v1.91.2.0 fix: consolidate gstack reliability wave (#2959)

* fix(memory-ingest): --scan-secrets scans the rendered page and fails closed

--scan-secrets ran gitleaks on the raw transcript .jsonl, then imported a
page rendered from it. gitleaks' assignment rules don't match across a
JSON-escaped quote (KEY=\"v\" on disk), so a secret the rendered page
shows as KEY="v" was imported unflagged. And the gate skipped a file only
on scanner "gitleaks" with findings, so a scan that errored (non-zero
exit, 16MB maxBuffer overflow on a file with many findings, unparseable
report) or could not run (gitleaks missing, slow-probe cooldown) imported
the file unscanned.

Scan the rendered page body, the exact bytes writeStaged() writes, via a
new secretScanText() helper, and skip the file whenever the scan did not
complete. Skipped files stay out of the state file, so the next run
retries them. Reword the helper warnings and setup-gbrain/memory.md,
which described the fail-open as intended.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* fix(test): reconcile Bun failure markers and footer counts

* fix(sync-gbrain): verify source-scoped reads without mutation

* fix(test): recognize grounded TTHW target choices structurally

* fix(aside): make the readiness probe work under zsh and report why it failed

The probe built its deadline into `_T` and expanded it unquoted, so
`$_T aside repl …` only worked in a shell that word-splits. zsh does not: it
looked for a command literally named "gtimeout 30", the probe answered
ASIDE_NOT_RUNNING with Aside installed and ready, and every browsing skill
fell back to the bundled Chromium in silence. zsh is the macOS default and
Aside is macOS-only, so on a stock Mac the probe could never report READY.

The deadline becomes a function, `_gs_d`. It receives the command as "$@",
already split, so sh, bash and zsh all behave the same, and the gtimeout →
timeout → perl alarm chain is unchanged. A 4th arm runs the call unbounded
when none of the three is present, which is what the empty `_T` did before.
Not `eval`: it re-parses the string, so the parens and `;` of the perl arm
become syntax and that arm dies in bash *and* zsh — on a stock Mac, the arm
that actually runs.

On failure the probe now prints the CLI's reason after ASIDE_NOT_RUNNING:,
the shape gstack-render already uses: the first line that starts with a
capital letter, i.e. the CLI's own sentence or Node's `Error:` line below its
loader frame. "Not running" covers states with different fixes — no window
open for the profile, a NODE_OPTIONS preload that kills the CLI — and a bare
verdict sent all of them to "open the Aside app". The BROWSER SETUP prose
quotes that reason before asking the user to open the app.

The text pin asserted the broken invocation verbatim, so it now pins the
function and asserts neither `$_T aside repl` nor an eval form comes back. A
second test executes the rendered probe in sh, bash and zsh on each of the
four deadline arms with stubbed binaries on a narrowed PATH, plus two failing
CLIs: one that prints its own sentence, one that crashes like Node with the
useful line below the frame.

The deadline function costs zero bytes against the lines it replaces; the
reason costs 53 per copy of the probe (44 where the reworded BROWSER SETUP
line gives 9 back). That moves four guards by the measured amount:
plan-devex-review's skeleton cap to 68,550 (measured 68,544), plan-ceo-review's
skeleton cap to 80,150 (measured 80,111) and union ratio to 1.081 (measured
1.0803), and plan-eng-review's union ratio to 1.151 (measured 1.1504).

Fixes #2842, #2941.

* Clarify engineering review startup and decision flow

* Fix Windows readiness fixture PATH and command shim

* fix(test): recognize grounded TTHW target choices structurally

* Clarify engineering review startup and decision flow

* fix(test): restrict QA-only fixture tools to its no-Edit contract

* v1.90.0.0 fix(sync-gbrain): guard readiness verdicts and refresh metadata

* fix(browse): validate canonical upload targets

* fix(gbrain): classify structured PGLite busy response

* fix(browse): preserve native extension runtime APIs

* Fix displayless browser handoff ownership

* Accept unique installed autoplan methodology aliases

* fix(skills): preserve positional literals during installation

* fix(browse): checksum installer contents through stdin

* fix(test): normalize Windows checksum fixture paths

* test: emulate unavailable shasum in Windows checksum fixture

* fix(investigate): preserve owned freeze lifecycle

* fix(review): preserve N+1 retry and Red Team completion

* fix: bound Aside readiness and preserve safe fallback

* test: exercise setup and Chromium on native ARM

* fix: preserve install ownership and ARM browser selection

* Fix gbrain ingest scan boundaries and seed observation

* Refresh managed ship hooks and supervise expanded paid census

* Reject resumed gbrain pages excluded by current policy

* Recover zombie agent locks safely and enable CI Python venv

* Repair paid actor declarations and Aside pitch assertions

* Bump consolidated wave to next free minor release

* Clarify CEO review admin choices and option tradeoffs

* Preserve CEO mode handoff anchors in clarified workflow

* Make Windows portability fixtures use shell-native paths

* Restore ARM Bun alias and clarify ship review gates

* Refresh ship workflow golden snapshots

* Fix Windows DX documentation controls without piped stdin

* Decode Codex child pipes without Bun's encoded-stream stall

* Bound DX pre-review audit before product questions

* Clarify trusted review-start read in paid revalidation

* Bump consolidated wave to next free minor release

* Clarify CEO review admin choices and option tradeoffs

* Preserve CEO mode handoff anchors in clarified workflow

* Make Windows portability fixtures use shell-native paths

* Restore ARM Bun alias and clarify ship review gates

* Refresh ship workflow golden snapshots

* Fix Windows DX documentation controls without piped stdin

* Decode Codex child pipes without Bun's encoded-stream stall

* Bound DX pre-review audit before product questions

* Clarify trusted review-start read in paid revalidation

* Reconcile new main planning flow and paid judge census

* fix: reconcile rebased planning and source-bound validation

* test: pin cookie workflow judge to scored Sonnet model

* fix: keep terminal agent boot out of module imports

* fix: preserve pending-question uncertainty in engineering review

* fix: stabilize Windows reliability-wave fixtures

* fix: clarify design consultation research workflow

* fix: preserve independent design consultation inputs

* fix: resolve design taste scope and browser research guidance

* fix: make consultation opt-in preflight unambiguous

* test: await native Edge owner readiness or terminal result

---------

Co-authored-by: Bruce Krysiak <brucek@alum.mit.edu>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Antonio Vitalic <antoninte99@gmail.com>

test/plan-floor-review.test.ts

@@ -127,6 +127,85 @@ test('an exhausted deadline starts no assessment process',()=>{
  let calls=0;expect(()=>judgePlanFloorReview(review(),{binary:'fake',model:'warmup',deadlineAt:Date.now()-1,invoke:(()=>{calls++;}) as any})).toThrow('deadline');expect(calls).toBe(0);
 });
 
+const tthwReview = ():PlanFloorReview=>({seed:FORCING_FLOOR_DEVEX,candidate:{transport:'native',
+ identity:'7cee1bbe-26cc-4121-8f27-131f5972a544:toolu_01FtAP1GCpoKcCYMzQHQZJ7q:question:0',question:{
+ header:'TTHW target', multiSelect:false,
+ question:'D2 — Which TTHW target should this journey be measured against?\nProject/branch/task: gstack-plan-count-4q6Zyp on main, PLAN.md SDK quickstart, DX POLISH mode.\nELI10: TTHW (time to hello world) is the clock from opening the quickstart to the first SDK call that works. For your first-time developer, the declared 8 steps take an estimated 35-80 minutes of hands-on work plus an unbounded wait for a human to email back a key.',
+ options:[
+  {label:'A) Champion (< 2 min)',description:'✅ Stripe-tier bar; every remaining step looks indefensible\n✅ Puts key and database questions on the table now\n❌ Not reachable via docs alone; key email, Postgres, clone-first are all outside POLISH'},
+  {label:'B) Competitive (2-5 min) (recommended)',description:'✅ Peer baseline your developer expects\n✅ Shows which gaps docs polish closes vs needs a process decision\n❌ Still blocked by emailed key and local Postgres; POLISH lands ~20-40 min + wait'},
+  {label:'C) Current trajectory',description:'✅ Zero process change needed; review sharpens the 8 steps as written\n✅ No pressure on processes you may not control\n❌ Accepts red-flag tier; predicted 50-70% abandonment stays'},
+  {label:"D) Tell me what's realistic",description:"✅ You know key issuance and infra constraints I can't see\n✅ Your number becomes the declared clock\n❌ One more round trip before the passes"},
+ ]}}});
+const firstSdkCallReview = ():PlanFloorReview=>({seed:FORCING_FLOOR_DEVEX,candidate:{transport:'native',
+ identity:'b191254c-1571-465a-a49b-e2c10019bfc2:toolu_0153xwUmLKBghW6M6mQEqEG4:question:0',question:{
+ header:'TTHW target',multiSelect:false,
+ question:'D2 — Which time-to-first-call target should this review hold the plan to?\nProject/branch/task: gstack-plan-count-M3R8Qq on main, /plan-devex-review of PLAN.md in DX POLISH mode.\nELI10: TTHW (time to hello world) is the clock from reading Step 1 to a first SDK call that returns something the developer understands. For this persona the estimate is ~25-40 min of active work plus an unbounded wait for an emailed key (8 declared steps, ~12 actions). Reported peers (Stripe, Twilio) sit near 3 min, but they start hosted with an instant key, so the clocks are not equivalent. The target decides what "done" means for every later score.',
+ options:[
+  {label:'A) Champion (< 2 min)',description:'✅ Matches the reported leaders; first call before the developer loses interest. ✅ Forces the three peer-divergent choices onto the table. ❌ Infeasible without hosted sandbox or instant key: scope expansion outside POLISH.'},
+  {label:'B) Competitive (2-5 min)',description:'✅ Reachable if key issuance is automated and Postgres is not required pre-call. ✅ Keeps the repo-clone model, no hosted service. ❌ Requires removing Step 4 or 7 from the pre-call path, a scope change you marked undecided.'},
+  {label:'C) Current trajectory, polished (recommended)',description:'✅ Honors supplied scope; all 8 steps get verify checks, exact commands, named failures. ✅ Key wait disclosed with expected turnaround. ❌ Stays in the >10 min red-flag tier regardless of doc quality.'},
+  {label:"D) Tell me what's realistic",description:'✅ You know the key turnaround and infra constraints. ✅ A real number replaces my estimate in the report. ❌ Needs you to supply a target and reasoning now.'},
+ ]}}});
+test.each(['first SDK call','first API call','first successful call','first call'])('target choice grounds the journey in its %s action without requiring a quickstart label',action=>{
+ const input=firstSdkCallReview(),q=(input.candidate as any).question;q.question=q.question.replace('first SDK call',action);
+ const before=structuredClone(input);let calls=0;
+ const actual=judgePlanFloorReview(input,{binary:'fake',model:'warmup',deadlineAt:Date.now()+30_000,
+  invoke:(()=>{calls++;throw Error('must not launch');}) as any});
+ expect(actual).toMatchObject({kind:'finding',questionQuote:'Which time-to-first-call target should this review hold the plan to?',optionIndex:1,optionQuote:q.options[0].label});
+ expect(validatePlanFloorAssessment(input,actual)).toEqual(actual);expect(calls).toBe(0);expect(input).toEqual(before);
+});
+test.each([
+ ['setup',(q:any)=>q.question='D2 — Which review mode should we use?\n'+q.question],
+ ['unrelated',(q:any)=>q.question='D2 — Should we add dark mode?\n'+q.question],
+ ['history',(q:any)=>q.question='Previously asked: '+q.question],
+ ['non-target labels',(q:any)=>q.options.forEach((o:any,i:number)=>o.label=['Champion reviewer','Competitive analysis','Review mode','Continue'][i])],
+ ['metric name alone',(q:any)=>q.question=q.question.split('\n')[0]+'\nThere is a wait for an emailed key.'],
+ ['missing key obstacle',(q:any)=>q.question=q.question.split('\n')[0]+'\nThis is the first SDK call.'],
+] as const)('first-call context retains the %s boundary',(_label,change)=>{
+ const input=firstSdkCallReview();change((input.candidate as any).question);let calls=0;
+ const actual=judgePlanFloorReview(input,{binary:'fake',model:'warmup',deadlineAt:Date.now()+30_000,
+  invoke:(()=>{calls++;return {status:0,stdout:JSON.stringify({kind:'uncertain',seedId:null,questionId:null,optionId:null,reason:'Adversarial first-call control requires assessment.'}),stderr:''};}) as any});
+ expect(calls).toBe(1);expect(actual.kind).toBe('uncertain');
+});
+test.each([
+ 'Which TTHW target should this quickstart be measured against?',
+ 'Which TTHW target should this journey be measured against?',
+ 'What time-to-first-call target should we use for this onboarding flow?',
+ 'Which Time-to-Hello-World target fits this SDK journey?',
+])('current target-choice structure is a finding without an answer: %s', brief=>{
+ const input=tthwReview(),q=(input.candidate as Extract<PlanFloorReview['candidate'],{transport:'native'}>).question;
+ q.question=q.question.replace(q.question.split('\n')[0]!,`D2 — ${brief}`);
+ const before=structuredClone(input);let calls=0;
+ const actual=judgePlanFloorReview(input,{binary:'fake',model:'warmup',deadlineAt:Date.now()+30_000,
+  invoke:(()=>{calls++;throw Error('must not launch');}) as any});
+ expect(actual).toMatchObject({kind:'finding',questionQuote:brief,optionIndex:1,optionQuote:q.options[0]!.label});
+ expect(validatePlanFloorAssessment(input,actual)).toEqual(actual);
+ expect(calls).toBe(0);expect(input).toEqual(before);
+ expect(pickPlanFloorMode('plan-devex-review',q)).toBeNull();expect(pickPlanFloorProductType(q,'sdk-documentation')).toBeNull();
+});
+test.each([
+ ['setup with target in context',(q:any)=>q.question='D2 — Which review mode should we use?\n'+q.question],
+ ['unrelated current decision',(q:any)=>q.question='D2 — Should we add dark mode?\n'+q.question],
+ ['historical quoted question',(q:any)=>q.question='Previously asked: '+q.question],
+ ['historical target selection',(q:any)=>q.question=q.question.replace(/should this \w+ be measured against/,'did we choose yesterday')],
+ ['non-target labels',(q:any)=>q.options.forEach((o:any,i:number)=>o.label=['Champion reviewer','Competitive analysis','Review mode','Continue'][i])],
+ ['setup labels with target descriptions',(q:any)=>q.options.forEach((o:any,i:number)=>{o.label=['DX POLISH','DX TRIAGE','DX EXPANSION','Skip review'][i];o.description+=' Competitive target under 10 min; measured wait.';})],
+ ['missing quickstart evidence',(q:any)=>q.question=q.question.split('\n')[0]],
+] as const)('%s receives no deterministic finding credit',(_label,change)=>{
+ const input=tthwReview(),q=(input.candidate as any).question;
+ q.question=q.question.replace('this journey','this quickstart');change(q);let calls=0;
+ const actual=judgePlanFloorReview(input,{binary:'fake',model:'warmup',deadlineAt:Date.now()+30_000,
+  invoke:(()=>{calls++;return {status:0,stdout:JSON.stringify({kind:'uncertain',seedId:null,questionId:null,optionId:null,reason:'Adversarial control requires assessment.'}),stderr:''};}) as any});
+ expect(calls).toBe(1);expect(actual.kind).toBe('uncertain');
+});
+test('a current TTHW choice without the owned seed evidence is not deterministic',()=>{
+ const input=tthwReview();input.seed='A different plan: add dark mode to the dashboard.';let calls=0;
+ const actual=judgePlanFloorReview(input,{binary:'fake',model:'warmup',deadlineAt:Date.now()+30_000,
+  invoke:(()=>{calls++;return {status:0,stdout:JSON.stringify({kind:'unrelated',seedId:null,questionId:null,optionId:null,reason:'Different seed.'}),stderr:''};}) as any});
+ expect(calls).toBe(1);expect(actual.kind).toBe('unrelated');
+});
+
 test('citations retain exact source wrapping and quotes without accepting rewritten evidence',()=>{
  const input=review(),assessment=resolvePlanFloorCitations(input,citationFinding());
  expect(assessment.seedQuote).toContain('current pricing\nis actually a barrier');