gsd-pi 2.74.0-dev.b741afb → 2.74.0-dev.ffbcc03

package/src/resources/extensions/gsd/uok/gitops.ts

@@ -0,0 +1,75 @@
+import { isDbAvailable, upsertTurnGitTransaction } from "../gsd-db.js";
+import type { TurnCloseoutRecord } from "./contracts.js";
+import { buildAuditEnvelope, emitUokAuditEvent } from "./audit.js";
+
+export type TurnGitStage = "turn-start" | "stage" | "checkpoint" | "publish" | "record";
+
+interface GitTxArgs {
+  basePath: string;
+  traceId: string;
+  turnId: string;
+  unitType?: string;
+  unitId?: string;
+  stage: TurnGitStage;
+  action: "commit" | "snapshot" | "status-only";
+  push: boolean;
+  status: "ok" | "failed";
+  error?: string;
+  metadata?: Record<string, unknown>;
+}
+
+export function writeTurnGitTransaction(args: GitTxArgs): void {
+  if (!isDbAvailable()) return;
+  upsertTurnGitTransaction({
+    traceId: args.traceId,
+    turnId: args.turnId,
+    unitType: args.unitType,
+    unitId: args.unitId,
+    stage: args.stage,
+    action: args.action,
+    push: args.push,
+    status: args.status,
+    error: args.error,
+    metadata: args.metadata,
+    updatedAt: new Date().toISOString(),
+  });
+
+  emitUokAuditEvent(
+    args.basePath,
+    buildAuditEnvelope({
+      traceId: args.traceId,
+      turnId: args.turnId,
+      category: "gitops",
+      type: `turn-git-${args.stage}`,
+      payload: {
+        unitType: args.unitType,
+        unitId: args.unitId,
+        action: args.action,
+        push: args.push,
+        status: args.status,
+        error: args.error,
+        ...(args.metadata ?? {}),
+      },
+    }),
+  );
+}
+
+export function writeTurnCloseoutGitRecord(basePath: string, record: TurnCloseoutRecord): void {
+  writeTurnGitTransaction({
+    basePath,
+    traceId: record.traceId,
+    turnId: record.turnId,
+    unitType: record.unitType,
+    unitId: record.unitId,
+    stage: "record",
+    action: record.gitAction,
+    push: record.gitPushed,
+    status: record.failureClass === "git" ? "failed" : "ok",
+    error: record.failureClass === "git" ? "git closeout failure" : undefined,
+    metadata: {
+      turnStatus: record.status,
+      finishedAt: record.finishedAt,
+      activityFile: record.activityFile,
+    },
+  });
+}

package/src/resources/extensions/gsd/uok/kernel.ts

@@ -0,0 +1,105 @@
+import type { ExtensionAPI, ExtensionContext } from "@gsd/pi-coding-agent";
+import { appendFileSync, mkdirSync } from "node:fs";
+import { join } from "node:path";
+
+import type { AutoSession } from "../auto/session.js";
+import type { LoopDeps } from "../auto/loop-deps.js";
+import { gsdRoot } from "../paths.js";
+import { buildAuditEnvelope, emitUokAuditEvent } from "./audit.js";
+import { setUnifiedAuditEnabled } from "./audit-toggle.js";
+import { resolveUokFlags } from "./flags.js";
+import { createTurnObserver } from "./loop-adapter.js";
+
+interface RunAutoLoopWithUokArgs {
+  ctx: ExtensionContext;
+  pi: ExtensionAPI;
+  s: AutoSession;
+  deps: LoopDeps;
+  runLegacyLoop: (
+    ctx: ExtensionContext,
+    pi: ExtensionAPI,
+    s: AutoSession,
+    deps: LoopDeps,
+  ) => Promise<void>;
+}
+
+function parityLogPath(basePath: string): string {
+  return join(gsdRoot(basePath), "runtime", "uok-parity.jsonl");
+}
+
+function writeParityEvent(basePath: string, event: Record<string, unknown>): void {
+  try {
+    mkdirSync(join(gsdRoot(basePath), "runtime"), { recursive: true });
+    appendFileSync(parityLogPath(basePath), `${JSON.stringify(event)}\n`, "utf-8");
+  } catch {
+    // parity telemetry must never block orchestration
+  }
+}
+
+function resolveKernelPathLabel(flags: ReturnType<typeof resolveUokFlags>): "uok-wrapper" | "legacy-wrapper" | "legacy-fallback" {
+  if (flags.legacyFallback) return "legacy-fallback";
+  return flags.enabled ? "uok-wrapper" : "legacy-wrapper";
+}
+
+export async function runAutoLoopWithUok(args: RunAutoLoopWithUokArgs): Promise<void> {
+  const { ctx, pi, s, deps, runLegacyLoop } = args;
+  const prefs = deps.loadEffectiveGSDPreferences()?.preferences;
+  const flags = resolveUokFlags(prefs);
+  setUnifiedAuditEnabled(flags.auditUnified);
+
+  writeParityEvent(s.basePath, {
+    ts: new Date().toISOString(),
+    path: resolveKernelPathLabel(flags),
+    flags,
+    phase: "enter",
+  });
+
+  if (flags.auditUnified) {
+    emitUokAuditEvent(
+      s.basePath,
+      buildAuditEnvelope({
+        traceId: `session:${String(s.autoStartTime || Date.now())}`,
+        category: "orchestration",
+        type: "uok-kernel-enter",
+        payload: {
+          flags,
+          sessionId: ctx.sessionManager?.getSessionId?.(),
+        },
+      }),
+    );
+  }
+
+  const decoratedDeps: LoopDeps = flags.enabled
+    ? {
+        ...deps,
+        uokObserver: createTurnObserver({
+          basePath: s.basePath,
+          gitAction: flags.gitopsTurnAction,
+          gitPush: flags.gitopsTurnPush,
+          enableAudit: flags.auditUnified,
+          enableGitops: flags.gitops,
+        }),
+      }
+    : deps;
+
+  try {
+    await runLegacyLoop(ctx, pi, s, decoratedDeps);
+    writeParityEvent(s.basePath, {
+      ts: new Date().toISOString(),
+      path: resolveKernelPathLabel(flags),
+      flags,
+      phase: "exit",
+      status: "ok",
+    });
+  } catch (err) {
+    writeParityEvent(s.basePath, {
+      ts: new Date().toISOString(),
+      path: resolveKernelPathLabel(flags),
+      flags,
+      phase: "exit",
+      status: "error",
+      error: err instanceof Error ? err.message : String(err),
+    });
+    throw err;
+  }
+}

package/src/resources/extensions/gsd/uok/loop-adapter.ts

@@ -0,0 +1,162 @@
+import type {
+  TurnCloseoutRecord,
+  TurnContract,
+  TurnResult,
+  UokTurnObserver,
+} from "./contracts.js";
+import { buildAuditEnvelope, emitUokAuditEvent } from "./audit.js";
+import { writeTurnCloseoutGitRecord, writeTurnGitTransaction } from "./gitops.js";
+
+export interface CreateTurnObserverOptions {
+  basePath: string;
+  gitAction: "commit" | "snapshot" | "status-only";
+  gitPush: boolean;
+  enableAudit: boolean;
+  enableGitops: boolean;
+}
+
+export function createTurnObserver(options: CreateTurnObserverOptions): UokTurnObserver {
+  let current: TurnContract | null = null;
+  const phaseResults: TurnResult["phaseResults"] = [];
+
+  return {
+    onTurnStart(contract): void {
+      current = contract;
+      phaseResults.length = 0;
+
+      if (options.enableGitops) {
+        writeTurnGitTransaction({
+          basePath: options.basePath,
+          traceId: contract.traceId,
+          turnId: contract.turnId,
+          unitType: contract.unitType,
+          unitId: contract.unitId,
+          stage: "turn-start",
+          action: options.gitAction,
+          push: options.gitPush,
+          status: "ok",
+          metadata: {
+            iteration: contract.iteration,
+            sidecarKind: contract.sidecarKind,
+          },
+        });
+      }
+
+      if (options.enableAudit) {
+        emitUokAuditEvent(
+          options.basePath,
+          buildAuditEnvelope({
+            traceId: contract.traceId,
+            turnId: contract.turnId,
+            category: "orchestration",
+            type: "turn-start",
+            payload: {
+              iteration: contract.iteration,
+              unitType: contract.unitType,
+              unitId: contract.unitId,
+              sidecarKind: contract.sidecarKind,
+            },
+          }),
+        );
+      }
+    },
+
+    onPhaseResult(phase, action, data): void {
+      phaseResults.push({
+        phase,
+        action,
+        ts: new Date().toISOString(),
+        data,
+      });
+
+      if (!current || !options.enableGitops) return;
+      if (phase === "dispatch") {
+        writeTurnGitTransaction({
+          basePath: options.basePath,
+          traceId: current.traceId,
+          turnId: current.turnId,
+          unitType: data?.unitType as string | undefined,
+          unitId: data?.unitId as string | undefined,
+          stage: "stage",
+          action: options.gitAction,
+          push: options.gitPush,
+          status: "ok",
+          metadata: { action },
+        });
+      }
+      if (phase === "unit") {
+        writeTurnGitTransaction({
+          basePath: options.basePath,
+          traceId: current.traceId,
+          turnId: current.turnId,
+          unitType: data?.unitType as string | undefined,
+          unitId: data?.unitId as string | undefined,
+          stage: "checkpoint",
+          action: options.gitAction,
+          push: options.gitPush,
+          status: "ok",
+          metadata: { action },
+        });
+      }
+      if (phase === "finalize") {
+        writeTurnGitTransaction({
+          basePath: options.basePath,
+          traceId: current.traceId,
+          turnId: current.turnId,
+          unitType: data?.unitType as string | undefined,
+          unitId: data?.unitId as string | undefined,
+          stage: "publish",
+          action: options.gitAction,
+          push: options.gitPush,
+          status: "ok",
+          metadata: { action },
+        });
+      }
+    },
+
+    onTurnResult(result): void {
+      const merged: TurnResult = {
+        ...result,
+        phaseResults: result.phaseResults.length > 0 ? result.phaseResults : [...phaseResults],
+      };
+
+      if (options.enableAudit) {
+        emitUokAuditEvent(
+          options.basePath,
+          buildAuditEnvelope({
+            traceId: merged.traceId,
+            turnId: merged.turnId,
+            category: "orchestration",
+            type: "turn-result",
+            payload: {
+              unitType: merged.unitType,
+              unitId: merged.unitId,
+              status: merged.status,
+              failureClass: merged.failureClass,
+              error: merged.error,
+              phaseCount: merged.phaseResults.length,
+            },
+          }),
+        );
+      }
+
+      if (options.enableGitops) {
+        const closeout: TurnCloseoutRecord = merged.closeout ?? {
+          traceId: merged.traceId,
+          turnId: merged.turnId,
+          unitType: merged.unitType,
+          unitId: merged.unitId,
+          status: merged.status,
+          failureClass: merged.failureClass,
+          gitAction: options.gitAction,
+          gitPushed: options.gitPush,
+          finishedAt: merged.finishedAt,
+        };
+        writeTurnCloseoutGitRecord(options.basePath, closeout);
+      }
+
+      current = null;
+      phaseResults.length = 0;
+    },
+  };
+}

package/src/resources/extensions/gsd/uok/model-policy.ts

@@ -0,0 +1,112 @@
+import type { TaskMetadata } from "../complexity-classifier.js";
+import { computeTaskRequirements, filterToolsForProvider } from "../model-router.js";
+import { buildAuditEnvelope, emitUokAuditEvent } from "./audit.js";
+
+export interface ModelCandidate {
+  id: string;
+  provider: string;
+  api: string;
+}
+
+export interface ModelPolicyDecision {
+  modelId: string;
+  provider: string;
+  allowed: boolean;
+  reason: string;
+}
+
+export interface ModelPolicyOptions {
+  basePath: string;
+  traceId: string;
+  turnId?: string;
+  unitType?: string;
+  taskMetadata?: TaskMetadata;
+  currentProvider?: string;
+  allowCrossProvider?: boolean;
+  requiredTools?: string[];
+  deniedProviders?: string[];
+  allowedApis?: string[];
+}
+
+export function buildRequirementVector(unitType?: string, taskMetadata?: TaskMetadata): Partial<Record<string, number>> {
+  if (!unitType) return {};
+  return computeTaskRequirements(unitType, taskMetadata) as unknown as Partial<Record<string, number>>;
+}
+
+export function applyModelPolicyFilter<T extends ModelCandidate>(
+  candidates: T[],
+  options: ModelPolicyOptions,
+): {
+  eligible: T[];
+  decisions: ModelPolicyDecision[];
+  requirements: Partial<Record<string, number>>;
+} {
+  const requiredTools = options.requiredTools ?? [];
+  const deniedProviders = new Set((options.deniedProviders ?? []).map((p) => p.toLowerCase()));
+  const allowedApis = options.allowedApis ? new Set(options.allowedApis) : null;
+  const requirements = buildRequirementVector(options.unitType, options.taskMetadata);
+  const decisions: ModelPolicyDecision[] = [];
+  const eligible: T[] = [];
+
+  for (const model of candidates) {
+    let allowed = true;
+    let reason = "allowed";
+
+    if (options.allowCrossProvider === false && options.currentProvider && model.provider !== options.currentProvider) {
+      allowed = false;
+      reason = `cross-provider routing disabled (${model.provider} != ${options.currentProvider})`;
+    }
+
+    if (allowed && deniedProviders.has(model.provider.toLowerCase())) {
+      allowed = false;
+      reason = `provider denied by policy: ${model.provider}`;
+    }
+
+    if (allowed && allowedApis && !allowedApis.has(model.api)) {
+      allowed = false;
+      reason = `transport/api denied by policy: ${model.api}`;
+    }
+
+    if (allowed && requiredTools.length > 0) {
+      const compatibility = filterToolsForProvider(requiredTools, model.api);
+      if (compatibility.filtered.length > 0) {
+        allowed = false;
+        reason = `tool policy denied (${compatibility.filtered.join(", ")}) for ${model.api}`;
+      }
+    }
+
+    const decision: ModelPolicyDecision = {
+      modelId: model.id,
+      provider: model.provider,
+      allowed,
+      reason,
+    };
+    decisions.push(decision);
+
+    emitUokAuditEvent(
+      options.basePath,
+      buildAuditEnvelope({
+        traceId: options.traceId,
+        turnId: options.turnId,
+        category: "model-policy",
+        type: allowed ? "model-policy-allow" : "model-policy-deny",
+        payload: {
+          modelId: model.id,
+          provider: model.provider,
+          api: model.api,
+          reason,
+          unitType: options.unitType,
+          requirements,
+        },
+      }),
+    );
+
+    if (allowed) eligible.push(model);
+  }
+
+  return {
+    eligible,
+    decisions,
+    requirements,
+  };
+}

package/src/resources/extensions/gsd/uok/plan-v2.ts

@@ -0,0 +1,156 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+import type { GSDState, Phase } from "../types.js";
+import { gsdRoot, resolveMilestoneFile, resolveSliceFile } from "../paths.js";
+import { isDbAvailable, getMilestoneSlices, getSliceTasks, type SliceRow } from "../gsd-db.js";
+import type { UokGraphNode } from "./contracts.js";
+
+const PLAN_V2_CLARIFY_ROUND_LIMIT = 3;
+const EXECUTION_ENTRY_PHASES: ReadonlySet<Phase> = new Set([
+  "executing",
+  "summarizing",
+  "validating-milestone",
+  "completing-milestone",
+]);
+
+export interface PlanV2CompileResult {
+  ok: boolean;
+  reason?: string;
+  graphPath?: string;
+  nodeCount?: number;
+  clarifyRoundLimit?: number;
+  researchSynthesized?: boolean;
+  draftContextIncluded?: boolean;
+  finalizedContextIncluded?: boolean;
+}
+
+function graphOutputPath(basePath: string): string {
+  return join(gsdRoot(basePath), "runtime", "uok-plan-v2-graph.json");
+}
+
+function hasFileContent(path: string | null): boolean {
+  if (!path || !existsSync(path)) return false;
+  try {
+    return readFileSync(path, "utf-8").trim().length > 0;
+  } catch {
+    return false;
+  }
+}
+
+function countSliceResearchArtifacts(basePath: string, milestoneId: string, slices: SliceRow[]): number {
+  let count = 0;
+  for (const slice of slices) {
+    if (hasFileContent(resolveSliceFile(basePath, milestoneId, slice.id, "RESEARCH"))) {
+      count += 1;
+    }
+  }
+  return count;
+}
+
+function isExecutionEntryPhase(phase: Phase): boolean {
+  return EXECUTION_ENTRY_PHASES.has(phase);
+}
+
+export function compileUnitGraphFromState(basePath: string, state: GSDState): PlanV2CompileResult {
+  const mid = state.activeMilestone?.id;
+  if (!mid) return { ok: false, reason: "no active milestone" };
+  if (!isDbAvailable()) return { ok: false, reason: "database not available" };
+
+  const slices = getMilestoneSlices(mid).sort((a, b) => Number(a.sequence ?? 0) - Number(b.sequence ?? 0));
+  const nodes: UokGraphNode[] = [];
+  const clarifyRoundLimit = PLAN_V2_CLARIFY_ROUND_LIMIT;
+  const draftContextIncluded = hasFileContent(resolveMilestoneFile(basePath, mid, "CONTEXT-DRAFT"));
+  const finalizedContextIncluded = hasFileContent(resolveMilestoneFile(basePath, mid, "CONTEXT"));
+  const researchSynthesized = hasFileContent(resolveMilestoneFile(basePath, mid, "RESEARCH"))
+    || countSliceResearchArtifacts(basePath, mid, slices) > 0;
+
+  if (isExecutionEntryPhase(state.phase) && !finalizedContextIncluded) {
+    const reason = draftContextIncluded
+      ? "milestone context draft exists but finalized CONTEXT.md is missing"
+      : "missing milestone CONTEXT.md";
+    return {
+      ok: false,
+      reason,
+      clarifyRoundLimit,
+      researchSynthesized,
+      draftContextIncluded,
+      finalizedContextIncluded,
+    };
+  }
+
+  for (const slice of slices) {
+    const sid = slice.id;
+    const tasks = getSliceTasks(mid, sid)
+      .sort((a, b) => Number(a.sequence ?? 0) - Number(b.sequence ?? 0));
+
+    let previousTaskNodeId: string | null = null;
+    for (const task of tasks) {
+      const nodeId = `execute-task:${mid}:${sid}:${task.id}`;
+      const dependsOn = previousTaskNodeId ? [previousTaskNodeId] : [];
+      nodes.push({
+        id: nodeId,
+        kind: "unit",
+        dependsOn,
+        writes: task.key_files,
+        metadata: {
+          unitType: "execute-task",
+          unitId: `${mid}.${sid}.${task.id}`,
+          title: task.title,
+          status: task.status,
+        },
+      });
+      previousTaskNodeId = nodeId;
+    }
+
+    if (previousTaskNodeId) {
+      nodes.push({
+        id: `complete-slice:${mid}:${sid}`,
+        kind: "verification",
+        dependsOn: [previousTaskNodeId],
+        metadata: {
+          unitType: "complete-slice",
+          unitId: `${mid}.${sid}`,
+          title: slice.title,
+          status: slice.status,
+        },
+      });
+    }
+  }
+
+  const output = {
+    compiledAt: new Date().toISOString(),
+    milestoneId: mid,
+    pipeline: {
+      clarifyRoundLimit,
+      researchSynthesized,
+      draftContextIncluded,
+      finalizedContextIncluded,
+      sourcePhase: state.phase,
+    },
+    nodes,
+  };
+
+  const outPath = graphOutputPath(basePath);
+  mkdirSync(join(gsdRoot(basePath), "runtime"), { recursive: true });
+  writeFileSync(outPath, JSON.stringify(output, null, 2) + "\n", "utf-8");
+
+  return {
+    ok: true,
+    graphPath: outPath,
+    nodeCount: nodes.length,
+    clarifyRoundLimit,
+    researchSynthesized: output.pipeline.researchSynthesized,
+    draftContextIncluded: output.pipeline.draftContextIncluded,
+    finalizedContextIncluded: output.pipeline.finalizedContextIncluded,
+  };
+}
+
+export function ensurePlanV2Graph(basePath: string, state: GSDState): PlanV2CompileResult {
+  const compiled = compileUnitGraphFromState(basePath, state);
+  if (!compiled.ok) return compiled;
+  if ((compiled.nodeCount ?? 0) <= 0) {
+    return { ok: false, reason: "compiled graph is empty" };
+  }
+  return compiled;
+}

package/src/resources/extensions/gsd/workflow-logger.ts

@@ -20,6 +20,8 @@ import { appendFileSync, readFileSync, existsSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 
 import { appendNotification } from "./notification-store.js";
+import { buildAuditEnvelope, emitUokAuditEvent } from "./uok/audit.js";
+import { isUnifiedAuditEnabled } from "./uok/audit-toggle.js";
 
 // ─── Types ──────────────────────────────────────────────────────────────
 
@@ -51,7 +53,8 @@ export type LogComponent =
   | "guided"        // Guided flow (discuss, plan wizards)
   | "registry"      // Rule registry hook state
   | "renderer"      // Markdown renderer and projections
-  | "safety";       // LLM safety harness
+  | "safety"        // LLM safety harness
+  | "ecosystem";    // GSD ecosystem extension loader and dispatch
 
 export interface LogEntry {
   ts: string;
@@ -275,6 +278,29 @@ function _push(
     _buffer.shift();
   }
 
+  if (_auditBasePath && isUnifiedAuditEnabled()) {
+    try {
+      emitUokAuditEvent(
+        _auditBasePath,
+        buildAuditEnvelope({
+          traceId: `workflow-log:${component}`,
+          turnId: context?.id,
+          causedBy: context?.fn ?? context?.tool,
+          category: "orchestration",
+          type: severity === "error" ? "workflow-log-error" : "workflow-log-warn",
+          payload: {
+            component,
+            message,
+            context: context ?? {},
+          },
+        }),
+      );
+    } catch (auditEmitErr) {
+      // Best-effort: unified audit projection must never block workflow logger.
+      _writeStderr(`[gsd:workflow-logger] unified-audit emit failed: ${(auditEmitErr as Error).message}\n`);
+    }
+  }
+
   // Persist errors to .gsd/audit-log.jsonl so they survive context resets.
   // Only error-severity entries are persisted — warnings are ephemeral (stderr + buffer)
   // to avoid log amplification from expected-control-flow catch paths.