Feat(installer): add phase 5 migration guardrails

docs/INVENTORY-MANIFEST.json

@@ -277,6 +277,7 @@
       "init-command-router.cjs",
       "init.cjs",
       "install-profiles.cjs",
+      "installer-migration-authoring.cjs",
       "installer-migration-report.cjs",
       "installer-migrations.cjs",
       "intel.cjs",

docs/INVENTORY.md

@@ -359,7 +359,7 @@ The `gsd-planner` agent is decomposed into a core agent plus reference modules t
 
 ---
 
-## CLI Modules (52 shipped)
+## CLI Modules (53 shipped)
 
 Full listing: `get-shit-done/bin/lib/*.cjs`.
 
@@ -385,6 +385,7 @@ Full listing: `get-shit-done/bin/lib/*.cjs`.
 | `init-command-router.cjs` | Thin CJS subcommand router adapter for `gsd-tools init` |
 | `init.cjs` | Compound context loading for each workflow type |
 | `install-profiles.cjs` | Install profile allowlist + skill staging for `--minimal` install (#2762); single source of truth for which `gsd-*` skills/agents land in runtime config dirs |
+| `installer-migration-authoring.cjs` | Installer migration authoring guardrails for record metadata, explicit scopes, ownership evidence, and runtime contract citations |
 | `installer-migration-report.cjs` | Installer migration report projection and blocked-action guard for install/update integration |
 | `installer-migrations.cjs` | Installer migration planning, artifact classification, install-state persistence, journaled apply, and rollback helpers |
 | `intel.cjs` | Codebase intel store backing `/gsd-map-codebase --query` and `gsd-intel-updater` |

docs/adr/0008-installer-migration-module.md

@@ -48,3 +48,12 @@ snapshot before migration work proceeds.
 The first implementation should extract manifest/user-owned helpers, add install-state persistence, add migration planning, and port one existing orphan cleanup into the migration runner. It should not rewrite every runtime installer branch in the first pass.
 
 The detailed module contract lives in `docs/installer-migrations.md`.
+
+## Amendment (2026-05-11): Authoring guard enforcement
+
+The Installer Migration Authoring Guard Module validates migration records and
+planned actions before planning can proceed. Records must declare title,
+description, introduction version, explicit install scopes, destructive status,
+and a plan function. Destructive or config-rewrite actions must include
+ownership evidence, and runtime config rewrites must cite the runtime
+configuration contract registry.

docs/installer-migrations.md

@@ -135,6 +135,7 @@ Required fields:
 module.exports = {
   id: '2026-05-11-runtime-layout-example',
   title: 'Move legacy commands into runtime skills',
+  description: 'Move legacy runtime command files into the generated skill layout.',
   introducedIn: '1.50.0',
   runtimes: ['claude', 'codex', 'gemini'],
   scopes: ['global', 'local'],
@@ -145,6 +146,12 @@ module.exports = {
 };
 ```
 
+The Installer Migration Authoring Guard Module rejects records that omit `id`,
+`title`, `description`, `introducedIn`, `scopes`, `destructive`, or `plan`.
+`runtimes` remains optional only for migrations intentionally shared by every
+runtime, but scope must always be explicit so an author cannot accidentally
+broaden local/global behavior.
+
 The `plan(ctx)` function receives an install context with runtime, scope,
 target directory, previous manifest, install state, package manifest, and
 filesystem helpers. It returns actions. It must not mutate disk.
@@ -169,6 +176,10 @@ Remove a path only when it is known to be GSD-managed and unchanged from the
 previous manifest, or when the migration provides a purpose-built detector for
 an old GSD-owned shape.
 
+Authoring guardrail: every `remove-managed` action must include
+`ownershipEvidence` explaining the manifest entry, generated marker, or
+purpose-built detector that proves GSD ownership.
+
 Use for retired hooks, old generated agents, deprecated command files, and
 stale runtime-specific generated artifacts.
 
@@ -203,6 +214,10 @@ Use this for legacy JSON config cleanup such as Codex `hooks.json`, where GSD
 can prove ownership of individual generated hook commands but not the whole
 file.
 
+Authoring guardrail: every `rewrite-json` action must include
+`ownershipEvidence`, and the migration record must include `runtimeContract`
+citing `docs/installer-migrations.md#runtime-configuration-contract-registry`.
+
 ### preserve-user
 
 Declare that a path is user-owned and must survive surrounding directory