@opengsd/gsd-path 1.0.0 → 1.2.0

package/AGENTS.md

@@ -69,7 +69,10 @@ full-repo suite on a tiny edit outrank the phase brief.
   needs verbal explanation is defective.
 - With no `.project/STATE.md`, route through the bundled
   `scripts/detect_project.py initialize --repo <absolute-root> --template
-  <absolute-state-template>` helper; do not classify from a directory listing
+  <absolute-state-template> --require-git` helper; `route: setup-repository`
+  leaves the invocation folder unchanged and routes to repository setup before
+  state creation or branch binding. Never delete the invocation folder or its
+  state to satisfy bootstrap path checks. Do not classify from a directory listing
   or conversation. Follow its JSON `verdict` and `route`. Reserve `classify`
   for read-only inspection; do not use it as a state-initialization preflight.
 - `.project/STATE.md` tracks phase position. Parse and validate it only with
@@ -98,11 +101,19 @@ full-repo suite on a tiny edit outrank the phase brief.
   deterministic logical task name, and a bounded responsibility. Independent
   briefs may run in parallel up to available child capacity; a dependent
   brief runs as soon as its dependencies complete.
-- Any phase-contract instruction to route, return, or invoke another GSD Path
-  phase is a caller handoff, not permission to trigger an explicit-only
-  skill. If an active router or orchestrator supplied the contract, return
-  control to it. On a direct invocation, report the exact next skill and stop
-  until the user explicitly invokes it.
+- After a phase completes its gate and state update, run the bundled
+  `pipeline_state.py status --repo <absolute-root>` with the routed
+  `--project-dir`. Its `handoff` is the shared phase handoff for chat and the
+  dashboard. Present **Outcome** from `handoff.outcome` plus the completed
+  work; **Review** links the phase artifact, or `handoff.review` when absent.
+  An active router uses `handoff.router_next` for **Next** and follows the
+  returned route. A directly invoked phase uses `handoff.phase_next` and
+  stops. A status or plain-prompt reply uses `handoff.next` and stays read-only.
+  Convert the `$` invocation prefix to the host's slash form when needed.
+  Phase owners still stop for required input and approval before completion;
+  a route is not approval. Return to an active caller instead of invoking an
+  explicit-only sibling skill. Derive the next phase from this result, not
+  from another lane table in prose.
 
 ## Plain-prompt re-entry
 
@@ -116,15 +127,17 @@ full-repo suite on a tiny edit outrank the phase brief.
   with `-B .gsd-path/status_runtime.py --repo <absolute-root>`
   before any requested repository mutation. Treat its JSON as the only route
   authority.
-  A plain change request does not authorize work outside the pipeline: make no
+  When `completion.status` is `verified` and `git.branch` is an ordinary
+  branch (not `gsd-path/M###`), requested product work may proceed normally.
+  Archives and pipeline control files remain protected. Otherwise,
+  a plain change request does not authorize work outside the pipeline: make no
   changes and report **Outcome**, link the returned `path` under **Review**, and
-  under **Next** name `next_skill` only for a `run-phase` route; for every other
-  route, report `route.action` and `route.reason`. An explicit request to leave
+  under **Next** use `handoff.next`. An explicit request to leave
   or bypass the pipeline is a user ruling;
   route it through the router's undo or abandon flow instead of editing directly.
 - After any other plain-prompt turn with owned state, rerun the same read-only
   status command immediately before the final response and append the same
-  **Outcome** / **Review** / **Next** handoff with the same exact-route rule.
+  **Outcome** / **Review** / **Next** handoff with the same shared handoff rule.
   Keep an informational turn read-only from start to finish: do not use repository
   mutation tools or run commands that can create or alter files. A GSD Path skill
   already supplies this handoff, so emit it once. With no STATE.md, respond
@@ -243,7 +256,7 @@ full-repo suite on a tiny edit outrank the phase brief.
   orchestrator.
 - Reviewers verify and block; they never fix. A block names the criterion,
   observed result, evidence location, and concrete fix direction. An optional
-  review panel is advisory: the inherit reviewer remains the only wave
+  review panel is advisory: the canonical reviewer remains the only wave
   pass/fail, and panel findings never average or auto-replan. Same-model
   agreement is not independent verification: matching verdicts from one
   model family count as a single evidence path. Independence comes from
@@ -337,7 +350,8 @@ full-repo suite on a tiny edit outrank the phase brief.
   approval of the exact owner/name, visibility, default-checkout path,
   `gsd-path/M001` branch, and linked primary-worktree path. Before the
   external action produces an artifact, present those proposed targets as the
-  inline **Review** surface and mark them not yet created. Do not write a
+  inline **Review** surface using the active router's preview contract.
+  Do not write a
   preview file into the invocation directory or another repository. Run the
   bundled bootstrap helper's read-only `preview` command for this evidence.
 - After approval, the bootstrap helper persists the exact targets under the
@@ -355,7 +369,8 @@ full-repo suite on a tiny edit outrank the phase brief.
   build-orchestrator owned.
 - Keep the cloned default checkout clean on the remote default branch. Run the
   pipeline from the linked GSD Path worktree; never initialize `.project/` in
-  the default checkout, reuse an existing branch or path, move an existing
+  the default checkout, reuse an existing branch or path (except an explicitly
+  approved empty linked-worktree folder via `--reuse-empty-worktree`), move an existing
   repository, or recover a partial GitHub creation without the exact approved
   journal and re-verification.
 
@@ -379,6 +394,11 @@ STATE.md.
 
 ## Distribution layout
 
+This section describes the GSD Path source checkout. These source paths and
+the sync command do not apply to an application that only installs GSD Path.
+In a consuming project, resolve roles, templates, and helpers from the active
+installed skill's absolute paths; the application need not contain this layout.
+
 | Path | Purpose |
 |------|---------|
 | `plugin.json` | Agent Plugins manifest (`agent-plugins.org` 1.0.0 schema) |

package/CHANGELOG.md

@@ -0,0 +1,68 @@
+# Changelog
+
+All notable changes to [@opengsd/gsd-path](https://www.npmjs.com/package/@opengsd/gsd-path)
+are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
+
+## [1.1.0] - 2026-09-18
+
+### Added
+- Scoped npm package `@opengsd/gsd-path` with trusted publishing workflow
+- Release trust evidence validation and host matrix documentation
+
+### Changed
+- Release workflow and maintainer documentation for npm publication
+
+## [1.0.0] - 2026-09-15
+
+### Added
+- Initial public release of the disk-backed GSD Path pipeline
+- Multi-host installer, skills package, and project contracts
+
+## [1.2.0] - 2026-09-20
+
+### Added
+- add Path settings and project history dashboard
+- add optional Jev evidence screening
+- store worktrees and pinned runtimes outside project checkouts
+- centralize sub-agent model selection policy
+
+### Changed
+- Correct stale release guidance and consolidate scope references
+- record passing eight-host release gate
+- validate corrected OpenCode release evidence
+- validate recovered Claude release evidence
+- record affected release gate results
+- preserve blocked host evaluations without receipt fallback
+- record passing Antigravity Kimi and Grok release runs
+- record remaining 1.2.0 release gate failures
+- record Kimi receipt and complete offline recheck
+- preserve 1.2.0 host receipts and release blockers
+- record v1.3.0 live release evidence and blockers
+- bump version to v1.3.0
+- Align release documentation with risk-based host validation
+- bump version to v1.2.0
+- Automate npm release docs, pack verification, and provenance (#133)
+- refresh README changes and dashboard screenshots
+- Refresh dashboard navigation and file history documentation
+- Clarify Jev receipt fields and consolidate documentation
+- Refresh dashboard update and guard documentation
+- Correct runtime installation, update, guard, and uninstall documentation
+- Correct model policy and dispatch documentation
+
+### Fixed
+- reuse unchanged host receipts for releases
+- verify prepared releases without advancing failed versions
+- scope release evidence to affected hosts
+- show project runtime updates and release completed milestone guards
+
+### Other
+- Fixed tests/package.test.mjs to invoke git_guard.py with pre-commit in a temporary Git repository instead of unsupported --help. The focused test failed before the fix and during restored-original sabotage. All 6 package tests now pass; resource sync and diff checks pass. Verified locally on Node 26; Node 18/20 CI reruns remain with the outer executor
+- Preserve historical commit selection across relative document links
+- Validate Jev probability normalization with CLI regression coverage
+- Record passing focused checks and isolation violation
+- Fix integration guard and runtime installer regression coverage
+- Fixed stale runtime paths in tests/test_git_guard.py using the installed runtime resolver. Both CI failures reproduced before the fix; all 38 Git guard tests now pass. Both corrected tests also caught a temporarily disabled native guard, which was restored. git diff --check passed. Only the test file changed; remote CI remains for the outer executor
+- Fix pinned runtime routing, guard blocking, and launcher bytes
+- Restore same-cycle recovery after partial review completion
+- Isolate assignment rejections and align native panel exclusions
+- Fix dispatch isolation, legacy pinning, and independent panel selection

package/DOCS.md

@@ -44,7 +44,8 @@ GSD Path has two install layers:
 
 1. **Skills** — router + phase skills for your AI host(s)
 2. **Project contracts** (optional) — `AGENTS.md`, `WORKFLOW.md`, and the
-   read-only `.gsd-path/runtime/` status engine in the repo
+   tracked runtime declaration and stable status/guard launchers; runtime code
+   lives outside the checkout under `~/.gsd-path/runtimes/`
 
 ### Decision tree
 
@@ -70,7 +71,7 @@ node scripts/install.mjs --all --dry-run   # preview — safe to run anytime
 node scripts/install.mjs --all             # apply
 ```
 
-**npm** (no clone — once the package is published to npm):
+**npm** (no clone required):
 
 ```bash
 npx @opengsd/gsd-path --all --dry-run
@@ -223,6 +224,40 @@ route through `NEEDS-ORCHESTRATOR` instead of guesses.
 **Quick lane:** ≤2 tasks, one wave, no open questions — may skip research/decide
 ([FULL.md](FULL.md)).
 
+### Worktree locations
+
+The primary worktree stays in the folder you opened. Serial task work stays
+there too. New parallel task worktrees, verify sidecars, and integration
+worktrees share this managed layout:
+
+```text
+~/.gsd-path/projects/<repository-id>/<workspace-id>/{task,verify,integrate}/<name>
+```
+
+Set `GSD_PATH_WORKTREE_ROOT` to another absolute directory before the first
+helper-owned allocation in a workspace. The root must be outside the project's
+own worktrees; an unrelated repository tracking your home folder is allowed.
+Repository and workspace IDs are full SHA-256 hashes of the
+resolved Git common directory and primary path, so separate clones and
+primary folders do not share a location.
+
+The first allocation pins the workspace location in
+`<git-common-dir>/gsd-path/workspaces/<workspace-id>.json`. Later environment
+changes do not move it. Existing sibling worktrees remain at their original
+paths and retain the same recovery and cleanup checks. These folders contain
+active work and evidence; they are not a disposable cache. Relocation needs
+a separate migration; do not edit placement records or move folders manually.
+
+New repository setup can also use an explicitly approved managed primary
+path through the existing `--worktree` option. Its parent must already exist
+for the read-only preview. An approved empty invocation folder is still
+reused in place. This choice does not move the default checkout.
+
+In the dashboard's **Watched folders**, add the managed root explicitly;
+watching its home-directory parent does not traverse hidden `.gsd-path`.
+Discovery follows Git's registered bound branches back to the primary and
+applies exclusions there, so task and verify copies do not displace it.
+
 ### Key artifacts
 
 | Path | Role |
@@ -263,7 +298,7 @@ Full tree: [README.md](README.md#handoff-contract).
 | --- | --- |
 | Global skills | `node scripts/install.mjs --update` |
 | Project-local skills | `node scripts/install.mjs --update --local` |
-| From npm (once published) | `npx @opengsd/gsd-path@latest --update` |
+| From npm | `npx @opengsd/gsd-path@latest --update` |
 | Guard scripts | `node scripts/install.mjs --hooks-refresh --project PATH` |
 | `AGENTS.md` / `WORKFLOW.md` | Manual merge — installer refuses overwrite |
 | Health check | `node scripts/install.mjs --doctor [--project PATH]` — read-only; flags missing/stale skills, hook drift, and bad pipeline state |
@@ -311,9 +346,10 @@ an external import bundle, reviews hook coexistence, and hands off to the Path
 router through inspect and define. See **[MIGRATE.md](MIGRATE.md)**.
 
 **Brownfield vs greenfield?**
-The router runs the bundled `scripts/detect_project.py initialize --repo
-<absolute-root>` command, which classifies the project before it creates
-STATE.md for a brownfield or greenfield verdict. A recognized
+After the [startup prerequisites](README.md#the-flow) are met, the router
+classifies the project before it creates STATE.md for a brownfield or
+greenfield verdict. The exact initializer invocation belongs to the
+[phase workflow](WORKFLOW.md#phase-0--inspect-gsd-path-inspect). A recognized
 manifest or source file, qualifying tracked Git file, or qualifying Markdown
 document with a body is brownfield and routes to inspect. A title-only README,
 `LICENSE`/`COPYING`, `.gitignore`, or content only in ignored trees such as
@@ -339,3 +375,36 @@ initializer. After a milestone ships, the next one inspects again.
 | Installer flags | `node scripts/install.mjs --help` |
 
 [Workflow runner and observed token budgets](RUNTIME.md) documents canonical gate receipts, serial verification preparation, and host budget limits.
+
+
+## Project runtime versions
+
+`.gsd-path/runtime.json` pins an exact runtime by package version and content
+digest. The runtime is stored under `~/.gsd-path/runtimes/<digest>/`; generated
+implementation files are not copied into project worktrees. Track the declaration
+and stable `.gsd-path` launchers as project configuration. Task isolation, Verify
+sidecars and Integration checkouts inherit this configuration through Git.
+
+Skill/plugin updates and `--hooks-refresh` retain the selected runtime. Use
+`gsd-path --runtime-upgrade --project /absolute/project` to explicitly select
+the supplied package's runtime and its compatible status launcher. Review those
+configuration changes before committing them. Existing versions remain available
+for other projects and branches.
+
+A new machine needs the selected runtime installed before status and guards can
+run. `gsd-path --runtime-restore --project /absolute/project --source-root
+/path/to/matching/package` restores that exact version without changing project
+files. The supplied package must match both the version and digest; custom source
+builds may share a release version while having different digests. No command
+silently substitutes a newer runtime, and status/guards never install or download.
+
+For an old tracked `.gsd-path/runtime/`, run `gsd-path --runtime-migrate --project
+/absolute/project --dry-run`, then the same command without `--dry-run` and review
+the Git diff. Migration removes the generated files from the checkout and writes
+the declaration and stable wiring. It does not stage or commit. Resolve local
+runtime edits or unknown files first. Interrupted migration is recovered by the
+same explicit command; its journal lives outside the checkout.
+
+An ignore rule alone cannot migrate tracked runtime files. This runtime lifecycle
+covers runtime code and launch wiring; project-local skill copies, retained skill
+backups, and mixed user/host settings remain separately owned installation output.

package/FULL.md

@@ -63,10 +63,9 @@ gsd-path  (router: reads STATE.md, runs the next valid phase)
   phases. See the [canonical skill table](DOCS.md#skills-optional).
 
 All skills are **explicit-only** on most hosts — generic “continue the project”
-does not inject the pipeline. In a project with an owned `.project/STATE.md`,
-such a prompt answers read-only with the current handoff and next skill, and a
-plain change request makes no changes (see `WORKFLOW.md`, Plain-prompt
-re-entry). On OpenCode stable, Antigravity CLI, and Kiro, treat explicit
+does not inject the pipeline. For plain prompts and their read-only handoff,
+see the [invocation and handoff rules](README.md#the-flow).
+On OpenCode stable, Antigravity CLI, and Kiro, treat explicit
 invocation as an operating rule.
 
 ### Invocation by host
@@ -79,7 +78,7 @@ Use the [router and phase invocation table](README.md#install-summary) for your
 
 ### Requirements
 
-- **Node 18.17+** for `scripts/install.mjs` (recommended; also the npm `gsd-path` bin once the package is published to npm)
+- **Node 18.17+** for `scripts/install.mjs` (recommended; also the npm `gsd-path` bin)
 - **Python 3.9+** required for project installs, project refresh, and project-state
   doctor checks; optional for global-only Node installs. `scripts/install.py`
   mirrors global and `--local` install transactions and `--update`; it does not
@@ -132,8 +131,9 @@ Install shared rules into a repo (refuses if managed files already exist):
 node scripts/install.mjs --all --project /path/to/project
 ```
 
-Writes `AGENTS.md`, `WORKFLOW.md`, and `.gsd-path/runtime/`; with Claude, also
-`.claude/CLAUDE.md`.
+Writes the [project contracts](DOCS.md#installing); with Claude, also
+`.claude/CLAUDE.md`. See [project runtime versions](DOCS.md#project-runtime-versions)
+for runtime storage, restoration, and legacy migration.
 Merge upgrades manually — the installer will not overwrite existing contracts.
 
 ### Guard hooks (optional)
@@ -160,7 +160,7 @@ See [UPDATE.md](UPDATE.md) for the full updating guide. Quick reference:
 ```bash
 node scripts/install.mjs --update              # global roots with existing install
 node scripts/install.mjs --update --local      # current project only
-npx @opengsd/gsd-path@latest --update                   # from npm, once published
+npx @opengsd/gsd-path@latest --update                   # from npm
 ```
 
 Previous copies move to `disabled-gsd-skills` beside each root. The router may
@@ -184,12 +184,9 @@ Open your agent in the project directory. Invoke the router explicitly.
 
 ### Initial greenfield repository (first milestone)
 
-With no `.project/STATE.md`, a `greenfield` classifier verdict routes to
-**define** immediately. The [DOCS.md FAQ](DOCS.md#faq) owns the exact
-classification rules.
-For an explicit request to create a new GitHub repository, the router first
-previews the repository and linked-worktree targets for approval as described
-in [README.md](README.md#the-flow).
+Follow the [startup and repository setup guidance](README.md#the-flow) first.
+Once setup is complete, a `greenfield` classifier verdict routes to **define**.
+The [DOCS.md FAQ](DOCS.md#faq) owns the exact classification rules.
 
 Define interviews across: problem, users, observable success, scope in,
 scope out (vetoes), constraints, risks, and surfaces. A surface is anything a
@@ -469,7 +466,7 @@ node scripts/install.mjs --update [--local]
 node scripts/install.mjs --hooks-refresh --project /path/to/repo
 node scripts/install.mjs --hooks-refresh-full --project /path/to/repo
 
-# From npm (once the package is published to npm)
+# From npm
 npx @opengsd/gsd-path --all
 npx @opengsd/gsd-path@latest --update
 ```

package/HOOKS.md

@@ -59,9 +59,10 @@ Native configs for unselected hosts are ignored.
 
 | File | Purpose |
 | --- | --- |
-| `.gsd-path/guard_hook.py` | Pre-tool-use guard (stdin JSON → exit 2 + denial JSON) |
+| `.gsd-path/guard_hook.py` | Pre-tool-use guard (stdin JSON → exit 2 + denial JSON; runtime resolution failures exit 2 with stderr) |
 | `.gsd-path/git_guard.py` | Commit and publication validator |
-| `.gsd-path/runtime/` | Project-local pipeline helpers, including the read-only status engine |
+| `.gsd-path/runtime.json` | Tracked selected runtime version and digest |
+| `~/.gsd-path/runtimes/<digest>/` | Immutable external pipeline helpers and guards |
 | `.git/hooks/pre-commit` | Runs `git_guard.py` before commit |
 | `.git/hooks/commit-msg` | Runs `git_guard.py` with commit message |
 | `.git/hooks/pre-push` | Runs `git_guard.py` on every pushed ref update |
@@ -114,6 +115,12 @@ See [UPDATE.md](UPDATE.md).
 
 **`guard_hook.py`** (pre-tool-use):
 
+- direct product edits outside the routed build phase while milestone work
+  remains unfinished. After integration is verified, ordinary branches allow
+  product edits, including a dirty product worktree. The proof still checks
+  the shipped archive, canonical integration merge, annotated published tag,
+  and default-branch ancestry. Missing proof keeps protection active. Closed
+  milestone branches, archives, and pipeline control files remain protected.
 - non-read tool actions targeting archived paths or an existing ancestor of
   the archive tree; shell operands count an ancestor only for deletion or move
   commands
@@ -137,7 +144,7 @@ See [UPDATE.md](UPDATE.md).
 - shell commands that reference the archive unless the whole command is a
   recognized standalone read or a single-command invocation of the bundled
   `pipeline_state.py` / `archive_milestone.py` helper, resolved to a regular file
-  inside the guard-owned `.gsd-path/runtime/` directory (beside `guard_hook.py`
+  inside the verified runtime selected by `.gsd-path/runtime.json` (legacy projects use `.gsd-path/runtime/` beside `guard_hook.py`
   in the repository layout), using exactly `python` or `python3` with optional
   `-B`; non-empty supplied tool working directories are authoritative. Empty
   strings, including list items, are treated as absent: nested payloads inherit
@@ -176,16 +183,18 @@ such as `rm -rf scratch` passes the archive check; other guard rules still apply
 
 - modifies, deletes, or renames away tracked archive paths
 - `ship:` commits (case-insensitive) staging paths outside `.project/`
-- on unshipped pipeline lineage (the committed `STATE.md` names a bound
-  `gsd-path/M###` branch that is not `shipped/done`, and HEAD descends from
-  it — the bound branch itself, `gsd-path-task/` branches, sidecars, and any
-  branch cut from them): commits staging paths outside `.project/` (or the
+- while committed `STATE.md` names unfinished milestone work, including
+  `shipped/done` without verified integration: commits staging paths outside `.project/` (or the
   guard's own `.gsd-path/` and native hook settings) unless the phase is
   `build` and they are landing commits as `isolation.py land` writes them —
   subject `<task id>: <task title>` matching the task file at `Base:`, a full
   base SHA HEAD descends from, the staged task file, only that task's declared
   `files:`, and a `Files:` list of exactly the staged paths. Outside build the
-  reviewed HEAD is frozen; product fixes reopen through the patch plan
+  reviewed HEAD is frozen; product fixes reopen through the patch plan.
+  The validated integration merge is allowed to complete before publication
+  proof exists; an ordinary commit with an integration subject is not exempt
+- deleting the recorded branch or switching to another branch while carrying
+  unfinished state does not release product commit protection
 - pushes (to any remote) that move a `gsd-path/M###` ref anywhere but its
   strict ship commit, or delete it while it holds anything else; and pushes of
   any other ref whose commit carries a `STATE.md` that still owes a ship commit
@@ -268,6 +277,6 @@ not intercept subagent tools — treat coverage as orchestrator-level.
 | Tool denied editing archive | Pre-tool guard — use active paths, not archive |
 | Hook not running in Cursor | Run `--hooks-refresh-full --cursor --project /path/to/repo` |
 | `--hooks-refresh` rejects an unmanaged guard | Move the foreign guard aside, then rerun refresh; use `--hooks-init` if guards are wanted |
-| `--hooks-refresh` rejects an unmanaged runtime file | Back up or merge that file, move it aside, then rerun refresh |
+| Runtime missing, invalid, or legacy | Follow [runtime restoration or migration](DOCS.md#project-runtime-versions) |
 
 More: [DOCS.md](DOCS.md#help) · [UPDATE.md](UPDATE.md)

package/QUICK.md

@@ -40,7 +40,7 @@ first (never writes files):
 node scripts/install.mjs --all --dry-run
 node scripts/install.mjs --all
 
-# From npm, no clone — once the package is published to npm
+# From npm, no clone required
 npx @opengsd/gsd-path --all --dry-run
 npx @opengsd/gsd-path --all
 ```
@@ -64,11 +64,13 @@ cd /path/to/your/repo
 node scripts/install.mjs --all --project "$(pwd)"
 ```
 
-Installs `AGENTS.md`, `WORKFLOW.md`, and `.gsd-path/runtime/`
+Installs the [project contracts](DOCS.md#installing)
 (+ `.claude/CLAUDE.md` if Claude is selected).
 If those managed files already exist, a plain install **refuses and installs
-nothing** — use `--update --project PATH` to refresh skills and `.gsd-path/`
-while keeping your contracts, and merge project-contract changes by hand
+nothing** — see [project runtime versions](DOCS.md#project-runtime-versions)
+for legacy migration, then use `--update --project PATH` to refresh skills and
+hook wiring while keeping your contracts and selected runtime. Merge contract
+changes by hand
 ([UPDATE.md](UPDATE.md)).
 
 **Optional** archive/git guards:
@@ -87,8 +89,8 @@ In the **project directory**, type explicitly:
 
 Use the [router and phase invocation table](README.md#install-summary) for your host.
 
-“Continue the project” does not advance a phase. With an owned
-`.project/STATE.md` it reports the current handoff and next skill, read-only.
+For plain prompts such as “continue the project,” see the
+[invocation and handoff rules](README.md#the-flow).
 
 **One phase only?** e.g. `/gsd-path-plan` — see skill table in [DOCS.md](DOCS.md#using).
 Need to talk through a question without advancing? Use `/gsd-path-discuss`;