@tekyzinc/gsd-t 5.17.12 → 5.17.13

package/CHANGELOG.md

@@ -2,6 +2,40 @@
 
 All notable changes to GSD-T are documented here. Updated with each release.
 
+## [5.17.13] - 2026-09-03
+
+### Fixed — the verify gate failed projects for GSD-T's own gaps (TD-395), and a lost finalizer crashed the phase workflow
+
+Reported from TimeTracking: verify could not reach Red Team / QA because the gate
+ahead of the triad failed on things the project could not fix. Two of them were ours.
+
+- `bin/gsd-t.js`: `gsd-t-logging-envelope-check.cjs` joins `PROJECT_BIN_TOOLS`. The
+  verify gate reaches it via `__dirname` inside the project's own `bin/`, so it existed
+  on the author's machine and in no project (5th propagation gap of this class).
+- `test/verify-gate-tools-propagated.test.js`: every `__dirname` tool the gate dispatches
+  to must be in the propagation set — structural, with a negative case. Closes the class.
+- `bin/gsd-t-graph-use-gate.cjs`: a workflow stamps its WIRED claim under its own name
+  (`phase`, `verify`) while its workers' Bash-run queries land under the query CLI's default
+  label `cli`, which the gate exempted. TimeTracking's ledger: 302 queries under `cli`,
+  gate FAILED as zero. A query from an id with no wiring claim of its own now counts as
+  evidence for every claimant whose claim precedes it; a query before the claim is not
+  evidence; another claimant's queries are never borrowed. 4 tests.
+- `templates/workflows/gsd-t-verify.workflow.js`: verify stamped its claim at Preflight and
+  ran its own gate immediately after — a fresh claim with zero queries, failing by
+  construction every run. The stamp now lands after the gate, before the first structural
+  query.
+- `templates/workflows/gsd-t-phase.workflow.js`: a finalizer agent lost to an API 529
+  resolved to null and the run died with a TypeError at `result.competition = …`. It now
+  ends with `status: "failed"` and a resume hint (a halt with a message, not a fallback).
+
+Not a GSD-T change: the gate's Playwright step runs `npx playwright test` exactly as the
+project's own `npm test` does; a config that throws without `TEST_DATABASE_URL` must load
+`.env.local` itself.
+
+Also in this release: **M115 Test-Plan-First Requirements Interrogation** is DEFINED and
+PARTITIONED (5 domains, 3 risk-first waves) with its A1 blind-replay answer key secured at
+`test/fixtures/m115-blind-replay/`. Nothing of M115 is built yet.
+
 ## [5.17.12] - 2026-09-02
 
 ### Fixed — an import written `.js` never resolved to its `.ts` source, so `who-imports` answered "nothing imports this"

package/README.md

@@ -1,6 +1,6 @@
 # GSD-T: Contract-Driven Development for Claude Code
 
-**v5.17.12** - A methodology for reliable, parallelizable development using Claude Code with optional Agent Teams support.
+**v5.17.13** - A methodology for reliable, parallelizable development using Claude Code with optional Agent Teams support.
 
 **Eliminates context rot** — task-level fresh dispatch (one subagent per task, ~10-20% context each) means compaction never triggers.
 **Compaction-proof debug loops** — `gsd-t headless --debug-loop` runs test-fix-retest cycles as separate `claude -p` sessions. A JSONL debug ledger persists all hypothesis/fix/learning history across fresh sessions. Anti-repetition preamble injection prevents retrying failed hypotheses. Escalation tiers (sonnet → opus → human) and a hard iteration ceiling enforced externally.

package/bin/gsd-t-graph-use-gate.cjs

@@ -94,7 +94,7 @@ function readLedger(files, sinceTs) {
 
   const ensure = (id) => {
     if (!consumers[id]) {
-      consumers[id] = { consumer: id, queryCount: 0, wiringModes: [], firstWiringTs: null };
+      consumers[id] = { consumer: id, queryCount: 0, queryTs: [], wiringModes: [], firstWiringTs: null };
     }
     return consumers[id];
   };
@@ -122,7 +122,9 @@ function readLedger(files, sinceTs) {
       const kind = String(ev.kind || '');
 
       if (kind === EVIDENCE_KIND) {
-        ensure(id).queryCount++;
+        const c = ensure(id);
+        c.queryCount++;
+        c.queryTs.push(typeof ev.ts === 'string' ? ev.ts : '');
       } else if (kind === WIRING_KIND) {
         const c = ensure(id);
         c.wiringModes.push(String(ev.graphWiringMode || ''));
@@ -143,24 +145,45 @@ function evaluate(consumers) {
   const violations = [];
   const checked = [];
 
+  // [RULE] graph-use-attributes-unlabelled-queries-by-time
+  // A workflow stamps its WIRED claim under its own name ("phase", "verify", …),
+  // but the graph queries its workers run through Bash carry the query CLI's
+  // default label ("cli") — nothing in the worker's shell exports
+  // GSDT_GRAPH_CONSUMER. TimeTracking (2026-09-03, TD-395): 302 queries under
+  // "cli", the three WIRED claims under "phase"/"verify", and the gate FAILED a
+  // run that had consulted the graph 302 times — attribution, not absence.
+  // So a query logged by an id that made NO wiring claim of its own (cli, a hook)
+  // counts as evidence for every claimant whose WIRED claim PRECEDES it. A query
+  // before the claim is not evidence: nothing had claimed anything yet.
+  const unlabelledQueryTs = [];
+  for (const id of Object.keys(consumers)) {
+    const c = consumers[id];
+    if (c.wiringModes.length === 0) unlabelledQueryTs.push(...(c.queryTs || []));
+  }
+
   for (const id of Object.keys(consumers)) {
     if (NON_CONSUMER_IDS.has(id)) continue;
     const c = consumers[id];
     if (c.wiringModes.length === 0) continue; // never declared; nothing claimed, nothing to prove
 
     const claimedWired = c.wiringModes.some((m) => m.toLowerCase() === 'wired');
-    checked.push({ consumer: id, wiringModes: c.wiringModes, queryCount: c.queryCount });
+    const since = c.firstWiringTs || '';
+    const attributed = unlabelledQueryTs.filter((ts) => ts && ts >= since).length;
+    const evidenceCount = c.queryCount + attributed;
+    checked.push({ consumer: id, wiringModes: c.wiringModes, queryCount: c.queryCount, attributedQueryCount: attributed });
 
-    if (claimedWired && c.queryCount === 0) {
+    if (claimedWired && evidenceCount === 0) {
       violations.push({
         consumer: id,
         wiringMode: 'WIRED',
         queryCount: 0,
+        attributedQueryCount: 0,
         firstWiringTs: c.firstWiringTs,
         evidence:
           `consumer "${id}" logged graphWiringMode=WIRED but issued 0 graph queries ` +
-          `(kind:"query") in this window — a WIRED claim with no query evidence means ` +
-          `the structural question was answered some other way.`,
+          `(kind:"query") in this window, and no unlabelled query (cli / hook) was logged after ` +
+          `the claim — a WIRED claim with no query evidence means the structural question ` +
+          `was answered some other way.`,
       });
     }
   }

package/bin/gsd-t.js

@@ -3467,6 +3467,11 @@ const PROJECT_BIN_TOOLS = [
   "cli-preflight.cjs", "parallel-cli.cjs", "parallel-cli-tee.cjs",
   "gsd-t-context-brief.cjs",
   "gsd-t-verify-gate.cjs", "gsd-t-verify-gate-judge.cjs",
+  // M100 D3 — trace+audit envelope gate. verify-gate dispatches to it via __dirname,
+  // so a project with the gate but not this file fails `logging-envelope` on every
+  // verify (TimeTracking TD-395, 2026-09-03 — the 5th propagation gap of this class;
+  // test/verify-gate-tools-propagated.test.js now asserts the whole set structurally).
+  "gsd-t-logging-envelope-check.cjs",
   // v5.4.10 — integer-identity primary-key gate. gsd-t-verify-gate.cjs dispatches to
   // it via an absolute path in the Track 2 plan, so a project that has the verify gate
   // but NOT this file gets an ENOENT on every verify. Ships alongside the gate itself.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tekyzinc/gsd-t",
-  "version": "5.17.12",
+  "version": "5.17.13",
   "description": "GSD-T: Contract-Driven Development for Claude Code — 54 slash commands with headless-by-default workflow spawning, unattended supervisor relay with event stream, graph-powered code analysis, real-time agent dashboard, task telemetry, doc-ripple enforcement, backlog management, impact analysis, test sync, milestone archival, and PRD generation",
   "author": "Tekyz, Inc.",
   "license": "MIT",

package/templates/workflows/gsd-t-phase.workflow.js

@@ -1320,6 +1320,13 @@ if (!competitionOn) {
     ].filter(Boolean).join("\n"),
     { label: `${phaseName}:finalize`, phase: "Finalize", schema: FINALIZE_SCHEMA, model: "opus" }
   ).catch((e) => ({ status: "failed", artifacts: [], summary: `finalizer error: ${e && e.message}` }));
+  // A finalizer that RESOLVES to nothing (API 529 overload observed 2026-09-02, run
+  // wf_66339f4d-545) used to crash the whole run with a TypeError at
+  // `result.competition = ...` — a stack trace instead of a status. This is a HALT,
+  // not a fallback: the run still ends failed, it just says so in the envelope.
+  if (!result || typeof result !== "object") {
+    result = { status: "failed", artifacts: [], summary: "finalizer returned no result (transient API error or empty agent return) — resume the run with resumeFromRunId; cached stages replay, only finalize re-runs" };
+  }
 
   // Re-validate the FINALIZED partition (Invariant 4). If salvage reintroduced an
   // overlap, the finalized graft is invalid → block completion with a clear reason.

package/templates/workflows/gsd-t-verify.workflow.js

@@ -301,8 +301,6 @@ if (!pre.ok) {
   return { status: "failed", reason: "preflight-failed", preflight: pre.envelope };
 }
 const brief = await generateBrief(projectDir, { kind: "verify", milestone, id: `verify-${(milestone || "m").toLowerCase()}` });
-// M99 D2: persist graphWiringMode for the verify consumer. [RULE] wiring-mode-three-states
-await persistWiringMode("Preflight");
 
 phase("Verify-Gate");
 const vg = await runVerifyGate(projectDir);
@@ -316,6 +314,14 @@ if (!vg.ok) {
 }
 log(`verify-gate green`);
 
+// M99 D2: persist graphWiringMode for the verify consumer. [RULE] wiring-mode-three-states
+// Stamped AFTER the verify-gate, not before it (TimeTracking TD-395, 2026-09-03): the
+// gate's graph-use check judges every WIRED claim on the queries that FOLLOW it, and
+// verify's first graph query (dead-code, just below) comes after the gate. Stamping at
+// Preflight made every verify run fail its own gate — a fresh claim, zero queries, by
+// construction. Now the claim precedes the structural queries and the NEXT run judges it.
+await persistWiringMode("Verify-Gate");
+
 // ─── M94-D10-T5: Graph Structural Slice — dead-code + dangling (ADDITIVE, announced-degradation) ──
 // [RULE] qa-verify-use-orphan-dangling-verbs — query dead-code + dangling structurally.
 // [RULE] verify-integrate-graph-additive-announced-not-hard-fail — PRE-MORTEM Finding 3