gsd-pi 2.73.1-dev.d987996 → 2.74.0-dev.14c45ac

package/src/resources/extensions/gsd/tests/token-profile.test.ts

@@ -34,11 +34,12 @@ const typesSrc = readFileSync(join(__dirname, "..", "types.ts"), "utf-8");
 // Type Definitions
 // ═══════════════════════════════════════════════════════════════════════════
 
-test("types: TokenProfile type exported with budget/balanced/quality", () => {
+test("types: TokenProfile type exported with budget/balanced/quality/burn-max", () => {
   assert.ok(typesSrc.includes("export type TokenProfile"), "TokenProfile should be exported");
   assert.match(typesSrc, /["']budget["']/, "should include budget");
   assert.match(typesSrc, /["']balanced["']/, "should include balanced");
   assert.match(typesSrc, /["']quality["']/, "should include quality");
+  assert.match(typesSrc, /["']burn-max["']/, "should include burn-max");
 });
 
 test("types: InlineLevel type exported with full/standard/minimal", () => {
@@ -91,7 +92,7 @@ test("preferences: KNOWN_PREFERENCE_KEYS includes token_profile and phases", ()
 // Profile Resolution
 // ═══════════════════════════════════════════════════════════════════════════
 
-test("profile: resolveProfileDefaults exists and handles all 3 tiers", () => {
+test("profile: resolveProfileDefaults exists and handles all 4 tiers", () => {
   assert.ok(
     preferencesSrc.includes("export function resolveProfileDefaults"),
     "resolveProfileDefaults should be exported",
@@ -99,8 +100,9 @@ test("profile: resolveProfileDefaults exists and handles all 3 tiers", () => {
   assert.ok(
     preferencesSrc.includes('case "budget"') &&
     preferencesSrc.includes('case "balanced"') &&
-    preferencesSrc.includes('case "quality"'),
-    "resolveProfileDefaults should handle all 3 tiers",
+    preferencesSrc.includes('case "quality"') &&
+    preferencesSrc.includes('case "burn-max"'),
+    "resolveProfileDefaults should handle all 4 tiers",
   );
 });
 
@@ -158,6 +160,7 @@ test("profile: resolveInlineLevel maps profile to inline level", () => {
   assert.ok(preferencesSrc.includes('case "budget": return "minimal"'), "budget → minimal");
   assert.ok(preferencesSrc.includes('case "balanced": return "standard"'), "balanced → standard");
   assert.ok(preferencesSrc.includes('case "quality": return "full"'), "quality → full");
+  assert.ok(preferencesSrc.includes('case "burn-max": return "full"'), "burn-max → full");
 });
 
 // ═══════════════════════════════════════════════════════════════════════════
@@ -167,7 +170,7 @@ test("profile: resolveInlineLevel maps profile to inline level", () => {
 test("validate: validatePreferences handles token_profile", () => {
   assert.ok(
     preferencesSrc.includes("preferences.token_profile") &&
-    preferencesSrc.includes("budget, balanced, quality"),
+    preferencesSrc.includes("budget, balanced, quality, burn-max"),
     "validatePreferences should validate token_profile enum values",
   );
 });
@@ -263,6 +266,6 @@ test("dispatch: phase skip guards return null (not stop)", () => {
   const researchGuard = dispatchSrc.match(/skip_research\).*?return null/s);
   assert.ok(researchGuard, "skip_research guard should return null (fall-through)");
 
-  const reassessGuard = dispatchSrc.match(/reassess_after_slice\).*?return null/s);
+  const reassessGuard = dispatchSrc.match(/reassess_after_slice.*?return null/s);
   assert.ok(reassessGuard, "reassess_after_slice guard should return null (fall-through)");
 });

package/src/resources/extensions/gsd/tests/uok-audit-unified.test.ts

@@ -0,0 +1,101 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, readFileSync, rmSync, existsSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { emitJournalEvent } from "../journal.ts";
+import { saveActivityLog } from "../activity-log.ts";
+import { initMetrics, resetMetrics, snapshotUnitMetrics } from "../metrics.ts";
+import { setLogBasePath, logWarning } from "../workflow-logger.ts";
+import { setUnifiedAuditEnabled } from "../uok/audit-toggle.ts";
+
+function readAuditEvents(basePath: string): Array<Record<string, unknown>> {
+  const file = join(basePath, ".gsd", "audit", "events.jsonl");
+  if (!existsSync(file)) return [];
+  const raw = readFileSync(file, "utf-8");
+  return raw
+    .split("\n")
+    .filter(Boolean)
+    .map((line) => JSON.parse(line) as Record<string, unknown>);
+}
+
+function makeMockContext(entries: unknown[]): any {
+  return {
+    sessionManager: {
+      getEntries: () => entries,
+    },
+  };
+}
+
+test("unified audit plane bridges journal/activity/metrics/workflow logger into audit envelope log", () => {
+  const basePath = mkdtempSync(join(tmpdir(), "gsd-uok-audit-"));
+  setUnifiedAuditEnabled(true);
+  try {
+    emitJournalEvent(basePath, {
+      ts: new Date().toISOString(),
+      flowId: "trace-123",
+      seq: 1,
+      eventType: "iteration-start",
+      data: { turnId: "turn-123", unitId: "M001/S01/T01" },
+    });
+
+    const activityCtx = makeMockContext([
+      { type: "message", message: { role: "assistant", content: [{ type: "text", text: "hello" }] } },
+    ]);
+    const activityPath = saveActivityLog(activityCtx, basePath, "execute-task", "M001/S01/T01");
+    assert.ok(activityPath);
+
+    initMetrics(basePath);
+    const metricsCtx = makeMockContext([
+      {
+        type: "message",
+        message: {
+          role: "assistant",
+          usage: { input: 10, output: 5, cacheRead: 0, cacheWrite: 0, totalTokens: 15, cost: 0.01 },
+          content: [],
+        },
+      },
+    ]);
+    const unit = snapshotUnitMetrics(
+      metricsCtx,
+      "execute-task",
+      "M001/S01/T01",
+      Date.now() - 1000,
+      "openai/gpt-5.4",
+      { traceId: "trace-123", turnId: "turn-123" },
+    );
+    assert.ok(unit);
+    resetMetrics();
+
+    setLogBasePath(basePath);
+    logWarning("engine", "audit bridge check", { id: "turn-123" });
+
+    const events = readAuditEvents(basePath);
+    const types = new Set(events.map((event) => String(event.type ?? "")));
+    assert.ok(types.has("journal-iteration-start"));
+    assert.ok(types.has("activity-log-saved"));
+    assert.ok(types.has("unit-metrics-snapshot"));
+    assert.ok(types.has("workflow-log-warn"));
+  } finally {
+    setUnifiedAuditEnabled(false);
+    resetMetrics();
+    rmSync(basePath, { recursive: true, force: true });
+  }
+});
+
+test("unified audit bridge is disabled when toggle is off", () => {
+  const basePath = mkdtempSync(join(tmpdir(), "gsd-uok-audit-off-"));
+  setUnifiedAuditEnabled(false);
+  try {
+    emitJournalEvent(basePath, {
+      ts: new Date().toISOString(),
+      flowId: "trace-off",
+      seq: 1,
+      eventType: "iteration-start",
+    });
+    const events = readAuditEvents(basePath);
+    assert.equal(events.length, 0);
+  } finally {
+    rmSync(basePath, { recursive: true, force: true });
+  }
+});

package/src/resources/extensions/gsd/tests/uok-contracts.test.ts

@@ -0,0 +1,85 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import type {
+  AuditEventEnvelope,
+  GateResult,
+  TurnContract,
+  TurnResult,
+  UokNodeKind,
+} from "../uok/contracts.ts";
+import { buildAuditEnvelope } from "../uok/audit.ts";
+
+test("uok contracts serialize/deserialize turn envelopes", () => {
+  const contract: TurnContract = {
+    traceId: "trace-1",
+    turnId: "turn-1",
+    iteration: 1,
+    basePath: "/tmp/project",
+    unitType: "execute-task",
+    unitId: "M001.S01.T01",
+    startedAt: new Date().toISOString(),
+  };
+
+  const gate: GateResult = {
+    gateId: "Q3",
+    gateType: "policy",
+    outcome: "pass",
+    failureClass: "none",
+    attempt: 1,
+    maxAttempts: 1,
+    retryable: false,
+    evaluatedAt: new Date().toISOString(),
+  };
+
+  const result: TurnResult = {
+    traceId: contract.traceId,
+    turnId: contract.turnId,
+    iteration: contract.iteration,
+    unitType: contract.unitType,
+    unitId: contract.unitId,
+    status: "completed",
+    failureClass: "none",
+    phaseResults: [
+      { phase: "dispatch", action: "next", ts: new Date().toISOString() },
+      { phase: "unit", action: "continue", ts: new Date().toISOString() },
+      { phase: "finalize", action: "next", ts: new Date().toISOString() },
+    ],
+    gateResults: [gate],
+    startedAt: contract.startedAt,
+    finishedAt: new Date().toISOString(),
+  };
+
+  const roundTrip = JSON.parse(JSON.stringify(result)) as TurnResult;
+  assert.equal(roundTrip.turnId, "turn-1");
+  assert.equal(roundTrip.gateResults?.[0]?.gateId, "Q3");
+  assert.equal(roundTrip.phaseResults.length, 3);
+});
+
+test("uok contracts include required DAG node kinds", () => {
+  const required: UokNodeKind[] = [
+    "unit",
+    "hook",
+    "subagent",
+    "team-worker",
+    "verification",
+    "reprocess",
+  ];
+  assert.deepEqual(required.length, 6);
+});
+
+test("uok audit envelope includes trace/turn/causality fields", () => {
+  const event: AuditEventEnvelope = buildAuditEnvelope({
+    traceId: "trace-xyz",
+    turnId: "turn-xyz",
+    causedBy: "turn-start",
+    category: "orchestration",
+    type: "turn-result",
+    payload: { status: "completed" },
+  });
+
+  assert.equal(event.traceId, "trace-xyz");
+  assert.equal(event.turnId, "turn-xyz");
+  assert.equal(event.causedBy, "turn-start");
+  assert.equal(event.payload.status, "completed");
+});

package/src/resources/extensions/gsd/tests/uok-execution-graph.test.ts

@@ -0,0 +1,69 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import type { SidecarItem } from "../auto/session.ts";
+import {
+  selectConflictFreeBatch,
+  selectReactiveDispatchBatch,
+  buildSidecarQueueNodes,
+  scheduleSidecarQueue,
+} from "../uok/execution-graph.ts";
+
+test("uok execution graph selects deterministic conflict-free IDs", () => {
+  const selected = selectConflictFreeBatch({
+    orderedIds: ["S01", "S02", "S03", "S04"],
+    maxParallel: 4,
+    hasConflict: (candidate, existing) =>
+      (candidate === "S02" && existing === "S01") ||
+      (candidate === "S01" && existing === "S02"),
+  });
+
+  assert.deepEqual(selected, ["S01", "S03", "S04"]);
+});
+
+test("uok execution graph reactive batch honors file conflicts and in-flight writes", () => {
+  const result = selectReactiveDispatchBatch({
+    graph: [
+      { id: "T01", dependsOn: [], outputFiles: ["src/a.ts"] },
+      { id: "T02", dependsOn: [], outputFiles: ["src/a.ts"] },
+      { id: "T03", dependsOn: [], outputFiles: ["src/b.ts"] },
+      { id: "T04", dependsOn: ["T03"], outputFiles: ["src/c.ts"] },
+    ],
+    readyIds: ["T01", "T02", "T03", "T04"],
+    maxParallel: 3,
+    inFlightOutputs: new Set(["src/c.ts"]),
+  });
+
+  assert.deepEqual(result.selected, ["T01", "T03"]);
+  assert.ok(
+    result.conflicts.some((c) => c.nodeA === "T01" && c.nodeB === "T02" && c.file === "src/a.ts"),
+    "conflict list should include overlapping outputs",
+  );
+});
+
+test("uok execution graph sidecar nodes map queue kinds to supported DAG kinds", () => {
+  const queue: SidecarItem[] = [
+    { kind: "hook", unitType: "execute-task", unitId: "M001/S01/T01", prompt: "hook" },
+    { kind: "triage", unitType: "triage", unitId: "M001/S01", prompt: "triage" },
+    { kind: "quick-task", unitType: "quick-task", unitId: "M001/S01/Q01", prompt: "quick" },
+  ];
+
+  const nodes = buildSidecarQueueNodes(queue);
+  assert.equal(nodes[0]?.kind, "hook");
+  assert.equal(nodes[1]?.kind, "verification");
+  assert.equal(nodes[2]?.kind, "team-worker");
+  assert.equal(nodes[1]?.dependsOn.length, 1);
+});
+
+test("uok execution graph sidecar scheduler preserves deterministic queue order", async () => {
+  const queue: SidecarItem[] = [
+    { kind: "quick-task", unitType: "quick-task", unitId: "M001/S01/Q01", prompt: "q1" },
+    { kind: "hook", unitType: "hook", unitId: "M001/S01/H01", prompt: "h1" },
+    { kind: "triage", unitType: "triage", unitId: "M001/S01/TR1", prompt: "t1" },
+  ];
+
+  const scheduled = await scheduleSidecarQueue(queue);
+  assert.deepEqual(
+    scheduled.map((item) => item.unitId),
+    queue.map((item) => item.unitId),
+  );
+});

package/src/resources/extensions/gsd/tests/uok-flags.test.ts

@@ -0,0 +1,39 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { resolveUokFlags } from "../uok/flags.ts";
+
+test("uok flags default to enabled when preference is unset", () => {
+  const flags = resolveUokFlags(undefined);
+  assert.equal(flags.enabled, true);
+  assert.equal(flags.legacyFallback, false);
+});
+
+test("uok legacy fallback preference forces legacy path", () => {
+  const flags = resolveUokFlags({
+    uok: {
+      enabled: true,
+      legacy_fallback: { enabled: true },
+    },
+  });
+  assert.equal(flags.enabled, false);
+  assert.equal(flags.legacyFallback, true);
+});
+
+test("uok legacy fallback env var forces legacy path", () => {
+  const previous = process.env.GSD_UOK_FORCE_LEGACY;
+  process.env.GSD_UOK_FORCE_LEGACY = "1";
+  try {
+    const flags = resolveUokFlags({
+      uok: {
+        enabled: true,
+      },
+    });
+    assert.equal(flags.enabled, false);
+    assert.equal(flags.legacyFallback, true);
+  } finally {
+    if (previous === undefined) delete process.env.GSD_UOK_FORCE_LEGACY;
+    else process.env.GSD_UOK_FORCE_LEGACY = previous;
+  }
+});
+

package/src/resources/extensions/gsd/tests/uok-gate-runner.test.ts

@@ -0,0 +1,70 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { closeDatabase, openDatabase, _getAdapter } from "../gsd-db.ts";
+import { UokGateRunner } from "../uok/gate-runner.ts";
+
+test.beforeEach(() => {
+  closeDatabase();
+  const ok = openDatabase(":memory:");
+  assert.equal(ok, true);
+});
+
+test.afterEach(() => {
+  closeDatabase();
+});
+
+test("uok gate runner retries timeout failures using deterministic matrix", async () => {
+  const runner = new UokGateRunner();
+
+  let calls = 0;
+  runner.register({
+    id: "timeout-gate",
+    type: "verification",
+    execute: async (_ctx, attempt) => {
+      calls += 1;
+      if (attempt < 2) {
+        return {
+          outcome: "fail",
+          failureClass: "timeout",
+          rationale: "first attempt timed out",
+        };
+      }
+      return {
+        outcome: "pass",
+        failureClass: "none",
+        rationale: "second attempt passed",
+      };
+    },
+  });
+
+  const result = await runner.run("timeout-gate", {
+    basePath: process.cwd(),
+    traceId: "trace-a",
+    turnId: "turn-a",
+    milestoneId: "M001",
+    sliceId: "S01",
+    taskId: "T01",
+  });
+
+  assert.equal(result.outcome, "pass");
+  assert.equal(calls, 2);
+
+  const adapter = _getAdapter();
+  const rows = adapter?.prepare("SELECT gate_id, outcome, attempt FROM gate_runs ORDER BY id").all() ?? [];
+  assert.equal(rows.length, 2);
+  assert.equal(rows[0]?.["outcome"], "retry");
+  assert.equal(rows[1]?.["outcome"], "pass");
+});
+
+test("uok gate runner returns manual-attention for unknown gate id", async () => {
+  const runner = new UokGateRunner();
+  const result = await runner.run("missing-gate", {
+    basePath: process.cwd(),
+    traceId: "trace-b",
+    turnId: "turn-b",
+  });
+
+  assert.equal(result.outcome, "manual-attention");
+  assert.equal(result.failureClass, "unknown");
+});

package/src/resources/extensions/gsd/tests/uok-gitops-turn-action.test.ts

@@ -0,0 +1,85 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { execSync } from "node:child_process";
+import { runTurnGitAction } from "../git-service.ts";
+
+function run(cmd: string, cwd: string): string {
+  return execSync(cmd, { cwd, stdio: "pipe", encoding: "utf-8" }).trim();
+}
+
+function makeRepo(): string {
+  const repo = mkdtempSync(join(tmpdir(), "gsd-uok-gitops-"));
+  run("git init", repo);
+  run('git config user.email "test@example.com"', repo);
+  run('git config user.name "Test User"', repo);
+  writeFileSync(join(repo, "README.md"), "# Test\n", "utf-8");
+  run("git add README.md", repo);
+  run('git commit -m "chore: init"', repo);
+  return repo;
+}
+
+test("uok gitops turn action status-only reports working tree dirtiness", () => {
+  const repo = makeRepo();
+  try {
+    const clean = runTurnGitAction({
+      basePath: repo,
+      action: "status-only",
+      unitType: "execute-task",
+      unitId: "M001/S01/T01",
+    });
+    assert.equal(clean.status, "ok");
+    assert.equal(clean.dirty, false);
+
+    writeFileSync(join(repo, "README.md"), "# Dirty\n", "utf-8");
+    const dirty = runTurnGitAction({
+      basePath: repo,
+      action: "status-only",
+      unitType: "execute-task",
+      unitId: "M001/S01/T01",
+    });
+    assert.equal(dirty.status, "ok");
+    assert.equal(dirty.dirty, true);
+  } finally {
+    rmSync(repo, { recursive: true, force: true });
+  }
+});
+
+test("uok gitops turn action snapshot writes snapshot refs", () => {
+  const repo = makeRepo();
+  try {
+    const result = runTurnGitAction({
+      basePath: repo,
+      action: "snapshot",
+      unitType: "execute-task",
+      unitId: "M001/S01/T01",
+    });
+    assert.equal(result.status, "ok");
+    assert.ok(result.snapshotLabel?.includes("execute-task/M001/S01/T01"));
+    const refs = run("git for-each-ref refs/gsd/snapshots/ --format='%(refname)'", repo);
+    assert.ok(refs.includes("refs/gsd/snapshots/execute-task/M001/S01/T01/"));
+  } finally {
+    rmSync(repo, { recursive: true, force: true });
+  }
+});
+
+test("uok gitops turn action commit creates commit with unit trailer", () => {
+  const repo = makeRepo();
+  try {
+    writeFileSync(join(repo, "feature.ts"), "export const x = 1;\n", "utf-8");
+    const result = runTurnGitAction({
+      basePath: repo,
+      action: "commit",
+      unitType: "execute-task",
+      unitId: "M001/S01/T02",
+    });
+    assert.equal(result.status, "ok");
+    assert.ok(result.commitMessage?.includes("chore: auto-commit after execute-task"));
+    const body = run("git log -1 --pretty=%B", repo);
+    assert.ok(body.includes("GSD-Unit: M001/S01/T02"));
+  } finally {
+    rmSync(repo, { recursive: true, force: true });
+  }
+});

package/src/resources/extensions/gsd/tests/uok-gitops-wiring.test.ts

@@ -0,0 +1,35 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const gsdDir = join(__dirname, "..");
+
+test("post-unit pre-verification selects turn git action from UOK gitops flags", () => {
+  const source = readFileSync(join(gsdDir, "auto-post-unit.ts"), "utf-8");
+  assert.ok(
+    source.includes("const turnAction: TurnGitActionMode = uokFlags.gitops ? uokFlags.gitopsTurnAction : \"commit\""),
+    "postUnitPreVerification should derive turn action from uok.gitops.turn_action when enabled",
+  );
+});
+
+test("post-unit pre-verification routes git failures through closeout gate", () => {
+  const source = readFileSync(join(gsdDir, "auto-post-unit.ts"), "utf-8");
+  assert.ok(
+    source.includes('id: "closeout-git-action"') &&
+    source.includes('type: "closeout"') &&
+    source.includes('failureClass: "git"'),
+    "git failures should be persisted via a closeout gate with failureClass=git",
+  );
+});
+
+test("auto snapshot opts carry trace/turn IDs for turn closeout records", () => {
+  const source = readFileSync(join(gsdDir, "auto.ts"), "utf-8");
+  assert.ok(
+    source.includes("traceId: s.currentTraceId ?? undefined") &&
+    source.includes("turnId: s.currentTurnId ?? undefined"),
+    "buildSnapshotOpts should pass trace/turn IDs into closeout options",
+  );
+});

package/src/resources/extensions/gsd/tests/uok-model-policy.test.ts

@@ -0,0 +1,89 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, readFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+import {
+  applyModelPolicyFilter,
+  buildRequirementVector,
+} from "../uok/model-policy.ts";
+import {
+  registerToolCompatibility,
+  resetToolCompatibilityRegistry,
+} from "@gsd/pi-coding-agent";
+
+test.afterEach(() => {
+  resetToolCompatibilityRegistry();
+});
+
+test("uok model policy builds requirement vectors from unit metadata", () => {
+  const requirements = buildRequirementVector("execute-task", {
+    tags: ["docs"],
+    fileCount: 8,
+    estimatedLines: 600,
+  });
+
+  assert.equal(requirements.instruction, 0.9);
+  assert.equal(requirements.coding, 0.3);
+  assert.equal(requirements.speed, 0.7);
+});
+
+test("uok model policy enforces provider/api/tool constraints and emits decision audit events", () => {
+  const basePath = mkdtempSync(join(tmpdir(), "gsd-uok-model-policy-"));
+  try {
+    mkdirSync(join(basePath, ".gsd"), { recursive: true });
+    registerToolCompatibility("screenshot", { producesImages: true });
+
+    const result = applyModelPolicyFilter(
+      [
+        { id: "openai-image", provider: "openai", api: "openai-responses" },
+        { id: "anthropic-ok", provider: "anthropic", api: "anthropic-messages" },
+        { id: "gemini-api-deny", provider: "google", api: "google-generative-ai" },
+        { id: "blocked-provider", provider: "blocked", api: "anthropic-messages" },
+      ],
+      {
+        basePath,
+        traceId: "trace-model-policy-1",
+        turnId: "turn-model-policy-1",
+        unitType: "execute-task",
+        taskMetadata: { tags: ["docs"] },
+        allowCrossProvider: true,
+        requiredTools: ["screenshot"],
+        allowedApis: ["anthropic-messages", "openai-responses"],
+        deniedProviders: ["blocked"],
+      },
+    );
+
+    assert.deepEqual(
+      result.eligible.map((m) => m.id),
+      ["anthropic-ok"],
+      "only the policy-compliant anthropic model should remain eligible",
+    );
+    assert.equal(result.decisions.length, 4);
+    assert.equal(result.decisions[0]?.allowed, false);
+    assert.match(result.decisions[0]?.reason ?? "", /tool policy denied/);
+    assert.equal(result.decisions[1]?.allowed, true);
+    assert.equal(result.decisions[2]?.allowed, false);
+    assert.match(result.decisions[2]?.reason ?? "", /transport\/api denied by policy/);
+    assert.equal(result.decisions[3]?.allowed, false);
+    assert.match(result.decisions[3]?.reason ?? "", /provider denied by policy/);
+
+    const auditLogPath = join(basePath, ".gsd", "audit", "events.jsonl");
+    const auditLines = readFileSync(auditLogPath, "utf-8")
+      .trim()
+      .split("\n")
+      .map((line) => JSON.parse(line) as { type: string; payload?: { reason?: string } });
+    const decisionTypes = auditLines.map((event) => event.type);
+
+    assert.equal(auditLines.length, 4);
+    assert.ok(decisionTypes.includes("model-policy-allow"));
+    assert.ok(decisionTypes.includes("model-policy-deny"));
+    assert.ok(
+      auditLines.some((event) => (event.payload?.reason ?? "").includes("tool policy denied")),
+      "audit stream should include explicit deny reasons",
+    );
+  } finally {
+    rmSync(basePath, { recursive: true, force: true });
+  }
+});