@hegemonart/get-design-done 1.35.1 → 1.35.2

package/.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "Get Design Done — 5-stage agent-orchestrated design pipeline with 9 connections, handoff-first workflow, bidirectional Figma write-back, 22+ specialized agents, queryable knowledge layer (intel store, dependency analysis, learnings extraction), and a self-improvement loop (reflector, frontmatter + budget feedback, global-skills layer). v1.20.0 ships the SDK foundation: gdd-state MCP server (11 typed tools), lockfile-safe STATE.md mutations, event stream, and resilience primitives (jittered-backoff, rate-guard, error-classifier, iteration-budget) for rate-limit + 429 + context-overflow recovery. Full CI/CD pipeline (Node 22/24 × Linux/macOS/Windows) and release automation (auto-tag + GitHub Release + release-time smoke test).",
-    "version": "1.35.1"
+    "version": "1.35.2"
   },
   "plugins": [
     {
       "name": "get-design-done",
       "source": "./",
       "description": "Agent-orchestrated 5-stage design pipeline: Brief → Explore → Plan → Design → Verify. 22+ specialized agents, 9 connections (Figma, Refero, Preview, Storybook, Chromatic, Figma Writer, Graphify, Pinterest, Claude Design), Claude Design handoff, bidirectional Figma write-back, and a queryable intel store (.design/intel/) for dependency and learnings queries. Standalone commands: style, darkmode, compare, figma-write, graphify, handoff, analyze-dependencies, skill-manifest, extract-learnings. Embeds NNG heuristics, WCAG thresholds, typographic systems, motion framework, and anti-pattern catalog. Ships with a full CI/CD pipeline (Node 22/24 × Linux/macOS/Windows) and release automation. Optimization layer (v1.0.4.1, retroactive): gdd-router + gdd-cache-manager skills, PreToolUse budget-enforcer hook, tier-aware agent frontmatter, lazy checker gates, streaming synthesizer, /gdd:warm-cache + /gdd:optimize commands, and cost telemetry at .design/telemetry/costs.jsonl — targeting 50-70% per-task token-cost reduction with no quality-floor regression. v1.20.0 SDK foundation: gdd-state MCP server (11 typed tools), lockfile-safe STATE.md mutations, event stream at .design/telemetry/events.jsonl, resilience primitives (jittered-backoff, rate-guard, error-classifier, iteration-budget) with rate-limit + 429 + context-overflow recovery, and TypeScript toolchain.",
-      "version": "1.35.1",
+      "version": "1.35.2",
       "author": {
         "name": "hegemonart"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "get-design-done",
   "short_name": "gdd",
-  "version": "1.35.1",
+  "version": "1.35.2",
   "description": "Agent-orchestrated 5-stage design pipeline: Brief → Explore → Plan → Design → Verify. 22+ specialized agents, 9 connections (Figma, Refero, Preview, Storybook, Chromatic, Figma Writer, Graphify, Pinterest, Claude Design), handoff-first workflow via Claude Design bundles, bidirectional Figma write-back (annotations, Code Connect), queryable intel store (`.design/intel/`) for O(1) design surface lookups, and self-improvement loop (reflector agent, frontmatter + budget feedback, global-skills layer at `~/.claude/gdd/global-skills/`). Standalone commands: style, darkmode, compare, figma-write, graphify, handoff, analyze-dependencies, skill-manifest, extract-learnings, reflect, apply-reflections. Embeds NNG heuristics, WCAG thresholds, typographic systems, motion framework, and anti-pattern catalog. Ships with a full CI/CD pipeline (Node 22/24 × Linux/macOS/Windows, lint + schema + frontmatter + stale-ref + shellcheck + gitleaks + injection-scan + blocking size-budget) and release automation (auto-tag + GitHub Release + release-time smoke test). Optimization layer (v1.0.4.1, retroactive): gdd-router + gdd-cache-manager skills, PreToolUse budget-enforcer hook, tier-aware agent frontmatter, lazy checker gates, streaming synthesizer, /gdd:warm-cache + /gdd:optimize commands, and cost telemetry at .design/telemetry/costs.jsonl — targeting 50-70% per-task token-cost reduction with no quality-floor regression. v1.20.0 SDK foundation: gdd-state MCP server (11 typed tools), lockfile-safe STATE.md mutations, event stream at .design/telemetry/events.jsonl, resilience primitives (jittered-backoff, rate-guard, error-classifier, iteration-budget) with rate-limit + 429 + context-overflow recovery, and TypeScript toolchain. v1.27.7 ships gdd-mcp (Phase 27.7): 12 read-only MCP tools for sub-3s priming. v1.28.0 (Phase 28): Foundational References Tier 2 — 5 new reference files (color-theory, composition, proportion-systems, i18n, contrast-advanced), 2 verifier i18n probes + 1 explore i18n-readiness probe, 12 additive cross-link insertions across 10 existing references, 2 orthogonal audit-scoring lens-tags (composition_alignment + i18n_readiness).",
   "author": {
     "name": "hegemonart",

package/CHANGELOG.md

@@ -4,6 +4,28 @@ All notable changes to get-design-done are documented here. Versions follow [sem
 
 ---
 
+## [1.35.2] - 2026-06-01
+
+### Phase 35.2 — Team Surfaces: Notification Backplane (Slack + Discord)
+
+Second sub-phase of the split **Phase 35**. Routes GDD pipeline events (verify-fail, audit-pass, ship) to **Slack + Discord** via incoming webhooks, so a non-GDD-running teammate is alerted in the channel they watch. **No new runtime dependency** — the dispatcher POSTs via an injectable `fetchImpl` (default global `fetch`; no `@slack/*` / `discord.js` SDK). Every outbound body is **redacted** at a single chokepoint; per-channel kill-switches + degrade-to-noop guarantee notification delivery never blocks the pipeline. A decimal on the v1.35.x arc. The parent Phase 35 stays open (35.3 Ticket Sync remains).
+
+### Added
+
+- **`connections/slack.md` + `connections/discord.md`** — incoming-webhook notification specs (`SLACK_WEBHOOK_URL` / `DISCORD_WEBHOOK_URL` env; env-presence probe; redact + kill-switch + degrade-to-noop).
+- **`scripts/lib/notify/dispatch.cjs`** — `dispatch(event, {fetchImpl, config, env})`: resolves event→channel routing, builds the **redacted** payload (single chokepoint), honors per-channel kill-switches, POSTs via an **injectable fetchImpl** (no Slack/Discord SDK), and **degrades-to-noop** (missing URL / disabled / error never throws). Allowlisted under the Phase-33.5 outbound gate (`scripts/lib/notify/**`); `scan:outbound` 0 findings.
+- **`reference/notification-routing.md`** — event→channel routing contract + the redact chokepoint + kill-switches; registered in `reference/registry.json`.
+- **`connections/connections.md`** — a **notify** capability-matrix column + Slack/Discord rows + env-based probes; onboarded 14 → 16.
+- **Privacy guard** — `test/suite/notify-privacy-guard.test.cjs` asserts no `scripts/lib/notify/*.cjs` builds an outbound body without `redact` (SC#5).
+
+### Notes
+
+- **No new runtime dependency** (injectable `fetch`); per-channel kill-switch `GDD_DISABLE_SLACK` / `GDD_DISABLE_DISCORD` mirrors Phase 30 / 35.1.
+- 6-manifest lockstep at **v1.35.2** + `OFF_CADENCE_VERSIONS.add('1.35.2')` + the 20 live-pinned `manifests-version.txt` baselines forward-propagated 1.35.1 → 1.35.2.
+- The 31.5 tarball golden was regenerated as a reviewed delta: **+4** (`connections/slack.md`, `connections/discord.md`, `scripts/lib/notify/dispatch.cjs`, `reference/notification-routing.md`), zero removals.
+
+---
+
 ## [1.35.1] - 2026-06-01
 
 ### Phase 35.1 — Team Surfaces: PR Inline Integration

package/README.md

@@ -138,6 +138,10 @@ The **discover** stage grounds design in real product references, resolving sour
 
 After `/gdd:ship` opens the PR, the [`pr-commenter`](agents/pr-commenter.md) agent posts GDD's verify/audit output **inline** on it: selector-specific findings as inline review comments on changed lines, Preview/Chromatic before-after screenshot pairs, and a `gdd/design-review` status check (audit pillar scores + verify pass/fail + a11y) that a teammate's branch protection can require. Outbound bodies are redacted; `GDD_DISABLE_PR_COMMENTER` (or `.design/config.json`) is the kill-switch; it degrades to a noop (prints bodies for manual paste) and **never fails the ship**. Uses `gh` only — **no new runtime dependency**. First sub-phase of the Team Surfaces layer (Slack/Discord notifications + Linear/Jira ticket-sync follow). Contract: [`reference/pr-review-integration.md`](reference/pr-review-integration.md).
 
+### Team surfaces — Notification backplane (v1.35.2)
+
+Routes pipeline events (verify-fail / audit-pass / ship) to **Slack** + **Discord** via incoming webhooks ([`connections/slack.md`](connections/slack.md) / [`connections/discord.md`](connections/discord.md)). The dispatcher ([`scripts/lib/notify/dispatch.cjs`](scripts/lib/notify/dispatch.cjs)) redacts every body at a single chokepoint, honors per-channel kill-switches (`GDD_DISABLE_SLACK` / `GDD_DISABLE_DISCORD`), and degrades to a noop when a webhook URL is unset — notification never blocks the pipeline. **No new runtime dependency** (injectable `fetch`, no Slack/Discord SDK). Routing: [`reference/notification-routing.md`](reference/notification-routing.md).
+
 ### Previous releases
 
 - **v1.26.0** — Headless Model Resolver (per-runtime tier→model map, `resolved_models` router field, per-runtime price tables, `reasoning-class` runtime-neutral alias).

package/connections/connections.md

@@ -2,7 +2,7 @@
 
 This directory contains connection specifications for external tools and MCPs that the get-design-done pipeline integrates with. Each connection has its own spec file. This file is the index.
 
-**Getting started:** run `/gdd:connections` for the interactive onboarding wizard — it probes all 14 connections, recommends setup based on your project type, and walks you through installing each one (auto-run for reversible MCP adds, copy-command for everything else). You can also run `/gdd:connections list` for a read-only status check or `/gdd:connections <name>` to jump to a single connection's setup.
+**Getting started:** run `/gdd:connections` for the interactive onboarding wizard — it probes all 16 connections, recommends setup based on your project type, and walks you through installing each one (auto-run for reversible MCP adds, copy-command for everything else). You can also run `/gdd:connections list` for a read-only status check or `/gdd:connections <name>` to jump to a single connection's setup.
 
 ---
 
@@ -30,6 +30,8 @@ This directory contains connection specifications for external tools and MCPs th
 | Print-Renderer | Active | [`connections/print-renderer.md`](connections/print-renderer.md) | **Optional** print render-test (Paged.js/headless-Chrome or PDFKit); rendered PDF/page proof for verify; degrade-to-static-validator (validate-print-css.cjs) / code-only when absent (D-03) |
 | Lazyweb | Active | [`connections/lazyweb.md`](connections/lazyweb.md) | **Free** bearer-token MCP `lazyweb_search` / `lazyweb_health` (ToolSearch-only probe; copy-command setup, no auto-run); discover **Tier 1** — tried first (D-01) |
 | Mobbin | Active | [`connections/mobbin.md`](connections/mobbin.md) | **Paid** HTTP MCP `claude mcp add mobbin --transport http https://api.mobbin.com/mcp` (ToolSearch-only probe; auto-run-safe, OAuth); discover **Tier 2** — mobile/flow-level (D-01) |
+| Slack | Active | [`connections/slack.md`](connections/slack.md) | **Notify** (Team Surfaces) — `SLACK_WEBHOOK_URL` incoming webhook; routed+redacted pipeline events; `GDD_DISABLE_SLACK` kill-switch; degrade-to-noop |
+| Discord | Active | [`connections/discord.md`](connections/discord.md) | **Notify** (Team Surfaces) — `DISCORD_WEBHOOK_URL` channel webhook; parity with Slack; `GDD_DISABLE_DISCORD` kill-switch; degrade-to-noop |
 
 ---
 
@@ -37,28 +39,30 @@ This directory contains connection specifications for external tools and MCPs th
 
 Each cell describes what the connection contributes at that pipeline stage, or `—` if it is not used.
 
-| Connection | scan | discover | plan | design | verify | canvas | generator |
-|-----------|------|----------|------|--------|--------|--------|-----------|
-| gdd-state | STATE mutation (init position, probe_connections, add_decision) | STATE mutation (add_decision, add_must_have, transition gate) | STATE mutation (locked decisions, must_haves, transition gate) | STATE mutation (update_progress, resolve_blocker, transition gate) | STATE mutation (must_have pass/fail, add_blocker, set_status) | — | — |
-| Figma | token augmentation via `get_variable_defs` (CONN-03) | decisions pre-populate via `get_variable_defs` (CONN-04) | — | write tokens/annotations/Code Connect via `use_figma` (FWR-01..04) | — | — | — |
-| Refero | — | reference search via `mcp__refero__search`; fallback → awesome-design-md (CONN-05) | — | — | — | — | — |
-| Preview | — | — | — | — | screenshots for `? VISUAL` checks (VIS-02) | — | — |
-| Storybook | — | component inventory (STB-01) | change-risk via story count (STB-02) | `.stories.tsx` stub (STB-03) | a11y per story (STB-02) | — | — |
-| Chromatic | — | — | change-risk scoping (CHR-02) | — | visual delta narration (CHR-01) | — | — |
-| Graphify | — | — | dependency scoping (GRF-03) | — | orphan detection (GRF-04) | — | — |
-| Pinterest | probe only | visual reference search via `pinterest_search`; fallback → Refero → awesome-design-md | — | — | — | — | — |
-| Claude Design | bundle probe → `claude_design: available` | synthesizer handoff mode — parses bundle → D-XX decisions; discussant `--from-handoff` confirms | — (skipped in handoff) | — (skipped in handoff) | Handoff Faithfulness section; bidirectional write-back via figma-writer `implementation-status` mode | — | — |
-| paper.design | — | canvas read: `get_selection`, `get_jsx`, `get_computed_styles` | — | paper-writer: annotate/tokenize/roundtrip | `get_screenshot` for `? VISUAL` | ✓ | — |
-| pencil.dev | `.pen` discovery | `.pen` as canonical design source | — | pencil-writer: annotate/roundtrip | spec-vs-impl diff | ✓ | — |
-| 21st.dev | — | prior-art gate: marketplace search before greenfield build | — | component-generator (21st impl) | — | — | ✓ |
-| Magic Patterns | — | — | — | component-generator (magic-patterns impl) | preview_url → `? VISUAL` check | — | ✓ |
-| OpenRouter | — | — | — | — | — | — | ✓ (model-router: tier→model resolution, all stages) |
-| Xcode Simulator | — | — | — | native iOS code-gen target (swift-executor / emitSwift) | rendered SwiftUI snapshot when simulator available, else degrade to code-only structural audit (D-03) | — | — |
-| Android Emulator | — | — | — | native Android code-gen target (compose-executor / emitCompose) | rendered Compose screenshot when emulator available, else degrade to code-only structural audit (D-03) | — | — |
-| Litmus | — | — | — | email render-test target (email-executor) | cross-client rendered evidence when Litmus available, else degrade to the static email-HTML validator / code-only (D-03) | — | — |
-| Print-Renderer | — | — | — | print render-test target (pdf-executor) | rendered PDF/page evidence when the print-render is available, else degrade to the static print-CSS validator / code-only (D-03) | — | — |
-| Lazyweb | — | reference search via `lazyweb_search` (**Tier 1 — free, tried first**; D-01); complements refero/pinterest | — | — | — | — | — |
-| Mobbin | — | reference search via mobbin tools (**Tier 2 — paid, mobile/flow-level**; D-01); complements refero/lazyweb | — | — | — | — | — |
+| Connection | scan | discover | plan | design | verify | canvas | generator | notify |
+|-----------|------|----------|------|--------|--------|--------|-----------|--------|
+| gdd-state | STATE mutation (init position, probe_connections, add_decision) | STATE mutation (add_decision, add_must_have, transition gate) | STATE mutation (locked decisions, must_haves, transition gate) | STATE mutation (update_progress, resolve_blocker, transition gate) | STATE mutation (must_have pass/fail, add_blocker, set_status) | — | — | — |
+| Figma | token augmentation via `get_variable_defs` (CONN-03) | decisions pre-populate via `get_variable_defs` (CONN-04) | — | write tokens/annotations/Code Connect via `use_figma` (FWR-01..04) | — | — | — | — |
+| Refero | — | reference search via `mcp__refero__search`; fallback → awesome-design-md (CONN-05) | — | — | — | — | — | — |
+| Preview | — | — | — | — | screenshots for `? VISUAL` checks (VIS-02) | — | — | — |
+| Storybook | — | component inventory (STB-01) | change-risk via story count (STB-02) | `.stories.tsx` stub (STB-03) | a11y per story (STB-02) | — | — | — |
+| Chromatic | — | — | change-risk scoping (CHR-02) | — | visual delta narration (CHR-01) | — | — | — |
+| Graphify | — | — | dependency scoping (GRF-03) | — | orphan detection (GRF-04) | — | — | — |
+| Pinterest | probe only | visual reference search via `pinterest_search`; fallback → Refero → awesome-design-md | — | — | — | — | — | — |
+| Claude Design | bundle probe → `claude_design: available` | synthesizer handoff mode — parses bundle → D-XX decisions; discussant `--from-handoff` confirms | — (skipped in handoff) | — (skipped in handoff) | Handoff Faithfulness section; bidirectional write-back via figma-writer `implementation-status` mode | — | — | — |
+| paper.design | — | canvas read: `get_selection`, `get_jsx`, `get_computed_styles` | — | paper-writer: annotate/tokenize/roundtrip | `get_screenshot` for `? VISUAL` | ✓ | — | — |
+| pencil.dev | `.pen` discovery | `.pen` as canonical design source | — | pencil-writer: annotate/roundtrip | spec-vs-impl diff | ✓ | — | — |
+| 21st.dev | — | prior-art gate: marketplace search before greenfield build | — | component-generator (21st impl) | — | — | ✓ | — |
+| Magic Patterns | — | — | — | component-generator (magic-patterns impl) | preview_url → `? VISUAL` check | — | ✓ | — |
+| OpenRouter | — | — | — | — | — | — | ✓ (model-router: tier→model resolution, all stages) | — |
+| Xcode Simulator | — | — | — | native iOS code-gen target (swift-executor / emitSwift) | rendered SwiftUI snapshot when simulator available, else degrade to code-only structural audit (D-03) | — | — | — |
+| Android Emulator | — | — | — | native Android code-gen target (compose-executor / emitCompose) | rendered Compose screenshot when emulator available, else degrade to code-only structural audit (D-03) | — | — | — |
+| Litmus | — | — | — | email render-test target (email-executor) | cross-client rendered evidence when Litmus available, else degrade to the static email-HTML validator / code-only (D-03) | — | — | — |
+| Print-Renderer | — | — | — | print render-test target (pdf-executor) | rendered PDF/page evidence when the print-render is available, else degrade to the static print-CSS validator / code-only (D-03) | — | — | — |
+| Lazyweb | — | reference search via `lazyweb_search` (**Tier 1 — free, tried first**; D-01); complements refero/pinterest | — | — | — | — | — | — |
+| Mobbin | — | reference search via mobbin tools (**Tier 2 — paid, mobile/flow-level**; D-01); complements refero/lazyweb | — | — | — | — | — | — |
+| Slack | — | — | — | — | — | — | — | verify-fail/audit-pass/ship → Slack webhook (routed, redacted, degrade-to-noop; D-04/D-05) |
+| Discord | — | — | — | — | — | — | — | parity with Slack — events → Discord webhook (routed, redacted, degrade-to-noop) |
 
 **Column definitions:**
 
@@ -164,6 +168,22 @@ Step E1 — ToolSearch check:
 Write mobbin status to STATE.md <connections>.
 ```
 
+**Slack probe (env-based, no MCP):**
+
+```
+Step F1 — Bash: test -n "$SLACK_WEBHOOK_URL"
+  → empty / GDD_DISABLE_SLACK=1    → slack: not_configured
+  → non-empty                      → slack: available
+```
+
+**Discord probe (env-based, no MCP):**
+
+```
+Step G1 — Bash: test -n "$DISCORD_WEBHOOK_URL"
+  → empty / GDD_DISABLE_DISCORD=1  → discord: not_configured
+  → non-empty                      → discord: available
+```
+
 Note: Lazyweb + Mobbin probes are ToolSearch-only (no live call). The discover stage resolves reference sources **cost-aware (D-01): Lazyweb (free) → Mobbin / Refero (paid, whichever is bound + subscribed) → Pinterest → awesome-design-md → WebFetch.**
 
 ---

package/connections/discord.md

@@ -0,0 +1,77 @@
+# Discord — Connection Specification
+
+This file is the connection specification for Discord within the get-design-done pipeline. It lives in `connections/` alongside other connection specs. See `connections/connections.md` for the full connection index and capability matrix (the discord row is added at the 35.2 closeout).
+
+---
+
+Discord is a **notification surface** for the Team Surfaces layer — the parity of `connections/slack.md`. GDD routes pipeline events (verify-fail, audit-pass, ship) to a Discord channel via a **channel Webhook**. Outbound only; every body is redacted; delivery degrades to a noop when unconfigured or disabled. The contract is identical to Slack — only the webhook host and the payload field (`content` vs Slack's `text`) differ.
+
+---
+
+## Setup
+
+**Prerequisites:** a Discord **channel Webhook** URL (Channel → Edit → Integrations → Webhooks → New Webhook → Copy Webhook URL → `https://discord.com/api/webhooks/...`).
+
+**Token (env, never committed):**
+
+```bash
+export DISCORD_WEBHOOK_URL="https://discord.com/api/webhooks/XXX/YYY"
+```
+
+The webhook URL is a credential — never commit it, never log it, rotate if exposed. GDD reads it from env only.
+
+**Verification:**
+
+```bash
+test -n "${DISCORD_WEBHOOK_URL}" && echo "discord webhook present" || echo "discord webhook absent"
+```
+
+---
+
+## What GDD sends
+
+The notify dispatcher (`scripts/lib/notify/dispatch.cjs`) posts a routed, **redacted** message for pipeline events, using the same routing as Slack (`reference/notification-routing.md`, overridable in `.design/config.json#notifications`): `verify_fail` → critical, `audit_pass`/`ship` → digest.
+
+Discord payload shape: `{ "content": "<redacted summary>" }` (Discord's field is `content`, not Slack's `text`). No embeds in v1.
+
+## Redaction (mandatory)
+
+Every body passes through `scripts/lib/redact.cjs` before the POST (the single egress chokepoint; asserted by `test/suite/notify-privacy-guard.test.cjs`).
+
+## Kill-switch
+
+Noop when **either** `GDD_DISABLE_DISCORD=1` (env) **or** `.design/config.json` `"notifications": { "discord": { "enabled": false } }`. `gsd-health` surfaces it.
+
+## Availability probe (env-based, no MCP)
+
+```bash
+test -n "${DISCORD_WEBHOOK_URL}"
+```
+
+- Non-empty AND not disabled → `discord: available`
+- Empty → `discord: not_configured`
+- Present but a POST errored → `discord: unavailable`
+
+Write `discord` status to `.design/STATE.md` `<connections>`.
+
+## Degrade-to-noop
+
+Missing `DISCORD_WEBHOOK_URL`, kill-switch on, or a POST failure → skipped (no error); the pipeline never blocks (D-03). The dispatcher returns `{ channel: "discord", status: "skipped"|"sent"|"error" }` and never throws.
+
+## STATE.md integration
+
+```xml
+<connections>
+discord: not_configured
+</connections>
+```
+
+| Value | Meaning |
+|---|---|
+| `available` | `DISCORD_WEBHOOK_URL` set AND not disabled |
+| `unavailable` | URL present but a send errored |
+| `not_configured` | no `DISCORD_WEBHOOK_URL` |
+
+## Outbound + dispatcher
+
+The POST is `scripts/lib/notify/dispatch.cjs` (injectable `fetchImpl` default global `fetch`; **no `discord.js` dependency**), allowlisted under the Phase-33.5 outbound gate (`scripts/lib/notify/**`). Slack is the sibling surface (`connections/slack.md`) with the identical contract.

package/connections/slack.md

@@ -0,0 +1,83 @@
+# Slack — Connection Specification
+
+This file is the connection specification for Slack within the get-design-done pipeline. It lives in `connections/` alongside other connection specs. See `connections/connections.md` for the full connection index and capability matrix (the slack row is added at the 35.2 closeout).
+
+---
+
+Slack is a **notification surface** for the Team Surfaces layer. GDD routes pipeline events (verify-fail, audit-pass, ship) to a Slack channel via an **Incoming Webhook**, so a non-GDD-running teammate gets alerted where they already watch. Outbound only; every message body is redacted; delivery degrades to a noop when unconfigured or disabled.
+
+---
+
+## Setup
+
+**Prerequisites:** a Slack **Incoming Webhook** URL (Slack app → Incoming Webhooks → Add New Webhook to Workspace → pick a channel → copy the `https://hooks.slack.com/services/...` URL).
+
+**Token (env, never committed):**
+
+```bash
+export SLACK_WEBHOOK_URL="https://hooks.slack.com/services/XXX/YYY/ZZZ"
+```
+
+The webhook URL is a credential (anyone with it can post to your channel) — never commit it (not in source, not in `.env`, not in config), never log it, rotate if exposed. GDD reads it from env only.
+
+**Verification:**
+
+```bash
+test -n "${SLACK_WEBHOOK_URL}" && echo "slack webhook present" || echo "slack webhook absent"
+```
+
+---
+
+## What GDD sends
+
+The notify dispatcher (`scripts/lib/notify/dispatch.cjs`) posts a routed, **redacted** message for pipeline events. Default routing (`reference/notification-routing.md`, overridable in `.design/config.json#notifications`):
+
+| Event | Default behavior |
+|---|---|
+| `verify_fail` | post to the critical channel (the configured Slack webhook) |
+| `audit_pass` | post to the digest channel |
+| `ship` | post to the digest channel (PR URL + top-line audit) |
+
+Slack payload shape: `{ "text": "<redacted summary>" }`. No blocks/attachments in v1.
+
+## Redaction (mandatory)
+
+Every message body passes through `scripts/lib/redact.cjs` before the POST — secrets/API keys/tokens are stripped (11 patterns). The dispatcher is the single egress chokepoint; no notify path bypasses redact (asserted by `test/suite/notify-privacy-guard.test.cjs`).
+
+## Kill-switch
+
+Slack delivery is a noop when **either** `GDD_DISABLE_SLACK=1` (env) **or** `.design/config.json` has `"notifications": { "slack": { "enabled": false } }`. `gsd-health` surfaces the state (mirrors Phase 30 / 35.1).
+
+## Availability probe (env-based, no MCP)
+
+```bash
+test -n "${SLACK_WEBHOOK_URL}"
+```
+
+- Non-empty AND not disabled → `slack: available`
+- Empty → `slack: not_configured`
+- Present but a POST errored at send time → `slack: unavailable`
+
+Write `slack` status to `.design/STATE.md` `<connections>` after probing.
+
+## Degrade-to-noop
+
+Missing `SLACK_WEBHOOK_URL`, kill-switch on, or a POST failure → that channel is skipped (no error); the pipeline never blocks on notification delivery (D-03). The dispatcher returns `{ channel: "slack", status: "skipped"|"sent"|"error" }` and never throws.
+
+## STATE.md integration
+
+```xml
+<connections>
+slack: not_configured
+</connections>
+```
+
+| Value | Meaning |
+|---|---|
+| `available` | `SLACK_WEBHOOK_URL` set AND not disabled |
+| `unavailable` | URL present but a send errored |
+| `not_configured` | no `SLACK_WEBHOOK_URL` |
+
+## Outbound + dispatcher
+
+The actual POST is `scripts/lib/notify/dispatch.cjs` (POSTs via an injectable `fetchImpl`, defaulting to global `fetch`; **no `@slack/*` dependency**). It is allowlisted under the Phase-33.5 outbound gate (`scripts/security/outbound-allowlist.json` → `scripts/lib/notify/**`). Discord is the parity surface (`connections/discord.md`); the contract is identical, only the payload field differs (`text` vs `content`).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hegemonart/get-design-done",
-  "version": "1.35.1",
+  "version": "1.35.2",
   "description": "A design-quality pipeline for AI coding agents: brief, plan, implement, and verify UI work against your design system.",
   "author": "Hegemon",
   "homepage": "https://github.com/hegemonart/get-design-done",

package/reference/notification-routing.md

@@ -0,0 +1,54 @@
+# Notification Routing — the event→channel contract for `scripts/lib/notify/dispatch.cjs`
+
+How GDD routes pipeline events to the Team-Surfaces notification channels (Slack + Discord), redacts every outbound body, and degrades to a noop when a channel is unconfigured or disabled. Consumed by `scripts/lib/notify/dispatch.cjs`; the channel specs are `connections/slack.md` + `connections/discord.md`.
+
+---
+
+## Default routing
+
+Event type → channels (overridable via `.design/config.json#notifications.routing`):
+
+| Event | Meaning | Default channels |
+|---|---|---|
+| `verify_fail` | a verify must-have failed | slack + discord (the "critical" surface) |
+| `audit_pass` | an audit cleared the quality floor | slack + discord (the "digest" surface) |
+| `ship` | a PR was created (`/gdd:ship`) | slack + discord (digest — PR URL + top-line audit) |
+
+A user narrows or splits this in `.design/config.json`:
+
+```json
+{
+  "notifications": {
+    "routing": { "verify_fail": ["slack"], "audit_pass": ["discord"], "ship": ["slack", "discord"] },
+    "slack":   { "enabled": true },
+    "discord": { "enabled": false }
+  }
+}
+```
+
+Unlisted event types route to nothing (no notification). Unknown channels are skipped.
+
+## Redaction (mandatory — the single chokepoint)
+
+`dispatch(event)` builds the outbound body as `redact(summary + "\n" + details)` using `scripts/lib/redact.cjs` (11 secret/token patterns, Phase 22 + 33.5) **before** any POST. There is exactly one egress chokepoint; no notify path constructs an un-redacted outbound body. The static test `test/suite/notify-privacy-guard.test.cjs` asserts every `scripts/lib/notify/*.cjs` references `redact`.
+
+## Kill-switches (per channel)
+
+A channel is a noop when **either**:
+
+- env `GDD_DISABLE_SLACK=1` / `GDD_DISABLE_DISCORD=1`, or
+- `.design/config.json` `notifications.<channel>.enabled === false`.
+
+`gsd-health` surfaces each channel's enabled/disabled state (mirrors the Phase 30 + 35.1 kill-switch pattern).
+
+## Outbound transport (no SDK, injectable, allowlisted)
+
+`dispatch(event, { fetchImpl, config, env })` POSTs `{ <field>: body }` to the channel's webhook URL (Slack `text`, Discord `content`) via an **injectable `fetchImpl`** (defaults to global `fetch`) — **no `@slack/*` / `discord.js` dependency** (D-02). Tests inject a stub fetchImpl (no live network — D-08). The module is allowlisted under the Phase-33.5 outbound gate (`scripts/security/outbound-allowlist.json` → `scripts/lib/notify/**`) with a threat-model egress entry.
+
+## Degrade-to-noop (never blocks the pipeline)
+
+For each routed channel, a missing webhook URL → `skipped (not_configured)`; kill-switch on → `skipped (disabled)`; a POST failure → `error` (logged, not thrown). `dispatch` returns `Array<{ channel, status, reason? }>` and **never throws** — notification delivery is a best-effort side surface, never a pipeline gate (D-03).
+
+## Out of scope (per Phase 35 split)
+
+Linear/Jira ticket-sync (Phase 35.3); PR-inline (35.1); `pseudonymize.cjs` identity-masking (Phase 30 — wired when available; redact for secrets is the must here); Microsoft Teams; rich blocks/embeds (plain text in v1); scheduled digests (event-driven only).

package/reference/registry.json

@@ -916,6 +916,13 @@
       "type": "heuristic",
       "phase": 35.1,
       "description": "Phase 35.1 PR-inline contract — the gh-CLI shapes agents/pr-commenter.md posts against: inline review comments (gh api pulls/{n}/comments with path+line), the summary review (event=COMMENT), the gdd/design-review check-run (gh api check-runs with name/head_sha/conclusion/output.summary carrying audit pillar scores + verify pass/fail + a11y result), Preview/Chromatic screenshot-pair attachment (degrade-to-text), mandatory scripts/lib/redact.cjs on every outbound body, the GDD_DISABLE_PR_COMMENTER kill-switch, and the consent-driven branch-protection setup (scripts/apply-branch-protection.sh; GDD registers the check, never force-edits protection)."
+    },
+    {
+      "name": "notification-routing",
+      "path": "reference/notification-routing.md",
+      "type": "heuristic",
+      "phase": 35.2,
+      "description": "Phase 35.2 notification-backplane routing contract — event→channel routing (verify_fail/audit_pass/ship → slack/discord, overridable via .design/config.json#notifications.routing), the mandatory scripts/lib/redact.cjs chokepoint on every outbound body, per-channel kill-switches (GDD_DISABLE_SLACK/GDD_DISABLE_DISCORD), and the injectable-fetchImpl + degrade-to-noop transport consumed by scripts/lib/notify/dispatch.cjs (allowlisted under the 33.5 outbound gate)."
     }
   ]
 }

package/scripts/lib/notify/dispatch.cjs

@@ -0,0 +1,80 @@
+'use strict';
+/**
+ * scripts/lib/notify/dispatch.cjs — Phase 35.2 notification backplane dispatcher.
+ *
+ * Routes a GDD pipeline event to Slack/Discord incoming webhooks. Every outbound body
+ * is REDACTED (scripts/lib/redact.cjs) — the single egress chokepoint. Delivery is
+ * degrade-to-noop: a missing webhook URL, a per-channel kill-switch, or a POST failure
+ * skips that channel and NEVER throws into the pipeline (D-03/D-04).
+ *
+ * Outbound is via an INJECTABLE fetchImpl (defaults to global fetch) — no @slack/discord
+ * SDK dependency (D-02); tests pass a stub fetchImpl (no live network — D-08). Allowlisted
+ * under the Phase-33.5 outbound gate (scripts/security/outbound-allowlist.json).
+ */
+
+const { redact } = require('../redact.cjs');
+
+// Default event → channel routing (overridable via .design/config.json#notifications.routing).
+const DEFAULT_ROUTING = {
+  verify_fail: ['slack', 'discord'], // critical
+  audit_pass: ['slack', 'discord'], // digest
+  ship: ['slack', 'discord'], // digest
+};
+
+const CHANNELS = {
+  slack: { urlEnv: 'SLACK_WEBHOOK_URL', disableEnv: 'GDD_DISABLE_SLACK', field: 'text' },
+  discord: { urlEnv: 'DISCORD_WEBHOOK_URL', disableEnv: 'GDD_DISABLE_DISCORD', field: 'content' },
+};
+
+function isDisabled(channel, config, env) {
+  if (env[CHANNELS[channel].disableEnv] === '1') return true;
+  const c = config && config.notifications && config.notifications[channel];
+  return !!(c && c.enabled === false);
+}
+
+function channelsFor(eventType, config) {
+  const routing = (config && config.notifications && config.notifications.routing) || DEFAULT_ROUTING;
+  return routing[eventType] || [];
+}
+
+/**
+ * dispatch(event, opts) → Promise<Array<{channel, status, reason?}>>
+ *   event: { type: 'verify_fail'|'audit_pass'|'ship'|string, summary: string, details?: string }
+ *   opts:  { fetchImpl?, config?, env? }   (all injectable for hermetic tests)
+ * Never throws — every failure mode becomes a {status:'skipped'|'error'} entry.
+ */
+async function dispatch(event, opts = {}) {
+  const env = opts.env || process.env;
+  const config = opts.config || {};
+  const fetchImpl = opts.fetchImpl || (typeof fetch === 'function' ? fetch : null);
+  const results = [];
+  if (!event || !event.type) return results;
+
+  // Single redaction chokepoint: the outbound body is always redacted.
+  const raw = [event.summary, event.details].filter(Boolean).join('\n');
+  const body = redact(String(raw));
+
+  for (const channel of channelsFor(event.type, config)) {
+    const meta = CHANNELS[channel];
+    if (!meta) { results.push({ channel, status: 'skipped', reason: 'unknown-channel' }); continue; }
+    if (isDisabled(channel, config, env)) { results.push({ channel, status: 'skipped', reason: 'disabled' }); continue; }
+    const url = env[meta.urlEnv];
+    if (!url) { results.push({ channel, status: 'skipped', reason: 'not_configured' }); continue; }
+    if (!fetchImpl) { results.push({ channel, status: 'skipped', reason: 'no-fetch' }); continue; }
+    try {
+      const res = await fetchImpl(url, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ [meta.field]: body }),
+      });
+      const ok = res && (res.ok === true || (typeof res.status === 'number' && res.status >= 200 && res.status < 300));
+      results.push({ channel, status: ok ? 'sent' : 'error', reason: ok ? undefined : `http-${res && res.status}` });
+    } catch (err) {
+      // Degrade-to-noop: a delivery failure never propagates into the pipeline.
+      results.push({ channel, status: 'error', reason: (err && err.message) || 'fetch-failed' });
+    }
+  }
+  return results;
+}
+
+module.exports = { dispatch, DEFAULT_ROUTING, CHANNELS };

package/skills/connections/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: gdd-connections
-description: "Interactive onboarding wizard for the 14 external integrations the pipeline supports — probes all (`figma`, `refero`, `preview`, `storybook`, `chromatic`, `graphify`, `pinterest`, `claude-design`, `paper-design`, `pencil-dev`, `21st-dev`, `magic-patterns`, `lazyweb`, `mobbin`), recommends based on project type, walks the user through setup (auto-run MCP install or copy-command fallback), writes results to `STATE.md <connections>`. Use after `/gdd:new-project` or whenever the user wants to add, inspect, or skip a connection. Re-runnable anytime."
+description: "Interactive onboarding wizard for the 16 external integrations the pipeline supports — probes all (`figma`, `refero`, `preview`, `storybook`, `chromatic`, `graphify`, `pinterest`, `claude-design`, `paper-design`, `pencil-dev`, `21st-dev`, `magic-patterns`, `lazyweb`, `mobbin`, `slack`, `discord`), recommends based on project type, walks the user through setup (auto-run MCP install or copy-command fallback), writes results to `STATE.md <connections>`. Use after `/gdd:new-project` or whenever the user wants to add, inspect, or skip a connection. Re-runnable anytime."
 argument-hint: "[list | <connection-name> | --auto]"
 user-invocable: true
 tools: Read, Write, Bash, Glob, Grep, AskUserQuestion, ToolSearch
@@ -8,11 +8,11 @@ tools: Read, Write, Bash, Glob, Grep, AskUserQuestion, ToolSearch
 
 # /gdd:connections
 
-Interactive onboarding for the 14 external integrations the pipeline supports. Replaces "probe silently at scan entry and hope the user noticed" with an explicit "here is what can plug in, here is how."
+Interactive onboarding for the 16 external integrations the pipeline supports. Replaces "probe silently at scan entry and hope the user noticed" with an explicit "here is what can plug in, here is how."
 
 Canonical per-connection specs live in `../../connections/<name>.md` (one file per integration). The capability matrix + probe-pattern spec live in `../../connections/connections.md`. This skill is the **user-facing front end** for those specs.
 
-For the 14 probe scripts (MCP + HTTP + CLI + file probes), bucket categorization, per-connection setup screen, auto-run eligibility matrix, value-prop one-liners, and STATE.md / config.json write contracts, see `./connections-onboarding.md`. For the cross-skill probe pattern + connection-handshake summary, see `../../reference/shared-preamble.md#connection-handshake-summary`. For the cross-skill output discipline, see `../../reference/shared-preamble.md#output-contract-reminders`.
+For the 16 probe scripts (MCP + HTTP + CLI + file probes), bucket categorization, per-connection setup screen, auto-run eligibility matrix, value-prop one-liners, and STATE.md / config.json write contracts, see `./connections-onboarding.md`. For the cross-skill probe pattern + connection-handshake summary, see `../../reference/shared-preamble.md#connection-handshake-summary`. For the cross-skill output discipline, see `../../reference/shared-preamble.md#output-contract-reminders`.
 
 ---
 
@@ -38,7 +38,7 @@ For the 14 probe scripts (MCP + HTTP + CLI + file probes), bucket categorization
 
 ## Workflow
 
-1. **Probe all 14 connections** — run every probe script per `./connections-onboarding.md#step-1--probe-all-14-connections`. MCP probes use `ToolSearch` first; HTTP / CLI / file probes follow non-MCP patterns. Merge results into `STATE.md <connections>` with the three-value schema (`available | unavailable | not_configured`) — never add new values.
+1. **Probe all 16 connections** — run every probe script per `./connections-onboarding.md#step-1--probe-all-16-connections`. MCP probes use `ToolSearch` first; HTTP / CLI / file probes follow non-MCP patterns. Merge results into `STATE.md <connections>` with the three-value schema (`available | unavailable | not_configured`) — never add new values.
 2. **Categorize + build summary** — bucket each probe result (available / recommended / optional / skipped / unavailable) using project-hint detection. Detail + recommendation mapping: `./connections-onboarding.md#step-2--bucket-categorization`.
 3. **Print summary table** — show buckets + value-prop one-liners (verbatim from `./connections-onboarding.md#step-3--summary-table`).
 4. **Route by mode** — `list` / `--auto` exits after summary; `<name>` jumps straight to Step 5; default mode opens an AskUserQuestion (configure recommended / pick one by one / configure all optional / re-check specific / exit). Routing detail: `./connections-onboarding.md#step-4--route-by-mode`.

package/skills/connections/connections-onboarding.md

@@ -9,7 +9,7 @@ last_updated: 2026-05-18
 
 Source: extracted from `skills/connections/SKILL.md` (Phase 28.5 rework — D-10 extract-then-link).
 The skill's load-bearing routing + invocation-mode dispatch stays in `../skills/connections/SKILL.md`;
-this file holds the 14 probe scripts, bucket categorization, per-connection setup screen,
+this file holds the 16 probe scripts, bucket categorization, per-connection setup screen,
 auto-run eligibility matrix, value-prop one-liners, and STATE.md / config.json write contracts.
 
 # Connections Onboarding Procedure
@@ -27,7 +27,7 @@ this file does NOT duplicate them; it points at them by name.
 
 ---
 
-## Step 1 — Probe all 14 connections
+## Step 1 — Probe all 16 connections
 
 Run every probe below in order. MCP probes call `ToolSearch` first (deferred tools fail silently without it). Write every result to `STATE.md <connections>` when done.
 
@@ -100,6 +100,20 @@ ToolSearch({ query: "mobbin", max_results: 5 })
 → Non-empty → mobbin: available
 ```
 
+**slack:** (notify — Team Surfaces, env-based)
+```
+Bash: test -n "$SLACK_WEBHOOK_URL"  (and GDD_DISABLE_SLACK != 1)
+→ empty / disabled → slack: not_configured
+→ non-empty        → slack: available
+```
+
+**discord:** (notify — parity, env-based)
+```
+Bash: test -n "$DISCORD_WEBHOOK_URL"  (and GDD_DISABLE_DISCORD != 1)
+→ empty / disabled → discord: not_configured
+→ non-empty        → discord: available
+```
+
 ### Non-MCP probes
 
 **storybook** (HTTP):
@@ -145,7 +159,7 @@ Bash: ls .design/handoff/ 2>/dev/null || find . -maxdepth 3 \
   → Non-empty → claude_design: available
 ```
 
-After all 14 probes complete, merge results into `STATE.md <connections>`. Preserve the three-value schema verbatim (`available | unavailable | not_configured`). Do not add new values.
+After all 16 probes complete, merge results into `STATE.md <connections>`. Preserve the three-value schema verbatim (`available | unavailable | not_configured`). Do not add new values.
 
 ---
 
@@ -228,6 +242,8 @@ One-line value props (use verbatim):
 | magic-patterns | AI component generator (DS-aware) |
 | lazyweb | free design reference search (pricing/onboarding/redesign) — discover Tier 1 |
 | mobbin | curated mobile + flow-level references (paid) — discover Tier 2 |
+| slack | notify — route verify-fail/audit-pass/ship to a Slack channel (redacted) |
+| discord | notify — route pipeline events to a Discord channel (redacted) |
 
 ---
 
@@ -255,7 +271,7 @@ options:
   - "Exit"                            → emit ## CONNECTIONS COMPLETE, exit
 ```
 
-If recommended bucket is empty, swap that option for "Show all 14 and pick."
+If recommended bucket is empty, swap that option for "Show all 16 and pick."
 
 ---
 
@@ -314,6 +330,8 @@ options:
 | claude-design | handoff bundle drop | ✗ no | User-driven file drop — force manual |
 | mobbin | `claude mcp add mobbin --transport http https://api.mobbin.com/mcp` | ✓ yes | Reversible MCP add; no credential filesystem-write (OAuth on first call) |
 | lazyweb | `claude plugin install lazyweb@lazyweb` (after token write to `~/.lazyweb/`) | ✗ no | Writes a bearer token to disk — force manual (user-consent step) |
+| slack | set `SLACK_WEBHOOK_URL` env (Slack Incoming Webhook URL) | ✗ no | Env credential — user sets it; no install command (degrade-to-noop when unset) |
+| discord | set `DISCORD_WEBHOOK_URL` env (Discord channel Webhook URL) | ✗ no | Env credential — user sets it; no install command (degrade-to-noop when unset) |
 
 For non-auto-run connections, hide the "Run install command now" option entirely in 5.3.