Files
msd-core/docs/FEATURES.md
Tom Boucher 9e6c404151 chore: merge release v1.4.0 to main (#884)
* fix(#663): resolve open CodeQL/Dependabot security alerts (ReDoS, prototype pollution, workflow perms, qs DoS) (#665)

* fix(#663): resolve open CodeQL/Dependabot security alerts

- ReDoS: collapse ambiguous nested quantifiers in phase-heading regexes
  (verify/validate/commands) and the plan-filename lookahead (phase) to
  provably-equivalent non-backtracking forms
- prototype pollution: guard __proto__/constructor/prototype in setConfigValue
- remove dead no-op .replace(/-/g,'-') in phase.cts
- escape all regex metachars in bug-2839 test
- add contents:read permissions to security-scan + install-smoke workflows
- pin qs >= 6.15.2 via overrides (DoS GHSA)
- broaden prompt-injection allowlist to translated security-model docs

Closes #663

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* test(#663): regression tests for prototype-pollution guard and roadmap-phase ReDoS

Behavioral test that config-set rejects __proto__/constructor/prototype keys
without polluting Object.prototype, plus a ReDoS guard (timing-bound) and
behavior-preservation assertions for the collapsed phase-heading regexes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* test(#663): make ReDoS regression assert structured result, not elapsed time

Replace elapsed-time assertions (which tripped local/no-elapsed-assertion
ESLint rule and were unsound for synchronous ReDoS) with structured-result
assertions on adversarial inputs: assert that malformed phase headings/
unchecked-item lines without a terminating colon/space yield an empty Set,
which is both the correct behavior and an exercise of the fixed linear regex
on the catastrophic-backtracking input shape.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* chore(#663): add Security changeset fragment for #665

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* test(#663): fold prototype-pollution regression into config.test.cjs

The standalone bug-663-config-prototype-pollution.test.cjs was a 9th
config-module test file, tripping lint-test-file-count (the allowlist is
ratcheted and must not grow). Consolidated into config.test.cjs instead.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* chore(#660): bump next to 1.3.1-dev.0 (-dev stream per ADR 660) (#672)

After the 1.3.0 release, next moves onto the -dev prerelease stream so the
trunk self-identifies as unreleased (floor = next patch). First manual
exercise of the ADR-660 release model.

Refs #660

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* ci(#660): use scoped GSD_BOT_PR_TOKEN for backmerge & release merge-back PR creation (#673)

The open-gsd org blocks the Actions GITHUB_TOKEN from creating PRs, so
auto-backmerge and the release finalize merge-back PR steps can't open
their PRs (must be done manually). Point those two steps at a scoped
secret (pull-requests:write + contents:write), falling back to
GITHUB_TOKEN so behavior is unchanged until the secret is added.

Refs #660

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* fix: accept published installer migration checksums

* fix(#670): self-healing recovery for installer-migration checksum drift (#675)

Editing the body of an already-released installer migration drifts its computed
checksum (it hashes plan.toString()). The integrity guard then hard-aborted
every prior install on upgrade with "applied migration checksum changed" — a
100% reproducible blocker (v1.3.0, all platforms).

Already-applied migrations are filtered out of `pending` and never re-run, so
a drifted checksum is functionally inert. ADR-0008 anticipates checksum-mismatch
state as something the install-state layer must handle gracefully (plan -> apply
-> recover/report), not abort on.

This supersedes the published-checksum allowlist merged in #674 (per-release
maintenance debt — every historical checksum hand-pinned, still throws for any
unregistered value) with a general, self-healing recovery:

- Replace the throwing guard with non-fatal `collectAppliedChecksumDrift`,
  surfaced on `plan.checksumDrift`.
- Reconcile drifted stored checksums durably on the next state write
  (`reconcileDriftedChecksums`), idempotently (no perpetual writes).
- Relocate the "shipped migration bodies are immutable" rule to a CI baseline
  test that locks every shipped migration's checksum and fails on body drift —
  where #615 should have been caught, instead of blocking users.

Removes #674's legacyChecksums field, per-migration checksum pins,
published-checksums.json fixture, and compat test.

Fixes #670

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#676): consolidate hotfix into release.yml (delete standalone hotfix workflow) (#678)

* fix(#676): consolidate hotfix into release.yml; delete standalone hotfix workflow

npm allows only one trusted publisher per package and it is release.yml, so the
standalone hotfix.yml (token-auth) could never publish via OIDC (ENEEDAUTH on the
v1.3.1 finalize). Fold the patch/hotfix path into release.yml — the sole OIDC
trusted publisher — and delete hotfix.yml.

- validate-version accepts X.Y.Z (Z>0) → hotfix/X.Y.Z + base_tag; rejects rc for
  hotfixes; X.Y.0 still → release/X.Y.0.
- create branches hotfix/X.Y.Z from the base tag with optional auto-cherry-pick
  (default on) of fix:/chore: from next; release path unchanged.
- finalize is branch-agnostic already and publishes @latest via the existing
  OIDC trusted publisher (no NODE_AUTH_TOKEN).
- CONTRIBUTING branching table updated; hotfix.yml removed.

Fixes #676
Supersedes #677.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#676): add hotfix/patch path to release.yml (OIDC trusted publisher)

The companion to the hotfix.yml deletion: release.yml now handles patch
versions (X.Y.Z) via hotfix/X.Y.Z branches and publishes @latest through the
existing OIDC trusted publisher. CONTRIBUTING branching table updated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#676): update tests/docs referencing deleted hotfix.yml (#680)

hotfix.yml was deleted (folded into release.yml). Remove the now-broken
release-coverage-scope and policy-release-no-npm-self-upgrade assertions that
readFileSync'd hotfix.yml (release.yml equivalents retained), drop the dead
install-smoke.yml path trigger, and update VERSIONING.md / docs/branching.md
prose to describe hotfixes via the Release workflow with a patch version.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* fix: bump hono to 4.12.23 on next to clear moderate advisory

Same moderate hono advisory (GHSA-3hrh-pfw6-9m5x et al.) that blocked the 1.3.1
hotfix is present on next (was 4.12.19); bump to keep the npm-audit gate green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#690): promote CHANGELOG 1.3.x + gate release-notes promotion (#694)

* fix(#690): promote CHANGELOG 1.3.x + gate release-notes promotion

/gsd:update showed an empty "What's New" preview after updating to 1.3.1
because CHANGELOG.md's 1.3.x content was never promoted out of [Unreleased]
into dated sections, so `scripts/changeset/cli.cjs extract` returned exit 2
("no releases in range").

- CHANGELOG.md: split [Unreleased] into dated [1.3.0] and [1.3.1] sections
  (1.3.1 = hono advisory bump + installer-migration checksum self-heal, #670;
  1.3.0 = the feature release), restoring an empty [Unreleased].
- scripts/changeset/cli.cjs: new `verify` subcommand that exits non-zero when
  CHANGELOG has no dated `## [x.y.z]` heading for a version; hoist shared
  stripV/resolveChangelogPath helpers used by extract + verify.
- .github/workflows/release.yml: gate the finalize job on `verify` (after the
  build, before tag/publish) so an unpromoted CHANGELOG can never ship again.
- gsd-core/workflows/update.md: move `rm -f $CHANGELOG_TMP` after the
  human-readable extract re-run so the preview no longer degrades to
  "(changelog unavailable)".
- tests: regression guard for the 1.3.x headings + extract range + verify
  command coverage (present/absent/undated/v-prefixed/--json/prerelease).

Closes #690

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* chore(#690): add changeset fragment for #694

Fixed-type fragment for the user-facing /gsd:update preview fix and the
release-notes promotion gate.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#698): make auto-backmerge main→next actually land (admin-merge via PAT) (#699)

The Auto Back-Merge workflow could open a back-merge PR but never landed it,
and silently reported success on failure. Fixes:

- Merge via admin bypass using GSD_BOT_PR_TOKEN (the PAT) instead of auto-merge,
  since back-merge PRs structurally can't satisfy next's required checks
  (Issue-link / PR-template / changeset-lint).
- Stop swallowing create/merge failures with "|| echo ::warning" — real
  failures now fail the job. (That greenwashing hid the whole bug.)
- Resolve the PR number with `--jq '.[0].number // empty'` (a no-match returns
  the string "null", not empty) and capture a freshly-created PR's number from
  the create URL to avoid GitHub API eventual-consistency races.
- Merge the exact PR number (env-bound) rather than by branch name.
- Force-push the disposable SHA-named bot branch, guarded by a
  chore/backmerge-main-to-next-* name check so a mislabeled PR can't redirect
  the force-push.
- Apply labels non-fatally so a missing label can't abort PR creation.
- On a genuine merge conflict, fail loudly (::error + exit 1) instead of
  pushing an empty branch and opening a PR with no diff.

Closes #698

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#637): route 3 more workflows through gsd_run launcher (hardcoded $HOME sweep) (#642)

* fix(#637): route 3 more workflows through gsd_run launcher (hardcoded $HOME sweep)

The hardcoded `node "$HOME/.claude/gsd-core/bin/gsd-tools.cjs"` invocation form
fixed in plan-phase.md (#621) survived in three more workflows. Same bug class:
on a global/shim-only install with no project-local runtime, the hardcoded path
can miss a working install, so the step reports the tool "not found" instead of
resolving it via the launcher. #3668 introduced gsd_run resolution; these sites
were missed.

- plan-review-convergence.md: convert the 3 hardcoded invocations (init,
  roadmap get-phase, state planned-phase) to gsd_run. File already carried the
  canonical preamble (first gsd_run is the earlier convergence-enabled check).
- ingest-docs.md, spec-phase.md: convert their hardcoded invocations to gsd_run
  and inject the canonical launcher preamble via
  `node scripts/sync-runtime-launcher.cjs` (these files previously had no
  gsd_run and no preamble). The injected preamble is byte-equal to
  _runtime-launcher.snippet.sh and precedes the first gsd_run call, per
  runtime-launcher-parity invariant (B).
- Add tests/bug-637-workflow-no-hardcoded-home-tool.test.cjs: repo-wide
  regression guard asserting NO workflow .md invokes gsd-tools via a hardcoded
  $HOME path. Generalizes the plan-phase-only guard from #621 — the parity test
  guards retired $GSD_SDK / bare /gsd-tools tokens but not this form, which is
  how it survived across four files. Fails on the pre-fix files, passes after.

runtime-launcher-parity 7/7; full unit suite green (3477 pass / 0 fail).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore(#637): add changeset fragment for PR #642

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* test(#637): update stale bug-2801 assertion to expect gsd_run

bug-2801 pinned ingest-docs.md to the hardcoded node "$HOME/.../gsd-tools.cjs" init form, which #637 replaces with the gsd_run launcher. Flip the assertion to expect gsd_run init ingest-docs; the bare-gsd-tools rejection and CLI-handler tests are unchanged, and bug-637's repo-wide guard now owns the no-hardcoded-$HOME invariant.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Co-authored-by: Tom Boucher <trekkie@nomorestars.com>

* fix(#705): route hardcoded $HOME gsd-tools invocations in agents/commands through gsd_run (#707)

* fix(#705): route hardcoded $HOME gsd-tools invocations in agents/commands through gsd_run

The hardcoded `node "$HOME/.claude/gsd-core/bin/gsd-tools.cjs" <cmd>` form
(fixed for workflows in #621/#637) survived in agent/command surfaces and
misresolves on global/shim-only installs. Route every agent-executed
invocation through the resolved `gsd_run` launcher in gsd-phase-researcher,
gsd-planner (load_graph_context extracted to a shared reference to stay under
the planner size budget), import, and graphify. Add a regression guard over
agents/ + commands/ + gsd-core/references/ bash blocks. User-facing display
messages and docs are intentionally left untouched.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#705): use repo changeset fragment format (type: Fixed, pr: 707)

The hand-written fragment used the standard changesets package format
(package: bump) which lacks the type:/pr: frontmatter the repo's
docs-required lint consumes (fail_malformed_fragment / missing_type).
Regenerated via scripts/changeset/new.cjs.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#685): set windowsHide on all Windows child-process spawns (#688)

* fix(#685): set windowsHide on all Windows child-process spawns

A visible "gsd-core" console window flashed on Windows whenever a gsd-core
child process spawned without `windowsHide: true`. The most visible offenders
fire on every SessionStart / `/clear` (execNpm's `shell:true` npm view via the
update-check worker) and on every Edit/Write/MultiEdit in a worktree (the
worktree-path guard's git probe).

Add `windowsHide: true` to every external-binary spawn in the runtime source:
- hooks/gsd-context-monitor.js (record-session spawn)
- hooks/gsd-worktree-path-guard.js (SPAWNOPT)
- hooks/gsd-workflow-guard.js (git branch --show-current)
- src/shell-command-projection.cts (execGit / execNpm / execTool)
- src/check-command-router.cts (git log execFileSync)
- src/roadmap-upgrade.cts (git status/rev-parse/reset/clean execSync)

gsd-check-update.js already had it (the precedent). probeTty's tty call is
POSIX-only and intentionally untouched. Adds a regression test that asserts
each site plus a repo-wide completeness guard so a future external-binary
spawn that omits windowsHide fails CI. No behavior change off-Windows.

Closes #685

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* chore(#685): set changeset pr number to 688

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#687): bound agy print mode with its native --print-timeout (#689)

`/gsd-review --agy` hung indefinitely on large prompts. agy's print mode runs the
full tool-enabled agent, and on a big, file-path-rich prompt its agentic Cascade
loops on the code_search/grep tool and never converges; the transcript fallback
only runs after agy exits, so it can't recover a run that never exits.

The agy CLI exposes no per-tool deny (that lives in the Antigravity SDK), but it
does expose --print-timeout — agy's native print-mode cap. Pass it explicitly so a
stalled run self-terminates through the tool's own mechanism; a non-zero exit
discards any partial output so the existing transcript fallback / "review failed"
stub take over. Adds a regression test.

Closes #687

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#669): /gsd-review --cursor actually invokes cursor-agent (#686)

* fix(#669): /gsd-review --cursor actually invokes cursor-agent

The Cursor reviewer branch in review.md never ran the agent:
- detection probed `cursor` (the IDE launcher) instead of the headless
  `cursor-agent` binary
- the invocation used the two-token `cursor agent` (the IDE treats `agent`
  as a file-path argument, so the agent never starts)
- the prompt was piped via stdin, but `cursor-agent -p` reads the prompt
  from a command-line argument, and `2>/dev/null` hid the empty result

Probe `cursor-agent`; invoke `cursor-agent -p --mode ask --trust
--output-format text` with the prompt passed as a file-path-reference
argument (avoids the OS arg-length limit on large prompts); capture stderr
so failures are diagnosable. Invert tests/cursor-reviewer.test.cjs to assert
the corrected contract, with negative guards against the two-token form and
the stdin pipe. The sibling `agy` reviewer already used the argument form.

Closes #669

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* chore(#669): set changeset pr number to 686

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* chore: archive 463 shipped changeset fragments before wiring render (#714)

CHANGELOG promotion was a manual operator step that was never run, so 463
fragments for work already shipped in <=1.3.1 accumulated in .changeset/.
Their notes were already hand-curated into the dated [1.2.0]/[1.3.0]/[1.3.1]
CHANGELOG sections (#690 backfill, PR #694). Rendering them now would
duplicate and mis-attribute shipped work.

Move them to .changeset/archived/ (read non-recursively by all changeset
tooling, so never rendered), keeping only the 3 genuinely-unreleased
fragments at the top level. Prep for wiring `render` into the release
finalize job (#690 follow-up).

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* chore(release): wire CHANGELOG render into release finalize job (#690 follow-up) (#715)

* feat(#690): wire CHANGELOG render into release finalize job

CHANGELOG promotion has always been a manual operator step, which is why
1.3.0/1.3.1 shipped unpromoted (#690). PR #694 added a `verify` latch that
fails a release lacking a dated heading, but nothing performed the promotion.

Wire `changeset render` into the finalize job, after build/test and before
the verify gate, committing the promoted CHANGELOG so it ships with the
release. Add a `--allow-empty` flag to cmdRender so a zero-fragment release
still emits a dated heading (with a '_No notable changes._' placeholder)
instead of writing nothing and tripping the verify gate.

Note: requires the changeset-archive cleanup (separate PR) to land first, so
the first render consumes only genuinely-unreleased fragments.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* chore(#713): set changeset pr number to 715

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* docs: document --only and --text flags for /gsd-autonomous (#695) (#716)

Adds --only N and --text to the COMMANDS.md reference table and the
run-phases-autonomously how-to guide, revised to fit the Diataxis
framework (reference: factual/parallel rows; how-to: goal-framed sections).

* feat(#656): Research module — content-addressed cache + provider seam + registry-API legitimacy (#664)

* feat(#656): add Research Store module (content-addressed cache, TTL staleness)

Content-addressed research cache behind a clock seam: researchKey (sha256, deterministic), putResearch/getResearch ({hit,stale}, never throws), ttlForSource (curated HIGH 30d / MED 7d / web LOW 1d), two-tier resolveStorePath (curated -> ~/.gsd/research-cache, web/synthesis -> project .planning/research/.cache). 28 behavioral + property tests; boundary coverage at ttl-1/ttl/ttl+1.

Issue #656. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(#656): add Research Provider module (waterfall + confidence + plan)

Single source of truth for the Balanced provider waterfall (docs Context7->Ref->Jina, web Exa+Tavily, fallback Perplexity/Brave, Firecrawl scrape-only). classifyConfidence stamps HIGH|MEDIUM|LOW by provider (never throws). providerAvailability maps config flags to usable providers. planResearch checks the Research Store (injected seam) and returns cache-hits + a per-question fetch plan, falling through the waterfall to the always-available websearch terminal. 22 behavioral + property tests.

Issue #656. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(#656): add Package Legitimacy module (registry-API verdicts, slopcheck optional)

Replaces the pip-install-or-degrade slopcheck prose gate with code: classifyPackage (pure, never throws) computes OK|SUS|SLOP from tunable thresholds (minAgeDays 30, minWeeklyDownloads 1000, requireRepo). checkPackages queries injectable npm/PyPI/crates registry adapters (real https with 5s timeout, degraded-not-thrown on failure); slopcheck is one optional adapter that can only escalate severity, never degrade to [ASSUMED]. 34 behavioral + property tests; boundary coverage on age and downloads (limit-1/limit/limit+1).

Known follow-up: real npm adapter must add api.npmjs.org last-week downloads fetch (currently null -> unknown-downloads). Issue #656. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(#656): detect Tavily/Ref/Perplexity/Jina provider keys; complete npm downloads adapter

config: add tavily_search/ref_search/perplexity/jina availability flags (env var or ~/.gsd/<x>_api_key), mirroring brave_search/exa_search/firecrawl, so the Research Provider waterfall can gate them. package-legitimacy: real npm adapter now fetches api.npmjs.org last-week downloads (bounded, degraded-not-thrown) so weeklyDownloads is populated. +12 config tests; 34 legitimacy tests unchanged.

Issue #656. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(#656): expose Research seam via gsd-tools query (research-plan, research-store, package-legitimacy)

Routes the L2-hybrid surface so agents reach it as CLI: 'query research-store get/put' (cache, HOME-sandboxable), 'query research-plan --input' (cache-hits + fetch plan from planResearch), 'query package-legitimacy check --ecosystem' (async registry verdicts). Commands skip .planning root resolution and appear in top-level usage. 5 behavioral runGsdTools tests; command-contract unchanged (335).

Issue #656. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* docs(#656): document Research module (CONTEXT predicates, ADR-0656, architecture, changeset)

Adds GSD-RESEARCH.* + DEFECT.RESEARCH-PROVIDER-PROSE-DRIFT predicates to CONTEXT.md, ADR-0656 recording the L2-hybrid seam decision, a docs/ARCHITECTURE.md Research Module subsection, and an Added changeset fragment (pr:0, backfill on PR). Notes the #657 deferrals (agent collapse + install.js MCP mapping).

Issue #656. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore(#656): sync inventory for research modules

Regenerate INVENTORY-MANIFEST.json and bump docs/INVENTORY.md CLI Modules count 82->85 with rows for research-store/research-provider/package-legitimacy (DEFECT.INVENTORY-DRIFT).

Issue #656. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore(#656): eslint-ignore generated research .cjs artifacts (ADR-457)

research-store/research-provider/package-legitimacy .cjs are tsc-generated from src/*.cts, so they belong in the ESLint ignore block (lint the .cts source, not the emitted .cjs). Fixes tests/551-eslint-bin-lib-coverage.

Issue #656. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore(#656): backfill changeset pr number to #664

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore(#656): satisfy eslint lint-tests gate

Fix 20 eslint errors in the new research files: use helpers.cleanup() instead of raw fs.rmSync() in tests (local/no-raw-rmsync-in-tests, Windows-EBUSY retry budget); drop redundant '| string' union members and unnecessary type assertions; deterministic object normalization in researchKey (no-base-to-string). Logic unchanged; 6180 tests still green.

Issue #656. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(#656): harden package legitimacy per review (W1/W2/I3/I4)

W1: httpsGet now reads statusCode; npm/PyPI/crates map 404 -> exists:false -> SLOP (registry-existence is the #1 slopsquatting defense; previously only npm caught it). Transport made injectable (_setHttpGet) for hermetic 404 tests. W2: suspicious-postinstall is now terminal SLOP independent of the optional slopcheck adapter, and the regex drops the bare https?:// arm (over-fired on esbuild/sharp/node-gyp) for shell-exec/download-exec signatures only. I3: checkPackages now threads version to registry.lookup and adapters verify that specific version exists. I4: moreServerVerdict -> moreSevereVerdict. +11 regression tests (all RED-first); 45 total green.

Addresses review by @davesienkowski on #664. Issue #656. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(#656): research-store tier coherence + freshness + version TTL (W4/I1/I2/I4)

I1: tier now derives from source (curated -> user ~/.gsd, else -> project .planning), not kind, so put-tier and get-tier can't diverge; kind is a key component only. W4: getResearch searches both tiers and returns the freshest (non-stale preferred), never letting a stale curated entry shadow a fresh web one; blank version caps TTL at 1 day (no 30d on version-blind keys). I2: atomic platformWriteSync instead of raw fs.writeFileSync on the shared global path. I4: dropped the dead ttlForSource arm. CLI get now searches both tiers. +5 RED-first regression tests; 38 green.

Addresses review by @davesienkowski on #664. Issue #656. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(#656): expose classifyConfidence as a CLI route, killing dead code (W3)

Adds 'gsd-tools query classify-confidence --provider X [--verified]' so research agents get the confidence tier FROM CODE (provider waterfall + verification lever) instead of asserting it in prose. classifyConfidence previously had no runtime caller. HIGH means 'trusted provider'; --verified raises web results to MEDIUM (verification semantics documented in ADR-0656). +4 behavioral tests.

Addresses review by @davesienkowski on #664 (W3). Issue #656. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(#656): close Codex adversarial-review findings (path-traversal, version-age, malformed-cache)

HIGH: research key must be 64-hex sha256 (isValidResearchKey) + resolved-path containment check in put/get + CLI validation -> blocks '../../x' arbitrary-file-write. HIGH: package legitimacy now derives publishedAt from the REQUESTED version (npm time[version], PyPI releases[version] upload_time, crates versions[].created_at) so a new malicious version of an old package can't inherit old age and evade 'too-new'. MEDIUM: getResearch validates entry shape (finite fetched_at + positive ttl + required fields) -> malformed cache entry is a miss, not fresh-forever. +regression tests (RED-first); 111 green.

Codex adversarial review (required pre-PR gate). Issue #656. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(#656): close code-review correctness findings

(1) package-legitimacy CLI now rejects unknown --flags instead of silently consuming the following package as a flag value; only --ecosystem takes a value. (2) crates recent_downloads (90-day) normalized to a weekly figure before the minWeeklyDownloads threshold (was ~13x too lenient). (3) research-plan --input validates parsed JSON is an object with an Array questions before destructuring -> clean usage error instead of an uncaught TypeError on null/bad input. (4) research-store put rejects a flag value that is itself a --flag (no more storing '--source' as content). (5) planResearch skips questions whose text is not a non-empty string instead of emitting question:undefined. +13 RED-first regression tests; 143 green.

Code-review gate. Issue #656. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* refactor(#657): extract researcher documentation_lookup to shared @-reference

6 researcher agents carried a near-duplicate <documentation_lookup> block; consolidate into gsd-core/references/research-documentation-lookup.md (@-included). Unifies the ctx7 CLI fallback to the safer 'command -v ctx7' guard (drops silent 'npx --yes ctx7@latest' execution in 5 agents). Behavior-preserving dedup; inventory 63->64 references. Phase A of the agent collapse.

Issue #657. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* refactor(#657): extract researcher philosophy + verification-protocol to shared @-references

philosophy and the pitfalls+pre-submission-checklist common-core were near-duplicated in project/phase researchers; consolidate into gsd-core/references/research-{philosophy,verification-protocol}.md (@-included). phase-researcher keeps its 3 extra checklist items inline. Pre-submission domains checklist made agent-agnostic so project-researcher doesn't lose features/architecture coverage. Write-contract intentionally left inline (bug-214 tests assert it verbatim). Inventory 64->66 refs. Behavior-preserving. Phase A.

Issue #657. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(#657): wire gsd-phase-researcher to the Research seam (Phase B / S1)

The phase researcher now CALLS the code seam instead of carrying inline mechanics: provider waterfall -> 'gsd-tools query research-plan' (+ research-store put to cache digests); confidence-tier prose -> 'gsd-tools query classify-confidence'; slopcheck pip-install protocol -> 'gsd-tools query package-legitimacy check'. This makes the Research module a real runtime consumer (validates the seam end-to-end, addresses reviewer S1) and removes the duplicated waterfall/confidence/slopcheck prose. RESEARCH.md output contract, commit step, structured returns, and Phase-A @-includes unchanged. package-legitimacy-gate.test.cjs rewritten prose-grep -> behavioral (asserts the seam invocation).

Issue #657. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(#657): wire gsd-project-researcher to the seam + add tavily/ref/jina MCP tools (Phase C.1)

project-researcher now calls gsd-tools query research-plan / classify-confidence (+ research-store put) instead of the inline provider waterfall + confidence-tier prose (mirrors the phase-researcher rewire; no package-legitimacy — phase-only). Output contract (STACK/FEATURES/ARCHITECTURE/PITFALLS/SUMMARY.md + sections, no-commit, structured returns, Phase-A @-includes) unchanged. Adds mcp__tavily/ref/jina__* to the project/phase/ui researcher tools frontmatter (Balanced provider set) so install.js MCP mapping (C.2) has a consumer.

Issue #657. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* test(#657): cover tavily/ref/jina MCP install handling + frontmatter parity guard (Phase C.2)

Investigation: exa/firecrawl have no explicit per-runtime tool-mapping — every mcp__<server>__* except context7 rides the generic passthrough (Copilot lowercases; OpenCode/Cursor/Windsurf/Augment keep as-is; Gemini auto-discovers). tavily/ref/jina are handled identically, no install path broken. Added 12 copilot-install passthrough tests + a mcp-tool-inheritance parity guard (tavily co-declared with exa, jina with firecrawl, ref present across the 3 web researchers) so the MCP set can't drift. No io.github registry ids invented (none sourceable in-repo); documented as a follow-up. 488 tests green.

Issue #657. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(#657): profiles as source of truth for researcher agents + drift-guard (Phase C.3)

scripts/research-profiles.cjs declares each of the 7 researcher agents' identity + contract (name, description, color, tools, required @-includes, required gsd-tools seam calls, output-contract markers). scripts/gen-research-agents.cjs --check validates every committed agent against its profile; --write regenerates ONLY the frontmatter from profiles (body untouched) and is a verified no-op against the current agents (zero diff = fidelity). tests/research-agent-profiles.test.cjs is the DEFECT.GENERATIVE-FIX drift guard. Design note: profiles govern the generatable/contract surface rather than destructively regenerating the disparate operational prose bodies (those were deduped via @-includes in Phase A). scripts/ is not inventoried (no inventory change).

Issue #657. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(#657): complete agent provider-dispatch + parity guard; align legitimacy field; validate profiles

Adversarial-review findings: (HIGH) the seam-wired agents' Step-C dispatch only mapped 6 providers, so a planResearch result of jina/ref/perplexity/brave (reachable via the waterfall fallbacks) had no handling -> agent stall; completed both agents' dispatch to all 9 PROVIDER_WATERFALL ids + a catch-all, and added a parity test asserting agent dispatch stays in sync with research-provider PROVIDER_WATERFALL (DEFECT.GENERATIVE-FIX). (MEDIUM) phase-researcher package-legitimacy JSON example used 'package' but the module returns 'name' -> aligned. (LOW) gen-research-agents checkAgent now returns a clear failure for a malformed profile instead of throwing. +parity/validation tests (RED-first).

Issue #657. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(#656): make classifyConfidence verification-evidence-driven (W3)

Confidence conflated provider authority with claim verification — context7/ref
stamped HIGH purely by provider identity, and the only verification lever was a
self-set --verified flag. Split into two axes: provider authority (static) +
verification evidence (code-computed). HIGH now requires ground-truth
corroboration (legitimacyVerdict OK), independent of provider; authority alone
caps at MEDIUM; SLOP caps at LOW; the self-reported --verified is demoted to a
MEDIUM-only web lever. HIGH = corroborated-against-authoritative-source, not a
correctness guarantee. Adds --legitimacy-verdict to the classify-confidence CLI;
updates CONTEXT.md predicate + ADR-0656 (tier set unchanged, ADR-consistent).

Addresses davesienkowski's W3 review on #664.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#656): bind classify-confidence verdict to code, closing CLI self-grading

Adversarial review found the new --legitimacy-verdict flag was caller-supplied,
so an agent could self-assert OK->HIGH without any real legitimacy check —
reintroducing the exact self-grading hole W3 closes. Remove the free flag; the
CLI now computes the verdict via checkPackages only when --package/--ecosystem
is given (code-computed, not agent-asserted). Update the stale CLI test
(context7 alone -> MEDIUM) and extend the property test to vary legitimacyVerdict.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(#717): re-base workflow size budget on bytes + document quality rationale (#719)

* feat(#717): re-base workflow size budget on bytes + document quality rationale

Re-base tests/workflow-size-budget.test.cjs from line counts to byte
counts (matches Codex's 32,768-byte project_doc_max_bytes cap; deterministic,
no tokenizer). Tier ceilings: XL=90000, LARGE=54000, DEFAULT=38000, GRACE=3000;
discuss-phase target re-expressed as <30 KB. The #597 tighten-only ratchet and
per-file budget semantics are preserved unchanged — only the unit swaps.

byteCount() uses fs.statSync().size to match `wc -c` (includes trailing
newline), deliberately not lineCount()'s newline-stripping.

Document the context-rot / attention-budget QUALITY rationale (independent of
prompt caching) in the test JSDoc and docs/ARCHITECTURE.md, plus the
Goodhart caveat: the byte budget measures one file, so the real goal is
bounded *loaded* context — eager @-imports game the proxy; legitimate
extraction is lazy. Update CONTEXT.md RULESET.WORKFLOW_SIZE_BUDGET to bytes and
remove a stale duplicate ruleset entry that still said "1800 lines".

Defers the #3182 MVP-mode split (tracked separately): MVP is a cross-cutting
concern woven through plan-phase/execute-phase, not a discrete extractable mode.

Closes #717

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* docs(#717): add changeset fragment for byte-budget re-base

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* feat(#159): auto-use existing RESEARCH.md in /gsd:plan-phase --research-phase (#718)

* feat(#159): auto-use existing RESEARCH.md in /gsd:plan-phase --research-phase

When RESEARCH.md already exists in research-only mode and neither --research
nor --view is passed, emit a one-line notice and exit cleanly instead of
prompting update/view/skip. This matches the promptless auto-use of standard
/gsd:plan-phase <N> (§5.1) and removes the §5.0/§5.1 inconsistency, making
AI-agent and CLI invocations non-interactive in the common case. The two
explicit-flag escape hatches (--research to refresh, --view to print) cover
any deviation.

Closes #159

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* chore(#159): point changeset fragment at PR #718

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* docs(#159): tighten research-phase reference register (Diataxis)

Make the 'no modifier' research-phase entries descriptive rather than
imperative and drop the trailing 'pass --research/--view' clauses, which
duplicated the adjacent --research/--view documentation. Reference docs
describe; the recovery flags are documented in their own entries. The
emitted runtime notice in the workflow keeps naming the flags (in-band
recovery), unchanged.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* chore: clean up clear-cut ESLint warnings (#732) (#734)

Pay down pre-existing error→warn lint debt. Removes dead imports/vars, unused functions, redundant regex/string escapes, and stale eslint-disable directives; converts unused `catch (_e)` to optional catch binding (src/*.cts).

No behavior change. Lint 345→125 warnings (0 errors); deferred categories (n/no-process-exit, test-sleeps, control-regex) tracked in #732 for follow-up. Full test suite green (0 failures); code-review verified all removals unused and all escape fixes semantics-preserving.

Closes #732

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* chore(lint): justify intentional no-control-regex (ANSI strip) + ratchet to error (#737)

The 5 no-control-regex warnings are all the same intentional ANSI-color-strip
pattern /\x1b\[[0-9;]*m/g across 5 test files. The \x1b (ESC) control char is
the required leading byte of an ANSI SGR sequence, so matching it is the whole
point of stripping color codes from captured CLI/console output. Add an inline
eslint-disable-next-line with justification at each site (not a refactor — the
control char is essential, not accidental), then flip no-control-regex from
warn to error so the debt can't regrow.

Refs #736

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* chore(lint): refactor magic-sleep tests to async waits + ratchet rules to error (#735)

Replace raw setTimeout/Atomics.wait synchronization sleeps in 4 test files
with a shared async delay()/waitFor() poll-for-condition helper in
tests/helpers.cjs, then flip local/no-magic-sleep-in-tests and
no-restricted-syntax from warn to error so the debt can't regrow.

- tests/helpers.cjs: add delay(ms) + waitFor(predicate, opts), exported
- bug-1974: setTimeout backoff -> await delay()
- config.test: drop Atomics.wait sleep(); async retry via await delay()
- graphify: waitForBuildStatus/cleanupHookRepo async via await delay()
- locking-bugs: 3 Atomics.wait poll loops -> await waitFor()
- eslint.config.mjs: ratchet both rules warn -> error

Refs #733

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#704): exclude } and ) from Codex path-rewrite lookbehind (no literal $gsd-core in installs) (#710)

* fix(#704): exclude } and ) from Codex path-rewrite lookbehind

Shell variable expressions like \${VAR}/gsd-core/ and command-substitution
paths like \$(cmd)/gsd-local-patches were being rewritten to \$gsd-core and
\$gsd-local-patches respectively because the negative lookbehind in
convertSlashCommandsToCodexSkillMentions did not include } or ).

Add both characters to the lookbehind set:
  (?<![a-zA-Z0-9./})])

Also adds regression test:
  tests/bug-704-codex-launcher-path-corruption.test.cjs

Closes #704

* chore: add changeset for #704

* test: use RUNTIME_ROOT_PATH in assertion to eliminate dead-code lint warning

Replace the partial hard-coded fragment '}/gsd-core/bin/' with the
existing RUNTIME_ROOT_PATH const so the assertion both compiles clean
(no unused variable) and self-documents which canonical launcher path
must survive Codex conversion intact (#704).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore: link changeset to PR #710

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(#706): skip rescue of already-committed SUMMARY to avoid worktree cleanup merge_failed (#709)

* fix(#706): skip rescueSummaryArtifacts when SUMMARY is already committed

rescueSummaryArtifacts now probes `git cat-file -e HEAD:<path>` before
copying a SUMMARY.md into the main checkout.  When the file is already
committed on the worktree branch, copying it as an untracked file causes
`git merge --no-ff` to abort with "untracked working tree files would be
overwritten by merge" — a permanent merge_failed cleanup-wave failure.

Fail-closed on timeout: if cat-file is unreliable we skip rescue (the
merge will surface the collision as it did before, which is recoverable).

Adds 4 new test cases in worktree-safety.test.cjs covering:
- committed SUMMARY skipped, merge succeeds (#706 regression case)
- committed SUMMARY skipped even when timeout (fail-closed)
- uncommitted SUMMARY still rescued (existing contract preserved)
- rescue failure on ENOSPC still propagates (unchanged)

Closes #706

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore: add changeset for #706

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(#706): treat cat-file exit 128 as uncertain — skip rescue (fail-closed)

The previous guard skipped rescue only when `exitCode === 0` (committed) or
`timedOut`. Any other non-zero exit, including `128` (fatal git error: corrupt
object store, unborn HEAD, missing repo), fell through and PROCEEDED with
rescue — potentially re-creating the #706 untracked-file merge collision.

Fix: rescue ONLY when `exitCode === 1` (cat-file definitively reports the
object absent). All other outcomes — 0 (committed), 128 (fatal), null/SIGTERM
(timeout), or any other code — are treated as "uncertain → skip rescue".

Also corrects the JSDoc bullet that still referenced `git ls-files
--error-unmatch` (the old mechanism); updated to `git cat-file -e HEAD:<relPath>`.

Regression test added: asserts rescue is SKIPPED when cat-file returns exit 128,
leaving the merge to surface the issue safely rather than silently copying an
already-committed file.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore: link changeset to PR #709

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

* refactor(scripts): replace process.exit() with ExitError + runMain handler (#739) (#740)

Part 1 of 2 of the n/no-process-exit cleanup (umbrella #738): convert every
process.exit() call in standalone scripts/** CLIs to the rule-compliant pattern.

- New shared helper scripts/lib/cli-exit.cjs: ExitError(code,message) + runMain()
  which translates a thrown ExitError / returned number into process.exitCode
  (never process.exit()), flushing output and still firing process.on('exit').
- main()-based entrypoints: throw new ExitError(code) for errors, return <code>
  for verdicts; invoked via runMain(main). Child exit codes preserved via return.
- top-level-only scripts: imperative body extracted into main() so mid-flow
  aborts (throw ExitError) actually halt; pure consts/helpers stay at module scope.
- diff-touches-shipped-paths.cjs: stdin event handling restructured to an async
  read so the whole flow runs under runMain; uncaughtException/unhandledRejection
  nets replaced by an in-band catch that preserves EXIT_ERROR=2.

Exit codes verified unchanged for every converted script (success/error/help and
the 0/1/2 semantic codes in diff-touches). Rule stays warn here; flipped to error
in part 2 (#738) once gsd-core/bin/** is also clean.

Refs #739

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* refactor(bin): replace process.exit() in CLI entrypoints + ratchet rule to error (#738) (#741)

Part 2 of 2 of the n/no-process-exit cleanup (completes umbrella #738; part 1
was #739/scripts). Converts the 20 flagged process.exit() calls in the three
hand-written gsd-core/bin CLI entrypoints and flips n/no-process-exit to error.

- New src/cli-exit.cts -> gsd-core/bin/lib/cli-exit.cjs (ExitError + runMain),
  the gsd-core-side equivalent of scripts/lib/cli-exit.cjs; registered in
  .gitignore, eslint ignores, and the inventory manifest like its siblings.
- gsd-tools.cjs: 13 apply-prompt-budget exits -> throw ExitError; main()->runMain.
- verify-reapply-patches.cjs: 6 exits -> throw ExitError / return verdict; runMain.
- check-latest-version.cjs: 1 exit -> return verdict; runMain.
- eslint.config.mjs: n/no-process-exit warn -> error.

Scope note: the gsd-core/bin/lib/*.cjs modules (core, state, profile-pipeline,
roadmap-command-router, adr-parser, ui-safety-gate) are tsc-generated and
eslint-ignored (ADR-457), so their process.exit calls were never flagged and are
intentionally left untouched. Only the linted hand-written entrypoints are in scope.

Exit codes verified unchanged for all three entrypoints.

Closes #738

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* refactor(#720): lazy-load MVP-only reference bodies on non-MVP runs (#746)

* refactor(#720): lazy-load MVP-only reference bodies (eager @-import → gated Read)

Convert eager @-imports of MVP-only reference bodies into lazy "Read" instructions
gated on MVP_MODE / WALKING_SKELETON / MVP+TDD, so non-MVP planning/execution runs
no longer pull MVP guidance into context. Covers both the workflow files and the
planner/executor agent definitions (the dominant context-cost path):

- workflows/plan-phase.md: planner-mvp-mode.md + skeleton-template.md (L146/936/937/941)
- workflows/execute-phase.md: execute-mvp-tdd.md halt-report ref, now gated on gate-trip (L191)
- agents/gsd-planner.md: planner-mvp-mode.md, user-story-template.md, skeleton-template.md
- agents/gsd-executor.md: execute-mvp-tdd.md

The dedicated always-MVP mvp-phase workflow keeps its eager imports (intentional).
Behaviour is unchanged; non-MVP runs simply carry less loaded context. Adds a
regression guard mirroring the discuss-phase lazy-load test, and documents the
conformance in docs/ARCHITECTURE.md.

Refs #720

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* docs(#720): add changeset fragment (pr #746)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* refactor(#712): replace Codex slash-command denylist lookbehind with positive-boundary match (#747)

* refactor(#712): replace Codex slash-command denylist lookbehind with positive-boundary match

The hyphen-style /gsd-<cmd> -> $gsd-<cmd> conversion in
convertSlashCommandsToCodexSkillMentions used a negative-lookbehind DENYLIST
enumerating characters that must NOT precede a real mention. #637 -> #704 showed
this is an unbounded treadmill: each new unanticipated preceding char (/, ., word
chars, then }, )) leaked the same path-corruption bug class, and a backtick-wrapped
path (`/gsd-core/workflows/update.md`) still leaked through.

Replace it with a POSITIVE two-boundary definition of a mention:
  1. Left: opens at start-of-string, whitespace, or an inline-prose delimiter
     (backtick/quote/paren/bracket).
  2. Right: the command token is not followed by a path separator `/` (a path
     continues, a command does not). The (?![a-z0-9/-]) lookahead also blocks
     regex backtracking to a shorter command.

This closes the whole class by construction (no preceding-char denylist to
maintain) and fixes the backtick-wrapped-path corruption the #704 test
documented as a pre-existing gap, while preserving conversion of legitimate
backtick-wrapped mentions (e.g. CONTEXT.md's `/gsd-execute-phase` lists).

The colon-style /gsd: replace is intentionally left unguarded (it never appears
as a filesystem path segment) and is annotated as such.

Tests assert the regex directly (function now exported) across a convert/
don't-convert matrix plus one end-to-end pipeline assertion for the headline
backtick-path case.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* chore(#712): add changeset fragment for PR #747

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#730): scope current-milestone Phase Details section in roadmap parser (#748)

`extractCurrentMilestone()` scoped the current-milestone window to its
`## Phases` checklist subsection and terminated at the milestone's own
`## Milestone … (Phase Details)` heading, so the `### Phase N:` detail
headers fell outside scope. Every parser-backed command — `init.phase-op`
(and thus `/gsd:discuss-phase`, `/gsd:plan-phase`), `state`, `roadmap list`,
and `validate health` (W006) — therefore could not resolve phases of any
milestone after the first until a `.planning/phases/` directory already
existed, blocking discuss/plan.

The parser now additionally includes the current milestone's `(Phase Details)`
section in scope, located via the already-computed version matches and anchored
(boundary-aware) to the selected milestone's version token so sibling
sub-milestones sharing a version prefix do not cross-pollinate. The existing
heading selection and primary window are unchanged.

Adds tests/bug-730-milestone-phase-details-scope.test.cjs covering the
two-milestone reproduction, first-milestone non-regression, direct
getRoadmapPhaseInternal resolution, validate-health W006 visibility, a
three-milestone roadmap, and the closed-sibling sub-milestone case.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#683): auto-degrade phase execution to sequential on worktree base mismatch (#749)

* fix(#683): auto-degrade phase execution to sequential on worktree base mismatch

Claude Code forks worktree-isolated executors off the repository default
branch (origin/HEAD), not the orchestrator's HEAD. Running /gsd-execute-phase
on a branch diverged from the default (unmerged milestone/feature branch) left
every executor without the phase's plan files and tripped the
worktree-branch-check guard with `exit 42` — 100% reproducible, all OSes.

- New module src/worktree-base-ref.cts: HEAD-vs-fork-base drift detection
  (origin/HEAD with symbolic-ref fallback) and no-clobber worktree.baseRef
  management, exposed as `worktree base-check` / `worktree set-baseref`.
- execute-phase.md: pre-dispatch, for Claude Code with worktrees enabled,
  auto-degrades the run to sequential on the main tree when a base mismatch
  is detected, recommending worktree.baseRef:"head". The exit-42 guard stays
  as a backstop.
- Installer: fresh local Claude installs set worktree.baseRef:"head" in
  .claude/settings.local.json (no-clobber, respecting an explicit shared
  settings.json value); upgrades print an opt-in notice pointing at
  `gsd-tools worktree set-baseref`.
- Docs: how-to guide, CLI/config reference, planning-config cross-ref.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#683): auto-apply worktree.baseRef on upgrade; gate fresh+upgrade on use_worktrees

Per maintainer direction: on a local Claude Code UPGRADE, set
worktree.baseRef:"head" automatically (no opt-in notice) when the project's
workflow.use_worktrees is enabled, instead of merely printing a remediation
notice. For consistency the FRESH path is now gated the same way: both paths
compute worktrees-enabled once (bounded walk-up read of .planning/config.json,
default enabled unless workflow.use_worktrees === false) and apply the
no-clobber baseRef only when enabled — never overwriting an explicit value in
settings.local.json or a shared settings.json. gsd-tools worktree set-baseref
remains for manual use. Docs + changeset updated; tests hardened (file-exists
assertions, fresh+disabled case, upgrade idempotency).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#683): measure workflow byte-budget on LF, fixing Windows-only CI failure

The workflow-size-budget test failed only on Windows: git checks out the .md
files as CRLF (no eol=lf in .gitattributes) and byteCount used
fs.statSync().size (raw on-disk bytes), counting an extra \r per line. That
inflated execute-phase.md — the XL high-water-mark file pinned near its ceiling
by the tighten-only ratchet — from 88492 LF bytes to ~90245 on Windows, over
the 90000 XL ceiling, while passing on the LF-checkout Mac/Linux runners.

The ceilings are explicitly "calibrated against raw `wc -c`" on an LF checkout,
so the measurement should be LF-based on every platform. byteCount now reads the
file and counts Buffer.byteLength after stripping CR, making the budget
platform-independent (a no-op on LF checkouts; verified statSync === normalized
for all 88 workflow files). No ceilings changed. Added a regression test
asserting CRLF and LF content of the same file count identically.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#683): make worktree-base-ref test path mocks Windows-safe (path.join)

tests/worktree-base-ref.test.cjs keyed its injected readFile/writeFile mocks
(and a few expected `file` values) with forward-slash template literals like
`${claudeDir}/settings.local.json`. The module composes those paths with
path.join(), which emits backslashes on Windows, so the mock keys never matched
the module's lookup → readFile returned null → resolveEffectiveBaseRef /
cmdWorktreeBaseCheck / cmdWorktreeSetBaseRef (and the JSONC variants) failed on
the Windows full-test runner only (they passed on Mac/Linux, and the install
tests passed because they use the real filesystem). The module is correct;
only the test fixtures hardcoded '/'.

All mock keys and path assertions now use path.join(base, ...) mirroring the
module, so they match on every platform (no-op on POSIX). 19 path references
across 16 lines.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* feat(#703): add --granularity override flag to /gsd:plan-phase (#750)

* feat(#703): add --granularity override flag to /gsd:plan-phase

Add a `--granularity <coarse|standard|fine>` flag to /gsd:plan-phase that
overrides the configured planning granularity for a single invocation.

The override is a new highest-priority tier above the existing precedence
chain (granularities[phaseType] -> granularity -> planning.granularity ->
'standard') in resolveGranularityInternal; when the flag is absent, resolution
is byte-for-byte unchanged. cmdInitPlanPhase now resolves with phaseType
'planning' so granularities.planning participates, and emits the resolved
value in the init JSON, which the plan-phase workflow forwards to the planner
prompt. Invalid values are rejected at the CLI boundary via a shared
assertValidGranularityOverride helper.

Closes #703

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* chore(#703): set changeset pr to 750

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#751): recognise config-set prototype-pollution guard in CodeQL + test dynamic-key vectors (#752)

CodeQL alert #26 (js/prototype-pollution-utility) kept firing on setConfigValue
because its dataflow does not trace the #663 Set-based, pre-loop keys.some(...)
forbidden-key check as a sanitising barrier on the write site.

- src/config.cts: replace the Set + pre-loop check with inline literal
  comparisons (key === '__proto__' || 'prototype' || 'constructor') on the exact
  key used to index `current`, immediately before each write (intermediate keys
  in the descent loop, plus the final key). Same forbidden set, same error
  message and ERROR_REASON.CONFIG_PARSE_FAILED — behaviour unchanged from #663,
  but the barrier is now CodeQL-recognised.
- tests/config.test.cjs: add regression tests for schema-valid dynamic-prefix
  keys (agent_skills.__proto__, agent_skills.constructor, agent_skills.prototype,
  features.__proto__, review.models.constructor) that pass the isValidConfigKey
  schema gate and reach the guard. Each asserts the guard's own message fires
  (not the schema gate's "Unknown config key") and Object.prototype is not
  polluted. The prior #663 tests never reached the guard — their keys are
  rejected by the schema gate first — so the guard's real attack surface was
  untested.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* feat(#25): scope gsd-verifier Step 7b to enumerate-or-single-test; forbid full-suite re-runs (#753)

* feat(#25): scope gsd-verifier Step 7b to enumerate-or-single-test; forbid full-suite re-runs

Step 7b's lone test example (`npm test -- --grep "$PHASE_TEST_PATTERN"`) is
mocha/vitest/jest-specific, where `--grep` filters which tests *execute*. Models
generalized it to `cargo test --workspace 2>&1 | grep X` (runs the whole suite,
filters only *output*) and repeated it once per must-have, adding minutes per
verification with no new evidence after the first run.

Replace the example with language-agnostic guidance: prove a test EXISTS via
enumeration (`cargo test -- --list` / `pytest --collect-only` / `npx vitest
list` / `go test -list`), and prove it PASSES via a single named test
(`cargo test <name> -- --exact` / `pytest -k` / `npx vitest run -t`). Add a
Spot-check constraint forbidding more than one full-suite run per verification
or piping a full run through grep per must-have, while still permitting one
saved run + grep when a full run is genuinely required. docs/AGENTS.md gains a
one-line Key-behaviors note, and a new test asserts the Step 7b content.

Scoped per the maintainer decision on the issue: folded into Step 7b (no new
top-level Step 7a) with no VERIFICATION.md label changes.

Closes #25

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* chore(#25): add Changed changeset fragment for PR #753

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* feat(#52): add agent_skills_security.trusted_global_roots allowlist for global skills (#754)

* feat(#52): add agent_skills_security.trusted_global_roots allowlist

Opt-in allowlist so a global: agent skill whose SKILL.md realpath resolves
outside the default global skills base (e.g. ~/.claude/skills) is accepted
when its real target lies under a user-declared trusted root. Default [] is
byte-identical to prior behavior; the symlink-escape guard is preserved and
simply re-applied against each declared root.

- src/security.cts: loadTrustedGlobalRoots — tilde-expand (~ and ~/), reject
  project-relative and dangerously broad roots (filesystem/UNC root, homedir),
  realpath-canonicalize each root every run and drop non-existent ones.
- src/init.cts: on base-check failure the guard consults the trusted roots
  (hoisted out of the loop); emits a stderr NOTE when a skill is accepted via
  a trusted root so the widened boundary is visible.
- src/core.cts: thread agent_skills_security through loadConfig.
- config-schema.manifest.json: allow the new key path.
- docs/CONFIGURATION.md: document the option and its security model.
- tests/agent-skills.test.cjs: unit + end-to-end CLI coverage (regression,
  feature, negative, broad-root hardening, stderr NOTE).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* docs(#52): add changeset fragment for trusted_global_roots (#754)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* refactor(#651): consolidate verification-status routing into one queryable seam (#755)

* refactor(#651): consolidate verification-status routing into one queryable seam

The passed/gaps_found/human_needed verification status was re-encoded as
bare strings across three prose surfaces (gsd-verifier emits, execute-phase
routes, ship gates), each independently deciding the per-status next action
with no parity coupling — the DEFECT.GENERATIVE-FIX class.

Give the enum one home: src/verification.cts (-> bin/lib/verification.cjs)
exposing `gsd_run query verification.status <phaseDir>` returning a typed
{status, next_action, next_command}. ship.md and execute-phase.md now consume
the query instead of re-deriving the routing in prose; gsd-verifier.md points
at the shared vocabulary as the single emitter (values unchanged).

Also fixes the latent broad-grep status misread (DEFECT.FRONTMATTER-SCALAR-
BROAD-GREP): execute-phase.md read `grep "^status:"` over the whole report, so
a body `status:` line could misroute a valid phase. Extraction is now
frontmatter-scoped in one place. A parity test fails if a verifier status
gains no route. Lands the two CONTEXT.md DEFECT entries captured on the issue.

Closes #651

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* chore(#651): set changeset pr to 755

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#758): trigger draft-PR auto-close on pull_request_target (#760)

Bare `pull_request` hands fork PRs a read-only GITHUB_TOKEN, so the
close/comment API calls 403 and a first-time/external contributor's draft
PR survives — bypassing the auto-close for exactly the population the job
targets. Switch to `pull_request_target`, which runs in the base-repo
context with a write-capable token even for fork PRs. Safe because the job
never checks out or executes PR-supplied code; it only reads event metadata
and calls the GitHub API. The minimal `permissions: pull-requests: write`
block still constrains the token.

Add a regression guard in tests/workflow-maintainer-skip.test.cjs asserting
the workflow triggers on pull_request_target and not bare pull_request.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* docs(#58): add ADR for Runtime Install Policy Module boundary (#762)

Record the Runtime Install Policy Module decision and ownership
boundary: install policy projects a pure, typed install plan by
composing artifact placements (ADR-3660) and command text (ADR-0009)
plus per-runtime config intentions, with no filesystem IO; runtime
adapters consume the plan and execute concrete file mutations and
format-specific config rendering. Explicitly records what stays
outside the policy module (TOML/JSON/Markdown serialization, merge
semantics, filesystem effects).

Adds the ADR index row in docs/adr/README.md and a glossary entry in
CONTEXT.md. Leads the installer-refactor chain (#58 -> #60 -> #56).

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* feat(#759): non-destructive CHANGELOG preview in the rc release job (#763)

The rc action publishes a release candidate to @next for testing but
never surfaces the curated CHANGELOG section for the version under test —
render only runs destructively at finalize (#715), so there was no safe
way to preview the upcoming notes during the RC window.

Add a --preview mode to scripts/changeset/cli.cjs cmdRender: it renders
the dated release section to stdout via the existing renderChangelog/
serializeChangelog path (with priorChangelog: null, so only the new
section is emitted), reuses the shared injectEmptyPlaceholder helper for
zero-fragment releases, and returns WITHOUT writing CHANGELOG.md or
deleting any .changeset fragment. Wire a "Preview CHANGELOG" step into
the rc job that renders to a file (standalone command, so a malformed
fragment fails the step) and cats it to the job summary and log.

Closes #759

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* feat(#761): add scheduled base-context sweep to close SHA-branch-evading draft PRs (#765)

close-draft-prs.yml (on pull_request_target after #760) cannot close fork draft
PRs whose head branch name looks like a Git SHA — GitHub never dispatches
pull_request_target for such branches, and a pull_request run from a fork gets a
read-only token. So a draft PR on a SHA-named fork branch evades the auto-close.

Add close-draft-prs-sweep.yml: a schedule (every 6h) + workflow_dispatch sweep
running in base-repo context with pull-requests: write that paginates open PRs,
filters to non-OWNER/MEMBER/COLLABORATOR drafts, and closes + comments them with
the identical policy/message as the event-driven workflow. Re-fetches each
candidate before mutating (TOCTOU guard), closes before commenting so
enforcement is never gated on the explanatory comment, and core.setFailed on
partial failures. The per-PR workflow remains the fast path; this is the
safety net for the documented residual bypass.

Extends tests/workflow-maintainer-skip.test.cjs with structural guards locking
the triggers, write permission, maintainer carve-out, pagination, and message.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* fix discord release changelog announcements

* test(#339): regression guard for gsd-sdk refs in runtime surfaces (#691)

* test(#339): add regression guard for gsd-sdk refs in runtime surfaces

Lock in the already-clean runtime surface so a retired `gsd-sdk`/`GSD_SDK`
reference cannot creep back into a shipped prompt or hook. Scans
gsd-core/workflows, gsd-core/references, commands/gsd, agents, and hooks
(excluding the gitignored dist/ build artifact).

Complements gsd-tools-path-refs.test.cjs, which only catches the
`gsd-sdk query` binary form; this catches any runtime reference. A second
test guards against an empty sweep so a future dir rename can't silently
turn the guard into a no-op.

Intentionally does NOT touch bin/install.js (live stale-package-detection
mechanics per #339 triage) or CI/lint scripts (legitimate stale detection).

Refs #339

* test(#339): split file content on /\r?\n/ for Windows CRLF parity

The windows-test-parity-guard lint requires test files that readFileSync +
split to use /\r?\n/, not '\n', so CRLF files don't leave a trailing \r.
New test files are not in the PR #3649 allowlist.

* test(#339): cover .sh/.json runtime files in workflows surface

Address #691 review: the gsd-core/workflows surface scanned only .md,
silently skipping two deployed runtime files — _runtime-launcher.snippet.sh
(synced into every hook) and discuss-phase/templates/checkpoint.json. Add
.sh/.json so the guard covers all 290 deployed runtime files (was 288/290),
not just the .md subset.

* test(#339): cover templates/contexts surfaces + per-ext empty-sweep guard

Address PR #691 review (trek-e):
- Add gsd-core/templates and gsd-core/contexts to RUNTIME_SURFACES —
  both are deep-copied by the installer and runtime-loaded via
  @~/.claude/gsd-core/templates/*.md anchors, so a reintroduced gsd-sdk
  ref there would have slipped past the guard. (major)
- Reword the bin/install.js exclusion rationale: it has zero gsd-sdk refs
  today (subsystem removed in #515, shim retired in #522); the real reason
  it is excluded is that it is installer code, not a deployed prompt/hook
  surface. (minor)
- Make the empty-sweep guard assert coverage per configured extension, not
  per surface — .md files alone kept gsd-core/workflows green even if
  .sh/.json were dropped, silently un-covering _runtime-launcher.snippet.sh
  and discuss-phase/templates/*.json. (low)

---------

Co-authored-by: Tom Boucher <trekkie@nomorestars.com>

* refactor(#60): make runtime config adapter registry explicit (#795)

* refactor(#60): make runtime config adapter registry explicit

Replace scattered inline `runtime === '...'` config-mutation branching in
bin/install.js with an explicit, typed adapter registry. The new
src/runtime-config-adapter-registry.cts maps each of the 15 supported
runtimes to a config intent { installSurface, writesSharedSettings,
finishPermissionWriter }; install()/finishInstall() dispatch by resolved
intent instead of runtime-name checks (cursor/windsurf/trae collapse to one
profile-marker-only branch).

Behavior-preserving: the same config files are written for the same runtimes
(opencode still writes both settings.json and its permissions; kilo writes
only its permissions; codex minimal-mode and opencode GSD_TEST_MODE guards
unchanged). Unknown runtimes fail loudly via TypeError, with an Object.hasOwn
barrier so prototype-chain keys (__proto__/constructor) also throw rather than
returning a bogus intent. Leads the installer-refactor chain (#58 -> #60 ->
#56), building on ADR-58.

Closes #60

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* chore(#60): add changeset for runtime config adapter registry

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* docs(#60): register Runtime Config Adapter Registry in CONTEXT.md glossary

Per docs/contributor-standards.md, every new Module/seam must get a
`### <Name>` entry under the domain glossary. Adds the entry for the
runtime-config-adapter-registry seam introduced in this PR (interface,
policy boundary, source file, ADR-58 / #60 cross-references).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* feat(#764): skip cross-platform test matrix for docs-only and inert-CI PRs (#798)

test.yml had no paths filter and the ci-test-scope classifier treated docs/
and every .github/workflows/* as code_changed, so documentation edits and
product-irrelevant automation tweaks still spun up the full Linux/Windows/macOS
matrix. Narrow the heavy matrix to changes that can actually affect the product
or the test pipeline.

- ci-test-scope.cjs: drop docs/ from code_changed (docs-only -> full skip; the
  required-tests fan-in still reports green). Add src/ to code_changed (it was
  missing -> a source-only PR previously skipped all tests). Add INERT_WORKFLOWS
  allowlist + isInertCi() + an "inert CI" rule, and a product_changed output that
  gates the heavy test/coverage jobs. Fail-safe: any workflow not on the inert
  allowlist defaults to the full matrix. A module-load assertion throws if a
  PROTECTED_WORKFLOWS entry (test/install-smoke/mutation/security-scan/release)
  is ever added to the inert set, so a weakening edit fails CI loudly.
- test.yml: keep the static 3-lane matrix (so the H1 shell-policy linter can
  still statically verify the Windows lane), gate test/coverage on
  product_changed, add a lightweight ubuntu-only test-inert job, and branch the
  required-tests fan-in on product_changed.
- docs-required.yml: run docs-parity-live-registry (gated on docs/ changes) so
  pure-docs PRs still catch live-registry drift without the matrix.
- tests: cover docs-only, inert-only, src/, pipeline, unknown-workflow fail-safe,
  mixed escalation, the code_changed=false -> no-lanes invariant, and protected-
  workflow tamper-evidence.

Closes #764

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* feat(#766): distribute gsd-core as a native Claude Code plugin (#797)

* feat(#766): distribute gsd-core as a native Claude Code plugin

Add an additive .claude-plugin/plugin.json manifest plus hooks/hooks.json so gsd-core can be installed as a first-class Claude Code plugin (marketplace or zero-friction @skills-dir), with /gsd-core: namespaced commands and lifecycle management — alongside the unchanged npm/file-copy installer.

- .claude-plugin/plugin.json: validated with 'claude plugin validate --strict'
- hooks/hooks.json: mirrors the installer's always-on Claude hook wiring via ${CLAUDE_PLUGIN_ROOT}
- package.json: ship .claude-plugin in the npm tarball
- tests/issue-766-plugin-manifest.test.cjs: manifest + always-on-hook-contract drift guards
- docs: install-on-your-runtime.md + FEATURES.md

Closes #766

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* docs(#766): add ADR-766 + glossary entry for Claude Code Plugin Manifest Module

Record the plugin manifest as the Seam projecting gsd-core's artifact surfaces onto the Claude Code plugin contract (sibling of the Runtime Artifact Layout Module, ADR-3660), with the defined kind->field mapping and the always-on hook projection rule.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* refactor(#56): retire legacy runtime directory helpers into runtime-homes projection (#802)

* refactor(#56): retire legacy runtime directory helpers into runtime-homes projection

Consolidate per-runtime global config-dir resolution onto the single
canonical projection runtime-homes:getGlobalConfigDir. Extend it with the
explicitDir override (CLI --config-dir) and the opencode/kilo
OPENCODE_CONFIG/KILO_CONFIG file-path precedence the installer helpers had,
making it byte-for-behavior equivalent to the old getGlobalDir across all
15 install runtimes.

Delete bin/install.js's getGlobalDir/getOpencodeGlobalDir/getKiloGlobalDir
(and the orphaned local expandTilde), repoint all 9 call-sites, and remove
getGlobalDir from module.exports (net -242 lines in the installer). Migrate
the 5 test importers to the canonical projection; harden default/XDG
assertions against ambient *_CONFIG env vars. getAgentsDir now respects
OPENCODE_CONFIG/KILO_CONFIG consistently with the installer (intentional
convergence). Update CONTEXT.md Installer Module entry.

Completes the installer-refactor chain #58 -> #60 -> #56.

Closes #56

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* chore(#56): add changeset for runtime directory helper retirement

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* feat(#786): elevate GitHub Copilot installer — lifecycle hook + AGENTS.md (#804)

* feat(#786): elevate Copilot installer with lifecycle hook + AGENTS.md

Emit a self-contained sessionStart hook config (.github/hooks/gsd-session.json
local, ~/.copilot/hooks/gsd-session.json global) and write AGENTS.md at the repo
root (Copilot CLI reads it as primary instructions) alongside
copilot-instructions.md. The hook is an inline `command` hook (no separate hook
script), so it cannot dangle. Uninstall removes both and preserves user content.

Verified against GitHub Copilot CLI primary docs: hooks-configuration (camelCase
events, version+hooks shape, inline bash/powershell command hooks) and
add-custom-instructions (AGENTS.md read at repo root as primary instructions).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* chore(#786): set changeset pr number to 804

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#783): resolve Kilo global skills base to ~/.kilo/skills (#806)

* fix(#783): resolve Kilo global skills base to ~/.kilo/skills

getGlobalSkillsBase('kilo') returned ~/.config/kilo/skills (the XDG config
dir), but Kilo Code discovers global skills from ~/.kilo/skills/ (the .kilo
dir in HOME), independent of the kilo.jsonc config dir. Add a HOME-relative
special case so the resolver matches Kilo's actual discovery path.

The config dir (~/.config/kilo) and the installer's command/ path are
correct and unchanged. This corrects the path used by doctor/status and
agent-skills-block resolution; the installer writes commands (not skills)
for Kilo, so no files were being written to the wrong location.

Closes #783

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* chore(#783): set changeset pr to 806

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* feat(#785): write .cursor/commands/ Cursor 1.6 slash-command surface (#805)

* feat(#785): write .cursor/commands/ as Cursor 1.6 slash-command surface

Cursor 1.6 (released 2025-09-12) introduced plain-markdown slash commands
in `.cursor/commands/<name>.md` — no frontmatter, invocable via `/` in the
Agent input. GSD previously emitted only `~/.cursor/skills/` for Cursor.

This PR wires a second artifact kind for `cursor` in
`runtime-artifact-layout.cts`: `convertedCommandsKind('commands', 'gsd-',
'convertClaudeCommandToCursorCommand', configDir)`. The new kind applies the
same `convertClaudeToCursorMarkdown` transforms (tool renames, brand
substitution, slash-command normalisation) and then strips YAML frontmatter
so the output is plain prose. Skills output is unchanged.

`stageCommandsForRuntimeFlat` in `install-profiles.cts` stages each source
`.md` as a flat `<stem>.md` in a temp dir; the existing `_copyStaged` commands
path then prefixes and copies to `<configDir>/commands/`.

`.cursor/mcp.json` is explicitly OUT OF SCOPE: GSD ships no MCP server; the
`mcpServers` schema cannot be usefully populated by the installer.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* refactor(#785): address review nit

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

* feat(#787): elevate Cline — .clinerules/ dir form, PreToolUse hook, AGENTS.md (#803)

* feat(#787): elevate Cline — .clinerules/ dir form, PreToolUse hook, AGENTS.md

Migrate the installer's Cline output from a single-file .clinerules to the
.clinerules/ directory form (.clinerules/gsd.md), which is the prerequisite for
Cline's v3.36 hooks (a path cannot be both a file and a directory). Add a
.clinerules/hooks/PreToolUse lifecycle hook implementing Cline's JSON stdin ->
{cancel,errorMessage,contextModification} protocol; it guards .planning/
artifacts and fails open. On global installs, merge GSD instructions into the
cross-tool ~/.agents/AGENTS.md target (marker-delimited, merge-safe). A legacy
single-file .clinerules is migrated in place; --uninstall removes the new
artifacts and strips the AGENTS.md GSD block.

Also fixes the uninstall targetDir for Cline local installs (it pointed at
./.cline instead of the project root) and re-runs writeManifest after the
Cline artifacts are written so they are hash-tracked.

Self-contained: implemented independently of the #782 Cline skills work.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#787): address review findings

- Scope PreToolUse hook path-walk to PATH_KEY fields only (eliminates false
  positive when doc body content mentions .planning/)
- Use lstatSync + isSymbolicLink() for migration guard so GSD never writes
  through a user's symlinked .clinerules into an external directory
- Add regression tests for both cases

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore(#787): set changeset pr: 803

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#812): honor COPILOT_HOME in Copilot global config-dir resolution (#814)

* fix(#812): honor COPILOT_HOME in Copilot global config-dir resolution

getGlobalConfigDir('copilot') resolved the global config directory using
only --config-dir > COPILOT_CONFIG_DIR > ~/.copilot, ignoring the
COPILOT_HOME env var. Per GitHub's Copilot CLI docs, COPILOT_HOME
overrides the default ~/.copilot location (and user-level hooks are read
from $COPILOT_HOME/hooks/), so a global --copilot install wrote all
artifacts (skills, agents, copilot-instructions.md, the gsd-session.json
hook) to ~/.copilot even when the user relocated their Copilot home,
making them undiscoverable by Copilot CLI.

Mirror the codex/CODEX_HOME branch: precedence is now
--config-dir > COPILOT_CONFIG_DIR > COPILOT_HOME > ~/.copilot. Uninstall
uses the same resolver, so it stays symmetric.

Also: document COPILOT_HOME in the installer --help notes, the
USER-GUIDE env-var table, and the installer-migrations Copilot row; and
clear COPILOT_HOME in the two default-path test suites so they stay
hermetic now that the resolver honors it.

Closes #812

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* chore(#812): add changeset for PR #814

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* feat(#788): expand Qwen Code hook-event coverage (#807)

* feat(#788): expand Qwen Code hook-event coverage to 4 new events

Register SubagentStop, Stop, PreCompact (gsd-context-monitor.js) and
UserPromptSubmit (gsd-prompt-guard.js) in the Qwen Code installer.
Guard is isQwen-only — Claude Code and all other runtimes are unchanged.
Uninstall loop extended to include the 4 new event names.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(#788): reconcile to 3 Qwen-only events — defer UserPromptSubmit

gsd-prompt-guard exits unless tool_name is Write|Edit (PreToolUse
payload shape); UserPromptSubmit carries raw user-prompt text with no
tool_name field, so wiring it would be a silent no-op.  Deferred to a
follow-on issue.

Artifacts made consistent:
- bin/install.js: drop UserPromptSubmit registration block; uninstall
  loop drops UPS from event list
- .changeset/788-qwen-hook-events.md: corrected to 3 events + rationale
- docs/how-to/install-on-your-runtime.md: remove UPS row from hook table
- tests/enh-788-qwen-hook-events.test.cjs: assert UPS NOT registered;
  fix idempotency suite to persist settings between installs; drop
  UPS-specific assertions

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore(#788): update changeset PR number to #807

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* test(#788): prune stale install-bucket allowlist entry for enh-788 test

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

* enhancement(#782): emit gsd skills to ~/.cline/skills for Cline >= v3.48 (#809)

Cline added a global skills system (~/.cline/skills/<name>/SKILL.md) in
v3.48.0, but gsd treated Cline as rules-only and emitted zero skills
(getGlobalSkillsBase('cline')=null, empty artifact kinds). This makes gsd
emit skills for Cline at global scope, alongside the existing .clinerules.

- runtime-homes: getGlobalSkillsBase('cline') -> ~/.cline/skills (was null)
- runtime-artifact-layout: cline emits a skills kind for GLOBAL scope only
  (local stays .clinerules-only), mirroring claude's scope dispatch
- install.js: convertClaudeCommandToClineSkill emits name+description-only
  SKILL.md frontmatter (Cline/agentskills.io spec; no Claude-specific
  allowed-tools/argument-hint/agent), hyphen-normalized + .cline/-rewritten
  body; global cline routed through the skills path while .clinerules is
  still written; _applyRuntimeRewrites cline case handles custom
  CLINE_CONFIG_DIR; convertClaudeToCliineMarkdown also rewrites bare
  ~/.claude and CLAUDE_CONFIG_DIR
- docs: install-on-your-runtime.md documents Cline global skills vs local rules
- tests: converter (name+description-only), global emission, skills+.clinerules
  coexistence, scope-aware layout, custom-dir paths, idempotency

Closes #782

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* feat(#790): emit Augment slash commands (~/.augment/commands/) (#808)

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

* enh(#784): emit native skills for OpenCode + Kilo runtimes (#810)

* feat(#784): emit native skills for OpenCode + Kilo runtimes

OpenCode and Kilo share a config schema and both discover on-demand
skills from skills/<name>/SKILL.md. The installer previously emitted
only flat commands (command/) and file-based agents (agents/) for these
runtimes. Add a shared OpenCode-family skill writer that stages each GSD
command as a spec-compliant SKILL.md (name matching the directory,
description 1-1024 chars), wired through the runtime artifact layout so
uninstall cleans skills/ automatically. Skills respect the active
install profile.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#784): correct skill body paths + preserve user dev-preferences

Address adversarial-review findings:
- Add opencode/kilo cases to _applyRuntimeRewrites so staged SKILL.md
  bodies are re-pointed from the converter's hardcoded default config dir
  to the actual install target (fixes --local / --config-dir installs;
  commands/agents already did this by applying pathPrefix pre-conversion).
- Preserve user-owned skills/gsd-dev-preferences across reinstall in
  installOpencodeFamilySkills (snapshot+restore around the gsd-* prune),
  matching installRuntimeArtifacts.
- Export installOpencodeFamilySkills and add regression tests.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#784): guarantee command/skill body parity, fix kilo-alt double-rewrite

Follow-up adversarial-review found the post-conversion path rewrite could
double-rewrite custom Kilo dirs (kilo -> kilo-alt -> kilo-alt-alt) because
the kilo pathPrefix is a $HOME (non-absolute) superset of the hardcoded
default base. Restructure so OpenCode/Kilo skills mirror copyFlattenedCommands
exactly: stage raw commands, apply pathPrefix BEFORE conversion via a new
shared applyOpencodeFamilyPathPrefix() helper (now used by both the command
and skill writers), then convert. This guarantees byte-for-byte command/
skill body parity for global, --local, and --config-dir installs and removes
the prefix-overlap hazard. Drop the fragile _applyRuntimeRewrites opencode/
kilo case. Strengthen the path regression test.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* refactor(#784): derive opencode/kilo skills from the same staged command set

Pass the installer's _stageSkills() output directly to
installOpencodeFamilySkills instead of re-staging via the layout, so the
command/ and skills/ surfaces always cover the identical profile-resolved
set — including the --minimal/--core-only alias path, which stages
differently from a plain --profile=core. Verified: minimal install now
emits 8 commands and 8 skills.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* chore(#784): set changeset PR number to 810

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* test(#784): fully escape backslashes in test helper (CodeQL js/incomplete-string-escaping)

Replace the dot-only escape `replace(/[.]/g, '\\.')` with a complete
regex-escape pattern `replace(/[\\.*+?^${}()|[\]]/g, '\\$&')` so all
regex metacharacters (including backslash itself) in `defaultBase` are
safely escaped before interpolation into `new RegExp(...)`.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#813): apply per-runtime skill path rewrites in applySurface (#817)

* fix(#813): apply per-runtime skill path rewrites in applySurface

applySurface() re-staged skill artifacts but, unlike installRuntimeArtifacts(),
never applied the per-runtime path rewrites. So /gsd:surface
(profile/enable/disable/reset) overwrote installed SKILL.md bodies with the
converter's default ~/.claude paths instead of the install target (pathPrefix),
silently regressing skill path references for every skillsKind runtime until
the next reinstall.

applySurface now mirrors installRuntimeArtifacts: for kind.kind === 'skills' it
derives pathPrefix the same way and applies applyRuntimeContentRewritesInPlace
on the staged dir before syncing.

- bin/install.js: export applyRuntimeContentRewritesInPlace
- runtime-artifact-layout.cts: carry resolved scope on Layout; export
  getInstallExports; type computePathPrefix/applyRuntimeContentRewritesInPlace
  on InstallExports
- surface.cts: lazily derive pathPrefix (only when a skills kind exists) and
  apply the rewrite via the shared getInstallExports accessor — single source of
  truth with install, only skills kinds rewritten (matches install)
- tests: regression test parameterized over cursor + codex asserting
  post-applySurface bodies carry the install pathPrefix, not ~/.claude
- CONTEXT.md: glossary updated for the applySurface rewrite parity + scope seam

Closes #813

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* chore(#813): add changeset fragment for PR #817

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* test(#813): normalize configDir prefix to forward slashes for Windows CI

The #813 regression assertion compared skill bodies against a raw
${configDir}/ prefix, but production derives pathPrefix via
path.resolve(configDir).replace(/\\/g, '/'). On Windows, mkdtempSync
returns backslash paths while the rewritten body uses forward slashes,
so the assertion would fail Windows-only (not covered by local gsd-test).
Normalize the expected prefix the same way production does.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#816): mirror install command-prefix handling in _syncGsdDir (#822)

* fix(#816): mirror install command-prefix handling in _syncGsdDir

applySurface() via _syncGsdDir handled command artifacts differently from a
fresh install. For flat command dirs (cursor/augment/opencode/kilo) install's
_copyStaged adds kind.prefix (gsd-<stem>.md) and _removeGsdEntries prunes
prefix-scoped, but _syncGsdDir copied staged files verbatim (unprefixed) and
pruned by exact name. So every /gsd:surface toggle wrote wrong filenames,
orphaned the installed gsd-*.md, and deleted user-authored command files.

_syncGsdDir's commands/agents branch now mirrors install:
- flat command dirs get the gsd- prefix on copy; namespaced dirs (commands/gsd)
  and agents keep staged names, using install's namespacedByDir rule
- prune is prefix-scoped so user files in shared flat dirs are preserved;
  namespaced commands/gsd stays membership-pruned so superseded commands are
  still removed on profile shrink

The naming rule is intentionally re-implemented (not via require('bin/install.js')
to avoid its module-load banner side-effect); a strict parity test asserts
applySurface and installRuntimeArtifacts produce identical command filenames for
opencode/kilo/cursor/augment/gemini, guarding against drift.

Closes #816

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* chore(#816): add changeset fragment for PR #822

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* chore(#771): convert agent color: hex/magenta values to documented named colors (#823)

* chore(#771): convert agent color: hex/magenta values to documented named colors

Claude Code's sub-agent `color:` field documents only 8 named colors
(red, blue, green, yellow, purple, orange, pink, cyan). Twelve agent
files used hex values and two used the undocumented `magenta`; convert
each to the nearest documented named color so the intended per-agent
TUI color differentiation is spec-compliant.

- agents/*.md: 14 color values hex/magenta -> nearest named color
- scripts/research-profiles.cjs: update the 3 generated research-agent
  profiles (source of truth) so gen-research-agents stays in sync
- docs/AGENTS.md: update documented colors; add missing Color rows for
  gsd-nyquist-auditor, gsd-project-researcher, gsd-phase-researcher
- tests/agent-frontmatter.test.cjs: add regression guard asserting every
  agent color: is in the documented named-color set

Closes #771

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* chore(#771): add changeset

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* feat(#773): add --ephemeral and --dangerously-bypass-hook-trust to automated codex exec wrappers (#824)

* feat(#773): add --ephemeral and --dangerously-bypass-hook-trust to automated codex exec invocations

Automated codex exec calls in the review workflow now carry --ephemeral
(no session-state accumulation across CI runs) and
--dangerously-bypass-hook-trust (skip hook-trust prompts for hooks
whose provenance gsd-core already controls). Both flags were verified
present in the installed codex CLI (codex exec --help).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#773): correct changeset pr: reference to #824

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* feat(#775): ship a gemini-extension.json extension package (#818)

Add a Gemini CLI extension package so users can install, update, and
remove GSD through Gemini's own extension lifecycle and have it appear in
`gemini extensions list`:

  gemini extensions install https://github.com/open-gsd/gsd-core
  gemini extensions update gsd-core
  gemini extensions uninstall gsd-core
  gemini extensions link /path/to/gsd-core   # dev

This mirrors the additive Claude Code plugin manifest (#766): a thin,
version-stamped manifest enforced by an in-repo drift test. The extension
ships the context-file payload (GEMINI.md), loaded into every Gemini
session; slash-command/agent/hook TOML projection into the extension is a
documented follow-up. The manual `npx gsd-core --gemini` installer (which
provides the /gsd:* commands) is unchanged — purely additive, no breaking
change.

- gemini-extension.json: name=binName, version tracks package.json,
  description, contextFileName=GEMINI.md (minimal; no mcpServers — gsd
  ships no MCP server)
- GEMINI.md: Gemini-session context payload
- package.json: add both artifacts to files[] so they publish
- CONTEXT.md: add "Gemini Extension Package" glossary entry
- docs: USER-GUIDE + install-on-your-runtime how-to
- tests/issue-775-gemini-extension.test.cjs: manifest validity, version
  parity with package.json, contextFileName existence, files[] publication

Closes #775

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* feat(#768): pre-populate settings.json permissions.allow/deny for Claude Code (#819)

* feat(#768): pre-populate settings.json permissions.allow/deny for Claude Code

Adds mergeClaudePermissions() to bin/install.js which non-destructively
appends GSD's known-safe tool-call patterns to permissions.allow and
defense-in-depth credential-file patterns to permissions.deny during
Claude Code installs. Merge is idempotent (no duplicates on reinstall)
and additive (existing user entries preserved). Uninstall removes only
the exact GSD-owned entries.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* chore: update changeset pr number to 819

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* feat(#774): emit service_tier/model_verbosity in Codex agent TOML + agents/openai.yaml skill chip (#828)

* feat(#774): emit service_tier/model_verbosity in Codex agent TOML + agents/openai.yaml skill chip

- Add service_tier = "flex" and model_verbosity = "low" to the Codex
  ConfigProfile TOML for light-tier agents (gsd-research-synthesizer,
  gsd-codebase-mapper, gsd-plan-checker, and 8 others identified via
  AGENT_DEFAULT_TIERS). Field names/values verified against Codex schema
  (profile_toml.rs / config_types.rs Verbosity enum). Non-light agents
  are unaffected.

- Add generateCodexSkillMetadataYaml() and writeCodexSkillMetadataFiles():
  after installRuntimeArtifacts, iterate every gsd-* skill directory,
  read the short-description already emitted in the SKILL.md frontmatter
  by convertClaudeCommandToCodexSkill, and write agents/openai.yaml with
  interface.display_name and interface.short_description for the Codex
  TUI skill picker chip.
  - yamlQuote (JSON.stringify) handles all YAML-unsafe chars.
  - User-owned gsd-dev-preferences dir is never overwritten.
  - Errors per-skill are swallowed so a bad SKILL.md can't abort install.
  - agents/openai.yaml is covered by the snapshot/rollback system and
    manifest hash (writeManifest hashes skill dirs recursively).
  - Uninstall symmetry: _removeGsdEntries removes whole gsd-* dirs.

- 21 new tests in codex-config.test.cjs covering service_tier/verbosity
  TOML emission, YAML generation (round-trip via js-yaml), and
  writeCodexSkillMetadataFiles including an e2e integration test.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#774): correct docs-lint coverage — proper changeset format + USER-GUIDE entry

Rewrite the changeset fragment from old @opengsd/gsd-core:patch format to the
required type:/pr: schema so the docs-lint parser can consume it.  Add a new
"Codex skill picker and agent scheduling (#774)" section to docs/USER-GUIDE.md
describing the flex-tier scheduling and /skills TUI chip enrichments — both are
user-visible and belong in docs rather than behind a docs-exempt marker.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* feat(#769): adopt context:fork + effort on heavy workflow skills (#820)

* feat(#769): emit context:fork + effort: frontmatter on heavy workflow skills

Add `context: fork` and `effort: xhigh` to the three heaviest workflow
commands (plan-phase, execute-phase, autonomous) and `effort: low` to the
two quick-status commands (progress, stats).

On Claude Code, `context: fork` runs the skill in an isolated subagent
context window so the main session's context budget is protected.
`effort: xhigh` / `effort: low` signal the appropriate token-budget tier to
the runtime. Both fields are silently ignored by runtimes that do not
recognise them (Gemini, Codex, Cursor, etc.) — no behaviour change outside
Claude Code.

Update convertClaudeCommandToClaudeSkill in bin/install.js to preserve
`context:` and `effort:` when rewriting source command files to SKILL.md for
a Claude global install. Add install-suite tests to assert the fields are
present in both source commands and the installed SKILL.md output.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* test(#769): tighten regex assertions + add execute/plan-phase effort coverage

Fix low-severity adversarial finding: tighten test regex patterns from
`\s*` to `[ \t]*` so they cannot match across newlines (CRLF parity).
Add missing effort: xhigh assertions for gsd-execute-phase and gsd-plan-phase
SKILL.md install output to complete the black-box coverage gap.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* feat(#772): adopt stable Codex hook events + commandWindows for Windows parity (#827)

* feat(#772): adopt stable Codex hook events + commandWindows for Windows parity

Register three new stable Codex hook events (SubagentStart, Stop,
PostToolUse) wired to gsd-context-monitor.js so Codex installs get
the same context-headroom tracking at subagent and session boundaries
that Claude/Qwen already have.

Add commandWindows field to the SessionStart hook entry on Windows so
Codex uses the .cmd shim directly (Git Bash/MSYS cannot POSIX-exec
node.exe). commandWindows is only emitted on win32; POSIX is unchanged.

Refactor reconcileCodexHooksJsonSessionStart into a generic
reconcileCodexHooksJsonEvent so any event name can be reconciled with
the same dedup/preserve-user-entries logic.

Add gsd-context-monitor.js and .cmd to MANAGED_HOOK_COMMAND_BASENAMES
_BY_SURFACE so idempotent re-runs de-duplicate entries correctly.

30 new tests covering: export surface, event registration for each of
the three events, commandWindows parity (POSIX vs win32), idempotency,
uninstall, and user-entry preservation.

Closes #772

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#772): windows path normalization + docs-lint

- Normalize scriptPath backslashes to forward slashes in
  ensureCodexHooksJsonEvent and ensureCodexHooksJsonSessionStart so that
  isManagedHookCommand can match stored commands against configDir on
  Windows CI runners. path.resolve returns backslash paths on Windows,
  but when platform is not 'win32' (e.g. platform:'linux' in tests),
  projectManagedHookCommand skips normalization — producing a mismatch
  that breaks idempotency deduplication (the same hook entry appended
  twice on re-register). Forward-slash paths are always valid in both
  Node.js and Codex, so the normalization is safe for all platforms.
- Fix changeset pr: 0 → 827 to resolve fail_malformed_fragment.
- Add Codex hook coverage table to docs/how-to/install-on-your-runtime.md
  documenting the SubagentStart/Stop/PostToolUse events + commandWindows
  Windows-parity field added by this enhancement.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* feat(#778): cross-runtime command enrichment (Gemini {{args}}/!{}, Qwen priority) (#825)

* feat(#778): cross-runtime command enrichment (Gemini {{args}}/!{}, Qwen priority)

Enrich the installer's per-runtime command/skill generators with native,
verified, additive fields:

- Gemini CLI: map Claude's $ARGUMENTS -> Gemini's {{args}} in generated TOML
  commands so typed arguments interpolate; inject live .planning/STATE.md into
  /gsd:progress via a fixed, injection-safe !{cat .planning/STATE.md 2>/dev/null}
  shell block (no interpolated input).
- Qwen Code: emit the optional numeric `priority` field on main-loop skills so
  the most-used workflows sort first in the /skills list (higher = earlier per
  the Qwen skills spec; the issue's inverse numbering was corrected).

OpenCode per-command model/agent/subtask/variant enrichment was evaluated and
intentionally not implemented: `model` reintroduces the #1156
ProviderModelNotFoundError regression for non-Anthropic providers (the converter
deliberately strips model:), `subtask`/`agent` change execution semantics for
GSD's interactive commands, and `variant` is not in the OpenCode command schema.

Schemas verified against primary docs (Gemini custom-commands, Qwen skills,
OpenCode commands/skills). Adds tests/enh-778-* and how-to + USER-GUIDE docs.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* chore(#778): set changeset PR number to 825

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* feat(#789): elevate CodeBuddy — slash commands (#830)

* feat(#789): elevate CodeBuddy — emit slash commands (+ document subagent/MCP scope)

Emit a CodeBuddy slash-command surface so GSD workflows appear in the
'/' menu, reaching parity with other elevated runtimes.

- Add convertClaudeCommandToCodebuddyCommand and register a commands/
  artifact kind for the codebuddy runtime (commands/gsd-<name>.md),
  consistent with the Cursor (#785) and Augment (#790) commands surfaces.
- Mark emitted skills user-invocable:false so the commands surface is the
  sole '/' entry point (no duplicate /gsd-* entries); skills stay
  model-invocable. CodeBuddy's SKILL.md supports this field.
- Normalize $HOME/.codebuddy (bare + slash) path forms in runtime
  rewrites so --config-dir/local installs don't leak the default home.
- Report installed commands/ count on install; uninstall prunes gsd-*
  commands while preserving user-owned commands.

Scope: subagents (~/.codebuddy/agents/) are already emitted by the
generic agents block (unchanged); no mcp.json is written (gsd ships no
MCP server, and CodeBuddy's mcp.json registers only external servers).

Closes #789

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* chore(#789): set changeset pr number to 830

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* feat(#776): Gemini hook events (BeforeAgent/AfterAgent/BeforeModel) + hooksConfig.enabled check (#829)

* feat(#776): Gemini hook events (BeforeAgent/AfterAgent/BeforeModel) + hooksConfig.enabled check

Register three new Gemini-CLI hook events on install:
  - BeforeAgent: fires before agent planning; wired to gsd-context-monitor
  - AfterAgent: fires after final response generation; wired to gsd-context-monitor
  - BeforeModel: fires before each LLM call (per-turn); wired to gsd-context-monitor

All three reuse gsd-context-monitor.js (no new hook files). Uninstall cleanup
loop extended to remove the new events. Non-array guard added for robustness
against malformed settings.

Also detect hooksConfig.enabled:false in Gemini settings and emit a clear
warning — without this check, all registered hooks silently do nothing.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* chore: update changeset pr: 829

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* docs(#776): document Gemini hook events

Add hook coverage table to the Gemini CLI section of install-on-your-runtime.md,
covering the three new events (BeforeAgent/AfterAgent/BeforeModel wired to
gsd-context-monitor) plus a callout for the hooksConfig.enabled:false silent
failure mode detected by the installer.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* feat(#777): register Cursor-native hooks (.cursor/hooks.json) for session-start/post-tool parity (#831)

* feat(#777): register Cursor-native hooks (.cursor/hooks.json) for session-start/post-tool parity

- Add gsd-cursor-session-start.js: injects STATE.md presence reminder (or
  new-project nudge) into Cursor sessions via the sessionStart hook event
- Add gsd-cursor-post-tool.js: emits an additional_context nudge when
  write-class tool calls touch .planning/ files (postToolUse hook event)
- Add 'cursor-hooks-json' installSurface to runtime-config-adapter-registry;
  writeCursorHooksJson/reconcileCursorHooksJson write the canonical
  { version: 1, hooks: { sessionStart, postToolUse } } JSON shape with
  idempotent reconciliation that preserves user-owned hook entries
- Hook scripts are copied with /gsd:→gsd- rewrite so installed files
  contain no colon-form slash-command refs (bug-376 invariant)
- 20 new tests in tests/cursor-hooks.test.cjs cover all reconciler paths,
  entry helpers, removal, runtime adapter surface, and hook script behavior
- Update CONTEXT.md, ARCHITECTURE.md, installer-migrations.md, and
  000-first-time-baseline.cts to include Cursor hooks.json surface

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#777): build hooks/dist on demand in bug-376 test for scoped/windows CI

hooks/dist is gitignored and only produced by `npm run build:hooks`.
The CI scoped (ubuntu-latest/node-22) and windows (windows-latest/node-24)
test jobs do NOT run build:hooks before executing tests, so bug-376's
prerequisite suite was failing with "hooks/dist not found" on both legs.

Add ensureHooksDist() helper (mirrors bug-3357 pattern) that builds
hooks/dist on demand in the before() hooks of prerequisite and Suite 3.
Also add ensureHooksDist() call to Suite 3's before() so the snapshot
step is also hermetic.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* docs(#832): add how-to guide for minimal install / skill profiles (#835)

Add docs/how-to/install-minimal-and-add-skills.md covering the --minimal
/ --core-only / --profile=core install, the core/standard/full profiles,
and growing the surface live via /gsd:surface or on reinstall. Register
it in the docs/README.md How-to guides index.

Closes #832

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* feat(#815): add /gsd-update --next to install the @next RC channel (#839)

Adds an opt-in --next (alias --rc) flag to /gsd-update targeting the @next RC dist-tag (ADR #660), with a {latest,next} allowlist enforced at three layers, channel-aware version check + banner, and byte-for-byte unchanged default @latest behavior.

Closes #815

* fix(#837): three-dot diff in ci-test-scope so docs-only PRs skip the heavy matrix (#841)

CI test-scope detection diffed changed files with a two-dot
`git diff --name-only base head`, where base is the moving tip of `next`.
A PR branch cut from a slightly older `next` surfaced every product file
`next` had gained since the merge-base, flipping product_changed/full_matrix
and running the full Windows/macOS matrix + coverage on docs-only PRs.

Switch to a three-dot `git diff --name-only base...head` (vs the merge-base),
matching GitHub's PR "Files changed" semantics. Add a regression test that
builds a stale-base topology, plus a guard test pinning `fetch-depth: 0` on
the `changes` job (required for the merge-base to be locally available).

Closes #837

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* feat(#836): no-LLM duplicate-issue detection + challenge + 1-day auto-close (#843)

* feat(#836): no-LLM duplicate-issue detection + challenge + 1-day auto-close

Adds a deterministic (no-LLM) duplicate-issue governance lifecycle:

- scripts/issue-dedupe.cjs: pure, unit-tested module (tokenize, Sørensen–Dice
  title similarity, scoreCandidates, renderChallengeComment, shouldClose) with
  fail-safe destructive-action guards.
- duplicate-check.yml (issues:opened): scores new-issue title against open
  issues, posts a challenge comment + applies the pending `possible-duplicate`
  label on a clear match.
- duplicate-sweep.yml (daily cron): closes possible-duplicate issues whose
  challenge comment is >24h old with no human reply and no 👎 veto; honors
  exempt labels; re-checks the label immediately before close (TOCTOU guard);
  strips the label on close to avoid reopen loops.
- remove-duplicate-label.yml (issue_comment:created): clears the label and
  applies needs-maintainer-review when any human responds.
- bug_report.yml / docs_issue.yml: add the required "I searched existing
  issues" preflight checkbox so all five forms force a pre-search attestation.
- docs/agents/triage-labels.md: document the label + lifecycle.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* chore(#836): add changeset fragment for duplicate-issue detection

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* feat(#770): register Claude Code lifecycle hooks (SubagentStop/Stop/PreCompact/FileChanged) (#821)

* feat(#770): register Claude Code lifecycle hooks (SubagentStop/Stop/PreCompact/FileChanged)

Wire three new context-tracking events (SubagentStop, Stop, PreCompact) to
gsd-context-monitor so context-headroom warnings surface at model-stop and
subagent-finalisation moments — not just on PostToolUse.  Add a new
FileChanged hook (gsd-config-reload.js) that hot-reloads .planning/config.json
context mid-session when the user edits it, injecting a config summary as
hookSpecificOutput.additionalContext.  Updates plugin manifest hooks.json,
managed-hooks-registry, installer-migration-report allowlist, and
shell-command-projection cleanup tables.  Tests: 21 new assertions in
enh-770-claude-hook-events.test.cjs; enh-788 and issue-766 test suites updated.

Closes #770

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* docs(#770): document newly-registered Claude Code lifecycle hooks

Add a Hook coverage table to the Claude Code npm installer section of
docs/how-to/install-on-your-runtime.md describing SubagentStop, Stop,
PreCompact, and the new FileChanged (gsd-config-reload.js) hook that
hot-reloads .planning/config.json mid-session. Also fixes the changeset
frontmatter (adds type: Added + pr: 821) so docs-lint can consume the
fragment.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#770): add gsd-config-reload.js to INVENTORY.md and regenerate manifest

The feat commit added hooks/gsd-config-reload.js but did not bump the
Hooks count in docs/INVENTORY.md (14→15) or add the new row, and did not
regenerate docs/INVENTORY-MANIFEST.json. Both inventory-counts and
inventory-manifest-sync tests failed across the full CI matrix.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#770): make lifecycle-hook tests deterministic on scoped runner

Replace the shared hooks/dist/ ensemble setup (ensureHooksDist /
teardownHooksDist) in the Claude hook tests with per-test isolation:
pre-populate each test's own tmpDir/.claude/hooks/ with stub files and
pass installerMigrations:[] to install() so the first-time-baseline
migration does not remove the stubs before the copy step can run.

Root cause: hooks/dist/ is gitignored and absent on a fresh npm ci.
ensureHooksDist() created it and teardownHooksDist() deleted it, but
with --test-concurrency=4 both test files ran concurrently as separate
Node.js worker processes sharing the same filesystem.  One file's
afterEach teardown deleted hooks/dist/ while the other file's install()
was copying from it, producing an ENOENT (reproduced 2/10 runs locally).

The additional issue: even with pre-placed stubs surviving the copy race,
the 000-first-time-baseline migration classified hooks/gsd-*.js as
bundled-gsd-hook artifacts, auto-removed them, and the copy step never
re-ran (hooks/dist/ absent) — leaving contextMonitorFile missing and all
hook registrations silently skipped (the 'got: []' symptom).

Fix: pre-populate targetDir/hooks/ per-test (isolated temp dir) AND pass
installerMigrations:[] so the baseline scan is skipped.  The Qwen suites
already used this pattern correctly; the Claude suites are aligned to it.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#770): ship gsd-config-reload.js by adding it to build-hooks HOOKS_TO_COPY

The #770 feature added hooks/gsd-config-reload.js and registered it in
MANAGED_HOOKS, the installer, INVENTORY, and the test EXPECTED_ALL_HOOKS
list — but never added it to scripts/build-hooks.js HOOKS_TO_COPY. As a
result the hook was never copied into hooks/dist/ during the build, so:

  - the hook would never ship to users (real production bug — the
    FileChanged config-reload feature was dead-on-arrival), and
  - install-minimal-hooks.test.cjs #1755 ("all expected hooks are copied
    from hooks/dist/ to target", ".js hooks are executable after copy",
    "manifest contains .js hook entries") failed on any environment with
    a clean checkout (no pre-existing hooks/dist/): coverage, full test
    macos-22/macos-24, test ubuntu-24.

The failures were masked locally only by a stale hooks/dist/ left from a
prior build (build-hooks copies into dist without clearing it). On CI's
fresh `npm ci` there is no dist, so the omission surfaced.

Fix: add 'gsd-config-reload.js' to HOOKS_TO_COPY so build-hooks stages it
into hooks/dist/ alongside the other JS hooks. Verified by removing
hooks/dist/ and rerunning the full suite green (0 fail).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#770): make config prototype-pollution beforeEach deterministic on scoped runner

Root cause: the #663 and alert-#26 prototype-pollution describe blocks
seeded .planning/config.json in beforeEach via a bare
runGsdTools('config-ensure-section') whose result was discarded. That
command runs in a spawned gsd-tools child; on the scoped CI lane
(--test-concurrency=4, config.test.cjs scheduled alongside the heavy
install/tarball suites that #770 pulled into the targeted set) the child
can be transiently killed under resource pressure (non-zero exit, empty
stderr — an OS-level kill, not an app error). The swallowed failure left
config.json absent, so the first subtest's readConfig() threw ENOENT
opening <tmp>/.planning/config.json. Only 1 of 4 subtests failed,
confirming a per-invocation transient, not a deterministic miss; the full
suite schedules files differently so config.test.cjs did not collide with
those heavy neighbors → passed there.

Fix: add ensureConfigReady(tmpDir) which retries config-ensure-section on
ANY failure or missing file and throws a clear diagnostic if it still
cannot create config.json, then use it in both prototype-pollution
beforeEach blocks. Setup is now deterministic under load; the #663/alert-#26
security assertions are unchanged.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* fix(#844): sync runtime manifest versions on npm version bump (#845)

* fix(#844): sync runtime manifest versions on npm version bump

The release workflow bumps package.json via `npm version` but never
stamped the runtime-integration manifests that must track it
(.claude-plugin/plugin.json #766, gemini-extension.json #775), so the
first RC/finalize whose version diverged from the -dev stream failed the
test suite before tagging/publishing.

Add scripts/sync-manifest-versions.cjs (single VERSIONED_MANIFESTS
registry) wired to a `version` npm lifecycle hook that stamps + stages
the manifests on every `npm version` — covering all four release bump
sites and local bumps with no workflow edits. A regression guard test
fails if any repo JSON whose version matches package.json is not
registered, forcing future version-bearing manifests into the sync.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* docs(#844): add changeset for manifest version sync fix

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

* chore: bump to 1.4.0-rc.2

* chore: finalize v1.4.0

* chore: promote CHANGELOG for v1.4.0

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Colin <colin@solvely.net>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Joe <44273333+jslitzkerttcu@users.noreply.github.com>
Co-authored-by: Solvely-Colin <211764741+Solvely-Colin@users.noreply.github.com>
2026-06-08 14:37:33 -04:00

142 KiB
Raw Blame History

GSD Feature Reference

Feature index and reference for GSD Core. For architecture details, see Architecture. For command syntax, see Command Reference. Return to docs index.


Table of Contents


Core Features

1. Project Initialization

Command: /gsd-new-project [--auto @file.md]

Purpose: Transform a user's idea into a fully structured project with research, scoped requirements, and a phased roadmap.

Requirements:

  • REQ-INIT-01: System MUST conduct adaptive questioning until project scope is fully understood
  • REQ-INIT-02: System MUST spawn parallel research agents to investigate the domain ecosystem
  • REQ-INIT-03: System MUST extract requirements into v1 (must-have), v2 (future), and out-of-scope categories
  • REQ-INIT-04: System MUST generate a phased roadmap with requirement traceability
  • REQ-INIT-05: System MUST require user approval of the roadmap before proceeding
  • REQ-INIT-06: System MUST prevent re-initialization when .planning/PROJECT.md already exists
  • REQ-INIT-07: System MUST support --auto @file.md flag to skip interactive questions and extract from a document

Produces:

Artifact Description
PROJECT.md Project vision, constraints, technical decisions, evolution rules
REQUIREMENTS.md Scoped requirements with unique IDs (REQ-XX)
ROADMAP.md Phase breakdown with status tracking and requirement mapping
STATE.md Initial project state with position, decisions, metrics
config.json Workflow configuration
research/SUMMARY.md Synthesized domain research
research/STACK.md Technology stack investigation
research/FEATURES.md Feature implementation patterns
research/ARCHITECTURE.md Architecture patterns and trade-offs
research/PITFALLS.md Common failure modes and mitigations

Process:

  1. Questions — Adaptive questioning guided by the "dream extraction" philosophy (not requirements gathering)
  2. Research — 4 parallel researcher agents investigate stack, features, architecture, and pitfalls
  3. Synthesis — Research synthesizer combines findings into SUMMARY.md
  4. Requirements — Extracted from user responses + research, categorized by scope
  5. Roadmap — Phase breakdown mapped to requirements, with granularity setting controlling phase count

Functional Requirements:

  • Questions adapt based on detected project type (web app, CLI, mobile, API, etc.)
  • Research agents have web search capability for current ecosystem information
  • Granularity setting controls phase count: coarse (2-4), standard (4-6), fine (6-10)
  • --auto mode extracts all information from the provided document without interactive questioning
  • Existing codebase context (from /gsd-map-codebase) is loaded if present

2. Phase Discussion

Command: /gsd-discuss-phase [N] [--auto] [--batch]

Purpose: Capture user's implementation preferences and decisions before research and planning begin. Eliminates the gray areas that cause AI to guess.

Requirements:

  • REQ-DISC-01: System MUST analyze the phase scope and identify decision areas (gray areas)
  • REQ-DISC-02: System MUST categorize gray areas by type (visual, API, content, organization, etc.)
  • REQ-DISC-03: System MUST ask only questions not already answered in prior CONTEXT.md files
  • REQ-DISC-04: System MUST persist decisions in {phase}-CONTEXT.md with canonical references
  • REQ-DISC-05: System MUST support --auto flag to auto-select recommended defaults
  • REQ-DISC-06: System MUST support --batch flag for grouped question intake
  • REQ-DISC-07: System MUST scout relevant source files before identifying gray areas (code-aware discussion)
  • REQ-DISC-08: System MUST adapt gray area language to product-outcome terms when USER-PROFILE.md indicates a non-technical owner (learning_style: guided, jargon in frustration_triggers, or high-level explanation depth)
  • REQ-DISC-09: When REQ-DISC-08 applies, advisor_research rationale paragraphs MUST be rewritten in plain language — same decisions, translated framing

Produces: {padded_phase}-CONTEXT.md — User preferences that feed into research and planning

Gray Area Categories:

Category Example Decisions
Visual features Layout, density, interactions, empty states
APIs/CLIs Response format, flags, error handling, verbosity
Content systems Structure, tone, depth, flow
Organization Grouping criteria, naming, duplicates, exceptions

3. UI Design Contract

Command: /gsd-ui-phase [N]

Purpose: Lock design decisions before planning so that all components in a phase share consistent visual standards.

Requirements:

  • REQ-UI-01: System MUST detect existing design system state (shadcn components.json, Tailwind config, tokens)
  • REQ-UI-02: System MUST ask only unanswered design contract questions
  • REQ-UI-03: System MUST validate against 6 dimensions (Copywriting, Visuals, Color, Typography, Spacing, Registry Safety)
  • REQ-UI-04: System MUST enter revision loop if validation returns BLOCKED (max 2 iterations)
  • REQ-UI-05: System MUST offer shadcn initialization for React/Next.js/Vite projects without components.json
  • REQ-UI-06: System MUST enforce registry safety gate for third-party shadcn registries

Produces: {padded_phase}-UI-SPEC.md — Design contract consumed by executors

6 Validation Dimensions:

  1. Copywriting — CTA labels, empty states, error messages
  2. Visuals — Focal points, visual hierarchy, icon accessibility
  3. Color — Accent usage discipline, 60/30/10 compliance
  4. Typography — Font size/weight constraint adherence
  5. Spacing — Grid alignment, token consistency
  6. Registry Safety — Third-party component inspection requirements

shadcn Integration:

  • Detects missing components.json in React/Next.js/Vite projects
  • Guides user through ui.shadcn.com/create preset configuration
  • Preset string becomes a planning artifact reproducible across phases
  • Safety gate requires npx shadcn view and npx shadcn diff before third-party components

4. Phase Planning

Command: /gsd-plan-phase [N] [--auto] [--skip-research] [--skip-verify]

Purpose: Research the implementation domain and produce verified, atomic execution plans.

Requirements:

  • REQ-PLAN-01: System MUST spawn a phase researcher to investigate implementation approaches
  • REQ-PLAN-02: System MUST produce plans with 2-3 tasks each, sized for a single context window
  • REQ-PLAN-03: System MUST structure plans as XML with <task> elements containing name, files, action, verify, and done fields
  • REQ-PLAN-04: System MUST include read_first and acceptance_criteria sections in every plan
  • REQ-PLAN-05: System MUST run plan checker verification loop (up to 3 iterations) unless --skip-verify is set
  • REQ-PLAN-06: System MUST support --skip-research flag to bypass research phase
  • REQ-PLAN-07: System MUST prompt user to run /gsd-ui-phase if frontend phase detected and no UI-SPEC.md exists (UI safety gate)
  • REQ-PLAN-08: System MUST include Nyquist validation mapping when workflow.nyquist_validation is enabled
  • REQ-PLAN-09: System MUST verify all phase requirements are covered by at least one plan before planning completes (requirements coverage gate)

Produces:

Artifact Description
{phase}-RESEARCH.md Ecosystem research findings
{phase}-{N}-PLAN.md Atomic execution plans (2-3 tasks each)
{phase}-VALIDATION.md Test coverage mapping (Nyquist layer)

Plan Structure (XML):

<task type="auto">
  <name>Create login endpoint</name>
  <files>src/app/api/auth/login/route.ts</files>
  <action>
    Use jose for JWT. Validate credentials against users table.
    Return httpOnly cookie on success.
  </action>
  <verify>curl -X POST localhost:3000/api/auth/login returns 200 + Set-Cookie</verify>
  <done>Valid credentials return cookie, invalid return 401</done>
</task>

Plan Checker Verification (8 Dimensions):

  1. Requirement coverage — Plans address all phase requirements
  2. Task atomicity — Each task is independently committable
  3. Dependency ordering — Tasks sequence correctly
  4. File scope — No excessive file overlap between plans
  5. Verification commands — Each task has testable done criteria
  6. Context fit — Tasks fit within a single context window
  7. Gap detection — No missing implementation steps
  8. Nyquist compliance — Tasks have automated verify commands (when enabled)

5. Phase Execution

Command: /gsd-execute-phase <N>

Purpose: Execute all plans in a phase using wave-based parallelization with fresh context windows per executor.

Requirements:

  • REQ-EXEC-01: System MUST analyze plan dependencies and group into execution waves
  • REQ-EXEC-02: System MUST spawn independent plans in parallel within each wave
  • REQ-EXEC-03: System MUST give each executor a fresh context window (200K tokens)
  • REQ-EXEC-04: System MUST produce atomic git commits per task
  • REQ-EXEC-05: System MUST produce a SUMMARY.md for each completed plan
  • REQ-EXEC-06: System MUST run post-execution verifier to check phase goals were met
  • REQ-EXEC-07: System MUST support git branching strategies (none, phase, milestone)
  • REQ-EXEC-08: System MUST invoke node repair operator on task verification failure (when enabled)
  • REQ-EXEC-09: System MUST run prior phases' test suites before verification to catch cross-phase regressions

Produces:

Artifact Description
{phase}-{N}-SUMMARY.md Execution outcomes per plan
{phase}-VERIFICATION.md Post-execution verification report
Git commits Atomic commits per task

Wave Execution:

  • Plans with no dependencies → Wave 1 (parallel)
  • Plans depending on Wave 1 → Wave 2 (parallel, waits for Wave 1)
  • Continues until all plans complete
  • File conflicts force sequential execution within same wave

Executor Capabilities:

  • Reads PLAN.md with full task instructions
  • Has access to PROJECT.md, STATE.md, CONTEXT.md, RESEARCH.md
  • Commits each task atomically with structured commit messages
  • Uses --no-verify on commits during parallel execution to avoid build lock contention
  • Handles checkpoint types: auto, checkpoint:human-verify, checkpoint:decision, checkpoint:human-action
  • Reports deviations from plan in SUMMARY.md

Parallel Safety:

  • Pre-commit hooks: Skipped by parallel agents (--no-verify), run once by orchestrator after each wave
  • STATE.md locking: File-level lockfile prevents concurrent write corruption across agents

6. Work Verification

Command: /gsd-verify-work [N]

Purpose: User acceptance testing — walk the user through testing each deliverable and auto-diagnose failures.

Requirements:

  • REQ-VERIFY-01: System MUST extract testable deliverables from the phase
  • REQ-VERIFY-02: System MUST present deliverables one at a time for user confirmation
  • REQ-VERIFY-03: System MUST spawn debug agents to diagnose failures automatically
  • REQ-VERIFY-04: System MUST create fix plans for identified issues
  • REQ-VERIFY-05: System MUST inject cold-start smoke test for phases modifying server/database/seed/startup files
  • REQ-VERIFY-06: System MUST produce UAT.md with pass/fail results

Produces: {phase}-UAT.md — User acceptance test results, plus fix plans if issues found


6.5. Ship

Command: /gsd-ship [N] [--draft]

Purpose: Bridge local completion → merged PR. After verification passes, push branch, create PR with auto-generated body from planning artifacts, optionally trigger review, and track in STATE.md.

Requirements:

  • REQ-SHIP-01: System MUST verify phase has passed verification before shipping
  • REQ-SHIP-02: System MUST push branch and create PR via gh CLI
  • REQ-SHIP-03: System MUST auto-generate PR body from SUMMARY.md, VERIFICATION.md, and REQUIREMENTS.md
  • REQ-SHIP-04: System MUST update STATE.md with shipping status and PR number
  • REQ-SHIP-05: System MUST support --draft flag for draft PRs
  • REQ-SHIP-06: System MUST support append-only project PR body sections configured with ship.pr_body_sections

Prerequisites: Phase verified, gh CLI installed and authenticated, work on feature branch

Produces: GitHub PR with rich body, optional configured PRD-style sections, STATE.md updated

User documentation: Custom PR Body Sections


7. UI Review

Command: /gsd-ui-review [N]

Purpose: Retroactive 6-pillar visual audit of implemented frontend code. Works standalone on any project.

Requirements:

  • REQ-UIREVIEW-01: System MUST score each of the 6 pillars on a 1-4 scale
  • REQ-UIREVIEW-02: System MUST capture screenshots via Playwright CLI to .planning/ui-reviews/
  • REQ-UIREVIEW-03: System MUST create .gitignore for screenshot directory
  • REQ-UIREVIEW-04: System MUST identify top 3 priority fixes
  • REQ-UIREVIEW-05: System MUST work standalone (without UI-SPEC.md) using abstract quality standards

6 Audit Pillars (scored 1-4):

  1. Copywriting — CTA labels, empty states, error states
  2. Visuals — Focal points, visual hierarchy, icon accessibility
  3. Color — Accent usage discipline, 60/30/10 compliance
  4. Typography — Font size/weight constraint adherence
  5. Spacing — Grid alignment, token consistency
  6. Experience Design — Loading/error/empty state coverage

Produces: {padded_phase}-UI-REVIEW.md — Scores and prioritized fixes


8. Milestone Management

Commands: /gsd-audit-milestone, /gsd-complete-milestone, /gsd-new-milestone [name]

Purpose: Verify milestone completion, archive, tag release, and start the next development cycle.

Requirements:

  • REQ-MILE-01: Audit MUST verify all milestone requirements are met
  • REQ-MILE-02: Audit MUST detect stubs, placeholder implementations, and untested code
  • REQ-MILE-03: Audit MUST check Nyquist validation compliance across phases
  • REQ-MILE-04: Complete MUST archive milestone data to MILESTONES.md
  • REQ-MILE-05: Complete MUST offer git tag creation for the release
  • REQ-MILE-06: Complete MUST offer squash merge or merge with history for branching strategies
  • REQ-MILE-07: Complete MUST clean up UI review screenshots
  • REQ-MILE-08: New milestone MUST follow same flow as new-project (questions → research → requirements → roadmap)
  • REQ-MILE-09: New milestone MUST NOT reset existing workflow configuration

Planning Features

9. Phase Management

Commands: /gsd-phase, /gsd-phase --insert [N], /gsd-phase --remove [N]

Purpose: Dynamic roadmap modification during development.

Requirements:

  • REQ-PHASE-01: Add MUST append a new phase to the end of the current roadmap
  • REQ-PHASE-02: Insert MUST use decimal numbering (e.g., 3.1) between existing phases
  • REQ-PHASE-03: Remove MUST renumber all subsequent phases
  • REQ-PHASE-04: Remove MUST prevent removing phases that have been executed
  • REQ-PHASE-05: All operations MUST update ROADMAP.md and create/remove phase directories

10. Quick Mode

Command: /gsd-quick [--full] [--discuss] [--research]

Purpose: Ad-hoc task execution with GSD guarantees but a faster path.

Requirements:

  • REQ-QUICK-01: System MUST accept freeform task description
  • REQ-QUICK-02: System MUST use same planner + executor agents as full workflow
  • REQ-QUICK-03: System MUST skip research, plan checker, and verifier by default
  • REQ-QUICK-04: --full flag MUST enable plan checking (max 2 iterations) and post-execution verification
  • REQ-QUICK-05: --discuss flag MUST run lightweight pre-planning discussion
  • REQ-QUICK-06: --research flag MUST spawn focused research agent before planning
  • REQ-QUICK-07: Flags MUST be composable (--discuss --research --full)
  • REQ-QUICK-08: System MUST track quick tasks in .planning/quick/YYMMDD-xxx-slug/
  • REQ-QUICK-09: System MUST produce atomic commits for quick task execution

11. Autonomous Mode

Command: /gsd-autonomous [--from N]

Purpose: Run all remaining phases autonomously — discuss → plan → execute per phase.

Requirements:

  • REQ-AUTO-01: System MUST iterate through all incomplete phases in roadmap order
  • REQ-AUTO-02: System MUST run discuss → plan → execute for each phase
  • REQ-AUTO-03: System MUST pause for explicit user decisions (gray area acceptance, blockers, validation)
  • REQ-AUTO-04: System MUST re-read ROADMAP.md after each phase to catch dynamically inserted phases
  • REQ-AUTO-05: --from N flag MUST start from a specific phase number

12. Freeform Routing

Command: /gsd-progress --do (see also /gsd-manager for interactive routing)

Purpose: Analyze freeform text and route to the appropriate GSD command.

Requirements:

  • REQ-DO-01: System MUST parse user intent from natural language input
  • REQ-DO-02: System MUST map intent to the best matching GSD command
  • REQ-DO-03: System MUST confirm the routing with the user before executing
  • REQ-DO-04: System MUST handle project-exists vs no-project contexts differently

13. Note Capture

Command: /gsd-capture

Purpose: Zero-friction idea capture without interrupting workflow. Append timestamped notes, list all notes, or promote notes to structured todos.

Requirements:

  • REQ-NOTE-01: System MUST save timestamped note files with a single Write call
  • REQ-NOTE-02: System MUST support list subcommand to show all notes from project and global scopes
  • REQ-NOTE-03: System MUST support promote N subcommand to convert a note into a structured todo
  • REQ-NOTE-04: System MUST support --global flag for global scope operations
  • REQ-NOTE-05: System MUST NOT use Task, AskUserQuestion, or Bash — runs inline only

14. Auto-Advance (Next)

Command: /gsd-progress --next

Purpose: Automatically detect current project state and advance to the next logical workflow step, eliminating the need to remember which phase/step you're on.

Requirements:

  • REQ-NEXT-01: System MUST read STATE.md, ROADMAP.md, and phase directories to determine current position
  • REQ-NEXT-02: System MUST detect whether discuss, plan, execute, or verify is needed
  • REQ-NEXT-03: System MUST invoke the correct command automatically
  • REQ-NEXT-04: System MUST suggest /gsd-new-project if no project exists
  • REQ-NEXT-05: System MUST suggest /gsd-complete-milestone when all phases are complete

State Detection Logic:

State Action
No .planning/ directory Suggest /gsd-new-project
Phase has no CONTEXT.md Run /gsd-discuss-phase
Phase has no PLAN.md files Run /gsd-plan-phase
Phase has plans but no SUMMARY.md Run /gsd-execute-phase
Phase executed but no VERIFICATION.md Run /gsd-verify-work
All phases complete Suggest /gsd-complete-milestone

Quality Assurance Features

15. Nyquist Validation

Purpose: Map automated test coverage to phase requirements before any code is written. Named after the Nyquist sampling theorem — ensures a feedback signal exists for every requirement.

Requirements:

  • REQ-NYQ-01: System MUST detect existing test infrastructure during plan-phase research
  • REQ-NYQ-02: System MUST map each requirement to a specific test command
  • REQ-NYQ-03: System MUST identify Wave 0 tasks (test scaffolding needed before implementation)
  • REQ-NYQ-04: Plan checker MUST enforce Nyquist compliance as 8th verification dimension
  • REQ-NYQ-05: System MUST support retroactive validation via /gsd-validate-phase
  • REQ-NYQ-06: System MUST be disableable via workflow.nyquist_validation: false

Produces: {phase}-VALIDATION.md — Test coverage contract

Retroactive Validation (/gsd-validate-phase [N]):

  • Scans implementation and maps requirements to tests
  • Identifies gaps where requirements lack automated verification
  • Spawns auditor to generate tests (max 3 attempts)
  • Never modifies implementation code — only test files and VALIDATION.md
  • Flags implementation bugs as escalations for user to address

16. Plan Checking

Purpose: Goal-backward verification that plans will achieve phase objectives before execution.

Requirements:

  • REQ-PLANCK-01: System MUST verify plans against 8 quality dimensions
  • REQ-PLANCK-02: System MUST loop up to 3 iterations until plans pass
  • REQ-PLANCK-03: System MUST produce specific, actionable feedback on failures
  • REQ-PLANCK-04: System MUST be disableable via workflow.plan_check: false

17. Post-Execution Verification

Purpose: Automated check that the codebase delivers what the phase promised.

Requirements:

  • REQ-POSTVER-01: System MUST check against phase goals, not just task completion
  • REQ-POSTVER-02: System MUST produce VERIFICATION.md with pass/fail analysis
  • REQ-POSTVER-03: System MUST log issues for /gsd-verify-work to address
  • REQ-POSTVER-04: System MUST be disableable via workflow.verifier: false

18. Node Repair

Purpose: Autonomous recovery when task verification fails during execution.

Requirements:

  • REQ-REPAIR-01: System MUST analyze failure and choose one strategy: RETRY, DECOMPOSE, or PRUNE
  • REQ-REPAIR-02: RETRY MUST attempt with a concrete adjustment
  • REQ-REPAIR-03: DECOMPOSE MUST break task into smaller verifiable sub-steps
  • REQ-REPAIR-04: PRUNE MUST remove unachievable tasks and escalate to user
  • REQ-REPAIR-05: System MUST respect repair budget (default: 2 attempts per task)
  • REQ-REPAIR-06: System MUST be configurable via workflow.node_repair_budget and workflow.node_repair

19. Health Validation

Command: /gsd-health [--repair]

Purpose: Validate .planning/ directory integrity and auto-repair issues.

Requirements:

  • REQ-HEALTH-01: System MUST check for missing required files
  • REQ-HEALTH-02: System MUST validate configuration consistency
  • REQ-HEALTH-03: System MUST detect orphaned plans without summaries
  • REQ-HEALTH-04: System MUST check phase numbering and roadmap sync
  • REQ-HEALTH-05: --repair flag MUST auto-fix recoverable issues

20. Cross-Phase Regression Gate

Purpose: Prevent regressions from compounding across phases by running prior phases' test suites after execution.

Requirements:

  • REQ-REGR-01: System MUST run test suites from all completed prior phases after phase execution
  • REQ-REGR-02: System MUST report any test failures as cross-phase regressions
  • REQ-REGR-03: Regressions MUST be surfaced before post-execution verification
  • REQ-REGR-04: System MUST identify which prior phase's tests were broken

When: Runs automatically during /gsd-execute-phase before the verifier step.


21. Requirements Coverage Gate

Purpose: Ensure all phase requirements are covered by at least one plan before planning completes.

Requirements:

  • REQ-COVGATE-01: System MUST extract all requirement IDs assigned to the phase from ROADMAP.md
  • REQ-COVGATE-02: System MUST verify each requirement appears in at least one PLAN.md
  • REQ-COVGATE-03: Uncovered requirements MUST block planning completion
  • REQ-COVGATE-04: System MUST report which specific requirements lack plan coverage

When: Runs automatically at the end of /gsd-plan-phase after the plan checker loop.


Context Engineering Features

22. Context Window Monitoring

Purpose: Prevent context rot by alerting both user and agent when context is running low.

Requirements:

  • REQ-CTX-01: Statusline MUST display context usage percentage to user
  • REQ-CTX-02: Context monitor MUST inject agent-facing warnings at ≤35% remaining (WARNING)
  • REQ-CTX-03: Context monitor MUST inject agent-facing warnings at ≤25% remaining (CRITICAL)
  • REQ-CTX-04: Warnings MUST debounce (5 tool uses between repeated warnings)
  • REQ-CTX-05: Severity escalation (WARNING→CRITICAL) MUST bypass debounce
  • REQ-CTX-06: Context monitor MUST differentiate GSD-active vs non-GSD-active projects
  • REQ-CTX-07: Warnings MUST be advisory, never imperative commands that override user preferences
  • REQ-CTX-08: All hooks MUST fail silently and never block tool execution

Architecture: Two-part bridge system:

  1. Statusline writes metrics to /tmp/claude-ctx-{session}.json
  2. Context monitor reads metrics and injects additionalContext warnings

23. Session Management

Commands: /gsd-pause-work, /gsd-resume-work, /gsd-progress

Purpose: Maintain project continuity across context resets and sessions.

Requirements:

  • REQ-SESSION-01: Pause MUST save current position and next steps to continue-here.md and structured HANDOFF.json
  • REQ-SESSION-02: Resume MUST restore full project context from HANDOFF.json (preferred) or state files (fallback)
  • REQ-SESSION-03: Progress MUST show current position, next action, and overall completion
  • REQ-SESSION-04: Progress MUST read all state files (STATE.md, ROADMAP.md, phase directories)
  • REQ-SESSION-05: All session operations MUST work after /clear (context reset)
  • REQ-SESSION-06: HANDOFF.json MUST include blockers, human actions pending, and in-progress task state
  • REQ-SESSION-07: Resume MUST surface human actions and blockers immediately on session start

24. Session Reporting

Command: /gsd-pause-work --report

Purpose: Generate a structured post-session summary document capturing work performed, outcomes achieved, and estimated resource usage.

Requirements:

  • REQ-REPORT-01: System MUST gather data from STATE.md, git log, and plan/summary files
  • REQ-REPORT-02: System MUST include commits made, plans executed, and phases progressed
  • REQ-REPORT-03: System MUST estimate token usage and cost based on session activity
  • REQ-REPORT-04: System MUST include active blockers and decisions made
  • REQ-REPORT-05: System MUST recommend next steps

Produces: .planning/reports/SESSION_REPORT.md

Report Sections:

  • Session overview (duration, milestone, phase)
  • Work performed (commits, plans, phases)
  • Outcomes and deliverables
  • Blockers and decisions
  • Resource estimates (tokens, cost)
  • Next steps recommendation

25. Multi-Agent Orchestration

Purpose: Coordinate specialized agents with fresh context windows for each task.

Requirements:

  • REQ-ORCH-01: Each agent MUST receive a fresh context window
  • REQ-ORCH-02: Orchestrators MUST be thin — spawn agents, collect results, route next
  • REQ-ORCH-03: Context payload MUST include all relevant project artifacts
  • REQ-ORCH-04: Parallel agents MUST be truly independent (no shared mutable state)
  • REQ-ORCH-05: Agent results MUST be written to disk before orchestrator processes them
  • REQ-ORCH-06: Failed agents MUST be detected (spot-check actual output vs reported failure)

26. Model Profiles

Command: /gsd-config --profile <quality|balanced|budget|adaptive|inherit>

Purpose: Control which AI model each agent uses, balancing quality vs cost.

Requirements:

  • REQ-MODEL-01: System MUST support 4 profiles: quality, balanced, budget, inherit
  • REQ-MODEL-02: Each profile MUST define model tier per agent (see profile table)
  • REQ-MODEL-03: Per-agent overrides MUST take precedence over profile
  • REQ-MODEL-04: inherit profile MUST defer to runtime's current model selection
  • REQ-MODEL-04a: inherit profile MUST be used when running non-Anthropic providers (OpenRouter, local models) to avoid unexpected API costs
  • REQ-MODEL-05: Profile switch MUST be programmatic (script, not LLM-driven)
  • REQ-MODEL-06: Model resolution MUST happen once per orchestration, not per spawn

Profile Assignments:

Agent quality balanced budget inherit
gsd-planner Opus Opus Sonnet Inherit
gsd-roadmapper Opus Sonnet Sonnet Inherit
gsd-executor Opus Sonnet Sonnet Inherit
gsd-phase-researcher Opus Sonnet Haiku Inherit
gsd-project-researcher Opus Sonnet Haiku Inherit
gsd-research-synthesizer Sonnet Sonnet Haiku Inherit
gsd-debugger Opus Sonnet Sonnet Inherit
gsd-codebase-mapper Sonnet Haiku Haiku Inherit
gsd-verifier Sonnet Sonnet Haiku Inherit
gsd-plan-checker Sonnet Sonnet Haiku Inherit
gsd-integration-checker Sonnet Sonnet Haiku Inherit
gsd-nyquist-auditor Sonnet Sonnet Haiku Inherit

Brownfield Features

27. Codebase Mapping

Command: /gsd-map-codebase [area]

Purpose: Analyze an existing codebase before starting a new project, so GSD understands what exists.

Requirements:

  • REQ-MAP-01: System MUST spawn parallel mapper agents for each analysis area
  • REQ-MAP-02: System MUST produce structured documents in .planning/codebase/
  • REQ-MAP-03: System MUST detect: tech stack, architecture patterns, coding conventions, concerns
  • REQ-MAP-04: Subsequent /gsd-new-project MUST load codebase mapping and focus questions on what's being added
  • REQ-MAP-05: Optional [area] argument MUST scope mapping to a specific area

Produces:

Document Content
STACK.md Languages, frameworks, databases, infrastructure
ARCHITECTURE.md Patterns, layers, data flow, boundaries
CONVENTIONS.md Naming, file organization, code style, testing patterns
CONCERNS.md Technical debt, security issues, performance bottlenecks
STRUCTURE.md Directory layout and file organization
TESTING.md Test infrastructure, coverage, patterns
INTEGRATIONS.md External services, APIs, third-party dependencies

Incremental remap — --paths (#2003): The mapper accepts an optional --paths <p1,p2,...> scope hint. When provided, it restricts exploration to the listed repo-relative prefixes instead of scanning the whole tree. This is the pathway used by the post-execute codebase-drift gate to refresh only the subtrees the phase actually changed. Each produced document carries last_mapped_commit in its YAML frontmatter so drift can be measured against the mapping point, not HEAD.

27a. Post-Execute Codebase Drift Detection

Introduced by: #2003 Trigger: Runs automatically at the end of every /gsd-execute-phase Configuration:

  • workflow.drift_threshold (integer, default 3) — minimum new structural elements before the gate acts.
  • workflow.drift_action (warn | auto-remap, default warn) — warn-only or spawn gsd-codebase-mapper with --paths scoped to affected subtrees.

What counts as drift:

  • New directory outside mapped paths
  • New barrel export at (packages|apps)/*/src/index.*
  • New migration file (supabase/prisma/drizzle/src/migrations/…)
  • New route module under routes/ or api/

Non-blocking guarantee: any internal failure (missing STRUCTURE.md, git errors, mapper spawn failure) logs a single line and the phase continues. Drift detection cannot fail verification.

Requirements:

  • REQ-DRIFT-01: System MUST detect the four drift categories from git diff --name-status last_mapped_commit..HEAD
  • REQ-DRIFT-02: Action fires only when element count ≥ workflow.drift_threshold
  • REQ-DRIFT-03: warn action MUST NOT spawn any agent
  • REQ-DRIFT-04: auto-remap action MUST pass sanitized --paths to the mapper
  • REQ-DRIFT-05: Detection/remap failure MUST be non-blocking for /gsd-execute-phase
  • REQ-DRIFT-06: last_mapped_commit round-trip through YAML frontmatter on each .planning/codebase/*.md file

Utility Features

28. Debug System

Command: /gsd-debug [description]

Purpose: Systematic debugging with persistent state across context resets.

Requirements:

  • REQ-DEBUG-01: System MUST create debug session file in .planning/debug/
  • REQ-DEBUG-02: System MUST track hypotheses, evidence, and eliminated theories
  • REQ-DEBUG-03: System MUST persist state so debugging survives context resets
  • REQ-DEBUG-04: System MUST require human verification before marking resolved
  • REQ-DEBUG-05: Resolved sessions MUST append to .planning/debug/knowledge-base.md
  • REQ-DEBUG-06: Knowledge base MUST be consulted on new debug sessions to prevent re-investigation

Debug Session States: gathering → investigating → fixing → verifying → awaiting_human_verify → resolved


29. Todo Management

Commands: /gsd-capture [desc], /gsd-capture --list

Purpose: Capture ideas and tasks during sessions for later work.

Requirements:

  • REQ-TODO-01: System MUST capture todo from current conversation context
  • REQ-TODO-02: Todos MUST be stored in .planning/todos/pending/
  • REQ-TODO-03: Completed todos MUST move to .planning/todos/completed/
  • REQ-TODO-04: Check-todos MUST list all pending items with selection to work on one

30. Statistics Dashboard

Command: /gsd-stats

Purpose: Display project metrics — phases, plans, requirements, git history, and timeline.

Requirements:

  • REQ-STATS-01: System MUST show phase/plan completion counts
  • REQ-STATS-02: System MUST show requirement coverage
  • REQ-STATS-03: System MUST show git commit metrics
  • REQ-STATS-04: System MUST support multiple output formats (json, table, bar)

31. Update System

Command: /gsd-update

Purpose: Update GSD to the latest version with changelog preview.

Requirements:

  • REQ-UPDATE-01: System MUST check for new versions via npm
  • REQ-UPDATE-02: System MUST display changelog for new version before updating
  • REQ-UPDATE-03: System MUST be runtime-aware and target the correct directory
  • REQ-UPDATE-04: System MUST back up locally modified files to gsd-local-patches/
  • REQ-UPDATE-05: /gsd-update --reapply MUST restore local modifications after update
  • REQ-UPDATE-06: /gsd-update --next (alias --rc) MUST target the @next RC dist-tag for version check and install; omitting the flag MUST keep @latest behavior unchanged (ADR #660)

32. Settings Management

Command: /gsd-settings

Purpose: Interactive configuration of workflow toggles and model profile.

Requirements:

  • REQ-SETTINGS-01: System MUST present current settings with toggle options
  • REQ-SETTINGS-02: System MUST update .planning/config.json
  • REQ-SETTINGS-03: System MUST support saving as global defaults (~/.gsd/defaults.json)

Configurable Settings:

Setting Type Default Description
mode enum interactive interactive or yolo (auto-approve)
granularity enum standard coarse, standard, or fine
model_profile enum balanced quality, balanced, budget, or inherit
models.<phase_type> enum (none) Per-phase-type tier override (planning, discuss, research, execution, verification, completion). Values: opus, sonnet, haiku, inherit. Coarse phase-level tuning that wins over model_profile but loses to per-agent model_overrides. See CONFIGURATION.md. Added in v1.40
granularities.<phase_type> enum (none) Per-phase-type granularity override (planning, discuss, research, execution, verification, completion). Values: coarse, standard, fine. Mirrors models.<phase_type> for granularity. See CONFIGURATION.md. Added in v1.43 (#68). /gsd:plan-phase --granularity <coarse|standard|fine> overrides all config-based granularity for a single invocation (takes precedence over granularities.planning, top-level granularity, and planning.granularity). (#703)
dynamic_routing.enabled boolean false Master switch for failure-tier escalation. When true, agents resolve to tier_models[default_tier] and escalate one tier on orchestrator-detected soft failure. Capped by max_escalations. See CONFIGURATION.md. Added in v1.40
workflow.research boolean true Domain research before planning
workflow.plan_check boolean true Plan verification loop
workflow.verifier boolean true Post-execution verification
workflow.auto_advance boolean false Auto-chain discuss→plan→execute
workflow.nyquist_validation boolean true Nyquist test coverage mapping
workflow.ui_phase boolean true UI design contract generation
workflow.ui_safety_gate boolean true Prompt for ui-phase on frontend phases
workflow.node_repair boolean true Autonomous task repair
workflow.node_repair_budget number 2 Max repair attempts per task
planning.commit_docs boolean true Commit .planning/ files to git
planning.search_gitignored boolean false Include gitignored files in searches
parallelization.enabled boolean true Run independent plans simultaneously
git.branching_strategy enum none none, phase, or milestone

33. Test Generation

Command: /gsd-add-tests [N]

Purpose: Generate tests for a completed phase based on UAT criteria and implementation.

Requirements:

  • REQ-TEST-01: System MUST analyze completed phase implementation
  • REQ-TEST-02: System MUST generate tests based on UAT criteria and acceptance criteria
  • REQ-TEST-03: System MUST use existing test infrastructure patterns

Infrastructure Features

34. Git Integration

Purpose: Atomic commits, branching strategies, and clean history management.

Requirements:

  • REQ-GIT-01: Each task MUST get its own atomic commit
  • REQ-GIT-02: Commit messages MUST follow structured format: type(scope): description
  • REQ-GIT-03: System MUST support 3 branching strategies: none, phase, milestone
  • REQ-GIT-04: Phase strategy MUST create one branch per phase
  • REQ-GIT-05: Milestone strategy MUST create one branch per milestone
  • REQ-GIT-06: Complete-milestone MUST offer squash merge (recommended) or merge with history
  • REQ-GIT-07: System MUST respect commit_docs setting for .planning/ files
  • REQ-GIT-08: System MUST auto-detect .planning/ in .gitignore and skip commits

Commit Format:

type(phase-plan): description

# Examples:
docs(08-02): complete user registration plan
feat(08-02): add email confirmation flow
fix(03-01): correct auth token expiry

35. CLI Tools

Purpose: Programmatic utilities for workflows and agents, replacing repetitive inline bash patterns.

Requirements:

  • REQ-CLI-01: System MUST provide atomic commands for state, config, phase, roadmap operations
  • REQ-CLI-02: System MUST provide compound init commands that load all context for each workflow
  • REQ-CLI-03: System MUST support --raw flag for machine-readable output
  • REQ-CLI-04: System MUST support --cwd flag for sandboxed subagent operation
  • REQ-CLI-05: All operations MUST use forward-slash paths on Windows

Command Categories: State (11 subcommands), Phase (5), Roadmap (3), Verify (8), Template (2), Frontmatter (4), Scaffold (4), Init (12), Validate (2), Progress, Stats, Todo


36. Multi-Runtime Support

Purpose: Run GSD across multiple AI coding agent runtimes.

Requirements:

  • REQ-RUNTIME-01: System MUST support Claude Code, OpenCode, Gemini CLI, Kilo, Codex, Copilot, Antigravity, Trae, Cline, Augment Code, CodeBuddy, Qwen Code
  • REQ-RUNTIME-02: Installer MUST transform content per runtime (tool names, paths, frontmatter)
  • REQ-RUNTIME-03: Installer MUST support interactive and non-interactive (--claude --global) modes
  • REQ-RUNTIME-04: Installer MUST support both global and local installation
  • REQ-RUNTIME-05: Uninstall MUST cleanly remove all GSD files without affecting other configurations
  • REQ-RUNTIME-06: Installer MUST handle platform differences (Windows, macOS, Linux, WSL, Docker)

Runtime Transformations:

Aspect Claude Code OpenCode Gemini Kilo Codex Copilot Antigravity Cursor Trae Cline Augment CodeBuddy Qwen Code
Commands Slash commands Slash commands Slash commands Slash commands Skills (TOML) Slash commands Skills Skills + Slash commands Skills Rules Skills Skills Skills
Agent format Claude native mode: subagent Claude native mode: subagent Skills Tool mapping Skills Skills Skills Rules Skills Skills Skills
Hook events PostToolUse N/A AfterTool N/A N/A N/A N/A N/A N/A N/A N/A N/A N/A
Config settings.json opencode.json(c) settings.json kilo.json(c) TOML Instructions Config Config Config .clinerules Config Config Config

Cursor artifact surfaces: gsd install --cursor writes two artifact kinds:

  • ~/.cursor/skills/gsd-<name>/SKILL.md — rich skills with YAML frontmatter, Cursor tool-name mapping, and adapter context header (existing surface)
  • ~/.cursor/commands/gsd-<name>.md — plain markdown slash commands (no frontmatter) invocable via / in the Agent input (Cursor 1.6+, added in #785)

Claude Code native plugin distribution: GSD Core ships a .claude-plugin/plugin.json manifest, enabling installation and lifecycle management via claude plugin install|enable|disable|update gsd-core. Commands load under the /gsd-core: namespace (e.g. /gsd-core:plan-phase), avoiding slash-command collisions with the classic npm installer which uses /gsd:. Always-on guard and update hooks are wired automatically via hooks/hooks.json. The plugin path is additive — the npm installer (npx @opengsd/gsd-core) remains fully supported.


37. Hook System

Purpose: Runtime event hooks for context monitoring, status display, and update checking.

Requirements:

  • REQ-HOOK-01: Statusline MUST display model, current task, directory, and context usage
  • REQ-HOOK-02: Context monitor MUST inject agent-facing warnings at threshold levels
  • REQ-HOOK-03: Update checker MUST run in background on session start
  • REQ-HOOK-04: All hooks MUST respect CLAUDE_CONFIG_DIR env var
  • REQ-HOOK-05: All hooks MUST include 3-second stdin timeout guard
  • REQ-HOOK-06: All hooks MUST fail silently on any error
  • REQ-HOOK-07: Context usage MUST normalize for autocompact buffer (16.5% reserved)
  • REQ-HOOK-08: Update banner MUST be opt-in and silent unless an update is available (PR #2795)

Statusline Display:

[⬆ /gsd-update │] model │ [current task │] directory [█████░░░░░ 50%]

Color coding: <50% green, <65% yellow, <80% orange, ≥80% red with skull emoji

Update Banner (opt-in, when GSD statusline isn't used):

When the user declines (or keeps a non-GSD) statusline, the installer offers a SessionStart banner that surfaces update availability without occupying statusline real estate. The banner reads ~/.cache/gsd/gsd-update-check.json (written by gsd-check-update-worker.js) and emits one line only when an update is available:

GSD update available: 1.39.0 → 1.40.0. Run /gsd-update.

The banner is silent when up-to-date and rate-limits "check failed" diagnostics to once per 24 hours. Removed cleanly by npx @opengsd/gsd-core --uninstall or by deleting the SessionStart entry that references gsd-update-banner.js.

38. Developer Profiling

Command: /gsd-profile-user [--questionnaire] [--refresh]

Purpose: Analyze Claude Code session history to build behavioral profiles across 8 dimensions, generating artifacts that personalize Claude's responses to the developer's style.

Dimensions:

  1. Communication style (terse vs verbose, formal vs casual)
  2. Decision patterns (rapid vs deliberate, risk tolerance)
  3. Debugging approach (systematic vs intuitive, log preference)
  4. UX preferences (design sensibility, accessibility awareness)
  5. Vendor/technology choices (framework preferences, ecosystem familiarity)
  6. Frustration triggers (what causes friction in workflows)
  7. Learning style (documentation vs examples, depth preference)
  8. Explanation depth (high-level vs implementation detail)

Generated Artifacts:

  • USER-PROFILE.md — Full behavioral profile with evidence citations
  • CLAUDE.md profile section — Auto-discovered by Claude Code

Flags:

  • --questionnaire — Interactive questionnaire fallback when session history is unavailable
  • --refresh — Re-analyze sessions and regenerate profile

Pipeline Modules:

  • profile-pipeline.cjs — Session scanning, message extraction, sampling
  • profile-output.cjs — Profile rendering, questionnaire, artifact generation
  • gsd-user-profiler agent — Behavioral analysis from session data

Requirements:

  • REQ-PROF-01: Session analysis MUST cover at least 8 behavioral dimensions
  • REQ-PROF-02: Profile MUST cite evidence from actual session messages
  • REQ-PROF-03: Questionnaire MUST be available as fallback when no session history exists
  • REQ-PROF-04: Generated artifacts MUST be discoverable by Claude Code (CLAUDE.md integration)

39. Execution Hardening

Purpose: Three additive quality improvements to the execution pipeline that catch cross-plan failures before they cascade.

Components:

1. Pre-Wave Dependency Check (execute-phase) Before spawning wave N+1, verify key-links from prior wave artifacts exist and are wired correctly. Catches cross-plan dependency gaps before they cascade into downstream failures.

2. Cross-Plan Data Contracts — Dimension 9 (plan-checker) New analysis dimension that checks plans sharing data pipelines have compatible transformations. Flags when one plan strips data that another plan needs in its original form.

3. Export-Level Spot Check (verify-phase) After Level 3 wiring verification passes, spot-check individual exports for actual usage. Catches dead stores that exist in wired files but are never called.

Requirements:

  • REQ-HARD-01: Pre-wave check MUST verify key-links from all prior wave artifacts before spawning next wave
  • REQ-HARD-02: Cross-plan contract check MUST detect incompatible data transformations between plans
  • REQ-HARD-03: Export spot-check MUST identify dead stores in wired files

40. Verification Debt Tracking

Command: /gsd-audit-uat

Purpose: Prevent silent loss of UAT/verification items when projects advance past phases with outstanding tests. Surfaces verification debt across all prior phases so items are never forgotten.

Components:

1. Cross-Phase Health Check (progress.md Step 1.6) Every /gsd-progress call scans ALL phases in the current milestone for outstanding items (pending, skipped, blocked, human_needed). Displays a non-blocking warning section with actionable links.

2. status: partial (verify-work.md, UAT.md) New UAT status that distinguishes between "session ended" and "all tests resolved". Prevents status: complete when tests are still pending, blocked, or skipped without reason.

3. result: blocked with blocked_by tag (verify-work.md, UAT.md) New test result type for tests blocked by external dependencies (server, physical device, release build, third-party services). Categorized separately from skipped tests.

4. HUMAN-UAT.md Persistence (execute-phase.md) When verification returns human_needed, items are persisted as a trackable HUMAN-UAT.md file with status: partial. Feeds into the cross-phase health check and audit systems.

5. Phase Completion Warnings (phase.cjs, transition.md) phase complete CLI returns verification debt warnings in its JSON output. Transition workflow surfaces outstanding items before confirmation.

Requirements:

  • REQ-DEBT-01: System MUST surface outstanding UAT/verification items from ALL prior phases in /gsd-progress
  • REQ-DEBT-02: System MUST distinguish incomplete testing (partial) from completed testing (complete)
  • REQ-DEBT-03: System MUST categorize blocked tests with blocked_by tags
  • REQ-DEBT-04: System MUST persist human_needed verification items as trackable UAT files
  • REQ-DEBT-05: System MUST warn (non-blocking) during phase completion and transition when verification debt exists
  • REQ-DEBT-06: /gsd-audit-uat MUST scan all phases, categorize items by testability, and produce a human test plan

v1.27 Features

41. Fast Mode

Command: /gsd-fast [task description]

Purpose: Execute trivial tasks inline without spawning subagents or generating PLAN.md files. For tasks too small to justify planning overhead: typo fixes, config changes, small refactors, forgotten commits, simple additions.

Requirements:

  • REQ-FAST-01: System MUST execute the task directly in the current context without subagents
  • REQ-FAST-02: System MUST produce an atomic git commit for the change
  • REQ-FAST-03: System MUST track the task in .planning/quick/ for state consistency
  • REQ-FAST-04: System MUST NOT be used for tasks requiring research, multi-step planning, or verification

When to use vs /gsd-quick:

  • /gsd-fast — One-sentence tasks executable in under 2 minutes (typo, config change, small addition)
  • /gsd-quick — Anything needing research, multi-step planning, or verification

42. Cross-AI Peer Review

Command: /gsd-review --phase N [--gemini] [--claude] [--codex] [--coderabbit] [--opencode] [--qwen] [--cursor] [--agy] [--ollama] [--lm-studio] [--llama-cpp] [--all]

Purpose: Invoke external AI CLIs (Gemini, Claude, Codex, CodeRabbit, OpenCode, Qwen Code, Cursor, Antigravity) to independently review phase plans. Produces structured REVIEWS.md with per-reviewer feedback.

Requirements:

  • REQ-REVIEW-01: System MUST detect available AI CLIs on the system
  • REQ-REVIEW-02: System MUST build a structured review prompt from phase plans
  • REQ-REVIEW-03: System MUST invoke each selected CLI independently
  • REQ-REVIEW-04: System MUST collect responses and produce REVIEWS.md
  • REQ-REVIEW-05: Reviews MUST be consumable by /gsd-plan-phase --reviews
  • REQ-REVIEW-06: System MUST support project-level no-flag defaults via review.default_reviewers
  • REQ-REVIEW-07: Reviewer precedence MUST be explicit flags > --all > review.default_reviewers > all detected reviewers

Produces: {phase}-REVIEWS.md — Per-reviewer structured feedback

User configuration note:

  • Set review.default_reviewers in .planning/config.json (or via gsd config-set) to control no-flag /gsd-review fan-out.
  • Use --all for a full pre-merge sweep without changing project defaults.
  • For local model servers with small context windows, set review.max_prompt_tokens_per_reviewer to auto-trim prompts per reviewer — see Prompt budgets for small-context reviewers in CONFIGURATION.md.

43. Backlog Parking Lot

Commands: /gsd-capture --backlog <description>, /gsd-review-backlog, /gsd-capture --seed <idea>

Purpose: Capture ideas that aren't ready for active planning. Backlog items use 999.x numbering to stay outside the active phase sequence. Seeds are forward-looking ideas with trigger conditions that surface automatically at the right milestone.

Requirements:

  • REQ-BACKLOG-01: Backlog items MUST use 999.x numbering to stay outside active phase sequence
  • REQ-BACKLOG-02: Phase directories MUST be created immediately so /gsd-discuss-phase and /gsd-plan-phase work on them
  • REQ-BACKLOG-03: /gsd-review-backlog MUST support promote, keep, and remove actions per item
  • REQ-BACKLOG-04: Promoted items MUST be renumbered into the active milestone sequence
  • REQ-SEED-01: Seeds MUST capture the full WHY and WHEN to surface conditions
  • REQ-SEED-02: /gsd-new-milestone MUST scan seeds and present matches

Produces:

Artifact Description
.planning/phases/999.x-slug/ Backlog item directory
.planning/seeds/SEED-NNN-slug.md Seed with trigger conditions

44. Persistent Context Threads

Command: /gsd-thread [name | description]

Purpose: Lightweight cross-session knowledge stores for work that spans multiple sessions but doesn't belong to any specific phase. Lighter weight than /gsd-pause-work — no phase state, no plan context.

Requirements:

  • REQ-THREAD-01: System MUST support create, list, and resume modes
  • REQ-THREAD-02: Threads MUST be stored in .planning/threads/ as markdown files
  • REQ-THREAD-03: Thread files MUST include Goal, Context, References, and Next Steps sections
  • REQ-THREAD-04: Resuming a thread MUST load its full context into the current session
  • REQ-THREAD-05: Threads MUST be promotable to phases or backlog items

Produces: .planning/threads/{slug}.md — Persistent context thread


45. PR Branch Filtering

Command: /gsd-pr-branch [target branch]

Purpose: Create a clean branch suitable for pull requests by filtering out .planning/ commits. Reviewers see only code changes, not GSD planning artifacts.

Requirements:

  • REQ-PRBRANCH-01: System MUST identify commits that only modify .planning/ files
  • REQ-PRBRANCH-02: System MUST create a new branch with planning commits filtered out
  • REQ-PRBRANCH-03: Code changes MUST be preserved exactly as committed

46. Security Hardening

Purpose: Defense-in-depth security for GSD's planning artifacts. Because GSD generates markdown files that become LLM system prompts, user-controlled text flowing into these files is a potential indirect prompt injection vector.

Components:

1. Centralized Security Module (security.cjs)

  • Path traversal prevention — validates file paths resolve within the project directory
  • Prompt injection detection — scans for known injection patterns in user-supplied text
  • Safe JSON parsing — catches malformed input before state corruption
  • Field name validation — prevents injection through config field names
  • Shell argument validation — sanitizes user text before shell interpolation

2. Prompt Injection Guard Hook (gsd-prompt-guard.js) PreToolUse hook that scans Write/Edit calls targeting .planning/ for injection patterns. Advisory-only — logs detection for awareness without blocking legitimate operations.

3. Workflow Guard Hook (gsd-workflow-guard.js) PreToolUse hook that detects when Claude attempts file edits outside a GSD workflow context. Advises using /gsd-quick or /gsd-fast instead of direct edits. Configurable via hooks.workflow_guard (default: false).

4. CI-Ready Injection Scanner (prompt-injection-scan.test.cjs) Test suite that scans all agent, workflow, and command files for embedded injection vectors.

Requirements:

  • REQ-SEC-01: All user-supplied file paths MUST be validated against the project directory
  • REQ-SEC-02: Prompt injection patterns MUST be detected before text enters planning artifacts
  • REQ-SEC-03: Security hooks MUST be advisory-only (never block legitimate operations)
  • REQ-SEC-04: JSON parsing of user input MUST catch malformed data gracefully
  • REQ-SEC-05: macOS /var → /private/var symlink resolution MUST be handled in path validation

47. Multi-Repo Workspace Support

Purpose: Auto-detection and project root resolution for monorepos and multi-repo setups. Supports workspaces where .planning/ may need to resolve across repository boundaries.

Requirements:

  • REQ-MULTIREPO-01: System MUST auto-detect multi-repo workspace configuration
  • REQ-MULTIREPO-02: System MUST resolve project root across repository boundaries
  • REQ-MULTIREPO-03: Executor MUST record per-repo commit hashes in multi-repo mode

48. Discussion Audit Trail

Purpose: Auto-generate DISCUSSION-LOG.md during /gsd-discuss-phase for full audit trail of decisions made during discussion.

Requirements:

  • REQ-DISCLOG-01: System MUST auto-generate DISCUSSION-LOG.md during discuss-phase
  • REQ-DISCLOG-02: Log MUST capture questions asked, options presented, and decisions made
  • REQ-DISCLOG-03: Decision IDs MUST enable traceability from discuss-phase to plan-phase

v1.28 Features

49. Forensics

Command: /gsd-forensics [description]

Purpose: Post-mortem investigation of failed or stuck GSD workflows.

Requirements:

  • REQ-FORENSICS-01: System MUST analyze git history for anomalies (stuck loops, long gaps, repeated commits)
  • REQ-FORENSICS-02: System MUST check artifact integrity (completed phases have expected files)
  • REQ-FORENSICS-03: System MUST generate a markdown report saved to .planning/forensics/
  • REQ-FORENSICS-04: System MUST offer to create a GitHub issue with findings
  • REQ-FORENSICS-05: System MUST NOT modify project files (read-only investigation)

Produces:

Artifact Description
.planning/forensics/report-{timestamp}.md Post-mortem investigation report

Process:

  1. Scan — Analyze git history for anomalies: stuck loops, long gaps between commits, repeated identical commits
  2. Integrity Check — Verify completed phases have expected artifact files
  3. Report — Generate markdown report with findings, saved to .planning/forensics/
  4. Issue — Offer to create a GitHub issue with findings for team visibility

50. Milestone Summary

Command: /gsd-milestone-summary [version]

Purpose: Generate comprehensive project summary from milestone artifacts for team onboarding.

Requirements:

  • REQ-SUMMARY-01: System MUST aggregate phase plans, summaries, and verification results
  • REQ-SUMMARY-02: System MUST work for both current and archived milestones
  • REQ-SUMMARY-03: System MUST produce a single navigable document

Produces:

Artifact Description
MILESTONE-SUMMARY.md Comprehensive navigable summary of milestone artifacts

Process:

  1. Collect — Aggregate phase plans, summaries, and verification results from the target milestone
  2. Synthesize — Combine artifacts into a single navigable document with cross-references
  3. Output — Write MILESTONE-SUMMARY.md suitable for team onboarding and stakeholder review

51. Workstream Namespacing

Command: /gsd-workstreams

Purpose: Parallel workstreams for concurrent work on different milestone areas.

Requirements:

  • REQ-WS-01: System MUST isolate workstream state in separate .planning/workstreams/{name}/ directories
  • REQ-WS-02: System MUST validate workstream names (alphanumeric + hyphens only, no path traversal)
  • REQ-WS-03: System MUST support list, create, switch, status, progress, complete, resume subcommands

Produces:

Artifact Description
.planning/workstreams/{name}/ Isolated workstream directory structure

Process:

  1. Create — Initialize a named workstream with isolated .planning/workstreams/{name}/ directory
  2. Switch — Change active workstream context for subsequent GSD commands
  3. Manage — List, check status, track progress, complete, or resume workstreams

52. Manager Dashboard

Command: /gsd-manager

Purpose: Interactive command center for managing multiple phases from one terminal.

Requirements:

  • REQ-MGR-01: System MUST show overview of all phases with status
  • REQ-MGR-02: System MUST filter to current milestone scope
  • REQ-MGR-03: System MUST show phase dependencies and conflicts

Produces: Interactive terminal output

Process:

  1. Scan — Load all phases in the current milestone with their statuses
  2. Display — Render overview showing phase dependencies, conflicts, and progress
  3. Interact — Accept commands to navigate, inspect, or act on individual phases

53. Assumptions Discussion Mode

Command: /gsd-discuss-phase with workflow.discuss_mode: 'assumptions'

Purpose: Replace interview-style questioning with codebase-first assumption analysis.

Requirements:

  • REQ-ASSUME-01: System MUST analyze codebase to generate structured assumptions before asking questions
  • REQ-ASSUME-02: System MUST classify assumptions by confidence level (Confident/Likely/Unclear)
  • REQ-ASSUME-03: System MUST produce identical CONTEXT.md format as default discuss mode
  • REQ-ASSUME-04: System MUST support confidence-based skip gate (all HIGH = no questions)

Produces:

Artifact Description
{phase}-CONTEXT.md Same format as default discuss mode

Process:

  1. Analyze — Scan codebase to generate structured assumptions about implementation approach
  2. Classify — Categorize assumptions by confidence level: Confident, Likely, Unclear
  3. Gate — If all assumptions are HIGH confidence, skip questioning entirely
  4. Confirm — Present unclear assumptions as targeted questions to the user
  5. Output — Produce {phase}-CONTEXT.md in identical format to default discuss mode

54. UI Phase Auto-Detection

Part of: /gsd-new-project and /gsd-progress

Purpose: Automatically detect UI-heavy projects and surface /gsd-ui-phase recommendation.

Requirements:

  • REQ-UI-DETECT-01: System MUST detect UI signals in project description (keywords, framework references)
  • REQ-UI-DETECT-02: System MUST annotate ROADMAP.md phases with ui_hint when applicable
  • REQ-UI-DETECT-03: System MUST suggest /gsd-ui-phase in next steps for UI-heavy phases
  • REQ-UI-DETECT-04: System MUST NOT make /gsd-ui-phase mandatory

Process:

  1. Detect — Scan project description and tech stack for UI signals (keywords, framework references)
  2. Annotate — Add ui_hint markers to applicable phases in ROADMAP.md
  3. Surface — Include /gsd-ui-phase recommendation in next steps for UI-heavy phases

55. Multi-Runtime Installer Selection

Part of: npx @opengsd/gsd-core

Purpose: Select multiple runtimes in a single interactive install session.

Requirements:

  • REQ-MULTI-RT-01: Interactive prompt MUST support multi-select (e.g., Claude Code + Gemini)
  • REQ-MULTI-RT-02: CLI flags MUST continue to work for non-interactive installs

Process:

  1. Detect — Identify available AI CLI runtimes on the system
  2. Prompt — Present multi-select interface for runtime selection
  3. Install — Configure GSD for all selected runtimes in a single session

v1.29 Features

56. Windsurf Runtime Support

Part of: npx @opengsd/gsd-core

Purpose: Add Windsurf as a supported AI CLI runtime for GSD installation and execution.

Requirements:

  • REQ-WINDSURF-01: Installer MUST detect Windsurf runtime and offer it as a target
  • REQ-WINDSURF-02: GSD commands MUST function correctly within Windsurf sessions

Process:

  1. Detect — Identify Windsurf runtime availability on the system
  2. Install — Configure GSD skills and hooks for the Windsurf environment

57. Internationalized Documentation

Part of: docs/

Purpose: Provide GSD documentation in Portuguese, Korean, and Japanese.

Requirements:

  • REQ-I18N-01: Documentation MUST be available in Portuguese (pt), Korean (ko), and Japanese (ja)
  • REQ-I18N-02: Translations MUST stay synchronized with English source documents

Process:

  1. Translate — Convert core documentation into target languages
  2. Publish — Make translated documentation accessible alongside English originals

v1.31 Features

59. Schema Drift Detection

Command: Automatic during /gsd-execute-phase

Purpose: Detect when ORM schema files are modified without corresponding migration or push commands, preventing false-positive verification.

Requirements:

  • REQ-SCHEMA-01: System MUST detect modifications to ORM schema files (Prisma, Drizzle, Payload, Sanity, Mongoose)
  • REQ-SCHEMA-02: System MUST verify corresponding migration/push commands exist when schema changes are detected
  • REQ-SCHEMA-03: System MUST implement two-layer defense: plan-time injection and execute-time gate
  • REQ-SCHEMA-04: System MUST support GSD_SKIP_SCHEMA_CHECK env var to override detection
  • REQ-SCHEMA-05: System MUST prevent false-positive verification when schema is modified without migration

Process:

  1. Detect — Monitor ORM schema file modifications during plan execution
  2. Verify — Check that corresponding migration/push commands are present in the plan
  3. Gate — Block execution if schema drift is detected without migration (execute-time gate)
  4. Inject — Add migration reminders during plan generation (plan-time injection)

Config: GSD_SKIP_SCHEMA_CHECK environment variable to bypass detection.


60. Security Enforcement

Command: /gsd-secure-phase <N>

Purpose: Threat-model-anchored security verification for phase implementations.

Requirements:

  • REQ-SEC-01: System MUST perform threat-model-anchored verification (not blind scanning)
  • REQ-SEC-02: System MUST support configurable OWASP ASVS verification levels (1-3)
  • REQ-SEC-03: System MUST block phase advancement based on configurable severity threshold
  • REQ-SEC-04: System MUST spawn gsd-security-auditor agent for analysis

Produces:

Artifact Description
Security audit report Threat-model-anchored findings with severity classification

Process:

  1. Model — Build threat model from phase implementation context
  2. Audit — Spawn gsd-security-auditor to verify against threat model
  3. Gate — Block phase advancement if findings meet or exceed security_block_on severity

Config:

Setting Type Default Description
security_enforcement boolean true Enable threat-model security verification
security_asvs_level number (1-3) 1 OWASP ASVS verification level
security_block_on string "high" Minimum severity to block phase advancement

61. Documentation Generation

Command: /gsd-docs-update

Purpose: Generate and verify project documentation with accuracy checks.

Requirements:

  • REQ-DOCS-01: System MUST spawn gsd-doc-writer agent to generate documentation
  • REQ-DOCS-02: System MUST spawn gsd-doc-verifier agent to check accuracy
  • REQ-DOCS-03: System MUST verify generated documentation against actual implementation

Produces:

Artifact Description
Updated project documentation Generated and verified documentation files

Process:

  1. Generate — Spawn gsd-doc-writer to create or update documentation from implementation
  2. Verify — Spawn gsd-doc-verifier to check documentation accuracy against codebase
  3. Output — Produce verified documentation with accuracy annotations

62. Discuss Chain Mode

Flag: /gsd-discuss-phase <N> --chain

Purpose: Auto-chain discuss, plan, and execute phases in one flow to reduce manual command sequencing.

Requirements:

  • REQ-CHAIN-01: System MUST auto-chain discuss → plan → execute when --chain flag is provided
  • REQ-CHAIN-02: System MUST respect all gate settings between chained phases
  • REQ-CHAIN-03: System MUST halt the chain if any phase fails

Process:

  1. Discuss — Run discuss-phase to gather context
  2. Plan — Automatically invoke plan-phase with gathered context
  3. Execute — Automatically invoke execute-phase with generated plan

63. Single-Phase Autonomous

Flag: /gsd-autonomous --only N

Purpose: Execute just one phase autonomously instead of all remaining phases.

Requirements:

  • REQ-ONLY-01: System MUST execute only the specified phase number when --only N is provided
  • REQ-ONLY-02: System MUST follow the same discuss → plan → execute flow as full autonomous mode
  • REQ-ONLY-03: System MUST stop after the specified phase completes

Process:

  1. Select — Identify the target phase from --only N argument
  2. Execute — Run full autonomous flow (discuss → plan → execute) for that single phase
  3. Stop — Halt after the phase completes instead of advancing to the next

64. Scope Reduction Detection

Part of: /gsd-plan-phase

Purpose: Prevent silent requirement dropping during plan generation with three-layer defense.

Requirements:

  • REQ-SCOPE-01: System MUST prohibit planners from reducing scope without explicit justification
  • REQ-SCOPE-02: System MUST have plan-checker verify requirement dimension coverage
  • REQ-SCOPE-03: System MUST have orchestrator recover dropped requirements and re-inject them
  • REQ-SCOPE-04: System MUST implement three-layer defense: planner prohibition, checker dimension, orchestrator recovery

Process:

  1. Prohibit — Planner instructions explicitly forbid scope reduction
  2. Check — Plan-checker verifies all phase requirements are covered in the plan
  3. Recover — Orchestrator detects dropped requirements and re-injects them into the planning loop

65. Claim Provenance Tagging

Part of: /gsd-plan-phase --research-phase <N>

Purpose: Ensure research claims are tagged with source evidence and assumptions are logged separately.

Requirements:

  • REQ-PROVENANCE-01: Researcher MUST mark claims with source evidence references
  • REQ-PROVENANCE-02: Assumptions MUST be logged separately from sourced claims
  • REQ-PROVENANCE-03: System MUST distinguish between evidenced facts and inferred assumptions

Process:

  1. Research — Researcher gathers information from codebase and domain sources
  2. Tag — Each claim is annotated with its source (file path, documentation, API response)
  3. Separate — Assumptions without direct evidence are logged in a distinct section

66. Worktree Toggle

Config: workflow.use_worktrees: false

Purpose: Disable git worktree isolation for users who prefer sequential execution.

Requirements:

  • REQ-WORKTREE-01: System MUST respect workflow.use_worktrees setting when deciding isolation strategy
  • REQ-WORKTREE-02: System MUST default to true (worktrees enabled) for backward compatibility
  • REQ-WORKTREE-03: System MUST fall back to sequential execution when worktrees are disabled

Config:

Setting Type Default Description
workflow.use_worktrees boolean true When false, disables git worktree isolation

67. Project Code Prefixing

Config: project_code: "ABC"

Purpose: Prefix phase directory names with a project code for multi-project disambiguation.

Requirements:

  • REQ-PREFIX-01: System MUST prefix phase directories with project code when configured (e.g., ABC-01-setup/)
  • REQ-PREFIX-02: System MUST use standard naming when project_code is not set
  • REQ-PREFIX-03: System MUST apply prefix consistently across all phase operations

Config:

Setting Type Default Description
project_code string (none) Prefix for phase directory names

68. Claude Code Skills Migration

Part of: npx @opengsd/gsd-core

Purpose: Migrate GSD commands to Claude Code 2.1.88+ skills format with backward compatibility.

Requirements:

  • REQ-SKILLS-01: Installer MUST write skills/gsd-*/SKILL.md for Claude Code 2.1.88+
  • REQ-SKILLS-02: Installer MUST auto-clean legacy commands/gsd/ directory
  • REQ-SKILLS-03: Installer MUST maintain backward compatibility with older Claude Code versions via Gemini path

Process:

  1. Detect — Check Claude Code version to determine skills support
  2. Migrate — Write skills/gsd-*/SKILL.md files for each GSD command
  3. Clean — Remove legacy commands/gsd/ directory if skills are installed
  4. Fallback — Maintain Gemini path compatibility for older Claude Code versions

v1.32 Features

69. STATE.md Consistency Gates

Commands: state validate, state sync [--verify], state planned-phase --phase N --plans N

Purpose: Detect and repair drift between STATE.md and the actual filesystem, preventing cascading errors from stale state.

Requirements:

  • REQ-STATE-01: state validate MUST detect drift between STATE.md fields and filesystem reality
  • REQ-STATE-02: state sync MUST reconstruct STATE.md from actual project state on disk
  • REQ-STATE-03: state sync --verify MUST perform a dry-run showing proposed changes without writing
  • REQ-STATE-04: state planned-phase MUST record the state transition after plan-phase completes (Planned/Ready to execute)

Produces:

Artifact Description
Updated STATE.md Corrected state reflecting filesystem reality

Process:

  1. Validate — Compare STATE.md fields against filesystem (phase directories, plan files, summaries)
  2. Sync — Reconstruct STATE.md from disk when drift is detected
  3. Transition — Record post-planning state with plan count for execute-phase readiness

70. Autonomous --to N Flag

Flag: /gsd-autonomous --to N

Purpose: Stop autonomous execution after completing a specific phase, allowing partial autonomous runs.

Requirements:

  • REQ-TO-01: System MUST stop execution after the specified phase number completes
  • REQ-TO-02: System MUST follow the same discuss -> plan -> execute flow for each phase up to N
  • REQ-TO-03: --to N MUST be combinable with --from N for bounded autonomous ranges

Process:

  1. Bound — Set the upper phase limit from --to N argument
  2. Execute — Run autonomous flow for each phase up to and including phase N
  3. Stop — Halt after phase N completes

71. Research Gate

Part of: /gsd-plan-phase

Purpose: Block planning when RESEARCH.md has unresolved open questions, preventing plans built on incomplete information.

Requirements:

  • REQ-RESGATE-01: System MUST scan RESEARCH.md for unresolved open questions before planning begins
  • REQ-RESGATE-02: System MUST block plan-phase entry when open questions exist
  • REQ-RESGATE-03: System MUST surface the specific unresolved questions to the user

Process:

  1. Scan — Check RESEARCH.md for open questions section with unresolved items
  2. Gate — Block planning if unresolved questions are found
  3. Surface — Display the specific open questions requiring resolution

72. Verifier Milestone Scope Filtering

Part of: /gsd-execute-phase (verifier step)

Purpose: Distinguish between genuine gaps and items deferred to later phases, reducing false negatives in verification.

Requirements:

  • REQ-VSCOPE-01: Verifier MUST check whether a gap is addressed in a later milestone phase
  • REQ-VSCOPE-02: Gaps addressed in later phases MUST be marked as "deferred", not "gap"
  • REQ-VSCOPE-03: Only genuine gaps (not covered by any future phase) MUST be reported as failures

Process:

  1. Verify — Run standard goal-backward verification
  2. Filter — Cross-reference detected gaps against later milestone phases
  3. Classify — Mark deferred items separately from genuine gaps

73. Read-Before-Edit Guard Hook

Part of: Hooks (PreToolUse)

Purpose: Prevent infinite retry loops in non-Claude runtimes by ensuring files are read before editing.

Requirements:

  • REQ-RBE-01: Hook MUST detect Edit/Write tool calls that target files not previously read in the session
  • REQ-RBE-02: Hook MUST advise reading the file first (advisory, non-blocking)
  • REQ-RBE-03: Hook MUST prevent infinite retry loops common in runtimes without built-in read-before-edit enforcement

74. Context Reduction

Part of: prompt assembly pipeline

Purpose: Reduce context prompt sizes through markdown truncation and cache-friendly prompt ordering.

Requirements:

  • REQ-CTXRED-01: System MUST truncate oversized markdown artifacts to fit within context budgets
  • REQ-CTXRED-02: System MUST order prompts for cache-friendly assembly (stable prefixes first)
  • REQ-CTXRED-03: Reduction MUST preserve essential information (headings, requirements, task structure)
  • REQ-CTXRED-04: Skill description: fields MUST be ≤ 100 chars; enforced by npm run lint:descriptions (see scripts/lint-descriptions.cjs and tests/enh-2789-description-budget.test.cjs)

Process:

  1. Measure — Calculate total prompt size for the workflow
  2. Truncate — Apply markdown-aware truncation to oversized artifacts
  3. Order — Arrange prompt sections for optimal KV-cache reuse

75. Discuss-Phase --power Flag

Flag: /gsd-discuss-phase --power

Purpose: File-based bulk question answering for discuss-phase, enabling batch input from a prepared answers file.

Requirements:

  • REQ-POWER-01: System MUST accept a file containing pre-written answers to discussion questions
  • REQ-POWER-02: System MUST map answers to the corresponding gray area questions
  • REQ-POWER-03: System MUST produce CONTEXT.md identical to interactive discuss-phase

76. Debug --diagnose Flag

Flag: /gsd-debug --diagnose

Purpose: Diagnosis-only mode that investigates without attempting fixes.

Requirements:

  • REQ-DIAG-01: System MUST perform full debug investigation (hypotheses, evidence, root cause)
  • REQ-DIAG-02: System MUST NOT attempt any code modifications
  • REQ-DIAG-03: System MUST produce a diagnostic report with findings and recommended fixes

77. Phase Dependency Analysis

Command: /gsd-manager --analyze-deps

Purpose: Detect phase dependencies and suggest Depends on entries for ROADMAP.md before running /gsd-manager.

Requirements:

  • REQ-DEP-01: System MUST detect file overlap between phases
  • REQ-DEP-02: System MUST detect semantic dependencies (API/schema producers and consumers)
  • REQ-DEP-03: System MUST detect data flow dependencies (output producers and readers)
  • REQ-DEP-04: System MUST suggest dependency entries with user confirmation before writing

Produces: Dependency suggestion table; optionally updates ROADMAP.md Depends on fields


78. Anti-Pattern Severity Levels

Part of: /gsd-resume-work

Purpose: Mandatory understanding checks at resume with severity-based anti-pattern enforcement.

Requirements:

  • REQ-ANTI-01: System MUST classify anti-patterns by severity level
  • REQ-ANTI-02: System MUST enforce mandatory understanding checks at session resume
  • REQ-ANTI-03: Higher severity anti-patterns MUST block workflow progression until acknowledged

79. Methodology Artifact Type

Part of: Planning artifacts

Purpose: Define consumption mechanisms for methodology documents, ensuring they are consumed correctly by agents.

Requirements:

  • REQ-METHOD-01: System MUST support methodology as a distinct artifact type
  • REQ-METHOD-02: Methodology artifacts MUST have defined consumption mechanisms for agents

80. Planner Reachability Check

Part of: /gsd-plan-phase

Purpose: Validate that plan steps are achievable before committing to execution.

Requirements:

  • REQ-REACH-01: Planner MUST validate that each plan step references reachable files and APIs
  • REQ-REACH-02: Unreachable steps MUST be flagged during planning, not discovered during execution

81. Playwright-MCP UI Verification

Part of: /gsd-verify-work (optional)

Purpose: Automated visual verification using Playwright-MCP during verify-phase.

Requirements:

  • REQ-PLAY-01: System MUST support optional Playwright-MCP visual verification during verify-phase
  • REQ-PLAY-02: Visual verification MUST be opt-in, not mandatory
  • REQ-PLAY-03: System MUST capture and compare visual state against UI-SPEC.md expectations

82. Pause-Work Expansion

Part of: /gsd-pause-work

Purpose: Support non-phase contexts with richer handoff data for broader pause-work applicability.

Requirements:

  • REQ-PAUSE-01: System MUST support pausing in non-phase contexts (quick tasks, debug sessions, threads)
  • REQ-PAUSE-02: Handoff data MUST include richer context appropriate to the current work type

83. Response Language Config

Config: response_language

Purpose: Cross-phase language consistency for non-English users.

Requirements:

  • REQ-LANG-01: System MUST respect response_language setting across all phases and agents
  • REQ-LANG-02: Setting MUST propagate to all spawned agents for consistent language output

Config:

Setting Type Default Description
response_language string (none) Language code for agent responses (e.g., "pt", "ko", "ja")

84. Manual Update Procedure

Part of: docs/manual-update.md

Purpose: Document a manual update path for environments where npx is unavailable or npm publish is experiencing outages.

Requirements:

  • REQ-MANUAL-01: Documentation MUST describe step-by-step manual update procedure
  • REQ-MANUAL-02: Procedure MUST work without npm access

85. New Runtime Support (Trae, Cline, Augment Code)

Part of: npx @opengsd/gsd-core

Purpose: Extend GSD installation to Trae IDE, Cline, and Augment Code runtimes.

Requirements:

  • REQ-TRAE-01: Installer MUST support --trae flag for Trae IDE installation
  • REQ-CLINE-01: Installer MUST support Cline via .clinerules configuration
  • REQ-AUGMENT-01: Installer MUST support Augment Code with skill conversion and config management

86. Autonomous --interactive Flag

Flag: /gsd-autonomous --interactive

Purpose: Lean-context autonomous mode that keeps discuss-phase interactive (user answers questions) while dispatching plan and execute as background agents.

Requirements:

  • REQ-INTERACT-01: --interactive MUST run discuss-phase inline with interactive questions (not auto-answered)
  • REQ-INTERACT-02: --interactive MUST dispatch plan-phase and execute-phase as background agents for context isolation
  • REQ-INTERACT-03: --interactive MUST enable pipeline parallelism — discuss Phase N+1 while Phase N builds
  • REQ-INTERACT-04: Main context MUST only accumulate discuss conversations (lean context)

Process:

  1. Discuss inline — Run discuss-phase in the main context with user interaction
  2. Dispatch — Send plan and execute to background agents with fresh context windows
  3. Pipeline — While background agents build Phase N, begin discussing Phase N+1

87. Commit-Docs Guard Hook

Hook: gsd-commit-docs.js

Purpose: PreToolUse hook that enforces the commit_docs configuration, preventing .planning/ files from being committed when planning.commit_docs is false.

Requirements:

  • REQ-COMMITDOCS-01: Hook MUST intercept git commit commands that stage .planning/ files
  • REQ-COMMITDOCS-02: Hook MUST block commits containing .planning/ files when commit_docs is false
  • REQ-COMMITDOCS-03: Hook MUST be advisory — does not block when commit_docs is true or absent

88. Community Hooks Opt-In

Hooks: gsd-validate-commit.sh, gsd-session-state.sh, gsd-phase-boundary.sh

Purpose: Optional git and session hooks for GSD projects, gated behind hooks.community: true in config.

Requirements:

  • REQ-COMMUNITY-01: All community hooks MUST be no-ops unless hooks.community is true in .planning/config.json
  • REQ-COMMUNITY-02: gsd-validate-commit.sh MUST enforce Conventional Commits format on git commit messages
  • REQ-COMMUNITY-03: gsd-session-state.sh MUST track session state transitions
  • REQ-COMMUNITY-04: gsd-phase-boundary.sh MUST enforce phase boundary checks

Config:

Setting Type Default Description
hooks.community boolean false Enable optional community hooks for commit validation, session state, and phase boundaries

v1.34.0 Features


89. Global Learnings Store

Commands: Auto-triggered at phase completion; consumed by planner Config: features.global_learnings

Purpose: Persist cross-session, cross-project learnings in a global store so the planner agent can learn from patterns across the entire project history — not just the current session.

Requirements:

  • REQ-LEARN-01: Learnings MUST be auto-copied from .planning/ to the global store at phase completion
  • REQ-LEARN-02: The planner agent MUST receive relevant learnings at spawn time via injection
  • REQ-LEARN-03: Injection MUST be capped by learnings.max_inject to avoid context bloat
  • REQ-LEARN-04: Feature MUST be opt-in via features.global_learnings: true

Config:

Setting Type Default Description
features.global_learnings boolean false Enable cross-project learnings pipeline
learnings.max_inject number (system default) Maximum learnings entries injected into planner

90. Queryable Codebase Intelligence

Command: /gsd-map-codebase --query [<term>|status|diff|refresh] Config: intel.enabled

Purpose: Maintain a queryable JSON index of codebase structure, API surface, dependency graph, file roles, and architecture decisions in .planning/intel/. Enables targeted lookups without reading the entire codebase.

Requirements:

  • REQ-INTEL-01: Intel files MUST be stored as JSON in .planning/intel/
  • REQ-INTEL-02: query mode MUST search across all intel files for a term and group results by file
  • REQ-INTEL-03: status mode MUST report freshness (FRESH/STALE, stale threshold: 24 hours)
  • REQ-INTEL-04: diff mode MUST compare current intel state to the last snapshot
  • REQ-INTEL-05: refresh mode MUST spawn the intel-updater agent to rebuild all files
  • REQ-INTEL-06: Feature MUST be opt-in via intel.enabled: true

Intel files produced:

File Contents
stack.json Technology stack and dependencies
api-map.json Exported functions and API surface
dependency-graph.json Inter-module dependency relationships
file-roles.json Role classification for each source file
arch-decisions.json Detected architecture decisions

91. Execution Context Profiles

Config: context_profile

Purpose: Select a pre-configured execution context (mode, model, workflow settings) tuned for a specific type of work without manually adjusting individual settings.

Requirements:

  • REQ-CTX-01: dev profile MUST optimize for iterative development (balanced model, plan_check enabled)
  • REQ-CTX-02: research profile MUST optimize for research-heavy work (higher model tier, research enabled)
  • REQ-CTX-03: review profile MUST optimize for code review work (verifier and code_review enabled)

Available profiles: dev, research, review

Config:

Setting Type Default Description
context_profile string (none) Execution context preset: dev, research, or review

92. Gates Taxonomy

References: gsd-core/references/gates.md Agents: plan-checker, verifier

Purpose: Define 4 canonical gate types that structure all workflow decision points, enabling plan-checker and verifier agents to apply consistent gate logic.

Gate types:

Type Description
Confirm User approves before proceeding (e.g., roadmap review)
Quality Automated quality check must pass (e.g., plan verification loop)
Safety Hard stop on detected risk or policy violation
Transition Phase or milestone boundary acknowledgment

Requirements:

  • REQ-GATES-01: plan-checker MUST classify each checkpoint as one of the 4 gate types
  • REQ-GATES-02: verifier MUST apply gate logic appropriate to the gate type
  • REQ-GATES-03: Hard stop safety gates MUST never be bypassed by --auto flags

93. Code Review Pipeline

Commands: /gsd-code-review, /gsd-code-review --fix

Purpose: Structured review of source files changed during a phase, with a separate auto-fix pass that commits each fix atomically.

Requirements:

  • REQ-REVIEW-01: gsd-code-review MUST scope files to the phase using SUMMARY.md and git diff fallback
  • REQ-REVIEW-02: Review MUST support three depth levels: quick, standard, deep
  • REQ-REVIEW-03: Findings MUST be severity-classified: Critical, Warning, Info
  • REQ-REVIEW-04: gsd-code-review --fix MUST read REVIEW.md and fix Critical + Warning findings by default
  • REQ-REVIEW-05: Each fix MUST be committed atomically with a descriptive message
  • REQ-REVIEW-06: --auto flag MUST enable fix + re-review iteration loop, capped at 3 iterations
  • REQ-REVIEW-07: Feature MUST be gated by workflow.code_review config flag

Config:

Setting Type Default Description
workflow.code_review boolean true Enable code review commands
workflow.code_review_depth string standard Default review depth: quick, standard, or deep

94. Socratic Exploration

Command: /gsd-explore [topic]

Purpose: Guide a developer through exploring an idea via Socratic probing questions before committing to a plan. Routes outputs to the appropriate GSD artifact: notes, todos, seeds, research questions, requirements updates, or a new phase.

Requirements:

  • REQ-EXPLORE-01: Exploration MUST use Socratic probing — ask questions before proposing solutions
  • REQ-EXPLORE-02: Session MUST offer to route outputs to the appropriate GSD artifact
  • REQ-EXPLORE-03: An optional topic argument MUST prime the first question
  • REQ-EXPLORE-04: Exploration MUST optionally spawn a research agent for technical feasibility

95. Safe Undo

Command: /gsd-undo --last N | --phase NN | --plan NN-MM

Purpose: Roll back GSD phase or plan commits safely using the phase manifest and git log, with dependency checks and a hard confirmation gate before any revert is applied.

Requirements:

  • REQ-UNDO-01: --phase mode MUST identify all commits for the phase via manifest and git log fallback
  • REQ-UNDO-02: --plan mode MUST identify all commits for a specific plan
  • REQ-UNDO-03: --last N mode MUST display recent GSD commits for interactive selection
  • REQ-UNDO-04: System MUST check for dependent phases/plans before reverting
  • REQ-UNDO-05: A confirmation gate MUST be shown before any git revert is executed

96. Plan Import

Command: /gsd-import --from <filepath>

Purpose: Ingest an external plan file into the GSD planning system with conflict detection against PROJECT.md decisions, converting it to a valid GSD PLAN.md and validating it through the plan-checker.

Requirements:

  • REQ-IMPORT-01: Importer MUST detect conflicts between the external plan and existing PROJECT.md decisions
  • REQ-IMPORT-02: All detected conflicts MUST be presented to the user for resolution before writing
  • REQ-IMPORT-03: Imported plan MUST be written as a valid GSD PLAN.md format
  • REQ-IMPORT-04: Written plan MUST pass gsd-plan-checker validation

97. Rapid Codebase Scan

Command: /gsd-map-codebase --fast [--focus tech|arch|quality|concerns]

Purpose: Lightweight alternative to /gsd-map-codebase that spawns a single mapper agent for one or two combined focus areas, producing targeted output in .planning/codebase/ without the overhead of 4 parallel agents.

Requirements:

  • REQ-SCAN-01: Scan MUST spawn exactly one mapper agent (not four parallel agents)
  • REQ-SCAN-02: Focus area MUST be one of: tech, arch, quality, concerns, or the combined tech+arch shorthand (default: tech+arch); combined focus runs as a single agent covering both areas in one pass
  • REQ-SCAN-03: Output MUST be written to .planning/codebase/ in the same format as /gsd-map-codebase

98. Autonomous Audit-to-Fix

Command: /gsd-audit-fix [--source <audit>] [--severity high|medium|all] [--max N] [--dry-run]

Purpose: End-to-end pipeline that runs an audit, classifies findings as auto-fixable vs. manual-only, then autonomously fixes auto-fixable issues with test verification and atomic commits.

Requirements:

  • REQ-AUDITFIX-01: Findings MUST be classified as auto-fixable or manual-only before any changes
  • REQ-AUDITFIX-02: Each fix MUST be verified with tests before committing
  • REQ-AUDITFIX-03: Each fix MUST be committed atomically
  • REQ-AUDITFIX-04: --dry-run MUST show classification table without applying any fixes
  • REQ-AUDITFIX-05: --max N MUST limit the number of fixes applied in one run (default: 5)

99. Improved Prompt Injection Scanner

Hook: gsd-prompt-guard.js Script: scripts/prompt-injection-scan.sh

Purpose: Enhanced detection of prompt injection attempts in planning artifacts, adding invisible Unicode character detection, encoding obfuscation patterns, and entropy-based analysis.

Requirements:

  • REQ-SCAN-INJ-01: Scanner MUST detect invisible Unicode characters (zero-width spaces, soft hyphens, etc.)
  • REQ-SCAN-INJ-02: Scanner MUST detect encoding obfuscation patterns (base64-encoded instructions, homoglyphs)
  • REQ-SCAN-INJ-03: Scanner MUST apply entropy analysis to flag high-entropy strings in unexpected positions
  • REQ-SCAN-INJ-04: Scanner MUST remain advisory-only — detection is logged, not blocking

100. Stall Detection in Plan-Phase

Command: /gsd-plan-phase

Purpose: Detect when the planner revision loop has stalled — producing the same output across multiple iterations — and break the cycle by escalating to a different strategy or exiting with a clear diagnostic.

Requirements:

  • REQ-STALL-01: Revision loop MUST detect identical plan output across consecutive iterations
  • REQ-STALL-02: On stall detection, system MUST escalate strategy before retrying
  • REQ-STALL-03: Maximum stall retries MUST be bounded (capped at the existing max 3 iterations)

101. Hard Stop Safety Gates in /gsd-progress --next

Command: /gsd-progress --next

Purpose: Prevent /gsd-progress --next from entering runaway loops by adding hard stop safety gates and a consecutive-call guard that interrupts autonomous chaining when repeated identical steps are detected.

Requirements:

  • REQ-NEXT-GATE-01: /gsd-progress --next MUST track consecutive same-step calls
  • REQ-NEXT-GATE-02: On repeated same-step, system MUST present a hard stop gate to the user
  • REQ-NEXT-GATE-03: User MUST explicitly confirm to continue past a hard stop gate

102. Adaptive Model Preset

Config: model_profile: "adaptive"

Purpose: Role-based model assignment that automatically selects the appropriate model tier based on the current agent's role, rather than applying a single tier to all agents.

Requirements:

  • REQ-ADAPTIVE-01: adaptive preset MUST assign model tiers based on agent role (planner → quality tier, executor → balanced tier, etc.)
  • REQ-ADAPTIVE-02: adaptive MUST be selectable via /gsd-config --profile adaptive

103. Post-Merge Hunk Verification

Command: /gsd-update --reapply

Purpose: After applying local patches post-update, verify that all hunks were actually applied by comparing the expected patch content against the live filesystem. Surface any dropped or partial hunks immediately rather than silently accepting incomplete merges.

Requirements:

  • REQ-PATCH-VERIFY-01: Reapply-patches MUST verify each hunk was applied after the merge
  • REQ-PATCH-VERIFY-02: Dropped or partial hunks MUST be reported to the user with file and line context
  • REQ-PATCH-VERIFY-03: Verification MUST run after all patches are applied, not per-patch

v1.35.0 Features


104. New Runtime Support (Cline, CodeBuddy, Qwen Code)

Part of: npx @opengsd/gsd-core

Purpose: Extend GSD installation to Cline, CodeBuddy, and Qwen Code runtimes.

Requirements:

  • REQ-CLINE-02: Cline install MUST write .clinerules to ~/.cline/ (global) or ./.cline/ (local). No custom slash commands — rules-based integration only. Flag: --cline.
  • REQ-CODEBUDDY-01: CodeBuddy install MUST deploy skills to ~/.codebuddy/skills/gsd-*/SKILL.md (emitted user-invocable: false), /gsd-* slash commands to ~/.codebuddy/commands/gsd-*.md, and subagents to ~/.codebuddy/agents/gsd-*.md. The commands surface is the sole / menu entry point. No mcp.json is written (gsd ships no MCP server). Flag: --codebuddy.
  • REQ-QWEN-01: Qwen Code install MUST deploy skills to ~/.qwen/skills/gsd-*/SKILL.md, following the open standard used by Claude Code 2.1.88+. QWEN_CONFIG_DIR env var overrides the default path. Flag: --qwen.

Runtime summary:

Runtime Install Format Config Path Flag
Cline .clinerules ~/.cline/ or ./.cline/ --cline
CodeBuddy Skills (SKILL.md) ~/.codebuddy/skills/ --codebuddy
Qwen Code Skills (SKILL.md) ~/.qwen/skills/ --qwen

105. GSD-2 Reverse Migration

Command: /gsd-import --from-gsd2 [--dry-run] [--force] [--path <dir>]

Purpose: Migrate a project from GSD-2 format (.gsd/ directory with Milestone→Slice→Task hierarchy) back to the v1 .planning/ format, restoring full compatibility with all GSD v1 commands.

Requirements:

  • REQ-FROM-GSD2-01: Importer MUST read .gsd/ from the specified or current directory
  • REQ-FROM-GSD2-02: Milestone→Slice hierarchy MUST be flattened to sequential phase numbers (M001/S01→phase 01, M001/S02→phase 02, M002/S01→phase 03, etc.)
  • REQ-FROM-GSD2-03: System MUST guard against overwriting an existing .planning/ directory without --force
  • REQ-FROM-GSD2-04: --dry-run MUST preview all changes without writing any files
  • REQ-FROM-GSD2-05: Migration MUST produce PROJECT.md, REQUIREMENTS.md, ROADMAP.md, STATE.md, and sequential phase directories

Flags:

Flag Description
--dry-run Preview migration output without writing files
--force Overwrite an existing .planning/ directory
--path <dir> Specify the GSD-2 root directory

106. AI Integration Phase Wizard

Command: /gsd-ai-integration-phase [N]

Purpose: Guide developers through selecting, integrating, and planning evaluation for AI/LLM capabilities in a project phase. Produces a structured AI-SPEC.md that feeds into planning and verification.

Requirements:

  • REQ-AISPEC-01: Wizard MUST present an interactive decision matrix covering framework selection, model choice, and integration approach
  • REQ-AISPEC-02: System MUST surface domain-specific failure modes and eval criteria relevant to the project type
  • REQ-AISPEC-03: System MUST spawn 3 parallel specialist agents: domain-researcher, framework-selector, and eval-planner
  • REQ-AISPEC-04: Output MUST produce {phase}-AI-SPEC.md with framework recommendation, implementation guidance, and evaluation strategy

Produces: {phase}-AI-SPEC.md in the phase directory


107. AI Eval Review

Command: /gsd-eval-review [N]

Purpose: Retroactively audit an executed AI phase's evaluation coverage against the AI-SPEC.md plan. Identifies gaps between planned and implemented evaluation before the phase is closed.

Requirements:

  • REQ-EVALREVIEW-01: Review MUST read AI-SPEC.md from the specified phase
  • REQ-EVALREVIEW-02: Each eval dimension MUST be scored as COVERED, PARTIAL, or MISSING
  • REQ-EVALREVIEW-03: Output MUST include findings, gap descriptions, and remediation guidance
  • REQ-EVALREVIEW-04: EVAL-REVIEW.md MUST be written to the phase directory

Produces: {phase}-EVAL-REVIEW.md with scored eval dimensions, gap analysis, and remediation steps


v1.36.0 Features

108. Plan Bounce

Command: /gsd-plan-phase N --bounce

Purpose: After plans pass the checker, optionally refine them through an external script (a second AI, a linter, a custom validator). The bounce step backs up each plan, runs the script, validates YAML frontmatter integrity on the result, re-runs the plan checker, and restores the original if anything fails.

Requirements:

  • REQ-BOUNCE-01: --bounce flag or workflow.plan_bounce: true activates the step; --skip-bounce always disables it
  • REQ-BOUNCE-02: workflow.plan_bounce_script must point to a valid executable; missing script produces a warning and skips
  • REQ-BOUNCE-03: Each plan is backed up to *-PLAN.pre-bounce.md before the script runs
  • REQ-BOUNCE-04: Bounced plans with broken YAML frontmatter or that fail the plan checker are restored from backup
  • REQ-BOUNCE-05: workflow.plan_bounce_passes (default: 2) controls how many refinement passes the script receives

Configuration: workflow.plan_bounce, workflow.plan_bounce_script, workflow.plan_bounce_passes


109. External Code Review Command

Command: /gsd-ship (enhanced)

Purpose: Before the manual review step in /gsd-ship, automatically run an external code review command if configured. The command receives the diff and phase context via stdin and returns a JSON verdict (APPROVED or REVISE). Falls through to the existing manual review flow regardless of outcome.

Requirements:

  • REQ-EXTREVIEW-01: workflow.code_review_command must be set to a command string; null means skip
  • REQ-EXTREVIEW-02: Diff is generated against BASE_BRANCH with --stat summary included
  • REQ-EXTREVIEW-03: Review prompt is piped via stdin (never shell-interpolated)
  • REQ-EXTREVIEW-04: 120-second timeout; stderr captured on failure
  • REQ-EXTREVIEW-05: JSON output parsed for verdict, confidence, summary, issues fields

Configuration: workflow.code_review_command


110. Cross-AI Execution Delegation

Command: /gsd-execute-phase N --cross-ai

Purpose: Delegate individual plans to an external AI runtime for execution. Plans with cross_ai: true in their frontmatter (or all plans when --cross-ai is used) are sent to the configured command via stdin. Successfully handled plans are removed from the normal executor queue.

Requirements:

  • REQ-CROSSAI-01: --cross-ai forces all plans through cross-AI; --no-cross-ai disables it
  • REQ-CROSSAI-02: workflow.cross_ai_execution: true and plan frontmatter cross_ai: true required for per-plan activation
  • REQ-CROSSAI-03: Task prompt is piped via stdin to prevent injection
  • REQ-CROSSAI-04: Dirty working tree produces a warning before execution
  • REQ-CROSSAI-05: On failure, user chooses: retry, skip (fall back to normal executor), or abort

Configuration: workflow.cross_ai_execution, workflow.cross_ai_command, workflow.cross_ai_timeout


111. Architectural Responsibility Mapping

Command: /gsd-plan-phase (enhanced research step)

Purpose: During phase research, the phase-researcher now maps each capability to its architectural tier owner (browser, frontend server, API, CDN/static, database). The planner cross-references tasks against this map, and the plan-checker enforces tier compliance as Dimension 7c.

Requirements:

  • REQ-ARM-01: Phase researcher produces an Architectural Responsibility Map table in RESEARCH.md (Step 1.5)
  • REQ-ARM-02: Planner sanity-checks task-to-tier assignments against the map
  • REQ-ARM-03: Plan checker validates tier compliance as Dimension 7c (WARNING for general mismatches, BLOCKER for security-sensitive ones)

Produces: ## Architectural Responsibility Map section in {phase}-RESEARCH.md


112. Extract Learnings

Command: /gsd-extract-learnings N

Purpose: Extract structured knowledge from completed phase artifacts. Reads PLAN.md and SUMMARY.md (required) plus VERIFICATION.md, UAT.md, and STATE.md (optional) to produce four categories of learnings: decisions, lessons, patterns, and surprises. Optionally captures each item to an external knowledge base via capture_thought tool.

Requirements:

  • REQ-LEARN-01: Requires PLAN.md and SUMMARY.md; exits with clear error if missing
  • REQ-LEARN-02: Each extracted item includes source attribution (artifact and section)
  • REQ-LEARN-03: If capture_thought tool is available, captures items with source, project, and phase metadata
  • REQ-LEARN-04: If capture_thought is unavailable, completes successfully and logs that external capture was skipped
  • REQ-LEARN-05: Running twice overwrites the previous LEARNINGS.md

Produces: {phase}-LEARNINGS.md with YAML frontmatter (phase, project, counts per category, missing_artifacts)

Optional integration — capture_thought: capture_thought is a convention, not a bundled tool. GSD does not ship one and does not require one. The workflow checks whether any MCP server in the current session exposes a tool named capture_thought and, if so, calls it once per extracted learning with the signature below. If no such tool is present, the step is skipped silently and LEARNINGS.md remains the primary output.

Expected tool signature:

capture_thought({
  category: "decision" | "lesson" | "pattern" | "surprise",
  phase: <phase_number>,
  content: <learning_text>,
  source: <artifact_name>
})

Users who run a memory / knowledge-base MCP server (for example, ExoCortex-style servers, claude-mem, or mem0-style servers) can implement this tool name to have learnings routed into their knowledge base automatically with project, phase, and source metadata. Everyone else can use /gsd-extract-learnings without any extra setup — the LEARNINGS.md artifact is the feature.


114. Context-Window-Aware Prompt Thinning

Purpose: Reduce static prompt overhead by ~40% for models with context windows under 200K tokens. Extended examples and anti-pattern lists are extracted from agent definitions into reference files loaded on demand via @ required_reading.

Requirements:

  • REQ-THIN-01: When CONTEXT_WINDOW < 200000, executor and planner agent prompts omit inline examples
  • REQ-THIN-02: Extracted content lives in references/executor-examples.md and references/planner-antipatterns.md
  • REQ-THIN-03: Standard (200K-500K) and enriched (500K+) tiers are unaffected
  • REQ-THIN-04: Core rules and decision logic remain inline; only verbose examples are extracted

Reference files: executor-examples.md, planner-antipatterns.md


115. Configurable CLAUDE.md Path

Purpose: Allow projects to store their CLAUDE.md in a non-root location. The claude_md_path config key controls where /gsd-profile-user and related commands write the generated CLAUDE.md file.

Requirements:

  • REQ-CMDPATH-01: claude_md_path defaults to ./CLAUDE.md
  • REQ-CMDPATH-02: Profile generation commands read the path from config and write to the specified location
  • REQ-CMDPATH-03: Relative paths are resolved from the project root

Configuration: claude_md_path


116. TDD Pipeline Mode

Purpose: Opt-in TDD (red-green-refactor) as a first-class phase execution mode. When enabled, the planner aggressively selects type: tdd for eligible tasks and the executor enforces RED/GREEN/REFACTOR gate sequence with fail-fast on unexpected GREEN before RED.

Requirements:

  • REQ-TDD-01: workflow.tdd_mode config key (boolean, default false)
  • REQ-TDD-02: When enabled, planner applies TDD heuristics from references/tdd.md to all eligible tasks (business logic, APIs, validations, algorithms, state machines)
  • REQ-TDD-03: Executor enforces gate sequence for type: tdd plans — RED commit (test(...)) must precede GREEN commit (feat(...))
  • REQ-TDD-04: Executor fails fast if tests pass unexpectedly during RED phase (feature already exists or test is wrong)
  • REQ-TDD-05: End-of-phase collaborative review checkpoint verifies gate compliance across all TDD plans (advisory, non-blocking)
  • REQ-TDD-06: Gate violations surfaced in SUMMARY.md under ## TDD Gate Compliance section

Configuration: workflow.tdd_mode Reference files: tdd.md, checkpoints.md


v1.37.0 Features

117. Spike Command

Command: /gsd-spike [idea] [--quick]

Purpose: Run 2–5 focused feasibility experiments before committing to an implementation approach. Each experiment uses Given/When/Then framing, produces executable code, and returns a VALIDATED / INVALIDATED / PARTIAL verdict. Companion /gsd-spike --wrap-up packages findings into a project-local skill.

Requirements:

  • REQ-SPIKE-01: Each experiment MUST produce a Given/When/Then hypothesis before any code is written
  • REQ-SPIKE-02: Each experiment MUST include working code or a minimal reproduction
  • REQ-SPIKE-03: Each experiment MUST return one of: VALIDATED, INVALIDATED, or PARTIAL verdict with evidence
  • REQ-SPIKE-04: Results MUST be stored in .planning/spikes/NNN-experiment-name/ with a README and MANIFEST.md
  • REQ-SPIKE-05: --quick flag skips intake conversation and uses the argument text as the experiment direction
  • REQ-SPIKE-06: /gsd-spike --wrap-up MUST package findings into .claude/skills/spike-findings-[project]/

Produces:

Artifact Description
.planning/spikes/NNN-name/README.md Hypothesis, experiment code, verdict, and evidence
.planning/spikes/MANIFEST.md Index of all spikes with verdicts
.claude/skills/spike-findings-[project]/ Packaged findings (via /gsd-spike --wrap-up)

118. Sketch Command

Command: /gsd-sketch [idea] [--quick] [--text]

Purpose: Explore design directions through throwaway HTML mockups before committing to implementation. Produces 2–3 interactive variants per design question, all viewable directly in a browser with no build step. Companion /gsd-sketch --wrap-up packages winning decisions into a project-local skill.

Requirements:

  • REQ-SKETCH-01: Each sketch MUST answer one specific visual design question
  • REQ-SKETCH-02: Each sketch MUST include 2–3 meaningfully different variants in a single index.html with tab navigation
  • REQ-SKETCH-03: All interactive elements (hover, click, transitions) MUST be functional
  • REQ-SKETCH-04: Sketches MUST use real-ish content, not lorem ipsum
  • REQ-SKETCH-05: A shared themes/default.css MUST provide CSS variables adapted to the agreed aesthetic
  • REQ-SKETCH-06: --quick flag skips mood intake; --text flag replaces AskUserQuestion with numbered lists for non-Claude runtimes
  • REQ-SKETCH-07: The winning variant MUST be marked in the README frontmatter and with a ★ in the HTML tab
  • REQ-SKETCH-08: /gsd-sketch --wrap-up MUST package winning decisions into .claude/skills/sketch-findings-[project]/

Produces:

Artifact Description
.planning/sketches/NNN-name/index.html 2–3 interactive HTML variants
.planning/sketches/NNN-name/README.md Design question, variants, winner, what to look for
.planning/sketches/themes/default.css Shared CSS theme variables
.planning/sketches/MANIFEST.md Index of all sketches with winners
.claude/skills/sketch-findings-[project]/ Packaged decisions (via /gsd-sketch --wrap-up)

119. Agent Size-Budget Enforcement

Purpose: Keep agent prompt files lean with tiered line-count limits enforced in CI. Oversized agents are caught before they bloat context windows in production.

Requirements:

  • REQ-BUDGET-01: agents/gsd-*.md files are classified into three tiers: XL (≤ 1 600 lines), Large (≤ 1 000 lines), Default (≤ 500 lines)
  • REQ-BUDGET-02: Tier assignment is declared in the file's YAML frontmatter (size: xl | large | default)
  • REQ-BUDGET-03: tests/agent-size-budget.test.cjs enforces limits and fails CI on violation
  • REQ-BUDGET-04: Files without a size frontmatter key default to the Default (500-line) limit

Test file: tests/agent-size-budget.test.cjs


120. Shared Boilerplate Extraction

Purpose: Reduce duplication across agents by extracting two common boilerplate blocks into shared reference files loaded on demand. Keeps agent files within size budget and makes boilerplate updates a single-file change.

Requirements:

  • REQ-BOILER-01: Mandatory-initial-read instructions extracted to references/mandatory-initial-read.md
  • REQ-BOILER-02: Project-skills-discovery instructions extracted to references/project-skills-discovery.md
  • REQ-BOILER-03: Agents that previously inlined these blocks MUST now reference them via @ required_reading

Reference files: references/mandatory-initial-read.md, references/project-skills-discovery.md


121. Knowledge Graph Integration

Purpose: Build, query, and inspect a lightweight knowledge graph of the project in .planning/graphs/. Opt-in per project. Exposed as the /gsd-graphify user-facing command and the gsd-tools.cjs graphify … programmatic verb family. Complements /gsd-map-codebase --query (snapshot-oriented) with a graph-oriented view of nodes and edges across commands, agents, workflows, and phases.

Requirements:

  • REQ-GRAPH-01: Opt-in via graphify.enabled: true in .planning/config.json. When disabled, /gsd-graphify prints an activation hint and stops without writing.
  • REQ-GRAPH-02: Slash-command /gsd-graphify exposes subcommands build, query <term>, status, diff. The programmatic CLI node gsd-tools.cjs graphify … additionally exposes snapshot, which is also invoked automatically as the final step of graphify build.
  • REQ-GRAPH-03: Build runs within the configurable graphify.build_timeout (seconds); exceeding the timeout aborts cleanly without leaving a partial graph.
  • REQ-GRAPH-04: graphify.cjs falls back to graph.links when graph.edges is absent so older graph artifacts keep rendering.
  • REQ-GRAPH-05: Graphify is invoked through gsd-tools.cjs graphify ... command handlers.

Configuration: graphify.enabled, graphify.build_timeout Reference files: commands/gsd/graphify.md, bin/lib/graphify.cjs


v1.40.0 Features

122. Skill Surface Consolidation

Purpose: Cut the eager skill-listing overhead by folding 31 micro-skills into 4 new grouped parents and 6 existing parents that absorb sub-operations as flags. Zero functional loss — every removed micro-skill's behavior survives via a flag on a consolidated parent. After consolidation, commands/gsd/*.md ships 59 sub-skills (plus 6 namespace meta-skills, see #123).

Requirements:

  • REQ-CONSOLIDATE-01: Four new grouped skills replace clusters of micro-skills:
    • /gsd-capture — folds add-todo (default), note (--note), add-backlog (--backlog), plant-seed (--seed), check-todos (--list)
    • /gsd-phase — folds add-phase (default), insert-phase (--insert), remove-phase (--remove), edit-phase (--edit)
    • /gsd-config — folds settings-advanced (--advanced), settings-integrations (--integrations), set-profile (--profile)
    • /gsd-workspace — folds new-workspace (--new), list-workspaces (--list), remove-workspace (--remove)
  • REQ-CONSOLIDATE-02: Six existing parents absorb wrap-up / sub-operations as flags: /gsd-update --sync, /gsd-update --reapply, /gsd-sketch --wrap-up, /gsd-spike --wrap-up, /gsd-map-codebase --fast, /gsd-map-codebase --query, /gsd-code-review --fix, /gsd-progress --do, /gsd-progress --next.
  • REQ-CONSOLIDATE-03: Deleted micro-skill slash forms (the bare gsd-add-todo, gsd-add-backlog, gsd-plant-seed, gsd-check-todos, gsd-add-phase, gsd-insert-phase, gsd-remove-phase, gsd-edit-phase, gsd-new-workspace, gsd-list-workspaces, gsd-remove-workspace, gsd-settings-advanced, gsd-settings-integrations, gsd-set-profile, gsd-sketch-wrap-up, gsd-spike-wrap-up, gsd-reapply-patches, gsd-code-review-fix, …) MUST resolve to "Unknown command" — no shadow stubs.
  • REQ-CONSOLIDATE-04: autonomous.md invokes /gsd-code-review --fix (was previously calling the deleted gsd-code-review-fix).

Reference issue: #2790


123. Namespace Meta-Skills (Two-Stage Routing)

Purpose: Replace the flat eager skill listing with a two-stage hierarchical routing layer. The model sees 6 namespace routers instead of 86 entries, selects a namespace, then routes to the sub-skill. Descriptions use pipe-separated keyword tags (≤ 60 chars) for routing density.

Commands:

  • /gsd-workflow — phase pipeline router (discuss / plan / execute / verify / phase / progress)
  • /gsd-project — project lifecycle (milestones, audits, summary)
  • /gsd-quality — quality gates (code review, debug, audit, security, eval, ui)
  • /gsd-context — codebase intelligence (map, graphify, docs, learnings)
  • /gsd-manage — config / workspace / workstreams / thread / update / ship / inbox
  • /gsd-ideate — exploration & capture (explore, sketch, spike, spec, capture)

Token cost:

Entries Approx tokens
Pre-1.40 full install 86 ~2,150
Namespace meta-skills 6 ~120

Requirements:

  • REQ-NS-01: Six commands/gsd/ns-*.md namespace routers ship with pipe-separated keyword-tag descriptions (≤ 60 chars).
  • REQ-NS-02: Existing sub-skills are unchanged and still invocable directly — namespace skills are additive, not a replacement for direct slash forms.
  • REQ-NS-03: The body of each namespace router contains a routing table that maps user intent to the correct concrete sub-skill on the post-#2790 consolidated surface.

Reference issue: #2792


124. Context-Window Utilization Guard

Command: /gsd-health --context

Purpose: Quality guard against context-window saturation. Two thresholds: 60 % utilization warns ("consider /gsd-thread"), 70 % is critical ("reasoning quality may degrade"; matches the fracture-point per recent context-attention research).

Requirements:

  • REQ-CTX-GUARD-01: /gsd-health --context prints a structured status line with current utilization, threshold tier (ok / warn / critical), and a remediation suggestion.
  • REQ-CTX-GUARD-02: The same triage is exposed as gsd-tools.cjs validate context --tokens-used <int> --context-window <int> — a structured envelope for status-line and hook callers (#125). Both flags are required; the handler returns the same { percent, state } envelope as the pure classifier in REQ-CTX-GUARD-03.
  • REQ-CTX-GUARD-03: The classifier (bin/lib/context-utilization.cjs) is pure: input (tokensUsed, contextWindow), output { percent, state }. Easy to unit-test, easy to reuse from any caller.

Reference issue: #2792


125. Phase-Lifecycle Status-Line Read-Side

Purpose: Surface phase orchestration state on the status-line. parseStateMd() reads four new STATE.md frontmatter fields and formatGsdState() renders in-flight, idle, and progress scenes. Write-side wiring follows in a later RC.

Requirements:

  • REQ-LIFECYCLE-01: parseStateMd() reads four optional fields:
    • active_phase — phase number when an orchestrator is in flight
    • next_action — recommended next command when idle
    • next_phases — YAML flow array of next phase numbers
    • progress — nested total_phases / completed_phases / percent block
  • REQ-LIFECYCLE-02: formatGsdState() checks the lifecycle fields in priority order and emits the first matching scene (Phase active → Idle next-recommended → Milestone complete → Default fallback).
  • REQ-LIFECYCLE-03: All four fields default to undefined; existing STATE.md files render byte-for-byte identically.

Reference issue: #2833 — see docs/STATE-MD-LIFECYCLE.md for the full field reference and rendering rules.


v1.41.0 Features

126. Per-Phase-Type Model Selection

Purpose: Express model tuning at the phase level (planning, research, execution, verification) without learning the full agent taxonomy. Sits between per-agent model_overrides (precise, verbose) and the global model_profile tier (coarse, uniform).

Config key: models in .planning/config.json

Phase-type slots:

Slot Agents assigned
planning gsd-planner, gsd-roadmapper, gsd-pattern-mapper
discuss (reserved for future subagent)
research gsd-phase-researcher, gsd-project-researcher, gsd-research-synthesizer, gsd-codebase-mapper, gsd-ui-researcher
execution gsd-executor, gsd-debugger, gsd-doc-writer
verification gsd-verifier, gsd-plan-checker, gsd-integration-checker, gsd-nyquist-auditor, gsd-ui-checker, gsd-ui-auditor, gsd-doc-verifier
completion (reserved for future subagent)

Accepted values: "opus" / "sonnet" / "haiku" / "inherit"

Resolution precedence (highest → lowest):

1. model_overrides[<agent>]
2. dynamic_routing.tier_models[<tier>]   (when enabled)
3. models[<phase_type>]                  (this feature)
4. model_profile
5. Runtime default

Requirements:

  • REQ-PHASE-MODELS-01: Six named models.* slots accepted by config-schema.cjs and config-schema.ts; config-set rejects unknown phase-types.
  • REQ-PHASE-MODELS-02: Configs without a models block behave byte-for-byte identically to pre-v1.41 behavior.
  • REQ-PHASE-MODELS-03: discuss and completion are accepted by the schema for forward compatibility; setting them today is a no-op until a subagent maps to each.

Reference issue: #3023


127. Dynamic Routing with Failure-Tier Escalation

Purpose: Pay for the cheap tier by default; escalate to a more capable model automatically when the orchestrator detects a soft failure (verification inconclusive, plan-check FLAG, etc.).

Config key: dynamic_routing in .planning/config.json

Behavior:

  • enabled: false (default) — feature is off; all agents use the precedence chain unchanged.
  • enabled: true — the resolver picks tier_models[default_tier] for the first spawn and escalates one tier up on orchestrator-detected soft failure, capped by max_escalations.

Composition: model_overrides always wins; dynamic_routing.tier_models[<tier>] resolves above models.<phase_type> and model_profile.

Requirements:

  • REQ-DYNROUTE-01: dynamic_routing.enabled acts as a master switch; when false or block is absent, zero behavior change.
  • REQ-DYNROUTE-02: New resolver resolveModelForTier(cwd, agent, attempt) in core.cjs is the single call-site for orchestrator integration.
  • REQ-DYNROUTE-03: max_escalations caps the escalation chain to prevent runaway cost.

Reference issue: #3024


128. Update Banner Opt-In

Purpose: Surface update availability to users who have declined or bypassed the GSD statusline, without requiring the statusline.

Behavior:

  • At install time, if the installer detects no GSD statusline, it offers an opt-in SessionStart hook.
  • The hook reads the existing ~/.cache/gsd/gsd-update-check.json cache — the same cache used by the statusline — and prints a banner only when an update is available.
  • Silent when up-to-date.
  • Failure diagnostics rate-limited to once per 24 h.
  • Cleanly removed by npx @opengsd/gsd-core --uninstall.

Requirements:

  • REQ-BANNER-01: Banner does not install without explicit opt-in.
  • REQ-BANNER-02: No additional network requests — reuses the existing background update-check cache.
  • REQ-BANNER-03: Uninstall path removes the banner hook.

Reference issue: #2795


129. Issue-Driven Orchestration Guide

Purpose: Document a recipe for driving the full GSD workflow from a GitHub / Linear / Jira issue, mapping tracker-centric concepts onto existing GSD primitives.

Document: docs/issue-driven-orchestration.md

Covered workflow:

  1. Create an isolated workspace per issue (/gsd-workspace --new)
  2. Run the manager dashboard to get oriented (/gsd-manager)
  3. Execute autonomously (/gsd-autonomous)
  4. Verify and review (/gsd-verify-work, /gsd-review)
  5. Ship and close the issue (/gsd-ship)

No new commands or daemon process — purely a documentation artifact that maps existing primitives onto a tracker-driven workflow.

Reference issue: #2840


130. Graphify Commit-Based Staleness

Purpose: Surface whether the architecture graph was built from the current commit or an older one, complementing the existing mtime-based stale signal.

Command: /gsd-graphify status

New fields returned (graphify v0.7+ graphs):

Field Type Description
built_at_commit string Commit SHA the graph was built from
current_commit string Current git HEAD
commits_behind number How many commits behind HEAD the graph is
commit_stale boolean | null true=stale, false=current, null=unavailable (pre-v0.7, non-git)

Rendered output (when signal is available):

Source commit: abc1234 (3 commits behind HEAD)

Security: built_at_commit validated as 4–40 hex chars before reaching git — a hostile graph.json cannot inject dashed options into argv.

Fallback: pre-v0.7 graphs and non-git checkouts return commit_stale: null; callers fall back to the existing mtime-based stale flag. No behavior change for existing users.

Reference issue: #3170


v1.42.1 Features

132. Package Legitimacy Gate

Purpose: Stop hallucinated, suspicious, or slopsquatting package names before they reach a shell install command.

Behavior:

  • Phase research writes a ## Package Legitimacy Audit table for recommended packages.
  • Packages verified only through search are treated as [ASSUMED], not trusted.
  • [SLOP] packages are removed from recommendations.
  • Plans that need [ASSUMED] or suspicious packages add a human verification checkpoint.
  • Executor install failures stop for human verification instead of auto-trying similarly named packages.

Requirements:

  • REQ-PKG-GATE-01: Research MUST record package registry, age, download/source signals, slopcheck verdict, and disposition.
  • REQ-PKG-GATE-02: Planner MUST gate unverified or suspicious package installs before execution.
  • REQ-PKG-GATE-03: Executor MUST NOT auto-substitute package names after failed package-manager installs.

Reference: v1.42.1 Release Notes


133. Skill Surface Budgeting

Purpose: Let users reduce installed skill and agent surface area when context budget matters.

Install profiles:

Profile Purpose
core Minimal main-loop surface
standard Core plus common phase-management commands
full Complete surface; default

Runtime control: /gsd:surface lists profile state and enables, disables, or resets skill clusters without reinstalling.

Requirements:

  • REQ-SURFACE-01: Installer MUST resolve --profile=<name> and persist the active profile in .gsd-profile.
  • REQ-SURFACE-02: --minimal and --core-only MUST remain aliases for --profile=core.
  • REQ-SURFACE-03: Runtime surface state MUST persist outside the install profile marker.

Reference: ADR-0011


134. Installer Migrations

Purpose: Make runtime config cleanup explicit, auditable, and rollback-aware during installs and updates.

Capabilities:

  • First-time baseline migration records managed files.
  • Legacy stale-file cleanup uses ownership evidence before deleting or rewriting.
  • User-owned artifacts are preserved.
  • Ambiguous GSD-looking files block with a clear report instead of being silently overwritten.
  • Migration plans support dry-run reporting and rollback protection.

Requirements:

  • REQ-INSTALL-MIGRATION-01: Migration records MUST include metadata, install scope, and ownership evidence.
  • REQ-INSTALL-MIGRATION-02: Destructive actions MUST fail closed when ownership is ambiguous.
  • REQ-INSTALL-MIGRATION-03: Install failures MUST restore the pre-install state when rollback data exists.

Reference: Installer Migrations


135. Custom Ship PR Body Sections

Command: /gsd-ship

Config key: ship.pr_body_sections

Purpose: Add project-specific PRD-style sections to generated PR bodies without editing GSD workflow files.

Behavior: Configured sections append after the required Summary, Changes, Requirements Addressed, Verification, and Key Decisions sections. They can copy from artifact headings, render templates, or fall back to static text.

Requirements:

  • REQ-SHIP-SECTIONS-01: Custom sections MUST NOT replace, remove, or reorder required PR sections.
  • REQ-SHIP-SECTIONS-02: Unknown template tokens MUST be rejected by config validation.
  • REQ-SHIP-SECTIONS-03: Disabled sections MUST stay in config without appearing in PR output.

Reference: Custom PR Body Sections


136. Review Default Reviewers

Command: /gsd-review

Config key: review.default_reviewers

Purpose: Let teams choose the default reviewer subset for no-flag /gsd-review runs.

Precedence:

explicit reviewer flags -> --all -> review.default_reviewers -> all detected reviewers

Requirements:

  • REQ-REVIEW-DEFAULTS-01: Missing review.default_reviewers MUST preserve the previous all-detected behavior.
  • REQ-REVIEW-DEFAULTS-02: Empty arrays MUST be rejected; remove the key to restore all-detected behavior.
  • REQ-REVIEW-DEFAULTS-03: Known but unavailable reviewers MUST be skipped with diagnostics rather than hard-failing the run.

Reference: Configuration Reference


137. Fallow Structural Review Pre-Pass

Command: /gsd-code-review

Config keys: code_quality.fallow.*

Purpose: Add an optional structural analysis pass before the agent review.

Behavior: When enabled, GSD resolves a fallow binary, runs a bounded audit, writes FALLOW.json, and embeds structural findings in REVIEW.md.

Requirements:

  • REQ-FALLOW-01: Fallow MUST be opt-in and disabled by default.
  • REQ-FALLOW-02: Missing or failing fallow runs MUST produce clear diagnostics.
  • REQ-FALLOW-03: Findings larger than the embed budget MUST be skipped with a warning, preserving the raw JSON artifact.

Reference: Configuration Reference


138. End-of-Phase Human Verification Mode

Config key: workflow.human_verify_mode

Purpose: Reduce mid-flight human checkpoint interruptions while preserving human verification requirements.

Behavior: The default "end-of-phase" mode embeds human checks into <verify><human-check> blocks for phase review. "mid-flight" restores blocking checkpoint:human-verify tasks.

Requirements:

  • REQ-HUMAN-VERIFY-01: checkpoint:decision and checkpoint:human-action MUST remain blocking regardless of mode.
  • REQ-HUMAN-VERIFY-02: Human-needed verification MUST remain pending until the end-of-phase review resolves it.
  • REQ-HUMAN-VERIFY-03: Configs without the key MUST use "end-of-phase".

Reference: Checkpoints Reference


139. Quota and Rate-Limit Failure Classification

Command: /gsd-execute-phase

Purpose: Treat provider quota and rate-limit failures as wait-and-resume conditions, not normal executor failures.

Behavior: Agent output is classified for signals such as 429, rate limit, usage limit, RESOURCE_EXHAUSTED, and usage_limit_reached. Matching failures present a wait-for-reset recovery path.

Requirements:

  • REQ-QUOTA-01: Quota failures MUST NOT offer immediate retry as the primary recovery.
  • REQ-QUOTA-02: Classification MUST cover Claude, Copilot, Codex, Gemini, and generic provider sentinels.
  • REQ-QUOTA-03: Non-quota failures MUST continue through the normal execution failure path.

Reference: Provider Rate Limit Signals


140. Statusline Context Position

Config key: statusline.context_position

Purpose: Keep the context meter visible in narrow terminals.

Options:

Value Behavior
"end" Default; render context meter near the line tail
"front" Render context meter immediately after the model name

Requirements:

  • REQ-STATUSLINE-POS-01: Invalid values MUST be rejected by config validation.
  • REQ-STATUSLINE-POS-02: Missing config MUST preserve existing end-position rendering.

Reference: Configuration Reference


141. Milestone Tag Creation Toggle

Command: /gsd-complete-milestone

Config key: git.create_tag

Purpose: Let projects with external release automation complete milestones without creating local git tags.

Behavior: git.create_tag: false skips milestone tag creation. The workflow still updates milestone artifacts and state.

Requirements:

  • REQ-MILESTONE-TAG-01: Missing config MUST preserve automatic tag creation.
  • REQ-MILESTONE-TAG-02: Existing tag collisions MUST fail clearly instead of overwriting tags.
  • REQ-MILESTONE-TAG-03: Disabling tag creation MUST NOT skip milestone archival.

Reference: Configuration Reference


142. Structured JSON Error Mode

CLI: gsd-tools --json-errors

Purpose: Give automation callers stable machine-readable error envelopes.

Behavior: Commands that fail under --json-errors return structured ok: false payloads with error kind, message, command context, and exit mapping instead of prose-only stderr.

Requirements:

  • REQ-JSON-ERRORS-01: Unknown commands, validation errors, timeouts, native failures, fallback failures, and internal errors MUST map to canonical error kinds.
  • REQ-JSON-ERRORS-02: CLI exit code mapping MUST remain stable for automation callers.
  • REQ-JSON-ERRORS-03: Human-readable output MUST remain the default when --json-errors is absent.

Reference: JSON Error Mode