@opengsd/gsd-pi 1.2.0-dev.e8563f58 → 1.2.0-dev.fbdca60b

package/src/resources/extensions/gsd/tests/start-auto-detached.test.ts

@@ -339,7 +339,7 @@ test("resume path only hard-exits on blocked stop, not blocked pause (#6154)", (
   );
 });
 
-test("prepareForUnit skips worktree safety when isolation is not worktree (#6154)", () => {
+test("prepareForUnit enforces worktree safety for all isolation modes (#6154)", () => {
   const orchSrc = readGsdFile("auto/orchestrator.ts");
   const prepareForUnitIdx = orchSrc.indexOf("private async prepareWorktreeForUnit(");
   const prepareForUnitBody = orchSrc.slice(prepareForUnitIdx, orchSrc.indexOf("private classifyAndRecover(", prepareForUnitIdx));
@@ -350,8 +350,12 @@ test("prepareForUnit skips worktree safety when isolation is not worktree (#6154
     "prepareForUnit should resolve the effective isolation mode once",
   );
   assert.ok(
-    prepareForUnitBody.includes('if (isolationMode !== "worktree")'),
-    "prepareForUnit should bypass worktree safety validation outside worktree isolation mode",
+    prepareForUnitBody.includes('const writeScope ='),
+    "prepareForUnit should classify the unit's write scope before validating",
+  );
+  assert.ok(
+    !prepareForUnitBody.includes('if (isolationMode !== "worktree")'),
+    "prepareForUnit must not bypass worktree safety outside worktree isolation mode",
   );
 });
 

package/src/resources/extensions/gsd/tests/stop-auto-race-null-unit.test.ts

@@ -3,7 +3,7 @@
 import test from "node:test";
 import assert from "node:assert/strict";
 
-import { _resolveCurrentUnitStartedAtForTest } from "../auto/phases.ts";
+import { _resolveCurrentUnitStartedAtForTest } from "../auto/phase-helpers.ts";
 
 test("unit started-at resolver tolerates stopAuto clearing currentUnit", () => {
   assert.equal(_resolveCurrentUnitStartedAtForTest(null), undefined);

package/src/resources/extensions/gsd/tests/teardown-chdir-failure-clears-registry.test.ts

@@ -159,4 +159,21 @@ describe("teardown chdir failure clears registry", () => {
     assert.strictEqual(getAutoWorktreeOriginalBase(), null, "registry null after successful teardown");
     assert.strictEqual(getActiveAutoWorktreeContext(), null, "context null after successful teardown");
   });
+
+  test("teardown survives when current working directory was deleted", () => {
+    repoDir = createTempRepo();
+    seedMilestone(repoDir, "M003");
+
+    const worktreePath = createAutoWorktree(repoDir, "M003");
+    process.chdir(worktreePath);
+    rmSync(worktreePath, { recursive: true, force: true });
+
+    assert.doesNotThrow(
+      () => teardownAutoWorktree(repoDir, "M003"),
+      "teardownAutoWorktree should not call process.cwd() unguarded from a deleted cwd",
+    );
+
+    assert.strictEqual(getAutoWorktreeOriginalBase(), null, "registry null after deleted-cwd teardown");
+    assert.strictEqual(getActiveAutoWorktreeContext(), null, "context null after deleted-cwd teardown");
+  });
 });

package/src/resources/extensions/gsd/tests/token-tool-gating.test.ts

@@ -365,13 +365,14 @@ test("buildMinimalAutoGsdToolSet includes closeout tool for complete-slice", ()
     "gsd_complete_slice",
     "memory_query",
     "capture_thought",
+    "gsd_capture_thought",
   ], "complete-slice");
 
   assert.ok(result.includes("gsd_slice_complete"));
   assert.ok(result.includes("gsd_task_reopen"));
   assert.ok(result.includes("gsd_replan_slice"));
   assert.ok(result.includes("subagent"));
-  assert.ok(result.includes("capture_thought"));
+  assert.ok(result.includes("gsd_capture_thought"));
   assert.ok(!result.includes("gsd_task_complete"));
   assert.ok(!result.includes("gsd_complete_slice"));
 });
@@ -387,6 +388,7 @@ test("buildMinimalAutoGsdToolSet preserves workflow MCP-namespaced closeout tool
     "mcp__gsd-workflow__gsd_exec",
     "mcp__gsd-workflow__memory_query",
     "mcp__gsd-workflow__capture_thought",
+    "mcp__gsd-workflow__gsd_capture_thought",
   ], "complete-slice");
 
   assert.ok(result.includes("mcp__gsd-workflow__gsd_task_reopen"));
@@ -395,7 +397,7 @@ test("buildMinimalAutoGsdToolSet preserves workflow MCP-namespaced closeout tool
   assert.ok(!result.includes("mcp__gsd-workflow__gsd_complete_slice"));
   assert.ok(result.includes("mcp__gsd-workflow__gsd_exec"));
   assert.ok(result.includes("mcp__gsd-workflow__memory_query"));
-  assert.ok(result.includes("mcp__gsd-workflow__capture_thought"));
+  assert.ok(result.includes("mcp__gsd-workflow__gsd_capture_thought"));
 });
 
 test("buildMinimalAutoGsdToolSet covers execute-task-simple", () => {

package/src/resources/extensions/gsd/tests/tool-surface-readiness.test.ts

@@ -4,7 +4,8 @@
 import { describe, test } from "node:test";
 import assert from "node:assert/strict";
 
-import { getToolSurfaceReadinessError } from "../tool-surface-readiness.ts";
+import { getToolSurfaceReadinessError, awaitWorkflowMcpToolRegistration } from "../tool-surface-readiness.ts";
+import { clearWorkflowMcpProbeCache, recordWorkflowMcpProbe } from "../workflow-mcp-readiness-cache.ts";
 import { isToolUnavailableError } from "../auto-tool-tracking.ts";
 import { classifyError, isTransient } from "../error-classifier.ts";
 import { toMcpToolName } from "../mcp-tool-name.ts";
@@ -58,18 +59,82 @@ describe("getToolSurfaceReadinessError", () => {
     assert.match(error, /gsd_uat_exec/);
   });
 
-  test("passes a still-connecting (pending) server through instead of aborting", () => {
-    // The SDK reports still-connecting servers as "pending" at init — the
-    // common healthy session. A genuine miss after pass-through is caught
-    // in-session ("No such tool available" → tool-unavailable → retry).
+  test("still blocks pending init when required tools are absent from the live surface", () => {
     const error = getToolSurfaceReadinessError({
-      unitType: "plan-slice",
+      unitType: "run-uat",
       workflowServerName: SERVER,
       observation: { tools: ["read", "bash"], mcpServers: [{ name: SERVER, status: "pending" }] },
     });
+    assert.ok(error);
+    assert.match(error!, /status is "pending"/);
+    assert.match(error!, /gsd_uat_exec/);
+  });
+
+  test("accepts pending server status when the live init surface already contains every required tool", () => {
+    const error = getToolSurfaceReadinessError({
+      unitType: "run-uat",
+      workflowServerName: SERVER,
+      observation: {
+        tools: [
+          prefixed("gsd_uat_exec"),
+          prefixed("gsd_uat_result_save"),
+          prefixed("gsd_resume"),
+          prefixed("gsd_milestone_status"),
+          prefixed("gsd_journal_query"),
+        ],
+        mcpServers: [{ name: SERVER, status: "pending" }],
+      },
+    });
     assert.equal(error, null);
   });
 
+  test("does not accept a pending live init surface just because a probe cache covers required tools", () => {
+    clearWorkflowMcpProbeCache();
+    const projectRoot = "/tmp/project-discuss-probe";
+    recordWorkflowMcpProbe(projectRoot, SERVER, [
+      "ask_user_questions",
+      "gsd_summary_save",
+      "gsd_requirement_save",
+      "gsd_requirement_update",
+      "gsd_plan_milestone",
+      "gsd_milestone_generate_id",
+    ]);
+
+    const error = getToolSurfaceReadinessError({
+      unitType: "discuss-milestone",
+      workflowServerName: SERVER,
+      projectRoot,
+      observation: {
+        tools: [],
+        mcpServers: [{ name: SERVER, status: "pending" }],
+      },
+    });
+
+    assert.ok(error, "expected live init tools to be authoritative over direct probe cache");
+    assert.match(error, /status is "pending"/);
+    assert.match(error, /ask_user_questions/);
+  });
+
+  test("pending server status reports only required tools missing from the live init surface", () => {
+    const error = getToolSurfaceReadinessError({
+      unitType: "run-uat",
+      workflowServerName: SERVER,
+      observation: {
+        tools: [
+          prefixed("gsd_uat_result_save"),
+          prefixed("gsd_resume"),
+          prefixed("gsd_milestone_status"),
+          prefixed("gsd_journal_query"),
+        ],
+        mcpServers: [{ name: SERVER, status: "pending" }],
+      },
+    });
+    assert.ok(error, "expected a readiness error while gsd_uat_exec is still absent");
+    assert.match(error, /status is "pending"/);
+    assert.match(error, /gsd_uat_exec/);
+    assert.doesNotMatch(error, /gsd_uat_result_save/);
+  });
+
   test("returns null when all required tools are registered under the MCP prefix", () => {
     const error = getToolSurfaceReadinessError({
       unitType: "run-uat",
@@ -82,7 +147,7 @@ describe("getToolSurfaceReadinessError", () => {
     assert.equal(error, null);
   });
 
-  test("reports the failed server and the missing tools when the surface never registered", () => {
+  test("reports the failed server as terminal", () => {
     const error = getToolSurfaceReadinessError({
       unitType: "run-uat",
       workflowServerName: SERVER,
@@ -90,7 +155,20 @@ describe("getToolSurfaceReadinessError", () => {
     });
     assert.ok(error, "expected a readiness error");
     assert.match(error, /workflow tool surface not ready for run-uat/);
-    assert.match(error, /status is "failed"/);
+    assert.match(error, /terminal/);
+  });
+
+  test("reports terminal status even when required tools are already on the init surface", () => {
+    const error = getToolSurfaceReadinessError({
+      unitType: "run-uat",
+      workflowServerName: SERVER,
+      observation: {
+        tools: RUN_UAT_TOOLS.map(prefixed),
+        mcpServers: [{ name: SERVER, status: "failed" }],
+      },
+    });
+    assert.ok(error, "expected a readiness error despite tools on the surface");
+    assert.match(error, /terminal/);
     assert.match(error, /gsd_uat_exec/);
   });
 
@@ -101,7 +179,7 @@ describe("getToolSurfaceReadinessError", () => {
       observation: { tools: ["read", "bash"], mcpServers: [{ name: SERVER, status: "needs-auth" }] },
     });
     assert.ok(error, "expected a readiness error for needs-auth");
-    assert.match(error, /status is "needs-auth"/);
+    assert.match(error, /terminal/);
   });
 
   test("aborts on disabled (terminal — cannot self-heal)", () => {
@@ -111,7 +189,7 @@ describe("getToolSurfaceReadinessError", () => {
       observation: { tools: ["read", "bash"], mcpServers: [{ name: SERVER, status: "disabled" }] },
     });
     assert.ok(error, "expected a readiness error for disabled");
-    assert.match(error, /status is "disabled"/);
+    assert.match(error, /terminal/);
   });
 
   test("reports partially-registered surfaces even when the server says connected", () => {
@@ -128,6 +206,102 @@ describe("getToolSurfaceReadinessError", () => {
     assert.match(error, /gsd_uat_result_save/);
     assert.doesNotMatch(error, /gsd_uat_exec,/);
   });
+
+  test("reports the screenshot case: result save registered but UAT exec missing", () => {
+    const error = getToolSurfaceReadinessError({
+      unitType: "run-uat",
+      workflowServerName: SERVER,
+      observation: {
+        tools: [
+          prefixed("gsd_uat_result_save"),
+          prefixed("gsd_resume"),
+          prefixed("gsd_milestone_status"),
+          prefixed("gsd_journal_query"),
+        ],
+        mcpServers: [{ name: SERVER, status: "connected" }],
+      },
+    });
+    assert.ok(error, "expected a readiness error when gsd_uat_exec is absent");
+    assert.match(error, /connected but has not registered/);
+    assert.match(error, /gsd_uat_exec/);
+    assert.doesNotMatch(error, /gsd_uat_result_save/);
+  });
+});
+
+describe("awaitWorkflowMcpToolRegistration", () => {
+  test("does not skip live probe when cache already covers required tools", async () => {
+    clearWorkflowMcpProbeCache();
+    const { recordWorkflowMcpProbe } = await import("../workflow-mcp-readiness-cache.ts");
+    recordWorkflowMcpProbe("/tmp/project-cache-hit", SERVER, RUN_UAT_TOOLS);
+
+    let probeCalls = 0;
+    const error = await awaitWorkflowMcpToolRegistration({
+      unitType: "run-uat",
+      workflowServerName: SERVER,
+      projectRoot: "/tmp/project-cache-hit",
+      timeoutMs: 1,
+      pollMs: 1,
+      probe: async () => {
+        probeCalls += 1;
+        return { ok: true, tools: RUN_UAT_TOOLS };
+      },
+    });
+    assert.equal(error, null);
+    assert.ok(probeCalls > 0, "preflight must probe the live MCP server even when cache is warm");
+  });
+
+  test("resolves when probe reports required tools", async () => {
+    clearWorkflowMcpProbeCache();
+    const error = await awaitWorkflowMcpToolRegistration({
+      unitType: "run-uat",
+      workflowServerName: SERVER,
+      projectRoot: "/tmp/project",
+      timeoutMs: 1_000,
+      pollMs: 1,
+      probe: async () => ({
+        ok: true,
+        tools: RUN_UAT_TOOLS,
+      }),
+    });
+    assert.equal(error, null);
+  });
+
+  test("times out when required tools never register", async () => {
+    clearWorkflowMcpProbeCache();
+    const error = await awaitWorkflowMcpToolRegistration({
+      unitType: "run-uat",
+      workflowServerName: SERVER,
+      projectRoot: "/tmp/project",
+      timeoutMs: 5,
+      pollMs: 1,
+      probe: async () => ({ ok: true, tools: ["gsd_uat_result_save"] }),
+    });
+    assert.ok(error);
+    assert.match(error!, /did not register required tools before session start/);
+  });
+
+  test("aborts while waiting for workflow MCP tools", async () => {
+    clearWorkflowMcpProbeCache();
+    const controller = new AbortController();
+    let probeCount = 0;
+    const wait = awaitWorkflowMcpToolRegistration({
+      unitType: "run-uat",
+      workflowServerName: SERVER,
+      projectRoot: "/tmp/project-abort",
+      timeoutMs: 10_000,
+      pollMs: 10_000,
+      signal: controller.signal,
+      probe: async () => {
+        probeCount += 1;
+        return { ok: true, tools: ["gsd_uat_result_save"] };
+      },
+    });
+
+    controller.abort();
+
+    await assert.rejects(wait, /AbortError/);
+    assert.equal(probeCount, 1);
+  });
 });
 
 describe("readiness error classification contract", () => {

package/src/resources/extensions/gsd/tests/tool-unavailable-retry.test.ts

@@ -0,0 +1,33 @@
+/**
+ * Regression test for MCP tool-availability race.
+ *
+ * When the MCP workflow server is still connecting, tool calls fail with
+ * "No such tool available". The bounded retry counter on AutoSession
+ * (toolUnavailableRetries) prevents infinite re-dispatch loops by capping
+ * retries at 3 with escalating delay, then pausing auto-mode.
+ */
+import { describe, test } from "node:test";
+import assert from "node:assert/strict";
+import { AutoSession } from "../auto/session.ts";
+
+describe("toolUnavailableRetries on AutoSession", () => {
+  test("defaults to 0", () => {
+    const s = new AutoSession();
+    assert.equal(s.toolUnavailableRetries, 0);
+  });
+
+  test("is cleared on reset()", () => {
+    const s = new AutoSession();
+    s.toolUnavailableRetries = 2;
+    s.reset();
+    assert.equal(s.toolUnavailableRetries, 0);
+  });
+
+  test("accumulates across assignments (simulates retry increments)", () => {
+    const s = new AutoSession();
+    s.toolUnavailableRetries = 1;
+    s.toolUnavailableRetries = 2;
+    s.toolUnavailableRetries = 3;
+    assert.equal(s.toolUnavailableRetries, 3);
+  });
+});

package/src/resources/extensions/gsd/tests/transport-gate-double-complete.test.ts

@@ -0,0 +1,139 @@
+// gsd-pi — Regression tests for the centralized transport gate and
+// milestone double-complete guard (auto-dispatch.ts + phases.ts).
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdirSync, mkdtempSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+import { resolveDispatch } from "../auto-dispatch.ts";
+import { openDatabase, closeDatabase, insertMilestone, getMilestone } from "../gsd-db.ts";
+import { isClosedStatus } from "../status-guards.ts";
+import { getWorkflowTransportSupportError } from "../workflow-mcp.ts";
+
+// ── transport gate: getWorkflowTransportSupportError blocks missing tools ────
+
+test("getWorkflowTransportSupportError blocks when required non-surface tools are missing", () => {
+  const err = getWorkflowTransportSupportError(
+    "claude-code",
+    ["custom_non_surface_tool"],
+    {
+      projectRoot: process.cwd(),
+      surface: "auto-mode",
+      unitType: "execute-task",
+      authMode: "externalCli",
+      baseUrl: "local://claude-code",
+      activeTools: ["some_other_tool"],
+    },
+  );
+  assert.ok(err, "should return an error when required non-surface tools are missing from activeTools");
+  assert.match(err, /cannot run/i);
+});
+
+test("getWorkflowTransportSupportError passes for non-MCP transport", () => {
+  const err = getWorkflowTransportSupportError(
+    "claude-code",
+    ["custom_non_surface_tool"],
+    {
+      projectRoot: process.cwd(),
+      surface: "auto-mode",
+      unitType: "execute-task",
+      authMode: "apiKey",
+      baseUrl: "https://api.anthropic.com",
+      activeTools: [],
+    },
+  );
+  assert.equal(err, null, "non-MCP transport should not be blocked");
+});
+
+test("resolveDispatch allows dispatch when MCP tools are available", async (t) => {
+  const base = mkdtempSync(join(tmpdir(), "gsd-transport-pass-"));
+  mkdirSync(join(base, ".gsd"), { recursive: true });
+  openDatabase(join(base, ".gsd", "gsd.db"));
+  t.after(() => {
+    closeDatabase();
+    rmSync(base, { recursive: true, force: true });
+  });
+
+  insertMilestone({ id: "M001", title: "Test", status: "active" });
+
+  const action = await resolveDispatch({
+    basePath: base,
+    mid: "M001",
+    midTitle: "Test",
+    state: {
+      phase: "executing",
+      activeMilestone: { id: "M001", title: "Test", status: "active" },
+      activeSlice: { id: "S01", title: "Slice" },
+      activeTask: { id: "M001/S01/T01", title: "Task", status: "pending" },
+      registry: [],
+      blockers: [],
+    } as any,
+    prefs: undefined,
+    // No transport gate deps → no MCP check → dispatch should go through
+  });
+
+  assert.equal(action.action, "dispatch");
+});
+
+// ── double-complete guard: isClosedStatus prevents duplicate closeout ────────
+
+test("isClosedStatus detects complete milestone status", () => {
+  assert.equal(isClosedStatus("complete"), true);
+  assert.equal(isClosedStatus("done"), true);
+  assert.equal(isClosedStatus("skipped"), true);
+  assert.equal(isClosedStatus("closed"), true);
+  assert.equal(isClosedStatus("active"), false);
+  assert.equal(isClosedStatus("pending"), false);
+  assert.equal(isClosedStatus(""), false);
+});
+
+test("getMilestone + isClosedStatus guards against double-complete dispatch", (t) => {
+  const base = mkdtempSync(join(tmpdir(), "gsd-double-complete-"));
+  mkdirSync(join(base, ".gsd"), { recursive: true });
+  openDatabase(join(base, ".gsd", "gsd.db"));
+  t.after(() => {
+    closeDatabase();
+    rmSync(base, { recursive: true, force: true });
+  });
+
+  insertMilestone({ id: "M001", title: "Test", status: "complete" });
+
+  // resolveDispatch itself checks for closed milestones at the top
+  // (before any dispatch rule fires), which is the same guard used
+  // by the phases.ts double-complete check.
+  const milestone = getMilestone("M001");
+  assert.ok(milestone, "milestone should exist in DB");
+  assert.equal(isClosedStatus(milestone.status), true, "closed milestone must be detected");
+});
+
+test("resolveDispatch stops on closed milestone before dispatching", async (t) => {
+  const base = mkdtempSync(join(tmpdir(), "gsd-closed-milestone-"));
+  mkdirSync(join(base, ".gsd"), { recursive: true });
+  openDatabase(join(base, ".gsd", "gsd.db"));
+  t.after(() => {
+    closeDatabase();
+    rmSync(base, { recursive: true, force: true });
+  });
+
+  insertMilestone({ id: "M001", title: "Test", status: "complete" });
+
+  const action = await resolveDispatch({
+    basePath: base,
+    mid: "M001",
+    midTitle: "Test",
+    state: {
+      phase: "complete",
+      activeMilestone: { id: "M001", title: "Test", status: "complete" },
+      activeSlice: null,
+      activeTask: null,
+      registry: [],
+      blockers: [],
+    } as any,
+    prefs: undefined,
+  });
+
+  assert.equal(action.action, "stop");
+  assert.match(action.reason ?? "", /closed/i);
+});

package/src/resources/extensions/gsd/tests/uok-audit-unified.test.ts

@@ -4,6 +4,7 @@ import { mkdtempSync, readFileSync, rmSync, existsSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { emitJournalEvent } from "../journal.ts";
+import { appendEvent } from "../workflow-events.ts";
 import { saveActivityLog } from "../activity-log.ts";
 import { initMetrics, resetMetrics, snapshotUnitMetrics } from "../metrics.ts";
 import { setLogBasePath, logWarning } from "../workflow-logger.ts";
@@ -38,6 +39,12 @@ test("unified audit plane bridges journal/activity/metrics/workflow logger into
       eventType: "iteration-start",
       data: { turnId: "turn-123", unitId: "M001/S01/T01" },
     });
+    appendEvent(basePath, {
+      cmd: "complete-task",
+      params: { milestoneId: "M001", sliceId: "S01", taskId: "T01" },
+      ts: new Date().toISOString(),
+      actor: "agent",
+    });
 
     const activityCtx = makeMockContext([
       { type: "message", message: { role: "assistant", content: [{ type: "text", text: "hello" }] } },
@@ -73,6 +80,7 @@ test("unified audit plane bridges journal/activity/metrics/workflow logger into
     const events = readAuditEvents(basePath);
     const types = new Set(events.map((event) => String(event.type ?? "")));
     assert.ok(types.has("journal-iteration-start"));
+    assert.ok(types.has("workflow-event-complete_task"));
     assert.ok(types.has("activity-log-saved"));
     assert.ok(types.has("unit-metrics-snapshot"));
     assert.ok(types.has("workflow-log-warn"));

package/src/resources/extensions/gsd/tests/uok-plan-v2-wiring.test.ts

@@ -22,7 +22,7 @@ import {
   _needsPlanV2GateForTest,
   _runPlanV2GateForTest,
 } from "../guided-flow.ts";
-import { shouldRunPlanV2Gate } from "../auto/phases.ts";
+import { shouldRunPlanV2Gate } from "../auto/phase-helpers.ts";
 import { resolveUokFlags } from "../uok/flags.ts";
 
 const MILESTONE_ID = "M001";

package/src/resources/extensions/gsd/tests/verification-verdict.test.ts

@@ -24,6 +24,8 @@ test("execute-task fails closed when no host-owned checks are discovered", () =>
   assert.equal(verdict.reason, "no-host-checks");
   assert.equal(verdict.retryable, false);
   assert.match(verdict.failureContext, /No runnable host-owned verification command/);
+  assert.match(verdict.failureContext, /\.gsd\/PREFERENCES\.md/);
+  assert.match(verdict.failureContext, /\/gsd next/);
 });
 
 test("execute-task passes when non-runnable task-plan prose is the verification source", () => {

package/src/resources/extensions/gsd/tests/workflow-events.test.ts

@@ -13,6 +13,7 @@ import {
   compactMilestoneEvents,
   type WorkflowEvent,
 } from '../workflow-events.ts';
+import { workflowEventLogPath } from '../workflow-event-ledger.ts';
 
 function tempDir(): string {
   return fs.mkdtempSync(path.join(os.tmpdir(), 'gsd-events-'));
@@ -38,6 +39,24 @@ test('workflow-events: appendEvent creates .gsd dir and event-log.jsonl', () =>
   }
 });
 
+test('workflow-events: appendEvent from canonical worktree writes project ledger', () => {
+  const base = tempDir();
+  try {
+    const worktree = path.join(base, '.gsd-worktrees', 'M001');
+    fs.mkdirSync(worktree, { recursive: true });
+
+    appendEvent(worktree, makeEvent('complete-task', { milestoneId: 'M001', taskId: 'T01' }));
+
+    const projectLog = path.join(base, '.gsd', 'event-log.jsonl');
+    const worktreeLog = path.join(worktree, '.gsd', 'event-log.jsonl');
+    assert.ok(fs.existsSync(projectLog), 'project event ledger should exist');
+    assert.equal(fs.existsSync(worktreeLog), false, 'worktree-local event log should not be the append target');
+    assert.equal(workflowEventLogPath(worktree), projectLog);
+  } finally {
+    cleanupDir(base);
+  }
+});
+
 test('workflow-events: appendEvent writes valid JSON line', () => {
   const base = tempDir();
   try {