gsd-pi 2.80.0-dev.c5f2443b3 → 2.80.0-dev.f55d16d13

package/dist/resources/extensions/gsd/clean-root-preflight.js

@@ -16,6 +16,31 @@ import { execFileSync } from "node:child_process";
 import { GIT_NO_PROMPT_ENV } from "./git-constants.js";
 import { logWarning } from "./workflow-logger.js";
 import { nativeHasChanges } from "./native-git-bridge.js";
+function findPreflightStashRef(basePath, milestoneId, stashMarker) {
+    const markerPrefix = `gsd-preflight-stash:${milestoneId}:`;
+    let fallbackRef = null;
+    try {
+        const list = execFileSync("git", ["stash", "list", "--format=%gd%x00%s"], {
+            cwd: basePath,
+            stdio: ["ignore", "pipe", "pipe"],
+            encoding: "utf-8",
+            env: GIT_NO_PROMPT_ENV,
+        });
+        for (const line of list.split("\n")) {
+            const [ref, subject] = line.split("\x00");
+            if (!ref || !subject)
+                continue;
+            if (stashMarker && subject.includes(stashMarker))
+                return ref;
+            if (!fallbackRef && subject.includes(markerPrefix))
+                fallbackRef = ref;
+        }
+    }
+    catch (err) {
+        logWarning("preflight", `stash list failed before restore: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return fallbackRef;
+}
 /**
  * Check the working tree for dirty files before a milestone merge.
  *
@@ -47,7 +72,8 @@ export function preflightCleanRoot(basePath, milestoneId, notify) {
     notify(warnMsg, "warning");
     // Push the stash
     try {
-        execFileSync("git", ["stash", "push", "--include-untracked", "-m", "gsd-preflight-stash"], {
+        const stashMarker = `gsd-preflight-stash:${milestoneId}:${process.pid}:${Date.now()}:${process.hrtime.bigint().toString(36)}`;
+        execFileSync("git", ["stash", "push", "--include-untracked", "-m", `gsd-preflight-stash [${stashMarker}]`], {
             cwd: basePath,
             stdio: ["ignore", "pipe", "pipe"],
             encoding: "utf-8",
@@ -55,6 +81,7 @@ export function preflightCleanRoot(basePath, milestoneId, notify) {
         });
         return {
             stashPushed: true,
+            stashMarker,
             summary: `Stashed uncommitted changes before merge (milestone ${milestoneId}).`,
         };
     }
@@ -73,9 +100,17 @@ export function preflightCleanRoot(basePath, milestoneId, notify) {
  * Any pop error (e.g. conflict) is logged and notified but does NOT throw —
  * the merge already completed successfully.
  */
-export function postflightPopStash(basePath, milestoneId, notify) {
+export function postflightPopStash(basePath, milestoneId, stashMarker, notify) {
+    let stashRef = null;
     try {
-        execFileSync("git", ["stash", "pop"], {
+        stashRef = findPreflightStashRef(basePath, milestoneId, stashMarker);
+        if (!stashRef) {
+            const msg = `No matching GSD preflight stash found for milestone ${milestoneId}; leaving stash list untouched.`;
+            logWarning("preflight", msg);
+            notify(msg, "warning");
+            return;
+        }
+        execFileSync("git", ["stash", "pop", stashRef], {
             cwd: basePath,
             stdio: ["ignore", "pipe", "pipe"],
             encoding: "utf-8",
@@ -86,7 +121,10 @@ export function postflightPopStash(basePath, milestoneId, notify) {
     catch (err) {
         // Pop conflicts mean the merged code collides with the stashed changes.
         // Log a warning — the user needs to resolve manually, but the merge succeeded.
-        const msg = `git stash pop failed after merge of milestone ${milestoneId}: ${err instanceof Error ? err.message : String(err)}. Run "git stash pop" manually to restore your changes.`;
+        const restoreHint = stashRef
+            ? `Run "git stash pop ${stashRef}" or "git stash apply ${stashRef}" manually to restore the correct stash.`
+            : `Run "git stash list" to find the matching GSD preflight stash before restoring manually.`;
+        const msg = `git stash pop ${stashRef ?? ""}`.trim() + ` failed after merge of milestone ${milestoneId}: ${err instanceof Error ? err.message : String(err)}. ${restoreHint}`;
         logWarning("preflight", msg);
         notify(msg, "warning");
     }

package/dist/resources/extensions/gsd/commands-extract-learnings.js

@@ -114,14 +114,19 @@ Using the \`write\` tool, persist the full structured report to
 LEARNINGS.md is the full, cited audit trail. Write it first — subsequent steps
 feed from its content.
 
-### Step 3 — Optionally pre-query the memory store for semantic duplicates
+### Step 3 — Run one bounded duplicate check
 
-Before persisting any extracted item in Steps 4–6, you may call
-\`memory_query\` with 2–3 keywords from the item to check whether the
-memory store already holds a semantically equivalent entry at high
-confidence. Skip those items in their respective steps. The memory store
-is the single source of truth for cross-session durable knowledge — no
-other persistence call is part of this flow.
+Before persisting extracted items in Steps 4–6, do at most one duplicate-check
+pass for the durable Decisions, Lessons, and Patterns from this milestone. Use
+the already-written LEARNINGS.md content and call \`memory_query\` once with a
+compact keyword summary for the whole batch. If that result clearly shows a
+semantically equivalent high-confidence memory for an item, mark only that item
+as already captured and skip it in its respective persistence step.
+
+Do not re-read milestone artefacts or repeat memory queries category-by-category
+after this point. The memory store is the single source of truth for
+cross-session durable knowledge — no other persistence call is part of this
+flow.
 
 ### Step 4 — Persist Patterns via \`capture_thought\`
 
@@ -160,11 +165,11 @@ later projection back to a human-visible decisions register stays lossless
 
 ### Step 7 — Deduplication rule (applies to Steps 4, 5, 6)
 
-Before each \`capture_thought\` call, optionally call \`memory_query\` with 2–3
-keywords from the entry. If a semantically equivalent memory is returned at
-high confidence, skip the capture entirely. Prefer skipping a near-duplicate
-over creating a second slightly-different row — redundancy degrades the
-signal.
+Use only the duplicate-check result from Step 3. If that bounded check returned
+a semantically equivalent memory at high confidence for an extracted item, skip
+the capture entirely. Otherwise, persist the item once via \`capture_thought\`.
+Prefer skipping a near-duplicate over creating a second slightly-different row
+— redundancy degrades the signal.
 
 ### Step 8 — Surprises stay only in LEARNINGS.md
 

package/dist/resources/extensions/gsd/custom-workflow-engine.js

@@ -13,13 +13,29 @@
  */
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
-import { readGraph, writeGraph, getNextPendingStep, markStepActive, markStepComplete, expandIteration, } from "./graph.js";
+import { readGraph, writeGraph, getNextPendingStep, markStepActive, markStepComplete, expandIteration, isTerminalStepStatus, } from "./graph.js";
 import { injectContext } from "./context-injector.js";
 import { readFrozenDefinition } from "./definition-io.js";
 import { parseUnitId } from "./unit-id.js";
 import { withFileLock } from "./file-lock.js";
 // Re-export for downstream consumers
 export { readFrozenDefinition } from "./definition-io.js";
+function formatBlockedWorkflowReason(graph) {
+    const statusById = new Map(graph.steps.map((step) => [step.id, step.status]));
+    const blockedSteps = graph.steps
+        .filter((step) => step.status === "pending")
+        .map((step) => {
+        const blockers = step.dependsOn
+            .filter((depId) => !isTerminalStepStatus(statusById.get(depId)))
+            .map((depId) => `${depId} (${statusById.get(depId) ?? "missing"})`);
+        return blockers.length > 0
+            ? `${step.id} waiting on ${blockers.join(", ")}`
+            : `${step.id} has no runnable dependency path`;
+    });
+    return blockedSteps.length > 0
+        ? `Workflow blocked: no pending steps are ready. Blocked steps: ${blockedSteps.join("; ")}`
+        : "Workflow blocked: no pending steps are ready.";
+}
 export class CustomWorkflowEngine {
     engineId = "custom";
     runDir;
@@ -80,7 +96,11 @@ export class CustomWorkflowEngine {
             if (!next) {
                 const allDone = graph.steps.every((step) => step.status === "complete" || step.status === "expanded");
                 if (!allDone) {
-                    return { action: "skip" };
+                    return {
+                        action: "stop",
+                        reason: formatBlockedWorkflowReason(graph),
+                        level: "error",
+                    };
                 }
                 return {
                     action: "stop",

package/dist/resources/extensions/gsd/db-base-schema.js

@@ -294,6 +294,19 @@ export function createBaseSchemaObjects(db, hooks) {
       updated_at TEXT NOT NULL DEFAULT '',
       PRIMARY KEY (trace_id, turn_id, stage)
     )
+  `);
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS milestone_commit_attributions (
+      commit_sha TEXT NOT NULL,
+      milestone_id TEXT NOT NULL,
+      slice_id TEXT DEFAULT NULL,
+      task_id TEXT DEFAULT NULL,
+      source TEXT NOT NULL DEFAULT 'recorded',
+      confidence REAL NOT NULL DEFAULT 1.0,
+      files_json TEXT NOT NULL DEFAULT '[]',
+      created_at TEXT NOT NULL DEFAULT '',
+      PRIMARY KEY (commit_sha, milestone_id)
+    )
   `);
     db.exec(`
     CREATE TABLE IF NOT EXISTS audit_events (
@@ -329,6 +342,7 @@ export function createBaseSchemaObjects(db, hooks) {
     db.exec("CREATE INDEX IF NOT EXISTS idx_gate_runs_turn ON gate_runs(trace_id, turn_id)");
     db.exec("CREATE INDEX IF NOT EXISTS idx_gate_runs_lookup ON gate_runs(milestone_id, slice_id, task_id, gate_id)");
     db.exec("CREATE INDEX IF NOT EXISTS idx_turn_git_tx_turn ON turn_git_transactions(trace_id, turn_id)");
+    db.exec("CREATE INDEX IF NOT EXISTS idx_milestone_commit_attr_milestone ON milestone_commit_attributions(milestone_id)");
     db.exec("CREATE INDEX IF NOT EXISTS idx_audit_events_trace ON audit_events(trace_id, ts)");
     db.exec("CREATE INDEX IF NOT EXISTS idx_audit_events_turn ON audit_events(trace_id, turn_id, ts)");
     db.exec("CREATE VIEW IF NOT EXISTS active_decisions AS SELECT * FROM decisions WHERE superseded_by IS NULL");

package/dist/resources/extensions/gsd/db-migration-steps.js

@@ -363,6 +363,22 @@ export function applyMigrationV21StructuredMemories(db) {
 export function applyMigrationV23MilestoneQueue(db) {
     ensureColumn(db, "milestones", "sequence", "ALTER TABLE milestones ADD COLUMN sequence INTEGER DEFAULT 0");
 }
+export function applyMigrationV26MilestoneCommitAttributions(db) {
+    db.exec(`
+    CREATE TABLE IF NOT EXISTS milestone_commit_attributions (
+      commit_sha TEXT NOT NULL,
+      milestone_id TEXT NOT NULL,
+      slice_id TEXT DEFAULT NULL,
+      task_id TEXT DEFAULT NULL,
+      source TEXT NOT NULL DEFAULT 'recorded',
+      confidence REAL NOT NULL DEFAULT 1.0,
+      files_json TEXT NOT NULL DEFAULT '[]',
+      created_at TEXT NOT NULL DEFAULT '',
+      PRIMARY KEY (commit_sha, milestone_id)
+    )
+  `);
+    db.exec("CREATE INDEX IF NOT EXISTS idx_milestone_commit_attr_milestone ON milestone_commit_attributions(milestone_id)");
+}
 export function applyMigrationV22QualityGateRepair(db, hooks) {
     const qgInfo = db.prepare("PRAGMA table_info(quality_gates)").all();
     const taskIdCol = qgInfo.find((r) => r["name"] === "task_id");

package/dist/resources/extensions/gsd/detection.js

@@ -5,6 +5,7 @@
  * Used by init-wizard.ts and guided-flow.ts to determine what onboarding
  * flow to show when entering a project directory.
  */
+import { execFileSync } from "node:child_process";
 import { existsSync, openSync, readSync, closeSync, readdirSync, readFileSync, statSync } from "node:fs";
 import { dirname, join, parse as parsePath } from "node:path";
 import { homedir } from "node:os";
@@ -171,6 +172,7 @@ const TEST_MARKERS = [
 const RECURSIVE_SCAN_IGNORED_DIRS = new Set([
     ".git",
     ".gsd",
+    ".bg-shell",
     ".planning",
     ".plans",
     ".claude",
@@ -194,6 +196,7 @@ const RECURSIVE_SCAN_IGNORED_DIRS = new Set([
     "DerivedData",
     "out",
 ]);
+const PROJECT_CONTENT_EXCLUDE_DIRS = RECURSIVE_SCAN_IGNORED_DIRS;
 /** Project file markers safe to detect recursively via suffix matching. */
 const ROOT_ONLY_PROJECT_FILES = new Set([
     ".github/workflows",
@@ -429,6 +432,109 @@ export function detectProjectSignals(basePath) {
         verificationCommands,
     };
 }
+function normalizeGitPath(file) {
+    return file.replaceAll("\\", "/").replace(/^\.\//, "");
+}
+function isProjectContentFile(file) {
+    const normalized = normalizeGitPath(file);
+    if (!normalized || normalized.endsWith("/"))
+        return false;
+    if (normalized === ".gitignore" || normalized === ".gitattributes")
+        return false;
+    const parts = normalized.split("/");
+    if (parts.some((part) => PROJECT_CONTENT_EXCLUDE_DIRS.has(part)))
+        return false;
+    if (normalized.endsWith(".DS_Store"))
+        return false;
+    return true;
+}
+function runGitLines(basePath, args) {
+    try {
+        const output = execFileSync("git", args, {
+            cwd: basePath,
+            stdio: ["ignore", "pipe", "ignore"],
+            encoding: "utf-8",
+        }).trim();
+        return output ? output.split("\n").map((line) => line.trim()).filter(Boolean) : [];
+    }
+    catch {
+        return [];
+    }
+}
+function listTrackedProjectFiles(basePath) {
+    return runGitLines(basePath, ["ls-files"])
+        .map(normalizeGitPath)
+        .filter(isProjectContentFile);
+}
+function listUntrackedProjectFiles(basePath) {
+    return runGitLines(basePath, ["ls-files", "--others", "--exclude-standard"])
+        .map(normalizeGitPath)
+        .filter(isProjectContentFile);
+}
+function hasKnownProjectMarkers(basePath, signals) {
+    if (signals.detectedFiles.length > 0)
+        return true;
+    if (signals.xcodePlatforms.length > 0)
+        return true;
+    return false;
+}
+/**
+ * Classify repo presence separately from ecosystem/tooling markers.
+ *
+ * Known project files identify tooling. Git-tracked/non-ignored content
+ * identifies whether this is an existing project at all. This keeps small
+ * static or documentation repos from being mislabeled as greenfield.
+ */
+export function classifyProject(basePath) {
+    const signals = detectProjectSignals(basePath);
+    const markers = [...signals.detectedFiles];
+    if (!signals.isGitRepo) {
+        return {
+            kind: "invalid-repo",
+            signals,
+            trackedFiles: [],
+            untrackedFiles: [],
+            contentFiles: [],
+            markers,
+            reason: "missing .git",
+        };
+    }
+    const trackedFiles = listTrackedProjectFiles(basePath);
+    const untrackedFiles = listUntrackedProjectFiles(basePath);
+    const contentFiles = [...new Set([...trackedFiles, ...untrackedFiles])];
+    const hasMarkers = hasKnownProjectMarkers(basePath, signals);
+    if (hasMarkers) {
+        return {
+            kind: "typed-existing",
+            signals,
+            trackedFiles,
+            untrackedFiles,
+            contentFiles,
+            markers,
+            reason: markers.length > 0 ? `detected markers: ${markers.join(", ")}` : "detected project structure",
+        };
+    }
+    if (contentFiles.length > 0) {
+        return {
+            kind: "untyped-existing",
+            signals,
+            trackedFiles,
+            untrackedFiles,
+            contentFiles,
+            markers,
+            reason: "project content exists but no recognized tooling markers were found",
+        };
+    }
+    return {
+        kind: "greenfield",
+        signals,
+        trackedFiles,
+        untrackedFiles,
+        contentFiles,
+        markers,
+        reason: "no tracked or non-ignored project content",
+    };
+}
 // ─── Xcode Platform Detection ───────────────────────────────────────────────────
 /** Known SDKROOT values → canonical platform names. */
 const SDKROOT_MAP = {

package/dist/resources/extensions/gsd/graph.js

@@ -89,10 +89,16 @@ export function writeGraph(runDir, graph) {
     renameSync(tmpPath, filePath);
 }
 /**
- * Get the next pending step whose dependencies are all complete.
+ * Return whether a graph step status satisfies dependency edges.
+ */
+export function isTerminalStepStatus(status) {
+    return status === "complete" || status === "expanded";
+}
+/**
+ * Get the next pending step whose dependencies are all terminal.
  *
  * Returns the first step (in array order) with status "pending" where
- * every step in its `dependsOn` list has status "complete".
+ * every step in its `dependsOn` list has status "complete" or "expanded".
  *
  * @param graph — the workflow graph to query
  * @returns The next dispatchable step, or null if none available
@@ -102,7 +108,7 @@ export function getNextPendingStep(graph) {
     for (const step of graph.steps) {
         if (step.status !== "pending")
             continue;
-        const depsComplete = step.dependsOn.every((depId) => statusMap.get(depId) === "complete");
+        const depsComplete = step.dependsOn.every((depId) => isTerminalStepStatus(statusMap.get(depId)));
         if (depsComplete)
             return step;
     }

package/dist/resources/extensions/gsd/gsd-db.js

@@ -36,7 +36,7 @@ import { rowToActiveDecision, rowToActiveRequirement, rowToDecision, rowToRequir
 import { rowToGate } from "./db-gate-rows.js";
 import { rowToArtifact, rowToMilestone } from "./db-milestone-artifact-rows.js";
 import { backupDatabaseBeforeMigration } from "./db-migration-backup.js";
-import { applyMigrationV2Artifacts, applyMigrationV3Memories, applyMigrationV4DecisionMadeBy, applyMigrationV5HierarchyTables, applyMigrationV6SliceSummaries, applyMigrationV7Dependencies, applyMigrationV8PlanningFields, applyMigrationV9Ordering, applyMigrationV10ReplanTrigger, applyMigrationV11TaskPlanning, applyMigrationV12QualityGates, applyMigrationV13HotPathIndexes, applyMigrationV14SliceDependencies, applyMigrationV15AuditTables, applyMigrationV16EscalationSource, applyMigrationV17TaskEscalation, applyMigrationV18MemorySources, applyMigrationV19MemoryFts, applyMigrationV20MemoryRelations, applyMigrationV21StructuredMemories, applyMigrationV22QualityGateRepair, applyMigrationV23MilestoneQueue, } from "./db-migration-steps.js";
+import { applyMigrationV2Artifacts, applyMigrationV3Memories, applyMigrationV4DecisionMadeBy, applyMigrationV5HierarchyTables, applyMigrationV6SliceSummaries, applyMigrationV7Dependencies, applyMigrationV8PlanningFields, applyMigrationV9Ordering, applyMigrationV10ReplanTrigger, applyMigrationV11TaskPlanning, applyMigrationV12QualityGates, applyMigrationV13HotPathIndexes, applyMigrationV14SliceDependencies, applyMigrationV15AuditTables, applyMigrationV16EscalationSource, applyMigrationV17TaskEscalation, applyMigrationV18MemorySources, applyMigrationV19MemoryFts, applyMigrationV20MemoryRelations, applyMigrationV21StructuredMemories, applyMigrationV22QualityGateRepair, applyMigrationV23MilestoneQueue, applyMigrationV26MilestoneCommitAttributions, } from "./db-migration-steps.js";
 import { isMemoriesFtsAvailableSchema, tryCreateMemoriesFtsSchema } from "./db-memory-fts-schema.js";
 import { createDbOpenState } from "./db-open-state.js";
 import { createRuntimeKvTableV25 } from "./db-runtime-kv-schema.js";
@@ -52,7 +52,7 @@ const providerLoader = createSqliteProviderLoader({
     nodeVersion: process.versions.node,
     writeStderr: (message) => process.stderr.write(message),
 });
-export const SCHEMA_VERSION = 25;
+export const SCHEMA_VERSION = 26;
 function initSchema(db, fileBacked) {
     if (fileBacked)
         db.exec("PRAGMA journal_mode=WAL");
@@ -246,6 +246,10 @@ function migrateSchema(db) {
             createRuntimeKvTableV25(db);
             recordSchemaVersion(db, 25);
         }
+        if (currentVersion < 26) {
+            applyMigrationV26MilestoneCommitAttributions(db);
+            recordSchemaVersion(db, 26);
+        }
         db.exec("COMMIT");
     }
     catch (err) {
@@ -1158,6 +1162,47 @@ export function getSliceTasks(milestoneId, sliceId) {
     const rows = currentDb.prepare("SELECT * FROM tasks WHERE milestone_id = :mid AND slice_id = :sid ORDER BY sequence, id").all({ ":mid": milestoneId, ":sid": sliceId });
     return rows.map(rowToTask);
 }
+export function getCompletedMilestoneTaskFileHints(milestoneId) {
+    if (!currentDb)
+        return [];
+    const rows = currentDb.prepare(`SELECT files, key_files
+     FROM tasks
+     WHERE milestone_id = :mid AND status IN ('complete', 'done')`).all({ ":mid": milestoneId });
+    const hints = new Set();
+    for (const row of rows) {
+        for (const raw of [row["files"], row["key_files"]]) {
+            for (const file of parseStringArrayColumn(raw)) {
+                const normalized = normalizeRepoPath(file);
+                if (normalized)
+                    hints.add(normalized);
+            }
+        }
+    }
+    return [...hints];
+}
+function parseStringArrayColumn(raw) {
+    if (Array.isArray(raw))
+        return raw.filter((entry) => typeof entry === "string");
+    if (typeof raw !== "string")
+        return [];
+    const trimmed = raw.trim();
+    if (!trimmed)
+        return [];
+    try {
+        const parsed = JSON.parse(trimmed);
+        if (Array.isArray(parsed))
+            return parsed.filter((entry) => typeof entry === "string");
+        if (typeof parsed === "string")
+            return [parsed];
+    }
+    catch {
+        return trimmed.split(",");
+    }
+    return [];
+}
+function normalizeRepoPath(file) {
+    return file.trim().replace(/\\/g, "/").replace(/^\.\/+/, "");
+}
 // ─── ADR-011 Phase 2 escalation helpers ──────────────────────────────────
 /** Set pause-on-escalation state on a completed task. Mutually exclusive with awaiting_review. */
 export function setTaskEscalationPending(milestoneId, sliceId, taskId, artifactPath) {
@@ -1735,6 +1780,7 @@ export function deleteMilestone(milestoneId) {
         currentDb.prepare(`DELETE FROM replan_history WHERE milestone_id = :mid`).run({ ":mid": milestoneId });
         currentDb.prepare(`DELETE FROM assessments WHERE milestone_id = :mid`).run({ ":mid": milestoneId });
         currentDb.prepare(`DELETE FROM artifacts WHERE milestone_id = :mid`).run({ ":mid": milestoneId });
+        currentDb.prepare(`DELETE FROM milestone_commit_attributions WHERE milestone_id = :mid`).run({ ":mid": milestoneId });
         currentDb.prepare(`DELETE FROM milestone_leases WHERE milestone_id = :mid`).run({ ":mid": milestoneId });
         currentDb.prepare(`DELETE FROM milestones WHERE id = :mid`).run({ ":mid": milestoneId });
     });
@@ -1962,6 +2008,59 @@ export function upsertTurnGitTransaction(entry) {
         ":updated_at": entry.updatedAt,
     });
 }
+export function getMilestoneCommitAttributionShas(milestoneId) {
+    if (!currentDb)
+        return [];
+    const rows = currentDb.prepare(`SELECT commit_sha
+     FROM milestone_commit_attributions
+     WHERE milestone_id = :mid
+     ORDER BY created_at, commit_sha`).all({ ":mid": milestoneId });
+    return rows
+        .map((row) => typeof row["commit_sha"] === "string" ? row["commit_sha"] : "")
+        .filter(Boolean);
+}
+export function recordMilestoneCommitAttribution(entry) {
+    if (!currentDb)
+        return;
+    transaction(() => {
+        currentDb.prepare(`INSERT OR REPLACE INTO milestone_commit_attributions (
+        commit_sha, milestone_id, slice_id, task_id, source, confidence, files_json, created_at
+      ) VALUES (
+        :commit_sha, :milestone_id, :slice_id, :task_id, :source, :confidence, :files_json, :created_at
+      )`).run({
+            ":commit_sha": entry.commitSha,
+            ":milestone_id": entry.milestoneId,
+            ":slice_id": entry.sliceId ?? null,
+            ":task_id": entry.taskId ?? null,
+            ":source": entry.source,
+            ":confidence": entry.confidence,
+            ":files_json": JSON.stringify(entry.files),
+            ":created_at": entry.createdAt,
+        });
+        currentDb.prepare(`INSERT OR IGNORE INTO audit_events (
+        event_id, trace_id, turn_id, caused_by, category, type, ts, payload_json
+      ) VALUES (
+        :event_id, :trace_id, :turn_id, :caused_by, :category, :type, :ts, :payload_json
+      )`).run({
+            ":event_id": `milestone-commit-attribution:${entry.milestoneId}:${entry.commitSha}`,
+            ":trace_id": "milestone-commit-attribution",
+            ":turn_id": null,
+            ":caused_by": null,
+            ":category": "git",
+            ":type": "milestone-commit-attribution-recorded",
+            ":ts": entry.createdAt,
+            ":payload_json": JSON.stringify({
+                commitSha: entry.commitSha,
+                milestoneId: entry.milestoneId,
+                sliceId: entry.sliceId ?? null,
+                taskId: entry.taskId ?? null,
+                source: entry.source,
+                confidence: entry.confidence,
+                files: entry.files,
+            }),
+        });
+    });
+}
 export function insertAuditEvent(entry) {
     if (!currentDb)
         return;
@@ -2048,6 +2147,7 @@ export function clearEngineHierarchy() {
         currentDb.exec("DELETE FROM slice_dependencies");
         currentDb.exec("DELETE FROM assessments");
         currentDb.exec("DELETE FROM replan_history");
+        currentDb.exec("DELETE FROM milestone_commit_attributions");
         currentDb.exec("DELETE FROM tasks");
         currentDb.exec("DELETE FROM slices");
         currentDb.exec("DELETE FROM milestone_leases");

package/dist/resources/extensions/gsd/guided-flow.js

@@ -1716,8 +1716,8 @@ export async function showSmartEntry(ctx, pi, basePath, options) {
     // standard wizard below.
     {
         const prefs = loadEffectiveGSDPreferences(basePath)?.preferences;
-        const { hasPendingDeepStage } = await import("./auto-dispatch.js");
-        if (hasPendingDeepStage(prefs, basePath)) {
+        const { shouldRunDeepProjectSetup } = await import("./auto-dispatch.js");
+        if (shouldRunDeepProjectSetup(state, prefs, basePath)) {
             await startDeepProjectSetupForeground(ctx, pi, basePath, stepMode);
             return;
         }

package/dist/resources/extensions/gsd/pr-evidence.js

@@ -8,8 +8,53 @@ const CHANGE_TYPE_LABELS = {
     docs: "Documentation only",
     chore: "Build, CI, or tooling changes",
 };
+// Per-item cap for user-supplied content. 2 KB gives slice titles plus
+// descriptions room while still bounding malicious DoS-via-PR-body input.
+const USER_CONTENT_CAP_BYTES = 2048;
+const TRUNCATION_SUFFIX = " … [truncated]";
+// Strips HTML comments, fake commit trailers (Co-Authored-By, Signed-off-by —
+// case-insensitive on the trailer name), and caps total length. Designed to
+// be a no-op for well-formed input; golden fixtures must remain byte-stable.
+// Trailer lines are removed (not rejected) so that a single bad line in an
+// otherwise legitimate description does not block the entire PR.
+function sanitizeUserContent(s) {
+    if (!s)
+        return s;
+    // Strip HTML comments greedily across newlines.
+    let out = s.replace(/<!--[\s\S]*?-->/g, "");
+    // Drop lines that look like commit trailers we do not want forged.
+    out = out
+        .split("\n")
+        .filter((line) => !/^\s*(co-authored-by|signed-off-by)\s*:/i.test(line))
+        .join("\n");
+    if (Buffer.byteLength(out, "utf8") > USER_CONTENT_CAP_BYTES) {
+        const budget = USER_CONTENT_CAP_BYTES - Buffer.byteLength(TRUNCATION_SUFFIX, "utf8");
+        // Truncate by code units to stay safely under the byte budget for ASCII;
+        // for multibyte content we conservatively walk back until under budget.
+        let sliced = out.slice(0, Math.max(0, budget));
+        while (Buffer.byteLength(sliced, "utf8") > budget && sliced.length > 0) {
+            sliced = sliced.slice(0, -1);
+        }
+        out = sliced + TRUNCATION_SUFFIX;
+    }
+    return out;
+}
+// Strips HTML comments and fake trailers without applying the length cap.
+// Used for short fields like linkedIssue where truncation would be confusing.
+function sanitizeIssueRef(s) {
+    if (!s)
+        return s;
+    let out = s.replace(/<!--[\s\S]*?-->/g, "");
+    out = out
+        .split("\n")
+        .filter((line) => !/^\s*(co-authored-by|signed-off-by)\s*:/i.test(line))
+        .join("\n");
+    return out;
+}
 function normalizeList(values) {
-    return (values ?? []).map((value) => value.trim()).filter(Boolean);
+    return (values ?? [])
+        .map((value) => sanitizeUserContent(value).trim())
+        .filter(Boolean);
 }
 function changeTypeChecklist(selected) {
     return Object.keys(CHANGE_TYPE_LABELS).map((type) => {
@@ -28,13 +73,17 @@ export function buildPrEvidence(input) {
     const subjectTitle = input.milestoneTitle?.trim() || subjectId;
     const changeType = input.changeType ?? "feat";
     const summaries = normalizeList(input.summaries);
+    const blockers = normalizeList(input.blockers);
     const roadmapItems = normalizeList(input.roadmapItems);
     const metrics = normalizeList(input.metrics);
     const testsRun = normalizeList(input.testsRun);
     const rollbackNotes = normalizeList(input.rollbackNotes);
-    const linkedIssue = input.linkedIssue?.trim() || "Not specified. Add an issue link before marking this PR ready if CONTRIBUTING.md requires one.";
-    const why = input.why?.trim() || `${capitalize(subjectKind)} work is complete and ready for review.`;
-    const how = input.how?.trim() || "Generated from GSD evidence and local workflow artifacts.";
+    // linkedIssue is sanitized but not length-capped: legitimate issue refs
+    // are short by nature, and truncating "Closes #123" would be unhelpful.
+    const linkedIssueRaw = input.linkedIssue ? sanitizeIssueRef(input.linkedIssue).trim() : "";
+    const linkedIssue = linkedIssueRaw || "Not specified. Add an issue link before marking this PR ready if CONTRIBUTING.md requires one.";
+    const why = (input.why ? sanitizeUserContent(input.why).trim() : "") || `${capitalize(subjectKind)} work is complete and ready for review.`;
+    const how = (input.how ? sanitizeUserContent(input.how).trim() : "") || "Generated from GSD evidence and local workflow artifacts.";
     const title = `${changeType}: ${subjectTitle}`;
     const sections = [
         "## TL;DR",
@@ -46,19 +95,11 @@ export function buildPrEvidence(input) {
         "## What",
         "",
         summaries.length > 0 ? summaries.join("\n\n") : `${capitalize(subjectKind)} ${subjectId} completed.`,
-        "",
-        "## Why",
-        "",
-        why,
-        "",
-        "## How",
-        "",
-        how,
-        "",
-        "## Linked Issue",
-        "",
-        linkedIssue,
     ];
+    if (blockers.length > 0) {
+        sections.push("", "## Blockers", "", blockers.map((blocker) => `- ${blocker}`).join("\n"));
+    }
+    sections.push("", "## Why", "", why, "", "## How", "", how, "", "## Linked Issue", "", linkedIssue);
     if (roadmapItems.length > 0) {
         sections.push("", "## Roadmap", "", roadmapItems.join("\n"));
     }