v1.91.7.0 feat: add functional QA and pre-publication docs checks (#2983)

* feat: add surface-aware exploratory QA and ship documentation gates

* test: preserve delegated QA setup authority after main integration

* fix(qa): clarify exploration order and preserve report artifacts

* test(qa): follow the shared setup reference directly

* refactor(ship): make verification and recovery routes explicit

* test(ship): align evidence and review guards with explicit routes

* fix(workflows): clarify ship recovery and functional QA evidence

* fix(workflows): clarify approval recovery and full QA coverage

* refactor(workflows): order review transactions and clarify ship state

* fix(ship): clarify final verification and fail closed at publication

* fix(evals): attribute native atomic documentation writes

* fix(ship): clarify recovery and documentation lifecycle guidance

* fix(test): preserve observed native placeholder styling in CI

* fix(codex): report watchdog timeouts without a process-exit race

* Checkpoint functional QA implementation and workflow validation repairs

* Fix documentation and shared-review fixture contracts

* docs: clarify judge reuse and evaluation supervision

* test: align review evidence and selected case contracts

* test: verify append-only documentation checkpoints and recovery

* fix: qualify QA workflows and CI validation repairs

* fix: launch shared-libs fixture scripts on Windows

* fix: qualify QA deadlines, fixture isolation, and shard cleanup

* fix: preserve qualified QA and cancellation repairs

* fix: enforce functional fixture authority and share strict event decoding

* fix: retain free-test evidence and explain recovery

* fix: reject malformed native evidence after decoder consolidation

* test: use reliable capture for telemetry privacy filters

* test: refresh measured quick coverage and document validation costs

* Fix native fixture receipts and preserve VM validation evidence

* Align negative judge controls with upstream clarity policy

* Fix report-only QA preparation and public evidence handling

* Clarify QA-only preparation and current-report preservation

* Stream Ship quality judgments with an explicit 64k response contract

* Validate compact judge reasoning locally with supported wire schema

* Align functional QA fixture instructions with evidence acceptance

* Bind native browser diagnostics to execution evidence and align review verdicts

* Preserve native diagnostic line boundaries

* Serialize functional QA evidence from native captures

* Keep large QA evidence fixture payload out of Windows argv

bin/gstack-codex-probe

@@ -6,11 +6,11 @@
 #   _gstack_codex_auth_probe      — multi-signal auth check (env + file)
 #   _gstack_codex_model_probe     — round-trip probe of gstack's selected model (#2477)
 #   _gstack_codex_version_check   — warn on known-bad Codex CLI versions
-#   _gstack_codex_timeout_wrapper — gtimeout -> timeout -> unwrapped fallback
+#   _gstack_codex_timeout_wrapper — gtimeout -> timeout -> bash-native watchdog
 #   _gstack_codex_log_event       — telemetry emission to ~/.gstack/analytics/
 #
 # Hygiene rules (enforced by test/codex-hardening.test.ts):
-#   - Never set -e / set -u / trap / IFS= / PATH= in this file.
+#   - Never change -e / -u / traps / IFS / PATH in the caller shell.
 #   - All internal vars prefix with _GSTACK_CODEX_.
 #   - All functions prefix with _gstack_codex_.
 #   - No command execution at source time (only function defs).
@@ -195,19 +195,15 @@ _gstack_codex_timeout_wrapper() {
     # capture on the orphaned sleep.
     "$@" &
     local _cmd_pid=$!
-    ( sleep "$_duration" && kill -TERM "$_cmd_pid" 2>/dev/null ) >/dev/null 2>&1 &
+    ( sleep "$_duration" && trap '' TERM && kill -TERM "$_cmd_pid" 2>/dev/null && exit 124 ) >/dev/null 2>&1 &
     local _watch_pid=$!
     local _rc
     wait "$_cmd_pid"
     _rc=$?
-    if kill -0 "$_watch_pid" 2>/dev/null; then
-      # Command finished before the deadline. Retiring the watchdog subshell
-      # also defuses its pending kill (the `&& kill` lives in the subshell);
-      # its detached sleep expires harmlessly.
-      kill "$_watch_pid" 2>/dev/null
-      wait "$_watch_pid" 2>/dev/null
-    elif [ "$_rc" -ge 128 ]; then
-      _rc=124  # killed by the watchdog: report timeout(1)'s code
+    kill "$_watch_pid" 2>/dev/null
+    wait "$_watch_pid" 2>/dev/null
+    if [ "$?" -eq 124 ]; then
+      _rc=124
     fi
     return "$_rc"
   fi

bin/gstack-qa-deadline

@@ -0,0 +1,6 @@
+#!/usr/bin/env bun
+import { qaDeadlineMain } from '../lib/qa-deadline';
+
+const args = process.argv.slice(2);
+const worker = args[0] === '--receipt-worker';
+process.exit(await qaDeadlineMain(worker ? (process.send ? args.slice(1) : []) : args, worker && !!process.send));

bin/gstack-qa-evidence

@@ -0,0 +1,4 @@
+#!/usr/bin/env bun
+import { qaEvidenceMain } from '../lib/qa-evidence';
+
+process.exit(await qaEvidenceMain(process.argv.slice(2)));

bin/gstack-review-log

@@ -9,6 +9,8 @@
 # a model read the code. Caller-supplied binding fields are always discarded.
 # Plan-tier rows retain their legacy binding behavior.
 set -euo pipefail
+export GIT_OPTIONAL_LOCKS=0
+export GIT_CONFIG_PARAMETERS="${GIT_CONFIG_PARAMETERS:+$GIT_CONFIG_PARAMETERS }'core.fsmonitor=false' 'core.untrackedCache=false'"
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 eval "$("$SCRIPT_DIR/gstack-slug" 2>/dev/null)"
 GSTACK_HOME="${GSTACK_HOME:-$HOME/.gstack}"
@@ -27,6 +29,7 @@ case "$(uname -s)" in
     fi
     ;;
 esac
+export GSTACK_REVIEW_LOG="$GSTACK_REVIEW_DIR/$BRANCH-reviews.jsonl"
 
 # Compute binding fields (best-effort; empty outside a git repo).
 COMMIT_FULL=$(git rev-parse HEAD 2>/dev/null || true)
@@ -51,8 +54,15 @@ if [ "$INPUT" = --start ]; then
   '
   exit $?
 fi
+if [ "$INPUT" = --check-shared-libs ] && [ "$#" -eq 2 ]; then
+  GSTACK_REVIEW_TOKEN="$2" bun -e '
+    const { checkSharedLibsReuse } = await import(process.env.GSTACK_REVIEW_LIB);
+    console.log(JSON.stringify(checkSharedLibsReuse(JSON.parse(await Bun.stdin.text()), process.env.GSTACK_REVIEW_TOKEN)));
+  '
+  exit $?
+fi
 if [ "$#" -ne 1 ] && { [ "$#" -ne 3 ] || [ "${2:-}" != --finish ]; }; then
-  echo 'Usage: gstack-review-log JSON [--finish TOKEN] | --start SKILL' >&2
+  echo 'Usage: gstack-review-log JSON [--finish TOKEN] | --start SKILL | --check-shared-libs TOKEN < finding.json' >&2
   exit 1
 fi