@opengsd/gsd-pi 1.3.0 → 1.4.0-dev.c18009cd

package/src/resources/extensions/gsd/unit-registry.ts

@@ -20,8 +20,9 @@
 //
 // Not yet declared here (remaining ADR-033 steps): the manifest data
 // (`UNIT_MANIFESTS` stays in unit-context-manifest.ts, already type-enforced
-// against the registry's `UnitType`) and prompt-template association (still
-// implicit in auto-prompts.ts builders).
+// against the registry's `UnitType`). Prompt-template association is declared
+// for direct one-template units; conditional/composite prompt selection stays
+// with the prompt builders until it has a richer registry shape.
 
 import type { CanonicalWorkflowToolName } from "@opengsd/contracts";
 import { BROWSER_CONTRACT_TOOL_NAMES } from "../shared/browser-contract.js";
@@ -61,6 +62,12 @@ export interface UnitDescriptor {
    * resolves against session defaults).
    */
   readonly phaseChain: readonly GSDModelPhaseKey[] | null;
+  /**
+   * Prompt template id passed to loadPrompt for units with a direct
+   * one-template builder. Omitted for conditional, composite, or not-yet
+   * verified prompt associations.
+   */
+  readonly promptTemplate?: string;
   /** `null` = the unit has no scoped gsd-tool contract. */
   readonly toolContract: UnitToolSurfaceContract | null;
 }
@@ -97,8 +104,15 @@ export const UNIT_REGISTRY = {
     kind: "primary",
     scopeClass: "standard",
     phaseChain: ["research"],
+    promptTemplate: "research-milestone",
     toolContract: {
-      allowedGsdTools: ["gsd_summary_save", "gsd_decision_save"],
+      allowedGsdTools: [
+        "gsd_summary_save",
+        "gsd_decision_save",
+        "gsd_exec",
+        "gsd_exec_search",
+        "gsd_resume",
+      ],
       requiredWorkflowTools: ["gsd_summary_save"],
     },
   },
@@ -106,15 +120,17 @@ export const UNIT_REGISTRY = {
     kind: "primary",
     scopeClass: "standard",
     phaseChain: ["planning"],
+    promptTemplate: "plan-milestone",
     toolContract: {
       allowedGsdTools: [
         "gsd_milestone_status",
         "gsd_plan_milestone",
         "gsd_plan_slice",
+        "gsd_plan_task",
         "gsd_decision_save",
         "gsd_requirement_update",
       ],
-      requiredWorkflowTools: ["gsd_milestone_status", "gsd_plan_milestone", "gsd_plan_slice"],
+      requiredWorkflowTools: ["gsd_milestone_status", "gsd_plan_milestone", "gsd_plan_slice", "gsd_plan_task"],
     },
   },
   "discuss-milestone": {
@@ -153,8 +169,17 @@ export const UNIT_REGISTRY = {
     kind: "primary",
     scopeClass: "section-close",
     phaseChain: ["validation", "planning"],
+    promptTemplate: "validate-milestone",
     toolContract: {
-      allowedGsdTools: ["gsd_milestone_status", "gsd_validate_milestone", "gsd_reassess_roadmap", "subagent"],
+      allowedGsdTools: [
+        "gsd_milestone_status",
+        "gsd_exec",
+        "gsd_exec_search",
+        "gsd_resume",
+        "gsd_validate_milestone",
+        "gsd_reassess_roadmap",
+        "subagent",
+      ],
       requiredWorkflowTools: ["gsd_milestone_status", "gsd_validate_milestone", "gsd_reassess_roadmap"],
     },
   },
@@ -162,9 +187,13 @@ export const UNIT_REGISTRY = {
     kind: "primary",
     scopeClass: "standard",
     phaseChain: ["completion"],
+    promptTemplate: "complete-milestone",
     toolContract: {
       allowedGsdTools: [
         "gsd_milestone_status",
+        "gsd_exec",
+        "gsd_exec_search",
+        "gsd_resume",
         "gsd_requirement_update",
         "gsd_summary_save",
         "gsd_complete_milestone",
@@ -182,8 +211,16 @@ export const UNIT_REGISTRY = {
     kind: "primary",
     scopeClass: "standard",
     phaseChain: ["research"],
+    promptTemplate: "research-slice",
     toolContract: {
-      allowedGsdTools: ["gsd_summary_save", "gsd_decision_save"],
+      allowedGsdTools: [
+        "gsd_milestone_status",
+        "gsd_summary_save",
+        "gsd_decision_save",
+        "gsd_exec",
+        "gsd_exec_search",
+        "gsd_resume",
+      ],
       requiredWorkflowTools: ["gsd_summary_save"],
     },
   },
@@ -191,17 +228,35 @@ export const UNIT_REGISTRY = {
     kind: "primary",
     scopeClass: "standard",
     phaseChain: ["planning"],
+    promptTemplate: "plan-slice",
     toolContract: {
-      allowedGsdTools: ["gsd_plan_slice", "gsd_reassess_roadmap", "gsd_decision_save"],
-      requiredWorkflowTools: ["gsd_plan_slice", "gsd_reassess_roadmap"],
+      allowedGsdTools: [
+        "gsd_milestone_status",
+        "gsd_plan_slice",
+        "gsd_plan_task",
+        "gsd_reassess_roadmap",
+        "gsd_decision_save",
+        "gsd_exec",
+        "gsd_exec_search",
+        "gsd_resume",
+      ],
+      requiredWorkflowTools: ["gsd_plan_slice", "gsd_plan_task", "gsd_reassess_roadmap"],
     },
   },
   "refine-slice": {
     kind: "primary",
     scopeClass: "standard",
     phaseChain: ["planning"],
+    promptTemplate: "refine-slice",
     toolContract: {
-      allowedGsdTools: ["gsd_plan_slice", "gsd_decision_save"],
+      allowedGsdTools: [
+        "gsd_milestone_status",
+        "gsd_plan_slice",
+        "gsd_decision_save",
+        "gsd_exec",
+        "gsd_exec_search",
+        "gsd_resume",
+      ],
       requiredWorkflowTools: ["gsd_plan_slice"],
     },
   },
@@ -209,6 +264,7 @@ export const UNIT_REGISTRY = {
     kind: "primary",
     scopeClass: "standard",
     phaseChain: ["planning"],
+    promptTemplate: "replan-slice",
     toolContract: {
       allowedGsdTools: ["gsd_replan_slice", "gsd_decision_save"],
       requiredWorkflowTools: ["gsd_replan_slice"],
@@ -218,9 +274,13 @@ export const UNIT_REGISTRY = {
     kind: "primary",
     scopeClass: "section-close",
     phaseChain: ["completion"],
+    promptTemplate: "complete-slice",
     toolContract: {
       allowedGsdTools: [
+        "gsd_milestone_status",
         "gsd_exec",
+        "gsd_exec_search",
+        "gsd_resume",
         "gsd_slice_complete",
         "gsd_task_reopen",
         "gsd_replan_slice",
@@ -231,6 +291,7 @@ export const UNIT_REGISTRY = {
         "subagent",
       ],
       requiredWorkflowTools: [
+        "gsd_milestone_status",
         "gsd_exec",
         "gsd_capture_thought",
         "gsd_slice_complete",
@@ -248,6 +309,7 @@ export const UNIT_REGISTRY = {
     kind: "primary",
     scopeClass: "standard",
     phaseChain: ["validation", "planning"],
+    promptTemplate: "reassess-roadmap",
     toolContract: {
       allowedGsdTools: ["gsd_milestone_status", "gsd_reassess_roadmap"],
       requiredWorkflowTools: ["gsd_milestone_status", "gsd_reassess_roadmap"],
@@ -257,6 +319,7 @@ export const UNIT_REGISTRY = {
     kind: "primary",
     scopeClass: "execute-task",
     phaseChain: ["execution"],
+    promptTemplate: "execute-task",
     toolContract: {
       allowedGsdTools: [
         "gsd_task_complete",
@@ -301,8 +364,15 @@ export const UNIT_REGISTRY = {
     kind: "primary",
     scopeClass: "execute-task",
     phaseChain: ["execution"],
+    promptTemplate: "reactive-execute",
     toolContract: {
-      allowedGsdTools: ["gsd_task_complete", "gsd_summary_save", "gsd_decision_save"],
+      allowedGsdTools: [
+        "gsd_milestone_status",
+        "gsd_task_complete",
+        "gsd_exec",
+        "gsd_summary_save",
+        "gsd_decision_save",
+      ],
       requiredWorkflowTools: ["gsd_task_complete", "gsd_summary_save"],
     },
   },
@@ -310,6 +380,7 @@ export const UNIT_REGISTRY = {
     kind: "primary",
     scopeClass: "standard",
     phaseChain: ["uat", "completion"],
+    promptTemplate: "run-uat",
     toolContract: {
       allowedGsdTools: [...RUN_UAT_WORKFLOW_TOOL_NAMES, "subagent"],
       requiredWorkflowTools: [...RUN_UAT_WORKFLOW_TOOL_NAMES],
@@ -324,6 +395,7 @@ export const UNIT_REGISTRY = {
     kind: "primary",
     scopeClass: "standard",
     phaseChain: ["validation", "planning"],
+    promptTemplate: "gate-evaluate",
     toolContract: {
       allowedGsdTools: ["gsd_save_gate_result"],
       requiredWorkflowTools: ["gsd_save_gate_result"],
@@ -333,6 +405,7 @@ export const UNIT_REGISTRY = {
     kind: "primary",
     scopeClass: "standard",
     phaseChain: ["validation", "planning"],
+    promptTemplate: "rewrite-docs",
     toolContract: {
       allowedGsdTools: ["gsd_summary_save", "gsd_decision_save"],
       requiredWorkflowTools: [],
@@ -357,6 +430,7 @@ export const UNIT_REGISTRY = {
     kind: "primary",
     scopeClass: "standard",
     phaseChain: ["discuss", "planning"],
+    promptTemplate: "guided-workflow-preferences",
     toolContract: {
       allowedGsdTools: ["gsd_summary_save"],
       requiredWorkflowTools: [],
@@ -366,6 +440,7 @@ export const UNIT_REGISTRY = {
     kind: "primary",
     scopeClass: "standard",
     phaseChain: ["discuss", "planning"],
+    promptTemplate: "guided-discuss-project",
     toolContract: {
       allowedGsdTools: ["gsd_summary_save", "gsd_decision_save", "gsd_requirement_save"],
       requiredWorkflowTools: ["ask_user_questions", "gsd_summary_save"],
@@ -375,6 +450,7 @@ export const UNIT_REGISTRY = {
     kind: "primary",
     scopeClass: "standard",
     phaseChain: ["discuss", "planning"],
+    promptTemplate: "guided-discuss-requirements",
     toolContract: {
       allowedGsdTools: ["gsd_requirement_save", "gsd_summary_save"],
       requiredWorkflowTools: ["ask_user_questions", "gsd_requirement_save", "gsd_summary_save"],
@@ -384,17 +460,22 @@ export const UNIT_REGISTRY = {
     kind: "primary",
     scopeClass: "standard",
     phaseChain: ["discuss", "planning"],
+    promptTemplate: "guided-research-decision",
     toolContract: {
       allowedGsdTools: ["gsd_summary_save"],
       requiredWorkflowTools: ["ask_user_questions"],
     },
   },
+  // research-project dispatches 4 parallel scout subagents (Task calls); each scout
+  // writes one file under .gsd/research/ directly. The parent coordinator does not
+  // call gsd_summary_save or gsd_decision_save — the scouts own their own output.
   "research-project": {
     kind: "primary",
     scopeClass: "standard",
     phaseChain: ["research"],
+    promptTemplate: "guided-research-project",
     toolContract: {
-      allowedGsdTools: ["gsd_summary_save", "gsd_decision_save"],
+      allowedGsdTools: [],
       requiredWorkflowTools: [],
     },
   },
@@ -440,3 +521,8 @@ export function getUnitDescriptor(unitType: string): UnitDescriptor | undefined
 export function getUnitPhaseChain(unitType: string): readonly GSDModelPhaseKey[] | null {
   return getUnitDescriptor(unitType)?.phaseChain ?? null;
 }
+
+/** Prompt template id for units with a direct one-template builder. */
+export function getUnitPromptTemplate(unitType: string): string | undefined {
+  return getUnitDescriptor(unitType)?.promptTemplate;
+}

package/src/resources/extensions/gsd/unit-runtime.ts

@@ -100,6 +100,14 @@ export interface ExecuteTaskRecoveryStatus {
   mustHavesMentionedInSummary: number;
 }
 
+export interface UnitHarnessAbortRecord {
+  kind: "tool-loop-guard" | "tool-error" | "turn-abort";
+  reason: string;
+  toolName?: string;
+  count?: number;
+  recordedAt: number;
+}
+
 export interface AutoUnitRuntimeRecord {
   version: 1;
   unitType: string;
@@ -116,6 +124,7 @@ export interface AutoUnitRuntimeRecord {
   recovery?: ExecuteTaskRecoveryStatus;
   recoveryAttempts?: number;
   lastRecoveryReason?: "idle" | "hard";
+  harnessAbort?: UnitHarnessAbortRecord;
 }
 
 function runtimeDir(basePath: string): string {
@@ -138,6 +147,8 @@ export function writeUnitRuntimeRecord(
   const path = runtimePath(basePath, unitType, unitId);
   return withRecordLock(path, () => {
     const prev = readUnitRuntimeRecord(basePath, unitType, unitId);
+    const sameRun = prev?.startedAt === startedAt;
+    const updatesHarnessAbort = Object.prototype.hasOwnProperty.call(updates, "harnessAbort");
     const next: AutoUnitRuntimeRecord = {
       version: 1,
       unitType,
@@ -154,12 +165,32 @@ export function writeUnitRuntimeRecord(
       recovery: updates.recovery ?? prev?.recovery,
       recoveryAttempts: updates.recoveryAttempts ?? prev?.recoveryAttempts ?? 0,
       lastRecoveryReason: updates.lastRecoveryReason ?? prev?.lastRecoveryReason,
+      harnessAbort: updatesHarnessAbort
+        ? updates.harnessAbort
+        : (sameRun ? prev?.harnessAbort : undefined),
     };
     atomicWriteSync(path, JSON.stringify(next, null, 2) + "\n", "utf-8");
     return next;
   });
 }
 
+export function recordUnitHarnessAbort(
+  basePath: string,
+  unitType: string,
+  unitId: string,
+  startedAt: number,
+  abort: Omit<UnitHarnessAbortRecord, "recordedAt"> & { recordedAt?: number },
+): AutoUnitRuntimeRecord {
+  return writeUnitRuntimeRecord(basePath, unitType, unitId, startedAt, {
+    harnessAbort: {
+      ...abort,
+      recordedAt: abort.recordedAt ?? Date.now(),
+    },
+    lastProgressAt: Date.now(),
+    lastProgressKind: `harness-abort:${abort.kind}`,
+  });
+}
+
 export function readUnitRuntimeRecord(basePath: string, unitType: string, unitId: string): AutoUnitRuntimeRecord | null {
   const path = runtimePath(basePath, unitType, unitId);
   if (!existsSync(path)) return null;
@@ -170,6 +201,17 @@ export function readUnitRuntimeRecord(basePath: string, unitType: string, unitId
   }
 }
 
+export function readUnitHarnessAbort(
+  basePath: string,
+  unitType: string,
+  unitId: string,
+  startedAt: number,
+): UnitHarnessAbortRecord | null {
+  const record = readUnitRuntimeRecord(basePath, unitType, unitId);
+  if (!record || record.startedAt !== startedAt) return null;
+  return record.harnessAbort ?? null;
+}
+
 export function clearUnitRuntimeRecord(basePath: string, unitType: string, unitId: string): void {
   const path = runtimePath(basePath, unitType, unitId);
   if (existsSync(path)) unlinkSync(path);

package/src/resources/extensions/gsd/unmerged-milestone-guard.ts

@@ -1,36 +1,61 @@
 // Project/App: gsd-pi
 // File Purpose: Block new workflow entry when completed milestone branches are still unmerged.
 
+import { execFileSync } from "node:child_process";
+
 import {
   nativeBranchExists,
   nativeDetectMainBranch,
   nativeDiffNumstat,
+  nativeIsAncestor,
 } from "./native-git-bridge.js";
 import { autoWorktreeBranch } from "./auto-worktree.js";
 import { ensureDbOpen } from "./bootstrap/dynamic-tools.js";
 import { getAllMilestones } from "./gsd-db.js";
 import { resolveMilestoneIntegrationBranch } from "./git-service.js";
 import { loadEffectiveGSDPreferences } from "./preferences.js";
-import { captureRootDirtySnapshot, type RootDirtyEntry } from "./root-write-leak-guard.js";
 import { isClosedStatus } from "./status-guards.js";
 
+export interface UnmergedMilestoneDirtyEntry {
+  path: string;
+  status: string;
+}
+
 export interface UnmergedMilestoneBlocker {
   milestoneId: string;
   branch: string;
   integrationBranch: string;
   files: string[];
-  dirtyOverlap: RootDirtyEntry[];
+  dirtyOverlap: UnmergedMilestoneDirtyEntry[];
 }
 
+type UnmergedMilestoneDirtySnapshot = Map<string, UnmergedMilestoneDirtyEntry>;
+
 const BLOCKED_COMMANDS = new Set([
   "auto",
   "next",
-  "parallel",
   "start",
   "workflow",
   "new-milestone",
   "new-project",
   "do",
+  "discuss-phase",
+  "plan-phase",
+  "execute-phase",
+  "spec-phase",
+  "mvp-phase",
+  "ui-phase",
+  "ai-integration-phase",
+  "ultraplan-phase",
+  "validate-phase",
+  "docs-update",
+  "review-backlog",
+  "import",
+  "ingest-docs",
+  "secure-phase",
+  "plan-review-convergence",
+  "autonomous",
+  "resume-work",
   "execute-task",
   "research-milestone",
   "plan-slice",
@@ -41,15 +66,56 @@ const BLOCKED_COMMANDS = new Set([
   "complete-milestone",
 ]);
 
+const UNMERGED_SAFE_PARALLEL_SUBCOMMANDS = new Set([
+  "status",
+  "watch",
+]);
+
 function isRuntimePath(path: string): boolean {
   return path === ".gsd" || path.startsWith(".gsd/");
 }
 
+function captureDirtyPathStatusSnapshot(rootPath: string): UnmergedMilestoneDirtySnapshot {
+  const snapshot: UnmergedMilestoneDirtySnapshot = new Map();
+  let status = "";
+  try {
+    status = execFileSync("git", ["status", "--porcelain", "--untracked-files=all"], {
+      cwd: rootPath,
+      stdio: ["ignore", "pipe", "pipe"],
+      encoding: "utf-8",
+    });
+  } catch {
+    return snapshot;
+  }
+
+  for (const line of status.split("\n")) {
+    if (!line.trim()) continue;
+    const code = line.slice(0, 2);
+    const path = line.slice(3).replace(/^"|"$/g, "");
+    if (!path || isRuntimePath(path)) continue;
+    snapshot.set(path, {
+      path,
+      status: code.trim() || code,
+    });
+  }
+  return snapshot;
+}
+
 function formatCommandLabel(attemptedCommand: string): string {
   const trimmed = attemptedCommand.trim();
   return trimmed ? `/gsd ${trimmed}` : "/gsd";
 }
 
+function hasFlag(command: string, flag: string): boolean {
+  const escaped = flag.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(`(?:^|\\s)${escaped}(?=\\s|$)`).test(command);
+}
+
+function isMutatingPhaseCommand(subcommand: string | undefined): boolean {
+  if (!subcommand) return false;
+  return ["add", "create", "new", "insert", "remove", "edit"].includes(subcommand);
+}
+
 function resolveIntegrationBranch(base: string, milestoneId: string): string | null {
   const prefs = loadEffectiveGSDPreferences(base)?.preferences?.git ?? {};
   const resolution = resolveMilestoneIntegrationBranch(base, milestoneId, prefs);
@@ -75,6 +141,24 @@ export function isUnmergedMilestoneAllowedCommand(trimmed: string): boolean {
   if (name === "dispatch") {
     return subcommand === "complete" || subcommand === "complete-milestone";
   }
+  if (name === "audit-fix") {
+    return hasFlag(command, "--dry-run");
+  }
+  if (name === "code-review") {
+    return !hasFlag(command, "--fix");
+  }
+  if (name === "docs-update") {
+    return hasFlag(command, "--verify-only");
+  }
+  if (name === "parallel") {
+    return UNMERGED_SAFE_PARALLEL_SUBCOMMANDS.has(subcommand ?? "");
+  }
+  if (name === "phase") {
+    return !isMutatingPhaseCommand(subcommand);
+  }
+  if (name === "progress") {
+    return !hasFlag(command, "--next") && !hasFlag(command, "--do");
+  }
   return !BLOCKED_COMMANDS.has(name);
 }
 
@@ -82,7 +166,7 @@ export async function findUnmergedCompletedMilestones(base: string): Promise<Unm
   await ensureDbOpen(base);
 
   const blockers: UnmergedMilestoneBlocker[] = [];
-  const dirtyByPath = captureRootDirtySnapshot(base);
+  let dirtyByPath: UnmergedMilestoneDirtySnapshot | null = null;
 
   for (const milestone of getAllMilestones()) {
     if (!isClosedStatus(milestone.status)) continue;
@@ -93,20 +177,31 @@ export async function findUnmergedCompletedMilestones(base: string): Promise<Unm
     const integrationBranch = resolveIntegrationBranch(base, milestone.id);
     if (!integrationBranch || integrationBranch === branch) continue;
 
+    // The milestone is merged when its branch tip is reachable from the
+    // integration branch tip — true for fast-forward, --no-ff, and squash
+    // merges alike. A raw diff is the wrong predicate: a --no-ff merge that
+    // took main's side for some conflicts leaves the branch tip differing from
+    // main, which the diff check would misread as "unmerged" (#825). The diff
+    // below remains the correct fallback only when the branch is NOT yet an
+    // ancestor — i.e. the merge is genuinely still pending.
+    if (nativeIsAncestor(base, branch, integrationBranch)) continue;
+
     const files = nativeDiffNumstat(base, integrationBranch, branch)
       .map((entry) => entry.path)
       .filter((path) => path && !isRuntimePath(path));
     const uniqueFiles = [...new Set(files)].sort();
     if (uniqueFiles.length === 0) continue;
 
+    if (!dirtyByPath) dirtyByPath = captureDirtyPathStatusSnapshot(base);
+    const dirtySnapshot = dirtyByPath;
     blockers.push({
       milestoneId: milestone.id,
       branch,
       integrationBranch,
       files: uniqueFiles,
       dirtyOverlap: uniqueFiles
-        .map((path) => dirtyByPath.get(path))
-        .filter((entry): entry is RootDirtyEntry => Boolean(entry)),
+        .map((path) => dirtySnapshot.get(path))
+        .filter((entry): entry is UnmergedMilestoneDirtyEntry => Boolean(entry)),
     });
   }
 

package/src/resources/extensions/gsd/validation-block-guard.ts

@@ -7,7 +7,7 @@ import { getAutoWorktreePath, isInAutoWorktree } from "./auto-worktree.js";
 import { ensureDbOpen } from "./bootstrap/dynamic-tools.js";
 import { refreshWorkflowDatabaseFromDisk } from "./db-workspace.js";
 import { getIsolationMode } from "./preferences.js";
-import { deriveState } from "./state.js";
+import { deriveState, invalidateStateCache } from "./state.js";
 import type { GSDState } from "./types.js";
 import { detectWorktreeName } from "./worktree.js";
 
@@ -28,6 +28,27 @@ const VALIDATION_BLOCKED_COMMANDS = new Set([
   "ship",
   "complete-milestone",
   "do",
+  "discuss-phase",
+  "import",
+  "ingest-docs",
+  "review-backlog",
+  "docs-update",
+  "secure-phase",
+  "plan-phase",
+  "execute-phase",
+  "spec-phase",
+  "mvp-phase",
+  "ui-phase",
+  "ai-integration-phase",
+  "ultraplan-phase",
+  "plan-review-convergence",
+  "autonomous",
+  "resume-work",
+  "discuss-phase",
+  "import",
+  "ingest-docs",
+  "review-backlog",
+  "secure-phase",
 ]);
 
 const VALIDATION_BLOCKED_PARALLEL_SUBCOMMANDS = new Set([
@@ -48,6 +69,16 @@ const VALIDATION_SAFE_WORKFLOW_SUBCOMMANDS = new Set([
   "uninstall",
 ]);
 
+function hasFlag(command: string, flag: string): boolean {
+  const escaped = flag.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(`(?:^|\\s)${escaped}(?=\\s|$)`).test(command);
+}
+
+function isMutatingPhaseCommand(subcommand: string | undefined): boolean {
+  if (!subcommand) return false;
+  return ["add", "create", "new", "insert", "remove", "edit"].includes(subcommand);
+}
+
 export function isValidationBlockedState(state: GSDState): boolean {
   if (state.phase !== "blocked") return false;
   return state.blockers.some((blocker) => VALIDATION_BLOCK_RE.test(blocker));
@@ -67,6 +98,21 @@ export function isValidationBlockAllowedCommand(trimmed: string): boolean {
   if (name === "workflow") {
     return VALIDATION_SAFE_WORKFLOW_SUBCOMMANDS.has(subcommand ?? "");
   }
+  if (name === "audit-fix") {
+    return hasFlag(command, "--dry-run");
+  }
+  if (name === "code-review") {
+    return !hasFlag(command, "--fix");
+  }
+  if (name === "docs-update") {
+    return hasFlag(command, "--verify-only");
+  }
+  if (name === "phase") {
+    return !isMutatingPhaseCommand(subcommand);
+  }
+  if (name === "progress") {
+    return !hasFlag(command, "--next") && !hasFlag(command, "--do");
+  }
   return !VALIDATION_BLOCKED_COMMANDS.has(name);
 }
 
@@ -87,12 +133,7 @@ export function formatValidationBlockedMessage(
   ].join("\n\n");
 }
 
-export async function getValidationBlockMessageForBase(
-  base: string,
-  attemptedCommand = "",
-): Promise<string | null> {
-  await ensureDbOpen(base);
-  refreshWorkflowDatabaseFromDisk();
+async function deriveValidationBlockState(base: string): Promise<GSDState> {
   let state = await deriveState(base);
 
   if (
@@ -107,5 +148,16 @@ export async function getValidationBlockMessageForBase(
     }
   }
 
+  return state;
+}
+
+export async function getValidationBlockMessageForBase(
+  base: string,
+  attemptedCommand = "",
+): Promise<string | null> {
+  await ensureDbOpen(base);
+  refreshWorkflowDatabaseFromDisk();
+  invalidateStateCache();
+  const state = await deriveValidationBlockState(base);
   return formatValidationBlockedMessage(state, attemptedCommand);
 }

package/src/resources/extensions/gsd/verification-gate.ts

@@ -244,6 +244,14 @@ export function formatFailureContext(result: VerificationResult): string {
   return header + body;
 }
 
+export function formatFailureSignature(result: VerificationResult): string {
+  return result.checks
+    .filter((check) => check.exitCode !== 0)
+    .map((check) => `${check.command.trim()}#${check.exitCode}`)
+    .sort()
+    .join("\n");
+}
+
 // ─── Gate Execution ─────────────────────────────────────────────────────────
 
 /** Characters that indicate shell control syntax when unquoted in a command string. */