Mechanical rename produced by scripts/msd-rename.cjs: gsd/Gsd/GSD -> msd/Msd/MSD
across contents and paths, upstream package/repo coordinates -> @golem15/msd-core
and golem15com/msd-core. Deep links into upstream history, sibling upstream
packages, the GSD-2 import feature, CHANGELOG.md and .changeset/ are kept as-is.
Hand edits on top: MSD block-letter banner and logos, LICENSE copyright line,
package/plugin identity, regenerated lockfile, install-tree fixtures, derived
registries and benchmark baseline; migration checksum baseline re-locked
(MSD keeps its own install state, so no install had applied the old sums);
sort-order and regex-escaped expectations in tests adjusted.
* chore(#2992): widen the when= grammar and key the section manifest per workflow
Epic #1671 Phase 6.1. Two blockers stopped the fragment model reaching any
file beyond execute-phase.md: the when= vocabulary was frozen at 4 atoms
(3 execute-phase-specific), and the section manifest was single-workflow by
construction with 'execute-phase' hardcoded into buildSectionManifestField.
- widen WHEN_VOCABULARY 4 -> 14 via a coordinated ADR-1671 amendment; the
grammar stays CLOSED (one atom, no operators, negation or nesting) and
WHEN_PREDICATES stays a hand-written literal map, never deriving a
predicate from its atom string
- InvocationFacts gains flags: ReadonlySet<string> plus three computed state
booleans; add the missing reverse vocabulary/predicate parity guard
- key the manifest artifact per workflow; a stale flat {sections:[...]}
artifact now fails shape validation instead of being misattributed
- wire the field into six init entry points and parse the flags each needs
An atom ships only with both a real consuming section and a fact the init
seam actually computes. Six surveyed atoms are withheld because their
workflows have no dedicated init entry point; an atom without a computed
fact evaluates false forever and silently disables its own section.
Fixes a defect found while wiring: parseNamedArgs always materializes a
boolean flag key, so folding its false into the absent sentinel is required
or every flag reads as present and gating is silently always-on.
Also resolves ADR-1671:194 by measurement: --mvp stays unmarkable, because
its interleaved sites are always-run flag resolution and a ~340 byte block
that already delegates lazily.
Refs #2992
* fix(#2992): treat any falsy option value as an absent flag and reject unsafe manifest read paths
Findings from two orthogonal reviews (Claude /code-review + an isolated
adversarial pass); both independently reproduced the first one.
- MAJOR: the flags-builder treated only `undefined` as absent, but
parseNamedArgs yields `null` for an absent value-flag and `false` for an
absent boolean-flag, so `--granularity` read as present on every
plan-phase invocation. Fixed at the root: a flag is present iff its
option value is truthy. The six per-handler `|| undefined` folds are now
redundant and removed, which also closes the duplicate-translation and
missed-onboard-handler findings.
- MAJOR: state:needs-codebase-map had zero coverage. Added unit, property
and real-CLI integration tests.
- MINOR: reject absolute, UNC/drive and `..`-traversing `read` paths in the
manifest, degrading the whole load to null like every other shape
violation. Verified: `/etc/passwd` previously reached section_manifest.read.
- MINOR: corrected a stale "4 to 20" doc comment; the vocabulary is 14.
Refs #2992
* test(#2992): update the generator suite for the per-workflow manifest shape
The remote matrix went red with 5 unique failures, identical on
linux-node22 and linux-node24, all in tests/gen-section-manifest.test.cjs.
Re-keying the artifact to {workflows:{...}} left this suite asserting the
old flat {sections:[...]} shape; nothing else in the tree still does.
- three tests read manifest.sections.length, now undefined; retargeted at
workflows.<name> with their original intent preserved (a fenced or
loop-host marker still asserts NO section is produced, not merely a
changed count)
- the stale-manifest test wrote its fixture in the OLD shape, so it tripped
shape validation and stopped exercising staleness at all. Its fixture is
now valid-but-mismatched so FAIL_STALE is genuinely reached again.
- added the coverage that exposed: a pre-6.1 flat artifact must report
FAIL_MANIFEST_MALFORMED_SHAPE. That is the real upgrade path for an
installed tree and nothing covered it.
Refs #2992
* chore(#2992): backfill changeset pr number to 3013
---------
Co-authored-by: sim <sim@local>
* chore(#2932): emit a per-invocation section manifest from init
Extends the init bundle with a typed per-invocation section manifest so an
invocation loads only the branch guidance it will actually take.
The three flag/state-gated branches in execute-phase.md move into their own
step files; the parent keeps its gsd:section markers wrapping a one-line
on-demand reference, so each section's prose lives in exactly one file and
the parent shrinks 93369 -> 89507 bytes. A new drift-guarded generator
derives the shipped section manifest from those markers, and a new pure
evaluator maps invocation facts to applicable section ids.
The evaluator is a lookup over the frozen WHEN_VOCABULARY, never a parser
(Greenspun's Tenth Rule, ADR-1671:69); a parity test asserts the vocabulary
and the predicate map stay exhaustively in sync.
Closes#2932
* fix(#2932): fail closed on prototype-chain when values
An isolated adversarial review found WHEN_PREDICATES[section.when] was a
bracket lookup on a plain-prototype object, so inherited Object.prototype
members resolved as predicates: "constructor"/"toString"/"valueOf"/
"hasOwnProperty" returned truthy and SILENTLY INCLUDED the section, and
"__proto__" threw an untyped TypeError carrying no .reason. Both violate
the module's documented fail-closed contract, and the manifest is read from
disk at run time so it cannot be assumed trustworthy.
Builds the predicate map on a null prototype and guards the lookup with an
explicit Object.hasOwn check. Adds table-driven coverage for nine
Object.prototype-shaped keys asserting the TYPED reason (asserting only
that it throws would still pass while broken) plus a fast-check property
injecting a hostile value at an arbitrary document position.
* test(#2932): retarget execute-phase step assertions at extracted step files
* fix(#2932): emit typed reasons for generator lib-load and write failures
* fix(#2932): restore launcher preamble in extracted steps and refresh derived fixtures
* chore(#2932): backfill changeset pr number to 2987
---------
Co-authored-by: sim <sim@local>
