gsd-pi 2.82.0-dev.ed17d078d → 3.0.0-dev.04f5ccf82

package/dist/resources/extensions/gsd/templates/task-plan.md

@@ -57,6 +57,12 @@ skills_used:
 - {{howToVerifyThisTaskIsActuallyDone}}
 - {{commandToRun_OR_behaviorToCheck}}
 
+## Verify Rules
+
+- Use a real executable check, not prose.
+- If the check needs file-content assertions, write a `node:test` file and run it with `node --test` or a package test script.
+- Do not use inline `node -e` assertions for verification.
+
 ## Observability Impact
 
 <!-- OMIT THIS SECTION ENTIRELY for simple tasks that don't touch runtime boundaries,
@@ -72,7 +78,8 @@ skills_used:
 <!-- Every input MUST be a backtick-wrapped file path. These paths are machine-parsed to
      derive task dependencies — vague descriptions without paths break dependency detection.
      For the first task in a slice with no prior task outputs, list the existing source files
-     this task reads or modifies. -->
+     this task reads or modifies.
+     Tool field: inputs must be an array of strings, e.g. ["src/index.ts"], never a single string. -->
 
 - `{{filePath}}` — {{whatThisTaskNeedsFromPriorWork}}
 
@@ -82,6 +89,7 @@ skills_used:
      or modifies. These paths are machine-parsed to derive task dependencies.
      This task should produce a real increment toward making the slice goal/demo true. A full
      slice plan should not be able to mark every task complete while the claimed slice behavior
-     still does not work at the stated proof level. -->
+     still does not work at the stated proof level.
+     Tool field: expectedOutput must be an array of strings, e.g. ["src/index.ts"], never a single string. -->
 
 - `{{filePath}}` — {{whatThisTaskCreatesOrModifies}}

package/dist/resources/extensions/gsd/tools/complete-milestone.js

@@ -8,7 +8,7 @@
  */
 import { join } from "node:path";
 import { mkdirSync, existsSync } from "node:fs";
-import { transaction, getMilestone, getMilestoneSlices, getSliceTasks, updateMilestoneStatus, } from "../gsd-db.js";
+import { transaction, getMilestone, getMilestoneSlices, getSliceTasks, getLatestAssessmentByScope, updateMilestoneStatus, } from "../gsd-db.js";
 import { resolveMilestonePath, clearPathCache } from "../paths.js";
 import { isClosedStatus } from "../status-guards.js";
 import { saveFile, clearParseCache } from "../files.js";
@@ -24,11 +24,11 @@ function renderMilestoneSummaryMarkdown(params, completedAt) {
     const keyFiles = params.keyFiles ?? [];
     const lessonsLearned = params.lessonsLearned ?? [];
     const keyDecisionsYaml = keyDecisions.length > 0
-        ? keyDecisions.map(d => `  - ${d}`).join("\n")
-        : "  - (none)";
+        ? `\n${keyDecisions.map(d => `  - ${d}`).join("\n")}`
+        : " []";
     const keyFilesYaml = keyFiles.length > 0
-        ? keyFiles.map(f => `  - ${f}`).join("\n")
-        : "  - (none)";
+        ? `\n${keyFiles.map(f => `  - ${f}`).join("\n")}`
+        : " []";
     const lessonsYaml = lessonsLearned.length > 0
         ? lessonsLearned.map(l => `  - ${l}`).join("\n")
         : "  - (none)";
@@ -37,10 +37,8 @@ id: ${params.milestoneId}
 title: "${displayTitle}"
 status: complete
 completed_at: ${completedAt}
-key_decisions:
-${keyDecisionsYaml}
-key_files:
-${keyFilesYaml}
+key_decisions:${keyDecisionsYaml}
+key_files:${keyFilesYaml}
 lessons_learned:
 ${lessonsYaml}
 ---
@@ -101,6 +99,14 @@ export async function handleCompleteMilestone(params, basePath) {
             alreadyComplete = true;
             return;
         }
+        // Defense-in-depth: only a passing milestone validation permits closeout.
+        const validation = getLatestAssessmentByScope(params.milestoneId, "milestone-validation");
+        if (validation?.status !== "pass") {
+            guardError =
+                `Refusing to complete ${params.milestoneId}: latest milestone-validation verdict is ` +
+                    `"${validation?.status ?? "absent"}". Only verdict=pass permits closeout.`;
+            return;
+        }
         // Verify all slices are complete
         const slices = getMilestoneSlices(params.milestoneId);
         if (slices.length === 0) {

package/dist/resources/extensions/gsd/tools/complete-slice.js

@@ -65,11 +65,11 @@ function renderSliceSummaryMarkdown(params) {
         ? affects.map(a => `  - ${a}`).join("\n")
         : "  []";
     const keyFilesYaml = keyFiles.length > 0
-        ? keyFiles.map(f => `  - ${f}`).join("\n")
-        : "  - (none)";
+        ? `\n${keyFiles.map(f => `  - ${f}`).join("\n")}`
+        : " []";
     const keyDecisionsYaml = keyDecisions.length > 0
-        ? keyDecisions.map(d => `  - ${d}`).join("\n")
-        : "  - (none)";
+        ? `\n${keyDecisions.map(d => `  - ${d}`).join("\n")}`
+        : " []";
     const patternsYaml = patternsEstablished.length > 0
         ? patternsEstablished.map(p => `  - ${p}`).join("\n")
         : "  - (none)";
@@ -106,10 +106,8 @@ requires:
 ${requiresYaml}
 affects:
 ${affectsYaml}
-key_files:
-${keyFilesYaml}
-key_decisions:
-${keyDecisionsYaml}
+key_files:${keyFilesYaml}
+key_decisions:${keyDecisionsYaml}
 patterns_established:
 ${patternsYaml}
 observability_surfaces:
@@ -183,6 +181,31 @@ function renderUatMarkdown(params) {
 ${params.uatContent}
 `;
 }
+function parseRequirementSection(summaryMd, heading, field) {
+    const headingLine = `## ${heading}\n\n`;
+    const start = summaryMd.indexOf(headingLine);
+    if (start === -1)
+        return [];
+    const contentStart = start + headingLine.length;
+    const nextHeading = summaryMd.indexOf("\n\n## ", contentStart);
+    const content = nextHeading === -1
+        ? summaryMd.slice(contentStart)
+        : summaryMd.slice(contentStart, nextHeading);
+    return content
+        .split("\n")
+        .map((line) => line.trim())
+        .filter((line) => line.startsWith("- "))
+        .map((line) => line.slice(2).trim())
+        .map((line) => {
+        const pair = line.match(/^(.+?)\s*(?:—|-)\s+(.+)$/);
+        const id = pair ? pair[1].trim() : line.trim();
+        const detail = pair ? pair[2].trim() : "";
+        if (!id || !detail)
+            return null;
+        return { id, [field]: detail };
+    })
+        .filter((entry) => entry !== null);
+}
 /**
  * Handle the complete_slice operation end-to-end.
  *
@@ -218,6 +241,7 @@ export async function handleCompleteSlice(params, basePath) {
     // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
     const completedAt = new Date().toISOString();
     let guardError = null;
+    let existingSummaryMd = "";
     transaction(() => {
         // State machine preconditions (inside txn for atomicity).
         // Milestone/slice not existing is OK — insertMilestone/insertSlice below will auto-create.
@@ -228,6 +252,7 @@ export async function handleCompleteSlice(params, basePath) {
             return;
         }
         const slice = getSlice(params.milestoneId, params.sliceId);
+        existingSummaryMd = slice?.full_summary_md?.trim() ?? "";
         if (slice && isClosedStatus(slice.status)) {
             if (isStaleWrite("complete-slice")) {
                 guardError = "__stale_duplicate__";
@@ -272,8 +297,29 @@ export async function handleCompleteSlice(params, basePath) {
     if (guardError) {
         return { error: guardError };
     }
+    const effectiveParams = { ...params };
+    if (existingSummaryMd) {
+        // Keep these heading names in lock-step with renderSliceSummaryMarkdown's
+        // section titles so omitted CompleteSliceParams requirement fields can be
+        // backfilled from previously rendered summary markdown.
+        if (effectiveParams.requirementsAdvanced === undefined) {
+            const parsed = parseRequirementSection(existingSummaryMd, "Requirements Advanced", "how");
+            if (parsed.length > 0)
+                effectiveParams.requirementsAdvanced = parsed;
+        }
+        if (effectiveParams.requirementsValidated === undefined) {
+            const parsed = parseRequirementSection(existingSummaryMd, "Requirements Validated", "proof");
+            if (parsed.length > 0)
+                effectiveParams.requirementsValidated = parsed;
+        }
+        if (effectiveParams.requirementsInvalidated === undefined) {
+            const parsed = parseRequirementSection(existingSummaryMd, "Requirements Invalidated or Re-scoped", "what");
+            if (parsed.length > 0)
+                effectiveParams.requirementsInvalidated = parsed;
+        }
+    }
     // Render summary markdown
-    const summaryMd = renderSliceSummaryMarkdown(params);
+    const summaryMd = renderSliceSummaryMarkdown(effectiveParams);
     // Resolve and write summary to disk
     let summaryPath;
     const sliceDir = resolveSlicePath(basePath, params.milestoneId, params.sliceId);
@@ -287,7 +333,7 @@ export async function handleCompleteSlice(params, basePath) {
         mkdirSync(manualSliceDir, { recursive: true });
         summaryPath = join(manualSliceDir, `${params.sliceId}-SUMMARY.md`);
     }
-    const uatMd = renderUatMarkdown(params);
+    const uatMd = renderUatMarkdown(effectiveParams);
     const uatPath = summaryPath.replace(/-SUMMARY\.md$/, "-UAT.md");
     setSliceSummaryMd(params.milestoneId, params.sliceId, summaryMd, uatMd);
     let projectionStale = false;

package/dist/resources/extensions/gsd/tools/exec-tool.js

@@ -1,9 +1,7 @@
-// GSD Exec Tool — executor for the gsd_exec MCP tool.
-//
-// Thin wrapper around exec-sandbox.ts that reads effective options from
-// the project preferences (context_mode block) and formats the result
-// for MCP return.
+// Project/App: GSD-2
+// File Purpose: Executor for the gsd_exec MCP tool.
 import { EXEC_DEFAULTS, runExecSandbox, } from "../exec-sandbox.js";
+import path from "node:path";
 import { isContextModeEnabled } from "../preferences-types.js";
 import { contextModeDisabledResult } from "./context-mode-tool-result.js";
 export function buildExecOptions(baseDir, cfg, extras) {
@@ -41,6 +39,86 @@ function paramError(message) {
         isError: true,
     };
 }
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function normalizeScanPath(value) {
+    return value.replace(/\\/g, "/").replace(/\/+$/, "");
+}
+function parseWorktreeBase(baseDir) {
+    const normalizedBase = normalizeScanPath(baseDir);
+    const marker = "/.gsd/worktrees/";
+    const markerIndex = normalizedBase.indexOf(marker);
+    if (markerIndex <= 0)
+        return null;
+    return {
+        originalRoot: normalizedBase.slice(0, markerIndex),
+        worktreeRoot: normalizedBase,
+    };
+}
+function pathInside(parent, target) {
+    const parentWithSep = parent.endsWith("/") ? parent : `${parent}/`;
+    return target === parent || target.startsWith(parentWithSep);
+}
+function stripWrappingQuotes(value) {
+    const trimmed = value.trim();
+    if (trimmed.length < 2)
+        return trimmed;
+    const first = trimmed[0];
+    const last = trimmed[trimmed.length - 1];
+    if ((first === "'" || first === '"' || first === "`") && last === first) {
+        return trimmed.slice(1, -1).trim();
+    }
+    return trimmed;
+}
+function extractPathLikeValues(script) {
+    const values = [];
+    const push = (candidate) => {
+        const cleaned = stripWrappingQuotes(candidate).trim();
+        if (!cleaned)
+            return;
+        values.push(cleaned);
+    };
+    const pushQuotedLiterals = (source, depth = 0) => {
+        for (const match of source.matchAll(/(["'`])((?:\\.|(?!\1).)*)\1/g)) {
+            push(match[2]);
+            if (depth < 2 && /["'`]/.test(match[2])) {
+                pushQuotedLiterals(match[2], depth + 1);
+            }
+        }
+    };
+    for (const match of script.matchAll(/(?:^|[;\n\r]|\&\&|\|\|)\s*cd\s+([^\n\r;|&]+)/g)) {
+        push(match[1]);
+    }
+    for (const match of script.matchAll(/process\.chdir\(\s*([^\n\r;]+?)\s*\)/g)) {
+        push(match[1]);
+        pushQuotedLiterals(match[1]);
+    }
+    pushQuotedLiterals(script);
+    return values;
+}
+function resolvesToOriginalRootOutsideWorktree(script, baseDir) {
+    const parsed = parseWorktreeBase(baseDir);
+    if (!parsed)
+        return false;
+    const normalizedWorktree = normalizeScanPath(path.resolve(parsed.worktreeRoot));
+    const normalizedOriginalRoot = normalizeScanPath(path.resolve(parsed.originalRoot));
+    for (const value of extractPathLikeValues(script)) {
+        const resolved = normalizeScanPath(path.resolve(normalizedWorktree, value));
+        if (pathInside(normalizedOriginalRoot, resolved) && !pathInside(normalizedWorktree, resolved)) {
+            return true;
+        }
+    }
+    return false;
+}
+function scriptReferencesOriginalRootFromWorktree(script, baseDir) {
+    const parsed = parseWorktreeBase(baseDir);
+    if (!parsed)
+        return false;
+    const normalizedScript = script.replace(/\\/g, "/");
+    const originalRootPattern = new RegExp(`${escapeRegExp(parsed.originalRoot)}(?=$|[\\s'"\\\`;)&|<>]|/(?!\\.gsd/worktrees(?:/|$)))`);
+    return originalRootPattern.test(normalizedScript);
+}
 export async function executeGsdExec(params, deps) {
     if (!isEnabled(deps.preferences))
         return contextModeDisabledResult("gsd_exec");
@@ -55,6 +133,10 @@ export async function executeGsdExec(params, deps) {
     if (Buffer.byteLength(script, "utf8") > 200_000) {
         return paramError("script exceeds the 200 KB length limit");
     }
+    if (resolvesToOriginalRootOutsideWorktree(script, deps.baseDir)
+        || scriptReferencesOriginalRootFromWorktree(script, deps.baseDir)) {
+        return paramError("script references the original project root while running inside a milestone worktree; use the active worktree path or relative paths");
+    }
     const opts = buildExecOptions(deps.baseDir, deps.preferences?.context_mode, { env: deps.env, now: deps.now, generateId: deps.generateId });
     const run = deps.run ?? runExecSandbox;
     try {

package/dist/resources/extensions/gsd/tools/plan-milestone.js

@@ -1,6 +1,6 @@
 import { clearParseCache } from "../files.js";
 import { isClosedStatus } from "../status-guards.js";
-import { isNonEmptyString, validateStringArray } from "../validation.js";
+import { isNonEmptyString, validateStringArray, validateTitle } from "../validation.js";
 import { transaction, getMilestone, getMilestoneSlices, getSlice, insertMilestone, insertSlice, upsertMilestonePlanning, upsertSlicePlanning, } from "../gsd-db.js";
 import { invalidateStateCache } from "../state.js";
 import { renderRoadmapFromDb } from "../markdown-renderer.js";
@@ -77,6 +77,9 @@ function validateSlices(value) {
         seen.add(sliceId);
         if (!isNonEmptyString(title))
             throw new Error(`slices[${index}].title must be a non-empty string`);
+        const titleIssue = validateTitle(title);
+        if (titleIssue)
+            throw new Error(`slices[${index}].title is invalid: ${titleIssue}`);
         if (!isNonEmptyString(risk))
             throw new Error(`slices[${index}].risk must be a non-empty string`);
         if (!Array.isArray(depends) || depends.some((item) => !isNonEmptyString(item))) {
@@ -127,6 +130,9 @@ function validateParams(params) {
         throw new Error("title is required");
     if (!isNonEmptyString(params?.vision))
         throw new Error("vision is required");
+    const milestoneTitleIssue = validateTitle(params.title);
+    if (milestoneTitleIssue)
+        throw new Error(`title is invalid: ${milestoneTitleIssue}`);
     return {
         ...params,
         dependsOn: params.dependsOn ? validateStringArray(params.dependsOn, "dependsOn") : [],

package/dist/resources/extensions/gsd/tools/plan-slice.js

@@ -1,7 +1,9 @@
+import { existsSync, rmSync } from "node:fs";
+import { join, relative } from "node:path";
 import { clearParseCache } from "../files.js";
 import { isClosedStatus, isDeferredStatus } from "../status-guards.js";
-import { isNonEmptyString } from "../validation.js";
-import { transaction, getMilestone, getSlice, insertTask, upsertSlicePlanning, upsertTaskPlanning, insertGateRow, updateSliceStatus, } from "../gsd-db.js";
+import { isNonEmptyString, validateStringArray } from "../validation.js";
+import { transaction, getMilestone, getSlice, getSliceTasks, insertTask, upsertSlicePlanning, upsertTaskPlanning, insertGateRow, updateSliceStatus, setSliceSketchFlag, deleteTask, deleteArtifactByPath, } from "../gsd-db.js";
 import { invalidateStateCache } from "../state.js";
 import { renderPlanFromDb } from "../markdown-renderer.js";
 import { renderAllProjections } from "../workflow-projections.js";
@@ -9,6 +11,21 @@ import { writeManifest } from "../workflow-manifest.js";
 import { appendEvent } from "../workflow-events.js";
 import { logWarning } from "../workflow-logger.js";
 import { validatePlanningPathScope } from "../planning-path-scope.js";
+import { checkFilePathConsistency, checkTaskOrdering } from "../pre-execution-checks.js";
+import { buildTaskFileName, gsdProjectionRoot } from "../paths.js";
+import { loadEffectiveGSDPreferences } from "../preferences.js";
+import { createRepositoryRegistryFromPreferences } from "../repository-registry.js";
+function validateRepositoryTargetIds(field, value) {
+    if (value === undefined)
+        return null;
+    const ids = validateStringArray(value, field);
+    if (ids.length === 0)
+        throw new Error(`${field} must include at least one repository id when provided`);
+    const deduped = Array.from(new Set(ids.map((id) => id.trim()).filter(Boolean)));
+    if (deduped.length === 0)
+        throw new Error(`${field} must include at least one repository id when provided`);
+    return deduped;
+}
 function validateTasks(value) {
     if (!Array.isArray(value) || value.length === 0) {
         throw new Error("tasks must be a non-empty array");
@@ -28,6 +45,7 @@ function validateTasks(value) {
         const inputs = obj.inputs;
         const expectedOutput = obj.expectedOutput;
         const observabilityImpact = obj.observabilityImpact;
+        const targetRepositories = obj.targetRepositories;
         if (!isNonEmptyString(taskId))
             throw new Error(`tasks[${index}].taskId must be a non-empty string`);
         if (seen.has(taskId))
@@ -39,30 +57,26 @@ function validateTasks(value) {
             throw new Error(`tasks[${index}].description must be a non-empty string`);
         if (!isNonEmptyString(estimate))
             throw new Error(`tasks[${index}].estimate must be a non-empty string`);
-        if (!Array.isArray(files) || files.some((item) => !isNonEmptyString(item))) {
-            throw new Error(`tasks[${index}].files must be an array of non-empty strings`);
-        }
+        const validatedFiles = validateStringArray(files, `tasks[${index}].files`);
         if (!isNonEmptyString(verify))
             throw new Error(`tasks[${index}].verify must be a non-empty string`);
-        if (!Array.isArray(inputs) || inputs.some((item) => !isNonEmptyString(item))) {
-            throw new Error(`tasks[${index}].inputs must be an array of non-empty strings`);
-        }
-        if (!Array.isArray(expectedOutput) || expectedOutput.some((item) => !isNonEmptyString(item))) {
-            throw new Error(`tasks[${index}].expectedOutput must be an array of non-empty strings`);
-        }
+        const validatedInputs = validateStringArray(inputs, `tasks[${index}].inputs`);
+        const validatedExpectedOutput = validateStringArray(expectedOutput, `tasks[${index}].expectedOutput`);
         if (observabilityImpact !== undefined && !isNonEmptyString(observabilityImpact)) {
             throw new Error(`tasks[${index}].observabilityImpact must be a non-empty string when provided`);
         }
+        const validatedTargetRepositories = validateRepositoryTargetIds(`tasks[${index}].targetRepositories`, targetRepositories);
         return {
             taskId,
             title,
             description,
             estimate,
-            files,
+            files: validatedFiles,
             verify,
-            inputs,
-            expectedOutput,
+            inputs: validatedInputs,
+            expectedOutput: validatedExpectedOutput,
             observabilityImpact: typeof observabilityImpact === "string" ? observabilityImpact : "",
+            targetRepositories: validatedTargetRepositories ?? undefined,
         };
     });
 }
@@ -73,6 +87,7 @@ function validateParams(params) {
         throw new Error("sliceId is required");
     if (!isNonEmptyString(params?.goal))
         throw new Error("goal is required");
+    const validatedTargetRepositories = validateRepositoryTargetIds("targetRepositories", params.targetRepositories);
     return {
         ...params,
         // Keep optional enrichment fields empty when omitted. The renderer supplies
@@ -81,9 +96,94 @@ function validateParams(params) {
         proofLevel: params.proofLevel ?? "",
         integrationClosure: params.integrationClosure ?? "",
         observabilityImpact: params.observabilityImpact ?? "",
+        targetRepositories: validatedTargetRepositories ?? undefined,
         tasks: validateTasks(params.tasks),
     };
 }
+function loadRepositoryRegistry(basePath) {
+    const loaded = loadEffectiveGSDPreferences(basePath);
+    return createRepositoryRegistryFromPreferences(basePath, loaded?.preferences);
+}
+function validateReferencedRepositories(params, registry) {
+    const known = new Set(registry.repositories.map((repo) => repo.id));
+    const missing = [];
+    const noteMissing = (id) => {
+        if (!known.has(id) && !missing.includes(id))
+            missing.push(id);
+    };
+    for (const id of params.targetRepositories ?? [])
+        noteMissing(id);
+    for (const task of params.tasks) {
+        for (const id of task.targetRepositories ?? [])
+            noteMissing(id);
+    }
+    if (missing.length === 0)
+        return null;
+    return `unknown targetRepositories: ${missing.join(", ")}. Declared repositories: ${Array.from(known).join(", ")}`;
+}
+function resolveAllowedRootsForPathScope(params, registry) {
+    const requested = new Set();
+    for (const id of params.targetRepositories ?? [])
+        requested.add(id);
+    for (const task of params.tasks) {
+        for (const id of task.targetRepositories ?? [])
+            requested.add(id);
+    }
+    if (requested.size === 0)
+        return [registry.projectRoot];
+    const roots = Array.from(requested)
+        .map((id) => registry.byId.get(id)?.root)
+        .filter((root) => typeof root === "string");
+    return roots.length > 0 ? roots : [registry.projectRoot];
+}
+function toTaskRows(params) {
+    return params.tasks.map((task, index) => ({
+        milestone_id: params.milestoneId,
+        slice_id: params.sliceId,
+        id: task.taskId,
+        title: task.title,
+        status: "pending",
+        one_liner: "",
+        narrative: "",
+        verification_result: "",
+        duration: "",
+        completed_at: null,
+        blocker_discovered: false,
+        deviations: "",
+        known_issues: "",
+        key_files: [],
+        key_decisions: [],
+        full_summary_md: "",
+        description: task.description,
+        estimate: task.estimate,
+        files: task.files,
+        verify: task.verify,
+        inputs: task.inputs,
+        expected_output: task.expectedOutput,
+        observability_impact: task.observabilityImpact ?? "",
+        full_plan_md: task.fullPlanMd ?? "",
+        target_repositories: task.targetRepositories ?? params.targetRepositories ?? ["project"],
+        sequence: index + 1,
+        blocker_source: "",
+        escalation_pending: 0,
+        escalation_awaiting_review: 0,
+        escalation_artifact_path: null,
+        escalation_override_applied_at: null,
+    }));
+}
+function validateTaskPathsBeforePersist(params, basePath) {
+    const taskRows = toTaskRows(params);
+    const checks = [
+        ...checkFilePathConsistency(taskRows, basePath),
+        ...checkTaskOrdering(taskRows, basePath),
+    ];
+    const blocking = checks.filter((check) => !check.passed && check.blocking);
+    if (blocking.length === 0)
+        return null;
+    return blocking
+        .map((check) => `[${check.category}] ${check.target}: ${check.message}`)
+        .join("\n");
+}
 export async function handlePlanSlice(rawParams, basePath) {
     let params;
     try {
@@ -92,18 +192,29 @@ export async function handlePlanSlice(rawParams, basePath) {
     catch (err) {
         return { error: `validation failed: ${err.message}` };
     }
+    const repositoryRegistry = loadRepositoryRegistry(basePath);
+    const repoValidationError = validateReferencedRepositories(params, repositoryRegistry);
+    if (repoValidationError) {
+        return { error: `validation failed: ${repoValidationError}` };
+    }
+    const allowedAbsoluteRoots = resolveAllowedRootsForPathScope(params, repositoryRegistry);
     const pathScopeError = validatePlanningPathScope(basePath, params.tasks.flatMap((task, index) => [
         { field: `tasks[${index}].files`, values: task.files },
         { field: `tasks[${index}].inputs`, values: task.inputs },
         { field: `tasks[${index}].expectedOutput`, values: task.expectedOutput },
-    ]));
+    ]), allowedAbsoluteRoots);
     if (pathScopeError) {
         return { error: `validation failed: ${pathScopeError}` };
     }
+    const pathError = validateTaskPathsBeforePersist(params, basePath);
+    if (pathError) {
+        return { error: `pre-execution validation failed:\n${pathError}` };
+    }
     // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
     // Guards must be inside the transaction so the state they check cannot
     // change between the read and the write (#2723).
     let guardError = null;
+    let omittedTaskIds = [];
     try {
         transaction(() => {
             const parentMilestone = getMilestone(params.milestoneId);
@@ -124,16 +235,32 @@ export async function handlePlanSlice(rawParams, basePath) {
                 guardError = `cannot re-plan slice ${params.sliceId}: it is already complete — use gsd_slice_reopen first`;
                 return;
             }
+            const newTaskIds = new Set(params.tasks.map((task) => task.taskId));
+            const existingTasks = getSliceTasks(params.milestoneId, params.sliceId);
+            omittedTaskIds = existingTasks
+                .filter((task) => !newTaskIds.has(task.id))
+                .map((task) => task.id);
+            for (const task of existingTasks) {
+                if (!newTaskIds.has(task.id) && isClosedStatus(task.status)) {
+                    guardError = `cannot remove completed task ${task.id}`;
+                    return;
+                }
+            }
             if (isDeferredStatus(parentSlice.status)) {
                 updateSliceStatus(params.milestoneId, params.sliceId, "pending");
             }
+            setSliceSketchFlag(params.milestoneId, params.sliceId, false);
             upsertSlicePlanning(params.milestoneId, params.sliceId, {
                 goal: params.goal,
                 successCriteria: params.successCriteria,
                 proofLevel: params.proofLevel,
                 integrationClosure: params.integrationClosure,
                 observabilityImpact: params.observabilityImpact,
+                targetRepositories: params.targetRepositories ?? ["project"],
             });
+            for (const taskId of omittedTaskIds) {
+                deleteTask(params.milestoneId, params.sliceId, taskId);
+            }
             for (const task of params.tasks) {
                 insertTask({
                     id: task.taskId,
@@ -152,6 +279,7 @@ export async function handlePlanSlice(rawParams, basePath) {
                     expectedOutput: task.expectedOutput,
                     observabilityImpact: task.observabilityImpact ?? "",
                     fullPlanMd: task.fullPlanMd,
+                    targetRepositories: task.targetRepositories ?? params.targetRepositories ?? ["project"],
                 });
             }
             // Seed quality gate rows inside the transaction — all-or-nothing with
@@ -176,6 +304,14 @@ export async function handlePlanSlice(rawParams, basePath) {
         return { error: guardError };
     }
     try {
+        const tasksDir = join(gsdProjectionRoot(basePath), "milestones", params.milestoneId, "slices", params.sliceId, "tasks");
+        for (const taskId of omittedTaskIds) {
+            const taskPlanPath = join(tasksDir, buildTaskFileName(taskId, "PLAN"));
+            if (existsSync(taskPlanPath))
+                rmSync(taskPlanPath, { force: true });
+            const artifactPath = relative(gsdProjectionRoot(basePath), taskPlanPath).replace(/\\/g, "/");
+            deleteArtifactByPath(artifactPath);
+        }
         const renderResult = await renderPlanFromDb(basePath, params.milestoneId, params.sliceId);
         invalidateStateCache();
         clearParseCache();

package/dist/resources/extensions/gsd/tools/validate-milestone.js

@@ -9,7 +9,7 @@
  * despite passing validation.
  */
 import { join } from "node:path";
-import { transaction, insertAssessment, getMilestoneSlices, } from "../gsd-db.js";
+import { transaction, insertAssessment, getMilestoneSlices, getMilestone, } from "../gsd-db.js";
 import { resolveMilestonePath, clearPathCache } from "../paths.js";
 import { resolveCanonicalMilestoneRoot } from "../worktree-manager.js";
 import { saveFile, clearParseCache } from "../files.js";
@@ -20,6 +20,27 @@ import { logWarning } from "../workflow-logger.js";
 import { UokGateRunner } from "../uok/gate-runner.js";
 import { loadEffectiveGSDPreferences } from "../preferences.js";
 import { resolveUokFlags } from "../uok/flags.js";
+function isVerificationNotApplicable(value) {
+    const v = (value ?? "").toLowerCase().trim().replace(/[.\s]+$/, "");
+    if (!v || v === "none")
+        return true;
+    return /^(?:none(?:[\s._\u2014-]+[\s\S]*)?|n\/?a(?:[\s._\u2014-]+[\s\S]*)?|not[\s._-]+(?:applicable|required|needed|provided)(?:[\s._\u2014-]+[\s\S]*)?|no[\s._-]+operational[\s\S]*)$/i.test(v);
+}
+function getRequiredVerificationClasses(milestoneId) {
+    const milestone = getMilestone(milestoneId);
+    if (!milestone)
+        return [];
+    const required = [];
+    if (!isVerificationNotApplicable(milestone.verification_contract))
+        required.push("Contract");
+    if (!isVerificationNotApplicable(milestone.verification_integration))
+        required.push("Integration");
+    if (!isVerificationNotApplicable(milestone.verification_operational))
+        required.push("Operational");
+    if (!isVerificationNotApplicable(milestone.verification_uat))
+        required.push("UAT");
+    return required;
+}
 function renderValidationMarkdown(params) {
     let md = `---
 verdict: ${params.verdict}
@@ -59,6 +80,16 @@ export async function handleValidateMilestone(params, basePath, opts) {
     if (!isValidMilestoneVerdict(params.verdict)) {
         return { error: `verdict must be one of: ${VALIDATION_VERDICTS.join(", ")}` };
     }
+    const requiredClasses = getRequiredVerificationClasses(params.milestoneId);
+    if (requiredClasses.length > 0) {
+        const verificationClasses = params.verificationClasses ?? "";
+        const missingClass = requiredClasses.find((className) => !new RegExp(`\\b${className}\\b`, "i").test(verificationClasses));
+        if (missingClass) {
+            return {
+                error: `verificationClasses must include canonical row "${missingClass}" because this milestone planned ${missingClass.toLowerCase()} verification`,
+            };
+        }
+    }
     // ── Resolve paths and render markdown ────────────────────────────────
     // #4761: route through the canonical-root resolver so that when a live
     // worktree exists for this milestone, validation reads/writes the