gsd-pi 2.74.0 → 2.75.0-dev.063e5a3

package/dist/resources/extensions/gsd/auto-post-unit.js

@@ -19,7 +19,7 @@ import { invalidateAllCaches } from "./cache.js";
 import { rebuildState } from "./doctor.js";
 import { parseUnitId } from "./unit-id.js";
 import { closeoutUnit } from "./auto-unit-closeout.js";
-import { autoCommitCurrentBranch, } from "./worktree.js";
+import { runTurnGitAction, } from "./git-service.js";
 import { verifyExpectedArtifact, resolveExpectedArtifactPath, writeBlockerPlaceholder, diagnoseExpectedArtifact, } from "./auto-recovery.js";
 import { regenerateIfMissing } from "./workflow-projections.js";
 import { syncStateToProjectRoot } from "./auto-worktree.js";
@@ -42,6 +42,9 @@ import { getSliceTasks } from "./gsd-db.js";
 import { runPreExecutionChecks } from "./pre-execution-checks.js";
 import { writePreExecutionEvidence } from "./verification-evidence.js";
 import { ensureCodebaseMapFresh } from "./codebase-generator.js";
+import { resolveUokFlags } from "./uok/flags.js";
+import { UokGateRunner } from "./uok/gate-runner.js";
+import { writeTurnGitTransaction } from "./uok/gitops.js";
 /** Maximum verification retry attempts before escalating to blocker placeholder (#2653). */
 const MAX_VERIFICATION_RETRIES = 3;
 /** Enqueue a sidecar item (hook, triage, or quick-task) for the main loop to
@@ -71,6 +74,7 @@ import { describeNextUnit, } from "./auto-dashboard.js";
 import { existsSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
 import { _resetHasChangesCache } from "./native-git-bridge.js";
+import { autoCommitCurrentBranch } from "./worktree.js";
 /**
  * Detect summary files written directly to disk without the LLM calling
  * the completion tool. A "rogue" file is one that exists on disk but has
@@ -189,6 +193,57 @@ export function buildStepCompleteMessage(nextState) {
     return `Step complete. Next: ${next.label}\n`
         + `Run /clear, then /gsd to continue (or /gsd auto to run continuously).`;
 }
+export async function autoCommitUnit(basePath, unitType, unitId, ctx) {
+    try {
+        let taskContext;
+        if (unitType === "execute-task") {
+            const { milestone: mid, slice: sid, task: tid } = parseUnitId(unitId);
+            if (mid && sid && tid) {
+                const summaryPath = resolveTaskFile(basePath, mid, sid, tid, "SUMMARY");
+                if (summaryPath) {
+                    try {
+                        const summaryContent = await loadFile(summaryPath);
+                        if (summaryContent) {
+                            const summary = parseSummary(summaryContent);
+                            let ghIssueNumber;
+                            try {
+                                const { getTaskIssueNumberForCommit } = await import("../github-sync/sync.js");
+                                ghIssueNumber = getTaskIssueNumberForCommit(basePath, mid, sid, tid) ?? undefined;
+                            }
+                            catch (err) {
+                                logWarning("engine", `GitHub issue lookup failed: ${err instanceof Error ? err.message : String(err)}`);
+                            }
+                            taskContext = {
+                                taskId: `${sid}/${tid}`,
+                                taskTitle: summary.title?.replace(/^T\d+:\s*/, "") || tid,
+                                oneLiner: summary.oneLiner || undefined,
+                                keyFiles: summary.frontmatter.key_files?.filter(f => !f.includes("{{")) || undefined,
+                                issueNumber: ghIssueNumber,
+                            };
+                        }
+                    }
+                    catch (e) {
+                        debugLog("postUnit", { phase: "task-summary-parse", error: String(e) });
+                    }
+                }
+            }
+        }
+        _resetHasChangesCache();
+        if (LIFECYCLE_ONLY_UNITS.has(unitType)) {
+            return null;
+        }
+        const commitMsg = autoCommitCurrentBranch(basePath, unitType, unitId, taskContext);
+        if (commitMsg) {
+            ctx?.ui.notify(`Committed: ${commitMsg.split("\n")[0]}`, "info");
+        }
+        return commitMsg;
+    }
+    catch (e) {
+        debugLog("postUnit", { phase: "auto-commit", error: String(e) });
+        ctx?.ui.notify(`Auto-commit failed: ${String(e).split("\n")[0]}`, "warning");
+        return null;
+    }
+}
 /**
  * Pre-verification processing: parallel worker signal check, cache invalidation,
  * auto-commit, doctor run, state rebuild, worktree sync, artifact verification.
@@ -221,12 +276,19 @@ export async function postUnitPreVerification(pctx, opts) {
     if (!opts?.skipSettleDelay) {
         await new Promise(r => setTimeout(r, 100));
     }
-    // Auto-commit
+    const prefs = loadEffectiveGSDPreferences()?.preferences;
+    const uokFlags = resolveUokFlags(prefs);
+    // Turn-level git action (commit | snapshot | status-only)
     if (s.currentUnit) {
         const unit = s.currentUnit;
+        const turnAction = uokFlags.gitops ? uokFlags.gitopsTurnAction : "commit";
+        const traceId = s.currentTraceId ?? `turn:${unit.startedAt}`;
+        const turnId = s.currentTurnId ?? `${unit.type}/${unit.id}/${unit.startedAt}`;
+        s.lastGitActionFailure = null;
+        s.lastGitActionStatus = null;
         try {
             let taskContext;
-            if (s.currentUnit.type === "execute-task") {
+            if (turnAction === "commit" && s.currentUnit.type === "execute-task") {
                 const { milestone: mid, slice: sid, task: tid } = parseUnitId(s.currentUnit.id);
                 if (mid && sid && tid) {
                     const summaryPath = resolveTaskFile(s.basePath, mid, sid, tid, "SUMMARY");
@@ -266,19 +328,101 @@ export async function postUnitPreVerification(pctx, opts) {
             // code files only in the working tree where they are destroyed by
             // `git worktree remove --force` during teardown.
             _resetHasChangesCache();
-            // Skip auto-commit for lifecycle-only units (#2553) — they only touch
-            // `.gsd/` internal state files. Those files are picked up by the next
-            // actual task commit via smartStage().
-            if (!LIFECYCLE_ONLY_UNITS.has(s.currentUnit.type)) {
-                const commitMsg = autoCommitCurrentBranch(s.basePath, s.currentUnit.type, s.currentUnit.id, taskContext);
-                if (commitMsg) {
-                    ctx.ui.notify(`Committed: ${commitMsg.split("\n")[0]}`, "info");
+            const skipLifecycleCommit = turnAction === "commit" && LIFECYCLE_ONLY_UNITS.has(s.currentUnit.type);
+            if (skipLifecycleCommit) {
+                debugLog("postUnit", {
+                    phase: "git-action-skipped",
+                    reason: "lifecycle-only-unit",
+                    unitType: s.currentUnit.type,
+                    unitId: s.currentUnit.id,
+                });
+            }
+            else {
+                const gitResult = runTurnGitAction({
+                    basePath: s.basePath,
+                    action: turnAction,
+                    unitType: s.currentUnit.type,
+                    unitId: s.currentUnit.id,
+                    taskContext,
+                });
+                if (uokFlags.gitops) {
+                    writeTurnGitTransaction({
+                        basePath: s.basePath,
+                        traceId,
+                        turnId,
+                        unitType: unit.type,
+                        unitId: unit.id,
+                        stage: "publish",
+                        action: turnAction,
+                        push: uokFlags.gitopsTurnPush,
+                        status: gitResult.status,
+                        error: gitResult.error,
+                        metadata: {
+                            dirty: gitResult.dirty,
+                            commitMessage: gitResult.commitMessage,
+                            snapshotLabel: gitResult.snapshotLabel,
+                        },
+                    });
+                }
+                if (gitResult.status === "failed") {
+                    s.lastGitActionFailure = gitResult.error ?? `git ${turnAction} failed`;
+                    s.lastGitActionStatus = "failed";
+                    if (uokFlags.gitops && uokFlags.gates) {
+                        const parsed = parseUnitId(unit.id);
+                        const gateRunner = new UokGateRunner();
+                        gateRunner.register({
+                            id: "closeout-git-action",
+                            type: "closeout",
+                            execute: async () => ({
+                                outcome: "fail",
+                                failureClass: "git",
+                                rationale: `turn git action "${turnAction}" failed`,
+                                findings: gitResult.error ?? "unknown git failure",
+                            }),
+                        });
+                        await gateRunner.run("closeout-git-action", {
+                            basePath: s.basePath,
+                            traceId,
+                            turnId,
+                            milestoneId: parsed.milestone ?? undefined,
+                            sliceId: parsed.slice ?? undefined,
+                            taskId: parsed.task ?? undefined,
+                            unitType: unit.type,
+                            unitId: unit.id,
+                        });
+                    }
+                    const failureMsg = `Git ${turnAction} failed: ${(gitResult.error ?? "unknown error").split("\n")[0]}`;
+                    if (uokFlags.gitops) {
+                        ctx.ui.notify(failureMsg, "error");
+                        await pauseAuto(ctx, pi);
+                        return "dispatched";
+                    }
+                    ctx.ui.notify(failureMsg, "warning");
+                    debugLog("postUnit", {
+                        phase: "git-action-failed-nonblocking",
+                        action: turnAction,
+                        error: gitResult.error ?? "unknown error",
+                    });
+                }
+                s.lastGitActionStatus = "ok";
+                if (turnAction === "commit" && gitResult.commitMessage) {
+                    ctx.ui.notify(`Committed: ${gitResult.commitMessage.split("\n")[0]}`, "info");
+                }
+                else if (turnAction === "snapshot" && gitResult.snapshotLabel) {
+                    ctx.ui.notify(`Snapshot recorded: ${gitResult.snapshotLabel}`, "info");
                 }
             }
         }
         catch (e) {
-            debugLog("postUnit", { phase: "auto-commit", error: String(e) });
-            ctx.ui.notify(`Auto-commit failed: ${String(e).split("\n")[0]}`, "warning");
+            const message = e instanceof Error ? e.message : String(e);
+            s.lastGitActionFailure = message;
+            s.lastGitActionStatus = "failed";
+            debugLog("postUnit", { phase: "git-action", error: message, action: turnAction });
+            ctx.ui.notify(`Git ${turnAction} failed: ${message.split("\n")[0]}`, uokFlags.gitops ? "error" : "warning");
+            if (uokFlags.gitops) {
+                await pauseAuto(ctx, pi);
+                return "dispatched";
+            }
         }
         // GitHub sync (non-blocking, opt-in)
         await runSafely("postUnit", "github-sync", async () => {
@@ -714,11 +858,13 @@ export async function postUnitPostVerification(pctx) {
     // ── Pre-execution checks (after plan-slice completes) ──
     if (s.currentUnit &&
         s.currentUnit.type === "plan-slice") {
+        const currentUnit = s.currentUnit;
         let preExecPauseNeeded = false;
         await runSafely("postUnitPostVerification", "pre-execution-checks", async () => {
+            const prefs = loadEffectiveGSDPreferences()?.preferences;
+            const uokFlags = resolveUokFlags(prefs);
             try {
                 // Check preferences — respect enhanced_verification and enhanced_verification_pre
-                const prefs = loadEffectiveGSDPreferences()?.preferences;
                 const enhancedEnabled = prefs?.enhanced_verification !== false; // default true
                 const preEnabled = prefs?.enhanced_verification_pre !== false; // default true
                 if (!enhancedEnabled || !preEnabled) {
@@ -730,7 +876,7 @@ export async function postUnitPostVerification(pctx) {
                     return;
                 }
                 // Parse the unit ID to get milestone/slice IDs
-                const { milestone: mid, slice: sid } = parseUnitId(s.currentUnit.id);
+                const { milestone: mid, slice: sid } = parseUnitId(currentUnit.id);
                 if (!mid || !sid) {
                     debugLog("postUnitPostVerification", {
                         phase: "pre-execution-checks",
@@ -749,6 +895,7 @@ export async function postUnitPostVerification(pctx) {
                     });
                     return;
                 }
+                const strictMode = prefs?.enhanced_verification_strict === true;
                 // Run pre-execution checks
                 const result = await runPreExecutionChecks(tasks, s.basePath);
                 // Log summary to stderr in existing verification output format
@@ -764,10 +911,43 @@ export async function postUnitPostVerification(pctx) {
                 if (slicePath) {
                     writePreExecutionEvidence(result, slicePath, mid, sid);
                 }
-                // Notify UI
+                if (uokFlags.gates) {
+                    const failedChecks = result.checks
+                        .filter((check) => !check.passed)
+                        .map((check) => `[${check.category}] ${check.target}: ${check.message}`);
+                    const warnEscalated = result.status === "warn" && strictMode;
+                    const blockingFailure = result.status === "fail" || warnEscalated;
+                    const gateRunner = new UokGateRunner();
+                    gateRunner.register({
+                        id: "pre-execution-checks",
+                        type: "input",
+                        execute: async () => ({
+                            outcome: blockingFailure ? "fail" : "pass",
+                            failureClass: result.status === "fail" ? "input" : warnEscalated ? "policy" : "none",
+                            rationale: blockingFailure
+                                ? `pre-execution checks ${result.status}${warnEscalated ? " (strict)" : ""}`
+                                : "pre-execution checks passed",
+                            findings: failedChecks.join("\n"),
+                        }),
+                    });
+                    await gateRunner.run("pre-execution-checks", {
+                        basePath: s.basePath,
+                        traceId: `pre-execution:${currentUnit.id}`,
+                        turnId: currentUnit.id,
+                        milestoneId: mid,
+                        sliceId: sid,
+                        unitType: currentUnit.type,
+                        unitId: currentUnit.id,
+                    });
+                }
+                // Notify UI — surface actionable details (#4259)
                 if (result.status === "fail") {
-                    const blockingCount = result.checks.filter(c => !c.passed && c.blocking).length;
-                    ctx.ui.notify(`Pre-execution checks failed: ${blockingCount} blocking issue${blockingCount === 1 ? "" : "s"} found`, "error");
+                    const blockingChecks = result.checks.filter(c => !c.passed && c.blocking);
+                    const blockingCount = blockingChecks.length;
+                    const details = blockingChecks.slice(0, 3).map(c => `  \u2022 ${c.message}`).join("\n");
+                    const suffix = blockingChecks.length > 3 ? `\n  \u2022 ...and ${blockingChecks.length - 3} more` : "";
+                    const evidenceNote = `\nSee ${sid}-PRE-EXEC-VERIFY.json for full details.`;
+                    ctx.ui.notify(`Pre-execution checks failed: ${blockingCount} blocking issue${blockingCount === 1 ? "" : "s"} found\n${details}${suffix}${evidenceNote}`, "error");
                     preExecPauseNeeded = true;
                 }
                 else if (result.status === "warn") {
@@ -794,6 +974,29 @@ export async function postUnitPostVerification(pctx) {
                 });
                 logError("engine", `gsd-pre-exec: Pre-execution checks threw an error: ${errorMessage}`);
                 ctx.ui.notify(`Pre-execution checks error: ${errorMessage} — pausing for human review`, "error");
+                if (uokFlags.gates && s.currentUnit) {
+                    const { milestone: mid, slice: sid } = parseUnitId(s.currentUnit.id);
+                    const gateRunner = new UokGateRunner();
+                    gateRunner.register({
+                        id: "pre-execution-checks",
+                        type: "input",
+                        execute: async () => ({
+                            outcome: "manual-attention",
+                            failureClass: "manual-attention",
+                            rationale: "pre-execution checks threw before completion",
+                            findings: errorMessage,
+                        }),
+                    });
+                    await gateRunner.run("pre-execution-checks", {
+                        basePath: s.basePath,
+                        traceId: `pre-execution:${s.currentUnit.id}`,
+                        turnId: s.currentUnit.id,
+                        milestoneId: mid ?? undefined,
+                        sliceId: sid ?? undefined,
+                        unitType: s.currentUnit.type,
+                        unitId: s.currentUnit.id,
+                    });
+                }
                 preExecPauseNeeded = true;
             }
         });

package/dist/resources/extensions/gsd/auto-prompts.js

@@ -20,6 +20,7 @@ import { assertGateCoverage, getGatesForTurn, } from "./gate-registry.js";
 import { formatDecisionsCompact, formatRequirementsCompact } from "./structured-data-formatter.js";
 import { readPhaseAnchor, formatAnchorForPrompt } from "./phase-anchor.js";
 import { logWarning } from "./workflow-logger.js";
+import { inlineGraphSubgraph } from "./graph-context.js";
 // ─── Preamble Cap ─────────────────────────────────────────────────────────────
 const MAX_PREAMBLE_CHARS = 30_000;
 function capPreamble(preamble) {
@@ -1040,6 +1041,10 @@ export async function buildResearchSlicePrompt(mid, _midTitle, sid, sTitle, base
     const knowledgeInlineRS = await inlineKnowledgeScoped(base, keywords);
     if (knowledgeInlineRS)
         inlined.push(knowledgeInlineRS);
+    // Knowledge graph: subgraph for this slice (graceful — skipped if no graph.json)
+    const graphBlockRS = await inlineGraphSubgraph(base, `${sid} ${sTitle}`, { budget: 3000 });
+    if (graphBlockRS)
+        inlined.push(graphBlockRS);
     inlined.push(inlineTemplate("research", "Research"));
     const depContent = await inlineDependencySummaries(mid, sid, base);
     const activeOverrides = await loadActiveOverrides(base);
@@ -1111,6 +1116,10 @@ export async function buildPlanSlicePrompt(mid, _midTitle, sid, sTitle, base, le
     const knowledgeInlinePS = await inlineKnowledgeScoped(base, keywordsPS);
     if (knowledgeInlinePS)
         inlined.push(knowledgeInlinePS);
+    // Knowledge graph: subgraph for this slice (graceful — skipped if no graph.json)
+    const graphBlockPS = await inlineGraphSubgraph(base, `${sid} ${sTitle}`, { budget: 3000 });
+    if (graphBlockPS)
+        inlined.push(graphBlockPS);
     inlined.push(inlineTemplate("plan", "Slice Plan"));
     if (inlineLevel === "full") {
         inlined.push(inlineTemplate("task-plan", "Task Plan"));
@@ -1194,12 +1203,15 @@ export async function buildExecuteTaskPrompt(mid, sid, sTitle, tid, tTitle, base
         : null;
     // Only include if it has content (not a "not found" result)
     const knowledgeContent = knowledgeInlineET && !knowledgeInlineET.includes("not found") ? knowledgeInlineET : null;
+    // Knowledge graph: tight subgraph for this task (graceful — skipped if no graph.json)
+    const graphBlockET = await inlineGraphSubgraph(base, `${tid} ${tTitle}`, { budget: 2000 });
     const inlinedTemplates = inlineLevel === "minimal"
         ? inlineTemplate("task-summary", "Task Summary")
         : [
             inlineTemplate("task-summary", "Task Summary"),
             inlineTemplate("decisions", "Decisions"),
             ...(knowledgeContent ? [knowledgeContent] : []),
+            ...(graphBlockET ? [graphBlockET] : []),
         ].join("\n\n---\n\n");
     const taskSummaryPath = join(base, `${relSlicePath(base, mid, sid)}/tasks/${tid}-SUMMARY.md`);
     const activeOverrides = await loadActiveOverrides(base);

package/dist/resources/extensions/gsd/auto-recovery.js

@@ -215,20 +215,28 @@ export function verifyExpectedArtifact(unitType, unitId, base) {
     const absPath = resolveExpectedArtifactPath(unitType, unitId, base);
     // For unit types with no verifiable artifact (null path), the parent directory
     // is missing on disk — treat as stale completion state so the key gets evicted (#313).
-    if (!absPath)
+    if (!absPath) {
+        logWarning("recovery", `verify-fail ${unitType} ${unitId}: resolveExpectedArtifactPath returned null (parent dir missing)`);
         return false;
-    if (!existsSync(absPath))
+    }
+    if (!existsSync(absPath)) {
+        logWarning("recovery", `verify-fail ${unitType} ${unitId}: existsSync false for ${absPath}`);
         return false;
+    }
     if (unitType === "validate-milestone") {
         const validationContent = readFileSync(absPath, "utf-8");
-        if (!isValidationTerminal(validationContent))
+        if (!isValidationTerminal(validationContent)) {
+            logWarning("recovery", `verify-fail ${unitType} ${unitId}: validation not terminal (len=${validationContent.length}) at ${absPath}`);
             return false;
+        }
     }
     if (unitType === "plan-milestone") {
         try {
             const roadmap = parseLegacyRoadmap(readFileSync(absPath, "utf-8"));
-            if (roadmap.slices.length === 0)
+            if (roadmap.slices.length === 0) {
+                logWarning("recovery", `verify-fail ${unitType} ${unitId}: roadmap has zero slices at ${absPath}`);
                 return false;
+            }
         }
         catch (err) {
             logWarning("recovery", `plan-milestone roadmap verification failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -245,8 +253,10 @@ export function verifyExpectedArtifact(unitType, unitId, base) {
         // Accept checkbox-style (- [x] **T01: ...) or heading-style (### T01 -- / ### T01: / ### T01 —)
         const hasCheckboxTask = /^- \[[xX ]\] \*\*T\d+:/m.test(planContent);
         const hasHeadingTask = /^#{2,4}\s+T\d+\s*(?:--|—|:)/m.test(planContent);
-        if (!hasCheckboxTask && !hasHeadingTask)
+        if (!hasCheckboxTask && !hasHeadingTask) {
+            logWarning("recovery", `verify-fail ${unitType} ${unitId}: plan has no task checkbox/heading (len=${planContent.length}) at ${absPath}`);
             return false;
+        }
     }
     // execute-task: DB status is authoritative. Fall back to checked-checkbox
     // detection when the DB is unavailable (unmigrated projects).
@@ -306,11 +316,15 @@ export function verifyExpectedArtifact(unitType, unitId, base) {
                 }
                 if (taskIds && taskIds.length > 0) {
                     const tasksDir = resolveTasksDir(base, mid, sid);
-                    if (tasksDir) {
-                        for (const tid of taskIds) {
-                            const taskPlanFile = join(tasksDir, `${tid}-PLAN.md`);
-                            if (!existsSync(taskPlanFile))
-                                return false;
+                    if (!tasksDir) {
+                        logWarning("recovery", `verify-fail ${unitType} ${unitId}: resolveTasksDir returned null for ${mid}/${sid}`);
+                        return false;
+                    }
+                    for (const tid of taskIds) {
+                        const taskPlanFile = join(tasksDir, `${tid}-PLAN.md`);
+                        if (!existsSync(taskPlanFile)) {
+                            logWarning("recovery", `verify-fail ${unitType} ${unitId}: task plan missing ${taskPlanFile}`);
+                            return false;
                         }
                     }
                 }

package/dist/resources/extensions/gsd/auto-unit-closeout.js

@@ -6,6 +6,7 @@
 import { snapshotUnitMetrics } from "./metrics.js";
 import { saveActivityLog } from "./activity-log.js";
 import { logWarning } from "./workflow-logger.js";
+import { writeTurnGitTransaction } from "./uok/gitops.js";
 /**
  * Snapshot metrics, save activity log, and fire-and-forget memory extraction
  * for a completed unit. Returns the activity log file path (if any).
@@ -28,5 +29,22 @@ export async function closeoutUnit(ctx, basePath, unitType, unitId, startedAt, o
             logWarning("engine", `operation failed: ${err instanceof Error ? err.message : String(err)}`);
         }
     }
+    if (opts?.traceId && opts.turnId && opts.gitAction && opts.gitStatus) {
+        writeTurnGitTransaction({
+            basePath,
+            traceId: opts.traceId,
+            turnId: opts.turnId,
+            unitType,
+            unitId,
+            stage: "record",
+            action: opts.gitAction,
+            push: opts.gitPush === true,
+            status: opts.gitStatus,
+            error: opts.gitError,
+            metadata: {
+                activityFile,
+            },
+        });
+    }
     return activityFile ?? undefined;
 }

package/dist/resources/extensions/gsd/auto-verification.js

@@ -24,6 +24,8 @@ import { writeVerificationJSON } from "./verification-evidence.js";
 import { logWarning } from "./workflow-logger.js";
 import { runPostExecutionChecks } from "./post-execution-checks.js";
 import { join } from "node:path";
+import { resolveUokFlags } from "./uok/flags.js";
+import { UokGateRunner } from "./uok/gate-runner.js";
 function isInfraVerificationFailure(stderr) {
     return /\b(ENOENT|ENOTFOUND|ETIMEDOUT|ECONNRESET|EAI_AGAIN|spawn\s+\S+\s+ENOENT|command not found)\b/i.test(stderr);
 }
@@ -43,6 +45,31 @@ function isInfraVerificationFailure(stderr) {
  */
 async function runValidateMilestonePostCheck(vctx, pauseAuto) {
     const { s, ctx, pi } = vctx;
+    const prefs = loadEffectiveGSDPreferences()?.preferences;
+    const uokFlags = resolveUokFlags(prefs);
+    const persistMilestoneValidationGate = async (outcome, failureClass, rationale, findings = "", milestoneId) => {
+        if (!uokFlags.gates || !s.currentUnit)
+            return;
+        const gateRunner = new UokGateRunner();
+        gateRunner.register({
+            id: "milestone-validation-post-check",
+            type: "verification",
+            execute: async () => ({
+                outcome,
+                failureClass,
+                rationale,
+                findings,
+            }),
+        });
+        await gateRunner.run("milestone-validation-post-check", {
+            basePath: s.basePath,
+            traceId: `validation-post-check:${s.currentUnit.id}`,
+            turnId: s.currentUnit.id,
+            milestoneId,
+            unitType: s.currentUnit.type,
+            unitId: s.currentUnit.id,
+        });
+    };
     if (!s.currentUnit)
         return "continue";
     const { milestone: mid } = parseUnitId(s.currentUnit.id);
@@ -55,17 +82,22 @@ async function runValidateMilestonePostCheck(vctx, pauseAuto) {
     if (!validationContent)
         return "continue";
     const verdict = extractVerdict(validationContent);
-    if (verdict !== "needs-remediation")
+    if (verdict !== "needs-remediation") {
+        await persistMilestoneValidationGate("pass", "none", `milestone validation verdict is ${verdict}; no remediation loop risk`, "", mid);
         return "continue";
+    }
     const incompleteSliceCount = await countIncompleteSlices(s.basePath, mid);
     // If any non-closed slices exist, the agent successfully queued remediation
     // work — proceed normally. The state machine will execute those slices and
     // re-validate per the #3596/#3670 fix.
-    if (incompleteSliceCount > 0)
+    if (incompleteSliceCount > 0) {
+        await persistMilestoneValidationGate("pass", "none", `remediation slices present (${incompleteSliceCount}); validation can continue`, "", mid);
         return "continue";
+    }
     ctx.ui.notify(`Milestone ${mid} validation returned verdict=needs-remediation but no remediation slices were added. Pausing for human review.`, "error");
     process.stderr.write(`validate-milestone: pausing — verdict=needs-remediation with no incomplete slices for ${mid}. ` +
         `The agent must call gsd_reassess_roadmap to add remediation slices before re-validation.\n`);
+    await persistMilestoneValidationGate("manual-attention", "manual-attention", "needs-remediation verdict without queued remediation slices", `No incomplete slices found for ${mid} while verdict=needs-remediation`, mid);
     await pauseAuto(ctx, pi);
     return "pause";
 }
@@ -122,6 +154,7 @@ export async function runPostUnitVerification(vctx, pauseAuto) {
     try {
         const effectivePrefs = loadEffectiveGSDPreferences();
         const prefs = effectivePrefs?.preferences;
+        const uokFlags = resolveUokFlags(prefs);
         // Read task plan verify field
         const { milestone: mid, slice: sid, task: tid } = parseUnitId(s.currentUnit.id);
         let taskPlanVerify;
@@ -153,6 +186,35 @@ export async function runPostUnitVerification(vctx, pauseAuto) {
                 process.stderr.write(`  [${w.severity}] ${w.name}: ${w.title}\n`);
             }
         }
+        if (uokFlags.gates) {
+            const gateRunner = new UokGateRunner();
+            gateRunner.register({
+                id: "verification-gate",
+                type: "verification",
+                execute: async () => ({
+                    outcome: result.passed ? "pass" : "fail",
+                    failureClass: result.runtimeErrors?.some((e) => e.blocking)
+                        ? "execution"
+                        : "verification",
+                    rationale: result.passed
+                        ? "verification checks passed"
+                        : "verification checks failed",
+                    findings: result.passed
+                        ? ""
+                        : formatFailureContext(result),
+                }),
+            });
+            await gateRunner.run("verification-gate", {
+                basePath: s.basePath,
+                traceId: `verification:${s.currentUnit.id}`,
+                turnId: s.currentUnit.id,
+                milestoneId: mid ?? undefined,
+                sliceId: sid ?? undefined,
+                taskId: tid ?? undefined,
+                unitType: s.currentUnit.type,
+                unitId: s.currentUnit.id,
+            });
+        }
         // Auto-fix retry preferences
         const autoFixEnabled = prefs?.verification_auto_fix !== false;
         const maxRetries = typeof prefs?.verification_max_retries === "number"
@@ -253,6 +315,42 @@ export async function runPostUnitVerification(vctx, pauseAuto) {
                                     : "⚠";
                             process.stderr.write(`gsd-post-exec:   ${checkEmoji} [${check.category}] ${check.target}: ${check.message}\n`);
                         }
+                        if (uokFlags.gates) {
+                            const strictMode = prefs?.enhanced_verification_strict === true;
+                            const warnEscalated = postExecResult.status === "warn" && strictMode;
+                            const blockingFailure = postExecResult.status === "fail" || warnEscalated;
+                            const findings = postExecResult.checks
+                                .filter((check) => !check.passed)
+                                .map((check) => `[${check.category}] ${check.target}: ${check.message}`)
+                                .join("\n");
+                            const gateRunner = new UokGateRunner();
+                            gateRunner.register({
+                                id: "post-execution-checks",
+                                type: "artifact",
+                                execute: async () => ({
+                                    outcome: blockingFailure ? "fail" : "pass",
+                                    failureClass: postExecResult.status === "fail"
+                                        ? "artifact"
+                                        : warnEscalated
+                                            ? "policy"
+                                            : "none",
+                                    rationale: blockingFailure
+                                        ? `post-execution checks ${postExecResult.status}${warnEscalated ? " (strict)" : ""}`
+                                        : "post-execution checks passed",
+                                    findings,
+                                }),
+                            });
+                            await gateRunner.run("post-execution-checks", {
+                                basePath: s.basePath,
+                                traceId: `verification:${s.currentUnit.id}`,
+                                turnId: s.currentUnit.id,
+                                milestoneId: mid,
+                                sliceId: sid,
+                                taskId: tid,
+                                unitType: s.currentUnit.type,
+                                unitId: s.currentUnit.id,
+                            });
+                        }
                         // Check for blocking failures
                         if (postExecResult.status === "fail") {
                             postExecBlockingFailure = true;

package/dist/resources/extensions/gsd/auto-worktree.js

@@ -54,6 +54,8 @@ function isSamePath(a, b) {
         return realpathSync(a) === realpathSync(b);
     }
     catch (e) {
+        if (e.code === "ENOENT")
+            return false;
         logWarning("worktree", `isSamePath failed: ${e.message}`);
         return false;
     }