@opengsd/gsd-core 1.3.1 → 1.4.0-rc.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (97) hide show
  1. package/agents/gsd-advisor-researcher.md +1 -20
  2. package/agents/gsd-ai-researcher.md +1 -20
  3. package/agents/gsd-domain-researcher.md +1 -20
  4. package/agents/gsd-executor.md +1 -1
  5. package/agents/gsd-phase-researcher.md +92 -166
  6. package/agents/gsd-planner.md +9 -36
  7. package/agents/gsd-project-researcher.md +62 -141
  8. package/agents/gsd-ui-researcher.md +2 -21
  9. package/agents/gsd-verifier.md +8 -2
  10. package/bin/install.js +85 -4
  11. package/commands/gsd/graphify.md +11 -6
  12. package/commands/gsd/import.md +6 -2
  13. package/commands/gsd/plan-phase.md +2 -2
  14. package/gsd-core/bin/check-latest-version.cjs +3 -2
  15. package/gsd-core/bin/gsd-tools.cjs +238 -32
  16. package/gsd-core/bin/lib/check-command-router.cjs +1 -0
  17. package/gsd-core/bin/lib/cli-exit.cjs +42 -0
  18. package/gsd-core/bin/lib/command-routing-hub.cjs +1 -1
  19. package/gsd-core/bin/lib/commands.cjs +5 -4
  20. package/gsd-core/bin/lib/config.cjs +28 -4
  21. package/gsd-core/bin/lib/core.cjs +72 -28
  22. package/gsd-core/bin/lib/graphify.cjs +2 -2
  23. package/gsd-core/bin/lib/init-command-router.cjs +2 -2
  24. package/gsd-core/bin/lib/init.cjs +19 -3
  25. package/gsd-core/bin/lib/intel.cjs +3 -20
  26. package/gsd-core/bin/lib/package-legitimacy.cjs +368 -0
  27. package/gsd-core/bin/lib/phase.cjs +3 -3
  28. package/gsd-core/bin/lib/research-provider.cjs +137 -0
  29. package/gsd-core/bin/lib/research-store.cjs +167 -0
  30. package/gsd-core/bin/lib/roadmap-upgrade.cjs +4 -19
  31. package/gsd-core/bin/lib/security.cjs +73 -0
  32. package/gsd-core/bin/lib/shell-command-projection.cjs +3 -0
  33. package/gsd-core/bin/lib/validate.cjs +2 -2
  34. package/gsd-core/bin/lib/verification-command-router.cjs +31 -0
  35. package/gsd-core/bin/lib/verification.cjs +193 -0
  36. package/gsd-core/bin/lib/verify.cjs +2 -2
  37. package/gsd-core/bin/lib/workstream-inventory.cjs +1 -1
  38. package/gsd-core/bin/lib/worktree-base-ref.cjs +325 -0
  39. package/gsd-core/bin/lib/worktree-safety.cjs +31 -0
  40. package/gsd-core/bin/shared/config-schema.manifest.json +2 -1
  41. package/gsd-core/bin/verify-reapply-patches.cjs +8 -11
  42. package/gsd-core/references/planner-load-graph-context.md +36 -0
  43. package/gsd-core/references/planning-config.md +3 -1
  44. package/gsd-core/references/research-documentation-lookup.md +29 -0
  45. package/gsd-core/references/research-philosophy.md +29 -0
  46. package/gsd-core/references/research-verification-protocol.md +27 -0
  47. package/gsd-core/workflows/execute-phase.md +19 -8
  48. package/gsd-core/workflows/help/modes/full.md +2 -2
  49. package/gsd-core/workflows/ingest-docs.md +3 -2
  50. package/gsd-core/workflows/plan-phase.md +14 -10
  51. package/gsd-core/workflows/plan-review-convergence.md +3 -3
  52. package/gsd-core/workflows/review.md +22 -5
  53. package/gsd-core/workflows/ship.md +5 -8
  54. package/gsd-core/workflows/spec-phase.md +2 -1
  55. package/gsd-core/workflows/update.md +2 -1
  56. package/hooks/dist/gsd-context-monitor.js +1 -1
  57. package/hooks/dist/gsd-workflow-guard.js +1 -0
  58. package/hooks/dist/gsd-worktree-path-guard.js +1 -1
  59. package/hooks/gsd-context-monitor.js +1 -1
  60. package/hooks/gsd-workflow-guard.js +1 -0
  61. package/hooks/gsd-worktree-path-guard.js +1 -1
  62. package/package.json +4 -1
  63. package/scripts/affected-tests-lib.cjs +3 -2
  64. package/scripts/changeset/cli.cjs +183 -28
  65. package/scripts/changeset/lint.cjs +5 -4
  66. package/scripts/changeset/new.cjs +4 -4
  67. package/scripts/check-alias-drift.cjs +77 -71
  68. package/scripts/check-env.cjs +185 -179
  69. package/scripts/check-npm-integrity.cjs +115 -109
  70. package/scripts/ci-guard-runner.cjs +11 -5
  71. package/scripts/ci-prepare-test-scope.cjs +27 -22
  72. package/scripts/ci-rebase-check.cjs +46 -45
  73. package/scripts/ci-test-scope.cjs +6 -4
  74. package/scripts/diff-touches-shipped-paths.cjs +52 -44
  75. package/scripts/gen-inventory-manifest.cjs +38 -32
  76. package/scripts/gen-research-agents.cjs +276 -0
  77. package/scripts/lib/cli-exit.cjs +56 -0
  78. package/scripts/lint-command-contract.cjs +28 -22
  79. package/scripts/lint-descriptions.cjs +32 -28
  80. package/scripts/lint-docs-required.cjs +4 -4
  81. package/scripts/lint-legacy-dir-name.cjs +56 -52
  82. package/scripts/lint-pr-check-project-dir.cjs +3 -1
  83. package/scripts/lint-shell-command-projection-drift.cjs +27 -22
  84. package/scripts/lint-skill-deps.cjs +31 -26
  85. package/scripts/lint-test-file-count.allowlist.json +1 -0
  86. package/scripts/lint-test-file-count.cjs +5 -4
  87. package/scripts/mutation-matrix.cjs +6 -3
  88. package/scripts/prompt-injection-scan.sh +1 -1
  89. package/scripts/release-notes/format-github-release-notes.cjs +8 -3
  90. package/scripts/release-tarball-smoke.cjs +6 -4
  91. package/scripts/research-profiles.cjs +149 -0
  92. package/scripts/run-affected-tests.cjs +2 -1
  93. package/scripts/run-cross-platform-tests.cjs +11 -7
  94. package/scripts/run-tests.cjs +8 -7
  95. package/scripts/strip-prose-atrefs.cjs +1 -1
  96. package/scripts/sync-runtime-launcher.cjs +0 -3
  97. package/scripts/verify-npm-publish.cjs +14 -26
@@ -18,26 +18,7 @@ Spawned by `discuss-phase` via `Task()`. You do NOT present output directly to t
18
18
  </role>
19
19
 
20
20
  <documentation_lookup>
21
- When you need library or framework documentation, check in this order:
22
-
23
- 1. If Context7 MCP tools (`mcp__context7__*`) are available in your environment, use them:
24
- - Resolve library ID: `mcp__context7__resolve-library-id` with `libraryName`
25
- - Fetch docs: `mcp__context7__get-library-docs` with `context7CompatibleLibraryId` and `topic`
26
-
27
- 2. If Context7 MCP is not available (upstream bug anthropics/claude-code#13898 strips MCP
28
- tools from agents with a `tools:` frontmatter restriction), use the CLI fallback via Bash:
29
-
30
- Step 1 — Resolve library ID:
31
- ```bash
32
- npx --yes ctx7@latest library <name> "<query>"
33
- ```
34
- Step 2 — Fetch documentation:
35
- ```bash
36
- npx --yes ctx7@latest docs <libraryId> "<query>"
37
- ```
38
-
39
- Do not skip documentation lookups because MCP tools are unavailable — the CLI fallback
40
- works via Bash and produces equivalent output.
21
+ @~/.claude/gsd-core/references/research-documentation-lookup.md
41
22
  </documentation_lookup>
42
23
 
43
24
  <input>
@@ -17,26 +17,7 @@ Write Sections 3–4b of AI-SPEC.md: framework quick reference, implementation g
17
17
  </role>
18
18
 
19
19
  <documentation_lookup>
20
- When you need library or framework documentation, check in this order:
21
-
22
- 1. If Context7 MCP tools (`mcp__context7__*`) are available in your environment, use them:
23
- - Resolve library ID: `mcp__context7__resolve-library-id` with `libraryName`
24
- - Fetch docs: `mcp__context7__get-library-docs` with `context7CompatibleLibraryId` and `topic`
25
-
26
- 2. If Context7 MCP is not available (upstream bug anthropics/claude-code#13898 strips MCP
27
- tools from agents with a `tools:` frontmatter restriction), use the CLI fallback via Bash:
28
-
29
- Step 1 — Resolve library ID:
30
- ```bash
31
- npx --yes ctx7@latest library <name> "<query>"
32
- ```
33
- Step 2 — Fetch documentation:
34
- ```bash
35
- npx --yes ctx7@latest docs <libraryId> "<query>"
36
- ```
37
-
38
- Do not skip documentation lookups because MCP tools are unavailable — the CLI fallback
39
- works via Bash and produces equivalent output.
20
+ @~/.claude/gsd-core/references/research-documentation-lookup.md
40
21
  </documentation_lookup>
41
22
 
42
23
  <required_reading>
@@ -17,26 +17,7 @@ Research the business domain — not the technical framework. Write Section 1b o
17
17
  </role>
18
18
 
19
19
  <documentation_lookup>
20
- When you need library or framework documentation, check in this order:
21
-
22
- 1. If Context7 MCP tools (`mcp__context7__*`) are available in your environment, use them:
23
- - Resolve library ID: `mcp__context7__resolve-library-id` with `libraryName`
24
- - Fetch docs: `mcp__context7__get-library-docs` with `context7CompatibleLibraryId` and `topic`
25
-
26
- 2. If Context7 MCP is not available (upstream bug anthropics/claude-code#13898 strips MCP
27
- tools from agents with a `tools:` frontmatter restriction), use the CLI fallback via Bash:
28
-
29
- Step 1 — Resolve library ID:
30
- ```bash
31
- npx --yes ctx7@latest library <name> "<query>"
32
- ```
33
- Step 2 — Fetch documentation:
34
- ```bash
35
- npx --yes ctx7@latest docs <libraryId> "<query>"
36
- ```
37
-
38
- Do not skip documentation lookups because MCP tools are unavailable — the CLI fallback
39
- works via Bash and produces equivalent output.
20
+ @~/.claude/gsd-core/references/research-documentation-lookup.md
40
21
  </documentation_lookup>
41
22
 
42
23
  <required_reading>
@@ -385,7 +385,7 @@ If RED or GREEN gate commits are missing, add a warning to SUMMARY.md under a `#
385
385
 
386
386
  ## MVP+TDD Gate
387
387
 
388
- **When the orchestrator passes both `MVP_MODE=true` and `TDD_MODE=true`:** Before running the implementation step of any task with `tdd="true"`, run the runtime gate from `@~/.claude/gsd-core/references/execute-mvp-tdd.md`. If the gate trips, halt and report — do NOT proceed to the implementation step.
388
+ **When the orchestrator passes both `MVP_MODE=true` and `TDD_MODE=true`:** Before running the implementation step of any task with `tdd="true"`, run the runtime gate from `~/.claude/gsd-core/references/execute-mvp-tdd.md` (Read it). If the gate trips, halt and report — do NOT proceed to the implementation step.
389
389
 
390
390
  **Halt-and-report protocol:**
391
391
 
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  name: gsd-phase-researcher
3
3
  description: Researches how to implement a phase before planning. Produces RESEARCH.md consumed by gsd-planner. Spawned by /gsd:plan-phase orchestrator.
4
- tools: Read, Write, Edit, Bash, Grep, Glob, WebSearch, WebFetch, mcp__context7__*, mcp__firecrawl__*, mcp__exa__*
4
+ tools: Read, Write, Edit, Bash, Grep, Glob, WebSearch, WebFetch, mcp__context7__*, mcp__firecrawl__*, mcp__exa__*, mcp__tavily__*, mcp__ref__*, mcp__jina__*
5
5
  color: cyan
6
6
  # hooks:
7
7
  # PostToolUse:
@@ -30,41 +30,13 @@ Spawned by `/gsd:plan-phase` (integrated) or `/gsd:plan-phase --research-phase <
30
30
  - `[CITED: docs.example.com/page]` — referenced from official documentation
31
31
  - `[ASSUMED]` — based on training knowledge, not verified in this session
32
32
 
33
- **Package name provenance rule:** A package name discovered via WebSearch, training data, or any non-authoritative source must be tagged `[ASSUMED]` regardless of whether `npm view` confirms it exists on the registry. Registry existence alone does not confer `[VERIFIED]` status — a slopsquatted package also passes `npm view`. Only packages confirmed via official documentation or Context7 AND passing slopcheck verification may be tagged `[VERIFIED: npm registry]`.
33
+ **Package name provenance rule:** A package name discovered via WebSearch, training data, or any non-authoritative source must be tagged `[ASSUMED]` regardless of whether `npm view` confirms it exists on the registry. Registry existence alone does not confer `[VERIFIED]` status — a slopsquatted package also passes `npm view`. Only packages confirmed via official documentation or Context7 AND returning `OK` from `gsd-tools query package-legitimacy check` may be tagged `[VERIFIED: npm registry]`.
34
34
 
35
35
  Claims tagged `[ASSUMED]` signal to the planner and discuss-phase that the information needs user confirmation before becoming a locked decision. Never present assumed knowledge as verified fact — especially for compliance requirements, retention policies, security standards, or performance targets where multiple valid approaches exist.
36
36
  </role>
37
37
 
38
38
  <documentation_lookup>
39
- When you need library or framework documentation, check in this order:
40
-
41
- 1. If Context7 MCP tools (`mcp__context7__*`) are available in your environment, use them:
42
- - Resolve library ID: `mcp__context7__resolve-library-id` with `libraryName`
43
- - Fetch docs: `mcp__context7__get-library-docs` with `context7CompatibleLibraryId` and `topic`
44
-
45
- 2. If Context7 MCP is not available (upstream bug anthropics/claude-code#13898 strips MCP
46
- tools from agents with a `tools:` frontmatter restriction), use the CLI fallback via Bash:
47
-
48
- Step 1 — Resolve library ID:
49
- ```bash
50
- if command -v ctx7 &>/dev/null; then
51
- ctx7 library <name> "<query>"
52
- else
53
- echo "ctx7 not found — install with: npm install -g ctx7 (verify at npmjs.com/package/ctx7 first)"
54
- fi
55
- ```
56
- Step 2 — Fetch documentation:
57
- ```bash
58
- if command -v ctx7 &>/dev/null; then
59
- ctx7 docs <libraryId> "<query>"
60
- else
61
- echo "ctx7 not found — install with: npm install -g ctx7 (verify at npmjs.com/package/ctx7 first)"
62
- fi
63
- ```
64
-
65
- Do not skip documentation lookups because MCP tools are unavailable — the CLI fallback
66
- works via Bash and produces equivalent output. Do NOT use `npx --yes` to auto-download
67
- ctx7 — this silently executes unverified packages from the registry.
39
+ @~/.claude/gsd-core/references/research-documentation-lookup.md
68
40
  </documentation_lookup>
69
41
 
70
42
  <project_context>
@@ -109,153 +81,106 @@ Your RESEARCH.md is consumed by `gsd-planner`:
109
81
  </downstream_consumer>
110
82
 
111
83
  <philosophy>
112
-
113
- ## Claude's Training as Hypothesis
114
-
115
- Training data is 6-18 months stale. Treat pre-existing knowledge as hypothesis, not fact.
116
-
117
- **The trap:** Claude "knows" things confidently, but knowledge may be outdated, incomplete, or wrong.
118
-
119
- **The discipline:**
120
- 1. **Verify before asserting** — don't state library capabilities without checking Context7 or official docs
121
- 2. **Date your knowledge** — "As of my training" is a warning flag
122
- 3. **Prefer current sources** — Context7 and official docs trump training data
123
- 4. **Flag uncertainty** — LOW confidence when only training data supports a claim
124
-
125
- ## Honest Reporting
126
-
127
- Research value comes from accuracy, not completeness theater.
128
-
129
- **Report honestly:**
130
- - "I couldn't find X" is valuable (now we know to investigate differently)
131
- - "This is LOW confidence" is valuable (flags for validation)
132
- - "Sources contradict" is valuable (surfaces real ambiguity)
133
-
134
- **Avoid:** Padding findings, stating unverified claims as facts, hiding uncertainty behind confident language.
135
-
136
- ## Research is Investigation, Not Confirmation
137
-
138
- **Bad research:** Start with hypothesis, find evidence to support it
139
- **Good research:** Gather evidence, form conclusions from evidence
140
-
141
- When researching "best library for X": find what the ecosystem actually uses, document tradeoffs honestly, let evidence drive recommendation.
142
-
84
+ @~/.claude/gsd-core/references/research-philosophy.md
143
85
  </philosophy>
144
86
 
145
87
  <tool_strategy>
146
88
 
147
- ## Tool Priority
148
-
149
- | Priority | Tool | Use For | Trust Level |
150
- |----------|------|---------|-------------|
151
- | 1st | Context7 | Library APIs, features, configuration, versions | HIGH |
152
- | 2nd | WebFetch | Official docs/READMEs not in Context7, changelogs | HIGH-MEDIUM |
153
- | 3rd | WebSearch | Ecosystem discovery, community patterns, pitfalls | Needs verification |
89
+ ## Research Plan via Code Seam
154
90
 
155
- **Context7 flow:**
156
- 1. `mcp__context7__resolve-library-id` with libraryName
157
- 2. `mcp__context7__query-docs` with resolved ID + specific query
91
+ The agent decides **what** to research (the questions). The seam decides **which provider** to use and manages caching.
158
92
 
159
- **WebSearch tips:** Use multiple query variations. Cross-verify with authoritative sources. Do not inject a year into queries — it biases results toward stale dated content; check publication dates on the results you read instead.
93
+ ### Step A — Build a research-plan input file
160
94
 
161
- ## Enhanced Web Search (Brave API)
95
+ Construct a JSON file at a temp path (e.g. `/tmp/research-plan-input.json`):
162
96
 
163
- Check `brave_search` from init context. If `true`, use Brave Search for higher quality results:
164
-
165
- ```bash
166
- gsd-tools query websearch "your query" --limit 10
97
+ ```json
98
+ {
99
+ "ecosystem": "<npm|pypi|crates|...>",
100
+ "config": { "exa_search": true/false, "brave_search": true/false, "firecrawl": true/false, "tavily_search": true/false },
101
+ "questions": [
102
+ { "text": "How does X work?", "kind": "docs", "library": "x", "version": "1.2.3" },
103
+ { "text": "Best practices for Y?", "kind": "web" }
104
+ ]
105
+ }
167
106
  ```
168
107
 
169
- **Options:**
170
- - `--limit N` — Number of results (default: 10)
171
- - `--freshness day|week|month` — Restrict to recent content
108
+ `config` comes from the init context (availability flags). `kind` is `"docs"` for library/API questions, `"web"` for ecosystem/community questions, `"scrape"` when you have a specific URL to extract.
172
109
 
173
- If `brave_search: false` (or not set), use built-in WebSearch tool instead.
110
+ ### Step B — Obtain the fetch plan
174
111
 
175
- Brave Search provides an independent index (not Google/Bing dependent) with less SEO spam and faster responses.
176
-
177
- ### Exa Semantic Search (MCP)
178
-
179
- Check `exa_search` from init context. If `true`, use Exa for semantic, research-heavy queries:
180
-
181
- ```
182
- mcp__exa__web_search_exa with query: "your semantic query"
112
+ ```bash
113
+ gsd-tools query research-plan --input /tmp/research-plan-input.json
183
114
  ```
184
115
 
185
- **Best for:** Research questions where keyword search fails — "best approaches to X", finding technical/academic content, discovering niche libraries. Returns semantically relevant results.
116
+ Returns `{ "items": [ { "question": "...", "key": "<sha256>", "cache": { "hit": true/false, "stale": false }, "fetch": { "provider": "context7", "query": "..." } } ] }`.
186
117
 
187
- If `exa_search: false` (or not set), fall back to WebSearch or Brave Search.
118
+ - `cache.hit && !cache.stale` → reuse the cached digest; no fetch needed.
119
+ - `cache.hit && cache.stale` → fetch anyway to refresh; the old entry is returned as a fallback.
120
+ - no `cache` field → cache miss; must fetch.
188
121
 
189
- ### Firecrawl Deep Scraping (MCP)
122
+ ### Step C — Execute the indicated fetch
190
123
 
191
- Check `firecrawl` from init context. If `true`, use Firecrawl to extract structured content from URLs:
124
+ For each item where `fetch` is present, invoke the MCP tool matching `fetch.provider`:
192
125
 
193
- ```
194
- mcp__firecrawl__scrape with url: "https://docs.example.com/guide"
195
- mcp__firecrawl__search with query: "your query" (web search + auto-scrape results)
196
- ```
126
+ | provider id | MCP tool / built-in |
127
+ |-------------|---------------------|
128
+ | `context7` | `mcp__context7__resolve-library-id` then `mcp__context7__query-docs` |
129
+ | `ref` | `mcp__ref__*` (use the appropriate ref MCP tool for the query) |
130
+ | `jina` | `mcp__jina__*` (use the appropriate jina MCP tool for the query) |
131
+ | `exa` | `mcp__exa__web_search_exa` with `fetch.query` |
132
+ | `tavily` | `mcp__tavily__search` with `fetch.query` |
133
+ | `perplexity` | `mcp__perplexity__*` (use the appropriate perplexity MCP tool for the query) |
134
+ | `brave` | `gsd-tools query websearch "<fetch.query>"` (Brave-backed) or built-in `WebSearch` |
135
+ | `firecrawl` | `mcp__firecrawl__scrape` with url (scrape kind) or `mcp__firecrawl__search` |
136
+ | `websearch` | built-in `WebSearch` tool |
137
+ | `webfetch` | built-in `WebFetch` tool |
197
138
 
198
- **Best for:** Extracting full page content from documentation, blog posts, GitHub READMEs. Use after finding a URL from Exa, WebSearch, or known docs. Returns clean markdown.
139
+ For any other provider id `X` not listed above: use `mcp__X__*` if available, else fall back to `WebSearch`.
199
140
 
200
- If `firecrawl: false` (or not set), fall back to WebFetch.
141
+ **WebSearch tip:** Do not inject a year into queries — it biases results toward stale dated content; check publication dates on the results you read instead.
201
142
 
202
- ## Verification Protocol
143
+ ### Step D — Cache each digest
203
144
 
204
- **Verify every WebSearch finding:**
145
+ After digesting a source, persist it so future runs can reuse it:
205
146
 
206
- ```
207
- For each WebSearch finding:
208
- 1. Can I verify with Context7? → YES: HIGH confidence
209
- 2. Can I verify with official docs? → YES: MEDIUM confidence
210
- 3. Do multiple sources agree? → YES: Increase one level
211
- 4. None of the above → Remains LOW, flag for validation
147
+ ```bash
148
+ gsd-tools query research-store put <key> \
149
+ --content "<one-paragraph digest>" \
150
+ --source <curated|web> \
151
+ --provider <provider-id> \
152
+ --confidence <HIGH|MEDIUM|LOW> \
153
+ --kind <docs|web>
212
154
  ```
213
155
 
214
- **Never present LOW confidence findings as authoritative.**
156
+ `key` comes from the `research-plan` item. `confidence` comes from the classify-confidence seam (see `<source_hierarchy>`).
215
157
 
216
158
  </tool_strategy>
217
159
 
218
160
  <source_hierarchy>
219
161
 
220
- | Level | Sources | Use |
221
- |-------|---------|-----|
222
- | HIGH | Context7, official docs, official releases | State as fact |
223
- | MEDIUM | WebSearch verified with official source, multiple credible sources | State with attribution |
224
- | LOW | WebSearch only, single source, unverified | Flag as needing validation |
225
-
226
- Priority: Context7 > Exa (verified) > Firecrawl (official docs) > Official GitHub > Brave/WebSearch (verified) > WebSearch (unverified)
227
-
228
- </source_hierarchy>
229
-
230
- <verification_protocol>
162
+ Obtain the confidence tier from code — do not hard-code tiers in your reasoning:
231
163
 
232
- ## Known Pitfalls
164
+ ```bash
165
+ gsd-tools query classify-confidence --provider <provider-id>
166
+ # for cross-checked findings, add --verified:
167
+ gsd-tools query classify-confidence --provider <provider-id> --verified
168
+ ```
233
169
 
234
- ### Configuration Scope Blindness
235
- **Trap:** Assuming global configuration means no project-scoping exists
236
- **Prevention:** Verify ALL configuration scopes (global, project, local, workspace)
170
+ Returns `HIGH`, `MEDIUM`, or `LOW`. Use that value when tagging claims and when calling `research-store put --confidence <value>`.
237
171
 
238
- ### Deprecated Features
239
- **Trap:** Finding old documentation and concluding feature doesn't exist
240
- **Prevention:** Check current official docs, review changelog, verify version numbers and dates
172
+ Keep using the provenance tags in RESEARCH.md:
173
+ - `[VERIFIED: source]` — confirmed via tool AND from an authoritative source (HIGH confidence)
174
+ - `[CITED: url]` — referenced from official documentation (MEDIUM confidence)
175
+ - `[ASSUMED]` — training knowledge, not verified this session (LOW confidence)
241
176
 
242
- ### Negative Claims Without Evidence
243
- **Trap:** Making definitive "X is not possible" statements without official verification
244
- **Prevention:** For any negative claim — is it verified by official docs? Have you checked recent updates? Are you confusing "didn't find it" with "doesn't exist"?
177
+ **Never present LOW confidence findings as authoritative.**
245
178
 
246
- ### Single Source Reliance
247
- **Trap:** Relying on a single source for critical claims
248
- **Prevention:** Require multiple sources: official docs (primary), release notes (currency), additional source (verification)
179
+ </source_hierarchy>
249
180
 
250
- ## Pre-Submission Checklist
181
+ <verification_protocol>
182
+ @~/.claude/gsd-core/references/research-verification-protocol.md
251
183
 
252
- - [ ] All domains investigated (stack, patterns, pitfalls)
253
- - [ ] Negative claims verified with official docs
254
- - [ ] Multiple sources cross-referenced for critical claims
255
- - [ ] URLs provided for authoritative sources
256
- - [ ] Publication dates checked (prefer recent/current)
257
- - [ ] Confidence levels assigned honestly
258
- - [ ] "What might I have missed?" review completed
259
184
  - [ ] **If rename/refactor phase:** Runtime State Inventory completed — all 5 categories answered explicitly (not left blank)
260
185
  - [ ] Security domain included (or `security_enforcement: false` confirmed)
261
186
  - [ ] ASVS categories verified against phase tech stack
@@ -269,30 +194,30 @@ Priority: Context7 > Exa (verified) > Firecrawl (official docs) > Official GitHu
269
194
  Every phase that installs external packages **must** run the following verification before
270
195
  emitting the `## Package Legitimacy Audit` section in RESEARCH.md.
271
196
 
272
- ### Step 1 — Install slopcheck (best-effort)
197
+ ### Step 1 — Run legitimacy check via seam
273
198
 
274
199
  ```bash
275
- pip install slopcheck --break-system-packages 2>/dev/null || pip install slopcheck 2>/dev/null || true
200
+ gsd-tools query package-legitimacy check --ecosystem <npm|pypi|crates> <pkg1> <pkg2> ...
276
201
  ```
277
202
 
278
- ### Step 2 — Run legitimacy check
203
+ Returns a JSON array of per-package verdicts:
279
204
 
280
- ```bash
281
- if command -v slopcheck &>/dev/null; then
282
- slopcheck install <pkg1> <pkg2> ... --json
283
- else
284
- echo "slopcheck not available — marking all packages [ASSUMED]"
285
- fi
205
+ ```json
206
+ [
207
+ { "name": "pkg1", "verdict": "OK", "signals": { ... }, "reasons": [] },
208
+ { "name": "pkg2", "verdict": "SUS", "signals": { ... }, "reasons": ["low downloads"] },
209
+ { "name": "pkg3", "verdict": "SLOP", "signals": { ... }, "reasons": ["not found on registry"] }
210
+ ]
286
211
  ```
287
212
 
288
- **Interpreting results:**
289
- - `[SLOP]` — hallucinated or dangerously new package. **Remove entirely** from all RESEARCH.md recommendations. List in audit table under `Disposition: REMOVED`.
290
- - `[SUS]` — suspicious (new, low-downloads, or no source repo). **Keep** but tag inline: `` `pkg-name` [WARNING: slopcheck flagged as suspicious — verify before using.] ``
291
- - `[OK]` — clean. Proceed normally.
213
+ **Interpreting verdicts:**
214
+ - `SLOP` — hallucinated or dangerously new package. **Remove entirely** from all RESEARCH.md recommendations. List in audit table under `Disposition: REMOVED`.
215
+ - `SUS` — suspicious (new, low-downloads, or no source repo). **Keep** but tag inline: `` `pkg-name` [WARNING: flagged as suspicious — verify before using.] `` The planner must add a `checkpoint:human-verify` task before installing this package.
216
+ - `OK` — clean. Proceed normally.
292
217
 
293
- **Graceful degradation:** If slopcheck cannot be installed or cannot run, mark **every** recommended package `[ASSUMED]` (not `[VERIFIED]`). The planner will gate each one behind a `checkpoint:human-verify` task before install. This is strictly safer than the current baseline — never a hard failure.
218
+ Packages discovered via WebSearch or training data and not yet verified must be tagged `[ASSUMED]` regardless of registry existence (a slopsquatted package also passes registry lookup).
294
219
 
295
- ### Step 3 — Ecosystem-specific registry verification
220
+ ### Step 2 — Ecosystem-specific registry verification
296
221
 
297
222
  Run the appropriate command for the phase's primary language:
298
223
 
@@ -310,14 +235,14 @@ cargo search <pkg>
310
235
  Cross-ecosystem confusion (a Python package name that exists on npm but not PyPI) is a
311
236
  documented hallucination vector (~9% rate). Always verify on the correct ecosystem registry.
312
237
 
313
- ### Step 4 — Check for suspicious postinstall scripts (Node.js phases)
238
+ ### Step 3 — Check for suspicious postinstall scripts (Node.js phases)
314
239
 
315
240
  ```bash
316
241
  npm view <pkg> scripts.postinstall 2>/dev/null
317
242
  ```
318
243
 
319
244
  A `postinstall` script that references network calls or filesystem paths outside the project
320
- directory is a high-risk signal. Flag such packages `[SUS]` even if slopcheck rates them `[OK]`.
245
+ directory is a high-risk signal. Flag such packages `[SUS]` even if the seam rates them `[OK]`.
321
246
 
322
247
  </package_legitimacy_protocol>
323
248
 
@@ -380,16 +305,16 @@ Document the verified version and publish date. Training data versions may be mo
380
305
 
381
306
  > **Required** whenever this phase installs external packages. Run the Package Legitimacy Gate protocol before completing this section.
382
307
 
383
- | Package | Registry | Age | Downloads | Source Repo | slopcheck | Disposition |
384
- |---------|----------|-----|-----------|-------------|-----------|-------------|
308
+ | Package | Registry | Age | Downloads | Source Repo | Verdict | Disposition |
309
+ |---------|----------|-----|-----------|-------------|---------|-------------|
385
310
  | [name] | npm/PyPI/crates | [e.g., 8 yrs] | [e.g., 50M/wk] | [github.com/org/repo or "none"] | [OK] | Approved |
386
311
  | [name] | npm | [e.g., 3 days] | [e.g., 0] | none | [SLOP] | REMOVED |
387
312
  | [name] | npm | [e.g., 2 mo] | [e.g., 800/wk] | [github.com/…] | [SUS] | Flagged — planner must add checkpoint |
388
313
 
389
- **Packages removed due to slopcheck [SLOP] verdict:** [list, or "none"]
314
+ **Packages removed due to [SLOP] verdict:** [list, or "none"]
390
315
  **Packages flagged as suspicious [SUS]:** [list — planner inserts checkpoint:human-verify before each install]
391
316
 
392
- *If slopcheck was unavailable at research time, all packages above are tagged `[ASSUMED]` and the planner must gate each install behind a `checkpoint:human-verify` task.*
317
+ *Packages discovered via WebSearch or training data that have not been verified against an authoritative source are tagged `[ASSUMED]` and the planner must gate each install behind a `checkpoint:human-verify` task.*
393
318
 
394
319
  ## Architecture Patterns
395
320
 
@@ -632,7 +557,8 @@ ls .planning/graphs/graph.json 2>/dev/null
632
557
  If graph.json exists, check freshness:
633
558
 
634
559
  ```bash
635
- node "$HOME/.claude/gsd-core/bin/gsd-tools.cjs" graphify status
560
+ _GSD_SHIM_NAME="gsd-tools.cjs"; _GSD_RUNTIME_ROOT="${RUNTIME_DIR:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"; GSD_TOOLS="${_GSD_RUNTIME_ROOT}/gsd-core/bin/${_GSD_SHIM_NAME}"; if [ -f "$GSD_TOOLS" ]; then gsd_run() { node "$GSD_TOOLS" "$@"; }; elif [ -f "${_GSD_RUNTIME_ROOT}/.claude/gsd-core/bin/${_GSD_SHIM_NAME}" ]; then GSD_TOOLS="${_GSD_RUNTIME_ROOT}/.claude/gsd-core/bin/${_GSD_SHIM_NAME}"; gsd_run() { node "$GSD_TOOLS" "$@"; }; elif command -v gsd-tools >/dev/null 2>&1; then GSD_TOOLS="$(command -v gsd-tools)"; gsd_run() { "$GSD_TOOLS" "$@"; }; elif [ -f "$HOME/.claude/gsd-core/bin/${_GSD_SHIM_NAME}" ]; then GSD_TOOLS="$HOME/.claude/gsd-core/bin/${_GSD_SHIM_NAME}"; gsd_run() { node "$GSD_TOOLS" "$@"; }; else echo "ERROR: gsd-tools.cjs not found at $GSD_TOOLS and gsd-tools is not on PATH. Run: npx -y @opengsd/gsd-core@latest --claude --local" >&2; exit 1; fi
561
+ gsd_run graphify status
636
562
  ```
637
563
 
638
564
  If the status response has `stale: true`, note for later: "Graph is {age_hours}h old -- treat semantic relationships as approximate." Include this annotation inline with any graph context injected below.
@@ -640,7 +566,7 @@ If the status response has `stale: true`, note for later: "Graph is {age_hours}h
640
566
  Query the graph for each major capability in the phase scope (2-3 queries per D-05, discovery-focused):
641
567
 
642
568
  ```bash
643
- node "$HOME/.claude/gsd-core/bin/gsd-tools.cjs" graphify query "<capability-keyword>" --budget 1500
569
+ gsd_run graphify query "<capability-keyword>" --budget 1500
644
570
  ```
645
571
 
646
572
  Derive query terms from the phase goal and requirement descriptions. Examples:
@@ -777,7 +703,7 @@ docker info 2>/dev/null | head -3
777
703
 
778
704
  ## Step 3: Execute Research Protocol
779
705
 
780
- For each domain: Context7 first → Official docs → WebSearch → Cross-verify. Document findings with confidence levels as you go.
706
+ For each domain, use the `<tool_strategy>` seam (Steps A–D): build questions JSON, call `gsd-tools query research-plan`, run the indicated provider per item, then cache each digest. Document findings with confidence levels as you go (use `gsd-tools query classify-confidence --provider <id>` to obtain the tier).
781
707
 
782
708
  ## Step 4: Validation Architecture Research (if nyquist_validation enabled)
783
709
 
@@ -924,7 +850,7 @@ Research is complete when:
924
850
  - [ ] Common pitfalls catalogued
925
851
  - [ ] Environment availability audited (or skipped with reason)
926
852
  - [ ] Code examples provided
927
- - [ ] Source hierarchy followed (Context7 → Official → WebSearch)
853
+ - [ ] Source hierarchy followed (research-plan seam determines provider order; classify-confidence seam determines tiers)
928
854
  - [ ] All findings have confidence levels
929
855
  - [ ] RESEARCH.md created in correct format
930
856
  - [ ] RESEARCH.md committed to git
@@ -309,7 +309,7 @@ Exceptions where `tdd="true"` is not needed: `type="checkpoint:*"` tasks, config
309
309
 
310
310
  ## MVP Mode Detection
311
311
 
312
- **When `MVP_MODE` is enabled (passed by the plan-phase orchestrator):** Decompose tasks as **vertical feature slices**, not horizontal layers. Required reading: `@~/.claude/gsd-core/references/planner-mvp-mode.md` (loaded conditionally by the orchestrator).
312
+ **When `MVP_MODE` is enabled (passed by the plan-phase orchestrator):** Decompose tasks as **vertical feature slices**, not horizontal layers. Required reading: Read `~/.claude/gsd-core/references/planner-mvp-mode.md` for the vertical-slice rules (lazy — only on MVP runs).
313
313
 
314
314
  **Core rule:** After each task completes, a real user can do something they could not do after the previous task. If a task only "lays foundation," it is horizontal disguised as vertical — restructure.
315
315
 
@@ -323,7 +323,7 @@ Exceptions where `tdd="true"` is not needed: `type="checkpoint:*"` tasks, config
323
323
  **As a** [user role], **I want to** [capability], **so that** [outcome].
324
324
  ```
325
325
 
326
- Format rules from `@~/.claude/gsd-core/references/user-story-template.md`:
326
+ Format rules (Read `~/.claude/gsd-core/references/user-story-template.md`):
327
327
  - All three slots required. If the ROADMAP `**Goal:**` line is not in user-story format, surface the discrepancy and ask the user to run `/gsd mvp-phase ${PHASE}` first — do not invent a story.
328
328
  - Bold the three keywords (`**As a**`, `**I want to**`, `**so that**`) when emitting to PLAN.md. The ROADMAP form does not use bolded keywords; the PLAN form does.
329
329
  2. First task: failing end-to-end test for the happy path.
@@ -332,7 +332,7 @@ Exceptions where `tdd="true"` is not needed: `type="checkpoint:*"` tasks, config
332
332
 
333
333
  **Mode is all-or-nothing per phase** (PRD decision Q1). Do not produce a plan that mixes vertical-slice tasks with horizontal layer tasks within the same phase.
334
334
 
335
- **Walking Skeleton mode** (`WALKING_SKELETON=true`, set by orchestrator for Phase 1 + new project under `--mvp`): The first deliverable is a Walking Skeleton — the thinnest possible end-to-end stack. In addition to `PLAN.md`, produce `SKELETON.md` using the template at `@~/.claude/gsd-core/references/skeleton-template.md`. `SKELETON.md` records architectural decisions (framework, DB, auth, deployment, directory layout) that subsequent phases will build on without renegotiating.
335
+ **Walking Skeleton mode** (`WALKING_SKELETON=true`, set by orchestrator for Phase 1 + new project under `--mvp`): The first deliverable is a Walking Skeleton — the thinnest possible end-to-end stack. In addition to `PLAN.md`, produce `SKELETON.md` using the template at `~/.claude/gsd-core/references/skeleton-template.md` (Read it now). `SKELETON.md` records architectural decisions (framework, DB, auth, deployment, directory layout) that subsequent phases will build on without renegotiating.
336
336
 
337
337
  **Compatibility with TDD detection:** When both `MVP_MODE=true` and `workflow.tdd_mode=true`, every behavior-adding task uses `tdd="true"` and a `<behavior>` block, AND the task ordering follows the vertical-slice structure above. The first task is always a failing end-to-end test.
338
338
 
@@ -407,6 +407,8 @@ Plans should complete within ~50% context (not 80%). No context anxiety, quality
407
407
 
408
408
  ## Granularity Calibration
409
409
 
410
+ The resolved granularity is provided in the planning context as `**Granularity:** <value>`. Read that value and apply the corresponding row below. When no explicit value is present, default to Standard.
411
+
410
412
  | Granularity | Typical Plans/Phase | Tasks/Plan |
411
413
  |-------------|---------------------|------------|
412
414
  | Coarse | 1-3 | 2-3 |
@@ -818,39 +820,10 @@ If exists, load relevant documents by phase type:
818
820
  </step>
819
821
 
820
822
  <step name="load_graph_context">
821
- Check for knowledge graph:
822
-
823
- ```bash
824
- ls .planning/graphs/graph.json 2>/dev/null
825
- ```
826
-
827
- If graph.json exists, check freshness:
828
-
829
- ```bash
830
- node "$HOME/.claude/gsd-core/bin/gsd-tools.cjs" graphify status
831
- ```
832
-
833
- If the status response has `stale: true`, note for later: "Graph is {age_hours}h old -- treat semantic relationships as approximate." Include this annotation inline with any graph context injected below.
834
-
835
- Query the graph for phase-relevant dependency context (single query per D-06):
836
-
837
- ```bash
838
- node "$HOME/.claude/gsd-core/bin/gsd-tools.cjs" graphify query "<phase-goal-keyword>" --budget 2000
839
- ```
840
-
841
- (graphify is not exposed on `gsd-tools query` yet; use `gsd-tools.cjs` for graphify only.)
842
-
843
- Use the keyword that best captures the phase goal. Examples:
844
- - Phase "User Authentication" -> query term "auth"
845
- - Phase "Payment Integration" -> query term "payment"
846
- - Phase "Database Migration" -> query term "migration"
847
-
848
- If the query returns nodes and edges, incorporate as dependency context for planning:
849
- - Which modules/files are semantically related to this phase's domain
850
- - Which subsystems may be affected by changes in this phase
851
- - Cross-document relationships that inform task ordering and wave structure
852
-
853
- If no results or graph.json absent, continue without graph context.
823
+ Read `gsd-core/references/planner-load-graph-context.md` and execute it. It checks for a
824
+ knowledge graph and, if `.planning/graphs/graph.json` exists, reads freshness and
825
+ phase-relevant dependency context via the `gsd_run` launcher and incorporates the results
826
+ into planning. If the graph is absent, skip and continue without graph context.
854
827
  </step>
855
828
 
856
829
  <step name="identify_phase">