gsd-pi 2.76.0 → 2.77.0-dev.1d17f366c

package/src/resources/extensions/claude-code-cli/tests/stream-adapter.test.ts

@@ -8,6 +8,7 @@ import {
 	getResultErrorMessage,
 	makeAbortedMessage,
 	mergePendingToolCalls,
+	buildFinalAssistantContent,
 	resolveClaudePermissionMode,
 	buildPromptFromContext,
 	buildSdkQueryPrompt,
@@ -372,13 +373,146 @@ describe("stream-adapter — Claude Code external tool results", () => {
 				toolUseId: "tool-bash-1",
 				result: {
 					content: [{ type: "text", text: "line 1\nline 2" }],
-					details: {},
+					// extractStructuredDetailsFromBlock returns undefined when no
+					// structured payload exists, restoring the pre-#4477 nullable
+					// contract (#4477 review feedback).
+					details: undefined,
 					isError: false,
 				},
 			},
 		]);
 	});
 
+	test("extractToolResultsFromSdkUserMessage reads structuredContent as a sibling field (#4472)", () => {
+		const message: SDKUserMessage = {
+			type: "user",
+			session_id: "sess-1",
+			parent_tool_use_id: "tool-mcp-1",
+			message: {
+				role: "user",
+				content: [
+					{
+						type: "mcp_tool_result",
+						tool_use_id: "tool-mcp-1",
+						content: [{ type: "text", text: "Gate Q3 result saved: verdict=pass" }],
+						is_error: false,
+						structuredContent: { gateId: "Q3", verdict: "pass" },
+					} as unknown as Record<string, unknown>,
+				],
+			},
+		};
+
+		const results = extractToolResultsFromSdkUserMessage(message);
+		assert.deepEqual(results[0].result.details, { gateId: "Q3", verdict: "pass" });
+	});
+
+	test("extractToolResultsFromSdkUserMessage reads structuredContent from a content sub-block (#4472)", () => {
+		const message: SDKUserMessage = {
+			type: "user",
+			session_id: "sess-1",
+			parent_tool_use_id: "tool-mcp-2",
+			message: {
+				role: "user",
+				content: [
+					{
+						type: "mcp_tool_result",
+						tool_use_id: "tool-mcp-2",
+						content: [
+							{ type: "text", text: "Gate Q4 result saved: verdict=flag" },
+							{ type: "structuredContent", structuredContent: { gateId: "Q4", verdict: "flag" } },
+						],
+						is_error: false,
+					} as unknown as Record<string, unknown>,
+				],
+			},
+		};
+
+		const results = extractToolResultsFromSdkUserMessage(message);
+		assert.deepEqual(results[0].result.details, { gateId: "Q4", verdict: "flag" });
+	});
+
+	test("#4477 extractToolResultsFromSdkUserMessage does NOT leak structuredContent pseudo-blocks into visible content", () => {
+		// Regression: when a content sub-block carries `type: "structuredContent"`,
+		// it carries the structured payload (extracted separately into `details`)
+		// and must NOT appear in the visible `content` array — otherwise the
+		// renderer stringifies the JSON pseudo-block and shows it next to the
+		// actual tool output. See PR #4477 review (CodeRabbit, post-fix-round).
+		const message: SDKUserMessage = {
+			type: "user",
+			session_id: "sess-1",
+			parent_tool_use_id: "tool-mcp-strip",
+			message: {
+				role: "user",
+				content: [
+					{
+						type: "mcp_tool_result",
+						tool_use_id: "tool-mcp-strip",
+						content: [
+							{ type: "text", text: "Gate Q5 result saved: verdict=pass" },
+							{ type: "structuredContent", structuredContent: { gateId: "Q5", verdict: "pass" } },
+							{ type: "text", text: "second visible line" },
+							// snake_case variant — also a pseudo-block; also must be stripped
+							{ type: "structured_content", structured_content: { extra: "data" } },
+						],
+						is_error: false,
+					} as unknown as Record<string, unknown>,
+				],
+			},
+		};
+
+		const results = extractToolResultsFromSdkUserMessage(message);
+		assert.equal(results.length, 1, "should extract one result");
+		const result = results[0].result;
+
+		// The structured payload IS extracted to `details`.
+		assert.deepEqual(result.details, { gateId: "Q5", verdict: "pass" });
+
+		// The visible content has the two text blocks but NEITHER pseudo-block.
+		const visibleTexts = result.content.map((c: any) => c.text);
+		assert.deepEqual(
+			visibleTexts,
+			["Gate Q5 result saved: verdict=pass", "second visible line"],
+			"visible content must include only the two text blocks; both structuredContent variants must be stripped",
+		);
+
+		// Belt-and-suspenders: assert no rendered text shows the JSON serialization
+		// of a pseudo-block. We don't check for bare keys like "gateId" or "verdict"
+		// because those are legitimate words in the gate-result message text. The
+		// regression signature would be a JSON-shaped substring that could only
+		// appear via stringification.
+		const allText = visibleTexts.join("\n");
+		assert.ok(
+			!allText.includes('"structuredContent"'),
+			"rendered content must not include the pseudo-block type marker as JSON text",
+		);
+		assert.ok(
+			!allText.includes('"structured_content"'),
+			"rendered content must not include the snake_case pseudo-block type marker as JSON text",
+		);
+	});
+
+	test("extractToolResultsFromSdkUserMessage accepts snake_case structured_content defensively (#4472)", () => {
+		const message: SDKUserMessage = {
+			type: "user",
+			session_id: "sess-1",
+			parent_tool_use_id: "tool-mcp-3",
+			message: {
+				role: "user",
+				content: [
+					{
+						type: "mcp_tool_result",
+						tool_use_id: "tool-mcp-3",
+						content: [{ type: "text", text: "ok" }],
+						structured_content: { operation: "save_gate_result" },
+					} as unknown as Record<string, unknown>,
+				],
+			},
+		};
+
+		const results = extractToolResultsFromSdkUserMessage(message);
+		assert.deepEqual(results[0].result.details, { operation: "save_gate_result" });
+	});
+
 	test("extractToolResultsFromSdkUserMessage falls back to tool_use_result", () => {
 		const message: SDKUserMessage = {
 			type: "user",
@@ -398,12 +532,79 @@ describe("stream-adapter — Claude Code external tool results", () => {
 				toolUseId: "tool-read-1",
 				result: {
 					content: [{ type: "text", text: "file contents" }],
-					details: {},
+					// undefined (not {}) per the restored nullable contract — see
+					// the analogous assertion in the tool_result test above.
+					details: undefined,
 					isError: true,
 				},
 			},
 		]);
 	});
+
+	test("buildFinalAssistantContent preserves intermediate tool calls with attached external results", () => {
+		const finalContent = buildFinalAssistantContent({
+			intermediateToolBlocks: [
+				{
+					type: "toolCall",
+					id: "tool-bash-1",
+					name: "bash",
+					arguments: { command: "echo hi" },
+				} as any,
+			],
+			pendingContent: [{ type: "text", text: "All done." }],
+			toolResultsById: new Map([
+				[
+					"tool-bash-1",
+					{
+						content: [{ type: "text", text: "hi\n" }],
+						details: { source: "claude-code" },
+						isError: false,
+					},
+				],
+			]),
+		});
+
+		assert.equal(finalContent[0]?.type, "toolCall");
+		assert.deepEqual((finalContent[0] as any).externalResult, {
+			content: [{ type: "text", text: "hi\n" }],
+			details: { source: "claude-code" },
+			isError: false,
+		});
+		assert.deepEqual(finalContent[1], { type: "text", text: "All done." });
+	});
+
+	test("buildFinalAssistantContent keeps final-turn tool calls when result arrives without a synthetic user boundary", () => {
+		const finalContent = buildFinalAssistantContent({
+			intermediateToolBlocks: [],
+			pendingContent: [
+				{
+					type: "toolCall",
+					id: "tool-read-1",
+					name: "read",
+					arguments: { path: "README.md" },
+				} as any,
+				{ type: "text", text: "Read complete." },
+			],
+			toolResultsById: new Map([
+				[
+					"tool-read-1",
+					{
+						content: [{ type: "text", text: "file contents" }],
+						details: { path: "README.md" },
+						isError: false,
+					},
+				],
+			]),
+		});
+
+		assert.equal(finalContent[0]?.type, "toolCall");
+		assert.deepEqual((finalContent[0] as any).externalResult, {
+			content: [{ type: "text", text: "file contents" }],
+			details: { path: "README.md" },
+			isError: false,
+		});
+		assert.deepEqual(finalContent[1], { type: "text", text: "Read complete." });
+	});
 });
 
 describe("stream-adapter — session persistence (#2859)", () => {
@@ -560,15 +761,18 @@ describe("stream-adapter — session persistence (#2859)", () => {
 			assert.equal(srv.env.GSD_CLI_PATH, "/tmp/gsd");
 			assert.equal(srv.env.GSD_PERSIST_WRITE_GATE_STATE, "1");
 			assert.equal(srv.env.GSD_WORKFLOW_PROJECT_ROOT, "/tmp/project");
-			assert.deepEqual(options.disallowedTools, ["AskUserQuestion"]);
+			assert.deepEqual(options.disallowedTools, []);
 			assert.deepEqual(options.allowedTools, [
 				"Read",
 				"Write",
 				"Edit",
 				"Glob",
 				"Grep",
-				"Bash(ls:*)",
-				"Bash(pwd)",
+				"Bash",
+				"Agent",
+				"WebFetch",
+				"WebSearch",
+				"AskUserQuestion",
 				"mcp__gsd-workflow__*",
 			]);
 		} finally {
@@ -580,7 +784,7 @@ describe("stream-adapter — session persistence (#2859)", () => {
 		}
 	});
 
-	test("buildSdkOptions disables AskUserQuestion for custom workflow MCP server names", () => {
+	test("buildSdkOptions auto-approves every tool for custom workflow MCP server names", () => {
 		const prev = {
 			GSD_WORKFLOW_MCP_COMMAND: process.env.GSD_WORKFLOW_MCP_COMMAND,
 			GSD_WORKFLOW_MCP_NAME: process.env.GSD_WORKFLOW_MCP_NAME,
@@ -598,15 +802,18 @@ describe("stream-adapter — session persistence (#2859)", () => {
 			const options = buildSdkOptions("claude-sonnet-4-20250514", "test");
 			const mcpServers = options.mcpServers as Record<string, any>;
 			assert.ok(mcpServers?.["custom-workflow"], "expected custom workflow server config");
-			assert.deepEqual(options.disallowedTools, ["AskUserQuestion"]);
+			assert.deepEqual(options.disallowedTools, []);
 			assert.deepEqual(options.allowedTools, [
 				"Read",
 				"Write",
 				"Edit",
 				"Glob",
 				"Grep",
-				"Bash(ls:*)",
-				"Bash(pwd)",
+				"Bash",
+				"Agent",
+				"WebFetch",
+				"WebSearch",
+				"AskUserQuestion",
 				"mcp__custom-workflow__*",
 			]);
 		} finally {
@@ -644,9 +851,9 @@ describe("stream-adapter — session persistence (#2859)", () => {
 			const mcpServers = (options as any).mcpServers;
 			if (mcpServers) {
 				assert.ok(mcpServers["gsd-workflow"], "if present, must be gsd-workflow");
-				assert.deepEqual((options as any).disallowedTools, ["AskUserQuestion"]);
+				assert.deepEqual((options as any).disallowedTools, []);
 			} else {
-				assert.deepEqual((options as any).disallowedTools, ["AskUserQuestion"]);
+				assert.deepEqual((options as any).disallowedTools, []);
 			}
 			rmSync(emptyDir, { recursive: true, force: true });
 		} finally {
@@ -693,7 +900,7 @@ describe("stream-adapter — session persistence (#2859)", () => {
 			assert.equal(srv.env.GSD_CLI_PATH, "/tmp/gsd");
 			assert.equal(srv.env.GSD_PERSIST_WRITE_GATE_STATE, "1");
 			assert.equal(srv.env.GSD_WORKFLOW_PROJECT_ROOT, resolvedRepoDir);
-			assert.deepEqual(options.disallowedTools, ["AskUserQuestion"]);
+			assert.deepEqual(options.disallowedTools, []);
 		} finally {
 			process.chdir(originalCwd);
 			rmSync(repoDir, { recursive: true, force: true });
@@ -1081,11 +1288,15 @@ describe("stream-adapter — permission mode (F10)", () => {
 		}
 	}
 
-	test("buildSdkOptions defaults to bypassPermissions for backwards compatibility", () => {
+	test("buildSdkOptions defaults to bypassPermissions (globally unblocks all tools)", () => {
 		clearWorkflowMcpEnv();
 		const opts = buildSdkOptions("claude-sonnet-4-6", "test");
 		assert.equal(opts.permissionMode, "bypassPermissions");
-		assert.equal(opts.allowDangerouslySkipPermissions, true);
+		assert.equal(
+			opts.allowDangerouslySkipPermissions,
+			true,
+			"allowDangerouslySkipPermissions must be true when permissionMode is bypassPermissions",
+		);
 	});
 
 	test("buildSdkOptions respects explicit acceptEdits override", () => {
@@ -1099,6 +1310,11 @@ describe("stream-adapter — permission mode (F10)", () => {
 		);
 	});
 
+	test("resolveClaudePermissionMode defaults to bypassPermissions when no env var is set (globally unblocks all tools)", async () => {
+		const mode = await resolveClaudePermissionMode({});
+		assert.equal(mode, "bypassPermissions");
+	});
+
 	test("resolveClaudePermissionMode honours the GSD_CLAUDE_CODE_PERMISSION_MODE env override", async () => {
 		const env = { GSD_CLAUDE_CODE_PERMISSION_MODE: "acceptEdits" } as NodeJS.ProcessEnv;
 		const mode = await resolveClaudePermissionMode(env);
@@ -1114,6 +1330,27 @@ describe("stream-adapter — permission mode (F10)", () => {
 			`expected bypass or acceptEdits, got ${mode}`,
 		);
 	});
+
+	test("resolveClaudePermissionMode flips to bypassPermissions when GSD_HEADLESS=1 (#4657)", async () => {
+		const originalWarn = console.warn;
+		console.warn = () => {};
+		try {
+			const env = { GSD_HEADLESS: "1" } as NodeJS.ProcessEnv;
+			const mode = await resolveClaudePermissionMode(env);
+			assert.equal(mode, "bypassPermissions");
+		} finally {
+			console.warn = originalWarn;
+		}
+	});
+
+	test("resolveClaudePermissionMode: explicit override wins over GSD_HEADLESS=1", async () => {
+		const env = {
+			GSD_HEADLESS: "1",
+			GSD_CLAUDE_CODE_PERMISSION_MODE: "acceptEdits",
+		} as NodeJS.ProcessEnv;
+		const mode = await resolveClaudePermissionMode(env);
+		assert.equal(mode, "acceptEdits");
+	});
 });
 
 describe("stream-adapter — Windows Claude path lookup (#3770)", () => {

package/src/resources/extensions/cmux/index.ts

@@ -2,8 +2,12 @@ import { execFileSync, spawn } from "node:child_process";
 import { existsSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import type { GSDPreferences } from "../gsd/preferences.js";
-import type { GSDState, Phase } from "../gsd/types.js";
+import { CMUX_CHANNELS, type CmuxSidebarEvent, type CmuxLogEvent, type CmuxPreferencesInput, type CmuxStateInput } from "../shared/cmux-events.js";
+import type { EventBus } from "@gsd/pi-coding-agent";
+
+type CmuxPreferences = CmuxPreferencesInput;
+type CmuxState = CmuxStateInput;
+type Phase = string;
 const DEFAULT_SOCKET_PATH = "/tmp/cmux.sock";
 const STATUS_KEY = "gsd";
 const lastSidebarSnapshots = new Map<string, string>();
@@ -52,7 +56,7 @@ export function detectCmuxEnvironment(
 }
 
 export function resolveCmuxConfig(
-  preferences: GSDPreferences | undefined,
+  preferences: CmuxPreferences | undefined,
   env: NodeJS.ProcessEnv = process.env,
   socketExists: (path: string) => boolean = existsSync,
   cliAvailable: () => boolean = isCmuxCliAvailable,
@@ -71,7 +75,7 @@ export function resolveCmuxConfig(
 }
 
 export function shouldPromptToEnableCmux(
-  preferences: GSDPreferences | undefined,
+  preferences: CmuxPreferences | undefined,
   env: NodeJS.ProcessEnv = process.env,
   socketExists: (path: string) => boolean = existsSync,
   cliAvailable: () => boolean = isCmuxCliAvailable,
@@ -113,7 +117,7 @@ export function emitOsc777Notification(title: string, body: string): void {
   process.stdout.write(`\x1b]777;notify;${safeTitle};${safeBody}\x07`);
 }
 
-export function buildCmuxStatusLabel(state: GSDState): string {
+export function buildCmuxStatusLabel(state: CmuxState): string {
   const parts: string[] = [];
   if (state.activeMilestone) parts.push(state.activeMilestone.id);
   if (state.activeSlice) parts.push(state.activeSlice.id);
@@ -125,7 +129,7 @@ export function buildCmuxStatusLabel(state: GSDState): string {
   return `${parts.join(" ")} · ${state.phase}`;
 }
 
-export function buildCmuxProgress(state: GSDState): CmuxSidebarProgress | null {
+export function buildCmuxProgress(state: CmuxState): CmuxSidebarProgress | null {
   const progress = state.progress;
   if (!progress) return null;
 
@@ -171,7 +175,7 @@ export class CmuxClient {
     this.config = config;
   }
 
-  static fromPreferences(preferences: GSDPreferences | undefined): CmuxClient {
+  static fromPreferences(preferences: CmuxPreferences | undefined): CmuxClient {
     return new CmuxClient(resolveCmuxConfig(preferences));
   }
 
@@ -372,7 +376,7 @@ export class CmuxClient {
   }
 }
 
-export function syncCmuxSidebar(preferences: GSDPreferences | undefined, state: GSDState): void {
+export function syncCmuxSidebar(preferences: CmuxPreferences | undefined, state: CmuxState): void {
   const client = CmuxClient.fromPreferences(preferences);
   const config = client.getConfig();
   if (!config.sidebar) return;
@@ -388,7 +392,7 @@ export function syncCmuxSidebar(preferences: GSDPreferences | undefined, state:
   lastSidebarSnapshots.set(key, snapshot);
 }
 
-export function clearCmuxSidebar(preferences: GSDPreferences | undefined): void {
+export function clearCmuxSidebar(preferences: CmuxPreferences | undefined): void {
   const config = resolveCmuxConfig(preferences);
   if (!config.available || !config.cliAvailable) return;
   const client = new CmuxClient({ ...config, enabled: true, sidebar: true });
@@ -399,7 +403,7 @@ export function clearCmuxSidebar(preferences: GSDPreferences | undefined): void
 }
 
 export function logCmuxEvent(
-  preferences: GSDPreferences | undefined,
+  preferences: CmuxPreferences | undefined,
   message: string,
   level: CmuxLogLevel = "info",
 ): void {
@@ -446,3 +450,24 @@ function extractSurfaceIds(value: unknown): string[] {
   visit(value);
   return Array.from(found);
 }
+
+/**
+ * Wire event subscriptions so cmux reacts to gsd events.
+ * Called by the gsd extension during registration, passing pi.events.
+ */
+export function initCmuxEventListeners(events: EventBus): void {
+  events.on(CMUX_CHANNELS.SIDEBAR, (data) => {
+    const event = data as CmuxSidebarEvent;
+    if (event.action === "sync" && event.state) {
+      syncCmuxSidebar(event.preferences as CmuxPreferences | undefined, event.state as CmuxState);
+    }
+    if (event.action === "clear") {
+      clearCmuxSidebar(event.preferences as CmuxPreferences | undefined);
+    }
+  });
+
+  events.on(CMUX_CHANNELS.LOG, (data) => {
+    const event = data as CmuxLogEvent;
+    logCmuxEvent(event.preferences as CmuxPreferences | undefined, event.message, event.level);
+  });
+}

package/src/resources/extensions/github-sync/templates.ts

@@ -181,3 +181,154 @@ export function formatSummaryComment(data: SummaryData): string {
 
   return lines.join("\n");
 }
+
+// ─── Swarm Delivery Routines ───────────────────────────────────────────────
+
+export type SwarmLaneId = "workflow" | "state" | "writer" | "uok" | "github";
+
+export interface SwarmLaneData {
+  id: SwarmLaneId;
+  branch: string;
+  owner?: string;
+  latestCommit?: string;
+  summary?: string;
+  changedContracts?: string[];
+  testEvidence?: string[];
+  blockers?: string[];
+}
+
+export interface SwarmLanePRData {
+  lane: SwarmLaneData;
+  impactArea: string;
+  transitionRisks: string[];
+  rollbackPlan: string[];
+  linkedIssue?: number;
+}
+
+export interface SwarmReleaseChecklistData {
+  integrationBranch: string;
+  lanes: SwarmLaneData[];
+  parityReport?: string;
+  rollbackDrill?: string;
+  requiredChecks?: string[];
+  openRisks?: string[];
+}
+
+export const SWARM_LANE_LABELS: Record<SwarmLaneId, string> = {
+  workflow: "lane/workflow",
+  state: "lane/state",
+  writer: "lane/writer",
+  uok: "lane/uok",
+  github: "lane/github",
+};
+
+function checkedList(items: string[] | undefined, emptyLabel: string): string[] {
+  if (!items?.length) return [`- [ ] ${emptyLabel}`];
+  return items.map((item) => `- [ ] ${item}`);
+}
+
+export function formatSwarmLanePRBody(data: SwarmLanePRData): string {
+  const lines: string[] = [];
+  const laneLabel = SWARM_LANE_LABELS[data.lane.id];
+
+  lines.push("## Swarm lane");
+  lines.push("");
+  lines.push(`**Lane:** \`${laneLabel}\``);
+  lines.push(`**Branch:** \`${data.lane.branch}\``);
+  if (data.lane.owner) lines.push(`**Owner:** ${data.lane.owner}`);
+  if (data.lane.latestCommit) lines.push(`**Latest commit:** \`${data.lane.latestCommit}\``);
+  lines.push("");
+
+  lines.push("## Impact area");
+  lines.push("");
+  lines.push(data.impactArea);
+  lines.push("");
+
+  lines.push("## Changed contracts");
+  lines.push(...checkedList(data.lane.changedContracts, "No shared contracts changed"));
+  lines.push("");
+
+  lines.push("## Transition risks");
+  lines.push(...checkedList(data.transitionRisks, "No transition risks identified"));
+  lines.push("");
+
+  lines.push("## Rollback plan");
+  lines.push(...checkedList(data.rollbackPlan, "Revert this lane PR"));
+  lines.push("");
+
+  lines.push("## Test evidence");
+  lines.push(...checkedList(data.lane.testEvidence, "Test evidence pending"));
+  lines.push("");
+
+  if (data.lane.blockers?.length) {
+    lines.push("## Blockers");
+    for (const blocker of data.lane.blockers) lines.push(`- ${blocker}`);
+    lines.push("");
+  }
+
+  if (data.linkedIssue) {
+    lines.push(`Closes #${data.linkedIssue}`);
+    lines.push("");
+  }
+
+  lines.push("---");
+  lines.push("*Auto-generated by GSD GitHub Sync swarm routines*");
+
+  return lines.join("\n");
+}
+
+export function formatSwarmReleaseChecklistBody(data: SwarmReleaseChecklistData): string {
+  const lines: string[] = [];
+
+  lines.push(`# UOK Swarm Release Checklist`);
+  lines.push("");
+  lines.push(`**Integration branch:** \`${data.integrationBranch}\``);
+  lines.push("");
+
+  lines.push("## Lane summary");
+  lines.push("");
+  lines.push("| Lane | Branch | Owner | Commit | Status |");
+  lines.push("|------|--------|-------|--------|--------|");
+  for (const lane of data.lanes) {
+    const owner = lane.owner ?? "";
+    const commit = lane.latestCommit ? `\`${lane.latestCommit}\`` : "";
+    const status = lane.blockers?.length ? "blocked" : "ready";
+    lines.push(`| \`${SWARM_LANE_LABELS[lane.id]}\` | \`${lane.branch}\` | ${owner} | ${commit} | ${status} |`);
+  }
+  lines.push("");
+
+  lines.push("## Required evidence");
+  lines.push("- [ ] Changed contracts summarized");
+  lines.push("- [ ] Transition matrix diff attached or linked");
+  lines.push("- [ ] Writer sequence proof attached or linked");
+  lines.push("- [ ] UOK parity report attached or linked");
+  lines.push("- [ ] Rollback drill evidence attached or linked");
+  lines.push("");
+
+  if (data.requiredChecks?.length) {
+    lines.push("## Required checks");
+    for (const check of data.requiredChecks) lines.push(`- [ ] ${check}`);
+    lines.push("");
+  }
+
+  lines.push("## Parity report");
+  lines.push(data.parityReport ?? "Pending.");
+  lines.push("");
+
+  lines.push("## Rollback drill");
+  lines.push(data.rollbackDrill ?? "Pending.");
+  lines.push("");
+
+  lines.push("## Open risks");
+  if (data.openRisks?.length) {
+    for (const risk of data.openRisks) lines.push(`- ${risk}`);
+  } else {
+    lines.push("None.");
+  }
+  lines.push("");
+
+  lines.push("---");
+  lines.push("*Auto-generated by GSD GitHub Sync swarm routines*");
+
+  return lines.join("\n");
+}