gsd-pi 2.74.0 → 2.75.0-dev.2203010a0

package/dist/resources/extensions/gsd/auto-verification.js

@@ -5,9 +5,9 @@
  * dependency audits, handles auto-fix retry logic, and writes
  * verification evidence JSON.
  *
- * Extracted from handleAgentEnd() in auto.ts. Returns a sentinel
- * value instead of calling return/pauseAuto directly — the caller
- * checks the result and handles control flow.
+ * Extracted from the pre-loop agent_end handler in auto.ts. Returns a
+ * sentinel value instead of calling return/pauseAuto directly — the
+ * caller checks the result and handles control flow.
  */
 import { mkdirSync, writeFileSync } from "node:fs";
 import { resolveSlicePath, resolveMilestoneFile } from "./paths.js";
@@ -24,6 +24,8 @@ import { writeVerificationJSON } from "./verification-evidence.js";
 import { logWarning } from "./workflow-logger.js";
 import { runPostExecutionChecks } from "./post-execution-checks.js";
 import { join } from "node:path";
+import { resolveUokFlags } from "./uok/flags.js";
+import { UokGateRunner } from "./uok/gate-runner.js";
 function isInfraVerificationFailure(stderr) {
     return /\b(ENOENT|ENOTFOUND|ETIMEDOUT|ECONNRESET|EAI_AGAIN|spawn\s+\S+\s+ENOENT|command not found)\b/i.test(stderr);
 }
@@ -43,6 +45,31 @@ function isInfraVerificationFailure(stderr) {
  */
 async function runValidateMilestonePostCheck(vctx, pauseAuto) {
     const { s, ctx, pi } = vctx;
+    const prefs = loadEffectiveGSDPreferences()?.preferences;
+    const uokFlags = resolveUokFlags(prefs);
+    const persistMilestoneValidationGate = async (outcome, failureClass, rationale, findings = "", milestoneId) => {
+        if (!uokFlags.gates || !s.currentUnit)
+            return;
+        const gateRunner = new UokGateRunner();
+        gateRunner.register({
+            id: "milestone-validation-post-check",
+            type: "verification",
+            execute: async () => ({
+                outcome,
+                failureClass,
+                rationale,
+                findings,
+            }),
+        });
+        await gateRunner.run("milestone-validation-post-check", {
+            basePath: s.basePath,
+            traceId: `validation-post-check:${s.currentUnit.id}`,
+            turnId: s.currentUnit.id,
+            milestoneId,
+            unitType: s.currentUnit.type,
+            unitId: s.currentUnit.id,
+        });
+    };
     if (!s.currentUnit)
         return "continue";
     const { milestone: mid } = parseUnitId(s.currentUnit.id);
@@ -55,17 +82,22 @@ async function runValidateMilestonePostCheck(vctx, pauseAuto) {
     if (!validationContent)
         return "continue";
     const verdict = extractVerdict(validationContent);
-    if (verdict !== "needs-remediation")
+    if (verdict !== "needs-remediation") {
+        await persistMilestoneValidationGate("pass", "none", `milestone validation verdict is ${verdict}; no remediation loop risk`, "", mid);
         return "continue";
+    }
     const incompleteSliceCount = await countIncompleteSlices(s.basePath, mid);
     // If any non-closed slices exist, the agent successfully queued remediation
     // work — proceed normally. The state machine will execute those slices and
     // re-validate per the #3596/#3670 fix.
-    if (incompleteSliceCount > 0)
+    if (incompleteSliceCount > 0) {
+        await persistMilestoneValidationGate("pass", "none", `remediation slices present (${incompleteSliceCount}); validation can continue`, "", mid);
         return "continue";
+    }
     ctx.ui.notify(`Milestone ${mid} validation returned verdict=needs-remediation but no remediation slices were added. Pausing for human review.`, "error");
     process.stderr.write(`validate-milestone: pausing — verdict=needs-remediation with no incomplete slices for ${mid}. ` +
         `The agent must call gsd_reassess_roadmap to add remediation slices before re-validation.\n`);
+    await persistMilestoneValidationGate("manual-attention", "manual-attention", "needs-remediation verdict without queued remediation slices", `No incomplete slices found for ${mid} while verdict=needs-remediation`, mid);
     await pauseAuto(ctx, pi);
     return "pause";
 }
@@ -122,6 +154,7 @@ export async function runPostUnitVerification(vctx, pauseAuto) {
     try {
         const effectivePrefs = loadEffectiveGSDPreferences();
         const prefs = effectivePrefs?.preferences;
+        const uokFlags = resolveUokFlags(prefs);
         // Read task plan verify field
         const { milestone: mid, slice: sid, task: tid } = parseUnitId(s.currentUnit.id);
         let taskPlanVerify;
@@ -153,6 +186,35 @@ export async function runPostUnitVerification(vctx, pauseAuto) {
                 process.stderr.write(`  [${w.severity}] ${w.name}: ${w.title}\n`);
             }
         }
+        if (uokFlags.gates) {
+            const gateRunner = new UokGateRunner();
+            gateRunner.register({
+                id: "verification-gate",
+                type: "verification",
+                execute: async () => ({
+                    outcome: result.passed ? "pass" : "fail",
+                    failureClass: result.runtimeErrors?.some((e) => e.blocking)
+                        ? "execution"
+                        : "verification",
+                    rationale: result.passed
+                        ? "verification checks passed"
+                        : "verification checks failed",
+                    findings: result.passed
+                        ? ""
+                        : formatFailureContext(result),
+                }),
+            });
+            await gateRunner.run("verification-gate", {
+                basePath: s.basePath,
+                traceId: `verification:${s.currentUnit.id}`,
+                turnId: s.currentUnit.id,
+                milestoneId: mid ?? undefined,
+                sliceId: sid ?? undefined,
+                taskId: tid ?? undefined,
+                unitType: s.currentUnit.type,
+                unitId: s.currentUnit.id,
+            });
+        }
         // Auto-fix retry preferences
         const autoFixEnabled = prefs?.verification_auto_fix !== false;
         const maxRetries = typeof prefs?.verification_max_retries === "number"
@@ -253,6 +315,42 @@ export async function runPostUnitVerification(vctx, pauseAuto) {
                                     : "⚠";
                             process.stderr.write(`gsd-post-exec:   ${checkEmoji} [${check.category}] ${check.target}: ${check.message}\n`);
                         }
+                        if (uokFlags.gates) {
+                            const strictMode = prefs?.enhanced_verification_strict === true;
+                            const warnEscalated = postExecResult.status === "warn" && strictMode;
+                            const blockingFailure = postExecResult.status === "fail" || warnEscalated;
+                            const findings = postExecResult.checks
+                                .filter((check) => !check.passed)
+                                .map((check) => `[${check.category}] ${check.target}: ${check.message}`)
+                                .join("\n");
+                            const gateRunner = new UokGateRunner();
+                            gateRunner.register({
+                                id: "post-execution-checks",
+                                type: "artifact",
+                                execute: async () => ({
+                                    outcome: blockingFailure ? "fail" : "pass",
+                                    failureClass: postExecResult.status === "fail"
+                                        ? "artifact"
+                                        : warnEscalated
+                                            ? "policy"
+                                            : "none",
+                                    rationale: blockingFailure
+                                        ? `post-execution checks ${postExecResult.status}${warnEscalated ? " (strict)" : ""}`
+                                        : "post-execution checks passed",
+                                    findings,
+                                }),
+                            });
+                            await gateRunner.run("post-execution-checks", {
+                                basePath: s.basePath,
+                                traceId: `verification:${s.currentUnit.id}`,
+                                turnId: s.currentUnit.id,
+                                milestoneId: mid,
+                                sliceId: sid,
+                                taskId: tid,
+                                unitType: s.currentUnit.type,
+                                unitId: s.currentUnit.id,
+                            });
+                        }
                         // Check for blocking failures
                         if (postExecResult.status === "fail") {
                             postExecBlockingFailure = true;

package/dist/resources/extensions/gsd/auto-worktree.js

@@ -20,7 +20,7 @@ import { MergeConflictError, readIntegrationBranch, RUNTIME_EXCLUSION_PATHS } fr
 import { debugLog } from "./debug-logger.js";
 import { logWarning, logError } from "./workflow-logger.js";
 import { loadEffectiveGSDPreferences } from "./preferences.js";
-import { nativeGetCurrentBranch, nativeDetectMainBranch, nativeWorkingTreeStatus, nativeAddAllWithExclusions, nativeCommit, nativeCheckoutBranch, nativeMergeSquash, nativeConflictFiles, nativeCheckoutTheirs, nativeAddPaths, nativeRmForce, nativeBranchDelete, nativeBranchExists, nativeDiffNumstat, nativeUpdateRef, nativeIsAncestor, nativeMergeAbort, } from "./native-git-bridge.js";
+import { nativeGetCurrentBranch, nativeDetectMainBranch, nativeWorkingTreeStatus, nativeAddAllWithExclusions, nativeCommit, nativeCheckoutBranch, nativeMergeSquash, nativeConflictFiles, nativeCheckoutTheirs, nativeAddPaths, nativeRmForce, nativeBranchDelete, nativeBranchForceReset, nativeBranchExists, nativeDiffNumstat, nativeUpdateRef, nativeIsAncestor, nativeMergeAbort, } from "./native-git-bridge.js";
 const gsdHome = process.env.GSD_HOME || join(homedir(), ".gsd");
 const PROJECT_PREFERENCES_FILE = "PREFERENCES.md";
 const LEGACY_PROJECT_PREFERENCES_FILE = "preferences.md";
@@ -54,6 +54,8 @@ function isSamePath(a, b) {
         return realpathSync(a) === realpathSync(b);
     }
     catch (e) {
+        if (e.code === "ENOENT")
+            return false;
         logWarning("worktree", `isSamePath failed: ${e.message}`);
         return false;
     }
@@ -790,9 +792,63 @@ export function runWorktreePostCreateHook(sourceDir, worktreeDir, hookPath) {
     }
 }
 // ─── Auto-Worktree Branch Naming ───────────────────────────────────────────
+/** Returns the git branch name for a milestone worktree (`milestone/<MID>`). */
 export function autoWorktreeBranch(milestoneId) {
     return `milestone/${milestoneId}`;
 }
+// ─── Branch-mode Entry ─────────────────────────────────────────────────────
+/**
+ * Enter branch isolation mode for a milestone.
+ *
+ * Creates `milestone/<MID>` from the integration branch (if it doesn't
+ * exist yet) and checks out to it.  No worktree directory is created — the
+ * project root is the working copy; only HEAD changes.
+ *
+ * Uses the same 3-tier integration-branch fallback as createAutoWorktree:
+ *   1. META.json recorded integration branch
+ *   2. git.main_branch preference
+ *   3. nativeDetectMainBranch (origin/HEAD auto-detection)
+ */
+export function enterBranchModeForMilestone(basePath, milestoneId) {
+    const branch = autoWorktreeBranch(milestoneId);
+    const branchExists = nativeBranchExists(basePath, branch);
+    if (!branchExists) {
+        // Create the milestone branch from the integration branch start-point.
+        const integrationBranch = readIntegrationBranch(basePath, milestoneId) ?? undefined;
+        const gitPrefs = loadEffectiveGSDPreferences()?.preferences?.git;
+        // Validate main_branch preference exists in the repo before using it —
+        // a stale preference (e.g. "master" when repo uses "main") would cause
+        // nativeBranchForceReset to fail with a bad start-point reference.
+        const validatedPrefBranch = gitPrefs?.main_branch &&
+            typeof gitPrefs.main_branch === "string" &&
+            gitPrefs.main_branch.length > 0 &&
+            nativeBranchExists(basePath, gitPrefs.main_branch)
+            ? gitPrefs.main_branch
+            : undefined;
+        const startPoint = integrationBranch ??
+            validatedPrefBranch ??
+            nativeDetectMainBranch(basePath);
+        // nativeBranchForceReset creates (or resets) branch at startPoint,
+        // then checkout switches HEAD to it.
+        nativeBranchForceReset(basePath, branch, startPoint);
+        debugLog("auto-worktree", {
+            action: "enterBranchMode",
+            milestoneId,
+            branch,
+            startPoint,
+            created: true,
+        });
+    }
+    else {
+        debugLog("auto-worktree", {
+            action: "enterBranchMode",
+            milestoneId,
+            branch,
+            reused: true,
+        });
+    }
+    nativeCheckoutBranch(basePath, branch);
+}
 // ─── Public API ────────────────────────────────────────────────────────────
 /**
  * Create a new auto-worktree for a milestone, chdir into it, and store

package/dist/resources/extensions/gsd/auto.js

@@ -36,7 +36,7 @@ import { captureAvailableSkills, resetSkillTelemetry, } from "./skill-telemetry.
 import { getRtkSessionSavings } from "../shared/rtk-session-stats.js";
 import { deactivateGSD } from "../shared/gsd-phase-state.js";
 import { initMetrics, resetMetrics, getLedger, getProjectTotals, formatCost, formatTokenCount, } from "./metrics.js";
-import { logWarning } from "./workflow-logger.js";
+import { setLogBasePath, logWarning } from "./workflow-logger.js";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { pathToFileURL } from "node:url";
@@ -45,12 +45,14 @@ import { atomicWriteSync } from "./atomic-write.js";
 import { autoCommitCurrentBranch, captureIntegrationBranch, detectWorktreeName, getCurrentBranch, getMainBranch, setActiveMilestoneId, } from "./worktree.js";
 import { GitServiceImpl } from "./git-service.js";
 import { getPriorSliceCompletionBlocker } from "./dispatch-guard.js";
-import { createAutoWorktree, enterAutoWorktree, teardownAutoWorktree, isInAutoWorktree, getAutoWorktreePath, mergeMilestoneToMain, autoWorktreeBranch, syncWorktreeStateBack, syncProjectRootToWorktree, checkResourcesStale, escapeStaleWorktree, } from "./auto-worktree.js";
+import { createAutoWorktree, enterAutoWorktree, enterBranchModeForMilestone, teardownAutoWorktree, isInAutoWorktree, getAutoWorktreePath, mergeMilestoneToMain, autoWorktreeBranch, syncWorktreeStateBack, syncProjectRootToWorktree, checkResourcesStale, escapeStaleWorktree, } from "./auto-worktree.js";
 import { pruneQueueOrder } from "./queue-order.js";
+import { startCommandPolling as _startCommandPolling, isRemoteConfigured } from "../remote-questions/manager.js";
 import { debugLog, isDebugEnabled, writeDebugSummary } from "./debug-logger.js";
 import { reconcileMergeState, } from "./auto-recovery.js";
 import { resolveDispatch, DISPATCH_RULES } from "./auto-dispatch.js";
 import { getErrorMessage } from "./error-utils.js";
+import { recoverFailedMigration } from "./migrate-external.js";
 import { initRegistry, convertDispatchRules } from "./rule-registry.js";
 import { emitJournalEvent as _emitJournalEvent } from "./journal.js";
 import { updateProgressWidget as _updateProgressWidget, updateSliceProgressCache, clearSliceProgressCache, hideFooter, } from "./auto-dashboard.js";
@@ -61,10 +63,12 @@ import { clearCmuxSidebar, logCmuxEvent, syncCmuxSidebar } from "../cmux/index.j
 // ── Extracted modules ──────────────────────────────────────────────────────
 import { startUnitSupervision } from "./auto-timers.js";
 import { runPostUnitVerification } from "./auto-verification.js";
-import { postUnitPreVerification, postUnitPostVerification, } from "./auto-post-unit.js";
+import { autoCommitUnit, postUnitPreVerification, postUnitPostVerification, } from "./auto-post-unit.js";
 import { bootstrapAutoSession, openProjectDbIfPresent } from "./auto-start.js";
 import { initHealthWidget } from "./health-widget.js";
-import { autoLoop, resolveAgentEnd, resolveAgentEndCancelled, _resetPendingResolve, isSessionSwitchInFlight } from "./auto-loop.js";
+import { runLegacyAutoLoop, runUokKernelLoop, resolveAgentEnd, resolveAgentEndCancelled, _resetPendingResolve, isSessionSwitchInFlight } from "./auto-loop.js";
+import { runAutoLoopWithUok } from "./uok/kernel.js";
+import { resolveUokFlags } from "./uok/flags.js";
 import { WorktreeResolver, } from "./worktree-resolver.js";
 import { reorderForCaching } from "./prompt-ordering.js";
 // ─── Session State ─────────────────────────────────────────────────────────
@@ -140,6 +144,7 @@ export function startAutoDetached(ctx, pi, base, verboseMode, options) {
         debugLog("auto-start-failed", { error: message });
     });
 }
+/** Returns true if the project is configured for `isolation:worktree` mode. */
 export function shouldUseWorktreeIsolation() {
     const prefs = loadEffectiveGSDPreferences()?.preferences?.git;
     if (prefs?.isolation === "worktree")
@@ -183,6 +188,26 @@ function deregisterSigtermHandler() {
     _deregisterSigtermHandler(s.sigtermHandler);
     s.sigtermHandler = null;
 }
+/**
+ * Wrapper: start background command polling for the configured remote channel
+ * (currently Telegram only). Stores the cleanup function on the session so
+ * every exit path can stop the interval via stopCommandPolling().
+ * No-op when no remote channel is configured.
+ */
+function startAutoCommandPolling(basePath) {
+    if (!isRemoteConfigured())
+        return;
+    // Clear any existing interval before starting a new one (e.g. resume path).
+    stopAutoCommandPolling();
+    s.commandPollingCleanup = _startCommandPolling(basePath);
+}
+/** Wrapper: stop background command polling and clear the stored cleanup. */
+function stopAutoCommandPolling() {
+    if (s.commandPollingCleanup) {
+        s.commandPollingCleanup();
+        s.commandPollingCleanup = null;
+    }
+}
 export function getAutoDashboardData() {
     const ledger = getLedger();
     const totals = ledger ? getProjectTotals(ledger.units) : null;
@@ -246,6 +271,14 @@ export function getActiveRunDir() {
 export function getAutoModeStartModel() {
     return s.autoModeStartModel;
 }
+/**
+ * Update the dashboard-facing dispatched model label.
+ * Used when runtime recovery switches models mid-unit (e.g. provider fallback)
+ * so the AUTO box reflects the active model immediately.
+ */
+export function setCurrentDispatchedModelId(model) {
+    s.currentDispatchedModelId = model ? `${model.provider}/${model.id}` : null;
+}
 // Tool tracking — delegates to auto-tool-tracking.ts
 export function markToolStart(toolCallId, toolName) {
     _markToolStart(toolCallId, s.active, toolName);
@@ -360,10 +393,22 @@ function clearUnitTimeout() {
 }
 /** Build snapshot metric opts. */
 function buildSnapshotOpts(_unitType, _unitId) {
+    const prefs = loadEffectiveGSDPreferences()?.preferences;
+    const uokFlags = resolveUokFlags(prefs);
     return {
         ...(s.autoStartTime > 0 ? { autoSessionKey: String(s.autoStartTime) } : {}),
         promptCharCount: s.lastPromptCharCount,
         baselineCharCount: s.lastBaselineCharCount,
+        traceId: s.currentTraceId ?? undefined,
+        turnId: s.currentTurnId ?? undefined,
+        ...(uokFlags.gitops
+            ? {
+                gitAction: uokFlags.gitopsTurnAction,
+                gitPush: uokFlags.gitopsTurnPush,
+                gitStatus: s.lastGitActionStatus ?? undefined,
+                gitError: s.lastGitActionFailure ?? undefined,
+            }
+            : {}),
         ...(s.currentUnitRouting ?? {}),
     };
 }
@@ -378,6 +423,7 @@ function handleLostSessionLock(ctx, lockStatus) {
     s.paused = false;
     deactivateGSD();
     clearUnitTimeout();
+    stopAutoCommandPolling();
     restoreProjectRootEnv();
     restoreMilestoneLockEnv();
     deregisterSigtermHandler();
@@ -413,6 +459,7 @@ function cleanupAfterLoopExit(ctx) {
     s.active = false;
     deactivateGSD();
     clearUnitTimeout();
+    stopAutoCommandPolling();
     restoreProjectRootEnv();
     restoreMilestoneLockEnv();
     // Clear crash lock and release session lock so the next `/gsd next` does
@@ -457,6 +504,7 @@ export async function stopAuto(ctx, pi, reason) {
         // ── Step 1: Timers and locks ──
         try {
             clearUnitTimeout();
+            stopAutoCommandPolling();
             if (lockBase())
                 clearLock(lockBase());
             if (lockBase())
@@ -710,6 +758,7 @@ export async function pauseAuto(ctx, _pi, _errorContext) {
     if (!s.active)
         return;
     clearUnitTimeout();
+    stopAutoCommandPolling();
     // Flush queued follow-up messages (#3512).
     // Late async notifications (async_job_result, gsd-auto-wrapup) can trigger
     // extra LLM turns after pause. Flush them the same way run-unit.ts does.
@@ -800,6 +849,7 @@ function buildResolverDeps() {
         teardownAutoWorktree,
         createAutoWorktree,
         enterAutoWorktree,
+        enterBranchModeForMilestone,
         getAutoWorktreePath,
         autoCommitCurrentBranch,
         getCurrentBranch,
@@ -884,6 +934,7 @@ function buildLoopDeps() {
         getMainBranch,
         // Unit closeout + runtime records
         closeoutUnit,
+        autoCommitUnit,
         recordOutcome,
         writeLock,
         captureAvailableSkills,
@@ -926,6 +977,11 @@ function buildLoopDeps() {
         emitJournalEvent: (entry) => _emitJournalEvent(s.basePath, entry),
     };
 }
+/**
+ * Start auto-mode. Handles both fresh-start and resume paths, sets up session
+ * state, enters the milestone worktree or branch, and dispatches the first unit.
+ * No-ops if auto-mode is already active.
+ */
 export async function startAuto(ctx, pi, base, verboseMode, options) {
     if (s.active) {
         debugLog("startAuto", { phase: "already-active", skipping: true });
@@ -941,6 +997,12 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
     }
     // Escape stale worktree cwd from a previous milestone (#608).
     base = escapeStaleWorktree(base);
+    // Heal .gsd.migrating before any branching — covers both fresh-start and
+    // resume paths (#4416). The matching call in auto-start.ts covers the
+    // bootstrap-only path; this call ensures the resume path is also protected.
+    if (recoverFailedMigration(base)) {
+        ctx.ui.notify("Recovered unfinished migration (.gsd.migrating → .gsd).", "info");
+    }
     const freshStartAssessment = interruptedAssessment
         ?? await assessInterruptedSession(base);
     if (freshStartAssessment.classification === "running") {
@@ -1081,6 +1143,11 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
         s.stepMode = requestedStepMode;
         s.cmdCtx = ctx;
         s.basePath = base;
+        // Ensure the workflow-logger audit log is pinned to the project root
+        // even when auto-mode is entered via a path that bypasses the
+        // bootstrap/dynamic-tools ensureDbOpen() → setLogBasePath() chain
+        // (e.g. /clear resume, hot-reload).
+        setLogBasePath(base);
         s.unitDispatchCount.clear();
         s.unitLifetimeDispatches.clear();
         if (!getLedger())
@@ -1092,9 +1159,9 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
             const level = to === "red" ? "error" : to === "yellow" ? "warning" : "info";
             ctx.ui.notify(summary, level);
         });
-        // ── Auto-worktree: re-enter worktree on resume ──
+        // ── Auto-worktree / branch-mode: re-enter on resume ──
         if (s.currentMilestoneId &&
-            shouldUseWorktreeIsolation() &&
+            getIsolationMode() !== "none" &&
             s.originalBasePath &&
             !isInAutoWorktree(s.basePath) &&
             !detectWorktreeName(s.basePath) &&
@@ -1159,7 +1226,15 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
         writeLock(lockBase(), "resuming", s.currentMilestoneId ?? "unknown");
         logCmuxEvent(loadEffectiveGSDPreferences()?.preferences, s.stepMode ? "Step-mode resumed." : "Auto-mode resumed.", "progress");
         captureProjectRootEnv(s.originalBasePath || s.basePath);
-        await autoLoop(ctx, pi, s, buildLoopDeps());
+        startAutoCommandPolling(s.basePath);
+        await runAutoLoopWithUok({
+            ctx,
+            pi,
+            s,
+            deps: buildLoopDeps(),
+            runKernelLoop: runUokKernelLoop,
+            runLegacyLoop: runLegacyAutoLoop,
+        });
         cleanupAfterLoopExit(ctx);
         return;
     }
@@ -1182,29 +1257,18 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
         logWarning("engine", `cmux sync failed: ${err instanceof Error ? err.message : String(err)}`, { file: "auto.ts" });
     }
     logCmuxEvent(loadEffectiveGSDPreferences()?.preferences, requestedStepMode ? "Step-mode started." : "Auto-mode started.", "progress");
+    startAutoCommandPolling(s.basePath);
     // Dispatch the first unit
-    await autoLoop(ctx, pi, s, buildLoopDeps());
+    await runAutoLoopWithUok({
+        ctx,
+        pi,
+        s,
+        deps: buildLoopDeps(),
+        runKernelLoop: runUokKernelLoop,
+        runLegacyLoop: runLegacyAutoLoop,
+    });
     cleanupAfterLoopExit(ctx);
 }
-// ─── Agent End Handler ────────────────────────────────────────────────────────
-/**
- * Deprecated thin wrapper — kept as export for backward compatibility.
- * The actual agent_end processing now happens via resolveAgentEnd() in auto-loop.ts,
- * which is called directly from index.ts. The autoLoop() while loop handles all
- * post-unit processing (verification, hooks, dispatch) that this function used to do.
- *
- * If called by straggler code, it simply resolves the pending promise so the loop
- * can continue.
- */
-export async function handleAgentEnd(ctx, pi) {
-    if (!s.active || !s.cmdCtx) {
-        // Even when inactive, resolve any pending promise so the loop is unblocked.
-        resolveAgentEndCancelled();
-        return;
-    }
-    clearUnitTimeout();
-    resolveAgentEnd({ messages: [] });
-}
 // describeNextUnit is imported from auto-dashboard.ts and re-exported
 export { describeNextUnit } from "./auto-dashboard.js";
 /** Thin wrapper: delegates to auto-dashboard.ts, passing state accessors. */

package/dist/resources/extensions/gsd/bootstrap/agent-end-recovery.js

@@ -1,6 +1,6 @@
 import { logWarning } from "../workflow-logger.js";
 import { checkAutoStartAfterDiscuss } from "../guided-flow.js";
-import { getAutoDashboardData, getAutoModeStartModel, isAutoActive, pauseAuto } from "../auto.js";
+import { getAutoDashboardData, getAutoModeStartModel, isAutoActive, pauseAuto, setCurrentDispatchedModelId } from "../auto.js";
 import { getNextFallbackModel, resolveModelWithFallbacksForUnit } from "../preferences.js";
 import { pauseAutoForProviderError } from "../provider-error-pause.js";
 import { isSessionSwitchInFlight, resolveAgentEnd } from "../auto-loop.js";
@@ -106,26 +106,11 @@ export async function handleAgentEnd(pi, event, ctx) {
         const explicitRetryAfterMs = ("retryAfterMs" in lastMsg && typeof lastMsg.retryAfterMs === "number") ? lastMsg.retryAfterMs : undefined;
         // ── 1. Classify using rawErrorMsg to avoid prose false-positives ────
         const cls = classifyError(rawErrorMsg, explicitRetryAfterMs);
-        // ── 1b. Defer to Core RetryHandler for transient errors ─────────────
-        // The Core RetryHandler (agent-session.ts) processes retryable errors
-        // AFTER this extension handler, in the same _processAgentEvent() call.
-        // For transient errors (overloaded, rate limit, server), the Core will
-        // retry in-context — same session, same conversation — which is strictly
-        // better than our Layer 2 pause+resume (which creates a new session).
-        //
-        // If we react here AND the Core also retries, we race: pauseAuto tears
-        // down the session while agent.continue() starts a new turn.
-        //
-        // Solution: Do nothing for transient errors. The Core RetryHandler
-        // runs next in _processAgentEvent and will either:
-        //   a) Retry successfully → new agent_end (success) → we see it next time
-        //   b) Exhaust retries → the agent stays idle, autoLoop's unit timeout
-        //      or stuck detection handles it
-        //
-        // We do NOT call resolveAgentEnd here — that would unblock autoLoop
-        // prematurely while the Core is still retrying in the same session.
-        // We do NOT call pauseAuto — that would tear down the session.
-        if (isTransient(cls)) {
+        // ── 1b. Defer to Core RetryHandler for most transient errors ────────
+        // Core retries transient failures in-session after this handler.
+        // Keep that behavior for non-rate-limit classes to avoid pause/retry races,
+        // but let rate-limit continue into model fallback logic below (#4373).
+        if (isTransient(cls) && cls.kind !== "rate-limit") {
             return;
         }
         // Cap rate-limit backoff for CLI-style providers (openai-codex, google-gemini-cli)
@@ -177,6 +162,7 @@ export async function handleAgentEnd(pi, event, ctx) {
                         if (modelToSet) {
                             const ok = await pi.setModel(modelToSet, { persist: false });
                             if (ok) {
+                                setCurrentDispatchedModelId({ provider: modelToSet.provider, id: modelToSet.id });
                                 ctx.ui.notify(`Model error${errorDetail}. Switched to fallback: ${nextModelId} and resuming.`, "warning");
                                 pi.sendMessage({ customType: "gsd-auto-timeout-recovery", content: "Continue execution.", display: false }, { triggerTurn: true });
                                 return;
@@ -193,6 +179,7 @@ export async function handleAgentEnd(pi, event, ctx) {
                     if (startModel) {
                         const ok = await pi.setModel(startModel, { persist: false });
                         if (ok) {
+                            setCurrentDispatchedModelId({ provider: startModel.provider, id: startModel.id });
                             retryState.networkRetryCount = 0;
                             retryState.currentRetryModelId = undefined;
                             ctx.ui.notify(`Model error${errorDetail}. Restored session model: ${sessionModel.provider}/${sessionModel.id} and resuming.`, "warning");

package/dist/resources/extensions/gsd/bootstrap/db-tools.js

@@ -421,10 +421,14 @@ export function registerDbTools(pi) {
                 depends: Type.Array(Type.String(), { description: "Slice dependency IDs" }),
                 demo: Type.String({ description: "Roadmap demo text / After this" }),
                 goal: Type.String({ description: "Slice goal" }),
-                successCriteria: Type.String({ description: "Slice success criteria block" }),
-                proofLevel: Type.String({ description: "Slice proof level" }),
-                integrationClosure: Type.String({ description: "Slice integration closure" }),
-                observabilityImpact: Type.String({ description: "Slice observability impact" }),
+                // ADR-011: heavy planning fields are optional for sketch slices; required for full slices.
+                successCriteria: Type.Optional(Type.String({ description: "Slice success criteria block (required for full slices; omit for sketches)" })),
+                proofLevel: Type.Optional(Type.String({ description: "Slice proof level (required for full slices; omit for sketches)" })),
+                integrationClosure: Type.Optional(Type.String({ description: "Slice integration closure (required for full slices; omit for sketches)" })),
+                observabilityImpact: Type.Optional(Type.String({ description: "Slice observability impact (required for full slices; omit for sketches)" })),
+                // ADR-011 sketch-then-refine fields.
+                isSketch: Type.Optional(Type.Boolean({ description: "ADR-011: true marks this slice as a sketch awaiting refine-slice expansion" })),
+                sketchScope: Type.Optional(Type.String({ description: "ADR-011: 2–3 sentence scope boundary, required when isSketch=true" })),
             }), { description: "Planned slices for the milestone" }),
             // ── Enrichment metadata (optional — defaults to empty) ────────────
             status: Type.Optional(Type.String({ description: "Milestone status (defaults to active)" })),
@@ -589,6 +593,20 @@ export function registerDbTools(pi) {
             keyFiles: Type.Optional(Type.Array(Type.String(), { description: "List of key files created or modified" })),
             keyDecisions: Type.Optional(Type.Array(Type.String(), { description: "List of key decisions made during this task" })),
             blockerDiscovered: Type.Optional(Type.Boolean({ description: "Whether a plan-invalidating blocker was discovered" })),
+            // ADR-011 Phase 2: mid-execution escalation — agent asks the user to resolve an ambiguity.
+            escalation: Type.Optional(Type.Object({
+                question: Type.String({ description: "The question the user needs to answer — one clear sentence." }),
+                options: Type.Array(Type.Object({
+                    id: Type.String({ description: "Short id (e.g. 'A', 'B') used by /gsd escalate resolve." }),
+                    label: Type.String({ description: "One-line label." }),
+                    tradeoffs: Type.String({ description: "1-2 sentences on the tradeoffs of this option." }),
+                }), { minItems: 2, maxItems: 4, description: "2–4 options the user can choose between." }),
+                recommendation: Type.String({ description: "Option id the executor recommends." }),
+                recommendationRationale: Type.String({ description: "Why the recommendation — 1–2 sentences." }),
+                continueWithDefault: Type.Boolean({
+                    description: "When true, loop continues (artifact logged for later review). When false, auto-mode pauses until the user resolves via /gsd escalate resolve.",
+                }),
+            }, { description: "ADR-011 Phase 2: optional escalation payload. Only honored when phases.mid_execution_escalation is true." })),
             verificationEvidence: Type.Optional(Type.Array(Type.Union([
                 Type.Object({
                     command: Type.String({ description: "Verification command that was run" }),

package/dist/resources/extensions/gsd/bootstrap/provider-error-resume.js

@@ -1,5 +1,6 @@
 import { getAutoDashboardData, startAuto } from "../auto.js";
 import { resetTransientRetryState } from "./agent-end-recovery.js";
+import { resetSessionTimeoutState } from "../auto/phases.js";
 const defaultDeps = {
     getSnapshot: () => getAutoDashboardData(),
     startAuto,
@@ -14,10 +15,11 @@ export async function resumeAutoAfterProviderDelay(pi, ctx, deps = defaultDeps)
         ctx.ui.notify("Provider error recovery delay elapsed, but no paused auto-mode base path was available. Leaving auto-mode paused.", "warning");
         return "missing-base";
     }
-    // Reset the transient retry counter before restarting — without this,
-    // consecutiveTransientCount accumulates across pause/resume cycles and
-    // permanently locks out auto-resume after MAX_TRANSIENT_AUTO_RESUMES errors.
+    // Reset retry counters before restarting — without this, counters
+    // accumulate across pause/resume cycles and permanently lock out
+    // auto-resume after their respective MAX thresholds.
     resetTransientRetryState();
+    resetSessionTimeoutState();
     await deps.startAuto(ctx, pi, snapshot.basePath, false, { step: snapshot.stepMode });
     return "resumed";
 }