatabase();
+        invalidateStateCache();
+        rmSync(root, { recursive: true, force: true });
+      },
+    };
+  } catch (error) {
+    closeDatabase();
+    rmSync(root, { recursive: true, force: true });
+    throw error;
+  }
+}

package/src/resources/extensions/gsd/tests/workflow-authority-projection-conflict.test.ts

@@ -0,0 +1,177 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdirSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+
+import { getMilestoneSlices, getSliceTasks } from "../gsd-db.ts";
+import { queryDecisionsFromMemories, queryRequirements } from "../context-store.ts";
+import { deriveStateFromDb } from "../state.ts";
+import {
+  createWorkflowAuthorityFixture,
+  type WorkflowAuthorityFixture,
+} from "./workflow-authority-fixture.ts";
+
+function writeProjection(root: string, path: string, content: string): void {
+  const fullPath = join(root, ".gsd", path);
+  mkdirSync(dirname(fullPath), { recursive: true });
+  writeFileSync(fullPath, content, "utf8");
+}
+
+function writeContradictoryProjections(root: string): void {
+  writeProjection(
+    root,
+    "STATE.md",
+    [
+      "# GSD State",
+      "",
+      "**Active Milestone:** M999",
+      "**Active Slice:** S99",
+      "**Phase:** complete",
+      "**Requirements Status:** 0 active · 1 validated",
+    ].join("\n"),
+  );
+  writeProjection(
+    root,
+    "PROJECT.md",
+    [
+      "# Projection-only project",
+      "",
+      "## Milestone Sequence",
+      "- [x] M001: Falsely complete",
+      "- [ ] M999: Projection-only active milestone",
+    ].join("\n"),
+  );
+  writeProjection(
+    root,
+    "REQUIREMENTS.md",
+    [
+      "# Requirements",
+      "",
+      "## Validated",
+      "### R999 — Markdown controls workflow state",
+      "- Status: validated",
+      "- Primary owning slice: M999/S99",
+    ].join("\n"),
+  );
+  writeProjection(
+    root,
+    "DECISIONS.md",
+    [
+      "# Decisions Register",
+      "",
+      "| # | When | Scope | Decision | Choice | Rationale | Revisable? | Made By |",
+      "|---|------|-------|----------|--------|-----------|------------|---------|",
+      "| D999 | M999/S99 | architecture | Choose authority | Markdown is authoritative | projection conflict | No | human |",
+    ].join("\n"),
+  );
+  writeProjection(
+    root,
+    "milestones/M001/M001-ROADMAP.md",
+    [
+      "# M001: Falsely complete",
+      "",
+      "## Slices",
+      "- [ ] **S01: Falsely reopened** `risk:low` `depends:[]`",
+      "- [x] **S02: Falsely complete** `risk:low` `depends:[]`",
+    ].join("\n"),
+  );
+  writeProjection(
+    root,
+    "milestones/M001/slices/S02/S02-PLAN.md",
+    [
+      "# S02: Falsely complete",
+      "",
+      "## Tasks",
+      "- [x] **T99: Projection-only task** `est:1m`",
+    ].join("\n"),
+  );
+}
+
+async function readDirectDbAuthoritySnapshot(fixture: WorkflowAuthorityFixture) {
+  const state = await deriveStateFromDb(fixture.root);
+  return {
+    state: {
+      phase: state.phase,
+      milestone: state.activeMilestone?.id ?? null,
+      slice: state.activeSlice?.id ?? null,
+      task: state.activeTask?.id ?? null,
+      requirements: state.requirements,
+    },
+    registry: state.registry.map((milestone) => ({
+      id: milestone.id,
+      status: milestone.status,
+    })),
+    slices: getMilestoneSlices(fixture.ids.milestone).map((slice) => ({
+      id: slice.id,
+      status: slice.status,
+      depends: slice.depends,
+    })),
+    tasks: {
+      completed: getSliceTasks(fixture.ids.milestone, fixture.ids.completedSlice).map((task) => ({
+        id: task.id,
+        status: task.status,
+      })),
+      ready: getSliceTasks(fixture.ids.milestone, fixture.ids.readySlice).map((task) => ({
+        id: task.id,
+        status: task.status,
+      })),
+    },
+    requirements: queryRequirements({
+      milestoneId: fixture.ids.milestone,
+      sliceId: fixture.ids.readySlice,
+    }).map((requirement) => ({
+      id: requirement.id,
+      status: requirement.status,
+      owner: requirement.primary_owner,
+    })),
+    decisions: queryDecisionsFromMemories().map((decision) => ({
+      id: decision.id,
+      choice: decision.choice,
+    })),
+  };
+}
+
+test("direct DB authority queries ignore contradictory Markdown projections", async (t) => {
+  const fixture = await createWorkflowAuthorityFixture();
+  t.after(() => fixture.cleanup());
+  fixture.reopen();
+  const before = await readDirectDbAuthoritySnapshot(fixture);
+
+  assert.deepEqual(before, {
+    state: {
+      phase: "executing",
+      milestone: fixture.ids.milestone,
+      slice: fixture.ids.readySlice,
+      task: fixture.ids.readyTask,
+      requirements: {
+        active: 1,
+        validated: 0,
+        deferred: 0,
+        outOfScope: 0,
+        blocked: 0,
+        total: 1,
+      },
+    },
+    registry: [{ id: fixture.ids.milestone, status: "active" }],
+    slices: [
+      { id: fixture.ids.completedSlice, status: "complete", depends: [] },
+      { id: fixture.ids.readySlice, status: "pending", depends: [fixture.ids.completedSlice] },
+    ],
+    tasks: {
+      completed: [{ id: fixture.ids.completedTask, status: "complete" }],
+      ready: [{ id: fixture.ids.readyTask, status: "pending" }],
+    },
+    requirements: [
+      { id: fixture.ids.requirement, status: "active", owner: "M001/S02" },
+    ],
+    decisions: [
+      { id: fixture.ids.decision, choice: "SQLite is authoritative" },
+    ],
+  });
+
+  writeContradictoryProjections(fixture.root);
+  fixture.reopen();
+
+  const after = await readDirectDbAuthoritySnapshot(fixture);
+  assert.deepEqual(after, before);
+});

package/src/resources/extensions/gsd/tests/workflow-fault-harness.test.ts

@@ -0,0 +1,39 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import {
+  createWorkflowFaultHarness,
+  type WorkflowFaultPoint,
+} from "./workflow-fault-harness.js";
+
+test("fault harness throws once at the armed named boundary", () => {
+  const harness = createWorkflowFaultHarness("after-db-commit-before-render");
+
+  harness.hit("before-transaction-commit", "complete-task");
+  assert.throws(
+    () => harness.hit("after-db-commit-before-render", "complete-task"),
+    /complete-task.*after-db-commit-before-render.*hit 1/,
+  );
+
+  assert.equal(harness.count("before-transaction-commit"), 1);
+  assert.equal(harness.count("after-db-commit-before-render"), 1);
+});
+
+test("fault harness automatically disarms after its first matching hit", () => {
+  const point: WorkflowFaultPoint = "during-projection-write";
+  const harness = createWorkflowFaultHarness(point);
+
+  assert.throws(() => harness.hit(point, "complete-slice"));
+  assert.doesNotThrow(() => harness.hit(point, "complete-slice"));
+  assert.equal(harness.count(point), 2);
+});
+
+test("fault harness instances never share armed state or counts", () => {
+  const first = createWorkflowFaultHarness("before-independent-reopen");
+  const second = createWorkflowFaultHarness("before-independent-reopen");
+
+  assert.throws(() => first.hit("before-independent-reopen", "resume"));
+  assert.equal(first.count("before-independent-reopen"), 1);
+  assert.equal(second.count("before-independent-reopen"), 0);
+  assert.throws(() => second.hit("before-independent-reopen", "resume"));
+});

package/src/resources/extensions/gsd/tests/workflow-fault-harness.ts

@@ -0,0 +1,72 @@
+import { mkdirSync } from "node:fs";
+
+import { getDb } from "../gsd-db.js";
+
+export type WorkflowFaultPoint =
+  | "before-transaction-commit"
+  | "after-db-commit-before-render"
+  | "during-projection-write"
+  | "before-independent-reopen"
+  | "after-independent-reopen";
+
+export interface WorkflowFaultHarness {
+  hit(point: WorkflowFaultPoint, operation?: string): void;
+  count(point: WorkflowFaultPoint): number;
+  armDatabaseAbort(
+    column: "status" | "full_summary_md",
+    predicate:
+      | "NEW.status = 'complete' AND OLD.status <> 'complete'"
+      | "NEW.full_summary_md IS NOT OLD.full_summary_md",
+  ): void;
+  obstructProjection(path: string): void;
+}
+
+export class WorkflowFaultError extends Error {
+  readonly point: WorkflowFaultPoint;
+  readonly operation: string;
+  readonly hitCount: number;
+
+  constructor(point: WorkflowFaultPoint, operation: string, hitCount: number) {
+    super(`${operation} fault at ${point} (hit ${hitCount})`);
+    this.name = "WorkflowFaultError";
+    this.point = point;
+    this.operation = operation;
+    this.hitCount = hitCount;
+  }
+}
+
+export function createWorkflowFaultHarness(
+  armedPoint: WorkflowFaultPoint,
+): WorkflowFaultHarness {
+  const counts = new Map<WorkflowFaultPoint, number>();
+  let armed = true;
+
+  return {
+    hit(point, operation = "workflow-operation") {
+      const hitCount = (counts.get(point) ?? 0) + 1;
+      counts.set(point, hitCount);
+      if (armed && point === armedPoint) {
+        armed = false;
+        throw new WorkflowFaultError(point, operation, hitCount);
+      }
+    },
+    count(point) {
+      return counts.get(point) ?? 0;
+    },
+    armDatabaseAbort(column, predicate) {
+      const triggerName = `workflow_fault_${armedPoint.replaceAll("-", "_")}`;
+      const message = `complete-dependent-slice fault at ${armedPoint}`;
+      getDb().exec(`
+        CREATE TEMP TRIGGER ${triggerName}
+        BEFORE UPDATE OF ${column} ON slices
+        WHEN ${predicate}
+        BEGIN
+          SELECT RAISE(ABORT, '${message}');
+        END
+      `);
+    },
+    obstructProjection(path) {
+      mkdirSync(path, { recursive: true });
+    },
+  };
+}

package/src/resources/extensions/gsd/tests/write-gate-planning-unit.test.ts

@@ -7,12 +7,15 @@
 
 import test from 'node:test';
 import assert from 'node:assert/strict';
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
 import { join, sep } from 'node:path';
 
 import { GSD_PHASE_SCOPE_DISPLAY_REASON, GSD_SECTION_CLOSE_GATE_DISPLAY_REASON } from '../auto-unit-tool-scope.ts';
 import { ALLOWED_PLANNING_DISPATCH_AGENTS, shouldBlockPlanningUnit } from '../bootstrap/write-gate.ts';
 import { extractSubagentAgentClasses } from '../bootstrap/subagent-input.ts';
 import { isDeterministicPolicyError } from '../auto-tool-tracking.ts';
+import { clearGSDPreferencesCache, getProjectGSDPreferencesPath, loadEffectiveGSDPreferences } from '../preferences.ts';
 import { applyPlanningSubagentPreferences } from '../planning-subagent-policy.ts';
 import type { ToolsPolicy } from '../unit-context-manifest.ts';
 
@@ -369,6 +372,43 @@ test('planning_subagents: widens plan-slice manifest allowlist without allowing
   assert.match(unsafe.reason!, /read-only specialists/);
 });
 
+test('planning_subagents: registered custom planning agents pass runtime read-only registry', (t) => {
+  const tempProject = mkdtempSync(join(tmpdir(), 'gsd-custom-planning-agent-'));
+
+  t.after(() => {
+    clearGSDPreferencesCache();
+    rmSync(tempProject, { recursive: true, force: true });
+  });
+
+  mkdirSync(join(tempProject, '.gsd'), { recursive: true });
+  writeFileSync(
+    getProjectGSDPreferencesPath(tempProject),
+    [
+      '---',
+      'version: 1',
+      'planning_subagent_registry:',
+      '  my-custom-planner:',
+      '    read_only_specialist: true',
+      'planning_subagents:',
+      '  plan-slice:',
+      '    allowed: [my-custom-planner]',
+      '---',
+      '',
+    ].join('\n'),
+    'utf-8',
+  );
+  clearGSDPreferencesCache();
+
+  const preferences = loadEffectiveGSDPreferences(tempProject)?.preferences;
+  const policy = applyPlanningSubagentPreferences('plan-slice', PLANNING_DISPATCH, preferences);
+  const custom = shouldBlockPlanningUnit('subagent', '', tempProject, 'plan-slice', policy, ['my-custom-planner']);
+  assert.strictEqual(custom.block, false, custom.reason);
+
+  const unregistered = shouldBlockPlanningUnit('subagent', '', tempProject, 'plan-slice', policy, ['other-planner']);
+  assert.strictEqual(unregistered.block, true);
+  assert.match(unregistered.reason!, /read-only specialists/);
+});
+
 // ─── planning mode: pass-through tools ────────────────────────────────────
 
 test('planning-unit: allows read tool', () => {

package/src/resources/extensions/gsd/tools/plan-slice.ts

@@ -20,7 +20,7 @@ import {
 } from "../gsd-db.js";
 import type { GateEvaluationConfig, GateId } from "../types.js";
 import { invalidateStateCache } from "../state.js";
-import { renderPlanFromDb } from "../markdown-renderer.js";
+import { renderPlanCheckboxes, renderPlanFromDb } from "../markdown-renderer.js";
 import { writeManifest } from "../workflow-manifest.js";
 import { appendEvent } from "../workflow-events.js";
 import { logWarning } from "../workflow-logger.js";
@@ -469,9 +469,13 @@ export async function handlePlanSlice(
     }
 
     const sliceTasks = getSliceTasks(params.milestoneId, params.sliceId);
+    const hasClosedTasks = sliceTasks.some((task) => isClosedStatus(task.status));
     const renderResult = sliceTasks.length === 0
       ? { planPath: "", taskPlanPaths: [] as string[] }
       : await renderPlanFromDb(basePath, params.milestoneId, params.sliceId);
+    if (sliceTasks.length > 0 && hasClosedTasks) {
+      await renderPlanCheckboxes(basePath, params.milestoneId, params.sliceId);
+    }
     if (sliceTasks.length > 0) {
       setSliceSketchFlag(params.milestoneId, params.sliceId, false);
     }

package/src/resources/extensions/gsd/verification-evidence.ts

@@ -98,8 +98,9 @@ export interface EvidenceJSON {
 }
 
 /**
- * Write a T##-VERIFY.json artifact to the tasks directory.
+ * Write a T##-VERIFY.json artifact to the evidence directory.
  * Creates the directory with mkdirSync({ recursive: true }) if it doesn't exist.
+ * Flat-phase callers can pass sliceId to write S##-T##-VERIFY.json.
  *
  * stdout/stderr are excluded from the JSON — the full output lives in VerificationResult
  * in memory and is logged to stderr during the gate run.
@@ -111,6 +112,7 @@ export function writeVerificationJSON(
   unitId?: string,
   retryAttempt?: number,
   maxRetries?: number,
+  sliceId?: string,
 ): void {
   mkdirSync(tasksDir, { recursive: true });
 
@@ -150,7 +152,8 @@ export function writeVerificationJSON(
     }));
   }
 
-  const filePath = join(tasksDir, `${taskId}-VERIFY.json`);
+  const fileName = sliceId ? `${sliceId}-${taskId}-VERIFY.json` : `${taskId}-VERIFY.json`;
+  const filePath = join(tasksDir, fileName);
   writeFileSync(filePath, JSON.stringify(evidence, null, 2) + "\n", "utf-8");
 }
 

package/src/resources/extensions/ollama/ollama-chat-provider.ts

@@ -207,7 +207,7 @@ export function streamOllamaChat(
  * - `"low" | "medium" | "high"` are passed through as strings; gpt-oss honors
  *   them as strength levels, other thinking models treat any present value
  *   as "thinking enabled".
- * - `"xhigh"` is collapsed to `"high"` (ollama caps strength at high).
+ * - `"xhigh"` and `"max"` are collapsed to `"high"` (ollama caps strength at high).
  */
 export function buildThinkParam(
 	model: Model<Api>,
@@ -217,7 +217,7 @@ export function buildThinkParam(
 	const level: ThinkingLevel | undefined = options?.reasoning;
 	if (level === undefined) return undefined;
 	if (level === "minimal") return false;
-	if (level === "xhigh") return "high";
+	if (level === "xhigh" || level === "max") return "high";
 	return level;
 }
 

package/src/resources/extensions/ollama/tests/ollama-chat-provider-think.test.ts

@@ -55,6 +55,10 @@ describe("buildThinkParam — ThinkingLevel mapping", () => {
 	it("collapses 'xhigh' to 'high' (ollama caps at high)", () => {
 		assert.equal(buildThinkParam(m, { reasoning: "xhigh" }), "high");
 	});
+
+	it("collapses 'max' to 'high' (ollama caps at high)", () => {
+		assert.equal(buildThinkParam(m, { reasoning: "max" }), "high");
+	});
 });
 
 describe("buildRequest — wire-level think field", () => {

package/src/resources/extensions/subagent/index.ts

@@ -735,7 +735,7 @@ async function runSingleAgentInCmuxSplit(
 	}
 }
 
-const ThinkingLevelSchema = StringEnum(["off", "minimal", "low", "medium", "high", "xhigh"] as const, {
+const ThinkingLevelSchema = StringEnum(["off", "minimal", "low", "medium", "high", "xhigh", "max"] as const, {
 	description:
 		"Reasoning effort override for the subagent (forwarded as --thinking). " +
 		"Independent of model choice; unsupported levels are clamped to the model at dispatch.",