@opengsd/gsd-path 1.0.0 → 1.2.0

package/skills/gsd-path-build/references/dispatch.md

@@ -7,10 +7,7 @@ use exactly one matching branch:
 - A `spawn_agent` tool exposing `task_name`, `agent_type`, and `fork_turns` is
   Codex. Use `fork_turns: "none"`; coders use the built-in `worker` type and
   every other role uses `default`. Reuse a completed logical target with
-  `followup_task`. For Codex reasoning effort, use `high` for the portable
-  `heavy` tier and `low` for the portable `light` tier; leave reasoning effort
-  unset for the session-default tier, and never pass `heavy` or `light` as a
-  literal Codex value.
+  `followup_task`.
 - A `spawn_agent` tool without those Codex fields is Zed. Spawn one isolated,
   full-capability child per brief. Zed children are not resumable, so retries
   use a fresh child and a complete prompt.
@@ -26,7 +23,7 @@ use exactly one matching branch:
   the complete new prompt for later work. Wait for a colliding active child and
   collect results with `wait_commands_or_subagents`.
 - A `Task` tool advertising the custom `gsd-path` subagent is Cursor. Use that
-  model-inheriting, full-capability child. Resume it by returned agent ID when
+  full-capability child. Resume it by returned agent ID when
   available; otherwise retry with a fresh child and a complete prompt.
 - A `Task` tool advertising the built-in `general` subagent is OpenCode. Use
   that child; if an installed OpenCode v2 host exposes the renamed `subagent`
@@ -65,20 +62,10 @@ For every branch:
 - Resolve the phase's linked role brief to an absolute path, include it in the
   prompt, and require the child to read it before acting. The role brief
   supplies the read-only boundary for auditors and reviewers.
-- Tier hints: use the portable `heavy` tier for `plan`, `plan_patch`, `decide`,
-  and `roadmap`, the portable `light` tier for `inspect_docs` and `docs_audit`,
-  and the session-default tier for every other role. Apply the Codex mapping
-  above when its schema advertises reasoning-effort selection. On every other
-  host, use only an exact native equivalent advertised by that host; otherwise
-  do not override the model or reasoning effort. The only exception is a
-  review-panel child: when the host advertises model selection, pass the exact
-  slug returned by `scripts/review_panel.py resolve` for that family. Never
-  override the model on the canonical reviewer, planner, coder, or any other
-  role.
-  Host isolation: none. The child's working directory is the exact absolute
-  root GSD Path supplied; a host SHA checkout or extra worktree is a contract
-  failure. Never ask the host to create a worktree. Give the child the exact
-  repository or linked-worktree root supplied by GSD Path.
+- Model selection: before every child launch or continuation, follow
+  [the model-policy contract](model-policy.md) and apply its recorded
+  native arguments. It owns defaults, project settings, task overrides,
+  capability failures, and reassignment. Host isolation: none. Use the exact GSD Path supplied root; create no extra checkout.
 - Send a self-contained prompt with absolute input, template, and output paths
   plus the child's bounded responsibility. Every brief also names the absolute
   `AGENTS.md` and `WORKFLOW.md` paths (or explicitly says they are absent), the
@@ -122,6 +109,12 @@ directory for the full logical session; resumptions reuse it. Record completed
 parent CLI run events and each native child's session events with stable logical
 task names before the next dispatch. The helper reads host counters and refuses
 incomplete or ambiguous usage; never estimate tokens or reset the ledger.
+When the verified CLI adapter reports cumulative counters across `resume`, record
+each later invocation with `--previous-events <previous recorded CLI events>`.
+The helper checks thread identity and records only the new output, preserving the
+raw total and predecessor. Keep that chain in order; never sum cumulative totals.
+Use ordinary `record` for per-invocation counters. An unknown counter convention
+is unproven usage, not permission to guess.
 Run `admit` for the next task and stop dispatch on a blocked result. Preserve
 its output in the dispatch evidence. This gates observed usage only: concurrent
 or in-flight work can overrun before the host reports usage. Codex CLI has no

package/skills/gsd-path-build/references/jev-review.md

@@ -0,0 +1,82 @@
+# Optional Jev evidence screening
+
+Jev screens selected criterion/evidence pairs for a wave or final reviewer.
+It is disabled by default. Normal Path review needs no account, API key, SDK,
+or network access. This helper uses Python's standard library.
+
+## Enable or disable
+
+Set these environment variables in the session that launches the reviewing
+agent; child agents must inherit them to use Jev:
+
+| Variable | Value |
+| --- | --- |
+| `GSD_PATH_JEV` | Exactly `1` enables screening. Unset it to disable. |
+| `TYPESAFE_API_KEY` | Your TypeSafe API key, supplied through the environment. |
+| `GSD_PATH_JEV_TIMEOUT_SECONDS` | Positive finite seconds chosen by the owner for the HTTP socket timeout. There is no default. |
+
+Enabling this option permits the selected criterion and evidence text to be
+sent to TypeSafe's hosted API. Supply only material authorized for that service.
+Do not include credentials, environment dumps, or unrelated repository content.
+Having a key alone does not enable Jev. Do not put keys in commands or artifacts.
+
+## Reviewer procedure
+
+1. Use only still-uncovered criteria from the assigned wave/final review and
+   the corresponding evidence already available in the supplied verify sidecar.
+   Keep existing rules for isolated evidence, command reuse, and provenance.
+2. Pass JSON through stdin to `python3 -B <absolute skill scripts/jev_review.py>`
+   from that sidecar. Resolve the helper as `../scripts/jev_review.py` relative
+   to this reference directory. Do not create another project report. The input
+   has exactly this shape; replace the illustrative revision and contents:
+
+   ```json
+   {
+     "reviewed_head": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+     "items": [
+       {
+         "id": "T001-AC1",
+         "criterion": "Reject an empty name.",
+         "evidence": "Recorded isolated Verify: test_empty_name passed."
+       }
+     ]
+   }
+   ```
+
+   Use the full review SHA supplied by the orchestrator, unique nonempty item
+   IDs, verbatim criterion text, and selected evidence text. Empty evidence is
+   allowed. The SHA is caller-supplied context; the helper does not prove Git
+   ancestry or that the text actually came from that revision.
+3. Read the JSON status. `disabled` means ordinary review. `unavailable` means
+   ordinary review with the explicit reason recorded in the assigned artifact.
+   Neither is a failed criterion. The helper exits zero for these optional
+   outcomes and makes no automatic retries. Correct invalid input/configuration
+   before an explicit retry; keep a service failure visible and continue review.
+4. For `ok`, inspect per-item `supported`, `partial`, `unsupported`, or `unclear`
+   answers, their probabilities, and confidence. Independently examine suggested
+   gaps under the existing rubric. A Jev answer is neither executable evidence
+   nor an independent review verdict. It cannot satisfy or waive a criterion,
+   change a gate, select a route, or authorize publication.
+5. Keep the advisory JSON receipt in the assigned review artifact's notes or
+   evidence prose, outside fixed-format verdict fields. An `ok` receipt includes
+   the supplied revision, SHA-256 of the exact canonical request, versioned model,
+   item IDs and answers, and token usage. An `unavailable` receipt includes the
+   reason and, only after request construction, the revision and request hash;
+   it has no model, answers, or usage. A `disabled` receipt contains only the
+   status and advisory marker. Retain the selected input with that evidence if it
+   is not already reconstructible from cited sources. Keep all canonical verdicts and template
+   structure unchanged. Reuse the recorded advisory when its exact request and
+   review revision remain unchanged; skip screening for a reused proven review.
+
+## Service behavior
+
+The helper calls only `https://api.typesafe.ai/v1/systemone` with the documented
+version `jev-1.13.0`. It does not follow redirects, echo provider error bodies,
+write files, or install packages. Missing keys/timeouts, HTTP and network errors,
+and invalid input/responses return `unavailable`. There is no confidence cutoff:
+the existing reviewer owns acceptance. Real model accuracy and savings must be
+evaluated on chosen evidence before relying on this advisory signal.
+
+Sources: [HTTP API](https://docs.typesafe.ai/api),
+[models](https://docs.typesafe.ai/models),
+[confidence](https://docs.typesafe.ai/confidence).

package/skills/gsd-path-build/references/model-policy.md

@@ -0,0 +1,139 @@
+# Dispatch model policy
+
+Before native dispatch, run the bundled `scripts/model_policy.py`. CLI dispatch
+uses the same resolver inside `dispatch_driver.py`. The helper owns model and
+effort decisions; apply its output instead of choosing again in prose.
+
+## Project choices
+
+Use `<repo>/.project/model-policy.json`, including when the active track is
+`.project/next`. This file owns project overrides. It is not phase status.
+No file is required to retain existing behavior. `path config` can also set user
+defaults in `~/.gsd-path/config.json` under `models`. Project common roles override
+user host and common roles. Within each scope, host roles override common roles.
+Task overrides still win, and recorded assignments stay pinned.
+
+```json
+{
+  "roles": {"coder": {"model": "inherit"}},
+  "hosts": {"codex": {"plan": {"effort": "high"}}}
+}
+```
+
+Values are exact advertised model/effort strings or `inherit`. This example
+illustrates configuration; it is not a cost-saving preset. Set concrete models
+only from the current host's advertised choices. Host-specific role settings
+override common role settings. Task settings override both, independently for
+model and effort; omitted fields retain the next applicable value. Explicit
+`inherit` removes that field's override. There are no automatic fallbacks.
+
+Role keys are `coder`, `reviewer` (wave, final, and gap review), `review_panel`,
+`skeptic`, `inspect_codebase`, `inspect_docs`, `docs_audit`, `research`, `decide`,
+`roadmap`, `plan`, and `plan_patch`. Use the logical task name as the assignment,
+not as the role. Keep each panel family and review lens a distinct assignment.
+
+The helper retains heavy effort hints for plan, plan_patch, decide, and roadmap;
+light hints for inspect_docs and docs_audit; otherwise effort inherits. Codex
+maps these hints to high/low. Other hosts use only advertised equivalents.
+Hints are conditional; unsupported explicit settings stop the affected child.
+
+Coders may have scalar `model:` and `effort:` fields in their task frontmatter.
+These are part of the approved task contract. Pass the task file with `--task`.
+For other roles, pass assignment-specific `--model` or `--effort` when the owner
+explicitly overrides the role choice. Coder settings do not affect reviewers.
+
+## Advertised capabilities
+
+Capture the current child tool's schema and advertised choices in a JSON file
+outside the product tree. For each supported control, provide its native field,
+allowed values, and, for CLI dispatch, its documented argument template. Omit
+unsupported controls. The values below are fixture examples, not a host catalog:
+
+```json
+{
+  "host": "codex",
+  "model": {"field": "model", "values": ["example-model"],
+            "args": ["--model", "{value}"]},
+  "effort": {"field": "reasoning_effort", "values": ["low", "high"],
+             "args": ["-c", "model_reasoning_effort={value}"]}
+}
+```
+
+`effort_hints` may map heavy/light to exact advertised equivalents. Supply
+`inherited_model` only when the host exposes its identity. Never infer models,
+fields, or CLI flags from a host name. Every existing host uses this contract,
+including hosts with no model or effort controls. Their explicit unsupported
+settings block; their default inheritance remains usable.
+
+## Native lifecycle
+
+Resolve the bundled helper to an absolute path. Use one record under the Git
+common directory's `gsd-path/model-selection/` directory per assignment. Scope
+the path and `--scope` to the milestone, active/lookahead track, and review cycle
+where applicable; later work must not reuse an earlier record.
+
+```text
+python3 -B <helper> resolve --repo <primary> --scope <milestone/track/cycle> --assignment <logical-name> --role <role> --record <absolute-record> --capabilities <advertised-json>
+```
+
+Only `status: ready` authorizes launch. Apply `selection.native` exactly to
+the advertised child tool, preserving the host adapter's other controls and
+GSD Path task isolation. The recorded selection applies to a fresh child too.
+If an existing child is still active, reattach or send its continuation;
+resolving again does not authorize launching a second copy. When a host cannot
+change model/effort on a resumed child, a changed selection requires a fresh
+child after terminal completion of the earlier one.
+
+After terminal completion, release the assignment with `release` using the
+same identity arguments and `--terminal-result <host-completion-evidence>`.
+To change the selection, use `reassign` with the same identity, current
+capabilities, explicit model/effort changes, and `--ruling <verbatim-owner-ruling>`.
+It requires an inactive assignment and preserves prior selection history.
+Resolve again before starting the replacement. A project-policy edit alone
+does not change an existing selection. Task-contract edits still require their
+legal pipeline path.
+
+For panel children, first resolve membership with `review_panel.py resolve`,
+passing `--parent-slug` when known and repeating `--exclude-family` for every
+known parent and canonical-reviewer family (including all deep review lenses).
+Apply these exclusions before persisting membership. Detected membership skips
+excluded families; explicitly named conflicts block. Pass its selected model through `--panel-model`, and pass `--panel-family` plus
+`--exclude-family` for known parent and
+canonical-reviewer families. Persist and reuse the panel roster. Policy cannot
+waive family independence or change canonical review authority. A changed
+panel roster requires a new legal review assignment.
+
+Requested controls are durable evidence. When the host hides the inherited
+model identity, exact effective-model continuity across fresh children remains
+unproven; report that limitation rather than asserting an identity.
+
+## CLI lifecycle
+
+Pass `--model-capabilities <advertised-json>` to the driver. Commands use whole
+argument slots `{model_args}` and `{effort_args}`; the resolver expands these
+to argument arrays. They are not shell substitutions. Remove fixed model and
+effort flags when using these slots; conflicting controls block dispatch.
+Commands with explicit policy choices must expose the corresponding slots,
+including when an explicit choice is `inherit`. Unconfigured legacy commands
+without a capability file retain their existing behavior.
+An existing legacy assignment with no recorded selection keeps its saved
+command across retries, even if project policy or capabilities are later added.
+It cannot use `reassign-model`; model controls require a new explicit assignment.
+
+Review and skeptic commands accept `--model` and `--effort` for that assignment.
+For distinct panel families or review lenses, pass `--model-overrides <json>`:
+a mapping from exact logical assignment names to model/effort objects. Each
+entry applies only to its named assignment; conflicting explicit inputs block.
+A common panel model must satisfy every selected family, so use these scoped
+overrides when families need different models. Family checks remain mandatory.
+Coders read their task overrides. Panels with capabilities use the argument
+slots; legacy panel commands may retain their existing `{model}` placeholder.
+
+The driver persists selection before launch and retains it on retry. Use
+`dispatch_driver.py reassign-model --repo <primary> --task-id <logical-name>
+--model-capabilities <advertised-json> --model <slug> --ruling <owner-ruling>`
+for an inactive unfinished assignment. Finished work and pinned panel rosters
+require a new legal assignment. Earlier attempt evidence is retained.
+
+Compare total cost only with observed usage and outcomes, including retries.
+These controls do not establish cost savings, pricing, or quality rankings.

package/skills/gsd-path-build/references/reviewer-final.md

@@ -0,0 +1,21 @@
+## Final integration mode
+
+Use only final-review.md. Treat INTENT.md success criteria as the rubric.
+Exercise the running system and record `met`, `not-met`, or `unverifiable`
+with checked command output or a precise file reference. When PLAN.md carries
+a `## Surface contract`, every criterion it lists under a surface is checked
+by performing that surface's Walkthrough from its Entry in the supplied
+sidecar: `Surface` names that surface, Check names what was performed,
+Observed records what the surface actually showed at each state, and a missing
+or unreachable surface is `not-met`. A surface criterion is never `met` on
+internal test output alone. Run project commands only in the supplied verify
+sidecar at the exact reviewed HEAD. Do not
+re-run PLAN.md's project Verify; cite the orchestrator's recorded
+project-verify sidecar output. `pass`
+requires every criterion to be `met`.
+
+## Final gap mode
+
+Use only gap-review.md. Check the one cross-wave risk in the brief against the
+running system in the supplied verify sidecar at the exact reviewed HEAD.
+Record evidence and `pass` or `blocked`; an unverified risk is blocked.

package/skills/gsd-path-build/references/reviewer-panel.md

@@ -0,0 +1,17 @@
+## Plan panel mode
+
+Use only plan-panel.md. Review `.project/plan/PLAN.md` and every task file
+against INTENT.md and SYNTHESIS.md. Do not edit those files. Write one
+finding block per issue, or `- none`. Mark `Kind: criterion` only when the
+finding names a written plan/task criterion; alternate designs are
+`Kind: preference`. This output is advisory. The structural plan gate and
+the user's approval remain the only plan gates.
+
+## Wave panel mode
+
+Use only wave-panel.md. Apply every Wave mode evidence rule (recorded SHAs,
+isolated patch, recorded Verify) when the brief supplies a verify sidecar.
+On a `deep` wave the brief is the adversarial lens only. Record findings
+the same way as plan panel mode. Do not write a Wave verdict and do not
+edit the canonical wave-review file. The canonical reviewer remains the only
+pass/fail.

package/skills/gsd-path-build/references/reviewer-skeptic.md

@@ -0,0 +1,20 @@
+## Skeptic mode
+
+Use only skeptic.md. The brief supplies one canonical criterion locator, the
+failed criterion verbatim, and every distinct blocking observation for that
+criterion from the `deep` wave lenses, plus the involved task files and their
+recorded bases and proven landing commits. The only job is to refute all of
+those observations.
+
+- Apply every Wave mode evidence rule (recorded SHAs, isolated patch,
+  recorded Verify) in the supplied sidecar, scoped to the tasks the
+  observations cite.
+- Address every distinct observation separately. Record `Verdict: refuted`
+  only when checked evidence refutes every observation by proving each
+  claimed failure cannot occur or the cited criterion actually holds.
+  Anything short of that is `Verdict: stands`.
+- Stage
+  `.project/review/wave-N.cycleC.skeptic-<criterion_locator>.md` under the
+  supplied sidecar.
+- Do not write a Wave verdict and do not review anything beyond the
+  supplied criterion and observations.

package/skills/gsd-path-build/references/reviewer-wave.md

@@ -0,0 +1,89 @@
+## Wave mode
+
+Use task acceptance criteria and the INTENT.md success criteria owned by
+tasks in this wave as the rubric. For each task:
+
+1. Read the task file's `base` and the landing commit SHA the orchestrator
+   supplied in your brief (it comes from `isolation.py land`/`recover`).
+   Never infer either SHA from task ids, branch position, or nearby history.
+2. Fail a missing, malformed, or invalid SHA. Inspect the commit with
+   `git show --format=fuller --stat --patch <commit> --`.
+3. In the supplied verify sidecar at `base`, apply only the complete
+   binary patch from `commit^..commit` for the task's declared product files
+   and inspect the diff. Use the orchestrator's recorded isolated Verify
+   output in that task's Log as the Verify evidence. Do not re-run the
+   task Verify command or PLAN.md's project Verify. Re-run a command only
+   when the recorded output plus the isolated diff cannot check the
+   criterion. Never use the primary worktree or branch tip as task
+   evidence. Do not create or remove Git worktrees yourself.
+4. Mark `pass` or `fail`. Before the evidence separator (` — `), copy the
+   complete task acceptance or interface criterion verbatim, joining wrapped
+   lines with spaces. Do not substitute an AC id or summary: finding grouping
+   binds this text to the task. Give the observed result, `file:line`, and
+   concrete fix direction for each failure.
+
+Then check each INTENT.md success criterion owned by a task in this wave
+against that same isolated product. Copy the criterion verbatim from
+INTENT.md. Mark `pass` or `fail` with evidence; a failed owned SC blocks
+the wave. Omit the Intent coverage section when no task in the wave owns
+an SC.
+
+Allow changed paths only in the task's `files` plus its assigned task file.
+Within the task file, allow orchestrator-owned `base`, `worktree`,
+`task_branch`, `status`, and `agent` fields plus append-only Log
+entries; block contract-body changes in the task commit. Warn on disabled tests
+or Verify commands that cannot fail unless either defeats a criterion. Set the
+wave verdict to `pass` only when every task passes and every owned INTENT
+success criterion for the wave passes.
+
+For cycle greater than 1, read the previous review, re-check every failure,
+and regression-check affected passes. State when the same criterion fails for
+a different reason. Use only the wave-review template.
+
+### Re-review after a proven repair
+
+When the brief supplies a `review_findings.py repair-evidence` receipt, use
+its isolated repair product for the linked original criteria, including owned
+INTENT criteria. The original faulty landing and earlier verdicts remain
+historical evidence; they do not force the later verdict to remain failed.
+Reconstruct the receipt's repair `base` plus only its `commit^..commit` patch
+for `files` inside the supplied sidecar. Read the repair task's recorded
+Verify, inspect the patch against the original unchanged contract, and reuse
+settled checks. Check unaffected criteria from their prior evidence plus the
+repair diff for regressions. Cite the receipt, repair landing and task Log in
+the new review. A receipt proves provenance, not acceptance: judge whether the
+repair actually satisfies the criterion. A missing or rejected receipt blocks
+using that repair; the parent resolves it rather than creating another product
+fix for the unchanged historical failure.
+
+## Final scope in a quick full wave
+
+When explicitly briefed with final scope, record `Review scope: final` and the
+full supplied review HEAD in the wave artifact. Check all INTENT success criteria
+and PLAN's Surface contract against the completed isolated product. Each surface
+criterion's Intent coverage block includes `- **Surface**:`, `- **Check**:`, and
+`- **Observed**:` with the walked states and actual result. Reuse recorded task
+output if it proves that exact walkthrough; run only a missing check. Final-scope
+coverage shares this wave artifact; do not write a second report. Shipping's
+runtime checks freshness and derives the final view from these records.
+
+## Deep review lenses
+
+A `deep` wave spawns two independent reviewers in parallel, each with a fresh
+context and its own verify sidecar at the recorded review base. Every
+Wave mode rule above applies to both lenses.
+
+- **Contract** — logical task name
+  `review_wave_<wave>_cycle_<cycle>_contract`; stages
+  `.project/review/wave-N.cycleC.contract.md`. This is the full wave review:
+  patches applied to the recorded base, recorded Verify plus diff, every
+  acceptance criterion and interface contract checked. Record `Lens:
+  contract`.
+- **Adversarial** — logical task name
+  `review_wave_<wave>_cycle_<cycle>_adversarial`; stages
+  `.project/review/wave-N.cycleC.adversarial.md`. Try to kill the work:
+  security holes, unhandled edge cases, failure modes, data-loss and
+  concurrency risks, missing error handling. Record `Lens: adversarial`.
+
+The wave passes only when both lenses return `pass`; any `blocked` lens
+blocks the wave.

package/skills/gsd-path-build/references/reviewer.md

@@ -17,159 +17,23 @@ Verify written GSD Path expectations and block failures. Never fix code.
   inside supplied sidecars. Never edit a product path or any other
   primary-worktree path. Stop on a missing input or template.
 
-## Wave mode
+## Load the assigned mode
 
-Use task acceptance criteria and the INTENT.md success criteria owned by
-tasks in this wave as the rubric. For each task:
+Read only the row matching the brief. Common rules below apply to every mode.
+Resolve sibling links against this role file's directory.
 
-1. Read the task file's `base` and the landing commit SHA the orchestrator
-   supplied in your brief (it comes from `isolation.py land`/`recover`).
-   Never infer either SHA from task ids, branch position, or nearby history.
-2. Fail a missing, malformed, or invalid SHA. Inspect the commit with
-   `git show --format=fuller --stat --patch <commit> --`.
-3. In the supplied verify sidecar at `base`, apply only the complete
-   binary patch from `commit^..commit` for the task's declared product files
-   and inspect the diff. Use the orchestrator's recorded isolated Verify
-   output in that task's Log as the Verify evidence. Do not re-run the
-   task Verify command or PLAN.md's project Verify. Re-run a command only
-   when the recorded output plus the isolated diff cannot check the
-   criterion. Never use the primary worktree or branch tip as task
-   evidence. Do not create or remove Git worktrees yourself.
-4. Mark `pass` or `fail`. Before the evidence separator (` — `), copy the
-   complete task acceptance or interface criterion verbatim, joining wrapped
-   lines with spaces. Do not substitute an AC id or summary: finding grouping
-   binds this text to the task. Give the observed result, `file:line`, and
-   concrete fix direction for each failure.
-
-Then check each INTENT.md success criterion owned by a task in this wave
-against that same isolated product. Copy the criterion verbatim from
-INTENT.md. Mark `pass` or `fail` with evidence; a failed owned SC blocks
-the wave. Omit the Intent coverage section when no task in the wave owns
-an SC.
-
-Allow changed paths only in the task's `files` plus its assigned task file.
-Within the task file, allow orchestrator-owned `base`, `worktree`,
-`task_branch`, `status`, and `agent` fields plus append-only Log
-entries; block contract-body changes in the task commit. Warn on disabled tests
-or Verify commands that cannot fail unless either defeats a criterion. Set the
-wave verdict to `pass` only when every task passes and every owned INTENT
-success criterion for the wave passes.
-
-For cycle greater than 1, read the previous review, re-check every failure,
-and regression-check affected passes. State when the same criterion fails for
-a different reason. Use only the wave-review template.
-
-### Re-review after a proven repair
-
-When the brief supplies a `review_findings.py repair-evidence` receipt, use
-its isolated repair product for the linked original criteria, including owned
-INTENT criteria. The original faulty landing and earlier verdicts remain
-historical evidence; they do not force the later verdict to remain failed.
-Reconstruct the receipt's repair `base` plus only its `commit^..commit` patch
-for `files` inside the supplied sidecar. Read the repair task's recorded
-Verify, inspect the patch against the original unchanged contract, and reuse
-settled checks. Check unaffected criteria from their prior evidence plus the
-repair diff for regressions. Cite the receipt, repair landing and task Log in
-the new review. A receipt proves provenance, not acceptance: judge whether the
-repair actually satisfies the criterion. A missing or rejected receipt blocks
-using that repair; the parent resolves it rather than creating another product
-fix for the unchanged historical failure.
-
-## Final scope in a quick full wave
-
-When explicitly briefed with final scope, record `Review scope: final` and the
-full supplied review HEAD in the wave artifact. Check all INTENT success criteria
-and PLAN's Surface contract against the completed isolated product. Each surface
-criterion's Intent coverage block includes `- **Surface**:`, `- **Check**:`, and
-`- **Observed**:` with the walked states and actual result. Reuse recorded task
-output if it proves that exact walkthrough; run only a missing check. Final-scope
-coverage shares this wave artifact; do not write a second report. Shipping's
-runtime checks freshness and derives the final view from these records.
-
-## Deep review lenses
-
-A `deep` wave spawns two independent reviewers in parallel, each with a fresh
-context and its own verify sidecar at the recorded review base. Every
-Wave mode rule above applies to both lenses.
-
-- **Contract** — logical task name
-  `review_wave_<wave>_cycle_<cycle>_contract`; stages
-  `.project/review/wave-N.cycleC.contract.md`. This is the full wave review:
-  patches applied to the recorded base, recorded Verify plus diff, every
-  acceptance criterion and interface contract checked. Record `Lens:
-  contract`.
-- **Adversarial** — logical task name
-  `review_wave_<wave>_cycle_<cycle>_adversarial`; stages
-  `.project/review/wave-N.cycleC.adversarial.md`. Try to kill the work:
-  security holes, unhandled edge cases, failure modes, data-loss and
-  concurrency risks, missing error handling. Record `Lens: adversarial`.
-
-The wave passes only when both lenses return `pass`; any `blocked` lens
-blocks the wave.
-
-## Skeptic mode
-
-Use only skeptic.md. The brief supplies one canonical criterion locator, the
-failed criterion verbatim, and every distinct blocking observation for that
-criterion from the `deep` wave lenses, plus the involved task files and their
-recorded bases and proven landing commits. The only job is to refute all of
-those observations.
-
-- Apply every Wave mode evidence rule (recorded SHAs, isolated patch,
-  recorded Verify) in the supplied sidecar, scoped to the tasks the
-  observations cite.
-- Address every distinct observation separately. Record `Verdict: refuted`
-  only when checked evidence refutes every observation by proving each
-  claimed failure cannot occur or the cited criterion actually holds.
-  Anything short of that is `Verdict: stands`.
-- Stage
-  `.project/review/wave-N.cycleC.skeptic-<criterion_locator>.md` under the
-  supplied sidecar.
-- Do not write a Wave verdict and do not review anything beyond the
-  supplied criterion and observations.
-
-## Final integration mode
-
-Use only final-review.md. Treat INTENT.md success criteria as the rubric.
-Exercise the running system and record `met`, `not-met`, or `unverifiable`
-with checked command output or a precise file reference. When PLAN.md carries
-a `## Surface contract`, every criterion it lists under a surface is checked
-by performing that surface's Walkthrough from its Entry in the supplied
-sidecar: `Surface` names that surface, Check names what was performed,
-Observed records what the surface actually showed at each state, and a missing
-or unreachable surface is `not-met`. A surface criterion is never `met` on
-internal test output alone. Run project commands only in the supplied verify
-sidecar at the exact reviewed HEAD. Do not
-re-run PLAN.md's project Verify; cite the orchestrator's recorded
-project-verify sidecar output. `pass`
-requires every criterion to be `met`.
-
-## Final gap mode
-
-Use only gap-review.md. Check the one cross-wave risk in the brief against the
-running system in the supplied verify sidecar at the exact reviewed HEAD.
-Record evidence and `pass` or `blocked`; an unverified risk is blocked.
-
-## Plan panel mode
-
-Use only plan-panel.md. Review `.project/plan/PLAN.md` and every task file
-against INTENT.md and SYNTHESIS.md. Do not edit those files. Write one
-finding block per issue, or `- none`. Mark `Kind: criterion` only when the
-finding names a written plan/task criterion; alternate designs are
-`Kind: preference`. This output is advisory. The structural plan gate and
-the user's approval remain the only plan gates.
-
-## Wave panel mode
-
-Use only wave-panel.md. Apply every Wave mode evidence rule (recorded SHAs,
-isolated patch, recorded Verify) when the brief supplies a verify sidecar.
-On a `deep` wave the brief is the adversarial lens only. Record findings
-the same way as plan panel mode. Do not write a Wave verdict and do not
-edit the canonical wave-review file. The inherit reviewer remains the only
-pass/fail.
+| Mode | Required procedure |
+|---|---|
+| Wave, full or deep; quick final scope | [Wave review](reviewer-wave.md) |
+| Skeptic | [Wave evidence rules](reviewer-wave.md) and [skeptic](reviewer-skeptic.md) |
+| Final integration or final gap | [Final review](reviewer-final.md) |
+| Plan panel | [Panel review](reviewer-panel.md) |
+| Wave panel | [Wave evidence rules](reviewer-wave.md) and [panel review](reviewer-panel.md) |
 
 ## Rules
 
+- When `GSD_PATH_JEV=1`, wave and final reviewers follow the optional
+  [Jev evidence screening procedure](jev-review.md) for uncovered criteria.
 - Review written expectations, not preferences or alternate designs.
 - Treat an Interface contract violation as a failed criterion, citing the
   contract line and the offending diff hunk.

package/skills/gsd-path-build/references/runtime-selection.md

@@ -0,0 +1,25 @@
+# Project runtime selection
+
+Before running a project runtime helper, check for
+`<absolute-project>/.gsd-path/runtime.json`. When present, run the stable launcher:
+
+```sh
+python3 -B <absolute-project>/.gsd-path/status_runtime.py --repo <absolute-project> --runtime-path
+```
+
+Use `python` only when it is the compatible Python 3.9+ interpreter. A failure
+stops helper execution: follow the exact-version restore action in the error.
+Do not install, upgrade, or fall back to the current plugin's runtime implicitly.
+
+The returned directory is the verified Project runtime. Resolve helper names
+present in its `manifest.json` from that directory, including status, state,
+isolation, integration, archive, recovery, build-state, final-verification, and guard helpers.
+The workflow runner resolves its subprocess helpers from this same directory;
+helper imports stay within the selected runtime. This rule overrides
+references to bundled copies of those helpers. Other skill helpers, templates,
+and role briefs remain in the installed skill bundle. Pass `-B` to Python helper
+invocations so execution does not create bytecode in the runtime store.
+
+With no declaration, retain the legacy helper lookup. An existing
+`.gsd-path/runtime/` requires the explicit `--runtime-migrate --project PATH`
+operation before adopting external storage; review the resulting Git diff.

package/skills/gsd-path-build/scripts/_common.py

@@ -9,6 +9,11 @@ consuming module keep working.
 
 from __future__ import annotations
 
+import sys
+
+# Runtime helpers must not modify their immutable installation.
+sys.dont_write_bytecode = True
+
 import json
 import os
 import re