@opengsd/gsd-pi 1.2.0-dev.955e4da0 → 1.2.0-dev.9ad8ae33

package/src/resources/extensions/gsd/tests/pre-execution-checks.test.ts

@@ -21,6 +21,7 @@ import { join } from "node:path";
 import {
   extractPackageReferences,
   checkFilePathConsistency,
+  checkPlanningArtifactReferences,
   checkTaskOrdering,
   checkInterfaceContracts,
   checkVerificationCommands,
@@ -973,7 +974,12 @@ describe("runPreExecutionChecks", () => {
     }
   });
 
-  test("resolves .gsd metadata inputs from canonical project root in worktree mode (#5492)", async () => {
+  // Supersedes #5492: .gsd metadata inputs used to be accepted in worktree mode
+  // by resolving from the canonical project root. Task inputs are source files
+  // only (CONTEXT.md "Task Input") — planning artifacts are now blocked with a
+  // removal message regardless of where they resolve. The canonical-root
+  // resolution itself remains for merged-but-unsynced source files.
+  test("blocks .gsd metadata inputs even when resolvable from canonical project root in worktree mode", async () => {
     const projectRoot = join(tmpdir(), `pre-exec-project-root-${Date.now()}`);
     const worktreeRoot = join(tmpdir(), `pre-exec-worktree-root-${Date.now()}`);
     mkdirSync(join(projectRoot, ".gsd"), { recursive: true });
@@ -990,6 +996,35 @@ describe("runPreExecutionChecks", () => {
         }),
       ];
 
+      const result = await runPreExecutionChecks(tasks, worktreeRoot, {
+        canonicalProjectRoot: projectRoot,
+      });
+      assert.equal(result.status, "fail");
+      assert.equal(result.checks.length, 1);
+      assert.ok(result.checks[0].message.includes("preloaded as context"));
+    } finally {
+      rmSync(projectRoot, { recursive: true, force: true });
+      rmSync(worktreeRoot, { recursive: true, force: true });
+    }
+  });
+
+  test("resolves source-file inputs from canonical project root in worktree mode (#5492)", async () => {
+    const projectRoot = join(tmpdir(), `pre-exec-project-root-src-${Date.now()}`);
+    const worktreeRoot = join(tmpdir(), `pre-exec-worktree-root-src-${Date.now()}`);
+    mkdirSync(join(projectRoot, "src"), { recursive: true });
+    mkdirSync(worktreeRoot, { recursive: true });
+    writeFileSync(join(projectRoot, "src", "merged.ts"), "// merged upstream");
+
+    try {
+      const tasks = [
+        createTask({
+          id: "T01",
+          files: [],
+          inputs: ["src/merged.ts"],
+          expected_output: [],
+        }),
+      ];
+
       const result = await runPreExecutionChecks(tasks, worktreeRoot, {
         canonicalProjectRoot: projectRoot,
       });
@@ -2263,3 +2298,160 @@ describe("checkFilePathConsistency quote-wrapped annotation (#3747)", () => {
     );
   });
 });
+
+// ─── Planning Artifact Reference Tests ───────────────────────────────────────
+
+describe("checkPlanningArtifactReferences", () => {
+  function withTempDir(run: (tempDir: string) => void): void {
+    const tempDir = join(tmpdir(), `pre-exec-artifact-test-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+    mkdirSync(tempDir, { recursive: true });
+    try {
+      run(tempDir);
+    } finally {
+      rmSync(tempDir, { recursive: true, force: true });
+    }
+  }
+
+  test("blocks .gsd/ paths in inputs even when the file exists", () => {
+    withTempDir((tempDir) => {
+      const artifactDir = join(tempDir, ".gsd", "milestones", "M001");
+      mkdirSync(artifactDir, { recursive: true });
+      writeFileSync(join(artifactDir, "M001-CONTEXT.md"), "# context");
+
+      const tasks = [
+        createTask({ id: "T01", inputs: [".gsd/milestones/M001/M001-CONTEXT.md"] }),
+      ];
+
+      const results = checkPlanningArtifactReferences(tasks, tempDir);
+      assert.equal(results.length, 1);
+      assert.equal(results[0].blocking, true);
+      assert.ok(results[0].message.includes("preloaded as context"));
+    });
+  });
+
+  test("blocks bare artifact names that do not resolve to a real file, with the truthful message", () => {
+    withTempDir((tempDir) => {
+      const tasks = [createTask({ id: "T01", inputs: ["M001-CONTEXT.md"] })];
+
+      const results = checkPlanningArtifactReferences(tasks, tempDir);
+      assert.equal(results.length, 1);
+      assert.ok(results[0].message.includes("preloaded as context"));
+      assert.ok(!results[0].message.includes("doesn't exist"));
+
+      // The consistency check must not double-report the same entry with the
+      // misleading "doesn't exist" message.
+      const consistency = checkFilePathConsistency(tasks, tempDir);
+      assert.deepEqual(consistency, []);
+    });
+  });
+
+  test("allows a bare artifact-style name that exists as a real source file", () => {
+    withTempDir((tempDir) => {
+      writeFileSync(join(tempDir, "M001-CONTEXT.md"), "# tracked source file");
+
+      const tasks = [createTask({ id: "T01", inputs: ["M001-CONTEXT.md"] })];
+      assert.deepEqual(checkPlanningArtifactReferences(tasks, tempDir), []);
+    });
+  });
+
+  test("leaves artifact-style names with directory components to the existence checks", () => {
+    withTempDir((tempDir) => {
+      const tasks = [createTask({ id: "T01", inputs: ["tests/fixtures/M001-CONTEXT.md"] })];
+
+      assert.deepEqual(checkPlanningArtifactReferences(tasks, tempDir), []);
+      const consistency = checkFilePathConsistency(tasks, tempDir);
+      assert.equal(consistency.length, 1);
+      assert.ok(consistency[0].message.includes("doesn't exist"));
+    });
+  });
+
+  test("blocks .planning/ and .audits/ paths in files", () => {
+    withTempDir((tempDir) => {
+      const tasks = [
+        createTask({ id: "T01", files: [".planning/codebase/STACK.md", ".audits/security.md"] }),
+      ];
+
+      const results = checkPlanningArtifactReferences(tasks, tempDir);
+      assert.equal(results.length, 2);
+      assert.ok(results.every((r) => r.blocking && r.message.includes("never task files")));
+    });
+  });
+
+  test("blocks .gsd/ paths in expectedOutput with the workflow-tools message and no ordering duplicate", () => {
+    withTempDir((tempDir) => {
+      const tasks = [
+        createTask({
+          id: "T01",
+          sequence: 0,
+          expected_output: [".gsd/milestones/M001/M001-SUMMARY.md"],
+        }),
+        createTask({
+          id: "T02",
+          sequence: 1,
+          inputs: [".gsd/milestones/M001/M001-SUMMARY.md"],
+        }),
+      ];
+
+      const results = checkPlanningArtifactReferences(tasks, tempDir);
+      assert.equal(results.length, 2);
+      const outputFinding = results.find((r) => r.message.includes("expectedOutput"));
+      assert.ok(outputFinding);
+      assert.ok(outputFinding.message.includes("written by workflow tools"));
+
+      assert.deepEqual(checkTaskOrdering(tasks, tempDir), []);
+    });
+  });
+
+  test("skips prose, sentinels, and runtime-only entries", () => {
+    withTempDir((tempDir) => {
+      const tasks = [
+        createTask({
+          id: "T01",
+          inputs: ["none", "Current enum shape", "server logs (runtime)"],
+        }),
+      ];
+
+      assert.deepEqual(checkPlanningArtifactReferences(tasks, tempDir), []);
+    });
+  });
+
+  test("runPreExecutionChecks surfaces artifact findings as blocking failures", async () => {
+    const tempDir = join(tmpdir(), `pre-exec-artifact-run-${Date.now()}`);
+    mkdirSync(tempDir, { recursive: true });
+    try {
+      const tasks = [createTask({ id: "T01", inputs: ["M001-CONTEXT.md"] })];
+      const result: PreExecutionResult = await runPreExecutionChecks(tasks, tempDir);
+      assert.equal(result.status, "fail");
+      assert.ok(
+        result.checks.some((c) => !c.passed && c.blocking && c.message.includes("preloaded as context")),
+      );
+    } finally {
+      rmSync(tempDir, { recursive: true, force: true });
+    }
+  });
+
+  test("allows a bare artifact-style name that exists only at canonicalProjectRoot (not at worktree basePath)", () => {
+    withTempDir((canonicalRoot) => {
+      withTempDir((worktreeRoot) => {
+        writeFileSync(join(canonicalRoot, "M001-CONTEXT.md"), "# tracked source file");
+        const tasks = [createTask({ id: "T01", inputs: ["M001-CONTEXT.md"] })];
+        assert.deepEqual(
+          checkPlanningArtifactReferences(tasks, worktreeRoot, { canonicalProjectRoot: canonicalRoot }),
+          [],
+        );
+      });
+    });
+  });
+
+  test("blocks .GSD/ paths with mixed casing (case-insensitive metadata dir match)", () => {
+    withTempDir((tempDir) => {
+      const tasks = [
+        createTask({ id: "T01", inputs: [".GSD/milestones/M001/M001-CONTEXT.md"] }),
+      ];
+      const results = checkPlanningArtifactReferences(tasks, tempDir);
+      assert.equal(results.length, 1);
+      assert.equal(results[0].blocking, true);
+      assert.ok(results[0].message.includes("preloaded as context"));
+    });
+  });
+});

package/src/resources/extensions/gsd/tests/prompt-db.test.ts

@@ -7,6 +7,9 @@
 
 import { describe, test } from 'node:test';
 import assert from 'node:assert/strict';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
 import {
   openDatabase,
   closeDatabase,
@@ -22,6 +25,17 @@ import {
   formatDecisionsForPrompt,
   formatRequirementsForPrompt,
 } from '../context-store.ts';
+import { inlineRequirementsFromDb } from '../auto-prompts.ts';
+import { migrateFromMarkdown } from '../md-importer.ts';
+
+function createDbProjectWithRequirements(content: string): { tmpDir: string; gsdDir: string } {
+  const tmpDir = mkdtempSync(join(tmpdir(), 'prompt-db-requirements-'));
+  const gsdDir = join(tmpDir, '.gsd');
+  mkdirSync(gsdDir, { recursive: true });
+  writeFileSync(join(gsdDir, 'REQUIREMENTS.md'), content);
+  openDatabase(join(gsdDir, 'gsd.db'));
+  return { tmpDir, gsdDir };
+}
 
 // ═══════════════════════════════════════════════════════════════════════════
 // prompt-db: DB-aware decisions helper returns scoped content
@@ -182,6 +196,116 @@ console.log('\n=== prompt-db: fallback when DB unavailable ===');
   assert.deepStrictEqual(formattedReqs, '', 'formatRequirementsForPrompt returns empty for empty input');
 }
 
+// ═══════════════════════════════════════════════════════════════════════════
+// prompt-db: DB-aware requirements helper does not fall back on empty DB rows
+// ═══════════════════════════════════════════════════════════════════════════
+
+test('prompt-db: inlineRequirementsFromDb returns null instead of full file when DB query is empty', async () => {
+  const { tmpDir } = createDbProjectWithRequirements(
+    `# Requirements\n\nFULL FILE SHOULD NOT BE INLINED\n\n${'large requirement body\n'.repeat(500)}`,
+  );
+  try {
+    const inlined = await inlineRequirementsFromDb(tmpDir, 'M999', undefined, 'full');
+
+    assert.equal(inlined, null);
+  } finally {
+    closeDatabase();
+    rmSync(tmpDir, { recursive: true, force: true });
+  }
+});
+
+test('prompt-db: inlineRequirementsFromDb cascades from empty milestone query to active requirements', async () => {
+  const { tmpDir } = createDbProjectWithRequirements(
+    '# Requirements\n\nFULL FILE SHOULD NOT BE INLINED\n',
+  );
+  try {
+    insertRequirement({
+      id: 'R001',
+      class: 'functional',
+      status: 'active',
+      description: 'active requirement for another milestone',
+      why: 'needed',
+      source: 'M001',
+      primary_owner: 'M001/S01',
+      supporting_slices: '',
+      validation: 'test',
+      notes: '',
+      full_content: '',
+      superseded_by: null,
+    });
+    insertRequirement({
+      id: 'R002',
+      class: 'functional',
+      status: 'validated',
+      description: 'validated requirement should not be active fallback',
+      why: 'already done',
+      source: 'M001',
+      primary_owner: 'M001/S02',
+      supporting_slices: '',
+      validation: 'done',
+      notes: '',
+      full_content: '',
+      superseded_by: null,
+    });
+
+    const inlined = await inlineRequirementsFromDb(tmpDir, 'M999', undefined, 'full');
+
+    assert.ok(inlined);
+    assert.match(inlined, /### Requirements/);
+    assert.match(inlined, /# Requirements \(compact\)/);
+    assert.match(inlined, /R001/);
+    assert.match(inlined, /active requirement for another milestone/);
+    assert.doesNotMatch(inlined, /R002/);
+    assert.doesNotMatch(inlined, /FULL FILE SHOULD NOT BE INLINED/);
+  } finally {
+    closeDatabase();
+    rmSync(tmpDir, { recursive: true, force: true });
+  }
+});
+
+test('prompt-db: inlineRequirementsFromDb keeps active fallback compact for slice-scoped full calls', async () => {
+  const { tmpDir } = createDbProjectWithRequirements(
+    '# Requirements\n\nFULL FILE SHOULD NOT BE INLINED\n',
+  );
+  try {
+    insertRequirement({
+      id: 'R001',
+      class: 'functional',
+      status: 'active',
+      description: 'active requirement for another milestone',
+      why: 'needed',
+      source: 'M001',
+      primary_owner: 'M001/S01',
+      supporting_slices: '',
+      validation: 'test',
+      notes: '',
+      full_content: '',
+      superseded_by: null,
+    });
+
+    // Slice-scoped call at inlineLevel "full" with no matching rows for the
+    // milestone+slice or milestone-only queries. The cascade should land on
+    // status: "active" rows from another milestone, and those project-wide
+    // active rows must be formatted compactly even though sliceId is set —
+    // otherwise the full per-requirement markdown would be inlined for every
+    // active row across the project.
+    const inlined = await inlineRequirementsFromDb(tmpDir, 'M999', 'S99', 'full');
+
+    assert.ok(inlined);
+    assert.match(inlined, /### Requirements/);
+    assert.match(inlined, /# Requirements \(compact\)/);
+    assert.match(inlined, /R001/);
+    // Full per-requirement markdown is forbidden here — its hallmark fields
+    // (Class:/Status:/Why: as bolded list items) are emitted only by
+    // formatRequirementsForPrompt, never by formatRequirementsCompact.
+    assert.doesNotMatch(inlined, /\*\*Class:\*\*/);
+    assert.doesNotMatch(inlined, /FULL FILE SHOULD NOT BE INLINED/);
+  } finally {
+    closeDatabase();
+    rmSync(tmpDir, { recursive: true, force: true });
+  }
+});
+
 // ═══════════════════════════════════════════════════════════════════════════
 // prompt-db: scoped filtering reduces content vs unscoped
 // ═══════════════════════════════════════════════════════════════════════════
@@ -316,12 +440,6 @@ console.log('\n=== prompt-db: DB helpers wrapper format matches expected pattern
 // prompt-db: re-import updates DB when source markdown changes
 // ═══════════════════════════════════════════════════════════════════════════
 
-import { mkdtempSync, writeFileSync, mkdirSync } from 'node:fs';
-import { join } from 'node:path';
-import { tmpdir } from 'node:os';
-import { migrateFromMarkdown } from '../md-importer.ts';
-
-
 describe('prompt-db', () => {
 test('prompt-db: re-import updates DB when source markdown changes', () => {
   // Create a temp dir simulating a project with .gsd/DECISIONS.md

package/src/resources/extensions/gsd/tests/provider-error-guidance.test.ts

@@ -3,10 +3,10 @@ import assert from "node:assert/strict";
 
 import { classifyError, isTransient } from "../error-classifier.ts";
 import {
-  formatProviderErrorGuidance,
   resolveProviderErrorGuidance,
   unitTypeToPrefsPhaseKey,
 } from "../provider-error-guidance.ts";
+import { formatGuidance } from "../guidance.ts";
 
 test("classifyError: Cloud Code Assist 400 invalid argument is model-error", () => {
   const result = classifyError(
@@ -75,8 +75,8 @@ test("resolveProviderErrorGuidance suggests gemini-3-flash for antigravity pro-h
   assert.ok(guidance.steps.some((step) => step.includes("fallbacks")));
 });
 
-test("formatProviderErrorGuidance numbers steps", () => {
-  const text = formatProviderErrorGuidance({
+test("formatGuidance numbers steps", () => {
+  const text = formatGuidance({
     summary: "Provider error on test/model.",
     steps: ["Change model", "Run /gsd next"],
   });

package/src/resources/extensions/gsd/tests/publication.test.ts

@@ -0,0 +1,120 @@
+// gsd-pi — ADR-034 Publication module tests.
+//
+// Exercises publishMilestone against real local git fixtures (a bare repo as
+// the remote) — no network, no gh. The PR path is only tested up to its
+// non-fatal failure contract, since createDraftPullRequestFromEvidence shells
+// out to gh.
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { rmSync } from "node:fs";
+import { join } from "node:path";
+
+import { gitRemoteExists, publishMilestone } from "../publication.ts";
+import { git, makeTempDir, makeTempRepo } from "./test-utils.ts";
+
+function makeRepoWithBareRemote(): { repo: string; bare: string; cleanup: () => void } {
+  const repo = makeTempRepo("gsd-publication-test-");
+  const bare = join(makeTempDir("gsd-publication-remote-"), "remote.git");
+  git(repo, "init", "--bare", bare);
+  git(repo, "remote", "add", "origin", bare);
+  return {
+    repo,
+    bare,
+    cleanup: () => {
+      rmSync(repo, { recursive: true, force: true });
+      rmSync(bare, { recursive: true, force: true });
+    },
+  };
+}
+
+const NO_PUBLISH_PREFS = { autoPush: false, autoPr: false };
+
+function makeRequest(repo: string, prefs: { autoPush: boolean; autoPr: boolean; remote?: string; prTargetBranch?: string }) {
+  return {
+    basePath: repo,
+    milestoneId: "M001",
+    milestoneTitle: "Test milestone",
+    integrationBranch: "main",
+    milestoneBranch: "milestone/M001",
+    sliceSummaries: ["### S01\nSlice one"],
+    nothingToCommit: false,
+    prefs,
+  };
+}
+
+test("gitRemoteExists distinguishes configured from missing remotes", () => {
+  const { repo, cleanup } = makeRepoWithBareRemote();
+  try {
+    assert.equal(gitRemoteExists(repo, "origin"), true);
+    assert.equal(gitRemoteExists(repo, "upstream"), false);
+  } finally {
+    cleanup();
+  }
+});
+
+test("auto-push pushes the integration branch to the remote", () => {
+  const { repo, bare, cleanup } = makeRepoWithBareRemote();
+  try {
+    const result = publishMilestone(makeRequest(repo, { autoPush: true, autoPr: false }));
+    assert.equal(result.pushed, true);
+    assert.equal(result.prCreated, false);
+    const remoteHeads = git(repo, "ls-remote", "--heads", bare);
+    assert.match(remoteHeads, /refs\/heads\/main/);
+  } finally {
+    cleanup();
+  }
+});
+
+test("auto-push is suppressed when auto-PR owns the remote interaction", () => {
+  const { repo, bare, cleanup } = makeRepoWithBareRemote();
+  try {
+    git(repo, "branch", "milestone/M001");
+    const result = publishMilestone(makeRequest(repo, { autoPush: true, autoPr: true }));
+    // PR creation pushes the milestone branch, then fails non-fatally at gh.
+    assert.equal(result.pushed, false);
+    assert.equal(result.prCreated, false);
+    assert.equal(result.prUrl, undefined);
+    const remoteHeads = git(repo, "ls-remote", "--heads", bare);
+    assert.match(remoteHeads, /refs\/heads\/milestone\/M001/);
+    assert.doesNotMatch(remoteHeads, /refs\/heads\/main/);
+  } finally {
+    cleanup();
+  }
+});
+
+test("nothing-to-commit short-circuits all publication", () => {
+  const { repo, bare, cleanup } = makeRepoWithBareRemote();
+  try {
+    const result = publishMilestone({
+      ...makeRequest(repo, { autoPush: true, autoPr: false }),
+      nothingToCommit: true,
+    });
+    assert.deepEqual(result, { pushed: false, prCreated: false });
+    const remoteHeads = git(repo, "ls-remote", "--heads", bare);
+    assert.equal(remoteHeads.trim(), "");
+  } finally {
+    cleanup();
+  }
+});
+
+test("missing remote makes publication a silent no-op", () => {
+  const { repo, cleanup } = makeRepoWithBareRemote();
+  try {
+    git(repo, "remote", "remove", "origin");
+    const result = publishMilestone(makeRequest(repo, { autoPush: true, autoPr: true }));
+    assert.deepEqual(result, { pushed: false, prCreated: false });
+  } finally {
+    cleanup();
+  }
+});
+
+test("publication disabled returns the empty result without touching git", () => {
+  const { repo, cleanup } = makeRepoWithBareRemote();
+  try {
+    const result = publishMilestone(makeRequest(repo, NO_PUBLISH_PREFS));
+    assert.deepEqual(result, { pushed: false, prCreated: false });
+  } finally {
+    cleanup();
+  }
+});

package/src/resources/extensions/gsd/tests/register-hooks-depth-verification.test.ts

@@ -14,6 +14,8 @@ import { deriveState, invalidateStateCache } from "../state.ts";
 import {
   getPendingGate,
   loadWriteGateSnapshot,
+  markApprovalGateVerified,
+  markDepthVerified,
   resetWriteGateState,
   setPendingGate,
   shouldBlockContextArtifactSave,
@@ -892,3 +894,158 @@ test("register-hooks agent_end does not re-arm deferred gate after workflow MCP
     pendingGateId: null,
   });
 });
+
+// ── External-engine post-hoc gate replay (write-gate two-process sync) ──────
+// On claude-code-cli, pi ingests the SDK turn's tool blocks after the workflow
+// MCP child already executed them. The depth gate can therefore arrive at
+// tool_execution_start AFTER the child verified it and allowed the CONTEXT
+// save; re-arming then wipes the verification and permanently blocks the
+// discuss→auto handoff.
+
+function makeHookHarness(): {
+  handlers: Map<string, Array<(event: any, ctx?: any) => Promise<any> | any>>;
+  pi: any;
+} {
+  const handlers = new Map<string, Array<(event: any, ctx?: any) => Promise<any> | any>>();
+  const pi = {
+    on(event: string, handler: (event: any, ctx?: any) => Promise<any> | any) {
+      const existing = handlers.get(event) ?? [];
+      existing.push(handler);
+      handlers.set(event, existing);
+    },
+  } as any;
+  return { handlers, pi };
+}
+
+test("tool_execution_start does not re-arm a depth gate the MCP child already verified", async (t) => {
+  const dir = makeTempDir("posthoc-no-rearm");
+  resetWriteGateState(dir);
+  t.after(() => {
+    resetWriteGateState(dir);
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  const { handlers, pi } = makeHookHarness();
+  registerHooks(pi, []);
+  const ctx = { cwd: dir, ui: { notify: () => undefined } } as any;
+
+  // The child verified the gate and allowed the CONTEXT save before the host
+  // ever saw the tool block.
+  markApprovalGateVerified("depth_verification_M002_confirm", dir);
+  markDepthVerified("M002", dir);
+
+  for (const handler of handlers.get("tool_execution_start") ?? []) {
+    await handler({
+      toolCallId: "t-depth",
+      toolName: "mcp__gsd-workflow__ask_user_questions",
+      args: { questions: [{ id: "depth_verification_M002_confirm" }] },
+    }, ctx);
+  }
+
+  assert.equal(getPendingGate(dir), null, "post-hoc replay must not re-arm a verified gate");
+  const snapshot = loadWriteGateSnapshot(dir);
+  assert.ok(
+    snapshot.verifiedDepthMilestones.includes("M002"),
+    "re-arm wipes verifiedDepthMilestones — the verification must survive the replay",
+  );
+  assert.equal(
+    shouldBlockContextArtifactSave("CONTEXT", "M002", null, dir).block,
+    false,
+    "context saves must stay unlocked after the replayed tool_execution_start",
+  );
+});
+
+test("tool_execution_start still arms an unverified depth gate", async (t) => {
+  const dir = makeTempDir("live-arm");
+  resetWriteGateState(dir);
+  t.after(() => {
+    resetWriteGateState(dir);
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  const { handlers, pi } = makeHookHarness();
+  registerHooks(pi, []);
+  const ctx = { cwd: dir, ui: { notify: () => undefined } } as any;
+
+  for (const handler of handlers.get("tool_execution_start") ?? []) {
+    await handler({
+      toolCallId: "t-depth",
+      toolName: "ask_user_questions",
+      args: { questions: [{ id: "depth_verification_M002_confirm" }] },
+    }, ctx);
+  }
+
+  assert.equal(getPendingGate(dir), "depth_verification_M002_confirm");
+});
+
+test("tool_result verifies the gate from result.structuredContent when event.details is missing", async (t) => {
+  const dir = makeTempDir("structured-fallback");
+  resetWriteGateState(dir);
+  t.after(() => {
+    resetWriteGateState(dir);
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  const { handlers, pi } = makeHookHarness();
+  registerHooks(pi, []);
+  const ctx = { cwd: dir, ui: { notify: () => undefined } } as any;
+
+  setPendingGate("depth_verification_M002_confirm", dir);
+
+  const questions = [{
+    id: "depth_verification_M002_confirm",
+    options: [
+      { label: "Yes, you got it (Recommended)" },
+      { label: "Not quite — let me clarify" },
+    ],
+  }];
+  for (const handler of handlers.get("tool_result") ?? []) {
+    await handler({
+      toolCallId: "t-depth",
+      toolName: "mcp__gsd-workflow__ask_user_questions",
+      input: { questions },
+      // External MCP relay: no pi-native details, structured payload on result.
+      result: {
+        content: [{ type: "text", text: "answered" }],
+        structuredContent: {
+          questions,
+          response: {
+            answers: {
+              depth_verification_M002_confirm: { selected: "Yes, you got it (Recommended)", notes: "" },
+            },
+          },
+          cancelled: false,
+        },
+      },
+    }, ctx);
+  }
+
+  assert.equal(getPendingGate(dir), null, "structured fallback must clear the pending gate");
+  assert.ok(loadWriteGateSnapshot(dir).verifiedDepthMilestones.includes("M002"));
+});
+
+test("tool_result without details or structured content leaves the gate pending without crashing", async (t) => {
+  const dir = makeTempDir("no-details");
+  resetWriteGateState(dir);
+  t.after(() => {
+    resetWriteGateState(dir);
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  const { handlers, pi } = makeHookHarness();
+  registerHooks(pi, []);
+  const ctx = { cwd: dir, ui: { notify: () => undefined } } as any;
+
+  setPendingGate("depth_verification_M002_confirm", dir);
+
+  for (const handler of handlers.get("tool_result") ?? []) {
+    await handler({
+      toolCallId: "t-depth",
+      toolName: "ask_user_questions",
+      input: { questions: [{ id: "depth_verification_M002_confirm" }] },
+      result: { content: [{ type: "text", text: "answered" }] },
+    }, ctx);
+  }
+
+  assert.equal(getPendingGate(dir), "depth_verification_M002_confirm");
+});