@opengsd/gsd-path 1.0.0 → 1.2.0

package/skills/gsd-path-roadmap/scripts/state_promote.py

@@ -4,6 +4,11 @@
 
 from __future__ import annotations
 
+import sys
+
+# Runtime helpers must not modify their immutable installation.
+sys.dont_write_bytecode = True
+
 import json
 import re
 import shutil
@@ -11,6 +16,31 @@ from pathlib import Path, PurePosixPath
 from typing import Mapping, Optional
 
 
+if __package__:  # imported as scripts.state_promote
+    from . import pipeline_state, state_checkpoint
+    from .pipeline_state import (
+        NULL,
+        PROMOTION_RESIDUAL,
+        PROMOTION_SCHEMA,
+        PROMOTION_TRACKS,
+        SLUG_RE,
+        PipelineState,
+        PipelineStateError,
+    )
+else:  # standalone script or sibling import
+    import pipeline_state
+    import state_checkpoint
+    from pipeline_state import (
+        NULL,
+        PROMOTION_RESIDUAL,
+        PROMOTION_SCHEMA,
+        PROMOTION_TRACKS,
+        SLUG_RE,
+        PipelineState,
+        PipelineStateError,
+    )
+
+
 def _render_roadmap(
     text: str,
     previous_milestone: str,
@@ -243,9 +273,9 @@ def _completed_promotion(
     if _head_with_exact_message(repo, subject, fields) != head:
         raise PipelineStateError("completed promotion has the wrong commit message")
 
-    active_text = pipeline_state._git_text_at(repo, base, ".project/STATE.md")
-    next_text = pipeline_state._git_text_at(repo, base, ".project/next/STATE.md")
-    roadmap_text = pipeline_state._git_text_at(repo, base, ".project/ROADMAP.md")
+    active_text = state_checkpoint._git_text_at(repo, base, ".project/STATE.md")
+    next_text = state_checkpoint._git_text_at(repo, base, ".project/next/STATE.md")
+    roadmap_text = state_checkpoint._git_text_at(repo, base, ".project/ROADMAP.md")
     if active_text is None or next_text is None or roadmap_text is None:
         raise PipelineStateError("promotion parent is missing required metadata")
     active_state = pipeline_state._state_from_text(active_text, "promotion parent STATE.md")
@@ -265,7 +295,7 @@ def _completed_promotion(
         )
 
     _promotion_tree_mapping(repo, base, head)
-    drift = pipeline_state._classify_plan_drift(repo, next_state, base, landing)
+    drift = state_checkpoint._classify_plan_drift(repo, next_state, base, landing)
     expected_roadmap = _render_roadmap(
         roadmap_text,
         active_state.milestone,
@@ -273,11 +303,11 @@ def _completed_promotion(
         branch,
         landing,
     )
-    current_roadmap = pipeline_state._git_text_at(repo, head, ".project/ROADMAP.md")
+    current_roadmap = state_checkpoint._git_text_at(repo, head, ".project/ROADMAP.md")
     if current_roadmap != expected_roadmap:
         raise PipelineStateError("completed promotion has invalid ROADMAP.md")
 
-    current_state = pipeline_state._git_text_at(repo, head, ".project/STATE.md")
+    current_state = state_checkpoint._git_text_at(repo, head, ".project/STATE.md")
     if current_state is None:
         raise PipelineStateError("completed promotion has no STATE.md")
     event = re.escape(_promotion_event(drift, branch, landing, base))
@@ -438,10 +468,10 @@ def _prepare_promotion(
         if source.exists() or source.is_symlink():
             if destination.exists() or destination.is_symlink():
                 raise PipelineStateError(f"promotion destination already exists: {destination}")
-            tracks[name] = pipeline_state._tree_digest(source)
+            tracks[name] = state_checkpoint._tree_digest(source)
     if not tracks:
         raise PipelineStateError("lookahead track has no promotable artifacts")
-    drift = pipeline_state._classify_plan_drift(repo, next_state, base, landing)
+    drift = state_checkpoint._classify_plan_drift(repo, next_state, base, landing)
     roadmap_path = project / "ROADMAP.md"
     roadmap_text = pipeline_state._read_real_file(roadmap_path, "ROADMAP.md")
     target_state = _promotion_state(
@@ -464,10 +494,10 @@ def _prepare_promotion(
         "landing": landing,
         "base": base,
         "tracks": tracks,
-        "residual_sha256": pipeline_state._tree_digest(next_root, tuple(tracks)),
-        "next_state_sha256": pipeline_state._sha256(next_text),
-        "active_state_sha256": pipeline_state._sha256(active_text),
-        "roadmap_sha256": pipeline_state._sha256(roadmap_text),
+        "residual_sha256": state_checkpoint._tree_digest(next_root, tuple(tracks)),
+        "next_state_sha256": state_checkpoint._sha256(next_text),
+        "active_state_sha256": state_checkpoint._sha256(active_text),
+        "roadmap_sha256": state_checkpoint._sha256(roadmap_text),
         "target_state": target_state,
         "target_roadmap": target_roadmap,
         "drift": drift,
@@ -521,7 +551,7 @@ def _resume_track_moves(project: Path, journal: dict[str, object], path: Path) -
         if not source_exists and not destination_exists:
             raise PipelineStateError(f"promotion lost both source and destination: {name}")
         candidate = source if source_exists else destination
-        if pipeline_state._tree_digest(candidate) != expected_digest:
+        if state_checkpoint._tree_digest(candidate) != expected_digest:
             raise PipelineStateError(f"promotion track drifted: {name}")
         if source_exists:
             source.rename(destination)
@@ -542,7 +572,7 @@ def _resume_metadata(project: Path, journal: dict[str, object], path: Path) -> N
             raise PipelineStateError("promotion journal has invalid metadata")
         if current == desired:
             continue
-        if pipeline_state._sha256(current) != expected_original:
+        if state_checkpoint._sha256(current) != expected_original:
             raise PipelineStateError(f"promotion metadata drifted: {target}")
         pipeline_state._atomic_write(target, desired)
         journal["stage"] = f"updated:{target.name}"
@@ -560,9 +590,9 @@ def _resume_next_removal(
         if residual.exists() or residual.is_symlink():
             raise PipelineStateError("promotion has both next track and residual staging")
         next_text = pipeline_state._read_real_file(next_root / "STATE.md", "next/STATE.md")
-        if pipeline_state._sha256(next_text) != journal.get("next_state_sha256"):
+        if state_checkpoint._sha256(next_text) != journal.get("next_state_sha256"):
             raise PipelineStateError("lookahead STATE drifted during promotion")
-        if pipeline_state._tree_digest(next_root) != journal.get("residual_sha256"):
+        if state_checkpoint._tree_digest(next_root) != journal.get("residual_sha256"):
             raise PipelineStateError("lookahead residual drifted during promotion")
         next_root.rename(residual)
         journal["stage"] = "next-staged"
@@ -574,7 +604,7 @@ def _resume_next_removal(
         raise PipelineStateError("promotion lost next track and residual staging")
     if residual.is_symlink() or not residual.is_dir():
         raise PipelineStateError(f"promotion residual must be a real directory: {residual}")
-    if pipeline_state._tree_digest(residual) != journal.get("residual_sha256"):
+    if state_checkpoint._tree_digest(residual) != journal.get("residual_sha256"):
         raise PipelineStateError("staged lookahead residual drifted during promotion")
 
 
@@ -714,30 +744,3 @@ def promote_next(
         "commit": commit,
         "drift": journal["drift"],
     }
-
-
-# pipeline_state imports this module, so the parent is resolved after the
-# definitions above. Parent functions are looked up on the module at call time
-# so patches applied to pipeline_state stay visible here.
-if __package__:  # imported as scripts.state_promote
-    from . import pipeline_state
-    from .pipeline_state import (
-        NULL,
-        PROMOTION_RESIDUAL,
-        PROMOTION_SCHEMA,
-        PROMOTION_TRACKS,
-        SLUG_RE,
-        PipelineState,
-        PipelineStateError,
-    )
-else:  # standalone script or sibling import
-    import pipeline_state
-    from pipeline_state import (
-        NULL,
-        PROMOTION_RESIDUAL,
-        PROMOTION_SCHEMA,
-        PROMOTION_TRACKS,
-        SLUG_RE,
-        PipelineState,
-        PipelineStateError,
-    )

package/skills/gsd-path-roadmap/scripts/worktree_paths.py

@@ -0,0 +1,94 @@
+#!/usr/bin/env python3
+# gsd-path project runtime
+"""Placement shared by task isolation, verification, and integration."""
+
+import sys
+
+# Runtime helpers must not modify their immutable installation.
+sys.dont_write_bytecode = True
+
+import hashlib
+import json
+import os
+import tempfile
+from pathlib import Path
+
+try:
+    import _common
+except ImportError:
+    from scripts import _common
+
+
+def _git(primary: Path, *args: str) -> str:
+    result = _common.run_git(primary, *args)
+    if result.returncode:
+        raise ValueError(result.stderr.strip() or "cannot inspect worktree placement")
+    return result.stdout.rstrip("\n")
+
+
+def _identity(path: Path) -> str:
+    return hashlib.sha256(os.fsencode(path)).hexdigest()
+
+
+def _workspace(primary: Path, pin: bool) -> Path:
+    common = Path(_git(primary, "rev-parse", "--git-common-dir"))
+    common = (primary / common).resolve()
+    identity = _identity(primary)
+    receipt = common / "gsd-path" / "workspaces" / f"{identity}.json"
+    try:
+        data = json.loads(receipt.read_text(encoding="utf-8"))
+    except FileNotFoundError:
+        pass
+    else:
+        if (not isinstance(data, dict) or data.get("primary") != str(primary)
+                or not isinstance(data.get("root"), str)
+                or not Path(data["root"]).is_absolute()):
+            raise ValueError(f"invalid worktree placement receipt: {receipt}")
+        return Path(data["root"])
+
+    root = Path(os.environ.get("GSD_PATH_WORKTREE_ROOT") or Path.home() / ".gsd-path" / "projects").expanduser()
+    if not root.is_absolute():
+        raise ValueError("GSD_PATH_WORKTREE_ROOT must be absolute")
+    root = root.resolve()
+    parent = root
+    while not parent.exists():
+        parent = parent.parent
+    ancestor = _common.run_git(parent, "rev-parse", "--git-common-dir")
+    same_repository = (
+        ancestor.returncode == 0
+        and (parent / ancestor.stdout.strip()).resolve() == common
+    )
+    if root.is_relative_to(primary) or same_repository:
+        raise ValueError(f"managed worktree root must be outside this repository's worktrees: {root}")
+    workspace = root / _identity(common) / identity
+    if pin:
+        receipt.parent.mkdir(parents=True, exist_ok=True)
+        fd, temporary = tempfile.mkstemp(dir=receipt.parent)
+        try:
+            with os.fdopen(fd, "w", encoding="utf-8") as handle:
+                json.dump({"primary": str(primary), "root": str(workspace)}, handle)
+            try:
+                os.link(temporary, receipt)
+            except FileExistsError:
+                return _workspace(primary, False)
+        finally:
+            os.unlink(temporary)
+    return workspace
+
+
+def worktree_path(primary: Path, kind: str, name: str, *, pin: bool = False) -> Path:
+    primary = primary.resolve()
+    if kind not in {"task", "verify", "integrate"} or not name or Path(name).name != name or name in {".", ".."}:
+        raise ValueError("invalid managed worktree kind or name")
+    legacy = (primary.parent / f".{primary.name}-gsd-path-integrate-{name}"
+              if kind == "integrate" else primary.parent / f"{primary.name}.gsd-path" / kind / name)
+    branch = f"refs/heads/gsd-path-{kind}/{name}"
+    records = _git(primary, "worktree", "list", "--porcelain", "-z").split("\0\0")
+    for record in records:
+        fields = record.split("\0")
+        if f"worktree {legacy}" in fields and f"branch {branch}" in fields:
+            return legacy
+    # Keep collision checks and missing-directory recovery at the old location.
+    if os.path.lexists(legacy):
+        return legacy
+    return _workspace(primary, pin) / kind / name

package/skills/gsd-path-ship/SKILL.md

@@ -3,13 +3,15 @@ name: gsd-path-ship
 description: Verify a completed GSD Path milestone, manage evidence-backed patch decisions, request final shipping approval, and archive the validated result. Use only when the user explicitly invokes $gsd-path-ship or an active $gsd-path router or build orchestrator explicitly routes to this phase.
 ---
 
+Before executing project helpers, read [runtime selection](references/runtime-selection.md).
+
 # GSD Path Ship Phase
 
 Reuse proven review scope; dispatch reviewers for remaining claims. They never fix
 product code.
 
-Routing instructions below are caller handoffs under the AGENTS.md handoff
-rule; never invoke an explicit-only sibling skill yourself.
+After completion, use the executable phase handoff in AGENTS.md.
+Before completion, preserve the approval and recovery gates below.
 
 Require `pipeline: gsd-path/v2` in `.project/STATE.md`; a missing or different
 marker returns to `$gsd-path` for ownership checking. Read the local
@@ -174,8 +176,9 @@ so the position is unchanged. Then:
 
 ## Archive transaction
 
-Resolve the project's guard-owned `.gsd-path/runtime/archive_milestone.py` and
-`.gsd-path/runtime/pipeline_state.py` to absolute paths for `prepare`,
+Resolve the declared runtime with `python3 -B
+<project>/.gsd-path/status_runtime.py --repo <project> --runtime-path`; use
+`archive_milestone.py` and `pipeline_state.py` from that verified directory for `prepare`,
 `render-manifest`, `preflight`, `record-shipment`, `validate`, `integrate`, and
 `validate-integrated`. Invoke them with `python3`; the files need not be
 executable. Skill-bundle copies are not the guard's trust anchor, even when
@@ -269,8 +272,9 @@ The persisted `STATE.archive` field is the transaction identity.
    create the ship phase's one commit with exact subject
    `ship: M00N — <milestone-slug>` and a body of exactly two consecutive lines,
    `Archive: .project/archive/<NNN>-<slug>` then
-   `Reviewed-HEAD: <reviewed SHA>`, with no comment lines or blank line between them
-   (pass the body as one `-m` value or from a message file). M00N and NNN come from STATE.archive.
+   `Reviewed-HEAD: <reviewed SHA>`, with no comment lines or blank line between them.
+   Write the subject, a blank line, and the two body lines to a message file,
+   then use `git commit -F <message-file>`. M00N and NNN come from STATE.archive.
    There is no untracked-project exception and no product or older-archive
    path may enter this commit.
 6. Immediately run `python3 <absolute archive_milestone.py> validate --repo <root>`. It requires the committed shipped state, exact archive and
@@ -363,27 +367,35 @@ Run this recovery setup from a separate checkout, outside the closed primary
 worktree's guard.
 
 1. Create separate disposable trust and validation checkouts from the same
-   published origin and `STATE.branch`. This separation is required because a
-   managed runtime refresh may dirty a checkout when `.gsd-path/` is tracked,
+   published origin and `STATE.branch`. This separation is required because an
+   explicit runtime upgrade changes the trust checkout's declaration and launcher,
    while archive validation requires a clean checkout. Never use the primary
    worktree for either role.
-2. From the trusted fixed GSD Path checkout, preview and then refresh only the
+2. From the trusted fixed GSD Path checkout, preview and then explicitly upgrade only the
    disposable trust checkout's managed trust anchor:
 
    ```bash
-   node <trusted-gsd-path>/scripts/install.mjs --hooks-refresh --dry-run --project <trust-root>
-   node <trusted-gsd-path>/scripts/install.mjs --hooks-refresh --project <trust-root>
+   node <trusted-gsd-path>/scripts/install.mjs --runtime-upgrade --dry-run --project <trust-root>
+   node <trusted-gsd-path>/scripts/install.mjs --runtime-upgrade --project <trust-root>
+   ```
+
+   Confirm that the preview identifies the intended fixed version and digest.
+   Upgrade changes only the disposable trust project's declaration and compatible
+   launcher. For a legacy trust checkout with no declaration, use the explicit
+   `--runtime-migrate` preview and migration first. Resolve the upgraded runtime:
+
+   ```bash
+   python3 -B <trust-root>/.gsd-path/status_runtime.py --repo <trust-root> --runtime-path
    ```
 
-   Continue only when the preview names managed `.gsd-path/` runtime or guard
-   files and no `.project/` path. The installer owns the atomic refresh and
-   refuses unmanaged or unsafe runtime entries.
-3. Use only the refreshed project-local trust anchor to refresh publication
+   Use the returned absolute directory as `<verified-runtime>` below. Stop on any
+   error; do not substitute the validation checkout's older selected runtime.
+3. Use only this verified upgraded runtime to refresh publication
    refs in the clean validation checkout and validate its integrated milestone:
 
    ```bash
-   python3 <trust-root>/.gsd-path/runtime/archive_milestone.py refresh-origin --repo <validation-root>
-   python3 <trust-root>/.gsd-path/runtime/archive_milestone.py validate-integrated --repo <validation-root> --slug <STATE.milestone>
+   python3 -B <verified-runtime>/archive_milestone.py refresh-origin --repo <validation-root>
+   python3 -B <verified-runtime>/archive_milestone.py validate-integrated --repo <validation-root> --slug <STATE.milestone>
    ```
 
 4. A pass restores the normal shipped handoff without another commit or

package/skills/gsd-path-ship/references/dispatch.md

@@ -7,10 +7,7 @@ use exactly one matching branch:
 - A `spawn_agent` tool exposing `task_name`, `agent_type`, and `fork_turns` is
   Codex. Use `fork_turns: "none"`; coders use the built-in `worker` type and
   every other role uses `default`. Reuse a completed logical target with
-  `followup_task`. For Codex reasoning effort, use `high` for the portable
-  `heavy` tier and `low` for the portable `light` tier; leave reasoning effort
-  unset for the session-default tier, and never pass `heavy` or `light` as a
-  literal Codex value.
+  `followup_task`.
 - A `spawn_agent` tool without those Codex fields is Zed. Spawn one isolated,
   full-capability child per brief. Zed children are not resumable, so retries
   use a fresh child and a complete prompt.
@@ -26,7 +23,7 @@ use exactly one matching branch:
   the complete new prompt for later work. Wait for a colliding active child and
   collect results with `wait_commands_or_subagents`.
 - A `Task` tool advertising the custom `gsd-path` subagent is Cursor. Use that
-  model-inheriting, full-capability child. Resume it by returned agent ID when
+  full-capability child. Resume it by returned agent ID when
   available; otherwise retry with a fresh child and a complete prompt.
 - A `Task` tool advertising the built-in `general` subagent is OpenCode. Use
   that child; if an installed OpenCode v2 host exposes the renamed `subagent`
@@ -65,20 +62,10 @@ For every branch:
 - Resolve the phase's linked role brief to an absolute path, include it in the
   prompt, and require the child to read it before acting. The role brief
   supplies the read-only boundary for auditors and reviewers.
-- Tier hints: use the portable `heavy` tier for `plan`, `plan_patch`, `decide`,
-  and `roadmap`, the portable `light` tier for `inspect_docs` and `docs_audit`,
-  and the session-default tier for every other role. Apply the Codex mapping
-  above when its schema advertises reasoning-effort selection. On every other
-  host, use only an exact native equivalent advertised by that host; otherwise
-  do not override the model or reasoning effort. The only exception is a
-  review-panel child: when the host advertises model selection, pass the exact
-  slug returned by `scripts/review_panel.py resolve` for that family. Never
-  override the model on the canonical reviewer, planner, coder, or any other
-  role.
-  Host isolation: none. The child's working directory is the exact absolute
-  root GSD Path supplied; a host SHA checkout or extra worktree is a contract
-  failure. Never ask the host to create a worktree. Give the child the exact
-  repository or linked-worktree root supplied by GSD Path.
+- Model selection: before every child launch or continuation, follow
+  [the model-policy contract](model-policy.md) and apply its recorded
+  native arguments. It owns defaults, project settings, task overrides,
+  capability failures, and reassignment. Host isolation: none. Use the exact GSD Path supplied root; create no extra checkout.
 - Send a self-contained prompt with absolute input, template, and output paths
   plus the child's bounded responsibility. Every brief also names the absolute
   `AGENTS.md` and `WORKFLOW.md` paths (or explicitly says they are absent), the
@@ -122,6 +109,12 @@ directory for the full logical session; resumptions reuse it. Record completed
 parent CLI run events and each native child's session events with stable logical
 task names before the next dispatch. The helper reads host counters and refuses
 incomplete or ambiguous usage; never estimate tokens or reset the ledger.
+When the verified CLI adapter reports cumulative counters across `resume`, record
+each later invocation with `--previous-events <previous recorded CLI events>`.
+The helper checks thread identity and records only the new output, preserving the
+raw total and predecessor. Keep that chain in order; never sum cumulative totals.
+Use ordinary `record` for per-invocation counters. An unknown counter convention
+is unproven usage, not permission to guess.
 Run `admit` for the next task and stop dispatch on a blocked result. Preserve
 its output in the dispatch evidence. This gates observed usage only: concurrent
 or in-flight work can overrun before the host reports usage. Codex CLI has no

package/skills/gsd-path-ship/references/jev-review.md

@@ -0,0 +1,82 @@
+# Optional Jev evidence screening
+
+Jev screens selected criterion/evidence pairs for a wave or final reviewer.
+It is disabled by default. Normal Path review needs no account, API key, SDK,
+or network access. This helper uses Python's standard library.
+
+## Enable or disable
+
+Set these environment variables in the session that launches the reviewing
+agent; child agents must inherit them to use Jev:
+
+| Variable | Value |
+| --- | --- |
+| `GSD_PATH_JEV` | Exactly `1` enables screening. Unset it to disable. |
+| `TYPESAFE_API_KEY` | Your TypeSafe API key, supplied through the environment. |
+| `GSD_PATH_JEV_TIMEOUT_SECONDS` | Positive finite seconds chosen by the owner for the HTTP socket timeout. There is no default. |
+
+Enabling this option permits the selected criterion and evidence text to be
+sent to TypeSafe's hosted API. Supply only material authorized for that service.
+Do not include credentials, environment dumps, or unrelated repository content.
+Having a key alone does not enable Jev. Do not put keys in commands or artifacts.
+
+## Reviewer procedure
+
+1. Use only still-uncovered criteria from the assigned wave/final review and
+   the corresponding evidence already available in the supplied verify sidecar.
+   Keep existing rules for isolated evidence, command reuse, and provenance.
+2. Pass JSON through stdin to `python3 -B <absolute skill scripts/jev_review.py>`
+   from that sidecar. Resolve the helper as `../scripts/jev_review.py` relative
+   to this reference directory. Do not create another project report. The input
+   has exactly this shape; replace the illustrative revision and contents:
+
+   ```json
+   {
+     "reviewed_head": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+     "items": [
+       {
+         "id": "T001-AC1",
+         "criterion": "Reject an empty name.",
+         "evidence": "Recorded isolated Verify: test_empty_name passed."
+       }
+     ]
+   }
+   ```
+
+   Use the full review SHA supplied by the orchestrator, unique nonempty item
+   IDs, verbatim criterion text, and selected evidence text. Empty evidence is
+   allowed. The SHA is caller-supplied context; the helper does not prove Git
+   ancestry or that the text actually came from that revision.
+3. Read the JSON status. `disabled` means ordinary review. `unavailable` means
+   ordinary review with the explicit reason recorded in the assigned artifact.
+   Neither is a failed criterion. The helper exits zero for these optional
+   outcomes and makes no automatic retries. Correct invalid input/configuration
+   before an explicit retry; keep a service failure visible and continue review.
+4. For `ok`, inspect per-item `supported`, `partial`, `unsupported`, or `unclear`
+   answers, their probabilities, and confidence. Independently examine suggested
+   gaps under the existing rubric. A Jev answer is neither executable evidence
+   nor an independent review verdict. It cannot satisfy or waive a criterion,
+   change a gate, select a route, or authorize publication.
+5. Keep the advisory JSON receipt in the assigned review artifact's notes or
+   evidence prose, outside fixed-format verdict fields. An `ok` receipt includes
+   the supplied revision, SHA-256 of the exact canonical request, versioned model,
+   item IDs and answers, and token usage. An `unavailable` receipt includes the
+   reason and, only after request construction, the revision and request hash;
+   it has no model, answers, or usage. A `disabled` receipt contains only the
+   status and advisory marker. Retain the selected input with that evidence if it
+   is not already reconstructible from cited sources. Keep all canonical verdicts and template
+   structure unchanged. Reuse the recorded advisory when its exact request and
+   review revision remain unchanged; skip screening for a reused proven review.
+
+## Service behavior
+
+The helper calls only `https://api.typesafe.ai/v1/systemone` with the documented
+version `jev-1.13.0`. It does not follow redirects, echo provider error bodies,
+write files, or install packages. Missing keys/timeouts, HTTP and network errors,
+and invalid input/responses return `unavailable`. There is no confidence cutoff:
+the existing reviewer owns acceptance. Real model accuracy and savings must be
+evaluated on chosen evidence before relying on this advisory signal.
+
+Sources: [HTTP API](https://docs.typesafe.ai/api),
+[models](https://docs.typesafe.ai/models),
+[confidence](https://docs.typesafe.ai/confidence).

package/skills/gsd-path-ship/references/model-policy.md

@@ -0,0 +1,139 @@
+# Dispatch model policy
+
+Before native dispatch, run the bundled `scripts/model_policy.py`. CLI dispatch
+uses the same resolver inside `dispatch_driver.py`. The helper owns model and
+effort decisions; apply its output instead of choosing again in prose.
+
+## Project choices
+
+Use `<repo>/.project/model-policy.json`, including when the active track is
+`.project/next`. This file owns project overrides. It is not phase status.
+No file is required to retain existing behavior. `path config` can also set user
+defaults in `~/.gsd-path/config.json` under `models`. Project common roles override
+user host and common roles. Within each scope, host roles override common roles.
+Task overrides still win, and recorded assignments stay pinned.
+
+```json
+{
+  "roles": {"coder": {"model": "inherit"}},
+  "hosts": {"codex": {"plan": {"effort": "high"}}}
+}
+```
+
+Values are exact advertised model/effort strings or `inherit`. This example
+illustrates configuration; it is not a cost-saving preset. Set concrete models
+only from the current host's advertised choices. Host-specific role settings
+override common role settings. Task settings override both, independently for
+model and effort; omitted fields retain the next applicable value. Explicit
+`inherit` removes that field's override. There are no automatic fallbacks.
+
+Role keys are `coder`, `reviewer` (wave, final, and gap review), `review_panel`,
+`skeptic`, `inspect_codebase`, `inspect_docs`, `docs_audit`, `research`, `decide`,
+`roadmap`, `plan`, and `plan_patch`. Use the logical task name as the assignment,
+not as the role. Keep each panel family and review lens a distinct assignment.
+
+The helper retains heavy effort hints for plan, plan_patch, decide, and roadmap;
+light hints for inspect_docs and docs_audit; otherwise effort inherits. Codex
+maps these hints to high/low. Other hosts use only advertised equivalents.
+Hints are conditional; unsupported explicit settings stop the affected child.
+
+Coders may have scalar `model:` and `effort:` fields in their task frontmatter.
+These are part of the approved task contract. Pass the task file with `--task`.
+For other roles, pass assignment-specific `--model` or `--effort` when the owner
+explicitly overrides the role choice. Coder settings do not affect reviewers.
+
+## Advertised capabilities
+
+Capture the current child tool's schema and advertised choices in a JSON file
+outside the product tree. For each supported control, provide its native field,
+allowed values, and, for CLI dispatch, its documented argument template. Omit
+unsupported controls. The values below are fixture examples, not a host catalog:
+
+```json
+{
+  "host": "codex",
+  "model": {"field": "model", "values": ["example-model"],
+            "args": ["--model", "{value}"]},
+  "effort": {"field": "reasoning_effort", "values": ["low", "high"],
+             "args": ["-c", "model_reasoning_effort={value}"]}
+}
+```
+
+`effort_hints` may map heavy/light to exact advertised equivalents. Supply
+`inherited_model` only when the host exposes its identity. Never infer models,
+fields, or CLI flags from a host name. Every existing host uses this contract,
+including hosts with no model or effort controls. Their explicit unsupported
+settings block; their default inheritance remains usable.
+
+## Native lifecycle
+
+Resolve the bundled helper to an absolute path. Use one record under the Git
+common directory's `gsd-path/model-selection/` directory per assignment. Scope
+the path and `--scope` to the milestone, active/lookahead track, and review cycle
+where applicable; later work must not reuse an earlier record.
+
+```text
+python3 -B <helper> resolve --repo <primary> --scope <milestone/track/cycle> --assignment <logical-name> --role <role> --record <absolute-record> --capabilities <advertised-json>
+```
+
+Only `status: ready` authorizes launch. Apply `selection.native` exactly to
+the advertised child tool, preserving the host adapter's other controls and
+GSD Path task isolation. The recorded selection applies to a fresh child too.
+If an existing child is still active, reattach or send its continuation;
+resolving again does not authorize launching a second copy. When a host cannot
+change model/effort on a resumed child, a changed selection requires a fresh
+child after terminal completion of the earlier one.
+
+After terminal completion, release the assignment with `release` using the
+same identity arguments and `--terminal-result <host-completion-evidence>`.
+To change the selection, use `reassign` with the same identity, current
+capabilities, explicit model/effort changes, and `--ruling <verbatim-owner-ruling>`.
+It requires an inactive assignment and preserves prior selection history.
+Resolve again before starting the replacement. A project-policy edit alone
+does not change an existing selection. Task-contract edits still require their
+legal pipeline path.
+
+For panel children, first resolve membership with `review_panel.py resolve`,
+passing `--parent-slug` when known and repeating `--exclude-family` for every
+known parent and canonical-reviewer family (including all deep review lenses).
+Apply these exclusions before persisting membership. Detected membership skips
+excluded families; explicitly named conflicts block. Pass its selected model through `--panel-model`, and pass `--panel-family` plus
+`--exclude-family` for known parent and
+canonical-reviewer families. Persist and reuse the panel roster. Policy cannot
+waive family independence or change canonical review authority. A changed
+panel roster requires a new legal review assignment.
+
+Requested controls are durable evidence. When the host hides the inherited
+model identity, exact effective-model continuity across fresh children remains
+unproven; report that limitation rather than asserting an identity.
+
+## CLI lifecycle
+
+Pass `--model-capabilities <advertised-json>` to the driver. Commands use whole
+argument slots `{model_args}` and `{effort_args}`; the resolver expands these
+to argument arrays. They are not shell substitutions. Remove fixed model and
+effort flags when using these slots; conflicting controls block dispatch.
+Commands with explicit policy choices must expose the corresponding slots,
+including when an explicit choice is `inherit`. Unconfigured legacy commands
+without a capability file retain their existing behavior.
+An existing legacy assignment with no recorded selection keeps its saved
+command across retries, even if project policy or capabilities are later added.
+It cannot use `reassign-model`; model controls require a new explicit assignment.
+
+Review and skeptic commands accept `--model` and `--effort` for that assignment.
+For distinct panel families or review lenses, pass `--model-overrides <json>`:
+a mapping from exact logical assignment names to model/effort objects. Each
+entry applies only to its named assignment; conflicting explicit inputs block.
+A common panel model must satisfy every selected family, so use these scoped
+overrides when families need different models. Family checks remain mandatory.
+Coders read their task overrides. Panels with capabilities use the argument
+slots; legacy panel commands may retain their existing `{model}` placeholder.
+
+The driver persists selection before launch and retains it on retry. Use
+`dispatch_driver.py reassign-model --repo <primary> --task-id <logical-name>
+--model-capabilities <advertised-json> --model <slug> --ruling <owner-ruling>`
+for an inactive unfinished assignment. Finished work and pinned panel rosters
+require a new legal assignment. Earlier attempt evidence is retained.
+
+Compare total cost only with observed usage and outcomes, including retries.
+These controls do not establish cost savings, pricing, or quality rankings.