@tekyzinc/gsd-t 5.17.11 → 5.17.13

package/CHANGELOG.md

@@ -2,6 +2,62 @@
 
 All notable changes to GSD-T are documented here. Updated with each release.
 
+## [5.17.13] - 2026-09-03
+
+### Fixed — the verify gate failed projects for GSD-T's own gaps (TD-395), and a lost finalizer crashed the phase workflow
+
+Reported from TimeTracking: verify could not reach Red Team / QA because the gate
+ahead of the triad failed on things the project could not fix. Two of them were ours.
+
+- `bin/gsd-t.js`: `gsd-t-logging-envelope-check.cjs` joins `PROJECT_BIN_TOOLS`. The
+  verify gate reaches it via `__dirname` inside the project's own `bin/`, so it existed
+  on the author's machine and in no project (5th propagation gap of this class).
+- `test/verify-gate-tools-propagated.test.js`: every `__dirname` tool the gate dispatches
+  to must be in the propagation set — structural, with a negative case. Closes the class.
+- `bin/gsd-t-graph-use-gate.cjs`: a workflow stamps its WIRED claim under its own name
+  (`phase`, `verify`) while its workers' Bash-run queries land under the query CLI's default
+  label `cli`, which the gate exempted. TimeTracking's ledger: 302 queries under `cli`,
+  gate FAILED as zero. A query from an id with no wiring claim of its own now counts as
+  evidence for every claimant whose claim precedes it; a query before the claim is not
+  evidence; another claimant's queries are never borrowed. 4 tests.
+- `templates/workflows/gsd-t-verify.workflow.js`: verify stamped its claim at Preflight and
+  ran its own gate immediately after — a fresh claim with zero queries, failing by
+  construction every run. The stamp now lands after the gate, before the first structural
+  query.
+- `templates/workflows/gsd-t-phase.workflow.js`: a finalizer agent lost to an API 529
+  resolved to null and the run died with a TypeError at `result.competition = …`. It now
+  ends with `status: "failed"` and a resume hint (a halt with a message, not a fallback).
+
+Not a GSD-T change: the gate's Playwright step runs `npx playwright test` exactly as the
+project's own `npm test` does; a config that throws without `TEST_DATABASE_URL` must load
+`.env.local` itself.
+
+Also in this release: **M115 Test-Plan-First Requirements Interrogation** is DEFINED and
+PARTITIONED (5 domains, 3 risk-first waves) with its A1 blind-replay answer key secured at
+`test/fixtures/m115-blind-replay/`. Nothing of M115 is built yet.
+
+## [5.17.12] - 2026-09-02
+
+### Fixed — an import written `.js` never resolved to its `.ts` source, so `who-imports` answered "nothing imports this"
+
+`who-imports src/content/dom-observer.ts` in binvoice returned 0 importers with
+coverage "complete" while five real importers sat in the edges table. TypeScript
+ESM requires an import to be WRITTEN `./dom-observer.js` even though the file on
+disk is `dom-observer.ts`. The resolver only ever APPENDED extensions
+(`x.js`, `x.js.ts`, …) and never SWAPPED one, so the specifier could not reach
+its source. 817 of binvoice's 2,376 import edges (34%) were unresolvable this way,
+each reading as "safe to delete."
+
+- `bin/gsd-t-graph-query-cli.cjs`: after the append pass, try the swap
+  (`.js`→`.ts`/`.tsx`, `.mjs`→`.mts`, `.cjs`→`.cts`) on both the relative and
+  alias-expanded routes. A real `.js` on disk still wins; a package specifier
+  stays as written. `[RULE] query-resolves-js-specifier-to-ts-source`.
+- `test/m114-nested-tsconfig-graph.test.js`: three end-to-end tests that index a
+  tiny repo and query it through the real CLI — `.js`→`.ts` resolves, a real
+  `.js` beats the swap, an external package is not rewritten.
+
+Re-run `gsd-t graph index` is NOT required — resolution happens at query time.
+
 ## [5.17.11] - 2026-09-01
 
 ### Fixed — every arrow-function export was invisible to the code graph

package/README.md

@@ -1,6 +1,6 @@
 # GSD-T: Contract-Driven Development for Claude Code
 
-**v5.17.11** - A methodology for reliable, parallelizable development using Claude Code with optional Agent Teams support.
+**v5.17.13** - A methodology for reliable, parallelizable development using Claude Code with optional Agent Teams support.
 
 **Eliminates context rot** — task-level fresh dispatch (one subagent per task, ~10-20% context each) means compaction never triggers.
 **Compaction-proof debug loops** — `gsd-t headless --debug-loop` runs test-fix-retest cycles as separate `claude -p` sessions. A JSONL debug ledger persists all hypothesis/fix/learning history across fresh sessions. Anti-repetition preamble injection prevents retrying failed hypotheses. Escalation tiers (sonnet → opus → human) and a hard iteration ceiling enforced externally.

package/bin/gsd-t-graph-query-cli.cjs

@@ -525,6 +525,25 @@ function loadSqliteStore(dbPath) {
     // expanded alias is ALREADY project-relative and must not be — joining it to
     // the importer's directory would produce `src/app/src/lib/db`. So the two
     // take different routes to the same place: add the extension either way.
+    // [RULE] query-resolves-js-specifier-to-ts-source
+    //
+    // binvoice, 2026-09-02: `who-imports src/content/dom-observer.ts` returned 0
+    // importers with coverage "complete" while five real importers sat in the
+    // edges table. TypeScript ESM requires an import to be WRITTEN `.js` even
+    // though the file on disk is `.ts` — so the edge says `./dom-observer.js`
+    // and no amount of appending extensions reaches `dom-observer.ts`. It has to
+    // SWAP the extension, not append to it. 817 of binvoice's 2,376 import edges
+    // (34%) were unresolvable this way, each answering "nothing imports this" —
+    // which reads as safe to delete.
+    const jsToTsCandidates = (p) => {
+      const m = /\.(js|jsx|mjs|cjs)$/.exec(p);
+      if (!m) return [];
+      const stem = p.slice(0, -m[0].length);
+      // .js->.ts/.tsx, .jsx->.tsx, .mjs->.mts, .cjs->.cts — the source files a
+      // bundler would have compiled INTO the specifier that was written.
+      return [stem + ".ts", stem + ".tsx", stem + ".mts", stem + ".cts"];
+    };
+
     const resolveDst = (srcFile, dst) => {
       if (typeof dst !== "string" || !dst) return dst;
 
@@ -536,6 +555,10 @@ function loadSqliteStore(dbPath) {
         for (const ext of EXTS) {
           if (fileIds.has(base + ext)) return base + ext;
         }
+        // An alias-expanded path can carry the same written-.js convention.
+        for (const cand of jsToTsCandidates(base)) {
+          if (fileIds.has(cand)) return cand;
+        }
         return dst; // genuinely external — keep it exactly as written
       }
 
@@ -544,6 +567,11 @@ function loadSqliteStore(dbPath) {
       for (const ext of EXTS) {
         if (fileIds.has(base + ext)) return base + ext;
       }
+      // TypeScript ESM: the import is written `.js`, the source is `.ts`. Swap,
+      // don't append. [RULE] query-resolves-js-specifier-to-ts-source
+      for (const cand of jsToTsCandidates(base)) {
+        if (fileIds.has(cand)) return cand;
+      }
       return base; // no indexed match (external/missing) — keep the resolved path
     };
 

package/bin/gsd-t-graph-use-gate.cjs

@@ -94,7 +94,7 @@ function readLedger(files, sinceTs) {
 
   const ensure = (id) => {
     if (!consumers[id]) {
-      consumers[id] = { consumer: id, queryCount: 0, wiringModes: [], firstWiringTs: null };
+      consumers[id] = { consumer: id, queryCount: 0, queryTs: [], wiringModes: [], firstWiringTs: null };
     }
     return consumers[id];
   };
@@ -122,7 +122,9 @@ function readLedger(files, sinceTs) {
       const kind = String(ev.kind || '');
 
       if (kind === EVIDENCE_KIND) {
-        ensure(id).queryCount++;
+        const c = ensure(id);
+        c.queryCount++;
+        c.queryTs.push(typeof ev.ts === 'string' ? ev.ts : '');
       } else if (kind === WIRING_KIND) {
         const c = ensure(id);
         c.wiringModes.push(String(ev.graphWiringMode || ''));
@@ -143,24 +145,45 @@ function evaluate(consumers) {
   const violations = [];
   const checked = [];
 
+  // [RULE] graph-use-attributes-unlabelled-queries-by-time
+  // A workflow stamps its WIRED claim under its own name ("phase", "verify", …),
+  // but the graph queries its workers run through Bash carry the query CLI's
+  // default label ("cli") — nothing in the worker's shell exports
+  // GSDT_GRAPH_CONSUMER. TimeTracking (2026-09-03, TD-395): 302 queries under
+  // "cli", the three WIRED claims under "phase"/"verify", and the gate FAILED a
+  // run that had consulted the graph 302 times — attribution, not absence.
+  // So a query logged by an id that made NO wiring claim of its own (cli, a hook)
+  // counts as evidence for every claimant whose WIRED claim PRECEDES it. A query
+  // before the claim is not evidence: nothing had claimed anything yet.
+  const unlabelledQueryTs = [];
+  for (const id of Object.keys(consumers)) {
+    const c = consumers[id];
+    if (c.wiringModes.length === 0) unlabelledQueryTs.push(...(c.queryTs || []));
+  }
+
   for (const id of Object.keys(consumers)) {
     if (NON_CONSUMER_IDS.has(id)) continue;
     const c = consumers[id];
     if (c.wiringModes.length === 0) continue; // never declared; nothing claimed, nothing to prove
 
     const claimedWired = c.wiringModes.some((m) => m.toLowerCase() === 'wired');
-    checked.push({ consumer: id, wiringModes: c.wiringModes, queryCount: c.queryCount });
+    const since = c.firstWiringTs || '';
+    const attributed = unlabelledQueryTs.filter((ts) => ts && ts >= since).length;
+    const evidenceCount = c.queryCount + attributed;
+    checked.push({ consumer: id, wiringModes: c.wiringModes, queryCount: c.queryCount, attributedQueryCount: attributed });
 
-    if (claimedWired && c.queryCount === 0) {
+    if (claimedWired && evidenceCount === 0) {
       violations.push({
         consumer: id,
         wiringMode: 'WIRED',
         queryCount: 0,
+        attributedQueryCount: 0,
         firstWiringTs: c.firstWiringTs,
         evidence:
           `consumer "${id}" logged graphWiringMode=WIRED but issued 0 graph queries ` +
-          `(kind:"query") in this window — a WIRED claim with no query evidence means ` +
-          `the structural question was answered some other way.`,
+          `(kind:"query") in this window, and no unlabelled query (cli / hook) was logged after ` +
+          `the claim — a WIRED claim with no query evidence means the structural question ` +
+          `was answered some other way.`,
       });
     }
   }

package/bin/gsd-t.js

@@ -3467,6 +3467,11 @@ const PROJECT_BIN_TOOLS = [
   "cli-preflight.cjs", "parallel-cli.cjs", "parallel-cli-tee.cjs",
   "gsd-t-context-brief.cjs",
   "gsd-t-verify-gate.cjs", "gsd-t-verify-gate-judge.cjs",
+  // M100 D3 — trace+audit envelope gate. verify-gate dispatches to it via __dirname,
+  // so a project with the gate but not this file fails `logging-envelope` on every
+  // verify (TimeTracking TD-395, 2026-09-03 — the 5th propagation gap of this class;
+  // test/verify-gate-tools-propagated.test.js now asserts the whole set structurally).
+  "gsd-t-logging-envelope-check.cjs",
   // v5.4.10 — integer-identity primary-key gate. gsd-t-verify-gate.cjs dispatches to
   // it via an absolute path in the Track 2 plan, so a project that has the verify gate
   // but NOT this file gets an ENOENT on every verify. Ships alongside the gate itself.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tekyzinc/gsd-t",
-  "version": "5.17.11",
+  "version": "5.17.13",
   "description": "GSD-T: Contract-Driven Development for Claude Code — 54 slash commands with headless-by-default workflow spawning, unattended supervisor relay with event stream, graph-powered code analysis, real-time agent dashboard, task telemetry, doc-ripple enforcement, backlog management, impact analysis, test sync, milestone archival, and PRD generation",
   "author": "Tekyz, Inc.",
   "license": "MIT",

package/templates/workflows/gsd-t-phase.workflow.js

@@ -1320,6 +1320,13 @@ if (!competitionOn) {
     ].filter(Boolean).join("\n"),
     { label: `${phaseName}:finalize`, phase: "Finalize", schema: FINALIZE_SCHEMA, model: "opus" }
   ).catch((e) => ({ status: "failed", artifacts: [], summary: `finalizer error: ${e && e.message}` }));
+  // A finalizer that RESOLVES to nothing (API 529 overload observed 2026-09-02, run
+  // wf_66339f4d-545) used to crash the whole run with a TypeError at
+  // `result.competition = ...` — a stack trace instead of a status. This is a HALT,
+  // not a fallback: the run still ends failed, it just says so in the envelope.
+  if (!result || typeof result !== "object") {
+    result = { status: "failed", artifacts: [], summary: "finalizer returned no result (transient API error or empty agent return) — resume the run with resumeFromRunId; cached stages replay, only finalize re-runs" };
+  }
 
   // Re-validate the FINALIZED partition (Invariant 4). If salvage reintroduced an
   // overlap, the finalized graft is invalid → block completion with a clear reason.

package/templates/workflows/gsd-t-verify.workflow.js

@@ -301,8 +301,6 @@ if (!pre.ok) {
   return { status: "failed", reason: "preflight-failed", preflight: pre.envelope };
 }
 const brief = await generateBrief(projectDir, { kind: "verify", milestone, id: `verify-${(milestone || "m").toLowerCase()}` });
-// M99 D2: persist graphWiringMode for the verify consumer. [RULE] wiring-mode-three-states
-await persistWiringMode("Preflight");
 
 phase("Verify-Gate");
 const vg = await runVerifyGate(projectDir);
@@ -316,6 +314,14 @@ if (!vg.ok) {
 }
 log(`verify-gate green`);
 
+// M99 D2: persist graphWiringMode for the verify consumer. [RULE] wiring-mode-three-states
+// Stamped AFTER the verify-gate, not before it (TimeTracking TD-395, 2026-09-03): the
+// gate's graph-use check judges every WIRED claim on the queries that FOLLOW it, and
+// verify's first graph query (dead-code, just below) comes after the gate. Stamping at
+// Preflight made every verify run fail its own gate — a fresh claim, zero queries, by
+// construction. Now the claim precedes the structural queries and the NEXT run judges it.
+await persistWiringMode("Verify-Gate");
+
 // ─── M94-D10-T5: Graph Structural Slice — dead-code + dangling (ADDITIVE, announced-degradation) ──
 // [RULE] qa-verify-use-orphan-dangling-verbs — query dead-code + dangling structurally.
 // [RULE] verify-integrate-graph-additive-announced-not-hard-fail — PRE-MORTEM Finding 3