gsd-pi 2.41.0-dev.cac69f9 → 2.42.0-dev.1df898f

package/src/resources/extensions/gsd/run-manager.ts

@@ -0,0 +1,180 @@
+/**
+ * run-manager.ts — Create and list isolated workflow run directories.
+ *
+ * Each run lives under `.gsd/workflow-runs/<name>/<timestamp>/` and contains:
+ * - DEFINITION.yaml — frozen snapshot of the workflow definition at run-creation time
+ * - GRAPH.yaml — initialized step graph with all steps pending
+ * - PARAMS.json — (optional) parameter overrides used for this run
+ *
+ * Observability:
+ * - All run state is on disk in human-readable YAML/JSON — inspectable with cat/less.
+ * - `listRuns()` returns structured metadata including step counts and overall status.
+ * - Timestamp directory names are filesystem-safe (ISO with hyphens replacing colons).
+ * - Errors include the full path context for diagnosis.
+ */
+
+import { mkdirSync, writeFileSync, existsSync, readdirSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { stringify } from "yaml";
+import { loadDefinition, substituteParams } from "./definition-loader.js";
+import { initializeGraph, writeGraph, readGraph } from "./graph.js";
+import type { WorkflowDefinition } from "./definition-loader.js";
+import type { WorkflowGraph } from "./graph.js";
+
+// ─── Types ───────────────────────────────────────────────────────────────
+
+export interface RunMetadata {
+  /** Workflow definition name. */
+  name: string;
+  /** Filesystem-safe timestamp string used as dir name. */
+  timestamp: string;
+  /** Full path to the run directory. */
+  runDir: string;
+  /** Step counts derived from GRAPH.yaml. */
+  steps: { total: number; completed: number; pending: number; active: number };
+  /** Overall status derived from step states. */
+  status: "pending" | "running" | "complete";
+}
+
+// ─── Constants ───────────────────────────────────────────────────────────
+
+const RUNS_DIR = "workflow-runs";
+const DEFS_DIR = "workflow-defs";
+
+// ─── Helpers ─────────────────────────────────────────────────────────────
+
+/**
+ * Generate a filesystem-safe timestamp: `YYYY-MM-DDTHH-MM-SS`.
+ * Replaces colons with hyphens so the string is safe as a directory name
+ * on all platforms (Windows forbids colons in paths).
+ */
+function makeTimestamp(date: Date = new Date()): string {
+  return date.toISOString().replace(/:/g, "-").replace(/\.\d{3}Z$/, "");
+}
+
+/**
+ * Derive overall status from a graph's step statuses.
+ */
+function deriveStatus(graph: WorkflowGraph): "pending" | "running" | "complete" {
+  const hasActive = graph.steps.some((s) => s.status === "active");
+  const allDone = graph.steps.every(
+    (s) => s.status === "complete" || s.status === "expanded",
+  );
+  if (allDone) return "complete";
+  if (hasActive) return "running";
+  return "pending";
+}
+
+// ─── Public API ──────────────────────────────────────────────────────────
+
+/**
+ * Create a new isolated run directory for a workflow definition.
+ *
+ * 1. Loads the definition from `<basePath>/.gsd/workflow-defs/<defName>.yaml`
+ * 2. Applies parameter substitution if overrides are provided
+ * 3. Creates `<basePath>/.gsd/workflow-runs/<defName>/<timestamp>/`
+ * 4. Writes frozen DEFINITION.yaml, initialized GRAPH.yaml, and optional PARAMS.json
+ *
+ * @param basePath — project root directory
+ * @param defName — definition filename (without .yaml extension)
+ * @param overrides — optional parameter overrides (merged with definition defaults)
+ * @returns Full path to the created run directory
+ * @throws Error if the definition file doesn't exist or is invalid
+ */
+export function createRun(
+  basePath: string,
+  defName: string,
+  overrides?: Record<string, string>,
+): string {
+  const defsDir = join(basePath, ".gsd", DEFS_DIR);
+
+  // Load and validate the definition
+  const rawDef = loadDefinition(defsDir, defName);
+
+  // Apply parameter substitution if overrides provided
+  const def: WorkflowDefinition = overrides
+    ? substituteParams(rawDef, overrides)
+    : substituteParams(rawDef); // still resolve default params if any
+
+  // Create the run directory
+  const timestamp = makeTimestamp();
+  const runDir = join(basePath, ".gsd", RUNS_DIR, defName, timestamp);
+  mkdirSync(runDir, { recursive: true });
+
+  // Freeze the definition as DEFINITION.yaml
+  writeFileSync(join(runDir, "DEFINITION.yaml"), stringify(def), "utf-8");
+
+  // Initialize and write GRAPH.yaml
+  const graph = initializeGraph(def);
+  writeGraph(runDir, graph);
+
+  // Write PARAMS.json if overrides were provided
+  if (overrides && Object.keys(overrides).length > 0) {
+    writeFileSync(
+      join(runDir, "PARAMS.json"),
+      JSON.stringify(overrides, null, 2),
+      "utf-8",
+    );
+  }
+
+  return runDir;
+}
+
+/**
+ * List existing workflow runs with metadata.
+ *
+ * Scans `<basePath>/.gsd/workflow-runs/` for run directories. Each run's
+ * GRAPH.yaml is read to derive step counts and overall status.
+ *
+ * @param basePath — project root directory
+ * @param defName — optional filter: only list runs for this definition name
+ * @returns Array of run metadata, sorted newest-first within each definition
+ */
+export function listRuns(basePath: string, defName?: string): RunMetadata[] {
+  const runsRoot = join(basePath, ".gsd", RUNS_DIR);
+  if (!existsSync(runsRoot)) return [];
+
+  const results: RunMetadata[] = [];
+
+  // Get workflow name directories
+  const nameDirs = defName ? [defName] : readdirSync(runsRoot).filter((entry) => {
+    const full = join(runsRoot, entry);
+    return statSync(full).isDirectory();
+  });
+
+  for (const name of nameDirs) {
+    const nameDir = join(runsRoot, name);
+    if (!existsSync(nameDir)) continue;
+
+    const timestamps = readdirSync(nameDir).filter((entry) => {
+      const full = join(nameDir, entry);
+      return statSync(full).isDirectory();
+    });
+
+    // Sort newest-first (ISO strings sort lexicographically)
+    timestamps.sort().reverse();
+
+    for (const ts of timestamps) {
+      const runDir = join(nameDir, ts);
+      try {
+        const graph = readGraph(runDir);
+        const total = graph.steps.length;
+        const completed = graph.steps.filter((s) => s.status === "complete").length;
+        const pending = graph.steps.filter((s) => s.status === "pending").length;
+        const active = graph.steps.filter((s) => s.status === "active").length;
+
+        results.push({
+          name,
+          timestamp: ts,
+          runDir,
+          steps: { total, completed, pending, active },
+          status: deriveStatus(graph),
+        });
+      } catch {
+        // Skip runs with invalid/missing GRAPH.yaml
+      }
+    }
+  }
+
+  return results;
+}

package/src/resources/extensions/gsd/service-tier.ts

@@ -23,6 +23,8 @@ import { ensurePreferencesFile, serializePreferencesToFrontmatter } from "./comm
 
 export type ServiceTierSetting = "priority" | "flex" | undefined;
 
+const SERVICE_TIER_SCOPE_NOTE = "Only affects gpt-5.4 models, regardless of provider.";
+
 // ─── Gating ──────────────────────────────────────────────────────────────────
 
 /**
@@ -51,7 +53,7 @@ export function formatServiceTierStatus(tier: ServiceTierSetting): string {
       "  /gsd fast flex   Set to flex (0.5x cost, slower)",
       "  /gsd fast off    Disable service tier",
       "",
-      "Only affects gpt-5.4 models.",
+      SERVICE_TIER_SCOPE_NOTE,
     ].join("\n");
   }
 
@@ -64,10 +66,18 @@ export function formatServiceTierStatus(tier: ServiceTierSetting): string {
     "  /gsd fast flex   Set to flex (0.5x cost, slower)",
     "  /gsd fast off    Disable service tier",
     "",
-    "Only affects gpt-5.4 models.",
+    SERVICE_TIER_SCOPE_NOTE,
   ].join("\n");
 }
 
+export function formatServiceTierFooterStatus(
+  tier: ServiceTierSetting,
+  modelId: string | undefined,
+): string | undefined {
+  if (!tier || !modelId || !supportsServiceTier(modelId)) return undefined;
+  return tier === "priority" ? "fast: ⚡ priority" : "fast: 💰 flex";
+}
+
 // ─── Icon Resolution ─────────────────────────────────────────────────────────
 
 /**
@@ -148,19 +158,22 @@ export async function handleFast(args: string, ctx: ExtensionCommandContext): Pr
 
   if (trimmed === "on") {
     await writeGlobalServiceTier(ctx, "priority");
-    ctx.ui.notify("Service tier set to priority (2x cost, faster responses). Only affects gpt-5.4 models.", "info");
+    ctx.ui.setStatus("gsd-fast", formatServiceTierFooterStatus("priority", ctx.model?.id));
+    ctx.ui.notify("Service tier set to priority (2x cost, faster responses). Only affects gpt-5.4 models, regardless of provider.", "info");
     return;
   }
 
   if (trimmed === "off") {
     await writeGlobalServiceTier(ctx, undefined);
+    ctx.ui.setStatus("gsd-fast", undefined);
     ctx.ui.notify("Service tier disabled.", "info");
     return;
   }
 
   if (trimmed === "flex") {
     await writeGlobalServiceTier(ctx, "flex");
-    ctx.ui.notify("Service tier set to flex (0.5x cost, slower responses). Only affects gpt-5.4 models.", "info");
+    ctx.ui.setStatus("gsd-fast", formatServiceTierFooterStatus("flex", ctx.model?.id));
+    ctx.ui.notify("Service tier set to flex (0.5x cost, slower responses). Only affects gpt-5.4 models, regardless of provider.", "info");
     return;
   }
 

package/src/resources/extensions/gsd/session-lock.ts

@@ -239,7 +239,7 @@ export function acquireSessionLock(basePath: string): SessionLockResult {
         const elapsed = Date.now() - _lockAcquiredAt;
         if (elapsed < 1_800_000) {
           process.stderr.write(
-            `[gsd] Lock heartbeat mismatch after ${Math.round(elapsed / 1000)}s — event loop stall, continuing.\n`,
+            `[gsd] Lock heartbeat caught up after ${Math.round(elapsed / 1000)}s — long LLM call, no action needed.\n`,
           );
           return; // Suppress false positive
         }
@@ -299,7 +299,7 @@ export function acquireSessionLock(basePath: string): SessionLockResult {
             const elapsed = Date.now() - _lockAcquiredAt;
             if (elapsed < 1_800_000) {
               process.stderr.write(
-                `[gsd] Lock heartbeat mismatch after ${Math.round(elapsed / 1000)}s — event loop stall, continuing.\n`,
+                `[gsd] Lock heartbeat caught up after ${Math.round(elapsed / 1000)}s — long LLM call, no action needed.\n`,
               );
               return;
             }

package/src/resources/extensions/gsd/tests/activity-log.test.ts

@@ -4,7 +4,7 @@
  *   - activity-log-save.test.ts (caching, dedup, collision recovery)
  */
 
-import test from "node:test";
+import { describe, test, beforeEach, afterEach } from "node:test";
 import assert from "node:assert/strict";
 import { existsSync, mkdtempSync, mkdirSync, readdirSync, realpathSync, rmSync, utimesSync, writeFileSync, readFileSync } from "node:fs";
 import { join, dirname } from "node:path";
@@ -48,9 +48,12 @@ function createCtx(entries: unknown[]) {
 
 // ── Pruning ──────────────────────────────────────────────────────────────────
 
-test("pruneActivityLogs deletes old files, keeps recent and highest-seq", () => {
-  const dir = createTmpDir();
-  try {
+describe("pruneActivityLogs", () => {
+  let dir: string;
+  beforeEach(() => { dir = createTmpDir(); });
+  afterEach(() => { rmSync(dir, { recursive: true, force: true }); });
+
+  test("deletes old files, keeps recent and highest-seq", () => {
     const f001 = writeActivityFile(dir, "001", "execute-task-M001-S01-T01");
     writeActivityFile(dir, "002", "execute-task-M001-S01-T02");
     writeActivityFile(dir, "003", "execute-task-M001-S01-T03");
@@ -61,14 +64,9 @@ test("pruneActivityLogs deletes old files, keeps recent and highest-seq", () =>
     assert.ok(!remaining.includes("001-execute-task-M001-S01-T01.jsonl"));
     assert.ok(remaining.includes("002-execute-task-M001-S01-T02.jsonl"));
     assert.ok(remaining.includes("003-execute-task-M001-S01-T03.jsonl"));
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-});
+  });
 
-test("pruneActivityLogs preserves highest-seq even when all files are old", () => {
-  const dir = createTmpDir();
-  try {
+  test("preserves highest-seq even when all files are old", () => {
     const f001 = writeActivityFile(dir, "001", "t1");
     const f002 = writeActivityFile(dir, "002", "t2");
     const f003 = writeActivityFile(dir, "003", "t3");
@@ -78,14 +76,9 @@ test("pruneActivityLogs preserves highest-seq even when all files are old", () =
     const remaining = listFiles(dir);
     assert.equal(remaining.length, 1);
     assert.ok(remaining[0].startsWith("003-"));
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-});
+  });
 
-test("pruneActivityLogs with retentionDays=0 keeps only highest-seq", () => {
-  const dir = createTmpDir();
-  try {
+  test("with retentionDays=0 keeps only highest-seq", () => {
     writeActivityFile(dir, "001", "t1");
     writeActivityFile(dir, "002", "t2");
     writeActivityFile(dir, "003", "t3");
@@ -94,51 +87,31 @@ test("pruneActivityLogs with retentionDays=0 keeps only highest-seq", () => {
     const remaining = listFiles(dir);
     assert.equal(remaining.length, 1);
     assert.ok(remaining[0].startsWith("003-"));
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-});
+  });
 
-test("pruneActivityLogs no-op when all files are recent", () => {
-  const dir = createTmpDir();
-  try {
+  test("no-op when all files are recent", () => {
     writeActivityFile(dir, "001", "t1");
     writeActivityFile(dir, "002", "t2");
     writeActivityFile(dir, "003", "t3");
 
     pruneActivityLogs(dir, 30);
     assert.equal(listFiles(dir).length, 3);
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-});
+  });
 
-test("pruneActivityLogs handles empty directory", () => {
-  const dir = createTmpDir();
-  try {
+  test("handles empty directory", () => {
     assert.doesNotThrow(() => pruneActivityLogs(dir, 30));
     assert.equal(readdirSync(dir).length, 0);
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-});
+  });
 
-test("pruneActivityLogs preserves single old file (it is highest-seq)", () => {
-  const dir = createTmpDir();
-  try {
+  test("preserves single old file (it is highest-seq)", () => {
     const f = writeActivityFile(dir, "001", "t1");
     backdateFile(f, 100);
 
     pruneActivityLogs(dir, 30);
     assert.equal(listFiles(dir).length, 1);
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-});
+  });
 
-test("pruneActivityLogs ignores non-matching filenames", () => {
-  const dir = createTmpDir();
-  try {
+  test("ignores non-matching filenames", () => {
     const f001 = writeActivityFile(dir, "001", "t1");
     writeFileSync(join(dir, "notes.txt"), "some notes\n", "utf-8");
     backdateFile(f001, 40);
@@ -148,16 +121,17 @@ test("pruneActivityLogs ignores non-matching filenames", () => {
     assert.ok(remaining.includes("notes.txt"));
     // 001 is the only seq file, so it's highest-seq and survives
     assert.ok(remaining.includes("001-t1.jsonl"));
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
+  });
 });
 
 // ── Save: caching, dedup, collision recovery ─────────────────────────────────
 
-test("saveActivityLog caches sequence instead of rescanning", () => {
-  const baseDir = createTmpDir();
-  try {
+describe("saveActivityLog", () => {
+  let baseDir: string;
+  beforeEach(() => { baseDir = createTmpDir(); });
+  afterEach(() => { rmSync(baseDir, { recursive: true, force: true }); });
+
+  test("caches sequence instead of rescanning", () => {
     saveActivityLog(createCtx([{ kind: "first", n: 1 }]) as any, baseDir, "execute-task", "M001/S01/T01");
     writeFileSync(join(activityDir(baseDir), "999-external.jsonl"), '{"x":1}\n', "utf-8");
     saveActivityLog(createCtx([{ kind: "second", n: 2 }]) as any, baseDir, "execute-task", "M001/S01/T02");
@@ -166,14 +140,9 @@ test("saveActivityLog caches sequence instead of rescanning", () => {
     assert.ok(files.includes("001-execute-task-M001-S01-T01.jsonl"));
     assert.ok(files.includes("002-execute-task-M001-S01-T02.jsonl"));
     assert.ok(!files.some(f => f.startsWith("1000-")));
-  } finally {
-    rmSync(baseDir, { recursive: true, force: true });
-  }
-});
+  });
 
-test("saveActivityLog deduplicates identical snapshots for same unit", () => {
-  const baseDir = createTmpDir();
-  try {
+  test("deduplicates identical snapshots for same unit", () => {
     const ctx = createCtx([{ role: "assistant", content: "same" }]);
     saveActivityLog(ctx as any, baseDir, "plan-slice", "M002/S01");
     saveActivityLog(ctx as any, baseDir, "plan-slice", "M002/S01");
@@ -184,14 +153,9 @@ test("saveActivityLog deduplicates identical snapshots for same unit", () => {
     saveActivityLog(createCtx([{ role: "assistant", content: "changed" }]) as any, baseDir, "plan-slice", "M002/S01");
     files = listFiles(activityDir(baseDir));
     assert.equal(files.length, 2);
-  } finally {
-    rmSync(baseDir, { recursive: true, force: true });
-  }
-});
+  });
 
-test("saveActivityLog recovers on sequence collision", () => {
-  const baseDir = createTmpDir();
-  try {
+  test("recovers on sequence collision", () => {
     saveActivityLog(createCtx([{ turn: 1 }]) as any, baseDir, "execute-task", "M003/S02/T01");
     writeFileSync(join(activityDir(baseDir), "002-execute-task-M003-S02-T02.jsonl"), '{"collision":true}\n', "utf-8");
     saveActivityLog(createCtx([{ turn: 2 }]) as any, baseDir, "execute-task", "M003/S02/T02");
@@ -199,9 +163,7 @@ test("saveActivityLog recovers on sequence collision", () => {
     const files = listFiles(activityDir(baseDir));
     assert.ok(files.includes("002-execute-task-M003-S02-T02.jsonl"));
     assert.ok(files.includes("003-execute-task-M003-S02-T02.jsonl"));
-  } finally {
-    rmSync(baseDir, { recursive: true, force: true });
-  }
+  });
 });
 
 // ── Prompt text assertion ────────────────────────────────────────────────────

package/src/resources/extensions/gsd/tests/bundled-workflow-defs.test.ts

@@ -0,0 +1,180 @@
+/**
+ * Bundled workflow definition validation tests.
+ *
+ * Verifies that every example YAML in src/resources/skills/create-workflow/templates/
+ * passes validateDefinition() from definition-loader.ts with { valid: true, errors: [] }.
+ *
+ * Also validates scaffold template and structural properties of each example
+ * (step counts, feature usage) to guard against accidental regressions.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { parse } from "yaml";
+
+import { validateDefinition } from "../definition-loader.ts";
+
+// ─── Path resolution ─────────────────────────────────────────────────────
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+// Navigate from tests/ → extensions/gsd/ → extensions/ → resources/ → skills/create-workflow/templates/
+const templatesDir = join(
+  __dirname,
+  "..",
+  "..",
+  "..",
+  "skills",
+  "create-workflow",
+  "templates",
+);
+
+function loadYaml(filename: string): unknown {
+  const raw = readFileSync(join(templatesDir, filename), "utf-8");
+  return parse(raw);
+}
+
+// ─── Scaffold template ──────────────────────────────────────────────────
+
+test("scaffold template (workflow-definition.yaml) passes validation", () => {
+  const parsed = loadYaml("workflow-definition.yaml");
+  const result = validateDefinition(parsed);
+  assert.equal(result.valid, true, `Scaffold invalid: ${result.errors.join("; ")}`);
+  assert.equal(result.errors.length, 0);
+});
+
+// ─── blog-post-pipeline.yaml ────────────────────────────────────────────
+
+test("blog-post-pipeline.yaml passes validation", () => {
+  const parsed = loadYaml("blog-post-pipeline.yaml");
+  const result = validateDefinition(parsed);
+  assert.equal(result.valid, true, `Invalid: ${result.errors.join("; ")}`);
+  assert.equal(result.errors.length, 0);
+});
+
+test("blog-post-pipeline.yaml: 3 steps, context_from, params, content-heuristic", () => {
+  const parsed = loadYaml("blog-post-pipeline.yaml") as Record<string, unknown>;
+  const steps = parsed.steps as Array<Record<string, unknown>>;
+
+  // 3 steps
+  assert.equal(steps.length, 3, "Expected 3 steps");
+
+  // params defined
+  assert.ok(parsed.params, "Expected params to be defined");
+  const params = parsed.params as Record<string, string>;
+  assert.ok("topic" in params, "Expected 'topic' param");
+  assert.ok("audience" in params, "Expected 'audience' param");
+
+  // At least one step uses context_from
+  const hasContextFrom = steps.some(
+    (s) => Array.isArray(s.context_from) && s.context_from.length > 0,
+  );
+  assert.ok(hasContextFrom, "Expected at least one step with context_from");
+
+  // All steps use content-heuristic verify
+  for (const step of steps) {
+    const verify = step.verify as Record<string, unknown> | undefined;
+    assert.ok(verify, `Step "${step.id}" missing verify`);
+    assert.equal(verify.policy, "content-heuristic", `Step "${step.id}" should use content-heuristic`);
+  }
+});
+
+// ─── code-audit.yaml ────────────────────────────────────────────────────
+
+test("code-audit.yaml passes validation", () => {
+  const parsed = loadYaml("code-audit.yaml");
+  const result = validateDefinition(parsed);
+  assert.equal(result.valid, true, `Invalid: ${result.errors.join("; ")}`);
+  assert.equal(result.errors.length, 0);
+});
+
+test("code-audit.yaml: iterate with capture group and shell-command verify", () => {
+  const parsed = loadYaml("code-audit.yaml") as Record<string, unknown>;
+  const steps = parsed.steps as Array<Record<string, unknown>>;
+
+  // Find step with iterate
+  const iterateStep = steps.find((s) => s.iterate != null);
+  assert.ok(iterateStep, "Expected a step with iterate config");
+
+  const iterate = iterateStep.iterate as Record<string, unknown>;
+  assert.equal(typeof iterate.source, "string", "iterate.source must be a string");
+  assert.equal(typeof iterate.pattern, "string", "iterate.pattern must be a string");
+
+  // Pattern has a capture group
+  const pattern = iterate.pattern as string;
+  assert.ok(/\((?!\?)/.test(pattern), "iterate.pattern must contain a capture group");
+
+  // Pattern is valid regex
+  assert.doesNotThrow(() => new RegExp(pattern), "iterate.pattern must be valid regex");
+
+  // Has shell-command verify
+  const verify = iterateStep.verify as Record<string, unknown>;
+  assert.equal(verify.policy, "shell-command");
+  assert.equal(typeof verify.command, "string");
+});
+
+// ─── release-checklist.yaml ─────────────────────────────────────────────
+
+test("release-checklist.yaml passes validation", () => {
+  const parsed = loadYaml("release-checklist.yaml");
+  const result = validateDefinition(parsed);
+  assert.equal(result.valid, true, `Invalid: ${result.errors.join("; ")}`);
+  assert.equal(result.errors.length, 0);
+});
+
+test("release-checklist.yaml: diamond dependencies and human-review", () => {
+  const parsed = loadYaml("release-checklist.yaml") as Record<string, unknown>;
+  const steps = parsed.steps as Array<Record<string, unknown>>;
+
+  // 4 steps
+  assert.equal(steps.length, 4, "Expected 4 steps");
+
+  // Diamond pattern: two steps depend on the same parent
+  const changelog = steps.find((s) => s.id === "changelog");
+  const versionBump = steps.find((s) => s.id === "version-bump");
+  const testSuite = steps.find((s) => s.id === "test-suite");
+  const publish = steps.find((s) => s.id === "publish");
+
+  assert.ok(changelog, "Expected 'changelog' step");
+  assert.ok(versionBump, "Expected 'version-bump' step");
+  assert.ok(testSuite, "Expected 'test-suite' step");
+  assert.ok(publish, "Expected 'publish' step");
+
+  // Both version-bump and test-suite depend on changelog
+  const vbReqs = versionBump.requires as string[];
+  const tsReqs = testSuite.requires as string[];
+  assert.ok(vbReqs.includes("changelog"), "version-bump should require changelog");
+  assert.ok(tsReqs.includes("changelog"), "test-suite should require changelog");
+
+  // publish depends on both (diamond join)
+  const pubReqs = publish.requires as string[];
+  assert.ok(pubReqs.includes("version-bump"), "publish should require version-bump");
+  assert.ok(pubReqs.includes("test-suite"), "publish should require test-suite");
+
+  // publish uses human-review
+  const verify = publish.verify as Record<string, unknown>;
+  assert.equal(verify.policy, "human-review");
+});
+
+// ─── Cross-cutting: no path traversal in produces ───────────────────────
+
+test("no produces path contains '..'", () => {
+  const files = [
+    "blog-post-pipeline.yaml",
+    "code-audit.yaml",
+    "release-checklist.yaml",
+  ];
+
+  for (const file of files) {
+    const parsed = loadYaml(file) as Record<string, unknown>;
+    const steps = parsed.steps as Array<Record<string, unknown>>;
+    for (const step of steps) {
+      const produces = (step.produces as string[]) ?? [];
+      for (const p of produces) {
+        assert.ok(!p.includes(".."), `${file} step "${step.id}" produces path contains '..': ${p}`);
+      }
+    }
+  }
+});