@opengsd/gsd-pi 1.4.0 → 1.5.0

package/dist/resources/extensions/gsd/auto-dispatch.js

@@ -596,7 +596,7 @@ export const DISPATCH_RULES = [
         },
     },
     {
-        name: "uat-verdict-gate (non-PASS blocks progression)",
+        name: "uat-verdict-gate (non-PASS observed; closeout enforces)",
         match: async ({ mid, basePath, prefs }) => {
             // Only applies when UAT dispatch is enabled
             if (!prefs?.uat_dispatch)
@@ -611,9 +611,9 @@ export const DISPATCH_RULES = [
                     continue;
                 const { verdict, uatType } = result;
                 if (!isAcceptableUatVerdict(verdict, uatType)) {
-                    // Do not hard-stop auto-mode on non-PASS verdicts. Allow progression
-                    // so follow-up slices can remediate, while complete-milestone still
-                    // enforces manual UAT PASS sign-off before closure.
+                    // Observe non-PASS verdicts without hard-stopping auto-mode. Allow
+                    // progression so follow-up slices can remediate, while
+                    // complete-milestone still enforces manual UAT PASS sign-off before closure.
                     continue;
                 }
             }
@@ -902,9 +902,19 @@ export const DISPATCH_RULES = [
             const sliceContextFile = resolveSliceFile(basePath, mid, state.activeSlice.id, "CONTEXT");
             if (sliceContextFile && existsSync(sliceContextFile))
                 return null; // discussion already done, proceed
+            const closedSliceIds = getClosedSliceIds(mid);
+            const justClosedSliceId = closedSliceIds[closedSliceIds.length - 1];
+            let priorVerdictWarning = "";
+            if (justClosedSliceId) {
+                const prior = await readUatGateVerdict(basePath, mid, justClosedSliceId);
+                if (prior && !isAcceptableUatVerdict(prior.verdict, prior.uatType)) {
+                    priorVerdictWarning =
+                        ` Note: the slice just closed (${justClosedSliceId}) recorded a non-PASS UAT verdict (${prior.verdict.toUpperCase()}); review before continuing.`;
+                }
+            }
             return {
                 action: "stop",
-                reason: `Slice ${state.activeSlice.id} requires discussion before planning (require_slice_discussion is enabled). Run /gsd discuss to discuss this slice, then /gsd auto to resume.`,
+                reason: `Slice ${state.activeSlice.id} requires discussion before planning (require_slice_discussion is enabled). Run /gsd discuss to discuss this slice, then /gsd auto to resume.${priorVerdictWarning}`,
                 level: "warning",
             };
         },

package/dist/resources/extensions/gsd/auto-model-selection.js

@@ -326,7 +326,7 @@ export function floorThinkingLevelForUnit(unitType, level) {
     return EXECUTE_TASK_MIN_THINKING_LEVEL;
 }
 export function resolvePreferredModelConfig(unitType, autoModeStartModel, isAutoMode = true, basePath, availableModelIds, preferredModelId) {
-    const explicitConfig = resolveModelWithFallbacksForUnit(unitType, basePath, availableModelIds, preferredModelId);
+    const explicitConfig = resolveModelWithFallbacksForUnit(unitType, basePath, availableModelIds, preferredModelId, true);
     if (explicitConfig) {
         return {
             ...explicitConfig,
@@ -338,23 +338,45 @@ export function resolvePreferredModelConfig(unitType, autoModeStartModel, isAuto
     if (!isAutoMode)
         return undefined;
     const routingConfig = resolveDynamicRoutingConfig();
-    if (!routingConfig.enabled || !routingConfig.tier_models)
+    if (!routingConfig.enabled)
         return undefined;
-    // Don't synthesize a routing config for flat-rate providers (#3453).
-    // Users can opt into routing for flat-rate subscriptions (e.g. claude-code)
-    // via dynamic_routing.allow_flat_rate_providers (#4386).
-    if (!routingConfig.allow_flat_rate_providers &&
+    // Only an explicit flat-rate opt-out suppresses synthesized routing.
+    // `dynamic_routing.enabled: true` is user intent to run routing even when
+    // the start provider is a flat-rate subscription. Applied ahead of both the
+    // tier-pin and profile-derived synthesis paths so the opt-out is uniform.
+    if (routingConfig.allow_flat_rate_providers === false &&
         autoModeStartModel &&
         isFlatRateProvider(autoModeStartModel.provider, autoModeStartModel.flatRateCtx)) {
         return undefined;
     }
-    const ceilingModel = routingConfig.tier_models.heavy
-        ?? (autoModeStartModel ? `${autoModeStartModel.provider}/${autoModeStartModel.id}` : undefined);
-    if (!ceilingModel)
+    // With explicit `tier_models` pins, synthesize a heavy-tier ceiling that
+    // dynamic routing downgrades from per unit.
+    if (routingConfig.tier_models) {
+        const ceilingModel = routingConfig.tier_models.heavy
+            ?? (autoModeStartModel ? `${autoModeStartModel.provider}/${autoModeStartModel.id}` : undefined);
+        if (!ceilingModel)
+            return undefined;
+        return {
+            primary: ceilingModel,
+            fallbacks: [],
+            source: "synthesized",
+        };
+    }
+    // No `tier_models` pins: fall back to the token-profile's per-phase model so
+    // profile tier resolution survives. `skipProfileDefaults` is left false here
+    // (unlike the explicit-detection call above) precisely because we WANT the
+    // profile defaults this time — they are the routing ceiling, not a hard
+    // user selection. Labeling the result `synthesized` (not `explicit`) keeps
+    // dynamic routing and fallbacks enabled downstream. Without this branch,
+    // `resolvePreferredModelConfig` returns undefined for profile-only configs
+    // and auto dispatch bleeds the start model onto every unit, silently
+    // discarding the profile (#1115: routing/fallbacks disabled when a
+    // token_profile is set but no tier_models are pinned).
+    const profileConfig = resolveModelWithFallbacksForUnit(unitType, basePath, availableModelIds, preferredModelId, false);
+    if (!profileConfig)
         return undefined;
     return {
-        primary: ceilingModel,
-        fallbacks: [],
+        ...profileConfig,
         source: "synthesized",
     };
 }
@@ -510,15 +532,11 @@ autoModeStartThinkingLevel) {
                 ]));
             }
         }
-        // Disable routing for flat-rate providers like GitHub Copilot (#3453).
-        // All models cost the same per request, so downgrading to a cheaper
-        // model provides no cost benefit — it only degrades quality.
+        // Disable routing for flat-rate providers only when the user explicitly
+        // opts out with dynamic_routing.allow_flat_rate_providers: false.
         // Fail-closed: if primary model can't be resolved, fall back to
         // provider-level signals rather than allowing unwanted downgrades.
-        // Opt-in: dynamic_routing.allow_flat_rate_providers skips the bypass so
-        // claude-code subscribers can still get intelligent per-task selection
-        // across their subscription (#4386).
-        if (routingConfig.enabled && !routingConfig.allow_flat_rate_providers) {
+        if (routingConfig.enabled && routingConfig.allow_flat_rate_providers === false) {
             const primaryModel = resolveModelId(modelConfig.primary, routingEligibleModels, ctx.model?.provider);
             if (primaryModel) {
                 const primaryFlatRateCtx = buildFlatRateContext(primaryModel.provider, ctx, prefs);

package/dist/resources/extensions/gsd/auto-prompts.js

@@ -12,12 +12,13 @@ import { hasVerdict, extractVerdict } from "./verdict-parser.js";
 import { loadPrompt, inlineTemplate } from "./prompt-loader.js";
 import { resolveMilestoneFile, resolveSliceFile, resolveSlicePath, resolveTasksDir, resolveTaskFiles, resolveTaskFile, relMilestoneFile, relSliceFile, relSlicePath, relMilestonePath, relTaskFile, resolveGsdRootFile, relGsdRootFile, resolveRuntimeFile, } from "./paths.js";
 import { resolveInlineLevel, loadEffectiveGSDPreferences } from "./preferences.js";
+import { createRepositoryRegistryFromPreferences } from "./repository-registry.js";
 import { isContextModeEnabled } from "./preferences-types.js";
 import { parseRoadmap } from "./parsers-legacy.js";
-import { join } from "node:path";
+import { join, relative, sep } from "node:path";
 import { existsSync } from "node:fs";
 import { computeBudgets, resolveExecutorContextWindow, truncateAtSectionBoundary } from "./context-budget.js";
-import { getPendingGatesForTurn } from "./gsd-db.js";
+import { getGateResults, getPendingGatesForTurn } from "./gsd-db.js";
 import { assertGateCoverage, getGatesForTurn, } from "./gate-registry.js";
 import { formatDecisionsCompact, formatRequirementsCompact } from "./structured-data-formatter.js";
 import { readPhaseAnchor, formatAnchorForPrompt } from "./phase-anchor.js";
@@ -295,6 +296,37 @@ function formatExecutorConstraints(sessionContextWindow, modelRegistry, sessionP
         `- Keep individual tasks completable within a single context window — if a task needs more context than fits, split it`,
     ].join("\n");
 }
+/**
+ * Builds the Declared Repositories block for parent-workspace planners.
+ * Returns "" for single-repo projects so the common-case prompt is unchanged;
+ * only parent mode with declared child repos gets the registry list and the
+ * targetRepositories assignment instruction.
+ */
+export function buildRepoRegistryBlock(base) {
+    let registry;
+    try {
+        registry = createRepositoryRegistryFromPreferences(base, loadEffectiveGSDPreferences(base)?.preferences);
+    }
+    catch {
+        return "";
+    }
+    const hasChildRepo = registry.repositories.some((repo) => repo.id !== "project");
+    if (registry.mode !== "parent" || !hasChildRepo)
+        return "";
+    const lines = registry.repositories.map((repo) => {
+        const relPath = relative(registry.projectRoot, repo.root).split(sep).join("/") || ".";
+        const role = repo.role ? ` — ${repo.role}` : "";
+        const root = repo.id === "project" ? " (root)" : ` (${relPath})`;
+        return `- \`${repo.id}\`${root}${role}`;
+    });
+    return [
+        "### Declared Repositories",
+        "",
+        ...lines,
+        "",
+        "This is a parent workspace. Assign each task's `targetRepositories` to the repository id(s) it touches (from the list above). Omit `targetRepositories` to inherit the slice-wide default from `gsd_plan_slice`; set it explicitly when a task differs (e.g. `[\"project\"]` for parent-root work).",
+    ].join("\n");
+}
 /**
  * Returns a markdown bullet list of known context file paths for the given
  * milestone (and optionally slice). Falls back to a generic tool-agnostic
@@ -2174,6 +2206,7 @@ async function renderSlicePrompt(options) {
         inlinedContext,
         dependencySummaries: depContent,
         sourceFilePaths: buildSourceFilePaths(base, mid, sid),
+        repoRegistry: buildRepoRegistryBlock(base),
         executorContextConstraints,
         commitInstruction,
         skillActivation: buildSkillActivationBlock({
@@ -2906,6 +2939,47 @@ export async function buildValidateMilestonePrompt(mid, midTitle, base, level) {
         inlined.push(outstandingBlock);
         trackPromptContext(contextTelemetry, "outstanding-items", "inline", outstandingBlock);
     }
+    const persistedGateFlags = [];
+    try {
+        const gateLabels = {
+            Q3: "Threat Surface",
+            Q4: "Requirement Impact",
+        };
+        for (const sid of seenValSlices) {
+            for (const gate of getGateResults(mid, sid, "slice")) {
+                if (gate.gate_id !== "Q3" && gate.gate_id !== "Q4")
+                    continue;
+                const findings = gate.findings.trim();
+                const rationale = gate.rationale.trim();
+                const verdict = gate.verdict ?? "";
+                const hasNonPassVerdict = verdict !== "" && verdict !== "pass" && verdict !== "omitted";
+                if (!findings && !hasNonPassVerdict)
+                    continue;
+                const displayVerdict = verdict || gate.status;
+                const detail = findings || rationale || "_No findings text recorded; reconcile the persisted non-pass verdict._";
+                persistedGateFlags.push(`- **${sid} / ${gate.gate_id} (${gateLabels[gate.gate_id]}) / ${displayVerdict}:** ${detail}`);
+                if (findings && rationale)
+                    persistedGateFlags.push(`  - Rationale: ${rationale}`);
+            }
+        }
+    }
+    catch (err) {
+        logWarning("prompt", `buildValidateMilestonePrompt persisted gate flags lookup failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (persistedGateFlags.length > 0) {
+        const persistedGateFlagsBlock = [
+            "### Persisted Slice-Level Gate Flags (from quality_gates)",
+            "",
+            "These slice gates recorded findings or non-pass verdicts during execution. Reconcile each against the milestone-level evidence before returning MV03/MV04 verdicts.",
+            "",
+            ...persistedGateFlags,
+        ].join("\n");
+        inlined.push(persistedGateFlagsBlock);
+        trackPromptContext(contextTelemetry, "persisted-slice-gate-flags", "inline", persistedGateFlagsBlock);
+    }
+    else {
+        trackPromptContext(contextTelemetry, "persisted-slice-gate-flags", "skipped", null, "none");
+    }
     // Inline existing VALIDATION file if this is a re-validation round
     const validationPath = resolveMilestoneFile(base, mid, "VALIDATION");
     const validationRel = relMilestoneFile(base, mid, "VALIDATION");

package/dist/resources/extensions/gsd/auto-start.js

@@ -1435,15 +1435,16 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
             ? `${s.autoModeStartModel.provider}/${s.autoModeStartModel.id}`
             : ctx.model ? `${ctx.model.provider}/${ctx.model.id}` : "default";
         // Flat-rate providers (e.g. GitHub Copilot, claude-code, user-declared
-        // subscription proxies, externalCli CLIs) suppress routing at dispatch
-        // time (#3453) — reflect that in the banner.  Thread the same
+        // subscription proxies, externalCli CLIs) suppress routing only when the
+        // user explicitly opts out with allow_flat_rate_providers: false. Reflect
+        // that in the banner. Thread the same
         // FlatRateContext used by selectAndApplyModel so user-declared
         // flat-rate providers and externalCli auto-detection are respected.
         const { isFlatRateProvider, buildFlatRateContext } = await import("./auto-model-selection.js");
         const bannerPrefs = loadEffectiveGSDPreferencesWithRegistry(ctx.modelRegistry, base, resolveProfileAnchorProvider(ctx.model?.provider, s.autoModeStartModel?.provider), s.autoModeStartModel ? `${s.autoModeStartModel.provider}/${s.autoModeStartModel.id}` : undefined)?.preferences;
         const effectiveProvider = s.autoModeStartModel?.provider ?? ctx.model?.provider;
         const effectivelyEnabled = routingConfig.enabled
-            && (routingConfig.allow_flat_rate_providers
+            && (routingConfig.allow_flat_rate_providers !== false
                 || !(effectiveProvider && isFlatRateProvider(effectiveProvider, buildFlatRateContext(effectiveProvider, ctx, bannerPrefs))));
         // The actual ceiling may come from tier_models.heavy, not the start model.
         const effectiveCeiling = (routingConfig.enabled && routingConfig.tier_models?.heavy)

package/dist/resources/extensions/gsd/auto-timeout-recovery.js

@@ -56,6 +56,8 @@ export async function recoverTimedOutUnit(ctx, pi, unitType, unitId, reason, rct
                 lastProgressAt: Date.now(),
                 progressCount: (runtime?.progressCount ?? 0) + 1,
                 lastProgressKind: reason === "idle" ? "idle-recovery-retry" : "hard-recovery-retry",
+                // This steering retry is a fresh chance for the same unit to save a valid result.
+                harnessAbort: undefined,
             });
             const steeringLines = isEscalation
                 ? [
@@ -151,6 +153,8 @@ export async function recoverTimedOutUnit(ctx, pi, unitType, unitId, reason, rct
             lastProgressAt: Date.now(),
             progressCount: (runtime?.progressCount ?? 0) + 1,
             lastProgressKind: reason === "idle" ? "idle-recovery-retry" : "hard-recovery-retry",
+            // This steering retry is a fresh chance for the same unit to save a valid result.
+            harnessAbort: undefined,
         });
         const steeringLines = isEscalation
             ? [

package/dist/resources/extensions/gsd/auto-worktree.js

@@ -986,10 +986,10 @@ export function teardownAutoWorktree(originalBasePath, milestoneId, opts = {}) {
     const branch = autoWorktreeBranch(milestoneId);
     const { preserveBranch = false, preserveWorktree = false } = opts;
     const previousCwd = safeCwd(originalBasePath);
+    let clearActiveWorkspace = true;
     // Wrap the entire teardown body in a single try/finally so activeWorkspace
-    // is ALWAYS cleared — even if process.chdir throws (e.g. originalBasePath
-    // was deleted before teardown ran). Previously the finally only covered
-    // removeWorktree, leaving the registry stale on a chdir failure (H3 fix).
+    // is cleared on completion or irrecoverable failure — even if process.chdir
+    // throws (e.g. originalBasePath was deleted before teardown ran).
     try {
         try {
             process.chdir(originalBasePath);
@@ -1026,17 +1026,23 @@ export function teardownAutoWorktree(originalBasePath, milestoneId, opts = {}) {
         // 3. Remove the worktree unless this exit path explicitly preserves it
         //    (slice-parallel dispatch stops the parent loop but keeps the parent
         //    milestone worktree for restart/re-entry).
+        let worktreeRemoved = preserveWorktree;
         if (!preserveWorktree) {
-            removeWorktree(originalBasePath, milestoneId, {
+            worktreeRemoved = removeWorktree(originalBasePath, milestoneId, {
                 branch,
                 deleteBranch: !preserveBranch,
             });
+            if (!worktreeRemoved) {
+                logWarning("worktree", `Worktree removal aborted for ${milestoneId}; uncommitted work was preserved. ` +
+                    `Manual quarantine recovery may be needed before retrying teardown.`, { worktree: milestoneId });
+                clearActiveWorkspace = false;
+            }
         }
         // Verify cleanup succeeded — warn if the worktree directory is still on disk.
         // On Windows, bash-based cleanup can silently fail when paths contain
         // backslashes (#1436), leaving ~1 GB+ orphaned directories.
         const wtDir = worktreePath(originalBasePath, milestoneId);
-        if (!preserveWorktree && existsSync(wtDir)) {
+        if (!preserveWorktree && worktreeRemoved && existsSync(wtDir)) {
             logWarning("reconcile", `Worktree directory still exists after teardown: ${wtDir}. ` +
                 `This is likely an orphaned directory consuming disk space. ` +
                 `Remove it manually with: rm -rf "${wtDir.replaceAll("\\", "/")}"`, { worktree: milestoneId });
@@ -1057,10 +1063,12 @@ export function teardownAutoWorktree(originalBasePath, milestoneId, opts = {}) {
         }
     }
     finally {
-        // Clear module state unconditionally — regardless of which step above
-        // failed. A stale activeWorkspace causes getActiveAutoWorktreeContext()
-        // to return wrong data for subsequent operations.
-        setActiveWorkspace(null);
+        // Clear module state when teardown completed or failed irrecoverably.
+        // When removeWorktree returns false (quarantine failure), preserve the
+        // registry so recovery logic still sees the active milestone worktree.
+        if (clearActiveWorkspace) {
+            setActiveWorkspace(null);
+        }
     }
 }
 /**
@@ -1491,15 +1499,28 @@ export function mergeMilestoneToMain(originalBasePath_, milestoneId, roadmapCont
         catch (err) {
             logWarning("worktree", `clearProjectRootStateFiles failed during already-merged cleanup: ${err instanceof Error ? err.message : String(err)}`);
         }
+        let worktreeRemoved = true;
         try {
-            removeWorktree(originalBasePath_, milestoneId, {
+            worktreeRemoved = removeWorktree(originalBasePath_, milestoneId, {
                 branch: milestoneBranch,
                 deleteBranch: false,
             });
         }
         catch (err) {
+            worktreeRemoved = false;
             logWarning("worktree", `worktree removal failed: ${err instanceof Error ? err.message : String(err)}`);
         }
+        if (!worktreeRemoved) {
+            logWarning("worktree", `Skipping milestone branch deletion for ${milestoneBranch}; worktree removal was aborted to preserve uncommitted milestone work.`);
+            nudgeGitBranchCache(previousCwd);
+            try {
+                process.chdir(originalBasePath_);
+            }
+            catch (err) {
+                logWarning("worktree", `chdir to project root after already-merged cleanup failed: ${err instanceof Error ? err.message : String(err)}`);
+            }
+            return { commitMessage, pushed: false, prCreated: false, codeFilesChanged: true };
+        }
         try {
             nativeBranchDelete(originalBasePath_, milestoneBranch);
         }
@@ -1932,16 +1953,22 @@ export function mergeMilestoneToMain(originalBasePath_, milestoneId, roadmapCont
     }
     const finalizeMilestoneCleanup = () => {
         // 12. Remove worktree directory first (must happen before branch deletion)
+        let worktreeRemoved = true;
         try {
-            removeWorktree(originalBasePath_, milestoneId, {
+            worktreeRemoved = removeWorktree(originalBasePath_, milestoneId, {
                 branch: milestoneBranch,
                 deleteBranch: false,
             });
         }
         catch (err) {
+            worktreeRemoved = false;
             // Best-effort -- worktree dir may already be gone
             logWarning("worktree", `worktree removal failed: ${err instanceof Error ? err.message : String(err)}`);
         }
+        if (!worktreeRemoved) {
+            logWarning("worktree", `Skipping milestone branch deletion for ${milestoneBranch}; worktree removal was aborted to preserve uncommitted milestone work.`);
+            return;
+        }
         // 13. Delete milestone branch (after worktree removal so ref is unlocked)
         try {
             nativeBranchDelete(originalBasePath_, milestoneBranch);

package/dist/resources/extensions/gsd/auto.js

@@ -68,7 +68,7 @@ import { MILESTONE_ID_RE } from "./milestone-ids.js";
 import { updateProgressWidget as _updateProgressWidget, setCompletionProgressWidget, setAutoOutcomeWidget, setAutoActiveStatus, updateSliceProgressCache, clearSliceProgressCache, unitVerb, } from "./auto-dashboard.js";
 import { registerSigtermHandler as _registerSigtermHandler, deregisterSigtermHandler as _deregisterSigtermHandler, } from "./auto-supervisor.js";
 import { isDbAvailable, getMilestone, getMilestoneSlices, } from "./gsd-db.js";
-import { closeWorkflowDatabase } from "./db-workspace.js";
+import { checkpointWorkflowDatabase, closeWorkflowDatabase } from "./db-workspace.js";
 import { markLatestActiveForWorkerCanceled } from "./db/unit-dispatches.js";
 import { writeUnitRuntimeRecord } from "./unit-runtime.js";
 import { countPendingCaptures } from "./captures.js";
@@ -651,6 +651,11 @@ export function stopAutoRemote(projectRoot) {
  * The normal stop path stays SIGTERM-only so cooperative sessions can clean up;
  * this path is only for the explicit "Force start" action.
  */
+// Grace window between SIGTERM and SIGKILL so the target can run its cleanup
+// handler (lock release, DB snapshot flush, worktree teardown). Polled so a
+// process that exits early is not made to wait the full window.
+const FORCE_STOP_GRACE_MS = 3000;
+const FORCE_STOP_POLL_MS = 100;
 export function forceStopAutoRemote(projectRoot) {
     const lock = readCrashLock(projectRoot);
     if (!lock)
@@ -665,6 +670,14 @@ export function forceStopAutoRemote(projectRoot) {
     }
     try {
         process.kill(lock.pid, "SIGTERM");
+        // Poll for graceful exit before escalating. Synchronous sleep keeps this
+        // function sync for its callers (Atomics.wait times out with no notify).
+        const deadline = Date.now() + FORCE_STOP_GRACE_MS;
+        while (Date.now() < deadline) {
+            if (!isLockProcessAlive(lock))
+                break;
+            Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, FORCE_STOP_POLL_MS);
+        }
         if (isLockProcessAlive(lock)) {
             process.kill(lock.pid, "SIGKILL");
         }
@@ -1089,6 +1102,12 @@ export async function stopAuto(ctx, pi, reason, options = {}) {
     const installTerminalCloseoutOutcome = completionStopRequested && preserveCloseoutTranscript;
     const preserveCompletionSurface = completionStopRequested || preserveCloseoutTranscript;
     s.completionStopInProgress = preserveCompletionSurface;
+    try {
+        checkpointWorkflowDatabase();
+    }
+    catch (e) {
+        debugLog("stop-checkpoint-failed", { error: e instanceof Error ? e.message : String(e) });
+    }
     playNotificationBell("stop", loadedPreferences?.notifications);
     // #4764 — telemetry: record the exit reason, isolation mode, whether an auto
     // worktree was active, and whether the current milestone was merged before
@@ -1719,7 +1738,7 @@ export function buildWorktreeLifecycleDeps() {
     //   C4 (#5627) — GitServiceImpl constructor → gitServiceFactory
     //
     // Final WorktreeLifecycleDeps shape: 3 fields (gitServiceFactory,
-    // worktreeProjection, mergeMilestoneToMain transaction runner). Down from 18 at slice-7
+    // worktreeProjection, mergeMilestone transaction runner). Down from 18 at slice-7
     // closure.
     return {
         gitServiceFactory: (basePath) => {
@@ -1727,7 +1746,7 @@ export function buildWorktreeLifecycleDeps() {
             return new GitServiceImpl(basePath, gitConfig);
         },
         worktreeProjection: new WorktreeStateProjection(),
-        mergeMilestoneToMain: createMilestoneMergeTransaction(mergeMilestoneToMain),
+        mergeMilestone: createMilestoneMergeTransaction(mergeMilestoneToMain),
     };
 }
 function buildLifecycle() {
@@ -1770,6 +1789,7 @@ function buildLoopDeps(pi, ctx) {
         stopAuto,
         pauseAuto,
         clearUnitTimeout,
+        checkpointWorkflowDatabase,
         updateProgressWidget,
         ...cmux,
         handleLostSessionLock: (ctx, lockStatus) => {

package/dist/resources/extensions/gsd/bootstrap/db-tools.js

@@ -674,12 +674,14 @@ export function registerDbTools(pi) {
                 inputs: Type.Array(Type.String(), { description: "Array<string> of input files or references; pass [\"path\"] or [], never a single string" }),
                 expectedOutput: Type.Array(Type.String(), { description: "Array<string> of files this task creates or overwrites; pass [\"path\"] or [], never prose or a single string" }),
                 observabilityImpact: Type.Optional(Type.String({ description: "Task observability impact" })),
+                targetRepositories: Type.Optional(Type.Array(Type.String(), { description: "Repository id(s) this task touches (parent workspace); must match a Declared Repository. Omit for single-repo projects." })),
             }), { description: "Optional full task replacement for the slice. Omit for incremental planning, then call gsd_plan_task once per task." })),
             // ── Enrichment metadata (optional — defaults to empty) ────────────
             successCriteria: Type.Optional(Type.String({ description: "Slice success criteria block" })),
             proofLevel: Type.Optional(Type.String({ description: "Slice proof level" })),
             integrationClosure: Type.Optional(Type.String({ description: "Slice integration closure" })),
             observabilityImpact: Type.Optional(Type.String({ description: "Slice observability impact" })),
+            targetRepositories: Type.Optional(Type.Array(Type.String(), { description: "Slice-wide default repository id(s) (parent workspace); must match a Declared Repository. Omit for single-repo projects." })),
             // Single-writer v3 audit trail (Stream 2): caller-provided actor identity + causation.
             actorName: Type.Optional(Type.String({ description: "Caller-provided actor identity for the audit trail (e.g. 'executor-01', 'gsd-orchestrator')" })),
             triggerReason: Type.Optional(Type.String({ description: "Caller-provided reason this action was triggered (e.g. 'plan-phase complete')" })),
@@ -749,6 +751,7 @@ export function registerDbTools(pi) {
             inputs: Type.Array(Type.String(), { description: "Array<string> of input files or references; pass [\"path\"] or [], never a single string" }),
             expectedOutput: Type.Array(Type.String(), { description: "Array<string> of files this task creates or overwrites; pass [\"path\"] or [], never prose or a single string" }),
             observabilityImpact: Type.Optional(Type.String({ description: "Task observability impact" })),
+            targetRepositories: Type.Optional(Type.Array(Type.String(), { description: "Repository id(s) this task touches (parent workspace); must match a Declared Repository. Omit for single-repo projects." })),
             // Single-writer v3 audit trail (Stream 2): caller-provided actor identity + causation.
             actorName: Type.Optional(Type.String({ description: "Caller-provided actor identity for the audit trail (e.g. 'executor-01', 'gsd-orchestrator')" })),
             triggerReason: Type.Optional(Type.String({ description: "Caller-provided reason this action was triggered (e.g. 'plan-phase complete')" })),