@opengsd/gsd-pi 1.3.0 → 1.4.0-dev.c18009cd

package/src/resources/extensions/gsd/preferences-models.ts

@@ -25,7 +25,7 @@ import type {
   ResolvedModelConfig,
   AutoSupervisorConfig,
 } from "./preferences-types.js";
-import { loadEffectiveGSDPreferences, getGlobalGSDPreferencesPath } from "./preferences.js";
+import { clearGSDPreferencesCache, loadEffectiveGSDPreferences, getGlobalGSDPreferencesPath } from "./preferences.js";
 import { getUnitPhaseChain } from "./unit-registry.js";
 
 // Re-export types so existing consumers of ./preferences-models.js keep working
@@ -98,8 +98,14 @@ export function resolveModelWithFallbacksForUnit(
   unitType: string,
   basePath?: string,
   availableModelIds?: string[],
+  preferredModelId?: string,
+  skipProfileDefaults = false,
 ): ResolvedModelConfig | undefined {
-  const loadOpts = availableModelIds !== undefined ? { availableModelIds } : undefined;
+  const loadOpts = {
+    ...(availableModelIds !== undefined ? { availableModelIds } : {}),
+    ...(preferredModelId !== undefined ? { preferredModelId } : {}),
+    ...(skipProfileDefaults ? { skipProfileDefaults: true } : {}),
+  };
   const prefs = loadEffectiveGSDPreferences(basePath, loadOpts);
   const chain = phaseChainForUnit(unitType);
   if (!chain) return undefined;
@@ -188,7 +194,9 @@ export function resolveThinkingLevelForUnit(
  * `openai-codex/gpt-5.4`).  When a bare ID is found and sessionProvider
  * is available, the session provider is used.  Without sessionProvider,
  * bare IDs are still returned with provider set to the bare ID itself
- * so downstream resolution (resolveModelId) can match it.
+ * so downstream resolution (resolveModelId) can match it. Accepts an optional
+ * `sessionModelId` so token-profile defaults can preserve the selected model
+ * before auto-mode captures its start snapshot.
  *
  * Returns `{ provider, id }` or `undefined` if no model preference is
  * configured.
@@ -197,8 +205,14 @@ export function resolveDefaultSessionModel(
   sessionProvider?: string,
   basePath?: string,
   availableModelIds?: string[],
+  sessionModelId?: string,
 ): { provider: string; id: string } | undefined {
-  const loadOpts = availableModelIds !== undefined ? { availableModelIds } : undefined;
+  const preferredModelId = sessionModelId && sessionProvider
+    ? `${sessionProvider}/${sessionModelId}`
+    : sessionModelId;
+  const loadOpts = availableModelIds !== undefined || preferredModelId !== undefined
+    ? { availableModelIds, preferredModelId }
+    : undefined;
   const prefs = loadEffectiveGSDPreferences(basePath, loadOpts);
   const models = prefs?.preferences?.models;
   if (!models) return undefined;
@@ -394,6 +408,7 @@ export function updatePreferencesModels(models: GSDModelConfigV2): void {
   }
 
   writeFileSync(prefsPath, content, "utf-8");
+  clearGSDPreferencesCache();
 }
 
 /**
@@ -477,27 +492,31 @@ const PROFILE_TIER_MAP: Record<TokenProfile, Record<string, ComplexityTier>> = {
  * the best match on the anchor provider (session / auto-start model). Callers
  * scope the available-model list via `modelIdsForProfileResolution` so token
  * profiles do not hop to a cheaper provider (e.g. Gemini Flash) when the user
- * is working on OpenAI or Anthropic. When not known (e.g., early startup),
- * falls back to canonical Anthropic model IDs.
+ * is working on OpenAI or Anthropic. When the selected/session model is known,
+ * it is preferred for tiers it can satisfy. When the registry is unavailable
+ * (e.g., early startup), falls back to canonical Anthropic model IDs.
  *
  * @param profile           The token profile to resolve
  * @param availableModelIds Optional list of available model IDs for cross-provider resolution.
  *                          Undefined means the registry is unavailable.
  * @param routingConfig     Optional routing config for tier model pins.
+ * @param preferredModelId  Optional selected/session model ID to prefer.
  */
 export function resolveProfileDefaults(
   profile: TokenProfile,
   availableModelIds?: string[],
   routingConfig: DynamicRoutingConfig = defaultRoutingConfig(),
+  preferredModelId?: string,
 ): Partial<GSDPreferences> {
   // burn-max never writes model defaults — preserve user-selected models.
   // For the other three profiles, derive concrete model IDs from the tier map
   // against the available-model list when the registry is provided. If callers
   // omit the registry entirely, use canonical fallbacks explicitly.
   const tierMap = PROFILE_TIER_MAP[profile];
-  const resolveTierModel = (tier: ComplexityTier): string => Array.isArray(availableModelIds)
-    ? resolveModelForTier(tier, availableModelIds, routingConfig)
-    : canonicalModelForTier(tier);
+  const resolveTierModel = (tier: ComplexityTier): string =>
+    Array.isArray(availableModelIds) || preferredModelId
+      ? resolveModelForTier(tier, availableModelIds ?? [], routingConfig, undefined, preferredModelId)
+      : canonicalModelForTier(tier);
   const models: GSDModelConfigV2 | undefined = profile === "burn-max"
     ? undefined
     : {

package/src/resources/extensions/gsd/preferences-validation.ts

@@ -51,6 +51,16 @@ const VALID_POST_UNIT_HOOK_ON_BLOCK_ACTIONS = new Set([
 ]);
 const VALID_GATE_EVALUATE_SLICE_GATES = new Set<string>(getGateIdsForTurn("gate-evaluate"));
 
+/** Cross-axis warnings that only apply to the effective (merged) preference shape. */
+export function crossAxisPreferenceWarnings(preferences: GSDPreferences): string[] {
+  if (preferences.mode === "team" && preferences.workspace?.mode === "parent") {
+    return [
+      "mode:team + workspace.mode:parent: team branch-push/PR resolves at the project root and will not push child repositories — see docs/dev/ADR-044",
+    ];
+  }
+  return [];
+}
+
 export function validatePreferences(preferences: GSDPreferences): {
   preferences: GSDPreferences;
   errors: string[];
@@ -509,8 +519,11 @@ export function validatePreferences(preferences: GSDPreferences): {
 
   // ─── Remote Questions ───────────────────────────────────────────────
   if (preferences.remote_questions !== undefined) {
-    if (preferences.remote_questions && typeof preferences.remote_questions === "object") {
-      validated.remote_questions = preferences.remote_questions;
+    const remoteQuestions = preferences.remote_questions as unknown;
+    if (typeof remoteQuestions === "object" && remoteQuestions !== null) {
+      validated.remote_questions = remoteQuestions as GSDPreferences["remote_questions"];
+    } else if (remoteQuestions === false) {
+      // Explicit disable for a globally-configured remote questions channel.
     } else {
       errors.push("remote_questions must be an object");
     }
@@ -1495,6 +1508,17 @@ export function validatePreferences(preferences: GSDPreferences): {
     } else {
       errors.push("workspace must be an object");
     }
+
+    // parent mode is behavioral: it must coordinate at least one declared
+    // child repository. Without one it is indistinguishable from project
+    // mode, so reject it explicitly rather than silently degrading.
+    if (validated.workspace?.mode === "parent") {
+      const childRepoCount = validated.workspace.repositories ? Object.keys(validated.workspace.repositories).length : 0;
+      if (childRepoCount === 0) {
+        errors.push('workspace.mode "parent" requires at least one repository under workspace.repositories');
+      }
+    }
+
   }
 
   // ─── Enhanced Verification ──────────────────────────────────────────────────
@@ -1568,5 +1592,7 @@ export function validatePreferences(preferences: GSDPreferences): {
     }
   }
 
+  warnings.push(...crossAxisPreferenceWarnings(validated));
+
   return { preferences: validated, errors, warnings };
 }

package/src/resources/extensions/gsd/preferences.ts

@@ -10,7 +10,7 @@
  * statements continue to work without modification.
  */
 
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync, statSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 
@@ -39,7 +39,7 @@ import {
   type SkillDiscoveryMode,
   formatSkillRef,
 } from "./preferences-types.js";
-import { validatePreferences } from "./preferences-validation.js";
+import { crossAxisPreferenceWarnings, validatePreferences } from "./preferences-validation.js";
 import { gsdHome } from "./gsd-home.js";
 
 // ─── Re-exports: types ──────────────────────────────────────────────────────
@@ -220,16 +220,20 @@ export function loadEffectiveGSDPreferencesWithRegistry(
   registry: PreferencesModelRegistry | undefined,
   basePath?: string,
   anchorProvider?: string,
+  preferredModelId?: string,
 ): LoadedGSDPreferences | null {
+  const preferenceOpts = preferredModelId !== undefined
+    ? { preferredModelId }
+    : undefined;
   if (!registry) {
-    return loadEffectiveGSDPreferences(basePath);
+    return loadEffectiveGSDPreferences(basePath, preferenceOpts);
   }
   const disabledProviders = resolveDisabledModelProvidersFromPreferences();
   const availableModelIds = modelIdsForProfileResolution(registry, anchorProvider, disabledProviders);
   if (!availableModelIds) {
-    return loadEffectiveGSDPreferences(basePath);
+    return loadEffectiveGSDPreferences(basePath, preferenceOpts);
   }
-  return loadEffectiveGSDPreferences(basePath, { availableModelIds });
+  return loadEffectiveGSDPreferences(basePath, { availableModelIds, preferredModelId });
 }
 
 /**
@@ -263,32 +267,101 @@ export function normalizePreferencesShape(
 }
 // ─── Loading ────────────────────────────────────────────────────────────────
 
-export function loadGlobalGSDPreferences(): LoadedGSDPreferences | null {
-  return loadFirstUsablePreferencesFile([
+const EFFECTIVE_PREFERENCES_CACHE_MAX = 64;
+const effectivePreferencesCache = new Map<string, LoadedGSDPreferences | null>();
+
+type EffectivePreferencesLoadOptions = {
+  availableModelIds?: string[];
+  preferredModelId?: string;
+  skipProfileDefaults?: boolean;
+};
+
+export function clearGSDPreferencesCache(): void {
+  effectivePreferencesCache.clear();
+}
+
+function globalPreferencesCandidatePaths(): string[] {
+  return [
     globalPreferencesPath(),
     legacyGlobalPreferencesPathLowercase(),
     legacyGlobalPreferencesPath(),
-  ], "global");
+  ];
 }
 
-export function loadProjectGSDPreferences(basePath?: string): LoadedGSDPreferences | null {
-  return loadFirstUsablePreferencesFile([
+function projectPreferencesCandidatePaths(basePath?: string): string[] {
+  return [
     projectPreferencesPath(basePath),
     legacyProjectPreferencesPathLowercase(basePath),
-  ], "project");
+  ];
+}
+
+function preferencesFileSignature(path: string): string {
+  try {
+    const stats = statSync(path);
+    return `${path}:${stats.size}:${stats.mtimeMs}`;
+  } catch (err) {
+    const code = (err as NodeJS.ErrnoException).code ?? "unknown";
+    return `${path}:missing:${code}`;
+  }
+}
+
+function effectivePreferencesCacheKey(
+  basePath?: string,
+  opts?: EffectivePreferencesLoadOptions,
+): string {
+  return JSON.stringify({
+    basePath: basePath ?? null,
+    global: globalPreferencesCandidatePaths().map(preferencesFileSignature),
+    project: projectPreferencesCandidatePaths(basePath).map(preferencesFileSignature),
+    availableModelIds: opts?.availableModelIds ?? null,
+    preferredModelId: opts?.preferredModelId ?? null,
+    skipProfileDefaults: opts?.skipProfileDefaults === true,
+  });
+}
+
+function cloneLoadedPreferences(
+  loaded: LoadedGSDPreferences | null,
+): LoadedGSDPreferences | null {
+  return loaded ? structuredClone(loaded) : null;
+}
+
+function cacheEffectivePreferences(
+  key: string,
+  loaded: LoadedGSDPreferences | null,
+): void {
+  if (!effectivePreferencesCache.has(key) && effectivePreferencesCache.size >= EFFECTIVE_PREFERENCES_CACHE_MAX) {
+    effectivePreferencesCache.clear();
+  }
+  effectivePreferencesCache.set(key, cloneLoadedPreferences(loaded));
+}
+
+export function loadGlobalGSDPreferences(): LoadedGSDPreferences | null {
+  return loadFirstUsablePreferencesFile(globalPreferencesCandidatePaths(), "global");
+}
+
+export function loadProjectGSDPreferences(basePath?: string): LoadedGSDPreferences | null {
+  return loadFirstUsablePreferencesFile(projectPreferencesCandidatePaths(basePath), "project");
 }
 
 export function loadEffectiveGSDPreferences(
   basePath?: string,
-  opts?: { availableModelIds?: string[] },
+  opts?: EffectivePreferencesLoadOptions,
 ): LoadedGSDPreferences | null {
+  const cacheKey = effectivePreferencesCacheKey(basePath, opts);
+  if (effectivePreferencesCache.has(cacheKey)) {
+    return cloneLoadedPreferences(effectivePreferencesCache.get(cacheKey)!);
+  }
+
   const globalPreferences = loadGlobalGSDPreferences();
   const projectPreferences = loadProjectGSDPreferences(basePath);
   const effectiveGlobalPreferences = globalPreferences?.ignored ? null : globalPreferences;
   const effectiveProjectPreferences = projectPreferences?.ignored ? null : projectPreferences;
   const projectHasPlanningDepth = effectiveProjectPreferences?.preferences.planning_depth !== undefined;
 
-  if (!effectiveGlobalPreferences && !effectiveProjectPreferences) return null;
+  if (!effectiveGlobalPreferences && !effectiveProjectPreferences) {
+    cacheEffectivePreferences(cacheKey, null);
+    return null;
+  }
 
   let result: LoadedGSDPreferences;
   if (!effectiveGlobalPreferences) {
@@ -318,11 +391,12 @@ export function loadEffectiveGSDPreferences(
   } else {
     profileForDefaults = DEFAULT_TOKEN_PROFILE;
   }
-  if (profileForDefaults) {
+  if (profileForDefaults && !opts?.skipProfileDefaults) {
     const profileDefaults = _resolveProfileDefaults(
       profileForDefaults,
       opts?.availableModelIds,
       result.preferences.dynamic_routing,
+      opts?.preferredModelId,
     );
     const defaultsToApply = explicitProfile
       ? profileDefaults
@@ -342,10 +416,38 @@ export function loadEffectiveGSDPreferences(
   }
 
   result = stripInheritedPlanningDepth(result, projectHasPlanningDepth);
+  result = appendCrossAxisPreferenceWarnings(result);
 
+  cacheEffectivePreferences(cacheKey, result);
   return result;
 }
 
+function appendCrossAxisPreferenceWarnings(loaded: LoadedGSDPreferences): LoadedGSDPreferences {
+  const crossWarnings = crossAxisPreferenceWarnings(loaded.preferences);
+  const existingMessages = new Set([
+    ...(loaded.warnings ?? []),
+    ...(loaded.diagnostics ?? []).map((diagnostic) => diagnostic.message),
+  ]);
+  const newWarnings = crossWarnings.filter((message) => !existingMessages.has(message));
+  if (newWarnings.length === 0) return loaded;
+
+  return {
+    ...loaded,
+    warnings: [...(loaded.warnings ?? []), ...newWarnings],
+    diagnostics: [
+      ...(loaded.diagnostics ?? []),
+      ...newWarnings.map((message): PreferenceDiagnostic => ({
+        path: loaded.path,
+        scope: loaded.scope,
+        severity: "warning",
+        kind: "validation",
+        message,
+        sanitized: true,
+      })),
+    ],
+  };
+}
+
 function withoutProfilePhaseDefaults(defaults: Partial<GSDPreferences>): Partial<GSDPreferences> {
   if (defaults.phases === undefined) return defaults;
   const { phases: _phases, ...rest } = defaults;

package/src/resources/extensions/gsd/prompts/ai-integration-phase.md

@@ -0,0 +1,28 @@
+You are running the GSD **ai-integration-phase** workflow — produce an AI design contract (AI-SPEC) for a milestone/slice that builds an AI system.
+
+## Target
+
+{{target}}
+
+## Process
+
+1. **Load intent.** Read the milestone/slice goal and requirements for the AI capability.
+
+2. **Define the AI capability contract:**
+   - **Inputs:** what the model receives (schema, context, examples) and any preprocessing.
+   - **Outputs:** the expected response shape, how it's parsed/validated, and how failures are handled.
+   - **Model & parameters:** which model/provider, temperature, max tokens, fallback chain — never hardcode; reference config.
+   - **Prompt/contract:** the system/user prompt strategy, or tool/function calling schema.
+   - **Evaluation:** how quality is measured (eval set, rubric, human-in-the-loop checkpoints).
+   - **Cost & latency budget:** expected per-call cost and latency, and the ceiling that triggers a redesign.
+
+3. **Risk register.** Hallucination/grounding, prompt injection, data leakage, cost runaway, model deprecation. For each, the mitigation.
+
+4. **Write the AI-SPEC** to the milestone/slice artifact in `.gsd/`. Recommend `/gsd plan-phase` or `/gsd spike` for high-uncertainty model behaviors.
+
+## Success criteria
+
+- Inputs/outputs are schema-defined, not prose-only.
+- Evaluation is concrete (eval set + rubric), not "it looks good".
+- Cost/latency has a budget and a ceiling.
+- The risk register covers the standard AI failure modes.

package/src/resources/extensions/gsd/prompts/audit-fix.md

@@ -0,0 +1,39 @@
+You are running the GSD **audit-fix** workflow — autonomous audit-to-fix pipeline: find issues, classify them, fix the auto-fixable ones, test after each fix, and commit atomically.
+
+## Source
+
+{{source}}
+
+## Severity filter
+
+{{severity}}
+
+## Max fixes
+
+{{maxFixes}}
+
+## Dry run
+
+{{dryRun}}
+
+## Process
+
+1. **Run the audit.** Use the named source audit (default: the most recent audit-uat / scan findings). If no audit exists, run a fresh `/gsd scan --focus concerns` first and use those findings.
+
+2. **Parse and classify findings.** For each finding, decide: `auto-fixable` (deterministic, localized, no public-behavior change) or `manual-only` (ambiguous, risky, or behavior-changing). Apply the severity filter and the `--max` cap.
+
+3. **Fix loop** (skip entirely if `--dry-run`). For each auto-fixable finding, in priority order:
+   - Apply the fix.
+   - Run the project's tests.
+   - If tests pass, stage the change and record the finding id.
+   - If tests fail, revert that fix, mark it manual-only, and continue.
+   Commit atomically, referencing the finding ids in the commit message for traceability.
+
+4. **Report.** List: fixed (with finding ids + commits), deferred to manual (with reasons), and any that were attempted but reverted due to test failure.
+
+## Success criteria
+
+- Every fix is tested before it's kept; failing fixes are reverted, not left half-applied.
+- Commits are atomic and reference finding ids.
+- `--dry-run` shows what would be fixed without changing anything.
+- Manual-only findings are reported, not silently ignored.

package/src/resources/extensions/gsd/prompts/audit-milestone.md

@@ -0,0 +1,26 @@
+You are running the GSD **audit-milestone** workflow — verify a milestone achieved its definition of done before it is archived.
+
+## Target
+
+{{target}}
+
+## Process
+
+1. **Load the milestone.** Read the milestone's ROADMAP entry, its slices' plans and SUMMARY/ASSESSMENT artifacts, and the requirements/acceptance criteria. If a specific milestone id was given, target it; otherwise target the active or most-recently-completed milestone.
+
+2. **Aggregate per-slice verification.** For each slice, confirm its tasks were completed and its verification strategy was satisfied (tests pass, UAT recorded). Flag slices with incomplete verification.
+
+3. **Check requirements coverage.** Map each requirement/acceptance criterion to the slice(s) and tasks that delivered it. Flag any requirement with no covering evidence.
+
+4. **Check cross-slice integration.** Identify slices that touch shared resources (APIs, data models, state) and confirm their integration points are consistent — no broken handoffs, conflicting schemas, or sequencing gaps.
+
+5. **Aggregate debt and deferred items.** Collect tech debt, deferred tasks, and known gaps into a single list with severity and owner-hint.
+
+6. **Produce the verdict.** Report: `PASS` (done-of-definition met), `NEEDS-ATTENTION` (gaps that need a human call), or `NEEDS-REMEDIATION` (gaps that block archival). Recommend the matching gsd-pi next step (`/gsd verdict`, `/gsd dispatch validate`, or scheduling remediation).
+
+## Success criteria
+
+- Every requirement is mapped to covering evidence or flagged as uncovered.
+- Cross-slice integration risks are explicit, not assumed away.
+- The verdict is one of the three canonical values with supporting evidence.
+- Debt/deferred items are listed, not silently dropped.

package/src/resources/extensions/gsd/prompts/audit-uat.md

@@ -0,0 +1,24 @@
+You are running the GSD **audit-uat** workflow — cross-milestone audit of all outstanding UAT and verification items.
+
+## Verify mode
+
+{{verifyMode}}
+
+## Process
+
+1. **Find every outstanding verification item.** Scan all milestones and slices for items in a non-passing state: pending, skipped, blocked, human_needed. Read the slice SUMMARY/ASSESSMENT artifacts and any UAT records.
+
+2. **Classify each item.** For each outstanding item, record: milestone/slice id, the item, its current state, and why it's outstanding (skipped intentionally, blocked by a dependency, awaiting a human, stale).
+
+3. **Verify against the codebase** (only when `--verify` is set): for each item, check whether the code now satisfies it — turning stale "pending" items into pass/fail based on current evidence. Do not modify code; only re-evaluate.
+
+4. **Produce a prioritized test plan.** Order the genuinely-outstanding items into a human test plan: blockers first, then high-risk, then the rest. Each entry has a clear test step and expected result.
+
+5. **Summarize.** Report counts by state, the count turned pass/fail by verification, and the prioritized plan.
+
+## Success criteria
+
+- Every outstanding verification item is listed with its milestone/slice and reason.
+- Stale items are detected (and, in verify mode, re-evaluated against the code).
+- The test plan is prioritized by risk, not alphabetical.
+- No item is silently dropped or assumed resolved.

package/src/resources/extensions/gsd/prompts/autonomous.md

@@ -0,0 +1,31 @@
+You are running the GSD **autonomous** workflow — run all remaining work on a milestone/slice continuously: discuss → plan → execute per slice, then validate, with minimal human intervention.
+
+## Scope
+
+{{scope}}
+
+## Flags
+
+- `--interactive` — {{interactiveFlag}} (pause for confirmation at key boundaries)
+- `--converge` — {{convergeFlag}} (re-run review cycles until concerns resolve before advancing)
+
+## Process
+
+This workflow is the gsd-pi equivalent of `/gsd auto` with explicit phase-ceremony. It drives the milestone through its lifecycle:
+
+1. **For each pending slice**, in order: discuss (if not done) → plan (if not done) → execute (all tasks) → complete slice.
+2. **Between slices**, honor the closeout boundary stop rule: stop after a slice closeout and leave the closeout surface visible, unless the user opted out of pause-at-boundary.
+3. **`--converge`:** before advancing, run a plan-review-convergence pass on the slice; only advance when concerns resolve.
+4. **`--interactive`:** confirm before each slice's discuss→plan→execute transitions.
+5. **At milestone completion,** run validation (`/gsd dispatch validate`) rather than auto-closing.
+
+Prefer delegating each lifecycle step to gsd-pi's native dispatch (`/gsd dispatch discuss|plan|execute`, `/gsd next`, `/gsd auto`) rather than reimplementing the unit machinery.
+
+Never barrel past a closeout boundary silently; never mark a milestone complete without validation.
+
+## Success criteria
+
+- The milestone advances through its lifecycle in the correct order.
+- Closeout boundaries are respected (stop and surface, don't barrel).
+- `--converge` actually gates advancement on resolved concerns.
+- Milestone completion goes through validation, not auto-close.

package/src/resources/extensions/gsd/prompts/code-review.md

@@ -0,0 +1,39 @@
+You are running the GSD **code-review** workflow — review source files changed during recent work for bugs, security issues, and code quality problems.
+
+## Scope
+
+{{scope}}
+
+## Depth
+
+{{depth}}
+
+## Fix mode
+
+{{fixMode}}
+
+## Process
+
+1. **Determine the file set.** Use the explicit `--files` list if provided. Otherwise derive the changed source files from the active slice's recent commits / SUMMARY, or fall back to the git diff against the base branch. Exclude `.gsd/`, lockfiles, generated/vendored code, and docs unless `--files` names them.
+
+2. **Gather diff-first context.** Run `git diff` for the file set (or the relevant commit range) and use that as the primary review evidence. Use `read` only when the diff is insufficient — new/untracked files, truncated hunks, or missing surrounding context needed for a finding. Do **not** read every changed file when the diff already covers the edits. If the Tool Call Loop Guard blocks a tool, stop calling tools for the rest of this turn and continue in text.
+
+3. **Review at the requested depth:**
+   - **quick** — bugs, security, and correctness only.
+   - **standard** (default) — quick + maintainability, error handling, edge cases.
+   - **deep** — standard + performance, concurrency, API design, test coverage gaps.
+
+   Ground every finding in the actual code with file path + line reference. Categorize each by severity (critical / warning / nit) and type (bug, security, quality, performance).
+
+4. **Write the review.** Produce `.gsd/reviews/{{reviewId}}-REVIEW.md` with the findings table and per-finding detail (location, issue, suggested fix).
+
+5. **Present results.** Summarize counts by severity and list the critical findings first.
+
+6. **Fix mode** (only when `--fix` is set): for each finding that is safely auto-fixable (deterministic, no behavior change beyond the fix), apply it. After each fix batch, run the project's tests. Commit atomically with the finding IDs referenced in the message. Do not auto-apply findings that are ambiguous or that change public behavior — surface those for a human decision instead.
+
+## Success criteria
+
+- Every finding cites a concrete file path and line.
+- Findings are categorized by severity and type.
+- The review is written to `.gsd/reviews/`.
+- Fixes only touch safely-auto-fixable findings, and tests run after each batch.

package/src/resources/extensions/gsd/prompts/complete-slice.md

@@ -6,7 +6,7 @@ You are executing GSD auto-mode.
 
 Your working directory is `{{workingDirectory}}`. All file reads, writes, and shell commands MUST operate relative to this directory. Do NOT `cd` to any other directory.
 
-If any inlined plan, summary, verification command, or prior artifact names an absolute path outside `{{workingDirectory}}`, treat that path as stale context. Convert it to the equivalent relative path under `{{workingDirectory}}` before reading, writing, or executing. If no equivalent path exists under `{{workingDirectory}}`, record a verification failure and stop; do not edit or run commands in another checkout.
+If inlined context names an absolute path outside `{{workingDirectory}}`, treat it as stale. Convert to the relative path under `{{workingDirectory}}` before use. If none exists, record a verification failure and stop; do not edit or run commands in another checkout.
 
 ## Your Role in the Pipeline
 
@@ -14,13 +14,13 @@ You are the closer: verify assembled task work delivers the slice goal, then com
 
 ### Closeout messaging (auto-mode)
 
-You write closeout artifacts; **GSD auto-mode** decides when the slice is actually **done**. Never say "Slice {{sliceId}} complete" in this unit — not even after `gsd_slice_complete` succeeds. GSD announces completion only after post-unit verification passes.
+You write closeout artifacts; **GSD auto-mode** decides when the slice is actually **done**. Never say "Slice {{sliceId}} complete" in this unit. GSD announces completion only after post-unit verification passes.
 
 {{inlinedContext}}
 
 {{gatesToClose}}
 
-Match effort to complexity. Simple slices need brief summary and light verification; multi-subsystem slices need stronger verification and detail.
+Match complexity: simple slices need brief summary/light verification; multi-subsystem slices need stronger verification/detail.
 
 Use `subagent` only when useful: reviewer, security, or tester. Apply findings before completion.
 
@@ -28,29 +28,34 @@ Use `subagent` only when useful: reviewer, security, or tester. Apply findings b
 
 1. Use the inlined Slice Summary and UAT templates.
 2. {{skillActivation}}
-3. Run all slice-level verification through `gsd_exec` / Context Mode evidence; refresh current state if needed. Do not use direct `bash` for verification commands. See the prepended **Tool Surface** block for unavailable tools.
-4. Complete only when every required check passes. If verification fails or source changes are needed, do **not** edit source files in this unit and do **not** call `gsd_slice_complete`.
+3. Run slice-level verification only through `gsd_exec` / Context Mode evidence; refresh current state if needed. Do not use direct `bash` for verification commands. Tool availability is in **Tool Surface**.
+4. Complete only after every required check passes. Exactly one terminal workflow tool is required: pass -> `gsd_slice_complete`; task follow-up -> `gsd_task_reopen`; planning follow-up -> `gsd_replan_slice`. A text-only stop, even one mentioning a tool, is invalid. If checks fail or source changes are needed, do **not** edit source files in this unit and do **not** call `gsd_slice_complete`.
 5. If verification fails:
-   - Task-specific regressions: if the failure is in files the task touched and pre-task verification evidence shows it was absent before that task ran, call `gsd_task_reopen` with that task and reason.
-   - Inherited/out-of-scope failures, including failures present before the task ran or failures without pre-task evidence: do **not** reopen completed tasks; call `gsd_replan_slice` with adjusted verification scope or follow-up tasks.
-   - Other plan-invalidating failures: call `gsd_replan_slice` with the blocker and updated execution tasks.
-   Then stop with: "Slice {{sliceId}} needs execution follow-up."
+   - Task-specific regression: if pre-task verification evidence shows it was absent before that task ran, call `gsd_task_reopen` with task and reason.
+   - Inherited/out-of-scope failure, including failures present before the task ran or no pre-task evidence: do **not** reopen tasks; call `gsd_replan_slice`.
+   - Other plan-invalidating failure: call `gsd_replan_slice` with blocker and updated tasks.
+   After any successful failure-handoff tool call, the unit is done. The `gsd_task_reopen` or `gsd_replan_slice` call is the handoff signal for the orchestrator.
+   - Never call `gsd_replan_slice` after calling `gsd_task_reopen`; reopened tasks are pending.
+   - Do not call `gsd_plan_slice`; that tool belongs to `plan-slice` and is hard-blocked here.
+   - Do not read source code, run `gsd_exec`, invoke subagents, or do implementation/planning work after the first `gsd_task_reopen` or `gsd_replan_slice` handoff call.
+   - Terminal reopen sequence: call `gsd_task_reopen`; after success, final text may only be: "Slice {{sliceId}} needs execution follow-up."
+   - Terminal replan sequence: call `gsd_replan_slice` once; after it succeeds, final text may only be: "Slice {{sliceId}} needs execution follow-up."
 6. Task summaries use a flat file layout under `tasks/` such as `T01-SUMMARY.md`, not inside per-task subdirectories like `tasks/T01/SUMMARY.md`. Never use `tasks/*/SUMMARY.md`.
 7. If observability/diagnostics were planned, verify them unless the slice is simple.
 8. Address every Gate to Close. Q8 = **Operational Readiness**: health signal, failure signal, recovery, monitoring gaps. Omit empty sections.
 9. If requirement status changed, call `gsd_requirement_update`; do not write `.gsd/REQUIREMENTS.md` directly.
-10. Prepare `gsd_slice_complete` content with camelCase fields `milestoneId`, `sliceId`, `sliceTitle`, `oneLiner`, `narrative`, `verification`, and `uatContent`.
-11. Draft concrete UAT with preconditions, steps, expected outcomes, edge cases, and UAT Type. Declare the type as a bullet under a `## UAT Type` heading, exactly like `- UAT mode: browser-executable`.
+10. Prepare `gsd_slice_complete` camelCase fields: `milestoneId`, `sliceId`, `sliceTitle`, `oneLiner`, `narrative`, `verification`, `uatContent`.
+11. Draft concrete UAT: preconditions, steps, expected outcomes, edge cases, and UAT Type. Declare type under `## UAT Type` exactly like `- UAT mode: browser-executable`.
     **Web apps:** when inlined Web App UAT guidance is present, declare `browser-executable` or `runtime-executable` (not `artifact-driven`) for localhost/browser/screenshot steps; include dev-server preconditions and name Playwright specs when they exist.
-12. Review the inlined task-summary excerpts for DECISIONS.md/KNOWLEDGE.md-worthy decisions and gotchas. Read full `*-SUMMARY.md` only if needed. Capture with `gsd_capture_thought` (MCP-scoped `mcp__...__gsd_capture_thought`), not bare `capture_thought`; do not append knowledge files.
+12. Review the inlined task-summary excerpts for DECISIONS.md/KNOWLEDGE.md-worthy decisions/gotchas. Read full `*-SUMMARY.md` only if needed. Capture with MCP-scoped `gsd_capture_thought`, not bare `capture_thought`; do not append knowledge files.
 13. When verification passes, call `gsd_slice_complete`. The DB-backed tool is the canonical write path. Do **not** manually write `{{sliceSummaryPath}}`. Do **not** manually write `{{sliceUatPath}}`. Do not edit roadmap checkboxes.
 14. Do not run git commands.
-15. If the current project state needs refresh, call `gsd_summary_save` with `artifact_type: "PROJECT"` and the full updated project markdown as `content`; omit `milestone_id`. Do not write or edit `.gsd/PROJECT.md` directly.
+15. If project state needs refresh, call `gsd_summary_save` with `artifact_type: "PROJECT"` and full updated project markdown as `content`; omit `milestone_id`. Do not edit `.gsd/PROJECT.md` directly.
 
 **Autonomous execution:** no human is available. Do not call `ask_user_questions` or `secure_env_collect`; make reasonable assumptions and document them.
 
-**File system safety:** if re-reading task summaries, use `find .gsd/milestones/{{milestoneId}}/slices/{{sliceId}}/tasks -name "*-SUMMARY.md"`. Never pass `{{slicePath}}` or any directory path directly to the `read` tool.
+**File system safety:** to re-read task summaries, use `find .gsd/milestones/{{milestoneId}}/slices/{{sliceId}}/tasks -name "*-SUMMARY.md"`. Never pass `{{slicePath}}` or any directory path directly to the `read` tool.
 
-**You MUST call `gsd_slice_complete` with summary and UAT content only after verification passes.**
+**You MUST call `gsd_slice_complete` after verification passes. If not, MUST call `gsd_task_reopen` or `gsd_replan_slice`. Never finish this unit with plain text only.**
 
-When done, say: "Slice {{sliceId}} closeout submitted." Do not say the slice is complete. Say this exactly once — if you already said it in a prior message, do not repeat it.
+When done, say exactly once: "Slice {{sliceId}} closeout submitted." Do not say the slice is complete.