@opengsd/gsd-path 1.3.1 → 1.5.0

package/skills/gsd-path/PLAN.md

@@ -3,7 +3,8 @@ name: gsd-path-plan
 description: Create and validate dependency-ordered GSD Path build waves and complete task contracts. Use only when the user explicitly invokes $gsd-path-plan or an active $gsd-path router explicitly routes to this phase.
 ---
 
-Before executing project helpers, read [runtime selection](references/runtime-selection.md).
+Before executing project helpers, read [runtime selection](references/runtime-selection.md)
+and [operating rules](references/operating-rules.md).
 
 # GSD Path Planning Phase
 
@@ -114,9 +115,10 @@ as stated in Lookahead mode.
      In patch mode, tasks already `done` keep their landed metadata; only
      the appended patch tasks must start clean.
    - Require every dependency id to exist, forbid later-wave dependencies,
-     detect cycles, and forbid file overlap between planned tasks in the same
-     wave. Same-wave dependency chains are allowed only when their files do
-     not overlap; the build executes them in dependency layers.
+     detect cycles, and forbid unordered file overlap between planned tasks
+     in the same wave. Same-wave tasks may share files only when one
+     transitively depends on the other through `deps`; the build executes
+     them in dependency layers.
    - Reject a declared dependency that carries neither data nor a prerequisite
      effect. A `deps` edge is valid only when the dependent consumes a symbol,
      signature, schema, endpoint, file format, or path named in that
@@ -156,6 +158,13 @@ as stated in Lookahead mode.
      command's output — not an internal unit test.
      Require the surface to land in the same wave as the capability behind
      it, never in a later polish wave.
+   - When INTENT.md has `## Edge coverage`, require a PLAN.md
+     `## Held-out checks` row for every `held-out` edge and for no other
+     edge. The named test is in that task's `files`, the task's Verify runs
+     it, and the task's Acceptance criteria state the edge id and its ruling
+     (see [spec-reach probes](references/spec-probes.md)). An edge or
+     prohibition ruled `criterion SCn` needs no extra row; it is covered as
+     SCn. Put each `judgment` prohibition in its owning task's Approach.
    - Prove every intent constraint and synthesis decision is covered, that no
      scope-out veto appears in a task, and that `Project verify` is a real,
      non-placeholder command in PLAN.md. Every Verify — task and project —
@@ -226,6 +235,11 @@ as stated in Lookahead mode.
    Before asking for approval, require exactly one panel artifact for non-off
    Config: `PLAN-PANEL.md` for `ready`, or `PLAN-PANEL.skipped.json` for
    `skipped`. Off Config requires neither. A mismatch blocks approval.
+   When the active router recorded a `plan` pre-approval grant, first run
+   `python3 <absolute workflow_run.py> preauthorize --repo <absolute root>
+   --kind plan`. On `complete`, present Outcome and Review, say the owner's
+   pre-approval passed this gate, and continue at step 6 as approved. On
+   `blocked`, ask as below.
    Ask one explicit next question: whether to approve this plan and start the
    build. When PLAN-PANEL.md has `Actionable: 0` or the panel did not run,
    list `Approve and start build (recommended)` first, with `Request changes`

package/skills/gsd-path/RESEARCH.md

@@ -3,7 +3,8 @@ name: gsd-path-research
 description: Dispatch parallel researchers and collect cited GSD Path evidence about domain, stack, pitfalls, and comparable products. Use only when the user explicitly invokes $gsd-path-research or an active $gsd-path router explicitly routes to this phase.
 ---
 
-Before executing project helpers, read [runtime selection](references/runtime-selection.md).
+Before executing project helpers, read [runtime selection](references/runtime-selection.md)
+and [operating rules](references/operating-rules.md).
 
 # GSD Path Research Phase
 
@@ -83,6 +84,17 @@ settled brownfield input.
    template before dispatch. Record every standard dimension exactly once as
    `dispatched` or `skipped` with a reason, and assign every research question
    to at least one dispatched dimension. No question may remain unassigned.
+   Copy each question to exactly one `Question assignments` row. Assign one or
+   more dispatched dimension slugs there, each in its own code span and
+   separated by commas, as in:
+
+   ```md
+   - `[RESEARCH] Which approach is viable?` → `stack`, `pitfalls`
+   ```
+
+   List a dimension only once per row. Every dispatched dimension must own at
+   least one question, and its evidence file must answer every question
+   assigned to it. Use `- none` only when there are no research questions.
 2. Decide which standard dimensions have work: dispatch a dimension only when
    it has at least one assigned `RESEARCH` question from INTENT.md or
    CHARTER.md. Unsettled choices and risks need that source question before

package/skills/gsd-path/ROADMAP.md

@@ -3,7 +3,8 @@ name: gsd-path-roadmap
 description: Slice an approved GSD Path program charter into a dependency-ordered roadmap of independently shippable milestones. Use only when the user explicitly invokes $gsd-path-roadmap or an active $gsd-path router explicitly routes to this phase.
 ---
 
-Before executing project helpers, read [runtime selection](references/runtime-selection.md).
+Before executing project helpers, read [runtime selection](references/runtime-selection.md)
+and [operating rules](references/operating-rules.md).
 
 # GSD Path Roadmap Phase
 

package/skills/gsd-path/SHIP.md

@@ -3,7 +3,8 @@ name: gsd-path-ship
 description: Verify a completed GSD Path milestone, manage evidence-backed patch decisions, request final shipping approval, and archive the validated result. Use only when the user explicitly invokes $gsd-path-ship or an active $gsd-path router or build orchestrator explicitly routes to this phase.
 ---
 
-Before executing project helpers, read [runtime selection](references/runtime-selection.md).
+Before executing project helpers, read [runtime selection](references/runtime-selection.md)
+and [operating rules](references/operating-rules.md).
 
 # GSD Path Ship Phase
 
@@ -82,10 +83,13 @@ so the position is unchanged. Then:
    This owns pending-discussion and landing checks, project Verify isolation,
    execution, output recording, collection, cleanup, and final-review reuse.
    Keep its JSON receipt; do not reconstruct those operations in shell calls.
-   Exact stdout/stderr live once in `.project/build/verify-ledger.jsonl`;
-   `final-gap-1.md` is the generated view referencing that entry. Re-entry at
-   the same command and commit reuses the execution, including a failed one,
-   and finishes interrupted collection without running the command again.
+   For a single-repo milestone, exact stdout/stderr live once in
+   `.project/build/verify-ledger.jsonl`; `final-gap-1.md` is the generated view
+   referencing that entry. For a member milestone, the gap records each member
+   head and holds the exact output; there is no reusable ledger entry.
+   Single-repo re-entry at the same command and commit reuses the execution,
+   including a failed one, and finishes interrupted collection without running
+   the command again.
    Missing legacy output requires evidence reconciliation, not a blind rerun.
    Any non-zero result stops this step; preserve its stderr and diagnose through
    the bundled forensics contract. Do not launch reviewers while project Verify
@@ -121,9 +125,10 @@ so the position is unchanged. Then:
    step 3 or create a fresh sidecar with `isolate-verify --name review-final`
    and dispatch the integration reviewer under logical task name
    `review_final`, assigning only
-   `.project/review/FINAL.md`. Its complete brief includes the exact recorded
-   project Verify ledger entry, every collected gap verdict so Overall verdict is
-   consistent with them, and PLAN.md's `## Surface contract` when INTENT.md
+   `.project/review/FINAL.md`. Its complete brief includes the project Verify
+   evidence from the ledger or the member milestone's gap output, every
+   collected gap verdict so Overall verdict is consistent with them, and
+   PLAN.md's `## Surface contract` when INTENT.md
    names surfaces — that reviewer performs each Walkthrough and records the
    surface and what it showed on every criterion the contract lists. Collect FINAL.md and retire its sidecar through the
    same helper flow.
@@ -154,7 +159,12 @@ so the position is unchanged. Then:
    then stop and do not invent a patch finding. A `not-met`,
    `unverifiable`, or blocked gap with valid evidence sets `ship/blocked`,
    writes `.project/review/PATCH-FINDINGS.md` from the patch-findings template,
-   and runs `python3 <absolute check_handoffs.py> patch --repo <absolute repo
+   copying the full `Risk: ...` line into each gap finding's Locator, its
+   `Found` field into Evidence, and its `Fix direction` field verbatim. For a
+   `FINAL.md` finding, use its `SC<n>` id as Locator and copy its `Finding` and
+   `Fix direction` fields verbatim. The patch validator requires these source
+   field values to match exactly; do not shorten or paraphrase them. Run
+   `python3 <absolute check_handoffs.py> patch --repo <absolute repo
    root>`. Present the blocked outcome, link the resolved absolute
    PATCH-FINDINGS.md path, and state that patch planning is next. The manifest
    contains exactly those FINAL.md and gap rows. When routed by an active
@@ -253,6 +263,14 @@ The persisted `STATE.archive` field is the transaction identity.
    at the current HEAD is the only artifact-producing remedy. The archive helper independently binds every FINAL.md
    `SCn` heading id and normalized text to the archived INTENT.md; a renamed or
    easier criterion blocks even if the earlier handoff gate was bypassed.
+   For a multi-repo milestone (the archive holds `build/members.json`), run
+   `python3 <absolute archive_milestone.py> close-members --repo <root>`
+   after preflight passes and before recording shipment. It closes each
+   locked member in lock order in that member's integration mode and
+   journals each one. When it returns `awaiting-merge`, report the member PR
+   link, stop, and rerun the same command after the user merges it; never
+   merge a member PR yourself. When it returns `integrated`, keep its `body`
+   for the ship commit below.
 5. Only after preflight passes, record shipment through the journaled helper;
    for a program it atomically replaces both ROADMAP.md and STATE.md, setting
    the current entry to `Status: shipped` with the exact `Archive:` pointer:
@@ -270,10 +288,14 @@ The persisted `STATE.archive` field is the transaction identity.
    idempotent after completion. Stage only
    `.project/` paths, inspect the staged path list against the transaction and
    create the ship phase's one commit with exact subject
-   `ship: M00N — <milestone-slug>` and a body of exactly two consecutive lines,
+   `ship: M00N — <milestone-slug>`. For a single-repo milestone, its body has
+   exactly two consecutive lines,
    `Archive: .project/archive/<NNN>-<slug>` then
    `Reviewed-HEAD: <reviewed SHA>`, with no comment lines or blank line between them.
-   Write the subject, a blank line, and the two body lines to a message file,
+   A multi-repo milestone's body is exactly the `body` that `close-members`
+   returned: those two lines, then one `Member-Reviewed-HEAD:` and one
+   `Member:` line per member.
+   Write the subject, a blank line, and the body lines to a message file,
    then use `git commit -F <message-file>`. M00N and NNN come from STATE.archive.
    There is no untracked-project exception and no product or older-archive
    path may enter this commit.

package/skills/gsd-path/SKILL.md

@@ -3,13 +3,29 @@ name: gsd-path
 description: Inspect .project/STATE.md, report GSD Path progress, and run the next valid phase. Use only when the user explicitly invokes $gsd-path. The status argument reports state without advancing; config views or edits settings without advancing. Do not infer this skill from generic project, next-step, or resume requests.
 ---
 
-Before executing project helpers, read [runtime selection](references/runtime-selection.md).
+Before executing project helpers, read [runtime selection](references/runtime-selection.md)
+and [operating rules](references/operating-rules.md).
 
 ## Configuration mode
 
 When the first argument is `config`, read [Path settings](references/config.md)
 and complete that request without initializing state or advancing a phase.
 
+## Pre-approval
+
+`--pre-approve <kinds>` in the arguments (`intent`, `plan`, or `intent,plan`)
+grants those gates ahead of time for this run, for unattended quick lanes.
+After `.project/STATE.md` exists and before milestone intent approval, run
+`python3 <absolute pipeline_state.py> pre-approve --repo <absolute root>
+--grant <kinds>` once; its Log record is the grant. Write only the kinds the
+owner passed. A refused grant stops the run with the helper's message. Ship,
+roadmap, patch selection, and repository setup are never pre-approved. At a
+granted gate, the define or plan contract runs `python3 <absolute
+workflow_run.py> preauthorize --repo <absolute root> --kind <kind>` before
+asking: `complete` passes the gate through its normal approval command;
+`blocked` asks the owner as usual. A grant never answers an interview
+question, ruling, or `NEEDS-USER` item.
+
 # GSD Path Router
 
 Determine the current pipeline phase, report it briefly, and run the next valid
@@ -188,6 +204,34 @@ The current value resets from the project default at the next milestone.
 Both settings lock when build starts. A lookahead STATE inherits the active
 project's `integration_default` and uses it for `integration`.
 
+## Member repositories
+
+A coordinator project can change other repositories (members) in the same
+milestone; `.project/MEMBERS.md` lists them. Change members only at a
+milestone boundary, never during build or ship. Resolve the bundled
+`scripts/members.py` to an absolute path and use it; never edit MEMBERS.md
+or a member marker by hand.
+
+- To add an existing repository, it needs a GitHub.com `origin` whose default
+  is `main`, a clean worktree, and no active milestone of its own. Ask for the
+  member name, checkout path, and integration (`direct`, `pull-request`, or
+  `default`, which follows the milestone's choice), then run
+  `python3 <members.py> add --repo <absolute-root> --name <name> --checkout <path> --integration <mode>`.
+- To create a new member repository, present the exact `owner/name`,
+  visibility, and checkout path as the **Review** surface and get approval
+  first, as for a new GitHub repository. Then run the same command with
+  `--create <owner/name> --visibility <visibility>`. It journals the approved
+  target before creating anything; rerun the identical command to resume.
+- After adding a member, tell the user to install its guard hooks:
+  `npx @opengsd/gsd-path@latest --member-of <absolute-root> --project <member checkout>`.
+- `python3 <members.py> validate --repo <absolute-root>` checks every member;
+  `repair` rewrites stale markers; `detect --checkout <path>` reports whether a
+  repository is a member and of which coordinator.
+
+Build locks the members that tasks name and works in Path-owned member
+branches `gsd-path/<project>-M00N`. Ship runs `close-members` after preflight
+to merge each member in lock order, then ships the coordinator.
+
 ## Transaction recovery first
 
 For a helper failure, use the diagnostic in the sibling bundle:

package/skills/gsd-path/references/build-native.md

@@ -24,6 +24,14 @@ python3 <absolute dispatch_driver.py> round --repo <absolute primary> --wave <N>
   [--child-timeout <owner seconds>]
 ```
 
+Use the absolute `dispatch_driver.py` from the active installed
+`gsd-path-build` skill when orchestrating a consuming project's build; that
+copy resolves role briefs and templates from its own skill bundle. The
+repository or npm package also supports the top-level `scripts/dispatch_driver.py`:
+when a default is not beside that script, it resolves from the shipped
+`skills/gsd-path` bundle. Explicit `--role-brief`, `--task-template`, and
+`--template` paths override those defaults and must name existing files.
+
 `round` owns the entry transition described in Preconditions and branch
 binding, checkpointed as `build: start milestone`, and sets `build/blocked`
 on a dependency deadlock or a blocked
@@ -82,9 +90,12 @@ dispatch contract and perform steps 1–5 by hand.
    - `recovered`: the task is landed (`land` already stamped `status: done`
      and `base`). Retire a still-present task worktree with `isolation.py
      retire` only when the report shows it present, clean, and on the task
-     branch. If only `task_branch` remains, finish its proven interrupted
-     retirement with `retire --branch <task_branch> --force --landed-commit
-     <commit>`; both absent is valid.
+     branch. If the checkout directory is absent and `task_branch` remains,
+     finish its proven interrupted retirement with `retire --branch
+     <task_branch> --force --landed-commit <commit>`. This also clears a stale
+     registration at that task's sidecar path after the landing proof passes;
+     a locked registration fails without deleting the branch. Both absent is
+     valid.
    - `resume`: continue from the returned `base`, `task_branch`, and worktree
      (the primary itself when no task branch exists); when the report shows
      the worktree absent, return the task to `pending` only when ownership is
@@ -133,6 +144,13 @@ dispatch contract and perform steps 1–5 by hand.
    even while unrelated tasks still run, so rerun `ready` after each landing.
    A `NEEDS-ORCHESTRATOR` block stays unselectable until its `Orchestrator
    answer` is recorded in the task Log and the task is back to `pending`.
+   An all-done wave whose latest canonical review cycle has any blocked lens
+   gates later waves: `ready` selects unfinished later tasks with a `## Review
+   findings` section that depend on it, sets `current_wave` to the earliest
+   repair wave, and adds `repair_for_wave` with the source wave. When no such
+   repair remains, `ready` returns no tasks and adds `blocked_review` (`wave`,
+   `cycle`, `waiting_waves`); a later passing canonical review cycle releases
+   the waiting waves.
    Its typed errors are the recovery rule:
    - `task-recovery-required`: for each listed failed or blocked task run
      `python3 <absolute build_state.py> reconcile --repo <absolute primary>
@@ -171,7 +189,17 @@ dispatch contract and perform steps 1–5 by hand.
    then create the retry. If retirement was interrupted after removing the
    worktree, rerun the same command; the recorded failed or blocked task and
    its exact base prove the remaining branch before deletion. Create the retry
-   from the new clean primary HEAD. After
+   from the new clean primary HEAD. A member task (`repo: <member>`) stays
+   `pending` in the coordinator; its rejected attempt lives in the member
+   sidecar. Copy the live copy's Log delta into the coordinator task file,
+   checkpoint it, then retire the sidecar with `python3 <absolute isolation.py>
+   retire-member-task --repo <absolute primary> --member <member> --task-id
+   <id> --task-file <task path> --force`. It refuses until the committed task
+   file holds that delta, and a rerun finishes an interrupted retirement. A
+   copy that fails the append-only check holds no trusted delta: record your
+   own rejection evidence in the coordinator task Log and checkpoint it, as for
+   a coordinator diff rejection; retirement then reports `copy_rejected`. The
+   next `prepare-task` creates the retry sidecar at the member bound tip. After
    resolving a recoverable `build/blocked` condition, use
    `pipeline_state.py transition` with the blocked state and bound branch as
    expected fields to set `build/active` and log the resolution. Checkpoint it
@@ -183,19 +211,21 @@ dispatch contract and perform steps 1–5 by hand.
    a later round unlocked by fresh landings records the later HEAD — and
    lint every ready task's brief with the bundled
    `scripts/check_task_briefs.py --repo <absolute repo root> --base <recorded
-   base>` and re-check Intent coverage with
+   base> --project-dir <routed project dir>` and re-check Intent coverage with
    `python3 <absolute check_handoffs.py> plan --repo <absolute repo root>`
    before creating any worktree; a lint or coverage failure is a documented plan
    defect — repair it against INTENT.md and SYNTHESIS.md, then re-establish
    the base. Then isolate each ready task with
    `python3 <absolute workflow_run.py> prepare-task --repo <absolute primary>
    --expected-head <recorded base> --task-id <id> --round-size <N>` where N is the
-   number of tasks in this dispatch round. Serial (`N=1`) returns the primary
-   worktree and `task_branch: null` — the coder works on the bound branch.
+   number of tasks in this dispatch round. For a coordinator task, serial
+   (`N=1`) returns the primary worktree and `task_branch: null` — the coder
+   works on the bound branch.
    The runner also creates a named verification sidecar at this clean base
    before dispatch. Retain both helper results in the dispatch evidence.
-   Parallel (`N>=2`) creates a named `gsd-path-task/<id>` branch and linked
-   worktree at that base; never a detached HEAD. Record dispatch through
+   For a coordinator task, parallel (`N>=2`) creates a named
+   `gsd-path-task/<id>` branch and linked worktree at that base; never a
+   detached HEAD. Record dispatch through
    `python3 <absolute isolation.py> activate-task --repo <returned worktree>
    --base <recorded base> --task-id <id> --agent build_<id> --task-file
    <exact selected task-file path> [--task-branch <returned task_branch>]`.
@@ -207,14 +237,26 @@ dispatch contract and perform steps 1–5 by hand.
    round. Do not append a dispatch Log entry: the isolated task later appends
    at that location, and two parallel appends make the cherry-pick ambiguous. Reuse a retained worktree only when
    its recorded base, branch, and task agree exactly.
+   A member task (`repo: <member>`) returns `mode: member` from
+   `prepare-task`: a member sidecar at the member bound tip, with no
+   coordinator verify sidecar. Record its dispatch with `python3 <absolute
+   isolation.py> activate-member-task --repo <absolute primary> --member
+   <member> --task-id <id> --agent build_<id> --task-file <exact task-file
+   path> --base <recorded base>`. It writes the live task copy (returned as
+   `copy`) inside the member sidecar; the coordinator task file stays
+   unchanged. Brief the coder with the member sidecar root and that live copy
+   as its task file, plus the coordinator's INTENT.md. Step 5's `finish` lands
+   it in the member and records it in the coordinator.
 
 4. **Dispatch the round.** Following the local runtime dispatch contract,
    spawn one implementation-capable child per task with deterministic logical
    task name `build_<task_id>`.
    Its brief contains the absolute isolated-worktree root, coder role, task
-   file, task template, and the absolute INTENT.md path in that worktree.
+   file, task template, and the absolute INTENT.md path in the coordinator for
+   member tasks or in that worktree for coordinator tasks.
    Generate the coder's intent view with `python3 <absolute task_context.py>
-   --repo <absolute isolated-worktree> --task <absolute task file>` and include
+   --repo <absolute coordinator root for member tasks, otherwise isolated-worktree>
+   --task <absolute live task copy for member tasks, otherwise isolated task file>` and include
    its output in the brief. The helper preserves all global rules and falls
    back to full intent when projection is ambiguous. Never summarize it by hand.
    Add no hidden implementation context; repair a
@@ -233,10 +275,15 @@ dispatch contract and perform steps 1–5 by hand.
    completion when it lands — never wait for slower in-flight tasks first;
    when several results wait, land them in task-id order.
 
-   - For `ready`, compare the complete worktree diff to `base`. Permit only
-     declared `files` plus append-only Log changes in that task file. Include
-     additions, deletions, renames, and binary changes; an unexpected path
-     blocks before any product commit.
+   - For a `ready` coordinator task, compare the complete worktree diff to
+     `base`. Permit only declared `files` plus append-only Log changes in that
+     task file. Include additions, deletions, renames, and binary changes; an
+     unexpected path blocks before any product commit.
+   - For a `ready` member task, compare the complete member sidecar diff to the
+     returned `member_base`. Permit only declared `files`, including additions,
+     deletions, renames, and binary changes. Separately check the returned live
+     task `copy` against the coordinator task contract for an append-only Log.
+     An unexpected path or Log change blocks before any product commit.
    - For a returned `ready` coder, run `python3 <absolute dispatch_driver.py>
      finish --repo <absolute primary> --task-id <id>`. This action works with
      native child tools; no child command is needed. It reproduces serial work
@@ -276,6 +323,7 @@ dispatch contract and perform steps 1–5 by hand.
      task to `blocked` or `failed`, revoke a parallel isolate's active dispatch
      with `python3 <absolute isolation.py> deactivate-task
      --repo <isolated worktree> --task-id <id> --task-branch <task_branch>`.
+     A member task keeps `pending` instead; follow the member retry in step 2.
      Then update and checkpoint the bookkeeping and apply the recovery
      rule. Preserve the isolated worktree unless and until the explicit clean
      retry-retirement procedure in step 2 owns and removes it.

package/skills/gsd-path/references/codebase-mapper.md

@@ -10,7 +10,8 @@ change nothing outside your single output file.
 - Read AGENTS.md and the template before scanning. Stop on a missing path.
 - Write only the assigned output using the template. When the brief supplies a
   disposable root, write the output under that root at the relative handoff
-  path; the orchestrator transfers it after validation. Do not ask the user
+  path; the orchestrator transfers it after validation. `Repo root` still names
+  the primary repo root, never the disposable root. Do not ask the user
   questions.
 
 ## What to establish

package/skills/gsd-path/references/dispatch.md

@@ -44,6 +44,19 @@ use exactly one matching branch:
   create another worktree. Encode task dependencies explicitly; launch
   independent children concurrently up to the host's advertised
   concurrent-subagent capacity.
+- A `muse.subagent_spawn` tool (with `muse.subagent_wait`,
+  `muse.subagent_read_result`, and `muse.subagent_send_message` siblings) is
+  Muse Code. Omit `subagent_type` (general-purpose, full capability), pass the
+  logical task name as `task_name` and `role`, and the complete brief as
+  `objective`. Never set `worktree_isolation`. Keep the returned
+  `subagent_id`; send a correction to a still-live child with
+  `muse.subagent_send_message` mode `followup` and the complete new prompt,
+  otherwise start a fresh child. Collect with `muse.subagent_wait`
+  (`wait_for: task_terminal`) then `muse.subagent_read_result`; on
+  `root_capacity_exhausted`, wait for a child to finish and retry. Spawn has no
+  model or effort argument, so record no such capability. If only
+  `muse.workflow` is exposed (untrusted workspace), do not script or inline
+  the work; stop and report that the workspace must be trusted.
 
 For every branch:
 

package/skills/gsd-path/references/docs-auditor.md

@@ -11,7 +11,8 @@ actually does. Read-only: change nothing outside your single output file.
 - Read AGENTS.md and the template before auditing. Stop on a missing path.
 - Write only the assigned output using the template. When the brief supplies a
   disposable root, write the output under that root at the relative handoff
-  path; the orchestrator transfers it after validation. Do not ask the user
+  path; the orchestrator transfers it after validation. `Repo root` still names
+  the primary repo root, never the disposable root. Do not ask the user
   questions.
 
 ## Method
@@ -58,6 +59,11 @@ actually does. Read-only: change nothing outside your single output file.
 5. **Classify remediation** for every non-verified claim: `fix-doc`,
    `fix-code`, or `NEEDS-USER` when the right side of the conflict is not
    yours to decide.
+   Number queue rows with unique, strictly increasing positive integers; they
+   need not be contiguous. A row that persists from the prior audit keeps its
+   number. A new row takes a number greater than every prior queue number and
+   every `## User rulings` Queue #. Never reuse a retired number: a ruling
+   stays bound to the item it was made for.
 
 ## Rules