@hegemonart/get-design-done 1.0.7

package/scripts/release-smoke-test.cjs

@@ -0,0 +1,169 @@
+#!/usr/bin/env node
+'use strict';
+// release-smoke-test.cjs — release-time smoke test per D-22.
+//
+// Validates that the freshly-checked-out tag produces a consistent plugin
+// surface. Runs deterministic (non-LLM) portions of /gdd:explore against
+// test-fixture/src/ in an isolated temp dir and diffs resulting artifacts
+// against the provided baseline directory. Exit code:
+//   0 — zero diffs, zero missing artifacts
+//   1 — one or more diffs or missing artifacts
+//   2 — baseline not found / argument error
+//
+// Does NOT invoke the `claude` CLI (unavailable on stock GitHub runners).
+// The LLM-dependent portions of /gdd:explore are intentionally out of scope;
+// this smoke test covers the intel builder + static analysis surface.
+//
+// Usage:
+//   node scripts/release-smoke-test.cjs --baseline <path>
+//   node scripts/release-smoke-test.cjs --baseline test-fixture/baselines/phase-13
+//   node scripts/release-smoke-test.cjs --baseline <path> --keep  # keep tmp dir
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const { spawnSync } = require('child_process');
+
+const args = process.argv.slice(2);
+const baselineIdx = args.indexOf('--baseline');
+const KEEP = args.includes('--keep');
+
+if (baselineIdx < 0 || !args[baselineIdx + 1]) {
+  console.error('Usage: node scripts/release-smoke-test.cjs --baseline <path> [--keep]');
+  process.exit(2);
+}
+
+const baselineDir = path.resolve(args[baselineIdx + 1]);
+if (!fs.existsSync(baselineDir) || !fs.statSync(baselineDir).isDirectory()) {
+  console.error(`baseline not found: ${baselineDir}`);
+  process.exit(2);
+}
+
+const REPO_ROOT = path.resolve(__dirname, '..');
+const FIXTURE_SRC = path.join(REPO_ROOT, 'test-fixture', 'src');
+
+if (!fs.existsSync(FIXTURE_SRC)) {
+  console.error(`fixture not found: ${FIXTURE_SRC}`);
+  process.exit(2);
+}
+
+const tmpDir = path.join(os.tmpdir(), `gdd-smoke-${Date.now()}`);
+fs.mkdirSync(tmpDir, { recursive: true });
+
+function copyRecursive(src, dst) {
+  fs.mkdirSync(dst, { recursive: true });
+  for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
+    const s = path.join(src, entry.name);
+    const d = path.join(dst, entry.name);
+    if (entry.isDirectory()) copyRecursive(s, d);
+    else fs.copyFileSync(s, d);
+  }
+}
+
+function cleanup() {
+  if (KEEP) {
+    console.log(`(kept) ${tmpDir}`);
+    return;
+  }
+  try {
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  } catch (_) {
+    /* best effort */
+  }
+}
+
+process.on('exit', cleanup);
+process.on('SIGINT', () => {
+  cleanup();
+  process.exit(130);
+});
+
+// ── Step 1: Copy fixture into isolated temp dir.
+const workDir = path.join(tmpDir, 'work');
+copyRecursive(FIXTURE_SRC, path.join(workDir, 'src'));
+
+// ── Step 2: Run deterministic intel builder against the temp dir.
+// build-intel.cjs uses process.cwd(); invoke it with cwd=workDir.
+const intelResult = spawnSync(
+  'node',
+  [path.join(REPO_ROOT, 'scripts', 'build-intel.cjs')],
+  { cwd: workDir, encoding: 'utf8' }
+);
+
+// Non-zero intel run is OK (fixture may lack some scan inputs) — log but don't fail.
+if (intelResult.status !== 0) {
+  console.log(`(note) build-intel exited ${intelResult.status} on fixture — continuing to baseline diff`);
+}
+
+// ── Step 3: Compare baseline files against the fresh run.
+const diffs = [];
+const missing = [];
+
+function walk(dir, base, out) {
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    const full = path.join(dir, entry.name);
+    const rel = path.relative(base, full);
+    if (entry.isDirectory()) walk(full, base, out);
+    else out.push(rel);
+  }
+}
+
+const baselineFiles = [];
+walk(baselineDir, baselineDir, baselineFiles);
+
+// Artifact resolution: for each baseline file, look for a sibling file in the
+// fresh run workDir (best-effort: baseline may contain reference manifests
+// that aren't produced by the deterministic pipeline — those count as
+// "present in baseline, not in run" and are recorded as missing_artifacts but
+// not as diffs).
+for (const rel of baselineFiles) {
+  const baselineFile = path.join(baselineDir, rel);
+  const freshCandidate1 = path.join(workDir, rel);
+  const freshCandidate2 = path.join(workDir, '.design', 'intel', path.basename(rel));
+
+  let freshFile = null;
+  if (fs.existsSync(freshCandidate1)) freshFile = freshCandidate1;
+  else if (fs.existsSync(freshCandidate2)) freshFile = freshCandidate2;
+
+  if (!freshFile) {
+    missing.push(rel);
+    continue;
+  }
+
+  const expected = fs.readFileSync(baselineFile, 'utf8').replace(/\r\n/g, '\n');
+  const actual = fs.readFileSync(freshFile, 'utf8').replace(/\r\n/g, '\n');
+
+  if (expected !== actual) {
+    diffs.push({
+      rel,
+      expected: expected.slice(0, 80),
+      actual: actual.slice(0, 80),
+    });
+  }
+}
+
+// ── Report.
+for (const d of diffs) {
+  console.log(`DIFF: ${d.rel}`);
+  console.log(`  Expected: ${d.expected.replace(/\n/g, '\\n')}`);
+  console.log(`  Actual:   ${d.actual.replace(/\n/g, '\\n')}`);
+}
+
+// Missing baseline artifacts are reported informationally. Baselines ship
+// reference material (like BASELINE.md) that the deterministic pipeline does
+// not regenerate — those are expected "missing in run" hits and are NOT treated
+// as failures. Only actual byte-level diffs fail the build.
+if (missing.length) {
+  console.log(`note: ${missing.length} baseline artifact(s) not regenerated by deterministic run:`);
+  for (const m of missing) console.log(`  - ${m}`);
+}
+
+console.log(`smoke-test: ${diffs.length} diffs, ${missing.length} baseline artifacts not in fresh run`);
+
+// Ensure .design/ was not created in the real repo root.
+if (fs.existsSync(path.join(REPO_ROOT, '.design'))) {
+  console.error('ERROR: .design/ polluted repo root — smoke test must use temp dir only');
+  process.exit(1);
+}
+
+process.exit(diffs.length > 0 ? 1 : 0);

package/scripts/rollback-release.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+# rollback-release.sh — manually delete a tag + GitHub Release. NOT called from CI.
+# Usage: bash scripts/rollback-release.sh <version>
+# Example: bash scripts/rollback-release.sh 1.0.7
+
+set -euo pipefail
+
+VERSION="${1:-}"
+if [ -z "$VERSION" ]; then
+  echo "Usage: $0 <version>"
+  echo "Example: $0 1.0.7"
+  exit 1
+fi
+
+TAG="v${VERSION}"
+REPO="${GITHUB_REPOSITORY:-hegemonart/get-design-done}"
+
+if ! command -v gh >/dev/null 2>&1; then
+  echo "ERROR: gh CLI not found."
+  exit 1
+fi
+
+echo "About to delete release + tag $TAG on $REPO."
+echo "This is a DESTRUCTIVE operation. Confirm (y/N): "
+read -r CONFIRM
+if [ "$CONFIRM" != "y" ]; then
+  echo "Aborted."
+  exit 0
+fi
+
+# Delete the GitHub Release (this also deletes the tag ref on github.com).
+gh release delete "$TAG" --repo "$REPO" --yes --cleanup-tag || {
+  echo "Release delete failed or no release existed; attempting tag-only delete."
+  gh api -X DELETE "repos/${REPO}/git/refs/tags/${TAG}" || true
+}
+
+# Also delete locally if the user has the tag.
+git tag -d "$TAG" 2>/dev/null || true
+
+echo "Rollback complete for $TAG."
+echo "Note: clones that already pulled the tag retain it. Consider posting"
+echo "      a deprecation note in the next CHANGELOG entry."

package/scripts/run-injection-scanner-ci.cjs

@@ -0,0 +1,92 @@
+#!/usr/bin/env node
+'use strict';
+// CI-mode wrapper over hooks/gdd-read-injection-scanner.js.
+// Scans all shipped reference/*.md, skills/**/SKILL.md, and agents/*.md for
+// prompt-injection patterns. Exits 0 on a clean tree, 1 on any finding.
+//
+// The patterns are imported indirectly by re-declaring them — the hook itself
+// is stdin-driven and cannot be required as a module. Keep these in sync with
+// hooks/gdd-read-injection-scanner.js.
+
+const fs = require('fs');
+const path = require('path');
+
+const REPO_ROOT = path.resolve(__dirname, '..');
+
+// Patterns mirror hooks/gdd-read-injection-scanner.js.
+const INJECTION_PATTERNS = [
+  { name: 'ignore previous', re: /ignore\s+(all\s+)?(previous|prior|above)\s+instructions?/i },
+  { name: 'disregard previous', re: /disregard\s+(all\s+)?(previous|prior|above)\s+instructions?/i },
+  { name: 'you are now a different', re: /you\s+are\s+now\s+a\s+different/i },
+  { name: 'system: you are', re: /system\s*:\s*you\s+are/i },
+  { name: 'role tag injection', re: /<\s*\/?\s*(system|assistant|human)\s*>/i },
+  { name: '[INST] fragment', re: /\[INST\]/i },
+  { name: '### instruction fragment', re: /###\s*instruction/i },
+];
+
+function walkMd(dir, out) {
+  if (!fs.existsSync(dir)) return;
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) walkMd(full, out);
+    else if (entry.isFile() && entry.name.endsWith('.md')) out.push(full);
+  }
+}
+
+function collectTargets() {
+  const targets = [];
+  // reference/ — all .md recursively
+  walkMd(path.join(REPO_ROOT, 'reference'), targets);
+  // skills/**/SKILL.md — only SKILL.md files
+  const skillsRoot = path.join(REPO_ROOT, 'skills');
+  const skillAccum = [];
+  walkMd(skillsRoot, skillAccum);
+  for (const f of skillAccum) {
+    if (path.basename(f) === 'SKILL.md') targets.push(f);
+  }
+  // agents/*.md (non-recursive)
+  const agentsRoot = path.join(REPO_ROOT, 'agents');
+  if (fs.existsSync(agentsRoot)) {
+    for (const entry of fs.readdirSync(agentsRoot, { withFileTypes: true })) {
+      if (entry.isFile() && entry.name.endsWith('.md')) {
+        targets.push(path.join(agentsRoot, entry.name));
+      }
+    }
+  }
+  return targets;
+}
+
+function main() {
+  const targets = collectTargets();
+  let findings = 0;
+
+  for (const file of targets) {
+    const body = fs.readFileSync(file, 'utf8');
+    const lines = body.split('\n');
+    let inFence = false;
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      // Track code fences — prompt-injection attacks live in prose, not in
+      // literal code/template blocks. Skip lines inside ``` ... ``` fences.
+      if (/^\s*```/.test(line)) {
+        inFence = !inFence;
+        continue;
+      }
+      if (inFence) continue;
+      for (const pat of INJECTION_PATTERNS) {
+        if (pat.re.test(line)) {
+          const rel = path.relative(REPO_ROOT, file);
+          const excerpt = line.trim().slice(0, 120);
+          console.log(`${rel}:${i + 1}: ${pat.name}: ${excerpt}`);
+          findings++;
+          break; // one finding per line is enough
+        }
+      }
+    }
+  }
+
+  console.log(`summary: ${targets.length} files scanned, ${findings} findings`);
+  process.exit(findings === 0 ? 0 : 1);
+}
+
+main();

package/scripts/validate-frontmatter.cjs

@@ -0,0 +1,68 @@
+#!/usr/bin/env node
+'use strict';
+// CI-friendly frontmatter validator for agents/*.md.
+// Enforces the Phase 7 agent frontmatter hygiene contract.
+// Exits 0 on success, 1 on any violation. One finding per stdout line.
+
+const fs = require('fs');
+const path = require('path');
+const { readFrontmatter } = require('../tests/helpers.cjs');
+
+const REQUIRED_FIELDS = [
+  'name',
+  'description',
+  'tools',
+  'color',
+  'parallel-safe',
+  'typical-duration-seconds',
+  'reads-only',
+  'writes',
+];
+
+function walkMd(dir) {
+  const out = [];
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) out.push(...walkMd(full));
+    else if (entry.isFile() && entry.name.endsWith('.md')) out.push(full);
+  }
+  return out;
+}
+
+function main() {
+  const args = process.argv.slice(2).filter((a) => !a.startsWith('--'));
+  const targets = args.length ? args : ['agents/'];
+  const files = [];
+  for (const t of targets) {
+    if (!fs.existsSync(t)) {
+      console.error(`${t}: path does not exist`);
+      process.exit(1);
+    }
+    const stat = fs.statSync(t);
+    if (stat.isDirectory()) files.push(...walkMd(t));
+    else files.push(t);
+  }
+
+  let violations = 0;
+  for (const f of files) {
+    const fm = readFrontmatter(f);
+    if (Object.keys(fm).length === 0) {
+      // README.md under agents/ may have no frontmatter — skip
+      if (path.basename(f).toLowerCase() === 'readme.md') continue;
+      console.log(`${f}:frontmatter: missing`);
+      violations++;
+      continue;
+    }
+    for (const field of REQUIRED_FIELDS) {
+      if (!(field in fm) || fm[field] === undefined || fm[field] === null || fm[field] === '') {
+        console.log(`${f}:${field}: missing`);
+        violations++;
+      }
+    }
+  }
+
+  console.log(`summary: ${files.length} file(s) checked, ${violations} violation(s)`);
+  process.exit(violations === 0 ? 0 : 1);
+}
+
+main();

package/scripts/validate-schemas.cjs

@@ -0,0 +1,225 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * validate-schemas.cjs
+ *
+ * Runs all Draft-07 JSON schemas under reference/schemas/ against their
+ * corresponding subject files. Used by `npm run validate:schemas` and by the
+ * CI validate job (added in plan 13-03).
+ *
+ * Primary path: spawn `npx --yes ajv-cli@5 validate -s <schema> -d <data>`.
+ *
+ * Fallback path: if `npx --yes` cannot fetch ajv-cli (offline/sandboxed
+ * environment), fall back to a structural parse check: confirm each schema is
+ * valid Draft-07 JSON (has $schema, type) and each data file is parseable JSON.
+ * The fallback exits 0 on structural validity; CI will run the real ajv pass.
+ *
+ * Usage:
+ *   node scripts/validate-schemas.cjs            # validate all schemas
+ *   node scripts/validate-schemas.cjs --no-npx   # force fallback path
+ *
+ * Exit codes:
+ *   0 — all present (schema, data) pairs pass
+ *   1 — one or more pairs failed validation or a present schema is invalid
+ */
+
+const { spawnSync } = require('child_process');
+const fs = require('fs');
+const path = require('path');
+
+const REPO_ROOT = path.resolve(__dirname, '..');
+const SCHEMA_DIR = path.join(REPO_ROOT, 'reference', 'schemas');
+
+/**
+ * (schema, data) pairs. `dataPath` is relative to repo root. `required=true`
+ * means the data file MUST exist in the repo; `required=false` means the data
+ * file is generated at runtime (gitignored) and only the schema itself is
+ * compiled.
+ */
+const PAIRS = [
+  {
+    name: 'plugin',
+    schema: 'reference/schemas/plugin.schema.json',
+    data: '.claude-plugin/plugin.json',
+    required: true,
+  },
+  {
+    name: 'marketplace',
+    schema: 'reference/schemas/marketplace.schema.json',
+    data: '.claude-plugin/marketplace.json',
+    required: true,
+  },
+  {
+    name: 'hooks',
+    schema: 'reference/schemas/hooks.schema.json',
+    data: 'hooks/hooks.json',
+    required: true,
+  },
+  {
+    name: 'config',
+    schema: 'reference/schemas/config.schema.json',
+    data: '.design/config.json',
+    required: false,
+  },
+  {
+    name: 'intel',
+    schema: 'reference/schemas/intel.schema.json',
+    // intel files are runtime-only (gitignored). Only schema-compile it.
+    data: null,
+    required: false,
+  },
+];
+
+const USE_NPX = !process.argv.includes('--no-npx');
+
+/**
+ * Try running ajv-cli via npx. Returns { ok, stdout, stderr, status, fetchFailed }.
+ * fetchFailed=true if npx couldn't fetch the package (offline); caller should fall back.
+ */
+function runAjv(args) {
+  const result = spawnSync(
+    'npx',
+    ['--yes', 'ajv-cli@5', ...args],
+    { encoding: 'utf8', cwd: REPO_ROOT }
+  );
+  const combined = (result.stdout || '') + (result.stderr || '');
+  // Heuristics for "network/fetch failed" — in that case fall back silently.
+  const fetchFailed =
+    result.status !== 0 &&
+    /(ENOTFOUND|ECONNREFUSED|ETIMEDOUT|getaddrinfo|network|unable to resolve|unable to fetch|offline|E404|registry\.npmjs\.org)/i.test(combined);
+  return {
+    ok: result.status === 0,
+    stdout: result.stdout || '',
+    stderr: result.stderr || '',
+    status: result.status,
+    fetchFailed,
+  };
+}
+
+/**
+ * Fallback: confirm schema file is a valid Draft-07 JSON Schema (has $schema
+ * pointing at draft-07). Confirm data file (if present) parses as JSON.
+ */
+function structuralCheck(schemaAbs, dataAbs) {
+  let schema;
+  try {
+    schema = JSON.parse(fs.readFileSync(schemaAbs, 'utf8'));
+  } catch (e) {
+    return { ok: false, reason: `schema not parseable JSON: ${e.message}` };
+  }
+  if (!schema.$schema || !/draft-07/.test(schema.$schema)) {
+    return { ok: false, reason: `schema missing Draft-07 $schema declaration` };
+  }
+  if (dataAbs) {
+    try {
+      JSON.parse(fs.readFileSync(dataAbs, 'utf8'));
+    } catch (e) {
+      return { ok: false, reason: `data file not parseable JSON: ${e.message}` };
+    }
+  }
+  return { ok: true };
+}
+
+function main() {
+  const results = [];
+  let fallbackReason = null;
+
+  for (const pair of PAIRS) {
+    const schemaAbs = path.join(REPO_ROOT, pair.schema);
+    const dataAbs = pair.data ? path.join(REPO_ROOT, pair.data) : null;
+
+    if (!fs.existsSync(schemaAbs)) {
+      results.push({
+        name: pair.name,
+        ok: false,
+        via: 'missing-schema',
+        reason: `schema not found at ${pair.schema}`,
+      });
+      continue;
+    }
+
+    const dataPresent = dataAbs && fs.existsSync(dataAbs);
+
+    if (!dataPresent && pair.required) {
+      results.push({
+        name: pair.name,
+        ok: false,
+        via: 'missing-data',
+        reason: `required data file missing at ${pair.data}`,
+      });
+      continue;
+    }
+
+    if (!dataPresent) {
+      // Schema-only: compile to confirm the schema is structurally valid.
+      if (USE_NPX && !fallbackReason) {
+        const r = runAjv(['compile', '-s', schemaAbs]);
+        if (r.ok) {
+          results.push({ name: pair.name, ok: true, via: 'ajv-compile', note: 'data not present in repo tree — schema compiled only' });
+          continue;
+        }
+        if (r.fetchFailed) {
+          fallbackReason = `npx fetch failed: ${r.stderr.split('\n')[0] || 'unknown'}`;
+          // fall through to structural check below
+        } else {
+          results.push({ name: pair.name, ok: false, via: 'ajv-compile', reason: r.stderr || r.stdout || `exit ${r.status}` });
+          continue;
+        }
+      }
+      const s = structuralCheck(schemaAbs, null);
+      results.push({
+        name: pair.name,
+        ok: s.ok,
+        via: 'structural-compile',
+        reason: s.ok ? 'schema is valid Draft-07 (data not in repo tree)' : s.reason,
+      });
+      continue;
+    }
+
+    // Both schema and data present — full validation.
+    if (USE_NPX && !fallbackReason) {
+      const r = runAjv(['validate', '-s', schemaAbs, '-d', dataAbs]);
+      if (r.ok) {
+        results.push({ name: pair.name, ok: true, via: 'ajv-validate' });
+        continue;
+      }
+      if (r.fetchFailed) {
+        fallbackReason = `npx fetch failed: ${r.stderr.split('\n')[0] || 'unknown'}`;
+        // fall through to structural check below
+      } else {
+        results.push({ name: pair.name, ok: false, via: 'ajv-validate', reason: r.stderr || r.stdout || `exit ${r.status}` });
+        continue;
+      }
+    }
+    const s = structuralCheck(schemaAbs, dataAbs);
+    results.push({
+      name: pair.name,
+      ok: s.ok,
+      via: 'structural-validate',
+      reason: s.ok ? 'schema is valid Draft-07 and data parses as JSON' : s.reason,
+    });
+  }
+
+  // Report.
+  console.log('validate-schemas: results');
+  for (const r of results) {
+    const status = r.ok ? 'OK' : 'FAIL';
+    const note = r.note ? ` (${r.note})` : '';
+    const reason = r.reason ? ` — ${r.reason}` : '';
+    console.log(`  [${status}] ${r.name} via ${r.via}${note}${reason}`);
+  }
+  if (fallbackReason) {
+    console.log(`\nnote: ajv-cli via npx unavailable (${fallbackReason}); fell back to structural checks. CI will run the authoritative ajv pass.`);
+  }
+  const failed = results.filter(r => !r.ok);
+  console.log(`summary: ${results.length} pair(s) checked, ${failed.length} failure(s)`);
+
+  process.exit(failed.length === 0 ? 0 : 1);
+}
+
+if (require.main === module) {
+  main();
+}
+
+module.exports = { PAIRS };

package/scripts/verify-version-sync.cjs

@@ -0,0 +1,30 @@
+#!/usr/bin/env node
+// Ensures package.json, .claude-plugin/plugin.json, and .claude-plugin/marketplace.json
+// all declare the same version before we publish. Exits non-zero on mismatch.
+
+const fs = require('fs');
+const path = require('path');
+
+const repoRoot = path.resolve(__dirname, '..');
+const pkg = JSON.parse(fs.readFileSync(path.join(repoRoot, 'package.json'), 'utf8'));
+const plugin = JSON.parse(fs.readFileSync(path.join(repoRoot, '.claude-plugin/plugin.json'), 'utf8'));
+const marketplace = JSON.parse(fs.readFileSync(path.join(repoRoot, '.claude-plugin/marketplace.json'), 'utf8'));
+
+const versions = {
+  'package.json': pkg.version,
+  '.claude-plugin/plugin.json': plugin.version,
+  '.claude-plugin/marketplace.json (metadata)': marketplace.metadata && marketplace.metadata.version,
+  '.claude-plugin/marketplace.json (plugins[0])': marketplace.plugins && marketplace.plugins[0] && marketplace.plugins[0].version,
+};
+
+const unique = [...new Set(Object.values(versions).filter(Boolean))];
+
+if (unique.length !== 1) {
+  console.error('Version mismatch across manifests:');
+  for (const [file, v] of Object.entries(versions)) {
+    console.error(`  ${file}: ${v}`);
+  }
+  process.exit(1);
+}
+
+console.log(`All manifests at version ${unique[0]}`);

package/skills/add-backlog/SKILL.md

@@ -0,0 +1,47 @@
+---
+name: gdd-add-backlog
+description: "Park a design idea for a future cycle. Writes to .design/backlog/BACKLOG.md."
+argument-hint: "[text]"
+tools: Read, Write, AskUserQuestion
+---
+
+# /gdd:add-backlog
+
+**Role:** Long-term parking lot for design ideas. Backing store: `.design/backlog/BACKLOG.md`.
+
+## Step 1 — Get text
+
+If `$ARGUMENTS` is empty, ask the user: "What should be added to the backlog?"
+
+## Step 2 — Append
+
+Create `.design/backlog/` directory and `BACKLOG.md` with `# Design Backlog` header if missing.
+
+Derive `<title>` = first 60 characters of the text (strip newlines). Append:
+
+```markdown
+## <title>
+**Added**: YYYY-MM-DD
+**Status**: parked
+
+<full text>
+
+---
+```
+
+## Output
+
+```
+━━━ Backlog entry parked ━━━
+Title: <title>
+Status: parked
+Promote later via: /gdd:review-backlog
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+```
+
+## Constraints
+
+- Do not modify files outside `.design/backlog/`.
+- Do not set status to anything other than `parked` here — `/gdd:review-backlog` owns status transitions.
+
+## ADD-BACKLOG COMPLETE