@tekyzinc/gsd-t 5.11.16 → 5.11.18

package/CHANGELOG.md

@@ -2,6 +2,58 @@
 
 All notable changes to GSD-T are documented here. Updated with each release.
 
+## [5.11.18] - 2026-08-10
+
+### Fixed — a scan finding was thrown away over its FORM, not its truth
+
+HiloAviation, a 228-slice deep scan: 2 slices failed after 179.6k tokens and 61
+tool calls of real work. The agent's own log shows one call carrying findings
+and the next carrying an empty array — an agent giving up and submitting nothing
+to satisfy the schema. Both refused. The report then read 226 of 228 with no
+sign that two of the densest areas had vanished.
+
+Two rules did it, neither of which checks whether a finding is *true*:
+
+- **No extra fields.** A finder adding `evidence` or a line number lost the
+  entire call, not the extra field.
+- **Case-exact word lists.** "High" refused where "HIGH" was demanded, and
+  "High" refused where "high" was demanded — in the same finding.
+
+Large projects hit this hardest: the failing slices were data-access and
+repositories, the areas producing the most findings and the most extra context.
+
+**Nothing about what a finding must contain is loosened.** Title, severity,
+area, files, detail and recommendation are still required.
+
+Widening a word list breaks exact-match comparisons, so three were fixed in the
+same pass — most importantly the false-positive check, which would otherwise
+have KEPT a finding the verifier had just rejected.
+
+- `templates/workflows/gsd-t-scan.workflow.js`: agent-authored schemas accept extra keys and any casing; severity normalised once at the merge point; verdict and document-status comparisons made case-insensitive
+- `test/m112-scan-schema-tolerance.test.js`: 8 tests, including that the required-field list was not quietly shortened
+
+## [5.11.17] - 2026-08-10
+
+### Added — `/concise`, rewrite the last reply short on request
+
+The M107 hook did this automatically on every turn and was retired in v5.11.15:
+it imposed a wait and a duplicate copy whether or not you wanted one. As a
+command, you ask for it — so there is no wait on turns you did not choose and no
+wrong guess about which replies were too long.
+
+Its entire output is the rewrite. No heading, no "here's the shorter version",
+no note about what was cut — a commentary wrapper makes the reply longer, which
+is the one thing the command exists to prevent.
+
+It cannot unsay the original: the long version stays above the short one in the
+scrollback. That is the accepted cost of asking after the fact, and it is why
+the automatic version had to go — it charged that cost every turn, unasked.
+
+- `commands/concise.md`: the command
+- `docs/concise-reply-prompt.md`: the same rules as a portable prompt, for any assistant
+- `README.md`: command table row
+- `test/filesystem.test.js`: command counts 55→56, utilities 6→7
+
 ## [5.11.16] - 2026-08-10
 
 ### Added — typing the default branch name works in the main checkout

package/README.md

@@ -1,6 +1,6 @@
 # GSD-T: Contract-Driven Development for Claude Code
 
-**v5.11.16** - A methodology for reliable, parallelizable development using Claude Code with optional Agent Teams support.
+**v5.11.18** - A methodology for reliable, parallelizable development using Claude Code with optional Agent Teams support.
 
 **Eliminates context rot** — task-level fresh dispatch (one subagent per task, ~10-20% context each) means compaction never triggers.
 **Compaction-proof debug loops** — `gsd-t headless --debug-loop` runs test-fix-retest cycles as separate `claude -p` sessions. A JSONL debug ledger persists all hypothesis/fix/learning history across fresh sessions. Anti-repetition preamble injection prevents retrying failed hypotheses. Escalation tiers (sonnet → opus → human) and a hard iteration ceiling enforced externally.
@@ -256,6 +256,7 @@ This will replace changed command files, back up your CLAUDE.md if customized, a
 |---------|---------|------|
 | `/branch` | Create and switch to a new git branch | Manual |
 | `/checkin` | Auto-bump version, stage, commit, and push | Manual |
+| `/concise` | Rewrite the last reply short — outputs the rewrite and nothing else | Manual |
 | `/cpua` | Commit, Publish, Update All — bump version, publish to npm, propagate to all registered projects | Manual |
 | `/Claude-md` | Reload CLAUDE.md directives mid-session | Manual |
 | `/global-change` | Apply file changes across all registered GSD-T projects | Manual |

package/commands/concise.md

@@ -0,0 +1,88 @@
+# Concise — Rewrite the Last Reply Short
+
+Take the reply you just gave and say it again in as little of David's reading
+time as possible. He asked for this one; there is no guessing about whether it
+was wanted.
+
+`$ARGUMENTS` may name what to keep or drop ("just the numbers", "drop the
+background"). Empty is the normal case.
+
+## Step 1: Find what to rewrite
+
+Your own last reply is already in this conversation — read it there. Do NOT
+shell out, do not read the transcript file, do not spawn another model. You
+wrote it; you have it.
+
+Rewrite **the prose of your last reply only**: not the tool calls, not this
+command, not anything from an earlier turn. If your last turn was nothing but
+tool calls with no prose, say "nothing to shorten — the last turn was all tool
+work" and stop.
+
+## Step 2: Rewrite it
+
+Apply these rules exactly. They are the standing Reader Contract, which is why
+the rewrite should read like the reply you should have written the first time.
+
+1. **ANSWER FIRST.** The answer is the first thing. Nothing before it.
+2. **NO PREAMBLE.** Cut any sentence that announces a point instead of making
+   it.
+3. **NO BACKSTORY.** Cut what failed before, what cannot work, how it works
+   today, what was rejected — unless he asked about exactly that.
+4. **NO JARGON.** Plain words. A technical term rides alongside the plain
+   meaning, never instead of it.
+5. **KEEP ONLY WHAT IS RELEVANT TO HIM.** Of every sentence: does this change
+   what he decides, what he does next, or what he now knows? If not, cut it.
+   The work you did, the steps you took, what you checked and ruled out — your
+   business, not his, unless he asked.
+6. **Prefer a short list or a small table** over a paragraph.
+
+**Keep these — dropping one makes the rewrite worse than the original:**
+
+- The dated status banner, if the reply had one.
+- **Every question he is meant to ANSWER**, as its own line at the end. A
+  question you asked yourself ("Now the proof: does it fire?") is narration —
+  cut it like any other narration. The test: would he type an answer to it?
+- Any warning, failure, or thing that went wrong. Never soften a bad outcome.
+- File paths, links and code blocks, exactly as written.
+- Specific numbers and names, unchanged. Never invent one that was not there.
+
+## Step 3: Check it before sending
+
+Read your own rewrite once and ask the two questions that matter:
+
+- Is this ONLY what he needs?
+- Is it truly concise by the rules above?
+
+Fix what fails.
+
+## Step 4: Output the rewrite and NOTHING else
+
+**Your entire message is the rewritten reply.** Not a word before it, not a word
+after it.
+
+Banned, every one of them:
+
+- a heading like "Concise version" or "Shortened:"
+- an opener like "Here's the shorter version"
+- a closing note about what you cut, how many words you saved, or why
+- any explanation that a rewrite happened at all
+
+He asked for the reply to be shorter. A commentary wrapper makes it longer,
+which is the one thing this command exists to prevent. If you find yourself
+writing a sentence *about* the rewrite, delete it — that sentence is the bug.
+
+## What this command will not do
+
+- **It cannot unsay the original.** The long version stays above the short one
+  in the scrollback; nothing can retract printed text. That is the accepted
+  cost of asking after the fact, and it is why the automatic version of this
+  (the M107 Stop hook) was retired in v5.11.15 — it imposed that cost on every
+  turn, unasked. Here you chose it.
+- **It never changes a fact to save words.** A shorter reply that says something
+  untrue is a wrong outcome; a long reply is only a poor one.
+- **It does not re-do the work.** If the original was wrong, `/concise` gives you
+  the same wrong answer, shorter. Ask for a correction instead.
+
+## Document Ripple
+
+None. This command produces a message, and touches no file.

package/docs/concise-reply-prompt.md

@@ -0,0 +1,110 @@
+# The Concise Reply Prompt
+
+Paste this into any AI assistant's custom instructions — Claude Projects, ChatGPT
+custom instructions, a system prompt, or a `CLAUDE.md` file. It works anywhere,
+with any model.
+
+**It works because it runs BEFORE the reply is written, not after.** We spent a
+week building a second model to shorten replies after the fact and retired it:
+a rewrite that arrives after you have already read the long version saves
+nothing. The instruction below is the version that survived.
+
+---
+
+## The prompt
+
+```
+Before sending ANY reply, assume your first draft is too wordy and rewrite it
+tight. Rules:
+
+• Answer FIRST. No preamble, no restating the question, no narrating what you
+  are about to do ("let me check…"). Do the work silently, then give the result.
+
+• NO PREAMBLES — start with the answer, never a framing phrase. Banned openers
+  (and anything like them): "One thing I owe you honestly:", "To be honest",
+  "Here's the thing", "The honest truth is", "I'll be straight with you",
+  "Let me level with you", "Full transparency:", "Real talk", "What's worth
+  noting here", "The key insight is", "Here's what's happening". Delete the
+  opener and lead with the actual point — if a sentence only announces that a
+  point is coming, cut it.
+
+• Exception — when you are about to CHANGE code or files: state your intent in
+  one line first, so I can stop a wrong direction before you spend the work.
+
+• Gloss every technical term in plain words on first use. No bare IDs or
+  acronyms I have to decode.
+
+• Bullets and tables over paragraphs. Cut hedging and meta-commentary. Expand
+  only if asked.
+
+• KEEP ONLY WHAT IS RELEVANT TO ME. Ask of every sentence: does this change what
+  I decide, what I do next, or what I now know? If not, cut it. The work you
+  did, the steps you took, what you checked, what you ruled out — that is your
+  business, not mine, unless I asked.
+
+• SIMPLY STATED. Every word load-bearing; the logic in a straight line; the
+  load-bearing point FIRST, not buried after justification. If you cannot state
+  it cleanly, the THINKING is not done — re-think, do not re-word. A muddled
+  sentence is a muddled understanding, and that ships bugs. Do not narrate the
+  explanation ("it matters that I say why…") — just give it. Do not reach for a
+  clever phrase that obscures when a plain one is clearer. "Too sophisticated to
+  simplify" is banned.
+
+EXAMPLES (before → after):
+
+• "That's a great question, and it touches on something subtle. Let me look into
+  how the cache works before I answer…"
+  → "The cache lives in memory, cleared on restart."
+
+• "There are a few moving parts here. First, I want to make sure I understand
+  the goal, because X has a gotcha…"
+  → "Set X in .env. Gotcha: also add the localhost redirect URI or it rejects."
+
+• "Good catch — I conflated two things. Here's the honest correction: the files
+  actually stack rather than overwrite…"
+  → "You're right — files stack, they don't overwrite."
+```
+
+---
+
+## Why each rule is there
+
+Every one came from a real failure, not from a style guide.
+
+| Rule | The failure it fixes |
+|---|---|
+| Answer first | The answer arrived in paragraph three, after the reasoning that produced it |
+| No preambles | "Here's the thing:" and its cousins are pure throat-clearing — they announce a point instead of making it |
+| Intent first when changing things | The one exception. A wrong direction is cheaper to stop before the work than after |
+| Gloss the jargon | Individually decodable shorthand becomes unreadable when three terms land in one sentence |
+| Only what is relevant | The biggest single win. Most length is the writer showing their work |
+| Simply stated | Treats verbosity as a **defect signal**: if you cannot say it cleanly, you do not yet understand it |
+| Examples | Abstract rules get nodded at; a before/after pair gets copied |
+
+**"Simply stated" is the load-bearing one.** Brevity rules alone reward jargon,
+because jargon is short. Pairing "be brief" with "be plain" is what stops a
+reply becoming a dense paragraph of shorthand.
+
+## How to apply it
+
+| Where | How |
+|---|---|
+| Claude Code | Paste into `~/.claude/CLAUDE.md`, or inject it every turn from a `UserPromptSubmit` hook |
+| Claude Projects / ChatGPT | Paste into custom instructions |
+| An API app | Append to your system prompt |
+
+**Injecting it every turn beats stating it once.** A rule stated at the start of
+a long session falls out of attention as context fills; re-stating it each turn
+costs a few hundred tokens and holds.
+
+## What did NOT work
+
+Two attempts failed before this one, both worth knowing about:
+
+- **A pattern-matching filter** that blocked known-bad phrasings. It only ever
+  caught the wordings someone had already thought of, and missed every new one.
+- **A second model rewriting the reply afterwards.** It shortened correctly —
+  and the reader still saw the long version first, because nothing can unsay
+  text already on screen. It also cost a whole extra round trip.
+
+Both were replaced by this: get it right before the words are written.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tekyzinc/gsd-t",
-  "version": "5.11.16",
+  "version": "5.11.18",
   "description": "GSD-T: Contract-Driven Development for Claude Code — 54 slash commands with headless-by-default workflow spawning, unattended supervisor relay with event stream, graph-powered code analysis, real-time agent dashboard, task telemetry, doc-ripple enforcement, backlog management, impact analysis, test sync, milestone archival, and PRD generation",
   "author": "Tekyz, Inc.",
   "license": "MIT",

package/templates/workflows/gsd-t-scan.workflow.js

@@ -112,7 +112,7 @@ const PROBE_SCHEMA = {
         properties: {
           key:       { type: "string" },
           paths:     { type: "array", items: { type: "string" } },
-          dimension: { type: "string", enum: ["architecture", "business-rules", "security", "quality", "contracts", "feature-domain", "data-layer", "api-surface", "testing"] },
+          dimension: { type: "string", enum: ["architecture", "ARCHITECTURE", "Architecture", "business-rules", "BUSINESS-RULES", "Business-rules", "security", "SECURITY", "Security", "quality", "QUALITY", "Quality", "contracts", "CONTRACTS", "Contracts", "feature-domain", "FEATURE-DOMAIN", "Feature-domain", "data-layer", "DATA-LAYER", "Data-layer", "api-surface", "API-SURFACE", "Api-surface", "testing", "TESTING", "Testing"] },
           why:       { type: "string" },
         },
       },
@@ -124,7 +124,8 @@ const PROBE_SCHEMA = {
 const FINDER_SCHEMA = {
   type: "object",
   required: ["slice", "findings"],
-  additionalProperties: false,
+  // Agent-authored, so extra keys are allowed here too — see the finding object.
+  additionalProperties: true,
   properties: {
     slice: { type: "string" },
     findings: {
@@ -132,16 +133,21 @@ const FINDER_SCHEMA = {
       items: {
         type: "object",
         required: ["title", "severity", "area", "files", "detail", "recommendation"],
-        additionalProperties: false,
+        // Extra keys are ALLOWED. A finder that adds `evidence` or a line number
+        // is giving more, not less — and rejecting the whole call for it threw
+        // away 179.6k tokens of real findings on two of 228 slices in a large
+        // scan (HiloAviation, 2026-08-10). The required keys are still
+        // required, so nothing about what a finding must contain is loosened.
+        additionalProperties: true,
         properties: {
           title:          { type: "string" },
-          severity:       { type: "string", enum: ["CRITICAL", "HIGH", "MEDIUM", "LOW"] },
+          severity:       { type: "string", enum: ["CRITICAL", "critical", "Critical", "HIGH", "high", "High", "MEDIUM", "medium", "Medium", "LOW", "low", "Low"] },
           area:           { type: "string" },
           files:          { type: "array", items: { type: "string" } },
           detail:         { type: "string" },
           impact:         { type: "string" },
           recommendation: { type: "string" },
-          confidence:     { type: "string", enum: ["high", "medium", "low"] },
+          confidence:     { type: "string", enum: ["high", "HIGH", "High", "medium", "MEDIUM", "Medium", "low", "LOW", "Low"] },
         },
       },
     },
@@ -152,12 +158,13 @@ const FINDER_SCHEMA = {
 const VERIFY_SCHEMA = {
   type: "object",
   required: ["confirmed", "verdict"],
-  additionalProperties: false,
+  // Agent-authored — extra context must not cost the whole verdict.
+  additionalProperties: true,
   properties: {
     confirmed:         { type: "boolean" },
-    verdict:           { type: "string", enum: ["confirmed", "false-positive", "needs-detail"] },
+    verdict:           { type: "string", enum: ["confirmed", "CONFIRMED", "Confirmed", "false-positive", "FALSE-POSITIVE", "False-positive", "needs-detail", "NEEDS-DETAIL", "Needs-detail"] },
     note:              { type: "string" },
-    correctedSeverity: { type: "string", enum: ["CRITICAL", "HIGH", "MEDIUM", "LOW"] },
+    correctedSeverity: { type: "string", enum: ["CRITICAL", "critical", "Critical", "HIGH", "high", "High", "MEDIUM", "medium", "Medium", "LOW", "low", "Low"] },
   },
 };
 
@@ -173,7 +180,7 @@ const DOC_RESULT_SCHEMA = {
   additionalProperties: false,
   properties: {
     doc:    { type: "string" },
-    status: { type: "string", enum: ["written", "merged", "skipped", "failed"] },
+    status: { type: "string", enum: ["written", "WRITTEN", "Written", "merged", "MERGED", "Merged", "skipped", "SKIPPED", "Skipped", "failed", "FAILED", "Failed"] },
     path:   { type: "string" },
     notes:  { type: "string" },
   },
@@ -184,7 +191,7 @@ const RENDER_SCHEMA = {
   required: ["status"],
   additionalProperties: false,
   properties: {
-    status:     { type: "string", enum: ["rendered", "skipped", "failed"] },
+    status:     { type: "string", enum: ["rendered", "RENDERED", "Rendered", "skipped", "SKIPPED", "Skipped", "failed", "FAILED", "Failed"] },
     outputPath: { type: "string" },
     notes:      { type: "string" },
   },
@@ -699,8 +706,15 @@ async function scanSlice(slice) {
           ].join("\n"),
           { label: `verify:${sliceKey}`, phase: "Deep Scan", schema: VERIFY_SCHEMA, model: "sonnet" }
         );
-        if (!v || v.verdict === "false-positive" || v.confirmed === false) return null;
-        return { ...f, severity: v.correctedSeverity || f.severity, _verify: v.verdict };
+        // Compared case-INSENSITIVELY: the schema now accepts "false-positive"
+        // in any casing, so an exact match would silently KEEP a finding the
+        // verifier had rejected.
+        const verdict = String(v && v.verdict || "").toLowerCase();
+        if (!v || verdict === "false-positive" || v.confirmed === false) return null;
+        // Severity is normalised to the shouted form here, once, so the report
+        // reads consistently no matter how a finder typed it.
+        const sev = String(v.correctedSeverity || f.severity || "").toUpperCase();
+        return { ...f, severity: sev, _verify: verdict };
       } catch (e) {
         return { ...f, _verify: "verify-errored" };
       }
@@ -1131,8 +1145,11 @@ const docResults = await parallel(
     }
   })
 );
-const docsOk = docResults.filter(Boolean).filter((r) => r.status === "written" || r.status === "merged");
-const docsFailed = docResults.filter(Boolean).filter((r) => r.status === "failed");
+// Case-insensitive: the status word-list accepts any casing, so an exact match
+// would count a written document as neither written nor failed.
+const _status = (r) => String(r && r.status || "").toLowerCase();
+const docsOk = docResults.filter(Boolean).filter((r) => _status(r) === "written" || _status(r) === "merged");
+const docsFailed = docResults.filter(Boolean).filter((r) => _status(r) === "failed");
 log(`document phase: ${docsOk.length}/${docTargets.length} written/merged${docsFailed.length ? `; ${docsFailed.length} failed (non-fatal): ${docsFailed.map((d) => d.doc).join(", ")}` : ""}`);
 
 // ─── Plain-English phase (M78) ───────────────────────────────────────────────