Files
msd-core/docs/adr/15-autonomous-cross-ai-convergence.md
Tom Boucher 67a9243cf1 chore(#2356): make the ADR index a generated artifact and enforce ADR lifecycle invariants (#2367)
* chore: rebuild ADR index as a generated artifact and enforce lifecycle invariants

The ADR index in docs/adr/README.md was hand-maintained with nothing checking
it, and had drifted to 40 of 65 ADRs. The absent rows included the entire
capability family (857/894/959/1016/1143/1213/1244) and ADR-1239 (EoS) itself,
so the decisions a reader most needed were the ones they could not find.

Make the index a derived artifact, matching the repo's existing generated-file
idiom (lint:generated-sync), and enforce the corpus' lifecycle invariants:

- scripts/gen-adr-index.cjs generates the index between markers and validates
  the status vocabulary (Accepted/Proposed/Superseded/Legacy/Retired),
  successor links, id/filename agreement, and supersession symmetry.
- Wire --check into lint:generated-sync so drift fails CI.

Correct the lifecycle metadata the gate surfaced, without flipping any status:

- ADR-1239 (EoS) declared it subsumed ADR-1016/58/3660/894; none recorded it.
  Add reciprocal "Subsumed by" pointers + dated amendments. Subsumption keeps
  the target Accepted -- these are live adapters, not dead decisions.
- ADR-857/894 carry dated status caveats: they read Proposed while the
  capability system shipped and epic #857 is closed. Ratification is a
  maintainer act and is deliberately left open.
- Link ADR-0005/0007/0012/3524 -> ADR-0174 and ADR-0010 -> ADR-0009; record
  the reciprocal Supersedes on ADR-0009.
- ADR-218 declared itself "ADR-0175" -- an unfinished rename.
- The 0011 PRD moves from the non-canonical "Draft" to "Legacy".

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* test: capture stderr via spawnSync; record ADR-0010 draft supersession

Two fixes surfaced by the first gsd-test run and by regenerating the index:

- tests/adr-index-gate.test.cjs used execFileSync, which only surfaces stderr
  through the thrown error on non-zero exit. The `--write` path exits 0 while
  reporting outstanding violations on stderr, so the helper always saw ''.
  spawnSync captures both streams on both outcomes.
- The hand-maintained index recorded 0010-skill-surface-budget-module.md as
  "earlier draft superseded by ADR-0011" while the file itself still said
  Proposed. Deriving the index from the files would have dropped that
  assertion and resurrected a superseded draft as a live decision, so it is
  recorded at its source, with the reciprocal Supersedes on ADR-0011.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix: drop the dead sdk/ model-catalog candidate retired by ADR-0174

src/model-catalog.cts resolved model-catalog.json through three candidates, the
second being sdk/shared/model-catalog.json three levels up. That was the legacy
source-repo fallback kept by the #3288 fix ("check the co-located path FIRST,
before the legacy source-repo path").

ADR-0174 then retired the @opengsd/gsd-sdk package boundary and deleted the sdk/
tree (11918dcc3), so the candidate can no longer resolve in any layout: a source
repo has no sdk/, and an install layout points it at ~/.claude/sdk/shared/, which
the installer never writes -- the original #3288 bug. It was dead weight implying
a package boundary this repo no longer has.

No test depends on it: the #3288 regression tests in tests/install.test.cjs write
their own synthetic old-path fixture and assert it throws.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* docs: ratify nine shipped ADRs; record why ten others stay Proposed

The corpus carried 19 Proposed ADRs, most describing architecture that had
already shipped. A Proposed label on live architecture tells contributors and
agents the decision is an unbuilt idea -- the capability system and EoS were
both being misread that way.

Audited all 19 against the shipped tree and GitHub. Each candidate flip then had
to survive two independent reviewers instructed to refute it.

Ratified Proposed -> Accepted, each with a dated Ratification section carrying
the verified evidence (file:line, symbols, tests, issue state):

  857  capability system      894  declaration format   1244 capability ecosystem
  1577 injection boundary     1610 size-budget ratchet  1990 existing-code onboarding
  15   cross-AI convergence   22   plan-drift guard     0011 default reviewers

Held ten, each now carrying a "Why this is still Proposed" section naming the
blocker and its unblock condition, so the audit is not repeated:

  2264 its own headline acceptance criterion is unmet in the tree
  230  live branch protection contradicts the decided spec (1 approval, not 2)
  660  the namesake release/<version> re-cut is manual, not automated
  959  issue #2346 is approved and plans its graduation as its own ADR
  1213 the shipped writer's return shape differs from the decided interface
  443  the orchestrator override path has no live caller
  1143 / 1606 each states its own bar for acceptance; neither is met
  612 / 1671 legitimately open

Shipped code proved necessary but not sufficient: eight ADRs had every named
module, symbol, and test present with their epics closed, and still failed the
bar. That lesson is written into README.md's ratification procedure.

Also corrected ADR-857's "Supersedes (generalizes)" to "Subsumes": taken
literally it would have marked two live seams dead -- ADR-0011 (surface.cts:348)
and ADR-58 (runtime-artifact-install-plan.cts:82). Both keep Accepted status and
gain Subsumed-by pointers.

Index: Active 39->48, Proposed 19->10, Superseded/Legacy 7. 65 total.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix: harden gen-adr-index against hostile titles and non-ADR filenames (#2356)

Three findings from the pre-PR orthogonal security review, all confirmed:

- An ADR title containing the literal ADR-INDEX:END marker was emitted verbatim
  into its table cell, relocating the splice boundary so the NEXT --write
  spliced against the wrong marker and truncated README.md. Titles now render
  through cellText(), which escapes pipes and angle brackets -- making an HTML
  comment (and any other HTML) unformable from ADR-authored text.
- A docs/adr/*.md without a numeric prefix crashed on match(...)[1] of null.
  Such a file is also invisible to the index -- the very failure this gate
  exists to prevent -- so it is now reported as a naming-convention violation
  naming the file and the fix.
- Tests leaked their mkdtemp dirs. They now use helpers.createTempDir/cleanup
  via t.after(); helpers.cleanup carries the Windows-EBUSY retry budget that a
  raw fs.rmSync lacks (caught by local/no-raw-rmsync-in-tests).

Adds five regression tests: marker hijack, HTML injection, pipe cell-break,
non-conforming filename, and splice stability across repeated writes.

Refs #2356

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix: close two gate false-passes; read ## Supersedes sections (#2356)

Second round of confirmed findings from the pre-PR orthogonal code review. Both
false-passes matter more than a false-fail: a gate that silently misses a
violation is worse than no gate, because it is trusted.

- A relation field mixing a link with a bare id silently dropped the bare claim:
  the check tested `rel.links.length` (does this field have ANY link?) instead
  of whether THAT id was linked. `Supersedes: [ADR-0001](...), ADR-0011` passed
  clean -- accepting exactly the ambiguous bare reference the rule forbids. Now
  each bare id is checked against the ids actually linked in the same field, so
  a repeat in trailing prose stays quiet while an unlinked claim is flagged.
- The ratification guard (`statusToken !== 'Accepted'`) skipped BOTH relation
  directions, which killed the IN check entirely: `supersedes.in` is only ever
  populated on an ADR whose status IS `Superseded`, so a dangling `Superseded by
  X` where X never claims it always passed. The guard now applies to OUT only --
  a prospective claim must not obligate its target, but an ADR's statement about
  ITSELF is always owed a reciprocal.
- Fixing that surfaced a parser gap: ADR-0174 declares its supersessions in a
  `## Supersedes` table SECTION, not a header field, and headerBlock() stops at
  the first `##`. The repo's best-documented supersession was invisible. Section
  form is now parsed for both relations.
- Replaced a vacuous test: the em-dash negation case passed whether or not
  NEGATED_RELATION_RE matched (a mutation to /$^/ survived). It now carries a
  link that would create a failing asymmetric relation if negation did not fire.

Also removes docs/adr/9401-test-target.md -- a synthetic fixture a reviewer
created in the worktree while reproducing a finding, swept in by `git add -A`.

Adds regression tests for each: mixed link+bare, linked-and-repeated-in-prose,
dangling superseded-by from a non-Accepted ADR, and the ADR-0174 section shape.

Refs #2356

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix: escape backslashes before pipes in the ADR index cell renderer (#2356)

CodeQL js/incomplete-sanitization (high) on scripts/gen-adr-index.cjs: cellText()
escaped `|` -> `\|` without first escaping the backslash. Markdown's escape
character is the backslash, so the input `\|` became `\\|`, which renders as a
literal backslash followed by an UNESCAPED pipe -- re-opening the cell break the
pipe escape exists to prevent. Order is load-bearing: escape the escape
character first, then everything that emits one.

Same class as the index-marker hijack fixed earlier: ADR-authored text breaking
out of the cell it is rendered into.

Adds a regression test asserting a `\|`-bearing title leaves exactly the row's
own 5 unescaped delimiters and cannot forge a Status cell. Uses split(/\r?\n/)
per local/no-crlf-fragile-split -- a literal "\n" split is CRLF-fragile on the
Windows CI leg.

Refs #2356

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-17 10:51:58 -04:00

11 KiB

Cross-AI Plan Convergence via Existing Orchestration Commands

  • Status: Accepted — ratified 2026-07-17 (originally Proposed 2026-05-24); see "Ratification" below
  • Date: 2026-05-24
  • Issue: #15

Current orchestration commands (/gsd-autonomous and /gsd-progress --next --auto) route planning through gsd-plan-phase and only use local/Claude subagent review paths. The cross-AI convergence path already exists (/gsd-plan-review-convergence, /gsd-review, review.default_reviewers, review.models.*) but is not wired into these orchestrators. This creates a gap: users can configure cross-AI reviewers yet still get local-only planning in autonomous/auto-chain execution.

Ratification (2026-07-17): Proposed → Accepted

Ratified by explicit maintainer directive after the shipped implementation was independently re-verified; the Status field had read "Proposed" for roughly 8 weeks after the underlying decision had already landed.

Evidence the decision shipped:

  • Primary, parity, and alias surfaces are present verbatim: commands/gsd/progress.md:4,28 (--next --converge, --cross-ai alias, reviewer flags, --max-cycles N) and commands/gsd/autonomous.md:4,40-41 (--converge, --cross-ai alias).
  • The plan_strategy=local|converge seam is implemented in gsd-core/workflows/next.md:260-313 (PLAN_STRATEGY parsing, CONVERGENCE_ARGS build, feature-gate check, Route-3 override) and mirrored in gsd-core/workflows/autonomous.md:19-90,378-419.
  • Fail-fast-on-disabled-gate behavior matches the ADR's Failure Policy exactly: next.md:279-292 and the equivalent block in autonomous.md check workflow.plan_review_convergence via config-get and abort with the exact gsd config-set workflow.plan_review_convergence true instruction — no silent downgrade to local.
  • The config contract is shipped: gsd-core/bin/shared/config-schema.manifest.json:36 (workflow.plan_review_convergence), :54 (review.default_reviewers), :123,141 (review.models.*); documented identically in docs/CONFIGURATION.md:225,316 and docs/COMMANDS.md:620-622,850-852.
  • Dedicated regression tests exist: tests/adr-15-progress-converge.test.cjs (179 lines, describe block titled 'ADR-15: /gsd:progress --next --auto --converge (#1190)') and tests/autonomous-converge.test.cjs (225 lines, covering the parity surface under 'autonomous --converge flag (#711)' — this file does not itself reference ADR-15 by name).
  • Landing commits: 092340d18 (fix(#711): wire autonomous convergence flag, 2026-06-10, parity surface) and 0b3a2e5f9 (feat(#1190): wire --converge primary surface into /gsd:progress --next (ADR-15) (#1237), 2026-06-14) — the latter's commit body states "ADR-15 designates /gsd-progress --next --auto --converge as the PRIMARY plan-convergence surface" and confirms the wiring gap the ADR called out is closed.
  • No later ADR references or supersedes ADR-15: grep -rl 'ADR-15' docs/adr/*.md returns only docs/adr/README.md's own index row (line 158), which still lists it as "Proposed" — the stale bookkeeping entry this ratification corrects.

Governance state: Issue #15 CLOSED — stateReason COMPLETED (closed 2026-05-25T03:12:26Z). Follow-up test-coverage issue #1190 ("test(coverage): fill Proposed-ADR test gaps") also CLOSED — stateReason COMPLETED (closed 2026-06-14T19:52:24Z).

Decision

Do not add a new command. Add convergence as an orchestration policy in existing commands, with /gsd-progress as the primary operator surface.

  1. Add a shared plan strategy seam for orchestration workflows:
    • plan_strategy=local|converge
    • local maps to gsd-plan-phase
    • converge maps to gsd-plan-review-convergence
  2. Expose the strategy via existing entry points:
    • /gsd-progress --next --auto --converge (primary)
    • /gsd-autonomous --converge (parity path for users who prefer autonomous directly)
    • keep --cross-ai as a compatibility alias for --converge
  3. Reuse existing reviewer selection semantics from /gsd-review and /gsd-plan-review-convergence:
    • explicit reviewer flags (--codex, --gemini, --claude, --opencode, --ollama, --lm-studio, --llama-cpp)
    • --all
    • review.default_reviewers and review.models.* config
  4. Add pass-through flags (no new command surface):
    • --converge (primary)
    • --cross-ai (alias)
    • reviewer selector flags listed above
    • --max-cycles N (forwarded per phase)
  5. Keep convergence behind existing feature gate:
    • if workflow.plan_review_convergence=false and --converge (or alias) is requested, fail fast with actionable enable instructions.
  6. Keep post-execution review behavior unchanged in this slice (gsd-code-review and gsd-ui-review stay as-is). Cross-AI code-review fanout is deferred.
  7. Define convergence eligibility and allowed AIs via config (no new command):
    • enable gate: workflow.plan_review_convergence=true
    • allowed reviewer set: review.default_reviewers (for no-flag converge runs)
    • per-reviewer model selection: review.models.*

Interface Contract

Existing CLI Surfaces (No New Command)

  • /gsd-progress --next --auto [--converge|--cross-ai] [reviewer flags] [--max-cycles N]
  • /gsd-autonomous [existing flags] [--converge|--cross-ai] [reviewer flags] [--max-cycles N]

Planning Step Routing

  • plan_strategy=local:
    • orchestrator step uses gsd-plan-phase (current behavior).
  • plan_strategy=converge:
    • orchestrator step uses gsd-plan-review-convergence.
    • convergence workflow remains owner of HIGH counting (CYCLE_SUMMARY), stall detection, and escalation.

Failure Policy

  • If --converge (or --cross-ai) is requested but convergence gate is disabled:
    • stop before planning dispatch
    • emit exact enable command:
      • gsd config-set workflow.plan_review_convergence true
  • no silent downgrade to local strategy.

Configuration Contract (Enable + Allowed AIs)

Convergence is configurable without introducing new config namespaces.

  1. Enable convergence:
    • workflow.plan_review_convergence: true
  2. Define which AIs are allowed by default for convergence runs:
    • review.default_reviewers: ["codex", "gemini"] (example)
  3. Optionally pin models per allowed reviewer:
    • review.models.codex, review.models.gemini, etc.

Precedence for reviewer selection in converge mode:

  1. Explicit CLI reviewer flags (--codex, --gemini, --all, etc.)
  2. review.default_reviewers
  3. If neither resolves to any reviewer, fail fast with actionable message.

Example config:

{
  "workflow": {
    "plan_review_convergence": true
  },
  "review": {
    "default_reviewers": ["codex", "gemini"],
    "models": {
      "codex": "gpt-5.4",
      "gemini": "gemini-2.5-pro"
    }
  }
}

Flag Naming

Issue #15 asks for a flag such as --converge or --cross-ai on autonomous execution. --converge is the better primary term because it names the behavior (plan-review convergence loop), not the transport (external AI) or mode label (autonomous).

  1. Primary: --converge
  2. Alias: --cross-ai
  3. Avoid: introducing --autonomous-* variants (the command already defines that mode)

Options Considered

  1. Autonomous-only flag (/gsd-autonomous --cross-ai)

    • Files: commands/gsd/autonomous.md, workflows/autonomous.md
    • Problem: solves issue #15 directly but leaves /gsd-progress --next --auto inconsistent.
    • Benefit: smallest blast radius.
    • Drawback: two orchestration modes diverge in behavior.
  2. Progress-primary + autonomous parity (Chosen)

    • Files: commands/gsd/progress.md, workflows/progress.md, workflows/next.md, plus autonomous wiring
    • Problem: must keep two orchestrators aligned.
    • Solution: one shared plan-strategy seam consumed by both commands.
    • Benefit: better locality; users who already drive from progress --next --auto get convergence without switching workflows.
  3. Config-only global toggle (no per-run flag)

    • Files: config schema + both orchestrators
    • Benefit: minimal CLI syntax expansion.
    • Drawback: less control per run; harder to do targeted high-cost convergence only when needed.
    • Decision: defer; keep explicit runtime flag.

Rubber-Duck Design Notes

Expected behavior: the two existing orchestration entry points should be able to opt into cross-AI plan convergence without adding another top-level command.

Actual behavior: both orchestration entry points always take the local planning route, so external reviewers are never reached unless the user abandons orchestration flow and runs convergence manually.

Wrong assumptions surfaced:

  1. "Enabling workflow.plan_review_convergence changes orchestration behavior." It does not unless the convergence command is explicitly routed.
  2. "Cross-AI config propagates automatically into autonomous/next flows." It only applies where convergence/review workflows are invoked.
  3. "Adding a separate command is required." Existing orchestration commands are sufficient if they expose a strategy seam and clear flag naming.

Root architectural gap: orchestration flows lack a plan strategy seam (local vs converge).

Scope

In scope

  • Plan strategy seam shared by existing orchestration commands.
  • --cross-ai pass-through contract on existing commands.
  • --converge primary flag naming and --cross-ai compatibility alias.
  • Feature-gate behavior contract for convergence strategy.
  • Config contract for enabling convergence and selecting allowed AIs.
  • Documentation updates tied to command/config behavior.

Out of scope

  • New top-level command creation.
  • Reworking gsd-code-review into cross-AI convergence loop.
  • New reviewer config schema (reuse existing review.* keys).
  • Changing default planning strategy without explicit opt-in.
  • Altering gsd-plan-review-convergence internal loop semantics.

Consequences

  • No new command tax on docs, routing, and long-term maintenance.
  • Existing orchestration habits (progress --next --auto and autonomous) can opt into convergence consistently.
  • Existing review configuration gets leverage without new schema.
  • Backward compatibility is preserved by default.
  • Explicit failure on disabled gate avoids silent false-confidence automation.

References

  • Issue: #15
  • commands/gsd/progress.md
  • gsd-core/workflows/progress.md
  • gsd-core/workflows/next.md
  • commands/gsd/autonomous.md
  • gsd-core/workflows/autonomous.md
  • commands/gsd/plan-review-convergence.md
  • gsd-core/workflows/plan-review-convergence.md
  • commands/gsd/review.md
  • docs/COMMANDS.md (/gsd-plan-review-convergence, /gsd-review)
  • docs/CONFIGURATION.md (workflow.plan_review_convergence, review.default_reviewers, review.models.*)