v4.0.1 — fix #17 checkpoint data-loss

Fixed

• Periodic-checkpoint hook destroyed HANDOFF.json and created .planning/ where it should not (#17). writeCheckpoint() in bin/lib/checkpoint.cjs had no guards: it created .planning/ when absent (so the PostToolUse hook spawned a .planning/HANDOFF.json in directories that are not GSD projects) and wrote a phase:null/task:null skeleton even with nothing to resume (so it silently blanked a hand-authored HANDOFF.json in an idle GSD project). Added two early-return guards before any filesystem mutation: no-op when .planning/ does not already exist, and no-op for any non-manual-pause source when both phase and task are null. /gsd:pause-work still writes via the manual-pause bypass; active phase/task work still checkpoints. Regression test tests/checkpoint-write-guards.test.cjs (8 cases).

Added

• Pre-release CI gate for the #17 regression. The checkpoint write-guards test now runs in CI (.github/workflows/check-drift.yml, handoff-schema job) on every push, so the data-loss failure mode fails the build before any tag. New RELEASING.md documents the pre-release checklist with CI as the source-of-truth gate.

Changed

• README polish: install flow moved ahead of "What's New"; "Added features beyond upstream" descriptions tightened for scannability; intro reworded ("evolution" of GSD, not "packaging"); redundant "Based on" header dropped (covered by the Upstream projects section).

v4.0.0 — Consistency & Code-Integrity Safeguards

This is a milestone release (internal milestone v1.3) and the first on the plugin's own version line. The major bump is a divergence signal, not a breaking change: existing commands, config, and planning artifacts work unchanged, and the new capabilities are additive and opt-in. Follows the gsd-core 1.x line.

Added

• Convention and architectural conformance gate. A zero-dependency bin/lib/conventions.cjs derives a project's naming and architecture conventions (identifier/file casing, export/import style) by majority vote with a normalized-entropy signal, exposes gsd-tools verify conventions --derive|--check, and wires named-contract output into gsd-pattern-mapper (a ## Conventions section in PATTERNS.md) and gsd-code-reviewer (CONVENTION-tier findings: convention deviation, verb-vs-body intent, architectural-split). Runs in the existing review path, never blocks.
• Native drift detection. Three native detection layers run as a single sweep over one bounded corpus via gsd-tools verify drift: structural near-clones (native MinHash+LCS in bin/lib/semantic-dup.cjs, heuristics ported from @vibedrift/cli@0.14.4), phantom/placeholder scaffolding (bin/lib/phantom-scaffolding.cjs), and convention reuse. A committed, auditable allowlist (.gsd/drift-allowlist.json) suppresses intentional duplication (e.g. the CJS/SDK dual resolver) while keeping suppressions visible in the report, and .vibedriftignore excludes generated/test paths. Surfaced through /gsd:scan --drift (ranked report) and an opt-in, warn-first /gsd:audit-milestone integrity gate (workflow.drift_gate, with --fail-on-score N as the only hard-exit escalation). Never throws, never exits non-zero by default.
• VibeDrift as a second upstream. GSD never installs or runs VibeDrift; it ports the heuristics natively (pinned to the v0.14.0 idea baseline) and watches the package for new releases via bin/check-vibedrift-release.sh (cron notifier; first-run seed, offline-safe, never fails cron) so future heuristics can be cherry-picked. See README § Upstream projects.
• Weekly plugin self-update watch. bin/check-plugin-update.sh compares the installed plugin version (from the Claude Code plugin cache) against the latest jnuyens/gsd-plugin tag and emails only when the install is behind, since Claude Code's plugin auto-update is unreliable. Uses tags (not the lagging Releases feed) as the version signal; never fails cron.
• CJS/SDK config-schema parity test (tests/config-schema-sdk-parity.test.cjs) wired into CI, guarding the whole class of resolver drift.

Changed

• Versioning is now an independent line. Retired the plugin_major = gsd-core_major + 2 offset; the plugin major now signals its own milestones. Provenance (which gsd-core line a release follows) is noted per release. See README § Versioning.

Fixed

• .vibedriftignore is now applied. The ignore list was loaded but never used; it now filters the drift corpus before any detector runs, so generated/test paths are excluded as documented.
• Structural-dup detector now sees class methods. METHOD_RE was declared but absent from the pattern set; added with a control-flow keyword guard so if/for/while/switch/catch are never extracted as functions.
• fable tier accepted by both resolvers. The SDK config schema accepted only opus|sonnet|haiku for model_profile_overrides while CJS accepted fable too; aligned the SDK pattern and added the parity test above.
• Multi-level glob suppression. semantic-dup globMatch mistranslated ** (it matched the never-existing escaped form), so sdk/src/** failed to suppress nested paths and the intentional CJS/SDK dual-resolver pairs leaked into findings. Corrected so verify drift reports suppressed: 21 with zero cross-resolver pairs in findings.
• Consumer workflows referenced non-existent counts.findings/counts.suppressed (the real keys are top-level findings/suppressed arrays); corrected in scan.md and audit-milestone.md.

v3.4.5: plan-convergence runs gsd-plan-phase inline (gsd-core #936)

Cherry-pick of gsd-core v1.4.3 #936.

Fixed

• workflows/plan-review-convergence.md: the cross-AI plan-convergence loop (/gsd:review convergence) wrapped gsd-plan-phase inside Agent() at both the initial-planning and replan sites. gsd-plan-phase is a spawner (it spawns gsd-planner and gsd-plan-checker); on Claude Code a depth-1 Agent has no Agent tool, so the wrapped plan-phase could never spawn its sub-agents and the replan loop silently produced no revised plan when reviewers flagged HIGH concerns. Both sites now run plan-phase inline (bare Skill() at depth 0); gsd-review stays wrapped (it is a Bash leaf with no sub-agent spawns). New structural-guard test ensures no workflow re-wraps a spawner.

The other two gsd-core v1.4.3 fixes were assessed and skipped as not applicable: #934 (prunes orphan gsd-pristine/get-shit-done/ snapshots from the upstream rename, which the plugin's flat layout never had) and #935 (upstream changeset-CLI release infra). The plugin is now current with gsd-core v1.4.3.

v3.4.4: Claude Fable 5 as a new top model tier

Adds Claude Fable 5 (claude-fable-5), Anthropic's new flagship, as a model tier above opus (1M context, ~2x Opus pricing at $10/$50 per Mtok).

Added

• New fable tier in the model catalog for every runtime: Anthropic-compatible runtimes (claude/copilot -> claude-fable-5; opencode/hermes -> anthropic/claude-fable-5) get the real model; non-Claude runtimes (codex/gemini/qwen) alias fable to their most capable model so a fable-tier agent still resolves; Group-B runtimes carry fable: null.
• The quality profile now uses fable for the 9 heaviest agents (routingTier: heavy): planner, roadmapper, debugger, assumptions-analyzer, debug-session-manager, eval-planner, framework-selector, security-auditor, user-profiler. Standard/light agents and the balanced/budget profiles are unchanged, so cost only rises (~2x Opus) for quality-profile users on those heavy agents. Opt out via balanced/budget or by overriding the tier.
• fable is first-class everywhere tiers are accepted: model_profile_overrides.<runtime>.fable and models.<phase>: fable both work.

New regression test (26 checks); full suite 14/14. Verified end-to-end: with model_profile: quality, gsd-planner resolves to claude-fable-5 while gsd-executor stays claude-opus-4-8.

v3.4.3: adapt #730 (multi-milestone Phase Details scope)

Integrates the highest-value deferred TIER-2 fix from the gsd-core v1.4.x survey.

Fixed

• #730 (adapts edd3c6c3): extractCurrentMilestone in a multi-milestone ROADMAP.md stopped the current-milestone window at the milestone's own ## Milestone vX.Y … (Phase Details) section, so every phase of any milestone after the first was invisible to /gsd:discuss-phase, /gsd:plan-phase, state, roadmap list, and validate health (W006) until a .planning/phases/<N>/ dir already existed. The parser now also pulls in the current milestone's own (Phase Details) section, anchored boundary-aware to its exact version token (v3.0 does not match v3.0-A). Bespoke adaptation onto the plugin's older single-match base (not a verbatim port); no-op on single-milestone roadmaps. New two/three-milestone regression test; suite 12/12.

Note: the other deferred TIER-2 item, #768 (CC permissions prepopulation), was verified to have no plugin mechanism (plugin.json has no permissions field; bundled settings.json ignores permissions; fails --strict). It can only ever be a documented settings.json snippet, so it stays deferred.

v3.4.2: integrate gsd-core v1.4.2 fixes (#925, #921/#922)

Hotfix follow-on to 3.4.1, integrating both real fixes from gsd-core's v1.4.2 (the rest of that release was chores). Both refine capabilities 3.4.1 just shipped.

Fixed

• #925 (27af8183): gsd-context-monitor.js now echoes the actual invoking hook event (data.hook_event_name) instead of hardcoding PostToolUse. Required companion to 3.4.1's #770 SubagentStop wiring -- without it Claude Code rejects the monitor's output on Stop/SubagentStop/PreCompact ("expected SubagentStop but got PostToolUse"), silently dropping those context-headroom warnings.
• #921/#922 (a6229ec1, plan-phase portion): the <runtime_compatibility> Agent gate is now attempt-based -- never pre-judge Agent availability by introspection; attempt the Agent() call and treat only a real tool-unavailable error as the absence signal. Refines the #913 guard.
• Regression test locking the #770 + #925 pairing. Full suite 11/11.

Checking the next upstream version caught that 3.4.1's SubagentStop was latently broken without #925.

v3.4.1: version re-base to gsd-core 1.4.x + auto-memory + 7 cherry-picks

Re-bases the plugin version to track the new upstream @opengsd/gsd-core line with a +2 major offset (gsd-core 1.4.1 -> plugin 3.4.1). The +2 (not +1) keeps the version monotonically above the prior 2.45.x lineage. 3.4.x tracks the gsd-core 1.4.x line as a selective cherry-pick, not byte-parity (the multi-runtime emitters and release/CI infra that dominate upstream are out of scope by design).

Added

• Ad-hoc durable-decision auto-capture at /gsd:quick, /gsd:debug, /gsd:fast close-out, gated on workflow.auto_memory_capture (default on). Also fixes the long-orphaned + doubly-broken phase-memory writer (it had never actually fired).

Fixed (cherry-picks from gsd-core v1.4.x)

• #905 STATE.md scalar preservation (data-loss fix)
• #904 phase-branch normalization under project_code
• #771 14 agent color: values -> documented Claude Code named colors
• #25 verifier Step 7b: enumerate-or-single-test, no full-suite re-runs
• #913 plan-phase role-collapse guard + CODEX RUNTIME -> ALL RUNTIMES
• #892 validate/W006 now match checklist-style roadmap phases
• #770 SubagentStop slice: context-monitor fires on subagent finalize

Deferred (CC-relevant, evaluated)

• #730 multi-milestone extractCurrentMilestone (97-line rewrite on a divergent patched file; wants its own task + two-milestone fixture)
• #768 CC permissions prepopulation (lives in upstream's npm installer; no confirmed plugin-manifest mechanism)

Full suite 10/10.

v2.45.10: 5 cherry-picked bug fixes from upstream v1.3.1

Selective cherry-pick of five verified bug fixes from upstream @opengsd/gsd-core v1.0.0..v1.3.1, ported by hand into the flat layout. Not a wholesale sync: upstream restructured heavily (build-at-publish for bin/lib, the SDK retired, a second rename to @opengsd/gsd-core), making a full vendor-and-merge a ~350-file migration. Pulled only the portable, low-risk wins.

Fixed

• 7 writer agents (#582, #571): granted Edit so surgical section edits stop silently clobbering shared files via whole-file Write. gsd-doc-writer fix mode now mandates Edit; docs-update.md gains a >90%-shrink restore guard.
• Brave websearch (#387/#308): fetch now bounded by an AbortController timeout (GSD_WEBSEARCH_TIMEOUT_MS, default 10s) + a 2-retry loop for 429/5xx honoring Retry-After. Previously a hung connection blocked the agent indefinitely.
• plan-phase decision gate (#283/#275): tolerates top-level .passed/.message result fields so it cannot silently mis-fire.
• AskUserQuestion 4-option cap (#243/#17): over-cap blocks in new-project / settings-advanced / settings-integrations split into gated two-block flows so options are no longer truncated.

Note: upstream's native CC plugin manifest (#766) is unreleased (next only); our manifest stays authoritative as a strict superset. Convergence parked until #766 reaches a stable tag.

v2.45.9: gaps_found defaults to backlog-park (prevents unbounded milestone growth)

Behavior change: when the verifier returns gaps_found, the default routing is now park to backlog, not "open a follow-up phase." Addresses a felt issue in larger projects where GSD-managed milestones tended to grow indefinitely.

The problem

The architecture has 4 workflows that add phases (add-phase, insert-phase, add-backlog, plan-milestone-gaps) against 1 that effectively closes them (complete-milestone). When gsd-verifier returned gaps_found, the historical default routed gaps into a new follow-up phase via /gsd:plan-phase --gaps, which kept gap-driven phase multiplication going. Combined with verifier-decomposition bias, milestones in large projects became unbounded.

This plugin's own milestones (v1.0, v1.1, v1.2) all shipped at 3, 2, 3 phases with zero decimal-numbered inserts. That works because the maintainer actively scope-polices. Larger team projects can't lean on a single judgment-bearer the same way, so the architectural bias toward addition becomes load-bearing.

The fix

When gaps_found, the orchestrator now asks the user how to handle them via AskUserQuestion:

Option	What happens	When to pick
Park to backlog (Recommended, default)	Each gap becomes a 999.x entry via /gsd:add-backlog. Phase marked gaps_parked. Milestone ships when remaining in-scope phases close.	Gaps are real follow-up work but don't block the milestone's ship criteria
Escalate to current milestone	Previous behavior. Gaps become a follow-up phase via /gsd:plan-phase --gaps. New verification cycle opens.	At least one gap genuinely blocks the milestone goal and MUST close before ship
Decide later	Print summary, no action. Phase stays gaps_found until user runs either path manually.	Need to think about it

The verifier's prompt was also softened: previously it instructed the agent to "Structure gaps for /gsd:plan-phase --gaps" in 3 places. Those now mention both downstream paths (backlog and escalation) so the verifier no longer pre-biases the orchestrator's routing choice.

Tradeoff

Looser scope discipline. Teams that WANT exhaustive coverage and want every gap to close before milestone ship will prefer the previous default. They can still pick "Escalate to current milestone" on any individual gaps_found event. If a project consistently picks escalation, a config flag (workflow.gaps_default_action: park | escalate) would let them flip the default back. Not shipped yet; will add if requested.

Bundled

The test stability commit from 834fa51 (refactor of tests/mcp-write-tools-end-to-end.test.cjs to drop the racy 6-sequential-spawn check, keeping gsd_add_blocker end-to-end + gsd_plan_status control case) landed unreleased earlier today. It ships with this release. 20/20 deterministic.

Stats

7 files changed, +78 / -9 lines. Workflow + agent prompt + version + CHANGELOG + README features row + jargon baseline.

v2.45.8: stabilize MCP write-tools end-to-end test

Test stability fix. No runtime behavior change.

The v2.45.5 fix routes each MCP write-tool call through a spawnSync of bin/gsd-tools.cjs. The end-to-end test at tests/mcp-write-tools-end-to-end.test.cjs sends 6 sequential write-tool calls in one case, meaning 6 sequential node-subprocess spawns inside the MCP server, each ~100-200ms.

The test's original 1.5s post-request budget was too tight. At v2.45.7 ship, 5 of 5 local runs produced 1-2 of 3 passes instead of 3 of 3.

The fix

Constant	Before	After
POST_REQUEST_WAIT_MS	1500	5000
TIMEOUT_MS	8000	15000
Kill-after-stdin-end delay	300ms	500ms

5 of 5 runs now pass deterministically. CI should stabilize on the same patch.

Stats

4 files changed, +21 / -6 lines. Test-only change plus version bump and CHANGELOG.