@opengsd/gsd-path 1.5.0 → 1.6.0

package/CHANGELOG.md

@@ -11,6 +11,144 @@ app and the daemon have their own file,
 [daemon/app/CHANGELOG.md](daemon/app/CHANGELOG.md). Release bookkeeping and
 test-only changes are not listed; the Git history has them.
 
+## [1.6.0] - 2026-10-12
+
+### Added
+- let a later task supersede an earlier task and retire its Verify
+- document the default branch record of a member
+- member paths read the default branch that MEMBERS.md records
+- record the default branch of a member in MEMBERS.md
+- add --uninstall to the skill installers
+- expose default_branch to the router and document the rule
+- refuse members under a coordinator whose default branch is not main
+- status, promotion and the git guard follow STATE default_branch
+- integrate and validate on the default branch that STATE records
+- bind milestones at the default branch that STATE records
+- record the origin default branch in STATE at initialization
+
+### Changed
+- make each checkpoint commit different in the stale sidecar test
+- record 1.6.0 live release evidence
+- prepare 1.6.0 minor candidate
+- Merge main into fix/issue-392-wave-review-validator
+- Merge main into fix/issue-393-helper-papercuts
+- Merge main into fix/issue-357-regression-verify
+- Merge main into fix/issue-358-multi-repo-batches
+- Merge main into fix/issue-390-build-helpers-runtime
+- state the repair base-to-landing rule in build-native.md
+- document supersedes gate rule in plan skill
+- describe finish retry, stale Verify sidecar, leftover isolate
+- document retired Verify key in RUNTIME.md
+- name per-repo batching in review_findings docstring
+- correct task_review_observation docstring after marker-tolerant matching
+- state the wave review format rules and name them in the gate errors
+- Document alias denial in directories that do not exist
+- a done task brief with a deleted Context path does not fail later lint
+- Document directory overlap rule in planner brief
+- prove the issue 374 fixes through the real commands
+- prove a define re-slice that removes a surface reaches the plan gate
+- Merge remote-tracking branch 'origin/main' into fix/issue-344-scope-destructive-git-guards
+- correct fix-tasks carried rule in RUNTIME.md
+- document regression Verify at landing in RUNTIME.md
+- point stale Python-installer flag lists to README
+- say how more than one person can work on a project
+- show host proof tiers in README and QUICK
+- Document literal attestation limit for declared directories
+- Align coder file-scope rule with declared-directory landing
+- add contributing guide, security policy, and issue forms
+- style: fix assignment spacing in round lint test
+- prove round lint accepts dependency-supplied contract paths
+- bind the next milestone after a direct ship on a master default
+- Add GitHub Actions workflow for Discord changelog
+- update release notes for v1.5.0
+- quote portable repository paths in shell fixture
+
+### Fixed
+- plan gate reads a declared directory when it checks supersedes
+- give no removal advice for an isolate that holds a gitignored file
+- replace a stale Verify sidecar only when it is proven untouched
+- check the chain files from the repair base, not from the repair landing
+- read update-ref, branch and worktree targets as Git does
+- deny scoped deletions when the guard cannot prove the repository
+- link review repairs by finding, not by criterion text alone
+- give a superseding task the protective role of the task it supersedes
+- check the files of every later linked repair before a chain receipt
+- name only the leftover isolate when a landed task could not be cleaned up
+- make only sub-bullet line markers optional in a criterion quote
+- give a receipt to a chain of review repairs on the same files
+- report a landed task as landed when the removal of its isolate fails
+- deliver review_findings and task_context through the project runtime
+- prove a member review repair in the member repository
+- match a quoted criterion without the list markers of its sub-bullets
+- let finish run again after a failed serial Verify, and prepare-task replace a stale Verify sidecar
+- accept a review repair whose files are not in its fix batch
+- report unreviewed earlier waves in ready and prove repair-wave order
+- say how to record a Log event when a transition changes no field
+- tell the user how to get the full SHA when a ref is refused
+- name the differing identity field when a model policy record does not match
+- a review cycle replaces an older one only with a valid wave verdict
+- land tasks that share an earlier task one at a time
+- list worktrees on Git versions without worktree list -z
+- keep tracked cd targets valid with the scoped deletion rules
+- keep ordinary Git commands allowed with env and in new directories
+- accept an unset base milestone only for a closed build recovery
+- keep review evidence checks when a criterion number repeats
+- keep the fallback for a missing bundled helper module
+- git guard uses main when STATE has no default_branch
+- do not skip an earlier Verify because its text is in the own Verify
+- treat a declared directory and a path below it as overlapping files
+- accept a default branch that starts with origin/ at ship
+- re-raise an import error from inside a bundled helper module
+- keep a blocked review cycle until a newer cycle has a verdict
+- keep the cap exemption when a cap line carries the template comment
+- run earlier-wave Verify at landing when a task edits the same files
+- keep each review repair in one repo and lint landed briefs as history
+- give a repeat finding its next repair and ignore repairs of a replaced review
+- land files under a declared files directory
+- let a define-entered re-slice amend the active roadmap entry
+- keep wave reviews when a plan repair changes only caps or dependency notes
+- drop superseded review cycles from the dashboard attention list
+- load bundled helpers when a foreign `scripts` package is importable
+- tolerate repeated criterion numbers and unset recovery base milestone
+- chain an existing Git hook instead of refusing the hook install
+- accept external-landing proof when the forge deletes the bound branch
+- fail early on a non-main default and document external-landing
+- cover all parameter syntaxes in scoped deletion
+- fail closed on literal parameter target ambiguity
+- scope destructive Git cleanup to Path-owned targets
+
+### Other
+- Resolve macOS temp path in ownership scope test fixture
+- Check unfolded and folded readings of process substitutions
+- Fold process substitutions; count only real earlier Git commands
+- Check each reading of inexact Git commands; limit descriptor denial
+- Split separator-joined redirections; read attached printf -v name
+- Strip shell redirections before Git detection; keep alias words
+- Both Windows failures have one cause, and it is a test defect, not a product defect. The fix is one line in `tests/test_member_native.py`; it is not committed. **Cause.** The failing assertion is the second leftover check in `test_next_finish_names_only_the_leftover_sidecar_of_a_landed_member_task` (line 136). The test's `attempt()` helper writes `app.py` with `write_text("v2\n")`, which is `v2\r\n` on Windows, and CI runs with `core.autocrlf=false`, so the landed blob is CRLF. The test then wrote the file back with `write_bytes(b"v2\n")`. On Windows those bytes are not the landed blob, so the driver correctly gave no "remove its leftover isolate" stop and reported `landed`, and the test raised `KeyError: 'reason'`. **Invariant.** A test that puts a "landed" file back must write the same bytes that were landed, on every platform. This was the only place in the branch's new tests that broke it: the sibling leftover tests in `test_dispatch_driver.py` and `test_isolation.py` pass on Windows. **Fix.** The restore now uses the same `write_text("v2\n", encoding="utf-8")` call as `attempt()`. No product code changed, so no generated copies needed a sync. **Verification (macOS only; no Windows run was possible here).** - `python3 -m unittest tests.test_member_native`: 6 tests pass. - With `Path.write_text` patched to write CRLF for `app.py` (to emulate Windows), the original test fails with the same `KeyError: 'reason'` at line 136, and the fixed test passes
+- Read redirections and Git context names as the shell does
+- list a part as retired only when dropped; document it
+- record each retired part of a fix-task Verify
+- retire copied Verify in fix tasks; restore _task_deps
+- Prefer exact criterion quote; join any-indent sub-bullets
+- give the leftover-isolate stop only after a content check
+- Cause: both Windows checks fail in one test only, `test_gsd_path_text_in_a_path_does_not_make_a_worktree_path_owned` (18 subtest failures = 6 targets x 3 pipeline states). The test put a native path, not quoted, into a Bash command. On Windows the path has backslashes, Bash word splitting removes them (`C:\Users\x` becomes `C:Usersx`), and the guard correctly answers "needs a literal target". The guard code is correct; the test was not cross-platform. Invariant: a test that puts a filesystem path into a shell command must quote it, so the guard sees the same path on each OS. Fix (tests/test_guard_hook.py only, no change to scripts/guard_hook.py): - The two commands in the failing test now use `shlex.quote(str(target))`, the convention the file already uses in other tests. - Same edit at the two sibling sites in `test_forced_worktree_remove_checks_registered_path_and_owner` (`{task_worktree}`, `{managed}`). They passed on Windows only because `assert_denied` accepts any denial reason, so they did not test ownership there. - No other unquoted path interpolation into a `worktree remove` command exists in tests/test_guard_hook.py, tests/test_guard_hook_windows.py or tests/test_git_guard.py. Verification: the two changed tests pass locally on macOS (2 tests, OK). A check with `shlex.split` on a sample Windows path shows the unquoted form loses the backslashes and the quoted form keeps them. Not verified: an actual Windows run; that needs the next CI run. The full test suite was not run, because only two test methods changed. Changes are in the working tree, not committed
+- restore the exact-heading repair marker test method
+- align plan gate supersedes with runtime; trim reviewer rule
+- match em-dash criteria in review_findings; correct placeholder message
+- leave landed repair waves out of unreviewed_waves
+- scope guard built-ins and worktree ownership correctly
+- void wave reviews on any review_panel line change
+- Cause: the PR's new test `test_validate_refuses_a_default_branch_that_cannot_be_recorded` (tests/test_members.py) wrote a MEMBERS.md row with `Checkout: /x`. On Windows `/x` is not an absolute path, so `members.py validate` stopped at the earlier check (`Checkout must be absolute`) and never reached the `Default branch` check. All 3 subtests failed on both Windows jobs (3.9 and 3.12, shard 2). The product code is correct. Invariant: a test row that targets one validation rule must be valid for every earlier rule on every OS. Sites checked in the changed area: - `test_validate_refuses_a_default_branch_that_cannot_be_recorded`: violated, fixed. - `repeated default branch` case in `test_validate_refuses_malformed_members_file` (also added by this PR, also uses `/x`): holds. It asserts only `MEMBERS.md` in stderr and passed on Windows. Not changed. Fix (1 line, test only): the row now uses `Checkout: {self.root / 'web'}`, which is absolute on each OS. This is the same pattern as the existing row at tests/test_members.py:190. Verification (macOS, local): - `python3 -m unittest tests.test_members -k default_branch`: 6 tests, OK. - Mutation check: with the `valid_default_branch` check in scripts/members.py disabled, the test fails with `failures=3`. The mutation was reverted; only tests/test_members.py is changed. - Not run on Windows locally. The Windows result depends on the next CI run. The change is not committed. The test-writer and ponytail skills were not invoked for this one-line test edit
+- drop dash from cap value class, allow cost caps
+- compare Config as raw text except cap values
+- accept member-create rerun on row without default branch
+- All 4 failing checks have one cause: the two new tests `test_land_staging_failure_reports_git_stderr` and `test_checkpoint_staging_failure_reports_git_stderr` in `tests/test_isolation.py` ("IsolationError not raised"). The fix is a test-only change in the helper `refuse_crlf_staging`; the product code is correct and is not changed. Root cause: the helper made `git add` fail with repository config `core.autocrlf=input` + `core.safecrlf=true`. The CI test runner (`scripts/dev/py.mjs`) sets `core.autocrlf=false` through `GIT_CONFIG_*` environment variables, and the environment overrides repository config. Thus on CI git did no CRLF conversion, `git add` passed, and no error was raised. The tests passed with plain `python3 -m unittest`, which is why the failure was not seen before the push. This is not an OS or git-version problem (Linux and Windows failed the same way). Invariant: a test that needs `git add` to fail must not depend on a git setting that the test runner overrides. The helper is the one shared boundary; only these two tests use it. No other test in this change sets `core.autocrlf`. Fix: the helper now writes `* text eol=lf` to `.git/info/attributes` (an attribute overrides `core.autocrlf`, and the file is outside the work tree, so it adds no pending path) and keeps `core.safecrlf=true`. The assertions are unchanged: they still require the error to end with git's stderr ("CRLF would be replaced by LF") and HEAD to stay at the base. Verification: - Reproduced the CI failure locally through `node scripts/dev/py.mjs` before the fix (2 failures). - After the fix the two tests pass through `node scripts/dev/py.mjs`, with plain `python3`, and with `core.autocrlf=true` forced through the environment. - Full `tests/test_isolation.py` through the CI runner: 155 tests, 1 failure. That failure is `RecoverTests.test_serial_task_recovers_after_only_project_bookkeeping_commits` (blocked subtest: verdict 'none', expected 'reconcile'). It also fails when run alone, it does not use the changed helper, the test and the recover code are not in this PR's diff, and CI reported only the two staging tests as failures. I did not change it. It looks like a local-environment difference (local git is 2.54, CI is 2.55), but I did not find its cause. Not run: the full repository suite and the Windows jobs (CI owns those)
+- identify replaced-review repairs by history, not name
+- split cap lines like the Config parser
+- state Codex native hook needs trust in README
+- keep cap lines with comment markers under Config guard
+- correct canonical-file rule in CONTRIBUTING.md
+- journal recovery_reviews so resumed approvals report dropped reviews
 ## [1.5.0] - 2026-10-09
 
 ### Added

package/DOCS.md

@@ -36,6 +36,7 @@ DOCS.md (here)     four journeys in one place
 | **Team** — pin skills in repo | `--local` install; see [Installing](#installing) |
 | **Shipping broke** — archive commit blocked | [HOOKS.md](HOOKS.md) (expected with hooks) |
 | **Several repos** — one milestone changes them all | [Multi-repo milestones](README.md#multi-repo-milestones) |
+| **Several people** — one project | [Working with more than one person](FULL.md#working-with-more-than-one-person) |
 
 ---
 
@@ -101,9 +102,9 @@ README's Windows notes). **Always** restart the agent session after install.
 
 Full roots and invocation table: [README.md](README.md#install-summary).
 
-**Python installer:** `scripts/install.py` supports global and `--local`
-installs plus `--update`. The Node CLI remains the interactive wizard and npm
-entry point.
+**Python installer:** `scripts/install.py`; see
+[README.md](README.md#install-summary) for what it supports. The Node CLI
+remains the interactive wizard and npm entry point.
 Help: `node scripts/install.mjs --help`
 
 ---

package/FULL.md

@@ -8,7 +8,8 @@ Complete walkthrough from install to shipped milestone.
 
 **Contents:** [What it is](#what-gsd-path-is) · [Installation](#installation) ·
 [Starting a milestone](#starting-a-milestone) · [Phases](#phases-and-your-role) ·
-[Shipping](#shipping) · [Resume](#resume-and-recovery) · [Troubleshooting](#troubleshooting)
+[Shipping](#shipping) · [Resume](#resume-and-recovery) ·
+[More than one person](#working-with-more-than-one-person) · [Troubleshooting](#troubleshooting)
 
 **Related docs**
 
@@ -86,8 +87,8 @@ Use the [router and phase invocation table](README.md#install-summary) for your
 - **Python 3.9+** found as `python3`, `python`, or `py -3`; required for project
   installs, project refresh, and project-state
   doctor checks; optional for global-only Node installs. `scripts/install.py`
-  mirrors global and `--local` install transactions and `--update`; it does not
-  provide the interactive wizard
+  does not provide the interactive wizard; see
+  [README.md](README.md#install-summary) for what it supports
 
 ### Global install (default)
 
@@ -328,7 +329,11 @@ approve **Archive and ship**, the archive transaction begins:
 
 Direct integration is the project default. Before build, ask the router to set
 `pull-request` as the project default or as an override for the current
-milestone. The setting locks when build starts.
+milestone. The setting locks when build starts. When origin is not GitHub.com
+and `main` accepts merge requests only, set `external-landing`: Path publishes
+the milestone branch, you merge it in your own forge with the merge message
+that Path returns, and Path then validates the merge and tags it. See
+[integration](WORKFLOW.md#integration).
 
 After `validate-integrated` passes, the next milestone starts clean on a new
 `gsd-path/M00N` cut from `origin/main`. Invoke the router again; brownfield
@@ -407,6 +412,61 @@ in force; see [the collection helper](scripts/isolation.py).
 
 ---
 
+## Working with more than one person
+
+One operator drives a milestone. One checkout holds the bound branch
+`gsd-path/M00N` and the `.project/` state of that milestone. A multi-repo
+milestone does not change this: one coordinator checkout holds the state.
+
+GSD Path does not record or check who approves a gate. The `STATE.md` log
+keeps the date, the phase, and the event. The only name is the Git author of a
+checkpoint commit, and GSD Path does not read it. Agree in your team who
+approves.
+
+**Supported**
+
+- One person runs the router and approves the gates, in one checkout.
+- Other people review and merge the result. Set `pull-request` integration
+  before build. Path opens the pull request and waits until a GitHub user
+  account merges it with a merge commit. Path does not check which user. With
+  `external-landing`, the review is the merge request in your own forge.
+- A second session in the same checkout can ask for status and can run the
+  discussion skill. Status only reads. The discussion helper takes a lock and
+  only appends records.
+- The desktop app and the monitor only read a watched project in the
+  background. Their explicit actions change install and configuration files.
+  They cannot advance a phase. See [daemon/README.md](daemon/README.md).
+
+**Not protected**
+
+- The locks are file locks on one computer, in one clone. They put helper
+  calls in sequence: state changes, approvals, discussion records, and
+  dispatch driver calls. A state change from an old view fails with
+  `expected state does not match`. A second dispatch driver call returns
+  `blocked`.
+- The locks do not cover the files that agents write: the artifacts in
+  `.project/` and the product files. Two sessions that do phase work in one
+  checkout write to the same working tree.
+- The locks do not reach a second clone. Each clone keeps its own `STATE.md`,
+  task landings, and approvals. GSD Path does not merge them. Ship stops
+  (`moved or collides`) when `origin` already has `gsd-path/M00N` from another
+  clone.
+- You cannot share a milestone in progress through the remote. With
+  [guard hooks](HOOKS.md) installed, the pre-push hook refuses `gsd-path/M00N`
+  before its ship commit. It also refuses any other branch that carries the
+  unfinished state. Hooks are optional and local to each clone. A clone
+  without hooks has no such check.
+
+**Do not**
+
+- Do not run the router or a phase skill for one milestone from two clones, or
+  from two sessions at the same time.
+- Do not push `gsd-path/M00N` by hand, and do not merge another branch into
+  it.
+- Do not squash or rebase the integration pull request or merge request.
+
+---
+
 ## Standalone docs audit
 
 `/gsd-path-docs-audit` runs between phases as a drift check. Findings get

package/HOOKS.md

@@ -77,6 +77,29 @@ setups (Husky and friends) and linked worktrees (where `.git` is a file).
 Every selected host requires an initialized repository with a resolvable hooks
 directory; otherwise installation stops before writing.
 
+### Existing Git hooks
+
+A repository can already have its own `pre-commit`, `commit-msg`, or `pre-push`
+hook.
+
+- **In the repository's own `.git/hooks`:** the installer keeps your hook as
+  `<hook>.gsd-path-chained` and writes the guard hook in its place. The guard
+  runs first. Your hook runs after it, with the same arguments and the same
+  `pre-push` input, only when the guard accepts. If the installation fails,
+  your hook is put back unchanged.
+- **In a `core.hooksPath` directory (for example Husky) or a linked worktree:**
+  the installer stops with `cannot chain` and changes nothing. That directory
+  can be tracked or shared, so a rename there reaches other clones. Rename your
+  hook to `<hook>.gsd-path-chained` yourself, then rerun the installer. Commit
+  the rename when the directory is tracked.
+- **`<hook>.gsd-path-chained` already exists beside a foreign hook:** the
+  installer stops. Decide which of the two files you want to keep.
+
+Git hooks are local to a clone. A bot that merges on the server, such as
+Renovate, never runs them, and its commits on the default branch do not
+disturb milestone validation. A merge request can still conflict when the bot
+and the milestone change the same file; Path does not resolve that conflict.
+
 Git hooks work for **any** agent that commits. Native guard wiring denies a tool
 call when its event is malformed or the guard cannot validate it.
 
@@ -128,9 +151,46 @@ See [UPDATE.md](UPDATE.md).
   the archive tree; shell operands count an ancestor only for deletion or move
   commands
 - `git reset --hard`, destructive `git clean` modes, force pushes (including
-  `+` refspecs), destructive branch or ref deletion, `git branch -m`,
-  `git worktree remove --force`, `git stash drop`/`clear`, and whole-tree
+  `+` refspecs), `git branch -m`, `git stash drop`/`clear`, and whole-tree
   `git checkout -- .`/`git restore .`
+- forced branch deletion (`git branch -D`), `git update-ref` deletion, and
+  `git worktree remove --force` when the target is Path-owned: a `gsd-path/`,
+  `gsd-path-task/`, `gsd-path-verify/`, or `gsd-path-integrate/` branch, a
+  `refs/gsd-path/` ref, the bound `STATE.branch`, a task branch or worktree
+  that task frontmatter records, a worktree on one of these branches, and a
+  worktree below a managed worktree root (`~/.gsd-path`,
+  `GSD_PATH_WORKTREE_ROOT`, a pinned workspace root, or the earlier
+  `<repo>.gsd-path/` and `.<repo>-gsd-path-integrate-*` locations beside the
+  repository). The text `gsd-path` in a path does not make a worktree
+  Path-owned. Also Path-owned: the remote-tracking ref of one of these
+  branches (`origin/gsd-path/M001`), `refs/stash`, and a name that differs
+  from a recorded branch only in letter case. Other branches, refs, and
+  registered worktrees are allowed in each pipeline state. These three
+  commands are also denied when the guard cannot prove the target: a missing,
+  non-literal, or unregistered target, a shell parameter in the Git command
+  (`git -C "$dir" branch -D x`), a `~` or glob in a Git option value,
+  `update-ref --stdin`, an `update-ref` name outside `refs/` (`HEAD`) or an
+  option cluster (`-dm`), an `update-ref` deletion without `--no-deref` after
+  another Git command in the same command line, ownership metadata it cannot
+  read, a working directory that does not exist yet, or an `env` wrapper that
+  resets or unsets `HOME`, `XDG_CONFIG_HOME`, or a `GIT_*` variable. They are
+  denied too after a directory change the guard cannot model. Only
+  `cd <directory>` or `cd -- <directory>` is modeled, with one literal
+  directory that is absolute or starts with `./` or `../` (a shell with
+  `CDPATH` looks for a plain relative name in other directories). Another
+  command name (`pushd`, `chdir`), an option, a second operand, a redirection,
+  a `cd` in a subshell, pipeline, condition, function, alias, trap, or
+  comment line is not modeled. Use `git -C <directory>` there. A plain
+  redirection on the Git command (`2>/dev/null`, `>file`, `>>file`, `<file`,
+  `2>&1`, `&>file`) is not a target. A here-document, here-string, process
+  substitution, a redirection target that is not one literal word, or a
+  `# comment` after the command keeps the denial. So does a file
+  descriptor word of more than one digit or a `{name}` word against a
+  redirection (`10>file`, `{fd}>file`), because bash and zsh read that word
+  differently. With
+  such an `env` wrapper, or in a directory that does not exist yet, a Git
+  command that is not a built-in command is denied too, because its alias
+  cannot be inspected
 - shell writes (redirections, `tee`, `cp`, `mv`, `rm`, `sed -i`, ...) that
   target a routing control (`.git`, `.project/STATE.md`, `.project/next`,
   `.gsd-path`) while `.project/STATE.md` exists, or target a product file
@@ -366,6 +426,7 @@ not intercept subagent tools — treat coverage as orchestrator-level.
 | `ship:` commit blocked with `app.py` staged | Ship commits may only touch `.project/` |
 | Tool denied editing archive | Pre-tool guard — use active paths, not archive |
 | Hook not running in Cursor | Run `--hooks-refresh-full --cursor --project /path/to/repo` |
+| Installer stops with `cannot chain` | See [existing Git hooks](#existing-git-hooks): rename your hook to `<hook>.gsd-path-chained`, or remove the stale chained file, then rerun |
 | `--hooks-refresh` rejects an unmanaged guard | Move the foreign guard aside, then rerun refresh; use `--hooks-init` if guards are wanted |
 | Runtime missing, invalid, or legacy | Follow [runtime restoration or migration](DOCS.md#project-runtime-versions) |
 

package/MIGRATE.md

@@ -10,6 +10,18 @@ selected project. Core history stays in `.planning/`; Path creates its own
 `.project/` state through the normal router. Core phase positions and completed
 plans do not become passed Path gates.
 
+## Requirements
+
+- The default branch of `origin` can have any name, for example `master`.
+  Path initialization records it in `.project/STATE.md` as `default_branch`
+  and ships onto it. Run `git remote set-head origin --auto` before the first
+  Path run: an unset `origin/HEAD` records `main`. See
+  [default branch](WORKFLOW.md#default-branch).
+- Pull-request shipping supports GitHub.com only. On GitLab, Gitea, or GitHub
+  Enterprise Server, ship with `direct`, or with
+  [`external-landing`](WORKFLOW.md#integration) when the default branch
+  accepts merge requests only.
+
 ## Start
 
 Install or update GSD Path using [the install guide](QUICK.md). In the Core

package/QUICK.md

@@ -13,8 +13,10 @@
 One router skill drives a gated pipeline: inspect → define → research → decide →
 plan → build → ship. Every handoff lives in `.project/` so any session can resume from disk.
 
-**Hosts:** Codex, Claude Code, Grok, OpenCode, Copilot CLI, Qwen, Antigravity,
-Cursor, Zed, Kiro, Kimi Code, Muse Code.
+**Hosts:** Codex, Claude Code, Grok, OpenCode, Antigravity, Cursor, and Kimi
+Code have a passing live milestone for release 1.6.0. Copilot CLI, Qwen, Zed,
+Kiro, and Muse Code install, but have no live milestone for that release. See
+[host tiers](README.md).
 
 ---
 

package/README.md

@@ -9,21 +9,29 @@ milestone loop. While a milestone builds, the next one can be planned in
 parallel under `.project/next/` (lookahead); a building milestone can also be
 abandoned on an explicit ruling, archiving its partial work for a re-slice.
 
-**Supported hosts:** Codex, Claude Code, Grok, OpenCode, GitHub Copilot CLI,
-Qwen Code, Antigravity CLI, Cursor, Zed, Kiro, Kimi Code, and Muse Code.
-Support means the installer and dispatch contract exist. See the
-[host trust matrix](https://github.com/open-gsd/gsd-path/blob/main/docs/trust-validation/HOST-MATRIX.md) for live milestone
-proof and each host's guard tier.
+**Hosts with a passing full live milestone for release 1.6.0:** Codex, Claude
+Code, Grok, OpenCode, Antigravity CLI, Cursor, and Kimi Code.
+
+**Hosts with an installer and a dispatch contract, but no live milestone for
+release 1.6.0:** GitHub Copilot CLI (account quota exhausted), Qwen Code, Zed,
+and Kiro (API credits), and Muse Code (no live release evidence recorded yet).
+These hosts are excluded from the release evaluation. Exclusion is not a pass.
+
+With guard hooks installed, only Claude Code and Cursor get a fail-closed
+native guard; every other host relies on Git hooks. The installer also writes a
+native Codex hook, and it runs only after you trust it (see [HOOKS.md](HOOKS.md)).
+The [host trust matrix](https://github.com/open-gsd/gsd-path/blob/main/docs/trust-validation/HOST-MATRIX.md)
+is the source of truth for live milestone proof and each host's guard tier.
 
 <!-- release-docs -->
-**Latest npm release:** [@opengsd/gsd-path@1.5.0](https://www.npmjs.com/package/@opengsd/gsd-path/v/1.5.0) — [release notes](CHANGELOG.md#150---2026-10-09)
+**Latest npm release:** [@opengsd/gsd-path@1.6.0](https://www.npmjs.com/package/@opengsd/gsd-path/v/1.6.0) — [release notes](CHANGELOG.md#160---2026-10-12)
 
 **Recent highlights**
-- record runtime hotfix provenance on the declaration
-- add signed self-update
-- add the Skills, Stats, Settings, and Environment pages and the setup wizard
-- register the hosts, project operation, and env routes
-- add project setup operations for the app
+- let a later task supersede an earlier task and retire its Verify
+- document the default branch record of a member
+- member paths read the default branch that MEMBERS.md records
+- record the default branch of a member in MEMBERS.md
+- add --uninstall to the skill installers
 
 <!-- /release-docs -->
 
@@ -120,7 +128,13 @@ contain newer changes.
 
 1. Open your project folder in your coding-agent host. Existing repositories
    need Git; GitHub repository creation and pull-request operations also need
-   an authenticated GitHub CLI (`gh`).
+   an authenticated GitHub CLI (`gh`). The default branch of `origin` can have
+   any name: Path records it at initialization and ships onto it. This guide
+   calls it `main`; see [default branch](WORKFLOW.md#default-branch).
+   Pull-request
+   shipping supports GitHub.com only. On GitLab, Gitea, or GitHub Enterprise
+   Server, use the [`external-landing` mode](WORKFLOW.md#integration) when
+   the default branch accepts merge requests only.
 2. Start or reload the host session so it discovers the installed skills.
 3. Invoke `$path` in Codex, or `/path` on slash-command hosts. The router
    identifies the project and guides you through the required inputs and approvals.
@@ -151,6 +165,25 @@ project settings. Dashboard users can open **Settings → Path settings** for th
 same shipping, model/effort, and future review-panel controls. See
 [Path settings](skills/gsd-path/references/config.md) for precedence and locks.
 
+### Uninstall
+
+```bash
+npx @opengsd/gsd-path@latest --uninstall --all --dry-run
+npx @opengsd/gsd-path@latest --uninstall --all
+```
+
+`--uninstall` removes the installed GSD Path skills from the selected hosts.
+For Cursor it also removes the GSD Path subagent file. Use host flags instead
+of `--all` to select hosts. For project-local skills, run the command from
+your project directory and add `--local`. `--dry-run` shows each path and
+removes nothing.
+
+The command removes only GSD Path skills. It keeps other skills, host
+settings, and `disabled-gsd-skills` backups. It makes no backup: changes that
+you made in a GSD Path skill directory are lost. It does not remove project
+contracts or hooks (`.project/`, `.gsd-path/`, the `AGENTS.md` block, guard
+hooks). See [Uninstall skills](UPDATE.md#uninstall-skills).
+
 ## Desktop app
 
 The **OpenGSD Path app** shows your projects without opening each project's
@@ -358,12 +391,30 @@ partial remote/clone/worktree transaction; the default checkout stays clean.
 One project can change several repositories in the same milestone. The
 **coordinator** repo holds `.project/` and runs the pipeline; each other repo
 is a **member** listed in `.project/MEMBERS.md`. A member needs a GitHub.com
-`origin` whose default is `main`. See
+`origin`. Its default branch can have any name, and it can differ from the
+default branch of the coordinator and of the other members. See
 [ADR 0002](docs/adr/0002-multi-repo-coordinator.md) for the design.
 
+`MEMBERS.md` has one section per member, in ship order. `members.py` writes
+it; do not edit it by hand:
+
+```markdown
+## web
+Checkout: /absolute/path/to/web
+Remote: https://github.com/acme/web.git
+Integration: default
+Default branch: master
+```
+
+`Default branch` is the member's default branch on `origin`. `members.py add`
+records it one time, from the member's local `origin/HEAD`; run
+`git remote set-head origin --auto` in the member first. A section without
+the field means `main`. See [default branch](WORKFLOW.md#default-branch).
+
 - Add members at a milestone boundary: ask the router to add an existing repo
   (`members.py add`) or to create a new one (`members.py add --create`, after
-  you approve the exact owner, name, visibility, and checkout). For optional
+  you approve the exact owner, name, visibility, and checkout; a new
+  repository uses `main`). For optional
   guard hooks, install them in the member with
   `npx @opengsd/gsd-path@latest --member-of <coordinator> --project <member>`.
 - The planner gives each member task `repo: <member>`; one task changes one
@@ -438,6 +489,7 @@ node scripts/install.mjs --all --local
 node scripts/install.mjs --all --project /path/to/project
 node scripts/install.mjs --update
 node scripts/install.mjs --all --update --project /path/to/project   # refresh .gsd-path/; keeps contracts
+node scripts/install.mjs --uninstall --all --dry-run                 # preview; removes skills only
 ```
 
 | Flag | User skills root | Invoke |
@@ -457,7 +509,7 @@ OpenCode stable: ask to load and use the `gsd-path` skill.
 `gsd-path` remains the canonical router name; `path` is its short menu alias.
 For a single phase, use `$gsd-path-plan` in Codex or `/gsd-path-plan` on slash hosts.
 
-`scripts/install.py` — Python install, including `--local` and `--update`.
+`scripts/install.py` — Python install, including `--local`, `--update`, and `--uninstall`.
 The Node CLI remains the interactive and npm entry point. See [FULL.md](FULL.md) and
 [UPDATE.md](UPDATE.md) for `--hooks`, `--hooks-refresh`, `--local`, and host notes.
 

package/RUNTIME.md

@@ -23,7 +23,7 @@ inputs, receipt handling, and entry conditions are owned by the
 | `gate-plan` | Git HEAD; optional lookahead project directory | Pending discussion, intent coverage, brief paths, and panel configuration checked in order. |
 | `approve-plan` | Owner approval and `--expected-head <reviewed full SHA>` | Plan gates followed by the existing journaled approval checkpoint. |
 | `lint-round` | Git HEAD; optional `--project-dir .project/next` | Task brief checks against HEAD, then plan handoff checks. |
-| `prepare-task` | `--expected-head <clean base> --task-id <id> --round-size <ready task count>` | Canonical task isolation; serial work also gets a verification sidecar before the primary becomes dirty. |
+| `prepare-task` | `--expected-head <clean base> --task-id <id> --round-size <ready task count>` | Canonical task isolation; serial work also gets a verification sidecar before the primary becomes dirty. A verification sidecar that an earlier `prepare-task` left for the task is retired first only when it is proven untouched: its branch did not move from its creation base on the bound branch, and it has no tracked change and no untracked or gitignored file. Any other sidecar stays, and the command stops with its path and what was found. |
 | `build-evidence` | `--expected-head <full SHA>` | Canonical landing proof written to `<project-dir>/build/evidence.json` (default: `.project/build/evidence.json`). |
 
 Plan approval recovery remains `pipeline_state.py resume-checkpoint`. Pre-Git
@@ -68,7 +68,7 @@ skeptic attempts under `skeptics/`.
 | `skeptics --repo <root> --wave <N> --cycle <C> --child-command '<cmd>' [--wait <s>] [--child-timeout <s>]` | Step 7 skeptic branch: one read-only skeptic per `skeptic_groups` locator in its own sidecar at the recorded review base, briefed with the criterion, every observation, and the cited tasks verbatim; validate with `review_findings.py`, collect, retire, then rerun the helper. `none` without skeptic groups; `escalate` for structural blockers or the cycle cap. The skeptic files stay uncommitted for the fix-task or ruling checkpoint. |
 | `fix-tasks --repo <root> --wave <N> --cycle <C>` | Step 7 batching: one fix task per `review_findings.py collect` batch with the failed criteria and observations verbatim, lint-checked; `escalate` for structural blockers, skeptic groups, cycle cap, or all-refuted. |
 | `complete --repo <root>` | Completion: clean primary at `build/active` (or a crash-left `build/done`), no unfinished wave, the archive-time review cycle check (`discussion_validate.review_cycle_counts`: contiguous cycles, passing last cycle, panel and skeptic artifacts present); `workflow_run.py build-evidence` at HEAD; `pipeline_state.py transition` to `ship/active` with event `build done; final review pending`; checkpoint `build: complete milestone`. |
-| `finish --repo <root> --task-id <id>` | Recover first; return a proven landing without repeating Verify, or verify, land, record, and retire one returned task. Without a dispatch record, or when the newest record is settled and its base differs from the task's current in-progress base (a native retry after a driver block), read the primary task's in-progress state; if it lacks a recorded base, use the parallel task isolate's state only if that worktree is authorized. A blocked record at the same base still refuses the retry. A deactivated isolate stays blocked. |
+| `finish --repo <root> --task-id <id>` | Recover first; return a proven landing without repeating Verify, or verify, land, record, and retire one returned task. Without a dispatch record, or when the newest record is settled and its base differs from the task's current in-progress base (a native retry after a driver block), read the primary task's in-progress state; if it lacks a recorded base, use the parallel task isolate's state only if that worktree is authorized. A blocked record at the same base still refuses the retry, except a host-dispatched record (no child command) while the task is still in progress at that base: `finish` may run again after a failed Verify. A deactivated isolate stays blocked. |
 | `answer --repo <root> --task-id <id> --answer '<text>'` | Append `Orchestrator answer:` to the isolate's task Log; the next `round` redispatches that isolate. |
 | `status --repo <root>` | Every task's newest dispatch record. |
 
@@ -95,6 +95,13 @@ For `round`, `review`, `panel`, and `skeptics`, when the child process is gone a
 unset, the driver rereads that attempt's state and exit receipt before
 collecting the result or blocking with
 `child wrapper exited without recording a result`.
+A landing is final when the removal of its isolate fails: the receipt reports
+the task as landed with a `cleanup_warning`, and the next `round` or `finish`
+checks the isolate again. When only a leftover of a landed task's isolate
+remains and it holds nothing that Git does not have, the driver stops with
+`task <id> is landed; remove its leftover isolate: <path>`, changes neither
+STATE nor HEAD, and never deletes the path itself. Every other isolate error
+keeps its recovery block.
 Review starts from a clean base. A same-cycle retry may dispatch a missing lens
 at that unchanged base while verified, already-collected review artifacts remain
 uncommitted. Altered artifacts or unrelated changes block recovery.
@@ -127,7 +134,15 @@ with `another dispatch_driver invocation holds the lock`; wait for the
 active call to return before retrying. Bookkeeping also blocks if an
 in-progress primary task has no open dispatch record.
 
-Verify output is saved in `verify.json`. A `verify-record` ledger entry is
+Verify output is saved in `verify.json`. `finish` also runs the Verify of each
+earlier-wave task that shares a file with the task, under the
+[wave loop](skills/gsd-path/references/build-native.md#wave-loop) rule; those
+runs are saved under `regressions` and a failure blocks the landing. A Verify
+that a `supersedes` field retires does not run; it is listed under `retired`. A fix
+task Verify that loses only the copy of a retired Verify has a `retired` entry with
+the key `part` (the superseded task) and the Log entry `orchestrator regression
+Verify of <fix task id>: part of <task id> retired: superseded by <task id>`. A task
+with a `Heavy: yes` regression Verify counts as heavy. A `verify-record` ledger entry is
 written only when the landing commit's parent equals the recorded task base;
 a later parallel landing can therefore have no ledger entry.
 
@@ -174,8 +189,11 @@ through its receipt only when the canonical file matches the saved hash.
 
 `fix-tasks` reconciles existing repair tasks and PLAN rows before linting and
 checkpointing. It creates missing batches in an appended repair wave and
-reports new tasks in `created`, reused tasks in `existing`, and batches already
-covered by other repair tasks in `carried`. Status `created` includes restored
+reports new tasks in `created`, reused tasks in `existing`, and batches that
+other repair tasks not yet `done` cover in the same repo in `carried`. A member
+batch and its task carry `repo`. A fix task for a finding that repeats after
+its fix landed also depends on that landed fix task, so
+`review_findings.py repair-evidence` can link the two. Status `created` includes restored
 PLAN rows or pending project bookkeeping; `exists` means nothing was written
 and no project changes needed a checkpoint. Status `none` means no batches
 need work; `escalate` leaves the named decisions with build step 7 and the user.

package/UPDATE.md

@@ -273,6 +273,41 @@ Unrecognized or foreign `.project/` state is never auto-migrated — the router
 
 ---
 
+## Uninstall skills
+
+```bash
+npx @opengsd/gsd-path@latest --uninstall --all --dry-run
+npx @opengsd/gsd-path@latest --uninstall --all
+```
+
+From a git clone, use `node scripts/install.mjs` with the same flags.
+
+- Select the hosts with host flags or `--all`. A selection is necessary.
+- Add `--local`, from the project directory, for project-local skills.
+- `--dry-run` lists each path and removes nothing. A real run lists each
+  removed path.
+- A host that has no GSD Path skills shows `nothing to remove`. This is not an
+  error. A second run removes nothing.
+
+**Removed:** skill directories that GSD Path owns, and Cursor's
+`agents/gsd-path.md`. A directory is owned when it has a GSD Path name
+(`gsd-path`, `gsd-path-*`, the legacy `ogsd` names, or the `path` alias) and
+contains a `VERSION` file or a `SKILL.md` that names `gsd-path`. The `path`
+alias must also pass the ownership rule in
+[What auto-updates](#what-auto-updates). A directory with a GSD Path name
+that is not owned shows as `kept` and stays in place.
+
+**Not removed:** other skills, host settings, `disabled-gsd-skills` backups,
+and all project files: `.project/`, `.gsd-path/`, the `AGENTS.md` block, and
+guard hooks. `--uninstall` with `--project`, `--update`, `--doctor`, or a hook
+or runtime flag stops with an error.
+
+Removal makes no backup. Changes that you made in a GSD Path skill directory
+are lost. Codex, Zed, and Muse use one skills root (with `--local`, also
+Antigravity): an uninstall for one of them removes the skills for all of them.
+
+---
+
 ## Troubleshooting
 
 | Symptom | Fix |