feat(sdk): golden parity harness and query handler CJS alignment (#2302 Track A) (#2341)

* feat(sdk): golden parity harness and query handler CJS alignment (#2302 Track A)

Golden/read-only parity tests and registry alignment, query handler fixes
(check-completion, state-mutation, commit, validate, summary, etc.), and
WAITING.json dual-write for .gsd/.planning readers.

Refs gsd-build/get-shit-done#2341

* fix(sdk): getMilestoneInfo matches GSD ROADMAP (🟡, last bold, STATE fallback)

- Recognize in-flight 🟡 milestone bullets like 🚧.
- Derive from last **vX.Y Title** before ## Phases when emoji absent.
- Fall back to STATE.md milestone when ROADMAP is missing; use last bare vX.Y
  in cleaned text instead of first (avoids v1.0 from shipped list).
- Fixes init.execute-phase milestone_version and buildStateFrontmatter after
  state.begin-phase (syncStateFrontmatter).

* feat(sdk): phase list, plan task structure, requirements extract handlers

- Register phase.list-plans, phase.list-artifacts, plan.task-structure,
  requirements.extract-from-plans (SDK-only; golden-policy exceptions).
- Add unit tests; document in QUERY-HANDLERS.md.
- writeProfile: honor --output, render dimensions, return profile_path and dimensions_scored.

* feat(sdk): centralize getGsdAgentsDir in query helpers

Extract agent directory resolution to helpers (GSD_AGENTS_DIR, primary
~/.claude/agents, legacy path). Use from init and docs-init init bundles.

docs(15): add 15-CONTEXT for autonomous phase-15 run.

* feat(sdk): query CLI CJS fallback and session correlation

- createRegistry(eventStream, sessionId) threads correlation into mutation events
- gsd-sdk query falls back to gsd-tools.cjs when no native handler matches
  (disable with GSD_QUERY_FALLBACK=off); stderr bridge warnings
- Export createRegistry from @gsd-build/sdk; add sdk/README.md
- Update QUERY-HANDLERS.md and registry module docs for fallback + sessionId
- Agents: prefer node dist/cli.js query over cat/grep for STATE and plans

* fix(sdk): init phase_found parity, docs-init agents path, state field extract

- Normalize findPhase not-found to null before roadmap fallback (matches findPhaseInternal)

- docs-init: use detectRuntime + resolveAgentsDir for checkAgentsInstalled

- state.cjs stateExtractField: horizontal whitespace only after colon (YAML progress guard)

- Tests: commit_docs default true; config-get golden uses temp config; golden integration green

Refs: #2302

* refactor(sdk): share SessionJsonlRecord in profile-extract-messages

CodeRabbit nit: dedupe JSONL record shape for isGenuineUserMessage and streamExtractMessages.

* fix(sdk): address CodeRabbit major threads (paths, gates, audit, verify)

- Resolve @file: and CLI JSON indirection relative to projectDir; guard empty normalized query command

- plan.task-structure + intel extract/patch-meta: resolvePathUnderProject containment

- check.config-gates: safe string booleans; plan_checker alias precedence over plan_check default

- state.validate/sync: phaseTokenMatches + comparePhaseNum ordering

- verify.schema-drift: token match phase dirs; files_modified from parsed frontmatter

- audit-open: has_scan_errors, unreadable rows, human report when scans fail

- requirements PLANNED key PLAN for root PLAN.md; gsd-tools timeout note

- ingest-docs: repo-root path containment; classifier output slug-hash

Golden parity test strips has_scan_errors until CJS adds field.

* fix: Resolve CodeRabbit security and quality findings
- Secure intel.ts and cli.ts against path traversal
- Catch and validate git add status in commit.ts
- Expand roadmap milestone marker extraction
- Fix parsing array-of-objects in frontmatter YAML
- Fix unhandled config evaluations
- Improve coverage test parity mapping

* test: raise planner character extraction limit to 48K

* fix(sdk): resolve TS build error in docs-init passing config

sdk/src/query/config-gates.ts

@@ -0,0 +1,69 @@
+/**
+ * Batch workflow config for orchestration decisions (`check.config-gates`).
+ *
+ * Replaces many repeated `config-get workflow.*` calls with one JSON object.
+ * See `.planning/research/decision-routing-audit.md` §3.3.
+ */
+
+import { CONFIG_DEFAULTS, loadConfig } from '../config.js';
+import type { QueryHandler } from './utils.js';
+
+/** Treat stringly YAML booleans safely (`Boolean('false')` is true — avoid that). */
+function workflowBool(v: unknown, defaultVal: boolean): boolean {
+  if (v === undefined || v === null) return defaultVal;
+  if (typeof v === 'boolean') return v;
+  if (typeof v === 'string') {
+    const s = v.toLowerCase().trim();
+    if (s === 'false' || s === '0' || s === 'no' || s === 'off') return false;
+    if (s === 'true' || s === '1' || s === 'yes' || s === 'on') return true;
+  }
+  return Boolean(v);
+}
+
+/**
+ * Merge workflow defaults with project config, then expose stable keys for workflows.
+ */
+export const checkConfigGates: QueryHandler = async (args, projectDir) => {
+  const config = await loadConfig(projectDir);
+  const wf: Record<string, unknown> = {
+    ...CONFIG_DEFAULTS.workflow,
+    ...(config.workflow as unknown as Record<string, unknown>),
+  };
+  const root = config as Record<string, unknown>;
+  const contextWindow =
+    typeof root.context_window === 'number' ? root.context_window : 200000;
+
+  /** Prefer explicit `plan_checker` when present (alias); else `plan_check` (defaults include only the latter). */
+  const w = wf as Record<string, unknown>;
+  const planCheckFlag = w.plan_checker !== undefined ? w.plan_checker : w.plan_check;
+
+  const data: Record<string, unknown> = {
+    workflow: args[0] ?? null,
+    research_enabled: workflowBool(wf.research, true),
+    plan_checker_enabled: workflowBool(planCheckFlag, true),
+    nyquist_validation: workflowBool(wf.nyquist_validation, true),
+    security_enforcement: workflowBool(wf.security_enforcement, true),
+    security_asvs_level: wf.security_asvs_level ?? 1,
+    security_block_on: wf.security_block_on ?? 'high',
+    ui_phase: workflowBool(wf.ui_phase, true),
+    ui_safety_gate: workflowBool(wf.ui_safety_gate, true),
+    ui_review: workflowBool(wf.ui_review, true),
+    text_mode: workflowBool(wf.text_mode, false),
+    auto_advance: workflowBool(wf.auto_advance, false),
+    auto_chain_active: workflowBool(wf._auto_chain_active, false),
+    code_review: workflowBool(wf.code_review, true),
+    code_review_depth: wf.code_review_depth ?? 'standard',
+    context_window: contextWindow,
+    discuss_mode: String(wf.discuss_mode ?? 'discuss'),
+    use_worktrees: workflowBool(wf.use_worktrees, true),
+    skip_discuss: workflowBool(wf.skip_discuss, false),
+    max_discuss_passes: wf.max_discuss_passes ?? 3,
+    node_repair: workflowBool(wf.node_repair, true),
+    research_before_questions: workflowBool(wf.research_before_questions, false),
+    verifier: workflowBool(wf.verifier, true),
+    plan_check: workflowBool(planCheckFlag, true),
+    subagent_timeout: wf.subagent_timeout ?? CONFIG_DEFAULTS.workflow.subagent_timeout,
+  };
+
+  return { data };
+};