@opengsd/gsd-path 1.3.1 → 1.4.0

package/AGENTS.md

@@ -43,13 +43,6 @@ full-repo suite on a tiny edit outrank the phase brief.
 
 - Start from disk, not conversation. If an input is absent from `.project/`,
   report it instead of inventing it.
-- `.project/discuss/DIALOGUE.md` and `.project/discuss/ANSWERS.md` are the
-  append-only memory for any-phase discussion. Read them before continuing an
-  existing thread; never treat chat history alone as durable context.
-- The discussion skill never commits. Every phase orchestrator treats only
-  complete append-only discussion records as expected bookkeeping and includes
-  them in its next normal `.project/` checkpoint; build does so before its next
-  clean layer base, and ship includes them in its transaction.
 - A discussion answer with `Status: final` or `NEEDS-USER`, `Follow-up:
   required`, and no later `Disposition X###` receipt is pending. Before phase
   work and again before a phase gate, the router and current phase run the
@@ -64,43 +57,6 @@ full-repo suite on a tiny edit outrank the phase brief.
   current phase with links to ANSWERS.md and the target artifact and ask the
   user; never auto-advance or archive it. Only the user may authorize
   `rejected-by-user`.
-- Write every output to the handoff path in WORKFLOW.md, using the absolute
-  bundled template path supplied by the active phase skill. An output that
-  needs verbal explanation is defective.
-- With no `.project/STATE.md`, route through the bundled
-  `scripts/detect_project.py initialize --repo <absolute-root> --template
-  <absolute-state-template> --require-git` helper; `route: setup-repository`
-  leaves the invocation folder unchanged and routes to repository setup before
-  state creation or branch binding. Never delete the invocation folder or its
-  state to satisfy bootstrap path checks. Do not classify from a directory listing
-  or conversation. Follow its JSON `verdict` and `route`. Reserve `classify`
-  for read-only inspection; do not use it as a state-initialization preflight.
-- `.project/STATE.md` tracks phase position. Parse and validate it only with
-  the bundled `scripts/pipeline_state.py validate` command, route with its
-  `route` command, and make ordinary phase transitions only with its
-  expected-state `transition`. A journaled transaction helper may write only
-  the state fields its contract explicitly owns. Never reproduce these
-  deterministic operations in model reasoning. The
-  orchestrator alone owns task frontmatter base, isolated worktree/branch,
-  status, and agent; the landing commit is proven from git by `isolation.py
-  recover`, never recorded. Require `pipeline: gsd-path/v2`; never
-  consume an ambiguous or differently owned state file. Artifacts outrank
-  summaries; reconcile STATE.md when it disagrees with task frontmatter.
-  During a program build, `.project/next/STATE.md` may hold
-  the lookahead planning track for the next milestone; it follows the same
-  marker rule, owns no task frontmatter, and never binds a branch.
-- STATE.integration_default is the project closeout choice and
-  STATE.integration is the current milestone choice. Both are `direct` or
-  `pull-request`; STATE.integration_source is `default` or `milestone` and
-  preserves explicit override provenance. Older v2 state defaults to `direct`,
-  and modes may be changed only through `pipeline_state.py
-  configure-integration` before build. A next milestone resets its current
-  choice from the project default.
-- Spawned agents have isolated context. Follow the installed runtime dispatch
-  contract and brief them with exact input and output paths, constraints, a
-  deterministic logical task name, and a bounded responsibility. Independent
-  briefs may run in parallel up to available child capacity; a dependent
-  brief runs as soon as its dependencies complete.
 - After a phase completes its gate and state update, run the bundled
   `pipeline_state.py status --repo <absolute-root>` with the routed
   `--project-dir`. Its `handoff` is the shared phase handoff for chat and the
@@ -114,6 +70,8 @@ full-repo suite on a tiny edit outrank the phase brief.
   a route is not approval. Return to an active caller instead of invoking an
   explicit-only sibling skill. Derive the next phase from this result, not
   from another lane table in prose.
+- Phase skills bundle the remaining rules in `references/operating-rules.md`;
+  read it before phase work.
 
 ## Plain-prompt re-entry
 
@@ -154,139 +112,6 @@ full-repo suite on a tiny edit outrank the phase brief.
   Questions never silently disappear between phases.
 - Record user corrections and vetoes verbatim.
 
-## Stay in role
-
-- The codebase mapper and docs auditor observe and verify; they are strictly
-  read-only, report observations rather than judgments, and never resolve a
-  doc-vs-code conflict — that ruling belongs to the user.
-- Build, test, lint, and help commands are not presumed read-safe. Read-only
-  roles run project commands only in orchestrator-created disposable worktrees
-  at a recorded revision; otherwise they use static evidence or mark the check
-  unverifiable. They never create worktrees or run commands in the source tree.
-- Researchers gather evidence; they do not decide. A dimension is researched
-  only when it has open questions; the research phase records dispatched and
-  skipped dimensions. Brownfield adds `evidence-codebase.md` as settled input.
-- The decider works from existing evidence; it does not re-research. An
-  unresolved or uncited required decision fails the synthesis gate.
-- The planner reads both INTENT.md and SYNTHESIS.md and specs
-  deliverable-sized outcomes and constraints; every INTENT success criterion
-  maps to a task AC and Verify in PLAN.md Intent coverage. Coders own
-  implementation decisions inside those bounds.
-- Coders implement only their full task contract, including owned INTENT
-  success criteria read from INTENT.md, and append their result to the
-  task Log. They never change task state, review acceptance, stage, commit, or
-  freelance outside declared files.
-- The orchestrator dispatches, arbitrates, and creates task isolation and
-  verify sidecars through the bundled `scripts/isolation.py` helper — named
-  branches only, never a detached HEAD — lands task work serially, and
-  records each clean base in task frontmatter; `land` stamps the landed
-  state into the task's own commit, so a task has exactly one commit. It
-  writes no product code. When a done task's work already sits on the bound
-  branch without a landing commit, only an explicit owner ruling through
-  `isolation.py attest` may stand in for it: one `.project/`-only commit that
-  names the base, the attested HEAD, the declared files that changed, the
-  task Verify recorded as passing at that HEAD, and the ruling verbatim.
-  `recover` reports it as `attested`, never as a proven landing.
-- All pipeline work for a milestone lives on `gsd-path/M00N` (M001, M002,
-  …) bound in STATE.branch. The next milestone binds a new unused
-  `gsd-path/M00N` at the remote default after the previous ship integrates.
-  Integration at ship is the only path from the bound branch to the default
-  branch — either Path's direct merge or a Path-owned PR merged by the user.
-  The bound branch never receives merges or back-merges and is never the
-  GitHub default.
-- After initialization writes STATE.md, and before entering the first pipeline
-  phase in an existing Git repository, the router calls
-  `scripts/pipeline_git.py bind-initial` with the selected M00N and exact
-  fetched `origin/main` SHA. The helper alone checks worktree identity and
-  cleanliness, exact base, and every local, remote, and other-worktree
-  collision before creating or adopting the branch. The sole cleanliness
-  exception is untracked `.project/STATE.md`: validated v2 state in active
-  inspect or define, with null milestone, branch, and archive, in a real
-  directory containing only that regular file with no hard links. The helper
-  checks its identity and bytes across binding. Do not commit initialization
-  before binding. The router persists its
-  typed result in the new state. Build has no branch-creation authority.
-- After `validate-integrated` passes and before any next-milestone file
-  changes, the router calls the bundled `scripts/pipeline_git.py bind-next`
-  helper with the previous bound branch, exact ship SHA, and exact current
-  `origin/main` SHA. The helper moves the clean primary worktree to the new
-  unused `gsd-path/M00N` branch at that SHA without moving the previous
-  branch or entering the default checkout, then retires the integrated
-  previous branch — deleted locally and on origin; the ship commit stays
-  reachable from the integration merge and its annotated tag. The router
-  persists the new branch in STATE; a wrong-SHA or colliding branch blocks.
-  After validated PR integration, `bind-next --allow-missing-previous` may
-  retire only the local previous branch when GitHub already auto-deleted its
-  remote branch.
-  `bind-initial`, this handoff, and the approved new-repository bootstrap are
-  the only bound-branch creation authorities, and the handoff's retirement
-  push is the router's only bound-branch deletion authority. When a lookahead
-  track exists, the router then calls `scripts/pipeline_state.py promote-next`;
-  only that journaled helper moves the track, updates state and roadmap,
-  classifies plan drift, and writes the router promotion commit.
-- Build adopts the branch recorded in STATE.branch, never whatever is current
-  when a recorded branch exists. A new-GitHub REPOSITORY.md proves the
-  default checkout and first bound branch; later milestones may rebind
-  `gsd-path/M00N` without rewriting that artifact. Build ignores older
-  milestone ship and integrate commits inherited through main. A ship commit
-  for the current STATE.branch milestone must be an ancestor of origin/main;
-  if it is not, that milestone's integration is incomplete and control routes
-  to ship, not build. Direct mode requires the matching canonical `integrate:`
-  commit; PR mode requires tag metadata and a two-parent merge whose second
-  parent is the ship commit. A null branch returns
-  to the router; build never creates, selects, switches, or rebinds it.
-- The ship phase makes exactly one commit on the bound branch — the
-  `.project/`-only ship commit recording
-  STATE.md, the final-review artifacts, and the archive — and additionally
-  owns the integration leg. Direct mode creates and pushes one `--no-ff` merge
-  onto `main` with subject
-  `integrate: M00N — merge gsd-path/M00N into main`. Pull-request mode creates
-  or reuses one GitHub.com PR and waits for the user to merge it with a merge
-  commit; it never auto-merges. Both modes create one annotated
-  `milestone/<NNN>-<slug>` tag after merge validation.
-  The roadmap and
-  plan phases each make exactly one approval checkpoint commit
-  (`.project/`-only, deferred to the build transition commit during a
-  new-repository transaction or before Git exists). Their bundled
-  `pipeline_state.py approve` command journals before changing STATE or
-  ROADMAP.md and owns that canonical checkpoint; a routed
-  `resume-checkpoint` must finish before phase work. The router makes one
-  bookkeeping commit through `pipeline_state.py promote-next` when promoting a
-  lookahead track at a milestone boundary. Every other commit belongs to the
-  orchestrator.
-- Reviewers verify and block; they never fix. A block names the criterion,
-  observed result, evidence location, and concrete fix direction. An optional
-  review panel is advisory: the canonical reviewer remains the only wave
-  pass/fail, and panel findings never average or auto-replan. Same-model
-  agreement is not independent verification: matching verdicts from one
-  model family count as a single evidence path. Independence comes from
-  re-run commands, reconstructed patches, different sources, or a
-  different model family. Resolve panel
-  membership with the bundled `scripts/review_panel.py` helper; do not invent
-  model families or slugs. Create task isolation and verify sidecars with the
-  bundled `scripts/isolation.py` helper; do not invent `git worktree add` or
-  `--detach`. Undo unpublished pipeline work with `scripts/pipeline_undo.py`;
-  do not invent `git reset`. Diagnose a stuck pipeline with
-  `scripts/pipeline_diagnose.py`.
-- A bundled helper that exits non-zero stops the current step. Print its
-  stderr verbatim, run `scripts/pipeline_diagnose.py diagnose --repo
-  <absolute-root>` (bundled with `$gsd-path-forensics`), and report both.
-  Do not rerun the same command unchanged unless the helper's own contract
-  names that exact rerun as its interruption recovery. Never repair state or
-  Git by hand instead.
-- The discussion sidecar may run during any non-shipped phase. It grounds
-  answers in code and phase artifacts, may perform focused research when
-  needed, and writes only its discussion artifacts; it never changes phase
-  state or bypasses a phase gate.
-- During an uncommitted archive transaction, discussion writes a complete
-  active copy that extends the archived pair. The ship phase reruns `prepare`;
-  the helper validates the prefix and atomically reconciles both files.
-  Discussion never edits an archive directly or writes after shipment.
-- The loop runner wraps explicit skills in a bounded check → verify → fix →
-  verify pass driven by a LOOP.md spec. It never advances a phase gate
-  itself and never commits or pushes.
-- Fix tasks use the complete task template, not an abbreviated finding.
-
 ## Gates
 
 - Same-wave dependencies execute in dependency order; a task dispatches as
@@ -344,36 +169,6 @@ full-repo suite on a tiny edit outrank the phase brief.
   and state whether the active router continues automatically or which exact
   explicit skill the user should invoke next.
 
-## New GitHub repositories
-
-- Create a GitHub repository only from an explicit user request followed by an
-  approval of the exact owner/name, visibility, default-checkout path,
-  `gsd-path/M001` branch, and linked primary-worktree path. Before the
-  external action produces an artifact, present those proposed targets as the
-  inline **Review** surface using the active router's preview contract.
-  Do not write a
-  preview file into the invocation directory or another repository. Run the
-  bundled bootstrap helper's read-only `preview` command for this evidence.
-- After approval, the bootstrap helper persists the exact targets under the
-  approved workspace before the first external mutation. Its `create` command
-  creates or verifies the remote, checkout, branch, and linked worktree one
-  stage at a time. A matching journal permits explicit resume and adoption; a
-  collision without that journal blocks. The helper removes the journal only
-  after writing owned STATE.md and fixed-format `.project/REPOSITORY.md` in the
-  linked worktree.
-- During an approved new-repository transaction, the router may create the
-  first GSD Path branch and linked primary worktree at the verified
-  remote-default SHA and persist that branch in STATE.md and REPOSITORY.md.
-  Build must verify and adopt that exact binding from REPOSITORY.md, never a
-  free-form log. Task branches and task worktrees remain exclusively
-  build-orchestrator owned.
-- Keep the cloned default checkout clean on the remote default branch. Run the
-  pipeline from the linked GSD Path worktree; never initialize `.project/` in
-  the default checkout, reuse an existing branch or path (except an explicitly
-  approved empty linked-worktree folder via `--reuse-empty-worktree`), move an existing
-  repository, or recover a partial GitHub creation without the exact approved
-  journal and re-verification.
-
 ## Escalation
 
 Stop and ask the user only when:

package/CHANGELOG.md

@@ -98,3 +98,284 @@ are documented here. Format follows [Keep a Changelog](https://keepachangelog.co
 ### Fixed
 - describe untracked legacy migration in help
 - preserve older untracked runtimes during migration
+
+## [1.4.0] - 2026-09-30
+
+### Added
+- key verify ledger rows by repo and fail closed on member drift (S3d)
+- guard coders in member sidecars with coordinator host hooks (S3c3b2)
+- dispatch and land member tasks in build rounds (S3c3b1)
+- activate member tasks with a live copy in the member sidecar (S3c3a)
+- prove landed member tasks from record and member landing (S3c2b)
+- land member tasks with a journaled two-repo landing (S3c2a)
+- isolate member tasks in Path-owned member checkouts (S3c1)
+- shrink the AGENTS.md block and move phase rules into skills
+- install AGENTS.md as a managed gsd-path block
+- lock members and create member bound branches at build start (S3b)
+- plan member tasks with repo: (S3a)
+- pre-approve intent and plan gates for unattended quick lanes (#150)
+- hold member writes to the coordinator phase (S2d)
+- install member git hooks with --member-of (S2c)
+- add member mode to git guard with push authorization (S2b)
+- add multi-repo member role marker (S2a)
+- add multi-repo member contract (S1)
+
+### Changed
+- Reflow Copilot exclusion wording in trust-validation docs
+- record 1.4.0 live release evidence
+- prepare 1.4.0 minor candidate
+- Note invalid-copy rejection evidence in multi-repo S5d
+- multi-repo: native retry for a failed member task
+- Refresh multi-repo activation docs and host guidance
+- multi-repo: native member task dispatch
+- evaluate_host: keep the release addendum on the quick scenario only
+- multi-repo S5d: two-repo host scenario
+- Clarify optional hooks and remove obsolete gate note
+- multi-repo S5c: activate member execution and document it
+- Correct S5b member documentation
+- record app release tags and Linux formats
+- daemon: refuse cross-site and non-JSON POSTs
+- plan a native dashboard app for every OS
+- multi-repo S5b: greenfield members and member detect
+- Make ReplaceTests portable to POSIX Python 3.9
+- Align two-repo proof documentation with test coverage
+- multi-repo S5a: two-repo full-cycle proof
+- Point lookahead drift guidance to S4d
+- multi-repo S4d: member lookahead drift check
+- Clarify active milestone member status documentation
+- multi-repo S4c3: member plan check, status, and diagnose
+- Document member undo safeguards
+- multi-repo S4c2: undo a member landing
+- Document member retirement guards and correct proof scope
+- multi-repo S4c1: retire member bound branches at bind-next
+- Exercise core.autocrlf=true in the attributes test under the dev runner
+- Keep .project LF under core.autocrlf=true with a local attributes rule
+- Port the member-close changes from main to native Windows
+- Patch only the probe module's os in the Windows retry test
+- Port the multi-repo member tests to native Windows
+- Run the native Windows gate in CI and make it blocking
+- Never skip an archive check because resolve() raised on Windows
+- Decode test subprocess output as UTF-8
+- Use the directory mutex for the discussion lock outside git on Windows
+- Make member-isolation and release-receipt tests portable to Windows
+- Decode archive and projection test output as UTF-8
+- Lock discussions outside git on Windows and report sync paths with slashes
+- Type guard-test helper paths the way Git Bash agents do
+- Retry installer lock and skill-directory moves on Windows
+- Make installer and core-migration tests portable to Windows
+- Keep doctor running when git is not on PATH on Windows
+- Make the runtime lifecycle tests portable to Windows
+- Retry runtime directory renames on Windows and copy the launcher exactly
+- Expect native paths in the Zed and Grok host command tests
+- Close OpenCode session-store connections so Windows can delete them
+- Read dispatch briefs as UTF-8 in the fake children
+- Send native Windows relative paths to git with forward slashes
+- Make daemon tests platform-correct on Windows
+- Write plugin-managed files as UTF-8 bytes
+- Keep discovered project roots in their original case on Windows
+- Compare lookahead layout as POSIX paths on Windows
+- Resolve codex through PATHEXT in the Codex evaluation harness
+- Shadow the real codex in the evaluate_codex test on Windows
+- Keep tests from ever reaching a real GitHub account
+- Send subprocess input to git byte-exact on Windows
+- Document native Windows requirements
+- Make the Node suite and dev runner portable to Windows
+- Make test fixtures portable to Windows
+- Update member ship documentation and sync skill copies
+- multi-repo S4b2b: post-commit member ship checks
+- tests: hold and reap dispatch wrappers started in-process
+- Align multi-repo work plan with S4b2a
+- Reuse a final-scope wave review whose Surface field carries detail
+- tests: keep git auto-maintenance in the foreground
+- multi-repo S4b2a: member close and ship body lines
+- tests: finish git housekeeping before trust-evidence temp cleanup
+- Clarify member PR integration documentation
+- multi-repo S4b1b: member pull-request integration
+- Document member integration recovery and refresh rules
+- multi-repo S4b1a: member direct integration
+- Split child commands with POSIX quoting and write runtime output as UTF-8
+- Install hooks and wrap Core hooks correctly on Windows
+- Close Windows guard bypasses and decode text as UTF-8
+- Run dispatch, verify, and loop processes portably on Windows
+- Create STATE.md on Windows through pinned handles
+- Lock pipeline state on Windows and write product files as LF bytes
+- Leave the Windows CI job to the PR where Windows passes
+- Isolate USERPROFILE with HOME in tests
+- Pick the lock implementation by what imports, and split Windows CI suites
+- Write test fixtures as exact UTF-8 LF bytes
+- Write package.json as LF bytes in the skill-resource sync
+- Add Windows platform helpers, portable dev runners, and a Windows CI job
+- Clarify member head binding documentation
+- multi-repo S4a2: member reviewed heads in the final review
+- Point workflow to member Verify contract
+- multi-repo S4a1: member sidecars for project Verify
+- Correct S3d ledger and drift guidance
+- Clarify member sidecar hook documentation
+- Refresh member dispatch documentation and generated comments
+- Document member activation safeguards and recovery
+- Document member landing proof and archive recovery
+- Correct member landing documentation and hook details
+- merge: preserve validated dashboard fixes after publication timeout
+- Refresh dashboard and tray documentation
+- Clarify native retry finish documentation
+- Align S3c documentation with member execution timing
+- dispatch_driver: finish a native retry after a blocked driver attempt
+- Drop the Node copy of the project runtime file list
+- Correct managed AGENTS.md guidance and ADR context
+- Document ignored .DS_Store setup behavior
+- Document S3b build-start lock and recovery
+- Sync generated GSD Path scripts
+- Clarify Finder junk handling in pipeline docs
+- Document pre-approval scope and reconcile gate guidance
+- Correct stale multi-repo planning documentation
+- Document legacy ledger checkpoint behavior
+- Document ignored .project artifact handling
+- Clarify local skill edit recovery guidance
+- Correct stale S2d work plan guidance
+- Clarify research transition gate documentation
+- propose ADR 0003 managed AGENTS.md block
+- Clarify first-install contract collision guidance
+- Clarify half-retire recovery documentation and verify formatting
+- Document Claude staging cleanup during shipment
+- Document ignored pipeline state recovery
+- Correct S2c member hook work plan
+- Document native parallel finish recovery
+- Clarify member guard documentation and authorization lifetime
+- Clarify member marker documentation and verify formatting
+- Update S1 plan and remove stale allowlist entry
+- Clarify member delete authorization and close recovery proof
+- close multi-repo plan open items R23-R24
+- Clarify member documentation and correct S5 doc targets
+- close multi-repo plan open items R17-R20
+- add multi-repo coordinator ADR and work plan
+- update release notes for v1.3.1
+
+### Fixed
+- Fix three Windows races and identity mismatches found on the rebased stack
+- Fix the member-build-start path regex
+- Fix the Windows CI-only test failures and a Python 3.9 guard crash
+- Fix the last native Windows test failures
+- show actual project folders in toolbar rows
+- group tray status progress and usage on separate lines
+- keep tray folder paths in tooltips
+- show project identity and wrap tray panel details
+- wrap full project paths on dashboard board
+- show main project folder alongside dashboard worktree
+- keep runtime module identity independent of test order
+- detect legacy marker as a whole line; keep distribution layout in AGENTS.md
+- match AGENTS.md markers as whole lines; doctor flags a cut block
+- harden AGENTS.md block install and uninstall
+- ignored .DS_Store in .project no longer orphans project setup (#149)
+- skip ignored .DS_Store inside .project subdirectories (#149)
+- keep DOCS-AUDIT Repo root on the primary repo, not the sidecar (#148)
+- commit a legacy ignored verify ledger in build checkpoints
+- skip ignored untracked .project entries in ship allowlist checks (#149)
+- say local skill edits are not carried forward (#151)
+- let decide run the research handoff check at decide/active
+- name a working path when --project finds an existing contract
+- prune empty host .claude dirs before .project gates
+- let retire recover a half-retired task worktree
+- refuse landings when ignore rules hide .project state
+- let finish land natively dispatched parallel tasks
+
+### Other
+- Align Copilot exclusion docs with persistent validator exclusion
+- Let forced member retire proceed on invalid task copy
+- Correct native member diff instructions and track retry gap
+- Record Claude and Codex two-repo host proof
+- Fix native member routing and isolate host scenario
+- Align activation host proof with pre-merge gate
+- Correct S5d host proof and release timing
+- Synced the canonical Windows checkout-path fix into 11 generated skill copies. Before the change, the resource sync check failed and caused the reported test failures. Afterward, the sync check, four affected Node tests, and 66 focused Python tests passed. Windows CI still needs to rerun
+- Fixed the Windows checkout-path comparison and replaced three test-fixture deletions that fail on read-only Git objects. The regression test failed before the fix and passed after; 66 focused tests pass locally. Windows CI still needs to rerun. The ponytail skill was unavailable in this environment
+- Record A1 daemon version and port ownership questions
+- Move legacy cleanup into A1 and require version bumps
+- Gate daemon reuse by bundled version
+- Specify app update index and verify migration cleanup
+- Plan legacy autostart cleanup during app upgrade
+- Resolve native app plan review findings
+- Fixed the Windows test fixtures in tests/test_member_create.py: Git now gets a forward-slash temporary path, and the gh test uses a platform-independent fake process. All 22 focused tests pass locally; both fixes failed sensitivity checks when deliberately undone. Windows CI still needs to rerun
+- Pin GitHub host and verify remote main
+- Verify checkout history and resume partial clones
+- Honor configured origins and prevent repository recreation
+- Reject invalid checkouts and stale clone reuse
+- Fix member creation recovery and validation
+- Prove member hook denials and branch retirement
+- Fixed two Windows daemon test races in tests/test_daemon_serve.py. The activity test now counts events for its own project. The poll test stages STATE.md outside the watched directory and retries a transient replacement lock. The activity failure was reproduced locally before the fix; all 15 daemon serve tests pass after it, including a simulated file-lock check. PR #230 remains open; CI has not been rerun in this phase
+- Reuse linted member base for lookahead approval
+- Detect member rename drift and fix done-task test
+- Filter done member drift; focused test remains failing
+- Scope member status to the active milestone
+- Block member undo while landing journals are pending
+- Guard member undo against publication and concurrent landings
+- Harden member undo journaling, recovery, and locking
+- Guard member retirement against moved refs and team checkouts
+- Sync member status fix to generated skill copies
+- Keep member status validation read-only
+- Read staged member lock in ship guard
+- Repair merged member PR body before tagging
+- Validate member PR provenance and repair reused bodies
+- Set Git identity in the temporary member test repository to fix the CI merge failures. The focused test reproduced the failure before the change; all 11 member integration tests passed after it, and a sabotage check reproduced the failure. Ponytail review found no smaller fix. CI has not rerun
+- Fixed the test fixture in tests/test_member_integration.py by setting the bare remote’s HEAD to main. The CI-style Git setting reproduced the 4 failures and 5 errors before the fix; all 11 focused tests passed after it. Skipping the new line caused the original error again. Ponytail review found no smaller fix. CI has not rerun
+- Guard member merges, resume interrupted branches, and refresh validation
+- Ignore commented member heads in review headers
+- Retire switched member sidecars without changing bound branches
+- Retire detached sidecars and retain member Verify output
+- Refuse colliding members and clean up rejected Verify
+- Fix member Verify sidecars and final review reuse
+- Fix member drift detection and document Verify output policy
+- Report untracked host config collisions during activation
+- Restore and validate member hooks before every launch
+- Both CI jobs failed because the temporary member repository had no Git author identity. I set its identity in the test fixture. The member-round suite passed (9 tests) with automatic identity discovery disabled; removing the fixture setting reproduced the failure. `git diff --check` passed. The ponytail skill was unavailable. An earlier diagnostic command created an empty `/tmp/ci-verify-18.log` outside the worktree; I made no other out-of-worktree changes
+- Retire recovered members and clarify locked brief bases
+- Recover partial and stale member isolates
+- Fix member task resume, retirement, and contract drift
+- Reject tracked and symlinked member copy paths
+- Reject missing member task agents
+- Unify member task contract field checks
+- Fix member recovery, activation, and retirement safeguards
+- Reject changed member task contracts after landing
+- Harden member landing proof across archival and status
+- Serialize coordinator landings and block pending member journals
+- Serialize member landings with per-member locks
+- Guard member landing with STATE branch checks
+- Fix member landing recovery and contract checks
+- Preserve bare-backed worktree identity and paths
+- Fix nested project identity and worktree paths
+- Fix dashboard search by repository name
+- Guard member checkout reuse and retirement ownership
+- Fix member isolation placement, lock guidance, and retirement
+- Preserve AGENTS.md owner text across updates and uninstall
+- Reject symlinked member lock paths
+- Remove stale member lock when tasks drop members
+- Preflight member build starts before creating refs
+- Preserve tracked .DS_Store in archive manifests
+- Resolve landed member bases during plan approval
+- Honor canonical lane and Config during preauthorization
+- Fix staged legacy ledger checkpoint retries
+- Validate docs audit rulings before preapproval
+- Warn on legacy Codex skill backups
+- Clarify block cutoff and release evaluation scope
+- Reference PR #161 in rejected option
+- Clarify managed block size and migration exceptions
+- Skip unreadable listed checkouts when checking foreign members
+- Resume blocked decide before the research recheck
+- Fix stale member markers, symlinks, and Git inspection failures
+- Suppress unsafe move when contract backup exists
+- Probe plan and archived ledger ignore rules
+- Probe fixed-name project files before landing
+- Require managed coordinator guard before installing member hooks
+- Harden member hook staging and worktree path checks
+- Require origin/main baseline for member joins and pushes
+- Reject nonfile member markers until manual removal
+- Preserve marker directory errors in validation
+- Reject redirected member marker directories
+- Write member marker before recording membership
+- Skip valid markers during member repair
+- Fix member marker recovery and coordinator ownership
+- Fix member validation and duplicate repository detection
+- Authorize direct member bound branch publication
+- Specify per-ref member push authorization for close
+- Fix member branch, landing, and ship recovery plan
+- Revise multi-repo plan for accepted design reviews
+- Align multi-repo plan with member binding decisions

package/DOCS.md

@@ -35,6 +35,7 @@ DOCS.md (here)     four journeys in one place
 | **Upgrading** — new gsd-path version | [UPDATE.md](UPDATE.md) |
 | **Team** — pin skills in repo | `--local` install; see [Installing](#installing) |
 | **Shipping broke** — archive commit blocked | [HOOKS.md](HOOKS.md) (expected with hooks) |
+| **Several repos** — one milestone changes them all | [Multi-repo milestones](README.md#multi-repo-milestones) |
 
 ---
 
@@ -92,7 +93,8 @@ node scripts/install.mjs --claude --project "$(pwd)" --hooks
 ```
 
 **Requirements:** Node 18.17+. Project installs also require Python 3.9+ as
-`python3` or `python`. **Always** restart the agent session after install.
+`python3`, `python`, or `py -3`. Windows also needs Git for Windows (see the
+README's Windows notes). **Always** restart the agent session after install.
 
 **Host flags** are derived from `scripts/skill-resources.json`. Run
 `node scripts/install.mjs --help` for the current `--<host>` list.
@@ -157,6 +159,9 @@ state or bypasses a gate.
 
 ### Gates (what you approve)
 
+These are the usual checkpoints. For the opt-in quick-lane grant, see
+[pre-approval in the README](README.md#start-your-first-project).
+
 | Phase | You do |
 | --- | --- |
 | Define | Answer gaps or review milestone derivation; approve intent playback |
@@ -300,7 +305,8 @@ Full tree: [README.md](README.md#handoff-contract).
 | Project-local skills | `node scripts/install.mjs --update --local` |
 | From npm | `npx @opengsd/gsd-path@latest --update` |
 | Guard scripts | `node scripts/install.mjs --hooks-refresh --project PATH` |
-| `AGENTS.md` / `WORKFLOW.md` | Manual merge — installer refuses overwrite |
+| `AGENTS.md` | `node scripts/install.mjs --update --project PATH` — replaces only the GSD Path block |
+| `WORKFLOW.md` | Manual merge — installer refuses overwrite |
 | Health check | `node scripts/install.mjs --doctor [--project PATH]` — read-only; flags missing/stale skills, hook drift, and bad pipeline state |
 
 Full guide: **[UPDATE.md](UPDATE.md)**. Router may print a one-line npm update notice.
@@ -321,10 +327,8 @@ Restart the host session. Confirm with `ls ~/.claude/skills/gsd-path` (or your h
 Yes: `node scripts/install.mjs --cursor` (add other flags as needed).
 
 **Will install overwrite my `AGENTS.md`?**
-No — if managed project files already exist, a plain install refuses and installs
-nothing for that project. Use `--update --project PATH` to refresh skills and the
-managed `.gsd-path/` runtime while keeping your contracts; merge project
-contract updates manually ([UPDATE.md](UPDATE.md)).
+No. GSD Path adds one marked block and keeps your text outside it byte for
+byte. See [Update project contracts](UPDATE.md#update-project-contracts).
 
 **Where is pipeline state?**
 `.project/` in your repo — not chat history.
@@ -357,7 +361,9 @@ document with a body is brownfield and routes to inspect. A title-only README,
 GSD Path skill bundles: a `gsd-path*` or `ogsd*` bundle is verified under a
 supported installer skill root or when it contains `SKILL.md`; a similarly
 named source directory still counts normally. Those scaffold-only trees stay
-greenfield and route to define. Other `.project/` content without STATE.md is
+greenfield and route to define. An ignored, untracked regular `.DS_Store`
+directly in `.project/` does not block setup, even if it appears while
+STATE.md is being created. Other `.project/` content without STATE.md is
 orphaned and blocks for recovery. An owned state, including the new-GitHub
 bootstrap state, routes by STATE.md after classification without running the
 initializer. After a milestone ships, the next one inspects again.

package/FULL.md

@@ -31,8 +31,10 @@ writes a fixed artifact under `.project/`; the next phase reads only from disk.
 You can close your session at any point and a fresh session resumes exactly
 where you left off.
 
-You are the gate: nothing advances past intent, plan approval, or final review
-without your approval.
+You approve intent, plan, and final shipping. For an unattended quick-lane run,
+you can grant intent and plan approval when invoking the router; see
+[pre-approval in the README](README.md#start-your-first-project). Final shipping
+still needs your approval.
 
 ### The pipeline
 
@@ -79,7 +81,10 @@ Use the [router and phase invocation table](README.md#install-summary) for your
 ### Requirements
 
 - **Node 18.17+** for `scripts/install.mjs` (recommended; also the npm `gsd-path` bin)
-- **Python 3.9+** required for project installs, project refresh, and project-state
+- **Windows:** runs natively (no WSL). Needs Git for Windows, whose Git Bash runs
+  git hooks and task Verify commands, and long paths enabled for deep worktrees.
+- **Python 3.9+** found as `python3`, `python`, or `py -3`; required for project
+  installs, project refresh, and project-state
   doctor checks; optional for global-only Node installs. `scripts/install.py`
   mirrors global and `--local` install transactions and `--update`; it does not
   provide the interactive wizard
@@ -442,6 +447,7 @@ layers. Every child brief names absolute input/output paths and bounded scope.
 | Skills missing after install | Restart host session; [UPDATE.md](UPDATE.md) |
 | Router blocked on branch | Check out `STATE.branch` or follow router instructions |
 | Phase says precondition missing | Run the producing phase it names |
+| Task landing or Verify reports ignored `.project/` state | Fix the matching product ignore rule through an owning task or patch wave (for example, anchor `build/` as `/build/`), then resume the pipeline. For the pre-existing ignored verify ledger exception, see the [build checkpoint](skills/gsd-path-build/SKILL.md). |
 | Pipeline on unrelated work | Explicit invocation only — [DOCS.md](DOCS.md#faq) |
 | Contradictory STATE / tasks | Re-invoke router; artifacts outrank chat |
 | Archive tamper blocked | Expected with hooks — [HOOKS.md](HOOKS.md) |

package/GUIDE.md

@@ -11,7 +11,7 @@ DOCS.md     hub — install, use, understand, update, FAQ
 └── README.md   reference tables, handoff contract, repo layout
 
 WORKFLOW.md   agent SOP (copied into your project with --project)
-AGENTS.md     operating rules (copied into your project)
+AGENTS.md     operating rules (marked block in your project; see UPDATE.md)
 ```
 
 | Doc | Read when |