ecea537194
Found pre-push by this round's third adversarial review pass. Not a rebase regression — round 3 shipped it and #2755 doubled it. resolveExtraWatchTargets watches one config.toml per non-registry descriptor, and its comment asserted "GSD writes ONE named file into these third-party roots". That is false: bin/install.js also calls installSharedHooksBundle on the same root, populating <root>/hooks/ with GSD's hook scripts and a CommonJS marker. So a suite-produced leak of a hook bundle into a developer's real ~/.kimi or ~/.kimi-code passes this guard silently — #2665's own hazard, in #2665's own safety net. Behaviour is deliberately unchanged and the gap is disclosed instead. Closing it is a layout decision rather than one more path, for the same reason getGlobalSkillsBase is already a deliberate non-target: the snapshot applies the config-root layout beneath every root it is given, and these roots are not ours. Happy to fix it here or take it as a separate issue — the maintainer's call. The enumeration-relative test could not have caught this: it asserts one target PER DESCRIPTOR and nothing about whether one per descriptor is enough, because its expectation is derived from the same array it checks. That is exactly the scope boundary round-2 Nit 7 asked to be marked, biting one layer up from where it was marked; the test now says so. 479979c4's message says "there are three" — that is three WATCHED targets, not a count of write surfaces. The hooks bundle is a fourth, and unwatched. lint:ci rc=0; tests/live-config-guard.test.cjs 24/24. Comments and catalog only.
Dynamic context management — Option-E reference example
Reference example for ADR-1671, "Dynamic context management platform."
This is a non-shipping reference example. It lives outside the build (
src/→bin/lib/), the npm packagefiles[], the installer, and the CI test suite (tests/). Nothing here is compiled into or installed with GSD. The production implementation lands in a later phase of the Dynamic Context Management epic (#1671).
What it demonstrates
The predicate fact-store → JIT selector slice of the platform: parse the
repo-root CONTEXT.md CLASS.subkey=value predicates into structured records,
drift-guard a generated index, and select the relevant predicate subset for a
task — the building block for just-in-time agent-brief assembly instead of
hand-citing a 200 KB file.
Files
context-predicates.cjs— parser + selector + deterministic index builder (self-contained).gen-context-index.cjs—--check/--writedrift-guarded generator +--select.CONTEXT-INDEX.json— sample generated output (415 predicates, 20 classes).demo.cjs— runnable usage example.
Run (from the repo root)
node examples/dynamic-context-management/demo.cjs
node examples/dynamic-context-management/gen-context-index.cjs --select PRED.k320
node examples/dynamic-context-management/gen-context-index.cjs --check
Validation
During research this slice was validated with 42 behavioral tests — predicate
forms, fenced-code / prose skipping, duplicate-id detection, the selector, a
deterministic index, and a fast-check property test. The production
implementation has since landed, with tests/context-predicates.test.cjs and
tests/context-index-sync.test.cjs as its behavioral tests under tests/,
and scripts/lint-example-parser-parity.cjs (wired into npm run lint:ci)
asserting this example and production agree.
Research also surfaced 3 latent duplicate predicate IDs in CONTEXT.md
(RULESET.WORKFLOW_MARKDOWN.FENCES, RULESET.GEMINI.TOOLS.ask_user,
RULESET.GEMINI.TEST_SENTINEL) at the time; all three have since been
resolved and the current index carries 0 duplicate ids.