@hegemonart/get-design-done 1.35.3 → 1.36.1

package/.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "Get Design Done — 5-stage agent-orchestrated design pipeline with 9 connections, handoff-first workflow, bidirectional Figma write-back, 22+ specialized agents, queryable knowledge layer (intel store, dependency analysis, learnings extraction), and a self-improvement loop (reflector, frontmatter + budget feedback, global-skills layer). v1.20.0 ships the SDK foundation: gdd-state MCP server (11 typed tools), lockfile-safe STATE.md mutations, event stream, and resilience primitives (jittered-backoff, rate-guard, error-classifier, iteration-budget) for rate-limit + 429 + context-overflow recovery. Full CI/CD pipeline (Node 22/24 × Linux/macOS/Windows) and release automation (auto-tag + GitHub Release + release-time smoke test).",
-    "version": "1.35.3"
+    "version": "1.36.1"
   },
   "plugins": [
     {
       "name": "get-design-done",
       "source": "./",
       "description": "Agent-orchestrated 5-stage design pipeline: Brief → Explore → Plan → Design → Verify. 22+ specialized agents, 9 connections (Figma, Refero, Preview, Storybook, Chromatic, Figma Writer, Graphify, Pinterest, Claude Design), Claude Design handoff, bidirectional Figma write-back, and a queryable intel store (.design/intel/) for dependency and learnings queries. Standalone commands: style, darkmode, compare, figma-write, graphify, handoff, analyze-dependencies, skill-manifest, extract-learnings. Embeds NNG heuristics, WCAG thresholds, typographic systems, motion framework, and anti-pattern catalog. Ships with a full CI/CD pipeline (Node 22/24 × Linux/macOS/Windows) and release automation. Optimization layer (v1.0.4.1, retroactive): gdd-router + gdd-cache-manager skills, PreToolUse budget-enforcer hook, tier-aware agent frontmatter, lazy checker gates, streaming synthesizer, /gdd:warm-cache + /gdd:optimize commands, and cost telemetry at .design/telemetry/costs.jsonl — targeting 50-70% per-task token-cost reduction with no quality-floor regression. v1.20.0 SDK foundation: gdd-state MCP server (11 typed tools), lockfile-safe STATE.md mutations, event stream at .design/telemetry/events.jsonl, resilience primitives (jittered-backoff, rate-guard, error-classifier, iteration-budget) with rate-limit + 429 + context-overflow recovery, and TypeScript toolchain.",
-      "version": "1.35.3",
+      "version": "1.36.1",
       "author": {
         "name": "hegemonart"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "get-design-done",
   "short_name": "gdd",
-  "version": "1.35.3",
+  "version": "1.36.1",
   "description": "Agent-orchestrated 5-stage design pipeline: Brief → Explore → Plan → Design → Verify. 22+ specialized agents, 9 connections (Figma, Refero, Preview, Storybook, Chromatic, Figma Writer, Graphify, Pinterest, Claude Design), handoff-first workflow via Claude Design bundles, bidirectional Figma write-back (annotations, Code Connect), queryable intel store (`.design/intel/`) for O(1) design surface lookups, and self-improvement loop (reflector agent, frontmatter + budget feedback, global-skills layer at `~/.claude/gdd/global-skills/`). Standalone commands: style, darkmode, compare, figma-write, graphify, handoff, analyze-dependencies, skill-manifest, extract-learnings, reflect, apply-reflections. Embeds NNG heuristics, WCAG thresholds, typographic systems, motion framework, and anti-pattern catalog. Ships with a full CI/CD pipeline (Node 22/24 × Linux/macOS/Windows, lint + schema + frontmatter + stale-ref + shellcheck + gitleaks + injection-scan + blocking size-budget) and release automation (auto-tag + GitHub Release + release-time smoke test). Optimization layer (v1.0.4.1, retroactive): gdd-router + gdd-cache-manager skills, PreToolUse budget-enforcer hook, tier-aware agent frontmatter, lazy checker gates, streaming synthesizer, /gdd:warm-cache + /gdd:optimize commands, and cost telemetry at .design/telemetry/costs.jsonl — targeting 50-70% per-task token-cost reduction with no quality-floor regression. v1.20.0 SDK foundation: gdd-state MCP server (11 typed tools), lockfile-safe STATE.md mutations, event stream at .design/telemetry/events.jsonl, resilience primitives (jittered-backoff, rate-guard, error-classifier, iteration-budget) with rate-limit + 429 + context-overflow recovery, and TypeScript toolchain. v1.27.7 ships gdd-mcp (Phase 27.7): 12 read-only MCP tools for sub-3s priming. v1.28.0 (Phase 28): Foundational References Tier 2 — 5 new reference files (color-theory, composition, proportion-systems, i18n, contrast-advanced), 2 verifier i18n probes + 1 explore i18n-readiness probe, 12 additive cross-link insertions across 10 existing references, 2 orthogonal audit-scoring lens-tags (composition_alignment + i18n_readiness).",
   "author": {
     "name": "hegemonart",

package/CHANGELOG.md

@@ -4,6 +4,51 @@ All notable changes to get-design-done are documented here. Versions follow [sem
 
 ---
 
+## [1.36.1] - 2026-06-01
+
+### Phase 36.1 — Knowledge Tier-3: Domain Packs (finance + healthcare + gaming + civic)
+
+First sub-phase of the split **Phase 36 (Knowledge Tier 3)**. Adds four industry-specific design-pattern reference packs and wires **domain detection** into the pipeline — closing the industry-lens gap (GDD shipped 18 generic design systems + foundational Tier-2, but no domain-specific patterns). Finance and healthcare especially carry regulatory constraints (PCI-DSS, MiFID II, HIPAA, Section 508) that bleed into UI. **No new pillar, no breaking scoring change, no new runtime dependency, no new egress** — pure reference markdown + agent-prompt edits; detection is keyword/dep matching done by the agent.
+
+### Added
+
+- **`reference/domains/finance-patterns.md`** — data-table density (tabular-nums, right-aligned numerics), trading-interface conventions (gain/loss never color-alone), regulatory disclosure placement (Reg-T, MiFID II cost & charges), PCI-DSS PAN masking, number-formatting precision, real-time data states.
+- **`reference/domains/healthcare-patterns.md`** — HIPAA-aware PHI isolation (no PHI in URLs/logs/analytics), idle auto-logout, audit-trail-as-UI, MyChart-class flows, WCAG 2.1 AAA, medical-data visualization. Surfaces risk; does **not** certify compliance.
+- **`reference/domains/gaming-patterns.md`** — HUD/diegetic UI taxonomy, vestibular + photosensitive safety (≤3 flashes/sec, reduced-motion + in-game toggles), ESRB/PEGI age-gates, input-model adaptation (controller/touch/KBM), TV-safe area.
+- **`reference/domains/civic-patterns.md`** — Section 508 + WCAG 2.1 AA hard floor, multi-language gov forms (EN/ES/zh-Hans), Plain Writing Act (grade 6-8), USWDS, session-timeout warnings, one-thing-per-page forms.
+- **`agents/design-context-builder.md`** — new **Step 0F (Domain Detection)**: a dispatcher table (keywords + `package.json` deps → pack) + the confidence rule (≥2 signals or any dep match → auto-apply; 1 weak keyword → suggest; none → skip) + a `<domain>` line in DESIGN-CONTEXT.md. Orthogonal to project-type.
+- **`agents/design-auditor.md`** — **domain checklist addendum**: when a `<domain>` is active, also run that pack's `## Audit checklist` and fold findings into the relevant pillar (additive — never replaces the 7-pillar scoring).
+- All four packs **registered** in `reference/registry.json` (`type: heuristic`, `phase: 36.1`); 145 → 149 entries.
+
+### Notes
+
+- **No new runtime dependency, no new egress.** Detection is the agent matching a small embedded signal table — no code, no network.
+- 6-manifest lockstep at **v1.36.1** + `OFF_CADENCE_VERSIONS.add('1.36.1')` + the 23 live-pinned `manifests-version.txt` baselines forward-propagated 1.35.5 → 1.36.1 (opens the v1.36.x arc).
+- The 31.5 tarball golden was regenerated as a reviewed delta: **+4** (the four domain packs), zero removals (661 → 665).
+
+---
+
+## [1.35.5] - 2026-06-01
+
+### Phase 35.5 — Design-Artifact Export (`/gdd:export`)
+
+Closes the gap that a completed cycle's design output (`EXPERIENCE.md`, `DESIGN.md`, `DESIGN-VERIFICATION.md`, the decision log, screenshots) lives only in the repo — stakeholders not in code can't consume it. `/gdd:export <cycle> --format html|pdf|notion` packages it into a shareable artifact. **No new runtime dependency** (D-02): `build-html.cjs` is a pure, dep-free assembler; the PDF format is the same HTML plus Paged.js-compatible `@page` print CSS that the user renders (GDD ships **no** PDF runtime); Notion is written via the Notion MCP. Every artifact is **redacted** (mandatory `scripts/lib/redact.cjs`); `--pseudonymize` masks git identity / paths / hostname for external sharing; `--pr` posts the HTML preview as a PR comment via `pr-commenter`.
+
+### Added
+
+- **`scripts/lib/export/build-html.cjs`** — a pure, dependency-free self-contained HTML assembler: inline `<style>`, base64-embedded screenshots, **zero external resource references**, a minimal deterministic markdown→HTML subset. `print: true` adds the Paged.js `@page` print CSS for the PDF format. Same input → byte-identical output.
+- **`skills/export/SKILL.md`** (`/gdd:export`) — resolves the cycle, reads the design source set, redacts always (+ pseudonymizes on `--pseudonymize`), renders html/pdf via `build-html` or a Notion page via the MCP, and hands the HTML to `pr-commenter` on `--pr`.
+- **`connections/notion.md`** — Notion MCP write-path (`mcp__notion__*`, ToolSearch probe, redact, `GDD_DISABLE_NOTION` kill-switch, degrade-to-HTML). Onboarded 18 → 19 — **export-only** (not a pipeline stage; no capability-matrix column).
+- **`reference/export-formats.md`** — the `/gdd:export` contract (source set, the three formats, redact + `--pseudonymize`, the `--pr` hand-off, the self-contained guarantee); registered in `reference/registry.json`.
+
+### Notes
+
+- **No new runtime dependency** (D-02) and **no new egress** (`scan:outbound` unchanged — Notion is written via MCP tools, not raw HTTP).
+- 6-manifest lockstep at **v1.35.5** + `OFF_CADENCE_VERSIONS.add('1.35.5')` + the 22 live-pinned `manifests-version.txt` baselines forward-propagated 1.35.3 → 1.35.5 (1.35.4 not used).
+- The 31.5 tarball golden was regenerated as a reviewed delta: **+4** (`scripts/lib/export/build-html.cjs`, `skills/export/SKILL.md`, `connections/notion.md`, `reference/export-formats.md`), zero removals (657 → 661).
+
+---
+
 ## [1.35.3] - 2026-06-01
 
 ### Phase 35.3 — Team Surfaces: Ticket Sync (Linear + Jira) — completes Phase 35

package/README.md

@@ -146,6 +146,14 @@ Routes pipeline events (verify-fail / audit-pass / ship) to **Slack** + **Discor
 
 Links a design cycle to a **Linear** or **Jira** ticket and keeps them in sync ([`connections/linear.md`](connections/linear.md) / [`connections/jira.md`](connections/jira.md), MCP-based). [`agents/ticket-sync-agent.md`](agents/ticket-sync-agent.md) surfaces the linked ticket's comments as context when a design file opens (via the decision-injector) and, on `/gdd:complete-cycle`, transitions the ticket + posts a **redacted** summary. Per-system kill-switches (`GDD_DISABLE_LINEAR` / `GDD_DISABLE_JIRA`); degrade-to-noop (never gates the cycle). **No new runtime dependency, no new egress** (MCP tools only). Contract: [`reference/ticket-sync.md`](reference/ticket-sync.md). **Completes the Team Surfaces layer** (PR inline + notifications + ticket sync).
 
+### Design-artifact export (v1.35.5)
+
+`/gdd:export <cycle> --format html|pdf|notion` packages a finished cycle's design output (`EXPERIENCE.md`, `DESIGN.md`, `DESIGN-VERIFICATION.md`, the decision log, screenshots) into a stakeholder-shareable artifact — for PMs/execs/brand who aren't in the repo. The [`build-html`](scripts/lib/export/build-html.cjs) assembler emits a **self-contained** HTML (inline CSS, base64-embedded screenshots, **zero external references**); `pdf` is the same HTML plus Paged.js-compatible `@page` print CSS you render yourself; `notion` writes a page via the Notion MCP ([`connections/notion.md`](connections/notion.md), degrade-to-HTML). Every artifact is **redacted**; `--pseudonymize` masks identity/paths/hostname for external sharing; `--pr` posts the HTML preview as a PR comment via `pr-commenter`. **No new runtime dependency** (D-02: pure assembler, no PDF/markdown library). Contract: [`reference/export-formats.md`](reference/export-formats.md).
+
+### Domain packs — Knowledge Tier 3 (v1.36.1)
+
+Four industry-specific design-pattern packs at [`reference/domains/`](reference/domains/) — **finance** (data-table density, trading-UI color semantics, Reg-T/MiFID II disclosure, PCI-DSS masking, number-formatting precision), **healthcare** (HIPAA PHI isolation, audit-trail-as-UI, WCAG 2.1 AAA, medical-data viz), **gaming** (HUD/diegetic taxonomy, vestibular + photosensitive safety, ESRB/PEGI age-gates, controller/touch input adaptation), and **civic** (Section 508 + WCAG 2.1 AA floor, multi-language gov forms, Plain Writing Act, USWDS). The [`design-context-builder`](agents/design-context-builder.md) auto-detects the domain from brief keywords + `package.json` dependencies (`@stripe/`, `fhir`, `@react-three/fiber`, `@uswds/uswds`, …) and loads the matching pack into downstream context; [`design-auditor`](agents/design-auditor.md) folds each pack's audit checklist into the relevant pillar. Additive knowledge — no new pillar, no new runtime dependency. First sub-phase of Phase 36 (Motion-tool verification + Conversational UI follow).
+
 ### Previous releases
 
 - **v1.26.0** — Headless Model Resolver (per-runtime tier→model map, `resolved_models` router field, per-runtime price tables, `reasoning-class` runtime-neutral alias).

package/SKILL.md

@@ -99,6 +99,7 @@ Each stage produces artifacts in `.design/` inside the current project.
 | `watch-authorities [--refresh] [--since <date>] [--feed <name>] [--schedule <cadence>]` | `get-design-done:gdd-watch-authorities` | Run design-authority-watcher — fetch curated feeds, diff snapshot, classify new entries → `.design/authority-report.md` (consumed by `/gdd:reflect`) |
 | `benchmark <component\|--wave N\|--list\|--refresh component>` | `get-design-done:gdd-benchmark` | Harvest + synthesize per-component design specs from 18 design systems → `reference/components/<name>.md` |
 | `benchmark <component\|--wave N\|--list\|--refresh component>` | `get-design-done:gdd-benchmark` | Harvest + synthesize per-component design specs from 18 design systems → `reference/components/<name>.md` |
+| `export <cycle> --format html\|pdf\|notion [--pseudonymize] [--pr]` | `get-design-done:gdd-export` | Phase 35.5 — package a finished cycle's design output into a stakeholder-shareable artifact (self-contained HTML / Paged.js-print PDF / Notion page); redacts always, `--pseudonymize` masks identity for external sharing, `--pr` posts the HTML preview via pr-commenter |
 
 ## Handoff Routing
 

package/agents/design-auditor.md

@@ -311,6 +311,21 @@ grep -rEn "w-4 h-4|w-5 h-5|w-6 h-6" src/ --include="*.tsx" --include="*.jsx" 2>/
 
 ---
 
+## Domain checklist addendum (Tier-3)
+
+If DESIGN-CONTEXT.md carries a `<domain>` line (set by `design-context-builder` Step 0F — `finance` / `healthcare` / `gaming` / `civic`), **also** run that pack's `## Audit checklist` from `reference/domains/<domain>-patterns.md` and fold its findings into the relevant pillar:
+
+| Domain | Pack | Folds into pillar(s) |
+|--------|------|----------------------|
+| finance | `reference/domains/finance-patterns.md` | Typography (tabular-nums / number formatting), Color (gain/loss never color-only), Copy (regulatory disclosure placement), Experience (destructive-action guards) |
+| healthcare | `reference/domains/healthcare-patterns.md` | Experience (PHI isolation, idle auto-logout), Copy (plain medical language), Color (critical-value flags not color-only), Visual Hierarchy (audit-trail surfacing) |
+| gaming | `reference/domains/gaming-patterns.md` | Micro-Polish + Experience (reduced-motion / vestibular, flash thresholds), Layout (TV-safe area), Experience (input-model adaptation, no hover-only) |
+| civic | `reference/domains/civic-patterns.md` | Copy (plain language, grade 6-8), Color (WCAG AA contrast floor), Experience (session-timeout warnings, keyboard operability), Typography (reading level) |
+
+A failed domain check is a **finding in its pillar** (it lowers that pillar's score and appears in DESIGN-AUDIT.md), not a separate score. When no `<domain>` is set, skip this addendum. This is **additive** — it never replaces the 7-pillar scoring (per "Supplement, Not Replace" above).
+
+---
+
 ## Execution Steps
 
 ### Step 1: Load Context

package/agents/design-context-builder.md

@@ -250,6 +250,36 @@ Record the detected type in DESIGN-CONTEXT.md as a `<project_type>` line (e.g. `
 
 Proceed to Step 1 regardless of outcome.
 
+## Step 0F — Domain Detection (Tier-3 packs)
+
+Detect the **industry domain** — orthogonal to project type (a finance app can be `web` or `native-ios`). When a domain matches, load its Tier-3 pattern pack so downstream stages (interview, executor, auditor) inherit industry-specific patterns + regulatory constraints. Reuse the file-read grep/glob idiom (< 1 second, no skip).
+
+**Domains + packs** (each pack's own `## Detection signals` section is canonical; this table is the dispatcher):
+
+| Domain | Pack | Keyword signals | `package.json` dependency signals |
+|--------|------|-----------------|-----------------------------------|
+| finance | `reference/domains/finance-patterns.md` | trading, portfolio, brokerage, ledger, invoice, banking, fintech, payments, KYC | `stripe`, `@stripe/*`, `plaid`, `@plaid/*`, `dwolla-v2`, `finnhub`, `@alpacahq/*`, `ccxt`, `lightweight-charts`, `react-financial-charts`, `highcharts` |
+| healthcare | `reference/domains/healthcare-patterns.md` | patient, clinical, EHR, EMR, telehealth, HIPAA, PHI, provider, diagnosis | `fhir`, `fhirclient`, `fhir-kit-client`, `@medplum/*`, `medplum`, `hl7`, `redox` |
+| gaming | `reference/domains/gaming-patterns.md` | game, HUD, player, level, multiplayer, leaderboard, inventory, quest | `phaser`, `three`, `@react-three/*`, `pixi.js`, `babylonjs`, `@babylonjs/*`, `colyseus`, `playcanvas`, `excalibur`, `matter-js` |
+| civic | `reference/domains/civic-patterns.md` | gov, government, public, citizen, benefits, permit, tax, election, municipal | `@uswds/uswds`, `uswds`, `@trussworks/react-uswds`, `govuk-frontend`, `@18f/*` |
+
+```bash
+grep -iE "trading|portfolio|brokerage|fintech|patient|clinical|EHR|HIPAA|HUD|multiplayer|leaderboard|gov|citizen|benefits|permit" -r . --include="*.md" --include="*.tsx" 2>/dev/null | head
+node -e "const p=require('./package.json');const d={...p.dependencies,...p.devDependencies};console.log(Object.keys(d).join(' '))" 2>/dev/null   # match against the dependency column
+```
+
+**Confidence rule (D-02):**
+
+- **≥2 distinct signals, OR any dependency match → auto-apply** the pack. Record it + note it in the brief ("Detected finance domain — loaded finance-patterns.md").
+- **Exactly 1 weak keyword signal → suggest**, don't impose ("This looks like a healthcare project — load healthcare-patterns.md? [y/N]").
+- **No signal → skip** (most projects have no domain pack; that's fine).
+
+Domain packs are **additive context, never a hard gate**. Multiple domains can co-apply (rare). A brief override wins (if the user says "it's a fintech dashboard", honor it).
+
+Record the result in DESIGN-CONTEXT.md as a `<domain>` line (e.g. `<domain>finance</domain>`, or omit when none). Do not inline the pack content here — the executor + `design-auditor` read `reference/domains/<domain>-patterns.md` directly.
+
+Proceed to Step 1 regardless of outcome.
+
 ## Step 1 — Auto-Detect Design System State
 
 Run all detection commands before asking any questions. Record what is found — this pre-populates the interview and reduces questions to only genuine unknowns.

package/connections/connections.md

@@ -2,7 +2,7 @@
 
 This directory contains connection specifications for external tools and MCPs that the get-design-done pipeline integrates with. Each connection has its own spec file. This file is the index.
 
-**Getting started:** run `/gdd:connections` for the interactive onboarding wizard — it probes all 18 connections, recommends setup based on your project type, and walks you through installing each one (auto-run for reversible MCP adds, copy-command for everything else). You can also run `/gdd:connections list` for a read-only status check or `/gdd:connections <name>` to jump to a single connection's setup.
+**Getting started:** run `/gdd:connections` for the interactive onboarding wizard — it probes all 19 connections, recommends setup based on your project type, and walks you through installing each one (auto-run for reversible MCP adds, copy-command for everything else). You can also run `/gdd:connections list` for a read-only status check or `/gdd:connections <name>` to jump to a single connection's setup.
 
 ---
 
@@ -34,6 +34,7 @@ This directory contains connection specifications for external tools and MCPs th
 | Discord | Active | [`connections/discord.md`](connections/discord.md) | **Notify** (Team Surfaces) — `DISCORD_WEBHOOK_URL` channel webhook; parity with Slack; `GDD_DISABLE_DISCORD` kill-switch; degrade-to-noop |
 | Linear | Active | [`connections/linear.md`](connections/linear.md) | **Ticket-sync** (Team Surfaces) — `mcp__linear__*` (ToolSearch probe); bidirectional cycle↔issue; redact + `GDD_DISABLE_LINEAR` kill-switch; degrade-to-noop |
 | Jira | Active | [`connections/jira.md`](connections/jira.md) | **Ticket-sync** (Team Surfaces) — Atlassian MCP `mcp__atlassian__*` (ToolSearch probe); parity with Linear; `GDD_DISABLE_JIRA` kill-switch; degrade-to-noop |
+| Notion | Active | [`connections/notion.md`](connections/notion.md) | **Export** write-path (not a pipeline stage) — `mcp__notion__*` (ToolSearch probe); `/gdd:export --format notion`; redact + `GDD_DISABLE_NOTION` kill-switch; degrade-to-HTML |
 
 ---
 
@@ -172,6 +173,14 @@ Step E1 — ToolSearch check:
 Write mobbin status to STATE.md <connections>.
 ```
 
+**Notion probe (ToolSearch-only — export write-path, 35.5):**
+
+```
+Step J1 — ToolSearch({ query: "notion", max_results: 5 })
+  → Empty / GDD_DISABLE_NOTION=1 → notion: not_configured (export degrades to the HTML format)
+  → Non-empty                    → notion: available
+```
+
 **Linear probe (ToolSearch-only — ticket-sync):**
 
 ```

package/connections/notion.md

@@ -0,0 +1,57 @@
+# Notion — Connection Specification
+
+This file is the connection specification for Notion within the get-design-done pipeline. See `connections/connections.md` for the index + capability matrix (the notion row is added at the 35.5 closeout).
+
+---
+
+Notion is the **export write-path** for `/gdd:export --format notion` (Phase 35.5). GDD generates a Notion page from a completed cycle's design artifacts — a stakeholder-shareable design-review packet. MCP-based (`mcp__notion__*`) — GDD calls MCP tools, not raw HTTP; no bundled Notion SDK, no new outbound egress. Outbound content is redacted; degrades to the self-contained HTML format when Notion is absent or disabled.
+
+---
+
+## Setup
+
+**Prerequisites:** the Notion MCP server connected to your workspace (OAuth on first use). No GDD-held token.
+
+```
+# register the Notion MCP per Notion's MCP docs, then restart the session
+```
+
+**Verification:**
+
+```
+ToolSearch({ query: "notion", max_results: 10 })
+```
+
+Expect Notion page/block tools (`mcp__notion__*`). If empty → `notion: not_configured`. Verify exact tool names via ToolSearch; do not hardcode.
+
+---
+
+## What GDD does
+
+On `/gdd:export --format notion`, GDD creates a page from the export source set (EXPERIENCE.md + DESIGN.md + DESIGN-VERIFICATION.md + decisions + screenshots): headings → toggle/section blocks, screenshots → image-upload blocks. Every text block is **redacted** (`scripts/lib/redact.cjs`); `--pseudonymize` additionally masks identity. Write-only (export); GDD does not read/sync Notion content.
+
+## Redaction + kill-switch + degrade
+
+- Every block body passes through `scripts/lib/redact.cjs` (the single chokepoint).
+- Kill-switch: `GDD_DISABLE_NOTION=1` (env) or `.design/config.json` `"export": { "notion": { "enabled": false } }`. `gsd-health` surfaces it.
+- **Degrade:** `notion: not_configured` / disabled / an MCP error → `/gdd:export` falls back to the self-contained `html` format + a note (the export never fails on Notion absence — D-03/D-07).
+
+## STATE.md integration + probe
+
+```xml
+<connections>
+notion: not_configured
+</connections>
+```
+
+| Value | Meaning |
+|---|---|
+| `available` | ToolSearch returned `mcp__notion__*` tools AND not disabled |
+| `unavailable` | tools present but a call errored (auth/rate) |
+| `not_configured` | ToolSearch empty — Notion MCP not registered |
+
+**Probe (ToolSearch-only):** `ToolSearch({ query: "notion", max_results: 5 })` → empty → `not_configured`, non-empty → `available`. Which stages probe: the export skill only (Notion is an export target, not a pipeline-stage connection).
+
+## Anti-pattern
+
+Don't post un-redacted artifacts; don't treat Notion as a read/sync source (export write-path only — bidirectional sync is out of scope); don't hard-require Notion (always degrade to the HTML file). Confluence is explicitly out of scope this phase (Notion-only).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hegemonart/get-design-done",
-  "version": "1.35.3",
+  "version": "1.36.1",
   "description": "A design-quality pipeline for AI coding agents: brief, plan, implement, and verify UI work against your design system.",
   "author": "Hegemon",
   "homepage": "https://github.com/hegemonart/get-design-done",

package/reference/domains/civic-patterns.md

@@ -0,0 +1,101 @@
+# Civic & Government Design Patterns
+
+This pack collects the design patterns, legal floors, and review heuristics that apply when building public-sector interfaces — benefits portals, permit and licensing flows, tax filing, election information, and municipal services. GDD loads it automatically when it detects a government / public-sector / civic project (see Detection signals). The legal citations below assume a US context, but the underlying patterns — accessibility floors, plain language, multilingual access, and high-trust defaults — generalize to public services anywhere.
+
+## Why civic is different
+
+In the private sector, accessibility, plain language, and translation are often framed as "nice to have" optimizations weighed against conversion. In government, they are obligations. The audience is non-self-selecting: a citizen cannot choose a competitor when a benefits form is unusable. People arrive under stress, on old hardware, on metered or slow connections, across many languages and literacy levels, often with a disability. The patterns here treat the hardest case as the design center, not the edge.
+
+## Accessibility legal floor
+
+Section 508 of the Rehabilitation Act incorporates **WCAG 2.1 Level AA** as the binding technical standard for US federal ICT. The Americans with Disabilities Act (ADA) extends comparable obligations to state and local government (Title II) and many public accommodations. Treat **WCAG 2.1 AA as a hard floor** — not optional, not an AAA-aspirational stretch goal. You do not "prioritize" it against other work; you cannot ship below it.
+
+Concretely, every civic UI must satisfy at least:
+
+| Requirement | WCAG SC | What it means in practice |
+|---|---|---|
+| Keyboard operable | 2.1.1 | Every interactive element works without a mouse; no keyboard traps (2.1.2). |
+| Visible focus | 2.4.7 | A clear, non-removed focus indicator on every focusable control. |
+| Landmarks & headings | 1.3.1, 2.4.6 | Real `main`/`nav`/`header`/`footer` regions; a logical, non-skipping heading outline. |
+| Error identification | 3.3.1 | Errors are described in text, programmatically associated with their field. |
+| Labels & instructions | 3.3.2 | Every input has a persistent, programmatic label — placeholder is not a label. |
+| Not color alone | 1.4.1 | Status, required fields, and errors never rely on color as the only cue. |
+| Text contrast | 1.4.3 | 4.5:1 for body text, 3:1 for large text and meaningful UI/graphics (1.4.11). |
+| Reflow | 1.4.10 | Usable at 400% zoom / 320 CSS px with no loss of content or horizontal scroll. |
+| Captions & transcripts | 1.2.2, 1.2.4 | Captions for video; transcripts/audio descriptions for time-based media. |
+| Name, role, value | 4.1.2 | Custom widgets expose correct accessible name, role, and state to assistive tech. |
+
+WCAG 2.2 AA adds obligations worth meeting now: **Focus Not Obscured (2.4.11)**, **Target Size (Minimum) 2.5.8** (24×24 CSS px floor; aim for ~44×44 for primary touch targets), and **Accessible Authentication (3.3.8)** (no cognitive-function test like solving a puzzle or transcribing characters as the only way in). Authoritative references: https://www.section508.gov and https://www.w3.org/WAI/WCAG21/quickref/.
+
+## Multi-language government forms
+
+A practical US minimum is **English + Spanish + Simplified Chinese (`zh-Hans`)**; agencies under Executive Order 13166 / Title VI must provide meaningful access to limited-English-proficient (LEP) users, and the right language set is driven by the served population (Vietnamese, Tagalog, Korean, Haitian Creole, Arabic, and others are common).
+
+Patterns:
+
+- **Persistent language toggle** in a predictable location (top of every page), not buried in a footer or settings panel. Selection persists across the whole session and survives navigation.
+- **Translate the content, not just the chrome.** Field labels, help text, **validation/error messages**, confirmation screens, emails, and PDFs must all be localized — a form that switches its buttons to Spanish but throws English errors has failed.
+- Set `lang` on the document and on any in-page language switches so assistive tech pronounces content correctly.
+- **Right-to-left readiness**: build layouts with logical properties / `dir="rtl"` support so Arabic, Farsi, Urdu, and Hebrew mirror correctly. Don't hard-code left/right.
+- **Avoid machine-only translation for legal text.** Eligibility rules, consent, rights notices, and binding terms need human translation and review; raw MT can be a compliance and liability problem.
+- Offer an **"I Speak" language-identification card** (a list of "I speak ___" statements in each language) so a user can self-identify their language and request an interpreter.
+
+## Plain language
+
+The **Plain Writing Act of 2010** requires US federal agencies to write public-facing material clearly. Target a **reading level of grade 6–8** (many benefits and health programs aim for grade 6 or lower).
+
+- **Active voice and short sentences.** Prefer "We denied your application" over "Your application has been denied." Keep most sentences under ~20 words; one idea per sentence.
+- **Define or avoid jargon and acronyms.** Spell out acronyms on first use; better, replace agency jargon with the everyday word ("proof of income," not "income documentation substantiation").
+- **Question-style labels.** "What is your date of birth?" reads more clearly than "DOB" or "Birthdate field."
+- **Clear next-step CTAs.** Buttons name the action and outcome ("Submit my application," "Check my status") rather than generic "OK"/"Continue" where ambiguous.
+- **Front-load the point.** Lead with what the user must do or what happened, then the detail. Use headings, short paragraphs, and lists.
+- Guidance: https://www.plainlanguage.gov. The **US Web Design System (USWDS)** encodes much of this in components and content guidance: https://designsystem.digital.gov.
+
+## Trust & accessibility-first defaults
+
+- **Generous session timeouts with warning + extend.** Per **WCAG 2.2.1 (Timing Adjustable)**, warn before a session expires and let the user extend or turn off the limit; never silently discard a half-finished benefits application. Pair with save-and-resume.
+- **No dark patterns.** No pre-checked consent, no confirm-shaming, no buried opt-outs, no fake urgency. Government must not manipulate; defaults should favor the user.
+- **Save-and-resume for long forms.** Let users leave and return without losing data — assume interruptions, shared/library computers, and multi-session completion.
+- **Print-friendliness.** Provide clean print styles and downloadable/printable confirmations and records; many users keep paper copies or mail documents.
+- **Low-bandwidth / older-device tolerance.** Server-render core content, keep payloads small, avoid blocking on heavy JS, and ensure the form is usable without the latest browser. Test on slow connections and old devices.
+- **Clear `.gov` identity & PII handling.** Show the official agency identity (the USWDS gov banner pattern), a plain-language privacy notice, and explain what personal information is collected, why, and how it is protected. Minimize PII collected; never expose SSNs or case numbers in URLs.
+
+## Forms at scale
+
+- **One-thing-per-page** (GOV.UK Design System style): ask a single question (or one tight group) per screen. It lowers cognitive load, simplifies validation and error messaging, and is far easier to make accessible and translatable. See https://design-system.service.gov.uk.
+- **Progressive disclosure.** Reveal follow-up questions only when relevant (conditional reveals), and keep the default path short for the common case.
+- **Inline validation that doesn't punish.** Validate on blur / on submit, not on every keystroke; never block typing. Allow flexible input formats (phone, dates) and normalize server-side rather than rejecting.
+- **Accessible error summary.** On a failed submit, render an error summary at the top of the form that lists each problem as a link jumping focus to the offending field, and move focus to the summary. Each field error is also shown inline and programmatically tied to its input (3.3.1).
+- **Helpful, specific errors.** Say what's wrong and how to fix it ("Enter your ZIP code as 5 digits"), in plain language and in the user's chosen language.
+- **Preserve user input on error.** Re-display everything the user entered; never make them re-key a long form because one field failed.
+
+## Detection signals
+
+GDD should auto-detect the civic/government domain from any combination of:
+
+- **Content / naming keywords:** `gov`, `government`, `public`, `citizen`, `benefits`, `permit`, `license`, `tax`, `election`, `voter`, `municipal`, `county`, `agency`, `eligibility`, `enrollment`, `public service`.
+- **`package.json` dependencies (strong signal):**
+  - `@uswds/uswds`, `uswds` — US Web Design System
+  - `@trussworks/react-uswds` — React USWDS components
+  - `govuk-frontend` — GOV.UK Design System
+  - `@18f/...` — 18F / TTS tooling and components
+- **Domain / config signals:** a `.gov`, `.mil`, or `.gov.<cc>` domain in config or deploy targets; accessibility-first project config (axe-core, `pa11y`, `jest-axe`, `eslint-plugin-jsx-a11y`, Lighthouse a11y budgets) wired into CI.
+
+Any one strong dependency match, or several keyword + domain matches together, should trigger loading this pack.
+
+## Audit checklist
+
+The auditor agent runs these against a civic UI. Each item is concrete and verifiable.
+
+1. Every interactive control is fully keyboard-operable with a visible focus ring, and there are no keyboard traps (WCAG 2.1.1, 2.1.2, 2.4.7).
+2. The page exposes correct landmarks and a logical, non-skipping heading outline; custom widgets expose correct name/role/value (WCAG 1.3.1, 2.4.6, 4.1.2).
+3. Text contrast meets 4.5:1 (body) / 3:1 (large text and meaningful UI), and no information is conveyed by color alone (WCAG 1.4.1, 1.4.3, 1.4.11).
+4. Content reflows and remains fully usable at 400% zoom / 320 CSS px with no horizontal scrolling or lost content (WCAG 1.4.10).
+5. Interactive targets meet the 24×24 CSS px minimum (primary touch targets ~44×44), and focus is never obscured (WCAG 2.5.8, 2.4.11).
+6. Every input has a persistent programmatic label (not placeholder-only); errors are described in text and tied to their field (WCAG 3.3.1, 3.3.2).
+7. On submit failure, an error summary lists each problem, links to and moves focus to the field, and user input is preserved.
+8. Reading level is grade 6–8: active voice, short sentences, no undefined jargon/acronyms, question-style labels (Plain Writing Act of 2010).
+9. A persistent language toggle covers content, help text, and **errors** — not just UI chrome — for at least EN + ES + zh-Hans, with correct `lang` and RTL readiness; legal/eligibility text is human-translated, not machine-only.
+10. Session timeout warns before expiry and offers an extend/disable option, and the form supports save-and-resume (WCAG 2.2.1).
+11. No dark patterns: no pre-checked consent, confirm-shaming, or buried opt-outs; defaults favor the user.
+12. Official `.gov` identity, a plain-language privacy/PII notice, print-friendly confirmations, and graceful behavior on low bandwidth / older devices are all present; no PII (SSN, case IDs) exposed in URLs.

package/reference/domains/finance-patterns.md

@@ -0,0 +1,123 @@
+# Finance & Fintech Design Patterns
+
+This pack documents the data-display, trading-UI, compliance, and payment-security conventions that distinguish finance products from generic SaaS. GDD loads it automatically when it detects a trading, brokerage, banking, ledger, or payments project (see Detection signals below). The auditor agent runs the Audit checklist at the end of this file against any finance UI.
+
+## Data-table density
+
+Financial UIs are table-first: positions, orders, ledgers, transaction histories. The table is the product, so its legibility budget is non-negotiable.
+
+| Property | Convention |
+|---|---|
+| Comfortable row height | 44-52px (touch-reachable, default for retail) |
+| Compact row height | 28-36px (pro/desktop blotters, high row counts) |
+| Density toggle | Offer comfortable/compact (and sometimes a 24px "ultra") as a persistent user setting |
+| Numeric font | `font-variant-numeric: tabular-nums` (or a font with lining + tabular figures) so digits occupy equal width |
+| Numeric alignment | Right-align all numbers; align on the decimal point so magnitudes stack visually |
+| Text columns | Left-align labels/symbols; never right-align prose |
+| Row separation | Prefer 1px hairline rules (or subtle zebra) for dense data; avoid heavy zebra that fights the numbers |
+| Header | Sticky/frozen header row; freeze the first identifier column (symbol/account) on horizontal scroll |
+| Column min-width | Size to the widest plausible value (e.g. a 12-digit notional), not the average |
+
+- Tabular numerals matter most where values change in place (live P&L): non-tabular figures cause horizontal jitter on every tick.
+- Right-aligning currency columns lets the eye compare orders of magnitude at a glance; decimal alignment is what makes `1,234.50` and `9.05` line up.
+- Keep currency symbols and unit suffixes out of the number cell when possible (put `USD`/`%` in the header) so the digits align cleanly.
+
+## Trading-interface conventions
+
+### Direction & semantics (never color alone)
+- Red = down/loss/sell, green = up/gain/buy is the Western default; some markets (e.g. parts of East Asia) invert this — make the mapping a setting, not a hard-coded assumption.
+- Roughly 1 in 12 men have red-green color vision deficiency. Never encode gain/loss with color only. Always pair color with a non-color cue: a `+`/`-` sign, an up/down arrow (▲/▼), or parentheses for negatives.
+- Use a colorblind-safe palette (e.g. teal/orange or blue/orange instead of pure red/green) or let users opt into one.
+
+### Real-time updates
+- Flash the cell background briefly (~150-300ms) on value change — green tint up, red tint down — then fade back. This draws the eye without permanent clutter.
+- Throttle/coalesce updates: batch ticks to ~4-10 fps (every 100-250ms) rather than rendering every websocket message; high-frequency feeds will otherwise pin the CPU and make text unreadable.
+- Show a stale/latency indicator: timestamp of last update, a "delayed 15 min" badge for non-real-time quotes (a regulatory requirement for many retail feeds), and grey the data when the feed is stale.
+
+### Order entry & destructive actions
+- Add deliberate friction to order submission: an explicit review/confirm step that restates side, symbol, quantity, order type, limit price, and estimated cost before the order is live.
+- Distinguish market vs limit orders clearly; warn on market orders in illiquid or fast-moving instruments.
+- Guard destructive/irreversible actions (cancel-all, close-all, liquidate, withdraw): require a confirmation that names the consequence, and consider type-to-confirm for account-level actions.
+- Disable the submit button while a submission is in flight; never allow accidental double-submission of an order.
+
+## Regulatory disclaimer placement
+
+The governing principle from advertising rules (SEC, FINRA) is proximity: a disclosure must sit next to the claim it qualifies, not buried in a global footer or behind a tooltip.
+
+| Context | Disclosure |
+|---|---|
+| Margin trading / leverage | Reg-T margin risk disclosure and current margin requirements, shown in the margin/borrow flow |
+| Performance / returns figures | "Past performance does not guarantee future results"; show net-of-fees and the period, adjacent to the number |
+| EU cost transparency | MiFID II ex-ante (pre-trade) cost & charges estimate at order entry; ex-post (annual) statement of aggregated costs |
+| Quotes & data | Delayed-data badge; real-time entitlement notice |
+| Projections / hypotheticals | Label clearly as hypothetical and state assumptions inline |
+
+- Ex-ante cost disclosure (MiFID II) belongs in the order ticket before confirmation, expressed in both percentage and cash terms, including the effect of costs on return.
+- FINRA Rule 2210 and SEC marketing rules require communications to be fair, balanced, and not misleading — risk disclosures must be presented with at least equal prominence to the benefit/claim, not in 8px grey fine print.
+- Authorities: https://www.sec.gov/ , https://www.finra.org/ , and the EU MiFID II framework.
+
+## Card & payment data (PCI-DSS)
+
+PCI-DSS governs how cardholder data is handled in the UI and beyond. Design must assume the front end is in scope.
+
+- Mask the PAN: display only the last 4 digits (e.g. `•••• •••• •••• 4242`). The first 6 (BIN) may be shown only where genuinely needed.
+- Never display, log, or store the CVV/CVC2/CID after authorization — not in state, not in logs, not in analytics. It is the one value that must never persist.
+- Never put PAN, CVV, or full account numbers in URLs, query strings, `localStorage`, analytics events, error reports, or screenshots.
+- Use tokenization: send card details directly to the processor (Stripe Elements, Plaid Link, etc.) so raw PAN never touches your servers; store the returned token, not the card.
+- Mask card entry inputs and disable autocomplete logging of the CVV field; clear sensitive fields from memory after submit.
+- Authority: https://www.pcisecuritystandards.org/
+
+## Number formatting precision
+
+Honest, locale-correct number formatting is a trust signal in finance. Use the platform's locale APIs (e.g. `Intl.NumberFormat`) rather than hand-rolled formatting.
+
+- Currency minor units: respect each currency's decimal places — USD/EUR use 2, JPY/KRW use 0, and several (BHD, KWD, TND) use 3. Do not hard-code 2.
+- Percentages: pick a precision and keep it consistent per context (2 decimals for yields/rates is common); show a trailing zero rather than dropping it (`5.00%`, not `5%`).
+- Basis points (bps): 1 bp = 0.01% = 0.0001. Use bps for small rate moves and spreads; label the unit explicitly.
+- Locale grouping/decimals: respect locale separators (`1,234.56` en-US vs `1.234,56` de-DE vs `1 234,56` fr-FR). Never assume `.` is the decimal mark.
+- Negatives: in accounting contexts, show negatives in parentheses `(1,234.50)` (often with red); elsewhere a leading minus is fine. Pick one convention per surface and apply it everywhere.
+- Rounding honesty: state whether a figure is rounded or truncated; never round a fee/cost down in a way that understates what the user pays. Carry full precision internally and round only at display.
+
+## Real-time data UI
+
+- Websocket cadence: subscribe to streams, but render on a throttled tick (100-250ms) and coalesce intermediate updates; full-snapshot on (re)connect, deltas thereafter.
+- Optimistic vs confirmed: clearly distinguish an order/transfer that is *pending* (optimistic, locally echoed) from one *confirmed* by the venue/backend. Use a distinct state — never let a pending action look settled.
+- Connection loss: show a persistent "Reconnecting…" banner the moment the socket drops; auto-reconnect with backoff.
+- Stale-data greying: when the feed is stale or disconnected, grey out live values and freeze the last-known number with its timestamp, so users never act on data that looks live but is not.
+
+## Detection signals
+
+GDD treats a project as finance/fintech when it sees these signals. Keywords (in product copy, route names, schema, or component names) plus payment/market data dependencies in `package.json` are the strongest indicators.
+
+**Keywords:** trading, trade, order, blotter, portfolio, position, P&L, brokerage, ledger, journal entry, invoice, banking, account balance, fintech, payments, payout, wallet, KYC, AML, custody, settlement.
+
+**`package.json` dependencies:**
+
+| Dependency | Signals |
+|---|---|
+| `stripe`, `@stripe/stripe-js`, `@stripe/react-stripe-js` | Card payments / billing |
+| `plaid`, `@plaid/...`, `react-plaid-link` | Bank account linking / ACH |
+| `dwolla-v2` | ACH transfers / payouts |
+| `finnhub`, `@alpacahq/alpaca-trade-api` | Market data / brokerage trading |
+| `ccxt` | Crypto exchange connectivity |
+| `lightweight-charts`, `react-financial-charts` | Financial / candlestick charting |
+| `highcharts` / `highstock` | Stock charting |
+
+Any one payment/market dependency, or a cluster of the keywords, should trigger this domain pack.
+
+## Audit checklist
+
+A finance UI should pass every item below.
+
+1. Numeric columns use `tabular-nums` (or tabular lining figures), are right-aligned, and align on the decimal point.
+2. The data table offers a density mode (comfortable/compact) and uses appropriate row heights; headers (and key identifier columns) stay frozen on scroll.
+3. Gain/loss and up/down are never conveyed by color alone — each carries a sign, arrow, or parentheses, and a colorblind-safe palette is available.
+4. Live values flash on change and updates are throttled/coalesced (no per-message re-render); a stale/delayed indicator and last-update timestamp are present.
+5. Order entry has an explicit confirmation step restating side, symbol, quantity, type, and estimated cost; submit is disabled while a request is in flight.
+6. Destructive/irreversible actions (cancel-all, liquidate, withdraw) are guarded by a consequence-naming confirmation.
+7. Cost and risk disclosures sit adjacent to the figure they qualify (e.g. ex-ante costs in the order ticket), not in a global footer, and are at least as prominent as the claim.
+8. Margin/leverage flows show the Reg-T margin risk disclosure; performance figures carry a past-performance disclaimer with period and net-of-fees basis.
+9. PAN is masked to last-4; CVV is never displayed, logged, persisted, or stored after authorization.
+10. No PAN, CVV, or account number appears in URLs, query strings, `localStorage`, analytics events, or error reports; card data is tokenized via the processor.
+11. Currency, percentage, and basis-point values respect the correct minor units, locale separators, and a consistent negative convention; rounding/truncation is honest and applied only at display.
+12. Real-time UI distinguishes pending (optimistic) from confirmed states and greys/freezes stale data on connection loss with a visible reconnect indicator.

package/reference/domains/gaming-patterns.md

@@ -0,0 +1,111 @@
+# Game UI & HUD Design Patterns
+
+This pack covers UI, HUD, and interaction patterns specific to games and interactive entertainment: the diegetic-UI taxonomy, high-motion accessibility, age-rating gates, multi-input (controller / touch / keyboard-mouse) interaction models, and game-feel feedback. GDD loads this domain automatically when it detects a game, HUD, or interactive-entertainment project (see Detection signals). The auditor agent runs the Audit checklist against the project's UI.
+
+## HUD / diegetic UI taxonomy
+
+The canonical model is the four-quadrant scheme from Fagerholt & Lorentzon ("Beyond the HUD", 2009), classified on two axes: whether the element exists in the game's **story (fiction)** and whether it exists in the **3D geometry of the game space**.
+
+| Type | In the fiction? | In 3D space? | Example | Use when |
+|------|-----------------|--------------|---------|----------|
+| **Non-diegetic** | No | No | Classic flat overlay: health bar, minimap, ammo counter | Information must be instantly legible regardless of camera; competitive or fast-twitch genres |
+| **Diegetic** | Yes | Yes | Dead Space health spine, Metro 2033 wrist watch, in-world ammo on the gun | Immersion-first single-player; the readout can plausibly belong to a character/object |
+| **Spatial** | No | Yes | Floating waypoint markers, enemy outlines, footstep VFX rendered in-world | Guidance anchored to a location/entity but not justified by the story |
+| **Meta** | Yes | No | Blood/cracked-glass screen splatter, rain on the "lens", damage-direction vignette | Conveying character state via the presentation layer / 4th-wall surface |
+
+Guidance:
+
+- Default competitive and twitch genres (shooters, MOBAs, fighting) to **non-diegetic** for raw readability; reserve diegetic/meta for ambience.
+- Diegetic elements must degrade gracefully — if the player can't see the gun, they can't see the ammo, so pair with an accessibility fallback (toggleable non-diegetic readout).
+- **Minimalist / no-HUD trends**: contextual fade (show on change, fade when idle), HUD-on-demand (hold a button to reveal), and full no-HUD modes (Journey, photo modes). Always make HUD density a player setting rather than a hard removal.
+- Never encode critical state in a single channel that a player may have disabled (color, a diegetic-only readout, an audio-only cue).
+
+## High-motion accessibility
+
+### Vestibular / motion triggers
+
+Provide **in-game toggles** for each of the following AND honor the OS / platform "reduce motion" signal (`prefers-reduced-motion` on web, the equivalent OS accessibility flag on console/mobile). The in-game control overrides, but reduced-motion should set the safe default.
+
+- Camera shake (combat, explosions, footsteps) — slider 0–100%, not just on/off.
+- Parallax and large background motion in menus and HUD.
+- Head-bob / weapon-sway / view-bob during locomotion.
+- Screen-wide motion: speed lines, motion blur, chromatic aberration, full-screen zoom/punch.
+- Field-of-view (FOV) slider; narrow FOV is a common nausea trigger in first-person.
+
+### Photosensitive epilepsy (PSE)
+
+- No more than **three general flashes per second** over any one-second window (WCAG 2.3.1 *Three Flashes or Below Threshold*; aligns with the Harding/ITU broadcast limit).
+- Apply extra caution to **saturated red** flashes — red flashing is disproportionately provocative and has a stricter threshold than general luminance flashes.
+- Avoid large high-contrast rapidly-alternating patterns (stripes, checkerboards) covering a large area of the screen.
+- Surface a PSE warning at first launch and document risky effects; offer a "reduce flashing" toggle that caps strobe effects.
+
+### Motion-sickness comfort (esp. VR)
+
+- Comfort vignette / tunneling that narrows peripheral vision during fast movement or turns.
+- **Snap-turn** (discrete angular increments) as an alternative to smooth turning; teleport locomotion as an alternative to smooth movement.
+- Fixed visual reference (cockpit, nose, horizon line) and a static-world option.
+
+## ESRB / PEGI age-gates & content disclosure
+
+- **Neutral date-of-birth gate**: collect day/month/year with **no pre-filled default** and no shortcut. Do **not** use a "Are you 18?" yes/no toggle or any single-tap affirmation — these are non-compliant gates. The gate should not telegraph the passing answer.
+- Display the **correct regional rating**: ESRB (North America, esrb.org), PEGI (Europe, pegi.info), plus regional bodies where shipped (USK in Germany, CERO in Japan, ACB in Australia, GRAC in Korea, ClassInd in Brazil).
+- Show **content descriptors** alongside the rating mark (e.g., Violence, Blood, Strong Language, Sexual Content, Use of Drugs) and **interactive elements** notices.
+- Disclose **in-game purchases** and the **"Includes Random Items"** / loot-box descriptor when paid randomized rewards exist; honor regional loot-box and odds-disclosure rules (e.g., published drop-rate odds where required).
+- See ESRB ratings guide: https://www.esrb.org/ratings-guide/ and PEGI: https://pegi.info/.
+
+## Input model — controller-first vs touch-first vs KB/M
+
+Detect the **active** input device and adapt; never assume mouse hover exists.
+
+- **Spatial focus navigation**: every interactive element must be reachable and selectable via D-pad / left-stick with a clearly visible focus highlight. Maintain a sane focus order and wrap/clamp logic; nothing should be reachable by pointer only.
+- **Adaptive button-prompt glyphs**: on-screen prompts must swap to match the detected device (Xbox A/B/X/Y, PlayStation cross/circle/square/triangle, Nintendo A/B/X/Y, or KB/M key caps). Re-detect on device switch mid-session.
+- **No hover-only affordances**: tooltips, reveals, and actions that only appear on mouse hover are invisible to controller and touch. Provide a focus/press equivalent.
+- **Dead-zone & cursor-vs-stick**: expose stick dead-zone and sensitivity; if a virtual cursor is driven by a stick, tune acceleration; distinguish analog cursor from discrete focus navigation.
+- **TV-safe area / overscan**: keep critical HUD and text inside a safe margin (target ~5% inset, the action-safe region) so nothing is clipped on overscanning TVs; offer a HUD-bounds/safe-area adjustment screen.
+- **Touch-first**: minimum touch target ~44–48 px; thumb-reach zones; avoid placing controls under resting thumbs; provide on-screen stick/buttons that can be repositioned and resized.
+- **Remappable controls as accessibility**: full rebinding for every action (including toggle-vs-hold options and the ability to remap sprint/crouch/aim) is an accessibility requirement, not a luxury.
+
+## Feedback & game-feel
+
+- **Juice, used deliberately**: hit-stop (brief freeze on impact), screen-shake, particle bursts, and squash/stretch sell impact — but screen-shake and heavy effects must be **sparing and toggleable** (ties into the vestibular sliders above).
+- **Readable damage / state feedback without color alone**: pair damage-direction indicators with shape/position, low-health with a non-color cue (audio heartbeat, vignette + icon), and status effects with distinct icons + text, not just a tint. This satisfies the color-independence requirement (WCAG 1.4.1 *Use of Color* as a design north star).
+- **Latency budgets**: target end-to-end input-to-photon responsiveness — roughly under ~100 ms feels responsive, under ~50 ms feels tight; competitive/rhythm titles need the tightest budgets. Never debounce or animation-gate a core action input so heavily that it adds perceptible lag.
+- **Multi-channel confirmation**: important events (pickup, hit-confirm, objective complete) should land on at least two of {visual, audio, haptic} so a player with one channel disabled still gets feedback.
+
+## Detection signals
+
+GDD activates this domain when it sees these signals in the repo or brief.
+
+**Keywords** (prose, file names, route/scene names): `game`, `HUD`, `player`, `level`, `multiplayer`, `leaderboard`, `inventory`, `quest`, `sprite`, `gamepad`, `controller`, `respawn`, `loot`.
+
+**`package.json` dependencies** (any one is a strong signal):
+
+| Dependency | Engine / role |
+|------------|---------------|
+| `phaser` | 2D HTML5 game framework |
+| `three` | WebGL 3D renderer |
+| `@react-three/fiber` | React renderer for three.js |
+| `@react-three/drei` | Helpers for react-three-fiber |
+| `pixi.js` | 2D WebGL rendering |
+| `babylonjs` / `@babylonjs/core` | 3D game engine |
+| `colyseus` | Authoritative multiplayer server |
+| `playcanvas` | 3D/WebGL game engine |
+| `excalibur` | TypeScript 2D game engine |
+| `matter-js` | 2D physics engine |
+
+The presence of a game engine dep plus any HUD/player keyword should auto-route the project into this domain.
+
+## Audit checklist
+
+1. Every motion effect (camera shake, parallax, head-bob, motion blur, screen-wide zoom) respects the OS reduced-motion setting AND exposes an in-game slider (not just on/off).
+2. No visual effect flashes more than **three times per second**, and saturated-red flashing is specifically avoided (WCAG 2.3.1); a PSE warning is shown at first launch.
+3. An FOV slider and a motion-sickness comfort option (vignette/tunneling; snap-turn or teleport in VR) are present where the camera is first/close-third person.
+4. The age gate is a **neutral date-of-birth entry** with no pre-filled default — not an "Are you 18?" yes/no toggle.
+5. The correct regional rating mark, content descriptors, and an in-game-purchase / loot-box ("Includes Random Items") disclosure are displayed.
+6. Every interactive element is reachable via D-pad / stick focus navigation with a visible focus highlight; nothing is pointer-only.
+7. On-screen button prompts adapt to the active input device (Xbox / PlayStation / Nintendo / KB-M) and re-detect on device switch; nothing relies on mouse hover.
+8. Critical HUD and text sit inside a TV-safe / action-safe margin (~5% inset) and survive overscan; a HUD-bounds adjustment exists where relevant.
+9. All gameplay controls are fully remappable (with toggle-vs-hold options) as an accessibility provision.
+10. No critical state is encoded by color alone — damage, low-health, and status effects use shape, position, icon+text, or audio in addition to color.
+11. Screen-shake and other "juice" are sparing and toggleable; core action inputs are not animation-gated into perceptible lag (input-to-response budget honored).
+12. Important events (hit-confirm, pickup, objective) are confirmed on at least two of visual / audio / haptic channels.

package/reference/domains/healthcare-patterns.md

@@ -0,0 +1,103 @@
+# Healthcare & Clinical Design Patterns
+
+This pack covers domain-specific UI/UX patterns for healthcare, clinical, and EHR/EMR software: HIPAA-aware forms, audit-trail surfaces, patient-portal flows, accessibility for vulnerable populations, and safe medical-data visualization. GDD loads it automatically when it detects a healthcare/clinical/EHR project from the signals below. GDD surfaces these patterns and flags likely risks; it does **not** certify HIPAA compliance — that is a legal and organizational process (Business Associate Agreements, Security Risk Analysis, counsel sign-off) that no design tool can perform.
+
+## HIPAA-aware form patterns
+
+Protected Health Information (PHI) is any individually identifiable health data — the 18 HIPAA identifiers include name, dates (DOB, admission), MRN, account numbers, biometric IDs, full-face photos, and any of the geographic/contact fields. Design forms so PHI is contained, intentional, and minimal.
+
+- **PHI isolation.** Keep PHI fields in clearly bounded form sections, visually and structurally separate from non-PHI (preferences, UI settings, marketing opt-ins). This makes the data classification obvious to engineers and supports field-level encryption/access scoping downstream.
+- **Minimum-necessary principle.** The HIPAA Privacy Rule requires using/disclosing only the PHI needed for the task. Do not collect a field "just in case." Every PHI input should map to a stated purpose; prefer progressive disclosure over one giant intake form.
+- **Never leak PHI into ambient surfaces.** No PHI in URLs, path segments, or query strings (`/patient/12345?ssn=...` is a breach vector — it lands in browser history, server logs, and `Referer` headers). No PHI in page `<title>`, no PHI in client analytics events (Google Analytics, Segment, Mixpanel, session-replay tools like FullStory/Hotjar — these are notorious for inadvertent capture), and no PHI written to console or client logs.
+- **Session auto-logout + idle timeout.** Auto-terminate or lock the session after **10-15 minutes** of inactivity (shorter on shared/kiosk workstations). Show a countdown warning ~60s before logout with an "I'm still here" extend action. Clear in-memory PHI on logout; never persist PHI to `localStorage`.
+- **Break-the-glass emergency access.** When a clinician needs records outside their normal authorization (e.g., a patient in the ED who isn't theirs), allow override but **capture justification at the moment of access** (free-text reason + structured reason code), warn that the access is logged and reviewed, and flag the event for compliance audit. The friction is intentional.
+- **Auto-fill / autocomplete.** Disable browser autofill on sensitive fields (`autocomplete="off"` where appropriate) and never pre-fill another patient's data into a shared form.
+
+## Audit trails as UI
+
+Access logging is mandated by the HIPAA Security Rule (audit controls, §164.312(b)). Treat the audit log as a first-class, user-visible feature — not just a backend table.
+
+- **Who-accessed-what.** Surface access events with actor identity, role, timestamp, the specific record/section viewed, and the action (view/edit/export/print).
+- **Access reason.** Where access requires justification (break-the-glass, sensitive segments), display the captured reason inline with the event.
+- **Immutability.** Audit entries are append-only. The UI must never offer edit/delete on a log row; show it as a read-only, chronological ledger. Surface tamper-evidence (e.g., sequence numbers) if the backend provides it.
+- **Patient-facing "who saw my record."** Patient portals should let patients review an access history of their own chart and report suspected inappropriate access. This supports the patient's right to an accounting of disclosures.
+
+## Patient-portal flows (MyChart-class)
+
+Patient portals (MyChart, Athenahealth, Healow-style) share a recognizable set of flows. Design each with the safety/consent rules below.
+
+| Flow | Key design considerations |
+|------|---------------------------|
+| Appointment scheduling | Real-time slot availability, visit-type/reason capture, pre-visit forms, reminders, easy reschedule/cancel with cancellation-window rules. |
+| Lab / result release | Respect **provider hold windows** — sensitive results (oncology, genetics, HIV, pathology) may be embargoed so the provider can contact the patient first. Note: the ONC Information Blocking rule (21st Century Cures Act) generally requires *prompt* release, so holds must be narrow and policy-driven. Always show units + reference ranges (see visualization). |
+| Proxy / caregiver access | Distinct, scoped access for parents of minors, caregivers, and guardians. Handle the **adolescent-confidentiality transition** (access often narrows at age 12-18 per state law). Show proxies clearly whose record they are viewing. |
+| Secure messaging | Encrypted in-app messaging with care team, not email/SMS. Set expectations (not for emergencies — direct to 911/ED), show response-time SLAs, and capture message threads in the chart. |
+| After-visit summary (AVS) | Plain-language recap of the visit: diagnoses, meds, instructions, follow-ups. Printable/downloadable, reading-level controlled. |
+| Prescription / refills | Refill requests, pharmacy selection, and medication lists with names, doses, and clear active/discontinued status. |
+
+## Accessibility-first
+
+Healthcare reaches the broadest, most impaired population of any domain: elderly users, low vision, motor and cognitive impairment, low health literacy, limited English proficiency, and people in pain or distress. Target **WCAG 2.1 Level AAA** where feasible (not just AA) and design for stress cases.
+
+- **Touch targets.** Minimum **44x44 px** (Apple HIG / WCAG 2.5.5 AAA recommends 44pt; Material recommends 48dp). Generous spacing between targets to prevent mis-taps.
+- **Contrast.** AAA text contrast is **7:1** for normal text and **4.5:1** for large text (vs. AA's 4.5:1 / 3:1). Do not rely on hairline gray-on-gray.
+- **Plain medical language + reading level.** Default to plain language (CDC guidance targets roughly a 6th-8th grade reading level for patient materials). Offer a reading-level / "explain this" control, expand acronyms (BP, A1C), and pair clinical terms with lay equivalents ("hypertension (high blood pressure)").
+- **Error messages that explain.** Say what is wrong, why, and how to fix it ("Date of birth must be in the past — use MM/DD/YYYY"). Never error-by-color-only; include text + icon and associate the message programmatically with the field (`aria-describedby`).
+- **Scalable type & zoom.** Support 200% zoom and OS text-scaling without loss of content (WCAG 1.4.4 / 1.4.10 reflow). Respect `prefers-reduced-motion`.
+- **Language access.** Support translation/interpreter pathways; civil-rights rules (ACA Section 1557) expect meaningful access for limited-English-proficiency patients.
+
+## Medical-data visualization
+
+Lab and vitals visualization is safety-critical. The goal is accurate interpretation without implying a diagnosis the data does not support.
+
+- **Values with reference ranges + units.** Every result shows the value, the **unit** (mg/dL, mmol/L, mEq/L — unit ambiguity causes real harm), and the lab's reference range. Ranges can be age/sex-specific; show the applicable range.
+- **Normal / abnormal / critical flags.** Mark results as within-range, abnormal (H/L), or critical (HH/LL / panic value). Critical values warrant the strongest treatment.
+- **Never color-only for critical values.** Encode status with **icon + text + position**, not hue alone (8% of men have color-vision deficiency). A red dot is invisible to many users and to grayscale printouts; pair it with an explicit "Critical — High" label and an icon.
+- **Trends over time.** Plot longitudinal values with the reference band shaded behind the line so abnormality is visible at a glance. Label axes with units; keep consistent scales when comparing.
+- **Avoid implying diagnosis.** Present data and flags, not conclusions. Don't auto-label a value as a disease; surface it as a flagged result for clinician interpretation. Show result status (preliminary vs. final), collection time, and the ordering provider.
+
+## Detection signals
+
+GDD auto-detects this domain from project keywords and dependencies.
+
+**Keywords (code, copy, file/route names):** `patient`, `clinical`, `EHR`, `EMR`, `telehealth`, `HIPAA`, `PHI`, `provider`, `diagnosis`, `prescription`, plus supporting terms like `MRN`, `chart`, `encounter`, `appointment`, `lab result`.
+
+**`package.json` dependencies (strong signal):**
+
+| Package | Indicates |
+|---------|-----------|
+| `fhir` | FHIR resource models/parsing |
+| `fhirclient` | SMART on FHIR client (EHR launch) |
+| `fhir-kit-client` | FHIR REST client |
+| `@medplum/core` / `medplum` | Medplum healthcare platform SDK |
+| `hl7` | HL7 v2 messaging |
+| `@types/fhir` | FHIR TypeScript types |
+| `redox` | Redox EHR integration engine |
+
+Any FHIR/HL7/Medplum/Redox dependency, or a cluster of the keywords above, should trigger loading this pack.
+
+## Audit checklist
+
+Concrete, verifiable items for reviewing a healthcare UI:
+
+1. **No PHI in URLs, path params, query strings, page titles, or client analytics/session-replay events.** Inspect routes and analytics payloads for identifiers.
+2. **Forms collect only minimum-necessary PHI** — each PHI field maps to a stated purpose; no speculative "just in case" fields.
+3. **PHI fields are isolated** from non-PHI (preferences, marketing) in clearly bounded sections.
+4. **Session auto-logs-out after a 10-15 min idle timeout**, with a countdown warning and an extend action; in-memory PHI is cleared and never stored in `localStorage`.
+5. **Break-the-glass / emergency access captures a justification** (reason code + free text), warns the user it is logged, and flags the event for review.
+6. **An immutable, append-only access log is surfaced in the UI** (actor, role, timestamp, record, action) with no edit/delete affordance.
+7. **Patients can view who accessed their own record** and report suspected inappropriate access.
+8. **Sensitive lab/result release honors provider hold windows** and proxy/adolescent-confidentiality rules.
+9. **Lab results show value + unit + reference range**, with normal/abnormal/critical flags.
+10. **Lab criticals are flagged by icon + text (and position), not color alone**, and remain legible in grayscale.
+11. **Visualizations present flagged data, not diagnoses** — no auto-labeling of results as a disease.
+12. **Accessibility meets the AAA bar where feasible:** touch targets >= 44x44 px, 7:1 text contrast, plain-language/reading-level control, and error messages that explain what's wrong and how to fix it.
+
+## Canonical references
+
+- HIPAA Privacy & Security Rules (HHS): https://www.hhs.gov/hipaa/for-professionals/index.html
+- HHS guidance on tracking technologies and PHI: https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/index.html
+- WCAG 2.1 (W3C/WAI): https://www.w3.org/TR/WCAG21/
+- WAI accessibility guidance: https://www.w3.org/WAI/
+- HL7 FHIR specification: https://hl7.org/fhir/
+- ONC Cures Act / information blocking (HealthIT.gov): https://www.healthit.gov/topic/information-blocking

package/reference/export-formats.md

@@ -0,0 +1,31 @@
+# Export Formats — the `/gdd:export` contract
+
+How `/gdd:export <cycle> --format html|pdf|notion [--pseudonymize] [--pr]` turns a completed cycle's in-repo design output into a stakeholder-shareable artifact. Dep-free: the HTML/PDF assembler is pure (`scripts/lib/export/build-html.cjs`); Notion is MCP-based; no `paged`/`puppeteer`/`pdfkit`/markdown-lib runtime.
+
+---
+
+## Source set (what gets packaged)
+
+In cycle order: `EXPERIENCE.md` (Phase 19.5 cross-cycle memory) · `.design/DESIGN.md` · `.design/DESIGN-VERIFICATION.md` · `.design/DESIGN-AUDIT.md` (if present) · the decision log (`D-XX`) · Preview/Chromatic screenshots (base64-embedded for html/pdf).
+
+## Formats
+
+- **`html`** (default) — `buildHtml({ title, subtitle, sections, images })` → a **single self-contained HTML** file: inline `<style>`, base64-embedded images, **zero external references** (safe to email / drop in Drive). Written to `.design/export/<cycle>.html`.
+- **`pdf`** — the same `buildHtml({ ..., print: true })` (adds a Paged.js-compatible `@page` print stylesheet). Written to `.design/export/<cycle>.print.html`; **the user renders it** via Paged.js / headless-Chrome. GDD ships **no** PDF runtime (the print-executor precedent, D-02).
+- **`notion`** — a Notion page via the Notion MCP (`connections/notion.md`): headings → section/toggle blocks, screenshots → image-upload blocks. Degrades to the `html` file when the Notion MCP is `not_configured`/disabled.
+
+## Privacy (redact always; pseudonymize opt-in)
+
+Every section is passed through `scripts/lib/redact.cjs` (secrets — the floor). `--pseudonymize` additionally applies `scripts/lib/pseudonymize.cjs` (git identity / paths / hostname / repo origin) — use it when sharing externally. Default (no flag) = redact only.
+
+## PR integration (`--pr`)
+
+`--pr` hands the generated self-contained HTML preview to `agents/pr-commenter.md` (Phase 35.1) to post as a PR comment — degrade-to-noop when there's no PR or pr-commenter is unavailable (never blocks the export).
+
+## Self-contained guarantee (html/pdf)
+
+`build-html.cjs` emits no external `src=`/`<link>`/`<script>` — CSS is inline, images are base64 `data:` URIs. Content links (`<a href="https://…">`) are preserved (they're references, not load-bearing resources). Deterministic: same input → byte-identical output (the regression baseline freezes a fixture render).
+
+## Out of scope
+
+Confluence (Notion-only this phase); Figma export (Phase 31); video walkthroughs; collaborative editing (read-only handoff); bidirectional Notion sync (export write-path only); a bundled PDF/markdown runtime (D-02).

package/reference/registry.json

@@ -930,6 +930,41 @@
       "type": "heuristic",
       "phase": 35.3,
       "description": "Phase 35.3 ticket-sync contract — the STATE <ticket_links> cycle→ticket map, the bidirectional read (decision-injector surfaces linked-ticket comments on .design open) + write (transition + redacted summary on cycle completion) flow via MCP tools (mcp__linear__* / mcp__atlassian__*; no SDK, no raw HTTP), the default status-transition map, tracker-wins conflict resolution, the mandatory scripts/lib/redact.cjs chokepoint, and the GDD_DISABLE_LINEAR/GDD_DISABLE_JIRA kill-switches. Consumed by agents/ticket-sync-agent.md."
+    },
+    {
+      "name": "export-formats",
+      "path": "reference/export-formats.md",
+      "type": "heuristic",
+      "phase": 35.5,
+      "description": "Phase 35.5 /gdd:export contract — the source set (EXPERIENCE.md + DESIGN.md + DESIGN-VERIFICATION.md + decisions + screenshots), the three formats (self-contained HTML via scripts/lib/export/build-html.cjs, Paged.js-compatible print PDF rendered by the user, Notion page via the Notion MCP), mandatory scripts/lib/redact.cjs + the --pseudonymize opt-in (scripts/lib/pseudonymize.cjs), and the --pr hand-off to pr-commenter. No bundled PDF/markdown runtime (D-02)."
+    },
+    {
+      "name": "finance",
+      "path": "reference/domains/finance-patterns.md",
+      "type": "heuristic",
+      "phase": 36.1,
+      "description": "Phase 36.1 Tier-3 domain pack — finance/fintech UI patterns: data-table density (tabular-nums), trading-interface conventions (colorblind-safe gain/loss), regulatory disclosure placement (Reg-T, MiFID II), PCI-DSS PAN masking, number-formatting precision, real-time data states. Carries Detection signals (keywords + deps) + an Audit checklist consumed by design-context-builder Step 0F + design-auditor."
+    },
+    {
+      "name": "healthcare",
+      "path": "reference/domains/healthcare-patterns.md",
+      "type": "heuristic",
+      "phase": 36.1,
+      "description": "Phase 36.1 Tier-3 domain pack — healthcare/clinical UI patterns: HIPAA-aware PHI isolation (no PHI in URLs/logs/analytics), idle auto-logout, audit-trail-as-UI, MyChart-class flows, WCAG 2.1 AAA, medical-data visualization. Surfaces risk, does not certify compliance. Detection signals + Audit checklist for Step 0F + design-auditor."
+    },
+    {
+      "name": "gaming",
+      "path": "reference/domains/gaming-patterns.md",
+      "type": "heuristic",
+      "phase": 36.1,
+      "description": "Phase 36.1 Tier-3 domain pack — game UI/HUD patterns: diegetic/non-diegetic/spatial/meta HUD taxonomy, vestibular + photosensitive safety (3 flashes/sec, reduced-motion + in-game toggles), ESRB/PEGI age-gates, input-model adaptation (controller/touch/KBM), TV-safe area. Detection signals + Audit checklist for Step 0F + design-auditor."
+    },
+    {
+      "name": "civic",
+      "path": "reference/domains/civic-patterns.md",
+      "type": "heuristic",
+      "phase": 36.1,
+      "description": "Phase 36.1 Tier-3 domain pack — civic/government UI patterns: Section 508 + WCAG 2.1 AA hard floor, multi-language gov forms (EN/ES/zh-Hans), Plain Writing Act (grade 6-8), USWDS, session-timeout warnings, one-thing-per-page forms. Detection signals + Audit checklist for Step 0F + design-auditor."
     }
   ]
 }

package/scripts/lib/export/build-html.cjs

@@ -0,0 +1,112 @@
+'use strict';
+/**
+ * scripts/lib/export/build-html.cjs — Phase 35.5 self-contained HTML assembler.
+ *
+ * Pure + dep-free (D-02): no markdown library, no `paged`/`puppeteer`/`pdfkit`. Produces a
+ * SINGLE self-contained HTML string — inline <style>, base64-embedded images, ZERO external
+ * references — for the /gdd:export html + pdf formats (pdf = the same HTML + Paged.js-compatible
+ * @page print CSS the user renders, never a bundled PDF runtime). Deterministic: same input →
+ * byte-identical output (hermetic tests, D-07).
+ */
+
+// Escapes the 5 HTML-significant characters so the result is safe in BOTH element
+// content AND double/single-quoted attribute values (e.g. <img alt="...">). Escaping
+// the quotes is what makes attribute interpolation injection-safe (js/incomplete-html-
+// attribute-sanitization). Order matters: & first so the entity ampersands aren't re-escaped.
+function esc(s) {
+  return String(s)
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;');
+}
+
+// Minimal, deterministic inline-markdown → HTML (escapes first, then re-introduces tags for
+// the constructs GDD's .design markdown uses): `code`, **bold**, *italic*, [text](url).
+function inline(text) {
+  let s = esc(text);
+  s = s.replace(/`([^`]+)`/g, (_, c) => `<code>${c}</code>`);
+  s = s.replace(/\*\*([^*]+)\*\*/g, (_, b) => `<strong>${b}</strong>`);
+  s = s.replace(/(^|[^*])\*([^*\n]+)\*/g, (_, p, i) => `${p}<em>${i}</em>`);
+  s = s.replace(/\[([^\]]+)\]\((https?:\/\/[^)\s]+|#[^)\s]*)\)/g, (_, t, u) => `<a href="${u}">${t}</a>`);
+  return s;
+}
+
+// Block-level markdown → HTML. Handles headings, fenced code, ul/ol, blockquote, hr, images
+// (resolved to base64 data URIs from the images map), and paragraphs.
+function mdToHtml(md, images) {
+  const lines = String(md).replace(/\r\n/g, '\n').split('\n');
+  const out = [];
+  let i = 0;
+  const imgByName = new Map((images || []).map((im) => [im.name, im.dataUri]));
+  while (i < lines.length) {
+    const line = lines[i];
+    if (/^```/.test(line)) { // fenced code
+      const buf = []; i++;
+      while (i < lines.length && !/^```/.test(lines[i])) { buf.push(esc(lines[i])); i++; }
+      i++; out.push(`<pre><code>${buf.join('\n')}</code></pre>`); continue;
+    }
+    const h = line.match(/^(#{1,4})\s+(.*)$/);
+    if (h) { const n = h[1].length; out.push(`<h${n}>${inline(h[2])}</h${n}>`); i++; continue; }
+    if (/^\s*([-*])\s+/.test(line)) { // unordered list
+      const items = [];
+      while (i < lines.length && /^\s*([-*])\s+/.test(lines[i])) { items.push(`<li>${inline(lines[i].replace(/^\s*[-*]\s+/, ''))}</li>`); i++; }
+      out.push(`<ul>${items.join('')}</ul>`); continue;
+    }
+    if (/^\s*\d+\.\s+/.test(line)) { // ordered list
+      const items = [];
+      while (i < lines.length && /^\s*\d+\.\s+/.test(lines[i])) { items.push(`<li>${inline(lines[i].replace(/^\s*\d+\.\s+/, ''))}</li>`); i++; }
+      out.push(`<ol>${items.join('')}</ol>`); continue;
+    }
+    if (/^>\s?/.test(line)) { out.push(`<blockquote>${inline(line.replace(/^>\s?/, ''))}</blockquote>`); i++; continue; }
+    if (/^(---+|\*\*\*+)\s*$/.test(line)) { out.push('<hr>'); i++; continue; }
+    const img = line.match(/^!\[([^\]]*)\]\(([^)\s]+)\)\s*$/); // image — resolve to base64
+    if (img) {
+      const src = imgByName.get(img[2]) || (img[2].startsWith('data:') ? img[2] : '');
+      if (src) out.push(`<figure><img alt="${esc(img[1])}" src="${src}"><figcaption>${esc(img[1])}</figcaption></figure>`);
+      i++; continue;
+    }
+    if (line.trim() === '') { i++; continue; }
+    // paragraph — gather consecutive non-blank, non-block lines
+    const para = [line]; i++;
+    while (i < lines.length && lines[i].trim() !== '' && !/^(#{1,4}\s|```|>\s?|\s*[-*]\s|\s*\d+\.\s|!\[)/.test(lines[i])) { para.push(lines[i]); i++; }
+    out.push(`<p>${inline(para.join(' '))}</p>`);
+  }
+  return out.join('\n');
+}
+
+const SCREEN_CSS = `:root{--ink:#1a1a1a;--muted:#6b7280;--rule:#e5e7eb;--accent:#2563eb}*{box-sizing:border-box}body{margin:0;font:16px/1.6 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,sans-serif;color:var(--ink);background:#fff}main{max-width:820px;margin:0 auto;padding:48px 24px}h1{font-size:2rem;line-height:1.2;margin:0 0 .5rem}h2{font-size:1.4rem;margin:2rem 0 .5rem;padding-top:1rem;border-top:1px solid var(--rule)}h3{font-size:1.1rem;margin:1.5rem 0 .4rem}p{margin:.6rem 0}code{background:#f3f4f6;padding:.1em .35em;border-radius:4px;font-size:.9em}pre{background:#f8f9fb;border:1px solid var(--rule);border-radius:8px;padding:14px;overflow:auto}pre code{background:none;padding:0}a{color:var(--accent)}blockquote{margin:.8rem 0;padding:.4rem 1rem;border-left:3px solid var(--accent);color:var(--muted)}figure{margin:1rem 0}img{max-width:100%;height:auto;border:1px solid var(--rule);border-radius:8px}figcaption{font-size:.85rem;color:var(--muted);margin-top:.3rem}hr{border:none;border-top:1px solid var(--rule);margin:2rem 0}.gdd-meta{color:var(--muted);font-size:.9rem;margin-bottom:2rem}`;
+const PRINT_CSS = `@page{size:A4;margin:18mm 16mm}@media print{h2{break-before:auto}figure,pre,blockquote{break-inside:avoid}main{max-width:none;padding:0}a{color:var(--ink);text-decoration:underline}}`;
+
+/**
+ * buildHtml({ title, subtitle?, sections:[{heading, markdown}], images?:[{name, dataUri}], print? })
+ *   → a single self-contained HTML document string (inline CSS, base64 images, no external refs).
+ */
+function buildHtml(opts = {}) {
+  const title = esc(opts.title || 'GDD Design Export');
+  const css = SCREEN_CSS + (opts.print ? PRINT_CSS : '');
+  const body = (opts.sections || [])
+    .map((sec) => `<section>\n<h2>${esc(sec.heading)}</h2>\n${mdToHtml(sec.markdown || '', opts.images)}\n</section>`)
+    .join('\n');
+  const subtitle = opts.subtitle ? `<p class="gdd-meta">${esc(opts.subtitle)}</p>` : '';
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${title}</title>
+<style>${css}</style>
+</head>
+<body>
+<main>
+<h1>${title}</h1>
+${subtitle}
+${body}
+</main>
+</body>
+</html>
+`;
+}
+
+module.exports = { buildHtml, mdToHtml, inline, esc };

package/skills/connections/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: gdd-connections
-description: "Interactive onboarding wizard for the 18 external integrations the pipeline supports — probes all (`figma`, `refero`, `preview`, `storybook`, `chromatic`, `graphify`, `pinterest`, `claude-design`, `paper-design`, `pencil-dev`, `21st-dev`, `magic-patterns`, `lazyweb`, `mobbin`, `slack`, `discord`, `linear`, `jira`), recommends based on project type, walks the user through setup (auto-run MCP install or copy-command fallback), writes results to `STATE.md <connections>`. Use after `/gdd:new-project` or whenever the user wants to add, inspect, or skip a connection. Re-runnable anytime."
+description: "Interactive onboarding wizard for the 19 external integrations the pipeline supports — probes all (`figma`, `refero`, `preview`, `storybook`, `chromatic`, `graphify`, `pinterest`, `claude-design`, `paper-design`, `pencil-dev`, `21st-dev`, `magic-patterns`, `lazyweb`, `mobbin`, `slack`, `discord`, `linear`, `jira`, `notion`), recommends based on project type, walks the user through setup (auto-run MCP install or copy-command fallback), writes results to `STATE.md <connections>`. Use after `/gdd:new-project` or whenever the user wants to add, inspect, or skip a connection. Re-runnable anytime."
 argument-hint: "[list | <connection-name> | --auto]"
 user-invocable: true
 tools: Read, Write, Bash, Glob, Grep, AskUserQuestion, ToolSearch
@@ -8,11 +8,11 @@ tools: Read, Write, Bash, Glob, Grep, AskUserQuestion, ToolSearch
 
 # /gdd:connections
 
-Interactive onboarding for the 18 external integrations the pipeline supports. Replaces "probe silently at scan entry and hope the user noticed" with an explicit "here is what can plug in, here is how."
+Interactive onboarding for the 19 external integrations the pipeline supports. Replaces "probe silently at scan entry and hope the user noticed" with an explicit "here is what can plug in, here is how."
 
 Canonical per-connection specs live in `../../connections/<name>.md` (one file per integration). The capability matrix + probe-pattern spec live in `../../connections/connections.md`. This skill is the **user-facing front end** for those specs.
 
-For the 18 probe scripts (MCP + HTTP + CLI + file probes), bucket categorization, per-connection setup screen, auto-run eligibility matrix, value-prop one-liners, and STATE.md / config.json write contracts, see `./connections-onboarding.md`. For the cross-skill probe pattern + connection-handshake summary, see `../../reference/shared-preamble.md#connection-handshake-summary`. For the cross-skill output discipline, see `../../reference/shared-preamble.md#output-contract-reminders`.
+For the 19 probe scripts (MCP + HTTP + CLI + file probes), bucket categorization, per-connection setup screen, auto-run eligibility matrix, value-prop one-liners, and STATE.md / config.json write contracts, see `./connections-onboarding.md`. For the cross-skill probe pattern + connection-handshake summary, see `../../reference/shared-preamble.md#connection-handshake-summary`. For the cross-skill output discipline, see `../../reference/shared-preamble.md#output-contract-reminders`.
 
 ---
 
@@ -38,7 +38,7 @@ For the 18 probe scripts (MCP + HTTP + CLI + file probes), bucket categorization
 
 ## Workflow
 
-1. **Probe all 18 connections** — run every probe script per `./connections-onboarding.md#step-1--probe-all-18-connections`. MCP probes use `ToolSearch` first; HTTP / CLI / file probes follow non-MCP patterns. Merge results into `STATE.md <connections>` with the three-value schema (`available | unavailable | not_configured`) — never add new values.
+1. **Probe all 19 connections** — run every probe script per `./connections-onboarding.md#step-1--probe-all-19-connections`. MCP probes use `ToolSearch` first; HTTP / CLI / file probes follow non-MCP patterns. Merge results into `STATE.md <connections>` with the three-value schema (`available | unavailable | not_configured`) — never add new values.
 2. **Categorize + build summary** — bucket each probe result (available / recommended / optional / skipped / unavailable) using project-hint detection. Detail + recommendation mapping: `./connections-onboarding.md#step-2--bucket-categorization`.
 3. **Print summary table** — show buckets + value-prop one-liners (verbatim from `./connections-onboarding.md#step-3--summary-table`).
 4. **Route by mode** — `list` / `--auto` exits after summary; `<name>` jumps straight to Step 5; default mode opens an AskUserQuestion (configure recommended / pick one by one / configure all optional / re-check specific / exit). Routing detail: `./connections-onboarding.md#step-4--route-by-mode`.

package/skills/connections/connections-onboarding.md

@@ -9,7 +9,7 @@ last_updated: 2026-05-18
 
 Source: extracted from `skills/connections/SKILL.md` (Phase 28.5 rework — D-10 extract-then-link).
 The skill's load-bearing routing + invocation-mode dispatch stays in `../skills/connections/SKILL.md`;
-this file holds the 18 probe scripts, bucket categorization, per-connection setup screen,
+this file holds the 19 probe scripts, bucket categorization, per-connection setup screen,
 auto-run eligibility matrix, value-prop one-liners, and STATE.md / config.json write contracts.
 
 # Connections Onboarding Procedure
@@ -27,7 +27,7 @@ this file does NOT duplicate them; it points at them by name.
 
 ---
 
-## Step 1 — Probe all 18 connections
+## Step 1 — Probe all 19 connections
 
 Run every probe below in order. MCP probes call `ToolSearch` first (deferred tools fail silently without it). Write every result to `STATE.md <connections>` when done.
 
@@ -128,6 +128,13 @@ ToolSearch({ query: "atlassian jira", max_results: 5 })
 → Non-empty                    → jira: available
 ```
 
+**notion:** (export write-path — MCP)
+```
+ToolSearch({ query: "notion", max_results: 5 })
+→ Empty / GDD_DISABLE_NOTION=1 → notion: not_configured
+→ Non-empty                    → notion: available
+```
+
 ### Non-MCP probes
 
 **storybook** (HTTP):
@@ -173,7 +180,7 @@ Bash: ls .design/handoff/ 2>/dev/null || find . -maxdepth 3 \
   → Non-empty → claude_design: available
 ```
 
-After all 18 probes complete, merge results into `STATE.md <connections>`. Preserve the three-value schema verbatim (`available | unavailable | not_configured`). Do not add new values.
+After all 19 probes complete, merge results into `STATE.md <connections>`. Preserve the three-value schema verbatim (`available | unavailable | not_configured`). Do not add new values.
 
 ---
 
@@ -260,6 +267,7 @@ One-line value props (use verbatim):
 | discord | notify — route pipeline events to a Discord channel (redacted) |
 | linear | ticket-sync — link a cycle to a Linear issue; read comments + transition on completion |
 | jira | ticket-sync — parity with Linear via the Atlassian MCP |
+| notion | export — `/gdd:export --format notion` writes a stakeholder page (degrade-to-HTML) |
 
 ---
 
@@ -287,7 +295,7 @@ options:
   - "Exit"                            → emit ## CONNECTIONS COMPLETE, exit
 ```
 
-If recommended bucket is empty, swap that option for "Show all 18 and pick."
+If recommended bucket is empty, swap that option for "Show all 19 and pick."
 
 ---
 
@@ -350,6 +358,7 @@ options:
 | discord | set `DISCORD_WEBHOOK_URL` env (Discord channel Webhook URL) | ✗ no | Env credential — user sets it; no install command (degrade-to-noop when unset) |
 | linear | `claude mcp add linear ...` (Linear MCP) | ✓ yes | Reversible MCP add; OAuth on first call, no credential filesystem-write |
 | jira | `claude mcp add atlassian ...` (Atlassian MCP) | ✓ yes | Reversible MCP add; OAuth on first call |
+| notion | `claude mcp add notion ...` (Notion MCP) | ✓ yes | Reversible MCP add; OAuth on first call |
 
 For non-auto-run connections, hide the "Run install command now" option entirely in 5.3.
 

package/skills/export/SKILL.md

@@ -0,0 +1,30 @@
+---
+name: gdd-export
+description: "Packages a completed design cycle (.design artifacts + decisions + screenshots) into a stakeholder-shareable artifact — self-contained HTML, print-styled PDF (Paged.js-compatible), or a Notion page. Redacts secrets; --pseudonymize masks identity for external sharing; --pr posts the HTML preview as a PR comment. Use to hand a design-review packet to PMs/execs/brand who aren't in the repo."
+argument-hint: "<cycle-id> --format html|pdf|notion [--pseudonymize] [--pr]"
+user-invocable: true
+tools: Read, Write, Bash, Glob, Grep, ToolSearch, Task
+---
+
+# /gdd:export
+
+Turns a completed cycle's in-repo design output into a shareable artifact. Closes the gap that `.design/*.md` lives only in the repo — stakeholders not in code can't consume it. The format contract + source set live in `../../reference/export-formats.md`; the Notion write-path in `../../connections/notion.md`.
+
+## Steps
+
+1. **Resolve the cycle.** `<cycle-id>` (or the current cycle from `.design/STATE.md`). Read the **source set**: `EXPERIENCE.md` (Phase 19.5), `.design/DESIGN.md`, `.design/DESIGN-VERIFICATION.md`, `.design/DESIGN-AUDIT.md` (if present), the decision log, and any Preview/Chromatic screenshots.
+2. **Redact (always) + pseudonymize (opt-in).** Pass every section through `scripts/lib/redact.cjs` (secrets). If `--pseudonymize`, additionally apply `scripts/lib/pseudonymize.cjs` (git identity / paths / hostname) for external sharing. Honor `GDD_DISABLE_NOTION` for the notion format.
+3. **Assemble per `--format`:**
+   - **`html`** (default) — `node -e "require('scripts/lib/export/build-html.cjs').buildHtml({...})"` → a **self-contained** HTML (inline CSS, base64-embedded screenshots, no external refs). Write to `.design/export/<cycle>.html`.
+   - **`pdf`** — the same `buildHtml({ ..., print: true })` (Paged.js-compatible `@page` print CSS). Write `.design/export/<cycle>.print.html`; instruct the user to render it via Paged.js / headless-Chrome (GDD ships **no** PDF runtime — D-02).
+   - **`notion`** — probe the Notion MCP (`ToolSearch({query:"notion"})`); if `available`, create a page from the same source (nested toggles + image upload) per `connections/notion.md`; if `not_configured`/disabled → degrade to the `html` format + a note.
+4. **`--pr`** — hand the generated HTML preview to `agents/pr-commenter.md` (via `Task`) to post as a PR comment (degrade-to-noop if no PR / pr-commenter unavailable).
+5. **Print the artifact path** (and the Notion URL / PR comment status when applicable).
+
+## Do Not
+
+- Do not add a PDF/markdown runtime dependency (`paged`/`puppeteer`/`pdfkit`/a markdown lib) — `build-html.cjs` is pure and the PDF is render-it-yourself print HTML (D-02).
+- Do not emit an un-redacted artifact — redact is mandatory; pseudonymize is the external-sharing opt-in.
+- Do not block on Notion/PR — both degrade to a noop / the html file.
+
+## EXPORT COMPLETE