Tom Boucher f9d9dfb4bc fix(#1627): scale security rigor by ASVS level (planner disposition + auditor depth) (#1636) ...

workflow.security_asvs_level was display-only — the planner hardcoded
'mitigate if ASVS L1 requires it' and the auditor only echoed the level,
so L2/L3 behaved identically to L1.

- New reference gsd-core/references/security-asvs-levels.md defines L1
  (opportunistic), L2 (standard), L3 (comprehensive) for both planner
  threat disposition and auditor verification depth (higher = superset).
- planner: disposition now scales with the configured ASVS level (no
  hardcoded L1) + @-pointer to the reference.
- auditor: verification depth scales with asvs_level (L1 grep-presence,
  L2 boundary/vector check, L3 end-to-end trace + bypass check).
- planning-config.md + INVENTORY updated; planner kept under its 48K cap
  by extracting the goal-backward worked example to planner-guidance.md.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-23 18:48:58 -04:00

..

discuss-phase

chore(#1073): purge phantom pre-migration issue refs from source, tests, docs (#1471)

2026-06-20 13:36:57 -04:00

execute-phase/steps

enhance(execute): isolated-executor rejected/over-reaching run fails safe — never default recovery to main (#1292) (#1303)

2026-06-15 20:53:38 -04:00

help/modes

feat(#441): add /gsd-capture --list-seeds for seed listing and audit (#722)

2026-06-22 00:59:41 -04:00

_runtime-launcher.snippet.sh

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

add-backlog.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

add-phase.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

add-tests.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

add-todo.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

ai-integration-phase.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

analyze-dependencies.md

chore(#604): rename get-shit-done/ runtime directory to gsd-core/ (#615)

2026-06-02 18:35:29 -04:00

audit-fix.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

audit-milestone.md

feat(#1137): migrate review verification hooks to capabilities (#1147)

2026-06-12 21:24:09 -04:00

audit-uat.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

autonomous.md

fix(#1521): resolve own runtime + worktrees-off for all non-Claude installs (#1537)

2026-06-21 13:48:47 -04:00

check-todos.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

cleanup.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

code-review-fix.md

feat(#1137): migrate review verification hooks to capabilities (#1147)

2026-06-12 21:24:09 -04:00

code-review.md

feat(#1137): migrate review verification hooks to capabilities (#1147)

2026-06-12 21:24:09 -04:00

complete-milestone.md

fix(#1146): single base-branch resolver across forking workflows (#1198)

2026-06-14 08:22:40 -04:00

debug.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

diagnose-issues.md

fix(#1521): resolve own runtime + worktrees-off for all non-Claude installs (#1537)

2026-06-21 13:48:47 -04:00

discovery-phase.md

chore(#604): rename get-shit-done/ runtime directory to gsd-core/ (#615)

2026-06-02 18:35:29 -04:00

discuss-phase-assumptions.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

discuss-phase-power.md

chore(#604): rename get-shit-done/ runtime directory to gsd-core/ (#615)

2026-06-02 18:35:29 -04:00

discuss-phase.md

chore(#1073): purge phantom pre-migration issue refs from source, tests, docs (#1471)

2026-06-20 13:36:57 -04:00

do.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

docs-update.md

fix(#1359): migrate workflows off deprecated TaskOutput to Read(outputFile) (#1362)

2026-06-16 21:55:45 -04:00

edit-phase.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

eval-review.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

execute-phase.md

feat(#1298): add validated worktree record-agent writer verb for wave manifests (#1448)

2026-06-21 15:38:44 -04:00

execute-plan.md

feat(#1602): deterministic coverage-metadata UAT routing for verify-work

2026-06-22 23:43:22 -04:00

explore.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

extract-learnings.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

fast.md

chore(#604): rename get-shit-done/ runtime directory to gsd-core/ (#615)

2026-06-02 18:35:29 -04:00

forensics.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

graduation.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

health.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

help.md

chore(#604): rename get-shit-done/ runtime directory to gsd-core/ (#615)

2026-06-02 18:35:29 -04:00

import.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

inbox.md

chore(#604): rename get-shit-done/ runtime directory to gsd-core/ (#615)

2026-06-02 18:35:29 -04:00

ingest-docs.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

insert-phase.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

list-phase-assumptions.md

chore(#604): rename get-shit-done/ runtime directory to gsd-core/ (#615)

2026-06-02 18:35:29 -04:00

list-seeds.md

feat(#441): add /gsd-capture --list-seeds for seed listing and audit (#722)

2026-06-22 00:59:41 -04:00

list-workspaces.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

manager.md

fix(#1521): resolve own runtime + worktrees-off for all non-Claude installs (#1537)

2026-06-21 13:48:47 -04:00

map-codebase.md

fix(#1359): migrate workflows off deprecated TaskOutput to Read(outputFile) (#1362)

2026-06-16 21:55:45 -04:00

milestone-summary.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

mvp-phase.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

new-milestone.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

new-project.md

fix(#1574): resolve review — copilot instruction file is .github/copilot-instructions.md

2026-06-22 09:56:15 -04:00

new-workspace.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

next.md

feat(#1190): wire --converge primary surface into /gsd:progress --next (ADR-15) (#1237)

2026-06-14 15:52:22 -04:00

node-repair.md

chore(#604): rename get-shit-done/ runtime directory to gsd-core/ (#615)

2026-06-02 18:35:29 -04:00

note.md

chore(#604): rename get-shit-done/ runtime directory to gsd-core/ (#615)

2026-06-02 18:35:29 -04:00

pause-work.md

feat(#1165): async external_job_waiting half-state + resume/pause contract (#1221)

2026-06-14 12:23:07 -04:00

plan-milestone-gaps.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

plan-phase.md

feat(#1592): add plan:pre codebase-drift pre-check before planner runs

2026-06-22 20:30:59 -04:00

plan-review-convergence.md

refactor(#1190): extract ADR-22 drift-guard decision logic into a testable seam (#1242)

2026-06-14 20:52:36 -04:00

plant-seed.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

pr-branch.md

fix(#666): pr-branch silently ignored planning.sub_repos (#667)

2026-06-21 22:34:00 -04:00

profile-user.md

fix(#1098): guard generate-claude-md against clobbering hand-crafted files; redirect default to .claude/CLAUDE.md (#1118)

2026-06-12 16:03:51 -04:00

progress.md

fix(#1107): progress consults verification.status before reporting a phase complete (#1116)

2026-06-12 15:55:01 -04:00

quick.md

fix(#1521): resolve own runtime + worktrees-off for all non-Claude installs (#1537)

2026-06-21 13:48:47 -04:00

reapply-patches.md

fix(#934): reapply verifier handles missing pristine baseline post-rename (#937)

2026-06-09 12:51:15 -04:00

remove-phase.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

remove-workspace.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

resume-project.md

feat(#1165): async external_job_waiting half-state + resume/pause contract (#1221)

2026-06-14 12:23:07 -04:00

review.md

feat(#1318): require external reviewers to verify plan claims against source (#1421)

2026-06-22 00:47:49 -04:00

scan.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

secure-phase.md

fix(#1627): scale security rigor by ASVS level (planner disposition + auditor depth) (#1636)

2026-06-23 18:48:58 -04:00

session-report.md

chore(#604): rename get-shit-done/ runtime directory to gsd-core/ (#615)

2026-06-02 18:35:29 -04:00

settings-advanced.md

fix(#1296): align config docs/prompts/schema with consumers (#1299)

2026-06-15 19:57:11 -04:00

settings-integrations.md

fix(#1296): align config docs/prompts/schema with consumers (#1299)

2026-06-15 19:57:11 -04:00

settings.md

feat(#1213): Capability State Writer — write-side inverse of the resolver (#1225)

2026-06-14 12:51:17 -04:00

ship.md

fix(#1146): single base-branch resolver across forking workflows (#1198)

2026-06-14 08:22:40 -04:00

sketch-wrap-up.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

sketch.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

spec-phase.md

enhance(verify-phase): node-test causation control — prove the RED is content-caused (#1346)

2026-06-21 10:44:48 -04:00

spike-wrap-up.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

spike.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

stats.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

sync-skills.md

chore(#604): rename get-shit-done/ runtime directory to gsd-core/ (#615)

2026-06-02 18:35:29 -04:00

thread.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

transition.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

ui-phase.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

ui-review.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

ultraplan-phase.md

fix(#381): make gsd_run launcher reachable in fresh-shell-per-block runtimes (#1084)

2026-06-11 21:42:52 -04:00

undo.md

chore(#604): rename get-shit-done/ runtime directory to gsd-core/ (#615)

2026-06-02 18:35:29 -04:00

update.md

feat(#791): migrate antigravity workspace base dir .agent → .agents (#1090)

2026-06-11 22:37:55 -04:00

validate-phase.md

feat(#1137): migrate review verification hooks to capabilities (#1147)

2026-06-12 21:24:09 -04:00

verify-phase.md

enhance(verify-phase): node-test causation control — prove the RED is content-caused (#1346)

2026-06-21 10:44:48 -04:00

verify-work.md

feat(#1602): deterministic coverage-metadata UAT routing for verify-work

2026-06-22 23:43:22 -04:00