Tom Boucher 8de2ff9121 feat(#2008): generic command-exit-zero gate-predicate evaluator (#2011) ...

* feat(#2008): add generic command-exit-zero gate-predicate evaluator

Third-party capability gates declared via check.predicate were rendered for
display but never evaluated (only built-in check.query gates fired; the
security capability's gate worked solely via a hard-coded ship.md branch).

Add a generic, deps-injected gate-predicate evaluator (src/gate-predicate-evaluator.cts)
that dispatches by predicate.kind. Built-in kind: command-exit-zero — runs a
bounded sh -c command at the project root (via shell-command-projection.execTool),
inherits env, exit 0 => pass, non-zero => block, timeout => block, fail-closed.

Wire a 'check predicate' subcommand into check-command-router.cts and extend
the three generic workflow gate-dispatch sites (execute:wave:post, execute:post,
plan:post) to route check.predicate gates to the new evaluator. The two-step
gate contract (command-failure => onError; block => halt) is unchanged.

- src/gate-predicate-evaluator.cts: pure leaf, KIND_TABLE extensible
- src/check-command-router.cts: cmdCheckPredicate + buildPredicateDeps + parsePredicateFlags
- docs/adr/2008-*, docs/reference/gate-predicates.md, docs/how-to/command-exit-zero-gate.md
- tests: 38 unit + integration tests (exit mapping, timeout, interpolation,
  property-based bijection, malformed-predicate fail-closed, real subprocess e2e)

Closes #2008

* docs(#2008): backfill changeset pr number 2011

2026-07-05 14:04:29 -04:00

..

discuss-phase

chore(#1073): purge phantom pre-migration issue refs from source, tests, docs (#1471)

2026-06-20 13:36:57 -04:00

execute-phase/steps

enhance(execute): isolated-executor rejected/over-reaching run fails safe — never default recovery to main (#1292) (#1303)

2026-06-15 20:53:38 -04:00

help/modes

feat(#1787): add /gsd:next smart entry workflow (#1798)

2026-07-03 12:18:25 -04:00

plan-phase/steps

refactor(#1852): lazy-split plan-phase.md into steps/ (#1934)

2026-07-02 23:30:19 -04:00

_runtime-launcher.snippet.sh

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

add-backlog.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

add-phase.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

add-tests.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

add-todo.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

ai-integration-phase.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

analyze-dependencies.md

chore(#604): rename get-shit-done/ runtime directory to gsd-core/ (#615)

2026-06-02 18:35:29 -04:00

audit-fix.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

audit-milestone.md

feat(#1137): migrate review verification hooks to capabilities (#1147)

2026-06-12 21:24:09 -04:00

audit-uat.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

autonomous.md

feat(#1866): agent-side self-load of configured agent_skills

2026-07-01 20:09:01 -04:00

check-todos.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

cleanup.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

code-review-fix.md

feat(#1137): migrate review verification hooks to capabilities (#1147)

2026-06-12 21:24:09 -04:00

code-review.md

feat(#1137): migrate review verification hooks to capabilities (#1147)

2026-06-12 21:24:09 -04:00

complete-milestone.md

fix(#1871): wire phase archival end-to-end (phases archive cmd + default + atomic) (#1924)

2026-07-02 11:14:01 -04:00

debug.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

diagnose-issues.md

fix(#1521): resolve own runtime + worktrees-off for all non-Claude installs (#1537)

2026-06-21 13:48:47 -04:00

discovery-phase.md

chore(#604): rename get-shit-done/ runtime directory to gsd-core/ (#615)

2026-06-02 18:35:29 -04:00

discuss-phase-assumptions.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

discuss-phase-power.md

chore(#604): rename get-shit-done/ runtime directory to gsd-core/ (#615)

2026-06-02 18:35:29 -04:00

discuss-phase.md

chore(#1073): purge phantom pre-migration issue refs from source, tests, docs (#1471)

2026-06-20 13:36:57 -04:00

do.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

docs-update.md

fix(#1359): migrate workflows off deprecated TaskOutput to Read(outputFile) (#1362)

2026-06-16 21:55:45 -04:00

edit-phase.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

eval-review.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

execute-phase.md

feat(#2008): generic command-exit-zero gate-predicate evaluator (#2011)

2026-07-05 14:04:29 -04:00

execute-plan.md

feat(#1602): deterministic coverage-metadata UAT routing for verify-work

2026-06-22 23:43:22 -04:00

explore.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

extract-learnings.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

fast.md

chore(#604): rename get-shit-done/ runtime directory to gsd-core/ (#615)

2026-06-02 18:35:29 -04:00

forensics.md

fix(#1863): use named flags for state.* calls in executor + workflows (#1873)

2026-07-02 13:01:10 -04:00

graduation.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

health.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

help.md

chore(#604): rename get-shit-done/ runtime directory to gsd-core/ (#615)

2026-06-02 18:35:29 -04:00

import.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

inbox.md

chore(#604): rename get-shit-done/ runtime directory to gsd-core/ (#615)

2026-06-02 18:35:29 -04:00

ingest-docs.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

insert-phase.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

list-phase-assumptions.md

chore(#604): rename get-shit-done/ runtime directory to gsd-core/ (#615)

2026-06-02 18:35:29 -04:00

list-seeds.md

feat(#441): add /gsd-capture --list-seeds for seed listing and audit (#722)

2026-06-22 00:59:41 -04:00

list-workspaces.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

manager.md

feat(#1708): typed documentation-sourced #853 dispatch-flatten (ADR-1239 Phase B) (#1719)

2026-06-25 15:37:33 -04:00

map-codebase.md

fix(#1359): migrate workflows off deprecated TaskOutput to Read(outputFile) (#1362)

2026-06-16 21:55:45 -04:00

milestone-summary.md

fix(#1863): use named flags for state.* calls in executor + workflows (#1873)

2026-07-02 13:01:10 -04:00

mvp-phase.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

new-milestone.md

fix(#1871): wire phase archival end-to-end (phases archive cmd + default + atomic) (#1924)

2026-07-02 11:14:01 -04:00

new-project.md

fix(#1516): expose adaptive model_profile in /gsd-new-project AI Models prompt (#1654)

2026-06-24 14:46:44 -04:00

new-workspace.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

next.md

feat(#1190): wire --converge primary surface into /gsd:progress --next (ADR-15) (#1237)

2026-06-14 15:52:22 -04:00

node-repair.md

chore(#604): rename get-shit-done/ runtime directory to gsd-core/ (#615)

2026-06-02 18:35:29 -04:00

note.md

chore(#604): rename get-shit-done/ runtime directory to gsd-core/ (#615)

2026-06-02 18:35:29 -04:00

pause-work.md

feat(#1165): async external_job_waiting half-state + resume/pause contract (#1221)

2026-06-14 12:23:07 -04:00

plan-milestone-gaps.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

plan-phase.md

feat(#2008): generic command-exit-zero gate-predicate evaluator (#2011)

2026-07-05 14:04:29 -04:00

plan-review-convergence.md

refactor(#1190): extract ADR-22 drift-guard decision logic into a testable seam (#1242)

2026-06-14 20:52:36 -04:00

plant-seed.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

pr-branch.md

fix(#666): pr-branch silently ignored planning.sub_repos (#667)

2026-06-21 22:34:00 -04:00

profile-user.md

fix(#1520): randomize mktemp temp paths on BSD/macOS (XXXXXX must be path-final) (#1550)

2026-06-24 17:27:45 -04:00

progress.md

fix(#1522): enforce canonical verification before phase transition (#1548)

2026-06-24 13:19:10 -04:00

quick.md

fix(#1520): randomize mktemp temp paths on BSD/macOS (XXXXXX must be path-final) (#1550)

2026-06-24 17:27:45 -04:00

reapply-patches.md

fix(#934): reapply verifier handles missing pristine baseline post-rename (#937)

2026-06-09 12:51:15 -04:00

remove-phase.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

remove-workspace.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

resume-project.md

feat(#1165): async external_job_waiting half-state + resume/pause contract (#1221)

2026-06-14 12:23:07 -04:00

review.md

fix(#1698): capture codex review via --output-last-message, not stdout

2026-06-28 08:15:37 -07:00

scan.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

secure-phase.md

fix(#1626): make the security gate severity-aware via per-threat severity (#1635)

2026-06-23 19:04:13 -04:00

session-report.md

chore(#604): rename get-shit-done/ runtime directory to gsd-core/ (#615)

2026-06-02 18:35:29 -04:00

settings-advanced.md

fix(#1847): resolve standard tier to claude sonnet 5

2026-06-30 22:21:18 -04:00

settings-integrations.md

fix(#1296): align config docs/prompts/schema with consumers (#1299)

2026-06-15 19:57:11 -04:00

settings.md

feat(#1213): Capability State Writer — write-side inverse of the resolver (#1225)

2026-06-14 12:51:17 -04:00

ship.md

fix(#1520): randomize mktemp temp paths on BSD/macOS (XXXXXX must be path-final) (#1550)

2026-06-24 17:27:45 -04:00

sketch-wrap-up.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

sketch.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

smart-entry.md

feat(#1787): add /gsd:next smart entry workflow (#1798)

2026-07-03 12:18:25 -04:00

spec-phase.md

fix(#1906): require node-test clean-fixture causation control (#2001)

2026-07-03 23:21:55 -04:00

spike-wrap-up.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

spike.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

stats.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

sync-skills.md

chore(#604): rename get-shit-done/ runtime directory to gsd-core/ (#615)

2026-06-02 18:35:29 -04:00

thread.md

fix(#1778): use 1.6 named-flag frontmatter.set form in thread workflow (#1816)

2026-06-28 22:42:44 -04:00

transition.md

fix(#1522): enforce canonical verification before phase transition (#1548)

2026-06-24 13:19:10 -04:00

ui-phase.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

ui-review.md

fix(#1522): enforce canonical verification before phase transition (#1548)

2026-06-24 13:19:10 -04:00

ultraplan-phase.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

undo.md

chore(#604): rename get-shit-done/ runtime directory to gsd-core/ (#615)

2026-06-02 18:35:29 -04:00

update.md

feat(#1928): remove sunset Gemini CLI runtime, redirect to Antigravity (#1996)

2026-07-04 13:32:51 -04:00

validate-phase.md

feat(#1137): migrate review verification hooks to capabilities (#1147)

2026-06-12 21:24:09 -04:00

verify-phase.md

feat(#1154): honest verifier — abstain (insufficient_spec) on non-inferable backstop truths (#1738)

2026-06-29 00:14:32 -04:00

verify-work.md

fix(#1716): route resume_from_file to complete_session when no pending tests remain (#1722)

2026-07-02 11:58:06 -04:00