gsd-pi 2.77.0-dev.58d3d4d6c → 2.77.0-dev.cfd69e714

package/src/resources/extensions/gsd/native-git-bridge.ts

@@ -894,11 +894,37 @@ export function nativeResetPaths(basePath: string, paths: string[]): void {
   }
 }
 
+/**
+ * Read `commit.gpgsign` from the repo config. Returns true only if the value
+ * is the literal string "true". Any other state (unset, false, error) → false.
+ *
+ * Used by nativeCommit to route signing-required commits through the git CLI,
+ * because the libgit2 native path does not invoke configured signers.
+ * (Issue #4980 CRIT-2)
+ */
+function shouldSignCommits(basePath: string): boolean {
+  try {
+    const result = execFileSync("git", ["config", "--get", "commit.gpgsign"], {
+      cwd: basePath,
+      stdio: ["ignore", "pipe", "pipe"],
+      encoding: "utf-8",
+      env: GIT_NO_PROMPT_ENV,
+    }).trim();
+    return result === "true";
+  } catch {
+    return false;
+  }
+}
+
 /**
  * Create a commit from the current index.
  * Returns the commit SHA on success, or null if nothing to commit.
  * Native: libgit2 commit create.
- * Fallback: `git commit --no-verify -F -`.
+ * Fallback: `git commit -F -` (runs hooks; honors commit.gpgsign).
+ *
+ * The fallback intentionally does NOT use --no-verify — user pre-commit /
+ * commit-msg / prepare-commit-msg hooks must fire on every GSD-automated
+ * commit. (Issue #4980 CRIT-1)
  */
 export function nativeCommit(
   basePath: string,
@@ -906,7 +932,10 @@ export function nativeCommit(
   options?: { allowEmpty?: boolean; input?: string },
 ): string | null {
   const native = loadNative();
-  if (native) {
+  // libgit2's commit-create does not invoke configured GPG/SSH signers. When
+  // commit.gpgsign=true, route through the git CLI fallback so signing
+  // happens. (Issue #4980 CRIT-2)
+  if (native && !shouldSignCommits(basePath)) {
     try {
       return native.gitCommit(basePath, message, options?.allowEmpty);
     } catch (e) {
@@ -916,9 +945,10 @@ export function nativeCommit(
     }
   }
 
-  // Fallback: use git commit with stdin pipe for safe multi-line messages
+  // Fallback / signed-commit path: use git CLI with stdin pipe for safe
+  // multi-line messages. Hooks run; commit.gpgsign honored.
   try {
-    const args = ["commit", "--no-verify", "-F", "-"];
+    const args = ["commit", "-F", "-"];
     if (options?.allowEmpty) args.push("--allow-empty");
     const result = execFileSync("git", args, {
       cwd: basePath,

package/src/resources/extensions/gsd/prompts/complete-milestone.md

@@ -10,14 +10,18 @@ Your working directory is `{{workingDirectory}}`. All file reads, writes, and sh
 
 All slices are done. You are closing out the milestone — verifying that the assembled work actually delivers the promised outcome, writing the milestone summary, and updating project state. The milestone summary is the final record. After you finish, the system merges the worktree back to the integration branch. If there are queued milestones, the next one starts its own research → plan → execute cycle from a clean slate — the milestone summary is how it learns what was already built.
 
-All relevant context has been preloaded below — the roadmap, all slice summaries, requirements, decisions, and project context are inlined. Start working immediately without re-reading these files.
+Preloaded context below — the roadmap, compact slice-summary excerpts, requirements, decisions, and project context. **Slice summaries are excerpts, not full files.** They include frontmatter fields, section heads (deviations, known limitations, follow-ups), and short narrative only. When drafting LEARNINGS, the Decision Re-evaluation table, or cross-slice narrative, Read the full slice SUMMARY.md files listed under "On-demand Slice Summaries" — do that selectively as needed, not preemptively.
+
+Start with what the excerpts give you. Read full files when the section heads signal richer context you need.
+
+**On-demand Read ordering:** Complete all slice SUMMARY Reads you need for cross-slice synthesis, the Decision Re-evaluation table, and LEARNINGS **before** calling `gsd_complete_milestone` (step 10). Once that tool runs, the milestone is marked complete in the DB — running out of tool budget between step 10 and the LEARNINGS write (step 12) leaves the milestone committed without its LEARNINGS artifact.
 
 {{inlinedContext}}
 
 Then:
 1. Use the **Milestone Summary** output template from the inlined context above
 2. {{skillActivation}}
-3. **Verify code changes exist.** Run `git diff --stat HEAD $(git merge-base HEAD main) -- ':!.gsd/'` (or the equivalent for the integration branch). If no non-`.gsd/` files appear in the diff, the milestone produced only planning artifacts and no actual code. Record this as a **verification failure**.
+3. **Verify code changes exist.** Compare the milestone against its integration branch (usually `main`, `master`, or the recorded integration branch), using the merge-base as the older revision and `HEAD` as the newer revision. If that branch diff lists non-`.gsd/` files, code-change verification passes. If `HEAD` is already the same commit as the integration branch/merge-base (a retry-on-main self-diff), do **not** treat the empty branch diff as proof of missing code. Instead, inspect milestone-scoped commit evidence such as recent commits with `GSD-Unit: {{milestoneId}}` or production `GSD-Task: Sxx/Tyy` trailers whose diff also touches `.gsd/milestones/{{milestoneId}}/`, then check those commits for non-`.gsd/` files. Only record a **verification failure** when neither the branch diff nor milestone-scoped commit evidence shows implementation files.
 4. Verify each **success criterion** from the milestone definition in `{{roadmapPath}}`. For each criterion, confirm it was met with specific evidence from slice summaries, test results, or observable behavior. Record any criterion that was NOT met as a **verification failure**.
 5. Verify the milestone's **definition of done** — all slices are `[x]`, all slice summaries exist, and any cross-slice integration points work correctly. Record any unmet items as a **verification failure**.
 6. If the roadmap includes a **Horizontal Checklist**, verify each item was addressed during the milestone. Note unchecked items in the milestone summary.

package/src/resources/extensions/gsd/prompts/plan-slice.md

@@ -20,9 +20,22 @@ Pay particular attention to **Forward Intelligence** sections — they contain h
 
 You have full tool access. Before decomposing, explore the relevant code to ground your plan in reality.
 
-### Verify Roadmap Assumptions
+### Verify Roadmap Assumptions (JIT Reassessment — ADR-003 §4)
 
-Check prior slice summaries (inlined above as dependency summaries, if present). If prior slices discovered constraints, changed approaches, or flagged fragility, adjust your plan accordingly. The roadmap description may be stale — verify it against the current codebase state.
+Before planning this slice, verify that the roadmap's assumptions still hold given prior slice summaries. Check inlined dependency summaries (below) for discovered constraints, changed approaches, or flagged fragility.
+
+**If the remaining roadmap needs adjustment, modify it before proceeding:**
+
+- If a downstream slice's title/demo/dependencies are now wrong, call `gsd_reassess_roadmap` with the corrected `sliceChanges.modified` entry.
+- If new work surfaced that deserves its own slice, add it via `sliceChanges.added`.
+- If a downstream slice is now redundant or out of scope, remove it via `sliceChanges.removed`.
+- **Bias strongly toward "roadmap is fine."** Most slice completions produce no structural change. Only adjust when there is concrete evidence a downstream slice is wrong — not speculative concern. Over-reassessment is costlier than a later mid-slice replan.
+
+Completed slices are immutable: never modify or remove a slice whose status is complete.
+
+Then proceed with planning this slice against the (possibly updated) roadmap.
+
+The roadmap description may be stale — verify it against the current codebase state.
 
 ### Explore Slice Scope
 

package/src/resources/extensions/gsd/safety/git-checkpoint.ts

@@ -72,6 +72,21 @@ export function rollbackToCheckpoint(
       return false;
     }
 
+    // Preserve any staged or untracked user work before the hard reset.
+    // The user may have a partial fix staged that they wanted to inspect;
+    // reset --hard wipes both staged and unstaged changes (reflog only
+    // covers committed state). Push a labeled stash first so recovery
+    // is possible. (Issue #4980 HIGH-4)
+    try {
+      execFileSync(
+        "git",
+        ["stash", "push", "--include-untracked", "-m", `gsd: pre-rollback-stash ${unitId} ${new Date().toISOString()}`],
+        { cwd: basePath, stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8" },
+      );
+    } catch {
+      /* nothing to stash, or stash refused — proceed with reset */
+    }
+
     // Reset branch pointer and working tree to checkpoint SHA in one step.
     // Using `git reset --hard <sha>` works on the currently checked-out branch
     // (unlike `git branch -f` which is rejected for checked-out branches).

package/src/resources/extensions/gsd/service-tier.ts

@@ -2,8 +2,8 @@
  * Service Tier — gating, status formatting, icon resolution, and
  * the /gsd fast command handler.
  *
- * Service tiers (priority/flex) are an OpenAI feature that only applies
- * to gpt-5.4 variants. This module centralizes the model-gating logic
+ * Service tiers (priority/flex) are an OpenAI feature that currently only
+ * applies to gpt-5.4 variants in GSD. This module centralizes the model-gating logic
  * so that icons, preferences, and the before_provider_request hook all
  * use a single source of truth.
  */
@@ -35,6 +35,9 @@ const SERVICE_TIER_SCOPE_NOTE = "Only affects gpt-5.4 models, regardless of prov
  * (set via CAPABILITY_PATCHES in packages/pi-ai/src/models.ts). When callers
  * have access to the full Model object, prefer reading capabilities directly.
  *
+ * GPT-5.5 is intentionally excluded until we verify its provider payload
+ * contract instead of assuming `service_tier` support.
+ *
  * See: https://github.com/gsd-build/gsd-2/issues/2546
  */
 const SERVICE_TIER_MODEL_PREFIXES = ["gpt-5.4"] as const;

package/src/resources/extensions/gsd/session-lock.ts

@@ -188,13 +188,14 @@ function ensureExitHandler(_gsdDir: string): void {
     // Lock files accumulate across main project .gsd/, worktree .gsd/,
     // and projects registry paths — cleanup must cover all of them.
     for (const dir of _lockDirRegistry) {
+      const lockFile = join(dir, LOCK_FILE);
+      const ownsRegisteredLock = isLockFileOwnedByCurrentProcess(lockFile);
       try {
-        const lockFile = join(dir, LOCK_FILE);
-        if (existsSync(lockFile)) unlinkSync(lockFile);
+        if (ownsRegisteredLock && existsSync(lockFile)) unlinkSync(lockFile);
       } catch { /* best-effort */ }
       try {
         const lockDir = join(dir + ".lock");
-        if (existsSync(lockDir)) rmSync(lockDir, { recursive: true, force: true });
+        if (ownsRegisteredLock && existsSync(lockDir)) rmSync(lockDir, { recursive: true, force: true });
       } catch { /* best-effort */ }
     }
   });
@@ -526,10 +527,13 @@ export function releaseSessionLock(basePath: string): void {
     _releaseFunction = null;
   }
 
-  // Remove the lock file at the current path
+  // Remove the lock file at the current path only if it still belongs to us.
+  // Lost-lock cleanup can run after another process has taken ownership; in
+  // that case deleting auto.lock would erase the newer owner's evidence.
   const lp = lockPath(basePath);
+  const ownsPrimaryLock = isLockFileOwnedByCurrentProcess(lp);
   try {
-    if (existsSync(lp)) unlinkSync(lp);
+    if (ownsPrimaryLock && existsSync(lp)) unlinkSync(lp);
   } catch {
     // Non-fatal
   }
@@ -540,12 +544,12 @@ export function releaseSessionLock(basePath: string): void {
   const lockTarget = effectiveLockTarget(gsdDir);
   try {
     const lockDir = join(lockTarget + ".lock");
-    if (existsSync(lockDir)) rmSync(lockDir, { recursive: true, force: true });
+    if (ownsPrimaryLock && existsSync(lockDir)) rmSync(lockDir, { recursive: true, force: true });
   } catch {
     // Non-fatal
   }
   // Also clean the per-milestone parallel directory itself if it exists
-  if (lockTarget !== gsdDir) {
+  if (ownsPrimaryLock && lockTarget !== gsdDir) {
     try {
       if (existsSync(lockTarget)) rmSync(lockTarget, { recursive: true, force: true });
     } catch {
@@ -556,13 +560,14 @@ export function releaseSessionLock(basePath: string): void {
   // Clean ALL registered lock paths (#1578) — lock files accumulate across
   // main project .gsd/, worktree .gsd/, and projects registry paths.
   for (const dir of _lockDirRegistry) {
+    const lockFile = join(dir, LOCK_FILE);
+    const ownsRegisteredLock = isLockFileOwnedByCurrentProcess(lockFile);
     try {
-      const lockFile = join(dir, LOCK_FILE);
-      if (existsSync(lockFile)) unlinkSync(lockFile);
+      if (ownsRegisteredLock && existsSync(lockFile)) unlinkSync(lockFile);
     } catch { /* best-effort */ }
     try {
       const lockDir = join(dir + ".lock");
-      if (existsSync(lockDir)) rmSync(lockDir, { recursive: true, force: true });
+      if (ownsRegisteredLock && existsSync(lockDir)) rmSync(lockDir, { recursive: true, force: true });
     } catch { /* best-effort */ }
   }
   _lockDirRegistry.clear();
@@ -619,6 +624,11 @@ function readExistingLockData(lp: string): SessionLockData | null {
   }
 }
 
+function isLockFileOwnedByCurrentProcess(lp: string): boolean {
+  const existing = readExistingLockData(lp);
+  return existing?.pid === process.pid;
+}
+
 /**
  * Retry-tolerant variant of readExistingLockData for use in onCompromised and
  * other paths where a transient filesystem hiccup (NFS/CIFS latency, macOS APFS

package/src/resources/extensions/gsd/skill-manifest.ts

@@ -0,0 +1,175 @@
+// GSD2 + skill-manifest — per-unit-type skill allowlist resolver (RFC #4779)
+//
+// Each auto-mode unit type can declare which skills are relevant to it. This
+// trims the set of skills considered for activation in the per-unit prompt,
+// reducing prompt token bloat and sharpening model focus.
+//
+// Contract:
+//   - Unknown unit types fall through to "all skills" (current behavior).
+//   - A manifest entry referencing a skill that is not installed is a silent
+//     no-op at filter time — the filter passes through installed skills only.
+//   - The allowlist is an inclusion list: only skills whose normalized name
+//     appears in the allowlist are retained. Order is not preserved.
+//
+// Phase 1 scope: seed manifests for a small number of unit types as proof.
+// Additional unit types can be added incrementally; each addition is a pure
+// data change with no wiring cost.
+
+import { logWarning } from "./workflow-logger.js";
+
+/** Normalize a skill reference the same way callers do (lowercase, trim). */
+function normalize(name: string): string {
+  return name.trim().toLowerCase();
+}
+
+/**
+ * Allowlist per unit type. Keys match unit type identifiers used by auto-mode
+ * dispatch. Values are normalized skill names.
+ *
+ * Wildcard semantics: a unit type absent from this map resolves to `null`
+ * (wildcard) — meaning "all installed skills are eligible". Prefer absence
+ * over an exhaustive list when uncertain.
+ */
+const UNIT_TYPE_SKILL_MANIFEST: Record<string, string[]> = {
+  // Milestone-level planning / meta flows — predictable skill sets.
+  "research-milestone": [
+    "write-docs",
+    "write-milestone-brief",
+    "decompose-into-slices",
+    "grill-me",
+    "design-an-interface",
+    "api-design",
+    "observability",
+  ],
+  "plan-milestone": [
+    "write-milestone-brief",
+    "decompose-into-slices",
+    "design-an-interface",
+    "grill-me",
+    "write-docs",
+    "api-design",
+    "tdd",
+    "verify-before-complete",
+  ],
+  "complete-milestone": [
+    "verify-before-complete",
+    "write-docs",
+    "handoff",
+    "forensics",
+    "observability",
+    "security-review",
+  ],
+  "validate-milestone": [
+    "verify-before-complete",
+    "review",
+    "test",
+    "lint",
+    "security-review",
+    "accessibility",
+    "forensics",
+    "observability",
+  ],
+  "reassess-roadmap": [
+    "decompose-into-slices",
+    "grill-me",
+    "write-milestone-brief",
+    "write-docs",
+    "forensics",
+  ],
+  // Slice-level research / planning.
+  "research-slice": [
+    "write-docs",
+    "decompose-into-slices",
+    "design-an-interface",
+    "grill-me",
+    "api-design",
+    "observability",
+  ],
+  "plan-slice": [
+    "decompose-into-slices",
+    "design-an-interface",
+    "grill-me",
+    "write-docs",
+    "api-design",
+    "tdd",
+    "verify-before-complete",
+  ],
+  "refine-slice": [
+    "decompose-into-slices",
+    "design-an-interface",
+    "grill-me",
+    "write-docs",
+    "api-design",
+    "tdd",
+    "verify-before-complete",
+  ],
+  "replan-slice": [
+    "decompose-into-slices",
+    "grill-me",
+    "design-an-interface",
+    "write-docs",
+    "api-design",
+  ],
+  "run-uat": [
+    "verify-before-complete",
+    "test",
+    "review",
+    "accessibility",
+  ],
+  // `execute-task` intentionally omitted — implementation hot path covers a
+  // wide surface of technologies; wildcard fallback preserves today's
+  // behavior until per-task skill hints can be derived from task-plan
+  // frontmatter. See RFC #4779.
+};
+
+/**
+ * Resolve the skill allowlist for a unit type.
+ *
+ * @returns Array of normalized skill names when an entry exists, or `null`
+ *   when the unit type is unknown (wildcard — caller should not filter).
+ */
+export function resolveSkillManifest(unitType: string | undefined): string[] | null {
+  if (!unitType) return null;
+  const entry = UNIT_TYPE_SKILL_MANIFEST[unitType];
+  if (!entry) return null;
+  return entry.map(normalize);
+}
+
+/**
+ * Filter a skill list by the manifest for `unitType`. Pass-through when the
+ * manifest is wildcard (unknown unit type) or `unitType` is undefined.
+ */
+export function filterSkillsByManifest<T extends { name: string }>(
+  skills: T[],
+  unitType: string | undefined,
+): T[] {
+  const allowlist = resolveSkillManifest(unitType);
+  if (allowlist === null) return skills;
+  const allowed = new Set(allowlist);
+  return skills.filter(skill => allowed.has(normalize(skill.name)));
+}
+
+/**
+ * Dev-mode guard: warn once per process if a manifest entry references a name
+ * that is not currently installed. Silent in production.
+ */
+const warnedMissing = new Set<string>();
+
+export function warnIfManifestHasMissingSkills(
+  unitType: string | undefined,
+  installedNames: Set<string>,
+): void {
+  // Strict mode is intentionally opt-in via exactly "1"; values like "0" or
+  // "false" must preserve the normal silent manifest behavior.
+  if (process.env.GSD_SKILL_MANIFEST_STRICT !== "1") return;
+  const allowlist = resolveSkillManifest(unitType);
+  if (!allowlist) return;
+  for (const name of allowlist) {
+    const key = `${unitType}:${name}`;
+    if (warnedMissing.has(key)) continue;
+    if (!installedNames.has(name)) {
+      warnedMissing.add(key);
+      logWarning("prompt", `skill-manifest: references uninstalled skill '${name}' for unit '${unitType}'`);
+    }
+  }
+}