@pareto4/pp-core 1.5.4 → 1.6.1

package/pp-core/bin/lib/check-command-router.cjs

@@ -23,6 +23,10 @@ const phaseLocatorMod = require("./phase-locator.cjs");
 const { findPhaseInternal } = phaseLocatorMod;
 const decisions_cjs_1 = require("./decisions.cjs");
 const ui_safety_gate_cjs_1 = require("./ui-safety-gate.cjs");
+const semver_compare_cjs_1 = require("./semver-compare.cjs");
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const projectRootMod = require("./project-root.cjs");
+const { findProjectRoot } = projectRootMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const verifyModule = require("./verify.cjs");
 const { cmdVerifySchemaDrift, cmdVerifyCodebaseDrift } = verifyModule;
@@ -345,7 +349,7 @@ function cmdDecisionCoverageVerify(projectDir, args, raw) {
  * Returns JSON: { frontend: boolean, hasUiSpec: boolean, block: boolean }
  *   block = frontend && !hasUiSpec (gate fires when UI work is detected but no spec exists)
  *
- * Invocable as: gsd_run check ui-plan-gate <phase>
+ * Invocable as: pp_run check ui-plan-gate <phase>
  *
  * Uses checkUiPresence from ui-safety-gate.cjs — does NOT reimplement frontend detection.
  * Uses getRoadmapPhaseWithFallback + findPhaseInternal from leaf modules for phase data.
@@ -455,8 +459,8 @@ function cmdUiPlanGate(projectDir, args, raw) {
  *   block = frontend && hasUiFiles && !hasUiSpec
  *
  * Args: check ui-safety-gate <phase>
- * Invocable as: gsd_run check ui-safety-gate <phase>
- *             or gsd_run check ui.safety-gate <phase> (dots normalized to hyphens)
+ * Invocable as: pp_run check ui-safety-gate <phase>
+ *             or pp_run check ui.safety-gate <phase> (dots normalized to hyphens)
  *
  * Uses checkUiPresence from ui-safety-gate.cjs — does NOT reimplement frontend detection.
  * Checks whether any files changed in recent git history match frontend file patterns.
@@ -701,7 +705,7 @@ function cmdTddReviewCheckpoint(projectDir, args, raw) {
  * This gate is always advisory (passed: true) — it never blocks phase advancement.
  *
  * Args: check gap-analysis.plan-post <phase-dir> [phase-req-ids]
- * Invocable as: gsd_run check gap-analysis.plan-post <phase-dir> [phase-req-ids]
+ * Invocable as: pp_run check gap-analysis.plan-post <phase-dir> [phase-req-ids]
  */
 function cmdGapAnalysisPlanPost(projectDir, args, raw) {
     // args[0] = 'check', args[1] = 'gap-analysis-plan-post' (normalized), args[2] = phaseDir, args[3] = phaseReqIds
@@ -727,12 +731,182 @@ function cmdGapAnalysisPlanPost(projectDir, args, raw) {
         message: result.table || result.summary || '',
     }, raw, undefined);
 }
+const DRIFT_SEVERITY_ORDINAL = {
+    none: 0,
+    minor: 1,
+    major: 2,
+    breaking: 3,
+};
+/**
+ * Classify drift severity from pinned vs latest semver tuples.
+ *
+ * Pre-condition: compareSemverCore(pinned, latest) < 0 (pinned is strictly behind).
+ * Severity mapping (A3):
+ *   differing major → 'major'  (breaking aliased to major; semver can't distinguish)
+ *   equal major, differing minor → 'minor'
+ *   equal major+minor, differing patch → 'none'  (below minor; always warn, not block)
+ */
+function classifyDriftSeverity(pinned, latest) {
+    const [pMaj, pMin] = (0, semver_compare_cjs_1.toNumericTuple)(pinned);
+    const [lMaj, lMin] = (0, semver_compare_cjs_1.toNumericTuple)(latest);
+    if (lMaj > pMaj)
+        return 'major';
+    if (lMin > pMin)
+        return 'minor';
+    return 'none'; // patch-level difference
+}
+/**
+ * Read pareto.drift_block_on from .planning/config.json.
+ * Returns 'major' (default) when config is absent, malformed, or the key is unset.
+ */
+function readParetoConfig(projectDir) {
+    const configPath = node_path_1.default.join(projectDir, '.planning', 'config.json');
+    try {
+        const parsed = JSON.parse(node_fs_1.default.readFileSync(configPath, 'utf-8'));
+        const pareto = parsed['pareto'] ?? {};
+        const raw = pareto['drift_block_on'];
+        if (typeof raw === 'string' && raw in DRIFT_SEVERITY_ORDINAL) {
+            return { drift_block_on: raw };
+        }
+    }
+    catch { /* config absent or malformed → use default */ }
+    return { drift_block_on: 'major' };
+}
+/**
+ * Resolve the latest stable tag for a platform repo via git ls-remote.
+ *
+ * T-10-04: every candidate tag is filtered through isStableTripletSemver — never shell-eval.
+ * Returns '' when offline or the remote is unreachable (callers treat this as "unknown latest").
+ */
+function resolveLatestTagViaGitRemote(repoShortPath) {
+    // Construct GitLab URL from "group/project" format (e.g. "pareto4/pareto-platform-gcp").
+    const remoteUrl = `https://gitlab.com/${repoShortPath}`;
+    try {
+        const lsOutput = (0, node_child_process_1.execFileSync)('git', ['ls-remote', '--tags', '--refs', '--sort=-v:refname', remoteUrl], { encoding: 'utf-8', timeout: 10_000, maxBuffer: 512 * 1024, windowsHide: true });
+        // Sort is descending by version (--sort=-v:refname) so the first isStableTripletSemver match
+        // is the latest stable tag. T-10-04: never use an unfiltered tag string.
+        const tag = lsOutput
+            .split('\n')
+            .map((line) => {
+            const m = line.match(/\brefs\/tags\/([^\s^]+)$/);
+            return m ? m[1].trim() : '';
+        })
+            .find((t) => t && (0, semver_compare_cjs_1.isStableTripletSemver)(t));
+        return tag ?? '';
+    }
+    catch {
+        return ''; // offline or unreachable → signals "unknown latest" (Pitfall 4)
+    }
+}
+/**
+ * ship.platform-drift query handler (HOOK-02).
+ *
+ * Derives a graded severity verdict from the pinned-vs-latest platform tag diff,
+ * maps it to the pareto.drift_block_on threshold, and degrades safely:
+ *   - Inert when .platform-bindings.json is absent (HOOK-04 runtime file layer).
+ *   - Non-blocking warn when latest is unresolved or offline (T-10-06, Pitfall 4).
+ *
+ * Verdict shape: { status: 'inert'|'pass'|'warn'|'block', block, severity, pinned, latest, present }
+ *   block (boolean) mirrors status === 'block' — the uniform gate contract field the host
+ *   loop reads regardless of which capability owns the gate.
+ *
+ * Invocable as: pp_run check ship.platform-drift [--latest-tag <tag>] [--raw]
+ * The dot → hyphen normalization in routeCheckCommand maps "ship.platform-drift"
+ * to the "ship-platform-drift" branch.
+ *
+ * Reuse:
+ *   - Phase 7 reader contract: reads .platform-bindings.json directly at repo root
+ *     (same find/parse/TOCTOU pattern as cmdValidateBindings in platform-bindings.cts).
+ *   - semver-compare.cjs: toNumericTuple, compareSemverCore, isStableTripletSemver
+ *     (no reimplemented semver; no shell-eval of tag strings).
+ */
+function cmdShipPlatformDrift(cwd, args, raw) {
+    // Step 1: Resolve project root (same approach as cmdValidateBindings in platform-bindings.cts).
+    let root;
+    try {
+        root = findProjectRoot(cwd) || cwd;
+    }
+    catch {
+        root = cwd;
+    }
+    // Step 1b: HOOK-04 runtime file layer — absent → inert (never error(), opt-in default).
+    const bindingsPath = node_path_1.default.join(root, '.platform-bindings.json');
+    if (!node_fs_1.default.existsSync(bindingsPath)) {
+        output({ status: 'inert', block: false, present: false }, raw, undefined);
+        return;
+    }
+    // Step 2: Parse .platform-bindings.json (malformed structure → graceful warn, not block).
+    let bindingsObj;
+    try {
+        const parsed = JSON.parse(node_fs_1.default.readFileSync(bindingsPath, 'utf-8'));
+        if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+            output({
+                status: 'warn', block: false, severity: 'none',
+                pinned: null, latest: null, present: true,
+                message: 'Malformed .platform-bindings.json structure — drift check skipped',
+            }, raw, undefined);
+            return;
+        }
+        bindingsObj = parsed;
+    }
+    catch {
+        // TOCTOU guard — file vanished between existsSync and readFileSync → inert path.
+        output({ status: 'inert', block: false, present: false }, raw, undefined);
+        return;
+    }
+    // Extract platform.tag (PINNED) and platform.repo for remote tag resolution.
+    const platformField = (typeof bindingsObj['platform'] === 'object' &&
+        bindingsObj['platform'] !== null &&
+        !Array.isArray(bindingsObj['platform'])) ? bindingsObj['platform'] : null;
+    const pinned = typeof platformField?.['tag'] === 'string' ? platformField['tag'].trim() : '';
+    const platformRepo = typeof platformField?.['repo'] === 'string' ? platformField['repo'].trim() : '';
+    // Guard: missing or invalid pinned tag → advisory warn, do not block.
+    if (!pinned || !(0, semver_compare_cjs_1.isStableTripletSemver)(pinned)) {
+        output({
+            status: 'warn', block: false, severity: 'none',
+            pinned: pinned || null, latest: null, present: true,
+            message: 'platform.tag is missing or not a valid semver in .platform-bindings.json — drift check advisory only',
+        }, raw, undefined);
+        return;
+    }
+    // Step 3: Resolve LATEST via --latest-tag arg (deterministic) or git ls-remote (live).
+    const latestTagArgIdx = args.indexOf('--latest-tag');
+    let latest = latestTagArgIdx >= 0 ? (args[latestTagArgIdx + 1] ?? '') : '';
+    if (!latest && platformRepo) {
+        // T-10-04: resolveLatestTagViaGitRemote filters all tags through isStableTripletSemver.
+        latest = resolveLatestTagViaGitRemote(platformRepo);
+    }
+    // Step 4: Offline / unresolved latest → non-blocking warn (T-10-06, Pitfall 4).
+    // A disconnected dev or CI run must never be blocked by an unresolvable remote.
+    if (!latest || !(0, semver_compare_cjs_1.isStableTripletSemver)(latest)) {
+        output({
+            status: 'warn', block: false, severity: 'none',
+            pinned, latest: latest || null, present: true,
+            message: 'Latest platform tag could not be resolved (offline or unreachable remote) — drift check advisory only',
+        }, raw, undefined);
+        return;
+    }
+    // Step 4b: Pinned is current or ahead of latest → pass.
+    if ((0, semver_compare_cjs_1.compareSemverCore)(pinned, latest) >= 0) {
+        output({ status: 'pass', block: false, severity: 'none', pinned, latest, present: true }, raw, undefined);
+        return;
+    }
+    // Step 5: Classify drift severity from tuple diff (A3; breaking aliased to major for now).
+    const severity = classifyDriftSeverity(pinned, latest);
+    // Step 6: Read pareto.drift_block_on threshold (default 'major').
+    const { drift_block_on: threshold } = readParetoConfig(cwd);
+    const thresholdOrd = DRIFT_SEVERITY_ORDINAL[threshold] ?? DRIFT_SEVERITY_ORDINAL['major'];
+    const severityOrd = DRIFT_SEVERITY_ORDINAL[severity];
+    // Step 7: Emit verdict — block when severity ≥ threshold, warn otherwise.
+    const status = severityOrd >= thresholdOrd ? 'block' : 'warn';
+    output({ status, block: status === 'block', severity, pinned, latest, present: true }, raw, undefined);
+}
 function routeCheckCommand({ args, cwd, raw }) {
     // Normalize dots to hyphens in the subcommand so both forms are accepted.
     // This makes `check.query = "ui.plan-gate"` (dotted form in capability.json gates)
-    // directly runnable as `gsd_run check ui.plan-gate` — the dot is normalized to
+    // directly runnable as `pp_run check ui.plan-gate` — the dot is normalized to
     // `ui-plan-gate` before routing. The generic gate-dispatch in §5.6 reads
-    // `check.query` from the active gate hook and runs `gsd_run check ${hook.check.query}`,
+    // `check.query` from the active gate hook and runs `pp_run check ${hook.check.query}`,
     // so the declared query must be dispatchable exactly as declared.
     const rawSubcommand = args[1];
     const subcommand = typeof rawSubcommand === 'string' ? rawSubcommand.replace(/\./g, '-') : rawSubcommand;
@@ -764,6 +938,13 @@ function routeCheckCommand({ args, cwd, raw }) {
         cmdUiSafetyGate(cwd, args, raw);
         return;
     }
+    if (subcommand === 'ship-platform-drift') {
+        // ship.platform-drift — graded platform-tag drift check (HOOK-02).
+        // Dot-to-hyphen normalization means query "ship.platform-drift" routes here.
+        // Reuses Phase 7 reader contract + semver-compare; inert when bindings absent (HOOK-04).
+        cmdShipPlatformDrift(cwd, args, raw);
+        return;
+    }
     if (subcommand === 'verify-schema-drift') {
         // Delegates to verify.schema-drift — drift capability gate at execute:wave:post (blocking).
         // Dot-to-hyphen normalization means query "verify.schema-drift" routes here.
@@ -783,11 +964,11 @@ function routeCheckCommand({ args, cwd, raw }) {
         // The deterministic test-tier prohibition PRODUCER/gate (#1259, ADR-550 D5d). Locates the
         // wired mechanical check (node-test or lint-rule), confirms fail-first, runs it, builds
         // enforcementEvidence, and emits the dispositionForProhibition verdict. Invocable as
-        // `gsd_run check prohibition-enforcement <request.json>`.
+        // `pp_run check prohibition-enforcement <request.json>`.
         (0, prohibition_enforcement_cjs_1.routeProhibitionEnforcement)(args, raw);
         return;
     }
-    error('Unknown check subcommand. Available: auto-mode, decision-coverage-plan, decision-coverage-verify, gap-analysis-plan-post, prohibition-enforcement, tdd-review-checkpoint, ui-plan-gate, ui-safety-gate, verify-schema-drift, verify-codebase-drift', ERROR_REASON.SDK_UNKNOWN_COMMAND);
+    error('Unknown check subcommand. Available: auto-mode, decision-coverage-plan, decision-coverage-verify, gap-analysis-plan-post, prohibition-enforcement, ship-platform-drift, tdd-review-checkpoint, ui-plan-gate, ui-safety-gate, verify-schema-drift, verify-codebase-drift', ERROR_REASON.SDK_UNKNOWN_COMMAND);
 }
 module.exports = {
     routeCheckCommand,
@@ -797,4 +978,5 @@ module.exports = {
     computeUiSafetyGate,
     cmdGapAnalysisPlanPost,
     cmdTddReviewCheckpoint,
+    cmdShipPlatformDrift,
 };

package/pp-core/bin/lib/cjs-command-router-adapter.cjs

@@ -2,7 +2,7 @@
 /**
  * CJS Command Router Adapter Module
  *
- * Compatibility routing for gsd-tools.cjs command families. Uses generated
+ * Compatibility routing for pp-tools.cjs command families. Uses generated
  * command metadata for availability and small family-local argument shapers for
  * CJS handler calls.
  *

package/pp-core/bin/lib/clusters.cjs

@@ -20,6 +20,7 @@ exports.CLUSTERS = void 0;
 exports.allClusteredSkills = allClusteredSkills;
 exports.CLUSTERS = Object.freeze({
     core_loop: Object.freeze([
+        'init',
         'new-project',
         'discovery',
         'discuss-phase',

package/pp-core/bin/lib/code-review-flags.cjs

@@ -16,7 +16,7 @@ exports.resolveCodeReviewWorkflow = resolveCodeReviewWorkflow;
 /**
  * Parse code-review flags from an argv array. The first positional argument
  * (phase number) is ignored — phase validation is handled by
- * `gsd-tools query init.phase-op`. Unknown flags are silently ignored.
+ * `pp-tools query init.phase-op`. Unknown flags are silently ignored.
  */
 function parseCodeReviewFlags(argv) {
     const flags = {

package/pp-core/bin/lib/command-aliases.cjs

@@ -583,6 +583,13 @@ exports.NON_FAMILY_COMMAND_ALIASES = [
         ],
         "mutation": false
     },
+    {
+        "canonical": "check.ship-platform-drift",
+        "aliases": [
+            "check ship-platform-drift"
+        ],
+        "mutation": false
+    },
     {
         "canonical": "commit",
         "aliases": [],

package/pp-core/bin/lib/config-loader.cjs

@@ -502,7 +502,7 @@ function loadConfig(cwd, options = {}) {
             const warnKey = unknownKeys.join(',');
             if (!_warnedUnknownConfigKeys.has(warnKey)) {
                 _warnedUnknownConfigKeys.add(warnKey);
-                process.stderr.write(`gsd-tools: warning: unknown config key(s) in .planning/config.json: ${unknownKeys.join(', ')} — these will be ignored\n`);
+                process.stderr.write(`pp-tools: warning: unknown config key(s) in .planning/config.json: ${unknownKeys.join(', ')} — these will be ignored\n`);
             }
         }
         // #2517 — Validate runtime/tier values

package/pp-core/bin/lib/config.cjs

@@ -749,7 +749,7 @@ function cmdConfigPath(cwd, _raw, workstreamContext = null) {
  *
  * Wraps the Configuration Module's migrateOnDisk() for the CLI surface. This
  * is the Phase 2 acceptance-criteria deliverable for opt-in migration (#3536):
- * users can run `gsd-tools migrate-config` to apply all four legacy-key
+ * users can run `pp-tools migrate-config` to apply all four legacy-key
  * migrations to their .planning/config.json without having to load any config
  * implicitly via another command.
  *

package/pp-core/bin/lib/context-utilization.cjs

@@ -8,7 +8,7 @@
  * Pure function. Callers pass tokensUsed + contextWindow; the
  * classifier returns the percent and one of three states. Recommendation
  * strings are NOT in this module — formatting is the renderer's job
- * (see `validate context` in gsd-tools.cjs). That separation lets the
+ * (see `validate context` in pp-tools.cjs). That separation lets the
  * copy change without touching this module's tests.
  *
  * Thresholds:

package/pp-core/bin/lib/docs.cjs

@@ -241,7 +241,7 @@ function detectMonorepoWorkspaces(cwd) {
  * resolution. Follows the cmdInitMapCodebase pattern.
  *
  * @example
- * node gsd-tools.cjs docs-init --raw
+ * node pp-tools.cjs docs-init --raw
  */
 function cmdDocsInit(cwd, raw) {
     const config = loadConfig(cwd);

package/pp-core/bin/lib/frontmatter.cjs

@@ -367,7 +367,7 @@ function parseMustHavesBlock(content, blockName) {
     if (items.length === 0 && blockLines.length > 0) {
         const nonEmptyLines = blockLines.filter(l => l.trim() !== '').length;
         if (nonEmptyLines > 0) {
-            process.stderr.write(`[gsd-tools] WARNING: must_haves.${blockName} block has ${nonEmptyLines} content lines but parsed 0 items. ` +
+            process.stderr.write(`[pp-tools] WARNING: must_haves.${blockName} block has ${nonEmptyLines} content lines but parsed 0 items. ` +
                 `Possible YAML formatting issue — verification will fall back to LLM-derived truths.\n`);
         }
     }

package/pp-core/bin/lib/git-base-branch.cjs

@@ -208,9 +208,9 @@ function gitWorktreeInfoInternal(cwd) {
 }
 // ─── CLI entry point ──────────────────────────────────────────────────────────
 /**
- * CLI command: `gsd-tools git base-branch`
+ * CLI command: `pp-tools git base-branch`
  * Resolves the default branch and writes it to stdout (raw string, newline-terminated).
- * Called by workflows via `gsd_run query git.base-branch`.
+ * Called by workflows via `pp_run query git.base-branch`.
  */
 function cmdGitBaseBranch(cwd, _args, deps) {
     const branch = resolveBaseBranch(cwd, deps);

package/pp-core/bin/lib/graphify-command-router.cjs

@@ -1,9 +1,9 @@
 'use strict';
 /**
- * Graphify command router — CLI subcommand dispatcher for `gsd-tools graphify`.
+ * Graphify command router — CLI subcommand dispatcher for `pp-tools graphify`.
  *
  * ADR-959 (phase 4d-impl-2) pilot: first real capability command cutover.
- * Extracted from the hardcoded `case 'graphify':` arm in gsd-tools.cjs.
+ * Extracted from the hardcoded `case 'graphify':` arm in pp-tools.cjs.
  * Behaviour is preserved byte-for-behaviour from the prior inline case;
  * the dispatch path now flows: default → dispatchCapabilityCommand →
  * require(graphify-command-router.cjs) → routeGraphifyCommand.
@@ -34,7 +34,7 @@ function routeGraphifyCommand({ args, cwd, raw, error, _graphify }) {
     if (subcommand === 'query') {
         const term = args[2];
         if (!term) {
-            error('Usage: gsd-tools graphify query <term>', ERROR_REASON.USAGE);
+            error('Usage: pp-tools graphify query <term>', ERROR_REASON.USAGE);
             return;
         }
         const budgetIdx = args.indexOf('--budget');
@@ -42,7 +42,7 @@ function routeGraphifyCommand({ args, cwd, raw, error, _graphify }) {
         if (budgetIdx !== -1) {
             const rawBudget = args[budgetIdx + 1];
             if (rawBudget === undefined || Number.isNaN(parseInt(rawBudget, 10))) {
-                error('Usage: gsd-tools graphify query <term> [--budget <N>]', ERROR_REASON.USAGE);
+                error('Usage: pp-tools graphify query <term> [--budget <N>]', ERROR_REASON.USAGE);
                 return;
             }
             budget = parseInt(rawBudget, 10);

package/pp-core/bin/lib/graphify.cjs

@@ -20,7 +20,7 @@ const { isCapabilityActive } = capabilityStateMod;
  * Return the standard disabled response object.
  */
 function disabledResponse() {
-    return { disabled: true, message: 'graphify is not enabled. Enable with: gsd-tools config-set graphify.enabled true' };
+    return { disabled: true, message: 'graphify is not enabled. Enable with: pp-tools config-set graphify.enabled true' };
 }
 // ─── Subprocess Helper ───────────────────────────────────────────────────────
 /**

package/pp-core/bin/lib/gsd2-import.cjs

@@ -392,7 +392,7 @@ function writePlanningDir(artifacts, planningRoot) {
 }
 // ─── Command Handler ──────────────────────────────────────────────────────────
 /**
- * Entry point called from gsd-tools.cjs.
+ * Entry point called from pp-tools.cjs.
  * Supports: --force, --dry-run, --path <dir>
  */
 function cmdFromGsd2(args, cwd, raw) {

package/pp-core/bin/lib/init-command-router.cjs

@@ -1,7 +1,7 @@
 "use strict";
 /**
  * Manifest-backed init subcommand router.
- * Keeps gsd-tools.cjs thin while preserving existing command semantics.
+ * Keeps pp-tools.cjs thin while preserving existing command semantics.
  *
  * Phase 6: all init.* subcommands have SDK equivalents and are dispatched
  * via executeForCjs (the sync bridge). CJS fallback retained when:

package/pp-core/bin/lib/init.cjs

@@ -1218,7 +1218,7 @@ function cmdInitManager(cwd, raw) {
         const safe = tokens.every((t) => /^--[a-zA-Z0-9][-a-zA-Z0-9]*$/.test(t) ||
             /^[a-zA-Z0-9][-a-zA-Z0-9_.]*$/.test(t));
         if (!safe) {
-            process.stderr.write(`gsd-tools: warning: manager.flags contains invalid tokens, ignoring: ${val}\n`);
+            process.stderr.write(`pp-tools: warning: manager.flags contains invalid tokens, ignoring: ${val}\n`);
             return '';
         }
         return val;

package/pp-core/bin/lib/intel-command-router.cjs

@@ -1,10 +1,10 @@
 'use strict';
 /**
- * Intel command router — CLI subcommand dispatcher for `gsd-tools intel`.
+ * Intel command router — CLI subcommand dispatcher for `pp-tools intel`.
  *
  * ADR-959 (phase 4d-impl-4): intel command family cutover — last first-party
  * command cutover in the initial capability rollout.
- * Extracted from the hardcoded `case 'intel':` arm in gsd-tools.cjs.
+ * Extracted from the hardcoded `case 'intel':` arm in pp-tools.cjs.
  * Behaviour is preserved byte-for-behaviour from the prior inline case;
  * the dispatch path now flows: default → dispatchCapabilityCommand →
  * require(intel-command-router.cjs) → routeIntelCommand.
@@ -56,7 +56,7 @@ function routeIntelCommand({ args, cwd, raw, error, _intel, _core }) {
     if (subcommand === 'query') {
         const term = args[2];
         if (!term) {
-            error('Usage: gsd-tools intel query <term>', ERROR_REASON.USAGE);
+            error('Usage: pp-tools intel query <term>', ERROR_REASON.USAGE);
             return;
         }
         const planningDir = path.join(cwd, '.planning');
@@ -85,7 +85,7 @@ function routeIntelCommand({ args, cwd, raw, error, _intel, _core }) {
     else if (subcommand === 'patch-meta') {
         const filePath = args[2];
         if (!filePath) {
-            error('Usage: gsd-tools intel patch-meta <file-path>', ERROR_REASON.USAGE);
+            error('Usage: pp-tools intel patch-meta <file-path>', ERROR_REASON.USAGE);
             return;
         }
         c.output(intel.intelPatchMeta(path.resolve(cwd, filePath)), raw);
@@ -97,7 +97,7 @@ function routeIntelCommand({ args, cwd, raw, error, _intel, _core }) {
     else if (subcommand === 'extract-exports') {
         const filePath = args[2];
         if (!filePath) {
-            error('Usage: gsd-tools intel extract-exports <file-path>', ERROR_REASON.USAGE);
+            error('Usage: pp-tools intel extract-exports <file-path>', ERROR_REASON.USAGE);
             return;
         }
         c.output(intel.intelExtractExports(path.resolve(cwd, filePath)), raw);

package/pp-core/bin/lib/intel.cjs

@@ -240,7 +240,7 @@ function intelUpdate(planningDir) {
         return disabledResponse();
     return {
         action: 'spawn_agent',
-        message: 'Run gsd-tools intel update or spawn gsd-intel-updater agent for full refresh',
+        message: 'Run pp-tools intel update or spawn gsd-intel-updater agent for full refresh',
     };
 }
 /**

package/pp-core/bin/lib/io.cjs

@@ -161,7 +161,7 @@ const ERROR_REASON = Object.freeze({
     CONFIG_NO_FILE: 'config_no_file',
     CONFIG_PARSE_FAILED: 'config_parse_failed',
     CONFIG_INVALID_KEY: 'config_invalid_key',
-    // SDK / gsd-tools dispatch
+    // SDK / pp-tools dispatch
     SDK_FAIL_FAST: 'sdk_fail_fast',
     SDK_UNKNOWN_COMMAND: 'sdk_unknown_command',
     SDK_MISSING_ARG: 'sdk_missing_arg',
@@ -175,13 +175,15 @@ const ERROR_REASON = Object.freeze({
     HOOKS_OPT_OUT: 'hooks_opt_out',
     // security-scan
     SECURITY_SCAN_FAILED: 'security_scan_failed',
+    // platform-bindings
+    PLATFORM_BINDINGS_PARSE_FAILED: 'platform_bindings_parse_failed',
     // generic
     USAGE: 'usage',
     UNKNOWN: 'unknown',
 });
 /**
  * Process-level flag: when true, error() emits structured JSON to stderr
- * instead of plain "Error: <message>" text. Set by gsd-tools.cjs when the
+ * instead of plain "Error: <message>" text. Set by pp-tools.cjs when the
  * CLI is invoked with `--json-errors`. Tests opt in to typed-IR error
  * assertions by passing that flag and parsing the JSON.
  *

package/pp-core/bin/lib/loop-resolver.cjs

@@ -10,7 +10,7 @@
  * at plan:pre (ui-phase) and autonomous.md at verify:post (ui-review). Further per-feature
  * cutovers are ongoing.
  *
- * Command surface: gsd-tools loop render-hooks <point>
+ * Command surface: pp-tools loop render-hooks <point>
  *
  * Exports (three things):
  *   resolveLoopHooks({ point, registry, config }) → { point, activeHooks }

package/pp-core/bin/lib/phase-command-router.cjs

@@ -1,7 +1,7 @@
 "use strict";
 /**
  * Manifest-backed phase subcommand router.
- * Keeps gsd-tools.cjs thin while preserving existing command semantics.
+ * Keeps pp-tools.cjs thin while preserving existing command semantics.
  *
  * Unsupported in this router:
  * - scaffold: routed through top-level scaffold command.

package/pp-core/bin/lib/phases-command-router.cjs

@@ -1,7 +1,7 @@
 "use strict";
 /**
  * Manifest-backed phases subcommand router.
- * Keeps gsd-tools.cjs thin while preserving current CJS semantics.
+ * Keeps pp-tools.cjs thin while preserving current CJS semantics.
  *
  * Unsupported in this router (treated as unknown):
  * - archive: `phases archive` is excluded from the subcommands list so it

package/pp-core/bin/lib/plan-drift-guard.cjs

@@ -8,7 +8,7 @@
  * Design constraints:
  *   - Pure module: no I/O, no require() calls, no side effects.
  *   - All inputs are validated; unknown values throw a TypeError.
- *   - Consumed by the `gsd-tools drift-guard` CLI seam and by tests.
+ *   - Consumed by the `pp-tools drift-guard` CLI seam and by tests.
  *
  * Authority ladder (rung values determine MISSING severity):
  *   grep=0  intel=1  treesitter=2  lsp=3  scip=4