@tekyzinc/gsd-t 5.11.17 → 5.11.18

package/CHANGELOG.md

@@ -2,6 +2,36 @@
 
 All notable changes to GSD-T are documented here. Updated with each release.
 
+## [5.11.18] - 2026-08-10
+
+### Fixed — a scan finding was thrown away over its FORM, not its truth
+
+HiloAviation, a 228-slice deep scan: 2 slices failed after 179.6k tokens and 61
+tool calls of real work. The agent's own log shows one call carrying findings
+and the next carrying an empty array — an agent giving up and submitting nothing
+to satisfy the schema. Both refused. The report then read 226 of 228 with no
+sign that two of the densest areas had vanished.
+
+Two rules did it, neither of which checks whether a finding is *true*:
+
+- **No extra fields.** A finder adding `evidence` or a line number lost the
+  entire call, not the extra field.
+- **Case-exact word lists.** "High" refused where "HIGH" was demanded, and
+  "High" refused where "high" was demanded — in the same finding.
+
+Large projects hit this hardest: the failing slices were data-access and
+repositories, the areas producing the most findings and the most extra context.
+
+**Nothing about what a finding must contain is loosened.** Title, severity,
+area, files, detail and recommendation are still required.
+
+Widening a word list breaks exact-match comparisons, so three were fixed in the
+same pass — most importantly the false-positive check, which would otherwise
+have KEPT a finding the verifier had just rejected.
+
+- `templates/workflows/gsd-t-scan.workflow.js`: agent-authored schemas accept extra keys and any casing; severity normalised once at the merge point; verdict and document-status comparisons made case-insensitive
+- `test/m112-scan-schema-tolerance.test.js`: 8 tests, including that the required-field list was not quietly shortened
+
 ## [5.11.17] - 2026-08-10
 
 ### Added — `/concise`, rewrite the last reply short on request

package/README.md

@@ -1,6 +1,6 @@
 # GSD-T: Contract-Driven Development for Claude Code
 
-**v5.11.17** - A methodology for reliable, parallelizable development using Claude Code with optional Agent Teams support.
+**v5.11.18** - A methodology for reliable, parallelizable development using Claude Code with optional Agent Teams support.
 
 **Eliminates context rot** — task-level fresh dispatch (one subagent per task, ~10-20% context each) means compaction never triggers.
 **Compaction-proof debug loops** — `gsd-t headless --debug-loop` runs test-fix-retest cycles as separate `claude -p` sessions. A JSONL debug ledger persists all hypothesis/fix/learning history across fresh sessions. Anti-repetition preamble injection prevents retrying failed hypotheses. Escalation tiers (sonnet → opus → human) and a hard iteration ceiling enforced externally.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tekyzinc/gsd-t",
-  "version": "5.11.17",
+  "version": "5.11.18",
   "description": "GSD-T: Contract-Driven Development for Claude Code — 54 slash commands with headless-by-default workflow spawning, unattended supervisor relay with event stream, graph-powered code analysis, real-time agent dashboard, task telemetry, doc-ripple enforcement, backlog management, impact analysis, test sync, milestone archival, and PRD generation",
   "author": "Tekyz, Inc.",
   "license": "MIT",

package/templates/workflows/gsd-t-scan.workflow.js

@@ -112,7 +112,7 @@ const PROBE_SCHEMA = {
         properties: {
           key:       { type: "string" },
           paths:     { type: "array", items: { type: "string" } },
-          dimension: { type: "string", enum: ["architecture", "business-rules", "security", "quality", "contracts", "feature-domain", "data-layer", "api-surface", "testing"] },
+          dimension: { type: "string", enum: ["architecture", "ARCHITECTURE", "Architecture", "business-rules", "BUSINESS-RULES", "Business-rules", "security", "SECURITY", "Security", "quality", "QUALITY", "Quality", "contracts", "CONTRACTS", "Contracts", "feature-domain", "FEATURE-DOMAIN", "Feature-domain", "data-layer", "DATA-LAYER", "Data-layer", "api-surface", "API-SURFACE", "Api-surface", "testing", "TESTING", "Testing"] },
           why:       { type: "string" },
         },
       },
@@ -124,7 +124,8 @@ const PROBE_SCHEMA = {
 const FINDER_SCHEMA = {
   type: "object",
   required: ["slice", "findings"],
-  additionalProperties: false,
+  // Agent-authored, so extra keys are allowed here too — see the finding object.
+  additionalProperties: true,
   properties: {
     slice: { type: "string" },
     findings: {
@@ -132,16 +133,21 @@ const FINDER_SCHEMA = {
       items: {
         type: "object",
         required: ["title", "severity", "area", "files", "detail", "recommendation"],
-        additionalProperties: false,
+        // Extra keys are ALLOWED. A finder that adds `evidence` or a line number
+        // is giving more, not less — and rejecting the whole call for it threw
+        // away 179.6k tokens of real findings on two of 228 slices in a large
+        // scan (HiloAviation, 2026-08-10). The required keys are still
+        // required, so nothing about what a finding must contain is loosened.
+        additionalProperties: true,
         properties: {
           title:          { type: "string" },
-          severity:       { type: "string", enum: ["CRITICAL", "HIGH", "MEDIUM", "LOW"] },
+          severity:       { type: "string", enum: ["CRITICAL", "critical", "Critical", "HIGH", "high", "High", "MEDIUM", "medium", "Medium", "LOW", "low", "Low"] },
           area:           { type: "string" },
           files:          { type: "array", items: { type: "string" } },
           detail:         { type: "string" },
           impact:         { type: "string" },
           recommendation: { type: "string" },
-          confidence:     { type: "string", enum: ["high", "medium", "low"] },
+          confidence:     { type: "string", enum: ["high", "HIGH", "High", "medium", "MEDIUM", "Medium", "low", "LOW", "Low"] },
         },
       },
     },
@@ -152,12 +158,13 @@ const FINDER_SCHEMA = {
 const VERIFY_SCHEMA = {
   type: "object",
   required: ["confirmed", "verdict"],
-  additionalProperties: false,
+  // Agent-authored — extra context must not cost the whole verdict.
+  additionalProperties: true,
   properties: {
     confirmed:         { type: "boolean" },
-    verdict:           { type: "string", enum: ["confirmed", "false-positive", "needs-detail"] },
+    verdict:           { type: "string", enum: ["confirmed", "CONFIRMED", "Confirmed", "false-positive", "FALSE-POSITIVE", "False-positive", "needs-detail", "NEEDS-DETAIL", "Needs-detail"] },
     note:              { type: "string" },
-    correctedSeverity: { type: "string", enum: ["CRITICAL", "HIGH", "MEDIUM", "LOW"] },
+    correctedSeverity: { type: "string", enum: ["CRITICAL", "critical", "Critical", "HIGH", "high", "High", "MEDIUM", "medium", "Medium", "LOW", "low", "Low"] },
   },
 };
 
@@ -173,7 +180,7 @@ const DOC_RESULT_SCHEMA = {
   additionalProperties: false,
   properties: {
     doc:    { type: "string" },
-    status: { type: "string", enum: ["written", "merged", "skipped", "failed"] },
+    status: { type: "string", enum: ["written", "WRITTEN", "Written", "merged", "MERGED", "Merged", "skipped", "SKIPPED", "Skipped", "failed", "FAILED", "Failed"] },
     path:   { type: "string" },
     notes:  { type: "string" },
   },
@@ -184,7 +191,7 @@ const RENDER_SCHEMA = {
   required: ["status"],
   additionalProperties: false,
   properties: {
-    status:     { type: "string", enum: ["rendered", "skipped", "failed"] },
+    status:     { type: "string", enum: ["rendered", "RENDERED", "Rendered", "skipped", "SKIPPED", "Skipped", "failed", "FAILED", "Failed"] },
     outputPath: { type: "string" },
     notes:      { type: "string" },
   },
@@ -699,8 +706,15 @@ async function scanSlice(slice) {
           ].join("\n"),
           { label: `verify:${sliceKey}`, phase: "Deep Scan", schema: VERIFY_SCHEMA, model: "sonnet" }
         );
-        if (!v || v.verdict === "false-positive" || v.confirmed === false) return null;
-        return { ...f, severity: v.correctedSeverity || f.severity, _verify: v.verdict };
+        // Compared case-INSENSITIVELY: the schema now accepts "false-positive"
+        // in any casing, so an exact match would silently KEEP a finding the
+        // verifier had rejected.
+        const verdict = String(v && v.verdict || "").toLowerCase();
+        if (!v || verdict === "false-positive" || v.confirmed === false) return null;
+        // Severity is normalised to the shouted form here, once, so the report
+        // reads consistently no matter how a finder typed it.
+        const sev = String(v.correctedSeverity || f.severity || "").toUpperCase();
+        return { ...f, severity: sev, _verify: verdict };
       } catch (e) {
         return { ...f, _verify: "verify-errored" };
       }
@@ -1131,8 +1145,11 @@ const docResults = await parallel(
     }
   })
 );
-const docsOk = docResults.filter(Boolean).filter((r) => r.status === "written" || r.status === "merged");
-const docsFailed = docResults.filter(Boolean).filter((r) => r.status === "failed");
+// Case-insensitive: the status word-list accepts any casing, so an exact match
+// would count a written document as neither written nor failed.
+const _status = (r) => String(r && r.status || "").toLowerCase();
+const docsOk = docResults.filter(Boolean).filter((r) => _status(r) === "written" || _status(r) === "merged");
+const docsFailed = docResults.filter(Boolean).filter((r) => _status(r) === "failed");
 log(`document phase: ${docsOk.length}/${docTargets.length} written/merged${docsFailed.length ? `; ${docsFailed.length} failed (non-fatal): ${docsFailed.map((d) => d.doc).join(", ")}` : ""}`);
 
 // ─── Plain-English phase (M78) ───────────────────────────────────────────────