@hegemonart/get-design-done 1.39.2 → 1.40.0

package/.claude-plugin/marketplace.json

@@ -5,14 +5,14 @@
   },
   "metadata": {
     "description": "Get Design Done — 5-stage agent-orchestrated design pipeline with 9 connections, handoff-first workflow, bidirectional Figma write-back, 22+ specialized agents, queryable knowledge layer (intel store, dependency analysis, learnings extraction), and a self-improvement loop (reflector, frontmatter + budget feedback, global-skills layer). v1.20.0 ships the SDK foundation: gdd-state MCP server (11 typed tools), lockfile-safe STATE.md mutations, event stream, and resilience primitives (jittered-backoff, rate-guard, error-classifier, iteration-budget) for rate-limit + 429 + context-overflow recovery. Full CI/CD pipeline (Node 22/24 × Linux/macOS/Windows) and release automation (auto-tag + GitHub Release + release-time smoke test).",
-    "version": "1.39.2"
+    "version": "1.40.0"
   },
   "plugins": [
     {
       "name": "get-design-done",
       "source": "./",
       "description": "Agent-orchestrated 5-stage design pipeline: Brief → Explore → Plan → Design → Verify. 22+ specialized agents, 9 connections (Figma, Refero, Preview, Storybook, Chromatic, Figma Writer, Graphify, Pinterest, Claude Design), Claude Design handoff, bidirectional Figma write-back, and a queryable intel store (.design/intel/) for dependency and learnings queries. Standalone commands: style, darkmode, compare, figma-write, graphify, handoff, analyze-dependencies, skill-manifest, extract-learnings. Embeds NNG heuristics, WCAG thresholds, typographic systems, motion framework, and anti-pattern catalog. Ships with a full CI/CD pipeline (Node 22/24 × Linux/macOS/Windows) and release automation. Optimization layer (v1.0.4.1, retroactive): gdd-router + gdd-cache-manager skills, PreToolUse budget-enforcer hook, tier-aware agent frontmatter, lazy checker gates, streaming synthesizer, /gdd:warm-cache + /gdd:optimize commands, and cost telemetry at .design/telemetry/costs.jsonl — targeting 50-70% per-task token-cost reduction with no quality-floor regression. v1.20.0 SDK foundation: gdd-state MCP server (11 typed tools), lockfile-safe STATE.md mutations, event stream at .design/telemetry/events.jsonl, resilience primitives (jittered-backoff, rate-guard, error-classifier, iteration-budget) with rate-limit + 429 + context-overflow recovery, and TypeScript toolchain.",
-      "version": "1.39.2",
+      "version": "1.40.0",
       "author": {
         "name": "hegemonart"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "get-design-done",
   "short_name": "gdd",
-  "version": "1.39.2",
+  "version": "1.40.0",
   "description": "Agent-orchestrated 5-stage design pipeline: Brief → Explore → Plan → Design → Verify. 22+ specialized agents, 9 connections (Figma, Refero, Preview, Storybook, Chromatic, Figma Writer, Graphify, Pinterest, Claude Design), handoff-first workflow via Claude Design bundles, bidirectional Figma write-back (annotations, Code Connect), queryable intel store (`.design/intel/`) for O(1) design surface lookups, and self-improvement loop (reflector agent, frontmatter + budget feedback, global-skills layer at `~/.claude/gdd/global-skills/`). Standalone commands: style, darkmode, compare, figma-write, graphify, handoff, analyze-dependencies, skill-manifest, extract-learnings, reflect, apply-reflections. Embeds NNG heuristics, WCAG thresholds, typographic systems, motion framework, and anti-pattern catalog. Ships with a full CI/CD pipeline (Node 22/24 × Linux/macOS/Windows, lint + schema + frontmatter + stale-ref + shellcheck + gitleaks + injection-scan + blocking size-budget) and release automation (auto-tag + GitHub Release + release-time smoke test). Optimization layer (v1.0.4.1, retroactive): gdd-router + gdd-cache-manager skills, PreToolUse budget-enforcer hook, tier-aware agent frontmatter, lazy checker gates, streaming synthesizer, /gdd:warm-cache + /gdd:optimize commands, and cost telemetry at .design/telemetry/costs.jsonl — targeting 50-70% per-task token-cost reduction with no quality-floor regression. v1.20.0 SDK foundation: gdd-state MCP server (11 typed tools), lockfile-safe STATE.md mutations, event stream at .design/telemetry/events.jsonl, resilience primitives (jittered-backoff, rate-guard, error-classifier, iteration-budget) with rate-limit + 429 + context-overflow recovery, and TypeScript toolchain. v1.27.7 ships gdd-mcp (Phase 27.7): 12 read-only MCP tools for sub-3s priming. v1.28.0 (Phase 28): Foundational References Tier 2 — 5 new reference files (color-theory, composition, proportion-systems, i18n, contrast-advanced), 2 verifier i18n probes + 1 explore i18n-readiness probe, 12 additive cross-link insertions across 10 existing references, 2 orthogonal audit-scoring lens-tags (composition_alignment + i18n_readiness).",
   "author": {
     "name": "hegemonart",

package/CHANGELOG.md

@@ -4,6 +4,85 @@ All notable changes to get-design-done are documented here. Versions follow [sem
 
 ---
 
+## [1.40.0] - 2026-06-01
+
+### Phase 40 — Team Collaboration Mode
+
+The largest architectural phase: GDD's single-operator baseline (Phase 20 lockfile + atomic STATE.md) now extends to **multiple developers**. Multi-writer STATE.md merges per-section, decisions are attributed + reviewed through an async queue with hard locks, a conflict-resolver reconciles parallel branches, decisions export to a read-only shared journal, and per-section permissions + sectional handoff gate who writes what. Everything is **git-native + advisory** — no server, no live multiplayer, no SSO. **No new runtime dependency, no new egress.**
+
+### Breaking changes
+
+**None.** Every Phase 40 surface is additive and **off by default**: `gdd_cycle_mode` defaults to `full` (current behavior), `permissions` absent = everyone is `owner`, `collab.multi_writer_enabled` defaults to `false`, `collab.sync_backend` defaults to `git`, and the decision attribution suffix is optional + backward-compatible. A single-operator project upgrading to v1.40.0 behaves exactly as it did on v1.39.5.
+
+### Added
+
+- **`reference/multi-author-model.md`** — the team-collaboration contract (merge model, attribution, review queue + locks, lock policy, sectional handoff, permissions, journal export + PR threading, opt-in sync). Registered.
+- **`scripts/lib/collab/`** — 7 pure, dep-free cores: `attribution` (decision `[author= co-author=]` suffix), `section-merge` (git-merge-driver per-section semantic merge — union by D-id, conflict only on same-id divergence), `lock-policy` (team-mode advisory-lock backoff), `review-queue` (proposed→reviewing→approved→locked + audited unlock), `cycle-mode` (sectional handoff stage gate), `permissions` (per-section `can()`), `sync-backend` (git/s3/git-lfs selector).
+- **`agents/conflict-resolver.md`** — three-way STATE.md merge, per-section + human-confirmed; never auto-picks or drops a decision.
+- **`agents/decision-journal-exporter.md`** — `<decisions>` → `pseudonymize` → read-only Notion/Confluence on cycle close (write-only; degrades to local markdown).
+- **`skills/review-decisions/SKILL.md`** (`/gdd:review-decisions`) + **`skills/unlock-decision/SKILL.md`** (`/gdd:unlock-decision <id> --approver`, the only audited escape from a hard lock).
+
+### Changed
+
+- **`reference/schemas/config.schema.json`** — + `gdd_cycle_mode` (designer|dev|full) + `permissions` + `collab` (multi_writer_enabled / lock_timeout_ms / sync_backend); `generated.d.ts` regenerated.
+- **`reference/STATE-TEMPLATE.md`** — document the optional decision attribution suffix.
+- **`agents/design-reflector.md`** — a "Per-author patterns" note (reads attribution).
+- **`agents/pr-commenter.md`** — thread PR comments on `D-XX` decisions (team-mode).
+
+### Notes
+
+- **No new runtime dependency, no new egress** — 7 pure cores + reference/agent/skill prose + an additive config-schema; the live S3/git-LFS sync client is explicitly out of scope (the selector ships, the backend is pluggable).
+- 6-manifest lockstep at **v1.40.0** + `OFF_CADENCE_VERSIONS.add('1.40.0')` (a minor bump) + the 33 live-pinned `manifests-version.txt` baselines forward-propagated 1.39.5 → 1.40.0.
+- Inventory relock: registry-diff 158 → 159 (+`multi-author-model`), skill-list 80 → 82 (+`review-decisions`, +`unlock-decision`), agent-list +`conflict-resolver` +`decision-journal-exporter` + both frontmatter-snapshots, skill-length-distribution relocked, tarball golden 709 → 721 (+12). Root `SKILL.md` command table += both skills.
+
+---
+
+## [1.39.5] - 2026-06-01
+
+### Phase 39.5 — GDD Self-Migration Tooling
+
+GDD migrates *user* design systems (39.1) but had no systematic story for **its own** breaking
+changes — Phase 31.5 moved `scripts/lib/**` → `sdk/**` with ad-hoc shims. 39.5 formalizes it: a
+machine-readable deprecation registry, a version-aware reader, a `/gdd:migrate` skill, a post-update
+advisory, and two CI gates (a completeness check + a CHANGELOG Breaking-changes linter). **No new
+runtime dependency, no new egress** — two pure helpers + a docs/skill surface.
+
+### Breaking changes
+
+None. (This release *adds* the deprecation machinery; it removes nothing. The historical Phase 31.5 →
+`sdk/` removals it documents already shipped in v1.33.0.)
+
+### Added
+
+- **`reference/DEPRECATIONS.md`** — a `## Path migrations (machine-readable)` table
+  (`Since · Removed in · Old · New · Migration hint`) + status semantics, backfilled with the 10
+  verified Phase 31.5 → `sdk/` removals (all confirmed gone from the tree).
+- **`scripts/lib/deprecation-registry.cjs`** — pure, dep-free reader: `compareVersions`,
+  `parseDeprecations` (markdown-table parser), `classify` (pending/deprecated/removed by version),
+  `checkReference`.
+- **`skills/migrate/SKILL.md`** (`/gdd:migrate [--yes] [--dry-run]`) — scans a project's references for
+  paths deprecated/removed at the installed version and **previews a diff** before rewriting. Preview-first.
+- **`scripts/lint-changelog.cjs`** (`npm run lint:changelog`) — every `## [x.y.0]` minor at/after the
+  1.39.0 floor must declare a `### Breaking changes` section; historical minors are grandfathered.
+- **`test/suite/deprecation-completeness.test.cjs`** — the SC#4 gate: every `removed` entry's old path
+  is gone + its replacement exists; every `deprecated` entry still has a shim. No orphan entries.
+
+### Changed
+
+- **`skills/update/SKILL.md`** — a post-update step that reports deprecations crossing into
+  `deprecated`/`removed` over the upgrade window and points the user at `/gdd:migrate`.
+
+### Notes
+
+- **No new runtime dependency, no new egress.** `lint-changelog.cjs` is a maintainer/CI tool (not shipped).
+- 6-manifest lockstep at **v1.39.5** + `OFF_CADENCE_VERSIONS.add('1.39.5')` + the 32 live-pinned
+  `manifests-version.txt` baselines forward-propagated 1.39.2 → 1.39.5.
+- Inventory relock: skill-list 79 → 80 (+`migrate`, phase-20 + current), tarball golden 707 → 709
+  (+`deprecation-registry.cjs` + `skills/migrate/SKILL.md`). No agent/event/connection deltas. Root
+  `SKILL.md` command table += `migrate`.
+
+---
+
 ## [1.39.2] - 2026-06-01
 
 ### Phase 39.2 — Long-Horizon Cost Governance

package/README.md

@@ -186,6 +186,14 @@ When a design system ships a breaking major — shadcn/ui v1→v2, Tailwind v3
 
 GDD already tracks cost per task and per runtime — now it **forecasts** it, **caps** it at the project level, and shows whether the spend **shipped**. [`/gdd:budget`](skills/budget/SKILL.md) groups `costs.jsonl` by cycle and (via [`cost-forecaster`](agents/cost-forecaster.md) → the pure [`cost-forecast`](scripts/lib/budget/cost-forecast.cjs)) projects the next N cycles in **best / typical / worst** scenarios — "at the current rate you'll hit your $X project cap in Y cycles." A new `budget.json.project_cap_usd` adds a **project-level hard cap**: the [`budget-enforcer`](hooks/budget-enforcer.ts) hook warns at 50% + 80% and **gracefully halts** the next agent spawn at 100% (via the pure [`project-cap`](scripts/lib/budget/project-cap.cjs) classifier) — **disabled by default**, so existing users are unaffected. [`/gdd:roi`](skills/roi/SKILL.md) joins per-cycle cost with commits that shipped (survived ≥ 14 days) vs reverted into a cost-per-shipped-commit table ([`roi`](scripts/lib/budget/roi.cjs)). **No new runtime dependency, no new egress** — the hook only ever blocks, never spends.
 
+### GDD self-migration (v1.39.5)
+
+GDD migrates *your* design systems (above) — now it migrates **itself**. When GDD ships a breaking path change (like the Phase 31.5 `scripts/lib/**` → `sdk/**` reorg), a machine-readable registry in [`reference/DEPRECATIONS.md`](reference/DEPRECATIONS.md) records `Since · Removed in · Old · New · hint`. After an upgrade, [`/gdd:update`](skills/update/SKILL.md) flags anything that crossed into deprecated/removed, and [`/gdd:migrate`](skills/migrate/SKILL.md) rewrites your project's stale references — **previewing a diff first, never silent** — via the pure [`deprecation-registry`](scripts/lib/deprecation-registry.cjs). Two CI gates keep the system honest: a completeness check (every entry has a shim or a confirmed removal) and `lint-changelog` (every future minor must declare a `### Breaking changes` section). **No new runtime dependency, no new egress.**
+
+### Team collaboration mode (v1.40.0)
+
+GDD's single-operator baseline now extends to **teams** — git-native + advisory, no server. Two developers working a cycle on parallel branches merge their `.design/STATE.md` **per section** ([`section-merge`](scripts/lib/collab/section-merge.cjs) unions decisions by `D-id`; a real conflict is only a same-id divergence, which [`conflict-resolver`](agents/conflict-resolver.md) reconciles with human confirmation — never auto-picking or dropping a decision). Decisions carry optional `[author= co-author=]` attribution, move through an async review queue (`proposed → reviewing → approved → locked`) with **hard locks** (the only escape is an audited [`/gdd:unlock-decision`](skills/unlock-decision/SKILL.md)), and [`/gdd:review-decisions`](skills/review-decisions/SKILL.md) surfaces what's pending. [`decision-journal-exporter`](agents/decision-journal-exporter.md) publishes a **pseudonymized, read-only** Notion/Confluence journal for stakeholders who don't run GDD. `gdd_cycle_mode` (designer/dev/full) partitions a cycle by role, a `permissions` model gates per-section writes, and `collab.multi_writer_enabled` switches the advisory lock to a team-mode backoff. The full contract: [`reference/multi-author-model.md`](reference/multi-author-model.md). **Everything is off by default** — a single-operator project is unaffected. **No new runtime dependency.**
+
 ### Previous releases
 
 - **v1.26.0** — Headless Model Resolver (per-runtime tier→model map, `resolved_models` router field, per-runtime price tables, `reasoning-class` runtime-neutral alias).

package/SKILL.md

@@ -104,6 +104,9 @@ Each stage produces artifacts in `.design/` inside the current project.
 | `rollout-status [<cycle>] [--all] [--stuck]` | `get-design-done:gdd-rollout-status` | Phase 38.5 — track a shipped cycle's production rollout (unrolled / staging-only / canary-N% / prod-100%) by reading the feature-flag service via `rollout-coordinator`; surfaces STUCK rollouts; feeds `design_arms` by deployed %. Read-only — never advances or rolls back |
 | `budget [--cycles N] [--scenario best\|typical\|worst]` | `get-design-done:gdd-budget` | Phase 39.2 — forecast design-cycle spend (best/typical/worst from telemetry variance) via `cost-forecaster`; "at the current rate you'll hit your $X project cap in Y cycles." Read-only — never spends, edits `budget.json`, or halts (the budget-enforcer hook halts) |
 | `roi [--since <date>] [--window-days 14]` | `get-design-done:gdd-roi` | Phase 39.2 — ROI table joining per-cycle cost with commits that shipped (survived ≥14d) vs reverted → cost-per-shipped-commit + stick rate. Read-only markdown report |
+| `migrate [--yes] [--dry-run]` | `get-design-done:gdd-migrate` | Phase 39.5 — migrate a project off GDD's own deprecated paths after an upgrade; reads `reference/DEPRECATIONS.md` via `deprecation-registry.cjs`, previews a diff, applies on confirm. Preview-first; never edits silently |
+| `review-decisions [<id>] [--pending]` | `get-design-done:gdd-review-decisions` | Phase 40 — surface the async decision-review queue (`proposed → reviewing → approved → locked`); `--pending` shows decisions still awaiting action. Read-only |
+| `unlock-decision <id> --approver <who> [--reason <text>] [--dry-run]` | `get-design-done:gdd-unlock-decision` | Phase 40 — reopen a LOCKED decision (the only escape hatch); requires an approver + writes an audit entry; previews before writing |
 
 ## Handoff Routing
 

package/agents/conflict-resolver.md

@@ -0,0 +1,80 @@
+---
+name: conflict-resolver
+description: Resolves design-artifact merge conflicts when two developers worked a cycle on parallel branches. Reads the conflicted STATE.md from both sides (ours/theirs) plus the merge base, runs the pure scripts/lib/collab/section-merge.cjs per-section semantic merge (union the <decisions> by D-id; a real conflict is only a same-id divergence), and proposes a resolution PER SECTION for explicit human confirmation. Never auto-commits a conflicted section — decisions are durable. Spawned during a team-mode merge.
+tools: Read, Bash, Grep, Glob
+color: green
+default-tier: sonnet
+tier-rationale: "Three-way semantic merge of a structured STATE.md via a pure helper + a human-confirmed per-section proposal; bounded reconciliation, not open design judgment — sonnet-tier."
+size_budget: M
+size_budget_rationale: "Honest tier sized to the ~95-line body. DELEGATES the merge math to scripts/lib/collab/section-merge.cjs + the attribution parse to scripts/lib/collab/attribution.cjs, and the model to reference/multi-author-model.md."
+parallel-safe: false
+typical-duration-seconds: 45
+reads-only: false
+required_reading:
+  - "reference/multi-author-model.md"
+writes:
+  - ".design/STATE.md (only the sections the human confirms)"
+---
+
+# conflict-resolver
+
+Two developers ran a GDD cycle on parallel branches; their `.design/STATE.md` now conflicts. You
+reconcile it **per section, with human confirmation** — you never silently pick a winner, and you
+never drop a decision. **Read `reference/multi-author-model.md` first** (the merge model).
+
+## Inputs
+
+A git merge conflict in `.design/STATE.md`. Recover the three versions:
+
+```bash
+git show :1:.design/STATE.md > /tmp/state.base   # merge base (common ancestor)
+git show :2:.design/STATE.md > /tmp/state.ours   # ours (current branch)
+git show :3:.design/STATE.md > /tmp/state.theirs # theirs (incoming)
+```
+
+(If a stage isn't available — e.g. an add/add conflict with no base — treat the base as empty.)
+
+## Procedure
+
+1. **Parse each side's `<decisions>` block** with `scripts/lib/collab/attribution.cjs`
+   (`parseDecisionsBlock`), preserving the `[author= co-author=]` attribution.
+2. **Three-way merge** via the pure helper — never merge by hand:
+
+   ```bash
+   node -e '
+     const fs = require("fs");
+     const at = require("./scripts/lib/collab/attribution.cjs");
+     const sm = require("./scripts/lib/collab/section-merge.cjs");
+     const block = (f) => { const m = fs.readFileSync(f,"utf8").match(/<decisions>([\s\S]*?)<\/decisions>/); return m ? at.parseDecisionsBlock(m[1]) : []; };
+     const r = sm.mergeDecisions(block("/tmp/state.base"), block("/tmp/state.ours"), block("/tmp/state.theirs"));
+     console.log(JSON.stringify(r, null, 2));
+   '
+   ```
+
+3. **Report the proposal per section.** For `<decisions>`:
+   - the clean union (auto-mergeable D-NN, both new adds kept) — show it,
+   - each **conflict** (same D-id, divergent text/status) — show ours vs theirs side by side and ask
+     the human which to keep (or to author a merged text). Never decide unilaterally.
+   Repeat for any other conflicted section (status, `<prototyping>`, `<rollout_status>`) using
+   `mergeStatusScalar` for single-value sections.
+4. **Apply only confirmed sections.** Write the merged `<decisions>` (re-formatted via
+   `attribution.formatDecisionLine`, attribution preserved) back to `.design/STATE.md`, leaving any
+   unconfirmed conflict marked for the human. Then `git add .design/STATE.md` is the human's call.
+5. **Never drop a decision.** A `D-NN` removed on one side but unchanged on the other is kept — surface
+   it, don't delete it.
+
+## Record
+
+Print a `## Conflict resolution` summary: sections merged, D-NN auto-unioned, conflicts surfaced +
+how each was resolved, and any section left for the human. Append one JSONL line to
+`.design/intel/insights.jsonl` recording the merge outcome. Close with:
+
+```
+## CONFLICT RESOLUTION COMPLETE
+```
+
+## Boundaries
+
+- Per-section, human-confirmed; no unilateral winner, no silent deletion.
+- Reconciles design artifacts (STATE.md); it does not run `git commit` or resolve source-code conflicts.
+- No network.

package/agents/decision-journal-exporter.md

@@ -0,0 +1,68 @@
+---
+name: decision-journal-exporter
+description: Exports a cycle's design decisions to a read-only shared journal (Notion/Confluence) so PMs, designers, and stakeholders who don't run GDD locally can see what was decided and why. Reads STATE.md <decisions>, pipes every line through scripts/lib/pseudonymize.cjs (git identity + stable hash) so author names are masked before leaving the repo, and writes a read-only page via the connections/notion.md interface on cycle close. Write-only (non-GDD users read; they never write back). Degrades to a local markdown file when no Notion connection is available.
+tools: Read, Write, Bash, Grep, Glob, ToolSearch
+color: green
+default-tier: sonnet
+tier-rationale: "Reads a STATE block, redacts via a pure helper, and renders a page through an existing connection; bounded transform + publish, no design judgment — sonnet-tier."
+size_budget: M
+size_budget_rationale: "Honest tier sized to the ~90-line body. DELEGATES redaction to scripts/lib/pseudonymize.cjs, the Notion write to connections/notion.md, and the contract to reference/multi-author-model.md."
+parallel-safe: false
+typical-duration-seconds: 45
+reads-only: false
+required_reading:
+  - "reference/multi-author-model.md"
+  - "connections/notion.md"
+writes:
+  - "a read-only Notion/Confluence page (external) OR .design/exports/decisions-<cycle>.md (fallback)"
+---
+
+# decision-journal-exporter
+
+You publish a cycle's decisions to a **read-only shared journal** so non-GDD stakeholders can follow
+the "what + why" without the repo. You run on cycle close. **Read `reference/multi-author-model.md`
+and `connections/notion.md` first.** Every author name is **pseudonymized before it leaves the repo**.
+
+## Procedure
+
+1. **Read the decisions.** Parse `.design/STATE.md` `<decisions>` (with
+   `scripts/lib/collab/attribution.cjs` `parseDecisionsBlock`), capturing id, text, status, and
+   attribution.
+2. **Pseudonymize.** Pipe the rendered decision text through `scripts/lib/pseudonymize.cjs` BEFORE any
+   outbound call — R1 (git identity) + R8 (stable pseudonym) mask `author=`/`co-author=` into a stable
+   hash. Never publish a raw git identity.
+
+   ```bash
+   node -e '
+     const fs = require("fs");
+     const { pseudonymize } = require("./scripts/lib/pseudonymize.cjs");
+     const raw = fs.readFileSync(0, "utf8");
+     process.stdout.write(pseudonymize(raw, {}));
+   ' < /tmp/decisions.md > /tmp/decisions.redacted.md
+   ```
+
+3. **Render** a read-only page: cycle id, the decision table (id · text · status · pseudonymous
+   author), and a "generated by GDD on cycle close — read-only" header. Regenerate each cycle (replace,
+   don't append duplicates).
+4. **Publish.** If a Notion connection is `available` (probe via `connections/notion.md`), write the
+   page through its write interface (redaction already applied; the connection's own redact pass is a
+   second belt). Otherwise **degrade**: write `.design/exports/decisions-<cycle>.md` locally and tell
+   the user to share it manually. Confluence follows the same shape if its connection is present.
+5. **Write-only.** You publish; you never read stakeholder edits back into STATE.md (bidirectional sync
+   is out of scope this phase).
+
+## Record
+
+Print a `## Decision journal export` summary: cycle, decisions exported, destination (Notion page /
+local fallback), and confirmation that redaction ran. Append one JSONL line to
+`.design/intel/insights.jsonl`. Close with:
+
+```
+## DECISION JOURNAL EXPORT COMPLETE
+```
+
+## Boundaries
+
+- **Pseudonymize before publish** — no raw git identity ever leaves the repo.
+- Write-only, read-only-for-readers; no bidirectional sync; degrade to local markdown on no connection.
+- Only the `<decisions>` block — not the full STATE.md, not telemetry.

package/agents/design-reflector.md

@@ -92,6 +92,8 @@ After listing standard surprises, apply the **Four Principles Checks** from `ref
 
 Scan STATE.md `<decisions>` block for D-XX codes. Cross-reference `.design/learnings/` files from prior cycles if present. Flag decisions that: (a) appeared in multiple sessions of the same cycle, or (b) appear under the same keyword in learnings from ≥2 prior cycles. These are candidates for `reference/` additions.
 
+**Per-author patterns (Phase 40, team mode).** When decisions carry the `[author= co-author=]` attribution suffix (see `reference/multi-author-model.md`), parse it with `scripts/lib/collab/attribution.cjs` (`parseDecisionsBlock` + `groupByAuthor`) and add a brief **Per-author patterns** sub-note: who locks decisions early, whose decisions get reverted or unlocked most, and any author whose decisions cluster around a recurring keyword. Skip silently when no decision is attributed (single-author projects).
+
 ### 3. Agent Performance
 
 Read `.design/agent-metrics.json`. For each agent:

package/agents/pr-commenter.md

@@ -67,6 +67,7 @@ const safeBody = redact(commentBody);
 1. **Inline review comments** — for each verify/audit finding that maps to a changed file+line, post an inline comment via `gh api repos/{owner}/{repo}/pulls/{n}/comments` (path + line + redacted body: the finding, the rule/pillar, and a one-line suggested fix). Findings with no changed-line locus go into a single summary review comment, not scattered.
 2. **Screenshot pairs (degrade, D-04)** — when `.design/STATE.md` `<connections>` shows `preview: available` or `chromatic: available` AND a before-after pair exists for a changed surface, attach the image refs in the comment/PR timeline. When absent → text-only; never a precondition.
 3. **`gdd/design-review` check-run (D-03)** — `gh api repos/{owner}/{repo}/check-runs` with `name: "gdd/design-review"`, a `conclusion` (`success` if verify passed + no blocker pillars, `failure` if verify failed or a11y-gate failed, else `neutral`), and an `output.summary` carrying the audit pillar scores + verify pass/fail + a11y result. This is the gate a teammate's branch-protection rule can require — see the reference for the required-check setup (`scripts/apply-branch-protection.sh`); you **register** the check, you never edit branch protection.
+4. **Decision threading (Phase 40, team mode)** — for each `D-XX` decision referenced in the PR's `DESIGN.md` / `DESIGN-VERIFICATION.md`, thread a PR comment keyed to that decision (one comment per `D-XX`, body = the decision text + its `proposed/reviewing/approved/locked` review state from `reference/multi-author-model.md`), so decision discussion persists as part of the PR history. Redacted like every other body; degrade-to-noop when `gh` is absent. This makes a decision's rationale reviewable inline by teammates who don't run GDD.
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hegemonart/get-design-done",
-  "version": "1.39.2",
+  "version": "1.40.0",
   "description": "A design-quality pipeline for AI coding agents: brief, plan, implement, and verify UI work against your design system.",
   "author": "Hegemon",
   "homepage": "https://github.com/hegemonart/get-design-done",
@@ -56,6 +56,7 @@
     "lint:md": "npx --yes markdownlint-cli2 \"**/*.md\" \"#node_modules\" \"#.planning\" \"#.claude\" \"#test/fixtures/baselines\"",
     "lint:links": "npx --yes lychee --no-progress --accept 200,206,403,429 \"**/*.md\" || true",
     "lint:agentskills": "node scripts/lint-agentskills-spec.cjs",
+    "lint:changelog": "node scripts/lint-changelog.cjs",
     "validate:schemas": "node --experimental-strip-types scripts/validate-schemas.ts",
     "validate:frontmatter": "node --experimental-strip-types scripts/validate-frontmatter.ts agents/",
     "detect:stale-refs": "node scripts/detect-stale-refs.cjs",

package/reference/DEPRECATIONS.md

@@ -39,3 +39,43 @@ the scanner pattern list in lockstep.
 
 The scanner excludes `.planning/`, `.claude/`, `.design/`, `node_modules/`,
 `test-fixture/`, and this file itself.
+
+## Path migrations (machine-readable)
+
+Phase 39.5 adds a machine-readable registry of **path** migrations — modules/files GDD moved or
+removed. `scripts/lib/deprecation-registry.cjs` parses the table below; `/gdd:migrate` consults it to
+help users update local references; `test/suite/deprecation-completeness.test.cjs` asserts every row
+is honest (a `removed` row's `Old` path must be gone from the tree; a `deprecated` row's `Old` path
+must still carry a shim).
+
+### Status semantics
+
+A row's status is derived from the running plugin version `v`:
+
+- **pending** — `v` < `Since` (deprecation announced for a future version; rare).
+- **deprecated** — `Since` ≤ `v` < `Removed in` (the old path still works via a shim; update at leisure).
+- **removed** — `v` ≥ `Removed in` (the old path is gone; you MUST use the new path).
+
+**Default shim lifetime is one minor version** (the Phase 31.5 precedent): a path deprecated in `x.y.z`
+is removed in the next minor `x.(y+1).0`. The `Removed in` column is authoritative per row.
+
+### Table
+
+Columns: `Since` (version the move shipped) · `Removed in` (version the old path stops working;
+blank = still shimmed) · `Old` (pre-move path) · `New` (current path) · `Migration hint`.
+
+| Since | Removed in | Old | New | Migration hint |
+|---|---|---|---|---|
+| 1.31.5 | 1.33.0 | `scripts/lib/cli` | `sdk/cli` | Import the CLI barrel from `sdk/cli` instead of `scripts/lib/cli`. |
+| 1.31.5 | 1.33.0 | `scripts/lib/event-stream` | `sdk/event-stream` | Import the event-stream barrel from `sdk/event-stream`. |
+| 1.31.5 | 1.33.0 | `scripts/lib/gdd-state` | `sdk/state` | Import the STATE primitives from `sdk/state`. |
+| 1.31.5 | 1.33.0 | `scripts/lib/gdd-errors` | `sdk/errors` | Import the error types from `sdk/errors`. |
+| 1.31.5 | 1.33.0 | `scripts/lib/error-classifier.cjs` | `sdk/primitives/error-classifier.cjs` | Require `sdk/primitives/error-classifier.cjs`. |
+| 1.31.5 | 1.33.0 | `scripts/lib/iteration-budget.cjs` | `sdk/primitives/iteration-budget.cjs` | Require `sdk/primitives/iteration-budget.cjs`. |
+| 1.31.5 | 1.33.0 | `scripts/lib/jittered-backoff.cjs` | `sdk/primitives/jittered-backoff.cjs` | Require `sdk/primitives/jittered-backoff.cjs`. |
+| 1.31.5 | 1.33.0 | `scripts/lib/lockfile.cjs` | `sdk/primitives/lockfile.cjs` | Require `sdk/primitives/lockfile.cjs`. |
+| 1.31.5 | 1.33.0 | `scripts/mcp-servers/gdd-state/server.ts` | `sdk/mcp/gdd-state/server.ts` | Point the MCP server config at `sdk/mcp/gdd-state/server.ts`. |
+| 1.31.5 | 1.33.0 | `scripts/mcp-servers/gdd-mcp/server.ts` | `sdk/mcp/gdd-mcp/server.ts` | Point the MCP server config at `sdk/mcp/gdd-mcp/server.ts`. |
+
+All ten rows are **removed** as of the current release (the Phase 31.5 → `sdk/` reorg; shims removed
+in v1.33.0). The completeness gate confirms none of the `Old` paths remain in the tree.

package/reference/STATE-TEMPLATE.md

@@ -47,6 +47,9 @@ skipped_stages: ""
 <decisions>
 <!-- Filled by discover stage. Format: -->
 <!-- D-01: [decision text] (locked | tentative) -->
+<!-- Phase 40 (team mode): an optional attribution suffix records provenance for multi-author merges: -->
+<!-- D-01: [decision text] (locked | tentative) [author=<git-user> co-author=<gdd-instance-id>] -->
+<!-- The suffix is optional + backward-compatible; see reference/multi-author-model.md. -->
 </decisions>
 
 <must_haves>

package/reference/config-schema.md

@@ -376,3 +376,22 @@ If `.design/cache-manifest.json` is missing when `hooks/budget-enforcer.js` read
 - `.design/budget.json` — provides `cache_ttl_seconds` default.
 - `.design/telemetry/costs.jsonl` (Plan 10.1-05) — records `cache_hit: true` rows with zero tokens and zero cost when the short-circuit fires.
 - D-05, D-08, D-09 in `.planning/phases/10.1-optimization-layer-cost-governance/10.1-CONTEXT.md` — decision lineage.
+
+## Team collaboration (Phase 40)
+
+Three optional top-level `.design/config.json` keys enable team mode. All are absent/off by default —
+single-operator projects are unaffected. Full contract: `reference/multi-author-model.md`.
+
+- **`gdd_cycle_mode`** (`designer` | `dev` | `full`, default `full`) — sectional handoff. `designer`
+  permits Brief + Explore writes; `dev` permits Plan + Design + Verify; `full` = all stages.
+  `scripts/lib/collab/cycle-mode.cjs` `stagePermitted(mode, stage)` gates STATE writes by stage.
+- **`permissions`** — per-section write permissions (`scripts/lib/collab/permissions.cjs`). Permissive
+  by default (absent = everyone `owner`). Shape: `{ default, actors: {<actor>: <role>}, rules:
+  [{section, action, roles}] }`, roles in `owner|contributor|reviewer|viewer`. A rule restricts a
+  `(section, action)` to its listed roles; an unruled pair is allowed. `viewer` never mutates. A CI
+  gate calls `can(config, actor, section, action)` to enforce on PRs.
+- **`collab`** — `{ multi_writer_enabled (bool), lock_timeout_ms (int), sync_backend
+  (git|s3|git-lfs) }`. `multi_writer_enabled: true` switches the gdd-state advisory lock to the
+  team-mode policy (`scripts/lib/collab/lock-policy.cjs` — 30 s wait + 100 ms backoff);
+  `sync_backend` selects the cross-machine `.design/` backend (`scripts/lib/collab/sync-backend.cjs`,
+  default `git`; `s3`/`git-lfs` are opt-in declarations — a live client is not bundled this phase).

package/reference/multi-author-model.md

@@ -0,0 +1,112 @@
+# Multi-Author Model — Team Collaboration Contract
+
+Phase 40 contract. GDD's single-process baseline (Phase 20 lockfile + atomic STATE.md RMW) is safe for
+one operator. This file is the contract for **multiple developers** working a design in parallel: how
+STATE.md merges, how decisions are attributed and reviewed, how writes coordinate across processes,
+and who is allowed to write what. Everything here is **git-native + advisory** — no server, no live
+multiplayer, no SSO.
+
+## 1. Multi-writer STATE.md — git-merge-driver with per-section semantic merge
+
+GDD does **not** ship a CRDT or OT engine. The chosen model (lowest risk, highest familiarity) is a
+**git merge driver with per-section semantic conflict detection**. The append-mostly `<decisions>`
+block is the common case: two branches each adding a new `D-NN` must merge cleanly. The pure core
+`scripts/lib/collab/section-merge.cjs` implements the rule:
+
+- **Union by id.** A `D-NN` present on only one side (vs the merge base) is kept.
+- **Equal duplicates collapse.** The same `D-NN` with identical text/status/attribution on both sides
+  is kept once.
+- **Divergence is the only conflict.** The same `D-NN` with different text or status on the two sides
+  is a genuine conflict — surfaced to `agents/conflict-resolver.md`, never auto-resolved.
+- **Decisions are durable.** A `D-NN` removed on one side but unchanged on the other is **kept** — a
+  decision is never silently deleted by a merge; removal goes through the unlock flow (§3).
+
+A single-value section (e.g. `status`) merges with `mergeStatusScalar`: if only one side changed, take
+that side; if both changed differently, it's a conflict.
+
+## 2. Attribution
+
+A decision line carries an **optional** attribution suffix:
+
+```
+D-07: Use OKLCH design tokens (locked) [author=alice co-author=gdd-3f9a]
+```
+
+- `author` — the git user who made the decision.
+- `co-author` — the GDD instance id (which machine/agent run produced it).
+
+The suffix is backward-compatible: a plain `D-01: text (locked)` parses with `author`/`co-author` =
+null. `scripts/lib/collab/attribution.cjs` parses + formats the line and groups decisions by author.
+`agents/design-reflector.md` reads attribution to surface **per-author patterns** (who tends to lock
+early, whose decisions get reverted). This is the SC#5 "attribution field" — encoded in the line, not
+a schema-breaking change to the `Decision` type.
+
+## 3. Async review queue + decision locks
+
+Each decision under review lives at `.design/reviews/<decision-id>/`, moving through a state machine
+(`scripts/lib/collab/review-queue.cjs`):
+
+```
+proposed → reviewing → approved → locked
+```
+
+- **`locked` is terminal and hard.** A locked decision cannot be amended. `canAmend(state)` is true
+  only for `proposed`/`reviewing`.
+- **Unlock is explicit + audited.** `/gdd:unlock-decision <id> --approver <who>` moves `locked →
+  reviewing` and appends an audit entry (`{ from:'locked', to:'reviewing', approver, reason }`). There
+  is no silent unlock.
+- **`/gdd:review-decisions`** surfaces every queue entry by state (and `--pending` for the ones
+  awaiting action).
+
+## 4. Multi-writer lock policy
+
+`scripts/lib/collab/lock-policy.cjs` derives the `acquire()` options from config. In single-process
+mode the Phase 20 defaults apply (`maxWaitMs: 5000`). When `collab.multi_writer_enabled: true`, a
+teammate's write may be queued, so the policy waits up to **30 s** with a **100 ms** backoff poll and a
+2-minute stale threshold. `collab.lock_timeout_ms` overrides the wait. The gdd-state MCP write path
+passes these options to the existing advisory lock — coordinated multi-process writes, no new lock
+mechanism.
+
+## 5. Sectional handoff — `gdd_cycle_mode`
+
+`.design/config.json#gdd_cycle_mode` partitions a cycle by role (`scripts/lib/collab/cycle-mode.cjs`):
+
+| Mode | Permitted stages |
+|---|---|
+| `designer` | Brief, Explore |
+| `dev` | Plan, Design, Verify |
+| `full` | all (the default / current behavior) |
+
+`stagePermitted(mode, stage)` gates STATE writes by stage — a designer-mode cycle cannot write Plan/Design
+state, and vice versa. This lets a designer hand a brief to a dev without either overwriting the other's
+sections.
+
+## 6. Permissions
+
+`.design/config.json#permissions` declares who can write which sections
+(`scripts/lib/collab/permissions.cjs` `can(config, actor, section, action)`). The default policy is
+permissive (`owner` can do everything); an override can restrict, e.g. "only `@lead-designer` can
+`lock` decisions". A CI gate asserts the permission model is enforced on PRs.
+
+## 7. Decision-journal export + PR threading
+
+- **`agents/decision-journal-exporter.md`** writes a **read-only** Notion/Confluence page from the
+  `<decisions>` block on cycle close (write-only this phase; non-GDD stakeholders read it). Every
+  decision is piped through `scripts/lib/pseudonymize.cjs` first (R1 git-identity + R8 stable hash), so
+  author names are masked before they leave the repo. Degrades to a local markdown file when no Notion
+  connection is available.
+- **`agents/pr-commenter.md`** threads PR review comments on the `D-XX` decisions referenced in
+  DESIGN.md / DESIGN-VERIFICATION.md, so decision discussion persists as part of the PR history.
+
+## 8. Cross-machine sync (opt-in)
+
+`scripts/lib/collab/sync-backend.cjs` `resolveBackend(config)` selects the `.design/` sync backend:
+`git` (the **default** — existing behavior), or an opt-in `s3` / `git-lfs` for orgs whose git
+push/pull cadence is too slow. Sync is **opt-in and off by default**; a live S3/LFS client is out of
+scope for this phase — the selector + contract ship, the backend is pluggable.
+
+## Boundaries
+
+No real-time multiplayer, no SSO/SAML, no GDD-side user accounts (users are git authors), no
+bidirectional Notion, no merge-queue automation beyond the conflict-resolver. Everything is advisory
+and git-native: a team that already uses git + PRs gets collaboration without new infrastructure.

package/reference/registry.json

@@ -1028,6 +1028,13 @@
       "type": "heuristic",
       "phase": 39.2,
       "description": "Phase 39.2 cost-governance contract: the per-cycle forecast model (best/typical/worst from mean ± k·σ, cyclesToCap) via scripts/lib/budget/cost-forecast.cjs; the project_cap hard-halt (disabled by default, graceful PreToolUse:Agent block, warn 50/80 + halt 100) via scripts/lib/budget/project-cap.cjs + hooks/budget-enforcer.ts; the ROI dashboard (shipped = surviving >=14d, cost-per-shipped-commit) via scripts/lib/budget/roi.cjs; and the budget_forecast/project_cap_warning/project_cap_halt events. Agent agents/cost-forecaster.md; skills /gdd:budget + /gdd:roi. Read/report-only — the hook only blocks, never spends."
+    },
+    {
+      "name": "multi-author-model",
+      "path": "reference/multi-author-model.md",
+      "type": "meta-rules",
+      "phase": 40,
+      "description": "Phase 40 team-collaboration contract: multi-writer STATE.md via a git-merge-driver with per-section semantic merge (scripts/lib/collab/section-merge.cjs — union by D-id, conflict only on same-id divergence); decision attribution line-suffix [author= co-author=] (attribution.cjs); the async review queue proposed->reviewing->approved->locked with hard locks + audited /gdd:unlock-decision (review-queue.cjs); the multi-writer advisory-lock policy (lock-policy.cjs, 30s/100ms backoff in team mode); sectional handoff gdd_cycle_mode designer|dev|full (cycle-mode.cjs); the permission model (permissions.cjs) + CI gate; decision-journal-exporter (pseudonymized, write-only Notion) + pr-commenter D-XX threading; opt-in cross-machine sync (sync-backend.cjs, defaults to git). Agents conflict-resolver + decision-journal-exporter; skills /gdd:review-decisions + /gdd:unlock-decision."
     }
   ]
 }

package/reference/schemas/config.schema.json

@@ -40,6 +40,43 @@
     "update_dismissed": {
       "type": "string",
       "description": "Latest plugin tag (e.g. \"v1.0.7.3\") whose update nudge the user has dismissed. Set by /gdd:check-update --dismiss and by hooks/update-check.sh on the --dismiss code path. When a newer tag ships, the nudge reappears."
+    },
+    "gdd_cycle_mode": {
+      "type": "string",
+      "enum": ["designer", "dev", "full"],
+      "description": "Phase 40 sectional handoff. designer = Brief + Explore only; dev = Plan + Design + Verify; full = all stages (default). scripts/lib/collab/cycle-mode.cjs gates STATE writes by stage so a designer and a dev can hand a cycle back and forth without overwriting each other's sections."
+    },
+    "permissions": {
+      "type": "object",
+      "additionalProperties": true,
+      "description": "Phase 40 per-section write permissions (scripts/lib/collab/permissions.cjs). Permissive by default (absent = everyone is owner). A team narrows it, e.g. only @lead-designer may lock decisions. A CI gate enforces on PRs.",
+      "properties": {
+        "default": { "type": "string", "enum": ["owner", "contributor", "reviewer", "viewer"], "description": "Role for any actor not listed in `actors`. Default owner." },
+        "actors": { "type": "object", "additionalProperties": { "type": "string", "enum": ["owner", "contributor", "reviewer", "viewer"] }, "description": "Per-actor role map (git user/handle -> role)." },
+        "rules": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "additionalProperties": true,
+            "properties": {
+              "section": { "type": "string", "description": "STATE.md section (decisions/prototyping/rollout_status/status/progress/blockers) or '*'." },
+              "action": { "type": "string", "enum": ["write", "lock", "unlock", "approve", "*"] },
+              "roles": { "type": "array", "items": { "type": "string", "enum": ["owner", "contributor", "reviewer", "viewer"] } }
+            }
+          },
+          "description": "Restrictive rules: a (section, action) is limited to the listed roles. No matching rule = allowed (permissive)."
+        }
+      }
+    },
+    "collab": {
+      "type": "object",
+      "additionalProperties": true,
+      "description": "Phase 40 team-collaboration settings.",
+      "properties": {
+        "multi_writer_enabled": { "type": "boolean", "description": "When true, the gdd-state advisory lock uses the team-mode policy (longer wait + backoff) via scripts/lib/collab/lock-policy.cjs. Default false (single-process)." },
+        "lock_timeout_ms": { "type": "integer", "minimum": 0, "description": "Override the team-mode lock acquire maxWaitMs (default 30000)." },
+        "sync_backend": { "type": "string", "enum": ["git", "s3", "git-lfs"], "description": "Cross-machine .design/ sync backend (scripts/lib/collab/sync-backend.cjs). Default git (existing push/pull). s3 / git-lfs are opt-in declarations; a live client is not bundled this phase." }
+      }
     }
   }
 }