@opengsd/gsd-path 1.5.0 → 1.6.1

package/AGENTS.md

@@ -139,7 +139,7 @@ full-repo suite on a tiny edit outrank the phase brief.
   canonical contents, carry-forward, and manifest pass the bundled precommit
   validator; report shipped only after the exact `.project/`-only ship commit
   passes the postcommit validator and `validate-integrated` proves the
-  two-parent integration merge, its tag, and its ancestry on origin/main —
+  integration landing, its tag, and its ancestry on origin/main —
   while integration is pending the router routes back to ship instead of
   reporting shipped or starting the next milestone.
 

package/CHANGELOG.md

@@ -11,6 +11,175 @@ app and the daemon have their own file,
 [daemon/app/CHANGELOG.md](daemon/app/CHANGELOG.md). Release bookkeeping and
 test-only changes are not listed; the Git history has them.
 
+## [1.6.1] - 2026-10-16
+
+### Added
+- accept GitHub rebase merges in pull-request integration
+
+### Changed
+- record 1.6.1 live host release evidence
+- prepare 1.6.1 patch candidate
+- Note PR rebase-merge landing in CONTEXT, WORKFLOW, AGENTS
+- Note owner-authorized push exception in FULL.md and HOOKS.md
+- correct the minimum Git version in TEST_ENVIRONMENT.md
+- prove the landed member base through the file scope check
+- describe project Update with no project install
+- update release notes for v1.6.0
+
+### Fixed
+- run dispatch_driver subprocess helpers from the selected runtime
+- refuse a relative model_policy --record and check release before locking
+- let promote-next replace a DOCS-AUDIT carry-forward the lookahead keeps
+- let the owner authorize one exact pre-ship push to a task branch
+- post Discord changelogs from automated releases
+- stage a landing or checkpoint change set with one git add
+- pass the landing message and member paths to git through stdin
+- do not check the paths that a landed task brief names
+- accept a landed task as the only owner of an Interface contract bullet
+- say why a project has no workflow status in the desktop app
+
+### Other
+- Accept only same value or T### for pending rulings
+- list not-started projects and re-probe after project install
+- sort idle projects with shipped in legacy dashboard
+## [1.6.0] - 2026-10-12
+
+### Added
+- let a later task supersede an earlier task and retire its Verify
+- document the default branch record of a member
+- member paths read the default branch that MEMBERS.md records
+- record the default branch of a member in MEMBERS.md
+- add --uninstall to the skill installers
+- expose default_branch to the router and document the rule
+- refuse members under a coordinator whose default branch is not main
+- status, promotion and the git guard follow STATE default_branch
+- integrate and validate on the default branch that STATE records
+- bind milestones at the default branch that STATE records
+- record the origin default branch in STATE at initialization
+
+### Changed
+- make each checkpoint commit different in the stale sidecar test
+- record 1.6.0 live release evidence
+- prepare 1.6.0 minor candidate
+- Merge main into fix/issue-392-wave-review-validator
+- Merge main into fix/issue-393-helper-papercuts
+- Merge main into fix/issue-357-regression-verify
+- Merge main into fix/issue-358-multi-repo-batches
+- Merge main into fix/issue-390-build-helpers-runtime
+- state the repair base-to-landing rule in build-native.md
+- document supersedes gate rule in plan skill
+- describe finish retry, stale Verify sidecar, leftover isolate
+- document retired Verify key in RUNTIME.md
+- name per-repo batching in review_findings docstring
+- correct task_review_observation docstring after marker-tolerant matching
+- state the wave review format rules and name them in the gate errors
+- Document alias denial in directories that do not exist
+- a done task brief with a deleted Context path does not fail later lint
+- Document directory overlap rule in planner brief
+- prove the issue 374 fixes through the real commands
+- prove a define re-slice that removes a surface reaches the plan gate
+- Merge remote-tracking branch 'origin/main' into fix/issue-344-scope-destructive-git-guards
+- correct fix-tasks carried rule in RUNTIME.md
+- document regression Verify at landing in RUNTIME.md
+- point stale Python-installer flag lists to README
+- say how more than one person can work on a project
+- show host proof tiers in README and QUICK
+- Document literal attestation limit for declared directories
+- Align coder file-scope rule with declared-directory landing
+- add contributing guide, security policy, and issue forms
+- style: fix assignment spacing in round lint test
+- prove round lint accepts dependency-supplied contract paths
+- bind the next milestone after a direct ship on a master default
+- Add GitHub Actions workflow for Discord changelog
+- update release notes for v1.5.0
+- quote portable repository paths in shell fixture
+
+### Fixed
+- plan gate reads a declared directory when it checks supersedes
+- give no removal advice for an isolate that holds a gitignored file
+- replace a stale Verify sidecar only when it is proven untouched
+- check the chain files from the repair base, not from the repair landing
+- read update-ref, branch and worktree targets as Git does
+- deny scoped deletions when the guard cannot prove the repository
+- link review repairs by finding, not by criterion text alone
+- give a superseding task the protective role of the task it supersedes
+- check the files of every later linked repair before a chain receipt
+- name only the leftover isolate when a landed task could not be cleaned up
+- make only sub-bullet line markers optional in a criterion quote
+- give a receipt to a chain of review repairs on the same files
+- report a landed task as landed when the removal of its isolate fails
+- deliver review_findings and task_context through the project runtime
+- prove a member review repair in the member repository
+- match a quoted criterion without the list markers of its sub-bullets
+- let finish run again after a failed serial Verify, and prepare-task replace a stale Verify sidecar
+- accept a review repair whose files are not in its fix batch
+- report unreviewed earlier waves in ready and prove repair-wave order
+- say how to record a Log event when a transition changes no field
+- tell the user how to get the full SHA when a ref is refused
+- name the differing identity field when a model policy record does not match
+- a review cycle replaces an older one only with a valid wave verdict
+- land tasks that share an earlier task one at a time
+- list worktrees on Git versions without worktree list -z
+- keep tracked cd targets valid with the scoped deletion rules
+- keep ordinary Git commands allowed with env and in new directories
+- accept an unset base milestone only for a closed build recovery
+- keep review evidence checks when a criterion number repeats
+- keep the fallback for a missing bundled helper module
+- git guard uses main when STATE has no default_branch
+- do not skip an earlier Verify because its text is in the own Verify
+- treat a declared directory and a path below it as overlapping files
+- accept a default branch that starts with origin/ at ship
+- re-raise an import error from inside a bundled helper module
+- keep a blocked review cycle until a newer cycle has a verdict
+- keep the cap exemption when a cap line carries the template comment
+- run earlier-wave Verify at landing when a task edits the same files
+- keep each review repair in one repo and lint landed briefs as history
+- give a repeat finding its next repair and ignore repairs of a replaced review
+- land files under a declared files directory
+- let a define-entered re-slice amend the active roadmap entry
+- keep wave reviews when a plan repair changes only caps or dependency notes
+- drop superseded review cycles from the dashboard attention list
+- load bundled helpers when a foreign `scripts` package is importable
+- tolerate repeated criterion numbers and unset recovery base milestone
+- chain an existing Git hook instead of refusing the hook install
+- accept external-landing proof when the forge deletes the bound branch
+- fail early on a non-main default and document external-landing
+- cover all parameter syntaxes in scoped deletion
+- fail closed on literal parameter target ambiguity
+- scope destructive Git cleanup to Path-owned targets
+
+### Other
+- Resolve macOS temp path in ownership scope test fixture
+- Check unfolded and folded readings of process substitutions
+- Fold process substitutions; count only real earlier Git commands
+- Check each reading of inexact Git commands; limit descriptor denial
+- Split separator-joined redirections; read attached printf -v name
+- Strip shell redirections before Git detection; keep alias words
+- Both Windows failures have one cause, and it is a test defect, not a product defect. The fix is one line in `tests/test_member_native.py`; it is not committed. **Cause.** The failing assertion is the second leftover check in `test_next_finish_names_only_the_leftover_sidecar_of_a_landed_member_task` (line 136). The test's `attempt()` helper writes `app.py` with `write_text("v2\n")`, which is `v2\r\n` on Windows, and CI runs with `core.autocrlf=false`, so the landed blob is CRLF. The test then wrote the file back with `write_bytes(b"v2\n")`. On Windows those bytes are not the landed blob, so the driver correctly gave no "remove its leftover isolate" stop and reported `landed`, and the test raised `KeyError: 'reason'`. **Invariant.** A test that puts a "landed" file back must write the same bytes that were landed, on every platform. This was the only place in the branch's new tests that broke it: the sibling leftover tests in `test_dispatch_driver.py` and `test_isolation.py` pass on Windows. **Fix.** The restore now uses the same `write_text("v2\n", encoding="utf-8")` call as `attempt()`. No product code changed, so no generated copies needed a sync. **Verification (macOS only; no Windows run was possible here).** - `python3 -m unittest tests.test_member_native`: 6 tests pass. - With `Path.write_text` patched to write CRLF for `app.py` (to emulate Windows), the original test fails with the same `KeyError: 'reason'` at line 136, and the fixed test passes
+- Read redirections and Git context names as the shell does
+- list a part as retired only when dropped; document it
+- record each retired part of a fix-task Verify
+- retire copied Verify in fix tasks; restore _task_deps
+- Prefer exact criterion quote; join any-indent sub-bullets
+- give the leftover-isolate stop only after a content check
+- Cause: both Windows checks fail in one test only, `test_gsd_path_text_in_a_path_does_not_make_a_worktree_path_owned` (18 subtest failures = 6 targets x 3 pipeline states). The test put a native path, not quoted, into a Bash command. On Windows the path has backslashes, Bash word splitting removes them (`C:\Users\x` becomes `C:Usersx`), and the guard correctly answers "needs a literal target". The guard code is correct; the test was not cross-platform. Invariant: a test that puts a filesystem path into a shell command must quote it, so the guard sees the same path on each OS. Fix (tests/test_guard_hook.py only, no change to scripts/guard_hook.py): - The two commands in the failing test now use `shlex.quote(str(target))`, the convention the file already uses in other tests. - Same edit at the two sibling sites in `test_forced_worktree_remove_checks_registered_path_and_owner` (`{task_worktree}`, `{managed}`). They passed on Windows only because `assert_denied` accepts any denial reason, so they did not test ownership there. - No other unquoted path interpolation into a `worktree remove` command exists in tests/test_guard_hook.py, tests/test_guard_hook_windows.py or tests/test_git_guard.py. Verification: the two changed tests pass locally on macOS (2 tests, OK). A check with `shlex.split` on a sample Windows path shows the unquoted form loses the backslashes and the quoted form keeps them. Not verified: an actual Windows run; that needs the next CI run. The full test suite was not run, because only two test methods changed. Changes are in the working tree, not committed
+- restore the exact-heading repair marker test method
+- align plan gate supersedes with runtime; trim reviewer rule
+- match em-dash criteria in review_findings; correct placeholder message
+- leave landed repair waves out of unreviewed_waves
+- scope guard built-ins and worktree ownership correctly
+- void wave reviews on any review_panel line change
+- Cause: the PR's new test `test_validate_refuses_a_default_branch_that_cannot_be_recorded` (tests/test_members.py) wrote a MEMBERS.md row with `Checkout: /x`. On Windows `/x` is not an absolute path, so `members.py validate` stopped at the earlier check (`Checkout must be absolute`) and never reached the `Default branch` check. All 3 subtests failed on both Windows jobs (3.9 and 3.12, shard 2). The product code is correct. Invariant: a test row that targets one validation rule must be valid for every earlier rule on every OS. Sites checked in the changed area: - `test_validate_refuses_a_default_branch_that_cannot_be_recorded`: violated, fixed. - `repeated default branch` case in `test_validate_refuses_malformed_members_file` (also added by this PR, also uses `/x`): holds. It asserts only `MEMBERS.md` in stderr and passed on Windows. Not changed. Fix (1 line, test only): the row now uses `Checkout: {self.root / 'web'}`, which is absolute on each OS. This is the same pattern as the existing row at tests/test_members.py:190. Verification (macOS, local): - `python3 -m unittest tests.test_members -k default_branch`: 6 tests, OK. - Mutation check: with the `valid_default_branch` check in scripts/members.py disabled, the test fails with `failures=3`. The mutation was reverted; only tests/test_members.py is changed. - Not run on Windows locally. The Windows result depends on the next CI run. The change is not committed. The test-writer and ponytail skills were not invoked for this one-line test edit
+- drop dash from cap value class, allow cost caps
+- compare Config as raw text except cap values
+- accept member-create rerun on row without default branch
+- All 4 failing checks have one cause: the two new tests `test_land_staging_failure_reports_git_stderr` and `test_checkpoint_staging_failure_reports_git_stderr` in `tests/test_isolation.py` ("IsolationError not raised"). The fix is a test-only change in the helper `refuse_crlf_staging`; the product code is correct and is not changed. Root cause: the helper made `git add` fail with repository config `core.autocrlf=input` + `core.safecrlf=true`. The CI test runner (`scripts/dev/py.mjs`) sets `core.autocrlf=false` through `GIT_CONFIG_*` environment variables, and the environment overrides repository config. Thus on CI git did no CRLF conversion, `git add` passed, and no error was raised. The tests passed with plain `python3 -m unittest`, which is why the failure was not seen before the push. This is not an OS or git-version problem (Linux and Windows failed the same way). Invariant: a test that needs `git add` to fail must not depend on a git setting that the test runner overrides. The helper is the one shared boundary; only these two tests use it. No other test in this change sets `core.autocrlf`. Fix: the helper now writes `* text eol=lf` to `.git/info/attributes` (an attribute overrides `core.autocrlf`, and the file is outside the work tree, so it adds no pending path) and keeps `core.safecrlf=true`. The assertions are unchanged: they still require the error to end with git's stderr ("CRLF would be replaced by LF") and HEAD to stay at the base. Verification: - Reproduced the CI failure locally through `node scripts/dev/py.mjs` before the fix (2 failures). - After the fix the two tests pass through `node scripts/dev/py.mjs`, with plain `python3`, and with `core.autocrlf=true` forced through the environment. - Full `tests/test_isolation.py` through the CI runner: 155 tests, 1 failure. That failure is `RecoverTests.test_serial_task_recovers_after_only_project_bookkeeping_commits` (blocked subtest: verdict 'none', expected 'reconcile'). It also fails when run alone, it does not use the changed helper, the test and the recover code are not in this PR's diff, and CI reported only the two staging tests as failures. I did not change it. It looks like a local-environment difference (local git is 2.54, CI is 2.55), but I did not find its cause. Not run: the full repository suite and the Windows jobs (CI owns those)
+- identify replaced-review repairs by history, not name
+- split cap lines like the Config parser
+- state Codex native hook needs trust in README
+- keep cap lines with comment markers under Config guard
+- correct canonical-file rule in CONTRIBUTING.md
+- journal recovery_reviews so resumed approvals report dropped reviews
 ## [1.5.0] - 2026-10-09
 
 ### Added

package/DOCS.md

@@ -36,6 +36,7 @@ DOCS.md (here)     four journeys in one place
 | **Team** — pin skills in repo | `--local` install; see [Installing](#installing) |
 | **Shipping broke** — archive commit blocked | [HOOKS.md](HOOKS.md) (expected with hooks) |
 | **Several repos** — one milestone changes them all | [Multi-repo milestones](README.md#multi-repo-milestones) |
+| **Several people** — one project | [Working with more than one person](FULL.md#working-with-more-than-one-person) |
 
 ---
 
@@ -101,9 +102,9 @@ README's Windows notes). **Always** restart the agent session after install.
 
 Full roots and invocation table: [README.md](README.md#install-summary).
 
-**Python installer:** `scripts/install.py` supports global and `--local`
-installs plus `--update`. The Node CLI remains the interactive wizard and npm
-entry point.
+**Python installer:** `scripts/install.py`; see
+[README.md](README.md#install-summary) for what it supports. The Node CLI
+remains the interactive wizard and npm entry point.
 Help: `node scripts/install.mjs --help`
 
 ---

package/FULL.md

@@ -8,7 +8,8 @@ Complete walkthrough from install to shipped milestone.
 
 **Contents:** [What it is](#what-gsd-path-is) · [Installation](#installation) ·
 [Starting a milestone](#starting-a-milestone) · [Phases](#phases-and-your-role) ·
-[Shipping](#shipping) · [Resume](#resume-and-recovery) · [Troubleshooting](#troubleshooting)
+[Shipping](#shipping) · [Resume](#resume-and-recovery) ·
+[More than one person](#working-with-more-than-one-person) · [Troubleshooting](#troubleshooting)
 
 **Related docs**
 
@@ -86,8 +87,8 @@ Use the [router and phase invocation table](README.md#install-summary) for your
 - **Python 3.9+** found as `python3`, `python`, or `py -3`; required for project
   installs, project refresh, and project-state
   doctor checks; optional for global-only Node installs. `scripts/install.py`
-  mirrors global and `--local` install transactions and `--update`; it does not
-  provide the interactive wizard
+  does not provide the interactive wizard; see
+  [README.md](README.md#install-summary) for what it supports
 
 ### Global install (default)
 
@@ -321,14 +322,18 @@ approve **Archive and ship**, the archive transaction begins:
 - `MANIFEST.md` records contents and ship metadata
 - One **ship commit** (subject `ship: M00N — <slug>`) touches only `.project/`
 - Ship then either merges `gsd-path/M00N` onto `main` directly or opens a
-  GitHub PR and waits for you to merge it with a merge commit. Path-created PRs
-  include a GSD Path credit footer.
-- After the two-parent merge validates, Path tags `milestone/<NNN>-<slug>`
+  GitHub PR and waits for you to merge it with a merge commit or a rebase
+  merge. Path-created PRs include a GSD Path credit footer.
+- After the landing validates, Path tags `milestone/<NNN>-<slug>`
 - Archives are **read-only** — guard hooks enforce this if installed
 
 Direct integration is the project default. Before build, ask the router to set
 `pull-request` as the project default or as an override for the current
-milestone. The setting locks when build starts.
+milestone. The setting locks when build starts. When origin is not GitHub.com
+and `main` accepts merge requests only, set `external-landing`: Path publishes
+the milestone branch, you merge it in your own forge with the merge message
+that Path returns, and Path then validates the merge and tags it. See
+[integration](WORKFLOW.md#integration).
 
 After `validate-integrated` passes, the next milestone starts clean on a new
 `gsd-path/M00N` cut from `origin/main`. Invoke the router again; brownfield
@@ -407,6 +412,62 @@ in force; see [the collection helper](scripts/isolation.py).
 
 ---
 
+## Working with more than one person
+
+One operator drives a milestone. One checkout holds the bound branch
+`gsd-path/M00N` and the `.project/` state of that milestone. A multi-repo
+milestone does not change this: one coordinator checkout holds the state.
+
+GSD Path does not record or check who approves a gate. The `STATE.md` log
+keeps the date, the phase, and the event. The only name is the Git author of a
+checkpoint commit, and GSD Path does not read it. Agree in your team who
+approves.
+
+**Supported**
+
+- One person runs the router and approves the gates, in one checkout.
+- Other people review and merge the result. Set `pull-request` integration
+  before build. Path opens the pull request and waits until a GitHub user
+  account merges it with a merge commit. Path does not check which user. With
+  `external-landing`, the review is the merge request in your own forge.
+- A second session in the same checkout can ask for status and can run the
+  discussion skill. Status only reads. The discussion helper takes a lock and
+  only appends records.
+- The desktop app and the monitor only read a watched project in the
+  background. Their explicit actions change install and configuration files.
+  They cannot advance a phase. See [daemon/README.md](daemon/README.md).
+
+**Not protected**
+
+- The locks are file locks on one computer, in one clone. They put helper
+  calls in sequence: state changes, approvals, discussion records, and
+  dispatch driver calls. A state change from an old view fails with
+  `expected state does not match`. A second dispatch driver call returns
+  `blocked`.
+- The locks do not cover the files that agents write: the artifacts in
+  `.project/` and the product files. Two sessions that do phase work in one
+  checkout write to the same working tree.
+- The locks do not reach a second clone. Each clone keeps its own `STATE.md`,
+  task landings, and approvals. GSD Path does not merge them. Ship stops
+  (`moved or collides`) when `origin` already has `gsd-path/M00N` from another
+  clone.
+- You cannot share a milestone in progress through the remote. With
+  [guard hooks](HOOKS.md) installed, the pre-push hook refuses `gsd-path/M00N`
+  before its ship commit. It also refuses any other branch that carries the
+  unfinished state, unless the owner authorizes that exact commit (see
+  [HOOKS.md](HOOKS.md)). Hooks are optional and local to each clone. A clone
+  without hooks has no such check.
+
+**Do not**
+
+- Do not run the router or a phase skill for one milestone from two clones, or
+  from two sessions at the same time.
+- Do not push `gsd-path/M00N` by hand, and do not merge another branch into
+  it.
+- Do not squash or rebase the integration pull request or merge request.
+
+---
+
 ## Standalone docs audit
 
 `/gsd-path-docs-audit` runs between phases as a drift check. Findings get

package/HOOKS.md

@@ -77,6 +77,29 @@ setups (Husky and friends) and linked worktrees (where `.git` is a file).
 Every selected host requires an initialized repository with a resolvable hooks
 directory; otherwise installation stops before writing.
 
+### Existing Git hooks
+
+A repository can already have its own `pre-commit`, `commit-msg`, or `pre-push`
+hook.
+
+- **In the repository's own `.git/hooks`:** the installer keeps your hook as
+  `<hook>.gsd-path-chained` and writes the guard hook in its place. The guard
+  runs first. Your hook runs after it, with the same arguments and the same
+  `pre-push` input, only when the guard accepts. If the installation fails,
+  your hook is put back unchanged.
+- **In a `core.hooksPath` directory (for example Husky) or a linked worktree:**
+  the installer stops with `cannot chain` and changes nothing. That directory
+  can be tracked or shared, so a rename there reaches other clones. Rename your
+  hook to `<hook>.gsd-path-chained` yourself, then rerun the installer. Commit
+  the rename when the directory is tracked.
+- **`<hook>.gsd-path-chained` already exists beside a foreign hook:** the
+  installer stops. Decide which of the two files you want to keep.
+
+Git hooks are local to a clone. A bot that merges on the server, such as
+Renovate, never runs them, and its commits on the default branch do not
+disturb milestone validation. A merge request can still conflict when the bot
+and the milestone change the same file; Path does not resolve that conflict.
+
 Git hooks work for **any** agent that commits. Native guard wiring denies a tool
 call when its event is malformed or the guard cannot validate it.
 
@@ -128,9 +151,46 @@ See [UPDATE.md](UPDATE.md).
   the archive tree; shell operands count an ancestor only for deletion or move
   commands
 - `git reset --hard`, destructive `git clean` modes, force pushes (including
-  `+` refspecs), destructive branch or ref deletion, `git branch -m`,
-  `git worktree remove --force`, `git stash drop`/`clear`, and whole-tree
+  `+` refspecs), `git branch -m`, `git stash drop`/`clear`, and whole-tree
   `git checkout -- .`/`git restore .`
+- forced branch deletion (`git branch -D`), `git update-ref` deletion, and
+  `git worktree remove --force` when the target is Path-owned: a `gsd-path/`,
+  `gsd-path-task/`, `gsd-path-verify/`, or `gsd-path-integrate/` branch, a
+  `refs/gsd-path/` ref, the bound `STATE.branch`, a task branch or worktree
+  that task frontmatter records, a worktree on one of these branches, and a
+  worktree below a managed worktree root (`~/.gsd-path`,
+  `GSD_PATH_WORKTREE_ROOT`, a pinned workspace root, or the earlier
+  `<repo>.gsd-path/` and `.<repo>-gsd-path-integrate-*` locations beside the
+  repository). The text `gsd-path` in a path does not make a worktree
+  Path-owned. Also Path-owned: the remote-tracking ref of one of these
+  branches (`origin/gsd-path/M001`), `refs/stash`, and a name that differs
+  from a recorded branch only in letter case. Other branches, refs, and
+  registered worktrees are allowed in each pipeline state. These three
+  commands are also denied when the guard cannot prove the target: a missing,
+  non-literal, or unregistered target, a shell parameter in the Git command
+  (`git -C "$dir" branch -D x`), a `~` or glob in a Git option value,
+  `update-ref --stdin`, an `update-ref` name outside `refs/` (`HEAD`) or an
+  option cluster (`-dm`), an `update-ref` deletion without `--no-deref` after
+  another Git command in the same command line, ownership metadata it cannot
+  read, a working directory that does not exist yet, or an `env` wrapper that
+  resets or unsets `HOME`, `XDG_CONFIG_HOME`, or a `GIT_*` variable. They are
+  denied too after a directory change the guard cannot model. Only
+  `cd <directory>` or `cd -- <directory>` is modeled, with one literal
+  directory that is absolute or starts with `./` or `../` (a shell with
+  `CDPATH` looks for a plain relative name in other directories). Another
+  command name (`pushd`, `chdir`), an option, a second operand, a redirection,
+  a `cd` in a subshell, pipeline, condition, function, alias, trap, or
+  comment line is not modeled. Use `git -C <directory>` there. A plain
+  redirection on the Git command (`2>/dev/null`, `>file`, `>>file`, `<file`,
+  `2>&1`, `&>file`) is not a target. A here-document, here-string, process
+  substitution, a redirection target that is not one literal word, or a
+  `# comment` after the command keeps the denial. So does a file
+  descriptor word of more than one digit or a `{name}` word against a
+  redirection (`10>file`, `{fd}>file`), because bash and zsh read that word
+  differently. With
+  such an `env` wrapper, or in a directory that does not exist yet, a Git
+  command that is not a built-in command is denied too, because its alias
+  cannot be inspected
 - shell writes (redirections, `tee`, `cp`, `mv`, `rm`, `sed -i`, ...) that
   target a routing control (`.git`, `.project/STATE.md`, `.project/next`,
   `.gsd-path`) while `.project/STATE.md` exists, or target a product file
@@ -291,6 +351,22 @@ such as `rm -rf scratch` passes the archive check; other guard rules still apply
   without `STATE.md` passes on an ordinary ref. An absent bound ref passes
   deletion. The authorized publisher is `archive_milestone.py integrate`;
   the hook checks ref updates, not which client initiated them
+- **allows** an owner-approved push of unshipped work, such as a task
+  branch that CI must measure before the task can finish. The owner records
+  the exact commit for the exact branch, then pushes it:
+
+  ```bash
+  git update-ref refs/gsd-path/authorizations/<project>/push/refs/heads/<branch> <commit>
+  ```
+
+  `<project>` is the `project` field in that commit's `STATE.md`. The hook
+  accepts the push only at that commit; a later commit, such as one that
+  removes the measurement inputs, needs its own record. Bound `gsd-path/M###`
+  refs, the default branch, and tags never accept an authorization. The
+  authorization accepts every push of that commit to that branch until the
+  owner removes it with `git update-ref -d <same ref>`. Deleting the remote
+  branch afterwards needs no authorization. Only the owner records an
+  authorization; an agent asks the owner for one
 - **allows** adding files to archive during the ship transaction, before the
   branch closes
 
@@ -298,8 +374,8 @@ These local hooks cover pushes made by plain Git and clients that invoke
 Git with hooks enabled. Creating a PR from an already published ref does not
 run the pre-push hook. A branch cut from `main` carrying `shipped/done` passes;
 if `main` instead carries an unshipped bound state, pushes of branches carrying
-that state remain blocked until the milestone records are repaired through the
-pipeline.
+that state remain blocked, except owner-authorized commits, until the
+milestone records are repaired through the pipeline.
 
 ## GitHub-side gate
 
@@ -366,6 +442,7 @@ not intercept subagent tools — treat coverage as orchestrator-level.
 | `ship:` commit blocked with `app.py` staged | Ship commits may only touch `.project/` |
 | Tool denied editing archive | Pre-tool guard — use active paths, not archive |
 | Hook not running in Cursor | Run `--hooks-refresh-full --cursor --project /path/to/repo` |
+| Installer stops with `cannot chain` | See [existing Git hooks](#existing-git-hooks): rename your hook to `<hook>.gsd-path-chained`, or remove the stale chained file, then rerun |
 | `--hooks-refresh` rejects an unmanaged guard | Move the foreign guard aside, then rerun refresh; use `--hooks-init` if guards are wanted |
 | Runtime missing, invalid, or legacy | Follow [runtime restoration or migration](DOCS.md#project-runtime-versions) |
 

package/MIGRATE.md

@@ -10,6 +10,18 @@ selected project. Core history stays in `.planning/`; Path creates its own
 `.project/` state through the normal router. Core phase positions and completed
 plans do not become passed Path gates.
 
+## Requirements
+
+- The default branch of `origin` can have any name, for example `master`.
+  Path initialization records it in `.project/STATE.md` as `default_branch`
+  and ships onto it. Run `git remote set-head origin --auto` before the first
+  Path run: an unset `origin/HEAD` records `main`. See
+  [default branch](WORKFLOW.md#default-branch).
+- Pull-request shipping supports GitHub.com only. On GitLab, Gitea, or GitHub
+  Enterprise Server, ship with `direct`, or with
+  [`external-landing`](WORKFLOW.md#integration) when the default branch
+  accepts merge requests only.
+
 ## Start
 
 Install or update GSD Path using [the install guide](QUICK.md). In the Core

package/QUICK.md

@@ -13,8 +13,10 @@
 One router skill drives a gated pipeline: inspect → define → research → decide →
 plan → build → ship. Every handoff lives in `.project/` so any session can resume from disk.
 
-**Hosts:** Codex, Claude Code, Grok, OpenCode, Copilot CLI, Qwen, Antigravity,
-Cursor, Zed, Kiro, Kimi Code, Muse Code.
+**Hosts:** Codex, Claude Code, Grok, OpenCode, Antigravity, Cursor, and Kimi
+Code have a passing live milestone for release 1.6.1. Copilot CLI, Qwen, Zed,
+Kiro, and Muse Code install, but have no live milestone for that release. See
+[host tiers](README.md).
 
 ---
 

package/README.md

@@ -9,21 +9,29 @@ milestone loop. While a milestone builds, the next one can be planned in
 parallel under `.project/next/` (lookahead); a building milestone can also be
 abandoned on an explicit ruling, archiving its partial work for a re-slice.
 
-**Supported hosts:** Codex, Claude Code, Grok, OpenCode, GitHub Copilot CLI,
-Qwen Code, Antigravity CLI, Cursor, Zed, Kiro, Kimi Code, and Muse Code.
-Support means the installer and dispatch contract exist. See the
-[host trust matrix](https://github.com/open-gsd/gsd-path/blob/main/docs/trust-validation/HOST-MATRIX.md) for live milestone
-proof and each host's guard tier.
+**Hosts with a passing full live milestone for release 1.6.1:** Codex, Claude
+Code, Grok, OpenCode, Antigravity CLI, Cursor, and Kimi Code.
+
+**Hosts with an installer and a dispatch contract, but no live milestone for
+release 1.6.1:** GitHub Copilot CLI (account quota exhausted), Qwen Code, Zed,
+and Kiro (API credits), and Muse Code (no live release evidence recorded yet).
+These hosts are excluded from the release evaluation. Exclusion is not a pass.
+
+With guard hooks installed, only Claude Code and Cursor get a fail-closed
+native guard; every other host relies on Git hooks. The installer also writes a
+native Codex hook, and it runs only after you trust it (see [HOOKS.md](HOOKS.md)).
+The [host trust matrix](https://github.com/open-gsd/gsd-path/blob/main/docs/trust-validation/HOST-MATRIX.md)
+is the source of truth for live milestone proof and each host's guard tier.
 
 <!-- release-docs -->
-**Latest npm release:** [@opengsd/gsd-path@1.5.0](https://www.npmjs.com/package/@opengsd/gsd-path/v/1.5.0) — [release notes](CHANGELOG.md#150---2026-10-09)
+**Latest npm release:** [@opengsd/gsd-path@1.6.1](https://www.npmjs.com/package/@opengsd/gsd-path/v/1.6.1) — [release notes](CHANGELOG.md#161---2026-10-16)
 
 **Recent highlights**
-- record runtime hotfix provenance on the declaration
-- add signed self-update
-- add the Skills, Stats, Settings, and Environment pages and the setup wizard
-- register the hosts, project operation, and env routes
-- add project setup operations for the app
+- accept GitHub rebase merges in pull-request integration
+- run dispatch_driver subprocess helpers from the selected runtime
+- refuse a relative model_policy --record and check release before locking
+- let promote-next replace a DOCS-AUDIT carry-forward the lookahead keeps
+- let the owner authorize one exact pre-ship push to a task branch
 
 <!-- /release-docs -->
 
@@ -120,7 +128,13 @@ contain newer changes.
 
 1. Open your project folder in your coding-agent host. Existing repositories
    need Git; GitHub repository creation and pull-request operations also need
-   an authenticated GitHub CLI (`gh`).
+   an authenticated GitHub CLI (`gh`). The default branch of `origin` can have
+   any name: Path records it at initialization and ships onto it. This guide
+   calls it `main`; see [default branch](WORKFLOW.md#default-branch).
+   Pull-request
+   shipping supports GitHub.com only. On GitLab, Gitea, or GitHub Enterprise
+   Server, use the [`external-landing` mode](WORKFLOW.md#integration) when
+   the default branch accepts merge requests only.
 2. Start or reload the host session so it discovers the installed skills.
 3. Invoke `$path` in Codex, or `/path` on slash-command hosts. The router
    identifies the project and guides you through the required inputs and approvals.
@@ -151,6 +165,25 @@ project settings. Dashboard users can open **Settings → Path settings** for th
 same shipping, model/effort, and future review-panel controls. See
 [Path settings](skills/gsd-path/references/config.md) for precedence and locks.
 
+### Uninstall
+
+```bash
+npx @opengsd/gsd-path@latest --uninstall --all --dry-run
+npx @opengsd/gsd-path@latest --uninstall --all
+```
+
+`--uninstall` removes the installed GSD Path skills from the selected hosts.
+For Cursor it also removes the GSD Path subagent file. Use host flags instead
+of `--all` to select hosts. For project-local skills, run the command from
+your project directory and add `--local`. `--dry-run` shows each path and
+removes nothing.
+
+The command removes only GSD Path skills. It keeps other skills, host
+settings, and `disabled-gsd-skills` backups. It makes no backup: changes that
+you made in a GSD Path skill directory are lost. It does not remove project
+contracts or hooks (`.project/`, `.gsd-path/`, the `AGENTS.md` block, guard
+hooks). See [Uninstall skills](UPDATE.md#uninstall-skills).
+
 ## Desktop app
 
 The **OpenGSD Path app** shows your projects without opening each project's
@@ -358,12 +391,30 @@ partial remote/clone/worktree transaction; the default checkout stays clean.
 One project can change several repositories in the same milestone. The
 **coordinator** repo holds `.project/` and runs the pipeline; each other repo
 is a **member** listed in `.project/MEMBERS.md`. A member needs a GitHub.com
-`origin` whose default is `main`. See
+`origin`. Its default branch can have any name, and it can differ from the
+default branch of the coordinator and of the other members. See
 [ADR 0002](docs/adr/0002-multi-repo-coordinator.md) for the design.
 
+`MEMBERS.md` has one section per member, in ship order. `members.py` writes
+it; do not edit it by hand:
+
+```markdown
+## web
+Checkout: /absolute/path/to/web
+Remote: https://github.com/acme/web.git
+Integration: default
+Default branch: master
+```
+
+`Default branch` is the member's default branch on `origin`. `members.py add`
+records it one time, from the member's local `origin/HEAD`; run
+`git remote set-head origin --auto` in the member first. A section without
+the field means `main`. See [default branch](WORKFLOW.md#default-branch).
+
 - Add members at a milestone boundary: ask the router to add an existing repo
   (`members.py add`) or to create a new one (`members.py add --create`, after
-  you approve the exact owner, name, visibility, and checkout). For optional
+  you approve the exact owner, name, visibility, and checkout; a new
+  repository uses `main`). For optional
   guard hooks, install them in the member with
   `npx @opengsd/gsd-path@latest --member-of <coordinator> --project <member>`.
 - The planner gives each member task `repo: <member>`; one task changes one
@@ -414,7 +465,8 @@ an atomic close across repos.
 Shipping moves milestone artifacts into `archive/` with a MANIFEST. It then
 either merges the milestone's `gsd-path/M00N` branch into `main` directly or
 opens/reuses a GitHub PR and waits for its user-controlled merge. Path reports
-shipped only after a two-parent merge and the milestone tag validate. Before
+shipped only after the landing (a two-parent merge, or a proven GitHub rebase
+merge of the PR) and the milestone tag validate. Before
 any next-milestone files change, the router binds
 a new `gsd-path/M00N` at the updated `origin/main`. `STATE.md`, `REPOSITORY.md`,
 `LESSONS.md`, `next/`, and the program artifacts (`CHARTER.md`, `ROADMAP.md`,
@@ -438,6 +490,7 @@ node scripts/install.mjs --all --local
 node scripts/install.mjs --all --project /path/to/project
 node scripts/install.mjs --update
 node scripts/install.mjs --all --update --project /path/to/project   # refresh .gsd-path/; keeps contracts
+node scripts/install.mjs --uninstall --all --dry-run                 # preview; removes skills only
 ```
 
 | Flag | User skills root | Invoke |
@@ -457,7 +510,7 @@ OpenCode stable: ask to load and use the `gsd-path` skill.
 `gsd-path` remains the canonical router name; `path` is its short menu alias.
 For a single phase, use `$gsd-path-plan` in Codex or `/gsd-path-plan` on slash hosts.
 
-`scripts/install.py` — Python install, including `--local` and `--update`.
+`scripts/install.py` — Python install, including `--local`, `--update`, and `--uninstall`.
 The Node CLI remains the interactive and npm entry point. See [FULL.md](FULL.md) and
 [UPDATE.md](UPDATE.md) for `--hooks`, `--hooks-refresh`, `--local`, and host notes.