@hegemonart/get-design-done 1.39.2 → 1.40.0

package/reference/schemas/generated.d.ts

@@ -101,6 +101,56 @@ export interface DesignConfigJson {
    * Latest plugin tag (e.g. "v1.0.7.3") whose update nudge the user has dismissed. Set by /gdd:check-update --dismiss and by hooks/update-check.sh on the --dismiss code path. When a newer tag ships, the nudge reappears.
    */
   update_dismissed?: string;
+  /**
+   * Phase 40 sectional handoff. designer = Brief + Explore only; dev = Plan + Design + Verify; full = all stages (default). scripts/lib/collab/cycle-mode.cjs gates STATE writes by stage so a designer and a dev can hand a cycle back and forth without overwriting each other's sections.
+   */
+  gdd_cycle_mode?: 'designer' | 'dev' | 'full';
+  /**
+   * Phase 40 per-section write permissions (scripts/lib/collab/permissions.cjs). Permissive by default (absent = everyone is owner). A team narrows it, e.g. only @lead-designer may lock decisions. A CI gate enforces on PRs.
+   */
+  permissions?: {
+    /**
+     * Role for any actor not listed in `actors`. Default owner.
+     */
+    default?: 'owner' | 'contributor' | 'reviewer' | 'viewer';
+    /**
+     * Per-actor role map (git user/handle -> role).
+     */
+    actors?: {
+      [k: string]: 'owner' | 'contributor' | 'reviewer' | 'viewer';
+    };
+    /**
+     * Restrictive rules: a (section, action) is limited to the listed roles. No matching rule = allowed (permissive).
+     */
+    rules?: {
+      /**
+       * STATE.md section (decisions/prototyping/rollout_status/status/progress/blockers) or '*'.
+       */
+      section?: string;
+      action?: 'write' | 'lock' | 'unlock' | 'approve' | '*';
+      roles?: ('owner' | 'contributor' | 'reviewer' | 'viewer')[];
+      [k: string]: unknown;
+    }[];
+    [k: string]: unknown;
+  };
+  /**
+   * Phase 40 team-collaboration settings.
+   */
+  collab?: {
+    /**
+     * When true, the gdd-state advisory lock uses the team-mode policy (longer wait + backoff) via scripts/lib/collab/lock-policy.cjs. Default false (single-process).
+     */
+    multi_writer_enabled?: boolean;
+    /**
+     * Override the team-mode lock acquire maxWaitMs (default 30000).
+     */
+    lock_timeout_ms?: number;
+    /**
+     * Cross-machine .design/ sync backend (scripts/lib/collab/sync-backend.cjs). Default git (existing push/pull). s3 / git-lfs are opt-in declarations; a live client is not bundled this phase.
+     */
+    sync_backend?: 'git' | 's3' | 'git-lfs';
+    [k: string]: unknown;
+  };
   [k: string]: unknown;
 }
 

package/scripts/lib/collab/attribution.cjs

@@ -0,0 +1,83 @@
+'use strict';
+// Phase 40 — attribution.cjs — PURE, dep-free parser/formatter for multi-author decision attribution.
+//
+// A STATE.md decision line carries an OPTIONAL attribution suffix so multiple developers' decisions
+// survive a merge with provenance intact (SC#5). The canonical line form is:
+//
+//   D-NN: <text> (<status>) [author=<git-user> co-author=<gdd-instance-id>]
+//
+// The suffix is optional and backward-compatible — a plain `D-01: text (locked)` parses with
+// author/coAuthor = null. This module does ONLY string parse/format + grouping; no fs, no clock.
+//
+// No `require` — pure. Deterministic.
+
+const STATUSES = Object.freeze(['locked', 'tentative']);
+
+/**
+ * Parse a single decision line into its parts. Returns null when the line is not a decision line.
+ * @returns {{id, text, status, author, coAuthor} | null}
+ */
+function parseDecisionLine(line) {
+  const s = String(line).trim().replace(/^[-*]\s+/, ''); // tolerate list-bullet prefixes
+  const m = s.match(/^(D-\d+)\s*:\s*(.*)$/);
+  if (!m) return null;
+  const id = m[1];
+  let rest = m[2].trim();
+  let author = null;
+  let coAuthor = null;
+  // Pull a trailing [author=... co-author=...] suffix (order-independent, both optional).
+  const attr = rest.match(/\[([^\]]*)\]\s*$/);
+  if (attr) {
+    const inner = attr[1];
+    const am = inner.match(/\bauthor=([^\s\]]+)/);
+    const cm = inner.match(/\bco-author=([^\s\]]+)/);
+    if (am) author = am[1];
+    if (cm) coAuthor = cm[1];
+    if (am || cm) rest = rest.slice(0, attr.index).trim();
+  }
+  // Pull a trailing (status).
+  let status = null;
+  const st = rest.match(/\(([a-z]+)\)\s*$/i);
+  if (st && STATUSES.includes(st[1].toLowerCase())) {
+    status = st[1].toLowerCase();
+    rest = rest.slice(0, st.index).trim();
+  }
+  return { id, text: rest, status, author, coAuthor };
+}
+
+/** Format a decision object back into the canonical line (omitting absent optional parts). */
+function formatDecisionLine(d) {
+  if (!d || !d.id) throw new Error('attribution: formatDecisionLine needs {id}');
+  let line = `${d.id}: ${String(d.text || '').trim()}`;
+  if (d.status) line += ` (${d.status})`;
+  const bits = [];
+  if (d.author) bits.push(`author=${d.author}`);
+  if (d.coAuthor) bits.push(`co-author=${d.coAuthor}`);
+  if (bits.length) line += ` [${bits.join(' ')}]`;
+  return line;
+}
+
+/** Group an array of decision objects by author → { '<author>': [decision,...], '<unattributed>': [...] }. */
+function groupByAuthor(decisions) {
+  if (!Array.isArray(decisions)) throw new Error('attribution: groupByAuthor needs an array');
+  const out = {};
+  for (const d of decisions) {
+    const key = d && d.author ? d.author : '<unattributed>';
+    (out[key] = out[key] || []).push(d);
+  }
+  return out;
+}
+
+/** Parse a whole `<decisions>` block body into decision objects (skips blanks/comments). */
+function parseDecisionsBlock(body) {
+  const out = [];
+  for (const line of String(body).replace(/\r\n/g, '\n').split('\n')) {
+    const t = line.trim();
+    if (!t || t.startsWith('<!--')) continue;
+    const d = parseDecisionLine(t);
+    if (d) out.push(d);
+  }
+  return out;
+}
+
+module.exports = { STATUSES, parseDecisionLine, formatDecisionLine, groupByAuthor, parseDecisionsBlock };

package/scripts/lib/collab/cycle-mode.cjs

@@ -0,0 +1,41 @@
+'use strict';
+// Phase 40 — cycle-mode.cjs — PURE, dep-free sectional-handoff gate (SC#8).
+//
+// `.design/config.json#gdd_cycle_mode` partitions a cycle by role so a designer can hand a brief to a
+// dev (and vice versa) without either overwriting the other's stages:
+//   designer → Brief, Explore
+//   dev      → Plan, Design, Verify
+//   full     → all stages (the default / current single-operator behavior)
+// `stagePermitted(mode, stage)` gates a STATE write by the stage that produced it.
+//
+// No `require` — pure. Deterministic.
+
+const MODES = Object.freeze(['designer', 'dev', 'full']);
+const ALL_STAGES = Object.freeze(['brief', 'explore', 'plan', 'design', 'verify']);
+
+const STAGES_BY_MODE = Object.freeze({
+  designer: Object.freeze(['brief', 'explore']),
+  dev: Object.freeze(['plan', 'design', 'verify']),
+  full: ALL_STAGES,
+});
+
+/** Normalize a mode value; unknown/missing → 'full' (the safe, backward-compatible default). */
+function normalizeMode(mode) {
+  const m = String(mode || 'full').toLowerCase().trim();
+  return MODES.includes(m) ? m : 'full';
+}
+
+/** Resolve the cycle mode from a parsed `.design/config.json` (defaults to 'full'). */
+function resolveMode(config) {
+  return normalizeMode(config && config.gdd_cycle_mode);
+}
+
+/** True when `stage` is writable under `mode`. Unknown stage → false. */
+function stagePermitted(mode, stage) {
+  const m = normalizeMode(mode);
+  const s = String(stage || '').toLowerCase().trim();
+  if (!ALL_STAGES.includes(s)) return false;
+  return STAGES_BY_MODE[m].includes(s);
+}
+
+module.exports = { MODES, ALL_STAGES, STAGES_BY_MODE, normalizeMode, resolveMode, stagePermitted };

package/scripts/lib/collab/lock-policy.cjs

@@ -0,0 +1,37 @@
+'use strict';
+// Phase 40 — lock-policy.cjs — PURE, dep-free advisory-lock policy for gdd-state multi-writer mode (SC#6).
+//
+// Phase 20's sdk/state/lockfile.ts already implements PID+timestamp advisory locks with retry
+// (staleMs / maxWaitMs / pollMs). "Multi-writer mode" is a POLICY layered on top: when a project
+// enables team mode (`.design/config.json#collab.multi_writer_enabled`), the state write path should
+// wait LONGER and poll on a backoff before giving up, because a teammate's write may be in flight.
+// This module derives the acquire-options object from config; the MCP write path passes it to acquire().
+//
+// No `require` — pure. Deterministic.
+
+// sdk/state/lockfile.ts defaults (single-process baseline).
+const SINGLE = Object.freeze({ staleMs: 60000, maxWaitMs: 5000, pollMs: 50 });
+// Team mode: a stuck teammate write is rare but a normal queued one is not — wait up to 30s,
+// poll slower (100ms) to reduce contention, and treat a lock older than 2min as stale.
+const TEAM = Object.freeze({ staleMs: 120000, maxWaitMs: 30000, pollMs: 100 });
+
+/** True when team multi-writer mode is enabled in config. */
+function isMultiWriter(config) {
+  return !!(config && config.collab && config.collab.multi_writer_enabled === true);
+}
+
+/**
+ * Resolve the acquire() options for the current config. A numeric `collab.lock_timeout_ms`
+ * overrides the team-mode maxWaitMs. Returns a fresh object (never the frozen constants).
+ */
+function acquireOpts(config) {
+  const base = isMultiWriter(config) ? TEAM : SINGLE;
+  const out = { staleMs: base.staleMs, maxWaitMs: base.maxWaitMs, pollMs: base.pollMs };
+  if (isMultiWriter(config)) {
+    const t = Number(config.collab.lock_timeout_ms);
+    if (Number.isFinite(t) && t > 0) out.maxWaitMs = t;
+  }
+  return out;
+}
+
+module.exports = { isMultiWriter, acquireOpts, SINGLE, TEAM };

package/scripts/lib/collab/permissions.cjs

@@ -0,0 +1,53 @@
+'use strict';
+// Phase 40 — permissions.cjs — PURE, dep-free section-write permission model (SC#10).
+//
+// `.design/config.json#permissions` declares who may perform which action on which STATE.md section.
+// The model is permissive-by-default (single-operator projects are unaffected): with no `permissions`
+// block, everyone is an `owner` and `can(...)` is always true. A team narrows it, e.g. "only
+// @lead-designer can `lock` decisions". A CI gate calls `can()` to enforce on PRs.
+//
+// Shape of config.permissions:
+//   {
+//     "default": "owner",                     // role for any actor not listed
+//     "actors": { "@alice": "reviewer", ... },// per-actor role
+//     "rules": [ { "section": "decisions", "action": "lock", "roles": ["owner"] }, ... ]
+//   }
+// A rule restricts (section, action) to the listed roles. No matching rule ⇒ allowed (permissive).
+//
+// No `require` — pure. Deterministic.
+
+const SECTIONS = Object.freeze(['decisions', 'prototyping', 'rollout_status', 'status', 'progress', 'blockers']);
+const ACTIONS = Object.freeze(['write', 'lock', 'unlock', 'approve']);
+const ROLES = Object.freeze(['owner', 'contributor', 'reviewer', 'viewer']);
+
+/** The role assigned to `actor` by the config (falls back to config.default, then 'owner'). */
+function roleOf(config, actor) {
+  const perms = (config && config.permissions) || {};
+  const actors = perms.actors || {};
+  if (actor && Object.prototype.hasOwnProperty.call(actors, actor)) return actors[actor];
+  return perms.default || 'owner';
+}
+
+/**
+ * May `actor` perform `action` on `section` under this config?
+ * Permissive by default: a (section, action) with no matching rule is allowed. A matching rule
+ * allows only its listed roles. `viewer` is denied any mutating action even absent a rule.
+ */
+function can(config, actor, section, action) {
+  const role = roleOf(config, actor);
+  if (role === 'viewer') return false; // viewers never mutate
+  const perms = (config && config.permissions) || {};
+  const rules = Array.isArray(perms.rules) ? perms.rules : [];
+  const matching = rules.filter(
+    (r) => r && (r.section === section || r.section === '*') && (r.action === action || r.action === '*'),
+  );
+  if (matching.length === 0) return true; // no restriction → allowed
+  return matching.some((r) => Array.isArray(r.roles) && r.roles.includes(role));
+}
+
+/** The default permissive policy (used when config has no permissions block). */
+function defaultPolicy() {
+  return { default: 'owner', actors: {}, rules: [] };
+}
+
+module.exports = { SECTIONS, ACTIONS, ROLES, roleOf, can, defaultPolicy };

package/scripts/lib/collab/review-queue.cjs

@@ -0,0 +1,64 @@
+'use strict';
+// Phase 40 — review-queue.cjs — PURE, dep-free async-review state machine for decisions (SC#7).
+//
+// Each decision under review lives at .design/reviews/<decision-id>/ and moves through:
+//   proposed → reviewing → approved → locked
+// `locked` is terminal and HARD: a locked decision cannot be amended. The only way back is an
+// explicit, AUDITED unlock (/gdd:unlock-decision <id> --approver <who>), which records who reopened
+// it and why. This module is the pure transition core — the skill does the filesystem I/O.
+//
+// No `require` — pure. Deterministic.
+
+const STATES = Object.freeze(['proposed', 'reviewing', 'approved', 'locked']);
+
+// Allowed forward transitions per state. `locked` has none (terminal — unlock() is the escape hatch).
+const TRANSITIONS = Object.freeze({
+  proposed: ['reviewing'],
+  reviewing: ['approved', 'proposed'], // can bounce back for revision
+  approved: ['locked', 'reviewing'],
+  locked: [],
+});
+
+/** True while a decision may still be edited (before it is locked). */
+function canAmend(state) {
+  return state === 'proposed' || state === 'reviewing';
+}
+
+/**
+ * Apply a transition. `event` is the TARGET state.
+ * @returns the new state string. Throws on an invalid transition.
+ */
+function transition(state, event) {
+  if (!STATES.includes(state)) throw new Error(`review-queue: unknown state "${state}"`);
+  if (!STATES.includes(event)) throw new Error(`review-queue: unknown target "${event}"`);
+  const allowed = TRANSITIONS[state];
+  if (!allowed.includes(event)) {
+    throw new Error(`review-queue: illegal transition ${state} -> ${event} (allowed: ${allowed.join(', ') || 'none'})`);
+  }
+  return event;
+}
+
+/**
+ * Explicit audited unlock of a locked decision. Moves locked -> reviewing and returns the new entry
+ * with an appended audit record. Requires a non-empty approver. Throws if the entry is not locked.
+ * @param {{id, state, audit?: Array}} entry
+ * @param {{approver: string, reason?: string}} opts
+ */
+function unlock(entry, opts) {
+  if (!entry || entry.state !== 'locked') {
+    throw new Error('review-queue: unlock() requires a locked decision');
+  }
+  const approver = opts && opts.approver ? String(opts.approver).trim() : '';
+  if (!approver) throw new Error('review-queue: unlock() requires an approver');
+  const audit = Array.isArray(entry.audit) ? entry.audit.slice() : [];
+  audit.push({ action: 'unlock', from: 'locked', to: 'reviewing', approver, reason: (opts && opts.reason) || '' });
+  return Object.assign({}, entry, { state: 'reviewing', audit });
+}
+
+/** Filter queue entries that still need a human action (not yet locked). */
+function pending(entries) {
+  if (!Array.isArray(entries)) throw new Error('review-queue: pending() needs an array');
+  return entries.filter((e) => e && e.state !== 'locked');
+}
+
+module.exports = { STATES, TRANSITIONS, canAmend, transition, unlock, pending };

package/scripts/lib/collab/section-merge.cjs

@@ -0,0 +1,77 @@
+'use strict';
+// Phase 40 — section-merge.cjs — PURE, dep-free per-section semantic merge for STATE.md (SC#1).
+//
+// The chosen multi-writer model (ROADMAP default) is a git-merge-driver with PER-SECTION semantic
+// conflict detection — strictly safer than a line-based merge for the append-mostly `<decisions>`
+// block. Two developers each adding a new D-NN on parallel branches should merge cleanly (union by
+// id); a real conflict is ONLY when the SAME id diverges in text or status. This module is the merge
+// core: it takes three decision arrays (base/ours/theirs, already parsed by attribution.cjs) and
+// returns the merged set plus any genuine conflicts for the conflict-resolver agent to resolve.
+//
+// No `require` — pure. Deterministic (stable id-sorted output).
+
+function byId(list) {
+  const m = new Map();
+  for (const d of list || []) if (d && d.id) m.set(d.id, d);
+  return m;
+}
+
+function sameDecision(a, b) {
+  return a.text === b.text && (a.status || null) === (b.status || null) &&
+    (a.author || null) === (b.author || null) && (a.coAuthor || null) === (b.coAuthor || null);
+}
+
+/** Numeric sort by the D-NN id (D-2 before D-10). */
+function idNum(id) {
+  const m = String(id).match(/(\d+)/);
+  return m ? parseInt(m[1], 10) : 0;
+}
+
+/**
+ * Three-way merge of `<decisions>` (base = common ancestor; ours/theirs = the two branches).
+ * @returns {{merged: Decision[], conflicts: [{id, ours, theirs}], added: string[]}}
+ *   - id only in one side (vs base) → kept (union).
+ *   - id in both sides, equal → kept once.
+ *   - id in both sides, divergent → CONFLICT (and `ours` is kept provisionally so the merged set is
+ *     still complete; the resolver overwrites after the human picks).
+ *   - id removed on one side but unchanged on the other → kept (deletions are never auto-applied —
+ *     decisions are durable; an explicit unlock/removal flow handles that).
+ */
+function mergeDecisions(base, ours, theirs) {
+  const B = byId(base);
+  const O = byId(ours);
+  const T = byId(theirs);
+  const ids = new Set([...O.keys(), ...T.keys(), ...B.keys()]);
+  const merged = [];
+  const conflicts = [];
+  const added = [];
+  for (const id of ids) {
+    const o = O.get(id);
+    const t = T.get(id);
+    const b = B.get(id);
+    if (o && t) {
+      if (sameDecision(o, t)) { merged.push(o); }
+      else { conflicts.push({ id, ours: o, theirs: t }); merged.push(o); }
+    } else if (o && !t) {
+      merged.push(o);
+      if (!b) added.push(id); // ours added it
+    } else if (!o && t) {
+      merged.push(t);
+      if (!b) added.push(id); // theirs added it
+    }
+    // (!o && !t) — present only in base, removed on both → drop.
+  }
+  merged.sort((a, x) => idNum(a.id) - idNum(x.id));
+  added.sort((a, x) => idNum(a) - idNum(x));
+  return { merged, conflicts, added };
+}
+
+/** Scalar merge for a single-value section (e.g. status): equal → value; divergent → conflict marker. */
+function mergeStatusScalar(base, ours, theirs) {
+  if (ours === theirs) return { value: ours, conflict: false };
+  if (ours === base) return { value: theirs, conflict: false }; // only theirs changed
+  if (theirs === base) return { value: ours, conflict: false }; // only ours changed
+  return { value: ours, conflict: true }; // both changed differently
+}
+
+module.exports = { mergeDecisions, mergeStatusScalar, sameDecision };

package/scripts/lib/collab/sync-backend.cjs

@@ -0,0 +1,36 @@
+'use strict';
+// Phase 40 — sync-backend.cjs — PURE, dep-free cross-machine sync backend selector (SC#9).
+//
+// `.design/` syncs between teammates over git by DEFAULT (existing behavior). Orgs whose git
+// push/pull cadence is too slow can opt into an `s3` or `git-lfs` backend. This module is the
+// SELECTOR + contract: it resolves which backend a config asks for and whether sync is opted in.
+// A live S3/LFS client is explicitly out of scope this phase — the selector ships, the backend is
+// pluggable. Defaulting to `git` means single-operator + most-team projects are unaffected.
+//
+// No `require` — pure. Deterministic.
+
+const BACKENDS = Object.freeze(['git', 's3', 'git-lfs']);
+const DEFAULT_BACKEND = 'git';
+
+/** True when the project opted into a non-git sync backend. */
+function isOptIn(config) {
+  const b = config && config.collab && config.collab.sync_backend;
+  return !!b && b !== 'git' && BACKENDS.includes(b);
+}
+
+/**
+ * Resolve the sync backend. Unknown/missing → 'git' (the safe default).
+ * @returns {{backend, optIn, supported}}  supported=false for opt-in backends whose live client
+ *   is not bundled this phase (the caller falls back to git + warns).
+ */
+function resolveBackend(config) {
+  const raw = config && config.collab && config.collab.sync_backend;
+  const backend = BACKENDS.includes(raw) ? raw : DEFAULT_BACKEND;
+  const optIn = backend !== DEFAULT_BACKEND;
+  // Phase 40 ships the selector only; no live S3/LFS client → opt-in backends are "declared but not
+  // yet executable". git is always supported (it's the existing push/pull path).
+  const supported = backend === DEFAULT_BACKEND;
+  return { backend, optIn, supported };
+}
+
+module.exports = { BACKENDS, DEFAULT_BACKEND, isOptIn, resolveBackend };

package/scripts/lib/deprecation-registry.cjs

@@ -0,0 +1,99 @@
+'use strict';
+// Phase 39.5 — deprecation-registry.cjs — PURE, dep-free reader for GDD's own path-migration registry.
+//
+// The canonical registry is the `## Path migrations (machine-readable)` table in
+// reference/DEPRECATIONS.md. This module parses that table and derives each entry's status against a
+// running plugin version, so /gdd:migrate, the /gdd:update advisory, and the completeness gate all
+// share one version-logic core. It reads NO files itself (callers pass the markdown text) — so it is
+// trivially unit-testable.
+//
+// No `require` — pure. Deterministic.
+
+/**
+ * Compare two dotted-numeric versions. Tolerant of decimals/patch (1.39, 1.39.2, 1.39.5).
+ * Missing components are treated as 0. Non-numeric components compare as 0.
+ * @returns -1 if a<b, 0 if equal, 1 if a>b
+ */
+function compareVersions(a, b) {
+  const pa = String(a).split('.').map((x) => parseInt(x, 10) || 0);
+  const pb = String(b).split('.').map((x) => parseInt(x, 10) || 0);
+  const n = Math.max(pa.length, pb.length);
+  for (let i = 0; i < n; i++) {
+    const da = pa[i] || 0;
+    const db = pb[i] || 0;
+    if (da < db) return -1;
+    if (da > db) return 1;
+  }
+  return 0;
+}
+
+/** Strip surrounding whitespace + a single pair of backticks from a table cell. */
+function cell(s) {
+  return String(s).trim().replace(/^`(.*)`$/, '$1').trim();
+}
+
+/**
+ * Parse the path-migrations table out of reference/DEPRECATIONS.md text.
+ * Finds the header row containing Since / Removed in / Old / New, skips the `|---|` separator, and
+ * reads pipe-delimited data rows until a non-table line. Returns [] when the table is absent.
+ * @returns {Array<{since, removedIn, old, new, hint}>}
+ */
+function parseDeprecations(mdText) {
+  const lines = String(mdText).replace(/\r\n/g, '\n').split('\n');
+  const entries = [];
+  let inTable = false;
+  for (const line of lines) {
+    const isRow = /^\s*\|.*\|\s*$/.test(line);
+    if (!inTable) {
+      if (isRow && /\bSince\b/i.test(line) && /Removed in/i.test(line) && /\bOld\b/i.test(line) && /\bNew\b/i.test(line)) {
+        inTable = true; // header found; the next line is the separator
+      }
+      continue;
+    }
+    if (!isRow) { inTable = false; continue; } // table ended
+    const cells = line.split('|').slice(1, -1).map(cell);
+    if (cells.length < 5) continue;
+    if (/^-+$/.test(cells[0].replace(/\s/g, ''))) continue; // separator row
+    if (/^since$/i.test(cells[0])) continue; // a repeated header, ignore
+    entries.push({ since: cells[0], removedIn: cells[1], old: cells[2], new: cells[3], hint: cells[4] });
+  }
+  return entries;
+}
+
+/**
+ * Status of an entry at `currentVersion`:
+ *   pending    — current < since
+ *   deprecated — since <= current < removedIn (or removedIn blank ⇒ never 'removed')
+ *   removed    — current >= removedIn
+ */
+function classify(entry, currentVersion) {
+  if (!entry || !entry.since) throw new Error('deprecation-registry: entry needs a `since` version');
+  if (compareVersions(currentVersion, entry.since) < 0) return 'pending';
+  if (entry.removedIn && String(entry.removedIn).trim() && compareVersions(currentVersion, entry.removedIn) >= 0) {
+    return 'removed';
+  }
+  return 'deprecated';
+}
+
+/**
+ * Look up a reference (an old path/name) against the registry at currentVersion.
+ * @returns {{entry, status, message} | null}  null when `ref` is not a known deprecated path.
+ */
+function checkReference(entries, ref, currentVersion) {
+  if (!Array.isArray(entries)) throw new Error('deprecation-registry: entries must be an array');
+  const r = cell(ref);
+  const entry = entries.find((e) => e.old === r);
+  if (!entry) return null;
+  const status = classify(entry, currentVersion);
+  let message;
+  if (status === 'removed') {
+    message = `${entry.old} was removed in v${entry.removedIn}; use ${entry.new}. ${entry.hint}`;
+  } else if (status === 'deprecated') {
+    message = `${entry.old} is deprecated since v${entry.since} (removed in v${entry.removedIn}); use ${entry.new}. ${entry.hint}`;
+  } else {
+    message = `${entry.old} will be deprecated in v${entry.since}; the replacement is ${entry.new}.`;
+  }
+  return { entry, status, message };
+}
+
+module.exports = { compareVersions, parseDeprecations, classify, checkReference };

package/skills/migrate/SKILL.md

@@ -0,0 +1,70 @@
+---
+name: gdd-migrate
+description: "Migrates a project off GDD's own deprecated paths after an upgrade. Reads the machine-readable registry in reference/DEPRECATIONS.md (via scripts/lib/deprecation-registry.cjs), scans the project's .design/config.json + any local skill/agent references for paths that are now deprecated or removed at the installed version, and PREVIEWS a diff before changing anything. Interactive by default (confirm per change); --yes auto-applies; --dry-run previews only. Read-first, never silent. Use after /gdd:update flags a breaking change."
+argument-hint: "[--yes] [--dry-run]"
+user-invocable: true
+tools: Read, Write, Bash, Grep, Glob
+---
+
+# /gdd:migrate
+
+Closes the GDD-on-GDD gap: when GDD moves or removes its own paths (e.g. the Phase 31.5
+`scripts/lib/**` → `sdk/**` reorg), a project that referenced the old paths needs updating. This skill
+consults the deprecation registry, finds the stale references **in this project**, and rewrites them —
+**after showing you the diff**. It never edits silently. Contract: `../../reference/DEPRECATIONS.md`.
+
+## Invocation
+
+| Command | Behavior |
+|---|---|
+| `/gdd:migrate` | Scan + preview every applicable migration, then confirm each before applying. |
+| `/gdd:migrate --dry-run` | Preview only — print the diff, change nothing. |
+| `/gdd:migrate --yes` | Apply every applicable migration without the per-change prompt (still prints what changed). |
+
+## Steps
+
+1. **Resolve the installed version** from `.claude-plugin/plugin.json` (`version`).
+2. **Load the registry.** Parse `reference/DEPRECATIONS.md` with the pure helper:
+
+   ```bash
+   node -e '
+     const fs = require("fs");
+     const dr = require("./scripts/lib/deprecation-registry.cjs");
+     const entries = dr.parseDeprecations(fs.readFileSync("reference/DEPRECATIONS.md","utf8"));
+     const version = require("./.claude-plugin/plugin.json").version;
+     // Only entries that are deprecated/removed at the installed version are actionable.
+     const actionable = entries.filter(e => dr.classify(e, version) !== "pending");
+     console.log(JSON.stringify({ version, actionable }));
+   '
+   ```
+
+3. **Scan the project** for each actionable entry's `Old` path:
+   - `.design/config.json` (string values referencing an old path),
+   - project-local skill/agent references (`grep` the repo, excluding `.git/`, `node_modules/`, and
+     GDD's own `reference/DEPRECATIONS.md`),
+   - any `require(...)`/import of a removed SDK path.
+   For a code rewrite, scaffold the edit with `scripts/lib/migration/codemod-gen.cjs` (Phase 39.1) —
+   you emit the change as a reviewable patch, you do not run a codemod engine.
+4. **Preview.** Print a unified-diff-style preview per file: `Old → New`, the registry status
+   (`deprecated` vs `removed`), and the migration hint. If `--dry-run`, stop here.
+5. **Confirm + apply.** Without `--yes`, ask per change. With `--yes`, apply all. Use `Write` to make
+   the edits; never touch a file the user didn't consent to.
+6. **Report.** Summarize: files changed, references rewritten, and any `removed`-status reference that
+   still has no replacement wired (flag it loudly — that one breaks at the installed version).
+
+## Boundaries
+
+- **Preview-first.** Nothing changes before you've shown the diff (or `--yes` was passed).
+- Migrates **this project's references** to GDD paths — it does not rewrite GDD's own source, and it
+  never performs a downgrade (reverse migrations are out of scope).
+- Read the registry; never invent a migration that isn't in `reference/DEPRECATIONS.md`.
+
+## Record
+
+Print a `## Migration summary` (version, actionable entries, files changed, unresolved `removed`
+references) and append one JSONL line to `.design/intel/insights.jsonl` recording the migration run.
+Close with:
+
+```
+## MIGRATE COMPLETE
+```

package/skills/review-decisions/SKILL.md

@@ -0,0 +1,42 @@
+---
+name: gdd-review-decisions
+description: "Surfaces the async decision-review queue for team mode. Reads .design/reviews/<decision-id>/ entries and reports each decision's state in the proposed → reviewing → approved → locked machine (via scripts/lib/collab/review-queue.cjs), so a team can see what's awaiting review, what's approved, and what's locked. --pending shows only decisions still needing action. Read-only — it reports the queue; it never advances a decision (that's a reviewer's explicit call). Use to run an async design-decision review without a meeting."
+argument-hint: "[<decision-id>] [--pending]"
+user-invocable: true
+tools: Read, Bash, Grep, Glob
+---
+
+# /gdd:review-decisions
+
+Closes the async-review gap for team mode: design decisions move through an explicit review queue
+instead of being decided in a single operator's head. This skill reports where each decision is.
+**Read-only** — it surfaces state; advancing a decision is a reviewer's explicit action. Contract:
+`../../reference/multi-author-model.md`.
+
+## Invocation
+
+| Command | Behavior |
+|---|---|
+| `/gdd:review-decisions` | Every decision in the queue, grouped by state. |
+| `/gdd:review-decisions <decision-id>` | One decision's state + audit trail. |
+| `/gdd:review-decisions --pending` | Only decisions not yet `locked` (awaiting action). |
+
+## Steps
+
+1. **Find the queue.** List `.design/reviews/*/` (each dir is a `<decision-id>`). No reviews dir →
+   print `review-decisions: no review queue yet (team mode not in use).` and exit.
+2. **Read each entry** (`.design/reviews/<id>/state.json` → `{ id, state, audit }`). Validate the
+   state against `scripts/lib/collab/review-queue.cjs` `STATES`.
+3. **Render** grouped by state: `proposed` / `reviewing` / `approved` / `locked`, each listing the
+   decision id + a one-line summary. For `--pending`, use `review-queue.pending(entries)` to show only
+   non-locked ones. For a single `<decision-id>`, also print its audit trail (transitions + approvers).
+4. **Do not advance.** Reporting only — moving a decision forward (or `/gdd:unlock-decision`) is the
+   reviewer's explicit call.
+
+## Output
+
+End with:
+
+```
+## REVIEW-DECISIONS COMPLETE
+```