@tekyzinc/gsd-t 4.13.11 → 4.14.10

package/scripts/gsd-t-graph-intercept.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * gsd-t-graph-intercept.js — M97
+ * gsd-t-graph-intercept.js — M97/M99
  *
  * A PostToolUse hook on the `Grep` tool. When Claude runs a grep that is actually
  * a STRUCTURAL question (who-calls / who-imports / a bare symbol), this answers it
@@ -21,8 +21,19 @@
  *   - No graph in this project → pure no-op.
  *   - Original grep hits are RETAINED beneath the graph answer (no silent hiding).
  *
+ * M99 D2:
+ *   - Presence check uses D1's resolver (resolveStorePath) — never re-derives the path.
+ *   - Layer-2a logging: one ledger line per decision (replaced + passthrough) via
+ *     append_ledger_line. Consumer resolved from GSDT_GRAPH_CONSUMER env or
+ *     payload hook_data.consumer; falls back to 'cli'. Fail-open.
+ *
  * [RULE] graph-intercept-fail-open-never-breaks-grep
  * [RULE] graph-intercept-structural-only-text-passes-through
+ * [RULE] presence-check-repointed
+ * [RULE] byte-identical-on-off
+ * [RULE] fail-open
+ * [RULE] import-resolver-never-hardcode
+ * [RULE] consumer-label-from-context-not-setenv
  */
 
 'use strict';
@@ -58,29 +69,93 @@ function resolveQueryCli(cwd) {
   return null;
 }
 
+// M99 D2: load D1's resolver module (resolveStorePath + append_ledger_line).
+// [RULE] import-resolver-never-hardcode / [RULE] presence-check-repointed
+function loadResolver(cwd) {
+  try {
+    const pkgLocal = path.join(__dirname, '..', 'bin', 'gsd-t-graph-store-resolver.cjs');
+    const projLocal = path.join(cwd, 'bin', 'gsd-t-graph-store-resolver.cjs');
+    const resolverPath = fs.existsSync(pkgLocal) ? pkgLocal
+      : fs.existsSync(projLocal) ? projLocal
+      : null;
+    if (!resolverPath) return null;
+    return require(resolverPath);
+  } catch { return null; }
+}
+
+// M99 D2: resolve consumer label from env or payload; falls back to 'cli'.
+// [RULE] consumer-label-from-context-not-setenv
+function resolveConsumer(payload) {
+  if (process.env.GSDT_GRAPH_CONSUMER) return process.env.GSDT_GRAPH_CONSUMER;
+  if (payload && payload.hook_data && typeof payload.hook_data.consumer === 'string') {
+    return payload.hook_data.consumer;
+  }
+  return 'cli';
+}
+
+// M99 D2: emit one Layer-2a ledger line. Fail-open — never alters the decision.
+// [RULE] fail-open  [RULE] byte-identical-on-off
+function logDecision(appendFn, cwd, consumer, classified, action, patternShape) {
+  if (!appendFn) return;
+  try {
+    appendFn({
+      kind: 'grep',
+      ts: new Date().toISOString(),
+      classified,
+      action,
+      patternShape: String(patternShape).slice(0, 200),
+      consumer,
+    }, cwd);
+  } catch { /* FAIL-OPEN: sink error never propagates */ }
+}
+
 function main(payload) {
   // Only act on Grep.
   if (!payload || payload.tool_name !== 'Grep') passThrough();
 
   const cwd = payload.cwd || process.cwd();
 
-  // Must be a GSD-T project with a graph present.
+  // Must be a GSD-T project.
   if (!fs.existsSync(path.join(cwd, '.gsd-t'))) passThrough();
-  if (!fs.existsSync(path.join(cwd, '.gsd-t', 'graph.db'))) passThrough();
+
+  // M99 D2: repoint presence check at D1's resolver. [RULE] presence-check-repointed
+  const resolver = loadResolver(cwd);
+  const storePath = resolver ? resolver.resolveStorePath(cwd) : null;
+  if (!storePath || !fs.existsSync(storePath)) passThrough();
 
   const pattern = payload.tool_input && payload.tool_input.pattern;
   if (typeof pattern !== 'string' || !pattern) passThrough();
 
+  // Resolve consumer and logging sink BEFORE the classify decision.
+  const consumer = resolveConsumer(payload);
+  const appendFn = resolver && typeof resolver.append_ledger_line === 'function'
+    ? resolver.append_ledger_line : null;
+
   // Classify (the classifier itself fails safe → text).
   let cls;
   try {
     const { classifyGrep } = require(path.join(__dirname, '..', 'bin', 'gsd-t-grep-classifier.cjs'));
     cls = classifyGrep(pattern);
-  } catch { passThrough(); }
-  if (!cls || !cls.structural) passThrough();
+  } catch {
+    // Classifier unavailable — passthrough without logging (no classified info to log)
+    passThrough();
+  }
+
+  if (!cls || !cls.structural) {
+    // Text-classified passthrough — log one line per the contract.
+    // [RULE] byte-identical-on-off: logging is a side-channel; passthrough is unchanged.
+    const classified = (cls && cls.classified) || 'text';
+    const patternShape = (cls && cls.patternShape) || pattern.slice(0, 80);
+    logDecision(appendFn, cwd, consumer, classified, 'passthrough', patternShape);
+    passThrough();
+  }
 
   const cliPath = resolveQueryCli(cwd);
-  if (!cliPath) passThrough();
+  if (!cliPath) {
+    // Structural but no CLI — log passthrough, pass through.
+    logDecision(appendFn, cwd, consumer, 'structural', 'passthrough', cls.patternShape || pattern.slice(0, 80));
+    passThrough();
+  }
 
   // Query the graph. who-calls for symbols/calls; who-imports for imports.
   // For a bare symbol we ALSO try who-imports so the model sees both usages.
@@ -118,8 +193,14 @@ function main(payload) {
     }
   }
 
-  // No graph answer → pass the grep through (don't replace with nothing).
-  if (!sections.length) passThrough();
+  // No graph answer → log passthrough (structural query but empty result), pass through.
+  if (!sections.length) {
+    logDecision(appendFn, cwd, consumer, 'structural', 'passthrough', cls.patternShape || pattern.slice(0, 80));
+    passThrough();
+  }
+
+  // Graph answered — log replaced, then emit.
+  logDecision(appendFn, cwd, consumer, 'structural', 'replaced', cls.patternShape || pattern.slice(0, 80));
 
   // Build the replacement: graph answer first (labeled), original grep beneath.
   const original = payload.tool_response || payload.tool_output || '';

package/scripts/gsd-t-read-intercept.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * gsd-t-read-intercept.js — M98
+ * gsd-t-read-intercept.js — M98/M99
  *
  * A PostToolUse hook on the `Read` tool. When Claude reads an INDEXED code file
  * with an offset+limit that lands inside exactly one known function's line range,
@@ -21,10 +21,22 @@
  *       updatedToolOutput: "<original file output> + graph note" } }
  *   ...or nothing (exit 0) to pass the Read through unchanged.
  *
+ * M99 D2:
+ *   - Presence check and Database open use D1's resolver (resolveStorePath) — never re-derive path.
+ *   - Layer-2b logging: one line per augment/passthrough decision via append_ledger_line.
+ *     Consumer resolved from GSDT_GRAPH_CONSUMER env or payload hook_data.consumer or 'cli'.
+ *     Fail-open: a throwing sink never alters the decision or the output.
+ *
  * INVARIANTS:
- *   [RULE] read-intercept-fail-open          — any error / missing graph / non-code → pass through
- *   [RULE] read-intercept-augment-never-shrink — only APPEND; never replace the file body
- *   [RULE] read-intercept-structural-only      — augment ONLY when offset+limit ∈ one funcId range
+ *   [RULE] read-intercept-fail-open             — any error / missing graph / non-code → pass through
+ *   [RULE] read-intercept-augment-never-shrink  — only APPEND; never replace the file body
+ *   [RULE] read-intercept-structural-only       — augment ONLY when offset+limit ∈ one funcId range
+ *   [RULE] presence-check-repointed             — M99: presence + DB open via resolver, never literal
+ *   [RULE] byte-identical-on-off                — logging is a side-channel; decision unchanged
+ *   [RULE] fail-open                            — sink error never propagates
+ *   [RULE] import-resolver-never-hardcode       — import resolver, never re-derive path
+ *   [RULE] augment-never-shrink-kept            — M98 augment-never-shrink rule KEPT
+ *   [RULE] consumer-label-from-context-not-setenv
  *   - NEVER calls Read/Grep (loop guard). Reads the graph DB directly (read-only).
  *   - No graph in this project → pure no-op.
  */
@@ -63,15 +75,63 @@ function emitAugment(original, note) {
   process.exit(0);
 }
 
+// M99 D2: load D1's resolver module.
+// [RULE] import-resolver-never-hardcode / [RULE] presence-check-repointed
+function loadResolver(cwd) {
+  try {
+    const pkgLocal = path.join(__dirname, '..', 'bin', 'gsd-t-graph-store-resolver.cjs');
+    const projLocal = path.join(cwd, 'bin', 'gsd-t-graph-store-resolver.cjs');
+    const resolverPath = fs.existsSync(pkgLocal) ? pkgLocal
+      : fs.existsSync(projLocal) ? projLocal
+      : null;
+    if (!resolverPath) return null;
+    return require(resolverPath);
+  } catch { return null; }
+}
+
+// M99 D2: resolve consumer label from env or payload.
+// [RULE] consumer-label-from-context-not-setenv
+function resolveConsumer(payload) {
+  if (process.env.GSDT_GRAPH_CONSUMER) return process.env.GSDT_GRAPH_CONSUMER;
+  if (payload && payload.hook_data && typeof payload.hook_data.consumer === 'string') {
+    return payload.hook_data.consumer;
+  }
+  return 'cli';
+}
+
+// M99 D2: emit one Layer-2b ledger line. Fail-open — never alters the decision.
+// [RULE] fail-open  [RULE] byte-identical-on-off
+function logDecision(appendFn, cwd, consumer, action, filePath) {
+  if (!appendFn) return;
+  try {
+    appendFn({
+      kind: 'read',
+      ts: new Date().toISOString(),
+      action,
+      file: String(filePath).slice(0, 500),
+      consumer,
+    }, cwd);
+  } catch { /* FAIL-OPEN: sink error never propagates */ }
+}
+
 function main(payload) {
   // Only act on Read.
   if (!payload || payload.tool_name !== 'Read') passThrough();
 
   const cwd = payload.cwd || process.cwd();
 
-  // Must be a GSD-T project with a graph present.
+  // Must be a GSD-T project.
   if (!fs.existsSync(path.join(cwd, '.gsd-t'))) passThrough();
-  if (!fs.existsSync(path.join(cwd, '.gsd-t', 'graph.db'))) passThrough();
+
+  // M99 D2: resolve consumer and logging sink early (used in ALL decision branches).
+  const consumer = resolveConsumer(payload);
+  const resolver = loadResolver(cwd);
+  const appendFn = resolver && typeof resolver.append_ledger_line === 'function'
+    ? resolver.append_ledger_line : null;
+
+  // M99 D2: repoint presence check at D1's resolver. [RULE] presence-check-repointed
+  const storePath = resolver ? resolver.resolveStorePath(cwd) : null;
+  if (!storePath || !fs.existsSync(storePath)) passThrough();
 
   const input = payload.tool_input || {};
   const filePath = input.file_path;
@@ -84,7 +144,11 @@ function main(payload) {
   // full-file read has no structural target → pass through (no silent shrinking).
   const offset = Number(input.offset);
   const limit = Number(input.limit);
-  if (!Number.isFinite(offset) || !Number.isFinite(limit) || limit <= 0) passThrough();
+  if (!Number.isFinite(offset) || !Number.isFinite(limit) || limit <= 0) {
+    // Log passthrough for reads with a code file but no structural signal.
+    logDecision(appendFn, cwd, consumer, 'passthrough', filePath);
+    passThrough();
+  }
   const readStart = offset;          // 1-based first line read (Read's offset is 1-based)
   const readEnd = offset + limit - 1;
 
@@ -93,19 +157,17 @@ function main(payload) {
   if (path.isAbsolute(filePath)) rel = path.relative(cwd, filePath);
   rel = rel.split(path.sep).join('/');
 
-  // Find the function whose [start,end] range the read window lands inside, by
-  // enumerating this file's funcIds straight from the graph DB (read-only). Cheaper
-  // and more direct than spawning the query CLL — and it's the same store the CLI reads.
+  // Find the function whose [start,end] range the read window lands inside.
   let match = null;
   try {
-    // Resolve the store loader from the global package (where this hook ships) first,
-    // falling back to the project's own copy — a synthetic project may have neither,
-    // in which case we fail-open (pass through).
+    // M99 D2: open the DB via the resolver-provided store path.
+    // [RULE] presence-check-repointed — storePath comes from D1's resolver, not a literal.
     let requireStore;
     try { requireStore = require(path.join(__dirname, '..', 'bin', 'gsd-t-require-store.cjs')); }
     catch { requireStore = require(path.join(cwd, 'bin', 'gsd-t-require-store.cjs')); }
     const Database = requireStore.requireBetterSqlite();
-    const db = new Database(path.join(cwd, '.gsd-t', 'graph.db'), { readonly: true });
+    // Use the resolver-provided storePath (M99 D2 repoint).
+    const db = new Database(storePath, { readonly: true });
     try {
       const hasEnd = db.prepare('PRAGMA table_info(nodes)').all().some((c) => c.name === 'end_line');
       if (hasEnd) {
@@ -117,9 +179,7 @@ function main(payload) {
           if (!m) continue;
           const start = parseInt(m[1], 10);
           const end = r.end_line;
-          // The read window starts inside this function's [start,end] body.
           if (readStart >= start && readStart <= end) {
-            // Prefer the innermost (largest start) enclosing function.
             if (!match || start > match.start) match = { funcId: r.func_id, name: r.name, start, end };
           }
         }
@@ -127,9 +187,15 @@ function main(payload) {
     } finally {
       try { db.close(); } catch { /* best-effort */ }
     }
-  } catch (_e) { passThrough(); }
+  } catch (_e) {
+    logDecision(appendFn, cwd, consumer, 'passthrough', rel);
+    passThrough();
+  }
 
-  if (!match) passThrough();
+  if (!match) {
+    logDecision(appendFn, cwd, consumer, 'passthrough', rel);
+    passThrough();
+  }
 
   // Build the augment note (appended beneath the original file output, kept intact).
   const original = payload.tool_response || payload.tool_output || '';
@@ -139,6 +205,9 @@ function main(payload) {
     `source + its imports, class header, and callers (≈10× fewer tokens), run:\n` +
     `    gsd-t graph body '${match.funcId}'`;
 
+  // Log augment decision BEFORE emitting (fail-open: if logging throws, decision unchanged).
+  logDecision(appendFn, cwd, consumer, 'augment', rel);
+
   emitAugment(typeof original === 'string' ? original : JSON.stringify(original), note);
 }
 

package/templates/workflows/gsd-t-debug.workflow.js

@@ -90,6 +90,23 @@ const projectDir = _args.projectDir || ".";
 const symptom = _args.symptom || null;
 const milestone = _args.milestone || null; // tags loop-ledger halts so they scope to this milestone
 
+// M99 D2: persist a kind:'wiring' ledger line. M81 sandbox: all I/O through agent() Bash.
+// Uses the `gsd-t graph wiring-log --auto` CLI shim (avoids embedding require() in strings).
+// [RULE] wiring-mode-three-states / [RULE] consumer-label-from-context-not-setenv
+async function persistWiringMode(phaseName) {
+  const consumer = "debug";
+  await agent(
+    [
+      `Persist one graph-wiring-mode ledger line for the debug workflow.`,
+      `Run: \`gsd-t graph wiring-log --consumer ${consumer} --auto --project '${projectDir}'\``,
+      `(--auto detects WIRED if the graph store exists, else fallback-announced)`,
+      `If the command is not found, exit 0 (ledger write is optional).`,
+      `Return ONLY: {"ok": true} or {"ok": false, "reason": "<short reason>"}.`,
+    ].join("\n"),
+    { label: "debug:wiring-ledger", phase: phaseName, model: "haiku", schema: { type: "object", required: ["ok"], properties: { ok: { type: "boolean" }, reason: { type: "string" } } } }
+  ).catch(() => null);
+}
+
 const DEBUG_CYCLE_SCHEMA = {
   type: "object",
   required: ["resolved", "rootCause", "filesEdited"],
@@ -359,6 +376,8 @@ phase("Preflight");
 const pre = await runPreflight(projectDir);
 if (!pre.ok) return { status: "failed", reason: "preflight-failed", preflight: pre.envelope };
 const brief = await generateBrief(projectDir, { kind: "execute", id: "debug-brief" });
+// M99 D2: persist graphWiringMode for the debug consumer. [RULE] wiring-mode-three-states
+await persistWiringMode("Preflight");
 
 // M94-D11 §READER: query graph ONCE before cycles (the structural slice is the same
 // for all cycles — same symptom). Injected into each cycle's prompt.

package/templates/workflows/gsd-t-integrate.workflow.js

@@ -52,6 +52,23 @@ const projectDir = _args.projectDir || ".";
 const milestone  = _args.milestone || null;
 const domains    = _args.domains || [];
 
+// M99 D2: persist a kind:'wiring' ledger line for this workflow.
+// Uses the `gsd-t graph wiring-log --auto` CLI shim (avoids embedding require() in strings).
+// [RULE] wiring-mode-three-states / [RULE] consumer-label-from-context-not-setenv
+async function persistWiringMode(phaseName) {
+  const consumer = "integrate";
+  await agent(
+    [
+      `Persist one graph-wiring-mode ledger line for the integrate workflow.`,
+      `Run: \`gsd-t graph wiring-log --consumer ${consumer} --auto --project '${projectDir}'\``,
+      `(--auto detects WIRED if the graph store exists, else fallback-announced)`,
+      `If the command is not found, exit 0 (ledger write is optional).`,
+      `Return ONLY: {"ok": true, "mode": "<mode>"} or {"ok": false, "reason": "<short reason>"}.`,
+    ].join("\n"),
+    { label: "integrate:wiring-ledger", phase: phaseName, model: "haiku", schema: { type: "object", required: ["ok"], properties: { ok: { type: "boolean" }, mode: { type: "string" }, reason: { type: "string" } } } }
+  ).catch(() => null); // fail-open
+}
+
 const INTEGRATE_SCHEMA = {
   type: "object",
   required: ["status", "crossDomainEdits"],
@@ -71,6 +88,8 @@ phase("Preflight");
 const pre = await runPreflight(projectDir);
 if (!pre.ok) return { status: "failed", reason: "preflight-failed", preflight: pre.envelope };
 const brief = await generateBrief(projectDir, { kind: "execute", milestone, id: `integrate-${(milestone || "m").toLowerCase()}` });
+// M99 D2: persist graphWiringMode for the integrate consumer. [RULE] wiring-mode-three-states
+await persistWiringMode("Preflight");
 
 // M94-D10-T6: Graph Structural Slice — who-imports + blast-radius (ADDITIVE, announced-degradation)
 // [RULE] integrate-uses-graph-for-wiring-verification

package/templates/workflows/gsd-t-phase.workflow.js

@@ -733,6 +733,23 @@ const milestone  = _args.milestone || null;
 const userInput  = _args.userInput || "";
 const phaseName  = _args.phase;
 
+// M99 D2: persist a kind:'wiring' ledger line for this workflow.
+// Uses the `gsd-t graph wiring-log --auto` CLI shim (avoids embedding require() in strings).
+// [RULE] wiring-mode-three-states / [RULE] consumer-label-from-context-not-setenv
+async function persistWiringMode(phaseNameArg) {
+  const consumer = "phase";
+  await agent(
+    [
+      `Persist one graph-wiring-mode ledger line for the phase workflow.`,
+      `Run: \`gsd-t graph wiring-log --consumer ${consumer} --auto --project '${projectDir}'\``,
+      `(--auto detects WIRED if the graph store exists, else fallback-announced)`,
+      `If the command is not found, exit 0 (ledger write is optional).`,
+      `Return ONLY: {"ok": true, "mode": "<mode>"} or {"ok": false, "reason": "<short reason>"}.`,
+    ].join("\n"),
+    { label: "phase:wiring-ledger", phase: phaseNameArg, model: "haiku", schema: { type: "object", required: ["ok"], properties: { ok: { type: "boolean" }, mode: { type: "string" }, reason: { type: "string" } } } }
+  ).catch(() => null); // fail-open
+}
+
 // M84: competition is AUTOMATIC. By default the workflow PROBES the solution space
 // (after brief) and self-decides whether to run a 3-producer + judge competition —
 // no flag needed. Optional manual OVERRIDES: `competition: N` (2-5) forces N
@@ -765,6 +782,8 @@ phase("Preflight");
 const pre = await runPreflight(projectDir);
 if (!pre.ok) return { status: "failed", reason: "preflight-failed", preflight: pre.envelope };
 const brief = await generateBrief(projectDir, { kind: phaseName, milestone, id: `${phaseName}-${(milestone || "m").toLowerCase()}` });
+// M99 D2: persist graphWiringMode for the phase consumer. [RULE] wiring-mode-three-states
+await persistWiringMode("Preflight");
 
 // ── M84: resolve competition AUTOMATICALLY (after brief, before producing) ──
 // Default: probe the solution space and self-decide. Overrides pin it.

package/templates/workflows/gsd-t-quick.workflow.js

@@ -88,6 +88,23 @@ const projectDir = _args.projectDir || ".";
 const task = _args.task || null;
 const model = _args.model || "sonnet";
 
+// M99 D2: persist a kind:'wiring' ledger line. M81 sandbox: all I/O through agent() Bash.
+// Uses the `gsd-t graph wiring-log --auto` CLI shim (avoids embedding require() in strings).
+// [RULE] wiring-mode-three-states / [RULE] consumer-label-from-context-not-setenv
+async function persistWiringMode(phaseName) {
+  const consumer = "quick";
+  await agent(
+    [
+      `Persist one graph-wiring-mode ledger line for the quick workflow.`,
+      `Run: \`gsd-t graph wiring-log --consumer ${consumer} --auto --project '${projectDir}'\``,
+      `(--auto detects WIRED if the graph store exists, else fallback-announced)`,
+      `If the command is not found, exit 0 (ledger write is optional).`,
+      `Return ONLY: {"ok": true} or {"ok": false, "reason": "<short reason>"}.`,
+    ].join("\n"),
+    { label: "quick:wiring-ledger", phase: phaseName, model: "haiku", schema: { type: "object", required: ["ok"], properties: { ok: { type: "boolean" }, reason: { type: "string" } } } }
+  ).catch(() => null);
+}
+
 const QUICK_SCHEMA = {
   type: "object",
   required: ["status", "filesEdited"],
@@ -228,6 +245,8 @@ phase("Preflight");
 const pre = await runPreflight(projectDir);
 if (!pre.ok) return { status: "failed", reason: "preflight-failed", preflight: pre.envelope };
 const brief = await generateBrief(projectDir, { kind: "execute", id: "quick-brief" });
+// M99 D2: persist graphWiringMode for the quick consumer. [RULE] wiring-mode-three-states
+await persistWiringMode("Preflight");
 
 // M94-D11 §READER: query graph for structural impact before the Execute agent reasons
 // [RULE] quick-writer-pattern

package/templates/workflows/gsd-t-scan.workflow.js

@@ -238,29 +238,70 @@ const GRAPH_SLICE_SCHEMA = {
 let structuralSlice = null;   // { deadCode, dangling, clusters, coverage, tier } | null
 let graphWiringMode = "pending"; // "wired" | "fallback-announced" | "disabled"
 
-// M94-D6: runCli — inline async helper that delegates CLI calls to an agent() Bash.
-// M81 invariant: NO require/fs/child_process in the orchestrator body.
-// This is the ONLY way to invoke the D5 query CLI from the sandbox.
-// [RULE] no-graph-baseline-proven-graph-free — this helper is called ONLY when graphMode==="wired".
+// M94-D6: runCli — inline async helper that delegates the D5 graph-query CLI to an
+// agent() Bash. M81 invariant: NO require/fs/child_process in the orchestrator body —
+// the agent runs the command; we read back a SCHEMA-VALIDATED envelope.
+//
+// v4.13.12 HARDENING (root cause of the NiceNote 2026-06-29 silent grep-fallback):
+// the old version told a HAIKU agent to "return ONLY the raw JSON line" and then
+// JSON.parse()'d its free-text reply. Haiku wrapped the JSON in a ```json fence →
+// JSON.parse threw → caught → graph-unavailable → grep-mode, even though the graph
+// was live (status returned ok, 156 files, compiler-accurate). Three fixes, mirroring
+// the proven gsd-t-verify.workflow.js runCli:
+//   1. SCHEMA-validated agent output (StructuredOutput) — the model returns structured
+//      JSON via the tool layer, never fenced text; no brittle JSON.parse of prose.
+//   2. project-local bin → GLOBAL `gsd-t` fallback (a project without a local bin copy
+//      no longer fails the probe — it was hardcoded to `node bin/...cjs`).
+//   3. stderr captured (dropped `2>/dev/null`) and surfaced in `reason` so the fallback
+//      log can say WHY (parse-fail vs not-found vs CLI-error), never a bare "unavailable".
+// [RULE] no-graph-baseline-proven-graph-free — called ONLY when graphMode==="wired".
+// [RULE] graph-probe-schema-validated-never-fence-parsed
+const _GRAPH_CLI_ENVELOPE_SCHEMA = {
+  type: "object",
+  required: ["ok"],
+  additionalProperties: true,
+  properties: {
+    ok:       { type: "boolean", description: "true iff the CLI printed a JSON envelope with ok:true" },
+    reason:   { type: "string",  description: "on failure: graph-unavailable / cli-not-found / cli-error / non-json-output, plus any stderr" },
+    via:      { type: "string",  description: "local | global | error" },
+    results:  { type: "array", items: {}, description: "the verb's results array (dead-code/dangling/cluster/etc.), [] if none" },
+    tier:     { type: "string",  description: "compiler-accurate | tree-sitter-floor | ... when present" },
+    coverage: {                   description: "coverage envelope when the verb returns one" },
+  },
+};
 async function runCli(verb, target, label) {
-  const targetArg = target ? ` ${JSON.stringify(target)}` : "";
-  const cmd = `node bin/gsd-t-graph-query-cli.cjs ${verb}${targetArg} 2>/dev/null || echo '{"ok":false,"reason":"graph-unavailable"}'`;
-  const result = await agent(
+  const targetArg = target ? ` '${String(target).replace(/'/g, "'\\''")}'` : "";
+  const prompt = [
+    `Run the GSD-T graph-query CLI for the project at \`${projectDir}\` and report its result. Steps:`,
+    `1. If \`${projectDir}/bin/gsd-t-graph-query-cli.cjs\` exists, run: \`node ${projectDir}/bin/gsd-t-graph-query-cli.cjs ${verb}${targetArg}\` (set via="local"). Otherwise run: \`gsd-t graph ${verb}${targetArg}\` (set via="global"). Use cwd \`${projectDir}\`. Do NOT redirect stderr — capture it.`,
+    `2. The command prints ONE JSON envelope to stdout. Parse it. Set ok = (the parsed envelope's "ok" field === true). Copy its "results", "tier", and "coverage" fields through if present.`,
+    `3. If the command exits non-zero, prints no JSON, or stdout is not valid JSON: set ok=false and put a short reason in "reason" — "cli-not-found" if the file/binary was missing, else "cli-error", else "non-json-output" — and append the first ~200 chars of stderr.`,
+    `Do NOT do any other work. ONLY run this one command and report the structured result.`,
+  ].join("\n");
+  const r = await agent(prompt, {
+    label: `graph:${label || verb}`,
+    phase: "Graph-Wiring",
+    model: "haiku",
+    schema: _GRAPH_CLI_ENVELOPE_SCHEMA,
+  }).catch((e) => ({ ok: false, reason: `agent-error: ${e && e.message}`, via: "error" }));
+  return r || { ok: false, reason: "graph-unavailable", via: "error" };
+}
+
+// M99 D2: persist a kind:'wiring' ledger line for this workflow.
+// M81 sandbox: all I/O through agent() Bash; no require/fs in the sandbox.
+// Uses the `gsd-t graph wiring-log` CLI shim (avoids embedding require() in strings).
+// [RULE] wiring-mode-three-states / [RULE] consumer-label-from-context-not-setenv
+async function persistWiringMode(mode) {
+  const consumer = "scan";
+  await agent(
     [
-      `Run the following command in \`${projectDir}\` via Bash and return ONLY the raw JSON line it prints (no commentary):`,
-      `\`\`\`bash`,
-      `cd ${JSON.stringify(projectDir)} && ${cmd}`,
-      `\`\`\``,
-      `If the command fails or prints no JSON, return: {"ok":false,"reason":"graph-unavailable"}`,
-      `Return ONLY the JSON, nothing else.`,
+      `Persist one graph-wiring-mode ledger line for the scan workflow.`,
+      `Run: \`gsd-t graph wiring-log --consumer ${consumer} --mode ${mode} --project '${projectDir}'\``,
+      `If the command is not found, exit 0 (ledger write is optional).`,
+      `Return ONLY: {"ok": true} or {"ok": false, "reason": "<short reason>"}.`,
     ].join("\n"),
-    { label: `graph:${label || verb}`, phase: "Graph-Wiring", model: "haiku" }
-  ).catch(() => null);
-  try {
-    return (typeof result === "string") ? JSON.parse(result.trim()) : (result || { ok: false, reason: "graph-unavailable" });
-  } catch (_) {
-    return { ok: false, reason: "graph-unavailable" };
-  }
+    { label: "scan:wiring-ledger", phase: "Graph-Wiring", model: "haiku", schema: { type: "object", required: ["ok"], properties: { ok: { type: "boolean" }, reason: { type: "string" } } } }
+  ).catch(() => null); // fail-open
 }
 
 // Preflight: an agent checks branch + whether a prior register exists, via Bash.
@@ -331,6 +372,7 @@ if (graphMode === "disabled") {
   // ZERO graph calls in this path — [RULE] no-graph-baseline-proven-graph-free.
   graphWiringMode = "disabled";
   log("graph-wiring: DISABLED (no-graph baseline mode — graph-query call-count == 0; AC-4 baseline)");
+  await persistWiringMode("disabled"); // M99 D2: persist wiring mode [RULE] wiring-mode-three-states
 } else {
   // graphMode === "wired": build index if absent, then query structural slice.
   // Step 1: check if index exists and is queryable.
@@ -339,7 +381,8 @@ if (graphMode === "disabled") {
     // Graph unavailable — announce fallback, continue with intact grep-mode scan.
     // [RULE] parser-fail-disables-loud-never-silent (from graph-query-cli-contract)
     graphWiringMode = "fallback-announced";
-    log(`⚠ GRAPH-FALLBACK (ANNOUNCED): graph index not available (${(statusResult && statusResult.reason) || "graph-unavailable"}) — scan continues in full grep-mode (today's architecture, intact). Structural findings from LLM reconstruction only. Build the index (gsd-t graph build) to enable graph-wired accuracy.`);
+    log(`⚠ GRAPH-FALLBACK (ANNOUNCED): graph status probe returned not-ok [reason=${(statusResult && statusResult.reason) || "graph-unavailable"}, via=${(statusResult && statusResult.via) || "?"}] — scan continues in full grep-mode (today's architecture, intact). Structural findings from LLM reconstruction only. Build the index (gsd-t graph build) to enable graph-wired accuracy.`);
+    await persistWiringMode("fallback-announced"); // M99 D2 [RULE] wiring-mode-three-states
   } else {
     // Step 2: query the structural slice (dead-code + dangling + clusters).
     // These are the findings the deep-finders currently reconstruct by reading files (error-prone);
@@ -358,6 +401,7 @@ if (graphMode === "disabled") {
       // All three verbs returned graph-unavailable — announce fallback.
       graphWiringMode = "fallback-announced";
       log(`⚠ GRAPH-FALLBACK (ANNOUNCED): all structural-slice queries returned graph-unavailable — scan continues in full grep-mode. Dead-code / dangling / cluster findings from LLM reconstruction only.`);
+      await persistWiringMode("fallback-announced"); // M99 D2 [RULE] wiring-mode-three-states
     } else {
       // Structural slice assembled — will be injected into scanSlice finder agents.
       structuralSlice = {
@@ -372,8 +416,15 @@ if (graphMode === "disabled") {
         },
         tier: (deadCodeResult && deadCodeResult.tier) || (danglingResult && danglingResult.tier) || "unknown",
       };
-      graphWiringMode = "wired";
+      // M99 Red Team fix: emit "WIRED" (uppercase) to MATCH the --auto router
+      // producers (bin/gsd-t.js:3915) AND the rollup's comparison
+      // (gsd-t-graph-metrics-rollup.cjs:333 `=== "WIRED"`). Lowercase "wired" here
+      // fell through all three rollup branches → a successfully-wired scan reported
+      // WIRED:0, defeating success criterion 13 (the metric M99 exists to surface).
+      // [RULE] wiring-mode-casing-matches-rollup
+      graphWiringMode = "WIRED";
       log(`graph-wiring: WIRED — structural slice ready (dead-code: ${structuralSlice.deadCode.length} candidates, dangling: ${structuralSlice.dangling.length} edges, clusters: ${structuralSlice.clusters.length} groups, tier: ${structuralSlice.tier}). Slice will be INJECTED ADDITIVELY into scanSlice deep-finders. [RULE] scan-injects-structural-slice`);
+      await persistWiringMode("WIRED"); // M99 D2 [RULE] wiring-mode-three-states / wiring-mode-casing-matches-rollup
     }
   }
 }
@@ -698,6 +749,11 @@ function fmtChunks(today) {
   head.push(`**Date:** ${today}`);
   head.push(`**Slices run:** ${slices.length} | **Coverage:** ${coverageComplete ? `FULL - all ${slices.length} slices succeeded` : `PARTIAL - ${succeededCount}/${slices.length} succeeded`}`);
   head.push(`**Verified findings:** ${counts.total}`, "");
+  // M99 D2 T4: stamp graphWiringMode into the header (north-star: invisible fallback leaves a trace).
+  // A `fallback-announced` mode co-occurring with a same-window outcome:'hit' is the machine-visible
+  // NiceNote scan-#12 contradiction. [RULE] wiring-mode-three-states
+  const _wiringEmoji = { "wired": "✅", "fallback-announced": "⚠️", "disabled": "🚫", "pending": "⏳" };
+  head.push(`**Graph wiring:** ${_wiringEmoji[graphWiringMode] || "?"} \`${graphWiringMode}\` (WIRED = graph answered structural queries; fallback-announced = graph unavailable, fell back to grep; disabled = no-graph baseline)`, "");
   head.push(`> Effort estimates use GSD-T-native units (domain / wave / spawn / token-spend). Never human-hours.`);
   head.push(`> TD numbering continues from the prior register (if any, archived). This scan begins at **TD-${tdStart}**.`, "");
   if (!coverageComplete) head.push(`> ⚠️ **PARTIAL COVERAGE - ${failedSlices.length} of ${slices.length} codebase areas were NOT scanned this pass** (failed to return findings): ${ascii(failedSlices.join(", "))}. Findings UNDER-COUNT the real debt. Re-run (resume) for full coverage.`, "");

package/templates/workflows/gsd-t-verify.workflow.js

@@ -230,6 +230,23 @@ const VERDICT_SCHEMA = {
   },
 };
 
+// M99 D2: persist a kind:'wiring' ledger line. M81 sandbox: all I/O through agent() Bash.
+// Uses the `gsd-t graph wiring-log --auto` CLI shim (avoids embedding require() in strings).
+// [RULE] wiring-mode-three-states / [RULE] consumer-label-from-context-not-setenv
+async function persistWiringMode(phaseName) {
+  const consumer = "verify";
+  await agent(
+    [
+      `Persist one graph-wiring-mode ledger line for the verify workflow.`,
+      `Run: \`gsd-t graph wiring-log --consumer ${consumer} --auto --project '${projectDir}'\``,
+      `(--auto detects WIRED if the graph store exists, else fallback-announced)`,
+      `If the command is not found, exit 0 (ledger write is optional).`,
+      `Return ONLY: {"ok": true} or {"ok": false, "reason": "<short reason>"}.`,
+    ].join("\n"),
+    { label: "verify:wiring-ledger", phase: phaseName, model: "haiku", schema: { type: "object", required: ["ok"], properties: { ok: { type: "boolean" }, reason: { type: "string" } } } }
+  ).catch(() => null);
+}
+
 // ───── Script body ─────
 
 if (!milestone) {
@@ -244,6 +261,8 @@ if (!pre.ok) {
   return { status: "failed", reason: "preflight-failed", preflight: pre.envelope };
 }
 const brief = await generateBrief(projectDir, { kind: "verify", milestone, id: `verify-${(milestone || "m").toLowerCase()}` });
+// M99 D2: persist graphWiringMode for the verify consumer. [RULE] wiring-mode-three-states
+await persistWiringMode("Preflight");
 
 phase("Verify-Gate");
 const vg = await runVerifyGate(projectDir);