@hegemonart/get-design-done 1.0.7 → 1.13.3

package/hooks/update-check.sh

@@ -0,0 +1,238 @@
+#!/usr/bin/env bash
+# get-design-done — update check (Phase 13.3)
+# SessionStart hook. Silent-on-failure by policy (D-04): exits 0 on every error path.
+# 24h-cached unauthenticated GET of /releases/latest. Renders .design/update-available.md
+# only when a newer version exists AND it is not dismissed AND stage-guard allows.
+
+set -u  # intentionally no -e: we want to fall through to exit 0
+
+PLUGIN_ROOT="${CLAUDE_PLUGIN_ROOT:-$(cd "$(dirname "$0")/.." && pwd)}"
+PLUGIN_ROOT="${PLUGIN_ROOT//\\//}"  # Windows → POSIX slashes
+
+DESIGN_DIR="$(pwd)/.design"
+CACHE="${DESIGN_DIR}/update-cache.json"
+BANNER="${DESIGN_DIR}/update-available.md"
+CONFIG="${DESIGN_DIR}/config.json"
+STATE="${DESIGN_DIR}/STATE.md"
+CACHE_TTL_SECONDS=86400  # 24h
+
+# Silent logger — writes nothing by default. Set GDD_UPDATE_DEBUG=1 to enable stderr.
+log() {
+  if [ "${GDD_UPDATE_DEBUG:-0}" = "1" ]; then
+    printf '[gdd update-check] %s\n' "$*" >&2
+  fi
+}
+
+# Ensure .design/ exists (bootstrap normally creates it; belt+suspenders).
+mkdir -p "${DESIGN_DIR}" 2>/dev/null || exit 0
+
+# ---- Read current plugin version (no jq) ----
+PLUGIN_JSON="${PLUGIN_ROOT}/.claude-plugin/plugin.json"
+
+read_current_tag() {
+  [ -f "${PLUGIN_JSON}" ] || return 1
+  grep -E '^[[:space:]]*"version"[[:space:]]*:' "${PLUGIN_JSON}" | head -n1 | \
+    sed -E 's/.*"version"[[:space:]]*:[[:space:]]*"([^"]+)".*/\1/'
+}
+
+# ---- Semver normalizer: "v1.0.7" -> "1 0 7 0"; "v1.0.7.3" -> "1 0 7 3" ----
+normalize_semver() {
+  local t="${1#v}"
+  # strip any -pre/-beta suffix after first hyphen (unauth'd API rarely surfaces these, best-effort)
+  t="${t%%-*}"
+  # Replace dots with spaces; pad to 4 segments
+  # shellcheck disable=SC2086
+  set -- $(printf '%s' "${t}" | tr '.' ' ')
+  local a="${1:-0}" b="${2:-0}" c="${3:-0}" d="${4:-0}"
+  # Sanitize to digits only (POSIX: tr -cd 0-9 — BSD+GNU safe)
+  a="$(printf '%s' "$a" | tr -cd '0-9')"; a="${a:-0}"
+  b="$(printf '%s' "$b" | tr -cd '0-9')"; b="${b:-0}"
+  c="$(printf '%s' "$c" | tr -cd '0-9')"; c="${c:-0}"
+  d="$(printf '%s' "$d" | tr -cd '0-9')"; d="${d:-0}"
+  printf '%s %s %s %s' "$a" "$b" "$c" "$d"
+}
+
+# ---- Classify delta: compare 4-segment tuples ----
+# Args: current_tag latest_tag
+# Prints: "newer|same|older|invalid" + "major|minor|patch|off-cadence|none"
+classify_delta() {
+  local cur lat
+  cur="$(normalize_semver "$1")" || { printf 'invalid none'; return; }
+  lat="$(normalize_semver "$2")" || { printf 'invalid none'; return; }
+  # shellcheck disable=SC2086
+  set -- $cur; local ca="$1" cb="$2" cc="$3" cd="$4"
+  # shellcheck disable=SC2086
+  set -- $lat; local la="$1" lb="$2" lc="$3" ld="$4"
+
+  # Per-segment integer compare (lexicographic per segment by numeric value)
+  if   [ "$la" -gt "$ca" ]; then printf 'newer major'; return
+  elif [ "$la" -lt "$ca" ]; then printf 'older major'; return
+  fi
+  if   [ "$lb" -gt "$cb" ]; then printf 'newer minor'; return
+  elif [ "$lb" -lt "$cb" ]; then printf 'older minor'; return
+  fi
+  if   [ "$lc" -gt "$cc" ]; then printf 'newer patch'; return
+  elif [ "$lc" -lt "$cc" ]; then printf 'older patch'; return
+  fi
+  if   [ "$ld" -gt "$cd" ]; then printf 'newer off-cadence'; return
+  elif [ "$ld" -lt "$cd" ]; then printf 'older off-cadence'; return
+  fi
+  printf 'same none'
+}
+
+# ---- Cache freshness check: returns 0 if fresh (<24h old), 1 if stale or missing ----
+is_cache_fresh() {
+  [ -f "${CACHE}" ] || return 1
+  local now mtime age
+  now="$(date +%s)"
+  # BSD date -r on macOS; GNU stat -c on Linux; fall back to perl then python.
+  if mtime="$(date -r "${CACHE}" +%s 2>/dev/null)"; then :
+  elif mtime="$(stat -c %Y "${CACHE}" 2>/dev/null)"; then :
+  elif mtime="$(perl -e 'print((stat shift)[9])' "${CACHE}" 2>/dev/null)"; then :
+  else return 1
+  fi
+  [ -n "${mtime:-}" ] || return 1
+  age=$((now - mtime))
+  [ "${age}" -lt "${CACHE_TTL_SECONDS}" ]
+}
+
+# ---- Fetch latest release. Writes raw body to stdout on success, nothing on failure. ----
+fetch_latest() {
+  command -v curl >/dev/null 2>&1 || { log "no curl"; return 1; }
+  local url="https://api.github.com/repos/hegemonart/get-design-done/releases/latest"
+  curl -sf --max-time 3 -H 'Accept: application/vnd.github+json' "${url}" 2>/dev/null || return 1
+}
+
+# ---- Extract fields from the release JSON (no jq). Robust to whitespace; fails soft. ----
+extract_tag() {
+  grep -E '"tag_name"[[:space:]]*:' | head -n1 | sed -E 's/.*"tag_name"[[:space:]]*:[[:space:]]*"([^"]+)".*/\1/'
+}
+# Body extraction: python3-only. If python3 is absent, we intentionally return empty
+# (D-04 silent-on-failure posture). No awk/sed fallback — JSON string decoding in pure
+# bash is fragile and untested; empty excerpt is the correct degraded state.
+extract_body() {
+  command -v python3 >/dev/null 2>&1 || return 0
+  python3 -c 'import json,sys
+try:
+  d=json.load(sys.stdin)
+  b=d.get("body","") or ""
+  print(b[:500])
+except Exception:
+  pass' 2>/dev/null
+}
+
+# ---- Read .design/STATE.md stage field. Returns "brief"|"explore"|"plan"|"design"|"verify"|"" ----
+# Schema source: reference/STATE-TEMPLATE.md — `stage:` lives in both the frontmatter
+# and the <position> block with identical values per the write contract. We take the
+# first occurrence (head -n1), which is the frontmatter line.
+read_state_stage() {
+  [ -f "${STATE}" ] || { printf ''; return; }
+  grep -E '^stage:' "${STATE}" 2>/dev/null | head -n1 | sed -E 's/^stage:[[:space:]]*"?([^"[:space:]]+)"?.*/\1/'
+}
+
+# ---- Read .design/config.json for update_dismissed. Returns tag or empty. ----
+read_dismissed() {
+  [ -f "${CONFIG}" ] || { printf ''; return; }
+  grep -E '"update_dismissed"[[:space:]]*:' "${CONFIG}" 2>/dev/null | head -n1 | \
+    sed -E 's/.*"update_dismissed"[[:space:]]*:[[:space:]]*"([^"]+)".*/\1/'
+}
+
+# ---- Main control flow ----
+# MANDATORY sourcing guard: wrap the entire main flow so that `source update-check.sh`
+# (used by unit tests and interactive debugging) loads the function definitions without
+# executing steps 1-6 and exiting the sourcing shell. This is non-negotiable — the
+# semver self-test acceptance criterion sources this script.
+if [ "${BASH_SOURCE[0]}" = "$0" ]; then
+
+  CURRENT_TAG="$(read_current_tag)" || { log "no plugin.json"; exit 0; }
+  [ -n "${CURRENT_TAG:-}" ] || { log "no current version parsed"; exit 0; }
+  # Normalize to "vX.Y.Z" shape for display (plugin.json stores bare "1.0.7")
+  DISPLAY_CURRENT="v${CURRENT_TAG#v}"
+
+  # Optional --refresh forces a fresh fetch (called by plan 13.3-04's /gdd:check-update --refresh).
+  FORCE_REFRESH=0
+  for arg in "$@"; do
+    case "$arg" in
+      --refresh) FORCE_REFRESH=1 ;;
+    esac
+  done
+
+  # 1. Populate cache if missing/stale or forced.
+  if [ "${FORCE_REFRESH}" -eq 1 ] || ! is_cache_fresh; then
+    RAW="$(fetch_latest)" || RAW=""
+    if [ -n "${RAW}" ]; then
+      LATEST_TAG="$(printf '%s' "${RAW}" | extract_tag)"
+      BODY_EXCERPT="$(printf '%s' "${RAW}" | extract_body)"
+      # Strip control chars defensively (T-13.3-03)
+      BODY_EXCERPT="$(printf '%s' "${BODY_EXCERPT}" | tr -d '\000-\010\013\014\016-\037')"
+      if [ -n "${LATEST_TAG}" ]; then
+        read -r DELTA_STATE DELTA_KIND <<EOF
+$(classify_delta "${DISPLAY_CURRENT}" "${LATEST_TAG}")
+EOF
+        IS_NEWER=false
+        [ "${DELTA_STATE}" = "newer" ] && IS_NEWER=true
+        CHECKED_AT="$(date +%s)"
+        # Write cache atomically (write-to-tmp + rename) — T-13.3-04 mitigation
+        TMP="${CACHE}.tmp.$$"
+        {
+          printf '{\n'
+          printf '  "checked_at": %s,\n' "${CHECKED_AT}"
+          printf '  "current_tag": "%s",\n' "${DISPLAY_CURRENT}"
+          printf '  "latest_tag": "%s",\n' "${LATEST_TAG}"
+          printf '  "delta": "%s",\n' "${DELTA_KIND}"
+          printf '  "is_newer": %s,\n' "${IS_NEWER}"
+          # Escape the body for JSON — backslashes first, then quotes, then newlines.
+          ESC="$(printf '%s' "${BODY_EXCERPT}" | sed -e 's/\\/\\\\/g' -e 's/"/\\"/g' | awk '{printf "%s\\n", $0}')"
+          printf '  "changelog_excerpt": "%s"\n' "${ESC}"
+          printf '}\n'
+        } > "${TMP}" 2>/dev/null && mv "${TMP}" "${CACHE}" 2>/dev/null || rm -f "${TMP}" 2>/dev/null
+      fi
+    fi
+  fi
+
+  # 2. Read cache (whether freshly written or still valid).
+  [ -f "${CACHE}" ] || exit 0  # no cache, nothing to do — silent exit
+
+  C_LATEST="$(grep -E '"latest_tag"' "${CACHE}" 2>/dev/null | head -n1 | sed -E 's/.*"latest_tag"[[:space:]]*:[[:space:]]*"([^"]+)".*/\1/')"
+  C_DELTA="$(grep -E '"delta"' "${CACHE}" 2>/dev/null | head -n1 | sed -E 's/.*"delta"[[:space:]]*:[[:space:]]*"([^"]+)".*/\1/')"
+  C_NEWER="$(grep -E '"is_newer"' "${CACHE}" 2>/dev/null | head -n1 | sed -E 's/.*"is_newer"[[:space:]]*:[[:space:]]*(true|false).*/\1/')"
+  C_BODY="$(grep -E '"changelog_excerpt"' "${CACHE}" 2>/dev/null | head -n1 | sed -E 's/.*"changelog_excerpt"[[:space:]]*:[[:space:]]*"(.*)".*/\1/' | sed -E 's/\\n/\n/g')"
+
+  # 3. Gate: if cache says not newer, remove any stale banner and exit.
+  if [ "${C_NEWER:-false}" != "true" ]; then
+    rm -f "${BANNER}" 2>/dev/null
+    exit 0
+  fi
+
+  # 4. Dismissal gate (D-13): if user already dismissed this exact tag, suppress.
+  DISMISSED="$(read_dismissed)"
+  if [ -n "${DISMISSED}" ] && [ "${DISMISSED}" = "${C_LATEST}" ]; then
+    rm -f "${BANNER}" 2>/dev/null
+    exit 0
+  fi
+
+  # 5. State-machine guard (D-11/D-12): suppress during plan|design|verify.
+  STAGE="$(read_state_stage)"
+  case "${STAGE}" in
+    plan|design|verify)
+      rm -f "${BANNER}" 2>/dev/null
+      exit 0
+      ;;
+  esac
+
+  # 6. All gates passed — render the banner atomically.
+  TMP="${BANNER}.tmp.$$"
+  {
+    printf '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n'
+    printf ' 📦 Plugin update: %s → %s (%s)\n' "${DISPLAY_CURRENT}" "${C_LATEST}" "${C_DELTA}"
+    if [ -n "${C_BODY}" ]; then
+      printf '%s\n' "${C_BODY}"
+    fi
+    printf ' Install: /gdd:update   Dismiss: /gdd:check-update --dismiss\n'
+    printf '━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n'
+  } > "${TMP}" 2>/dev/null && mv "${TMP}" "${BANNER}" 2>/dev/null || rm -f "${TMP}" 2>/dev/null
+
+  exit 0
+fi
+# When sourced (BASH_SOURCE != $0), fall through with function definitions loaded
+# and without side effects. Sourcing callers must invoke functions explicitly.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hegemonart/get-design-done",
-  "version": "1.0.7",
+  "version": "1.13.3",
   "description": "A Claude Code plugin for systematic design improvement",
   "author": "Hegemon",
   "homepage": "https://github.com/hegemonart/get-design-done",

package/reference/authority-feeds.md

@@ -0,0 +1,72 @@
+# Authority Feeds — Whitelist
+
+> **Scope:** Curated whitelist of **design authorities** — sources that ship specs, guidelines, or named-practitioner curation. Consumed by `agents/design-authority-watcher.md` at runtime. Rejected kinds are listed explicitly below and enforced by `scripts/tests/test-authority-rejected-kinds.sh`.
+>
+> **Anti-slop thesis:** No Dribbble. No Behance. No LinkedIn. No generic trending aggregators. See `.planning/PROJECT.md` and `.planning/phases/13.2-external-authority-watcher/13.2-CONTEXT.md` §D-08.
+
+**Last reviewed:** 2026-04-19
+**Feed count:** 26 (updated each time a feed is added or removed)
+
+---
+
+## Spec sources (4-5 feeds)
+
+- **[WAI-ARIA Authoring Practices Guide](https://www.w3.org/WAI/ARIA/apg/)** — `kind: spec-source` · `url: https://github.com/w3c/aria-practices/releases.atom` · `cadence-hint: monthly` · *Normative accessibility patterns from the W3C ARIA working group; release-tagged on each APG update.*
+- **[Material Design 3](https://m3.material.io/)** — `kind: spec-source` · `url: https://github.com/material-components/material-web/releases.atom` · `cadence-hint: weekly` · *Google's design system release notes; new tokens and components land here first.*
+- **[Apple Human Interface Guidelines](https://developer.apple.com/design/human-interface-guidelines/)** — `kind: spec-source` · `url: https://developer.apple.com/news/releases/rss/releases.rss` · `cadence-hint: irregular` · *Apple developer release feed — HIG updates ship alongside SDK announcements.*
+- **[Fluent 2 Design System](https://fluent2.microsoft.design/)** — `kind: spec-source` · `url: https://github.com/microsoft/fluentui/releases.atom` · `cadence-hint: weekly` · *Microsoft's cross-platform design system; normative component API and token changes.*
+- **[W3C Design Tokens Community Group](https://www.w3.org/community/design-tokens/)** — `kind: spec-source` · `url: https://github.com/design-tokens/community-group/commits/main.atom` · `cadence-hint: monthly` · *Draft tokens format spec; commit feed surfaces spec edits before formal publication.*
+
+## Component systems (6-8 feeds)
+
+- **[Radix UI](https://www.radix-ui.com/)** — `kind: component-system` · `url: https://github.com/radix-ui/primitives/releases.atom` · `cadence-hint: weekly` · *Unstyled accessible primitives; release notes document ARIA behavior changes.*
+- **[shadcn/ui](https://ui.shadcn.com/)** — `kind: component-system` · `url: https://github.com/shadcn-ui/ui/releases.atom` · `cadence-hint: weekly` · *Copy-paste component library built on Radix + Tailwind; release notes map to new patterns.*
+- **[Shopify Polaris](https://polaris.shopify.com/)** — `kind: component-system` · `url: https://github.com/Shopify/polaris/releases.atom` · `cadence-hint: weekly` · *Shopify admin design system; commerce-tuned component patterns.*
+- **[IBM Carbon](https://carbondesignsystem.com/)** — `kind: component-system` · `url: https://github.com/carbon-design-system/carbon/releases.atom` · `cadence-hint: weekly` · *IBM's enterprise design system; strong on data-dense patterns and accessibility.*
+- **[GitHub Primer](https://primer.style/)** — `kind: component-system` · `url: https://github.com/primer/react/releases.atom` · `cadence-hint: weekly` · *GitHub's design system; opinionated developer-tool patterns.*
+- **[Atlassian Design System](https://atlassian.design/)** — `kind: component-system` · `url: https://github.com/atlassian/design-system/releases.atom` · `cadence-hint: weekly` · *Jira/Confluence design system; strong on collaboration and editor patterns.*
+- **[Ant Design](https://ant.design/)** — `kind: component-system` · `url: https://github.com/ant-design/ant-design/releases.atom` · `cadence-hint: weekly` · *Enterprise React component library with deep form and table patterns.*
+- **[Mantine](https://mantine.dev/)** — `kind: component-system` · `url: https://github.com/mantinedev/mantine/releases.atom` · `cadence-hint: weekly` · *React components with hooks-first architecture; strong accessibility defaults.*
+
+## Research institutions (2-3 feeds)
+
+- **[Nielsen Norman Group Articles](https://www.nngroup.com/articles/)** — `kind: research` · `url: https://www.nngroup.com/feed/rss/` · `cadence-hint: weekly` · *UX research articles from the Nielsen Norman Group; heuristic updates and usability findings ship here.*
+- **[Laws of UX](https://lawsofux.com/)** — `kind: research` · `url: https://github.com/jonyablonski/laws-of-ux/releases.atom` · `cadence-hint: monthly` · *Jon Yablonski's curated catalogue of psychology-rooted UX principles; release feed tracks new laws and revisions.*
+- **[Baymard Institute](https://baymard.com/)** — `kind: research` · `url: https://baymard.com/blog/rss` · `cadence-hint: monthly` · *E-commerce UX research with empirical benchmarks; public surface of their large-scale usability studies.*
+
+## Named practitioners (10-12 feeds)
+
+- **[Adam Wathan](https://adamwathan.me/)** — `kind: named-practitioner` · `url: https://adamwathan.me/feed.xml` · `cadence-hint: monthly` · *Tailwind creator; utility-first CSS, component API design, refactoring patterns.*
+- **[Ryan Mulligan](https://ryanmulligan.dev/)** — `kind: named-practitioner` · `url: https://ryanmulligan.dev/feed.xml` · `cadence-hint: monthly` · *CSS craft at spec-adjacent depth; cascade layers, container queries, color functions.*
+- **[Rachel Andrew](https://rachelandrew.co.uk/)** — `kind: named-practitioner` · `url: https://rachelandrew.co.uk/feed/atom` · `cadence-hint: monthly` · *CSS Working Group member; grid, layout, and evolving layout-engine features.*
+- **[Josh W. Comeau](https://www.joshwcomeau.com/)** — `kind: named-practitioner` · `url: https://www.joshwcomeau.com/rss.xml` · `cadence-hint: monthly` · *Interactive explainers on CSS, animation, and React rendering; durable reference-quality deep dives.*
+- **[Ahmad Shadeed](https://ishadeed.com/)** — `kind: named-practitioner` · `url: https://ishadeed.com/rss.xml` · `cadence-hint: monthly` · *CSS layout and component articles grounded in real interface patterns.*
+- **[Sara Soueidan](https://www.sarasoueidan.com/)** — `kind: named-practitioner` · `url: https://www.sarasoueidan.com/feed.xml` · `cadence-hint: quarterly` · *SVG, accessibility, and inclusive design with spec-level rigor.*
+- **[Lea Verou](https://lea.verou.me/)** — `kind: named-practitioner` · `url: https://lea.verou.me/feed/atom` · `cadence-hint: quarterly` · *CSS Working Group invited expert; writes about the spec surface before it ships.*
+- **[Scott Jehl](https://scottjehl.com/)** — `kind: named-practitioner` · `url: https://scottjehl.com/feed/` · `cadence-hint: monthly` · *Progressive enhancement and web performance; long-form durable analysis.*
+- **[Heydon Pickering](https://heydonworks.com/)** — `kind: named-practitioner` · `url: https://heydonworks.com/feed.xml` · `cadence-hint: irregular` · *Accessibility-first component design; Inclusive Components author.*
+- **[Una Kravets](https://una.im/)** — `kind: named-practitioner` · `url: https://una.im/feed.xml` · `cadence-hint: monthly` · *Chrome DevRel on CSS; surfaces and explains new platform capabilities.*
+
+## User-added Are.na channels (user-extensible)
+
+Are.na channels are user-curated reference collections. Add your own channel by appending an entry to this section following the schema shown in the commented template below. The watcher fetches `https://api.are.na/v2/channels/<slug>/contents` and treats each block addition as a new entry.
+
+<!--
+- **[My Design Refs](https://are.na/my-handle/my-design-refs)** — `kind: arena` · `url: https://api.are.na/v2/channels/my-design-refs/contents` · `cadence-hint: irregular` · *Personal channel of pattern references.*
+-->
+
+## Rejected kinds
+
+The following hosts and feed kinds are **explicitly rejected** from this whitelist. This list is enforced by `scripts/tests/test-authority-rejected-kinds.sh` — any merge that adds a matching URL fails CI.
+
+- **dribbble.com** — visual-trend aggregator; no normative content, no named-practitioner curation.
+- **behance.net** — portfolio aggregator; same category.
+- **linkedin.com** — social feed; signal-to-noise ratio incompatible with the plugin's anti-slop thesis.
+- **medium.com/topic/\*** — generic topic feeds; named Medium authors may appear as `named-practitioner` entries, but topic-level feeds are rejected wholesale.
+- **"trending"-style aggregators** (e.g., product-hunt daily digests, "top 10 UI" roundups) — curatorial output indistinguishable from advertising.
+
+Rationale: the whitelist is restricted to sources that ship specs, guidelines, or named-practitioner curation (PROJECT.md, ROADMAP.md SC 8, CONTEXT.md D-08).
+
+---
+
+**How to propose a new feed:** open a PR that adds an entry to the appropriate `## <kind>` section. Are.na channel additions go in the Are.na section and do not require approval beyond CI-green. All other additions are reviewed against the anti-slop thesis.

package/reference/schemas/authority-snapshot.schema.json

@@ -0,0 +1,42 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://raw.githubusercontent.com/hegemonart/get-design-done/main/reference/schemas/authority-snapshot.schema.json",
+  "title": "AuthoritySnapshot",
+  "description": "Structure of .design/authority-snapshot.json produced by agents/design-authority-watcher.md. See .planning/phases/13.2-external-authority-watcher/13.2-CONTEXT.md §D-12.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["version", "generated_at", "feeds"],
+  "properties": {
+    "version": { "const": 1 },
+    "generated_at": { "type": "string", "format": "date-time" },
+    "feeds": {
+      "type": "object",
+      "additionalProperties": { "$ref": "#/definitions/feedState" }
+    }
+  },
+  "definitions": {
+    "feedState": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["last_fetched_at", "entries"],
+      "properties": {
+        "last_fetched_at": { "type": "string", "format": "date-time" },
+        "etag": { "type": "string" },
+        "entries": {
+          "type": "array",
+          "maxItems": 200,
+          "items": { "$ref": "#/definitions/entry" }
+        }
+      }
+    },
+    "entry": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "hash"],
+      "properties": {
+        "id": { "type": "string", "minLength": 1 },
+        "hash": { "type": "string", "pattern": "^[0-9a-f]{64}$" }
+      }
+    }
+  }
+}

package/reference/schemas/config.schema.json

@@ -36,6 +36,10 @@
           }
         }
       }
+    },
+    "update_dismissed": {
+      "type": "string",
+      "description": "Latest plugin tag (e.g. \"v1.0.7.3\") whose update nudge the user has dismissed. Set by /gdd:check-update --dismiss and by hooks/update-check.sh on the --dismiss code path. When a newer tag ships, the nudge reappears."
     }
   }
 }

package/reference/schemas/marketplace.schema.json

@@ -25,7 +25,7 @@
       "required": ["description", "version"],
       "properties": {
         "description": { "type": "string", "minLength": 1 },
-        "version": { "type": "string", "pattern": "^\\d+\\.\\d+\\.\\d+$" }
+        "version": { "type": "string", "pattern": "^\\d+\\.\\d+\\.\\d+(\\.\\d+)?$" }
       }
     },
     "plugins": {
@@ -48,7 +48,7 @@
           "name": { "type": "string", "minLength": 1 },
           "source": { "type": "string", "minLength": 1 },
           "description": { "type": "string", "minLength": 1 },
-          "version": { "type": "string", "pattern": "^\\d+\\.\\d+\\.\\d+$" },
+          "version": { "type": "string", "pattern": "^\\d+\\.\\d+\\.\\d+(\\.\\d+)?$" },
           "author": {
             "type": "object",
             "additionalProperties": true,

package/reference/schemas/plugin.schema.json

@@ -28,7 +28,7 @@
     },
     "version": {
       "type": "string",
-      "pattern": "^\\d+\\.\\d+\\.\\d+$"
+      "pattern": "^\\d+\\.\\d+\\.\\d+(\\.\\d+)?$"
     },
     "description": {
       "type": "string",

package/scripts/tests/test-authority-rejected-kinds.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+# test-authority-rejected-kinds.sh
+#
+# Asserts that reference/authority-feeds.md does NOT contain trend-aggregator
+# hosts OUTSIDE the explicit "## Rejected kinds" section. Enforces the anti-slop
+# thesis structurally (CONTEXT.md D-08, D-28).
+#
+# Exit 0 = clean. Exit 1 = at least one rejected host appeared in the active
+# whitelist, or the rejected-kinds section itself was removed.
+
+set -euo pipefail
+
+WHITELIST="${WHITELIST:-reference/authority-feeds.md}"
+
+if [ ! -f "$WHITELIST" ]; then
+  echo "FAIL: $WHITELIST not found." >&2
+  exit 1
+fi
+
+# Split the file at the "## Rejected kinds" heading. Everything BEFORE it is
+# the active whitelist; everything AFTER is the rejection manifest (which is
+# allowed to mention these hosts — that's the whole point).
+ACTIVE_SECTION="$(awk '/^## Rejected kinds/{exit} {print}' "$WHITELIST")"
+
+REJECTED_PATTERNS=(
+  'dribbble\.com'
+  'behance\.net'
+  'linkedin\.com'
+  'medium\.com/topic'
+  'producthunt\.com/posts'
+  'top[[:space:]]*10[[:space:]]*ui'
+  'trending-ui'
+)
+
+FAIL=0
+for pat in "${REJECTED_PATTERNS[@]}"; do
+  if echo "$ACTIVE_SECTION" | grep -iEq "$pat"; then
+    echo "FAIL: rejected pattern '$pat' matched in active whitelist section of $WHITELIST." >&2
+    FAIL=1
+  fi
+done
+
+if [ "$FAIL" -ne 0 ]; then
+  echo "" >&2
+  echo "The whitelist must not contain trend-aggregator hosts outside the '## Rejected kinds' block." >&2
+  echo "See .planning/phases/13.2-external-authority-watcher/13.2-CONTEXT.md §D-08." >&2
+  exit 1
+fi
+
+# Also assert the rejected-kinds section itself is present — regression against
+# someone deleting the section entirely.
+if ! grep -q '^## Rejected kinds$' "$WHITELIST"; then
+  echo "FAIL: '## Rejected kinds' section is missing from $WHITELIST." >&2
+  exit 1
+fi
+
+echo "OK: $WHITELIST passes rejected-kinds check."
+exit 0

package/scripts/tests/test-authority-watcher-diff.sh

@@ -0,0 +1,109 @@
+#!/usr/bin/env bash
+# test-authority-watcher-diff.sh
+#
+# Structural-only v1: validates that the frozen authority-report baseline at
+# test-fixture/baselines/phase-13.2/authority-report.expected.md preserves the
+# shape the watcher-diff test depends on. Full end-to-end byte-diff against a
+# live watcher run is deferred — CI cannot spawn Claude Code agents.
+#
+# What this test asserts (structural-only v1):
+#   1. The fixture directory exists and is non-empty.
+#   2. The baseline file exists, is non-empty, and starts with an Authority
+#      Report header.
+#   3. The baseline contains the canonical classification section headings in
+#      the D-21 weighted order (spec > heuristic > pattern > craft).
+#   4. The baseline declares a total-entries line consistent with the count of
+#      bulleted entries under its classification sections.
+#   5. The baseline ends with a `**Skipped:**` footer.
+#
+# Exit 0 = structural shape preserved. Exit 1 = shape drift detected.
+#
+# Full end-to-end byte-diff (running the watcher against the fixtures and
+# diffing stdout against the baseline) is a follow-up tracked in STATE.md
+# "Open follow-ups". When the agent runtime becomes available in CI this
+# script graduates from structural-only v1 to the full diff check.
+
+set -euo pipefail
+
+FIXTURE_DIR="test-fixture/authority-feeds"
+BASELINE="test-fixture/baselines/phase-13.2/authority-report.expected.md"
+
+if [ ! -d "$FIXTURE_DIR" ]; then
+  echo "FAIL: fixture dir $FIXTURE_DIR missing." >&2
+  exit 1
+fi
+
+# Count actual fixture files (should be 4 frozen feeds + 1 README; we only
+# care that at least one XML/JSON fixture is present).
+FIXTURE_COUNT=$(find "$FIXTURE_DIR" -maxdepth 1 -type f \( -name '*.atom' -o -name '*.rss' -o -name '*.json' \) | wc -l | tr -d ' ')
+if [ "$FIXTURE_COUNT" -lt 1 ]; then
+  echo "FAIL: $FIXTURE_DIR contains no feed fixtures (.atom/.rss/.json)." >&2
+  exit 1
+fi
+
+if [ ! -f "$BASELINE" ]; then
+  echo "FAIL: baseline $BASELINE missing." >&2
+  exit 1
+fi
+
+if [ ! -s "$BASELINE" ]; then
+  echo "FAIL: baseline $BASELINE is empty." >&2
+  exit 1
+fi
+
+# Header: must start with "# Authority Report"
+if ! head -1 "$BASELINE" | grep -q '^# Authority Report'; then
+  echo "FAIL: baseline does not begin with '# Authority Report' header." >&2
+  exit 1
+fi
+
+# Totals line must declare a non-negative surfaced-entries count.
+if ! grep -qE '^[0-9]+ entries surfaced across [0-9]+ feeds\. [0-9]+ skipped\.$' "$BASELINE"; then
+  echo "FAIL: baseline is missing the 'N entries surfaced across M feeds. K skipped.' totals line." >&2
+  exit 1
+fi
+
+# Classification sections — at least one of the four non-skip buckets must
+# appear. (Empty buckets are omitted by D-21, but a well-shaped baseline
+# always has at least one.)
+SECTION_HITS=0
+for heading in '^## spec-change' '^## heuristic-update' '^## pattern-guidance' '^## craft-tip'; do
+  if grep -qE "$heading" "$BASELINE"; then
+    SECTION_HITS=$((SECTION_HITS + 1))
+  fi
+done
+
+if [ "$SECTION_HITS" -lt 1 ]; then
+  echo "FAIL: baseline does not contain any classification heading (spec-change / heuristic-update / pattern-guidance / craft-tip)." >&2
+  exit 1
+fi
+
+# Count consistency check: the header's "N entries surfaced" must match the
+# total bulleted entries across the four classification sections.
+HEADER_COUNT=$(grep -oE '^[0-9]+ entries surfaced' "$BASELINE" | head -1 | grep -oE '^[0-9]+')
+
+# Extract the body between the first "## spec-change|heuristic-update|pattern-guidance|craft-tip"
+# heading and the closing "---" horizontal rule before the Skipped footer.
+BULLET_COUNT=$(awk '
+  /^## (spec-change|heuristic-update|pattern-guidance|craft-tip)/ { in_section=1; next }
+  /^---$/ { in_section=0 }
+  in_section && /^- / { count++ }
+  END { print count+0 }
+' "$BASELINE")
+
+if [ "$HEADER_COUNT" != "$BULLET_COUNT" ]; then
+  echo "FAIL: baseline header declares $HEADER_COUNT entries but the classification sections contain $BULLET_COUNT bullets." >&2
+  echo "      Counts MUST match — regenerate the baseline or fix the header." >&2
+  exit 1
+fi
+
+# Footer: must have a Skipped line.
+if ! grep -qE '^\*\*Skipped:\*\*' "$BASELINE"; then
+  echo "FAIL: baseline is missing the '**Skipped:**' footer line." >&2
+  exit 1
+fi
+
+echo "OK: authority-report baseline shape preserved (structural-only v1)."
+echo "    Fixtures: $FIXTURE_COUNT files under $FIXTURE_DIR"
+echo "    Entries:  $HEADER_COUNT (header) = $BULLET_COUNT (bullets)"
+exit 0

package/scripts/validate-schemas.cjs

@@ -69,6 +69,14 @@ const PAIRS = [
     data: null,
     required: false,
   },
+  {
+    name: 'authority-snapshot',
+    schema: 'reference/schemas/authority-snapshot.schema.json',
+    // .design/authority-snapshot.json is runtime-only (gitignored via .design/).
+    // Only schema-compile it; Phase 13.2-02's watcher emits the data file at runtime.
+    data: null,
+    required: false,
+  },
 ];
 
 const USE_NPX = !process.argv.includes('--no-npx');
@@ -76,11 +84,20 @@ const USE_NPX = !process.argv.includes('--no-npx');
 /**
  * Try running ajv-cli via npx. Returns { ok, stdout, stderr, status, fetchFailed }.
  * fetchFailed=true if npx couldn't fetch the package (offline); caller should fall back.
+ *
+ * We pass `-c ajv-formats` so schemas declaring `format: "date-time"` (etc.) are
+ * validated against the standard JSON Schema formats plugin rather than being
+ * rejected as unknown formats under ajv's strict mode. Schemas that declare no
+ * formats (e.g., plugin, marketplace) are unaffected.
  */
 function runAjv(args) {
+  const injected = [...args];
+  // Inject `-c ajv-formats` after the sub-command (compile/validate) but before -s flags.
+  // Simpler: just append; ajv-cli accepts -c at any position.
+  injected.push('-c', 'ajv-formats');
   const result = spawnSync(
     'npx',
-    ['--yes', 'ajv-cli@5', ...args],
+    ['--yes', '-p', 'ajv-cli@5', '-p', 'ajv-formats@3', 'ajv', ...injected],
     { encoding: 'utf8', cwd: REPO_ROOT }
   );
   const combined = (result.stdout || '') + (result.stderr || '');

package/skills/audit/SKILL.md

@@ -2,7 +2,7 @@
 name: gdd-audit
 description: "Run design audit — wraps design-verifier + design-auditor + design-reflector. --retroactive audits the full cycle scope."
 argument-hint: "[--retroactive] [--quick] [--no-reflect]"
-tools: Read, Write, Task, Glob
+tools: Read, Write, Task, Glob, Bash
 ---
 
 # /gdd:audit
@@ -51,4 +51,14 @@ Run only `design-auditor` (skip `design-integration-checker`). Faster health che
 - Do not modify source files.
 - Do not rerun stages; this is a read-only audit.
 
+## Step 7 — Update notice (post-closeout surface)
+
+After the consolidated audit summary has been printed (and any reflection-proposal count appended), emit the plugin-update banner if one is present:
+
+```bash
+[ -f .design/update-available.md ] && cat .design/update-available.md
+```
+
+Written by `hooks/update-check.sh`; suppressed mid-pipeline and when the latest release is dismissed.
+
 ## AUDIT COMPLETE