3f6b063fbb
* chore(#2799): resolve reviewer lanes into executable invocation plans Phase 5b of ADR-2782. Adds the resolver and runner that let invoke_reviewers iterate declared lanes instead of hand-authored per-CLI bash. Five additive descriptor amendments, each forced by a lane that ships today: - LaneHandler gains 'opencode' — the lane rebuilds its review from assistant text parts of a --format json stream; a plain stdout copy re-breaks #1936. - modelConfigKey — antigravity's key is review.models.agy, not .antigravity, so resolving by slug silently dropped a configured model. - defaultHost/fallbackModel — Phase 4 federated every *_host with a default of empty string; the real fallback only existed in the bash. - args becomes an argv template with a closed four-placeholder vocabulary. Positional splicing produced 'codex --model M -o F exec --ephemeral', which is not a valid invocation: codex injects in the middle, twice. - kimi-code lane, with the bounded command-capability probe (needle --output-format) that tells Kimi Code from the legacy python kimi-cli. Parity gate re-pointed: the workflow-text families it scanned are the text this phase deletes, so they are replaced by descriptor-to-registry parity plus an anti-parity check that no bespoke leg returns. jq, curl and external timeout/gtimeout all drop out of the review path. Refs #2782 * chore(#2799): add review-lane query surface and widen the manifest vocabulary Adds the gsd-tools 'review-lane' route (plan/invoke/sections) the workflow loops over, projects all twelve lanes into their capability manifests, and widens capability-validator for the amendments. opencode admitted to VALID_LANE_HANDLERS under the second arm of the enum's own admission rule: one lane, justified by a documented upstream defect data cannot express (#1936 — the agent can end its turn with zero output tokens and --format default then drops the assistant text entirely). Two bugs caught by an end-to-end stub run and fixed here: - loadConfigResolved returns a provenance wrapper, not the config; using it directly resolved every key to undefined, which reads as 'nothing configured' and silently dropped every model override. - hasBinary used shell:true with an args array (Node 26 DEP0190). Replaced with a PATH scan that spawns nothing at all. Refs #2782 * chore(#2799): iterate declared lanes in invoke_reviewers and write_reviews Replaces the eleven hand-authored per-CLI bash legs with a loop over resolved lanes, and renders REVIEWS.md sections from each lane's declared reviewsSection instead of thirteen hardcoded headings. review.md drops from 1104 lines to 507 (61KB to 28.7KB). Parity gate re-pointed, as agreed: the leg-marker and section-heading families scanned exactly the text this phase deletes, so they are replaced by descriptor-to-registry parity in both directions, plus an anti-parity check that fires if a bespoke leg is ever re-added. Enum, emitting sites and the Object.keys lock moved together. The budget-trim helper is hoisted out of the Ollama leg: it was always lane-agnostic, and any lane may now declare a promptBudgetKey. Refs #2782 * feat(#2799): bind the consented egress host and re-verify it at invocation Completes ADR-2782 D5. Rule 1 was recorded in the ADR as delivered by Phase 3 but was not implemented: ConsentRecord had no host field and nothing in the tree bound one, so this phase's rule-4 comparison had no baseline. ConsentRecord gains an OPTIONAL reviewerHost. Optional is the whole design: isValidConsentRecord does not require it, so every record already on disk stays valid and no re-consent storm fires (D4 rule 5). It is deliberately excluded from disclosureSignature — the loader has no config resolver, so folding a config-derived value in would make loader and lifecycle compute different signatures for the same manifest and re-prompt forever. Install resolves hostConfigKey (falling back to the lane's declared defaultHost, which is what the invocation path uses) and records it. Invocation re-resolves and blocks on mismatch rather than silently redirecting. Absence allows: no record, or a record predating the field, means nothing to compare — denying there would break every existing local-model user on upgrade. Refs #2782 * test(#2799): cover the resolver, runner and handlers; retarget the parity suites Adds the golden invocation-plan table (one row per shipped lane, derived from the bash legs rather than the descriptor types) plus runner coverage for the probe, empty-output policy, the three handlers and the egress check. Retargets the existing suites onto the new contract: descriptor-to-registry parity, the anti-parity check, the opencode handler, and the twelfth lane. Two corrections found by running them: - modelConfigKey was required; that breaks D4 rule 2, since a reviewer manifest authored before this phase would fail validation on upgrade. It is optional, read as null when absent. - the antigravity non-zero-exit test pre-seeded the transcript, which asserted that a STALE entry leaks through — the exact bug the watermark prevents. The spawn now appends, as the real tool does. Refs #2782 * fix(#2799): restore agy --add-dir and the self-report prompt in the handler Retargeting the three legacy reviewer suites off the deleted bash surfaced two real regressions in the port, both #2176: - --add-dir was dropped. Without it agy's permission context never receives the cwd repo, so the agent anchors on its own scratch dir and reviews the plan text in isolation — the exact failure the Review Instructions forbid. It is capability-probed, because an older agy rejects the unknown flag outright and a lane that fails to start is worse than one running on the prompt anchor. - the prompt lost the clause mandating a REVIEWED-WITHOUT-REPO-ACCESS self-report, which is what makes a blind review distinguishable from a grounded one. antigravity now builds its own prompt variant. Also ports the #2073 mode-2 cli.log diagnostic, which was dropped: a pinned model that 404s exits 0 with empty stdout AND an empty transcript, so agy's own log is the only evidence that anything failed. The three suites now assert against the plan and the handler instead of matching fence text, so they no longer need allow-test-rule exemptions. Refs #2782 * docs(#2799): document the declared lanes, the new flag, and dropped prerequisites COMMANDS.md gains --kimi-code and replaces the jq-prerequisite paragraph, which is now false: no lane requires jq, curl or an external timeout. Adds the changed-egress-destination behavior, since a blocked lane is something a user can hit. CONFIGURATION.md records that the model config key is declared per lane rather than derived from the flag — antigravity's is review.models.agy — and adds review.models.kimi-code. reviewer-instances.md now routes an instance through its lane's single invocation seam instead of a copied per-adapter bash block, which is what lets a cross-cutting fix reach instances for free. That required implementing the --model/--agent/--as flags it documents; --model re-resolves through the lane's argv template rather than splicing, so the flag lands where the lane declares it rather than ahead of a subcommand. CONTEXT.md glossary gains both new modules. Refs #2782 * chore(#2799): drop the stale emitted-drift acknowledgment The only entry was #2797's, acknowledging COMMENT-ONLY GROWTH in review.md. That file now shrinks by ~32KB and every emitted hash that moved is attributable to this diff, so the ack no longer explains anything. Removing the last entry means removing the file: its presence is the alarm, and an empty one signals nothing. Verified by deleting it and re-running the attribution and provenance gates plus lint:ci — all green without it. Refs #2782 * docs(#2799): record the Phase 5b vocabulary widenings in ADR-2782 Five additive amendments, each forced by a lane that ships today, plus two corrections the phase had to make rather than work around: - D5 rule 1 was recorded as delivered by Phase 3 and was not implemented, so this phase's rule-4 comparison had no baseline. Recorded because an ADR asserting a rule was delivered is exactly what stops a later phase checking. - The DEFECT.GENERATIVE-FIX gate is re-pointed: its workflow-text families scanned the text this phase deletes. Also records that D7's 'skip the probe where no bounding mechanism exists' carve-out is obsolete — in practice it meant the Antigravity lane ran unbounded on every stock macOS host, which ships neither timeout nor gtimeout. Refs #2782 * fix(#2799): close four defects found by adversarial review Two confirmed bugs, both reproduced before fixing: - resolveLanePlan was not total. An openai-http lane with a missing or non-object invoke dereferenced inv.hostConfigKey and threw, contradicting the module's own documented contract; the spawn branch guarded correctly and the http branch did not. The CLI seam resolves every selected lane in one map, so one malformed overlay manifest would have aborted the whole review rather than dropping its own lane. Guarded, plus a per-lane try/catch at the seam so a throw can never take down siblings. - A reviewer-instance model was silently dropped for any lane declaring modelConfigKey null (cursor, qwen, coderabbit). reviewer_instances validates that cli is a known slug but never that the slug accepts a model, so a user could configure one, get a clean run, and never learn a different model reviewed their plan. Now warns explicitly. Two hardening fixes: - The slug is concatenated into artifact paths, so LANE_SLUG_RE is enforced in the resolver rather than inherited from a validator that does not run on this path — the module documents itself as the overlay-manifest trust boundary, so it should not depend on someone else having checked. - normalizeHost mangled a scheme-less value: new URL('localhost:11434') parses with an empty hostname, so it became 'localhost://11434' and was compared and requested as if real. An empty hostname now means not-a-URL. Also documents the one gap that cannot be closed here: the antigravity watermark is keyed by workspace, so two concurrent reviews of the same repo share a transcript. agy exposes no per-invocation id to filter on, so the handler now states which half of its never-stale guarantee actually holds. Refs #2782 * test(#2799): retarget the remaining eight review.md-asserting suites The remote runner found 37 failures the local sweep missed (it hit the shell's two-minute cap before reaching these). All eight extract per-CLI bash from review.md that this phase deletes; each protects a real invariant, so each is retargeted onto the plan, the runner or the handler rather than removed. Three real defects surfaced by doing so: - effort args never reached ANY lane. model-resolver.cjs exports no resolveExecution, so effortFor silently returned [] every time. Restored by calling the same bounded resolve-execution query the bash legs used — and NOT with --raw, which prints the resolved effort rather than the picked field, so claude got 'low' instead of '--effort low'. - the timeout guidance lost 'a silent empty output is a timeout kill, not a crash' — the operator note that exists because of the Codex 0xc0000142 misdiagnosis. Restored. - the opencode handler dropped EMPTY assistant text parts. The shipped jq was , and only substitutes for false/null — an empty string is truthy in jq and contributed a blank line. Found by a property test shrinking to ['', '']. The opencode property suite no longer spawns jq at all, which deletes the #2099 hang mechanism it was architected around rather than mitigating it. Refs #2782 * fix(#2799): register the two new generated modules, and untrack them The remote runner caught build output committed to git. Both new modules compile from src/*.cts into gsd-core/bin/lib/*.cjs, and every sibling generated that way is gitignored and eslint-ignored (ADR-457) - including Phase 1's own review-lane-descriptor.cjs. Mine were neither, so repo-invariants' "each bin/lib/*.cjs is linted xor ignored according to migration state" failed. Registered both in .gitignore and eslint.config.mjs alongside the Phase 1 module, and dropped them from the index. Nothing about the shipped behaviour changes; the artifacts are rebuilt by build:lib. This is the new-.cts-module registration ripple, and it is the one part of it I had not completed - the CONTEXT.md glossary and the inventory manifest were already done. Refs #2782 * chore(#2799): backfill changeset pr number to 2861 * chore(#2799): backfill changeset pr number to 2861 --------- Co-authored-by: Test <test@example.com>
Architecture Decision Records
This directory contains Architecture Decision Records (ADRs) for GSD.
Each ADR documents one architectural decision: what was decided, why, and what consequences follow. ADRs are append-only. Amendments extend existing ADRs with a dated section rather than replacing them.
Reading this corpus
Start with the index below, and respect the status. The index is grouped so that the first table — Active decisions — is the set that governs the system as it stands. An ADR in Superseded, Retired, and Legacy is historical: it records what was once decided and names what replaced it. Do not cite it as current architecture.
Two things the index makes explicit, because getting them wrong has actually misled readers here:
- "Read first" on an active ADR points at a broader ADR that now frames it. A decision can be entirely correct and still not be the whole picture. The runtime capability descriptor (ADR-1016) is live and load-bearing, but ADR-1239 (EoS — GSD as an Embeddable Orchestration Engine) subsumes it as the declarative adapter and inverts its direction: GSD is the engine a host embeds, not an installer that projects onto a host. For how GSD meets a host, EoS is the current frame.
Proposedmeans not ratified — and it is kept honest. On 2026-07-17 the corpus was audited against the shipped tree and nine ADRs whose decisions had demonstrably shipped were ratified toAccepted, each carrying a dated Ratification section with the evidence (see ADR-857 for the fullest example). The ADRs that remainProposedareProposedfor a reason recorded in the file — an unmet acceptance criterion, an outstanding phase, or a successor ADR already planned — not through neglect. Trust the label; if you think it is wrong, prove it in a dated section and see Ratifying a staleProposed.
Naming Convention
New ADRs use issue#-prefix slug naming:
docs/adr/<issue#>-<kebab-slug>.md
Examples: 2264-golden-parity-redesign.md, 1239-gsd-embeddable-orchestration-engine.md.
Why
Two developers computing "next ADR number" locally against main will independently pick the same integer and both ship. The collision is already on disk — 0010-* exists twice and 0011-* exists three times. GitHub issue numbers are server-assigned and atomic: the moment you open an issue, that number is reserved globally. Two PRs that both edit the ### Fixed block of CHANGELOG.md always conflict on merge — two PRs that each use a distinct issue# as their ADR prefix never collide. Same shape, same solution.
Legacy naming is not Legacy status
Files 0001-* through 0012-* are preserved as immutable historical record of the old local-compute numbering. The duplicate 0010-* and the three-way 0011-* are documented residue of that convention — not patterns to imitate. Do not renumber them.
This is the single authoritative statement of the legacy range.
docs/contributor-standards.mdreferences it rather than restating it, so the two cannot drift.
Two other zero-padded files look legacy but are not: 0174-retire-gsd-sdk-package-boundary.md (issue #174) and 0656-research-module-seam.md (issue #656) are mis-padded modern ADRs — modern, issue-numbered files whose four-digit padding is a mistake. They are NOT part of the legacy sequential set above and are not "old local-compute numbering" residue.
This is a statement about filenames only. Many of those ADRs are Accepted and load-bearing today (ADR-0002, ADR-0004, ADR-0008, ADR-0009). An old filename says nothing about whether a decision still holds. The Legacy status in the table below is a separate claim — see the vocabulary.
Because 0010-* and 0011-* each resolve to more than one file, a bare cross-reference like "ADR-0011" is genuinely ambiguous. Link the file (see Lifecycle rules).
Full process
See CONTRIBUTING.md — "Proposing an ADR or PRD" for the end-to-end workflow: opening the issue, waiting for approval, naming the file, and submitting the PR.
PRDs live in docs/prd/, not here. (0011-review-default-reviewers-prd.md predates that directory and is kept in place as frozen historical record.)
Lifecycle rules
These are enforced by scripts/gen-adr-index.cjs, which runs in CI via npm run lint:generated-sync. A violation fails the build with the exact file and fix.
1. Every ADR declares one status from the canonical vocabulary
The first word of the Status field must be one of:
| Status | Means | Obligation |
|---|---|---|
Accepted |
Decided and in force. Cite it. | — |
Proposed |
Decided in principle, not ratified. Do not cite as settled. | If the work has demonstrably shipped, ratify it (below) — do not leave the label lying. |
Superseded |
A specific newer ADR replaced this decision. | Must name the successor as a file link. |
Retired |
What this ADR decided no longer exists at all, and no single ADR replaced it. | Say what was removed and when. |
Legacy |
Frozen historical record, kept for provenance; not a pattern to follow. | Say why it is frozen. |
Prose may follow the token (Superseded by [ADR-0174](0174-retire-gsd-sdk-package-boundary.md) (2026-05-23); originally Accepted (2026-05-09)). Both the bullet form (- **Status:** Accepted) and the table form (| **Status** | Accepted |) are accepted.
2. Cross-references to other ADRs are file links, never bare ids
Write [ADR-0011](0011-skill-surface-budget-module.md), not ADR-0011. Bare ids are ambiguous for 0010/0011, and unlinked references cannot be checked.
If you mean an issue, write #857 — not ADR-857. (An ADR and its owning issue often share a number; that is intentional and not a conflict.)
3. Supersession and subsumption are symmetric
These are different relations. Do not conflate them:
Supersedes/Superseded by— the target is replaced. Its status becomesSuperseded.Subsumes/Subsumed by— the target still holds, but a broader ADR now frames it. Its status is unchanged; it becomes a component of the larger decision.
If A declares either relation toward B, B must record the reciprocal. A one-way pointer is the failure this corpus actually suffered: ADR-1239 declared it subsumed four ADRs, none of which said so, and none of which pointed back — so a reader landing on any of them concluded the superseded frame was the way forward.
Only an Accepted ADR is owed the back-link. A Proposed ADR's claim is prospective: it has not taken effect, so its target is not marked. On ratification, the check begins demanding the back-links.
4. The declared id matches the filename
An H1 of # ADR-0175: … in a file named 218-*.md is a rename that never finished. The id in the title must match the filename's prefix.
Ratifying a stale Proposed
A stale Proposed is not cosmetic: it tells contributors and agents that live architecture is an unbuilt idea. Fix it — but on evidence, not vibes.
The bar. All four must hold before flipping to Accepted:
- The decided mechanism demonstrably exists in the tree — name the files, symbols, and tests.
- The owning issue is closed as completed. A closed issue is not proof:
stateReasonof not planned / duplicate means the decision was dropped (that isLegacyorRetired, notAccepted). - No material part is unshipped. If the ADR defines phases and one is outstanding, or states its own bar for acceptance and that bar is unmet, it stays
Proposed. - No later ADR supersedes it, and no approved issue already plans its graduation as separate work.
The procedure. Set the status to Accepted — ratified <date> (originally Proposed <date>), add a dated ## Ratification section holding the evidence, then run node scripts/gen-adr-index.cjs --write. If the ADR claims to supersede or subsume others, the gate will now demand their back-links — that is the point. Ratify deliberately.
Two traps worth knowing, both hit during the 2026-07-17 audit:
- Shipped code is necessary, not sufficient. Eight ADRs had every named module, symbol, and test present and their epics closed — and still failed the bar: ADR-2264's own headline acceptance criterion is unmet in the tree, ADR-230's decided branch protection does not match the live API, ADR-660's namesake mechanism is performed by hand, and ADR-959 has an approved issue planning its graduation as its own ADR. Verify the decision, not just the code.
- "Supersedes" is often "subsumes". Read what the ADR means before the gate makes you act on what it says. ADR-857 said "Supersedes (generalizes)"; taken literally, ratifying it would have stamped two live seams (ADR-0011, ADR-58) as dead. The parenthetical was the truth; the field name was wrong.
Maintaining the index
The index is generated. Do not hand-edit it. Everything between the ADR-INDEX:START / ADR-INDEX:END markers is derived from the ADR files themselves:
node scripts/gen-adr-index.cjs # print the index
node scripts/gen-adr-index.cjs --write # regenerate it into this file
node scripts/gen-adr-index.cjs --check # CI: fail if stale or invalid
After adding an ADR, or changing any ADR's status or relations, run --write and commit the result. npm run lint:generated-sync runs --check in CI, so a missing or stale row fails the build rather than rotting silently.
This replaces a hand-maintained table that had drifted to 40 of 65 ADRs — the entire capability family and EoS itself were missing from it, which is precisely why the ADRs a reader most needed were the ones they could not find.
Index
Active decisions (53)
These govern the system as it stands. Cite these.
| ADR | Title | Status | Read first |
|---|---|---|---|
| ADR-0001 | Dispatch policy module as single seam for query execution outcomes | Accepted | — |
| ADR-0002 | Command Contract Validation Module | Accepted | — |
| ADR-0003 | Model Catalog Module as single source of truth for agent profiles and runtime tier defaults | Accepted | — |
| ADR-0004 | Planning Workspace Module as single seam for worktree and workstream state | Accepted | — |
| ADR-0006 | Planning Path Projection Module for SDK query handlers | Accepted | — |
| ADR-0008 | Installer Migration Module owns install-time upgrade safety | Accepted | — |
| ADR-0009 | Shell Command Projection Module owns runtime-aware OS command rendering | Accepted | — |
| ADR-0011 | review.default_reviewers config key scopes the no-flag /gsd-review fan-out |
Accepted | — |
| ADR-0011 | Skill Surface Budget Module owns install-time profile staging and runtime surface control | Accepted | ADR-857 |
| ADR-15 | Cross-AI Plan Convergence via Existing Orchestration Commands | Accepted | — |
| ADR-22 | Plan-vs-codebase drift guard: defaults and symbol-resolver seam | Accepted | — |
| ADR-58 | Runtime Install Policy Module owns the typed install-plan projection | Accepted | ADR-1239, ADR-857 |
| ADR-0174 | Retire @opengsd/gsd-sdk package boundary — single-runtime collapse | Accepted | — |
| ADR-218 | Harden release-workflow version validation — reject leading zeros and pre-check npm | Accepted | — |
| ADR-227 | Input validation must check semantic shape, not just type | Accepted | — |
| ADR-415 | Prevent stale-base reintroduction of retired runtime tokens | Accepted | — |
| ADR-452 | Adopt standard ESLint flat-config lint harness | Accepted | — |
| ADR-456 | Test-rigor architecture — deterministic scheduling, antagonistic tier, typed-surface mandate, and delete-bad-tests policy | Accepted | — |
| ADR-457 | Generation model for bin/lib/*.cjs type safety |
Accepted | — |
| ADR-550 | spec-phase probe pattern and prohibition contract | Accepted | — |
| ADR-0656 | Research Module — L2-hybrid seam for cached, curated-first research | Accepted | — |
| ADR-766 | Claude Code Plugin Manifest Module owns the projection of gsd-core surfaces onto the Claude Code plugin contract | Accepted | — |
| ADR-857 | Capability system — five-step loop as core, features as plug-ins behind Loop Extension Points | Accepted | — |
| ADR-894 | Capability declaration format + registry generation | Accepted | ADR-1239 |
| ADR-959 | Capability Command Contribution | Accepted | — |
| ADR-1016 | Runtime Capability Descriptor | Accepted | ADR-1239 |
| ADR-1235 | Migrate agent conversion to the descriptor-driven install path | Accepted | — |
| ADR-1239 | GSD as an Embeddable Orchestration Engine | Accepted | — |
| ADR-1244 | Capability Ecosystem: third-party authoring, versioned manifests, and URL import/upgrade/remove | Accepted | — |
| ADR-1372 | Canonical markdown-structure parsing — the markdown-sectionizer seam |
Accepted | — |
| ADR-1411 | Resolution must report provenance, not fall open silently | Accepted | — |
| ADR-1508 | Runtime Artifact Conversion Module owns per-runtime content rewriting | Accepted | — |
| ADR-1517 | Reviewer instances — bounded config surface for same-adapter multi-model review | Accepted | — |
| ADR-1577 | Untrusted-input boundary + opt-in injection blocking | Accepted | — |
| ADR-1593 | Skill mapping & converter methodology across runtimes | Accepted | — |
| ADR-1610 | workflow & agent size-budget ratchet (per-file byte baseline + tier hard caps) | Accepted | — |
| ADR-1703 | Cross-platform portability enforcement as AST ESLint rules | Accepted | — |
| ADR-1769 | STATE.md Transition Module — intent-based transitions over scattered RMW callbacks | Accepted | — |
| ADR-1787 | /gsd:next smart-entry front door delegates advancement to /gsd:progress --next |
Accepted | — |
| ADR-1817 | STATE.md rebuild — derivability contract (capstone transition) | Accepted | — |
| ADR-1820 | Spec-Optional Predicate Rail — the Spec-Section Detection Module, the fallback toggle, and the SPEC↔probe precedence contract | Accepted | — |
| ADR-1866 | agent_skills dual injection — orchestrator-side + agent-side self-load | Accepted | — |
| ADR-1990 | Existing Code Onboarding Module owns deterministic repo-state detection and onboarding route selection | Accepted | — |
| ADR-2008 | Generic gate-predicate evaluator (command-exit-zero) |
Accepted | — |
| ADR-2121 | Phase-Identifier Parsing Consolidation | Accepted | — |
| ADR-2143 | Markdown Table Model, Bounded Mutation, and Fail-Loud Consolidation (#1372 part 2) | Accepted | — |
| ADR-2164 | Statusline draws its data boundary at local, read-only sources | Accepted | — |
| ADR-2207 | STATE.md Status lifecycle — phase-completion writes an intermediate state; milestone-close owns termination |
Accepted | — |
| ADR-2346 | Command Dispatch Completion | Accepted | — |
| ADR-2629 | Phase effort is estimated against a calibrated smart-zone budget, not a static heuristic | Accepted | — |
| ADR-2719 | Emitted-artifact attribution — replace the committed parity fixtures with a computed conservation law | Accepted | — |
| ADR-2782 | Reviewer Lane — the cross-AI reviewer handoff becomes a declared capability surface | Accepted | — |
| ADR-3660 | Runtime Artifact Layout Module owns per-runtime artifact placement | Accepted | ADR-1239 |
Proposed (8)
Decided in principle, not yet ratified. Do not cite as settled architecture.
| ADR | Title | Status | Read first |
|---|---|---|---|
| ADR-230 | Introduce next as a long-lived integration branch |
Proposed | — |
| ADR-443 | Unified cross-provider effort controls and fast-mode-aware routing | Proposed | — |
| ADR-612 | Bracket Phase-ID Convention | Proposed | — |
| ADR-660 | Release from the head of next; immutable release tags; @next dist-tag as the RC surface |
Proposed | — |
| ADR-1143 | Claude orchestration capability — Workflow tool (ultracode) as a runtime-gated loop execution backend | Proposed | — |
| ADR-1213 | Capability write side — the Capability State Writer | Proposed | — |
| ADR-1606 | prohibition-enforcement verify-time seam | Proposed | — |
| ADR-1671 | Dynamic context management platform | Proposed | — |
Superseded, Retired, and Legacy (8)
Historical record. Do not follow these — each names what replaced it, or why it was retired.
| ADR | Title | Status | Replaced by |
|---|---|---|---|
| ADR-0005 | SDK Architecture seam map for query/runtime surfaces | Superseded | ADR-0174 |
| ADR-0007 | SDK Package Seam Module owns SDK-to-get-shit-done-redux compatibility | Superseded | ADR-0174 |
| ADR-0010 | File Operation Engine Module owns safe runtime/config file mutations | Superseded | ADR-0009 |
| ADR-0010 | Skill Surface Budget Module owns install-time skill listing curation | Superseded | ADR-0011 |
| ADR-0011 | PRD — review.default_reviewers config key for /gsd-review reviewer selection |
Legacy | — |
| ADR-0012 | CommandRoutingHub as single dispatch seam for CJS command families | Superseded | ADR-0174 |
| ADR-2264 | Redesign golden-install-parity — single-source manifest builder + split invariant | Superseded | ADR-2719 |
| ADR-3524 | CJS↔SDK hard seam — one source of truth per Shared Module | Superseded | ADR-0174 |
69 ADRs. Generated by scripts/gen-adr-index.cjs — run --write after adding or restatusing an ADR.
Seam map
Orientation for the module-ownership ADRs. This section is prose and hand-maintained; the index above is the authority on status.
How GSD meets a host — start at ADR-1239 (EoS). It is the current frame and subsumes the descriptor/projection ADRs (ADR-1016, ADR-58, ADR-3660, ADR-894) as adapters beneath it.
The SDK seam map is gone. ADR-0005 was once the entry point for SDK module ownership; it is superseded by ADR-0174, which retired the @opengsd/gsd-sdk package boundary entirely. There is no sdk/ tree. Read ADR-0174 for the single-runtime collapse; the seam-Module vocabulary survives under one src/.
ADR-0006 documents how query handlers project planning paths (cwd → effectiveRoot → .planning/<project>/...). Cross-reference the Planning Workspace Module (ADR-0004) for workstream pointer policy.
ADR-0008 documents the Installer Migration Module for safe install-time moves, removals, config rewrites, and user-data preservation.
ADR-0009 documents the Shell Command Projection Module seam for runtime-aware projection of installer-owned command text and projection IR. Its Phases 3–4 absorbed the File Operation Engine Module (ADR-0010).
ADR-0011 documents the Skill Surface Budget Module for install-time skill/agent profile staging (--profile=<name>, .gsd-profile marker, requires: closure) and the Phase 2 runtime /gsd:surface command.
ADR-1411 establishes the Resolution Provenance principle: context resolution (config loading, project-root anchoring, workstream resolution) must report its provenance rather than fall open silently to defaults. It is the resolution-side analog of ADR-227 (input-validation shape).