mirror of
https://github.com/garrytan/gstack.git
synced 2026-11-02 06:54:50 +01:00
4527c9b93ff08568ddea052d2a004e38ab96d997
4
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Garry Tan
|
74512c20a7 |
v1.91.15.0 v1.91.15.0: Opus 5.5 prompt cleanup, behavior-level skill tests, transcript consent (#3017)
* fix(models): allowlist routing for model-pinned Claude families (W1) resolveModel lowercases input and strips one trailing [...] context marker. Opus 4.7, Opus 4.8 and Sonnet 5 keep their pinned overlay only for the bare ID, the bare ID plus an 8-digit date, and the bare ID plus -latest; any other suffix (point releases such as claude-sonnet-5-5, claude-opus-4-7-1) falls to the generic claude overlay. claude-opus-5-5 routes to claude explicitly (no new overlay, no new ALL_MODEL_NAMES entry). Fable keeps its prefix match while CLAUDE_FRONTIER_EVAL_MODEL is claude-fable-5-1, guarded by a test. Tests: one test/model-overlays.test.ts case per shape in the plan, plus the lowercase / [1m] marker / family-name cases and the Fable guard. * docs(CLAUDE.md): define when prompt bytes are a test contract (W7 prompt-byte rule) Adds the gstack-repo definition to the Testing section at normal volume: prompt bytes are a contract only when software reads them or a recorded eval shows the wording matters. Amends the test-value-bar line so 'prompt bytes' refers to that definition. scripts/resolvers/test-value.ts and docs/test-value-bar.md are unchanged. * fix(browse): sidebar tab hint names real tabs.json fields and how $B resolves (s11 H1, s11 M8, s11 M9) * fix(router): route telemetry uses the echoed SESSION_ID (s01 H1) $_SESSION_ID is never set in the router's bash block since bin/gstack-skill-start took over session bookkeeping, so every /gstack route event logged an empty session id. Use the literal SESSION_ID placeholder and tell the model to substitute the echoed value, matching the completion-status telemetry block. No W7a pins on the changed line. * docs(CLAUDE.md): correct stale test-infra facts (s01 H2, H3, H4, H5) H2: TREE_MUTATING is not empty; it still holds bootstrap-retention. H3: catalog ceiling is CATALOG_BUDGET_TOKEN_EQUIVALENTS (1,194), not 1,171. H4: detach timeouts point at package.json's --timeout values (gate is 49320s). H5: Writing Style lives in preamble/generate-writing-style.ts and the jargon list is Read at runtime, not baked at generation time. No W7a pins on the changed lines. * fix(preamble): drop the stale jargon-list count (s01 H6) The list has 77 terms, not 80+, and the model Reads the file anyway. No W7a pins on the changed text. * fix(overlay): claude.md dedicated-tools nudge stops naming tools the host may lack (s01 M1) The nudge named Glob and Grep, which some Claude hosts do not expose. It now names the host's dedicated file tools and its search tools when it has them, keeping the prefer-dedicated-tools behavior the claude-dedicated-tools-vs-bash overlay eval measures. Updates the prose comment at test/gen-skill-docs.test.ts:643 (comment only, no assertion change). The matching comment in test/fixtures/overlay-nudges.ts is left to its owner. * fix(preamble): progress notes on phase changes, not a [PROGRESS] cadence (s01 M2) Context Health told the model to periodically write a tagged [PROGRESS] summary. No code reads that tag; the line now says when to tell the user (finishing a phase or changing direction). Loop detection stays. W7a pin: test/terse-build.test.ts:103 pinned 'PROGRESS'; it now checks the default build emits a non-empty Context Health body (terse still emits ''). * fix(preamble): learnings review without incident archaeology (s01 M3) Drops the issue number, the 43-of-44 statistic and the ALWAYS caps from the Operational Self-Improvement step; keeps the rule that the review runs every time and that an empty result is stated explicitly. No W7a pins on the removed text. * docs(CLAUDE.md): fold 'Long-running tasks' into the detach section (s01 M4, CEO W4) The 'don't give up' section told agents to poll a plain background task with sleep 180 + TaskOutput, which the next section forbids for evals. Its one durable rule (keep checking until the run finishes, report progress at each check) now lives in the detach section's poll step, pointed at the gstack-detach EXIT sentinel, at normal volume. No tests pin the removed text. * fix(preamble): test-failure triage questions defer to the AskUserQuestion Format (s01 M5) The two quoted pseudo-briefs pinned a superseded question shape (RECOMMENDATION: Choose X, a completeness score on the recommendation, no D<N>/ELI10/Net). The triage step now gives the facts, the options with their completeness values, and the recommended option as data, and defers the shape to the Format section. Option labels that Step T4 and test/skill-validation.test.ts:2004-2016 depend on are verbatim. No W7a pins on the removed text. * fix(proactive): PROACTIVE=false means no suggestions, including 'want me to run /X?' (W5.1) The router forbade suggesting skills when PROACTIVE is false while the preamble told the model to ask 'want me to run it?'. Decision: false means never auto-invoke and never suggest, including by asking. The preamble line in generate-upgrade-check.ts now matches the router, and both quote the value as `false`, the way gstack-skill-start prints it. Restore with gstack-config set proactive true. W7a pin: test/gen-skill-docs.test.ts:4488 used the old quoted sentence as a preamble-order marker; it now finds the PROACTIVE-false rule with a quote-tolerant, case-insensitive pattern. * docs(ETHOS.md): correct the claim that ETHOS is injected into every preamble (W5.7) Nothing injects ETHOS.md. Preambles carry condensed principles (completeness, voice, search before building) and the Search Before Building section links to this file. Edit approved by Garry for this PR. * office-hours: fix stale refs, state-root path, profile query, SESSION_ID (s07 H1, H2, H3, M7, M10; s01 H1 office-hours note) - Phase 4.5 points at Founder Resources instead of the nonexistent Beat 3.5 (H1). - builder-journey.md is written to $GSTACK_STATE_ROOT, where it is opened (H2). - builder-profile context query reads developer-profile.json, the file the migration leaves behind; drop meaningless tail (H3). - Drop issue numbers from three headings (M7) and the MANDATORY/NOT optional markers on Phase 4 (M10). - Handoff telemetry uses the echoed SESSION_ID placeholder; $_SESSION_ID is never set in a fresh shell. Template-only commit: generated SKILL.md is expected red until the regeneration commit. * spec: plain Phase 3 gate, drop duplicates, dead telemetry and review IDs (s07 H4, M1, M2, M3, M4, M5, M6) - H4: Standard template heading no longer names nonexistent --bug/--feature/--refactor flags. - M1: Phase 3 read-code-first gate at normal volume, constraint and reason kept. - M2: drop the in-phase repeat of the read-first rule (Rules recap stays). - M3: drop the duplicate audit-sink paragraph. - M4: drop TTHW telemetry block and its never-set frontmatter keys. - M5/M6: drop plan-review finding IDs from Phase 5 headings and the /ship handoff. W7a pins: spec-template-invariants:314 (Mandatory/MUST) becomes a Phase 3 section check for the read-evidence-before-asking constraint; :203 matches 'raw spec must not be persisted' across line wraps so no duplicate paragraph is needed to satisfy it. Template-only commit: generated SKILL.md is expected red until the regeneration commit. * investigate: drop issue numbers from freeze-script comment (s07 M8) Template-only commit: generated SKILL.md is expected red until the regeneration commit. * qa: replace WTF point table with named signals and a plain stop rule (s07 M9) The self-regulation check keeps its cadence (every 5 fixes or after a revert), its signals (reverts, unrelated files, sprawl, long runs, low-severity tail), STOP-and-ask, and the 50-fix hard cap. The percentage table goes; the stop threshold (two reverts, or one unrelated-file edit) stops at least as early. W7a pins: qa-browser-preservation:220 drops 'WTF > 20%' and checks the signals case-insensitively; skill-validation:1250 checks the test-only exclusion rule instead of the heading name; carve-guards qa anchor 'WTF-LIKELIHOOD' becomes the '### 8f. Self-Regulation' heading. Template-only commit: generated SKILL.md is expected red until the regeneration commit. * design-html: match Pretext docs to the vendored bundle; fix cross-block server state (s08 H1, H2, H3, H4, H7, M6) - H1-H3: walkLineRanges, layoutNextLine and layoutWithLines signatures and return shapes now match design-html/vendor/pretext.js; patterns 2-4 rewritten. - H4: inline the ES-module bundle in <script type="module"> with page code in the same module; no window.Pretext global exists. - H7: remember the printed server URL and PID; later blocks restate them. - M6: drop the 2-3 line cap on the refinement summary. Template-only commit: generated SKILL.md is expected red until the regeneration commit. * make-pdf: drop nonexistent --no-syntax flag, trigger list and relative phrasing (s08 H5, M7, M9) Template-only commit: generated SKILL.md is expected red until the regeneration commit. * design-shotgun: DESIGN.md decides what variants vary; fix $SLUG; drop history (s08 H6, M1, M2, M3; W5.6) - H6: the office-hours lookup block evals gstack-slug before using $SLUG. - M1 + W5.6: with a DESIGN.md, variants keep its fonts and palette and vary layout and composition; without one they vary font, palette and layout. The swap-the-headline test and the 'Anti-convergence directive' heading (carve-guards anchor) stay. - M2: drop the Claude Code version pin; run_in_background: false and its reason stay. - M3: /tmp-then-cp rule and reason without the incident story. G1 (replace executor subagents) deferred to TODOS.md per plan. Template-only commit: generated SKILL.md is expected red until the regeneration commit. * design-review: plain identity line; scope 'never read source' to the audit (s08 M4, M10) M5 (risk-percentage stop conditions) is a UC2 gate and keeps its wording. Template-only commit: generated SKILL.md is expected red until the regeneration commit. * design-consultation: plain CLAUDE.md design-system snippet with its reason (s08 M8) Template-only commit: generated SKILL.md is expected red until the regeneration commit. * plan-tune: describe the never-ask hook truthfully; drop plan codes (s09 H8, H9, H10, M10; W4 plan-tune) W4: make the text true rather than change the hook. The consent copy and scope now say never-ask questions are auto-decided with gstack's recommendation by the question-preference hook (one-way doors still ask), and the profile itself never changes defaults. H10 removes the nonexistent --dismiss command. M10 strips cathedral/Layer/D-codes and keeps mechanisms. Template-only commit: generated SKILL.md is expected red until the regeneration commit. * context-save/restore: drop rename history; fix command-list branch rule (s09 H11, M1, M2, M3, M4, M5, M6) Template-only commit: generated SKILL.md is expected red until the regeneration commit. * retro: correct what the skill writes; drop word cap and archaeology (s09 H13, M7, M8, M9, M25) H13 and M7 touch neighbouring lines and were merged by hand in that order. Template-only commit: generated SKILL.md is expected red until the regeneration commit. * health: compute the composite in code; fix example weights; drop D6 codes (s09 H12, M21, M22) Template-only commit: generated SKILL.md is expected red until the regeneration commit. * gstack-upgrade: drop issue numbers and version history, keep rationale (s09 M20) Template-only commit: generated SKILL.md is expected red until the regeneration commit. * canary: replace the 30-second/don't-over-analyze rule with the goal (s09 M23) Template-only commit: generated SKILL.md is expected red until the regeneration commit. * benchmark: self-contained page discovery instead of a /canary reference (s09 M24) Template-only commit: generated SKILL.md is expected red until the regeneration commit. * codex: drop judge vocabulary and the maintainer known-bad-list note (s10 M1, M2) The synthesis line keeps its Recommendation: <action> because <reason> shape. M16 (consult-mode embed rule) is a UC2 gate and keeps its wording; the outside-voice prompt bodies sent to Codex are unchanged. Template-only commit: generated SKILL.md is expected red until the regeneration commit. * document-generate: true redaction-fence behavior; drop thoroughness booster (s10 H8, M3) Template-only commit: generated SKILL.md is expected red until the regeneration commit. * document-release: changelog sell test as three questions, not a 0-3 score (s10 M6) The threshold stays (fewer than two answered = needs attention, not replacement). M4/M5 (NEVER CLOBBER / NEVER BUMP) keep their wording; the integrator owns the eval-gated rewrite. W7a pin: workflow-excerpt:170 'Entries scoring <2 need attention, not replacement' becomes a case-insensitive check that weak entries get attention, not replacement. Template-only commit: generated SKILL.md is expected red until the regeneration commit. * ios-clean/fix/sync: match the generator's real header, package shape and regen command (s10 H2, H3, H4, H5, M9, M12) - H2: inventory greps the header the generator actually writes. - H4/H5: remove the local .package(path:) entry and DebugBridge* product deps; delete the generated DebugBridge/ and DebugBridgeGenerated/ dirs so the Phase 3 check can pass. - H3: regenerate accessors with /ios-sync (gstack-ios-qa-regen). - M12: ios-fix writes the regression with the project's own test runner. - M9: drop migration-relative sentence. ios-qa DEMO MODE (M8) is a UC2 gate and keeps its wording. Template-only commit: generated SKILL.md is expected red until the regeneration commit. * setup-deploy: drop User-invocable boilerplate; say default branch, not main (s10 M10, M11) Template-only commit: generated SKILL.md is expected red until the regeneration commit. * skillify: test staged skills directly; stop after Aside scrapes; drop roadmap notes (s10 H1, H6, H7, M14, M15) Template-only commit: generated SKILL.md is expected red until the regeneration commit. * W4: transcript ingest needs affirmative consent (recent|all) normalizeTranscriptConsent() in gstack-memory-ingest reads transcript_ingest_mode once per process. Only recent (90 days) and all (all history) are consent; an absent key, off, legacy gate letters, incremental and unknown values skip transcripts while other memory still syncs. The ingest's default source set drops transcript without consent; an explicit --sources list naming transcript overrides. gstack-gbrain-sync reads consent once at sync start and pins a non-consented run to an explicit source list, so a mid-run config change cannot add transcripts. It prints the pinned skip notice on every such run (even --quiet), records the normalized mode and skip reason in the memory stage, restages an interrupted import when the consent policy changed, passes --all-history on --full for mode all, and documents the default in --help. Tests: new gstack-gbrain-sync-transcript-mode.test.ts; memory-ingest fixtures seed consent; regression-2922's every-type case seeds consent. Findings: s09 H16 (enforce the consent choice in code). * W4: gstack-brain-sync holds staged transcript pages without consent Queued transcripts/ pages stay queued and on disk unless transcript_ingest_mode is recent or all; other classes still push. Test: brain-sync.test.ts push-filter case (absent, off, legacy A, then recent). * W4: gstack-config validates transcript_ingest_mode; set rejects empty and multi-line values transcript_ingest_mode accepts only recent|all|off and leaves the stored value unchanged otherwise. set rejects an empty value or one containing a newline for every key instead of truncating it. The config header documents the key; lookup_default keeps off. * setup-gbrain, sync-gbrain: fix stale facts and strip plan archaeology Applies s09 H1a, H1c (Mac-only wording; the installer supports Linux and Windows), H2 (smoke test has no delete step), H3 (five invocation modes), H4 (no CI grep test backs the telemetry claim), H7 (Step 4.5 does not exist; the prompt is Path 4 step 4d), M11, M12, M13, M15, M18, M19 (plan codes, issue numbers, version pins, rename story), M14 (restore-from-sync never shipped), M16 (draft self-dialogue in the Supabase steps), M17 (passed sunset date, manual merge into both sections). W7a: retires the setup-gbrain-bin-invocation-paths 'now persists staged transcripts' change-detector (t06 #17); the no-bare-invocation regex tests keep the contract. * W4: transcript consent prose in /setup-gbrain, /sync-gbrain and memory.md The Step 7.5 gate is rewritten as a consent question (manual merge of s09 H5, with H1b and H6): it checks gstack-config has, asks once with A) recent, B) all history, E) never, names Claude Code and Codex sessions from every repo-policy-allowed project and the destination brain, stores the mode value (never the letter), asks yes/no when no transcripts exist, never asks spawned or headless sessions, and drops the silent no-question bulk paths and the false skill-start-hook claim (s09 H5c). Path 4 no longer stores off on the user's behalf. /sync-gbrain gains Step 1.6 (ask when the key is absent or holds a legacy value). Step 10 and the sync verdict show the mode. setup-gbrain/memory.md gains #transcripts (values, sources, destination, override precedence, one-time restage, held staged pages, already-ingested pages stay). W7a: setup-gbrain-bin-invocation-paths drops the silent-bulk and preamble-hook pins (that prose is gone) for negative checks (no pre-answer --bulk, no skill-start claim), loosens the gstack-config pin (t06 #18) to the command without <choice>, and adds the DX 'gated on has' order check for both skills. * W5.2: /sync-gbrain is the only writer of the CLAUDE.md search-guidance block setup-gbrain's claude-md-persist section stops writing its own '## GBrain Search Guidance' block, which also removes the false 'auto-syncs on every gstack skill start' text (s09 H15; s09 H14 decided). Step 10 offers to run /sync-gbrain now and names it otherwise. Test sweep: only skill-e2e-sync-gbrain-readiness references the heading, and it checks the block /sync-gbrain writes, so no test changes. * E4: config-key reader tripwire in gstack-config-defaults.test.ts Every key in bin/gstack-config's DEFAULTS table must be read by code (gstack-config get/has <key>, a config-binary variable, a spawn argv, a config-reader call, or an anchored ^key: pattern in bin/, lib/, scripts/, setup or any .tmpl; wildcard keys by prefix) or appear in PROSE_ONLY_KEYS with a reason. Run on the current tree first: every key has a reader, so the seeded prose-only list is empty. Failure messages name the two fixes. A synthetic-tree case checks each reader form and that docs prose does not count. setup is scanned because timeline_stop_hook is read only there. * W4: /open-gstack-browser asks before replacing a live browse daemon Step 0 probes with BROWSE_NO_AUTOSTART=1 $B status (no daemon is booted by the probe). No live daemon: clear Chromium profile locks and run plain $B connect, which reaps orphans and refuses to replace a busy daemon. Already headed: connect reports it. Live headless daemon: AskUserQuestion, and only an explicit yes runs $B connect --force-restart; spawned or headless sessions leave it running and print the stop line with the resolved browse binary. The hand-rolled kill / kill -9 of the recorded PID and the browse.json deletion are gone. Supersedes s10 M13. Tests: new open-gstack-browser-liveness.test.ts (no kill of the recorded PID, status probe before connect, --force-restart only after the yes branch, profile-lock cleanup kept, spawned/headless stop line). The state-extraction tripwire now covers only the port snippet, since the pid snippet is gone. * fix(browse): untrusted-content warnings name both marker formats (s02 H5, s02 L2 / W7f) The /browse warning named only the --- UNTRUSTED EXTERNAL CONTENT --- envelope and the browser fallback only the ═══ UNTRUSTED WEB CONTENT ═══ one; $B prints both (commands.ts wrapUntrustedContent, content-security.ts ENVELOPE_BEGIN). Both surfaces now name both formats. W7f pin: test/aside-driver.test.ts:347-350 no longer bans the EXTERNAL marker; it reads both marker labels from browse/src/commands.ts and browse/src/content-security.ts and requires both in the fallback and warning. Negative control: reverting browse.ts turns the test red. Parity cap (test/helpers/carve-guards.ts): qa maxSizeRatio 1.103 -> 1.104 (measured 1.1035); the second marker adds bytes to every skill that renders the browser fallback. expected red until the regeneration commit (generated SKILL.md not committed) * fix(design): mockup board loop matches the daemon CLI (s02 H1, s02 H2, s02 H3) - H1: $D compare --serve publishes to the design daemon and exits; read BOARD_URL from stderr, wait with AskUserQuestion, then read feedback.json / feedback-pending.json. The fallback no longer names a $D serve command the step never runs. - H2: the reload POST uses the jq --arg form, so $_DESIGN_DIR expands (the single-quoted JSON sent the literal variable name). - H3: Content & Microcopy lists 11 items, not 8. No test pins the removed text. expected red until the regeneration commit * design: name the defaults to avoid in native design-direction prompts; plain path rule (s02 H4a, s02 H4b, s02 M9) - H4a/H4b: the design-consultation and design-sketch native subagent prompts now name the default looks to avoid (the three looks from the Hard Rules calibration plus the catalog entries the sibling outside-voice prompt already lists) and say to pick again if the first idea is one of them. - M9: 'CRITICAL PATH RULE' -> 'Path rule'; the rule and its reason stay. No test pins the changed text. Parity cap (test/helpers/carve-guards.ts): design-consultation maxSizeRatio 1.085 -> 1.092 (measured 1.0911). expected red until the regeneration commit * fix(outside-voice): preflight mode list no longer looks exhaustive (s02 M10) The preflight also prints under_codex and under_current_harness; not_authed exists only on the Codex path. 'every other mode skips them' covers all non-ready modes. No test pins the old line. expected red until the regeneration commit * outside-voice: drop booster sentences and plan-review decision IDs (s02 M1, s02 M7) - M1: native adversarial subagent prompt drops 'Be adversarial. Be thorough.'; the attacker framing, defect list and 'No compliments' output rule stay. - M7: doc-review headings drop the D3 / T3B plan-review decision IDs (D<N> also collides with AskUserQuestion brief numbering). Not changed: s02 M2 (outside adversarial prompt body sent to Codex/GPT: out of scope per plan) and s02 M3 (CODEX_BOUNDARY: UC2 gate keeps its wording). No test pins the removed text. expected red until the regeneration commit * confidence: drop issue IDs and the contributor-only design-doc pointer (s02 M4a, s02 M4b) - M4a: gate heading and FP-class intro lose '#1539' and the Django sprint measurement note; the gate rule and its four FP classes stay. - M4b: remove the pointer to ~/.gstack-dev/plans/1539-framework-aware-review.md, a contributor-local file that never exists where /plan-eng-review and /ship run. W7a pins (test/regression-1539-review-self-verify.test.ts): - :34 toMatch(/#1539/) removed (cosmetic issue-number pin; the gate-header check stays). - :64-67 'references the deferred design doc' replaced by a structural check that no .gstack-dev/plans/ path reaches the emitted prose. expected red until the regeneration commit * question-tuning: state why the summary is piped instead of citing #2024 (s02 M6) No test pins the resolver text (#2024 appears only in test names/comments). expected red until the regeneration commit * fix(testing): shared TEST_BOOTSTRAP undoes only owned changes (s03 H1, s03 H2, s03 H3, s03 M1) The shared {{TEST_BOOTSTRAP}} (/ship, /design-review) still told the agent to 'git checkout -- package.json package-lock.json', to 'revert all bootstrap changes', to 'delete silently' a failing first test, and to stage 'all bootstrap files'. The QA copy (qa/sections/test-bootstrap.md.tmpl) already says undo only owned changes, never blanket-checkout, never silently delete a valid red regression, and stop on unrelated staged edits. The shared copy now matches it. This removes destructive behavior (UC2: lands regardless of eval). W7g: test/qa-browser-preservation.test.ts gains a check that the shared copy (ship, design-review) has no 'git checkout --', no silent deletion, no blanket revert, and keeps the owned-change and staged-edits rules (case-insensitive). Negative control: the old testing.ts turns it red. Parity cap (test/helpers/carve-guards.ts): ship maxSizeRatio 1.404 -> 1.405 (measured 1.4044 at the branch tip, with the s03 M2/M3 wording). expected red until the regeneration commit * testing: coverage trace and test generation follow the value bar (s03 M2, s03 M3) - M2: 'Every branch in this diagram needs a test' / 'Each step in the journey needs a test' contradicted COVERAGE_GOAL ('Test count is not a goal') in the same rendered audit. Branches and journey steps now need coverage that would catch a regression; the value bar decides new test vs extension vs covered. - M3: 'Mock all external dependencies' -> the smallest native test, mocking only services unrelated to the behavior (matches the QA handoff in qa.ts and the audit's own E2E routing). No test pins the removed text. expected red until the regeneration commit * plan-gates: per-item confirmation states its reason, not an incident ID (s03 M4) 'VAS-449' meant nothing to the model and reached the user in the >5-items warning. The rule now gives the reason (a blanket confirmation lets the user click through without opening any file / lets unchecked items pass as verified). The per-item confirmation rule is unchanged. W7a pin: test/ship-plan-completion-invariants.test.ts:122 toMatch(/VAS-449/) removed (cosmetic incident-ID pin); the per-item rule and blanket-confirm ban checks on the same test stay. expected red until the regeneration commit * plan-gates, review-dashboard: terminal-report rules without trait claims or 'prior versions' narrative (s03 M5, s03 M7) - M5: exit gate drops 'will (correctly) reject it' and the 'Self-deception failure mode' aside; keeps the contract-violation sentence (pinned by test/gen-skill-docs.test.ts) and the body-prose-is-not-the-report rule. - M7: report-write step states the rule and its reason (delete and append at EOF so the report stays last) instead of the history of how it broke. No test pins the removed text. expected red until the regeneration commit * spec-review: default anti-shortcut clause without incident narrative (s03 M6) Drops 'the May 2026 transcript bug ... that's the bug, recognize it' and the caps; keeps the rule: each non-trivial finding goes through AskUserQuestion before it enters the plan, and only a zero-finding review skips asking. The four skill-specific branches are unchanged. W7a pin: test/skill-ceo-section-ordering.test.ts:868-873 pinned the SHA-256 of the default clause. It now checks, on every host, that the clause still says the plan cannot replace the interactive review, routes findings through AskUserQuestion, and lets only zero findings reach ExitPlanMode without asking (case-insensitive), and that the clause is host-independent. The old clause also passes; deleting the zero-findings rule turns it red. The DX hash pin is unchanged. expected red until the regeneration commit * constants: foreground-dispatch note in current-state terms at normal volume (s03 M8) Keeps every constraint (explicit run_in_background: false, Agent tool only, never inline or as a Skill, fallback only after a dispatched subagent fails) and the reason (fresh-context isolation); drops 'no longer', BACKGROUND/ONLY/ WRONG/FALLBACK caps. test/ship-control-flow.test.ts and run-in-background-guidance.test.ts check the placeholder and the explicit flag, not this prose. expected red until the regeneration commit * tasks-section: inline the effort ratios for every phase (s03 M9) The non-CEO/Eng branch said 'Effort uses the AI-compression table from CLAUDE.md', but at runtime CLAUDE.md is the user's project file; the table exists only in gstack's own repo. Every phase now renders the inline ratios the CEO/Eng branch already used. No test pins the removed text. expected red until the regeneration commit * hosts, utility: model-neutral Claude co-author trailer (s03 M10, s11 M10) The Claude host trailer and the resolver fallback (cursor, kiro, opencode, slate) signed commits as 'Claude Opus 4.7' whatever model ran. Both now read 'Co-Authored-By: Claude <noreply@anthropic.com>' so the trailer cannot go stale at the next model release (the s11 report offered this neutral form; s03 M10's hunk uses it). document-release's release body renders the same {{CO_AUTHOR_TRAILER}} and follows on regeneration. test/host-config.test.ts:589 only requires 'Claude' and stays green. Goldens move on regeneration (not committed). expected red until the regeneration commit * changelog workflow: cross-check covers user-facing changes, not every commit (s03 M11) 'Every commit must map to at least one bullet' contradicted the same block's voice rule (never mention contributor-facing details) and CLAUDE.md's entry rule (the diff vs main, not how the branch got there). Every user-facing change in the commit list must be represented; merges, version bumps and mid-branch fixes need no bullet. W7a pin: test/gen-skill-docs.test.ts:2038 no longer pins the old sentence; it checks the Cross-check step still compares against the step-2 commit list and scopes to user-facing changes (case-insensitive), without re-pinning the new sentence. expected red until the regeneration commit * plan-ceo-review, plan-eng-review: storage paths follow the state root (s04 F2, s04 F3) The CEO storage policy and the eng write policy named ~/.gstack/projects/ and ~/.gstack/analytics/, while the writers (tasks-section.ts, testing.ts, spec-review.ts) use $GSTACK_STATE_ROOT. When the state root is relocated the prose pointed at the wrong directory. W7a pin: test/plan-review-cases.test.ts:852 pinned the stale path; it now checks the discovery path is under $GSTACK_STATE_ROOT and that the hardcoded ~/.gstack/projects/{slug}/ is gone. expected red until the regeneration commit * plan-ceo-review: remove the handoff-note reader and cleanup for files nothing writes (s04 F6, s04 F7) CEO handoff notes (*-ceo-handoff-*.md) have not been written since v0.11.5.1; no template, resolver or bin script produces them. The reader cost a bash call on every CEO run, depended on $SLUG/$BRANCH from another shell, and looked under $GSTACK_STATE_ROOT where pre-state-root notes never lived. W7a pin: test/skill-ceo-section-ordering.test.ts:320 sliced up to the removed '## Handoff Note Cleanup' heading; it now slices to the next heading ('## Review Log') with the same assertions. Note: the ceo-mode-option / ceo-mode-prerequisite PTY cases fail under the image's Bun 1.3.14 with or without this change and pass under Bun 1.4.0. expected red until the regeneration commit * plan reviews: replace context-pressure triage with the full-completion rule (s04 F1; manual merge of s05 M2) plan-ceo-review, plan-design-review and plan-devex-review ranked sections 'under context pressure' ending in 'Everything else', which licensed dropping sections their own anti-skip rules require. plan-eng-review already replaced the same block with 'Complete every required stage ... do not preemptively warn'. All three now use that rule and name what may never be shortened (design: Step 0, Step 0.5 mockups unless the user opted out, Passes 1-7; devex: Step 0 with persona/empathy/benchmark/magical moment/TTHW, Passes 1-8). s04 F1 noted the same block in the s05 files; the design copy is a manual merge of s05 M2 (drops 'non-negotiable', which contradicted the user's explicit 'skip mockups' opt-out). No test pins the removed text. expected red until the regeneration commit * plan-ceo-review: shared-code guidance matches the eng review (s04 F4, s04 F5) 'DRY: flag repetition aggressively' and 'DRY violations. Be aggressive.' contradicted plan-eng-review's newer rule (require common behavior and improved reliability or net savings; similar-looking code alone is insufficient), so the two reviews gave the same plan opposite advice. Both CEO lines now follow the eng rule; Section 5 keeps the file:line citation. No test pins the removed text. expected red until the regeneration commit * plan reviews: normal-volume rules; eng sections report every finding (s04 F8, s04 F10, s04 F11) - F8: eng 'at most 8 findings' per section conflicted with 'never condense or skip' and left a 9th high-confidence finding nowhere to go; report every main-report finding, most severe first (confidence calibration still suppresses low-confidence ones). - F10: drop 'It is not optional.' (the anti-skip rule already covers Section 2). - F11: 'ALWAYS a smell' -> 'a smell'. No test pins the removed text. Two eng PTY cases fail under Bun 1.3.14 and pass under Bun 1.4.0 (CI pin). expected red until the regeneration commit * plan reviews: '## CRITICAL RULE — How to ask questions' -> '## How to ask questions' (s04 F9, s05 L3) The bodies are plain procedure; the caps label added nothing and competed with the CRITICAL GAP output label. Applied in plan-ceo-review, plan-design-review and plan-devex-review sections (s05 L3 promoted by the plan). W7a: test/devex-finding-fixture.test.ts:83-84 now finds the section by a heading regex ending in 'How to ask questions'; the skill-e2e-plan-ceo-plan-mode failure diagnosis names the new heading. Judge anchors NOT changed here (builder E moves them to structural anchors): skill-ceo-section-ordering.test.ts (old :938), workflow-excerpt.test.ts:109,296, skill-llm-eval.test.ts:638, workflow-judge-input.test.ts:366,373; the mirror in touchfiles.test.ts:219 also uses '## CRITICAL RULE'. These stay red until E's anchor commit lands. expected red until the regeneration commit * autoplan: phase drivers match the loaded review skills (s05 H1, s05 H2, s05 H3, s05 H4, s05 H5, s05 M5) - H1/H2: the skip list names the current headings ('Step 0: Detect platform and base branch', 'Design Outside Voices (independent)'); the old names never matched, risking a duplicate base-branch detection or outside-voice pass. - H3: the DX journey map is the 6-stage table from Step 0F, not 9 stages. - H4: the DX checklist names Step 0 'DX Investigation' and scores only after the evidence exists, as plan-devex-review requires. - H5 (manual merge): the eng test-plan artifact uses the eng skill's {user}-{branch}-eng-review-test-plan-{datetime}.md name under $GSTACK_STATE_ROOT/projects/$SLUG (consistent with s04 F3). - M5: the Decision Audit Trail separator has 7 columns to match its header. No test pins the removed text. Three autoplan PTY cases fail under Bun 1.3.14 and pass under Bun 1.4.0. expected red until the regeneration commit * plan-design-review: scope gate runs Step 0 before mockups (W5.4, s05 H6) The scope gate said 'audit → mockups → Step 0' while the body runs Step 0 (0A-0D) first and 0D announces 'I'll generate visual mockups next'. Per the W5.4 decision, the three gate phrases now read audit → Step 0 → Step 0.5 mockups. 'Reply with A, B, or C' is unchanged. W7a pins: - test/plan-scope-selection.test.ts:616 pinned the old order sentence; it now checks the order of the 'After resolution:' steps (preamble, base branch, audit, Step 0, mockups). Negative control: the old order turns it red. - test/gen-skill-docs.test.ts:4737 normalizer strips the design-only 'Then run the pre-review audit, ... against that plan.' sentence by pattern. expected red until the regeneration commit * plan-design-review: mockup default and retrospective at normal volume (s05 M1, s05 M3, s05 M4) - M1: 'YOUR PRIMARY TOOL' / 'The rule is simple ... Don't ask permission ... Mockups ARE the plan' -> generate mockups without asking when the plan has UI and the designer is available, with the reason; skip only under the Step 0.5 conditions (which include the user's opt-out). - M3: 'be MORE aggressive' on previously flagged areas -> check whether the earlier issue recurs or was only partly fixed and say so. - M4: drop the unverifiable 'Tier 2+ (15+ RPM)' rate-tier aside; keep the one-at-a-time rule and the /design-shotgun pointer. (s05 M2 landed with s04 F1.) No test pins the removed text; the remaining failing case is the plan-scope-selection PTY case that fails under Bun 1.3.14 and passes under Bun 1.4.0. expected red until the regeneration commit * plan-devex-review: DX TRIAGE keeps every pass and reports blockers only (W5.5, s05 H7) The Mode Quick Reference let TRIAGE skip the benchmark, the magical moment and passes 2/4-8, contradicting the anti-skip rule, the 0C target gate and the 'executed all 8 DX passes' self-check. Per the W5.5 decision the TRIAGE cells now read 'Target only' / 'Verify exists' / 'All 8, blockers only', matching the Rating Method's 'flag adoption blockers; skip nice-to-haves'. No test pins the removed cells. expected red until the regeneration commit * ship, review, land-and-deploy, landing-report: fix stale cross-references (s06 H1, s06 H2, s06 H3, s06 H4, s06 H5, s06 H8, s06 M6) - H1: TODOS-format cites /ship Step 14, not 5.5. - H2: the land readiness review is the checklist /ship applies in Step 9 (there is no Step 3.5). - H3: the Apple adapter names the no-credential-talk rule by location instead of 'line 14' (it renders at line 16). - H4: greptile triage diffs against origin/<base> from the caller's detected base, not origin/main. - H5: the land Important Rules recap matches the steps (4-minute CI rounds in Step 3; 30 seconds for merge readback and deploy status). - H8: landing-report calls the util once per bump level (four), and drops the unsupported 'cached by bun' claim. - M6: landing-report says what its base detection does instead of claiming it matches other skills. No test pins the removed text. expected red until the regeneration commit * fix(land-and-deploy): readiness gate uses the project's test command and the live eval store (s06 H6, s06 H7) - H6 (manual merge): TEST_COMMAND comes from CLAUDE.md or AGENTS.md; if neither documents one, ask the user instead of defaulting to 'bun test' (wrong for non-Bun projects and a bare suite run in gstack). The audit hunk's 'persist the answer to CLAUDE.md' write is not adopted: it adds a write the readiness gate never had. - H7: E2E and judge results are searched in the eval store the collector writes (~/.gstack/projects/<slug>/evals/ and its shards/*/ directories), then the legacy ~/.gstack-dev/evals/ fallback; the gate no longer reports 'no E2E tests run today' when results exist. test/state-root-ratchet.allowlist.json: allowlist the EVAL_DIR line with its reason (test/helpers/eval-store.ts writes under os.homedir()/.gstack, so the reader must use the same path, not $GSTACK_STATE_ROOT). Parity cap (test/helpers/carve-guards.ts): land-and-deploy maxSizeRatio 1.10 -> 1.108 (measured 1.1076 at the branch tip, including the W7f marker). expected red until the regeneration commit * ship: Step 9 Pass 1 defers to the checklist's critical categories (W5.3, s06 H9) /ship restated the checklist's Pass 1 as two of its five CRITICAL categories (missing Race Conditions, Shell Injection, Enum Completeness). Per the W5.3 decision it now names 'the checklist's Pass 1 categories', matching /review. No test pins the removed text. expected red until the regeneration commit * land-and-deploy: host-neutral post-merge branch example (s06 M5) The squash-merge cleanup example created 'codex/post-merge-pr-N' branches on every host. The example is now 'post-merge/pr-N', naming Codex Desktop's codex/ prefix as the host-specific case and keeping the detached-HEAD reason and the no-force-push rule. No test pins the removed text. expected red until the regeneration commit * ship: drop issue/incident IDs and the 'continue silently' suppressor (s06 M2, s06 M3, s06 M4, s06 M7) - M2/M3: '(#1946)' and '(#1079)' removed from the credential guard and REST fallback headings; the rules are unchanged. - M4: the audit-failure fallback states the reason (a skipped audit lets unverified plan items ship as done) instead of 'the failure shape that VAS-449 surfaced'. - M7: 'Continue silently — just note the counts briefly' -> report the pass counts in one line and continue to Step 6 (Step 16 cites these counts). Not changed: s06 M1, the Step 16 IRON LAW (UC2 gate keeps its wording). W7a pin: test/ship-plan-completion-invariants.test.ts:127 pinned the VAS-449 sentence; it now checks that the audit-failure fallback still forbids a silent fail-open (case-insensitive). Negative control: deleting that sentence turns it red. expected red until the regeneration commit * test: anchor plan-design excerpts on the question-procedure heading, not '## CRITICAL RULE' (W7a judge-anchor move; workflow-excerpt.test.ts:109,296) The end marker now accepts a RegExp. ASK_QUESTIONS_HEADING matches the heading with or without its 'CRITICAL RULE — ' prefix, so the excerpt is byte-identical on the current templates and survives the s04 F9 / s05 L3 rename. * test: plan-design judge-input case anchors on the question-procedure heading (W7a judge-anchor move; workflow-judge-input.test.ts:366,373) * test: plan-design workflow judge ends its slice at the question-procedure heading (W7a judge-anchor move; skill-llm-eval.test.ts:638) Judge input is byte-identical on the current templates; judge prompts and schemas are unchanged. * test: CEO governing-stage order anchors on the question-procedure heading (W7a judge-anchor move; skill-ceo-section-ordering.test.ts:938) * test: dedicated-tools overlay gates on correct output plus 20% fewer Bash calls (Eng W7 overlay predicate; replaces overlay-nudges.ts:213 taskCorrect) Every ON trial must pass the fixture's verify (already a valid-measurement requirement) and lowerIsBetter20Pct must hold; when the OFF median is 0, every ON trial must also be 0. assessOverlayArms enforces both through a new fixture.gate. Overlay contract bumps to v3 so v2 records are never reinterpreted. overlay-measurement gains rows for correct+worse (fails), 20%+incorrect (fails) and the zero baseline (passes only at 0). The prose comment follows the s01 M1 claude.md wording. * test: document-release E2E stops coaching the rules it measures (W7b; UC2 gate eval for NEVER CLOBBER / NEVER BUMP) Drops the IMPORTANT block at skill-e2e-workflow.test.ts:76-83, including 'auto-approve everything' and the CHANGELOG/VERSION instructions; keeps only the environment facts (non-interactive, no remote). Asserts the outcome: the original CHANGELOG entries remain, VERSION still reads 1.1.1, no commit after the fixture head touches VERSION, and README mentions Feature C. * test: routing E2E uses the routing instruction gstack ships (W7b routing fixture; skill-routing-e2e.test.ts:113) readShippedSkillRouting() parses the '## Skill routing' section from the routing-injection heredoc in bin/gstack-skill-start at test time. The journey fixture now carries that instruction instead of 'ALWAYS invoke … FIRST action. Do NOT answer directly', and still withholds the per-skill rule list so a regressed description can fail. bin/gstack-skill-start and the helper join the journey, context-skills and skillify touchfiles. A free check catches heredoc drift. Runs on unchanged templates set the new baseline. * test: context-skills E2E routes with the shipped ## Skill routing section (W7b routing fixture) Replaces the shouted 'ALWAYS invoke it … FIRST action' fixture and its hand-written context-save/restore rules with the section gstack appends to CLAUDE.md, which already routes save/resume to those skills. * test: skillify E2E stops scripting the skill and routes with the shipped section (W7b skillify prompt + routing fixture; W7d skillify narration ban) - CLAUDE.md fixture: the shipped ## Skill routing section replaces 'ALWAYS invoke it via the Skill tool as your FIRST action' and its hand-written rules. - scrape-match-path: prompt is 'Run /scrape latest hacker news stories'; the 'You MUST follow … 1. Run skill list … Do NOT enter the prototype phase' script is gone. Asserts the outcome: the bundled skill ran, no goto prototyping, no new skill or skillify staging written. Listing is logged. - scrape-prototype-path: drops the five-step script and the self-fulfilling 'Suggest /skillify'; keeps the user's JSON shape request. - skillify-provenance-refusal: prompt no longer dictates the refusal. - Narration grader moves to helpers/skill-body-narration.ts: line-start 'I '/'I'll '/'Let me ' plus mid-sentence 'let me <verb>', so 'let me know' is legal. Stored known-good/known-bad bodies show it still rejects every known-bad case the old /Let me /i ban caught. * test: land-and-deploy E2Es state environment facts instead of scripting the skill (W7b deploy prompts) The workflow, first-run and review-gate prompts drop the 'IMPORTANT … simulate: 1. Detect … 2. Infer … 3. Note …' scripts and the answers they supplied (platform, app, URL, merge method, 'Eng Review should be NOT RUN'). They keep the facts the fixture cannot provide (no remote, no PR, gh/fly unavailable, gstack-review-read output, report directory). Assertions now check the outcome: the artifacts name Fly and test-app, and the readiness report records the missing review. Canary, benchmark and setup-deploy prompts are unchanged. * test: ship triage asserts each failure's in-branch/pre-existing label (W7b ship triage) The old check passed if the words 'in-branch', 'pre-existing', 'math' and 'string' appeared anywhere in the final message, in any pairing. The prompt now asks for a closing JSON map; helpers/ship-triage-labels.ts reads it (or unambiguous per-failure lines) and the test requires truncate/string -> in-branch and divide/math -> pre-existing, plus a Bash call that ran the suite. Stored outputs show swapped, words-only and one-label runs fail. Drops the untyped recordE2E extras (typecheck baseline shrinks by one). * test: design-review-fix asserts a fixed design issue, not only the Aside ritual (W7b design-review-fix) Keeps the engine-routing checks (Aside driven, retired binary unused) and adds the outcome: design-audit.md exists, names a seeded defect, and index.html or style.css differs from the initial fixture commit. The style(design) commit prefix is not required. This case still cannot gate the design-review stop-condition rewrite (it self-skips without Aside and caps fixes in its prompt), per the Eng item. * test: CEO HOLD preservation grader checks the decision, not its phrasing (W7d CEO mode-routing regex judge, ceo-mode-option.ts:410-440) Drops the exact 'Keep <x> in scope' / 'Defer <x> to TODOS' labels, the 'D<n> — Keep … in scope, or defer' title, the '<plan>.md lists' phrase and the 2-of-5 keyword quota. Keeps the evidence bindings (native answer, session, timestamps, source read, mode context, later withdrawal) and now requires: one keep option and one defer option, the answer selects keep, a word of the kept label names a listed plan requirement, no expansion language, and an ELI10 + Stakes rationale of at least 20 words (so a bare mode label still fails). Stored captures: both retained known-good runs pass; every existing known-bad mutation still fails; four rewordings the old grader rejected now pass; three new known-bad cases fail. The Net/Note single-brief checks (t02 #3) are unchanged: the 'second sentence after Net' row adds scope ('Also add shared views'), so it stays a known-bad. * test: docsync observer accepts harmless read wrappers (W7d docsync observer) docsCommandAllowed now unwraps, on read-only commands only (pwd, ls, cat, stat, sha256sum, Git reads): a leading 'cd <fixture repo> &&', '2>/dev/null', a trailing '|| true', '--no-pager', '-C <fixture repo>' and '-c' with core.pager=cat / core.quotepath / color.* settings. Lifecycle and script calls stay literal so their failures cannot be suppressed. Writes, other repos, --git-dir/--work-tree, config that can execute code, real composition and redirects stay rejected. Stored commands (fixtures/docsync-observer-commands.json): 11 known-good read forms, which the old observer rejected, now pass; all 17 known-bad forms still fail under the new and old observers. docsync-command-grammar moves its three harmless rows to an accept test and keeps unsafe variants of them as rejects. * test: AUQ matrix fails only on the format fields software reads (W7d AUQ matrix emoji check) auqMachineFormatProblems() fails a first-question run when the Recommendation: line is missing or empty, or when the brief does not label exactly one option (recommended); recommendation substance >= 4 is unchanged. ELI10, Pros / cons, ✅/❌ and Net: are still scored and logged but no longer fail a paid case. scoreAuqFormat and the consistency suite are unchanged. Stored briefs: three known-good (including one without emoji or Net) pass; four known-bad (no or empty Recommendation, zero or two (recommended)) fail. * test: coverage audit grades a closing tested/untested summary before the diagram grammar (W7d coverage-audit-evidence) The diagram grammar grew through four waves of capture patches to accept correct-but-different diagrams. The E2E prompt now asks for one closing JSON line {"tested": [...], "untested": [...]}; coverageAuditVerdict passes the outcome when processPayment is only in tested and refundPayment only in untested (last summary wins; quoted or example summaries ignored). The legacy grammar stays as a fallback, so every stored capture keeps its verdict (all existing rows unchanged). Read evidence and capture success are still required. Stored summaries: three known-good (which the old grader rejected) pass; seven known-bad fail. * test: disabled outside-plan grader reads the run's own coverage self-report (W7d disabled-plan-review-evidence) The false-completion oracle kept being patched to tell historical review-log mentions from current claims. The E2E prompt now asks for a closing JSON line {"outside_review_this_run": ...}. When present, the coverage claim is that report ('completed' fails) plus any undenied 'both reviewers agree'; 'disabled' also satisfies attribution. Runs without it keep the existing prose oracle, so all stored captures and mutation rows keep their verdicts. Dispatch, CLI execution, preflight and persisted-disabled checks are unchanged. Stored outputs: three known-good pass (the old grader rejected the table form); four known-bad fail. * test: investigate boundary grader checks the verified fix, not one Edit and one verify (W7d investigate exactly-one ritual) Completion now needs at least one allowed Edit, the correction in place, at least one verifier run whose final status is 0, and no edit after the final verification. The ending-error case still requires a single verifier run (status 69), because that fixture's error tells the actor to stop without retrying. Ownership acquisition/release checks are unchanged. New free protocol controls: a passing re-verification passes (the old grader failed it); a failing final re-verification and a retry after the ending error both fail, as they did before. * test: CEO split-overflow call floor is two, the minimum for five options at four per call (W7d split-overflow 4-call floor) The regression is a candidate silently dropped to fit the four-option cap. The scope validator already requires an offered Include/Defer/Cut disposition for all five candidates; the extra N-1 call floor failed agents that batch compatible candidates, which the test header calls legitimate. FLOOR now comes from CEO_SPLIT_CALL_FLOOR = 2. Stored shapes (ceo-split-floor.test.ts): five sequential, 2-call and 3-call batches pass; a dropped candidate fails with 'missing target decisions'. The registration controls keep their verdicts; the 3-call plan_ready scenario still fails, now on missing decisions. * test: shared-libs PR coverage checks the stated page budget, not per-PR ceilings from one run (W7d shared-libs per-endpoint page caps) prCoverageRequestViolations keeps the skill's stated older-open-PR budget (five metadata pages, fifty file-list pages plus recent PR 7) and the coverage outcome (PR 42's file list read from page 1 through page 2). It drops the PR 42 three/four-page and single-first-page ceilings, which were tuned to one observed capture with a truncated first view. The judge criteria are unchanged. Stored endpoint lists: three known-good (including a re-read first page the old ceilings rejected) pass; four known-bad plus an over-budget file-list run fail. incompleteFirstFileView is no longer used by the paid case. * test: test-value review accepts any caller search, not only the literal 'git grep' (W7d literal git grep in test-value) recordsNonTestCallerSearch keeps the value-card contract (non_test_callers recorded) and accepts git grep, rg, grep or the Grep tool as the search. Severity checks and the golden exclusion are unchanged. Stored evidence: four known-good (three the old check rejected) pass; three known-bad (no search, no caller count, prose only) fail. * test: plan-format accepts any statement that kind-differentiated options are not comparable on coverage (W7d 'options differ in kind' phrase) The outcome, no fabricated Completeness: N/10, stays asserted. The required note now matches any brief wording of the same fact (KIND_NOTE_RE in helpers/plan-format-kind-note.ts). The format-compliance suite that pins the declared kind-note string is unchanged. Stored lines: four known-good pass, three known-bad (a completeness score, a recommendation, 'kind to the user') fail. * test: plan-mode smokes check the targeted plan, not the scope-gate announcement, and reject plan-file ## Decisions (W7d exact scope-gate line; W7g plan-mode ## Decisions) - Seeded eng/design plan-mode cases keep 'no scope menu' and replace the exact 'Scope gate: plan mode — auto-selected B' requirement with seededPlanTargeted(): the announcement or native seeded-plan selection, or seed-only plan names appearing in the review output after the slash command (trackTokens). The announcement is logged. - The AskUserQuestion format forbids writing a decision to the plan file as a substitute for asking. assertNoPlanFileDecisions() fails any plan_ready run whose plan carries ## Decisions (eng, design, devex, office-hours auto-mode). The AUQ-blocked cases (eng seeded, devex, office-hours) now require outcome 'asked' (AskUserQuestion variant or prose fallback). - plan-mode-evidence registration controls keep their verdicts; the missing-decisions control now fails on 'without a question'. - plan-mode-targeting.test.ts stores known-good (announcement; paraphrase plus seed content) and known-bad (neither; an untracked token) observations and plan files with and without ## Decisions. * test: plan-design judge selection check anchors on the question-procedure heading (W7a judge-anchor move; touchfiles.test.ts:219) Same structural anchor as the other judge-anchor moves; selects the same text on the current templates and after the '## How to ask questions' rename. * test: CEO plan-mode failure message names the current rule, not the '## CRITICAL RULE' heading (t13 F20) * test: browse reference judge gates on its stated floors; the baseline comparison is recorded, not a ratchet (W7d browse judge baseline ratchet; t08 F7) expect(regressions).toEqual([]) compared a noisy three-sample mean against eval-baselines.json (clarity 4), silently raising the stated clarity floor of 3. The comparison stays in judge_reasoning; pass and assertions use BROWSE_JUDGE_FLOORS (clarity 3, completeness 4, actionability 4). Judge prompt and schema are unchanged. Stored panel means: three known-good (two the ratchet rejected) pass; three below-floor panels fail. * test: eval-kinds drops the exact 22 behavior / 25 judge census (W7d exact count in eval-kinds; t12 F6) The kind contract is already asserted: every live case has one kind, kinds are rule/behavior/judge, every LLM judge is judge-kind, every behavior case has a literal registration and a BEHAVIOR_WHY, and the named contract-shaped cases stay rule. The census count only broke on adding or retiring a case. * test: plan-eng artifact case binds to the hermetic state root and requires the artifact; report case drops its shouted requirement (W7g plan-artifact fixture binding; W7g skill-e2e-plan.test.ts:479,720) - plan-eng-review-artifact: actor, observer and cleanup use one isolated GSTACK_HOME (the hermetic run's, or a seeded temporary one when hermetic mode is off) and the slug gstack-slug resolves for the fixture, instead of os.homedir()/.gstack/projects/test-project. A guard refuses a state root under the real home, and cleanup removes only the fixture's project directory. The 'IMPORTANT … you MUST write the test-plan artifact' line is replaced by the environment fact (state root and slug). The soft warning becomes an assertion: exactly one new *eng-review-test-plan-*.md about the reviewed dashboard change. - plan-review-report: removes 'CRITICAL REQUIREMENT … MOST IMPORTANT deliverable' and the restated report contract; keeps 'plan.md is the plan file'. The existing assertions (report present, last, rows, unresolved status) now measure the skill's own report prose. * test: session-runner-tools checks harness prompt properties, not a byte-for-byte copy (W7e session-runner-tools.test.ts:544; t09 F7, F8) The ship capture prompt test asserts its purpose (no CEO-only writing guidance) plus the functional rules: one allowed skill path, AskUserQuestion unavailable, the section Read rule, no git/gh/mutation, and the REPORT.md path. The two 'MUST actually Read' pins match the Read rule case-insensitively. Negative control: dropping the no-mutation rule from the harness prompt turns the test red. * test: section-capture native tools checks harness prompt properties, not a copied golden (W7e section-capture-native-tools.test.ts:467; t04 F4) Asserts the absolute skill path is the only SKILL.md named, the scenario, AskUserQuestion unavailable, the section Read rule (case-insensitive, also at :308), no git/gh/mutation, and the REPORT.md path. argv/tool-list checks are unchanged. Negative control: dropping the no-mutation rule turns it red. * test: office-hours review-preservation judge test keeps its schema and untrusted-data checks, not its wording (W7e office-hours-completion.test.ts:416-429; t09 F10) Drops 13 phrase pins on the judge prompt. Kept: both inputs carried as JSON, the response schema (wire format), and the separate untrusted-DATA test. The validator behavior tests already use stub judges. Negative control: changing the schema string in the prompt builder turns the test red. * test: docsync lifecycle interface drops pins on its own helper prompt (W7e docsync-lifecycle-interface.test.ts; t02 #17) docsNativeInterface is the test helper's own prompt, so its sentence pins only checked that the helper says what it says. Kept: owned skill path, the two extracted lifecycle commands (exact), the scripts-list interpolation, the repo path and Git read examples, and every docsCommandAllowed / docsToolFailures behavior check that enforces the interface. * test: shared-libs revalidation prompt keeps its machine-shaped checks, not ~69 phrase pins (W7e shared-libs-revalidation-prompt; t11 #3, #8; t05 F17) reviewRevalidationPrompt and reviewPrompt are test-owned harness prompts (non-test callers: 0); the paid shared-libs E2Es measure whether they work. Kept: the three exact receipt commands, base-prompt prefix and resumed suffix identity, branch selection (actor / default / resumed coverage), the state path and turn-budget interpolations, read-record-before-diff and first-response-before-start ordering, no embedded token, no supplied Skip answer, reusable:true before reusable:false, the captured R59 stage boundaries in the exclusion list, asset roots and interfaces, and the stale step-6 reference ban. The review template's Step 4.7/4.8 completion rule is matched by step number on one line, not by sentence. Negative control: reordering the diff-read instruction turns the test red. * test: plan-design SDK fixture pins its harness prompt once, by ordered properties (W7e plan-design-sdk-fixture.test.ts:91-120; t01 F13) The prompt was pinned three ways (sha256, ~20 sentences, an order check). Kept: the skill and lazy-section paths, the plan path, the ordered read -> review -> edit -> Write -> read-back -> summary steps, and the no-browsing rule (case-insensitive). Dropped the hash and sentence pins. Negative control: removing the read-back step turns it red. * docs: overlay benchmark contract v3 (dedicated-tools gate = correct output + 20% fewer Bash) * test: dedicated-tools overlay case pinned to claude-opus-5-5 (E2) * chore: regenerate SKILL.md, goldens and context-budget fixture for the Opus 5.5 prompt cleanup * document-release: CHANGELOG-preservation and VERSION-ask rules at normal volume (s10 M4, M5; UC2, eval-gated) * chore: regenerate document-release * Revert "test: dedicated-tools overlay case pinned to claude-opus-5-5 (E2)" This reverts commit |
||
|
Garry Tan
|
dcaea52800 |
v1.91.7.0 feat: add functional QA and pre-publication docs checks (#2983)
* feat: add surface-aware exploratory QA and ship documentation gates * test: preserve delegated QA setup authority after main integration * fix(qa): clarify exploration order and preserve report artifacts * test(qa): follow the shared setup reference directly * refactor(ship): make verification and recovery routes explicit * test(ship): align evidence and review guards with explicit routes * fix(workflows): clarify ship recovery and functional QA evidence * fix(workflows): clarify approval recovery and full QA coverage * refactor(workflows): order review transactions and clarify ship state * fix(ship): clarify final verification and fail closed at publication * fix(evals): attribute native atomic documentation writes * fix(ship): clarify recovery and documentation lifecycle guidance * fix(test): preserve observed native placeholder styling in CI * fix(codex): report watchdog timeouts without a process-exit race * Checkpoint functional QA implementation and workflow validation repairs * Fix documentation and shared-review fixture contracts * docs: clarify judge reuse and evaluation supervision * test: align review evidence and selected case contracts * test: verify append-only documentation checkpoints and recovery * fix: qualify QA workflows and CI validation repairs * fix: launch shared-libs fixture scripts on Windows * fix: qualify QA deadlines, fixture isolation, and shard cleanup * fix: preserve qualified QA and cancellation repairs * fix: enforce functional fixture authority and share strict event decoding * fix: retain free-test evidence and explain recovery * fix: reject malformed native evidence after decoder consolidation * test: use reliable capture for telemetry privacy filters * test: refresh measured quick coverage and document validation costs * Fix native fixture receipts and preserve VM validation evidence * Align negative judge controls with upstream clarity policy * Fix report-only QA preparation and public evidence handling * Clarify QA-only preparation and current-report preservation * Stream Ship quality judgments with an explicit 64k response contract * Validate compact judge reasoning locally with supported wire schema * Align functional QA fixture instructions with evidence acceptance * Bind native browser diagnostics to execution evidence and align review verdicts * Preserve native diagnostic line boundaries * Serialize functional QA evidence from native captures * Keep large QA evidence fixture payload out of Windows argv |
||
|
Garry TanandClaude Fable 5
|
c86e6472eb |
v1.67.1.0 fix: external-contributor security sweep — 6 findings hardened, regression-pinned (#2605)
* fix(redact): block real all-caps URL passwords, not just shape-match urlPasswordIsPlaceholder skipped any password matching /^[A-Z][A-Z0-9_]*$/, so a real DSN like postgres://admin:PROD2026SECRET@db-prod.internal/app slipped the HIGH pre-push block. Replace the shape rule with an anchored, exact-match set of doc-convention placeholder tokens (PASSWORD, PASS, CHANGEME, ...), compared case-sensitively and never as a substring (PROD2026SECRET must not match SECRET). The USER:PASSWORD doc convention still suppresses; real all-caps and lowercase passwords block. Regression cases pinned both directions. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(browse): write self-contained .gstack/.gitignore unconditionally ensureStateDir only appended .gstack/ to the project .gitignore when that file already existed, skipped silently on ENOENT, and swallowed other append failures. With BROWSE_PERSIST_STATE=1, session-state.json (live cookies + localStorage/sessionStorage tokens) and browse-network.log / browse-audit.jsonl (request headers) then sat git-add-able under <git-root>/.gstack/. Write a self-contained <stateDir>/.gitignore containing "*" unconditionally, before return, so the state dir's contents can never be committed regardless of the project .gitignore. The project-.gitignore append is kept as redundant safety. The no-import-side-effects guard is relaxed to allow exactly this lone .gitignore guard file (still fails on browse.json / session-state.json / logs / listener binds) — the guard is written eagerly by ensureStateDir at import and is not leaked state. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(browse): restore Bun.spawn exited/drain/OOM-cap contract on Node polyfill The v1.65 fork-port squash silently dropped the `exited` promise, eager stdout/stderr drain, and 16MB GSTACK_SPAWN_MAX_BUFFER cap that v1.64 added (#2571), plus the five tests pinning them. On the Windows Node fallback, `await proc.exited` then resolved to undefined immediately — cookie-import, isBrowserRunning, and browser-skill children all read stdout before the child produced it, a silent failure. Re-land the block (keeping v1.65's windowsHide comment improvements) and re-add the pinning tests. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ios-qa): compile the private-API touch bridge out of Release builds PR #2264 claimed DebugBridgeTouch.m (KIF-derived in-process touch synthesis using private UIKit/IOKit symbols: _touchesEvent, IOHIDEventCreateDigitizer*, _AXSSetAutomationEnabled) was "compiled out in Release," but the body was gated only by TARGET_OS_IOS, so a Release iOS build carried the private symbols (App Store rejection risk). The safety half of the fix (closed PR #2269) never landed. Gate the body on `#if TARGET_OS_IOS && DEBUG` and add the cSettings DEBUG define to the DebugBridgeTouch target so `#if DEBUG` is true in debug and false in release (mirrors the Core/UI swiftSettings). A free static tripwire pins both halves; the nm/strings symbol proof needs an iOS-SDK build and belongs in the device/periodic tier. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs(egress): state truncation/deletion of the ledger are out of scope gstack-egress verify catches in-place edits, reordering, and mid-chain deletion (the hash chain breaks) but not tail-truncation, whole-file re-fabrication, or deletion — a same-user local actor who owns the ledger defeats those and verify still exits 0. That matches the stated threat model (forensic observability, not an exfiltration control). Document it in the header threat model and the usage text rather than adding a count-sidecar, which would false-positive on every legitimate rotation and barely raise the bar. Head-anchoring stays the tracked rotation TODO in lib/egress-receipt.ts. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ship): scope the App Store Connect key to one app and disclose it at exit The release flow minted a non-expiring APP_MANAGER key with allAppsVisible:true (standing authority over every app on the team) and was told never to mention any credential to the user, so the durable key never reached their revocation checklist. Scope the key to the app being released via the apps relationship (allAppsVisible:false + an explicit apps association — required, since a no-app key can see nothing and uploads fail), and disclose the key once in the closing report with its ASC revocation path. Carve the exit disclosure as the explicit exception to the mid-run no-credential-talk rule so the one-authorization-moment contract still holds. Edited the .tmpl source and regenerated the section. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * harden(browse): constant-time bearer-token comparison in validateAuth The loopback auth check compared the Authorization header with `===`, whose byte-by-byte early exit leaks the token prefix through response timing. Use crypto.timingSafeEqual with a length gate (the length is not secret). Behavior is unchanged for valid/invalid tokens; auth tests unaffected. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test: pin the security-property regression guards from pre-landing review The pre-landing review found the fixes were correct but three regression guards were missing — each pins a property whose silent revert would keep behavior identical while reopening the hole: - validateAuth: a static tripwire asserting crypto.timingSafeEqual + the got.length===want.length gate + the null-header guard (a revert to `===` keeps accept/reject green but restores the timing side-channel). - redact: a table-driven loop over the exported URL_PASSWORD_PLACEHOLDER_WORDS so a typo or dropped entry can't silently start blocking a doc placeholder; plus a substring-can't-rescue-a-real-secret assertion. - config: assert the self-contained .gitignore is written even when git already ignores .gstack/, proving the write precedes the isIgnoredByGit early return. - bun-polyfill: cover the 128+signal exit branch (POSIX only). URL_PASSWORD_PLACEHOLDER_WORDS is exported so the table test can't drift. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore: bump version and changelog (v1.66.2.0) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs: sync egress-verify scope and layered iOS Release guard into user docs ARCHITECTURE.md and README.md now carry the same gstack-egress verify scope disclosure the CLI ships (edits/reordering/mid-chain deletion detected; tail-truncation and ledger deletion out of scope for a forensic log). docs/howto-ios-testing-with-gstack.md documents the second Release-build guard: DebugBridgeTouch.m compiles out behind #if TARGET_OS_IOS && DEBUG via the cSettings DEBUG define. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs(ios-qa): call the DebugBridge targets SwiftPM targets, not Swift targets DebugBridgeTouch is Objective-C (the same sentence says so); "Swift targets" was the wrong word. Cross-model doc review catch. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs(changelog): describe the all-caps DSN examples without a scannable URL shape The v1.66.2.0 entry quoted its own headline fix as three literal postgres://user:PASSWORD@host examples — which the branch's stricter HIGH gate now correctly flags, failing CI's quality scan on this very PR (the local pre-push hook passed because the installed gstack still runs the old engine). Rewrite the three mentions: the reproduce command uses a fully-braced shell interpolation (suppressed in the diff scan by design, expands to the real all-caps password at runtime, still exits 3 — verified), and the table row + Fixed bullet name the password token without the URL shape. Gate scan on the amended diff: 0 high. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * ci(evals): pre-seed one-time preamble markers for PTY smokes Root cause of the documented intermittent scope-gate-question-NOT-observed failure (test/skill-e2e-plan-mode-no-op.test.ts, also PR #2593 rounds 3/11): on a fresh runner every one-time preamble marker is missing, so each PTY child runs first-run feature discovery before the behavior under test, and touching .feature-prompted-model-overlay under ~/.claude/skills/gstack/ trips Claude Code's sensitive-file permission prompt — the run stalls on that dialog (classified outcome=asked) and the scope gate never renders. Dev machines never reproduce it because the operator's markers exist. Seed ~/.gstack one-time markers (.activated, .first-loop-tip-shown, .telemetry-prompted, .proactive-prompted, .completeness-intro-seen, .plan-tune-nudge-shown) and both .feature-prompted-* markers (via the gstack root symlink into the checkout) in the PTY-smoke registration step, so no first-run prompt can preempt the assertion under test. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore: re-version release as v1.67.1.0 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix: restore main's dependency manifest clobbered by the merge resolution The v1.67.0.0 merge resolved the package.json conflict wholesale --ours, which kept this branch's version stamp but erased main's dependency work (playwright 1.58->1.62 + its patchedDependencies entry, transformers 4.1->4.2, cross-spawn added, puppeteer-core removed — which is also why main dropped the basic-ftp pin test: the pinned package left the tree with it — marked/socks bumps, adm-zip override) while bun.lock auto-merged to main's side. Every CI job that runs `bun install --frozen-lockfile` failed on the mismatch (check-freshness, quality, free-tests, gate, windows x2). Take main's package.json + bun.lock verbatim, re-stamp the version through gstack-version-bump (1.67.1.0). bun.lock is now byte-identical to main's; frozen install verified locally; full free suite green for the branch. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> |
||
|
|
2be6c06ba8 |
v1.65.0.0 feat: fork port wave 2 — feature fixes, session persistence, Apple releases, supply-chain CI (#2577)
* fix(memory-ingest): pass --include-gitignored to gbrain import gstack-artifacts-init writes an ignore-everything .gitignore (a bare `*`, headed "Do not edit") at the root of ~/.gstack. The memory ingest stages pages into ~/.gstack/.staging-ingest-<pid>-<ts>/, which is inside that repo, and gbrain's markdown collector honours .gitignore. The collector therefore matches every staged file against `*` and collects zero. The failure is silent. gbrain import exits 0 having imported nothing while the ingest prints `written: N` from the STAGED count rather than the imported count, so a run that indexes nothing looks identical to a healthy one and the memory corpus quietly stops growing. Reproduction, using git's own ignore machinery (no gbrain needed): git init . mkdir -p .staging-ingest-12345/learnings echo x > .staging-ingest-12345/learnings/page.md printf '*\n' > .gitignore git ls-files --others --exclude-standard # -> empty Passing --include-gitignored makes the import independent of whatever .gitignore sits above the staging directory. Adding a negation to the generated .gitignore is the alternative, but that file is gstack-owned and marked "Do not edit", so any regeneration silently reintroduces the bug. Adds a regression pin in the shape of memory-ingest-no-put_page.test.ts, plus a behavioural test for the collision itself. Both source pins fail against the unpatched file. * fix(memory-ingest): GIT_CEILING_DIRECTORIES defense-in-depth on the import child (#2144) Second layer under #2560's --include-gitignored: a realpath'd ceiling at the staging dir's parent pushes any git-enumerating collector off the git fast path (which sees zero files under ~/.gstack's ignore-everything root) onto its plain FS walk, even on gbrain builds whose flag semantics drift. Ceiling is realpath'd because git compares canonicalized directories during discovery — a staging dir reached through a symlink (macOS /var -> /private/var, symlinked $GSTACK_HOME) otherwise never matches. Behavioral tests prove discovery stops at the ceiling from the staging dir, including through a symlinked path, using git itself — no gbrain required. Mechanism ported from time-attack/gstack (GStack 2). Co-authored-by: Sina Matian <sina@time-attack.dev> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(autoplan): Phase 4 task aggregator emitted zero tasks on every run (#2018) The branch+commit jq filter piped to the split commit array and then referenced .commit — jq rebinds context across a pipe, so .commit indexed the ARRAY with a string, every input line errored into 2>/dev/null, and || true swallowed the exit. The aggregate table has been empty for every user since the feature shipped. Bind .commit to a variable before the pipe. Functional pin extracts the ACTUAL emitted jq program from the resolver and runs it against fixture JSONL (verified RED against the broken filter), plus a source-shape guard against reintroducing a context-rebinding reference. Fix mechanism from time-attack/gstack (GStack 2). Co-authored-by: Sina Matian <sina@time-attack.dev> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(codex): BSD mktemp templates broke /codex on every macOS install (#2091) macOS mktemp requires the X's to end the template; the five "codex-*-XXXXXX.txt" sites failed with "mkstemp failed ... File exists" before Codex ever ran (reproduced live on this machine). Same class fixed in claude/SKILL.md.tmpl's three sites. bin/gstack-paths now strips macOS's trailing slash from TMPDIR so TMP_ROOT-built paths stop carrying "//". Static tripwire scans every tracked .tmpl for characters after the X-run in a mktemp template (longer X-runs stay valid), plus a live portability check of the emitted shape. Co-authored-by: Sina Matian <sina@time-attack.dev> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(decision-log): --supersede silently discarded the replacement decision The supersede/redact branch appended the retirement event and exited before the JSON argument was ever read — a user recording a reversal WITH its replacement lost the replacement, and the payload finder's first-non-flag-arg predicate would have mistaken the target id for JSON anyway. Payloads are now identified by their leading brace, validated BEFORE any write, and appended FIRST (retirement second), so the only visible interleaving under a crash is both-active — recoverable, never lost. The replacement carries supersedes:<old-id> provenance. Bare --supersede <id> (the documented reversal-without-replacement) stays legal; --redact with a payload now refuses instead of dropping it. Ported from time-attack/gstack (GStack 2), tests included. Co-authored-by: Sina Matian <sina@time-attack.dev> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(brain-context): cold-start probe latency permanently disabled gbrain context gbrainAvailable() spawned gbrain --version under a 500ms budget; a cold CLI start on a loaded machine blew the timeout, misclassified gbrain as missing, and every skill session silently ran brainless — plus the per-query re-probe burned 3x the budget before any real work. Replaced with a memoized stat-based PATH scan (PATHEXT-aware on Windows) and made the query timeout overridable via GSTACK_BRAIN_TIMEOUT_MS for loaded CI environments. Also picks up the fork's manifest-filter coverage (#1687 shape) against the fake-gbrain harness — passes against our existing filter support. Ported from time-attack/gstack (GStack 2). Co-authored-by: Sina Matian <sina@time-attack.dev> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(setup-gbrain): voyage-code-3 flags were silently dropped under zsh (#1798) zsh does not word-split an unquoted $VAR, so all three PGLite-init sites passed the entire flag string as ONE argv word — gbrain ignored it and silently fell back to its default embedding model, downgrading code retrieval for every zsh user (macOS default shell). Flags now ride the positional params (set -- ...; "$@"). Tests run the shape under BOTH bash and zsh against the fake-gbrain argv recorder (per-word argc log distinguishes one-blob from split), include a demonstration of the zsh collision on the old shape, and pin the template's three sites statically. Ported from time-attack/gstack (GStack 2). Co-authored-by: Sina Matian <sina@time-attack.dev> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(model-benchmark): recognize macOS Keychain auth in the claude adapter (#1890) The default macOS Claude Code install stores OAuth under the Keychain generic-password service "Claude Code-credentials" and never writes ~/.claude/.credentials.json, so available()'s file-or-env sniff reported "No Claude auth found" while claude -p worked fine. On darwin the sniff now also probes the Keychain entry — metadata only (no -w, the secret is never read), 5s timeout, any security(1) failure degrades to not-found. Verified live on this machine (subscription install, no creds file, Keychain entry present). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(upgrade): v1.27 migration no longer auto-proceeds without a TTY or records a failed rename as done (#1383) Two silent-failure shapes in one script. Non-interactive runs (Claude Code Bash tool, CI) blanket-auto-proceeded into a REMOTE repo rename — now they skip-for-now by default and ask again next upgrade; unattended runs opt in with GSTACK_MIGRATE_ASSUME_YES=1. And a failed gh rename was journaled as done and the done-touchfile written, permanently stranding a half-renamed install — the failed step now stays PENDING with the manual command printed, finalize refuses the done-marker while any step is unjournaled, and the migration exits 1 with a re-run pointer while completed steps still skip on retry. Harness updated to opt in explicitly; new tests pin the default-skip and failure-stays-pending-then-retry-succeeds contracts (13/13). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ship): REST fallback when gh pr edit hits the Projects-classic GraphQL deprecation (#1079) On repos where GitHub enforces the Projects-classic sunset, gh pr edit hard-errors on repository.pullRequest.projectCards and Step 19's PR body update dies. The template now names the error shape, says it is not an auth problem, and falls back to the REST endpoint (gh api pulls/N -X PATCH) with the SAME already-redaction-scanned temp file for body and title. Generated SKILL.md regen rides the cluster regen commit. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ship): test-command detection was blind to Django and config-less-but-tested projects The Test Framework Bootstrap detected Python only via requirements.txt or pyproject.toml and treated missing config files as no-tests, so a green 'python manage.py test' Django app, a Go project with *_test.go beside the source, in-source Rust #[test] blocks, or a package.json with only a test script all got offered a SECOND test framework over a working one. Detection now enumerates definitive per-ecosystem markers (manage.py, tox.ini/setup.cfg, pom.xml/gradle, Makefile test targets, a tracked-file test census, in-source Rust tests) as EVIDENCE for the question it asks — never a command to run blind — preserving the read-CLAUDE.md-or-ask contract, with a marker→candidate-command table and ask-once persistence. The shared coverage-audit detection block gains the same markers. Test runs the resolver's emitted detection bash against Django / Go / Rust / Node fixtures in throwaway git repos. Ported from time-attack/gstack commit e3259078 (GStack 2). Co-authored-by: Sina Matian <sina@time-attack.dev> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore: regenerate SKILL.md files for cluster A (autoplan jq, codex mktemp, setup-gbrain zsh, ship detection + REST fallback) Atomic regen of the 9 generated files whose templates/resolvers changed in the A-cluster commits. bun run gen:skill-docs, no hand edits. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test: refresh ship goldens + parity ratios for cluster A growth Codex/Factory hosts render single-file ship skills whose committed goldens must track template changes; refreshed from the regenerated renders. Parity size guards bumped with the growth itemized — ship (carve-guards) 1.08 -> 1.10 for the detection-evidence + REST-fallback growth measured at 1.090x, qa (parity-harness monolith invariant) 1.07 -> 1.12 for the shared coverage-audit markers measured at 1.111x. Kept tight so the next growth is a deliberate decision, not drift; the Apple adapter raises ship again with its own justification. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(gbrain-sync): enforce the per-repo policy at the code-import chokepoint (#2140 sync path) The deny/read-only tiers in ~/.gstack/gbrain-repo-policy.json were stored by gstack-gbrain-repo-policy but enforced only in /sync-gbrain skill prose — a direct or cron invocation of gstack-gbrain-sync ingested repo code regardless. Worse: the code stage's egress receipt has cited 'per-repo policy chokepoint (repoPolicyTier)' as its consent since v1.63 while no such function existed. repoPolicyTier() now gates the stage before the dry-run branch: deny → refused-policy-deny (exit 1, loud), read-only → clean skipped-policy-read-only (code ingest writes pages), unreadable store → fail-closed refused-policy-unreadable, no store → unchanged fail-open. Subprocess tests pin all four paths against real git repos and a permission-blocked store (verified RED against the ungated binary). The receipt's consent string is truthful from this commit. #2140's ingest-path source-isolation ask remains open — partial-progress comment at ship. Ported from time-attack/gstack (GStack 2). Co-authored-by: Sina Matian <sina@time-attack.dev> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ios-qa): /auth/sessions no longer hands raw bearer tokens to any local process The loopback sessions list echoed live tokens — a harvest-and-replay primitive for anything on the machine (same class as the /health token leak fixed in v1.63). The list now returns a device-salted 16-hex token_id plus metadata; the salt is shared with the attempts log so identifiers correlate. /auth/revoke keeps the list→revoke workflow alive by accepting token_id alongside the caller's own raw token and identity. saltedHash() is exported from audit.ts and writeAttempt now reuses it (was inlined). Integration tests pin raw-token absence, the id shape/metadata, and the token_id revoke round-trip (verified RED against the leaking handler). List fix ported from time-attack/gstack (GStack 2); token_id revoke is ours. Co-authored-by: Sina Matian <sina@time-attack.dev> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(ios-qa): boot token out of os_log entirely; IPv4 listener pinned to loopback at the socket The StateServer's bootstrap announce logged the live boot token with privacy: .public — and nothing consumed it: the daemon has read the token from the 0600 app-container file since the devicectl copy flow landed. The log line handed a credential to anything reading the unified log during the launch window. It now announces port/build only. The IPv4 listener bound the wildcard interface and relied on the per-connection peer check alone; IPv4 has no CoreDevice tunnel path, so it now binds 127.0.0.1 via requiredLocalEndpoint at the socket level. IPv6 keeps the wildcard bind for CoreDevice ULA peers by design. Static pins cover both the template and the fixture app copy. Ported from time-attack/gstack (GStack 2). Co-authored-by: Sina Matian <sina@time-attack.dev> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(make-pdf): close the offline-gate bypass via raw-HTML fetch vectors With --allow-network off, the sanitizer stripped script/iframe/link but let Chromium fetch remote resources at print time through four raw-HTML vectors: <style> @import (any form), remote url() in <style> blocks and inline style attributes (incl. protocol-relative //), srcset with a remote candidate (Chromium prefers srcset over the inlined src), and remote src/poster on video/audio/source/track. All neutralized at the sanitizer; remote <img src> is deliberately left for the image inliner so its blocked-remote placeholder still fires, and url() mentions in prose/code spans stay untouched. Fork's test suite ported verbatim (12 cases incl. the end-to-end render assertion), verified RED against the old sanitizer. Ported from time-attack/gstack (GStack 2). Co-authored-by: Sina Matian <sina@time-attack.dev> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(pair-agent): tunnel activation is consent-gated — and the receipt's consent claim is now real The tunnel egress receipts have claimed consent: 'pair_agent=on' since v1.63 while no such key or gate existed — ngrok installed+authed was enough for the CLI to auto-start an internet-facing tunnel. isPairAgentEnabled() (fail- closed, env-overridable) now gates all three activation points: CLI auto-start, POST /tunnel/start (refuses with the enable hint), and the BROWSE_TUNNEL=1 startup bind. Consent-on-first-use, not silent breakage: the /pair-agent skill asks once (one-way-door posture), sets pair_agent via gstack-config (registered with on|off validation, default off), and never asks again; direct API callers get the same hint in the refusal. Adapted from the fork's gate: their reader targeted config.json, which on main would have made the gate silently un-enableable — ours reads the canonical ~/.gstack/config.yaml with the JSON shape as fallback, pinned by tests either way (11 cases, gate wiring tripwires included). Ported from time-attack/gstack (GStack 2), store adaptation ours. Co-authored-by: Sina Matian <sina@time-attack.dev> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore: regenerate pair-agent SKILL.md for cluster B (consent gate) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(browse): cancel the parent watchdog when handoff promotes a daemon to headed The parent-process watchdog assumes connection mode is fixed at boot: headless daemons outlive their parent, headed ones do not. The env guards (BROWSE_PARENT_PID=0, BROWSE_HEADED=1) only cover daemons that were headed when they started. handoff breaks that assumption. It swaps in a headed context on a RUNNING daemon and sets connectionMode = 'headed' without a restart, so a daemon that legitimately registered a watchdog lands on the fatal side of the branch. The parent is usually a short-lived shell, and Claude Code's Bash tool kills one after every invocation, so the next 15s poll shuts the daemon down. The user-visible effect is that handoff destroys the thing it just created. It exists so a human can log in, solve a CAPTCHA, or clear an MFA prompt; the browser disappears about fifteen seconds later and takes the session with it. Observed while driving two registrar control panels: five daemon deaths and three logins, each one discarding the authenticated session. BrowserManager now exposes onHeadedPromotion, fired only on runtime promotion and not on a headed boot, and the server binds it to a canceller for the interval it already owned but previously discarded. Bound on both the module-level manager and any embedder-supplied one, since the watchdog reads activeBrowserManager and binding only the default would let embedders promote silently. The binding sits next to the browserManager declaration rather than next to clearParentWatchdog. Placing it with the function, which lives with the watchdog it cancels, reads better but touches browserManager in its temporal dead zone, which aborts module evaluation and leaves every later const uninitialized. findport tests catch that immediately. Tests: watchdog.test.ts already noted in its header that its three cases all fix mode via env at spawn time, so none reaches the headed branch. Driving a real handoff needs a headed Chromium, so the wiring is pinned with static tripwires instead, matching cdp-session-cleanup.test.ts and server-auth.test.ts. Verified they fail when the notification call is removed and pass when restored. Full `bun test` shows the same 6 pre-existing failures on this branch and on main (gstack-gbrain-detect, gstack-artifacts-init), which pass in isolation on both, so they are test-order pollution rather than a regression here. * fix(browse): pass windowsHide so the daemon stops popping console windows On Windows, `browse` leaves empty black console windows on top of whatever the user is doing — they pop up every few minutes for as long as any browser skill is alive, and outlive the process that created them. Cause: `bun-polyfill.cjs` maps `Bun.spawn`/`Bun.spawnSync` onto node's `child_process`, and node defaults `windowsHide` to **false**. Bun never creates these windows, so nothing in the daemon's own code looks wrong — the behaviour only appears on the node fallback path. The one users notice is `spawnTerminalAgent()`, which launches `bun run terminal-agent.ts` through this shim. The daemon respawns it on a watchdog, so closing the window is not enough — a new one arrives shortly after. Ten `bun.exe` processes were live on the machine this was diagnosed on. Why they linger after the child exits: with the default terminal application set to "Let Windows decide", the console is brokered through Windows Terminal via svchost, and WT leaves the empty frame behind when its only child exits. The frame has no child process at all, which is why it looks like a dead terminal. Setting `windowsHide: true` on both wrappers fixes every console child routed through the shim — the bun agent plus the `tasklist`, `git` and `powershell` calls elsewhere in the daemon. No behaviour change on macOS or Linux, where the option is ignored. Not covered by this commit: `chromium.launch()` goes through playwright's own process launcher rather than this shim, so it still creates one window per daemon start. Worth a follow-up. * test(browse): make bun-polyfill tests runnable on Windows, and cover windowsHide `bun test browse/test/bun-polyfill.test.ts` was **0 pass / 4 fail on Windows** before this — every test in the file, on the platform the polyfill exists to support. Each test interpolates the polyfill's absolute path into a single-quoted JS string passed to `node -e`. On Windows that path has backslashes, so JS eats them as escapes: 'C:\Users\jwilk\dev\gstack-fork\browse\src\bun-polyfill.cjs' -> C:Usersjwilkdevgstack-forkrowsesrcun-polyfill.cjs (`\b` is a real escape, so it deletes a character too.) `require()` throws, the subprocess dies, stdout is empty, and every assertion compares against "". The tests pass on macOS and Linux purely because those paths have no backslashes. Fixed by interpolating with `JSON.stringify(polyfillPath)`, which quotes and escapes correctly on all platforms. Also adds a regression test for the windowsHide fix in the previous commit. It stubs `child_process.spawn`/`spawnSync` *before* the polyfill destructures them and asserts the captured options, so it is deterministic and needs no window — it verifies the contract on macOS and Linux too, where the option is a no-op. Verified on Windows: 5 pass / 0 fail with the fix, and the new test alone fails ("VISIBLE" instead of "HIDDEN") when the previous commit is reverted. * fix(browse): forward windowsHide through the Bun polyfill spawn shims The Node fallback shim accepts a Bun.spawn options object and forwards only stdio, env and cwd to child_process.spawn. windowsHide is dropped, and because Node defaults it to false while Bun.spawn hides the console window, the omission inverts the behavior on the one platform the shim exists to support. Symptom: the terminal-agent respawn in server.ts (60s watchdog ticker) pops a visible bun.exe console window on Windows every time it fires, so the window keeps coming back with no scheduled task or startup entry behind it. stdio:'ignore' silences the child's output but does not suppress its window. Both shims now forward the option and default it to true, matching the Bun API being emulated; an explicit windowsHide:false still passes through. spawnTerminalAgent also sets it explicitly at the call site. Tests: three cases in browse/test/bun-polyfill.test.ts assert the default for spawn and spawnSync and that an explicit false is honored. Each was confirmed to fail against the unpatched shim. Drive-by, required to run the suite at all on Windows: the tests interpolated an absolute path into a JS string literal, so backslashes were consumed as escapes and every require() failed with MODULE_NOT_FOUND. The path is now normalized to forward slashes. On Windows this file went from 0/4 passing to 7/7. * fix(browse): headed mode on macOS 26 — stop mutating the signed Chromium bundle, heal the ones we already broke (#2242, #2138, #2139) The in-place rebrand rewrote the Chrome-for-Testing bundle's Info.plist (global name replace — which also renamed CFBundleExecutable to a binary that doesn't exist) and overwrote its Resources/*.icns, breaking the codesign seal: GPU process exit_code=5, headed mode dead on macOS 26. The mutation lived in the SHARED Playwright cache, so it also poisoned the user's other Playwright projects. Three layers land together: (1) the rebrand block is gone — branding lives in the GStack Browser.app wrapper via GSTACK_CHROMIUM_PATH, with a tombstone and a static tripwire (no plist/icns writes into the bundle; the tripwire allows the read-only probe below); (2) a launch-time self-heal detects an already-poisoned cache bundle, removes it, and errors with the exact re-fetch command — covering deploy paths that never run migrations; (3) migration v1.64.0.0 sweeps every cached bundle, removes poisoned ones, and re-fetches clean Chromium immediately (migrations run after ./setup, so without the re-fetch an upgrade would end with zero working browser). Functionally verified against fixture caches: poisoned removed, clean untouched, rerun no-op. Migration filename tracks the final VERSION at ship. The #2242 watchdog half is the absorbed PR #2565 (thanks @Screddyice). Tombstone/tripwire ported from time-attack/gstack (GStack 2); self-heal and migration are ours. Co-authored-by: Sina Matian <sina@time-attack.dev> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(browse): 'browse stop' no longer restarts the daemon it was asked to stop The stop handler awaited shutdown() — which ends in process.exit — before returning, so the acknowledgement never egressed. The CLI's fetch reset, which its crash path reasonably interpreted as a dead daemon: it relaunched Chromium, re-sent stop, watched the daemon exit again, and errored 'Server crashed twice in a row'. Every stop cost a wasted Chromium launch and a nonzero exit. The ack now returns first; shutdown fires on a 25ms unref'd timer. Same fix for restart. Fork's test pins ack-before-teardown for both. Ported from time-attack/gstack (GStack 2). Co-authored-by: Sina Matian <sina@time-attack.dev> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(browse): lock acquisition reports real errors instead of phantom contention (#1084) acquireServerLock's bare catch treated EVERY failure as 'another process holds the lock' — a missing state dir, EACCES, or ENOSPC read as permanent phantom contention with nothing to debug. Now only EEXIST is contention: ENOENT self-heals with one mkdirSecure retry, everything else throws ServerLockError carrying the real errno, and the stale-lock unlink/retry loop is depth-capped so it can't livelock. Fork's five-case test ported. Ported from time-attack/gstack (GStack 2). Co-authored-by: Sina Matian <sina@time-attack.dev> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(browse): integration coverage for #1781 busy-vs-dead recovery Fork's wedged-daemon fixture: first /command connection drops, daemon PID stays alive. Pins the whole contract — CLI retries the same daemon instance without a kill, state file untouched, no restart, exactly two command requests. Message-text assertion adapted: our CLI retries silently at the probe layer where the fork announces on stderr; the behavior, not the message, is the invariant. Ported from time-attack/gstack (GStack 2). Co-authored-by: Sina Matian <sina@time-attack.dev> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(browse): windowsHide on every Windows-reachable spawn (#1835) Console windows flashed (and stole focus) on every daemon relaunch, taskkill, tasklist poll, and powershell DPAPI call — node-level spawns default windowsHide to false. Covered: the node -e launcher (outer spawnSync AND the inner detached daemon spawn inside the launcher string), the dev-mode bun fallback, killServer's taskkill, isProcessAlive's tasklist, and cookie-import's powershell + tasklist. The Bun-polyfill shims were covered by absorbed PRs #2523 + #2539 (thanks @jwilk-hrep, @jerrynicholsai); this closes the sites those PRs didn't reach. The icacls sites land with the #1605 DACL commit alongside the static tripwire that pins all of them. R8's planned spawnHidden() helper is deliberately NOT built: the polyfill default plus the tripwire achieve the no-drift goal without indirection over seven heterogeneous call shapes. The polyfill + spawn-hide tests join the Windows CI shard. Ported from time-attack/gstack (GStack 2). Co-authored-by: Sina Matian <sina@time-attack.dev> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(browse): self-repair broken Windows DACLs on state dirs (#1605) icacls '/inheritance:r /grant:r' can partially fail on localized or domain accounts: inheritance strips but the user grant doesn't resolve, leaving a machine-SID-only DACL the owner can't even list — the sidebar/PTY failure chain in #1605, caused by the very hardening call meant to protect the dir. mkdirSecure now verifies listability after hardening (a real readdir — fs.accessSync doesn't consult NTFS ACLs) and repairs via icacls /reset, re-hardens, and if hardening breaks access again leaves inherited ACLs: functional-but-unhardened beats hardened-but-unusable. The icacls calls carry windowsHide (#1835's last two sites) and the fork's static spawn-hide tripwire lands here, pinning every covered site. file-permissions.test.ts is already in the windows-free-tests curated shard, so the DACL contract executes on windows-latest. Ported from time-attack/gstack (GStack 2). Co-authored-by: Sina Matian <sina@time-attack.dev> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(browse): opt-in session persistence — auth survives daemon restarts (#778, #2193) BROWSE_PERSIST_STATE=1 snapshots cookies + per-tab URL/localStorage/ sessionStorage to <stateDir>/session-state.json (0600) on a 30s unref'd interval and at clean shutdown, and restores on the next launch — killing the top-complained auth-lost-on-restart class (#778, #2193, #1128, #1129). Security invariants mirror state save|load: loadedHtml and owner are never persisted and never accepted from disk; restored cookies pass the same hygiene filter (localhost/.internal/metadata domains dropped); restoreState re-validates every URL. Default OFF; headed mode excluded (the persistent profile owns that state). Hardened past the fork's shape per review R3: corrupt state quarantines to .corrupt (forensic artifact, boots fresh, one log line), snapshot failures warn once and never kill the daemon, and the boot log reports restored counts or fresh-session status. Module + 10 tests ported (MIT header retained); server wiring at launch, interval, and shutdown; skill docs section added (regen rides the cluster regen commit). Ported from time-attack/gstack (GStack 2). Co-authored-by: Sina Matian <sina@time-attack.dev> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore: regenerate browse SKILL.md for cluster C (session persistence docs) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(skills): third-party web-actions contract — offer to drive vendor-site steps, never just dump a manual list When a workflow needs something done on an external website the user controls (register an API key, create a vendor account, configure a dashboard/webhook/OAuth app), five skills (ship, spec, office-hours, setup-deploy, land-and-deploy) now follow one contract: offer to drive it in a visible browser via gstack's own stack ($B headed + handoff/resume, GStack Browser) behind ONE per-task consent question naming the exact site and actions; passwords, payment, CAPTCHA, and identity stay user-performed; captured secrets go to owner-only files or the user's secret store, never chat/logs/history; and the credential is verified with one non-mutating API call before any success claim — dashboards show masked placeholders, and a 401 catches them. Declining yields manual steps and a blocked-on-user mark; nothing new is ever installed to close the gap. New resolver token {{THIRD_PARTY_ACTIONS}} (adapted from the fork's contract — their Aside-browser detection swapped for our own driver stack; MIT portions noted). Parity guards bumped with growth itemized (ship 1.10->1.12 at measured 1.103x; office-hours skeleton 101K / 1.09 at measured 1.079x); ship goldens refreshed. Ported from time-attack/gstack (GStack 2), driver adaptation ours. Co-authored-by: Sina Matian <sina@time-attack.dev> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(office-hours): design docs land in the repo, written as decision records (#703, #2000) Office-hours Phase 5 now dual-writes the design doc: the docs/designs/ copy is what teammates and plan reviews read (committable, visible), while the ~/.gstack copy keeps memory ingest and cross-session discovery working. The repo copy leaves the private store, so it passes the redaction scan-at-sink first (HIGH blocks the repo copy, MEDIUM confirms per finding), and any failure — read-only checkout, non-git dir, unconfirmed finding — degrades to the private copy with a one-line reason, never blocking the handoff. The doc itself is now a decision record, not a transcript: one bullet per decision with its why, ruled-out approaches collapsed to a single line with the rejection reason, settled/empty template sections omitted. No page cap; extra length must come from genuinely open questions. Plan reviews (ceo/eng/devex + the shared review resolver) prefer the repo-local doc (DESIGN.md, then newest docs/designs/*.md) when it's at least as fresh as the private copy — a stale old repo doc never shadows a newer session. Parity guards bumped with measured values (three plan-review skeletons +~0.7KB each; office-hours 1.092x). Judgment ported from time-attack/gstack (GStack 2); scan-at-sink and freshness-preference adaptations ours. Co-authored-by: Sina Matian <sina@time-attack.dev> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(office-hours): 'never show me these again' for the founder-resources pitch (#538) The Phase 6 resources offer (34 PG essays + Garry/YC videos) had no permanent decline — the reporter showed memory instructions kept being overridden on every update, so people who said no got re-pitched forever. The offer now closes with a standing choice; opting out runs gstack-config set founder_resources false (new key, default true, true|false validated), the write is VERIFIED before any promise (a failed write says so and skips this session only), and every future session skips the entire section silently — no resources, no 'skipped as requested' mention. Config outlives session context, so never means never. Re-enable anytime: gstack-config set founder_resources true. The pitch stays default-ON for everyone who never opted out. Tests pin the key's default/persistence/validation through the real config bin and the generated section's gate-before-content + write-verify contract. Approved as a promo-surface change (CEO review D3.4, 2026-08-14). Ported from time-attack/gstack (GStack 2). Co-authored-by: Sina Matian <sina@time-attack.dev> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(ship): the Apple App Store release journey — working tree to Submit for Review Point /ship at a repo with an .xcodeproj, .xcworkspace, or app-product Swift package and ask to release: the adapter runs the whole journey with ONE authorization moment (membership + pricing + in-session sign-in, decision- store persisted so repeat releases ask nothing) and one store-assets question only when assets are missing. fastlane is the single tool (produce/cert/ sigh/gym/pilot/deliver/frameit); credential vocabulary never reaches the user. The adapter carries 21 live releases' worth of paid-for Apple knowledge: the web session mints the permanent upload key itself (iris POST /v1/apiKeys; privateKey is base64-of-PEM, downloadable only at creation) so nobody ever types an app-specific password; error -22938 is Transporter asking for a key, not a user task; errors are CLASSIFIED before credentials are touched (validation/UnexpectedResponse = metadata, incl. Apple's expanded age-rating attributes); pricing goes through POST /v1/appPriceSchedules because fastlane's price_tier is broken against the current API; and store distribution NEVER routes through the branch gate — a clean tree on main is the solo shipper's normal case (Step 0.9 loads the adapter BEFORE the gate, pinned by test with the non-Apple gate byte-unchanged and unique). Uploads/submissions follow an idempotency-log contract (inspect App Store Connect before any re-run). Non-Mac hosts get the honest split: build legs via a macOS CI runner with the minted key as a secret, API legs local. Browser use inside the journey is banned except the named paid-app banking/tax residue. Redaction dry-run clean. Ship's parity ratio raised 1.12 -> 1.22 deliberately: the 14.8KB section is on-demand (Apple store targets only), one manifest line otherwise. Ported from time-attack/gstack (GStack 2), refined across its 21 live releases; architecture adaptation (carved section, decision-store paths, idempotency log, third-party-actions handoff) ours. Co-authored-by: Sina Matian <sina@time-attack.dev> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(code-intelligence): provider contract Phase 1 — GBrain, Sourcebot, Graphify behind one ask-once offer Open a large repo (1,000+ tracked files) and gstack can offer code intelligence ONCE, with the trade-offs stated: GBrain (semantic memory + code, sends content to YOUR gbrain DB, per-repo consent), Sourcebot (self-hosted whole-repo search, local on localhost), Graphify (local tree-sitter graph, nothing leaves the machine, user-installed), or No indexing — a decline persists machine-wide so no skill ever asks again. Small repos never see the question; grep stays the always-working default and provider-OFF degrades silently (PROVIDER_UNAVAILABLE -> file-only). Ported: lib/code-intelligence/ (contract + 3 verified adapters + picker + selection + suggest, MIT headers), the gstack-code-intelligence CLI (suggest/select/consent/index/search/status), 31 offline tests (fake CLI shims + injected fetch), and the provider-contract design doc. Verified live on this repo: suggest fires at 1,233 files with real availability detail per provider. Hardened per review: the per-remote trust store is the SINGLE consent authority — a gstack-gbrain-repo-policy deny tier vetoes any recorded code-intelligence consent (fail-closed on an unreadable store, pinned by three tests); both send-capable adapters are registered as fail-closed MODULE_SINKS in the egress tripwire so a refactor can't drop their receipts; and local-compute vs remote-send consents are never bundled. setup-gbrain gains the provider-choice Step 0. The fork's Phases 2-4 glue-collapse is explicitly NOT ported. Ported from time-attack/gstack (GStack 2); consent unification ours. Co-authored-by: Sina Matian <sina@time-attack.dev> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(ci): supply-chain hygiene — secret gate on every PR diff, dependency review, OSV, dependabot, evidence-bar PR template The repo owned a redaction engine and had zero CI-side secret scanning. quality-gate.yml now pipes every PR diff's ADDED lines through our own bin/gstack-redact (gate-secret-scan.mjs, taken from the fork — it dogfoods the engine): HIGH findings fail the check, MEDIUM prints an advisory count only (no human in CI to confirm), planted-bug fixtures excluded by pathspec. Live-verified both directions: PEM key fails, clean diff and MEDIUM shapes pass; ShellCheck (errors) covers the setup/build shell boundary and passes today; bun audit gates critical advisories. Trigger is pull_request, never pull_request_target. dependency-review.yml adopts the hardened never-merged prior-art branch (fail-on-severity high, workflow paths watched, tight perms) — verify the dependency graph parses bun.lock with a canary bump before trusting the gate. dependabot: weekly, grouped per ecosystem, capped PR counts; and evals.yml image build/push now skips dependabot actors, whose read-only GITHUB_TOKEN made every lockfile bump a permanently red check. OSV scans weekly with a reasoned ignore file. All new workflow actions SHA-pinned. Scorecard deliberately not taken (no consumer for the score). The PR template front-loads the evidence bar (live proof, liveness screenshot, no-ETHOS/voice-changes checklist); the unenforced DCO line is dropped. bin/gstack-verify-gate ships OPT-IN (never registered by ./setup — a Stop hook running the project's verify command after every turn is the user's call), with the fork's tests adapted to pin exactly that. Ported from time-attack/gstack (GStack 2) + our own prior-art branch. Co-authored-by: Sina Matian <sina@time-attack.dev> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore: remove dead bins; extend the stale-ref scan to docs (the 36-release gap) bin/chrome-cdp, bin/gstack-open-url, and bin/gstack-platform-detect were referenced only by an audit test and CHANGELOG history — dead weight that the stale-ref scanner should police, which required removing them FIRST. The scanner now also sweeps docs/, README.md, and USING_GBRAIN_WITH_GSTACK — the deliberate exclusion that let a dead command survive ~36 releases as a command-not-found instruction. Scan is green on the extended surface. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(bins): detect the default branch instead of hardcoding main gstack-diff-scope fell to an empty diff (all-false SCOPE_*) and gstack-next-version mis-based its bump math on any repo whose default branch isn't main (trunk, master, local-only). Both now resolve origin/HEAD -> origin/main -> origin/master -> main. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix: housekeeping sweep — telemetry integrity, persistent opt-out, context-bill accuracy, setup hang, dev-server discovery, model resolution (#2136 + v1.63 polish) Seven small fixes, one theme (claims matching code): - telemetry-sync strips local-only fields with jq del() (structural) instead of quote-fragile sed regexes; unparseable lines are dropped, never forwarded unstripped. Sed survives only as a jq-less fallback. - telemetry-log rejects non-integer durations BEFORE the range caps, whose test(1) comparisons silently no-op on non-numerics — a malformed duration spliced raw text into the JSONL stream. - browse's local telemetry honors the persistent tier (config.yaml telemetry: off), not just the preamble's env hint — direct $B use and embedders now respect the opt-out. - gstack-context-bill --exact sees GSTACK_-promoted keys inside Conductor (conductor-env-shim wired at the CLI entry), and the TOTAL line no longer double-counts every nested skill through the root skill's walk (v1.63 deferred polish; the telemetry-sync HTTP-status outcome deferred alongside it turned out already shipped). - setup's Chromium probe is deadline-bounded (90s, background + poll-kill — macOS has no GNU timeout) and prefers Node for the launch probe everywhere (the bun --eval hang family behind #2136); the install is single-flight behind a lock dir with an actionable stale-lock message. Probe verified live on this Mac. - the review resolver's dev-server check reads CLAUDE.md and the plan file before falling back to an expanded port probe, and says how to make itself smarter next time. - eval/harness model IDs resolve through lib/eval-model.ts (GSTACK_EVAL_MODEL[_KIND] env overrides, per-kind defaults, tested) at the SDK-capture and PTY-warmup sites; the bash-embedded distill snippet mirrors the resolution inline. - memory-ingest's silent-zero shape (staged>0, imported+unchanged==0, errors==0) warns even under --quiet — a run that indexes nothing must never look healthy again. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test: wire ios-qa/daemon/test into the free suite and shard runner (E2) The daemon's 5 test files (allowlist, audit, auth-mint, cli-mint, daemon-integration — now 6 with session hardening) were invisible to every runner: not in the bun test glob, not in TEST_ROOTS. The same silent-coverage-hole class as the tracked design/test P2 — and it meant B2's auth regression tests would never have gated. All files are hermetic (stub state-servers on ephemeral ports, no devices); verified green in the shard census. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(skills): claimed limitations now require evidence, everywhere + wave follow-ups filed Every tier-2+ skill's preamble gains one directive distilled from nine live release failures in two days on the fork: a claimed limitation or requirement ('the API can't do this', 'X requires a credential', 'impossible on this platform') is a material claim, stated only with the verbatim error, the documented statement, or a live probe in hand — pattern-matching a failure to a familiar story is not evidence, and a cheap probe runs BEFORE asking the user or declaring a step blocked. ONE directive adapted into the preamble resolver; the fork's full judgment contract is deliberately not imported. Full regen (46 files), ship goldens refreshed, parity guards bumped with the measured ~0.45KB/skill (investigate, autoplan, plan-design-review, office-hours), Step 0.9 registered as an intentional sub-step. Approved deferrals filed: persona-fleet hostile-user harness + answer-key methodology in TODOS; the fork's question-budget ACCOUNTING judgment (never its 5/8/12 constants) folded into the V1.1 pacing design doc; the Apple adapter added to #1882's coverage note. Ported from time-attack/gstack (GStack 2). Co-authored-by: Sina Matian <sina@time-attack.dev> Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(make-pdf): close offline-gate bypasses via unquoted style attrs, CSS-escape and HTML-entity obfuscation Three live vectors found by the ship review army, all red-first tested: unquoted style attributes skipped the remote-url neutralizer entirely; CSS ident/string escapes (@\69mport, url(\68ttps://…)) defeated the literal-match patterns Chromium happily decodes; and HTML entities in style attribute values (https) decoded to fetchable schemes before CSS parsing. Style-attr values are now entity-decoded in one browser- faithful pass, escape-bearing at-rules and function tokens are dropped fail-closed, and output is re-encoded double-quoted. 21 new test rows. * fix(migrations): v1.65 Chromium re-fetch actually re-downloads, and success is verified before .done The migration (renamed from the provisional v1.64.0.0 slot, which open PR #2564 claims) deleted only the poisoned .app while Playwright's INSTALLATION_COMPLETE marker survived in the revision dir — so the advertised 'bunx playwright install chromium' re-fetch no-opped and the user finished the upgrade with no browser and a success message. Now: the whole chromium-<rev> dir goes, bunx runs cwd-pinned to the install root, .done is gated on a verified executable, and a needs-refetch sentinel makes re-runs retry a failed download. Stranded rev dirs (markers without .app) also re-trigger. 6 hermetic tests, red-first. * fix(migrations): v1.27 remediation prints a real command instead of a fictional flag Every skip/failure path referenced '/setup-gbrain --rerun-migration', which is implemented nowhere, and promised the migration 'will ask again next upgrade', which the version-window runners make false. All five sites now print the direct GSTACK_MIGRATE_ASSUME_YES=1 bash invocation. Runner-side re-offer tracking is filed in TODOS. * fix(browse): poisoned-bundle self-heal removes the revision dir, probes handoff too, and throws typed Same marker flaw as the migration: rmSync of the .app alone left INSTALLATION_COMPLETE behind, so the error message's own remediation no-opped and the user was hard-stuck. The probe is now an exported, unit-tested helper (probePoisonedChromiumBundle) that removes the whole chromium-<rev> dir, never touches GSTACK_CHROMIUM_PATH custom bundles, throws PoisonedBundleError (instanceof, not string-match), and runs on BOTH headed entry points — launchHeaded and handoff. 7 tests. * fix(browse): session snapshots are atomic and the cookie filter drops loopback IP literals A crash mid-write destroyed the previous good snapshot — the exact scenario persistence exists to survive; writes now go tmp+rename. The internal-network cookie filter gains 127.*/::1/169.254.* (a tampered state file could previously hand loopback-service cookies back to the browser), and 'state load' imports the shared filter instead of maintaining a comment-synced copy. Test cleanup made exception-safe. * fix(browse): server runtime — restore off the boot path, shutdown that cannot hang, watchdog that still reaps tunnels Four review findings on the wave's own new wiring: session restore ran before Bun.serve with sequential 15s gotos while the CLI gives up at 8s (one slow saved URL bricked every $B command) — restore now runs in the background after bind; the shutdown snapshot gets a 2s deadline so a wedged page.evaluate can't hold the port forever behind the new ack-first stop; the persistence ticker gets in-flight + shutdown gates and is cleared before the final snapshot; and the absorbed #2565 handoff fix no longer clears the whole parent watchdog — a suppress flag keeps the tunnel-orphan reaper alive (handoff→resume→tunnel is no longer an unreapable internet-exposed daemon). pair-agent with consent off now names the real remedy instead of ngrok install instructions. Lock-acquisition edge branches (garbage pidfile, vanish-race depth cap) pinned. * fix(browse): telemetry defaults to off like every other surface The persistent tier defaulted ON when the config key was absent, while gstack-config's DEFAULTS table answers 'off' for the same question — preamble-spawned daemons and direct $B daemons disagreed about consent. Absent key/file now means disabled; community/anonymous enable; env kill-switch still beats everything. Both config.yaml consumers now share one readGstackConfigYamlKey reader. 12-case consent suite. * fix(code-intelligence): consent that means what it says — polarity, receipts, read-only veto Four review findings on the wave's own Phase 1 port, all red-first: 'consent <repo> no' recorded consent GRANTED (the CLI ignored the argument and always wrote true) — yes|no is now required and garbage records nothing; Sourcebot egress receipts claimed consented=true on paths that never checked consent — the actual consent state is threaded into every receipt, search is fail-closed on non-loopback, and the liveness probe's receipt says truthfully that it sends no repo content; repoPolicyVeto only honored the deny tier while gbrain refresh writes pages — write-class ops now veto on read-only too, matching the sync chokepoint, via one shared lib/gbrain-repo-policy-client.ts (win32 bash invocation, spawn-vs-unreadable error distinction) used by both call sites. Also: source ids get a host+path hash (same-name repos no longer collide), refresh timeout raised to 120s, availability probes run concurrently at 3s, graphify status stops JSON.parsing 100MB graphs for a count, and every ported file carries the fork MIT notice. +15 tests across the two suites. * fix(verify-gate): trust before eval, re-check on re-entry, audit every grant The opt-in Stop hook eval'd whatever command the first CLAUDE.md up the tree declared — any cloned repo got arbitrary shell at turn end. Now a per-repo trust store (path+command hash, 0600) gates execution: an untrusted or changed command never runs (exit 0 with the --trust invocation printed), stop_hook_active re-entry re-runs the trusted check instead of rubber-stamping (bounded at 3 blocks per episode), and every grant appends a forensic line to ~/.gstack/security/verify-gate-trust-grants.jsonl. 20 tests, red-first. * fix(setup): EXIT traps chain instead of clobbering; timed-out probes reap their whole tree The Playwright-lock trap replaced the copied-bun cleanup trap and then cleared ALL exit handling, leaking .tmp-bun-bin on every Chromium install; and _wait_with_deadline killed only the subshell, orphaning the wedged node→Chromium tree it exists to escape — re-creating the #2136 pile-up on every timed-out re-run. Traps now chain; timeouts walk pgrep -P descendants leaves-first. * refactor(resolvers): one source for the design-doc discovery block The #703 repo-doc-preference bash was pasted byte-identically into three plan-review templates and a fourth copy embedded in review.ts — drift there means plan reviews disagree about which design doc wins. Now a {{DESIGN_DOC_DISCOVERY}} resolver; generated output is byte-identical, so no SKILL.md changes ride along. * fix(ship): finish the Apple upload idempotency sentence The durable-effect contract dropped its consequence clause mid-sentence — the instruction for what to DO when the idempotency key already exists (treat the upload as possibly-done, never re-run it) was missing from the one rule governing whether a binary uploads twice. * fix(ci): SHA-pin dependency-review; the secret gate fails closed without a report dependency-review.yml rode mutable refs (@v4 resolves to a BRANCH on that repo) inside the one workflow whose job is supply-chain hygiene — now commit-pinned like its siblings, with dependabot keeping the pins fresh. gate-secret-scan.mjs crashed with an unhandled EPIPE on oversize diffs (the designed report.oversize branch was unreachable: the scanner emits no JSON on refusal) — the pipe write now tolerates early exit and a missing report is an explicit fail-closed exit 1. Oversize + broken-scanner legs pinned. * fix(bins): Windows-safe GIT_CEILING join; next-version probes the full default-base chain GIT_CEILING_DIRECTORIES was joined with ':' — git on Windows splits on ';' and drive letters contain ':', silently disabling the #2144 second-layer defense there; now path.delimiter. next-version's default-base detection only tried origin/HEAD then 'main', diverging from the canonical 4-step chain diff-scope uses — origin/main and origin/master probes added, pinned by fixture repos. * fix(eval-model): kinds are a literal union, not string Record<string,string> widened EvalModelKind to string, so a typo'd kind only failed at runtime; as const satisfies keeps the closed set the doc comment promises. * test: coverage backfill from the ship review The telemetry-strip invariant only validated the sed FALLBACK while the live jq path went unchecked — the jq del() lists are now held to the same every-emitted-field bar, plus a behavioral pipe-through. The context-bill nested-skill double-count fix gets a regression pin (a revert shipped green before). The windowsHide tripwire gains terminal-agent-control.ts — the exact file the fix commit names. The ios-qa revoke-by-token_id branch gets its negative case: unknown ids revoke nothing and leave live sessions alone. * docs: SLATE_HOST no longer cites the deleted platform-detect bin Host detection lives in the hosts/ registry via host-config-export.ts; the doc's known-gaps list now says so instead of pointing at a bin this branch removed. * test(e2e): headroom for the two plan-ceo-review budget-edge tests Both rode their 360s runner budget at the edge (main clears at 243s of 360s), and the wave legitimately adds work to the review: the evidence directive tells the agent to probe before claiming, and the design-doc discovery block adds bash steps. Under concurrent in-file children the API queuing tipped all retry attempts past the ceiling — the runner then reports $0.00/0 turns for a timed-out child, which reads like a dead spawn but is a healthy child killed at the deadline. 540s runner / 660s test for these two only; verified 2/2 green at 228s and 315s. * fix(code-intelligence): gbrain search/export are consent-gated and receipted The Sourcebot side got this in the last round; gbrain had the same hole — search() and export() sent repo-derived query text into a possibly-remote DATABASE_URL with no consent check and no egress receipt, bypassing the deny-tier veto. Both now assert consent before any bytes move, receipts record the actual consent state (never a hardcoded true), and search receipts carry the query's sha256. gbrain stays fail-closed: the adapter cannot see where DATABASE_URL points, so every send requires consent. 7 new tests, red-first. * fix(make-pdf): SVG remote refs and image-set can no longer fetch offline <svg><image href=https://…> and <use xlink:href=…> survived the gate (only javascript: schemes were stripped from svg hrefs), and bare-string image-set("https://…" 1x) dodged the url()-shaped neutralizer. Remote svg hrefs rewrite to '#' (entity-decode-aware, unclosed-svg smuggle closed) and remote image-set args neutralize to url(#). Local fragments, local image-set, and plain <a> links pinned intact. 12 new rows, red-first. * fix(browse): duplicate config keys read last-wins, matching gstack-config readGstackConfigYamlKey took the FIRST match while gstack-config's get takes the LAST — a duplicated pair_agent or telemetry line made the two consent surfaces disagree about what the user chose. * fix(setup): stale Chromium-install lock self-heals The mkdir mutex had no owner: a SIGKILL'd setup left the lock behind and every later run exited with manual rmdir instructions. The holder pid is recorded in the lock; a dead holder is reclaimed automatically. * fix(setup-gbrain): the code-intelligence offer gate skips when the bin is absent The new Step 1.7 told the agent to run gstack-code-intelligence before the path pick — on installs predating the CLI (and hermetic E2E children) the bin doesn't exist and setup derailed before doing any setup. The gate now probes for the bin and reports offer:false reason:bin-absent, with explicit instructions to proceed: the user asked for gbrain, so set up gbrain. Never block setup on an optional gate. * test(e2e): periodic-tier repairs from the failure triage Each fix traces to a receipt: brain-privacy-gate staged config never reached the hermetic child (ambient GSTACK_HOME is scrubbed) and the operator's remote-mode gbrain suppressed the gate — both now injected per-test; ship-idempotency threw away its evidence on the timeout path and ran a 600s budget its own subject can exceed (now 900s, evidence captured); auto-decide-preserved gets the same headroom its sibling plan-ceo tests got; context-skills' hides-checks scanned bash output where an ls legitimately names old checkpoints (final-text scope now); design names the missing section instead of a bare count and learns the easing/duration/micro-interaction synonyms; qa-workflow's collector afterAll gets an explicit 60s hook timeout. * fix(eval-harness): eng-review phase boundary fires on qid-tagged questions The Step 0 boundary only matched two prose phrases, but plan-eng-review may legitimately reach the review phase without either — every per-finding AskUserQuestion then counted as pre-review and the batching regression test read 0 questions while watching the agent ask them one by one. The boundary now also fires on the first answered question carrying a gstack-qid:eng-review- marker. Additive only; 119 runner unit tests green. * chore: bump version and changelog (v1.65.0.0) Fork port wave 2: the release-summary entry credits Sina Matian (time-attack/gstack) and the four absorbed community PRs. TODOS gains three review-round follow-ups (dual-write E2E, migration runner re-offer, gbrain-adapter op coverage). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(eval-harness): eng-review qid boundary matches the real skill-name prefix Live qids render as gstack-qid:plan-eng-review-<slug> ({skill}-{slug} convention); the boundary anchored eng-review- immediately after the colon and never matched, leaving the batching counter blind while the transcript showed per-finding questions being asked one by one. * fix(setup-gbrain): never ask the provider question inside /setup-gbrain Invoking /setup-gbrain IS the provider choice. Step 1.7 now records 'select gbrain' best-effort and proceeds straight to setup; the offer ceremony is reserved for entry points where no provider was named. On machines where the code-intelligence CLI exists, the offer:true path was hijacking setup into the provider ceremony and the E2E child never reached MCP registration. * chore: file the three documented-red periodic tests as structural-repair TODOs Sidebar trio exercises endpoints removed on every tree; ship-idempotency's PTY child never receives its typed command; brain-privacy-gate has never been green anywhere. Each carries its triage receipt in the entry. * test(e2e): setup-gbrain remote — hermetic env via opts, evidence on failure, output-scoped classifier Three separate defects stacked on this one test: the ambient GBRAIN_MCP_TOKEN/GSTACK_HOME/PATH mutations never reached the child (hermetic-env scrubs them by allowlist — broken since hermetic env landed; the child correctly stopped at Step 4c with NEEDS_CONTEXT), failures discarded the in-memory transcript so every triage started blind, and the wrote-findings-before-asking classifier scanned the full event stream where the child's own Read of the skill file always contains the review-report phrase. Env now goes via opts.env, failures dump bash commands + final text, and the classifier scans assistant output only. Green in 67s with all seven asserts. * test: final coverage pass — CLI rendering, revert traps, keychain probe, gbrain doc ops The user-directed third generation pass closes the audit's remaining tail: the code-intelligence CLI's options/status/suggest surfaces get behavioral coverage through the fake-shim chain; brain-context-load gains an argv-logging trap that goes red if anyone reverts the memoized PATH scan back to the spawn probe (receipt: simulated revert failed exactly these tests); the darwin Keychain auth branch (#1890) gets its first free-tier tests via a PATH-shimmed security binary; and the gbrain add/delete/export ops are pinned (body piped byte-for-byte, receipt sha256, stdin-EOF prompt guard, PROVIDER_UNAVAILABLE degradation) — retiring their TODOS entry. * test: assemble the planted PEM at runtime so the fixture never trips the prepush guard The repo's own credential guard scans pushed diffs and correctly blocked these fixtures: the engine flags any one-line BEGIN…END spelling regardless of body. Header, body, and footer are now joined at runtime, so the file and every diff of it stay clean while the scanner under test still receives the true live shape. * docs: update project documentation for v1.65.0.0 README gains the two wave-2 CLIs (gstack-code-intelligence, gstack-verify-gate) in the standalone-binaries table, BROWSER.md documents BROWSE_PERSIST_STATE next to manual state save/load, CONTRIBUTING's CI section lists the new supply-chain gates, and CLAUDE.md's project tree reflects lib/code-intelligence/ and the added workflows. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs: apply cross-model doc-review fixes for v1.65.0.0 Findings from the release doc review, verified against source: verify-gate's README row gains the actual install one-liner (setup never registers the Stop hook; test/verify-gate.test.ts pins that) and the 3-blocked-re-entries yield behavior; code-intelligence's row gains the suggest subcommand and the search-side consent gate; CONTRIBUTING scopes the SHA-pin claim to the supply-chain workflows and widens the dependency-review trigger; BROWSER.md's restore-time cookie drop list matches isInternalCookieDomain; CLAUDE.md's workflows comment stops implying six workflows are all of them. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs: CHANGELOG accuracy pass — scope the SHA-pin claim, restore-time cookie filter, exact test counts * test: env restore runs per-test, not per-suite — the leak that failed 30 strangers gstack-memory-helpers saved HOME/GSTACK_HOME/PATH in beforeEach but restored in afterAll, so the last beforeEach's snapshot won and a gstack-test-engine temp dir leaked into every later file in the same process: gstack-config read the wrong store, make-pdf's child resolved Chromium under the temp cache, update-check and artifacts-init lost their real homes. afterAll is now afterEach; the config and update-check harnesses also strip GSTACK_HOME/GSTACK_STATE_ROOT from child env as a belt. * fix(browse): restore the #1846 start-timeout resolution the merge dropped The v1.64.1.0 merge kept this branch's lock design in cli.ts and silently lost main's resolveStartTimeout + late health re-check while their test survived — ported both back in alongside the kept design. * test: adapt main's diagnostics tests to the merged designs cli-lock asserts typed ServerLockError (errno + lock path) instead of the log-and-return shape the merge didn't keep, dropping only the one duplicate of server-lock-errors coverage; the liveness tripwire exempts error-handling.ts as the sanctioned tasklist site; snapshot and compare-board wrappers pass the now-mandatory browser-manager arg; background.js's test pins that the retired sidebar-command type is rejected pre-gate with no response fields. * chore: gitignore the gen-accessors tool's SPM build output skill-e2e-ios-swift-build compiles the Swift package in place, leaving .build/ (2,800+ files) and Package.resolved untracked after every periodic run — the workspace read as ~100 dirty changes with a clean tree. Same class as the dist/ binaries: build output, never committed. * test(browse): subprocess budget for the polyfill suite on Windows CI Every test here spawnSync's a node child; cold-start on the Windows runner (AV scan, first node.exe touch) blew bun's 5s default by 7ms on a 50ms sleep test. File-level 20s default — subprocess budget, not assertion looseness. * test: make the Darwin migration path and the query-timeout SKIP deterministic on Linux CI The v1.65 migration suite relied on the host being macOS — on the ubicloud runner the script's uname gate early-exited every test with empty output; a Darwin uname shim in the shared setup runs the real path everywhere (the non-Darwin test still overrides it with Linux). The 1ms-budget brain-context test assumed 1ms is always too short; the runner's fake gbrain answered in 0ms and no SKIP printed — the fake now sleeps 300ms so the timeout is a certainty, while --version stays instant for the detection assertion. --------- Co-authored-by: Gawie van Blerk <gawievanblerk@gmail.com> Co-authored-by: Sina Matian <sina@time-attack.dev> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Shawn Reddy <19191746+Screddyice@users.noreply.github.com> Co-authored-by: Jake Wilk <jwilk@highlinerepartners.com> Co-authored-by: Jerry Nichols <jerrynicholsai@users.noreply.github.com> |