gsd-pi 2.74.0-dev.2b524c3 → 2.74.0-dev.6e23363

package/src/resources/extensions/gsd/tests/workflow-logger-wiring.test.ts

@@ -0,0 +1,223 @@
+// GSD Extension — workflow-logger wiring regression tests
+//
+// Verifies the plumbing between workflow-logger and the rest of the state
+// system (auto-loop phases, detect-stuck, notification store). Without this
+// wiring, warnings/errors logged during a unit leak across units, never
+// reach the user as a consolidated post-unit alert, and don't enrich
+// stuck-detection reasons.
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+import {
+  logWarning,
+  logError,
+  peekLogs,
+  _resetLogs,
+  setStderrLoggingEnabled,
+} from "../workflow-logger.ts";
+import { detectStuck } from "../auto/detect-stuck.ts";
+
+const phasesSrc = readFileSync(
+  join(import.meta.dirname, "..", "auto", "phases.ts"),
+  "utf-8",
+);
+const autoSrc = readFileSync(
+  join(import.meta.dirname, "..", "auto.ts"),
+  "utf-8",
+);
+
+// ─── Source-scan: phases.ts calls the logger lifecycle API ─────────────────
+
+test("auto/phases.ts imports _resetLogs, drainAndSummarize, formatForNotification, hasAnyIssues", () => {
+  assert.match(
+    phasesSrc,
+    /from\s+"\.\.\/workflow-logger\.js"/,
+    "phases.ts imports from workflow-logger",
+  );
+  for (const name of [
+    "_resetLogs",
+    "drainLogs",
+    "drainAndSummarize",
+    "formatForNotification",
+    "hasAnyIssues",
+  ]) {
+    assert.ok(
+      phasesSrc.includes(name),
+      `phases.ts should reference ${name}`,
+    );
+  }
+});
+
+test("runUnitPhase calls _resetLogs() before assigning s.currentUnit", () => {
+  // Find the "s.currentUnit = { type: unitType" assignment line and check
+  // the preceding ~500 chars contain a _resetLogs() call.
+  const idx = phasesSrc.indexOf("s.currentUnit = { type: unitType");
+  assert.ok(idx > 0, "runUnitPhase should assign s.currentUnit");
+  const before = phasesSrc.slice(Math.max(0, idx - 500), idx);
+  assert.match(
+    before,
+    /_resetLogs\(\)/,
+    "_resetLogs() must be called immediately before s.currentUnit assignment",
+  );
+});
+
+test("runFinalize drains and surfaces logger buffer via ctx.ui.notify", () => {
+  // Locate the runFinalize success path and verify it calls drainAndSummarize
+  // and routes the result through ctx.ui.notify.
+  const runFinalizeIdx = phasesSrc.indexOf("export async function runFinalize");
+  assert.ok(runFinalizeIdx > 0, "runFinalize export should exist");
+  const finalizeBody = phasesSrc.slice(runFinalizeIdx);
+  assert.match(
+    finalizeBody,
+    /hasAnyIssues\(\)/,
+    "runFinalize should gate drain on hasAnyIssues",
+  );
+  assert.match(
+    finalizeBody,
+    /drainAndSummarize\(\)/,
+    "runFinalize should call drainAndSummarize on success",
+  );
+  assert.match(
+    finalizeBody,
+    /formatForNotification\(logs\)/,
+    "runFinalize should format drained logs for the notification",
+  );
+});
+
+test("runFinalize timeout branches drain the buffer to prevent bleed", () => {
+  // Both timeout branches null out s.currentUnit — they should also drain
+  // so accumulated logs for the timed-out unit don't leak into the next.
+  const runFinalizeIdx = phasesSrc.indexOf("export async function runFinalize");
+  const finalizeBody = phasesSrc.slice(runFinalizeIdx);
+  const drainCallCount =
+    (finalizeBody.match(/drainLogs\(\)/g) ?? []).length;
+  assert.ok(
+    drainCallCount >= 2,
+    `runFinalize timeout branches should each call drainLogs() (found ${drainCallCount}, expected >= 2)`,
+  );
+});
+
+// ─── Source-scan: auto.ts calls setLogBasePath in startAuto ────────────────
+
+test("startAuto calls setLogBasePath(base) so audit log is pinned on resume", () => {
+  const startAutoIdx = autoSrc.indexOf("export async function startAuto");
+  assert.ok(startAutoIdx > 0, "startAuto export should exist");
+  const body = autoSrc.slice(startAutoIdx);
+  assert.match(
+    body,
+    /setLogBasePath\(base\)/,
+    "startAuto must call setLogBasePath(base) to pin the audit log",
+  );
+});
+
+// ─── Runtime: detect-stuck enriches reason with summarizeLogs() ────────────
+
+test("detectStuck reason includes workflow-logger summary when logs present", () => {
+  setStderrLoggingEnabled(false);
+  try {
+    _resetLogs();
+    logWarning("projection", "STATE.md render failed");
+    logError("db", "WAL checkpoint failed");
+
+    const result = detectStuck([
+      { key: "execute-task/slice-A/task-1", error: "ENOENT: no such file" },
+      { key: "execute-task/slice-A/task-1", error: "ENOENT: no such file" },
+    ]);
+
+    assert.notEqual(result, null);
+    assert.equal(result!.stuck, true);
+    assert.match(
+      result!.reason,
+      /Same error repeated:/,
+      "reason should still start with the rule string",
+    );
+    assert.match(
+      result!.reason,
+      /STATE\.md render failed/,
+      "reason should include the accumulated logger warning",
+    );
+    assert.match(
+      result!.reason,
+      /WAL checkpoint failed/,
+      "reason should include the accumulated logger error",
+    );
+
+    // Critical: summarizeLogs must not drain — the auto-loop's finalize
+    // step owns the buffer lifecycle, detect-stuck is read-only.
+    assert.equal(
+      peekLogs().length,
+      2,
+      "detect-stuck must not drain the buffer",
+    );
+  } finally {
+    _resetLogs();
+    setStderrLoggingEnabled(true);
+  }
+});
+
+test("detectStuck reason unchanged when logger buffer is empty", () => {
+  setStderrLoggingEnabled(false);
+  try {
+    _resetLogs();
+    const result = detectStuck([
+      { key: "A", error: "boom" },
+      { key: "A", error: "boom" },
+    ]);
+    assert.notEqual(result, null);
+    // No trailing " — " suffix when there are no logs to summarize.
+    assert.doesNotMatch(
+      result!.reason,
+      / — \d+ (error|warning)/,
+      "reason should have no logger suffix when buffer is empty",
+    );
+  } finally {
+    setStderrLoggingEnabled(true);
+  }
+});
+
+// ─── Runtime: readTransaction rollback failure surfaces via logError ────────
+//
+// snapshotState now delegates its transaction to readTransaction() in
+// gsd-db.ts (single-writer refactor in #4198), so the split-brain
+// ROLLBACK-failure log lives there, not in workflow-manifest.ts.
+
+test("readTransaction logs ROLLBACK failures as split-brain signal", () => {
+  const dbSrc = readFileSync(
+    join(import.meta.dirname, "..", "gsd-db.ts"),
+    "utf-8",
+  );
+  assert.match(
+    dbSrc,
+    /logError\("db",\s*"snapshotState ROLLBACK failed"/,
+    "readTransaction ROLLBACK catch should call logError",
+  );
+});
+
+// ─── Runtime: state.ts and workflow-projections.ts log silent bailouts ─────
+
+test("state.ts logs roadmap read failures instead of silently continuing", () => {
+  const stateSrc = readFileSync(
+    join(import.meta.dirname, "..", "state.ts"),
+    "utf-8",
+  );
+  assert.match(
+    stateSrc,
+    /logWarning\("state",\s*"reconcileDiskToDb: roadmap read failed/,
+    "state.ts reconcileDiskToDb should log roadmap read failures",
+  );
+});
+
+test("workflow-projections.ts logs DB probe failures instead of silent return", () => {
+  const projectionsSrc = readFileSync(
+    join(import.meta.dirname, "..", "workflow-projections.ts"),
+    "utf-8",
+  );
+  assert.match(
+    projectionsSrc,
+    /logWarning\("projection",\s*"renderStateProjection: DB handle probe failed/,
+    "renderStateProjection DB probe should log on failure",
+  );
+});

package/src/resources/extensions/gsd/tools/complete-slice.ts

@@ -424,6 +424,32 @@ export async function handleCompleteSlice(
     logError("tool", `complete-slice event log FAILED — completion invisible to reconciliation`, { error: (eventErr as Error).message });
   }
 
+  // Fire-and-forget graph rebuild — must NOT await, must NOT crash slice completion.
+  // Dynamic import of the package name (not a relative path) so it resolves
+  // correctly via package.json#exports in both development and production.
+  // eslint-disable-next-line @typescript-eslint/no-floating-promises
+  (async () => {
+    try {
+      const graphMod = await import("@gsd-build/mcp-server") as unknown as Partial<{
+        buildGraph: (dir: string) => Promise<{ nodes: unknown[]; edges: unknown[]; builtAt: string }>;
+        writeGraph: (gsdRoot: string, graph: unknown) => Promise<void>;
+        resolveGsdRoot: (basePath: string) => string;
+      }>;
+      if (
+        typeof graphMod.buildGraph !== "function"
+        || typeof graphMod.writeGraph !== "function"
+        || typeof graphMod.resolveGsdRoot !== "function"
+      ) {
+        throw new Error("graph helpers unavailable from @gsd-build/mcp-server");
+      }
+      const g = await graphMod.buildGraph(basePath);
+      await graphMod.writeGraph(graphMod.resolveGsdRoot(basePath), g);
+    } catch (graphErr) {
+      // Graph rebuild is best-effort — log at warning level but never propagate
+      logWarning("tool", `complete-slice graph rebuild failed (non-fatal): ${(graphErr as Error).message ?? String(graphErr)}`);
+    }
+  })();
+
   return {
     sliceId: params.sliceId,
     milestoneId: params.milestoneId,

package/src/resources/extensions/gsd/tools/validate-milestone.ts

@@ -23,6 +23,9 @@ import { invalidateStateCache } from "../state.js";
 import { VALIDATION_VERDICTS, isValidMilestoneVerdict } from "../verdict-parser.js";
 import { insertMilestoneValidationGates } from "../milestone-validation-gates.js";
 import { logWarning } from "../workflow-logger.js";
+import { UokGateRunner } from "../uok/gate-runner.js";
+import { loadEffectiveGSDPreferences } from "../preferences.js";
+import { resolveUokFlags } from "../uok/flags.js";
 
 export interface ValidateMilestoneParams {
   milestoneId: string;
@@ -43,6 +46,12 @@ export interface ValidateMilestoneResult {
   validationPath: string;
 }
 
+export interface ValidateMilestoneOptions {
+  uokGatesEnabled?: boolean;
+  traceId?: string;
+  turnId?: string;
+}
+
 function renderValidationMarkdown(params: ValidateMilestoneParams): string {
   let md = `---
 verdict: ${params.verdict}
@@ -81,6 +90,7 @@ ${params.verdictRationale}
 export async function handleValidateMilestone(
   params: ValidateMilestoneParams,
   basePath: string,
+  opts?: ValidateMilestoneOptions,
 ): Promise<ValidateMilestoneResult | { error: string }> {
   if (!params.milestoneId || typeof params.milestoneId !== "string" || params.milestoneId.trim() === "") {
     return { error: "milestoneId is required and must be a non-empty string" };
@@ -108,6 +118,8 @@ export async function handleValidateMilestone(
   // rendering can regenerate. The inverse (file exists, no DB row) is
   // harder to detect and recover from (#2725).
   const validatedAt = new Date().toISOString();
+  const slices = getMilestoneSlices(params.milestoneId);
+  const gateSliceId = slices.length > 0 ? slices[0].id : "_milestone";
 
   transaction(() => {
     insertAssessment({
@@ -123,11 +135,9 @@ export async function handleValidateMilestone(
     // #2945 Bug 4: persist quality_gates records alongside the assessment.
     // Previously only the assessment was written, leaving M002+ milestones
     // with zero quality_gate records despite passing validation.
-    const slices = getMilestoneSlices(params.milestoneId);
-    const sliceId = slices.length > 0 ? slices[0].id : "_milestone";
     insertMilestoneValidationGates(
       params.milestoneId,
-      sliceId,
+      gateSliceId,
       params.verdict,
       validatedAt,
     );
@@ -147,6 +157,41 @@ export async function handleValidateMilestone(
   clearPathCache();
   clearParseCache();
 
+  const prefs = loadEffectiveGSDPreferences()?.preferences;
+  const gatesEnabled = opts?.uokGatesEnabled ?? resolveUokFlags(prefs).gates;
+  if (gatesEnabled) {
+    try {
+      const gateRunner = new UokGateRunner();
+      const nonPassVerdict = params.verdict !== "pass";
+      gateRunner.register({
+        id: "milestone-validation-gates",
+        type: "verification",
+        execute: async () => ({
+          outcome: nonPassVerdict ? "manual-attention" : "pass",
+          failureClass: nonPassVerdict ? "manual-attention" : "none",
+          rationale: `milestone validation verdict: ${params.verdict}`,
+          findings: nonPassVerdict
+            ? [params.verdictRationale, params.remediationPlan ?? ""].filter(Boolean).join("\n")
+            : "",
+        }),
+      });
+      await gateRunner.run("milestone-validation-gates", {
+        basePath,
+        traceId: opts?.traceId ?? `validate-milestone:${params.milestoneId}`,
+        turnId: opts?.turnId ?? `${params.milestoneId}:validate`,
+        milestoneId: params.milestoneId,
+        sliceId: gateSliceId,
+        unitType: "validate-milestone",
+        unitId: params.milestoneId,
+      });
+    } catch (err) {
+      logWarning(
+        "tool",
+        `validate_milestone — failed to persist UOK gate result: ${(err as Error).message}`,
+      );
+    }
+  }
+
   return {
     milestoneId: params.milestoneId,
     verdict: params.verdict,

package/src/resources/extensions/gsd/tools/workflow-tool-executors.ts

@@ -5,7 +5,7 @@ import {
   getMilestone,
   getSliceStatusSummary,
   getSliceTaskCounts,
-  _getAdapter,
+  readTransaction,
   saveGateResult,
 } from "../gsd-db.js";
 import { GATE_REGISTRY } from "../gate-registry.js";
@@ -616,12 +616,9 @@ export async function executeMilestoneStatus(
       };
     }
 
-    const adapter = _getAdapter()!;
-    adapter.exec("BEGIN");
-    try {
+    return readTransaction(() => {
       const milestone = getMilestone(params.milestoneId);
       if (!milestone) {
-        adapter.exec("COMMIT");
         return {
           content: [{ type: "text", text: `Milestone ${params.milestoneId} not found in database.` }],
           details: { operation: "milestone_status", milestoneId: params.milestoneId, found: false },
@@ -635,8 +632,6 @@ export async function executeMilestoneStatus(
         taskCounts: getSliceTaskCounts(params.milestoneId, s.id),
       }));
 
-      adapter.exec("COMMIT");
-
       const result = {
         milestoneId: milestone.id,
         title: milestone.title,
@@ -651,10 +646,7 @@ export async function executeMilestoneStatus(
         content: [{ type: "text", text: JSON.stringify(result, null, 2) }],
         details: { operation: "milestone_status", milestoneId: milestone.id, sliceCount: slices.length },
       };
-    } catch (txErr) {
-      try { adapter.exec("ROLLBACK"); } catch { /* swallow */ }
-      throw txErr;
-    }
+    });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     logWarning("tool", `gsd_milestone_status tool failed: ${msg}`);

package/src/resources/extensions/gsd/triage-resolution.ts

@@ -111,14 +111,9 @@ export function executeReplan(
     // Also write replan_triggered_at column for DB-backed detection
     try {
       const req = createRequire(import.meta.url);
-      const { isDbAvailable, _getAdapter } = req("./gsd-db.js");
+      const { isDbAvailable, setSliceReplanTriggeredAt } = req("./gsd-db.js");
       if (isDbAvailable()) {
-        const adapter = _getAdapter();
-        if (adapter) {
-          adapter.prepare(
-            "UPDATE slices SET replan_triggered_at = :ts WHERE milestone_id = :mid AND id = :sid",
-          ).run({ ":ts": ts, ":mid": mid, ":sid": sid });
-        }
+        setSliceReplanTriggeredAt(mid, sid, ts);
       }
     } catch {
       // DB write is best-effort — disk file is the primary trigger for fallback path

package/src/resources/extensions/gsd/types.ts

@@ -306,7 +306,7 @@ export interface HookDispatchResult {
 
 export type BudgetEnforcementMode = "warn" | "pause" | "halt";
 
-export type TokenProfile = "budget" | "balanced" | "quality";
+export type TokenProfile = "budget" | "balanced" | "quality" | "burn-max";
 
 export type InlineLevel = "full" | "standard" | "minimal";
 

package/src/resources/extensions/gsd/unit-ownership.ts

@@ -46,8 +46,8 @@ let loadAttempted = false;
 
 function suppressSqliteWarning(): void {
   const origEmit = process.emit;
-  // @ts-expect-error overriding process.emit for warning filter
-  process.emit = function (event: string, ...args: unknown[]): boolean {
+  // Override via loose cast: Node's overloaded emit signature is not directly assignable.
+  (process as any).emit = function (event: string, ...args: unknown[]): boolean {
     if (
       event === "warning" &&
       args[0] &&

package/src/resources/extensions/gsd/uok/audit-toggle.ts

@@ -0,0 +1,9 @@
+const AUDIT_ENV_KEY = "GSD_UOK_AUDIT_UNIFIED";
+
+export function setUnifiedAuditEnabled(enabled: boolean): void {
+  process.env[AUDIT_ENV_KEY] = enabled ? "1" : "0";
+}
+
+export function isUnifiedAuditEnabled(): boolean {
+  return process.env[AUDIT_ENV_KEY] === "1";
+}

package/src/resources/extensions/gsd/uok/audit.ts

@@ -0,0 +1,51 @@
+import { appendFileSync, mkdirSync } from "node:fs";
+import { join } from "node:path";
+import { randomUUID } from "node:crypto";
+
+import { gsdRoot } from "../paths.js";
+import { isDbAvailable, insertAuditEvent } from "../gsd-db.js";
+import type { AuditEventEnvelope } from "./contracts.js";
+
+function auditLogPath(basePath: string): string {
+  return join(gsdRoot(basePath), "audit", "events.jsonl");
+}
+
+function ensureAuditDir(basePath: string): void {
+  mkdirSync(join(gsdRoot(basePath), "audit"), { recursive: true });
+}
+
+export function buildAuditEnvelope(args: {
+  traceId: string;
+  turnId?: string;
+  causedBy?: string;
+  category: AuditEventEnvelope["category"];
+  type: string;
+  payload?: Record<string, unknown>;
+}): AuditEventEnvelope {
+  return {
+    eventId: randomUUID(),
+    traceId: args.traceId,
+    turnId: args.turnId,
+    causedBy: args.causedBy,
+    category: args.category,
+    type: args.type,
+    ts: new Date().toISOString(),
+    payload: args.payload ?? {},
+  };
+}
+
+export function emitUokAuditEvent(basePath: string, event: AuditEventEnvelope): void {
+  try {
+    ensureAuditDir(basePath);
+    appendFileSync(auditLogPath(basePath), `${JSON.stringify(event)}\n`, "utf-8");
+  } catch {
+    // Best-effort: audit writes must never break orchestration.
+  }
+
+  if (!isDbAvailable()) return;
+  try {
+    insertAuditEvent(event);
+  } catch {
+    // Projection failures are non-fatal while legacy readers are still active.
+  }
+}

package/src/resources/extensions/gsd/uok/contracts.ts

@@ -0,0 +1,135 @@
+export type FailureClass =
+  | "none"
+  | "policy"
+  | "input"
+  | "execution"
+  | "artifact"
+  | "verification"
+  | "closeout"
+  | "git"
+  | "timeout"
+  | "manual-attention"
+  | "unknown";
+
+export type GateOutcome = "pass" | "fail" | "retry" | "manual-attention";
+
+export interface GateResult {
+  gateId: string;
+  gateType: string;
+  outcome: GateOutcome;
+  failureClass: FailureClass;
+  rationale?: string;
+  findings?: string;
+  attempt: number;
+  maxAttempts: number;
+  retryable: boolean;
+  evaluatedAt: string;
+}
+
+export type TurnPhase =
+  | "pre-dispatch"
+  | "dispatch"
+  | "unit"
+  | "finalize"
+  | "guard"
+  | "custom-engine";
+
+export type TurnStatus =
+  | "completed"
+  | "failed"
+  | "paused"
+  | "stopped"
+  | "skipped"
+  | "retry";
+
+export interface TurnContract {
+  traceId: string;
+  turnId: string;
+  iteration: number;
+  basePath: string;
+  unitType?: string;
+  unitId?: string;
+  sidecarKind?: string;
+  startedAt: string;
+  metadata?: Record<string, unknown>;
+}
+
+export interface TurnCloseoutRecord {
+  traceId: string;
+  turnId: string;
+  unitType?: string;
+  unitId?: string;
+  status: TurnStatus;
+  failureClass: FailureClass;
+  gitAction: "commit" | "snapshot" | "status-only";
+  gitPushed: boolean;
+  activityFile?: string;
+  finishedAt: string;
+}
+
+export interface TurnResult {
+  traceId: string;
+  turnId: string;
+  iteration: number;
+  unitType?: string;
+  unitId?: string;
+  status: TurnStatus;
+  failureClass: FailureClass;
+  phaseResults: Array<{
+    phase: TurnPhase;
+    action: string;
+    ts: string;
+    data?: Record<string, unknown>;
+  }>;
+  gateResults?: GateResult[];
+  closeout?: TurnCloseoutRecord;
+  error?: string;
+  startedAt: string;
+  finishedAt: string;
+}
+
+export interface AuditEventEnvelope {
+  eventId: string;
+  traceId: string;
+  turnId?: string;
+  causedBy?: string;
+  category:
+    | "orchestration"
+    | "gate"
+    | "model-policy"
+    | "gitops"
+    | "verification"
+    | "metrics"
+    | "plan"
+    | "execution";
+  type: string;
+  ts: string;
+  payload: Record<string, unknown>;
+}
+
+export type UokNodeKind =
+  | "unit"
+  | "hook"
+  | "subagent"
+  | "team-worker"
+  | "verification"
+  | "reprocess";
+
+export interface UokGraphNode {
+  id: string;
+  kind: UokNodeKind;
+  dependsOn: string[];
+  writes?: string[];
+  reads?: string[];
+  metadata?: Record<string, unknown>;
+}
+
+export interface UokTurnObserver {
+  onTurnStart(contract: TurnContract): void;
+  onPhaseResult(
+    phase: TurnPhase,
+    action: string,
+    data?: Record<string, unknown>,
+  ): void;
+  onTurnResult(result: TurnResult): void;
+}