gsd-pi 2.73.1 → 2.74.0-dev.0306a2e

package/dist/resources/extensions/gsd/preferences-validation.js

@@ -8,7 +8,12 @@
 import { VALID_BRANCH_NAME } from "./git-service.js";
 import { normalizeStringArray } from "../shared/format-utils.js";
 import { KNOWN_PREFERENCE_KEYS, KNOWN_UNIT_TYPES, SKILL_ACTIONS, } from "./preferences-types.js";
-const VALID_TOKEN_PROFILES = new Set(["budget", "balanced", "quality"]);
+const VALID_TOKEN_PROFILES = new Set(["budget", "balanced", "quality", "burn-max"]);
+const VALID_UOK_TURN_ACTIONS = new Set([
+    "commit",
+    "snapshot",
+    "status-only",
+]);
 export function validatePreferences(preferences) {
     const errors = [];
     const warnings = [];
@@ -136,13 +141,114 @@ export function validatePreferences(preferences) {
             errors.push(`budget_enforcement must be one of: warn, pause, halt`);
         }
     }
+    // ─── UOK Flags ──────────────────────────────────────────────────────
+    if (preferences.uok !== undefined) {
+        if (typeof preferences.uok === "object" && preferences.uok !== null) {
+            const raw = preferences.uok;
+            const valid = {};
+            if (raw.enabled !== undefined) {
+                if (typeof raw.enabled === "boolean")
+                    valid.enabled = raw.enabled;
+                else
+                    errors.push("uok.enabled must be a boolean");
+            }
+            const parseEnabledBlock = (key) => {
+                const value = raw[key];
+                if (value === undefined)
+                    return;
+                if (typeof value !== "object" || value === null) {
+                    errors.push(`uok.${key} must be an object`);
+                    return;
+                }
+                const block = value;
+                const parsed = {};
+                if (block.enabled !== undefined) {
+                    if (typeof block.enabled === "boolean")
+                        parsed.enabled = block.enabled;
+                    else
+                        errors.push(`uok.${key}.enabled must be a boolean`);
+                }
+                const unknown = Object.keys(block).filter((k) => k !== "enabled");
+                for (const unk of unknown) {
+                    warnings.push(`unknown uok.${key} key "${unk}" — ignored`);
+                }
+                if (Object.keys(parsed).length > 0) {
+                    valid[key] = parsed;
+                }
+            };
+            parseEnabledBlock("legacy_fallback");
+            parseEnabledBlock("gates");
+            parseEnabledBlock("model_policy");
+            parseEnabledBlock("execution_graph");
+            parseEnabledBlock("audit_unified");
+            parseEnabledBlock("plan_v2");
+            if (raw.gitops !== undefined) {
+                if (typeof raw.gitops !== "object" || raw.gitops === null) {
+                    errors.push("uok.gitops must be an object");
+                }
+                else {
+                    const gitops = raw.gitops;
+                    const parsed = {};
+                    if (gitops.enabled !== undefined) {
+                        if (typeof gitops.enabled === "boolean")
+                            parsed.enabled = gitops.enabled;
+                        else
+                            errors.push("uok.gitops.enabled must be a boolean");
+                    }
+                    if (gitops.turn_action !== undefined) {
+                        if (typeof gitops.turn_action === "string" &&
+                            VALID_UOK_TURN_ACTIONS.has(gitops.turn_action)) {
+                            parsed.turn_action = gitops.turn_action;
+                        }
+                        else {
+                            errors.push("uok.gitops.turn_action must be one of: commit, snapshot, status-only");
+                        }
+                    }
+                    if (gitops.turn_push !== undefined) {
+                        if (typeof gitops.turn_push === "boolean")
+                            parsed.turn_push = gitops.turn_push;
+                        else
+                            errors.push("uok.gitops.turn_push must be a boolean");
+                    }
+                    const unknown = Object.keys(gitops).filter((k) => !["enabled", "turn_action", "turn_push"].includes(k));
+                    for (const unk of unknown) {
+                        warnings.push(`unknown uok.gitops key "${unk}" — ignored`);
+                    }
+                    if (Object.keys(parsed).length > 0) {
+                        valid.gitops = parsed;
+                    }
+                }
+            }
+            const knownUokKeys = new Set([
+                "enabled",
+                "legacy_fallback",
+                "gates",
+                "model_policy",
+                "execution_graph",
+                "gitops",
+                "audit_unified",
+                "plan_v2",
+            ]);
+            for (const key of Object.keys(raw)) {
+                if (!knownUokKeys.has(key)) {
+                    warnings.push(`unknown uok key "${key}" — ignored`);
+                }
+            }
+            if (Object.keys(valid).length > 0) {
+                validated.uok = valid;
+            }
+        }
+        else {
+            errors.push("uok must be an object");
+        }
+    }
     // ─── Token Profile ─────────────────────────────────────────────────
     if (preferences.token_profile !== undefined) {
         if (typeof preferences.token_profile === "string" && VALID_TOKEN_PROFILES.has(preferences.token_profile)) {
             validated.token_profile = preferences.token_profile;
         }
         else {
-            errors.push(`token_profile must be one of: budget, balanced, quality`);
+            errors.push(`token_profile must be one of: budget, balanced, quality, burn-max`);
         }
     }
     // ─── Search Provider ─────────────────────────────────────────────
@@ -155,6 +261,28 @@ export function validatePreferences(preferences) {
             errors.push(`search_provider must be one of: brave, tavily, ollama, native, auto`);
         }
     }
+    // ─── Flat-rate Providers ────────────────────────────────────────────
+    // User-declared flat-rate providers for dynamic routing suppression.
+    // Built-in providers (github-copilot, copilot, claude-code) and any
+    // externalCli provider are already auto-detected; this list layers on
+    // top for private subscription proxies and custom CLI wrappers.
+    if (preferences.flat_rate_providers !== undefined) {
+        if (Array.isArray(preferences.flat_rate_providers)) {
+            const allStrings = preferences.flat_rate_providers.every((item) => typeof item === "string");
+            if (allStrings) {
+                // Strip empty/whitespace-only entries to avoid false matches.
+                validated.flat_rate_providers = preferences.flat_rate_providers
+                    .map((s) => s.trim())
+                    .filter((s) => s.length > 0);
+            }
+            else {
+                errors.push("flat_rate_providers must be an array of strings");
+            }
+        }
+        else {
+            errors.push("flat_rate_providers must be an array of strings");
+        }
+    }
     // ─── Phase Skip Preferences ─────────────────────────────────────────
     if (preferences.phases !== undefined) {
         if (typeof preferences.phases === "object" && preferences.phases !== null) {

package/dist/resources/extensions/gsd/preferences.js

@@ -293,6 +293,32 @@ function mergePreferences(base, override) {
         dynamic_routing: (base.dynamic_routing || override.dynamic_routing)
             ? { ...(base.dynamic_routing ?? {}), ...(override.dynamic_routing ?? {}) }
             : undefined,
+        uok: (base.uok || override.uok)
+            ? {
+                enabled: override.uok?.enabled ?? base.uok?.enabled,
+                legacy_fallback: (base.uok?.legacy_fallback || override.uok?.legacy_fallback)
+                    ? { ...(base.uok?.legacy_fallback ?? {}), ...(override.uok?.legacy_fallback ?? {}) }
+                    : undefined,
+                gates: (base.uok?.gates || override.uok?.gates)
+                    ? { ...(base.uok?.gates ?? {}), ...(override.uok?.gates ?? {}) }
+                    : undefined,
+                model_policy: (base.uok?.model_policy || override.uok?.model_policy)
+                    ? { ...(base.uok?.model_policy ?? {}), ...(override.uok?.model_policy ?? {}) }
+                    : undefined,
+                execution_graph: (base.uok?.execution_graph || override.uok?.execution_graph)
+                    ? { ...(base.uok?.execution_graph ?? {}), ...(override.uok?.execution_graph ?? {}) }
+                    : undefined,
+                gitops: (base.uok?.gitops || override.uok?.gitops)
+                    ? { ...(base.uok?.gitops ?? {}), ...(override.uok?.gitops ?? {}) }
+                    : undefined,
+                audit_unified: (base.uok?.audit_unified || override.uok?.audit_unified)
+                    ? { ...(base.uok?.audit_unified ?? {}), ...(override.uok?.audit_unified ?? {}) }
+                    : undefined,
+                plan_v2: (base.uok?.plan_v2 || override.uok?.plan_v2)
+                    ? { ...(base.uok?.plan_v2 ?? {}), ...(override.uok?.plan_v2 ?? {}) }
+                    : undefined,
+            }
+            : undefined,
         token_profile: override.token_profile ?? base.token_profile,
         phases: (base.phases || override.phases)
             ? { ...(base.phases ?? {}), ...(override.phases ?? {}) }

package/dist/resources/extensions/gsd/prompts/add-tests.md

@@ -0,0 +1,35 @@
+You are generating tests for recently completed GSD work.
+
+## Slice: {{sliceId}} — {{sliceTitle}}
+
+### Summary
+
+{{sliceSummary}}
+
+### Existing Test Patterns
+
+{{existingTestPatterns}}
+
+## Working Directory
+
+`{{workingDirectory}}`
+
+## Instructions
+
+1. Read the slice summary above to understand what was built
+2. Identify the source files that were created or modified for this slice
+3. Read the implementation code to understand behavior, edge cases, and error paths
+4. Write comprehensive tests following the project's existing test patterns and framework
+5. Run the tests to verify they pass
+6. Fix any failures
+
+### Rules
+
+- Follow the project's existing test patterns (framework, assertions, file structure)
+- Test behavior, not implementation details
+- Cover: happy path, edge cases, error conditions, boundary values
+- Do NOT modify implementation files — only create or update test files
+- Name test files consistently with the project's conventions
+- Keep tests focused and readable
+
+{{skillActivation}}

package/dist/resources/extensions/gsd/slice-parallel-orchestrator.js

@@ -21,6 +21,7 @@ import { createWorktree, worktreePath, removeWorktree } from "./worktree-manager
 import { writeSessionStatus, } from "./session-status-io.js";
 import { hasFileConflict } from "./slice-parallel-conflict.js";
 import { getErrorMessage } from "./error-utils.js";
+import { selectConflictFreeBatch } from "./uok/execution-graph.js";
 // ─── Module State ──────────────────────────────────────────────────────────
 let sliceState = null;
 // ─── Public API ────────────────────────────────────────────────────────────
@@ -62,7 +63,7 @@ export async function startSliceParallel(basePath, milestoneId, eligibleSlices,
     const started = [];
     const errors = [];
     // Filter out conflicting slices (conservative: check all pairs)
-    const safeSlices = filterConflictingSlices(basePath, milestoneId, eligibleSlices);
+    const safeSlices = filterConflictingSlices(basePath, milestoneId, eligibleSlices, opts.useExecutionGraph === true);
     // Limit to maxWorkers
     const toSpawn = safeSlices.slice(0, maxWorkers);
     for (const slice of toSpawn) {
@@ -176,7 +177,16 @@ export function resetSliceOrchestrator() {
  * Greedy: add slices to the safe set in order; skip any that conflict
  * with an already-included slice.
  */
-function filterConflictingSlices(basePath, milestoneId, slices) {
+function filterConflictingSlices(basePath, milestoneId, slices, useExecutionGraph) {
+    if (useExecutionGraph) {
+        const selectedIds = selectConflictFreeBatch({
+            orderedIds: slices.map((slice) => slice.id),
+            maxParallel: slices.length,
+            hasConflict: (candidate, existing) => hasFileConflict(basePath, milestoneId, candidate, existing),
+        });
+        const selected = new Set(selectedIds);
+        return slices.filter((slice) => selected.has(slice.id));
+    }
     const safe = [];
     for (const candidate of slices) {
         let conflictsWithSafe = false;

package/dist/resources/extensions/gsd/state.js

@@ -271,7 +271,11 @@ function reconcileDiskToDb(basePath) {
         try {
             roadmapContent = readFileSync(roadmapPath, "utf-8");
         }
-        catch {
+        catch (err) {
+            logWarning("state", "reconcileDiskToDb: roadmap read failed, skipping milestone", {
+                mid,
+                error: err.message,
+            });
             continue;
         }
         const parsed = parseRoadmap(roadmapContent);
@@ -312,6 +316,10 @@ function reconcileDiskToDb(basePath) {
 function buildCompletenessSet(basePath, milestones) {
     const completeMilestoneIds = new Set();
     const parkedMilestoneIds = new Set();
+    // DB-authoritative: a milestone is only "complete" when its DB row says so.
+    // SUMMARY-file presence is NOT a completion signal here — an orphan SUMMARY
+    // (crashed complete-milestone turn, partial merge, manual edit) must not
+    // flip derived state to complete and cascade into a false auto-merge (#4179).
     for (const m of milestones) {
         const parkedFile = resolveMilestoneFile(basePath, m.id, "PARKED");
         if (parkedFile || m.status === 'parked') {
@@ -322,11 +330,6 @@ function buildCompletenessSet(basePath, milestones) {
             completeMilestoneIds.add(m.id);
             continue;
         }
-        const summaryFile = resolveMilestoneFile(basePath, m.id, "SUMMARY");
-        if (summaryFile) {
-            completeMilestoneIds.add(m.id);
-            continue;
-        }
     }
     return { completeMilestoneIds, parkedMilestoneIds };
 }
@@ -347,17 +350,22 @@ async function buildRegistryAndFindActive(basePath, milestones, completeMileston
             if (isGhostMilestone(basePath, m.id))
                 continue;
         }
-        const summaryFile = resolveMilestoneFile(basePath, m.id, "SUMMARY");
-        if (completeMilestoneIds.has(m.id) || (summaryFile !== null)) {
+        // DB-authoritative completeness (#4179): only trust completeMilestoneIds,
+        // which is itself derived from DB status. SUMMARY-file presence alone must
+        // not imply completion. The summary file may still be consulted below as a
+        // title source for legitimately-complete milestones whose DB row has no title.
+        if (completeMilestoneIds.has(m.id)) {
             let title = stripMilestonePrefix(m.title) || m.id;
-            if (summaryFile && !m.title) {
-                const summaryContent = await loadFile(summaryFile);
-                if (summaryContent) {
-                    title = parseSummary(summaryContent).title || m.id;
+            if (!m.title) {
+                const summaryFile = resolveMilestoneFile(basePath, m.id, "SUMMARY");
+                if (summaryFile) {
+                    const summaryContent = await loadFile(summaryFile);
+                    if (summaryContent) {
+                        title = parseSummary(summaryContent).title || m.id;
+                    }
                 }
             }
             registry.push({ id: m.id, title, status: 'complete' });
-            completeMilestoneIds.add(m.id);
             continue;
         }
         const allSlicesDone = slices.length > 0 && slices.every(s => isStatusDone(s.status));
@@ -391,7 +399,14 @@ async function buildRegistryAndFindActive(basePath, milestones, completeMileston
                 const validationFile = resolveMilestoneFile(basePath, m.id, "VALIDATION");
                 const validationContent = validationFile ? await loadFile(validationFile) : null;
                 const validationTerminal = validationContent ? isValidationTerminal(validationContent) : false;
-                if (!validationTerminal || (validationTerminal && !summaryFile)) {
+                // DB-authoritative (#4179): completeness is already decided by
+                // completeMilestoneIds above. If we reached this branch, the DB says
+                // the milestone is NOT complete — so any SUMMARY file on disk is an
+                // orphan (crashed complete-milestone, partial merge, manual edit) and
+                // must not short-circuit this path. When validation is terminal, fall
+                // through to the default active-push below so `complete-milestone` can
+                // re-run idempotently.
+                if (!validationTerminal) {
                     activeMilestone = { id: m.id, title };
                     activeMilestoneSlices = slices;
                     activeMilestoneFound = true;
@@ -516,6 +531,9 @@ function resolveSliceDependencies(activeMilestoneSlices) {
             return { activeSlice: null, activeSliceRow: null };
         }
     }
+    // First pass: find a slice with ALL dependencies satisfied (strict)
+    let bestFallback = null;
+    let bestFallbackSatisfied = -1;
     for (const s of activeMilestoneSlices) {
         if (isStatusDone(s.status))
             continue;
@@ -524,6 +542,23 @@ function resolveSliceDependencies(activeMilestoneSlices) {
         if (s.depends.every(dep => doneSliceIds.has(dep))) {
             return { activeSlice: { id: s.id, title: s.title }, activeSliceRow: s };
         }
+        // Track the slice with the most satisfied dependencies as fallback
+        const satisfied = s.depends.filter(dep => doneSliceIds.has(dep)).length;
+        if (satisfied > bestFallbackSatisfied || (satisfied === bestFallbackSatisfied && !bestFallback)) {
+            bestFallback = s;
+            bestFallbackSatisfied = satisfied;
+        }
+    }
+    // Fallback: if no slice has all deps met but there ARE incomplete non-deferred
+    // slices, pick the one with the most deps satisfied. This prevents hard-blocking
+    // when dependency metadata is stale (e.g. after reassessment added/removed slices)
+    // or when deps reference slices from previous milestones.
+    if (bestFallback) {
+        const unmet = bestFallback.depends.filter(dep => !doneSliceIds.has(dep));
+        logWarning("state", `No slice has all deps satisfied — falling back to ${bestFallback.id} ` +
+            `(${bestFallbackSatisfied}/${bestFallback.depends.length} deps met, ` +
+            `unmet: ${unmet.join(", ")})`, { mid: activeMilestoneSlices[0]?.milestone_id, sid: bestFallback.id });
+        return { activeSlice: { id: bestFallback.id, title: bestFallback.title }, activeSliceRow: bestFallback };
     }
     return { activeSlice: null, activeSliceRow: null };
 }
@@ -567,7 +602,7 @@ async function reconcileSliceTasks(basePath, milestoneId, sliceId, planFile) {
         const summaryPath = resolveTaskFile(basePath, milestoneId, sliceId, t.id, "SUMMARY");
         if (summaryPath && existsSync(summaryPath)) {
             try {
-                updateTaskStatus(milestoneId, sliceId, t.id, "complete");
+                updateTaskStatus(milestoneId, sliceId, t.id, "complete", new Date().toISOString());
                 logWarning("reconcile", `task ${milestoneId}/${sliceId}/${t.id} status reconciled from "${t.status}" to "complete" (#2514)`, { mid: milestoneId, sid: sliceId, tid: t.id });
                 reconciled = true;
             }
@@ -1269,6 +1304,8 @@ export async function _deriveStateImpl(basePath) {
         }
     }
     else {
+        let bestFallbackLegacy = null;
+        let bestFallbackLegacySatisfied = -1;
         for (const s of activeRoadmap.slices) {
             if (s.done)
                 continue;
@@ -1276,6 +1313,20 @@ export async function _deriveStateImpl(basePath) {
                 activeSlice = { id: s.id, title: s.title };
                 break;
             }
+            // Track best fallback
+            const satisfied = s.depends.filter(dep => doneSliceIds.has(dep)).length;
+            if (satisfied > bestFallbackLegacySatisfied) {
+                bestFallbackLegacy = s;
+                bestFallbackLegacySatisfied = satisfied;
+            }
+        }
+        // Fallback: if no slice has all deps met, pick the one with the most deps satisfied
+        if (!activeSlice && bestFallbackLegacy) {
+            const unmet = bestFallbackLegacy.depends.filter(dep => !doneSliceIds.has(dep));
+            logWarning("state", `No slice has all deps satisfied — falling back to ${bestFallbackLegacy.id} ` +
+                `(${bestFallbackLegacySatisfied}/${bestFallbackLegacy.depends.length} deps met, ` +
+                `unmet: ${unmet.join(", ")})`);
+            activeSlice = { id: bestFallbackLegacy.id, title: bestFallbackLegacy.title };
         }
     }
     if (!activeSlice) {

package/dist/resources/extensions/gsd/templates/PREFERENCES.md

@@ -39,6 +39,24 @@ dynamic_routing:
   budget_pressure:
   cross_provider:
   hooks:
+uok:
+  enabled: true
+  legacy_fallback:
+    enabled: false
+  gates:
+    enabled: false
+  model_policy:
+    enabled: false
+  execution_graph:
+    enabled: false
+  gitops:
+    enabled: false
+    turn_action: status-only
+    turn_push: false
+  audit_unified:
+    enabled: false
+  plan_v2:
+    enabled: false
 auto_visualize:
 auto_report:
 parallel:

package/dist/resources/extensions/gsd/tools/complete-slice.js

@@ -354,6 +354,26 @@ export async function handleCompleteSlice(params, basePath) {
     catch (eventErr) {
         logError("tool", `complete-slice event log FAILED — completion invisible to reconciliation`, { error: eventErr.message });
     }
+    // Fire-and-forget graph rebuild — must NOT await, must NOT crash slice completion.
+    // Dynamic import of the package name (not a relative path) so it resolves
+    // correctly via package.json#exports in both development and production.
+    // eslint-disable-next-line @typescript-eslint/no-floating-promises
+    (async () => {
+        try {
+            const graphMod = await import("@gsd-build/mcp-server");
+            if (typeof graphMod.buildGraph !== "function"
+                || typeof graphMod.writeGraph !== "function"
+                || typeof graphMod.resolveGsdRoot !== "function") {
+                throw new Error("graph helpers unavailable from @gsd-build/mcp-server");
+            }
+            const g = await graphMod.buildGraph(basePath);
+            await graphMod.writeGraph(graphMod.resolveGsdRoot(basePath), g);
+        }
+        catch (graphErr) {
+            // Graph rebuild is best-effort — log at warning level but never propagate
+            logWarning("tool", `complete-slice graph rebuild failed (non-fatal): ${graphErr.message ?? String(graphErr)}`);
+        }
+    })();
     return {
         sliceId: params.sliceId,
         milestoneId: params.milestoneId,

package/dist/resources/extensions/gsd/tools/validate-milestone.js

@@ -16,6 +16,9 @@ import { invalidateStateCache } from "../state.js";
 import { VALIDATION_VERDICTS, isValidMilestoneVerdict } from "../verdict-parser.js";
 import { insertMilestoneValidationGates } from "../milestone-validation-gates.js";
 import { logWarning } from "../workflow-logger.js";
+import { UokGateRunner } from "../uok/gate-runner.js";
+import { loadEffectiveGSDPreferences } from "../preferences.js";
+import { resolveUokFlags } from "../uok/flags.js";
 function renderValidationMarkdown(params) {
     let md = `---
 verdict: ${params.verdict}
@@ -48,7 +51,7 @@ ${params.verdictRationale}
     }
     return md;
 }
-export async function handleValidateMilestone(params, basePath) {
+export async function handleValidateMilestone(params, basePath, opts) {
     if (!params.milestoneId || typeof params.milestoneId !== "string" || params.milestoneId.trim() === "") {
         return { error: "milestoneId is required and must be a non-empty string" };
     }
@@ -73,6 +76,8 @@ export async function handleValidateMilestone(params, basePath) {
     // rendering can regenerate. The inverse (file exists, no DB row) is
     // harder to detect and recover from (#2725).
     const validatedAt = new Date().toISOString();
+    const slices = getMilestoneSlices(params.milestoneId);
+    const gateSliceId = slices.length > 0 ? slices[0].id : "_milestone";
     transaction(() => {
         insertAssessment({
             path: validationPath,
@@ -86,9 +91,7 @@ export async function handleValidateMilestone(params, basePath) {
         // #2945 Bug 4: persist quality_gates records alongside the assessment.
         // Previously only the assessment was written, leaving M002+ milestones
         // with zero quality_gate records despite passing validation.
-        const slices = getMilestoneSlices(params.milestoneId);
-        const sliceId = slices.length > 0 ? slices[0].id : "_milestone";
-        insertMilestoneValidationGates(params.milestoneId, sliceId, params.verdict, validatedAt);
+        insertMilestoneValidationGates(params.milestoneId, gateSliceId, params.verdict, validatedAt);
     });
     // ── Filesystem render (outside transaction) ────────────────────────────
     // If disk render fails, roll back the DB row so state stays consistent.
@@ -103,6 +106,38 @@ export async function handleValidateMilestone(params, basePath) {
     invalidateStateCache();
     clearPathCache();
     clearParseCache();
+    const prefs = loadEffectiveGSDPreferences()?.preferences;
+    const gatesEnabled = opts?.uokGatesEnabled ?? resolveUokFlags(prefs).gates;
+    if (gatesEnabled) {
+        try {
+            const gateRunner = new UokGateRunner();
+            const nonPassVerdict = params.verdict !== "pass";
+            gateRunner.register({
+                id: "milestone-validation-gates",
+                type: "verification",
+                execute: async () => ({
+                    outcome: nonPassVerdict ? "manual-attention" : "pass",
+                    failureClass: nonPassVerdict ? "manual-attention" : "none",
+                    rationale: `milestone validation verdict: ${params.verdict}`,
+                    findings: nonPassVerdict
+                        ? [params.verdictRationale, params.remediationPlan ?? ""].filter(Boolean).join("\n")
+                        : "",
+                }),
+            });
+            await gateRunner.run("milestone-validation-gates", {
+                basePath,
+                traceId: opts?.traceId ?? `validate-milestone:${params.milestoneId}`,
+                turnId: opts?.turnId ?? `${params.milestoneId}:validate`,
+                milestoneId: params.milestoneId,
+                sliceId: gateSliceId,
+                unitType: "validate-milestone",
+                unitId: params.milestoneId,
+            });
+        }
+        catch (err) {
+            logWarning("tool", `validate_milestone — failed to persist UOK gate result: ${err.message}`);
+        }
+    }
     return {
         milestoneId: params.milestoneId,
         verdict: params.verdict,

package/dist/resources/extensions/gsd/tools/workflow-tool-executors.js

@@ -1,7 +1,7 @@
 import { ensureDbOpen } from "../bootstrap/dynamic-tools.js";
 import { sanitizeCompleteMilestoneParams } from "../bootstrap/sanitize-complete-milestone.js";
 import { loadWriteGateSnapshot, shouldBlockContextArtifactSaveInSnapshot } from "../bootstrap/write-gate.js";
-import { getMilestone, getSliceStatusSummary, getSliceTaskCounts, _getAdapter, saveGateResult, } from "../gsd-db.js";
+import { getMilestone, getSliceStatusSummary, getSliceTaskCounts, readTransaction, saveGateResult, } from "../gsd-db.js";
 import { GATE_REGISTRY } from "../gate-registry.js";
 import { saveArtifactToDb } from "../db-writer.js";
 import { handleCompleteMilestone } from "./complete-milestone.js";
@@ -493,12 +493,9 @@ export async function executeMilestoneStatus(params, basePath = process.cwd()) {
                 isError: true,
             };
         }
-        const adapter = _getAdapter();
-        adapter.exec("BEGIN");
-        try {
+        return readTransaction(() => {
             const milestone = getMilestone(params.milestoneId);
             if (!milestone) {
-                adapter.exec("COMMIT");
                 return {
                     content: [{ type: "text", text: `Milestone ${params.milestoneId} not found in database.` }],
                     details: { operation: "milestone_status", milestoneId: params.milestoneId, found: false },
@@ -510,7 +507,6 @@ export async function executeMilestoneStatus(params, basePath = process.cwd()) {
                 status: s.status,
                 taskCounts: getSliceTaskCounts(params.milestoneId, s.id),
             }));
-            adapter.exec("COMMIT");
             const result = {
                 milestoneId: milestone.id,
                 title: milestone.title,
@@ -524,14 +520,7 @@ export async function executeMilestoneStatus(params, basePath = process.cwd()) {
                 content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
                 details: { operation: "milestone_status", milestoneId: milestone.id, sliceCount: slices.length },
             };
-        }
-        catch (txErr) {
-            try {
-                adapter.exec("ROLLBACK");
-            }
-            catch { /* swallow */ }
-            throw txErr;
-        }
+        });
     }
     catch (err) {
         const msg = err instanceof Error ? err.message : String(err);

package/dist/resources/extensions/gsd/triage-resolution.js

@@ -83,12 +83,9 @@ export function executeReplan(basePath, mid, sid, capture) {
         // Also write replan_triggered_at column for DB-backed detection
         try {
             const req = createRequire(import.meta.url);
-            const { isDbAvailable, _getAdapter } = req("./gsd-db.js");
+            const { isDbAvailable, setSliceReplanTriggeredAt } = req("./gsd-db.js");
             if (isDbAvailable()) {
-                const adapter = _getAdapter();
-                if (adapter) {
-                    adapter.prepare("UPDATE slices SET replan_triggered_at = :ts WHERE milestone_id = :mid AND id = :sid").run({ ":ts": ts, ":mid": mid, ":sid": sid });
-                }
+                setSliceReplanTriggeredAt(mid, sid, ts);
             }
         }
         catch {

package/dist/resources/extensions/gsd/unit-ownership.js

@@ -20,7 +20,7 @@ let providerModule = null;
 let loadAttempted = false;
 function suppressSqliteWarning() {
     const origEmit = process.emit;
-    // @ts-expect-error overriding process.emit for warning filter
+    // Override via loose cast: Node's overloaded emit signature is not directly assignable.
     process.emit = function (event, ...args) {
         if (event === "warning" &&
             args[0] &&

package/dist/resources/extensions/gsd/uok/audit-toggle.js

@@ -0,0 +1,7 @@
+const AUDIT_ENV_KEY = "GSD_UOK_AUDIT_UNIFIED";
+export function setUnifiedAuditEnabled(enabled) {
+    process.env[AUDIT_ENV_KEY] = enabled ? "1" : "0";
+}
+export function isUnifiedAuditEnabled() {
+    return process.env[AUDIT_ENV_KEY] === "1";
+}