@opengsd/gsd-path 1.4.0 → 1.5.0

package/DOCS.md

@@ -247,8 +247,10 @@ resolved Git common directory and primary path, so separate clones and
 primary folders do not share a location.
 
 The first allocation pins the workspace location in
-`<git-common-dir>/gsd-path/workspaces/<workspace-id>.json`. Later environment
-changes do not move it. Existing sibling worktrees remain at their original
+`<git-common-dir>/gsd-path/workspaces/<workspace-id>.json`. Environment
+changes do not move it while a linked worktree remains. When a sidecar is
+retired and no linked worktree remains, Path removes the pin, and the next
+allocation reads `GSD_PATH_WORKTREE_ROOT` again. Existing sibling worktrees remain at their original
 paths and retain the same recovery and cleanup checks. These folders contain
 active work and evidence; they are not a disposable cache. Relocation needs
 a separate migration; do not edit placement records or move folders manually.
@@ -397,6 +399,14 @@ the supplied package's runtime and its compatible status launcher. Review those
 configuration changes before committing them. Existing versions remain available
 for other projects and branches.
 
+To record where a patched runtime came from, add `--runtime-provenance-source`,
+`--runtime-provenance-patch`, or `--runtime-provenance-note` to
+`--runtime-upgrade`. The values are written to the `provenance` object
+(`source`, `patch_ref`, `note`) in `.gsd-path/runtime.json`. Without a patch
+value, a source root that is a Git checkout records its `HEAD` commit. A later
+upgrade without these flags keeps the object only when the digest is unchanged.
+Provenance is a record only; it does not change the digest or runtime validation.
+
 A new machine needs the selected runtime installed before status and guards can
 run. `gsd-path --runtime-restore --project /absolute/project --source-root
 /path/to/matching/package` restores that exact version without changing project

package/FULL.md

@@ -106,7 +106,7 @@ node scripts/install.mjs --codex --claude --cursor
 
 | Flag | Skills root |
 | --- | --- |
-| `--codex`, `--zed` | `~/.agents/skills` (shared bundle) |
+| `--codex`, `--zed`, `--muse` | `~/.agents/skills` (shared bundle) |
 | `--claude` | `~/.claude/skills` |
 | `--grok` | `~/.grok/skills` |
 | `--opencode` | OpenCode config `skills/` |
@@ -176,7 +176,7 @@ also print a one-line update notice (24h cache, fail-silent).
 - Validates synchronized package before writing
 - Uses the [managed-skill backup and collision rules](UPDATE.md#what-auto-updates)
 - Rolls back **all** selected targets if any one fails
-- Codex, Antigravity, and Zed share one local physical root — installed once
+- Codex, Antigravity, Zed, and Muse share one local physical root — installed once
   with a shared host-aware bundle
 
 Restart the host session after install if skills do not appear.
@@ -432,6 +432,7 @@ your skills:
 | Antigravity | `invoke_subagent` | |
 | Cursor | `Task` | installed `gsd-path` subagent |
 | Zed | `spawn_agent` | |
+| Muse Code | `muse.subagent_spawn` | trusted workspace required |
 | Kiro | subagent facility | |
 | Kimi | `Agent` | `coder` child type |
 

package/HOOKS.md

@@ -133,7 +133,8 @@ See [UPDATE.md](UPDATE.md).
   `git checkout -- .`/`git restore .`
 - shell writes (redirections, `tee`, `cp`, `mv`, `rm`, `sed -i`, ...) that
   target a routing control (`.git`, `.project/STATE.md`, `.project/next`,
-  `.gsd-path`) while `.project/STATE.md` exists
+  `.gsd-path`) while `.project/STATE.md` exists, or target a product file
+  outside the routed build phase (same rule as direct file-edit tools)
 - repeated assignments to the same shell variable within one command; split
   these into separate tool calls so write targets can be resolved
 - copies whose destinations, including nested recursive-copy entries, resolve
@@ -145,7 +146,8 @@ See [UPDATE.md](UPDATE.md).
   source trees containing directory symlinks are denied; use literal directory
   paths and copy directory links separately
 - shell commands that reference the archive unless the whole command is a
-  recognized standalone read or a single-command invocation of the bundled
+  recognized standalone read, a pipeline in which each segment is a recognized
+  read, or a single-command invocation of the bundled
   `pipeline_state.py` / `archive_milestone.py` helper, resolved to a regular file
   inside the verified runtime selected by `.gsd-path/runtime.json` (legacy projects use `.gsd-path/runtime/` beside `guard_hook.py`
   in the repository layout), using exactly `python` or `python3` with optional
@@ -161,11 +163,93 @@ See [UPDATE.md](UPDATE.md).
 - deletion or move commands outside a single simple segment, including command
   chains, pipes, newlines, grouping, directory changes, and command substitution
 - deletion or move commands with any argument outside the literal-path character
-  set: ASCII letters, digits, `.`, `_`, `-`, and `/` (plus a drive prefix and
-  backslashes on Windows). One matching pair of surrounding quotes is allowed;
-  spaces, parameters, wildcards, braces, and tilde paths are denied even when
-  quoted. This also applies to `find -delete` and supported destructive aliases
+  set: ASCII letters, digits, `.`, `_`, `-`, `/`, and ASCII spaces inside one
+  shell unit (plus a drive prefix and backslashes on Windows). One matching
+  pair of surrounding quotes is allowed; parameters, wildcards, braces, and
+  tilde paths are denied even when quoted. This also applies to
+  `find -delete` and supported destructive aliases
 - destructive Git commands nested in supported shell and command wrappers
+- Git arguments that contain a shell parameter. Only plain `$name` and
+  `${name}` expansions pass, and only inside plain double-quoted spans of
+  read-only subcommands (`status`, `log`, `diff`, `show`, and the other
+  inspection commands) that the guard parses directly, such as
+  `git log --format="$t %H"` or `git show "HEAD:$f"`, because only double
+  quoting prevents word-splitting into options. A parameter outside double
+  quotes (`$x`, `HEAD:$f`, `--format=$x`, `"a b"$x`) is denied because its
+  expansion can split into a write option such as `--output`. Every other
+  parameter form (`${=x}`, `${(z)x}`, `${x:-y}`, `$x[@]`, `$1`, `$@`, `$*`,
+  `$#`, and the unbraced zsh flags `$=x`, `$~x`, `$^x`, `$+x`) is denied even
+  inside double quotes, because it can expand to more than one word; a
+  backslash-escaped marker (`"\$t"`) is likewise denied, because the shell
+  executes the literal text while the argument still shows the bare marker.
+  The same four zsh flags are denied in a `git -C` directory. A literal `$`
+  that starts no expansion (a regex anchor such as `--grep='fix$'`) passes.
+  A `-c`/`--config` key whose value git executes as a program —
+  `core.fsmonitor`, editors and pagers, `core.sshCommand`,
+  `core.askPass`, `filter.*` clean/smudge/process, `diff.*`
+  textconv/external/command, `merge.*` drivers, `core.gitProxy`,
+  `interactive.diffFilter`,
+  `remote.*` uploadpack/receivepack, `gpg.program` and `gpg.*.program`, `credential.helper` and
+  `credential.*.helper`, each `pager.<cmd>` key — is denied with a literal
+  value as with a parameter, because git runs it during an otherwise
+  read-only subcommand. A disabling form of such a key passes: the bare key,
+  an empty value, or `false`. A `--config-env` form is always denied, because
+  its value comes from the environment. A key through which git loads code —
+  `core.hooksPath`, `include.path`, `includeIf.*.path`, `url.*.insteadOf`,
+  `url.*.pushInsteadOf` — is denied with each value. `git config` is denied
+  when it sets one of these keys; to read or unset the key stays allowed.
+  A redirection at the end of a read (`git config <key> 2>/dev/null`) is not
+  a value. A separate digit before a redirection (`5 >/dev/null`), a word of two
+  or more digits (`12>/dev/null`) and a quoted operator are values, so they
+  make a set.
+  Each `git config` argument must be a plain literal word, bare or in one
+  pair of quotes: a backslash, mixed quotes, an unquoted glob (`*`, `?`, `[`),
+  an unquoted brace list or range (`{a,b}`, `{1..3}`) or a line continuation
+  in the word or one that joins it to the next word is denied, because the shell can make a different
+  argument list from it.
+  An unquoted word that starts with `#` among the `git config` arguments
+  is denied, because the shell reads it and the words after it as a comment.
+  The git subcommand word must be a plain literal word in each git command:
+  `git {config,...}` and a subcommand split by a line continuation are denied.
+  A program that runs the command in its arguments (`nice`, `nohup`,
+  `timeout`, `sudo`, `watch`, `time`, `env`, `stdbuf`, `setsid`) is
+  unwrapped: the guard skips the options of the program and checks the
+  command that it runs, so `nice git -c core.fsmonitor=/abs/h.sh status` is
+  denied by the git rule and `sudo apt install git` passes. A runner
+  option that writes, edits or enters a file or directory by itself is
+  denied (`time -o`, `sudo -e`, `sudo -D`, `sudo -R`, `watch -s`). The
+  `timeout` duration and the `watch` interval must be literal numbers, and
+  each runner option word must be a literal word; only a separate option
+  value can be a parameter in double quotes (`sudo -u "$USER" ls`). A short
+  option word is read as getopt reads it, so the attached value in
+  `sudo -upostgres psql` is not taken as more options. With an archive working directory a command runner is not
+  unwrapped and is denied as an unknown program. Other command
+  runners (`doas`, `ionice`, `noglob`) are not unwrapped, and `watch` with
+  the command in one quoted word is not checked.
+  Each git global option word, and the value word of `-c`, `-C`,
+  `--git-dir`, `--work-tree`, `--namespace` and `--config-env`, must resolve
+  to one word: a backslash, an unquoted glob or an unquoted brace list or
+  range in it is denied (`git -c {core.fsmonitor=/abs/h.sh,status}`,
+  `git -{p,c} core.fsmonitor=/abs/h.sh status`). A parameter in such a value
+  is denied also when no subcommand follows (`git -c $x`). Plain quoted parts
+  pass (`git -c user.name='A B' log`).
+  `git config` section renames and removals (`--rename-section`,
+  `--remove-section`) and `--edit` are denied, because a rename can move a
+  key into an executed section and `--edit` starts an editor.
+  Command substitution output, a parameter that starts an
+  argument, and a parameter in the value of an option that git writes to or
+  runs as a command (`--output`, `--upload-pack`, `--receive-pack`, `--exec`,
+  `-c`, `--config-env`, or a `<transport>::<address>` remote) are denied in
+  every form. These option names match by prefix (`--upload-pa`, `--exe`),
+  because git accepts abbreviated long options; in archive context the same
+  prefix match applies to `--output`, `--ext-diff`, and `--textconv`. The
+  exact read-only option `--text` is not an abbreviation and stays allowed. Any
+  other quoting construct in the command (`$'...'`, `$"..."`, quotes inside `${...}`, quotes or
+  backslashes in a comment, here-documents and here-strings) disables the
+  exception, so every parameter in a git argument of that command is denied.
+  The exception applies only to commands the guard parses directly, never
+  inside wrapped shell strings (`eval`, `bash -c`, `sh -c`, PowerShell or
+  `cmd` command strings), where the outer shell expands the parameter first
 - archive glob/brace expansions and execution-capable read options such as
   `rg --pre`
 - direct write, edit, and patch tool calls targeting `.project/STATE.md`,
@@ -265,9 +349,12 @@ writes nor verifies that wiring. To add it yourself, register
 | Antigravity | `.agents/hooks.json` `PreToolUse` | [Antigravity hooks](https://antigravity.google/docs/hooks) |
 | OpenCode | JS plugin `tool.execute.before` | [OpenCode plugins](https://opencode.ai/docs/plugins/) |
 | Zed | no hook API — git hooks only | — |
+| Muse Code | no GSD Path hook integration — git hooks only | — |
 
-**Caveats:** The hook cannot prove which skill initiated a shell command or a
-build-phase edit, so AGENTS.md owns those re-entry cases. Grok and Kimi
+**Caveats:** The hook cannot prove which skill initiated a build-phase edit
+when the routed build phase is already active. Shell product writes use the
+same phase gate as file-edit tools; AGENTS.md still owns plain-prompt re-entry
+when no `.project/STATE.md` exists. Grok and Kimi
 fail-open on hook errors by design. Copilot, Kimi, Kiro, and Antigravity may
 not intercept subagent tools — treat coverage as orchestrator-level.
 

package/QUICK.md

@@ -14,7 +14,7 @@ One router skill drives a gated pipeline: inspect → define → research → de
 plan → build → ship. Every handoff lives in `.project/` so any session can resume from disk.
 
 **Hosts:** Codex, Claude Code, Grok, OpenCode, Copilot CLI, Qwen, Antigravity,
-Cursor, Zed, Kiro, Kimi Code.
+Cursor, Zed, Kiro, Kimi Code, Muse Code.
 
 ---
 

package/README.md

@@ -10,20 +10,20 @@ parallel under `.project/next/` (lookahead); a building milestone can also be
 abandoned on an explicit ruling, archiving its partial work for a re-slice.
 
 **Supported hosts:** Codex, Claude Code, Grok, OpenCode, GitHub Copilot CLI,
-Qwen Code, Antigravity CLI, Cursor, Zed, Kiro, and Kimi Code.
+Qwen Code, Antigravity CLI, Cursor, Zed, Kiro, Kimi Code, and Muse Code.
 Support means the installer and dispatch contract exist. See the
 [host trust matrix](https://github.com/open-gsd/gsd-path/blob/main/docs/trust-validation/HOST-MATRIX.md) for live milestone
 proof and each host's guard tier.
 
 <!-- release-docs -->
-**Latest npm release:** [@opengsd/gsd-path@1.4.0](https://www.npmjs.com/package/@opengsd/gsd-path/v/1.4.0) — [release notes](CHANGELOG.md#140---2026-09-30)
+**Latest npm release:** [@opengsd/gsd-path@1.5.0](https://www.npmjs.com/package/@opengsd/gsd-path/v/1.5.0) — [release notes](CHANGELOG.md#150---2026-10-09)
 
 **Recent highlights**
-- key verify ledger rows by repo and fail closed on member drift (S3d)
-- guard coders in member sidecars with coordinator host hooks (S3c3b2)
-- dispatch and land member tasks in build rounds (S3c3b1)
-- activate member tasks with a live copy in the member sidecar (S3c3a)
-- prove landed member tasks from record and member landing (S3c2b)
+- record runtime hotfix provenance on the declaration
+- add signed self-update
+- add the Skills, Stats, Settings, and Environment pages and the setup wizard
+- register the hosts, project operation, and env routes
+- add project setup operations for the app
 
 <!-- /release-docs -->
 
@@ -40,37 +40,31 @@ proof and each host's guard tier.
 | [WORKFLOW.md](WORKFLOW.md) | Phase-by-phase agent SOP |
 | [HOOKS.md](HOOKS.md) | Optional archive/git guard hooks |
 | [Jev screening](skills/gsd-path/references/jev-review.md) | Optional evidence screening; disabled by default, no SDK required |
-| [daemon/README.md](daemon/README.md) | Dashboard, menu-bar app, and monitoring setup |
-| [CHANGELOG.md](CHANGELOG.md) | Published release notes |
+| [daemon/app/README.md](daemon/app/README.md) | Desktop app: develop, release, and updates |
+| [daemon/README.md](daemon/README.md) | Monitor daemon: routes, configuration, and manual setup |
+| [CHANGELOG.md](CHANGELOG.md) | npm package release notes |
+| [daemon/app/CHANGELOG.md](daemon/app/CHANGELOG.md) | Desktop app release notes |
 | [RELEASE.md](RELEASE.md) | Maintainer CI and npm release cycle |
 | [GUIDE.md](GUIDE.md) | Pointer to the guides above |
 
-## What's new — September 19, 2026
+## What's new — October 2, 2026
 
 These changes are merged into the source checkout; npm installs use the latest
 published release.
 
-- **Dashboard settings and history:** edit Path settings, browse project files
-  and Git versions, and load full recorded evidence. See the
-  [dashboard guide](daemon/README.md#project-history-and-files).
-- **Model and effort policy:** set user, project, host, and task choices through
-  one resolver. Recorded assignments stay pinned; unsupported explicit choices
-  stop the affected dispatch. See the
-  [model policy](skills/gsd-path/references/model-policy.md).
-- **External worktrees and pinned runtimes:** new parallel task, verification,
-  and integration worktrees live outside project checkouts. Projects pin runtime
-  versions by content digest, with explicit upgrade, restore, and legacy migration
-  commands. See
-  [worktree locations](DOCS.md#worktree-locations) and
-  [runtime versions](DOCS.md#project-runtime-versions).
-- **Clearer project updates:** the dashboard shows project runtime versions and
-  update results. After verified integration, ordinary branches can resume
-  product work while archived milestones remain protected. See
-  [update guidance](UPDATE.md#update-the-project-runtime-and-guard-hooks).
-- **Optional Jev screening:** reviewers can request advisory checks of selected
-  criteria and evidence. It is disabled by default and never replaces recorded
-  verification or review gates. See
-  [Jev screening](skills/gsd-path/references/jev-review.md).
+- **Desktop app (pre-release):** one app for macOS, Windows, and Linux shows
+  your projects, manages skills in each coding agent, and updates itself. See
+  [Desktop app](#desktop-app).
+- **Skills from the published release:** the monitor installs skills from the
+  npm release, checks the download against the registry's sha512, and refuses
+  one that does not match. A release picker lets you stay on an older version.
+- **Safer monitor writes:** a monitor started by the app accepts changes only
+  with the app's local token, so another web page cannot change your setup.
+- **Environment editor:** edit a project's `.env` files with values masked and
+  a diff before each save.
+- **Usage charts:** tokens and cost per day, time per phase, tasks per wave,
+  and verify history. Missing data shows as missing, never as zero.
+- **Muse Code** is a supported host.
 
 ## Install from npm
 
@@ -157,65 +151,52 @@ project settings. Dashboard users can open **Settings → Path settings** for th
 same shipping, model/effort, and future review-panel controls. See
 [Path settings](skills/gsd-path/references/config.md) for precedence and locks.
 
-## Dashboard and menu-bar toolbar
-
-The optional **OpenGSD Path monitor** shows your projects without opening each
-project's `.project/` files. It watches the folders you choose and reads project
-state without advancing phase gates. Explicit Path settings saves use the
-validated configuration helper; background monitoring remains read-only.
-The monitor is a separate install from the npm skills package.
-
-### Dashboard
-
-The project board shows blocked, active, and shipped work, with milestone and
-phase progress, task counts, last activity, and available usage data. Use the
-[dashboard controls](daemon/README.md#dashboard) to filter or search projects,
-switch between Board and Milestones, refresh status, and manage settings.
-
-![OpenGSD Path project board showing sample projects, status filters, milestone progress, tasks, and usage](docs/images/dashboard-board.png)
-
-Click a project to see its milestone roadmap, tasks, success criteria, review
-results, verification history, and activity. Usage includes tokens and turns
-from supported host session logs; cost estimates require model prices in the
-daemon configuration.
-
-![Project dashboard showing the history viewer link, milestone progress, expandable evidence, and usage with sample data](docs/images/dashboard-project.png)
-
-*Dashboard screenshots captured on September 19, 2026, using the repository's
-sample projects; the current project folder layout may differ.*
-
-Open **History & files** to browse project files and archived milestones,
-preview Markdown, or read a file at a selected Git commit. Relative document
-links keep that selected version. **Records & sources → Load full records**
-loads recorded usage, verification, activity, and indexed host turns on demand,
-with coverage details that make missing or invalid data visible.
-
-Open **Settings → Path settings** to change user defaults or project overrides
-for shipping mode, model and effort choices, and future review panels. Each
-setting shows its source and any lock reason; changes are saved explicitly.
-
-The **Plugin** settings page shows each watched project's runtime version and
-provides an explicit **Update** action with progress and failure details.
-Updating global skills does not update a project's pinned runtime.
-
-### macOS menu bar
-
-Click the OpenGSD Path menu-bar icon for a compact project list with phase
-meters and task progress. Click a project to open its dashboard page. The
-bottom toolbar opens the dashboard, plugin settings, and watched folders;
-it also provides rescan, appearance, and quit controls. The daemon row shows
-its running state and provides restart and stop controls. Option-click the
-menu-bar icon to open the dashboard directly.
-
-<img src="docs/images/macos-menu-bar.png" alt="OpenGSD Path native macOS panel with sample projects and its bottom toolbar" width="400">
-
-*The native panel screenshot uses sample project data and was captured in its
-preview window; the current folder layout may differ.*
-
-### Install the monitor
-
-The monitor requires Python 3.9+. From a source checkout, preview the setup,
-then install (macOS/Linux shell):
+## Desktop app
+
+The **OpenGSD Path app** shows your projects without opening each project's
+`.project/` files, and manages the Path setup on your computer. It is a
+pre-release for testers.
+
+**Get it:** download the installer for your system from the newest `app-v`
+entry on the [releases page](https://github.com/open-gsd/gsd-path/releases):
+`.dmg` (macOS, Apple Silicon or Intel), `.msi` (Windows), `.deb` or AppImage
+(Linux). The app needs Python 3.9+ and Git; its first screen checks for both
+and shows the fix when one is missing.
+
+macOS builds are signed with a Developer ID and notarized by Apple from 0.1.1
+on, so they open without an approval in Privacy & Security. Windows builds have
+no code signature yet: SmartScreen shows a warning; choose **More info → Run
+anyway**.
+
+What the app does:
+
+- **Projects:** blocked, active, and shipped work with milestone and phase
+  progress, tasks, last activity, and usage. A project page shows its
+  roadmap, tasks, success criteria, reviews, verification history, files at
+  any Git version, and full recorded evidence.
+- **Skills:** which coding agents have Path skills, at which version, with
+  preview, install, update, and uninstall. Every write shows a preview or a
+  plan first.
+- **Project setup:** runtime version, guard hooks, health check, and, for a
+  multi-repo coordinator, member hooks and marker repair.
+- **Settings:** updates, Path settings (shipping mode, models, review panel),
+  watched folders, model prices, launch at login, and appearance.
+- **Stats** and the per-project **Environment** editor.
+- **Tray:** a compact project list, items that need attention, and controls
+  to start, restart, and quit.
+
+The app only watches and sets up. It never advances a phase; approvals and
+rulings stay in your agent. It updates itself: it checks a signed update file,
+asks before it installs, and refuses an update whose signature does not match.
+
+Background monitoring is read-only. The app starts a local monitor (the
+daemon) and stops it on quit. See the [app guide](daemon/app/README.md) and the
+[daemon guide](daemon/README.md).
+
+### Manual monitor (without the app)
+
+From a source checkout you can still run the monitor and its browser
+dashboard without the app. It requires Python 3.9+:
 
 ```bash
 git clone https://github.com/open-gsd/gsd-path.git
@@ -224,33 +205,20 @@ PYTHONPATH=daemon python3 -m gsd_daemon install --dry-run
 PYTHONPATH=daemon python3 -m gsd_daemon install
 ```
 
-On Windows, after cloning and entering `gsd-path`, use PowerShell:
+On Windows, use PowerShell in the `gsd-path` folder. The last command starts
+the monitor for this session; it starts by itself at later logins:
 
 ```powershell
 $env:PYTHONPATH = "daemon"
 python -m gsd_daemon install --dry-run
 python -m gsd_daemon install
-```
-
-On Windows, launch the installed shortcut for this session before opening the
-dashboard. It starts automatically at future logins:
-
-```powershell
 Start-Process "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\gsd-path-daemon.lnk"
 ```
 
-Open **http://127.0.0.1:8765**, then use **Settings → Watched folders** to add
-your project folders. The installer creates an isolated Python environment and
-configures autostart. On macOS it also builds and installs the native menu-bar
-app; this requires macOS 12+ and Xcode Command Line Tools (`swiftc`). On
-macOS, use `--no-tray` for the dashboard only. Linux autostart runs the
-dashboard; launch the optional tray separately with
-`~/.gsd-path/venv/bin/gsd-path-daemon tray`. Windows uses a tray-and-dashboard
-Startup shortcut; see the [daemon guide](daemon/README.md) for platform details.
-
-See the [daemon guide](daemon/README.md) for configuration, usage pricing,
-manual startup, and platform setup, or the [macOS guide](daemon/macos/README.md)
-for native menu-bar details.
+Then open **http://127.0.0.1:8765**. The first launch of the desktop app
+removes this older autostart entry so only one monitor runs. See the
+[daemon guide](daemon/README.md) for platform details, configuration, and
+usage pricing.
 
 ## Skills
 
@@ -474,7 +442,7 @@ node scripts/install.mjs --all --update --project /path/to/project   # refresh .
 
 | Flag | User skills root | Invoke |
 | --- | --- | --- |
-| `--codex`, `--zed` | `~/.agents/skills` | Codex: `$path` or `$gsd-path`; Zed: `/path` or `/gsd-path` |
+| `--codex`, `--zed`, `--muse` | `~/.agents/skills` | Codex: `$path` or `$gsd-path`; Zed, Muse: `/path` or `/gsd-path` |
 | `--claude` | `~/.claude/skills` | `/path` or `/gsd-path` |
 | `--cursor` | `~/.cursor/skills` (+ subagent) | `/path` or `/gsd-path` |
 | `--grok` | `~/.grok/skills` | `/path` or `/gsd-path` |

package/RUNTIME.md

@@ -91,7 +91,7 @@ argument slots defined in the dispatch model policy.
 calls. In `round`, an unfinished earlier wave blocks dispatch before the bookkeeping
 checkpoint. Child completion is recorded in `exit.json`; the parent alone
 writes `state.json`.
-For `review`, `panel`, and `skeptics`, when the child process is gone and `finished_at` is
+For `round`, `review`, `panel`, and `skeptics`, when the child process is gone and `finished_at` is
 unset, the driver rereads that attempt's state and exit receipt before
 collecting the result or blocking with
 `child wrapper exited without recording a result`.

package/UPDATE.md

@@ -176,9 +176,10 @@ a global update does not update project runtimes. Use the project's **Update**
 button to refresh its runtime and existing guards. Install and update actions
 show progress, success or failure, and installer output.
 
-If the daemon's plugin source checkout has local changes, project Update uses
-that local build and says so in its result. It does not pull remote changes over
-local edits. Clean source checkouts still refresh before a project update.
+Project Update refreshes the daemon's plugin source first. With the
+[git source](daemon/README.md#plugin-lifecycle), a clone that has local changes
+is used as that local build, and the result says so. It does not pull remote
+changes over local edits.
 
 Older unstamped installs show **Unknown — version metadata unavailable**.
 This does not establish that their runtime is outdated or broken. **Update**

package/WORKFLOW.md

@@ -223,6 +223,20 @@ vetoes and corrections verbatim. Unresolved items remain tagged `RESEARCH` or
 first and presented as settled coverage for correction; the interview covers
 only its gaps and contradictions.
 
+Once the success criteria are drafted, define runs the spec-reach probes
+([spec-probes.md](skills/gsd-path/references/spec-probes.md)). The edge probe
+walks each criterion through a closed edge taxonomy (boundary, adjacency,
+empty, encoding, ordering, precision, idempotency, concurrency) and records
+the user's ruling per applicable edge in INTENT.md `## Edge coverage`:
+`criterion SCn` (stated in a success criterion), `held-out` (a named test
+pins it), or `dismissed` with a reason. The prohibition probe asks what each
+criterion must never silently become and records kept items in
+`## Prohibitions` as `criterion SCn`, `judgment`, or `dismissed`. Define
+never rules on an edge itself. `scripts/check_handoffs.py intent` checks
+both tables before every approval question, and the `define/done` transition
+refuses an intent whose tables are incomplete. An INTENT.md without these
+sections predates the probes and is not rechecked.
+
 At approval define classifies the milestone lane in INTENT.md: `quick`
 when scope fits at most two deliverable-sized tasks in one wave with no open
 questions and no cross-wave risk; otherwise `standard`. Milestone mode — a
@@ -343,6 +357,9 @@ by — which that task must own, in the same wave as the capability behind it.
 `check_handoffs.py final` then requires each of those criteria to name its
 surface in FINAL.md with the walkthrough as its Check, so a surface criterion
 cannot be marked `met` on internal test output.
+Every `held-out` edge gets a PLAN.md `## Held-out checks` row naming the task
+and test file; that test is in the task's files, its Verify runs it, and its
+Acceptance criteria state the edge id and ruling.
 `scripts/check_handoffs.py plan` gates the table; `wave` and `final`
 require a verdict per owned SC id. Acceptance criteria,
 owned SCs, and Verify are the contract; the coder owns
@@ -417,7 +434,11 @@ surface walkthroughs, in its existing review. The runtime proves freshness and
 generates FINAL.md from that record. Dispatch an integration reviewer only when
 that proof is incomplete or stale; dispatch gap reviewers only for uncovered
 cross-wave risks through the shared capacity-aware contract. The integration reviewer marks each success
-criterion `met`, `not-met`, or `unverifiable` with checked evidence. Each gap
+criterion `met`, `not-met`, or `unverifiable` with checked evidence. A criterion
+tagged by a `held-out` edge or `judgment` prohibition is `met` only when its
+evidence cites every tag id; otherwise the reviewer records `unverifiable`
+(insufficient spec evidence) and `check_handoffs.py final` refuses a `met`
+that skips a tag. Each gap
 reviewer records `pass` or `blocked` for its assigned end-to-end or cross-wave
 risk. List only genuine
 risks that could plausibly fail; never pad the list. The runtime

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengsd/gsd-path",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "description": "Disk-backed AI agent pipeline. Docs: DOCS.md (start here), QUICK.md, FULL.md, UPDATE.md",
   "license": "MIT",
   "repository": {
@@ -77,7 +77,9 @@
     "skills/",
     "platforms/",
     "AGENTS.md",
-    "WORKFLOW.md"
+    "WORKFLOW.md",
+    "!**/__pycache__/**",
+    "!**/*.pyc"
   ],
   "engines": {
     "node": ">=18.17"
@@ -85,6 +87,7 @@
   "scripts": {
     "install:ci": "npm ci",
     "check:prereqs": "node scripts/dev/check-prereqs.mjs",
+    "check:locks": "node scripts/dev/py.mjs scripts/check_lock_usage.py",
     "test": "node tests/run-node-tests.mjs",
     "test:smoke": "npm test",
     "test:integration": "npm run test:python",

package/platforms/shared-agents/dispatch.md

@@ -44,6 +44,19 @@ use exactly one matching branch:
   create another worktree. Encode task dependencies explicitly; launch
   independent children concurrently up to the host's advertised
   concurrent-subagent capacity.
+- A `muse.subagent_spawn` tool (with `muse.subagent_wait`,
+  `muse.subagent_read_result`, and `muse.subagent_send_message` siblings) is
+  Muse Code. Omit `subagent_type` (general-purpose, full capability), pass the
+  logical task name as `task_name` and `role`, and the complete brief as
+  `objective`. Never set `worktree_isolation`. Keep the returned
+  `subagent_id`; send a correction to a still-live child with
+  `muse.subagent_send_message` mode `followup` and the complete new prompt,
+  otherwise start a fresh child. Collect with `muse.subagent_wait`
+  (`wait_for: task_terminal`) then `muse.subagent_read_result`; on
+  `root_capacity_exhausted`, wait for a child to finish and retry. Spawn has no
+  model or effort argument, so record no such capability. If only
+  `muse.workflow` is exposed (untrusted workspace), do not script or inline
+  the work; stop and report that the workspace must be trusted.
 
 For every branch: