@tekyzinc/gsd-t 4.0.29 → 4.2.10

package/CHANGELOG.md

@@ -2,6 +2,43 @@
 
 All notable changes to GSD-T are documented here. Updated with each release.
 
+## [4.2.10] - 2026-06-05 (M83 Left-Shifted Plan Hardening - minor)
+
+### Added - Plan-phase hardening: catch dead deliverables and edge cases BEFORE execute
+
+Left-shifts failure detection from verify to plan. Adversarial validation (the Red Team) ran only at verify — after code exists — so a milestone whose headline capability shipped as DEAD CODE (the NiceNote M5 incident: a 100MB+ chunked reader built but never wired into `openPath`, with no test exercising it) burned **four verify cycles** re-litigating the milestone's reason to exist. The root cause was in the plan: it never bound each acceptance criterion to a code path + a killing test, and nothing adversarial reviewed the design before code was written. The `plan` phase now runs two blocking gates before execute.
+
+- **Acceptance-traceability gate** (deterministic) — `bin/gsd-t-traceability-gate.cjs`, dispatched as `gsd-t traceability-gate`. Parses `.gsd-t/domains/*/tasks.md`; every behavioral task (one declaring acceptance criteria) must bind its ACs to a `**Files**` code path AND a named killing test; a `**Headline:** true` task must have BOTH a real implementation path and a test. Exit 4 blocks execute. Field detection is emphasis-stripped + colon-position-agnostic (`**Label**:` ≡ `**Label:**`); task blocks are detected by any non-structural heading bearing an AC (descriptive headings are not dropped); the test check is tied to the Test/Files/AC fields only (an incidental runner word in a Dependencies note does not clear it); pytest `test_*.py` / `*_test.py` conventions are preserved.
+- **Adversarial pre-mortem** (generative) — `templates/prompts/pre-mortem-subagent.md`, an opus, fresh-context, assume-the-plan-is-flawed reviewer wired into the plan workflow. Predicts edge-case / dead-deliverable / NFR / shallow-test failures and converts each blocking finding into a **required test** the plan must adopt (advisory notes forbidden — that is how M5's chunk reader shipped three data-loss bugs across three cycles). Verdict `BLOCK` / `CLEARED`.
+- The two gates are the temporal dual of the Red Team: attack the design at plan, not just the code at verify. The deterministic gate runs first and fails CLOSED (an unevaluable gate blocks); the pre-mortem cannot approve a gate-blocked plan.
+- New CLI `gsd-t traceability-gate [--milestone Mxx] [--tasks FILE]` (exit 0/4/64), added to project + global bin tools. Contract `.gsd-t/contracts/plan-hardening-contract.md` v1.0.0 STABLE. `gsd-t-plan.md` + the phase-workflow plan objective updated to require traceable tasks up front.
+- **Verification**: orthogonal triad ran. Adversarial Workflow Red Team (Opus, fresh context) FAILed first pass (1 CRITICAL — colon-inside-bold markdown defeated all field detection, silently passing the literal M5 dead-code plan — + 2 HIGH + 2 MEDIUM), all fixed; re-validation found a regression the CRITICAL fix introduced (underscore-stripping broke pytest paths, HIGH), fixed; final re-validation GRUDGING-PASS (14/14 checks, no new HIGH/CRITICAL). Real-sandbox acceptance gate passed (gate fires through the Workflow sandbox and blocks the bad plan). Suite 1372/0/4 (+15 M83 tests). Self-tested against the actual NiceNote M5 dead-code plan — the gate FAILs it at plan time, which is the milestone's reason to exist.
+- Origin: review of the NiceNote 9-milestone build, where the triad caught real bugs at verify but late; the user's proposal for an adversarial risk-assessment agent at plan.
+
+### Versioning
+
+Minor bump 4.1.10 → 4.2.10 (new feature, additive; patch reset to 10).
+
+## [4.1.10] - 2026-06-05 (M82 Competition Mode - minor)
+
+### Added - Competition Mode: generate-and-judge for upstream, pre-contract phases
+
+The *generative* dual of the orthogonal validation triad. The triad is adversarial (many critics, one candidate → a filter); Competition Mode is generative (many candidates, one judge → a generator). GSD-T historically filtered hard but **generated singly** — every upstream artifact was a single draft. Competition Mode adds the missing generator on the phases where it pays. **Watershed rule:** generate-and-judge ABOVE the contract; attack-and-filter BELOW it.
+
+- **Opt-in `--competition N`** (N clamped 2–5; default off) on eligible upstream phases: `partition`, `milestone`, `discuss`, `design-decompose`. Ignored (single producer, logged) on ineligible phases (plan/impact/prd/doc-ripple) and impossible on post-contract phases (execute/verify/…).
+- **Producers = Self-MoA** — N samples of ONE strong model (opus), diversified by prompt *angle* (max-parallelism / simplicity / risk-isolation / dependency-depth / balance), not by a model zoo. Evidence (Self-MoA, arXiv 2502.00674): aggregation is far more sensitive to candidate quality than diversity; mixing models injects low-quality candidates. No debate — producers stay independent.
+- **Objective judge for partition (the v1 beachhead)** — `bin/gsd-t-competition-judge.cjs --kind partition` scores candidate decompositions via the SAME file-disjointness oracle the dispatcher uses (`bin/gsd-t-file-disjointness.cjs`): parallelGroups / waveDepth / validity. A calculator, not an LLM critic → immune to position/verbosity/self-preference bias. Touch paths normalized (`./a` ≡ `a`, `//`, backslashes, trailing slash, dedupe; case preserved).
+- **Subjective judge for milestone/discuss/design** — blind + deterministically-shuffled + different-model (sonnet) + rubric-scored; the winner is finalized deterministically by `--kind generic` (highest weighted score; reproducible tiebreak; zero inference in the substrate).
+- **Two-gate selection policy** (synthesize only when candidate-quality-uniform AND artifact-is-list-shaped; else pick-one) + three artifact classes (coupled-thesis → pick-one; line-items → union/dedup; structurally-validated → synthesize+re-validate). The finalizer does pick-one-at-thesis + union-at-line-item-level, then partition re-validates the graft via the oracle and BLOCKS on a reintroduced overlap.
+- **New CLI**: `gsd-t competition-judge [--in SPEC.json] [--project-dir P]` (exit 0 winner / 4 no valid candidate / 64 bad input). Added to project + global bin tools.
+- **Contract**: `.gsd-t/contracts/competition-mode-contract.md` v1.0.0 STABLE (6 invariants).
+- **Verification**: orthogonal triad ran. Adversarial Workflow Red Team (Opus, fresh context) FAILed first pass (3 HIGH + 2 MEDIUM), all fixed, re-validation Red Team GRUDGING-PASS (all 5 fixed, no new HIGH/CRITICAL). Real-sandbox acceptance gate passed (judge integration ran end-to-end in the Workflow sandbox). Suite 1357/0/4 (+6 M82 tests). **SC#1 measured on M82's own partition: competition (3 producers) → 3 parallel groups vs N=1 baseline's 1 (3× parallelism), invalid overlap candidate correctly disqualified.** SC#3 position-bias probe: order-invariant winner (100%).
+- Origin: brainstorm 2026-06-05 grounded in 2 deep-research runs (best-of-N/judge/debate + synthesis-vs-pick-one/MoA/Frankenstein).
+
+### Versioning
+
+Minor bump 4.0.29 → 4.1.10 (new feature, additive; patch reset to 10).
+
 ## [4.0.29] - 2026-06-05 (M81 Workflows Runtime-Native - patch)
 
 ### Fixed - TD-113: 6 of 7 workflows (+ quick) crashed in the Workflow sandbox and had never run

package/README.md

@@ -122,8 +122,14 @@ gsd-t build-coverage --json                             # M57: new top-level pat
 gsd-t ci-parity --json                                  # M57: reproduce the project's actual CI build locally (auto docker build)
 gsd-t test-data --list [--run ID] [--json]              # M58: list test-data ledger entries
 gsd-t test-data --purge --run ID [--dry-run] [--json]   # M58: purge tagged test data after Verify (Step 4.5)
+gsd-t competition-judge --in SPEC.json [--project-dir P] # M82: generate-and-judge selection oracle (partition / generic)
+gsd-t traceability-gate --milestone Mxx [--project-dir P] # M83: plan-phase acceptance-traceability gate (AC → path → killing test)
 ```
 
+**Plan Hardening (M83).** The `plan` phase now runs two blocking gates before execute, so a plan can't ship a dead deliverable: a deterministic **acceptance-traceability gate** (`gsd-t traceability-gate` — every AC must bind to a code path + a killing test; the headline capability needs both impl and test) and an adversarial **pre-mortem** agent (opus, fresh-context, predicts edge-case/NFR/dead-deliverable failures and requires a test for each). The temporal dual of the Red Team — attack the design at plan, not just the code at verify. Origin: a build where the headline capability shipped as dead code and burned 4 verify cycles. See `.gsd-t/contracts/plan-hardening-contract.md`.
+
+**Competition Mode (M82).** Opt-in `--competition N` (N 2–5) on upstream, pre-contract phases (`/gsd-t-partition`, `/gsd-t-milestone`, `/gsd-t-design-decompose`) fans out N parallel candidate producers and a judge selects the winner — the generative dual of the orthogonal validation triad. Partition uses an *objective* file-disjointness oracle as the judge (a calculator, not a biased critic); subjective phases use a blind + different-model + rubric judge. Default off. See `.gsd-t/contracts/competition-mode-contract.md`.
+
 `gsd-t parallel` consumes the M44 task-graph (D1) and applies three pre-spawn gates (D4 depgraph validation → D5 file-disjointness → D6 economics) followed by mode-aware headroom/split math. Extends — does not replace — the M40 orchestrator. Contract: `.gsd-t/contracts/wave-join-contract.md` v1.1.0.
 
 Each iteration runs as a fresh `claude -p` session. A cumulative debug ledger (`.gsd-t/debug-state.jsonl`) preserves hypothesis/fix/learning history across sessions. An anti-repetition preamble prevents retrying failed approaches.

package/bin/gsd-t-competition-judge.cjs

@@ -0,0 +1,344 @@
+"use strict";
+
+/**
+ * gsd-t-competition-judge — M82 D1
+ *
+ * The selection oracle for Competition Mode (generate-and-judge on upstream,
+ * pre-contract phases). Given N candidate artifacts produced by parallel
+ * producers, score them and emit a winner — the GENERATIVE dual of the
+ * orthogonal validation triad (which is adversarial: many critics, one
+ * candidate). Contract: .gsd-t/contracts/competition-mode-contract.md v1.0.0.
+ *
+ * Two judge modes, chosen by `--kind`:
+ *
+ *   --kind partition  → OBJECTIVE judge (the v1 beachhead). Each candidate is a
+ *       proposed domain decomposition: a list of domains, each with a write-
+ *       touch list. We score it with the SAME disjointness oracle the real
+ *       parallel dispatcher uses (bin/gsd-t-file-disjointness.cjs), so the judge
+ *       is a CALCULATOR, not a critic — it sidesteps every LLM-judge bias
+ *       (position / verbosity / self-preference). Metrics, higher-is-better
+ *       unless noted:
+ *         - valid             : zero write-target overlaps across domains (HARD gate)
+ *         - parallelGroups    : count of disjoint domains that can fan out at once
+ *         - waveDepth         : serial gates (sequential groups + 1 if any) — LOWER better
+ *         - unprovableCount   : domains with no touch list — LOWER better (safe-default seq)
+ *       Ranking: invalid candidates are disqualified; among valid ones, rank by
+ *       (parallelGroups desc, waveDepth asc, unprovableCount asc, domainCount asc).
+ *
+ *   --kind generic   → records a SUBJECTIVE judge's verdict. The numeric scoring
+ *       lives in the rubric the Workflow's judge agent fills in (blind+shuffled,
+ *       different-model, rubric-scored — see the contract). This CLI only
+ *       validates/normalizes the rubric scores the agent supplies and picks the
+ *       winner deterministically (highest weighted score; ties → lowest index of
+ *       the ORIGINAL, pre-shuffle order to keep selection reproducible). It does
+ *       NOT call an LLM — keeping inference out of the deterministic substrate
+ *       (per feedback_deterministic_orchestration + anthropic-key-measurement-only).
+ *
+ * Input: a JSON spec on stdin OR via --in <path>. Shapes:
+ *
+ *   partition: {
+ *     "kind": "partition",
+ *     "candidates": [
+ *       { "id": "A", "domains": [ { "name": "d1", "touches": ["a.js","b.js"] }, ... ] },
+ *       ...
+ *     ]
+ *   }
+ *
+ *   generic: {
+ *     "kind": "generic",
+ *     "axes": [ { "key": "coherence", "weight": 1 }, { "key": "completeness", "weight": 1 }, ... ],
+ *     "candidates": [
+ *       { "id": "A", "scores": { "coherence": 4, "completeness": 3, ... } },
+ *       ...
+ *     ]
+ *   }
+ *
+ * Output (JSON envelope, the shape runCli parses):
+ *   {
+ *     ok: boolean,            // true unless input was unusable
+ *     exitCode: 0 | 4 | 64,
+ *     kind, n,
+ *     winner: <candidateId|null>,
+ *     ranked: [ { id, valid?, parallelGroups?, waveDepth?, unprovableCount?, score?, rank } ],
+ *     reason?: string
+ *   }
+ *
+ * Exit codes: 0 ok+winner · 4 ok but NO valid candidate (all disqualified) · 64 bad input.
+ *
+ * Hard rules (mirrors the disjointness prover's discipline):
+ *   - Zero external runtime deps (Node built-ins only).
+ *   - Never throws — always emits an envelope.
+ *   - Pure / read-only — no project mutation. Deterministic given the same input.
+ */
+
+const fs = require("node:fs");
+
+// The objective partition judge reuses the production disjointness oracle so the
+// judge's notion of "parallelizable" is byte-identical to the dispatcher's.
+let proveDisjointness;
+try {
+  ({ proveDisjointness } = require("./gsd-t-file-disjointness.cjs"));
+} catch {
+  proveDisjointness = null;
+}
+
+// ─── Partition scoring (objective) ───────────────────────────────────────
+
+/**
+ * Score one candidate partition by running its domains through the disjointness
+ * oracle. Each domain becomes a pseudo-task {id, domain, touches}; we never hit
+ * git history (every domain carries an explicit touch list or is counted
+ * unprovable), so scoring is pure and deterministic.
+ *
+ * @returns {{valid, domainCount, parallelGroups, sequentialGroups, unprovableCount, waveDepth}}
+ */
+// Normalize a touch path to a stable file identity so two spellings of the SAME
+// file (./bin/x.js vs bin/x.js, trailing slash, backslashes, redundant ./ or //)
+// are detected as a conflict. Without this, an overlapping partition could be
+// scored `valid` and WIN — then the real dispatcher would hit a write conflict.
+// Note: case is preserved (most CI runs on case-sensitive Linux); collapsing case
+// here would create false conflicts on case-sensitive repos. Path identity only.
+function _normPath(p) {
+  if (typeof p !== "string") return "";
+  let s = p.trim().replace(/\\/g, "/");        // backslashes -> forward
+  s = s.replace(/\/+/g, "/");                    // collapse repeated slashes
+  s = s.replace(/^\.\//, "");                    // drop leading ./
+  while (s.includes("/./")) s = s.replace("/./", "/"); // drop interior /./
+  s = s.replace(/\/+$/, "");                      // drop trailing slash
+  return s;
+}
+
+function scorePartition(candidate, projectDir) {
+  const domains = Array.isArray(candidate.domains) ? candidate.domains : [];
+  const tasks = domains.map((d, i) => ({
+    id: `${candidate.id}:${d.name || `d${i}`}`,
+    domain: d.name || `d${i}`,
+    // Only honor an explicit touch list — never let the oracle fall through to
+    // git history during scoring (would make the judge non-deterministic).
+    // Normalize + de-dupe so path-spelling variants are caught as real conflicts.
+    touches: Array.isArray(d.touches)
+      ? Array.from(new Set(d.touches.map(_normPath).filter(Boolean)))
+      : [],
+  }));
+
+  // Run the real oracle when available; otherwise fall back to a self-contained
+  // overlap check so the judge still works if the lib isn't co-located.
+  const res = proveDisjointness
+    ? proveDisjointness({ tasks, projectDir })
+    : _localDisjoint(tasks);
+
+  const parallelGroups = (res.parallel || []).length;
+  const sequentialGroups = (res.sequential || []).filter(
+    (g) => !(g.length === 1 && (res.unprovable || []).includes(g[0])),
+  ).length;
+  const unprovableCount = (res.unprovable || []).length;
+
+  // VALID = no two domains with declared touch lists write the same file. An
+  // overlap shows up as a sequential group of size ≥2 among provable tasks.
+  const overlapGroup = (res.sequential || []).some((g) => g.length >= 2);
+  const valid = !overlapGroup;
+
+  // waveDepth: 1 wave for the disjoint fan-out, +1 per serial bottleneck
+  // (overlapping/unprovable domains that must run after). Fewer = better.
+  const serialBottlenecks = sequentialGroups + unprovableCount;
+  const waveDepth = (parallelGroups > 0 ? 1 : 0) + (serialBottlenecks > 0 ? 1 : 0) || 1;
+
+  return {
+    valid,
+    domainCount: domains.length,
+    parallelGroups,
+    sequentialGroups,
+    unprovableCount,
+    waveDepth,
+  };
+}
+
+// Self-contained overlap fallback (only used if the oracle lib is absent).
+function _localDisjoint(tasks) {
+  const parallel = [];
+  const sequential = [];
+  const unprovable = [];
+  const provable = [];
+  for (const t of tasks) {
+    if (!t.touches || t.touches.length === 0) {
+      unprovable.push(t);
+      sequential.push([t]);
+    } else {
+      provable.push(t);
+    }
+  }
+  // union-find over file overlap
+  const parent = provable.map((_, i) => i);
+  const find = (i) => {
+    while (parent[i] !== i) { parent[i] = parent[parent[i]]; i = parent[i]; }
+    return i;
+  };
+  for (let i = 0; i < provable.length; i++) {
+    for (let j = i + 1; j < provable.length; j++) {
+      const a = new Set(provable[i].touches);
+      if (provable[j].touches.some((f) => a.has(f))) {
+        const ra = find(i), rb = find(j);
+        if (ra !== rb) parent[ra] = rb;
+      }
+    }
+  }
+  const groups = new Map();
+  for (let i = 0; i < provable.length; i++) {
+    const r = find(i);
+    if (!groups.has(r)) groups.set(r, []);
+    groups.get(r).push(provable[i]);
+  }
+  for (const g of groups.values()) (g.length === 1 ? parallel : sequential).push(g);
+  return { parallel, sequential, unprovable };
+}
+
+// Drop candidates that are not usable objects with a string id (Red Team MED-4:
+// the 'never throws' guarantee is on the function, not just the CLI shell — an
+// in-process caller passing [null] or {id:{}} must not crash, and a non-string id
+// could never match `c.id === winnerId` in the workflow anyway).
+function _safeCandidates(candidates) {
+  return (Array.isArray(candidates) ? candidates : []).filter(
+    (c) => c && typeof c === "object" && typeof c.id === "string" && c.id.length > 0,
+  );
+}
+
+function rankPartitions(rawCandidates, projectDir) {
+  const candidates = _safeCandidates(rawCandidates);
+  const scored = candidates.map((c) => ({ id: c.id, ...scorePartition(c, projectDir) }));
+  // Disqualify invalid (file-overlap) candidates from winning, but keep them in
+  // the ranking so the caller can see why they lost.
+  const valid = scored.filter((s) => s.valid);
+  const cmp = (a, b) =>
+    b.parallelGroups - a.parallelGroups ||      // more concurrency wins
+    a.waveDepth - b.waveDepth ||                 // fewer serial gates wins
+    a.unprovableCount - b.unprovableCount ||     // fewer unknowns wins
+    a.domainCount - b.domainCount;               // simpler (fewer domains) wins
+  valid.sort(cmp);
+  const invalid = scored.filter((s) => !s.valid);
+  const ordered = [...valid, ...invalid];
+  ordered.forEach((s, i) => { s.rank = i + 1; });
+  return { ranked: ordered, winner: valid.length ? valid[0].id : null };
+}
+
+// ─── Generic scoring (subjective rubric, deterministic selection) ────────
+
+function rankGeneric(spec) {
+  const axes = Array.isArray(spec.axes) && spec.axes.length
+    ? spec.axes
+    : [{ key: "quality", weight: 1 }];
+  const candidates = _safeCandidates(spec.candidates);
+  const scored = candidates.map((c, idx) => {
+    const scores = c.scores || {};
+    let total = 0;
+    let weightSum = 0;
+    for (const ax of axes) {
+      const w = Number(ax.weight) || 0;
+      const v = Number(scores[ax.key]) || 0;
+      total += w * v;
+      weightSum += w;
+    }
+    const score = weightSum > 0 ? total / weightSum : 0;
+    return { id: c.id, score: Number(score.toFixed(4)), _idx: idx };
+  });
+  // Highest weighted score wins; ties broken by ORIGINAL index (reproducible,
+  // immune to candidate-order shuffling done for bias control upstream).
+  scored.sort((a, b) => b.score - a.score || a._idx - b._idx);
+  scored.forEach((s, i) => { s.rank = i + 1; delete s._idx; });
+  return { ranked: scored, winner: scored.length ? scored[0].id : null };
+}
+
+// ─── Driver ──────────────────────────────────────────────────────────────
+
+function judge(spec, projectDir) {
+  const candidates = Array.isArray(spec && spec.candidates) ? spec.candidates : [];
+  if (!candidates.length) {
+    return { ok: false, exitCode: 64, kind: spec && spec.kind, n: 0, winner: null, ranked: [], reason: "no-candidates" };
+  }
+  const kind = spec.kind === "generic" ? "generic" : "partition";
+  const { ranked, winner } = kind === "partition"
+    ? rankPartitions(candidates, projectDir)
+    : rankGeneric(spec);
+  const ok = winner != null;
+  return {
+    ok,
+    exitCode: ok ? 0 : 4,
+    kind,
+    n: candidates.length,
+    winner,
+    ranked,
+    ...(ok ? {} : { reason: kind === "partition" ? "no-valid-candidate" : "no-candidates" }),
+  };
+}
+
+function readInput(opts) {
+  if (opts.in) return fs.readFileSync(opts.in, "utf8");
+  // stdin
+  try {
+    return fs.readFileSync(0, "utf8");
+  } catch {
+    return "";
+  }
+}
+
+function parseArgs(argv) {
+  const opts = { json: true, in: null, projectDir: process.cwd(), help: false };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--help" || a === "-h") opts.help = true;
+    else if (a === "--in") opts.in = argv[++i];
+    else if (a === "--project-dir") opts.projectDir = argv[++i];
+    else if (a === "--json") opts.json = true;
+  }
+  return opts;
+}
+
+const HELP = `Usage: gsd-t competition-judge [--in PATH] [--project-dir PATH]
+
+Reads a candidate-set JSON spec (stdin or --in) and emits a ranked winner.
+
+  --in PATH          Read spec from file instead of stdin.
+  --project-dir PATH Project root (default: cwd).
+  --json             Emit JSON envelope (default; always on).
+
+Spec.kind:
+  "partition"  Objective oracle judge — scores domain decompositions via the
+               file-disjointness prover (parallelGroups / waveDepth / validity).
+  "generic"    Deterministic rubric selector — picks the highest weighted score
+               from rubric values an upstream judge agent supplied.
+
+Exit codes: 0 winner · 4 no valid candidate · 64 bad input.`;
+
+function main() {
+  const opts = parseArgs(process.argv.slice(2));
+  if (opts.help) {
+    process.stdout.write(HELP + "\n");
+    process.exit(0);
+  }
+  let spec;
+  try {
+    const raw = readInput(opts);
+    spec = JSON.parse(raw);
+  } catch (e) {
+    const env = { ok: false, exitCode: 64, kind: null, n: 0, winner: null, ranked: [], reason: `bad-input: ${e && e.message}` };
+    process.stdout.write(JSON.stringify(env, null, 2) + "\n");
+    process.exit(64);
+  }
+  let result;
+  try {
+    result = judge(spec, opts.projectDir);
+  } catch (e) {
+    result = { ok: false, exitCode: 64, kind: spec && spec.kind, n: 0, winner: null, ranked: [], reason: `judge-error: ${e && e.message}` };
+  }
+  process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+  process.exit(result.exitCode);
+}
+
+if (require.main === module) main();
+
+module.exports = {
+  judge,
+  scorePartition,
+  rankPartitions,
+  rankGeneric,
+  _internal: { _localDisjoint, _normPath },
+};