@opengsd/gsd-core 1.2.0 → 1.3.0

package/{get-shit-done → gsd-core}/workflows/review.md

@@ -14,7 +14,7 @@ A plan that survives review from 2-3 independent AI systems is more robust.
 Check which AI CLIs are available on the system:
 
 ```bash
-_GSD_SHIM_NAME="gsd-tools.cjs"; _GSD_RUNTIME_ROOT="${RUNTIME_DIR:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"; GSD_TOOLS="${_GSD_RUNTIME_ROOT}/get-shit-done/bin/${_GSD_SHIM_NAME}"; if [ -f "$GSD_TOOLS" ]; then gsd_run() { node "$GSD_TOOLS" "$@"; }; elif [ -f "${_GSD_RUNTIME_ROOT}/.claude/get-shit-done/bin/${_GSD_SHIM_NAME}" ]; then GSD_TOOLS="${_GSD_RUNTIME_ROOT}/.claude/get-shit-done/bin/${_GSD_SHIM_NAME}"; gsd_run() { node "$GSD_TOOLS" "$@"; }; elif command -v gsd-tools >/dev/null 2>&1; then GSD_TOOLS="$(command -v gsd-tools)"; gsd_run() { "$GSD_TOOLS" "$@"; }; elif [ -f "$HOME/.claude/get-shit-done/bin/${_GSD_SHIM_NAME}" ]; then GSD_TOOLS="$HOME/.claude/get-shit-done/bin/${_GSD_SHIM_NAME}"; gsd_run() { node "$GSD_TOOLS" "$@"; }; else echo "ERROR: gsd-tools.cjs not found at $GSD_TOOLS and gsd-tools is not on PATH. Run: npx -y @opengsd/gsd-core@latest --claude --local" >&2; exit 1; fi
+_GSD_SHIM_NAME="gsd-tools.cjs"; _GSD_RUNTIME_ROOT="${RUNTIME_DIR:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"; GSD_TOOLS="${_GSD_RUNTIME_ROOT}/gsd-core/bin/${_GSD_SHIM_NAME}"; if [ -f "$GSD_TOOLS" ]; then gsd_run() { node "$GSD_TOOLS" "$@"; }; elif [ -f "${_GSD_RUNTIME_ROOT}/.claude/gsd-core/bin/${_GSD_SHIM_NAME}" ]; then GSD_TOOLS="${_GSD_RUNTIME_ROOT}/.claude/gsd-core/bin/${_GSD_SHIM_NAME}"; gsd_run() { node "$GSD_TOOLS" "$@"; }; elif command -v gsd-tools >/dev/null 2>&1; then GSD_TOOLS="$(command -v gsd-tools)"; gsd_run() { "$GSD_TOOLS" "$@"; }; elif [ -f "$HOME/.claude/gsd-core/bin/${_GSD_SHIM_NAME}" ]; then GSD_TOOLS="$HOME/.claude/gsd-core/bin/${_GSD_SHIM_NAME}"; gsd_run() { node "$GSD_TOOLS" "$@"; }; else echo "ERROR: gsd-tools.cjs not found at $GSD_TOOLS and gsd-tools is not on PATH. Run: npx -y @opengsd/gsd-core@latest --claude --local" >&2; exit 1; fi
 # Check each CLI
 command -v gemini >/dev/null 2>&1 && echo "gemini:available" || echo "gemini:missing"
 command -v claude >/dev/null 2>&1 && echo "claude:available" || echo "claude:missing"
@@ -23,6 +23,7 @@ command -v coderabbit >/dev/null 2>&1 && echo "coderabbit:available" || echo "co
 command -v opencode >/dev/null 2>&1 && echo "opencode:available" || echo "opencode:missing"
 command -v qwen >/dev/null 2>&1 && echo "qwen:available" || echo "qwen:missing"
 command -v cursor >/dev/null 2>&1 && echo "cursor:available" || echo "cursor:missing"
+command -v agy >/dev/null 2>&1 && echo "antigravity:available" || echo "antigravity:missing"
 
 # Check local model servers (OpenAI-compatible HTTP API — no CLI binary required)
 OLLAMA_HOST=$(gsd_run query config-get review.ollama_host 2>/dev/null | jq -r '.' 2>/dev/null || echo "")
@@ -46,6 +47,7 @@ Parse flags from `$ARGUMENTS`:
 - `--opencode` → include OpenCode
 - `--qwen` → include Qwen Code
 - `--cursor` → include Cursor
+- `--agy` or `--antigravity` → include Antigravity CLI
 - `--ollama` → include Ollama (local server, OpenAI-compatible)
 - `--lm-studio` → include LM Studio (local server, OpenAI-compatible)
 - `--llama-cpp` → include llama.cpp (local server, OpenAI-compatible)
@@ -73,6 +75,7 @@ No external AI CLIs found. Install at least one:
 - opencode: https://opencode.ai (leverages GitHub Copilot subscription models)
 - qwen: https://github.com/nicepkg/qwen-code (Alibaba Qwen models)
 - cursor: https://cursor.com (Cursor IDE agent mode)
+- agy: curl -fsSL https://antigravity.google/cli/install.sh | bash (Antigravity CLI — free with Google credentials)
 
 Then run /gsd:review again.
 ```
@@ -218,6 +221,8 @@ GEMINI_MODEL=$(gsd_run query config-get review.models.gemini 2>/dev/null | jq -r
 CLAUDE_MODEL=$(gsd_run query config-get review.models.claude 2>/dev/null | jq -r '.' 2>/dev/null || true)
 CODEX_MODEL=$(gsd_run query config-get review.models.codex 2>/dev/null | jq -r '.' 2>/dev/null || true)
 OPENCODE_MODEL=$(gsd_run query config-get review.models.opencode 2>/dev/null | jq -r '.' 2>/dev/null || true)
+# review.models.agy is reserved for future model-pinning support; agy selects its model internally
+AGY_MODEL=$(gsd_run query config-get review.models.agy 2>/dev/null | jq -r '.' 2>/dev/null || true)
 ```
 
 For each selected CLI, invoke in sequence (not parallel — avoid rate limits):
@@ -285,6 +290,103 @@ if [ ! -s /tmp/gsd-review-cursor-{phase}.md ]; then
 fi
 ```
 
+**Antigravity CLI:**
+
+**Maintainer note — why this block has three layers (last updated against agy 1.0.2):**
+
+`agy -p` (the `--print` non-interactive flag) works correctly on macOS and Linux: it sends the
+prompt, receives the model response, and writes it to stdout. On **native Windows** it silently
+produces no stdout output despite the API call succeeding — a bug in `text_drip.go`'s non-TTY
+flush path, tracked at https://github.com/google-antigravity/antigravity-cli/issues/27466 and
+still open as of agy 1.0.2.
+
+Regardless of platform, `agy` always persists the full exchange to a transcript file on disk.
+The transcript fallback (Step 2 below) reads that file directly, giving Windows users full review
+coverage without any extra tooling. This pattern was first documented by the community MCP bridge
+at https://github.com/SinanTufekci/Claude-Code-Antigravity-CLI-MCP-Server — we inline the same
+logic here in pure bash/jq so no additional dependency is required.
+
+**Stale-response guard (why the pre-flight watermark matters):**
+Without a watermark, the fallback would read the last `PLANNER_RESPONSE` entry in the transcript
+regardless of when it was written — including entries from a previous invocation in the same
+workspace. To prevent that, we record the transcript's line count *before* calling `agy -p`. In
+the fallback, we only read lines appended after that count. If no new lines were written (agy
+failed before producing a response), `_AGY_RESULT` is empty and Step 3 fires — never stale. If
+the conv-id changed (agy started a fresh session), all lines in the new file are new and we use
+skip=0.
+
+**If the upstream stdout bug is fixed** (check the issue above): Step 2 silently becomes
+unreachable; stdout is non-empty and Step 1 handles it. No code change needed.
+
+**If the transcript paths change** in a future `agy` release: Step 2 silently becomes a no-op
+and Step 3 fires with a clear error message in REVIEWS.md. No silent corruption. To debug:
+- `~/.gemini/antigravity-cli/cache/last_conversations.json` — workspace → conv-id map
+- `~/.gemini/antigravity-cli/brain/<id>/.system_generated/logs/transcript.jsonl`
+  Filter: `source=="MODEL"`, `status=="DONE"`, `type=="PLANNER_RESPONSE"`, take the last match's `content` field.
+
+Invocation specifics (verified agy 1.0.0, macOS arm64 and Linux amd64):
+- `-p` takes the prompt as a **flag value** — `echo X | agy -p` errors with "flag needs an argument: -p"
+- `--print-timeout` defaults to 5m, aligning with this workflow's global timeout
+- No `-m` / `--model` flag — agy selects the model internally
+
+```bash
+# Pre-flight: snapshot the transcript watermark before invoking agy.
+# Must run BEFORE agy -p — this is what prevents the fallback from reading a stale prior response.
+_AGY_WS=$(git rev-parse --show-toplevel 2>/dev/null || pwd)
+_AGY_CACHE="$HOME/.gemini/antigravity-cli/cache/last_conversations.json"
+_AGY_MARK_CONV=""
+_AGY_MARK_LINES=0
+if [ -f "$_AGY_CACHE" ]; then
+  _AGY_MARK_CONV=$(jq -r --arg ws "$_AGY_WS" '
+    .[$ws] //
+    (to_entries
+     | map(select(.key | ascii_downcase == ($ws | ascii_downcase)))
+     | first | .value) //
+    empty
+  ' "$_AGY_CACHE" 2>/dev/null)
+  if [ -n "$_AGY_MARK_CONV" ] && [ "$_AGY_MARK_CONV" != "null" ]; then
+    _AGY_MARK_TX="$HOME/.gemini/antigravity-cli/brain/${_AGY_MARK_CONV}/.system_generated/logs/transcript.jsonl"
+    [ -f "$_AGY_MARK_TX" ] && _AGY_MARK_LINES=$(wc -l < "$_AGY_MARK_TX" | tr -d ' ')
+  fi
+fi
+
+# Step 1 — primary invocation: stdout works on macOS, Linux, and WSL
+agy -p "$(cat /tmp/gsd-review-prompt-{phase}.md)" 2>/dev/null > /tmp/gsd-review-antigravity-{phase}.md
+
+# Step 2 — transcript fallback: catches Windows agy -p stdout bug (and any future stdout-silent edge cases).
+# Reads only lines appended AFTER the pre-flight watermark. If agy failed before writing a new response,
+# _AGY_RESULT is empty and Step 3 fires — no stale content can leak through.
+# Undocumented paths, verified agy 1.0.0–1.0.2. See maintainer note above if these break.
+if [ ! -s /tmp/gsd-review-antigravity-{phase}.md ]; then
+  if [ -f "$_AGY_CACHE" ]; then
+    _AGY_CONV=$(jq -r --arg ws "$_AGY_WS" '
+      .[$ws] //
+      (to_entries
+       | map(select(.key | ascii_downcase == ($ws | ascii_downcase)))
+       | first | .value) //
+      empty
+    ' "$_AGY_CACHE" 2>/dev/null)
+    if [ -n "$_AGY_CONV" ] && [ "$_AGY_CONV" != "null" ]; then
+      _AGY_TX="$HOME/.gemini/antigravity-cli/brain/${_AGY_CONV}/.system_generated/logs/transcript.jsonl"
+      if [ -f "$_AGY_TX" ]; then
+        # If conv-id changed, agy started a new session — all lines are new, skip 0.
+        # If same conv-id, only read lines beyond the watermark.
+        [ "$_AGY_CONV" = "$_AGY_MARK_CONV" ] && _AGY_SKIP=$_AGY_MARK_LINES || _AGY_SKIP=0
+        _AGY_RESULT=$(tail -n +"$((_AGY_SKIP + 1))" "$_AGY_TX" 2>/dev/null | \
+          jq -r 'select(.source=="MODEL" and .status=="DONE" and .type=="PLANNER_RESPONSE") | .content' \
+          2>/dev/null | tail -1)
+        [ -n "$_AGY_RESULT" ] && echo "$_AGY_RESULT" > /tmp/gsd-review-antigravity-{phase}.md
+      fi
+    fi
+  fi
+fi
+
+# Step 3 — final guard: both approaches yielded nothing (auth error, first-run setup, path schema changed, etc.)
+if [ ! -s /tmp/gsd-review-antigravity-{phase}.md ]; then
+  echo "Antigravity review failed or returned empty output." > /tmp/gsd-review-antigravity-{phase}.md
+fi
+```
+
 **Ollama (local, OpenAI-compatible):**
 
 Read host and model from config. All three local backends share the same `/v1/chat/completions` endpoint — only host and model differ. Use `jq --rawfile` to safely encode the multi-line prompt as JSON without shell-escaping issues.
@@ -493,7 +595,7 @@ After all reviewers complete, collect trim metadata files written during the run
 ```markdown
 ---
 phase: {N}
-reviewers: [gemini, claude, codex, coderabbit, opencode, qwen, cursor, ollama, lm_studio, llama_cpp]  # populate at runtime with only the reviewers actually invoked
+reviewers: [gemini, claude, codex, coderabbit, opencode, qwen, cursor, antigravity, ollama, lm_studio, llama_cpp]  # populate at runtime with only the reviewers actually invoked
 reviewed_at: {ISO timestamp}
 plans_reviewed: [{list of PLAN.md files}]
 trimmed_reviewers:        # only present if at least one reviewer was trimmed
@@ -552,6 +654,12 @@ trimmed_reviewers:        # only present if at least one reviewer was trimmed
 
 ---
 
+## Antigravity Review
+
+{antigravity review content}
+
+---
+
 ## Ollama Review
 
 {ollama review content}

package/{get-shit-done → gsd-core}/workflows/scan.md

@@ -39,7 +39,7 @@ Exit.
 ## Step 2: Check for existing documents
 
 ```bash
-_GSD_SHIM_NAME="gsd-tools.cjs"; _GSD_RUNTIME_ROOT="${RUNTIME_DIR:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"; GSD_TOOLS="${_GSD_RUNTIME_ROOT}/get-shit-done/bin/${_GSD_SHIM_NAME}"; if [ -f "$GSD_TOOLS" ]; then gsd_run() { node "$GSD_TOOLS" "$@"; }; elif [ -f "${_GSD_RUNTIME_ROOT}/.claude/get-shit-done/bin/${_GSD_SHIM_NAME}" ]; then GSD_TOOLS="${_GSD_RUNTIME_ROOT}/.claude/get-shit-done/bin/${_GSD_SHIM_NAME}"; gsd_run() { node "$GSD_TOOLS" "$@"; }; elif command -v gsd-tools >/dev/null 2>&1; then GSD_TOOLS="$(command -v gsd-tools)"; gsd_run() { "$GSD_TOOLS" "$@"; }; elif [ -f "$HOME/.claude/get-shit-done/bin/${_GSD_SHIM_NAME}" ]; then GSD_TOOLS="$HOME/.claude/get-shit-done/bin/${_GSD_SHIM_NAME}"; gsd_run() { node "$GSD_TOOLS" "$@"; }; else echo "ERROR: gsd-tools.cjs not found at $GSD_TOOLS and gsd-tools is not on PATH. Run: npx -y @opengsd/gsd-core@latest --claude --local" >&2; exit 1; fi
+_GSD_SHIM_NAME="gsd-tools.cjs"; _GSD_RUNTIME_ROOT="${RUNTIME_DIR:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"; GSD_TOOLS="${_GSD_RUNTIME_ROOT}/gsd-core/bin/${_GSD_SHIM_NAME}"; if [ -f "$GSD_TOOLS" ]; then gsd_run() { node "$GSD_TOOLS" "$@"; }; elif [ -f "${_GSD_RUNTIME_ROOT}/.claude/gsd-core/bin/${_GSD_SHIM_NAME}" ]; then GSD_TOOLS="${_GSD_RUNTIME_ROOT}/.claude/gsd-core/bin/${_GSD_SHIM_NAME}"; gsd_run() { node "$GSD_TOOLS" "$@"; }; elif command -v gsd-tools >/dev/null 2>&1; then GSD_TOOLS="$(command -v gsd-tools)"; gsd_run() { "$GSD_TOOLS" "$@"; }; elif [ -f "$HOME/.claude/gsd-core/bin/${_GSD_SHIM_NAME}" ]; then GSD_TOOLS="$HOME/.claude/gsd-core/bin/${_GSD_SHIM_NAME}"; gsd_run() { node "$GSD_TOOLS" "$@"; }; else echo "ERROR: gsd-tools.cjs not found at $GSD_TOOLS and gsd-tools is not on PATH. Run: npx -y @opengsd/gsd-core@latest --claude --local" >&2; exit 1; fi
 INIT=$(gsd_run query init.map-codebase 2>/dev/null || echo "{}")
 if [[ "$INIT" == @file:* ]]; then INIT=$(cat "${INIT#@file:}"); fi
 ```
@@ -72,6 +72,8 @@ mkdir -p .planning/codebase
 
 Spawn a single `gsd-codebase-mapper` agent with the selected focus area:
 
+Print: `◆ Spawning scanner... (runs in a subagent — no output until it returns, ~1–5 min; expected, not a freeze)`
+
 ```
 Agent(
   prompt="Scan this codebase with focus: {focus}. Write results to .planning/codebase/. Produce only: {document_list}",

package/{get-shit-done → gsd-core}/workflows/secure-phase.md

@@ -3,7 +3,7 @@ Verify threat mitigations for a completed phase. Confirm PLAN.md threat register
 </purpose>
 
 <required_reading>
-@~/.claude/get-shit-done/references/ui-brand.md
+@~/.claude/gsd-core/references/ui-brand.md
 </required_reading>
 
 <available_agent_types>
@@ -16,7 +16,7 @@ Valid GSD subagent types (use exact names — do not fall back to 'general-purpo
 ## 0. Initialize
 
 ```bash
-_GSD_SHIM_NAME="gsd-tools.cjs"; _GSD_RUNTIME_ROOT="${RUNTIME_DIR:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"; GSD_TOOLS="${_GSD_RUNTIME_ROOT}/get-shit-done/bin/${_GSD_SHIM_NAME}"; if [ -f "$GSD_TOOLS" ]; then gsd_run() { node "$GSD_TOOLS" "$@"; }; elif [ -f "${_GSD_RUNTIME_ROOT}/.claude/get-shit-done/bin/${_GSD_SHIM_NAME}" ]; then GSD_TOOLS="${_GSD_RUNTIME_ROOT}/.claude/get-shit-done/bin/${_GSD_SHIM_NAME}"; gsd_run() { node "$GSD_TOOLS" "$@"; }; elif command -v gsd-tools >/dev/null 2>&1; then GSD_TOOLS="$(command -v gsd-tools)"; gsd_run() { "$GSD_TOOLS" "$@"; }; elif [ -f "$HOME/.claude/get-shit-done/bin/${_GSD_SHIM_NAME}" ]; then GSD_TOOLS="$HOME/.claude/get-shit-done/bin/${_GSD_SHIM_NAME}"; gsd_run() { node "$GSD_TOOLS" "$@"; }; else echo "ERROR: gsd-tools.cjs not found at $GSD_TOOLS and gsd-tools is not on PATH. Run: npx -y @opengsd/gsd-core@latest --claude --local" >&2; exit 1; fi
+_GSD_SHIM_NAME="gsd-tools.cjs"; _GSD_RUNTIME_ROOT="${RUNTIME_DIR:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"; GSD_TOOLS="${_GSD_RUNTIME_ROOT}/gsd-core/bin/${_GSD_SHIM_NAME}"; if [ -f "$GSD_TOOLS" ]; then gsd_run() { node "$GSD_TOOLS" "$@"; }; elif [ -f "${_GSD_RUNTIME_ROOT}/.claude/gsd-core/bin/${_GSD_SHIM_NAME}" ]; then GSD_TOOLS="${_GSD_RUNTIME_ROOT}/.claude/gsd-core/bin/${_GSD_SHIM_NAME}"; gsd_run() { node "$GSD_TOOLS" "$@"; }; elif command -v gsd-tools >/dev/null 2>&1; then GSD_TOOLS="$(command -v gsd-tools)"; gsd_run() { "$GSD_TOOLS" "$@"; }; elif [ -f "$HOME/.claude/gsd-core/bin/${_GSD_SHIM_NAME}" ]; then GSD_TOOLS="$HOME/.claude/gsd-core/bin/${_GSD_SHIM_NAME}"; gsd_run() { node "$GSD_TOOLS" "$@"; }; else echo "ERROR: gsd-tools.cjs not found at $GSD_TOOLS and gsd-tools is not on PATH. Run: npx -y @opengsd/gsd-core@latest --claude --local" >&2; exit 1; fi
 INIT=$(gsd_run query init.phase-op "${PHASE_ARG}")
 if [[ "$INIT" == @file:* ]]; then INIT=$(cat "${INIT#@file:}"); fi
 AGENT_SKILLS_AUDITOR=$(gsd_run query agent-skills gsd-security-auditor)
@@ -93,6 +93,8 @@ Call AskUserQuestion with threat table and options:
 - `register_authored_at_plan_time: true` — **Verify mitigations exist** — do not scan for new threats. The register is complete; verify each threat's mitigation is present in the implementation.
 - `register_authored_at_plan_time: false` (retroactive-STRIDE mode) — **Retroactive-STRIDE: build a STRIDE register from implementation files first, then verify mitigations.** The phase was authored before formal threat modelling; the auditor must construct the register from scratch before verifying.
 
+Print: `◆ Spawning security auditor... (runs in a subagent — no output until it returns, ~1–5 min; expected, not a freeze)`
+
 ```
 Agent(
   prompt="Read ~/.claude/agents/gsd-security-auditor.md for instructions.\n\n" +
@@ -117,7 +119,7 @@ Handle return:
 ## 6. Write/Update SECURITY.md
 
 **State B (create):**
-1. Read template from `~/.claude/get-shit-done/templates/SECURITY.md`
+1. Read template from `~/.claude/gsd-core/templates/SECURITY.md`
 2. Fill: frontmatter, threat register, accepted risks, audit trail
 3. Write to `${PHASE_DIR}/${PADDED_PHASE}-SECURITY.md`
 

package/{get-shit-done → gsd-core}/workflows/settings-advanced.md

@@ -1,12 +1,14 @@
 <purpose>
 Interactive configuration of GSD power-user knobs — plan bounce, node repair, subagent timeouts,
 inline plan threshold, cross-AI execution, base branch, branch templates, response language,
-context window, gitignored search, graphify build timeout, and runtime model tier overrides.
+context window, gitignored search, graphify build timeout, runtime model tier overrides, and
+model policy configuration (provider + budget → canonical tier mapping, or manual model ID
+assignment per cost tier).
 
 This is a companion to `/gsd:settings` — the common-case prompt there covers model profile,
 research/plan_check/verifier toggles, branching strategy, UI/AI phase gates, and worktree
 isolation. This advanced command covers everything else that is user-settable, grouped into
-seven sections so each prompt batch stays cognitively scoped. Every answer pre-selects the
+eight sections so each prompt batch stays cognitively scoped. Every answer pre-selects the
 current value; numeric-input answers that are non-numeric are rejected and re-prompted.
 </purpose>
 
@@ -20,7 +22,7 @@ Read all files referenced by the invoking prompt's execution_context before star
 Ensure config exists and resolve the workstream-aware config path (mirrors `settings.md`):
 
 ```bash
-_GSD_SHIM_NAME="gsd-tools.cjs"; _GSD_RUNTIME_ROOT="${RUNTIME_DIR:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"; GSD_TOOLS="${_GSD_RUNTIME_ROOT}/get-shit-done/bin/${_GSD_SHIM_NAME}"; if [ -f "$GSD_TOOLS" ]; then gsd_run() { node "$GSD_TOOLS" "$@"; }; elif [ -f "${_GSD_RUNTIME_ROOT}/.claude/get-shit-done/bin/${_GSD_SHIM_NAME}" ]; then GSD_TOOLS="${_GSD_RUNTIME_ROOT}/.claude/get-shit-done/bin/${_GSD_SHIM_NAME}"; gsd_run() { node "$GSD_TOOLS" "$@"; }; elif command -v gsd-tools >/dev/null 2>&1; then GSD_TOOLS="$(command -v gsd-tools)"; gsd_run() { "$GSD_TOOLS" "$@"; }; elif [ -f "$HOME/.claude/get-shit-done/bin/${_GSD_SHIM_NAME}" ]; then GSD_TOOLS="$HOME/.claude/get-shit-done/bin/${_GSD_SHIM_NAME}"; gsd_run() { node "$GSD_TOOLS" "$@"; }; else echo "ERROR: gsd-tools.cjs not found at $GSD_TOOLS and gsd-tools is not on PATH. Run: npx -y @opengsd/gsd-core@latest --claude --local" >&2; exit 1; fi
+_GSD_SHIM_NAME="gsd-tools.cjs"; _GSD_RUNTIME_ROOT="${RUNTIME_DIR:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"; GSD_TOOLS="${_GSD_RUNTIME_ROOT}/gsd-core/bin/${_GSD_SHIM_NAME}"; if [ -f "$GSD_TOOLS" ]; then gsd_run() { node "$GSD_TOOLS" "$@"; }; elif [ -f "${_GSD_RUNTIME_ROOT}/.claude/gsd-core/bin/${_GSD_SHIM_NAME}" ]; then GSD_TOOLS="${_GSD_RUNTIME_ROOT}/.claude/gsd-core/bin/${_GSD_SHIM_NAME}"; gsd_run() { node "$GSD_TOOLS" "$@"; }; elif command -v gsd-tools >/dev/null 2>&1; then GSD_TOOLS="$(command -v gsd-tools)"; gsd_run() { "$GSD_TOOLS" "$@"; }; elif [ -f "$HOME/.claude/gsd-core/bin/${_GSD_SHIM_NAME}" ]; then GSD_TOOLS="$HOME/.claude/gsd-core/bin/${_GSD_SHIM_NAME}"; gsd_run() { node "$GSD_TOOLS" "$@"; }; else echo "ERROR: gsd-tools.cjs not found at $GSD_TOOLS and gsd-tools is not on PATH. Run: npx -y @opengsd/gsd-core@latest --claude --local" >&2; exit 1; fi
 gsd_run query config-ensure-section
 if [[ -z "${GSD_CONFIG_PATH:-}" ]]; then
   if [[ -f .planning/active-workstream ]]; then
@@ -81,6 +83,13 @@ Runtime Model Tiers:
 - `model_profile_overrides.<runtime>.sonnet` (default: built-in for the runtime, or absent)
 - `model_profile_overrides.<runtime>.haiku` (default: built-in for the runtime, or absent)
 
+Model Policy:
+- `model_policy.provider` (default: `null` — known values: anthropic, openai, google, qwen)
+- `model_policy.budget` (default: `null` — known values: high, medium, low)
+- `model_policy.high` (default: `null` — model ID for the high-cost tier; used by generic provider path)
+- `model_policy.medium` (default: `null` — model ID for the medium-cost tier; used by generic provider path)
+- `model_policy.low` (default: `null` — model ID for the low-cost tier; used by generic provider path)
+
 Each field's **current value is pre-selected** in the prompt rendering below. When the
 current value is absent from the config, render the documented default as the pre-selected
 option so the user sees what the effective value is.
@@ -500,7 +509,7 @@ gsd_run query config-set model_profile_overrides.gemini.haiku null
 
 Conceptual shape after merge (unchanged top-level keys like `model_profile`,
 `granularity`, `mode`, `brave_search`, `agent_skills.*`, `hooks.context_warnings`, and
-anything not listed in Sections 1–7 MUST survive the update):
+anything not listed in Sections 1–8 MUST survive the update):
 
 ```json
 {
@@ -542,6 +551,14 @@ anything not listed in Sections 1–7 MUST survive the update):
       "sonnet": <new|existing|null>,
       "haiku": <new|existing|null>
     }
+  },
+  "model_policy": {
+    ...existing_model_policy,
+    "provider": <new|existing|null>,
+    "budget": <new|existing|null>,
+    "high": <new|existing|null>,
+    "medium": <new|existing|null>,
+    "low": <new|existing|null>
   }
 }
 ```
@@ -551,6 +568,170 @@ route each write through `gsd-tools.cjs query config-set` so sibling preservatio
 the central setter.
 </step>
 
+### Section 8 — Model Policy
+
+This section configures the `model_policy` key in `.planning/config.json`. Model policy
+defines which AI models GSD uses at each cost tier (low / medium / high), independently
+of the `runtime` and `model_profile` selections above. Two paths are offered:
+
+- **Known provider:** choose a provider and a budget level; GSD materializes the canonical
+  tier mapping for that provider.
+- **Generic provider:** enter low / medium / high model IDs manually.
+
+**Step A — Read and display the current model policy:**
+
+```bash
+cat "$GSD_CONFIG_PATH" | python3 -c "import sys,json; c=json.load(sys.stdin); mp=c.get('model_policy',{}); print(json.dumps(mp,indent=2))" 2>/dev/null || echo "{}"
+```
+
+Display the current values (or "(unset)" for any absent field) before asking:
+
+```text
+Current model_policy:
+  provider : <value or "(unset)">
+  budget   : <value or "(unset)">
+  low      : <value or "(unset)">
+  medium   : <value or "(unset)">
+  high     : <value or "(unset)">
+```
+
+**Step B — Choose configuration path:**
+
+```text
+AskUserQuestion([
+  {
+    question: "How do you want to configure the model policy?",
+    header: "Model Policy",
+    multiSelect: false,
+    options: [
+      { label: "Known provider", description: "Choose a provider (Claude / OpenAI / Gemini / Qwen) and a budget level — GSD writes the canonical tier mapping automatically." },
+      { label: "Generic provider", description: "Enter low / medium / high model IDs manually for any provider or custom deployment." },
+      { label: "Keep current", description: "Leave model_policy unchanged." }
+    ]
+  }
+])
+```
+
+**If "Keep current" is selected:** skip Steps C–E and move on to the confirm step.
+
+**Step C — Known-provider path:**
+
+```text
+AskUserQuestion([
+  {
+    question: "Which provider?",
+    header: "Provider",
+    multiSelect: false,
+    options: [
+      { label: "anthropic", description: "claude-opus-4-8 / claude-sonnet-4-6 / claude-haiku-4-5 (Anthropic / Claude)" },
+      { label: "openai", description: "gpt-5.5 / gpt-5.3-codex / gpt-5.4-mini (OpenAI / Codex)" },
+      { label: "google", description: "gemini-3-pro / gemini-3-flash / gemini-2.5-flash-lite (Google Gemini)" },
+      { label: "qwen", description: "qwen3-max-2026-01-23 / qwen3-coder-plus / qwen3-coder-next (Qwen)" }
+    ]
+  }
+])
+```
+
+After the user picks a provider, ask:
+
+```text
+AskUserQuestion([
+  {
+    question: "Which budget level?",
+    header: "Budget",
+    multiSelect: false,
+    options: [
+      { label: "high", description: "All tiers use the highest-quality model for the chosen provider. Highest cost." },
+      { label: "medium", description: "High tier → top model; medium → mid model; low → cheapest model. Best cost/quality ratio." },
+      { label: "low", description: "All tiers use the cheapest model for the chosen provider. Lowest cost." }
+    ]
+  }
+])
+```
+
+Canonical tier mappings by provider and budget:
+
+| Provider  | Budget | high                       | medium                     | low                        |
+|-----------|--------|----------------------------|----------------------------|----------------------------|
+| anthropic | high   | claude-opus-4-8            | claude-opus-4-8            | claude-opus-4-8            |
+| anthropic | medium | claude-opus-4-8            | claude-sonnet-4-6          | claude-haiku-4-5           |
+| anthropic | low    | claude-haiku-4-5           | claude-haiku-4-5           | claude-haiku-4-5           |
+| openai    | high   | gpt-5.5                    | gpt-5.5                    | gpt-5.5                    |
+| openai    | medium | gpt-5.5                    | gpt-5.3-codex              | gpt-5.4-mini               |
+| openai    | low    | gpt-5.4-mini               | gpt-5.4-mini               | gpt-5.4-mini               |
+| google    | high   | gemini-3-pro               | gemini-3-pro               | gemini-3-pro               |
+| google    | medium | gemini-3-pro               | gemini-3-flash             | gemini-2.5-flash-lite      |
+| google    | low    | gemini-2.5-flash-lite      | gemini-2.5-flash-lite      | gemini-2.5-flash-lite      |
+| qwen      | high   | qwen3-max-2026-01-23       | qwen3-max-2026-01-23       | qwen3-max-2026-01-23       |
+| qwen      | medium | qwen3-max-2026-01-23       | qwen3-coder-plus           | qwen3-coder-next           |
+| qwen      | low    | qwen3-coder-next           | qwen3-coder-next           | qwen3-coder-next           |
+
+Look up the selected (provider, budget) row and proceed to Step E to write those values.
+
+**Step D — Generic-provider path:**
+
+Prompt the user to enter each model ID as a free-text input. An empty input means "keep
+the current value for that tier." Validate that non-empty inputs are non-blank strings
+(no whitespace-only values); if validation fails, re-prompt that single field.
+
+```text
+AskUserQuestion([
+  {
+    question: "Model ID for the HIGH-cost tier? (most capable model — used for heavy reasoning tasks)",
+    header: "High-tier model",
+    multiSelect: false,
+    options: [
+      { label: "Keep current", description: "Leave unchanged (current: <model_policy.high or '(unset)'>)." },
+      { label: "Enter model ID", description: "Type the exact model identifier. Non-blank string required." }
+    ]
+  },
+  {
+    question: "Model ID for the MEDIUM-cost tier? (balanced model — used for most agents)",
+    header: "Medium-tier model",
+    multiSelect: false,
+    options: [
+      { label: "Keep current", description: "Leave unchanged (current: <model_policy.medium or '(unset)'>)." },
+      { label: "Enter model ID", description: "Type the exact model identifier." }
+    ]
+  },
+  {
+    question: "Model ID for the LOW-cost tier? (cheapest model — used for lightweight/fast tasks)",
+    header: "Low-tier model",
+    multiSelect: false,
+    options: [
+      { label: "Keep current", description: "Leave unchanged (current: <model_policy.low or '(unset)'>)." },
+      { label: "Enter model ID", description: "Type the exact model identifier." }
+    ]
+  }
+])
+```
+
+Set `provider = "custom"` and `budget = null` when writing the generic-provider result.
+Proceed to Step E.
+
+**Step E — Write model_policy to config:**
+
+```bash
+# Known-provider path — write all four keys atomically:
+gsd_run query config-set model_policy.provider "<provider>"   # e.g., anthropic / openai / google / qwen
+gsd_run query config-set model_policy.budget   "<budget>"    # high / medium / low
+gsd_run query config-set model_policy.high     "<high-id>"
+gsd_run query config-set model_policy.medium   "<medium-id>"
+gsd_run query config-set model_policy.low      "<low-id>"
+
+# Generic-provider path — write only tiers the user changed ("Keep current" skipped):
+gsd_run query config-set model_policy.provider "custom"
+gsd_run query config-set model_policy.budget   null
+# Per-tier writes for each non-"Keep current" answer:
+gsd_run query config-set model_policy.high     "<high-id>"   # omit if user chose "Keep current"
+gsd_run query config-set model_policy.medium   "<medium-id>" # omit if user chose "Keep current"
+gsd_run query config-set model_policy.low      "<low-id>"    # omit if user chose "Keep current"
+```
+
+Never write a tier the user explicitly chose to keep; the existing value must survive.
+
+</step>
+
 <step name="confirm">
 Display:
 
@@ -594,6 +775,11 @@ Display:
 | fast_mode.routing_tier_defaults.standard   | {true/false} |
 | fast_mode.routing_tier_defaults.heavy      | {true/false} |
 | fast_mode.agent_overrides.<agent-id>       | {true/false} |
+| model_policy.provider                      | {anthropic/openai/google/qwen/custom/null} |
+| model_policy.budget                        | {high/medium/low/null} |
+| model_policy.high                          | {model-id/null} |
+| model_policy.medium                        | {model-id/null} |
+| model_policy.low                           | {model-id/null} |
 
 These settings apply to future /gsd:plan-phase, /gsd:execute-phase, /gsd:discuss-phase,
 and /gsd:ship runs.
@@ -607,7 +793,7 @@ UI/AI phase gates), use /gsd:settings.
 
 <success_criteria>
 - [ ] Current config read from resolved `$GSD_CONFIG_PATH`
-- [ ] Seven sections rendered (Planning, Execution, Discussion, Cross-AI, Git, Runtime/Output, Runtime Model Tiers)
+- [ ] Eight sections rendered (Planning, Execution, Discussion, Cross-AI, Git, Runtime/Output, Runtime Model Tiers, Model Policy)
 - [ ] Every field pre-selected to its current value (or documented default if absent)
 - [ ] Numeric inputs validated — non-numeric rejected and re-prompted
 - [ ] Branch-template inputs validated — non-default must contain a placeholder
@@ -616,5 +802,9 @@ UI/AI phase gates), use /gsd:settings.
 - [ ] Section 7 shows current runtime and built-in tier table
 - [ ] Group B runtimes display "(no built-in default — your runtime handles model selection)"
 - [ ] Override set/clear/keep paths all work correctly for each tier
-- [ ] Confirmation table rendered listing all 23 fields (19 + runtime + 3 tier overrides)
+- [ ] Section 8 (Model Policy) offers three top-level choices: Known provider, Generic provider, Keep current
+- [ ] Known-provider path: provider + budget → canonical tier mapping written to model_policy.{provider,budget,high,medium,low}
+- [ ] Generic-provider path: per-tier manual model IDs; "Keep current" tiers are never written; provider=custom budget=null
+- [ ] model_policy written under the model_policy key in config.json, never as a top-level flat key
+- [ ] Confirmation table rendered listing all fields including model_policy.{provider,budget,high,medium,low}
 </success_criteria>

package/{get-shit-done → gsd-core}/workflows/settings-integrations.md

@@ -25,7 +25,7 @@ log the plaintext value. The workflow follows these rules:
   other than `config.json` itself.
 - **`config-set` output is masked** for keys in the secret set
   (`brave_search`, `firecrawl`, `exa_search`) — see
-  `get-shit-done/bin/lib/secrets.cjs`.
+  `gsd-core/bin/lib/secrets.cjs`.
 - **Agent-type and CLI slug validation.** `agent_skills.<agent-type>` and
   `review.models.<cli>` keys are matched against `^[a-zA-Z0-9_-]+$`. Inputs
   containing path separators (`/`, `\`, `..`), whitespace, or shell
@@ -42,7 +42,7 @@ Read all files referenced by the invoking prompt's execution_context before star
 Ensure config exists and resolve the active config path (flat vs workstream, #2282):
 
 ```bash
-_GSD_SHIM_NAME="gsd-tools.cjs"; _GSD_RUNTIME_ROOT="${RUNTIME_DIR:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"; GSD_TOOLS="${_GSD_RUNTIME_ROOT}/get-shit-done/bin/${_GSD_SHIM_NAME}"; if [ -f "$GSD_TOOLS" ]; then gsd_run() { node "$GSD_TOOLS" "$@"; }; elif [ -f "${_GSD_RUNTIME_ROOT}/.claude/get-shit-done/bin/${_GSD_SHIM_NAME}" ]; then GSD_TOOLS="${_GSD_RUNTIME_ROOT}/.claude/get-shit-done/bin/${_GSD_SHIM_NAME}"; gsd_run() { node "$GSD_TOOLS" "$@"; }; elif command -v gsd-tools >/dev/null 2>&1; then GSD_TOOLS="$(command -v gsd-tools)"; gsd_run() { "$GSD_TOOLS" "$@"; }; elif [ -f "$HOME/.claude/get-shit-done/bin/${_GSD_SHIM_NAME}" ]; then GSD_TOOLS="$HOME/.claude/get-shit-done/bin/${_GSD_SHIM_NAME}"; gsd_run() { node "$GSD_TOOLS" "$@"; }; else echo "ERROR: gsd-tools.cjs not found at $GSD_TOOLS and gsd-tools is not on PATH. Run: npx -y @opengsd/gsd-core@latest --claude --local" >&2; exit 1; fi
+_GSD_SHIM_NAME="gsd-tools.cjs"; _GSD_RUNTIME_ROOT="${RUNTIME_DIR:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"; GSD_TOOLS="${_GSD_RUNTIME_ROOT}/gsd-core/bin/${_GSD_SHIM_NAME}"; if [ -f "$GSD_TOOLS" ]; then gsd_run() { node "$GSD_TOOLS" "$@"; }; elif [ -f "${_GSD_RUNTIME_ROOT}/.claude/gsd-core/bin/${_GSD_SHIM_NAME}" ]; then GSD_TOOLS="${_GSD_RUNTIME_ROOT}/.claude/gsd-core/bin/${_GSD_SHIM_NAME}"; gsd_run() { node "$GSD_TOOLS" "$@"; }; elif command -v gsd-tools >/dev/null 2>&1; then GSD_TOOLS="$(command -v gsd-tools)"; gsd_run() { "$GSD_TOOLS" "$@"; }; elif [ -f "$HOME/.claude/gsd-core/bin/${_GSD_SHIM_NAME}" ]; then GSD_TOOLS="$HOME/.claude/gsd-core/bin/${_GSD_SHIM_NAME}"; gsd_run() { node "$GSD_TOOLS" "$@"; }; else echo "ERROR: gsd-tools.cjs not found at $GSD_TOOLS and gsd-tools is not on PATH. Run: npx -y @opengsd/gsd-core@latest --claude --local" >&2; exit 1; fi
 gsd_run query config-ensure-section
 if [[ -z "${GSD_CONFIG_PATH:-}" ]]; then
   if [[ -f .planning/active-workstream ]]; then

package/{get-shit-done → gsd-core}/workflows/settings.md

@@ -12,7 +12,7 @@ Read all files referenced by the invoking prompt's execution_context before star
 Ensure config exists and load current state:
 
 ```bash
-_GSD_SHIM_NAME="gsd-tools.cjs"; _GSD_RUNTIME_ROOT="${RUNTIME_DIR:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"; GSD_TOOLS="${_GSD_RUNTIME_ROOT}/get-shit-done/bin/${_GSD_SHIM_NAME}"; if [ -f "$GSD_TOOLS" ]; then gsd_run() { node "$GSD_TOOLS" "$@"; }; elif [ -f "${_GSD_RUNTIME_ROOT}/.claude/get-shit-done/bin/${_GSD_SHIM_NAME}" ]; then GSD_TOOLS="${_GSD_RUNTIME_ROOT}/.claude/get-shit-done/bin/${_GSD_SHIM_NAME}"; gsd_run() { node "$GSD_TOOLS" "$@"; }; elif command -v gsd-tools >/dev/null 2>&1; then GSD_TOOLS="$(command -v gsd-tools)"; gsd_run() { "$GSD_TOOLS" "$@"; }; elif [ -f "$HOME/.claude/get-shit-done/bin/${_GSD_SHIM_NAME}" ]; then GSD_TOOLS="$HOME/.claude/get-shit-done/bin/${_GSD_SHIM_NAME}"; gsd_run() { node "$GSD_TOOLS" "$@"; }; else echo "ERROR: gsd-tools.cjs not found at $GSD_TOOLS and gsd-tools is not on PATH. Run: npx -y @opengsd/gsd-core@latest --claude --local" >&2; exit 1; fi
+_GSD_SHIM_NAME="gsd-tools.cjs"; _GSD_RUNTIME_ROOT="${RUNTIME_DIR:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"; GSD_TOOLS="${_GSD_RUNTIME_ROOT}/gsd-core/bin/${_GSD_SHIM_NAME}"; if [ -f "$GSD_TOOLS" ]; then gsd_run() { node "$GSD_TOOLS" "$@"; }; elif [ -f "${_GSD_RUNTIME_ROOT}/.claude/gsd-core/bin/${_GSD_SHIM_NAME}" ]; then GSD_TOOLS="${_GSD_RUNTIME_ROOT}/.claude/gsd-core/bin/${_GSD_SHIM_NAME}"; gsd_run() { node "$GSD_TOOLS" "$@"; }; elif command -v gsd-tools >/dev/null 2>&1; then GSD_TOOLS="$(command -v gsd-tools)"; gsd_run() { "$GSD_TOOLS" "$@"; }; elif [ -f "$HOME/.claude/gsd-core/bin/${_GSD_SHIM_NAME}" ]; then GSD_TOOLS="$HOME/.claude/gsd-core/bin/${_GSD_SHIM_NAME}"; gsd_run() { node "$GSD_TOOLS" "$@"; }; else echo "ERROR: gsd-tools.cjs not found at $GSD_TOOLS and gsd-tools is not on PATH. Run: npx -y @opengsd/gsd-core@latest --claude --local" >&2; exit 1; fi
 gsd_run query config-ensure-section
 INIT=$(gsd_run query state.load)
 if [[ "$INIT" == @file:* ]]; then INIT=$(cat "${INIT#@file:}"); fi
@@ -57,6 +57,11 @@ Parse current values (default to `true` if not present):
 - `model_profile` — which model each agent uses (default: `balanced`)
 - `git.branching_strategy` — branching approach (default: `"none"`)
 - `workflow.use_worktrees` — whether parallel executor agents run in worktree isolation (default: `true`)
+- `model_policy.provider` — provider slug for model policy (default: `null`; known values: anthropic, openai, google, qwen; set via /gsd:config --advanced)
+- `model_policy.budget` — budget level for model policy (default: `null`; known values: high, medium, low; set via /gsd:config --advanced)
+- `model_policy.high` — model ID for high-cost tier (default: `null`; set via /gsd:config --advanced)
+- `model_policy.medium` — model ID for medium-cost tier (default: `null`; set via /gsd:config --advanced)
+- `model_policy.low` — model ID for low-cost tier (default: `null`; set via /gsd:config --advanced)
 </step>
 
 <step name="present_settings">
@@ -423,6 +428,15 @@ Merge new settings into existing config.json:
   "hooks": {
     "context_warnings": true/false,
     "workflow_guard": true/false
+  },
+  "model_policy": {
+    // Read-only in this flow — written only by /gsd:config --advanced (Section 8).
+    // Listed here so safe-merge never clobbers an existing model_policy object.
+    "provider": <existing|null>,
+    "budget": <existing|null>,
+    "high": <existing|null>,
+    "medium": <existing|null>,
+    "low": <existing|null>
   }
 }
 ```
@@ -537,7 +551,7 @@ Quick commands:
 - /gsd:plan-phase --research — force research
 - /gsd:plan-phase --skip-research — skip research
 - /gsd:plan-phase --skip-verify — skip plan check
-- /gsd:config --advanced — power-user tuning (plan bounce, timeouts, branch templates, cross-AI, context window)
+- /gsd:config --advanced — power-user tuning (plan bounce, timeouts, branch templates, cross-AI, context window, model policy)
 ```
 </step>