@opengsd/gsd-pi 1.2.0-dev.844675c9 → 1.2.0-dev.84c56d87

package/src/resources/extensions/gsd/tests/codebase-generator.test.ts

@@ -696,3 +696,25 @@ test("ensureCodebaseMapFresh: does not rewrite expired metadata when fingerprint
     cleanup(base);
   }
 });
+
+test("ensureCodebaseMapFresh: detects file changes within the TTL window", () => {
+  const base = makeTmpRepo();
+  try {
+    addFile(base, "src/main.ts");
+    // Generate initial map with a long TTL so the cache is still active.
+    const initial = ensureCodebaseMapFresh(base, undefined, { ttlMs: 60_000 });
+    assert.equal(initial.status, "generated");
+
+    // Add a new tracked file while the TTL is still active.
+    addFile(base, "src/new.ts");
+
+    // Must detect the change even though the TTL has not expired.
+    const refreshed = ensureCodebaseMapFresh(base, undefined, { ttlMs: 60_000 });
+    assert.equal(refreshed.status, "updated");
+    assert.equal(refreshed.reason, "files-changed");
+    const written = readCodebaseMap(base);
+    assert.ok(written?.includes("`src/new.ts`"));
+  } finally {
+    cleanup(base);
+  }
+});

package/src/resources/extensions/gsd/tests/commands-dispatcher-workspace-git.test.ts

@@ -64,3 +64,14 @@ test("getWorkspaceGitBlockMessageForBase allows doctor on product conflicts", as
     cleanup(base);
   }
 });
+
+test("getWorkspaceGitBlockMessageForBase allows forensics on product conflicts", async () => {
+  const base = makeTempRepo("gsd-dispatch-ws-git-forensics-");
+  try {
+    seedProductConflict(base);
+    const blocked = await getWorkspaceGitBlockMessageForBase(base, "forensics");
+    assert.equal(blocked, null);
+  } finally {
+    cleanup(base);
+  }
+});

package/src/resources/extensions/gsd/tests/commands-verdict.test.ts

@@ -10,7 +10,7 @@
  */
 import test from "node:test";
 import assert from "node:assert/strict";
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { randomUUID } from "node:crypto";
@@ -472,17 +472,55 @@ test("auto-dispatch needs-attention pause message references /gsd verdict", asyn
   }
 });
 
-test("state.ts needs-remediation blocker messages reference /gsd verdict", async () => {
+test("guidance.ts needs-remediation blocker messages reference /gsd verdict", async () => {
   // We don't need to invoke deriveState — just assert the substring is in the
-  // source. The blocker strings are constructed inline and shipped to the user
-  // verbatim, so a static check is sufficient and avoids fragile DB setup.
-  const stateSource = readFileSync(
-    new URL("../state.ts", import.meta.url).pathname,
+  // source. The blocker strings are constructed in the guidance catalog and
+  // shipped to the user verbatim, so a static check is sufficient and avoids
+  // fragile DB setup.
+  const guidanceSource = readFileSync(
+    new URL("../guidance.ts", import.meta.url).pathname,
     "utf-8",
   );
-  const occurrences = stateSource.match(/`\/gsd verdict /g) ?? [];
+  const occurrences = guidanceSource.match(/`\/gsd verdict /g) ?? [];
   assert.ok(
     occurrences.length >= 2,
-    `expected at least 2 references to /gsd verdict in state.ts blockers, found ${occurrences.length}`,
+    `expected at least 2 references to /gsd verdict in guidance.ts blockers, found ${occurrences.length}`,
   );
 });
+
+// ─── WAL checkpoint regression (#563) ───────────────────────────────────
+
+test("handleVerdict pass checkpoints WAL so subsequent processes see the updated verdict (#563)", async () => {
+  // Regression: before the fix, executeValidateMilestone wrote the assessment
+  // only into the WAL file.  The next /gsd auto invocation (a new process)
+  // opened gsd.db directly and saw stale pre-verdict data because the WAL
+  // had not been flushed.  The fix adds checkpointDatabase() after a
+  // successful verdict so the WAL is truncated and gsd.db is self-contained.
+  const base = makeBase();
+  try {
+    openTestDb(base);
+    seedMilestone("M001", "Checkpoint Test Milestone");
+    seedSlice("M001", "S01", "complete");
+    writeValidation(base, "M001", "needs-attention");
+
+    const { ctx } = makeMockCtx();
+    await handleVerdict("pass --milestone M001", ctx, base);
+
+    // After handleVerdict succeeds, PRAGMA wal_checkpoint(TRUNCATE) must have
+    // run.  The WAL file is truncated to zero bytes — a new process reading
+    // gsd.db directly sees the updated verdict without needing the WAL.
+    const walPath = join(base, ".gsd", "gsd.db-wal");
+    if (existsSync(walPath)) {
+      const { size } = statSync(walPath);
+      assert.equal(
+        size,
+        0,
+        "WAL must be zero bytes after handleVerdict pass — checkpointDatabase() was not called (#563)",
+      );
+    }
+  } finally {
+    closeDatabase();
+    invalidateStateCache();
+    cleanup(base);
+  }
+});

package/src/resources/extensions/gsd/tests/dispatch-complete-milestone-guard.test.ts

@@ -14,7 +14,15 @@ import { execFileSync } from "node:child_process";
 
 import { DISPATCH_RULES, resolveDispatch, type DispatchContext } from "../auto-dispatch.ts";
 import { AutoSession } from "../auto/session.ts";
-import { closeDatabase, insertAssessment, insertGateRow, insertMilestone, insertSlice, openDatabase } from "../gsd-db.ts";
+import {
+  closeDatabase,
+  getPendingGates,
+  insertAssessment,
+  insertGateRow,
+  insertMilestone,
+  insertSlice,
+  openDatabase,
+} from "../gsd-db.ts";
 
 function makeBase(): string {
   const base = mkdtempSync(join(tmpdir(), "gsd-complete-dispatch-"));
@@ -243,7 +251,7 @@ describe("complete phase dispatch guard (#5683)", () => {
     assert.equal(result?.reason, "All milestones complete.");
   });
 
-  test("blocks terminal stop when closed milestone still has pending gates", async () => {
+  test("closes stale pending gates from milestone validation before terminal stop", async () => {
     base = makeBase();
     openDatabase(join(base, ".gsd", "gsd.db"));
     insertMilestone({ id: "M001", title: "Milestone One", status: "complete" });
@@ -268,10 +276,33 @@ describe("complete phase dispatch guard (#5683)", () => {
 
     const result = await rule.match(ctx);
 
+    assert.equal(result?.action, "stop");
+    assert.equal(result?.reason, "All milestones complete.");
+    assert.deepEqual(getPendingGates("M001", "S01"), []);
+  });
+
+  test("blocks terminal stop when pending gates have no closeout evidence", async () => {
+    base = makeBase();
+    openDatabase(join(base, ".gsd", "gsd.db"));
+    insertMilestone({ id: "M001", title: "Milestone One", status: "complete" });
+    insertSlice({ milestoneId: "M001", id: "S01", title: "Done", status: "complete" });
+    insertGateRow({
+      milestoneId: "M001",
+      sliceId: "S01",
+      gateId: "Q3",
+      scope: "slice",
+      status: "pending",
+    });
+
+    const ctx = buildDispatchCtx(base);
+    ctx.state.phase = "complete";
+
+    const result = await rule.match(ctx);
+
     assert.equal(result?.action, "stop");
     assert.equal(result?.level, "warning");
     assert.match(result?.reason ?? "", /closeout-consistency-blocked/);
-    assert.match(result?.reason ?? "", /quality gate Q3 is still pending/);
+    assert.match(result?.reason ?? "", /latest milestone validation is "absent"/);
   });
 });
 

package/src/resources/extensions/gsd/tests/dispatch-run-uat-browser-tools.test.ts

@@ -0,0 +1,89 @@
+// Project/App: gsd-pi
+// File Purpose: Regression coverage for run-uat browser tool availability checks.
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { DISPATCH_RULES, type DispatchContext } from "../auto-dispatch.ts";
+import type { GSDState } from "../types.ts";
+import { BROWSER_AUTOMATION_CONTRACT_TOOLS } from "./browser-automation-contract-fixture.ts";
+
+type DispatchRuleEntry = (typeof DISPATCH_RULES)[number];
+
+function runUatRule(): DispatchRuleEntry {
+  const rule = DISPATCH_RULES.find((entry) => entry.name === "run-uat (post-completion)");
+  assert.ok(rule, "run-uat dispatch rule must exist");
+  return rule;
+}
+
+function makeState(): GSDState {
+  return {
+    activeMilestone: { id: "M001", title: "Browser UAT" },
+    activeSlice: { id: "S02", title: "Next Slice" },
+    activeTask: null,
+    phase: "verifying",
+    recentDecisions: [],
+    blockers: [],
+    nextAction: "",
+    registry: [],
+  };
+}
+
+function scaffoldRunUatProject(basePath: string): void {
+  const milestoneDir = join(basePath, ".gsd", "milestones", "M001");
+  const sliceDir = join(milestoneDir, "slices", "S01");
+  mkdirSync(sliceDir, { recursive: true });
+
+  writeFileSync(join(milestoneDir, "M001-ROADMAP.md"), [
+    "# M001: Browser UAT",
+    "",
+    "## Slices",
+    "",
+    "- [x] **S01: Completed browser slice** `risk:low` `depends:[]`",
+    "- [ ] **S02: Next slice** `risk:low` `depends:[S01]`",
+    "",
+  ].join("\n"), "utf-8");
+
+  writeFileSync(join(sliceDir, "S01-SUMMARY.md"), "# S01 Summary\n\nDone.\n", "utf-8");
+  writeFileSync(join(sliceDir, "S01-UAT.md"), [
+    "# S01 UAT",
+    "",
+    "## UAT Type",
+    "- UAT mode: human-experience",
+    "",
+    "Open the app in a browser and verify the completed user flow.",
+    "",
+  ].join("\n"), "utf-8");
+}
+
+function makeContext(basePath: string, overrides: Partial<DispatchContext> = {}): DispatchContext {
+  return {
+    basePath,
+    mid: "M001",
+    midTitle: "Browser UAT",
+    state: makeState(),
+    prefs: undefined,
+    activeTools: ["read", "gsd_uat_exec", "gsd_uat_result_save"],
+    ...overrides,
+  };
+}
+
+test("run-uat browser preflight uses registered tools when the active surface is scoped", async (t) => {
+  const basePath = mkdtempSync(join(tmpdir(), "gsd-run-uat-browser-tools-"));
+  t.after(() => rmSync(basePath, { recursive: true, force: true }));
+  scaffoldRunUatProject(basePath);
+
+  const blocked = await runUatRule().match(makeContext(basePath));
+  assert.equal(blocked?.action, "stop");
+  assert.match(blocked?.action === "stop" ? blocked.reason : "", /run-uat tool surface has none/);
+
+  const dispatched = await runUatRule().match(makeContext(basePath, {
+    registeredTools: [...BROWSER_AUTOMATION_CONTRACT_TOOLS.piProvider],
+  }));
+  assert.equal(dispatched?.action, "dispatch");
+  assert.equal(dispatched?.action === "dispatch" ? dispatched.unitType : undefined, "run-uat");
+  assert.equal(dispatched?.action === "dispatch" ? dispatched.unitId : undefined, "M001/S01");
+});

package/src/resources/extensions/gsd/tests/doctor-scope-db-unavailable.test.ts

@@ -26,6 +26,24 @@ test("filterDoctorIssues keeps project and environment issues in scoped reports"
   );
 });
 
+test("filterDoctorIssues keeps invalid_preferences issues regardless of preferences file scope", () => {
+  // Both global and project preference diagnostics should survive scope filtering.
+  // doctor.ts uses unitId: "project" for all invalid_preferences issues so they
+  // pass through the scope filter the same way other project-level issues do.
+  const issues = [
+    { severity: "error", code: "invalid_preferences", scope: "project", unitId: "project", message: "global PREFERENCES.md parse error", fixable: false },
+    { severity: "error", code: "invalid_preferences", scope: "project", unitId: "project", message: "project PREFERENCES.md parse error", fixable: false },
+    { severity: "error", code: "invalid_preferences", scope: "project", unitId: "global", message: "stale unitId — should be filtered out", fixable: false },
+  ] as const;
+
+  const filtered = filterDoctorIssues([...issues], { scope: "M016", includeWarnings: true });
+  assert.deepEqual(
+    filtered.map((issue) => issue.message),
+    ["global PREFERENCES.md parse error", "project PREFERENCES.md parse error"],
+    "invalid_preferences issues with unitId: project survive scope filtering; unitId: global is dropped",
+  );
+});
+
 test("checkEngineHealth reports db_unavailable when gsd.db exists but the DB is closed", async (t) => {
   const base = mkdtempSync(join(tmpdir(), "gsd-doctor-db-unavailable-"));
   t.after(() => rmSync(base, { recursive: true, force: true }));

package/src/resources/extensions/gsd/tests/evidence-xref-gsd-exec.test.ts

@@ -0,0 +1,157 @@
+// Project/App: gsd-pi
+// File Purpose: Regression tests for evidence cross-referencing of gsd_exec /
+// gsd_uat_exec tool calls. Mirrors the live false-positive where an
+// execute-task agent ran its verification commands through gsd_exec (script
+// body in the `script` argument) and the cross-referencer reported
+// "No bash tool call found" despite successful execution.
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import {
+  resetEvidence,
+  getEvidence,
+  recordToolCall,
+  recordToolResult,
+  isExecutionToolName,
+  type BashEvidence,
+} from "../safety/evidence-collector.ts";
+import { crossReferenceEvidence } from "../safety/evidence-cross-ref.ts";
+
+function gsdExecResult(exitCode: number, id = "4858202d-2ed7-4a0a-9ef7-4e159e65da83"): unknown {
+  return {
+    content: [{
+      type: "text",
+      text: JSON.stringify({
+        operation: "gsd_exec",
+        id,
+        runtime: "bash",
+        exit_code: exitCode,
+        signal: null,
+        timed_out: false,
+        duration_ms: 272,
+        stdout_bytes: 592,
+        stderr_bytes: 0,
+        meta_path: `/tmp/does-not-exist/.gsd/exec/${id}.meta.json`,
+      }),
+    }],
+  };
+}
+
+test("evidence-xref: verification run through gsd_exec script matches the claimed command", () => {
+  resetEvidence();
+
+  // The live false positive: agent runs `node --test tests/verify-s01.test.js`
+  // inside a gsd_exec script with a cd prefix and exit-code echo suffix.
+  recordToolCall("tc-exec-1", "gsd_exec", {
+    script: 'cd /work/.gsd/worktrees/M001 && node --test tests/verify-s01.test.js; echo "EXIT=$?"',
+    purpose: "T02: run node --test contract checks against T01 index.html",
+  });
+  recordToolResult("tc-exec-1", "gsd_exec", gsdExecResult(0), false);
+
+  const mismatches = crossReferenceEvidence(
+    [{ command: "node --test tests/verify-s01.test.js", exitCode: 0, verdict: "passed" }],
+    getEvidence(),
+  );
+
+  assert.deepEqual(mismatches, [], "gsd_exec-executed verification must not be flagged as missing");
+});
+
+test("evidence-xref: multi-line gsd_exec script matches claims for each embedded command", () => {
+  resetEvidence();
+
+  recordToolCall("tc-exec-2", "gsd_exec", {
+    script: [
+      "cd /work/.gsd/worktrees/M001",
+      "sed -i '' \"s/'todos'/'tasks-v1'/\" index.html",
+      "node --test tests/verify-s01.test.js > /dev/null 2>&1",
+      'echo "BROKEN_EXIT=$?"',
+    ].join("\n"),
+    purpose: "T02: deliberate contract break must fail, then restore",
+  });
+  recordToolResult("tc-exec-2", "gsd_exec", gsdExecResult(0), false);
+
+  const mismatches = crossReferenceEvidence(
+    [{ command: "node --test tests/verify-s01.test.js > /dev/null 2>&1", exitCode: 0, verdict: "passed" }],
+    getEvidence(),
+  );
+
+  assert.deepEqual(mismatches, [], "command embedded in a multi-line script must match");
+});
+
+test("evidence-xref: claimed pass with failing gsd_exec exit_code is still an error", () => {
+  resetEvidence();
+
+  recordToolCall("tc-exec-3", "gsd_exec", {
+    script: "node --test tests/verify-s01.test.js",
+    purpose: "verification",
+  });
+  // gsd_exec reports failures via the JSON envelope's exit_code (and isError).
+  recordToolResult("tc-exec-3", "gsd_exec", gsdExecResult(1), true);
+
+  const mismatches = crossReferenceEvidence(
+    [{ command: "node --test tests/verify-s01.test.js", exitCode: 0, verdict: "passed" }],
+    getEvidence(),
+  );
+
+  assert.equal(mismatches.length, 1);
+  assert.equal(mismatches[0].severity, "error");
+  assert.match(mismatches[0].reason, /Claimed exitCode=0 but actual exitCode=1/);
+});
+
+test("evidence-collector: gsd_uat_exec and MCP-namespaced variants are execution tools", () => {
+  assert.equal(isExecutionToolName("gsd_uat_exec"), true);
+  assert.equal(isExecutionToolName("mcp__gsd-workflow__gsd_uat_exec"), true);
+  assert.equal(isExecutionToolName("mcp__gsd-workflow__gsd_exec"), true);
+
+  resetEvidence();
+  recordToolCall("tc-uat-1", "gsd_uat_exec", { script: "curl -fsS http://localhost:3000/health" });
+  const bash = getEvidence().filter((e): e is BashEvidence => e.kind === "bash");
+  assert.equal(bash.length, 1, "gsd_uat_exec must record bash evidence");
+  assert.equal(bash[0].command, "curl -fsS http://localhost:3000/health");
+});
+
+test("evidence-xref: blank-command evidence does not satisfy arbitrary claims", () => {
+  // Before script extraction existed, gsd_exec calls were recorded with
+  // command: "" — and `"x".includes("")` made them match every claim,
+  // masking genuine fabrications. Blank entries must never match.
+  const mismatches = crossReferenceEvidence(
+    [{ command: "node --test tests/verify-s01.test.js", exitCode: 0, verdict: "passed" }],
+    [{
+      kind: "bash",
+      toolCallId: "tc-blank",
+      command: "",
+      exitCode: 0,
+      outputSnippet: "",
+      timestamp: 1,
+    }],
+  );
+
+  assert.equal(mismatches.length, 1);
+  assert.equal(mismatches[0].severity, "warning");
+  assert.match(mismatches[0].reason, /No bash tool call found/);
+});
+
+test("evidence-collector: exit code falls back to .gsd/exec meta.json when result text omits it", (t) => {
+  const dir = mkdtempSync(join(tmpdir(), "gsd-exec-meta-"));
+  t.after(() => rmSync(dir, { recursive: true, force: true }));
+
+  const metaPath = join(dir, "run-1.meta.json");
+  writeFileSync(metaPath, JSON.stringify({ id: "run-1", exit_code: 7 }));
+
+  resetEvidence();
+  recordToolCall("tc-meta-1", "gsd_exec", { script: "exit 7" });
+  // Truncated result: meta_path survives but exit_code was cut off.
+  recordToolResult(
+    "tc-meta-1",
+    "gsd_exec",
+    { content: [{ type: "text", text: `{"operation":"gsd_exec","meta_path":${JSON.stringify(metaPath)}` }] },
+    false,
+  );
+
+  const bash = getEvidence().filter((e): e is BashEvidence => e.kind === "bash");
+  assert.equal(bash[0].exitCode, 7, "exit code must be recovered from meta.json");
+});

package/src/resources/extensions/gsd/tests/execute-task-rendering.test.ts

@@ -38,6 +38,7 @@ test("execute-task prompt renders compact execution and completion gates", async
     planPath: ".gsd/milestones/M001/slices/S01/S01-PLAN.md",
     taskPlanPath: ".gsd/milestones/M001/slices/S01/tasks/T01-PLAN.md",
     priorTaskLines: "- None",
+    onDemandContext: "",
     skillActivation: "Load relevant skills.",
     inlinedTemplates: "### Output Template: Task Summary\nSource: `templates/task-summary.md`",
     templatesDir: join(fixtureRoot, "templates"),

package/src/resources/extensions/gsd/tests/extension-bootstrap-isolation.test.ts

@@ -117,7 +117,8 @@ describe("extension bootstrap isolation (#4168, #4172)", () => {
 // registration is wrapped in its own try/catch so one failure does not
 // prevent siblings from loading.
 
-import { registerGsdExtension } from "../bootstrap/register-extension.ts";
+import { CRITICAL_GSD_WORKFLOW_TOOL_NAMES, registerGsdExtension } from "../bootstrap/register-extension.ts";
+import { drainLogs } from "../workflow-logger.ts";
 
 describe("registerGsdExtension defensive registration", () => {
   test("a failing shortcut registration does not prevent kill command registration", async () => {
@@ -161,4 +162,37 @@ describe("registerGsdExtension defensive registration", () => {
       `registerGsdExtension must NOT register 'gsd' (it is registered separately by index.ts), got ${JSON.stringify(registered)}`,
     );
   });
+
+  test("critical workflow tool list includes lifecycle planning and completion tools", () => {
+    assert.ok(CRITICAL_GSD_WORKFLOW_TOOL_NAMES.includes("gsd_plan_slice"));
+    assert.ok(CRITICAL_GSD_WORKFLOW_TOOL_NAMES.includes("gsd_slice_complete"));
+    assert.ok(CRITICAL_GSD_WORKFLOW_TOOL_NAMES.includes("gsd_validate_milestone"));
+    assert.ok(CRITICAL_GSD_WORKFLOW_TOOL_NAMES.includes("gsd_complete_milestone"));
+  });
+
+  test("partial db-tools registration fails visibly when critical tools are missing", () => {
+    drainLogs();
+    const registeredTools: string[] = [];
+    const pi = {
+      registerCommand: () => {},
+      registerTool: (tool: { name: string }) => {
+        if (tool.name === "gsd_plan_slice") {
+          throw new Error("simulated db-tools partial registration failure");
+        }
+        registeredTools.push(tool.name);
+      },
+      registerHook: () => {},
+      registerShortcut: () => {},
+      events: { on: () => {}, off: () => {}, emit: () => {} },
+      getAllTools: () => registeredTools.map((name) => ({ name })),
+    };
+
+    assert.throws(
+      () => registerGsdExtension(pi as any),
+      /Critical GSD workflow tool registration failed; missing required tool\(s\): .*gsd_plan_slice/,
+    );
+    assert.ok(registeredTools.includes("gsd_plan_milestone"));
+    assert.ok(!registeredTools.includes("gsd_plan_slice"));
+    drainLogs();
+  });
 });

package/src/resources/extensions/gsd/tests/file-change-validator.test.ts

@@ -5,7 +5,7 @@ import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
-import { validateFileChanges } from "../safety/file-change-validator.ts";
+import { validateFileChanges, effectiveFileChangeAllowlist } from "../safety/file-change-validator.ts";
 
 function git(cwd: string, ...args: string[]): string {
   return execFileSync("git", args, {
@@ -106,3 +106,35 @@ test("validateFileChanges ignores inline descriptions in expected output paths",
     "described expected output should not trigger unexpected-file warnings",
   );
 });
+
+test("effectiveFileChangeAllowlist includes .gitignore when GSD manages it", () => {
+  assert.deepEqual(effectiveFileChangeAllowlist([], undefined), [".gitignore"]);
+  assert.deepEqual(effectiveFileChangeAllowlist(["docs/**"], true), ["docs/**", ".gitignore"]);
+});
+
+test("effectiveFileChangeAllowlist keeps .gitignore auditable when management is disabled", () => {
+  assert.deepEqual(effectiveFileChangeAllowlist(["docs/**"], false), ["docs/**"]);
+});
+
+test("GSD-managed .gitignore edit swept into a task commit is not flagged", (t) => {
+  const base = mkdtempSync(join(tmpdir(), "gsd-file-change-validator-"));
+  t.after(() => rmSync(base, { recursive: true, force: true }));
+
+  git(base, "init");
+  git(base, "config", "user.email", "test@example.com");
+  git(base, "config", "user.name", "Test User");
+  writeFileSync(join(base, "index.html"), "<main></main>\n");
+  writeFileSync(join(base, ".gitignore"), "# ── GSD baseline (auto-generated) ──\n.gsd\n");
+  git(base, "add", ".");
+  git(base, "commit", "-m", "task commit with swept gitignore");
+
+  const audit = validateFileChanges(
+    base,
+    ["index.html"],
+    [],
+    effectiveFileChangeAllowlist([], undefined),
+  );
+
+  assert.ok(audit, "audit should be produced");
+  assert.deepEqual(audit.unexpectedFiles, [], ".gitignore must not be flagged when GSD manages it");
+});

package/src/resources/extensions/gsd/tests/fixtures/pr-body/swarm-lane-no-blockers.md

@@ -48,8 +48,4 @@ Closes #123
 
 ## Rollback And Compatibility
 
-- Disable writer sequence enrichment
-
-## AI Assistance Disclosure
-
-This PR was prepared with AI assistance.
+- Disable writer sequence enrichment

package/src/resources/extensions/gsd/tests/fixtures/pr-body/swarm-lane-with-blockers.md

@@ -53,8 +53,4 @@ Closes #123
 
 ## Rollback And Compatibility
 
-- Disable writer sequence enrichment
-
-## AI Assistance Disclosure
-
-This PR was prepared with AI assistance.
+- Disable writer sequence enrichment

package/src/resources/extensions/gsd/tests/gate-state-canonicalization.test.ts

@@ -3,7 +3,7 @@
 
 import { describe, test, beforeEach, afterEach } from "node:test";
 import assert from "node:assert/strict";
-import { mkdtempSync, rmSync } from "node:fs";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
 
@@ -18,6 +18,7 @@ import {
   insertSlice,
 } from "../gsd-db.ts";
 import type { GateVerdict } from "../types.ts";
+import { closeQualityGatesFromEvidence } from "../quality-gate-closure.ts";
 
 describe("gate-state canonicalization (#4950)", () => {
   let tmpDir: string;
@@ -99,4 +100,50 @@ describe("gate-state canonicalization (#4950)", () => {
       assert.notEqual(g.verdict, "", `gate ${g.gate_id} verdict must not be empty string`);
     }
   });
+
+  test("closeQualityGatesFromEvidence repairs pending gate from durable section", () => {
+    insertGateRow({ milestoneId: "M001", sliceId: "S01", gateId: "Q3", scope: "slice" });
+    mkdirSync(join(tmpDir, ".gsd", "milestones", "M001", "slices", "S01"), { recursive: true });
+    writeFileSync(
+      join(tmpDir, ".gsd", "milestones", "M001", "slices", "S01", "S01-PLAN.md"),
+      [
+        "# S01",
+        "",
+        "## Threat Surface",
+        "",
+        "- Credential stuffing is rate-limited.",
+      ].join("\n"),
+    );
+
+    const result = closeQualityGatesFromEvidence("M001", { artifactBasePath: tmpDir });
+
+    assert.deepEqual(result.unresolved, []);
+    assert.deepEqual(result.repaired, [{ gateId: "Q3", sliceId: "S01", verdict: "pass" }]);
+    assert.equal(getPendingGates("M001", "S01").length, 0);
+    assert.equal(getGateResults("M001", "S01")[0].verdict, "pass");
+  });
+
+  test("closeQualityGatesFromEvidence omits stale pending gate after validation pass", () => {
+    insertGateRow({ milestoneId: "M001", sliceId: "S01", gateId: "Q4", scope: "slice" });
+
+    const result = closeQualityGatesFromEvidence("M001", {
+      artifactBasePath: tmpDir,
+      milestoneValidationPassed: true,
+    });
+
+    assert.deepEqual(result.unresolved, []);
+    assert.deepEqual(result.repaired, [{ gateId: "Q4", sliceId: "S01", verdict: "omitted" }]);
+    assert.equal(getGateResults("M001", "S01")[0].verdict, "omitted");
+  });
+
+  test("closeQualityGatesFromEvidence leaves pending gate unresolved without evidence", () => {
+    insertGateRow({ milestoneId: "M001", sliceId: "S01", gateId: "Q3", scope: "slice" });
+
+    const result = closeQualityGatesFromEvidence("M001", { artifactBasePath: tmpDir });
+
+    assert.deepEqual(result.repaired, []);
+    assert.equal(result.unresolved.length, 1);
+    assert.equal(result.unresolved[0].gate_id, "Q3");
+    assert.equal(getPendingGates("M001", "S01").length, 1);
+  });
 });