@opengsd/gsd-pi 1.2.0-dev.844675c9 → 1.2.0-dev.955e4da0

package/dist/resources/extensions/gsd/auto/orchestrator.js

@@ -9,8 +9,9 @@
 // the real collaborators (state-reconciliation, doctor-proactive,
 // auto-dispatch, recovery-classification, tool-contract, worktree-safety,
 // uok/gate-runner, journal, session-lock, ctx.ui.notify) directly.
-import { debugCount, debugTime } from "../debug-logger.js";
+import { debugCount, debugLog, debugTime } from "../debug-logger.js";
 import { reconcileBeforeDispatch } from "../state-reconciliation.js";
+import { isLegalEdge, IllegalPhaseTransitionError } from "../state-transition-matrix.js";
 import { resolveDispatch } from "../auto-dispatch.js";
 import { classifyFailure } from "../recovery-classification.js";
 import { verifyExpectedArtifact, refreshRecoveryDbForArtifact } from "../auto-recovery.js";
@@ -24,22 +25,26 @@ import { checkResourcesStale, autoWorktreeBranch, mergeMilestoneToMain } from ".
 import { getSessionLockStatus } from "../session-lock.js";
 import { resolveUokFlags } from "../uok/flags.js";
 import { emitJournalEvent as _emitJournalEvent } from "../journal.js";
-import { loadEffectiveGSDPreferences, getIsolationMode } from "../preferences.js";
-import { detectWorktreeName, resolveProjectRoot } from "../worktree.js";
+import { loadEffectiveGSDPreferences, getIsolationMode, resolveEffectiveUnitIsolationMode } from "../preferences.js";
+import { detectWorktreeName, getMainBranch, resolveProjectRoot, resolveWorktreeProjectRoot, } from "../worktree.js";
+import { getPriorSliceCompletionBlocker } from "../dispatch-guard.js";
 import { GitServiceImpl } from "../git-service.js";
 import { WorktreeStateProjection } from "../worktree-state-projection.js";
 import { WorktreeLifecycle } from "../worktree-lifecycle.js";
+import { createMilestoneMergeTransaction } from "../milestone-merge-transaction.js";
 import { createWorkspace, scopeMilestone } from "../workspace.js";
 import { supportsStructuredQuestions } from "../workflow-mcp.js";
-import { getToolBaselineSnapshot } from "../auto-model-selection.js";
+import { getRegisteredToolSnapshot, getToolBaselineSnapshot } from "../auto-model-selection.js";
 import { deriveState } from "../state.js";
 import { parseUnitId } from "../unit-id.js";
 import { isClosedStatus } from "../status-guards.js";
-import { isDbAvailable, getSlice, getTask, refreshOpenDatabaseFromDisk, } from "../gsd-db.js";
+import { isDbAvailable, getSlice, getTask, } from "../gsd-db.js";
+import { refreshWorkflowDatabaseFromDisk } from "../db-workspace.js";
 import { getErrorMessage } from "../error-utils.js";
 import { logWarning } from "../workflow-logger.js";
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
+import { evaluateAllCompleteSettlement } from "../milestone-settlement.js";
 function now() {
     return Date.now();
 }
@@ -52,16 +57,24 @@ function now() {
  * preserved across the eventual cutover (issue #5791).
  */
 export const STUCK_WINDOW_SIZE = 6;
-function noRemainingUnitsReason(stateSnapshot) {
+function noRemainingUnitsOutcome(stateSnapshot) {
     if (stateSnapshot.phase === "complete") {
-        return "all milestones complete";
+        return {
+            code: "all-complete",
+            displayReason: "All milestones complete",
+            allMilestonesComplete: true,
+        };
     }
-    return "no remaining units";
+    return {
+        code: "no-remaining-units",
+        displayReason: "No remaining units",
+        allMilestonesComplete: false,
+    };
 }
 function getAlreadyClosedDispatchReason(unitType, unitId) {
     if (!isDbAvailable())
         return null;
-    refreshOpenDatabaseFromDisk();
+    refreshWorkflowDatabaseFromDisk();
     const { milestone, slice, task } = parseUnitId(unitId);
     if (unitType === "execute-task" && milestone && slice && task) {
         const row = getTask(milestone, slice, task);
@@ -127,6 +140,7 @@ export async function decideOrchestratorDispatch(ctx, pi, dispatchBasePath, sess
     // active set may be narrowed by the prior unit before selectAndApplyModel
     // restores it, causing false transport-preflight failures (#477 follow-up).
     const activeTools = getToolBaselineSnapshot(pi);
+    const registeredTools = getRegisteredToolSnapshot(pi);
     // Mirrors runDispatch: deep-planning keeps approval gates in plain chat
     // because structured questions can be cancelled outside the chat turn on
     // some transports.
@@ -168,6 +182,7 @@ export async function decideOrchestratorDispatch(ctx, pi, dispatchBasePath, sess
         sessionProvider,
         modelRegistry,
         activeTools,
+        registeredTools,
         sessionAuthMode: authMode,
         sessionBaseUrl: ctx.model?.baseUrl,
     });
@@ -230,6 +245,10 @@ export class AutoOrchestrator {
     lastAdvanceKey = null;
     lastFinalizedUnitKey = null;
     dispatchKeyWindow = [];
+    // ADR-030 Phase Transition Invariant: the prior advance's reconciled Phase,
+    // the "from" endpoint of the edge check. In-memory; reset on start/resume/stop
+    // so the first advance of a session has no edge to assert.
+    lastDerivedPhase = null;
     // #442: the unit key we last attempted graduated stuck-recovery for. Bounds
     // recovery to one attempt per stuck episode per run (reset on start/resume/
     // stop), mirroring the legacy Level-1-then-Level-2 escalation in phases.ts.
@@ -412,6 +431,47 @@ export class AutoOrchestrator {
     decideNextUnit(input) {
         return decideOrchestratorDispatch(this.ctx, this.pi, this.dispatchBasePath, this.s, input);
     }
+    evaluateNoRemainingUnitsSettlement(stateSnapshot) {
+        const settlement = evaluateAllCompleteSettlement({
+            milestoneId: this.s.currentMilestoneId ?? stateSnapshot.activeMilestone?.id,
+            statePhase: stateSnapshot.phase,
+            basePath: this.s.basePath || this.getLiveDispatchBasePath(),
+            originalBasePath: this.s.originalBasePath || this.runtimeBasePath,
+            milestoneMerged: this.s.milestoneMergedInPhases,
+        });
+        this.s.milestoneSettlement = settlement;
+        if (settlement.ok)
+            return null;
+        return {
+            kind: "blocked",
+            reason: settlement.message,
+            action: settlement.action,
+            stateSnapshot,
+            terminalOutcome: {
+                code: "settlement-blocked",
+                displayReason: settlement.message,
+                nextAction: settlement.nextAction,
+                milestoneId: settlement.milestoneId,
+                allMilestonesComplete: false,
+            },
+        };
+    }
+    clearPendingDispatch() {
+        this.s.pendingOrchestrationDispatch = null;
+    }
+    findPriorSliceCompletionBlocker(unitType, unitId) {
+        const guardBasePath = resolveWorktreeProjectRoot(this.getLiveDispatchBasePath(), this.s.originalBasePath);
+        let mainBranch = "main";
+        try {
+            mainBranch = getMainBranch(guardBasePath);
+        }
+        catch (err) {
+            // Preserve legacy dispatch behavior: fall back to main when branch
+            // discovery fails, then let the guard make the progression decision.
+            logWarning("engine", `branch discovery failed, falling back to main: ${getErrorMessage(err)}`, { file: "orchestrator.ts" });
+        }
+        return getPriorSliceCompletionBlocker(guardBasePath, mainBranch, unitType, unitId);
+    }
     // ── ToolContractAdapter (folded) ─────────────────────────────────────────
     compileUnitToolContract(unitType) {
         const result = compileUnitToolContract(unitType);
@@ -421,8 +481,7 @@ export class AutoOrchestrator {
     }
     // ── WorktreeAdapter (folded) ─────────────────────────────────────────────
     getEffectiveUnitIsolationMode(basePath) {
-        const configuredMode = getIsolationMode(basePath);
-        return configuredMode === "worktree" && this.s.isolationDegraded ? "branch" : configuredMode;
+        return resolveEffectiveUnitIsolationMode(getIsolationMode(basePath), this.s.isolationDegraded, this.s.strandedRecoveryIsolationMode);
     }
     buildLifecycle() {
         return new WorktreeLifecycle(this.s, {
@@ -431,7 +490,7 @@ export class AutoOrchestrator {
                 return new GitServiceImpl(basePath, gitConfig);
             },
             worktreeProjection: new WorktreeStateProjection(),
-            mergeMilestoneToMain,
+            mergeMilestoneToMain: createMilestoneMergeTransaction(mergeMilestoneToMain),
         });
     }
     rebuildScope(rawPath, milestoneId) {
@@ -521,6 +580,21 @@ export class AutoOrchestrator {
         const recovery = classifyFailure(input);
         return { action: recovery.action, reason: recovery.reason };
     }
+    /**
+     * ADR-030 Phase Transition Invariant (advisory mode). The matrix is an
+     * assertion, not a decision-maker — deriveState already chose the phase; we
+     * only observe illegal *derived* edges that survived reconciliation. The
+     * matrix is still a sparse hardening spec, so this is telemetry-only (no
+     * block) until it is expanded into a validated legal-edge graph. To enforce:
+     * `throw violation;` instead of logging — recovery-classification maps
+     * IllegalPhaseTransitionError to kind "illegal-transition" (escalate).
+     */
+    observePhaseTransition(from, to) {
+        if (isLegalEdge(from, to))
+            return;
+        const violation = new IllegalPhaseTransitionError(from, to);
+        debugLog("phase-transition-advisory", { from, to, message: violation.message });
+    }
     // ── Lifecycle verbs ──────────────────────────────────────────────────────
     /**
      * #442: graduated stuck recovery, ported from the legacy
@@ -581,6 +655,7 @@ export class AutoOrchestrator {
         this.lastFinalizedUnitKey = null;
         this.dispatchKeyWindow = [];
         this.lastStuckRecoveryKey = null;
+        this.lastDerivedPhase = null;
         this.status.phase = "running";
         this.bumpTransition();
         this.journalTransition({ name: "start" });
@@ -666,12 +741,30 @@ export class AutoOrchestrator {
                 this.postAdvanceRecord(blocked);
                 return blocked;
             }
+            const reconciledPhase = reconciliation.stateSnapshot.phase;
+            if (this.lastDerivedPhase !== null) {
+                this.observePhaseTransition(this.lastDerivedPhase, reconciledPhase);
+            }
+            this.lastDerivedPhase = reconciledPhase;
             const decision = await this.decideNextUnit({ stateSnapshot: reconciliation.stateSnapshot });
             if (!decision) {
+                const settlementBlock = this.evaluateNoRemainingUnitsSettlement(reconciliation.stateSnapshot);
+                if (settlementBlock) {
+                    this.status.phase = "paused";
+                    this.status.activeUnit = undefined;
+                    this.lastAdvanceKey = null;
+                    this.dispatchKeyWindow = [];
+                    this.bumpTransition();
+                    this.journalTransition({ name: "advance-blocked", reason: settlementBlock.reason });
+                    this.postAdvanceRecord(settlementBlock);
+                    return settlementBlock;
+                }
+                const terminalOutcome = noRemainingUnitsOutcome(reconciliation.stateSnapshot);
                 const stopped = {
                     kind: "stopped",
-                    reason: noRemainingUnitsReason(reconciliation.stateSnapshot),
+                    reason: terminalOutcome.displayReason,
                     stateSnapshot: reconciliation.stateSnapshot,
+                    terminalOutcome,
                 };
                 this.status.phase = "stopped";
                 this.status.activeUnit = undefined;
@@ -706,6 +799,24 @@ export class AutoOrchestrator {
                 this.postAdvanceRecord(blocked);
                 return blocked;
             }
+            const priorSliceBlocker = this.findPriorSliceCompletionBlocker(decision.unitType, decision.unitId);
+            if (priorSliceBlocker) {
+                this.clearPendingDispatch();
+                const blocked = {
+                    kind: "blocked",
+                    reason: priorSliceBlocker,
+                    action: "stop",
+                    stateSnapshot: reconciliation.stateSnapshot,
+                };
+                this.journalTransition({
+                    name: "advance-blocked",
+                    reason: blocked.reason,
+                    unitType: decision.unitType,
+                    unitId: decision.unitId,
+                });
+                this.postAdvanceRecord(blocked);
+                return blocked;
+            }
             const nextKey = `${decision.unitType}:${decision.unitId}`;
             // Record every dispatch decision in the ring buffer before pre-flight
             // checks so the stuck-loop detector observes the full decision history
@@ -721,8 +832,10 @@ export class AutoOrchestrator {
                 // actually completed on disk with a stale DB. Verify + recover before
                 // hard-stopping (legacy graduated stuck-recovery parity).
                 if (this.tryStuckArtifactRecovery(decision.unitType, decision.unitId)) {
+                    this.clearPendingDispatch();
                     return this.stuckRecovered(decision, reconciliation.stateSnapshot);
                 }
+                this.clearPendingDispatch();
                 const blocked = {
                     kind: "blocked",
                     reason: `state did not advance after finalized ${decision.unitType} ${decision.unitId}`,
@@ -745,6 +858,7 @@ export class AutoOrchestrator {
             // checks coexist: idempotency for the common immediate-repeat case,
             // stuck-loop for the saturated-window case.
             if (this.lastAdvanceKey === nextKey && matchingCount < STUCK_WINDOW_SIZE) {
+                this.clearPendingDispatch();
                 const blocked = { kind: "blocked", reason: "idempotent advance: unit already active", action: "pause" };
                 this.journalTransition({
                     name: "advance-blocked",
@@ -764,8 +878,10 @@ export class AutoOrchestrator {
                 // complete on disk (stale DB) and recover if so — legacy graduated
                 // stuck-recovery parity. Otherwise hard-stop with a diagnosable reason.
                 if (this.tryStuckArtifactRecovery(decision.unitType, decision.unitId)) {
+                    this.clearPendingDispatch();
                     return this.stuckRecovered(decision, reconciliation.stateSnapshot);
                 }
+                this.clearPendingDispatch();
                 const blocked = {
                     kind: "blocked",
                     reason: `stuck-loop: ${nextKey} picked ${matchingCount} times`,
@@ -782,6 +898,7 @@ export class AutoOrchestrator {
             }
             const contract = this.compileUnitToolContract(decision.unitType);
             if (!contract.ok) {
+                this.clearPendingDispatch();
                 const blocked = {
                     kind: "blocked",
                     reason: contract.reason,
@@ -799,6 +916,7 @@ export class AutoOrchestrator {
             }
             const worktree = await this.prepareWorktreeForUnit(decision.unitType, decision.unitId);
             if (!worktree.ok) {
+                this.clearPendingDispatch();
                 const blocked = {
                     kind: "blocked",
                     reason: worktree.reason,
@@ -885,8 +1003,12 @@ export class AutoOrchestrator {
     async resume() {
         this.lastAdvanceKey = null;
         this.lastFinalizedUnitKey = null;
-        this.dispatchKeyWindow = [];
+        // Preserve dispatchKeyWindow across resume so stuck-loop detection
+        // accumulates across pause/resume cycles rather than resetting each time.
         this.lastStuckRecoveryKey = null;
+        // ADR-030: drop the prior "from" — the first advance after resume has no
+        // edge to assert (avoids a false illegal-edge across the pause boundary).
+        this.lastDerivedPhase = null;
         this.status.phase = "running";
         this.bumpTransition();
         this.journalTransition({ name: "resume" });
@@ -902,7 +1024,12 @@ export class AutoOrchestrator {
         this.status.activeUnit = undefined;
         this.lastAdvanceKey = null;
         this.lastFinalizedUnitKey = null;
-        this.dispatchKeyWindow = [];
+        this.lastDerivedPhase = null;
+        // Preserve dispatchKeyWindow on pause so stuck-loop detection accumulates
+        // across pause/resume cycles. Only clear on a hard stop.
+        if (reason !== "pause") {
+            this.dispatchKeyWindow = [];
+        }
         this.lastStuckRecoveryKey = null;
         this.bumpTransition();
         this.journalTransition({ name: "stop", reason });

package/dist/resources/extensions/gsd/auto/phases.js

@@ -11,6 +11,7 @@
 import { importExtensionModule } from "@gsd/pi-coding-agent";
 import { USER_DRIVEN_DEEP_UNITS, isAwaitingUserInput, } from "../auto-post-unit.js";
 import { lastAssistantText } from "../user-input-boundary.js";
+import { resolveEffectiveUnitIsolationMode } from "../preferences.js";
 import { MAX_RECOVERY_CHARS, BUDGET_THRESHOLDS, MAX_FINALIZE_TIMEOUTS, } from "./types.js";
 import { detectStuck } from "./detect-stuck.js";
 import { runUnit } from "./run-unit.js";
@@ -33,7 +34,8 @@ import { writeUnitRuntimeRecord } from "../unit-runtime.js";
 import { withTimeout, FINALIZE_PRE_TIMEOUT_MS, FINALIZE_POST_TIMEOUT_MS } from "./finalize-timeout.js";
 import { getEligibleSlices } from "../slice-parallel-eligibility.js";
 import { isSliceParallelActive, startSliceParallel } from "../slice-parallel-orchestrator.js";
-import { isDbAvailable, getMilestoneSlices, getSlice, getTask, refreshOpenDatabaseFromDisk } from "../gsd-db.js";
+import { isDbAvailable, getMilestoneSlices, getSlice, getTask } from "../gsd-db.js";
+import { refreshWorkflowDatabaseFromDisk } from "../db-workspace.js";
 import { isClosedStatus } from "../status-guards.js";
 import { setRuntimeKv } from "../db/runtime-kv.js";
 import { getLatestForUnit } from "../db/unit-dispatches.js";
@@ -49,7 +51,7 @@ import { resolveSafetyHarnessConfig } from "../safety/safety-harness.js";
 import { getContextPauseAction } from "../auto-budget.js";
 import { getWorkflowTransportSupportError, getRequiredWorkflowToolsForAutoUnit, supportsStructuredQuestions, } from "../workflow-mcp.js";
 import { prepareWorkflowMcpForProject } from "../workflow-mcp-auto-prep.js";
-import { getToolBaselineSnapshot, applyThinkingLevelForModel, floorThinkingLevelForUnit } from "../auto-model-selection.js";
+import { applyThinkingLevelForModel, floorThinkingLevelForUnit, getRegisteredToolSnapshot, getToolBaselineSnapshot, } from "../auto-model-selection.js";
 import { resolveManifest } from "../unit-context-manifest.js";
 import { createWorktreeSafetyModule } from "../worktree-safety.js";
 import { isSuspiciousGhostCompletion } from "../auto-unit-closeout.js";
@@ -156,7 +158,7 @@ function rememberRetryDispatch(s, unit, iterData) {
 function getAlreadyClosedDispatchReason(unitType, unitId) {
     if (!isDbAvailable())
         return null;
-    refreshOpenDatabaseFromDisk();
+    refreshWorkflowDatabaseFromDisk();
     const { milestone, slice, task } = parseUnitId(unitId);
     if (unitType === "execute-task" && milestone && slice && task) {
         const row = getTask(milestone, slice, task);
@@ -264,7 +266,11 @@ async function validateSourceWriteWorktreeSafety(ic, unitType, unitId, milestone
     if (!writesSource)
         return null;
     const projectRoot = s.canonicalProjectRoot ?? resolveWorktreeProjectRoot(s.basePath, s.originalBasePath);
-    const isolationMode = deps.getIsolationMode(projectRoot);
+    // A degraded session already fell back to the milestone branch in the
+    // project root — validating against the canonical worktree root there
+    // would fail every dispatch with a false invalid-root. The same applies
+    // to a stranded-recovery session that adopted the milestone branch.
+    const isolationMode = resolveEffectiveUnitIsolationMode(deps.getIsolationMode(projectRoot), s.isolationDegraded, s.strandedRecoveryIsolationMode);
     if (isolationMode !== "worktree")
         return null;
     const safety = createWorktreeSafetyModule();
@@ -447,6 +453,14 @@ export async function _runMilestoneMergeWithStashRestore(ic, milestoneId, option
     const exitResult = deps.lifecycle.exitMilestone(milestoneId, { merge: true }, ctx.ui);
     if (exitResult.ok) {
         s.milestoneMergedInPhases = true;
+        try {
+            const projectRoot = s.originalBasePath || s.canonicalProjectRoot || s.basePath;
+            const { rebuildMarkdownProjectionsFromDb } = await import("../commands-maintenance.js");
+            await rebuildMarkdownProjectionsFromDb(projectRoot);
+        }
+        catch (err) {
+            logWarning("engine", `markdown projection rebuild after milestone merge failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
     }
     else {
         mergeError = exitResult.cause ?? new Error(`exit ${exitResult.reason}`);
@@ -929,6 +943,19 @@ export async function runPreDispatch(ic, loopState) {
         catch (e) {
             logWarning("engine", "STATE.md rebuild failed after milestone transition", { error: String(e) });
         }
+        // Re-project ROADMAP/PLAN markdown from the authoritative DB. Worktree DB
+        // reconciliation during merge can leave main-branch markdown stale relative
+        // to gsd.db (the 3M/3S/10T vs 3M/5S/16T drift class at /gsd startup).
+        try {
+            const { rebuildMarkdownProjectionsFromDb } = await import("../commands-maintenance.js");
+            await rebuildMarkdownProjectionsFromDb(s.canonicalProjectRoot);
+            if (s.basePath !== s.canonicalProjectRoot) {
+                await rebuildMarkdownProjectionsFromDb(s.basePath);
+            }
+        }
+        catch (e) {
+            logWarning("engine", "markdown projection rebuild failed after milestone transition", { error: String(e) });
+        }
     }
     if (mid) {
         s.currentMilestoneId = mid;
@@ -1082,6 +1109,7 @@ export async function runDispatch(ic, preData, loopState) {
     // Checking a stale-narrowed set causes false transport-preflight warnings
     // that repeat on every /gsd auto resume (#477 follow-up).
     const activeTools = getToolBaselineSnapshot(pi);
+    const registeredTools = getRegisteredToolSnapshot(pi);
     // Deep planning intentionally keeps human checkpoints in plain chat. In
     // Claude Code/local MCP transports, structured question requests can be
     // cancelled outside the normal chat flow, which made approval gates easy to
@@ -1105,6 +1133,7 @@ export async function runDispatch(ic, preData, loopState) {
         sessionProvider: ctx.model?.provider,
         modelRegistry: ctx.modelRegistry,
         activeTools,
+        registeredTools,
         sessionBaseUrl: ctx.model?.baseUrl,
         sessionAuthMode: authMode,
     });
@@ -1131,6 +1160,7 @@ export async function runDispatch(ic, preData, loopState) {
             sessionProvider: ctx.model?.provider,
             modelRegistry: ctx.modelRegistry,
             activeTools,
+            registeredTools,
             sessionBaseUrl: ctx.model?.baseUrl,
             sessionAuthMode: authMode,
         });

package/dist/resources/extensions/gsd/auto/run-unit.js

@@ -95,7 +95,8 @@ export async function runUnit(ctx, pi, s, unitType, unitId, prompt) {
             unitId,
             error: msg,
         });
-        return { status: "cancelled", errorContext: { message: `Session creation failed: ${msg}`, category: "session-failed", isTransient: true } };
+        const isStructural = sessionErr instanceof TypeError || /is not a function/i.test(msg);
+        return { status: "cancelled", errorContext: { message: `Session creation failed: ${msg}`, category: "session-failed", isTransient: !isStructural } };
     }
     if (sessionTimeoutHandle)
         clearTimeout(sessionTimeoutHandle);

package/dist/resources/extensions/gsd/auto/session.js

@@ -143,6 +143,8 @@ export class AutoSession {
     /** Set to true after phases.ts successfully calls mergeAndExit, so that
      *  stopAuto does not attempt the same merge a second time (#2645). */
     milestoneMergedInPhases = false;
+    /** Last milestone settlement result observed by Auto Orchestration. */
+    milestoneSettlement = null;
     // #4765 — slice-cadence collapse: main-branch SHAs at the moment each
     // milestone's first slice merge began. Used by resquashMilestoneOnMain at
     // milestone completion to collapse N slice commits into one. Cleared when
@@ -311,6 +313,7 @@ export class AutoSession {
         this.strandedRecoveryIsolationMode = null;
         this.rootWriteBaseline = null;
         this.milestoneMergedInPhases = false;
+        this.milestoneSettlement = null;
         this.milestoneStartShas = new Map();
         this.checkpointSha = null;
         // Signal handler

package/dist/resources/extensions/gsd/auto-dashboard.js

@@ -16,6 +16,7 @@ import { parseUnitId } from "./unit-id.js";
 import { logWarning } from "./workflow-logger.js";
 import { formattedShortcutPair } from "./shortcut-defs.js";
 import { readUnitRuntimeRecord } from "./unit-runtime.js";
+import { describeMilestoneReadinessPhase } from "./milestone-readiness.js";
 const ACTIVE_SPINNER_FRAMES = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
 // ─── UAT Slice Extraction ─────────────────────────────────────────────────────
 /**
@@ -84,6 +85,18 @@ export function unitPhaseLabel(unitType) {
         default: return unitType.toUpperCase();
     }
 }
+export function formatToolSurfaceSnapshot(snapshot) {
+    if (!snapshot)
+        return null;
+    const counts = [
+        `model ${snapshot.modelFacingToolNames.length}`,
+        `registered ${snapshot.registeredToolNames.length}`,
+        `scoped ${snapshot.scopedToolNames.length}`,
+        `presented ${snapshot.presentedToolNames.length}`,
+    ];
+    const label = snapshot.unitType ?? snapshot.phase ?? snapshot.source;
+    return `${label}: ${counts.join(" / ")}`;
+}
 function peekNext(unitType, state) {
     // Show active hook info in progress display
     const activeHookState = getActiveHook();
@@ -118,11 +131,10 @@ export function describeNextUnit(state) {
     const sTitle = state.activeSlice?.title;
     const tid = state.activeTask?.id;
     const tTitle = state.activeTask?.title;
+    const readinessDescription = describeMilestoneReadinessPhase(state.phase);
+    if (readinessDescription)
+        return readinessDescription;
     switch (state.phase) {
-        case "needs-discussion":
-            return { label: "Discuss milestone draft", description: "Milestone has a draft context — needs discussion before planning." };
-        case "pre-planning":
-            return { label: "Research & plan milestone", description: "Scout the landscape and create the roadmap." };
         case "planning":
             return { label: `Plan ${sid}: ${sTitle}`, description: "Research and decompose into tasks." };
         case "executing":

package/dist/resources/extensions/gsd/auto-dispatch.js

@@ -37,7 +37,7 @@ import { probeGitConflictState } from "./git-conflict-state.js";
 import { runTurnGitAction } from "./git-service.js";
 import { parseUnitId } from "./unit-id.js";
 import { resolveExpectedArtifactPath } from "./auto-artifact-paths.js";
-import { checkCloseoutConsistencyGate, formatCloseoutConsistencyBlock, } from "./closeout-consistency-gate.js";
+import { formatCloseoutProofBlock, proveMilestoneCloseout, } from "./milestone-closeout-proof.js";
 function resolveExistingExpectedArtifact(unitType, unitId, basePath) {
     const artifactPath = resolveExpectedArtifactPath(unitType, unitId, basePath);
     return artifactPath && existsSync(artifactPath) ? artifactPath : null;
@@ -518,7 +518,7 @@ export const DISPATCH_RULES = [
     },
     {
         name: "run-uat (post-completion)",
-        match: async ({ state, mid, basePath, prefs, sessionProvider, sessionAuthMode, activeTools, sessionBaseUrl }) => {
+        match: async ({ state, mid, basePath, prefs, sessionProvider, sessionAuthMode, activeTools, registeredTools, sessionBaseUrl, }) => {
             const needsRunUat = await checkNeedsRunUat(basePath, mid, state, prefs);
             if (!needsRunUat)
                 return null;
@@ -533,6 +533,7 @@ export const DISPATCH_RULES = [
             const browserToolError = getUatBrowserToolSupportError({
                 uatType,
                 activeTools,
+                registeredTools,
                 milestoneId: mid,
                 sliceId,
             });
@@ -1425,11 +1426,11 @@ export const DISPATCH_RULES = [
                     };
                 }
                 if (milestone) {
-                    const closeoutGate = checkCloseoutConsistencyGate(mid, { refreshFromDisk: true });
-                    if (!closeoutGate.ok) {
+                    const closeoutProof = proveMilestoneCloseout(mid, { refreshFromDisk: true });
+                    if (!closeoutProof.ok) {
                         return {
                             action: "stop",
-                            reason: formatCloseoutConsistencyBlock(closeoutGate),
+                            reason: formatCloseoutProofBlock(closeoutProof),
                             level: "warning",
                         };
                     }

package/dist/resources/extensions/gsd/auto-model-selection.js

@@ -90,6 +90,14 @@ export function getToolBaselineSnapshot(pi) {
         return live;
     return [...new Set([...baseline, ...live])];
 }
+export function getRegisteredToolSnapshot(pi) {
+    if (typeof pi.getAllTools !== "function")
+        return getToolBaselineSnapshot(pi);
+    const names = pi.getAllTools()
+        .map((tool) => tool.name)
+        .filter((name) => typeof name === "string" && name.length > 0);
+    return [...new Set(names)];
+}
 /**
  * Models eligible for the pre-dispatch policy gate. Prefer registry-available
  * models; when that list is empty (common after worktree resume before registry

package/dist/resources/extensions/gsd/auto-post-unit.js

@@ -28,7 +28,8 @@ import { regenerateIfMissing } from "./workflow-projections.js";
 import { WorktreeStateProjection } from "./worktree-state-projection.js";
 import { createWorkspace, scopeMilestone } from "./workspace.js";
 import { normalizeWorktreePathForCompare } from "./worktree-root.js";
-import { isDbAvailable, getDbPath, refreshOpenDatabaseFromDisk, getTask, getSlice, getMilestone, getMilestoneSlices, updateTaskStatus, _getAdapter, getVerificationEvidence } from "./gsd-db.js";
+import { isDbAvailable, getTask, getSlice, getMilestone, getMilestoneSlices, updateTaskStatus, _getAdapter, getVerificationEvidence } from "./gsd-db.js";
+import { getWorkflowDatabasePath, refreshWorkflowDatabaseFromDisk } from "./db-workspace.js";
 import { renderPlanCheckboxes, renderRoadmapFromDb } from "./markdown-renderer.js";
 import { parseRoadmap as parseLegacyRoadmap } from "./parsers-legacy.js";
 import { consumeSignal } from "./session-status-io.js";
@@ -38,7 +39,7 @@ import { debugLog } from "./debug-logger.js";
 import { runSafely } from "./auto-utils.js";
 import { isMilestoneCloseoutSettled, runMilestoneCloseoutGitHub, } from "./milestone-closeout.js";
 import { getEvidence, clearEvidenceFromDisk, isExecutionToolName } from "./safety/evidence-collector.js";
-import { validateFileChanges } from "./safety/file-change-validator.js";
+import { validateFileChanges, effectiveFileChangeAllowlist } from "./safety/file-change-validator.js";
 import { crossReferenceEvidence } from "./safety/evidence-cross-ref.js";
 import { validateContent } from "./safety/content-validator.js";
 import { resolveSafetyHarnessConfig } from "./safety/safety-harness.js";
@@ -506,9 +507,10 @@ export function _hasExecutionToolCallsInSessionForTest(entries) {
         if (e?.type === "toolCall" && isExecutionToolName(e?.name ?? e?.toolName)) {
             return true;
         }
-        if (e?.type !== "message")
-            continue;
-        const msg = e?.message;
+        // Accept both session-manager entries ({type: "message", message}) and
+        // bare agent-end messages ({role, content}) — the auto loop passes the
+        // latter via opts.agentEndMessages.
+        const msg = e?.type === "message" ? e?.message : e;
         if (!msg || msg.role !== "assistant" || !Array.isArray(msg.content))
             continue;
         for (const block of msg.content) {
@@ -1052,9 +1054,9 @@ export async function postUnitPreVerification(pctx, opts) {
     if (!opts?.skipSettleDelay) {
         await new Promise(r => setTimeout(r, 100));
     }
-    const dbPath = getDbPath();
+    const dbPath = getWorkflowDatabasePath();
     if (isDbAvailable() && dbPath && dbPath !== ":memory:") {
-        const refreshed = refreshOpenDatabaseFromDisk();
+        const refreshed = refreshWorkflowDatabaseFromDisk();
         if (!refreshed) {
             logWarning("db", "post-unit database refresh failed; derived state may be stale");
         }
@@ -1288,6 +1290,7 @@ export async function postUnitPreVerification(pctx, opts) {
             const safetyConfig = resolveSafetyHarnessConfig(prefs?.safety_harness);
             if (safetyConfig.enabled) {
                 const { milestone: sMid, slice: sSid, task: sTid } = parseUnitId(s.currentUnit.id);
+                const fileChangeAllowlist = effectiveFileChangeAllowlist(safetyConfig.file_change_allowlist, prefs?.git?.manage_gitignore);
                 // File change validation (execute-task only, after unit execution)
                 if (safetyConfig.file_change_validation && s.currentUnit.type === "execute-task" && sMid && sSid && sTid) {
                     try {
@@ -1302,7 +1305,7 @@ export async function postUnitPreVerification(pctx, opts) {
                             const plannedFiles = getPlannedKeyFiles(sliceTaskRows.map((taskRow) => ({
                                 files: taskRow.files,
                             })));
-                            const audit = validateFileChanges(s.basePath, expectedOutput, plannedFiles, safetyConfig.file_change_allowlist);
+                            const audit = validateFileChanges(s.basePath, expectedOutput, plannedFiles, fileChangeAllowlist);
                             if (audit && audit.violations.length > 0) {
                                 const warnings = audit.violations.filter(v => v.severity === "warning");
                                 for (const v of warnings) {
@@ -1318,7 +1321,7 @@ export async function postUnitPreVerification(pctx, opts) {
                             if (taskRow) {
                                 const expectedOutput = taskRow.expected_output ?? [];
                                 const plannedFiles = taskRow.files ?? [];
-                                const audit = validateFileChanges(s.basePath, expectedOutput, plannedFiles, safetyConfig.file_change_allowlist);
+                                const audit = validateFileChanges(s.basePath, expectedOutput, plannedFiles, fileChangeAllowlist);
                                 if (audit && audit.violations.length > 0) {
                                     const warnings = audit.violations.filter(v => v.severity === "warning");
                                     for (const v of warnings) {