v1.91.2.0 fix: consolidate gstack reliability wave (#2959)

* fix(memory-ingest): --scan-secrets scans the rendered page and fails closed

--scan-secrets ran gitleaks on the raw transcript .jsonl, then imported a
page rendered from it. gitleaks' assignment rules don't match across a
JSON-escaped quote (KEY=\"v\" on disk), so a secret the rendered page
shows as KEY="v" was imported unflagged. And the gate skipped a file only
on scanner "gitleaks" with findings, so a scan that errored (non-zero
exit, 16MB maxBuffer overflow on a file with many findings, unparseable
report) or could not run (gitleaks missing, slow-probe cooldown) imported
the file unscanned.

Scan the rendered page body, the exact bytes writeStaged() writes, via a
new secretScanText() helper, and skip the file whenever the scan did not
complete. Skipped files stay out of the state file, so the next run
retries them. Reword the helper warnings and setup-gbrain/memory.md,
which described the fail-open as intended.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(test): reconcile Bun failure markers and footer counts

* fix(sync-gbrain): verify source-scoped reads without mutation

* fix(test): recognize grounded TTHW target choices structurally

* fix(aside): make the readiness probe work under zsh and report why it failed

The probe built its deadline into `_T` and expanded it unquoted, so
`$_T aside repl …` only worked in a shell that word-splits. zsh does not: it
looked for a command literally named "gtimeout 30", the probe answered
ASIDE_NOT_RUNNING with Aside installed and ready, and every browsing skill
fell back to the bundled Chromium in silence. zsh is the macOS default and
Aside is macOS-only, so on a stock Mac the probe could never report READY.

The deadline becomes a function, `_gs_d`. It receives the command as "$@",
already split, so sh, bash and zsh all behave the same, and the gtimeout →
timeout → perl alarm chain is unchanged. A 4th arm runs the call unbounded
when none of the three is present, which is what the empty `_T` did before.
Not `eval`: it re-parses the string, so the parens and `;` of the perl arm
become syntax and that arm dies in bash *and* zsh — on a stock Mac, the arm
that actually runs.

On failure the probe now prints the CLI's reason after ASIDE_NOT_RUNNING:,
the shape gstack-render already uses: the first line that starts with a
capital letter, i.e. the CLI's own sentence or Node's `Error:` line below its
loader frame. "Not running" covers states with different fixes — no window
open for the profile, a NODE_OPTIONS preload that kills the CLI — and a bare
verdict sent all of them to "open the Aside app". The BROWSER SETUP prose
quotes that reason before asking the user to open the app.

The text pin asserted the broken invocation verbatim, so it now pins the
function and asserts neither `$_T aside repl` nor an eval form comes back. A
second test executes the rendered probe in sh, bash and zsh on each of the
four deadline arms with stubbed binaries on a narrowed PATH, plus two failing
CLIs: one that prints its own sentence, one that crashes like Node with the
useful line below the frame.

The deadline function costs zero bytes against the lines it replaces; the
reason costs 53 per copy of the probe (44 where the reworded BROWSER SETUP
line gives 9 back). That moves four guards by the measured amount:
plan-devex-review's skeleton cap to 68,550 (measured 68,544), plan-ceo-review's
skeleton cap to 80,150 (measured 80,111) and union ratio to 1.081 (measured
1.0803), and plan-eng-review's union ratio to 1.151 (measured 1.1504).

Fixes #2842, #2941.

* Clarify engineering review startup and decision flow

* Fix Windows readiness fixture PATH and command shim

* fix(test): recognize grounded TTHW target choices structurally

* Clarify engineering review startup and decision flow

* fix(test): restrict QA-only fixture tools to its no-Edit contract

* v1.90.0.0 fix(sync-gbrain): guard readiness verdicts and refresh metadata

* fix(browse): validate canonical upload targets

* fix(gbrain): classify structured PGLite busy response

* fix(browse): preserve native extension runtime APIs

* Fix displayless browser handoff ownership

* Accept unique installed autoplan methodology aliases

* fix(skills): preserve positional literals during installation

* fix(browse): checksum installer contents through stdin

* fix(test): normalize Windows checksum fixture paths

* test: emulate unavailable shasum in Windows checksum fixture

* fix(investigate): preserve owned freeze lifecycle

* fix(review): preserve N+1 retry and Red Team completion

* fix: bound Aside readiness and preserve safe fallback

* test: exercise setup and Chromium on native ARM

* fix: preserve install ownership and ARM browser selection

* Fix gbrain ingest scan boundaries and seed observation

* Refresh managed ship hooks and supervise expanded paid census

* Reject resumed gbrain pages excluded by current policy

* Recover zombie agent locks safely and enable CI Python venv

* Repair paid actor declarations and Aside pitch assertions

* Bump consolidated wave to next free minor release

* Clarify CEO review admin choices and option tradeoffs

* Preserve CEO mode handoff anchors in clarified workflow

* Make Windows portability fixtures use shell-native paths

* Restore ARM Bun alias and clarify ship review gates

* Refresh ship workflow golden snapshots

* Fix Windows DX documentation controls without piped stdin

* Decode Codex child pipes without Bun's encoded-stream stall

* Bound DX pre-review audit before product questions

* Clarify trusted review-start read in paid revalidation

* Bump consolidated wave to next free minor release

* Clarify CEO review admin choices and option tradeoffs

* Preserve CEO mode handoff anchors in clarified workflow

* Make Windows portability fixtures use shell-native paths

* Restore ARM Bun alias and clarify ship review gates

* Refresh ship workflow golden snapshots

* Fix Windows DX documentation controls without piped stdin

* Decode Codex child pipes without Bun's encoded-stream stall

* Bound DX pre-review audit before product questions

* Clarify trusted review-start read in paid revalidation

* Reconcile new main planning flow and paid judge census

* fix: reconcile rebased planning and source-bound validation

* test: pin cookie workflow judge to scored Sonnet model

* fix: keep terminal agent boot out of module imports

* fix: preserve pending-question uncertainty in engineering review

* fix: stabilize Windows reliability-wave fixtures

* fix: clarify design consultation research workflow

* fix: preserve independent design consultation inputs

* fix: resolve design taste scope and browser research guidance

* fix: make consultation opt-in preflight unambiguous

* test: await native Edge owner readiness or terminal result

---------

Co-authored-by: Bruce Krysiak <brucek@alum.mit.edu>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Antonio Vitalic <antoninte99@gmail.com>

plan-ceo-review/SKILL.md

@@ -500,19 +500,25 @@ Never skip Step 0, system audit, error/rescue map or failure modes.
 
 ## Web research runs in Aside
 
-When a step calls for looking something up on the web (competitors, current best practices, a known bug, prior art), do it through Aside's own agent first: it searches with the user's real browser, signed-in sessions included. If Aside is not ready, fall back to the WebSearch tool when this host provides one. If neither is available, say so once and continue on what you already know.
+For web research, do it through Aside's own agent first, using the user's signed-in browser. If Aside is not ready, fall back to the WebSearch tool when this host provides one.
 
-Check once per run that Aside is ready (if this skill already ran this same probe, in BROWSER SETUP or Third-Party Web Actions, reuse its answer):
+Check once (if this skill already ran this same probe, in BROWSER SETUP or Third-Party Web Actions, reuse its answer):
 
 ```bash
-_T=""; command -v gtimeout >/dev/null 2>&1 && _T="gtimeout 30"; [ -z "$_T" ] && command -v timeout >/dev/null 2>&1 && _T="timeout 30"
-[ -z "$_T" ] && command -v perl >/dev/null 2>&1 && _T="perl -e alarm(shift);exec(@ARGV) 30"
+_gs_d() { if command -v gtimeout >/dev/null; then gtimeout 30 "$@"; elif command -v timeout >/dev/null; then timeout 30 "$@"
+elif command -v perl >/dev/null; then perl -e 'alarm(shift);exec(@ARGV)' 30 "$@"; else return 125; fi; }
 if [ "${GSTACK_SKIP_ASIDE:-}" = "1" ] || ! command -v aside >/dev/null 2>&1; then
   echo "NEEDS_ASIDE"
-elif $_T aside repl 'console.log("ASIDE_READY " + pwd)' 2>&1 | grep -q '^ASIDE_READY'; then
-  echo "READY: aside $(aside --version 2>/dev/null)"
 else
-  echo "ASIDE_NOT_RUNNING"
+  _rc=0; _o=$(_gs_d aside repl 'console.log("ASIDE_READY " + pwd)' 2>&1) || _rc=$?
+  case "$_rc" in
+    124|142) echo "ASIDE_TIMEOUT: probe deadline exceeded" ;;
+    125) echo "ASIDE_UNAVAILABLE: bounded probe unavailable" ;;
+    0) if printf '%s\n' "$_o" | grep -q '^ASIDE_READY '; then echo "READY: aside"
+       else echo "ASIDE_NOT_RUNNING: no readiness marker"; fi ;;
+    *) echo "ASIDE_CLI_ERROR: exit $_rc; inspect aside --help locally" ;;
+  esac
+  unset _o
 fi
 ```
 
@@ -523,7 +529,7 @@ fi
   _aside_exec "Search the web for <query>. Read-only: do not sign in, submit, or change anything. Reply with <format, e.g. up to 8 bullets, each with its source URL>, then stop."
   ```
 
-- `NEEDS_ASIDE` or `ASIDE_NOT_RUNNING`: run the same queries with the WebSearch tool if this host provides it — same read-only intent, same untrusted-content rule. If it does not, skip the research and say once: "Search unavailable — proceeding with in-distribution knowledge only." Never install Aside yourself; mention aside.com at most once per run. The rest of the skill continues.
+- Any non-READY result: report only the safe status, never raw diagnostics. Run the same queries with the WebSearch tool if available, still read-only and untrusted. Otherwise say once: "Search unavailable — proceeding with in-distribution knowledge only." Never install Aside yourself; mention aside.com at most once per run. Continue the skill.
 
 Sanitize every query before it leaves the machine: strip hostnames, IPs, file paths, SQL fragments, and anything that looks like a secret. Search for the error class and the library, not the user's data.
 
@@ -832,7 +838,7 @@ run Section 11 only for UI. Strategy-only uses capability-level rows and
 Implementation-ready names interfaces, codepaths, rescue behavior and tests.
 For one narrow decision, apply every section to that choice and its dependencies.
 
-**Keep the stated limits.** Record each measure, value, unit and prerequisite. Count all deliverables, including reused code. Changing a limit needs evidence and user approval.
+**Keep the stated limits.** Record each measure, value, unit and prerequisite. Count all deliverables, including reused code, as scope; 0E estimates only files that will change. Changing a limit needs evidence and user approval.
 
 **Storage policy: choose before writing.** Honor user/host artifact and cleanup
 limits. One working plan: requested output, else reviewed plan, else host active
@@ -851,8 +857,9 @@ ExitPlanMode or next-skill handoff.
 | 0H spec-review metrics | Stop with the cause; reviewer availability does not waive this write. |
 | Review, decision and question history logs | Report cause and unsaved fields; continue. The plan's ledger is still required. |
 
-Paths: CEO archive = `CEO_PLANS` (0H), tasks =
-`~/.gstack/projects/`, metrics = `~/.gstack/analytics/`; log helpers choose theirs.
+Paths are per output: resolve the CEO archive as `CEO_PLANS` in 0H; tasks
+use `~/.gstack/projects/`, metrics use `~/.gstack/analytics/`, and log helpers
+choose their own paths. Do not substitute the CEO archive root for these paths.
 
 Keep one decision ledger through Step 0, Spec Review Loop and Outside Voice:
 
@@ -885,7 +892,9 @@ With no required choice, or after those choices settle, go to 0E.
 **Choose the question's route first:**
 - **Admin question:** mode, setup, navigation, document approval or promotion.
   Use its listed menu and the preamble question transport, then wait and record
-  the answer. Skip steps 1–4; this approves no plan changes.
+  the answer. Skip steps 1–4; this approves no plan changes. For mode selection,
+  0E defines the four-option menu and any authorized automatic preference;
+  neither needs a plan-decision row, comparison grid or completeness score.
 - **Plan decision:** review-depth expansion, scope additions/cuts, approach
   choices, TODOs, specs and review/outside findings. Start at step 1. Reuse exact
   prior approvals; run steps 2–4 only when a new answer is needed, even for one option.
@@ -921,9 +930,12 @@ Build one `currentDecision` using these fields and the preamble format:
 | `header` and option labels | Final native text within host limits; exactly one label includes `(recommended)`. |
 | Each option's `description` | A 1–2 sentence summary; S/M/L/XL effort, low/medium/high risk, reuse, verification coverage, at least 2 ✅ pros and 1 ❌ con. Apply the preamble's minimum lengths and destructive-choice exception. |
 
-Without a prescribed menu, offer 2–3 options (prefer 3 for non-trivial plans).
+For a plan decision without a prescribed menu, offer 2–3 options (prefer 3 for
+non-trivial plans). This default does not replace an admin or scope menu.
 For an option with no implementation, use effort S and state zero implementation
-work, never effort 0. Weigh diff size and long-term architecture equally, including rewrites.
+work, never effort 0. Weigh diff size and long-term architecture equally,
+including rewrites: state the immediate changed-file cost and the future
+maintenance cost for each option, then explain both in the recommendation.
 
 In Proposed, compare every commitment in the labels, descriptions and pros/cons:
 
@@ -1002,9 +1014,9 @@ Follow the preamble's session rules; `CONDUCTOR_SESSION: true` changes transport
    In the Recommendation's `because` clause, connect a concrete plan fact or
    constraint to this mode's actual benefit or tradeoff. Count/category alone
    is not a reason.
-3. Resolve that recommendation. When `QUESTION_TUNING: true`, first check
-   `question_id=plan-ceo-review-mode` through the preamble. A check that exits 0
-   with `AUTO_DECIDE` selects the recommendation; go to the automatic handoff in
+3. Resolve that recommendation. Mode selection is an admin choice, not a plan
+   decision. When `QUESTION_TUNING: true`, first check `question_id=plan-ceo-review-mode` through the preamble.
+   A check that exits 0 with `AUTO_DECIDE` selects the recommendation; go to the automatic handoff in
    step 4. When tuning is false, omit the lookup.
    Without that successful check, offer all four modes in one AskUserQuestion,
    using step 2's recommendation. **STOP for the answer**; the user's choice
@@ -1020,7 +1032,9 @@ Record mode provenance after the handoff:
 - **Successful preference check:** result and recommendation; log `plan-ceo-review-mode`, `auto_decided: true`.
 - **Actual question answer:** question, answer reference and mode; log `auto_decided: false`, including the question ID only when `QUESTION_TUNING: true`.
 
-If no new 0D choice: "No new approach decision was needed". Ask before changing mode.
+If 0D needed no approach choice, say "No new approach decision was needed" after
+the mode handoff. This records no plan decision, not automatic mode approval.
+Ask before changing a previously chosen mode.
 
 Selecting a mode does not approve changes. Preserve 0D approvals and ask about
 each proposed addition or cut, including those prompted by file-count thresholds.
@@ -1138,6 +1152,9 @@ Repo: {owner/repo}
 
 ## Deferred to TODOS.md
 - {items with context}
+
+## Reviewer Concerns
+- {unresolved spec-review issues with their owning input, or "None"}
 ```
 
 #### Spec Review Loop
@@ -1188,7 +1205,8 @@ Recording the **0H spec-review metrics** is
 required when writing is permitted, even if the reviewer failed. Append the
 actual outcome below; failed mkdir or append stops the review. When writing is
 forbidden, show the actual fields as not persisted and continue without writing.
-Reviewer failure therefore continues here; required storage failure stops here.
+If the reviewer fails, report that limit and continue after recording the outcome;
+if a required save fails, stop before claiming completion.
 ```bash
 mkdir -p ~/.gstack/analytics || exit 1
 echo '{"skill":"plan-ceo-review","ts":"'$(date -u +%Y-%m-%dT%H:%M:%SZ)'","iterations":ITERATIONS,"issues_found":FOUND,"issues_fixed":FIXED,"remaining":REMAINING,"quality_score":SCORE}' >> ~/.gstack/analytics/spec-review.jsonl || exit 1

plan-ceo-review/SKILL.md.tmpl

@@ -221,7 +221,7 @@ run Section 11 only for UI. Strategy-only uses capability-level rows and
 Implementation-ready names interfaces, codepaths, rescue behavior and tests.
 For one narrow decision, apply every section to that choice and its dependencies.
 
-**Keep the stated limits.** Record each measure, value, unit and prerequisite. Count all deliverables, including reused code. Changing a limit needs evidence and user approval.
+**Keep the stated limits.** Record each measure, value, unit and prerequisite. Count all deliverables, including reused code, as scope; 0E estimates only files that will change. Changing a limit needs evidence and user approval.
 
 **Storage policy: choose before writing.** Honor user/host artifact and cleanup
 limits. One working plan: requested output, else reviewed plan, else host active
@@ -240,8 +240,9 @@ ExitPlanMode or next-skill handoff.
 | 0H spec-review metrics | Stop with the cause; reviewer availability does not waive this write. |
 | Review, decision and question history logs | Report cause and unsaved fields; continue. The plan's ledger is still required. |
 
-Paths: CEO archive = `CEO_PLANS` (0H), tasks =
-`~/.gstack/projects/`, metrics = `~/.gstack/analytics/`; log helpers choose theirs.
+Paths are per output: resolve the CEO archive as `CEO_PLANS` in 0H; tasks
+use `~/.gstack/projects/`, metrics use `~/.gstack/analytics/`, and log helpers
+choose their own paths. Do not substitute the CEO archive root for these paths.
 
 Keep one decision ledger through Step 0, Spec Review Loop and Outside Voice:
 
@@ -274,7 +275,9 @@ With no required choice, or after those choices settle, go to 0E.
 **Choose the question's route first:**
 - **Admin question:** mode, setup, navigation, document approval or promotion.
   Use its listed menu and the preamble question transport, then wait and record
-  the answer. Skip steps 1–4; this approves no plan changes.
+  the answer. Skip steps 1–4; this approves no plan changes. For mode selection,
+  0E defines the four-option menu and any authorized automatic preference;
+  neither needs a plan-decision row, comparison grid or completeness score.
 - **Plan decision:** review-depth expansion, scope additions/cuts, approach
   choices, TODOs, specs and review/outside findings. Start at step 1. Reuse exact
   prior approvals; run steps 2–4 only when a new answer is needed, even for one option.
@@ -310,9 +313,12 @@ Build one `currentDecision` using these fields and the preamble format:
 | `header` and option labels | Final native text within host limits; exactly one label includes `(recommended)`. |
 | Each option's `description` | A 1–2 sentence summary; S/M/L/XL effort, low/medium/high risk, reuse, verification coverage, at least 2 ✅ pros and 1 ❌ con. Apply the preamble's minimum lengths and destructive-choice exception. |
 
-Without a prescribed menu, offer 2–3 options (prefer 3 for non-trivial plans).
+For a plan decision without a prescribed menu, offer 2–3 options (prefer 3 for
+non-trivial plans). This default does not replace an admin or scope menu.
 For an option with no implementation, use effort S and state zero implementation
-work, never effort 0. Weigh diff size and long-term architecture equally, including rewrites.
+work, never effort 0. Weigh diff size and long-term architecture equally,
+including rewrites: state the immediate changed-file cost and the future
+maintenance cost for each option, then explain both in the recommendation.
 
 In Proposed, compare every commitment in the labels, descriptions and pros/cons:
 
@@ -391,9 +397,9 @@ Follow the preamble's session rules; `CONDUCTOR_SESSION: true` changes transport
    In the Recommendation's `because` clause, connect a concrete plan fact or
    constraint to this mode's actual benefit or tradeoff. Count/category alone
    is not a reason.
-3. Resolve that recommendation. When `QUESTION_TUNING: true`, first check
-   `question_id=plan-ceo-review-mode` through the preamble. A check that exits 0
-   with `AUTO_DECIDE` selects the recommendation; go to the automatic handoff in
+3. Resolve that recommendation. Mode selection is an admin choice, not a plan
+   decision. When `QUESTION_TUNING: true`, first check `question_id=plan-ceo-review-mode` through the preamble.
+   A check that exits 0 with `AUTO_DECIDE` selects the recommendation; go to the automatic handoff in
    step 4. When tuning is false, omit the lookup.
    Without that successful check, offer all four modes in one AskUserQuestion,
    using step 2's recommendation. **STOP for the answer**; the user's choice
@@ -409,7 +415,9 @@ Record mode provenance after the handoff:
 - **Successful preference check:** result and recommendation; log `plan-ceo-review-mode`, `auto_decided: true`.
 - **Actual question answer:** question, answer reference and mode; log `auto_decided: false`, including the question ID only when `QUESTION_TUNING: true`.
 
-If no new 0D choice: "No new approach decision was needed". Ask before changing mode.
+If 0D needed no approach choice, say "No new approach decision was needed" after
+the mode handoff. This records no plan decision, not automatic mode approval.
+Ask before changing a previously chosen mode.
 
 Selecting a mode does not approve changes. Preserve 0D approvals and ask about
 each proposed addition or cut, including those prompted by file-count thresholds.
@@ -527,6 +535,9 @@ Repo: {owner/repo}
 
 ## Deferred to TODOS.md
 - {items with context}
+
+## Reviewer Concerns
+- {unresolved spec-review issues with their owning input, or "None"}
 ```
 
 {{SPEC_REVIEW_LOOP}}

plan-ceo-review/sections/review-sections.md

@@ -829,8 +829,9 @@ Use the full mode name from Step 0E; replace spaces with underscores only in the
 review log's `MODE` field. "System Audit" summarizes repository findings from
 Step 0 and the review sections. "Lake Score" counts complete options selected:
 Y is the number of answered coverage questions offering a 10/10 option; X is
-how many selected that option. Report X/Y, excluding kind-only and unanswered
-questions; use `N/A` when Y is zero.
+how many selected that option. Count a reopened choice only once, using its
+latest answered option; superseded answers add nothing. Exclude kind-only and
+unanswered questions; use `N/A` when Y is zero.
 
 ```
   +====================================================================+

plan-ceo-review/sections/review-sections.md.tmpl

@@ -451,8 +451,9 @@ Use the full mode name from Step 0E; replace spaces with underscores only in the
 review log's `MODE` field. "System Audit" summarizes repository findings from
 Step 0 and the review sections. "Lake Score" counts complete options selected:
 Y is the number of answered coverage questions offering a 10/10 option; X is
-how many selected that option. Report X/Y, excluding kind-only and unanswered
-questions; use `N/A` when Y is zero.
+how many selected that option. Count a reopened choice only once, using its
+latest answered option; superseded answers add nothing. Exclude kind-only and
+unanswered questions; use `N/A` when Y is zero.
 
 ```
   +====================================================================+