gsd-pi 2.71.0-dev.e17e0ce → 2.72.0-dev.593fa74

package/dist/resources/extensions/gsd/auto-prompts.js

@@ -15,7 +15,8 @@ import { getLoadedSkills } from "@gsd/pi-coding-agent";
 import { join, basename } from "node:path";
 import { existsSync } from "node:fs";
 import { computeBudgets, resolveExecutorContextWindow, truncateAtSectionBoundary } from "./context-budget.js";
-import { getPendingGates } from "./gsd-db.js";
+import { getPendingGatesForTurn } from "./gsd-db.js";
+import { assertGateCoverage, getGatesForTurn, } from "./gate-registry.js";
 import { formatDecisionsCompact, formatRequirementsCompact } from "./structured-data-formatter.js";
 import { readPhaseAnchor, formatAnchorForPrompt } from "./phase-anchor.js";
 import { logWarning } from "./workflow-logger.js";
@@ -1221,6 +1222,13 @@ export async function buildExecuteTaskPrompt(mid, sid, sTitle, tid, tTitle, base
         ? `### Runtime Context\nSource: \`.gsd/RUNTIME.md\`\n\n${runtimeContent.trim()}`
         : "";
     const phaseAnchorSection = planAnchor ? formatAnchorForPrompt(planAnchor) : "";
+    // Task-scoped gates owned by execute-task (Q5/Q6/Q7). Pull only the
+    // gates that plan-slice actually seeded for this task — tasks with no
+    // external dependencies legitimately skip Q5, tasks with no runtime
+    // load dimension skip Q6, etc.
+    const etPending = getPendingGatesForTurn(mid, sid, "execute-task", tid);
+    assertGateCoverage(etPending, "execute-task", { requireAll: false });
+    const gatesToClose = renderGatesToCloseBlock(getGatesForTurn("execute-task"), { pending: new Set(etPending.map((g) => g.gate_id)), allowOmit: true });
     return loadPrompt("execute-task", {
         overridesSection,
         runtimeContext,
@@ -1238,6 +1246,7 @@ export async function buildExecuteTaskPrompt(mid, sid, sTitle, tid, tTitle, base
         taskSummaryPath,
         inlinedTemplates,
         verificationBudget,
+        gatesToClose,
         skillActivation: buildSkillActivationBlock({
             base,
             milestoneId: mid,
@@ -1298,6 +1307,15 @@ export async function buildCompleteSlicePrompt(mid, _midTitle, sid, sTitle, base
     const sliceRel = relSlicePath(base, mid, sid);
     const sliceSummaryPath = join(base, `${sliceRel}/${sid}-SUMMARY.md`);
     const sliceUatPath = join(base, `${sliceRel}/${sid}-UAT.md`);
+    // Gates owned by complete-slice (e.g. Q8). Pull from the DB so the
+    // prompt only prompts for gates the plan actually seeded. The tool
+    // handler closes each gate based on the SUMMARY.md section content
+    // after the assistant calls gsd_complete_slice.
+    const csPending = getPendingGatesForTurn(mid, sid, "complete-slice");
+    // coverage check: every pending row must be owned by complete-slice.
+    // requireAll:false because a slice may have already closed some gates.
+    assertGateCoverage(csPending, "complete-slice", { requireAll: false });
+    const gatesToClose = renderGatesToCloseBlock(getGatesForTurn("complete-slice"), { pending: new Set(csPending.map((g) => g.gate_id)), allowOmit: true });
     return loadPrompt("complete-slice", {
         workingDirectory: base,
         milestoneId: mid, sliceId: sid, sliceTitle: sTitle,
@@ -1306,6 +1324,7 @@ export async function buildCompleteSlicePrompt(mid, _midTitle, sid, sTitle, base
         inlinedContext,
         sliceSummaryPath,
         sliceUatPath,
+        gatesToClose,
     });
 }
 export async function buildCompleteMilestonePrompt(mid, midTitle, base, level) {
@@ -1498,6 +1517,15 @@ export async function buildValidateMilestonePrompt(mid, midTitle, base, level) {
     const inlinedContext = capPreamble(`## Inlined Context (preloaded — do not re-read these files)\n\n${inlined.join("\n\n---\n\n")}`);
     const validationOutputPath = join(base, `${relMilestonePath(base, mid)}/${mid}-VALIDATION.md`);
     const roadmapOutputPath = `${relMilestonePath(base, mid)}/${mid}-ROADMAP.md`;
+    // Every milestone validation turn owns MV01–MV04 unconditionally: the
+    // registry is the source of truth for which gates the validator must
+    // address, and the block below is what the template renders so the
+    // assistant can never accidentally skip one.
+    const mvGates = getGatesForTurn("validate-milestone");
+    const gatesToEvaluate = renderGatesToCloseBlock(mvGates, {
+        pending: new Set(mvGates.map((g) => g.id)),
+        allowOmit: false,
+    });
     return loadPrompt("validate-milestone", {
         workingDirectory: base,
         milestoneId: mid,
@@ -1506,6 +1534,7 @@ export async function buildValidateMilestonePrompt(mid, midTitle, base, level) {
         inlinedContext,
         validationPath: validationOutputPath,
         remediationRound: String(remediationRound),
+        gatesToEvaluate,
         skillActivation: buildSkillActivationBlock({
             base,
             milestoneId: mid,
@@ -1740,26 +1769,43 @@ export async function buildReactiveExecutePrompt(mid, midTitle, sid, sTitle, rea
     });
 }
 // ─── Gate Evaluation ──────────────────────────────────────────────────────
-const GATE_QUESTIONS = {
-    Q3: {
-        question: "How can this be exploited?",
-        guidance: [
-            "Identify abuse scenarios: parameter tampering, replay attacks, privilege escalation.",
-            "Map data exposure risks: PII, tokens, secrets accessible through this slice.",
-            "Define input trust boundaries: untrusted user input reaching DB, API, or filesystem.",
-            "If none apply, return verdict 'omitted' with rationale explaining why.",
-        ].join("\n"),
-    },
-    Q4: {
-        question: "What existing promises does this break?",
-        guidance: [
-            "List which existing requirements (R001, R003, etc.) are touched by this slice.",
-            "Identify what must be re-tested after shipping.",
-            "Flag decisions that should be revisited given the new scope.",
-            "If no existing requirements are affected, return verdict 'omitted'.",
-        ].join("\n"),
-    },
-};
+//
+// Gate definitions (question, guidance, owner turn) now live in
+// gate-registry.ts so that prompt builders, dispatch rules, state
+// derivation, and tool handlers all consult the same source of truth.
+// See gate-registry.ts for the full ownership map.
+/**
+ * Render a "Gates to Close" block for turns like `complete-slice` and
+ * `validate-milestone` that own gates which are closed as a side-effect
+ * of writing artifact sections (not via a dedicated gate-evaluate
+ * subagent loop).
+ *
+ * Returns a plain-text block or an empty string if there are no gates to
+ * close, so callers can drop it straight into a template variable.
+ */
+function renderGatesToCloseBlock(gates, opts) {
+    const applicable = gates.filter((g) => opts.pending.has(g.id));
+    if (applicable.length === 0)
+        return "";
+    const lines = [];
+    lines.push("## Gates to Close");
+    lines.push("");
+    lines.push("These quality gates are still pending for this unit. You MUST address every one before calling the closing tool — the handler closes the DB row based on whether the corresponding artifact section is present.");
+    lines.push("");
+    for (const def of applicable) {
+        lines.push(`### ${def.id} — ${def.promptSection}`);
+        lines.push("");
+        lines.push(`**Question:** ${def.question}`);
+        lines.push("");
+        lines.push(def.guidance);
+        if (opts.allowOmit) {
+            lines.push("");
+            lines.push(`If this gate genuinely does not apply to this unit, leave the **${def.promptSection}** section empty and the handler will record it as \`omitted\`. Otherwise, fill the section with concrete evidence.`);
+        }
+        lines.push("");
+    }
+    return lines.join("\n").trimEnd();
+}
 export async function buildParallelResearchSlicesPrompt(mid, midTitle, slices, basePath) {
     // Build individual research-slice prompts for each slice
     const subagentSections = [];
@@ -1784,24 +1830,33 @@ export async function buildParallelResearchSlicesPrompt(mid, midTitle, slices, b
     });
 }
 export async function buildGateEvaluatePrompt(mid, midTitle, sid, sTitle, base) {
-    const pending = getPendingGates(mid, sid, "slice");
+    // Pull only the gates this turn actually owns (Q3/Q4). Filter via the
+    // registry so that scope:"slice" gates owned by other turns (Q8) can't
+    // leak into this prompt and can't block dispatch via silent skip.
+    const pending = getPendingGatesForTurn(mid, sid, "gate-evaluate");
+    // Fails loudly if the pending list contains a gate id the registry
+    // doesn't own for this turn. Missing owned gates is allowed here —
+    // `gate-evaluate` is dispatched whenever *any* of its owned gates are
+    // pending, not only when all of them are.
+    assertGateCoverage(pending, "gate-evaluate", { requireAll: false });
     // Load the slice plan for context
     const planFile = resolveSliceFile(base, mid, sid, "PLAN");
     const planContent = planFile ? (await loadFile(planFile)) ?? "(plan file empty)" : "(plan file not found)";
-    // Build per-gate subagent prompts
+    // Build per-gate subagent prompts from the pending rows. Because the
+    // registry has already validated every row, `getGateDefinition` cannot
+    // return undefined here.
+    const pendingIds = new Set(pending.map((g) => g.gate_id));
+    const gateDefs = getGatesForTurn("gate-evaluate").filter((def) => pendingIds.has(def.id));
     const subagentSections = [];
     const gateListLines = [];
-    for (const gate of pending) {
-        const meta = GATE_QUESTIONS[gate.gate_id];
-        if (!meta)
-            continue;
-        gateListLines.push(`- **${gate.gate_id}**: ${meta.question}`);
+    for (const def of gateDefs) {
+        gateListLines.push(`- **${def.id}**: ${def.question}`);
         const subPrompt = [
-            `You are evaluating quality gate **${gate.gate_id}** for slice ${sid} (${sTitle}).`,
+            `You are evaluating quality gate **${def.id}** for slice ${sid} (${sTitle}).`,
             "",
-            `## Question: ${meta.question}`,
+            `## Question: ${def.question}`,
             "",
-            meta.guidance,
+            def.guidance,
             "",
             "## Slice Plan",
             "",
@@ -1813,13 +1868,13 @@ export async function buildGateEvaluatePrompt(mid, midTitle, sid, sTitle, base)
             `Call the \`gsd_save_gate_result\` tool with:`,
             `- \`milestoneId\`: "${mid}"`,
             `- \`sliceId\`: "${sid}"`,
-            `- \`gateId\`: "${gate.gate_id}"`,
+            `- \`gateId\`: "${def.id}"`,
             "- `verdict`: \"pass\" (no concerns), \"flag\" (concerns found), or \"omitted\" (not applicable)",
             "- `rationale`: one-sentence justification",
             "- `findings`: detailed markdown findings (or empty if omitted)",
         ].join("\n");
         subagentSections.push([
-            `### ${gate.gate_id}: ${meta.question}`,
+            `### ${def.id}: ${def.question}`,
             "",
             "Use this as the prompt for a `subagent` call:",
             "",

package/dist/resources/extensions/gsd/auto-start.js

@@ -190,16 +190,33 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
     //
     // Precedence:
     // 1) Explicit session override via /gsd model (this session)
-    // 2) GSD model preferences from PREFERENCES.md
-    // 3) Current session model from settings/session restore
+    // 2) GSD model preferences from PREFERENCES.md (validated against live auth)
+    // 3) Current session model from settings/session restore (if provider ready)
     //
     // This preserves #3517 defaults while honoring explicit runtime model
     // selection for subsequent /gsd runs in the same session.
     const manualSessionOverride = getSessionModelOverride(ctx.sessionManager.getSessionId());
     const preferredModel = resolveDefaultSessionModel(ctx.model?.provider);
+    // Validate the preferred model against the live registry + provider auth so
+    // an unconfigured PREFERENCES.md entry (no API key / OAuth) can't become the
+    // start-model snapshot. Without this, every subsequent unit would try to
+    // fall back to an unusable model.
+    let validatedPreferredModel;
+    if (preferredModel) {
+        const { resolveModelId } = await import("./auto-model-selection.js");
+        const available = ctx.modelRegistry.getAvailable();
+        const match = resolveModelId(`${preferredModel.provider}/${preferredModel.id}`, available, ctx.model?.provider);
+        if (match) {
+            validatedPreferredModel = { provider: match.provider, id: match.id };
+        }
+        else {
+            ctx.ui.notify(`Preferred model ${preferredModel.provider}/${preferredModel.id} from PREFERENCES.md is not configured; falling back to session default.`, "warning");
+        }
+    }
+    const sessionModelReady = ctx.model && ctx.modelRegistry.isProviderRequestReady(ctx.model.provider);
     const startModelSnapshot = manualSessionOverride
-        ?? preferredModel
-        ?? (ctx.model
+        ?? validatedPreferredModel
+        ?? (sessionModelReady && ctx.model
             ? { provider: ctx.model.provider, id: ctx.model.id }
             : null);
     try {
@@ -453,6 +470,9 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         // Successfully resolved an active milestone — reset the re-entry guard
         s.consecutiveCompleteBootstraps = 0;
         // ── Initialize session state ──
+        // Notify shared phase state so subagent conflict checks can fire
+        const { activateGSD: activateGSDPhaseState } = await import("../shared/gsd-phase-state.js");
+        activateGSDPhaseState();
         s.active = true;
         s.stepMode = requestedStepMode;
         s.verbose = verboseMode;

package/dist/resources/extensions/gsd/auto.js

@@ -34,6 +34,7 @@ import { preDispatchHealthGate, resetProactiveHealing, setLevelChangeCallback, }
 import { clearSkillSnapshot } from "./skill-discovery.js";
 import { captureAvailableSkills, resetSkillTelemetry, } from "./skill-telemetry.js";
 import { getRtkSessionSavings } from "../shared/rtk-session-stats.js";
+import { deactivateGSD } from "../shared/gsd-phase-state.js";
 import { initMetrics, resetMetrics, getLedger, getProjectTotals, formatCost, formatTokenCount, } from "./metrics.js";
 import { logWarning } from "./workflow-logger.js";
 import { homedir } from "node:os";
@@ -374,6 +375,7 @@ function handleLostSessionLock(ctx, lockStatus) {
     });
     s.active = false;
     s.paused = false;
+    deactivateGSD();
     clearUnitTimeout();
     restoreProjectRootEnv();
     restoreMilestoneLockEnv();
@@ -406,6 +408,7 @@ function handleLostSessionLock(ctx, lockStatus) {
 function cleanupAfterLoopExit(ctx) {
     s.currentUnit = null;
     s.active = false;
+    deactivateGSD();
     clearUnitTimeout();
     restoreProjectRootEnv();
     restoreMilestoneLockEnv();
@@ -743,6 +746,7 @@ export async function pauseAuto(ctx, _pi, _errorContext) {
     _resetPendingResolve();
     s.active = false;
     s.paused = true;
+    deactivateGSD();
     restoreProjectRootEnv();
     restoreMilestoneLockEnv();
     s.pendingVerificationRetry = null;

package/dist/resources/extensions/gsd/bootstrap/db-tools.js

@@ -919,12 +919,12 @@ export function registerDbTools(pi) {
     const saveGateResultTool = {
         name: "gsd_save_gate_result",
         label: "Save Gate Result",
-        description: "Save the result of a quality gate evaluation (Q3-Q8) to the GSD database. " +
+        description: "Save the result of a quality gate evaluation (Q3-Q8 or MV01-MV04) to the GSD database. " +
             "Called by gate evaluation sub-agents after analyzing a specific quality question.",
         promptSnippet: "Save quality gate evaluation result (verdict, rationale, findings)",
         promptGuidelines: [
             "Use gsd_save_gate_result after evaluating a quality gate question.",
-            "gateId must be one of: Q3, Q4, Q5, Q6, Q7, Q8.",
+            "gateId must be one of: Q3, Q4, Q5, Q6, Q7, Q8, MV01, MV02, MV03, MV04.",
             "verdict must be: pass (no concerns), flag (concerns found), or omitted (not applicable).",
             "rationale should be a one-sentence justification for the verdict.",
             "findings should contain detailed markdown analysis (or empty string if omitted).",
@@ -932,7 +932,7 @@ export function registerDbTools(pi) {
         parameters: Type.Object({
             milestoneId: Type.String({ description: "Milestone ID (e.g. M001)" }),
             sliceId: Type.String({ description: "Slice ID (e.g. S01)" }),
-            gateId: Type.String({ description: "Gate ID: Q3, Q4, Q5, Q6, Q7, or Q8" }),
+            gateId: Type.String({ description: "Gate ID: Q3, Q4, Q5, Q6, Q7, Q8, MV01, MV02, MV03, or MV04" }),
             taskId: Type.Optional(Type.String({ description: "Task ID for task-scoped gates (Q5/Q6/Q7)" })),
             verdict: Type.String({ description: "pass, flag, or omitted" }),
             rationale: Type.String({ description: "One-sentence justification" }),

package/dist/resources/extensions/gsd/bootstrap/register-shortcuts.js

@@ -71,9 +71,6 @@ export function registerShortcuts(pi) {
         description: shortcutDesc(GSD_SHORTCUTS.parallel.action, GSD_SHORTCUTS.parallel.command),
         handler: openParallelOverlay,
     });
-    // Fallback for terminals where Ctrl+Alt letter chords are not forwarded reliably.
-    pi.registerShortcut(Key.ctrlShift(GSD_SHORTCUTS.parallel.key), {
-        description: shortcutDesc(`${GSD_SHORTCUTS.parallel.action} (fallback)`, GSD_SHORTCUTS.parallel.command),
-        handler: openParallelOverlay,
-    });
+    // No Ctrl+Shift+P fallback — conflicts with cycleModelBackward (shift+ctrl+p).
+    // Use Ctrl+Alt+P or /gsd parallel watch instead.
 }

package/dist/resources/extensions/gsd/doctor-providers.js

@@ -147,10 +147,33 @@ const PROVIDER_ROUTES = {
     openai: ["github-copilot", "openai-codex"],
     google: ["google-gemini-cli"],
 };
+/**
+ * Providers that use external CLI authentication (not API keys).
+ * These are always considered "ok" — the host CLI handles auth.
+ */
+const CLI_AUTH_PROVIDERS = new Set([
+    "claude-code",
+    "openai-codex",
+    "google-gemini-cli",
+    "google-antigravity",
+]);
 function checkLlmProviders() {
     const required = collectConfiguredModelProviders();
     const results = [];
     for (const providerId of required) {
+        // CLI-authenticated providers don't need API keys — skip key check
+        if (CLI_AUTH_PROVIDERS.has(providerId)) {
+            const info = PROVIDER_REGISTRY.find(p => p.id === providerId);
+            results.push({
+                name: providerId,
+                label: info?.label ?? providerId,
+                category: "llm",
+                status: "ok",
+                message: `${info?.label ?? providerId} — CLI auth (no key needed)`,
+                required: true,
+            });
+            continue;
+        }
         const info = PROVIDER_REGISTRY.find(p => p.id === providerId);
         const label = providerId === "anthropic-vertex"
             ? "Anthropic Vertex"

package/dist/resources/extensions/gsd/error-classifier.js

@@ -20,6 +20,9 @@ export function resetRetryState(state) {
 // ── Classification ──────────────────────────────────────────────────────────
 const PERMANENT_RE = /auth|unauthorized|forbidden|invalid.*key|invalid.*api|billing|quota exceeded|account/i;
 const RATE_LIMIT_RE = /rate.?limit|too many requests|429/i;
+// OpenRouter affordability-style quota errors should be treated as transient
+// so core retry logic can lower maxTokens and continue in-session.
+const AFFORDABILITY_RE = /requires more credits|can only afford|insufficient credits|not enough credits|fewer max_tokens/i;
 const NETWORK_RE = /network|ECONNRESET|ETIMEDOUT|ECONNREFUSED|socket hang up|fetch failed|connection.*reset|dns/i;
 const SERVER_RE = /internal server error|500|502|503|overloaded|server_error|api_error|service.?unavailable/i;
 // ECONNRESET/ECONNREFUSED are in NETWORK_RE (same-model retry first).
@@ -42,7 +45,7 @@ const RESET_DELAY_RE = /reset in (\d+)s/i;
  */
 export function classifyError(errorMsg, retryAfterMs) {
     const isPermanent = PERMANENT_RE.test(errorMsg);
-    const isRateLimit = RATE_LIMIT_RE.test(errorMsg);
+    const isRateLimit = RATE_LIMIT_RE.test(errorMsg) || AFFORDABILITY_RE.test(errorMsg);
     // 1. Permanent — but rate limit takes precedence
     if (isPermanent && !isRateLimit) {
         return { kind: "permanent" };

package/dist/resources/extensions/gsd/gate-registry.js

@@ -0,0 +1,208 @@
+/**
+ * GSD Gate Registry — single source of truth for quality-gate ownership.
+ *
+ * Each gate declares which workflow turn owns it, the scope at which it is
+ * persisted in the `quality_gates` table, and the question/guidance text used
+ * in the prompt that turn sends. The registry replaces the ad-hoc
+ * `GATE_QUESTIONS` table that used to live in `auto-prompts.ts`, and every
+ * layer of the prompt system (prompt builders, dispatch rules, state
+ * derivation, tool handlers) consults it so a pending gate can never be
+ * silently dropped.
+ *
+ * Design notes:
+ *   - `GATE_REGISTRY` is exhaustiveness-checked against `GateId` via
+ *     `satisfies Record<GateId, GateDefinition>`, so adding a new GateId
+ *     without a registry entry is a compile error.
+ *   - `getGatesForTurn(turn)` returns the definitions a turn owns.
+ *   - `assertGateCoverage(pending, turn)` throws a GSDError if the pending
+ *     list for a turn contains unknown gates, or if any gate owned by the
+ *     turn is missing from the pending list.
+ */
+import { GSDError, GSD_PARSE_ERROR } from "./errors.js";
+export const GATE_REGISTRY = {
+    Q3: {
+        id: "Q3",
+        scope: "slice",
+        ownerTurn: "gate-evaluate",
+        question: "How can this be exploited?",
+        guidance: [
+            "Identify abuse scenarios: parameter tampering, replay attacks, privilege escalation.",
+            "Map data exposure risks: PII, tokens, secrets accessible through this slice.",
+            "Define input trust boundaries: untrusted user input reaching DB, API, or filesystem.",
+            "If none apply, return verdict 'omitted' with rationale explaining why.",
+        ].join("\n"),
+        promptSection: "Abuse Surface",
+    },
+    Q4: {
+        id: "Q4",
+        scope: "slice",
+        ownerTurn: "gate-evaluate",
+        question: "What existing promises does this break?",
+        guidance: [
+            "List which existing requirements (R001, R003, etc.) are touched by this slice.",
+            "Identify what must be re-tested after shipping.",
+            "Flag decisions that should be revisited given the new scope.",
+            "If no existing requirements are affected, return verdict 'omitted'.",
+        ].join("\n"),
+        promptSection: "Broken Promises",
+    },
+    Q5: {
+        id: "Q5",
+        scope: "task",
+        ownerTurn: "execute-task",
+        question: "What breaks when dependencies fail?",
+        guidance: [
+            "Enumerate the task's external dependencies (APIs, filesystem, network, subprocesses).",
+            "Describe the failure path for each: timeout, malformed response, connection loss.",
+            "Verify the implementation handles each failure or explicitly bubbles the error.",
+            "Return verdict 'omitted' only if the task has no external dependencies.",
+        ].join("\n"),
+        promptSection: "Failure Modes",
+    },
+    Q6: {
+        id: "Q6",
+        scope: "task",
+        ownerTurn: "execute-task",
+        question: "What is the 10x load breakpoint?",
+        guidance: [
+            "Identify the resource that saturates first at 10x the expected load.",
+            "Describe the protection applied (pool sizing, rate limiting, pagination, caching).",
+            "Return verdict 'omitted' if the task has no runtime load dimension.",
+        ].join("\n"),
+        promptSection: "Load Profile",
+    },
+    Q7: {
+        id: "Q7",
+        scope: "task",
+        ownerTurn: "execute-task",
+        question: "What negative tests protect this task?",
+        guidance: [
+            "List malformed inputs, error paths, and boundary conditions the tests cover.",
+            "Point to the specific test files or cases that assert each negative scenario.",
+            "Return verdict 'omitted' only if the task has no meaningful negative surface.",
+        ].join("\n"),
+        promptSection: "Negative Tests",
+    },
+    Q8: {
+        id: "Q8",
+        scope: "slice",
+        ownerTurn: "complete-slice",
+        question: "How will ops know this slice is healthy or broken?",
+        guidance: [
+            "Describe the health signal (metric, log line, dashboard) that proves the slice works.",
+            "Describe the failure signal that triggers an alert or paging.",
+            "Document the recovery procedure and any monitoring gaps.",
+            "Return verdict 'omitted' only for slices with no runtime behavior at all.",
+        ].join("\n"),
+        promptSection: "Operational Readiness",
+    },
+    MV01: {
+        id: "MV01",
+        scope: "milestone",
+        ownerTurn: "validate-milestone",
+        question: "Is every success criterion in the milestone roadmap satisfied?",
+        guidance: [
+            "Walk the success-criteria checklist from the milestone roadmap.",
+            "For each criterion, point to the slice / assessment / verification evidence that proves it.",
+            "Return verdict 'flag' if any criterion is unmet or unverifiable.",
+        ].join("\n"),
+        promptSection: "Success Criteria Checklist",
+    },
+    MV02: {
+        id: "MV02",
+        scope: "milestone",
+        ownerTurn: "validate-milestone",
+        question: "Does every slice have a SUMMARY.md and a passing assessment?",
+        guidance: [
+            "Confirm every slice listed in the roadmap has a SUMMARY.md.",
+            "Confirm each slice has an ASSESSMENT verdict of 'pass' (or justified 'omitted').",
+            "Flag missing artifacts and slices with outstanding follow-ups or known limitations.",
+        ].join("\n"),
+        promptSection: "Slice Delivery Audit",
+    },
+    MV03: {
+        id: "MV03",
+        scope: "milestone",
+        ownerTurn: "validate-milestone",
+        question: "Do the slices integrate end-to-end?",
+        guidance: [
+            "Trace at least one cross-slice flow proving the pieces compose.",
+            "Flag gaps where two slices were built in isolation with no integration evidence.",
+        ].join("\n"),
+        promptSection: "Cross-Slice Integration",
+    },
+    MV04: {
+        id: "MV04",
+        scope: "milestone",
+        ownerTurn: "validate-milestone",
+        question: "Are all touched requirements covered and still coherent?",
+        guidance: [
+            "For each requirement advanced, validated, surfaced, or invalidated across the milestone's slices, confirm the milestone-level evidence matches.",
+            "Flag requirements that slices claim to advance but no artifact proves.",
+        ].join("\n"),
+        promptSection: "Requirement Coverage",
+    },
+};
+/** Stable ordered lists per owner turn — iteration order matches declaration. */
+const ORDERED_GATES = Object.values(GATE_REGISTRY);
+/** Return every gate owned by a turn, in stable declaration order. */
+export function getGatesForTurn(turn) {
+    return ORDERED_GATES.filter((g) => g.ownerTurn === turn);
+}
+/** Return the set of gate ids a turn owns. */
+export function getGateIdsForTurn(turn) {
+    return new Set(getGatesForTurn(turn).map((g) => g.id));
+}
+/** Look up a definition by gate id, or undefined if unknown. */
+export function getGateDefinition(id) {
+    return GATE_REGISTRY[id];
+}
+/** Look up the owner turn for a gate id. Throws if the gate is unknown. */
+export function getOwnerTurn(id) {
+    const def = GATE_REGISTRY[id];
+    if (!def) {
+        throw new GSDError(GSD_PARSE_ERROR, `gate-registry: unknown gate id "${id}"`);
+    }
+    return def.ownerTurn;
+}
+/**
+ * Assert that the pending gate rows for a turn match what the registry says
+ * the turn owns. Fails loudly rather than silently skipping.
+ *
+ * - Every row in `pending` must have a definition whose `ownerTurn` matches `turn`.
+ *   (The caller is responsible for scoping the pending list — e.g. filtering
+ *   by slice scope before passing it in.)
+ * - `options.requireAll` (default true): every gate the turn owns must appear
+ *   in `pending`. Set to false for turns like `execute-task` that only need
+ *   coverage for the subset of gates that were seeded (e.g. tasks with no
+ *   external dependencies have no Q5 row).
+ */
+export function assertGateCoverage(pending, turn, options = {}) {
+    const requireAll = options.requireAll ?? true;
+    const expected = getGateIdsForTurn(turn);
+    const pendingIds = new Set(pending.map((g) => g.gate_id));
+    const unknown = [];
+    for (const id of pendingIds) {
+        const def = getGateDefinition(id);
+        if (!def) {
+            unknown.push(id);
+            continue;
+        }
+        if (def.ownerTurn !== turn) {
+            unknown.push(`${id} (owned by ${def.ownerTurn}, not ${turn})`);
+        }
+    }
+    if (unknown.length > 0) {
+        throw new GSDError(GSD_PARSE_ERROR, `assertGateCoverage: turn "${turn}" received pending gates it does not own: ${unknown.join(", ")}`);
+    }
+    if (requireAll) {
+        const missing = [];
+        for (const id of expected) {
+            if (!pendingIds.has(id))
+                missing.push(id);
+        }
+        if (missing.length > 0) {
+            throw new GSDError(GSD_PARSE_ERROR, `assertGateCoverage: turn "${turn}" is missing required gates: ${missing.join(", ")}`);
+        }
+    }
+}

package/dist/resources/extensions/gsd/gsd-db.js

@@ -8,6 +8,7 @@ import { createRequire } from "node:module";
 import { existsSync, copyFileSync, mkdirSync, realpathSync } from "node:fs";
 import { dirname } from "node:path";
 import { GSDError, GSD_STALE_STATE } from "./errors.js";
+import { getGateIdsForTurn } from "./gate-registry.js";
 import { logError, logWarning } from "./workflow-logger.js";
 const _require = createRequire(import.meta.url);
 let providerName = null;
@@ -1927,3 +1928,43 @@ export function getPendingSliceGateCount(milestoneId, sliceId) {
      WHERE milestone_id = :mid AND slice_id = :sid AND scope = 'slice' AND status = 'pending'`).get({ ":mid": milestoneId, ":sid": sliceId });
     return row ? row["cnt"] : 0;
 }
+/**
+ * Return pending gate rows owned by a specific workflow turn.
+ *
+ * Unlike `getPendingGates(..., scope)`, this filters by the registry's
+ * `ownerTurn` metadata so callers can distinguish Q3/Q4 (owned by
+ * gate-evaluate) from Q8 (owned by complete-slice) even though both are
+ * scope:"slice". Pass `taskId` to narrow task-scoped results to one task.
+ */
+export function getPendingGatesForTurn(milestoneId, sliceId, turn, taskId) {
+    if (!currentDb)
+        return [];
+    const ids = getGateIdsForTurn(turn);
+    if (ids.size === 0)
+        return [];
+    const idList = [...ids];
+    const placeholders = idList.map((_, i) => `:gid${i}`).join(",");
+    const params = {
+        ":mid": milestoneId,
+        ":sid": sliceId,
+    };
+    idList.forEach((id, i) => {
+        params[`:gid${i}`] = id;
+    });
+    let sql = `SELECT * FROM quality_gates
+     WHERE milestone_id = :mid AND slice_id = :sid
+       AND status = 'pending'
+       AND gate_id IN (${placeholders})`;
+    if (taskId !== undefined) {
+        sql += ` AND task_id = :tid`;
+        params[":tid"] = taskId;
+    }
+    return currentDb.prepare(sql).all(params).map(rowToGate);
+}
+/**
+ * Count pending gates for a turn. Convenience wrapper used by state
+ * derivation to decide whether a phase transition should pause.
+ */
+export function getPendingGateCountForTurn(milestoneId, sliceId, turn) {
+    return getPendingGatesForTurn(milestoneId, sliceId, turn).length;
+}