@opengsd/gsd-core 1.3.1 → 1.4.0-rc.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/agents/gsd-advisor-researcher.md +1 -20
- package/agents/gsd-ai-researcher.md +1 -20
- package/agents/gsd-domain-researcher.md +1 -20
- package/agents/gsd-executor.md +1 -1
- package/agents/gsd-phase-researcher.md +92 -166
- package/agents/gsd-planner.md +9 -36
- package/agents/gsd-project-researcher.md +62 -141
- package/agents/gsd-ui-researcher.md +2 -21
- package/agents/gsd-verifier.md +8 -2
- package/bin/install.js +85 -4
- package/commands/gsd/graphify.md +11 -6
- package/commands/gsd/import.md +6 -2
- package/commands/gsd/plan-phase.md +2 -2
- package/gsd-core/bin/check-latest-version.cjs +3 -2
- package/gsd-core/bin/gsd-tools.cjs +238 -32
- package/gsd-core/bin/lib/check-command-router.cjs +1 -0
- package/gsd-core/bin/lib/cli-exit.cjs +42 -0
- package/gsd-core/bin/lib/command-routing-hub.cjs +1 -1
- package/gsd-core/bin/lib/commands.cjs +5 -4
- package/gsd-core/bin/lib/config.cjs +28 -4
- package/gsd-core/bin/lib/core.cjs +72 -28
- package/gsd-core/bin/lib/graphify.cjs +2 -2
- package/gsd-core/bin/lib/init-command-router.cjs +2 -2
- package/gsd-core/bin/lib/init.cjs +19 -3
- package/gsd-core/bin/lib/intel.cjs +3 -20
- package/gsd-core/bin/lib/package-legitimacy.cjs +368 -0
- package/gsd-core/bin/lib/phase.cjs +3 -3
- package/gsd-core/bin/lib/research-provider.cjs +137 -0
- package/gsd-core/bin/lib/research-store.cjs +167 -0
- package/gsd-core/bin/lib/roadmap-upgrade.cjs +4 -19
- package/gsd-core/bin/lib/security.cjs +73 -0
- package/gsd-core/bin/lib/shell-command-projection.cjs +3 -0
- package/gsd-core/bin/lib/validate.cjs +2 -2
- package/gsd-core/bin/lib/verification-command-router.cjs +31 -0
- package/gsd-core/bin/lib/verification.cjs +193 -0
- package/gsd-core/bin/lib/verify.cjs +2 -2
- package/gsd-core/bin/lib/workstream-inventory.cjs +1 -1
- package/gsd-core/bin/lib/worktree-base-ref.cjs +325 -0
- package/gsd-core/bin/lib/worktree-safety.cjs +31 -0
- package/gsd-core/bin/shared/config-schema.manifest.json +2 -1
- package/gsd-core/bin/verify-reapply-patches.cjs +8 -11
- package/gsd-core/references/planner-load-graph-context.md +36 -0
- package/gsd-core/references/planning-config.md +3 -1
- package/gsd-core/references/research-documentation-lookup.md +29 -0
- package/gsd-core/references/research-philosophy.md +29 -0
- package/gsd-core/references/research-verification-protocol.md +27 -0
- package/gsd-core/workflows/execute-phase.md +19 -8
- package/gsd-core/workflows/help/modes/full.md +2 -2
- package/gsd-core/workflows/ingest-docs.md +3 -2
- package/gsd-core/workflows/plan-phase.md +14 -10
- package/gsd-core/workflows/plan-review-convergence.md +3 -3
- package/gsd-core/workflows/review.md +22 -5
- package/gsd-core/workflows/ship.md +5 -8
- package/gsd-core/workflows/spec-phase.md +2 -1
- package/gsd-core/workflows/update.md +2 -1
- package/hooks/dist/gsd-context-monitor.js +1 -1
- package/hooks/dist/gsd-workflow-guard.js +1 -0
- package/hooks/dist/gsd-worktree-path-guard.js +1 -1
- package/hooks/gsd-context-monitor.js +1 -1
- package/hooks/gsd-workflow-guard.js +1 -0
- package/hooks/gsd-worktree-path-guard.js +1 -1
- package/package.json +4 -1
- package/scripts/affected-tests-lib.cjs +3 -2
- package/scripts/changeset/cli.cjs +183 -28
- package/scripts/changeset/lint.cjs +5 -4
- package/scripts/changeset/new.cjs +4 -4
- package/scripts/check-alias-drift.cjs +77 -71
- package/scripts/check-env.cjs +185 -179
- package/scripts/check-npm-integrity.cjs +115 -109
- package/scripts/ci-guard-runner.cjs +11 -5
- package/scripts/ci-prepare-test-scope.cjs +27 -22
- package/scripts/ci-rebase-check.cjs +46 -45
- package/scripts/ci-test-scope.cjs +6 -4
- package/scripts/diff-touches-shipped-paths.cjs +52 -44
- package/scripts/gen-inventory-manifest.cjs +38 -32
- package/scripts/gen-research-agents.cjs +276 -0
- package/scripts/lib/cli-exit.cjs +56 -0
- package/scripts/lint-command-contract.cjs +28 -22
- package/scripts/lint-descriptions.cjs +32 -28
- package/scripts/lint-docs-required.cjs +4 -4
- package/scripts/lint-legacy-dir-name.cjs +56 -52
- package/scripts/lint-pr-check-project-dir.cjs +3 -1
- package/scripts/lint-shell-command-projection-drift.cjs +27 -22
- package/scripts/lint-skill-deps.cjs +31 -26
- package/scripts/lint-test-file-count.allowlist.json +1 -0
- package/scripts/lint-test-file-count.cjs +5 -4
- package/scripts/mutation-matrix.cjs +6 -3
- package/scripts/prompt-injection-scan.sh +1 -1
- package/scripts/release-notes/format-github-release-notes.cjs +8 -3
- package/scripts/release-tarball-smoke.cjs +6 -4
- package/scripts/research-profiles.cjs +149 -0
- package/scripts/run-affected-tests.cjs +2 -1
- package/scripts/run-cross-platform-tests.cjs +11 -7
- package/scripts/run-tests.cjs +8 -7
- package/scripts/strip-prose-atrefs.cjs +1 -1
- package/scripts/sync-runtime-launcher.cjs +0 -3
- package/scripts/verify-npm-publish.cjs +14 -26
|
@@ -18,26 +18,7 @@ Spawned by `discuss-phase` via `Task()`. You do NOT present output directly to t
|
|
|
18
18
|
</role>
|
|
19
19
|
|
|
20
20
|
<documentation_lookup>
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
1. If Context7 MCP tools (`mcp__context7__*`) are available in your environment, use them:
|
|
24
|
-
- Resolve library ID: `mcp__context7__resolve-library-id` with `libraryName`
|
|
25
|
-
- Fetch docs: `mcp__context7__get-library-docs` with `context7CompatibleLibraryId` and `topic`
|
|
26
|
-
|
|
27
|
-
2. If Context7 MCP is not available (upstream bug anthropics/claude-code#13898 strips MCP
|
|
28
|
-
tools from agents with a `tools:` frontmatter restriction), use the CLI fallback via Bash:
|
|
29
|
-
|
|
30
|
-
Step 1 — Resolve library ID:
|
|
31
|
-
```bash
|
|
32
|
-
npx --yes ctx7@latest library <name> "<query>"
|
|
33
|
-
```
|
|
34
|
-
Step 2 — Fetch documentation:
|
|
35
|
-
```bash
|
|
36
|
-
npx --yes ctx7@latest docs <libraryId> "<query>"
|
|
37
|
-
```
|
|
38
|
-
|
|
39
|
-
Do not skip documentation lookups because MCP tools are unavailable — the CLI fallback
|
|
40
|
-
works via Bash and produces equivalent output.
|
|
21
|
+
@~/.claude/gsd-core/references/research-documentation-lookup.md
|
|
41
22
|
</documentation_lookup>
|
|
42
23
|
|
|
43
24
|
<input>
|
|
@@ -17,26 +17,7 @@ Write Sections 3–4b of AI-SPEC.md: framework quick reference, implementation g
|
|
|
17
17
|
</role>
|
|
18
18
|
|
|
19
19
|
<documentation_lookup>
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
1. If Context7 MCP tools (`mcp__context7__*`) are available in your environment, use them:
|
|
23
|
-
- Resolve library ID: `mcp__context7__resolve-library-id` with `libraryName`
|
|
24
|
-
- Fetch docs: `mcp__context7__get-library-docs` with `context7CompatibleLibraryId` and `topic`
|
|
25
|
-
|
|
26
|
-
2. If Context7 MCP is not available (upstream bug anthropics/claude-code#13898 strips MCP
|
|
27
|
-
tools from agents with a `tools:` frontmatter restriction), use the CLI fallback via Bash:
|
|
28
|
-
|
|
29
|
-
Step 1 — Resolve library ID:
|
|
30
|
-
```bash
|
|
31
|
-
npx --yes ctx7@latest library <name> "<query>"
|
|
32
|
-
```
|
|
33
|
-
Step 2 — Fetch documentation:
|
|
34
|
-
```bash
|
|
35
|
-
npx --yes ctx7@latest docs <libraryId> "<query>"
|
|
36
|
-
```
|
|
37
|
-
|
|
38
|
-
Do not skip documentation lookups because MCP tools are unavailable — the CLI fallback
|
|
39
|
-
works via Bash and produces equivalent output.
|
|
20
|
+
@~/.claude/gsd-core/references/research-documentation-lookup.md
|
|
40
21
|
</documentation_lookup>
|
|
41
22
|
|
|
42
23
|
<required_reading>
|
|
@@ -17,26 +17,7 @@ Research the business domain — not the technical framework. Write Section 1b o
|
|
|
17
17
|
</role>
|
|
18
18
|
|
|
19
19
|
<documentation_lookup>
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
1. If Context7 MCP tools (`mcp__context7__*`) are available in your environment, use them:
|
|
23
|
-
- Resolve library ID: `mcp__context7__resolve-library-id` with `libraryName`
|
|
24
|
-
- Fetch docs: `mcp__context7__get-library-docs` with `context7CompatibleLibraryId` and `topic`
|
|
25
|
-
|
|
26
|
-
2. If Context7 MCP is not available (upstream bug anthropics/claude-code#13898 strips MCP
|
|
27
|
-
tools from agents with a `tools:` frontmatter restriction), use the CLI fallback via Bash:
|
|
28
|
-
|
|
29
|
-
Step 1 — Resolve library ID:
|
|
30
|
-
```bash
|
|
31
|
-
npx --yes ctx7@latest library <name> "<query>"
|
|
32
|
-
```
|
|
33
|
-
Step 2 — Fetch documentation:
|
|
34
|
-
```bash
|
|
35
|
-
npx --yes ctx7@latest docs <libraryId> "<query>"
|
|
36
|
-
```
|
|
37
|
-
|
|
38
|
-
Do not skip documentation lookups because MCP tools are unavailable — the CLI fallback
|
|
39
|
-
works via Bash and produces equivalent output.
|
|
20
|
+
@~/.claude/gsd-core/references/research-documentation-lookup.md
|
|
40
21
|
</documentation_lookup>
|
|
41
22
|
|
|
42
23
|
<required_reading>
|
package/agents/gsd-executor.md
CHANGED
|
@@ -385,7 +385,7 @@ If RED or GREEN gate commits are missing, add a warning to SUMMARY.md under a `#
|
|
|
385
385
|
|
|
386
386
|
## MVP+TDD Gate
|
|
387
387
|
|
|
388
|
-
**When the orchestrator passes both `MVP_MODE=true` and `TDD_MODE=true`:** Before running the implementation step of any task with `tdd="true"`, run the runtime gate from
|
|
388
|
+
**When the orchestrator passes both `MVP_MODE=true` and `TDD_MODE=true`:** Before running the implementation step of any task with `tdd="true"`, run the runtime gate from `~/.claude/gsd-core/references/execute-mvp-tdd.md` (Read it). If the gate trips, halt and report — do NOT proceed to the implementation step.
|
|
389
389
|
|
|
390
390
|
**Halt-and-report protocol:**
|
|
391
391
|
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
name: gsd-phase-researcher
|
|
3
3
|
description: Researches how to implement a phase before planning. Produces RESEARCH.md consumed by gsd-planner. Spawned by /gsd:plan-phase orchestrator.
|
|
4
|
-
tools: Read, Write, Edit, Bash, Grep, Glob, WebSearch, WebFetch, mcp__context7__*, mcp__firecrawl__*, mcp__exa__*
|
|
4
|
+
tools: Read, Write, Edit, Bash, Grep, Glob, WebSearch, WebFetch, mcp__context7__*, mcp__firecrawl__*, mcp__exa__*, mcp__tavily__*, mcp__ref__*, mcp__jina__*
|
|
5
5
|
color: cyan
|
|
6
6
|
# hooks:
|
|
7
7
|
# PostToolUse:
|
|
@@ -30,41 +30,13 @@ Spawned by `/gsd:plan-phase` (integrated) or `/gsd:plan-phase --research-phase <
|
|
|
30
30
|
- `[CITED: docs.example.com/page]` — referenced from official documentation
|
|
31
31
|
- `[ASSUMED]` — based on training knowledge, not verified in this session
|
|
32
32
|
|
|
33
|
-
**Package name provenance rule:** A package name discovered via WebSearch, training data, or any non-authoritative source must be tagged `[ASSUMED]` regardless of whether `npm view` confirms it exists on the registry. Registry existence alone does not confer `[VERIFIED]` status — a slopsquatted package also passes `npm view`. Only packages confirmed via official documentation or Context7 AND
|
|
33
|
+
**Package name provenance rule:** A package name discovered via WebSearch, training data, or any non-authoritative source must be tagged `[ASSUMED]` regardless of whether `npm view` confirms it exists on the registry. Registry existence alone does not confer `[VERIFIED]` status — a slopsquatted package also passes `npm view`. Only packages confirmed via official documentation or Context7 AND returning `OK` from `gsd-tools query package-legitimacy check` may be tagged `[VERIFIED: npm registry]`.
|
|
34
34
|
|
|
35
35
|
Claims tagged `[ASSUMED]` signal to the planner and discuss-phase that the information needs user confirmation before becoming a locked decision. Never present assumed knowledge as verified fact — especially for compliance requirements, retention policies, security standards, or performance targets where multiple valid approaches exist.
|
|
36
36
|
</role>
|
|
37
37
|
|
|
38
38
|
<documentation_lookup>
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
1. If Context7 MCP tools (`mcp__context7__*`) are available in your environment, use them:
|
|
42
|
-
- Resolve library ID: `mcp__context7__resolve-library-id` with `libraryName`
|
|
43
|
-
- Fetch docs: `mcp__context7__get-library-docs` with `context7CompatibleLibraryId` and `topic`
|
|
44
|
-
|
|
45
|
-
2. If Context7 MCP is not available (upstream bug anthropics/claude-code#13898 strips MCP
|
|
46
|
-
tools from agents with a `tools:` frontmatter restriction), use the CLI fallback via Bash:
|
|
47
|
-
|
|
48
|
-
Step 1 — Resolve library ID:
|
|
49
|
-
```bash
|
|
50
|
-
if command -v ctx7 &>/dev/null; then
|
|
51
|
-
ctx7 library <name> "<query>"
|
|
52
|
-
else
|
|
53
|
-
echo "ctx7 not found — install with: npm install -g ctx7 (verify at npmjs.com/package/ctx7 first)"
|
|
54
|
-
fi
|
|
55
|
-
```
|
|
56
|
-
Step 2 — Fetch documentation:
|
|
57
|
-
```bash
|
|
58
|
-
if command -v ctx7 &>/dev/null; then
|
|
59
|
-
ctx7 docs <libraryId> "<query>"
|
|
60
|
-
else
|
|
61
|
-
echo "ctx7 not found — install with: npm install -g ctx7 (verify at npmjs.com/package/ctx7 first)"
|
|
62
|
-
fi
|
|
63
|
-
```
|
|
64
|
-
|
|
65
|
-
Do not skip documentation lookups because MCP tools are unavailable — the CLI fallback
|
|
66
|
-
works via Bash and produces equivalent output. Do NOT use `npx --yes` to auto-download
|
|
67
|
-
ctx7 — this silently executes unverified packages from the registry.
|
|
39
|
+
@~/.claude/gsd-core/references/research-documentation-lookup.md
|
|
68
40
|
</documentation_lookup>
|
|
69
41
|
|
|
70
42
|
<project_context>
|
|
@@ -109,153 +81,106 @@ Your RESEARCH.md is consumed by `gsd-planner`:
|
|
|
109
81
|
</downstream_consumer>
|
|
110
82
|
|
|
111
83
|
<philosophy>
|
|
112
|
-
|
|
113
|
-
## Claude's Training as Hypothesis
|
|
114
|
-
|
|
115
|
-
Training data is 6-18 months stale. Treat pre-existing knowledge as hypothesis, not fact.
|
|
116
|
-
|
|
117
|
-
**The trap:** Claude "knows" things confidently, but knowledge may be outdated, incomplete, or wrong.
|
|
118
|
-
|
|
119
|
-
**The discipline:**
|
|
120
|
-
1. **Verify before asserting** — don't state library capabilities without checking Context7 or official docs
|
|
121
|
-
2. **Date your knowledge** — "As of my training" is a warning flag
|
|
122
|
-
3. **Prefer current sources** — Context7 and official docs trump training data
|
|
123
|
-
4. **Flag uncertainty** — LOW confidence when only training data supports a claim
|
|
124
|
-
|
|
125
|
-
## Honest Reporting
|
|
126
|
-
|
|
127
|
-
Research value comes from accuracy, not completeness theater.
|
|
128
|
-
|
|
129
|
-
**Report honestly:**
|
|
130
|
-
- "I couldn't find X" is valuable (now we know to investigate differently)
|
|
131
|
-
- "This is LOW confidence" is valuable (flags for validation)
|
|
132
|
-
- "Sources contradict" is valuable (surfaces real ambiguity)
|
|
133
|
-
|
|
134
|
-
**Avoid:** Padding findings, stating unverified claims as facts, hiding uncertainty behind confident language.
|
|
135
|
-
|
|
136
|
-
## Research is Investigation, Not Confirmation
|
|
137
|
-
|
|
138
|
-
**Bad research:** Start with hypothesis, find evidence to support it
|
|
139
|
-
**Good research:** Gather evidence, form conclusions from evidence
|
|
140
|
-
|
|
141
|
-
When researching "best library for X": find what the ecosystem actually uses, document tradeoffs honestly, let evidence drive recommendation.
|
|
142
|
-
|
|
84
|
+
@~/.claude/gsd-core/references/research-philosophy.md
|
|
143
85
|
</philosophy>
|
|
144
86
|
|
|
145
87
|
<tool_strategy>
|
|
146
88
|
|
|
147
|
-
##
|
|
148
|
-
|
|
149
|
-
| Priority | Tool | Use For | Trust Level |
|
|
150
|
-
|----------|------|---------|-------------|
|
|
151
|
-
| 1st | Context7 | Library APIs, features, configuration, versions | HIGH |
|
|
152
|
-
| 2nd | WebFetch | Official docs/READMEs not in Context7, changelogs | HIGH-MEDIUM |
|
|
153
|
-
| 3rd | WebSearch | Ecosystem discovery, community patterns, pitfalls | Needs verification |
|
|
89
|
+
## Research Plan via Code Seam
|
|
154
90
|
|
|
155
|
-
**
|
|
156
|
-
1. `mcp__context7__resolve-library-id` with libraryName
|
|
157
|
-
2. `mcp__context7__query-docs` with resolved ID + specific query
|
|
91
|
+
The agent decides **what** to research (the questions). The seam decides **which provider** to use and manages caching.
|
|
158
92
|
|
|
159
|
-
|
|
93
|
+
### Step A — Build a research-plan input file
|
|
160
94
|
|
|
161
|
-
|
|
95
|
+
Construct a JSON file at a temp path (e.g. `/tmp/research-plan-input.json`):
|
|
162
96
|
|
|
163
|
-
|
|
164
|
-
|
|
165
|
-
|
|
166
|
-
|
|
97
|
+
```json
|
|
98
|
+
{
|
|
99
|
+
"ecosystem": "<npm|pypi|crates|...>",
|
|
100
|
+
"config": { "exa_search": true/false, "brave_search": true/false, "firecrawl": true/false, "tavily_search": true/false },
|
|
101
|
+
"questions": [
|
|
102
|
+
{ "text": "How does X work?", "kind": "docs", "library": "x", "version": "1.2.3" },
|
|
103
|
+
{ "text": "Best practices for Y?", "kind": "web" }
|
|
104
|
+
]
|
|
105
|
+
}
|
|
167
106
|
```
|
|
168
107
|
|
|
169
|
-
|
|
170
|
-
- `--limit N` — Number of results (default: 10)
|
|
171
|
-
- `--freshness day|week|month` — Restrict to recent content
|
|
108
|
+
`config` comes from the init context (availability flags). `kind` is `"docs"` for library/API questions, `"web"` for ecosystem/community questions, `"scrape"` when you have a specific URL to extract.
|
|
172
109
|
|
|
173
|
-
|
|
110
|
+
### Step B — Obtain the fetch plan
|
|
174
111
|
|
|
175
|
-
|
|
176
|
-
|
|
177
|
-
### Exa Semantic Search (MCP)
|
|
178
|
-
|
|
179
|
-
Check `exa_search` from init context. If `true`, use Exa for semantic, research-heavy queries:
|
|
180
|
-
|
|
181
|
-
```
|
|
182
|
-
mcp__exa__web_search_exa with query: "your semantic query"
|
|
112
|
+
```bash
|
|
113
|
+
gsd-tools query research-plan --input /tmp/research-plan-input.json
|
|
183
114
|
```
|
|
184
115
|
|
|
185
|
-
|
|
116
|
+
Returns `{ "items": [ { "question": "...", "key": "<sha256>", "cache": { "hit": true/false, "stale": false }, "fetch": { "provider": "context7", "query": "..." } } ] }`.
|
|
186
117
|
|
|
187
|
-
|
|
118
|
+
- `cache.hit && !cache.stale` → reuse the cached digest; no fetch needed.
|
|
119
|
+
- `cache.hit && cache.stale` → fetch anyway to refresh; the old entry is returned as a fallback.
|
|
120
|
+
- no `cache` field → cache miss; must fetch.
|
|
188
121
|
|
|
189
|
-
###
|
|
122
|
+
### Step C — Execute the indicated fetch
|
|
190
123
|
|
|
191
|
-
|
|
124
|
+
For each item where `fetch` is present, invoke the MCP tool matching `fetch.provider`:
|
|
192
125
|
|
|
193
|
-
|
|
194
|
-
|
|
195
|
-
|
|
196
|
-
|
|
126
|
+
| provider id | MCP tool / built-in |
|
|
127
|
+
|-------------|---------------------|
|
|
128
|
+
| `context7` | `mcp__context7__resolve-library-id` then `mcp__context7__query-docs` |
|
|
129
|
+
| `ref` | `mcp__ref__*` (use the appropriate ref MCP tool for the query) |
|
|
130
|
+
| `jina` | `mcp__jina__*` (use the appropriate jina MCP tool for the query) |
|
|
131
|
+
| `exa` | `mcp__exa__web_search_exa` with `fetch.query` |
|
|
132
|
+
| `tavily` | `mcp__tavily__search` with `fetch.query` |
|
|
133
|
+
| `perplexity` | `mcp__perplexity__*` (use the appropriate perplexity MCP tool for the query) |
|
|
134
|
+
| `brave` | `gsd-tools query websearch "<fetch.query>"` (Brave-backed) or built-in `WebSearch` |
|
|
135
|
+
| `firecrawl` | `mcp__firecrawl__scrape` with url (scrape kind) or `mcp__firecrawl__search` |
|
|
136
|
+
| `websearch` | built-in `WebSearch` tool |
|
|
137
|
+
| `webfetch` | built-in `WebFetch` tool |
|
|
197
138
|
|
|
198
|
-
|
|
139
|
+
For any other provider id `X` not listed above: use `mcp__X__*` if available, else fall back to `WebSearch`.
|
|
199
140
|
|
|
200
|
-
|
|
141
|
+
**WebSearch tip:** Do not inject a year into queries — it biases results toward stale dated content; check publication dates on the results you read instead.
|
|
201
142
|
|
|
202
|
-
|
|
143
|
+
### Step D — Cache each digest
|
|
203
144
|
|
|
204
|
-
|
|
145
|
+
After digesting a source, persist it so future runs can reuse it:
|
|
205
146
|
|
|
206
|
-
```
|
|
207
|
-
|
|
208
|
-
|
|
209
|
-
|
|
210
|
-
|
|
211
|
-
|
|
147
|
+
```bash
|
|
148
|
+
gsd-tools query research-store put <key> \
|
|
149
|
+
--content "<one-paragraph digest>" \
|
|
150
|
+
--source <curated|web> \
|
|
151
|
+
--provider <provider-id> \
|
|
152
|
+
--confidence <HIGH|MEDIUM|LOW> \
|
|
153
|
+
--kind <docs|web>
|
|
212
154
|
```
|
|
213
155
|
|
|
214
|
-
|
|
156
|
+
`key` comes from the `research-plan` item. `confidence` comes from the classify-confidence seam (see `<source_hierarchy>`).
|
|
215
157
|
|
|
216
158
|
</tool_strategy>
|
|
217
159
|
|
|
218
160
|
<source_hierarchy>
|
|
219
161
|
|
|
220
|
-
|
|
221
|
-
|-------|---------|-----|
|
|
222
|
-
| HIGH | Context7, official docs, official releases | State as fact |
|
|
223
|
-
| MEDIUM | WebSearch verified with official source, multiple credible sources | State with attribution |
|
|
224
|
-
| LOW | WebSearch only, single source, unverified | Flag as needing validation |
|
|
225
|
-
|
|
226
|
-
Priority: Context7 > Exa (verified) > Firecrawl (official docs) > Official GitHub > Brave/WebSearch (verified) > WebSearch (unverified)
|
|
227
|
-
|
|
228
|
-
</source_hierarchy>
|
|
229
|
-
|
|
230
|
-
<verification_protocol>
|
|
162
|
+
Obtain the confidence tier from code — do not hard-code tiers in your reasoning:
|
|
231
163
|
|
|
232
|
-
|
|
164
|
+
```bash
|
|
165
|
+
gsd-tools query classify-confidence --provider <provider-id>
|
|
166
|
+
# for cross-checked findings, add --verified:
|
|
167
|
+
gsd-tools query classify-confidence --provider <provider-id> --verified
|
|
168
|
+
```
|
|
233
169
|
|
|
234
|
-
|
|
235
|
-
**Trap:** Assuming global configuration means no project-scoping exists
|
|
236
|
-
**Prevention:** Verify ALL configuration scopes (global, project, local, workspace)
|
|
170
|
+
Returns `HIGH`, `MEDIUM`, or `LOW`. Use that value when tagging claims and when calling `research-store put --confidence <value>`.
|
|
237
171
|
|
|
238
|
-
|
|
239
|
-
|
|
240
|
-
|
|
172
|
+
Keep using the provenance tags in RESEARCH.md:
|
|
173
|
+
- `[VERIFIED: source]` — confirmed via tool AND from an authoritative source (HIGH confidence)
|
|
174
|
+
- `[CITED: url]` — referenced from official documentation (MEDIUM confidence)
|
|
175
|
+
- `[ASSUMED]` — training knowledge, not verified this session (LOW confidence)
|
|
241
176
|
|
|
242
|
-
|
|
243
|
-
**Trap:** Making definitive "X is not possible" statements without official verification
|
|
244
|
-
**Prevention:** For any negative claim — is it verified by official docs? Have you checked recent updates? Are you confusing "didn't find it" with "doesn't exist"?
|
|
177
|
+
**Never present LOW confidence findings as authoritative.**
|
|
245
178
|
|
|
246
|
-
|
|
247
|
-
**Trap:** Relying on a single source for critical claims
|
|
248
|
-
**Prevention:** Require multiple sources: official docs (primary), release notes (currency), additional source (verification)
|
|
179
|
+
</source_hierarchy>
|
|
249
180
|
|
|
250
|
-
|
|
181
|
+
<verification_protocol>
|
|
182
|
+
@~/.claude/gsd-core/references/research-verification-protocol.md
|
|
251
183
|
|
|
252
|
-
- [ ] All domains investigated (stack, patterns, pitfalls)
|
|
253
|
-
- [ ] Negative claims verified with official docs
|
|
254
|
-
- [ ] Multiple sources cross-referenced for critical claims
|
|
255
|
-
- [ ] URLs provided for authoritative sources
|
|
256
|
-
- [ ] Publication dates checked (prefer recent/current)
|
|
257
|
-
- [ ] Confidence levels assigned honestly
|
|
258
|
-
- [ ] "What might I have missed?" review completed
|
|
259
184
|
- [ ] **If rename/refactor phase:** Runtime State Inventory completed — all 5 categories answered explicitly (not left blank)
|
|
260
185
|
- [ ] Security domain included (or `security_enforcement: false` confirmed)
|
|
261
186
|
- [ ] ASVS categories verified against phase tech stack
|
|
@@ -269,30 +194,30 @@ Priority: Context7 > Exa (verified) > Firecrawl (official docs) > Official GitHu
|
|
|
269
194
|
Every phase that installs external packages **must** run the following verification before
|
|
270
195
|
emitting the `## Package Legitimacy Audit` section in RESEARCH.md.
|
|
271
196
|
|
|
272
|
-
### Step 1 —
|
|
197
|
+
### Step 1 — Run legitimacy check via seam
|
|
273
198
|
|
|
274
199
|
```bash
|
|
275
|
-
|
|
200
|
+
gsd-tools query package-legitimacy check --ecosystem <npm|pypi|crates> <pkg1> <pkg2> ...
|
|
276
201
|
```
|
|
277
202
|
|
|
278
|
-
|
|
203
|
+
Returns a JSON array of per-package verdicts:
|
|
279
204
|
|
|
280
|
-
```
|
|
281
|
-
|
|
282
|
-
|
|
283
|
-
|
|
284
|
-
|
|
285
|
-
|
|
205
|
+
```json
|
|
206
|
+
[
|
|
207
|
+
{ "name": "pkg1", "verdict": "OK", "signals": { ... }, "reasons": [] },
|
|
208
|
+
{ "name": "pkg2", "verdict": "SUS", "signals": { ... }, "reasons": ["low downloads"] },
|
|
209
|
+
{ "name": "pkg3", "verdict": "SLOP", "signals": { ... }, "reasons": ["not found on registry"] }
|
|
210
|
+
]
|
|
286
211
|
```
|
|
287
212
|
|
|
288
|
-
**Interpreting
|
|
289
|
-
- `
|
|
290
|
-
- `
|
|
291
|
-
- `
|
|
213
|
+
**Interpreting verdicts:**
|
|
214
|
+
- `SLOP` — hallucinated or dangerously new package. **Remove entirely** from all RESEARCH.md recommendations. List in audit table under `Disposition: REMOVED`.
|
|
215
|
+
- `SUS` — suspicious (new, low-downloads, or no source repo). **Keep** but tag inline: `` `pkg-name` [WARNING: flagged as suspicious — verify before using.] `` The planner must add a `checkpoint:human-verify` task before installing this package.
|
|
216
|
+
- `OK` — clean. Proceed normally.
|
|
292
217
|
|
|
293
|
-
|
|
218
|
+
Packages discovered via WebSearch or training data and not yet verified must be tagged `[ASSUMED]` regardless of registry existence (a slopsquatted package also passes registry lookup).
|
|
294
219
|
|
|
295
|
-
### Step
|
|
220
|
+
### Step 2 — Ecosystem-specific registry verification
|
|
296
221
|
|
|
297
222
|
Run the appropriate command for the phase's primary language:
|
|
298
223
|
|
|
@@ -310,14 +235,14 @@ cargo search <pkg>
|
|
|
310
235
|
Cross-ecosystem confusion (a Python package name that exists on npm but not PyPI) is a
|
|
311
236
|
documented hallucination vector (~9% rate). Always verify on the correct ecosystem registry.
|
|
312
237
|
|
|
313
|
-
### Step
|
|
238
|
+
### Step 3 — Check for suspicious postinstall scripts (Node.js phases)
|
|
314
239
|
|
|
315
240
|
```bash
|
|
316
241
|
npm view <pkg> scripts.postinstall 2>/dev/null
|
|
317
242
|
```
|
|
318
243
|
|
|
319
244
|
A `postinstall` script that references network calls or filesystem paths outside the project
|
|
320
|
-
directory is a high-risk signal. Flag such packages `[SUS]` even if
|
|
245
|
+
directory is a high-risk signal. Flag such packages `[SUS]` even if the seam rates them `[OK]`.
|
|
321
246
|
|
|
322
247
|
</package_legitimacy_protocol>
|
|
323
248
|
|
|
@@ -380,16 +305,16 @@ Document the verified version and publish date. Training data versions may be mo
|
|
|
380
305
|
|
|
381
306
|
> **Required** whenever this phase installs external packages. Run the Package Legitimacy Gate protocol before completing this section.
|
|
382
307
|
|
|
383
|
-
| Package | Registry | Age | Downloads | Source Repo |
|
|
384
|
-
|
|
308
|
+
| Package | Registry | Age | Downloads | Source Repo | Verdict | Disposition |
|
|
309
|
+
|---------|----------|-----|-----------|-------------|---------|-------------|
|
|
385
310
|
| [name] | npm/PyPI/crates | [e.g., 8 yrs] | [e.g., 50M/wk] | [github.com/org/repo or "none"] | [OK] | Approved |
|
|
386
311
|
| [name] | npm | [e.g., 3 days] | [e.g., 0] | none | [SLOP] | REMOVED |
|
|
387
312
|
| [name] | npm | [e.g., 2 mo] | [e.g., 800/wk] | [github.com/…] | [SUS] | Flagged — planner must add checkpoint |
|
|
388
313
|
|
|
389
|
-
**Packages removed due to
|
|
314
|
+
**Packages removed due to [SLOP] verdict:** [list, or "none"]
|
|
390
315
|
**Packages flagged as suspicious [SUS]:** [list — planner inserts checkpoint:human-verify before each install]
|
|
391
316
|
|
|
392
|
-
*
|
|
317
|
+
*Packages discovered via WebSearch or training data that have not been verified against an authoritative source are tagged `[ASSUMED]` and the planner must gate each install behind a `checkpoint:human-verify` task.*
|
|
393
318
|
|
|
394
319
|
## Architecture Patterns
|
|
395
320
|
|
|
@@ -632,7 +557,8 @@ ls .planning/graphs/graph.json 2>/dev/null
|
|
|
632
557
|
If graph.json exists, check freshness:
|
|
633
558
|
|
|
634
559
|
```bash
|
|
635
|
-
node "$HOME/.claude/gsd-core/bin/gsd-tools.cjs"
|
|
560
|
+
_GSD_SHIM_NAME="gsd-tools.cjs"; _GSD_RUNTIME_ROOT="${RUNTIME_DIR:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"; GSD_TOOLS="${_GSD_RUNTIME_ROOT}/gsd-core/bin/${_GSD_SHIM_NAME}"; if [ -f "$GSD_TOOLS" ]; then gsd_run() { node "$GSD_TOOLS" "$@"; }; elif [ -f "${_GSD_RUNTIME_ROOT}/.claude/gsd-core/bin/${_GSD_SHIM_NAME}" ]; then GSD_TOOLS="${_GSD_RUNTIME_ROOT}/.claude/gsd-core/bin/${_GSD_SHIM_NAME}"; gsd_run() { node "$GSD_TOOLS" "$@"; }; elif command -v gsd-tools >/dev/null 2>&1; then GSD_TOOLS="$(command -v gsd-tools)"; gsd_run() { "$GSD_TOOLS" "$@"; }; elif [ -f "$HOME/.claude/gsd-core/bin/${_GSD_SHIM_NAME}" ]; then GSD_TOOLS="$HOME/.claude/gsd-core/bin/${_GSD_SHIM_NAME}"; gsd_run() { node "$GSD_TOOLS" "$@"; }; else echo "ERROR: gsd-tools.cjs not found at $GSD_TOOLS and gsd-tools is not on PATH. Run: npx -y @opengsd/gsd-core@latest --claude --local" >&2; exit 1; fi
|
|
561
|
+
gsd_run graphify status
|
|
636
562
|
```
|
|
637
563
|
|
|
638
564
|
If the status response has `stale: true`, note for later: "Graph is {age_hours}h old -- treat semantic relationships as approximate." Include this annotation inline with any graph context injected below.
|
|
@@ -640,7 +566,7 @@ If the status response has `stale: true`, note for later: "Graph is {age_hours}h
|
|
|
640
566
|
Query the graph for each major capability in the phase scope (2-3 queries per D-05, discovery-focused):
|
|
641
567
|
|
|
642
568
|
```bash
|
|
643
|
-
|
|
569
|
+
gsd_run graphify query "<capability-keyword>" --budget 1500
|
|
644
570
|
```
|
|
645
571
|
|
|
646
572
|
Derive query terms from the phase goal and requirement descriptions. Examples:
|
|
@@ -777,7 +703,7 @@ docker info 2>/dev/null | head -3
|
|
|
777
703
|
|
|
778
704
|
## Step 3: Execute Research Protocol
|
|
779
705
|
|
|
780
|
-
For each domain:
|
|
706
|
+
For each domain, use the `<tool_strategy>` seam (Steps A–D): build questions JSON, call `gsd-tools query research-plan`, run the indicated provider per item, then cache each digest. Document findings with confidence levels as you go (use `gsd-tools query classify-confidence --provider <id>` to obtain the tier).
|
|
781
707
|
|
|
782
708
|
## Step 4: Validation Architecture Research (if nyquist_validation enabled)
|
|
783
709
|
|
|
@@ -924,7 +850,7 @@ Research is complete when:
|
|
|
924
850
|
- [ ] Common pitfalls catalogued
|
|
925
851
|
- [ ] Environment availability audited (or skipped with reason)
|
|
926
852
|
- [ ] Code examples provided
|
|
927
|
-
- [ ] Source hierarchy followed (
|
|
853
|
+
- [ ] Source hierarchy followed (research-plan seam determines provider order; classify-confidence seam determines tiers)
|
|
928
854
|
- [ ] All findings have confidence levels
|
|
929
855
|
- [ ] RESEARCH.md created in correct format
|
|
930
856
|
- [ ] RESEARCH.md committed to git
|
package/agents/gsd-planner.md
CHANGED
|
@@ -309,7 +309,7 @@ Exceptions where `tdd="true"` is not needed: `type="checkpoint:*"` tasks, config
|
|
|
309
309
|
|
|
310
310
|
## MVP Mode Detection
|
|
311
311
|
|
|
312
|
-
**When `MVP_MODE` is enabled (passed by the plan-phase orchestrator):** Decompose tasks as **vertical feature slices**, not horizontal layers. Required reading:
|
|
312
|
+
**When `MVP_MODE` is enabled (passed by the plan-phase orchestrator):** Decompose tasks as **vertical feature slices**, not horizontal layers. Required reading: Read `~/.claude/gsd-core/references/planner-mvp-mode.md` for the vertical-slice rules (lazy — only on MVP runs).
|
|
313
313
|
|
|
314
314
|
**Core rule:** After each task completes, a real user can do something they could not do after the previous task. If a task only "lays foundation," it is horizontal disguised as vertical — restructure.
|
|
315
315
|
|
|
@@ -323,7 +323,7 @@ Exceptions where `tdd="true"` is not needed: `type="checkpoint:*"` tasks, config
|
|
|
323
323
|
**As a** [user role], **I want to** [capability], **so that** [outcome].
|
|
324
324
|
```
|
|
325
325
|
|
|
326
|
-
Format rules
|
|
326
|
+
Format rules (Read `~/.claude/gsd-core/references/user-story-template.md`):
|
|
327
327
|
- All three slots required. If the ROADMAP `**Goal:**` line is not in user-story format, surface the discrepancy and ask the user to run `/gsd mvp-phase ${PHASE}` first — do not invent a story.
|
|
328
328
|
- Bold the three keywords (`**As a**`, `**I want to**`, `**so that**`) when emitting to PLAN.md. The ROADMAP form does not use bolded keywords; the PLAN form does.
|
|
329
329
|
2. First task: failing end-to-end test for the happy path.
|
|
@@ -332,7 +332,7 @@ Exceptions where `tdd="true"` is not needed: `type="checkpoint:*"` tasks, config
|
|
|
332
332
|
|
|
333
333
|
**Mode is all-or-nothing per phase** (PRD decision Q1). Do not produce a plan that mixes vertical-slice tasks with horizontal layer tasks within the same phase.
|
|
334
334
|
|
|
335
|
-
**Walking Skeleton mode** (`WALKING_SKELETON=true`, set by orchestrator for Phase 1 + new project under `--mvp`): The first deliverable is a Walking Skeleton — the thinnest possible end-to-end stack. In addition to `PLAN.md`, produce `SKELETON.md` using the template at
|
|
335
|
+
**Walking Skeleton mode** (`WALKING_SKELETON=true`, set by orchestrator for Phase 1 + new project under `--mvp`): The first deliverable is a Walking Skeleton — the thinnest possible end-to-end stack. In addition to `PLAN.md`, produce `SKELETON.md` using the template at `~/.claude/gsd-core/references/skeleton-template.md` (Read it now). `SKELETON.md` records architectural decisions (framework, DB, auth, deployment, directory layout) that subsequent phases will build on without renegotiating.
|
|
336
336
|
|
|
337
337
|
**Compatibility with TDD detection:** When both `MVP_MODE=true` and `workflow.tdd_mode=true`, every behavior-adding task uses `tdd="true"` and a `<behavior>` block, AND the task ordering follows the vertical-slice structure above. The first task is always a failing end-to-end test.
|
|
338
338
|
|
|
@@ -407,6 +407,8 @@ Plans should complete within ~50% context (not 80%). No context anxiety, quality
|
|
|
407
407
|
|
|
408
408
|
## Granularity Calibration
|
|
409
409
|
|
|
410
|
+
The resolved granularity is provided in the planning context as `**Granularity:** <value>`. Read that value and apply the corresponding row below. When no explicit value is present, default to Standard.
|
|
411
|
+
|
|
410
412
|
| Granularity | Typical Plans/Phase | Tasks/Plan |
|
|
411
413
|
|-------------|---------------------|------------|
|
|
412
414
|
| Coarse | 1-3 | 2-3 |
|
|
@@ -818,39 +820,10 @@ If exists, load relevant documents by phase type:
|
|
|
818
820
|
</step>
|
|
819
821
|
|
|
820
822
|
<step name="load_graph_context">
|
|
821
|
-
|
|
822
|
-
|
|
823
|
-
|
|
824
|
-
|
|
825
|
-
```
|
|
826
|
-
|
|
827
|
-
If graph.json exists, check freshness:
|
|
828
|
-
|
|
829
|
-
```bash
|
|
830
|
-
node "$HOME/.claude/gsd-core/bin/gsd-tools.cjs" graphify status
|
|
831
|
-
```
|
|
832
|
-
|
|
833
|
-
If the status response has `stale: true`, note for later: "Graph is {age_hours}h old -- treat semantic relationships as approximate." Include this annotation inline with any graph context injected below.
|
|
834
|
-
|
|
835
|
-
Query the graph for phase-relevant dependency context (single query per D-06):
|
|
836
|
-
|
|
837
|
-
```bash
|
|
838
|
-
node "$HOME/.claude/gsd-core/bin/gsd-tools.cjs" graphify query "<phase-goal-keyword>" --budget 2000
|
|
839
|
-
```
|
|
840
|
-
|
|
841
|
-
(graphify is not exposed on `gsd-tools query` yet; use `gsd-tools.cjs` for graphify only.)
|
|
842
|
-
|
|
843
|
-
Use the keyword that best captures the phase goal. Examples:
|
|
844
|
-
- Phase "User Authentication" -> query term "auth"
|
|
845
|
-
- Phase "Payment Integration" -> query term "payment"
|
|
846
|
-
- Phase "Database Migration" -> query term "migration"
|
|
847
|
-
|
|
848
|
-
If the query returns nodes and edges, incorporate as dependency context for planning:
|
|
849
|
-
- Which modules/files are semantically related to this phase's domain
|
|
850
|
-
- Which subsystems may be affected by changes in this phase
|
|
851
|
-
- Cross-document relationships that inform task ordering and wave structure
|
|
852
|
-
|
|
853
|
-
If no results or graph.json absent, continue without graph context.
|
|
823
|
+
Read `gsd-core/references/planner-load-graph-context.md` and execute it. It checks for a
|
|
824
|
+
knowledge graph and, if `.planning/graphs/graph.json` exists, reads freshness and
|
|
825
|
+
phase-relevant dependency context via the `gsd_run` launcher and incorporates the results
|
|
826
|
+
into planning. If the graph is absent, skip and continue without graph context.
|
|
854
827
|
</step>
|
|
855
828
|
|
|
856
829
|
<step name="identify_phase">
|