gsd-pi 2.44.0 → 2.45.0-dev.1afbdaa

package/src/resources/extensions/gsd/tests/worktree.test.ts

@@ -17,9 +17,9 @@ import {
 } from "../worktree.ts";
 import { readIntegrationBranch } from "../git-service.ts";
 import { _resetHasChangesCache } from "../native-git-bridge.ts";
-import { createTestContext } from './test-helpers.ts';
+import { describe, test } from 'node:test';
+import assert from 'node:assert/strict';
 
-const { assertEq, assertTrue, report } = createTestContext();
 
 /**
  * Normalize a path for reliable comparison on Windows CI runners.
@@ -47,56 +47,56 @@ writeFileSync(join(base, ".gsd", "milestones", "M001", "slices", "S01", "S01-PLA
 run("git add .", base);
 run('git commit -m "chore: init"', base);
 
-async function main(): Promise<void> {
+describe('worktree', async () => {
 
   console.log("\n=== autoCommitCurrentBranch ===");
   // Clean — should return null
   const cleanResult = autoCommitCurrentBranch(base, "execute-task", "M001/S01/T01");
-  assertEq(cleanResult, null, "returns null for clean repo");
+  assert.deepStrictEqual(cleanResult, null, "returns null for clean repo");
 
   // Make dirty — reset the nativeHasChanges cache so the fresh dirt is detected
   _resetHasChangesCache();
   writeFileSync(join(base, "dirty.txt"), "uncommitted\n", "utf-8");
   const dirtyResult = autoCommitCurrentBranch(base, "execute-task", "M001/S01/T01");
-  assertTrue(dirtyResult !== null, "returns commit message for dirty repo");
-  assertTrue(dirtyResult!.includes("M001/S01/T01"), "commit message includes unit id");
-  assertEq(run("git status --short", base), "", "repo is clean after auto-commit");
+  assert.ok(dirtyResult !== null, "returns commit message for dirty repo");
+  assert.ok(dirtyResult!.includes("M001/S01/T01"), "commit message includes unit id");
+  assert.deepStrictEqual(run("git status --short", base), "", "repo is clean after auto-commit");
 
   console.log("\n=== getSliceBranchName ===");
-  assertEq(getSliceBranchName("M001", "S01"), "gsd/M001/S01", "branch name format correct");
-  assertEq(getSliceBranchName("M001", "S01", null), "gsd/M001/S01", "null worktree = plain branch");
-  assertEq(getSliceBranchName("M001", "S01", "my-wt"), "gsd/my-wt/M001/S01", "worktree-namespaced branch");
+  assert.deepStrictEqual(getSliceBranchName("M001", "S01"), "gsd/M001/S01", "branch name format correct");
+  assert.deepStrictEqual(getSliceBranchName("M001", "S01", null), "gsd/M001/S01", "null worktree = plain branch");
+  assert.deepStrictEqual(getSliceBranchName("M001", "S01", "my-wt"), "gsd/my-wt/M001/S01", "worktree-namespaced branch");
 
   console.log("\n=== parseSliceBranch ===");
   const plain = parseSliceBranch("gsd/M001/S01");
-  assertTrue(plain !== null, "parses plain branch");
-  assertEq(plain!.worktreeName, null, "plain branch has no worktree name");
-  assertEq(plain!.milestoneId, "M001", "plain branch milestone");
-  assertEq(plain!.sliceId, "S01", "plain branch slice");
+  assert.ok(plain !== null, "parses plain branch");
+  assert.deepStrictEqual(plain!.worktreeName, null, "plain branch has no worktree name");
+  assert.deepStrictEqual(plain!.milestoneId, "M001", "plain branch milestone");
+  assert.deepStrictEqual(plain!.sliceId, "S01", "plain branch slice");
 
   const namespaced = parseSliceBranch("gsd/feature-auth/M001/S01");
-  assertTrue(namespaced !== null, "parses worktree-namespaced branch");
-  assertEq(namespaced!.worktreeName, "feature-auth", "worktree name extracted");
-  assertEq(namespaced!.milestoneId, "M001", "namespaced branch milestone");
-  assertEq(namespaced!.sliceId, "S01", "namespaced branch slice");
+  assert.ok(namespaced !== null, "parses worktree-namespaced branch");
+  assert.deepStrictEqual(namespaced!.worktreeName, "feature-auth", "worktree name extracted");
+  assert.deepStrictEqual(namespaced!.milestoneId, "M001", "namespaced branch milestone");
+  assert.deepStrictEqual(namespaced!.sliceId, "S01", "namespaced branch slice");
 
   const invalid = parseSliceBranch("main");
-  assertEq(invalid, null, "non-slice branch returns null");
+  assert.deepStrictEqual(invalid, null, "non-slice branch returns null");
 
   const worktreeBranch = parseSliceBranch("worktree/foo");
-  assertEq(worktreeBranch, null, "worktree/ prefix is not a slice branch");
+  assert.deepStrictEqual(worktreeBranch, null, "worktree/ prefix is not a slice branch");
 
   console.log("\n=== SLICE_BRANCH_RE ===");
-  assertTrue(SLICE_BRANCH_RE.test("gsd/M001/S01"), "regex matches plain branch");
-  assertTrue(SLICE_BRANCH_RE.test("gsd/my-wt/M001/S01"), "regex matches worktree branch");
-  assertTrue(!SLICE_BRANCH_RE.test("main"), "regex rejects main");
-  assertTrue(!SLICE_BRANCH_RE.test("gsd/"), "regex rejects bare gsd/");
-  assertTrue(!SLICE_BRANCH_RE.test("worktree/foo"), "regex rejects worktree/foo");
+  assert.ok(SLICE_BRANCH_RE.test("gsd/M001/S01"), "regex matches plain branch");
+  assert.ok(SLICE_BRANCH_RE.test("gsd/my-wt/M001/S01"), "regex matches worktree branch");
+  assert.ok(!SLICE_BRANCH_RE.test("main"), "regex rejects main");
+  assert.ok(!SLICE_BRANCH_RE.test("gsd/"), "regex rejects bare gsd/");
+  assert.ok(!SLICE_BRANCH_RE.test("worktree/foo"), "regex rejects worktree/foo");
 
   console.log("\n=== detectWorktreeName ===");
-  assertEq(detectWorktreeName("/projects/myapp"), null, "no worktree in plain path");
-  assertEq(detectWorktreeName("/projects/myapp/.gsd/worktrees/feature-auth"), "feature-auth", "detects worktree name");
-  assertEq(detectWorktreeName("/projects/myapp/.gsd/worktrees/my-wt/subdir"), "my-wt", "detects worktree with subdir");
+  assert.deepStrictEqual(detectWorktreeName("/projects/myapp"), null, "no worktree in plain path");
+  assert.deepStrictEqual(detectWorktreeName("/projects/myapp/.gsd/worktrees/feature-auth"), "feature-auth", "detects worktree name");
+  assert.deepStrictEqual(detectWorktreeName("/projects/myapp/.gsd/worktrees/my-wt/subdir"), "my-wt", "detects worktree with subdir");
 
   // ═══════════════════════════════════════════════════════════════════════
   // Integration branch — facade-level tests
@@ -115,16 +115,16 @@ async function main(): Promise<void> {
     run("git add -A && git commit -m init", repo);
 
     run("git checkout -b f-123-thing", repo);
-    assertEq(getCurrentBranch(repo), "f-123-thing", "on feature branch");
+    assert.deepStrictEqual(getCurrentBranch(repo), "f-123-thing", "on feature branch");
 
     const commitsBefore = run("git rev-list --count HEAD", repo);
     captureIntegrationBranch(repo, "M001");
-    assertEq(readIntegrationBranch(repo, "M001"), "f-123-thing",
+    assert.deepStrictEqual(readIntegrationBranch(repo, "M001"), "f-123-thing",
       "captureIntegrationBranch records the current branch");
 
     // Metadata is stored in external state, not committed to git.
     const commitsAfter = run("git rev-list --count HEAD", repo);
-    assertEq(commitsAfter, commitsBefore, "captureIntegrationBranch does not create a git commit");
+    assert.deepStrictEqual(commitsAfter, commitsBefore, "captureIntegrationBranch does not create a git commit");
 
     rmSync(repo, { recursive: true, force: true });
   }
@@ -144,7 +144,7 @@ async function main(): Promise<void> {
     run("git checkout -b gsd/M001/S01", repo);
     captureIntegrationBranch(repo, "M001");
 
-    assertEq(readIntegrationBranch(repo, "M001"), null,
+    assert.deepStrictEqual(readIntegrationBranch(repo, "M001"), null,
       "capture from slice branch is a no-op");
 
     rmSync(repo, { recursive: true, force: true });
@@ -167,12 +167,12 @@ async function main(): Promise<void> {
 
     // Without milestone set, getMainBranch returns "main"
     setActiveMilestoneId(repo, null);
-    assertEq(getMainBranch(repo), "main",
+    assert.deepStrictEqual(getMainBranch(repo), "main",
       "getMainBranch returns main without milestone set");
 
     // With milestone set, getMainBranch returns feature branch
     setActiveMilestoneId(repo, "M001");
-    assertEq(getMainBranch(repo), "my-feature",
+    assert.deepStrictEqual(getMainBranch(repo), "my-feature",
       "getMainBranch returns integration branch with milestone set");
 
     rmSync(repo, { recursive: true, force: true });
@@ -180,22 +180,22 @@ async function main(): Promise<void> {
 
   // ── detectWorktreeName: symlink-resolved paths ───────────────────────────
   console.log("\n=== detectWorktreeName (symlink-resolved paths) ===");
-  assertEq(
+  assert.deepStrictEqual(
     detectWorktreeName("/Users/fran/.gsd/projects/89e1c9ad49bf/worktrees/M001"),
     "M001",
     "detects milestone in symlink-resolved path",
   );
-  assertEq(
+  assert.deepStrictEqual(
     detectWorktreeName("/Users/fran/.gsd/projects/abc123/worktrees/M002/subdir"),
     "M002",
     "detects milestone with trailing subdir in symlink-resolved path",
   );
-  assertEq(
+  assert.deepStrictEqual(
     detectWorktreeName("/Users/fran/.gsd/projects/abc123"),
     null,
     "returns null for project root without worktrees segment",
   );
-  assertEq(
+  assert.deepStrictEqual(
     detectWorktreeName("/foo/.gsd/worktrees/M001"),
     "M001",
     "still detects direct layout path",
@@ -211,7 +211,7 @@ async function main(): Promise<void> {
   
   // With GSD_PROJECT_ROOT env var set (layer 1 — coordinator passes it)
   process.env.GSD_PROJECT_ROOT = "/real/project";
-  assertEq(
+  assert.deepStrictEqual(
     resolveProjectRoot("/Users/fran/.gsd/projects/89e1c9ad49bf/worktrees/M001"),
     "/real/project",
     "uses GSD_PROJECT_ROOT when set",
@@ -219,7 +219,7 @@ async function main(): Promise<void> {
   delete process.env.GSD_PROJECT_ROOT;
 
   // Without GSD_PROJECT_ROOT, direct layout still works (no ~/.gsd collision)
-  assertEq(
+  assert.deepStrictEqual(
     resolveProjectRoot("/some/repo"),
     "/some/repo",
     "ignores GSD_PROJECT_ROOT override for non-worktree paths",
@@ -227,19 +227,19 @@ async function main(): Promise<void> {
   delete process.env.GSD_PROJECT_ROOT;
 
   // Without GSD_PROJECT_ROOT, direct layout still works (no ~/.gsd collision)
-  assertEq(
+  assert.deepStrictEqual(
     resolveProjectRoot("/foo/.gsd/worktrees/M001"),
     "/foo",
     "still resolves direct layout path",
   );
-  assertEq(
+  assert.deepStrictEqual(
     resolveProjectRoot("/some/repo"),
     "/some/repo",
     "returns unchanged for non-worktree path",
   );
 
   // Without GSD_PROJECT_ROOT, direct layout with nested subdirs
-  assertEq(
+  assert.deepStrictEqual(
     resolveProjectRoot("/data/.gsd/worktrees/M003/nested"),
     "/data",
     "resolves correctly with nested subdirs after worktree name (direct layout)",
@@ -264,7 +264,7 @@ async function main(): Promise<void> {
     mkdirSync(deep, { recursive: true });
 
     process.env.GSD_HOME = join(fakeHome, ".gsd");
-    assertEq(
+    assert.deepStrictEqual(
       normalizePath(resolveProjectRoot(realpathSync(deep))),
       normalizePath(project),
       "resolves to real project root from deep symlink-resolved worktree path",
@@ -276,10 +276,4 @@ async function main(): Promise<void> {
   }
 
   rmSync(base, { recursive: true, force: true });
-  report();
-}
-
-main().catch((error) => {
-  console.error(error);
-  process.exit(1);
 });

package/src/resources/extensions/gsd/tests/write-intercept.test.ts

@@ -0,0 +1,76 @@
+// GSD Extension — write-intercept unit tests
+// Tests isBlockedStateFile() and BLOCKED_WRITE_ERROR constant.
+
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { isBlockedStateFile, BLOCKED_WRITE_ERROR } from '../write-intercept.ts';
+
+// ─── isBlockedStateFile: blocked paths ───────────────────────────────────
+
+test('write-intercept: blocks unix .gsd/STATE.md path', () => {
+  assert.strictEqual(isBlockedStateFile('/project/.gsd/STATE.md'), true);
+});
+
+test('write-intercept: blocks relative path with dir prefix before .gsd/STATE.md', () => {
+  assert.strictEqual(isBlockedStateFile('project/.gsd/STATE.md'), true);
+});
+
+test('write-intercept: blocks bare relative .gsd/STATE.md (no leading separator)', () => {
+  // (^|[/\\]) matches paths that start with .gsd/ — covers the case where write
+  // tools receive a bare relative path before the file exists (realpathSync fails).
+  assert.strictEqual(isBlockedStateFile('.gsd/STATE.md'), true);
+});
+
+test('write-intercept: blocks nested project .gsd/STATE.md path', () => {
+  assert.strictEqual(isBlockedStateFile('/Users/dev/my-project/.gsd/STATE.md'), true);
+});
+
+test('write-intercept: blocks .gsd/projects/<name>/STATE.md (symlinked projects path)', () => {
+  assert.strictEqual(isBlockedStateFile('/home/user/.gsd/projects/my-project/STATE.md'), true);
+});
+
+// ─── isBlockedStateFile: allowed paths ───────────────────────────────────
+
+test('write-intercept: allows .gsd/ROADMAP.md', () => {
+  assert.strictEqual(isBlockedStateFile('/project/.gsd/ROADMAP.md'), false);
+});
+
+test('write-intercept: allows .gsd/PLAN.md', () => {
+  assert.strictEqual(isBlockedStateFile('/project/.gsd/PLAN.md'), false);
+});
+
+test('write-intercept: allows .gsd/REQUIREMENTS.md', () => {
+  assert.strictEqual(isBlockedStateFile('/project/.gsd/REQUIREMENTS.md'), false);
+});
+
+test('write-intercept: allows .gsd/SUMMARY.md', () => {
+  assert.strictEqual(isBlockedStateFile('/project/.gsd/SUMMARY.md'), false);
+});
+
+test('write-intercept: allows .gsd/PROJECT.md', () => {
+  assert.strictEqual(isBlockedStateFile('/project/.gsd/PROJECT.md'), false);
+});
+
+test('write-intercept: allows regular source files', () => {
+  assert.strictEqual(isBlockedStateFile('/project/src/index.ts'), false);
+});
+
+test('write-intercept: allows slice plan files', () => {
+  assert.strictEqual(isBlockedStateFile('/project/.gsd/milestones/M001/slices/S01/S01-PLAN.md'), false);
+});
+
+test('write-intercept: does not block files named STATE.md outside .gsd/', () => {
+  assert.strictEqual(isBlockedStateFile('/project/docs/STATE.md'), false);
+});
+
+// ─── BLOCKED_WRITE_ERROR: content ────────────────────────────────────────
+
+test('write-intercept: BLOCKED_WRITE_ERROR is a non-empty string', () => {
+  assert.strictEqual(typeof BLOCKED_WRITE_ERROR, 'string');
+  assert.ok(BLOCKED_WRITE_ERROR.length > 0);
+});
+
+test('write-intercept: BLOCKED_WRITE_ERROR mentions engine tool calls', () => {
+  assert.ok(BLOCKED_WRITE_ERROR.includes('gsd_complete_task'), 'should mention gsd_complete_task');
+  assert.ok(BLOCKED_WRITE_ERROR.includes('engine tool calls'), 'should mention engine tool calls');
+});

package/src/resources/extensions/gsd/tools/complete-milestone.ts

@@ -11,12 +11,17 @@ import { mkdirSync } from "node:fs";
 
 import {
   transaction,
+  getMilestone,
   getMilestoneSlices,
+  getSliceTasks,
   _getAdapter,
 } from "../gsd-db.js";
 import { resolveMilestonePath, clearPathCache } from "../paths.js";
 import { saveFile, clearParseCache } from "../files.js";
 import { invalidateStateCache } from "../state.js";
+import { renderAllProjections } from "../workflow-projections.js";
+import { writeManifest } from "../workflow-manifest.js";
+import { appendEvent } from "../workflow-events.js";
 
 export interface CompleteMilestoneParams {
   milestoneId: string;
@@ -31,6 +36,11 @@ export interface CompleteMilestoneParams {
   lessonsLearned: string[];
   followUps: string;
   deviations: string;
+  verificationPassed: boolean;
+  /** Optional caller-provided identity for audit trail */
+  actorName?: string;
+  /** Optional caller-provided reason this action was triggered */
+  triggerReason?: string;
 }
 
 export interface CompleteMilestoneResult {
@@ -108,22 +118,53 @@ export async function handleCompleteMilestone(
     return { error: "title is required and must be a non-empty string" };
   }
 
-  // ── Verify all slices are complete ───────────────────────────────────────
-  const slices = getMilestoneSlices(params.milestoneId);
-  if (slices.length === 0) {
-    return { error: `no slices found for milestone ${params.milestoneId}` };
+  // ── Verify that verification passed ─────────────────────────────────────
+  if (params.verificationPassed !== true) {
+    return { error: "verification did not pass — milestone completion blocked. verificationPassed must be explicitly set to true after all verification steps succeed" };
   }
 
-  const incompleteSlices = slices.filter(s => s.status !== "complete" && s.status !== "done");
-  if (incompleteSlices.length > 0) {
-    const incompleteIds = incompleteSlices.map(s => `${s.id} (status: ${s.status})`).join(", ");
-    return { error: `incomplete slices: ${incompleteIds}` };
-  }
-
-  // ── DB writes inside a transaction ──────────────────────────────────────
+  // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
   const completedAt = new Date().toISOString();
+  let guardError: string | null = null;
 
   transaction(() => {
+    // State machine preconditions (inside txn for atomicity)
+    const milestone = getMilestone(params.milestoneId);
+    if (!milestone) {
+      guardError = `milestone not found: ${params.milestoneId}`;
+      return;
+    }
+    if (milestone.status === "complete" || milestone.status === "done") {
+      guardError = `milestone ${params.milestoneId} is already complete`;
+      return;
+    }
+
+    // Verify all slices are complete
+    const slices = getMilestoneSlices(params.milestoneId);
+    if (slices.length === 0) {
+      guardError = `no slices found for milestone ${params.milestoneId}`;
+      return;
+    }
+
+    const incompleteSlices = slices.filter(s => s.status !== "complete" && s.status !== "done");
+    if (incompleteSlices.length > 0) {
+      const incompleteIds = incompleteSlices.map(s => `${s.id} (status: ${s.status})`).join(", ");
+      guardError = `incomplete slices: ${incompleteIds}`;
+      return;
+    }
+
+    // Deep check: verify all tasks in all slices are complete
+    for (const slice of slices) {
+      const tasks = getSliceTasks(params.milestoneId, slice.id);
+      const incompleteTasks = tasks.filter(t => t.status !== "complete" && t.status !== "done");
+      if (incompleteTasks.length > 0) {
+        const ids = incompleteTasks.map(t => `${t.id} (status: ${t.status})`).join(", ");
+        guardError = `slice ${slice.id} has incomplete tasks: ${ids}`;
+        return;
+      }
+    }
+
+    // All guards passed — perform write
     const adapter = _getAdapter()!;
     adapter.prepare(
       `UPDATE milestones SET status = 'complete', completed_at = :completed_at WHERE id = :mid`,
@@ -133,6 +174,10 @@ export async function handleCompleteMilestone(
     });
   });
 
+  if (guardError) {
+    return { error: guardError };
+  }
+
   // ── Filesystem operations (outside transaction) ─────────────────────────
   const summaryMd = renderMilestoneSummaryMarkdown(params);
 
@@ -169,6 +214,24 @@ export async function handleCompleteMilestone(
   clearPathCache();
   clearParseCache();
 
+  // ── Post-mutation hook: projections, manifest, event log ───────────────
+  try {
+    await renderAllProjections(basePath, params.milestoneId);
+    writeManifest(basePath);
+    appendEvent(basePath, {
+      cmd: "complete-milestone",
+      params: { milestoneId: params.milestoneId },
+      ts: new Date().toISOString(),
+      actor: "agent",
+      actor_name: params.actorName,
+      trigger_reason: params.triggerReason,
+    });
+  } catch (hookErr) {
+    process.stderr.write(
+      `gsd: complete-milestone post-mutation hook warning: ${(hookErr as Error).message}\n`,
+    );
+  }
+
   return {
     milestoneId: params.milestoneId,
     summaryPath,

package/src/resources/extensions/gsd/tools/complete-slice.ts

@@ -15,14 +15,20 @@ import {
   transaction,
   insertMilestone,
   insertSlice,
+  getSlice,
   getSliceTasks,
+  getMilestone,
   updateSliceStatus,
   _getAdapter,
 } from "../gsd-db.js";
 import { resolveSliceFile, resolveSlicePath, clearPathCache } from "../paths.js";
+import { checkOwnership, sliceUnitKey } from "../unit-ownership.js";
 import { saveFile, clearParseCache } from "../files.js";
 import { invalidateStateCache } from "../state.js";
 import { renderRoadmapCheckboxes } from "../markdown-renderer.js";
+import { renderAllProjections } from "../workflow-projections.js";
+import { writeManifest } from "../workflow-manifest.js";
+import { appendEvent } from "../workflow-events.js";
 
 export interface CompleteSliceResult {
   sliceId: string;
@@ -200,27 +206,60 @@ export async function handleCompleteSlice(
     return { error: "milestoneId is required and must be a non-empty string" };
   }
 
-  // ── Verify all tasks are complete ───────────────────────────────────────
-  const tasks = getSliceTasks(params.milestoneId, params.sliceId);
-  if (tasks.length === 0) {
-    return { error: `no tasks found for slice ${params.sliceId} in milestone ${params.milestoneId}` };
+  // ── Ownership check (opt-in: only enforced when claim file exists) ──────
+  const ownershipErr = checkOwnership(
+    basePath,
+    sliceUnitKey(params.milestoneId, params.sliceId),
+    params.actorName,
+  );
+  if (ownershipErr) {
+    return { error: ownershipErr };
   }
 
-  const incompleteTasks = tasks.filter(t => t.status !== "complete");
-  if (incompleteTasks.length > 0) {
-    const incompleteIds = incompleteTasks.map(t => `${t.id} (status: ${t.status})`).join(", ");
-    return { error: `incomplete tasks: ${incompleteIds}` };
-  }
-
-  // ── DB writes inside a transaction ──────────────────────────────────────
+  // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
   const completedAt = new Date().toISOString();
+  let guardError: string | null = null;
 
   transaction(() => {
+    // State machine preconditions (inside txn for atomicity).
+    // Milestone/slice not existing is OK — insertMilestone/insertSlice below will auto-create.
+    // Only block if they exist and are closed.
+    const milestone = getMilestone(params.milestoneId);
+    if (milestone && (milestone.status === "complete" || milestone.status === "done")) {
+      guardError = `cannot complete slice in a closed milestone: ${params.milestoneId} (status: ${milestone.status})`;
+      return;
+    }
+
+    const slice = getSlice(params.milestoneId, params.sliceId);
+    if (slice && (slice.status === "complete" || slice.status === "done")) {
+      guardError = `slice ${params.sliceId} is already complete — use gsd_slice_reopen first if you need to redo it`;
+      return;
+    }
+
+    // Verify all tasks are complete
+    const tasks = getSliceTasks(params.milestoneId, params.sliceId);
+    if (tasks.length === 0) {
+      guardError = `no tasks found for slice ${params.sliceId} in milestone ${params.milestoneId}`;
+      return;
+    }
+
+    const incompleteTasks = tasks.filter(t => t.status !== "complete" && t.status !== "done");
+    if (incompleteTasks.length > 0) {
+      const incompleteIds = incompleteTasks.map(t => `${t.id} (status: ${t.status})`).join(", ");
+      guardError = `incomplete tasks: ${incompleteIds}`;
+      return;
+    }
+
+    // All guards passed — perform writes
     insertMilestone({ id: params.milestoneId });
     insertSlice({ id: params.sliceId, milestoneId: params.milestoneId });
     updateSliceStatus(params.milestoneId, params.sliceId, "complete", completedAt);
   });
 
+  if (guardError) {
+    return { error: guardError };
+  }
+
   // ── Filesystem operations (outside transaction) ─────────────────────────
   // If disk render fails, roll back the DB status so deriveState() and
   // verifyExpectedArtifact() stay consistent (both say "not done").
@@ -291,6 +330,24 @@ export async function handleCompleteSlice(
   clearPathCache();
   clearParseCache();
 
+  // ── Post-mutation hook: projections, manifest, event log ───────────────
+  try {
+    await renderAllProjections(basePath, params.milestoneId);
+    writeManifest(basePath);
+    appendEvent(basePath, {
+      cmd: "complete-slice",
+      params: { milestoneId: params.milestoneId, sliceId: params.sliceId },
+      ts: new Date().toISOString(),
+      actor: "agent",
+      actor_name: params.actorName,
+      trigger_reason: params.triggerReason,
+    });
+  } catch (hookErr) {
+    process.stderr.write(
+      `gsd: complete-slice post-mutation hook warning: ${(hookErr as Error).message}\n`,
+    );
+  }
+
   return {
     sliceId: params.sliceId,
     milestoneId: params.milestoneId,

package/src/resources/extensions/gsd/tools/complete-task.ts

@@ -17,12 +17,19 @@ import {
   insertSlice,
   insertTask,
   insertVerificationEvidence,
+  getMilestone,
+  getSlice,
+  getTask,
   _getAdapter,
 } from "../gsd-db.js";
 import { resolveSliceFile, resolveTasksDir, clearPathCache } from "../paths.js";
+import { checkOwnership, taskUnitKey } from "../unit-ownership.js";
 import { saveFile, clearParseCache } from "../files.js";
 import { invalidateStateCache } from "../state.js";
 import { renderPlanCheckboxes } from "../markdown-renderer.js";
+import { renderAllProjections } from "../workflow-projections.js";
+import { writeManifest } from "../workflow-manifest.js";
+import { appendEvent } from "../workflow-events.js";
 
 export interface CompleteTaskResult {
   taskId: string;
@@ -131,10 +138,43 @@ export async function handleCompleteTask(
     return { error: "milestoneId is required and must be a non-empty string" };
   }
 
-  // ── DB writes inside a transaction ──────────────────────────────────────
+  // ── Ownership check (opt-in: only enforced when claim file exists) ──────
+  const ownershipErr = checkOwnership(
+    basePath,
+    taskUnitKey(params.milestoneId, params.sliceId, params.taskId),
+    params.actorName,
+  );
+  if (ownershipErr) {
+    return { error: ownershipErr };
+  }
+
+  // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
   const completedAt = new Date().toISOString();
+  let guardError: string | null = null;
 
   transaction(() => {
+    // State machine preconditions (inside txn for atomicity).
+    // Milestone/slice not existing is OK — insertMilestone/insertSlice below will auto-create.
+    // Only block if they exist and are closed.
+    const milestone = getMilestone(params.milestoneId);
+    if (milestone && (milestone.status === "complete" || milestone.status === "done")) {
+      guardError = `cannot complete task in a closed milestone: ${params.milestoneId} (status: ${milestone.status})`;
+      return;
+    }
+
+    const slice = getSlice(params.milestoneId, params.sliceId);
+    if (slice && (slice.status === "complete" || slice.status === "done")) {
+      guardError = `cannot complete task in a closed slice: ${params.sliceId} (status: ${slice.status})`;
+      return;
+    }
+
+    const existingTask = getTask(params.milestoneId, params.sliceId, params.taskId);
+    if (existingTask && (existingTask.status === "complete" || existingTask.status === "done")) {
+      guardError = `task ${params.taskId} is already complete — use gsd_task_reopen first if you need to redo it`;
+      return;
+    }
+
+    // All guards passed — perform writes
     insertMilestone({ id: params.milestoneId });
     insertSlice({ id: params.sliceId, milestoneId: params.milestoneId });
     insertTask({
@@ -167,6 +207,10 @@ export async function handleCompleteTask(
     }
   });
 
+  if (guardError) {
+    return { error: guardError };
+  }
+
   // ── Filesystem operations (outside transaction) ─────────────────────────
   // If disk render fails, roll back the DB status so deriveState() and
   // verifyExpectedArtifact() stay consistent (both say "not done").
@@ -236,6 +280,24 @@ export async function handleCompleteTask(
   clearPathCache();
   clearParseCache();
 
+  // ── Post-mutation hook: projections, manifest, event log ───────────────
+  try {
+    await renderAllProjections(basePath, params.milestoneId);
+    writeManifest(basePath);
+    appendEvent(basePath, {
+      cmd: "complete-task",
+      params: { milestoneId: params.milestoneId, sliceId: params.sliceId, taskId: params.taskId },
+      ts: new Date().toISOString(),
+      actor: "agent",
+      actor_name: params.actorName,
+      trigger_reason: params.triggerReason,
+    });
+  } catch (hookErr) {
+    process.stderr.write(
+      `gsd: complete-task post-mutation hook warning: ${(hookErr as Error).message}\n`,
+    );
+  }
+
   return {
     taskId: params.taskId,
     sliceId: params.sliceId,