@pmelab/gtd 18.0.0 → 19.0.0

package/dist/gtd.bundle.mjs

@@ -30000,7 +30000,7 @@ const handleBadArgument = (method) => (cause) => new BadArgument({
 	method,
 	cause
 });
-const access = /*#__PURE__*/ (() => {
+const access$1 = /*#__PURE__*/ (() => {
 	const nodeAccess = /*#__PURE__*/ effectify(NFS.access, /*#__PURE__*/ handleErrnoException("FileSystem", "access"), /*#__PURE__*/ handleBadArgument("access"));
 	return (path, options) => {
 		let mode = NFS.constants.F_OK;
@@ -30285,7 +30285,7 @@ const writeFile$1 = (path, data, options) => async((resume, signal) => {
 * @category layer
 */
 const layer$7 = /* @__PURE__ */ effect$1(FileSystem, /* @__PURE__ */ map$4(/*#__PURE__*/ serviceOption(WatchBackend), (backend) => make$6({
-	access,
+	access: access$1,
 	chmod,
 	chown,
 	copy,
@@ -30968,6 +30968,8 @@ const head = () => ctx().head();
 const start = () => ctx().start();
 /** The skill list `localName` (scoped from here, same as `agent()`) resolves to — for a prompt preamble. */
 const skillsFor = (localName) => ctx().skillsFor(localName);
+/** The folded access `localName` (scoped from here, same as `agent()`) resolves to — for a prompt preamble. */
+const accessFor = (localName, file) => ctx().accessFor(localName, file);
 const settingsProxy = (read) => new Proxy({}, {
 	get: (_target, key) => typeof key === "string" ? read()[key] : void 0,
 	has: (_target, key) => typeof key === "string" && key in read(),
@@ -31011,6 +31013,7 @@ const checkScript = (command, options) => {
 	return [
 		"#!/usr/bin/env sh",
 		"set +e",
+		...options.preamble ?? [],
 		...removal(options.sweep ?? []),
 		`mkdir -p "$(dirname ${report})"`,
 		"(",
@@ -31104,12 +31107,13 @@ const wrote = (path) => changes(path).some((c) => c.status !== "deleted");
 * command passed.
 */
 const check = async (name, command, options) => {
-	const { report, label, sweep, sweepOnGreen } = options;
+	const { report, label, sweep, sweepOnGreen, preamble } = options;
 	await run$3(name, checkScript(command, {
 		report,
 		stamp: head().slice(0, 7),
 		sweep,
-		sweepOnGreen
+		sweepOnGreen,
+		preamble
 	}), { label });
 	return !wrote(report);
 };
@@ -31161,6 +31165,7 @@ const requireRevert = (edited, base) => {
 //#endregion
 //#region src/flows/index.ts
 var flows_exports = /* @__PURE__ */ __exportAll({
+	accessFor: () => accessFor,
 	agent: () => agent,
 	answered: () => answered,
 	changes: () => changes,
@@ -47480,6 +47485,34 @@ const viewOf = (format, content) => ({
 /** Every OPEN thread — last entry is the agent's — as `{ name, line, firstMe }` (0-based line). `[]` for a format with no thread concept. */
 const openThreads = (format, content) => format.openThreads?.(content) ?? [];
 //#endregion
+//#region src/replay/Access.ts
+const UNRESTRICTED = {};
+const withExtras = (globs, extras) => globs === void 0 ? null : [.../* @__PURE__ */ new Set([...globs, ...extras])];
+/**
+* Fold a step's own paths into a scope's access: each restricted side gets the
+* steering `file`, then the code threads waiting on the agent. An unrestricted
+* side stays `null`.
+*/
+const foldAccess = (scopeAccess, file, threadPaths) => {
+	const access = scopeAccess ?? UNRESTRICTED;
+	const extras = [...file === void 0 ? [] : [file], ...threadPaths];
+	return {
+		read: withExtras(access.read, extras),
+		write: withExtras(access.write, extras)
+	};
+};
+/** The shape fault of a `scope()` `access` value, or `undefined` when well-formed. */
+const accessShapeFault = (value) => {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return "access must be an object of { read?, write? } glob arrays";
+	for (const [side, globs] of Object.entries(value)) {
+		if (side !== "read" && side !== "write") return `unknown access key "${side}"`;
+		if (globs === void 0) continue;
+		if (!Array.isArray(globs) || globs.some((g) => typeof g !== "string")) return `access.${side} must be an array of glob strings`;
+	}
+};
+const sameGlobs = (a, b) => a === void 0 || b === void 0 ? a === b : a.length === b.length && a.every((g, i) => g === b[i]);
+const sameAccess = (a, b) => sameGlobs(a?.read, b?.read) && sameGlobs(a?.write, b?.write);
+//#endregion
 //#region src/replay/Glob.ts
 const ESCAPE_RE = /[.+^${}()|[\]\\?]/g;
 const compile = (glob) => {
@@ -47701,7 +47734,8 @@ const budgeted = (evidence, budgetBytes) => {
 		truncated
 	};
 };
-const samePersona = (a, b) => a.model === b.model && a.system === b.system && (a.skills?.length ?? 0) === (b.skills?.length ?? 0) && (a.skills ?? []).every((skill, i) => skill === b.skills?.[i]);
+const sameSkills = (a, b) => (a?.length ?? 0) === (b?.length ?? 0) && (a ?? []).every((skill, i) => skill === b?.[i]);
+const samePersona = (a, b) => a.model === b.model && a.system === b.system && sameSkills(a.skills, b.skills) && sameAccess(a.access, b.access);
 /**
 * Replay one episode: run its entry flow, answering each step from the
 * episode's commits in order, until a step has no commit left — the rest.
@@ -47791,17 +47825,34 @@ const replay = async (input) => {
 		truncated: judgeCuts.get(request) ?? []
 	} : void 0;
 	const judgeCuts = /* @__PURE__ */ new WeakMap();
-	const resolveSkills = (memory) => {
+	const resolveScoped = (memory, pick, configured, bundled) => {
 		const own = /* @__PURE__ */ new Map();
 		const names = [];
 		for (const s of scopes) {
 			if (s.name !== void 0) names.push(s.name);
-			if (s.skills !== void 0) own.set(names.join("."), s.skills);
+			const v = pick(s);
+			if (v !== void 0) own.set(names.join("."), v);
 		}
 		const parts = memory === "" ? [] : memory.split(".");
-		const hit = parts.map((_, i) => parts.slice(0, parts.length - i).join(".")).concat("").map((p) => input.configuredSkills?.[p] ?? own.get(p) ?? input.skills?.[p]).find((r) => r !== void 0);
+		return parts.map((_, i) => parts.slice(0, parts.length - i).join(".")).concat("").map((p) => configured?.[p] ?? own.get(p) ?? bundled?.[p]).find((r) => r !== void 0);
+	};
+	const resolveSkills = (memory) => {
+		const hit = resolveScoped(memory, (s) => s.skills, input.configuredSkills, input.skills);
 		return hit === void 0 || hit.length === 0 ? void 0 : hit;
 	};
+	const resolveAccess = (memory) => resolveScoped(memory, (s) => s.access, input.configuredAccess, input.access);
+	const foldedAccessFor = (scopeAccess, file) => {
+		return foldAccess(scopeAccess, file, scopeAccess?.read !== void 0 || scopeAccess?.write !== void 0 ? context.codeThreads().filter((t) => t.waitingOn === "agent").map((t) => t.path) : []);
+	};
+	const scopeAccessFault = () => {
+		for (const [i, s] of scopes.entries()) {
+			if (s.access === void 0) continue;
+			const fault = accessShapeFault(s.access);
+			if (fault === void 0) continue;
+			return `gtd: scope "${scopes.slice(0, i + 1).flatMap((o) => o.name === void 0 ? [] : [o.name]).join(".") || "root"}": ${fault}`;
+		}
+	};
+	const unfoldedAccess = /* @__PURE__ */ new WeakMap();
 	const resolve = (request) => {
 		if (request.kind === "agent") {
 			const persona = {};
@@ -47833,6 +47884,8 @@ const replay = async (input) => {
 		const occurrence = (occurrences.get(name) ?? 0) + 1;
 		occurrences.set(name, occurrence);
 		const resolved = resolve(request);
+		const memory = memoryScopeOf(name);
+		const scopeAccess = resolved.kind === "agent" ? resolveAccess(memory) : void 0;
 		const reached = {
 			id: {
 				name,
@@ -47843,11 +47896,15 @@ const replay = async (input) => {
 			actor: actorOfKind(resolved.kind),
 			request: resolved,
 			memoryScope: memoryScopeOf(name),
-			...resolved.kind === "agent" ? { skills: resolveSkills(memoryScopeOf(name)) } : {},
+			...resolved.kind === "agent" ? {
+				skills: resolveSkills(memory),
+				access: foldedAccessFor(scopeAccess, resolved.options.file)
+			} : {},
 			enteredAt: position.hash,
 			truncated: (judgeCuts.get(resolved) ?? []).length > 0,
 			scopeCalls: namedScopeCalls()
 		};
+		if (resolved.kind === "agent") unfoldedAccess.set(reached, scopeAccess);
 		trace.push(reached);
 		return reached;
 	};
@@ -47856,14 +47913,15 @@ const replay = async (input) => {
 		const identity = {
 			model: step.request.options.model,
 			system: step.request.options.system,
-			skills: step.skills
+			skills: step.skills,
+			access: unfoldedAccess.get(step)
 		};
 		const seen = personas.get(step.memoryScope);
 		if (seen === void 0) {
 			personas.set(step.memoryScope, identity);
 			return;
 		}
-		return samePersona(seen, identity) ? void 0 : `gtd: "${step.name}" runs with a different model, system prompt or skills than an earlier agent step in memory scope "${step.memoryScope || "root"}" — one scope is one conversation, and a conversation has one identity`;
+		return samePersona(seen, identity) ? void 0 : `gtd: "${step.name}" runs with a different model, system prompt, skills or file access than an earlier agent step in memory scope "${step.memoryScope || "root"}" — one scope is one conversation, and a conversation has one identity`;
 	};
 	const DIVERGED = "the workflow changed under this process; run `gtd abandon` to start over";
 	const blockerAt = (step) => {
@@ -47917,6 +47975,10 @@ const replay = async (input) => {
 		});
 		return replyFor(step.request, input.pending.verdicts ?? []);
 	};
+	const requestFault = (request) => {
+		if (request.kind === "run" && typeof request.body !== "string") return `gtd: step "${scoped(request.name)}": a run() body is a shell script string — decide in flow code, then render the script (see checkScript and friends)`;
+		return request.kind === "agent" ? scopeAccessFault() : void 0;
+	};
 	const handleStep = async (request) => {
 		if (outcome !== void 0) throw new Stop();
 		if (request.kind === "restart") return finish(endOfFlow("restart"));
@@ -47924,9 +47986,10 @@ const replay = async (input) => {
 			kind: "failed",
 			message: "gtd: a step was called without a name"
 		});
-		if (request.kind === "run" && typeof request.body !== "string") return finish({
+		const fault = requestFault(request);
+		if (fault !== void 0) return finish({
 			kind: "failed",
-			message: `gtd: step "${scoped(request.name)}": a run() body is a shell script string — decide in flow code, then render the script (see checkScript and friends)`
+			message: fault
 		});
 		const step = reach(request);
 		const blocker = blockerAt(step);
@@ -47946,7 +48009,7 @@ const replay = async (input) => {
 		if (tree === void 0) throw new Error(`gtd: changesSince(${hash}): ${hash} is not the episode base or one of its commits — pass a hash this run read from head() or start(), not one captured earlier, read from state, or from another branch`);
 		return changesBetween(tree, position.tree);
 	};
-	installContext({
+	const context = {
 		step: handleStep,
 		refuse: (message) => {
 			outcome ??= {
@@ -48001,11 +48064,13 @@ const replay = async (input) => {
 		env: input.env,
 		start: () => input.start,
 		skillsFor: (localName) => resolveSkills(memoryScopeOf(scoped(localName))) ?? [],
+		accessFor: (localName, file) => foldedAccessFor(resolveAccess(memoryScopeOf(scoped(localName))), file),
 		head: () => {
 			const rest = commits.slice(cursor);
 			return rest.length > 0 && rest.every((c) => c.parsed.step === void 0) ? rest[rest.length - 1].hash : position.hash;
 		}
-	});
+	};
+	installContext(context);
 	try {
 		const flowDone = input.flow(args).then(() => {
 			if (outcome === void 0 && trace.length === 0) outcome = {
@@ -48045,6 +48110,11 @@ const skillsPreamble = `- Load whatever's listed here that your harness actually
   prompt states first
 - Never let a loaded skill turn this turn interactive — answer nothing,
   ask nothing; this runs unattended, with no one at a keyboard`;
+/** One bullet per restricted side; empty when neither is. An empty glob list reads "nothing". */
+const accessPreamble = (access) => {
+	const globs = (list) => list.length === 0 ? "nothing" : list.join(", ");
+	return [...access.read === null ? [] : [`- This turn may read only: ${globs(access.read)}`], ...access.write === null ? [] : [`- This turn may write only: ${globs(access.write)} — anything else is refused when the turn lands`]].join("\n");
+};
 const styleBlock = `- A deliverable, not a chat reply — size follows the work; cut padding
 - Lead with the answer; never circle back to restate it
 - Flat, commanding sentences — commit to the claim, never hedge
@@ -48089,8 +48159,7 @@ const architectPersona = `You are the technical planning voice in gtd's build pi
 once product concerns are settled, reading them cold, no carried
 conversation. Work out the *how* per concern — structure, data models,
 tech-stack choices, error handling — raise the technical open
-questions, then write one package spec per concern with no further
-judgement call: the grouping is already decided.`;
+questions, then pin interfaces and tests in the architecture document.`;
 const reviewerPersona = `You are the independent reviewing mind in gtd's build pipeline —
 deliberately separate from whoever wrote the code, with no attachment
 to it. Write a structured review document grouping a diff into
@@ -48099,12 +48168,6 @@ just approving; answer the human's questions inline in the review;
 and, when asked, fix the small nits the human flagged and the risks
 you marked yourself, each in one batch.
 Beyond that you never fix or build anything yourself.`;
-const specReviewerPersona = `You are the adversarial spec-conformance checker in gtd's build
-pipeline, checking one freshly-built package against its spec. Verify
-only: tasks done, criteria met, code sound and consistent with the
-codebase. Write feedback only when something is genuinely wrong —
-otherwise write nothing; a clean turn IS the approval. Never fix what
-you find — naming it precisely enough for a fix turn is the whole job.`;
 const builderPersona = `You are the TDD implementer in gtd's build pipeline: build one
 package's declared scope end to end, tests first, and come back to fix
 things when redirected — a failing check, or reviewer feedback. Stay
@@ -48282,8 +48345,12 @@ const withSkills = (skills, prompt) => {
 	if (skills === void 0 || skills.trim() === "") return prompt;
 	return `${skillsPreamble.replaceAll("{skills}", skills)}\n\n${prompt}`;
 };
-/** An `agent()` step whose prompt opens with the preamble naming its scope's skills. */
-const agentWithSkills = (name, prompt, options = {}) => agent(name, withSkills(skillsFor(name).join(", "), prompt), options);
+/** An `agent()` step whose prompt opens with the preamble naming its scope's skills, then its restricted file access. */
+const agentWithSkills = (name, prompt, options = {}) => {
+	const access = accessPreamble(accessFor(name, options.file));
+	const body = access === "" ? prompt : `${access}\n\n${prompt}`;
+	return agent(name, withSkills(skillsFor(name).join(", "), body), options);
+};
 const unwindFailure = (commit) => `gtd could not unwind ${commit} out of your working tree.`;
 const idleMessage = () => `No active gtd process.
 
@@ -48310,14 +48377,6 @@ carries it.
 What each change does next (then run \`gtd land\`):
 - **Continue** — having undone the sketch by hand, check the test baseline is green and start triage (**start-gate.check**).
 `;
-const architecturePreMessage = () => `Judging whether \`.gtd/REQUIREMENTS.md\`'s settled concerns need a
-dedicated architecture pass — real structural decisions, multiple
-integration points, or a non-obvious tradeoff — before packages
-are written. Run \`gtd judge answer\` and pipe a verdict for
-\`architectureWarranted\` — or land untouched to run the full pass
-(the conservative default; a skipped judgment never suppresses
-it).
-`;
 const startGateBlockedMessage = () => `The test baseline is red — gtd will not start new work on a broken suite.
 \`.gtd/FEEDBACK.md\` holds the failing output.
 
@@ -48482,22 +48541,46 @@ ${footnoteFoldIn}${codeThreadReplies()}
   authority is to merge only, never to split — the whole problem
   is over-granularity
 - Record every merge under \`## Merged Concerns\`,
-  carrying both merged requirements verbatim so spec review
-  still covers each independently
+  carrying both merged requirements verbatim so each requirement
+  stays traceable to its tests
 - A merge raises no open question and stops for no
   human — do not route it to \`architecture.gate\` for a veto; the
-  human sees it when reviewing the plan, and spec review is the
-  real safety net
+  human sees it when reviewing the plan
 - Prefer fewer, larger packages — the smallest independently
   valuable change, not the smallest change that compiles
 - Every open point here is TECHNICAL — triage already resolved
   the product ones, one phase earlier. PERMISSIVE: answer it
   yourself unless you genuinely cannot defend a default; a wrong
-  technical call is still caught at spec review
+  technical call is still caught by the full run and the quality lap
 - The narrow exception: a simplification that drops something
   \`.gtd/REQUIREMENTS.md\` mentions is an open question, not a
   silent default
 
+- \`.gtd/ARCHITECTURE.md\` is the acceptance spec the human signs
+  off. It carries these sections, in this order:
+  1. \`## Open Questions\` (qa format, first, only when present)
+  2. \`## Interfaces\` — new and changed signatures/contracts
+     only, as fenced TypeScript (or the repository's language)
+  3. \`## Call Stacks\` — seam level, entry point → module
+     boundary; one line per hop, never per line of code
+  4. \`## E2E Scenarios\` — Gherkin in fenced \`gherkin\` blocks
+     (whatever e2e framework the repository uses), each preceded
+     by a line \`- e2e: <path>\`. With no user-visible
+     behaviour change, the literal line \`No e2e change.\` plus a
+     one-line reason — never empty or missing
+  5. \`## Unit Tests\` — one \`### <interface>\` per entry of
+     \`## Interfaces\`, each test a line
+     \`- unit: <path> — <behaviour> (covers <concern>)\`;
+     never against an internal helper. A requirement no test can
+     cover (docs, README, deletions, config) goes under a
+     \`### Chores\` heading in this section as
+     \`- chore: <path> — <what> (covers <concern>)\`
+  6. \`## Merged Concerns\` — kept, when any merge happened
+  7. \`## Answered Questions\` — last
+- Coverage rule: every concern in \`.gtd/REQUIREMENTS.md\` appears
+  in at least one \`(covers …)\` tail, as a test or a chore. Each
+  test entry carries its file path and level (unit / e2e)
+
 ${questionBar}
 ## Return lap
 
@@ -48509,26 +48592,41 @@ const architectureDecomposePrompt = () => `${styleBlock}
 
 ${stateFileRules}
 - The only state files this turn touches are the package files
-  under \`.gtd/packages/\` and \`.gtd/ARCHITECTURE.md\` (deleted) —
-  no other files for notes or output
+  under \`.gtd/packages/\` — no other files for notes or output.
+  Never delete \`.gtd/ARCHITECTURE.md\`: the build tail's full run
+  still needs it, and package files may reference it
 - Work from \`.gtd/ARCHITECTURE.md\` if you wrote it earlier this
   conversation, otherwise read it (the converged technical
-  plan). It already lists an ordered set of concerns with every
-  merge/split judgement made — this turn is a mechanical
-  write-out, not a planning one. A \`## Merged Concerns\` heading
-  there records those merges, never a concern of its own: write
-  no package file for it
-- Write one package file per concern, in the settled order,
-  under \`.gtd/packages/\` (e.g. \`.gtd/packages/01-name.md\`,
-  \`02-name.md\`, ...), each carrying that concern's
-  requirement(s) — both, independently, if merged — its
-  independent tasks, and each task's acceptance criteria as
-  \`- [ ]\` checkboxes and relevant paths
-- Do not merge or split concerns here — that judgement already
-  happened; carry the settled grouping over verbatim. No
-  package file may reference any other \`.gtd/\` file
-- Once written, delete \`.gtd/ARCHITECTURE.md\`. Leave everything
-  uncommitted and finish
+  plan). It already lists the concerns, interfaces, e2e scenarios
+  and unit tests — this turn groups them into packages. A
+  \`## Merged Concerns\` heading there records merges, never a
+  concern of its own: write no package file for it
+- A package is a consecutive run of \`## Unit Tests\` entries that go
+  green together on the fast suite, at most ~8 unit-test entries
+  each. Keep the merge rule: concerns whose footprints centre on the
+  same files stay in one package unless the later one only consumes
+  an interface the earlier one creates. Prefer fewer, larger
+  packages. Order them so each stays green on the fast suite —
+  interface-introducing packages first
+- Write the packages under \`.gtd/packages/\`, each carrying its
+  requirement(s) — both, independently, if merged — its tasks, and
+  each task's acceptance criteria as \`- [ ]\` checkboxes and
+  relevant paths:
+  - \`.gtd/packages/00-e2e-scenarios.md\` — package 0: it writes
+    \`## E2E Scenarios\` as tests in the repository's own e2e
+    framework and leaves them red. Write no such file when
+    \`## E2E Scenarios\` says "No e2e change."
+  - \`01-…\` onward — the unit-test packages. A requirement no test
+    covers (docs, README, deletions, config) becomes a chore
+    package, or a task of one; chore packages declare no tests
+  - the last numbered package is the wiring package: CLI entry,
+    workflow composition, config. A red e2e after it is a bug, not
+    missing work
+- Every package with tests has a \`## Tests\` section, one line per
+  declared test, copied from the architecture entries:
+  \`- unit: \\\`<path>\\\`\` or \`- e2e: \\\`<path>\\\`\`. Chore packages have
+  none
+- Leave everything uncommitted and finish
 `;
 const architectureGateAnswerMessage = () => `This gate stops on every process, even with no open question, so
 you can discuss \`.gtd/ARCHITECTURE.md\`; changing nothing and re-running
@@ -48557,7 +48655,7 @@ What each change does next (then run \`gtd land\`):
 `;
 const packagesItemBuildingPrompt = (pkg) => `${stateFileRules}
 - The only state file this turn may write is \`.gtd/SATISFIED.md\`;
-  never delete the package file (the spec-review gate reads it
+  never delete the package file (the declared-tests guard reads it
   after you)
 - The package to implement is \`${pkg}\`
 - First check its acceptance criteria against the current tree —
@@ -48566,6 +48664,13 @@ const packagesItemBuildingPrompt = (pkg) => `${stateFileRules}
   with each criterion's concrete evidence (commit, file, or
   symbol), change nothing else, and finish. Otherwise implement
   normally and skip that file
+- Write the tests the package declares under \`## Tests\` first,
+  then the code that makes them pass; the turn is refused unless
+  every declared test is in your diff
+- Package 0 (\`.gtd/packages/00-e2e-scenarios.md\`) writes the scenarios verbatim
+  from \`## E2E Scenarios\` of \`.gtd/ARCHITECTURE.md\`, with only
+  step code that typechecks, and leaves them red — no
+  implementation
 - Implement every task the package describes, no more, no less,
   fanning independent ones out to parallel subagents where your
   harness supports it; leave other package files untouched
@@ -48582,15 +48687,6 @@ ${fixFeedbackPrompt}
   then legitimately report itself already satisfied later
 - Leave everything uncommitted and finish your turn — do not commit
 `;
-const packagesItemFixSpecPrompt = (pkg) => `${stateFileRules}
-- The only state file this turn touches is
-  \`.gtd/SPEC_FEEDBACK.md\` — address it, then delete it
-- Read it (the reviewer's concerns) and the package spec
-  (\`${pkg}\`), then fix the code to
-  resolve every concern
-- Delete \`.gtd/SPEC_FEEDBACK.md\` once resolved; leave everything
-  else uncommitted and finish your turn
-`;
 const healthJudgeMessage = () => `The check is still red, and this isn't the first round —
 \`.gtd/FEEDBACK.md\` holds this round's output, and the previous round's
 is in history. Run \`gtd judge answer\` and pipe a
@@ -48628,45 +48724,22 @@ Edit \`.gtd/ESCALATION.md\` with fresh instructions for the next fix
 turn, or land untouched to give it one more attempt at the same
 analysis.
 `;
-const packagesItemSpecPreMessage = () => `Judging whether the code already satisfies each requirement in the
-package spec, before spending a full review turn. Run \`gtd judge
-answer\` and pipe a verdict per section — or land untouched to run
-the full review (the conservative default; a skipped judgment
-never suppresses anything).
+const buildContextPrompt = (built) => {
+	const list = (paths) => paths.length === 0 ? "  (none)" : paths.map((path) => `  - ${path}`).join("\n");
+	return `- Read \`.gtd/ARCHITECTURE.md\` — the plan every package was built from
+- A red scenario that is NEW in this plan likely means missing wiring
+  between packages; new scenarios:
+${list(built.scenarios.added)}
+- A red CHANGED or existing scenario or test is a regression a package
+  introduced; scenarios this plan changed:
+${list(built.scenarios.changed)}
+- Each package's commits, to bisect a break:
+${built.ranges.map((r) => `  git log --oneline ${r.from}..${r.to}  # ${r.pkg}`).join("\n")}
 `;
-/** The sections a pre-judge could not clear, when it cleared the rest. */
-const specScope = (failing) => failing.length > 0 ? `- A pre-judge already found the other sections satisfied. Confine
-  your review to only these sections:
-${failing.map((title) => `  - ${title}\n`).join("")}` : "";
-const packagesItemSpecReviewPrompt = (pkg, failing = []) => `${styleBlock}
-
-You are reviewing a freshly-built work package against its own
-spec.
-
-${stateFileRules}
-- The only state file this turn touches is
-  \`.gtd/SPEC_FEEDBACK.md\` — write it only when you find problems
-- The package spec is \`${pkg}\`
-${specScope(failing)}- Verify the implementation against it: tasks done, criteria
-  met, code sound and consistent with the codebase. No diff is
-  given — read the range yourself, from \`${start()}\`
-  to the working tree, process-wide (it can span earlier
-  packages)
-- You own that bar; nothing downstream re-weighs your findings
-- Write nothing when the package fully satisfies its spec —
-  silence is your approval. Otherwise write
-  \`.gtd/SPEC_FEEDBACK.md\` listing what would violate the spec if
-  it shipped unaddressed, specific enough to act on, each as its
-  own \`## \` heading
-- Never fix anything yourself and never delete the package
-  file — a later step owns that
-`;
-const specReviewerSystem = () => `${specReviewerPersona}
-
-${agentConduct}`;
-const buildFixPrompt = () => `${stateFileRules}
+};
+const buildFixPrompt = (built) => `${stateFileRules}
 ${fixFeedbackPrompt}
-- Leave everything uncommitted — do not commit
+${built === void 0 ? "" : buildContextPrompt(built)}- Leave everything uncommitted — do not commit
 `;
 const finisherSystem = () => `${finisherPersona}
 
@@ -48999,6 +49072,20 @@ ${it.processCostByModel.map((m) => `- ${m.model}: ${m.cost}\n`).join("")}
 Print the closing message and stop — this writes nothing itself.
 `;
 };
+const scenarioWordingMessage = (at, drifted) => `The e2e scenario wording was frozen when package 0 landed, and the last
+turn changed it. Removed lines are marked \`-\`, added ones \`+\`:
+
+${drifted.map(({ path, lines }) => `${path}\n${lines.join("\n")}`).join("\n\n")}
+
+To accept the change, land untouched.
+
+To reject it, run
+
+    git checkout ${at} -- ${drifted.map(({ path }) => quote(path)).join(" ")}
+
+and land. Restoring only some of the files is a partial accept: every file
+still differing from the frozen wording is accepted.
+`;
 //#endregion
 //#region src/workflows/steps.ts
 const FEEDBACK = ".gtd/FEEDBACK.md";
@@ -49007,7 +49094,6 @@ const REQUIREMENTS = ".gtd/REQUIREMENTS.md";
 const ARCHITECTURE = ".gtd/ARCHITECTURE.md";
 const REVIEW = ".gtd/REVIEW.md";
 const QUALITY = ".gtd/QUALITY.md";
-const SPEC_FEEDBACK = ".gtd/SPEC_FEEDBACK.md";
 const planner = () => env.plannerModel ?? "";
 const coder = () => env.coderModel ?? "";
 /** Turn the sketch since `base` into `.gtd/REQUIREMENTS.md`. */
@@ -49055,20 +49141,7 @@ const fixSuite = () => agentWithSkills("fix.suite.fixing", packagesItemFixSuiteP
 	model: coder(),
 	system: builderSystem()
 });
-const fixSpec = (pkg) => agentWithSkills("fix.spec.fixing", packagesItemFixSpecPrompt(pkg), {
-	label: "Fixing review feedback",
-	file: SPEC_FEEDBACK,
-	model: coder(),
-	system: builderSystem()
-});
-/** Review `pkg` against its spec, focused on the `failing` sections the pre-judge could not clear. */
-const reviewPackage = (pkg, failing = []) => agentWithSkills("spec.review", packagesItemSpecReviewPrompt(pkg, failing), {
-	label: "Reviewing the package",
-	model: planner(),
-	system: specReviewerSystem(),
-	allowEmpty: true
-});
-const fix = () => agentWithSkills("fix", buildFixPrompt(), {
+const fix = (built) => agentWithSkills("fix", buildFixPrompt(built), {
 	label: "Fixing the check",
 	file: FEEDBACK,
 	model: coder(),
@@ -49176,11 +49249,29 @@ const collecting = (capture) => agentWithSkills("review.collecting", buildReview
 	system: reviewerSystem(),
 	allowEmpty: true
 });
+//#endregion
+//#region src/workflows/health.ts
+/** Written while `fastTestCommand` is unset; its presence rests the process at the check. */
+const SETUP = ".gtd/SETUP.md";
+const SETUP_TEXT = "The bundled workflow needs the `fastTestCommand` setting: the fast suite (everything but e2e).\nSet it under `env:` in `.gtdrc` or as GTD_FASTTESTCOMMAND.";
+/** Shell lines for a check's preamble: unset (blank after trim) setting writes `SETUP` and skips the suite. */
+const fastSuiteGuard = () => (env.fastTestCommand ?? "").trim() === "" ? [
+	`mkdir -p ${quote(dirname(SETUP))}`,
+	`printf '%s\\n' ${quote(SETUP_TEXT)} > ${quote(SETUP)}`,
+	`printf '%s\\n' ${quote(SETUP_TEXT)} >&2`,
+	"exit 0"
+] : [`rm -f ${quote(SETUP)}`];
 /** Run the suite as step `name`; resolves `true` when it passed. A failure is in `.gtd/FEEDBACK.md`. */
-const baseline = (name, label = "Checking the baseline") => check(name, env.testCommand ?? "", {
-	report: FEEDBACK,
-	label
-});
+const baseline = async (name, label = "Checking the baseline") => {
+	for (;;) {
+		const green = await check(name, env.testCommand ?? "", {
+			report: FEEDBACK,
+			label,
+			preamble: fastSuiteGuard()
+		});
+		if (read(".gtd/SETUP.md") === void 0) return green;
+	}
+};
 /**
 * Hand a red suite that repeated attempts could not fix to a person: an
 * agent writes `.gtd/ESCALATION.md`, a human narrows it. From the third round
@@ -49219,6 +49310,15 @@ const sameFailure = async (previous, current) => {
 	});
 	return comparable && truncated.length === 0 && answered(answers.verdict, "identical", numeric(vars.judgeIdenticalMinP, Infinity));
 };
+const runSuite = (options) => {
+	const fast = options.suite === "fast";
+	return check("health.check", (fast ? env.fastTestCommand : env.testCommand) ?? "", {
+		report: FEEDBACK,
+		label: "Running checks",
+		sweepOnGreen: [ESCALATION, ...options.sweepOnGreen ?? []],
+		...fast ? { preamble: fastSuiteGuard() } : {}
+	});
+};
 /**
 * Loop until the suite is green: check, and on red run `fix` — escalating
 * first once `FIX_CAP` fixes are spent, or a judge calls the failure
@@ -49229,11 +49329,9 @@ const healthy = async (fix, options = {}) => {
 	let fixes = options.fixesSoFar ?? 0;
 	let previous;
 	for (;;) {
-		if (await check("health.check", env.testCommand ?? "", {
-			report: ".gtd/FEEDBACK.md",
-			label: "Running checks",
-			sweepOnGreen: [".gtd/ESCALATION.md"]
-		})) {
+		const green = await runSuite(options);
+		if (options.suite === "fast" && read(".gtd/SETUP.md") !== void 0) continue;
+		if (green) {
 			escalations.rounds = 0;
 			return;
 		}
@@ -49257,324 +49355,184 @@ const gate = (name, message) => scope(name, async () => {
 	});
 });
 //#endregion
-//#region src/workflows/diff.ts
-const CONTEXT = 3;
-const TOO_LARGE_LINES = 1500;
-const LOCKFILES = /* @__PURE__ */ new Set([
-	"package-lock.json",
-	"npm-shrinkwrap.json",
-	"yarn.lock",
-	"pnpm-lock.yaml",
-	"bun.lock",
-	"bun.lockb",
-	"Cargo.lock",
-	"composer.lock",
-	"Gemfile.lock",
-	"poetry.lock",
-	"uv.lock",
-	"Pipfile.lock",
-	"go.sum",
-	"flake.lock",
-	"mix.lock",
-	"pubspec.lock",
-	"Podfile.lock",
-	"gradle.lockfile"
-]);
-const GENERATED_GLOBS = [
-	"dist/**",
-	"build/**",
-	"out/**",
-	"coverage/**",
-	"node_modules/**",
-	"vendor/**",
-	".turbo/**",
-	"**/__snapshots__/**",
-	"**/*.snap",
-	"**/*.min.js",
-	"**/*.min.css",
-	"**/*.map"
-];
-const BINARY_EXTENSIONS = /* @__PURE__ */ new Set([
-	"png",
-	"jpg",
-	"jpeg",
-	"gif",
-	"webp",
-	"ico",
-	"pdf",
-	"zip",
-	"gz",
-	"tar",
-	"woff",
-	"woff2",
-	"ttf",
-	"otf",
-	"mp4",
-	"wasm",
-	"bin",
-	"exe",
-	"so",
-	"dylib"
-]);
-const globCache = /* @__PURE__ */ new Map();
-const compileGlob = (glob) => {
-	let pattern = "^";
-	let i = 0;
-	while (i < glob.length) {
-		const char = glob[i];
-		if (char !== "*") {
-			pattern += char.replace(/[.+^${}()|[\]\\?]/g, "\\$&");
-			i += 1;
-		} else if (glob[i + 1] !== "*") {
-			pattern += "[^/]*";
-			i += 1;
-		} else if (glob[i + 2] === "/") {
-			pattern += "(?:.*/)?";
-			i += 3;
+//#region src/workflows/scenarios.ts
+const DOC_STRING = /^(\s*)("""|```)/;
+/**
+* Gherkin wording only: lines trimmed; blank, `#` comment and `@` tag lines
+* dropped — except inside a doc string, whose content is test input: kept
+* whole, indented relative to its opening delimiter (as Gherkin reads it).
+*/
+const scenarioText = (source) => {
+	const out = [];
+	let doc;
+	for (const line of source.split("\n")) {
+		const delimiter = DOC_STRING.exec(line);
+		if (doc === void 0 && delimiter !== null) {
+			doc = {
+				indent: delimiter[1].length,
+				fence: delimiter[2]
+			};
+			out.push(line.trim());
+		} else if (doc !== void 0 && line.trim().startsWith(doc.fence)) {
+			doc = void 0;
+			out.push(line.trim());
+		} else if (doc !== void 0) {
+			const lead = line.length - line.trimStart().length;
+			out.push(line.slice(Math.min(lead, doc.indent)).trimEnd());
 		} else {
-			pattern += ".*";
-			i += 2;
+			const trimmed = line.trim();
+			if (trimmed !== "" && !trimmed.startsWith("#") && !trimmed.startsWith("@")) out.push(trimmed);
 		}
 	}
-	return new RegExp(`${pattern}$`);
+	return out.join("\n");
 };
-const matchesGlob = (path, glob) => {
-	let regex = globCache.get(glob);
-	if (regex === void 0) {
-		regex = compileGlob(glob);
-		globCache.set(glob, regex);
-	}
-	return regex.test(path);
+const textOf = (path) => {
+	const source = read(path);
+	return source === void 0 ? void 0 : scenarioText(source);
 };
-const extensionOf = (path) => {
-	const base = path.split("/").pop() ?? path;
-	const dot = base.lastIndexOf(".");
-	return dot === -1 ? "" : base.slice(dot + 1).toLowerCase();
-};
-const isBinary = (change) => BINARY_EXTENSIONS.has(extensionOf(change.path)) || (change.before?.includes("\0") ?? false) || (change.after?.includes("\0") ?? false);
-const isExcluded = (change) => change.path === ".gtd" || change.path.startsWith(".gtd/") || LOCKFILES.has(change.path.split("/").pop() ?? change.path) || GENERATED_GLOBS.some((glob) => matchesGlob(change.path, glob)) || isBinary(change);
-/** `changes` with lockfiles, generated trees and binaries dropped. */
-const filterChanges = (changes) => changes.filter((change) => !isExcluded(change));
-const linesOf = (content) => {
-	if (content === void 0 || content === "") return [];
-	const lines = content.split("\n");
-	if (lines[lines.length - 1] === "") lines.pop();
-	return lines;
+/** Snapshot `.feature` paths at `head()`, merged over `previous`; `undefined` when nothing is frozen. */
+const freezeScenarios = (paths, previous) => {
+	if (paths.length === 0) return previous;
+	const texts = { ...previous?.texts };
+	for (const path of paths) {
+		const text = textOf(path);
+		if (text !== void 0) texts[path] = text;
+	}
+	return Object.keys(texts).length === 0 ? previous : {
+		at: head(),
+		texts
+	};
 };
-/** `dp[i][j]` = the LCS length of `a[i:]` and `b[j:]`. */
+/** Paths whose wording differs from the snapshot (a deleted file counts). */
+const driftedScenarios = (frozen) => Object.entries(frozen.texts).filter(([path, text]) => textOf(path) !== text).map(([path]) => path);
+const lines = (text) => text === void 0 || text === "" ? [] : text.split("\n");
+/** `table[i][j]`: the longest common subsequence of `a[i..]` and `b[j..]`. */
 const lcsTable = (a, b) => {
-	const n = a.length;
-	const m = b.length;
-	const dp = Array.from({ length: n + 1 }, () => Array.from({ length: m + 1 }).fill(0));
-	for (let i = n - 1; i >= 0; i--) for (let j = m - 1; j >= 0; j--) dp[i][j] = a[i] === b[j] ? dp[i + 1][j + 1] + 1 : Math.max(dp[i + 1][j], dp[i][j + 1]);
-	return dp;
-};
-/** Walk an LCS table into an edit script, favoring a deletion on a tie. */
-const backtrack = (a, b, dp) => {
-	const ops = [];
+	const table = Array.from({ length: a.length + 1 }, () => Array(b.length + 1).fill(0));
+	for (let i = a.length - 1; i >= 0; i--) for (let j = b.length - 1; j >= 0; j--) table[i][j] = a[i] === b[j] ? table[i + 1][j + 1] + 1 : Math.max(table[i + 1][j], table[i][j + 1]);
+	return table;
+};
+/** Changed lines in file order, `- ` / `+ `-prefixed, so a moved or repeated step still shows. */
+const lineDiff = (a, b) => {
+	const table = lcsTable(a, b);
+	const out = [];
 	let i = 0;
 	let j = 0;
 	while (i < a.length && j < b.length) if (a[i] === b[j]) {
-		ops.push({
-			type: "eq",
-			line: a[i]
-		});
-		i++;
-		j++;
-	} else if (dp[i + 1][j] >= dp[i][j + 1]) {
-		ops.push({
-			type: "del",
-			line: a[i]
-		});
 		i++;
-	} else {
-		ops.push({
-			type: "add",
-			line: b[j]
-		});
 		j++;
-	}
-	while (i < a.length) ops.push({
-		type: "del",
-		line: a[i++]
-	});
-	while (j < b.length) ops.push({
-		type: "add",
-		line: b[j++]
-	});
-	return ops;
-};
-/** Longest-common-subsequence edit script between two (already trimmed) line arrays. */
-const lcsOps = (a, b) => backtrack(a, b, lcsTable(a, b));
-const commonAffixes = (before, after) => {
-	const maxPrefix = Math.min(before.length, after.length);
-	let prefix = 0;
-	while (prefix < maxPrefix && before[prefix] === after[prefix]) prefix++;
-	const maxSuffix = maxPrefix - prefix;
-	let suffix = 0;
-	while (suffix < maxSuffix && before[before.length - 1 - suffix] === after[after.length - 1 - suffix]) suffix++;
-	return {
-		prefix,
-		suffix
-	};
+	} else if (table[i + 1][j] >= table[i][j + 1]) out.push(`- ${a[i++]}`);
+	else out.push(`+ ${b[j++]}`);
+	return [
+		...out,
+		...a.slice(i).map((l) => `- ${l}`),
+		...b.slice(j).map((l) => `+ ${l}`)
+	];
 };
-const buildHunks = (ops) => {
-	const beforeLineAt = [];
-	const afterLineAt = [];
-	let bl = 1;
-	let al = 1;
-	for (const op of ops) {
-		beforeLineAt.push(bl);
-		afterLineAt.push(al);
-		if (op.type !== "add") bl++;
-		if (op.type !== "del") al++;
-	}
-	const ranges = [];
-	ops.forEach((op, idx) => {
-		if (op.type === "eq") return;
-		const start = Math.max(0, idx - CONTEXT);
-		const end = Math.min(ops.length - 1, idx + CONTEXT);
-		const last = ranges[ranges.length - 1];
-		if (last !== void 0 && start <= last[1] + 1) last[1] = Math.max(last[1], end);
-		else ranges.push([start, end]);
-	});
-	return ranges.map(([start, end]) => {
-		const slice = ops.slice(start, end + 1);
-		return {
-			beforeStart: beforeLineAt[start],
-			beforeCount: slice.filter((op) => op.type !== "add").length,
-			afterStart: afterLineAt[start],
-			afterCount: slice.filter((op) => op.type !== "del").length,
-			lines: slice.map((op) => `${op.type === "add" ? "+" : op.type === "del" ? "-" : " "}${op.line}`)
-		};
+const wordingDrift = (frozen, path) => ({
+	path,
+	lines: lineDiff(lines(frozen.texts[path]), lines(textOf(path)))
+});
+/** After a turn: stop at `scenario-wording` while wording drifted; accept moves the snapshot. */
+const holdWording = async (frozen) => {
+	if (frozen === void 0) return;
+	const drifted = driftedScenarios(frozen);
+	if (drifted.length === 0) return;
+	await human("scenario-wording", {
+		message: scenarioWordingMessage(frozen.at, drifted.map((path) => wordingDrift(frozen, path))),
+		label: "Scenario wording changed",
+		acceptClean: true,
+		base: frozen.at
 	});
+	const accepted = driftedScenarios(frozen);
+	if (accepted.length === 0) return;
+	for (const path of accepted) {
+		const text = textOf(path);
+		if (text === void 0) delete frozen.texts[path];
+		else frozen.texts[path] = text;
+	}
+	frozen.at = head();
 };
-const renderHunk = (hunk) => [`@@ -${hunk.beforeStart},${hunk.beforeCount} +${hunk.afterStart},${hunk.afterCount} @@`, ...hunk.lines];
-/** One file's unified diff, or a summary line when its changed region is too large to inline. */
-const renderFileDiff = (change) => {
-	const before = linesOf(change.before);
-	const after = linesOf(change.after);
-	const { prefix, suffix } = commonAffixes(before, after);
-	const beforeMiddle = before.slice(prefix, before.length - suffix);
-	const afterMiddle = after.slice(prefix, after.length - suffix);
-	if (beforeMiddle.length > TOO_LARGE_LINES || afterMiddle.length > TOO_LARGE_LINES) return `${change.path}: +${afterMiddle.length}/-${beforeMiddle.length} lines, too large to inline`;
-	const prefixOps = before.slice(0, prefix).map((line) => ({
-		type: "eq",
-		line
-	}));
-	const suffixOps = before.slice(before.length - suffix).map((line) => ({
-		type: "eq",
-		line
-	}));
-	const ops = [
-		...prefixOps,
-		...lcsOps(beforeMiddle, afterMiddle),
-		...suffixOps
-	];
-	const beforePath = change.status === "added" ? "/dev/null" : `a/${change.path}`;
-	const afterPath = change.status === "deleted" ? "/dev/null" : `b/${change.path}`;
-	return [
-		`--- ${beforePath}`,
-		`+++ ${afterPath}`,
-		...buildHunks(ops).flatMap(renderHunk)
-	].join("\n");
-};
-const omissionTrailer = (paths) => `${paths.length} file(s) omitted for the judge's byte budget: ${paths.join(", ")}`;
-/** The byte size of keeping `files`' first `keepCount` entries plus the trailer the rest would need — the trailer counts against the cap too, not just the kept text. */
-const sizeWithTrailer = (files, keepCount) => {
-	let used = 0;
-	for (let i = 0; i < keepCount; i++) used += Buffer.byteLength(files[i].text, "utf8") + (i > 0 ? 1 : 0);
-	if (files.length - keepCount === 0) return used;
-	const trailer = omissionTrailer(files.slice(keepCount).map((f) => f.path));
-	return used + (keepCount > 0 ? 1 : 0) + Buffer.byteLength(trailer, "utf8");
-};
-/**
-* The filtered `changes`, rendered as one unified diff (files in path order)
-* and bounded to `capBytes`: over the cap, whole files are dropped from the
-* end — never bytes off a hunk — and named in a trailer line, so the
-* judge is told what it did not see rather than handed a silently short diff.
-* The trailer itself is sized against the cap along with the files it keeps,
-* so a package with many touched files can never push the total past it.
-*/
-const packageDiff = (changes, capBytes) => {
-	const files = filterChanges(changes).slice().sort((a, b) => a.path.localeCompare(b.path)).map((change) => ({
-		path: change.path,
-		text: renderFileDiff(change)
-	}));
-	let keepCount = files.length;
-	while (keepCount > 0 && sizeWithTrailer(files, keepCount) > capBytes) keepCount--;
-	const dropped = files.slice(keepCount).map((f) => f.path);
-	return [...files.slice(0, keepCount).map((f) => f.text), ...dropped.length > 0 ? [omissionTrailer(dropped)] : []].join("\n");
+/** `turn`, then `holdWording`; `within` names the scope the gate rests in. */
+const guarded = (frozen, turn, within) => async () => {
+	await turn();
+	if (within === void 0) await holdWording(frozen);
+	else await scope(within, () => holdWording(frozen));
 };
 //#endregion
 //#region src/workflows/packages.ts
-const MAX_SECTIONS = 8;
-const DIFF_KEY = "diff";
-const sectionQuestion = (id, title) => ({
-	id,
-	primitive: "noul",
-	instructions: `Is the requirement "${title}" — the "${id}" evidence — already fully satisfied by the code in the "${DIFF_KEY}" evidence?`,
-	criteria: "Judge from the requirement text and the diff evidence alone. Only answer yes at a probability clearing the threshold below if genuinely confident nothing in this section is missing."
-});
-/**
-* Review one freshly built package against its spec: a pre-judge per
-* section, then an agent review of the sections it did not confidently
-* clear. `since` is the commit the package's own build started from — the
-* pre-judge's evidence is a diff over exactly that range, never an earlier
-* package's commits. Resolves `true` when approved.
-*/
-const specReview = async (pkg, since) => {
-	const found = sectionBodies(read(pkg) ?? "");
-	const titles = found.map((section) => section.title);
-	const judged = titles.length > 0 && titles.length <= MAX_SECTIONS;
-	const evidence = {};
-	const questions = [];
-	if (judged) {
-		found.forEach(({ title, body }, i) => {
-			evidence[`section-${i + 1}`] = body;
-			questions.push(sectionQuestion(`section-${i + 1}`, title));
+/** Package 0: the e2e scenarios, written red. */
+const SCENARIO_PACKAGE = ".gtd/packages/00-e2e-scenarios.md";
+const TEST_LINE = /^\s*-\s+(unit|e2e):\s+`([^`]+)`/;
+/** The `## Tests` entries of a package file; malformed lines are ignored. */
+const declaredTests = (packageText) => {
+	const found = [];
+	let inTests = false;
+	for (const line of packageText.split("\n")) if (/^##\s/.test(line)) inTests = /^##\s+Tests\s*$/.test(line);
+	else if (inTests) {
+		const match = TEST_LINE.exec(line);
+		if (match) found.push({
+			level: match[1],
+			path: match[2]
 		});
-		const capBytes = Math.floor(numeric(vars.judgeBudgetBytes, 32768) / (found.length + 1));
-		evidence[DIFF_KEY] = packageDiff(changesSince(since), capBytes);
-	}
-	const { answers, truncated } = await judge("spec.pre", {
-		questions,
-		evidence,
-		message: packagesItemSpecPreMessage(),
-		label: "Judging spec coverage"
-	});
-	const clearMinP = numeric(vars.specPreJudge, Infinity);
-	const failing = titles.filter((_, i) => {
-		const id = `section-${i + 1}`;
-		return !judged || truncated.includes(id) || truncated.includes(DIFF_KEY) || !answered(answers[id], "yes", clearMinP);
-	});
-	if (titles.length > 0 && failing.length === 0) return true;
-	await reviewPackage(pkg, failing);
-	if (wrote(".gtd/SPEC_FEEDBACK.md")) return false;
-	if (changes(".gtd/SPEC_FEEDBACK.md").length > 0 || changes().length === 0) return true;
-	return refuse("gtd land: no declared pattern matches the pending changes — write .gtd/SPEC_FEEDBACK.md to request changes, or change nothing to approve");
-};
-/** Build `pkg`, keep the suite green, review it against its spec, and close it out, which removes it. */
-const packageItem = async (pkg) => {
-	const since = head();
-	await build(pkg);
-	for (;;) {
-		await healthy(fixSuite);
-		if (await specReview(pkg, since)) break;
-		await fixSpec(pkg);
 	}
-	await run$3("closing", removeScript([
+	return found;
+};
+/**
+* Refuse a build or fix turn unless every test `pkg` declares exists and is in the
+* diff since `since`. The package text is read as of `since`, so a builder
+* editing its own `## Tests` cannot dodge the guard; with `.gtd/SATISFIED.md`
+* written, existing in the tree suffices.
+*/
+const requireDeclaredTests = (pkg, since) => {
+	const range = changesSince(since);
+	const text = range.get(pkg)?.before ?? read(pkg) ?? "";
+	const satisfied = read(".gtd/SATISFIED.md") !== void 0;
+	const missing = declaredTests(text).map((test) => test.path).filter((path) => satisfied ? read(path) === void 0 : range.get(path) === void 0 || range.get(path)?.status === "deleted" || read(path) === void 0);
+	if (missing.length === 0) return;
+	refuse(`gtd land: declared-tests: ${pkg} declares tests that are ${satisfied ? "missing from the tree" : "not in the package's diff"} — write them first:\n${missing.map((path) => `  - ${path}`).join("\n")}`);
+};
+/** Build `pkg`, check its declared tests, keep the fast suite green, and close it out, which removes it. */
+const packageItem = async (pkg, frozen) => {
+	const from = head();
+	const declared = (turn) => async () => {
+		await turn();
+		requireDeclaredTests(pkg, from);
+	};
+	await guarded(frozen, declared(() => build(pkg)))();
+	await healthy(guarded(frozen, declared(fixSuite)), { suite: "fast" });
+	await run$3("closing", removeScript([pkg, ".gtd/SATISFIED.md"]), { label: "Closing out the package" });
+	return {
 		pkg,
-		SPEC_FEEDBACK,
-		".gtd/SATISFIED.md",
-		ARCHITECTURE
-	]), { label: "Closing out the package" });
+		from,
+		to: head()
+	};
 };
 /** The first queued package — the one a package step works on. */
 const nextPackage = () => [...glob(".gtd/packages/*.md")].sort()[0];
+const outsideGtd = (path) => path !== ".gtd" && !path.startsWith(".gtd/");
 /** Build every package file under `.gtd/packages/`, in name order. */
-const packages = () => scope("packages", async () => {
-	for (let pkg = nextPackage(); pkg !== void 0; pkg = nextPackage()) await scope("item", () => packageItem(pkg));
+const packages = (carried) => scope("packages", async () => {
+	let frozen = carried;
+	const ranges = [];
+	let touched = [];
+	for (let pkg = nextPackage(); pkg !== void 0; pkg = nextPackage()) {
+		const range = await scope("item", () => packageItem(pkg, pkg === ".gtd/packages/00-e2e-scenarios.md" ? void 0 : frozen));
+		ranges.push(range);
+		if (pkg === ".gtd/packages/00-e2e-scenarios.md") {
+			touched = changesSince(range.from).filter((c) => outsideGtd(c.path) && c.status !== "deleted");
+			frozen = freezeScenarios(touched.filter((c) => c.path.endsWith(".feature")).map((c) => c.path), frozen);
+		}
+	}
+	const paths = (status) => touched.filter((c) => c.status === status).map((c) => c.path);
+	return {
+		ranges,
+		scenarios: {
+			added: paths("added"),
+			changed: paths("modified")
+		},
+		frozen
+	};
 });
 //#endregion
 //#region src/workflows/planning.ts
@@ -49607,30 +49565,8 @@ const architecture = () => scope("architecture", async () => {
 	} while (await noteGate(ARCHITECTURE, answerTechnicalQuestions));
 	await decompose();
 	if (changes(".gtd/packages/**").length === 0) refuse("gtd land: decompose: write at least one package under .gtd/packages/");
+	if (changes(".gtd/ARCHITECTURE.md").some((c) => c.status === "deleted")) refuse("gtd land: decompose: keep .gtd/ARCHITECTURE.md — the build tail's full run needs it; it is removed only once that run is green");
 });
-/** A package file name from a plan's first heading. */
-const slug = (title) => title.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "package";
-/** Whether the settled plan needs its own architecture pass, or goes straight to one package. */
-const architecturePass = async () => {
-	const { answers, truncated } = await judge("architecture-pre", {
-		questions: [{
-			id: "architectureWarranted",
-			primitive: "noul",
-			instructions: "Given the settled concerns in `.gtd/REQUIREMENTS.md` (in state), does this plan warrant a dedicated architecture pass — real structural decisions, multiple integration points, or a non-obvious tradeoff — before packages are written?",
-			criteria: "Answer yes if uncertain; a trivial, single-concern, mechanical plan with no real design decision answers no."
-		}],
-		evidence: { requirements: read(".gtd/REQUIREMENTS.md") ?? "" },
-		message: architecturePreMessage(),
-		label: "Judging whether this plan warrants an architecture pass"
-	});
-	const skip = truncated.length === 0 && answered(answers.architectureWarranted, "no", numeric(vars.architectureSkipMinP, Infinity));
-	const plan = read(REQUIREMENTS);
-	if (skip && plan !== void 0) {
-		await run$3("architecture-promote", moveScript(REQUIREMENTS, `.gtd/packages/01-${slug(sections(plan)[0] ?? "")}.md`), { label: "Promoting the plan straight to a package" });
-		return;
-	}
-	await architecture();
-};
 //#endregion
 //#region src/workflows/review.ts
 /** Split a `qualityReviews` value into its lenses: on `,`, trimmed, blanks dropped. */
@@ -49645,10 +49581,10 @@ const qualityLap = async () => {
 	return (read(".gtd/QUALITY.md") ?? "").length > 0 ? "findings" : "clean";
 };
 /** Resolves `true` once `.gtd/QUALITY.md` is resolved, `false` when the fix cap escalated instead. */
-const fixQualityFindings = async (escalations) => {
+const fixQualityFindings = async (escalations, frozen) => {
 	for (let turns = 0; turns < 3; turns++) {
-		await fixQuality();
-		if (changes(".gtd/QUALITY.md").some((c) => c.status === "deleted")) return true;
+		await guarded(frozen, fixQuality)();
+		if (read(".gtd/QUALITY.md") === void 0) return true;
 	}
 	await escalation(escalations);
 	return false;
@@ -49750,8 +49686,8 @@ const routeNotes = async (notes, r) => {
 		answeredAt = head();
 	}
 	if (nits.length > 0) {
-		await fixNits(nits);
-		await healthy(fix, { escalations: r.escalations });
+		await guarded(r.frozen, () => fixNits(nits), "review")();
+		await healthy(guarded(r.frozen, fix, "review"), { escalations: r.escalations });
 	}
 	if (edits.length > 0) {
 		await r.close();
@@ -49769,7 +49705,7 @@ const routeNotes = async (notes, r) => {
 		reviewed: answeredAt
 	};
 };
-const finish = async (reviewed, collectedAt, escalations) => {
+const finish = async (reviewed, collectedAt, escalations, frozen) => {
 	const round = head();
 	const since = changesSince(reviewed);
 	const edited = since.filter(isCodeEdit);
@@ -49802,18 +49738,19 @@ const finish = async (reviewed, collectedAt, escalations) => {
 	return routeNotes(notes, {
 		round,
 		escalations,
+		frozen,
 		close,
 		outcome,
 		unfolded
 	});
 };
 /** Write the review; if it marks risks, fix them, keep green, and write it again — once, so the re-review's own risks reach the human unfixed. */
-const reviewOnce = async (base, carry, escalations) => {
+const reviewOnce = async (base, carry, escalations, frozen) => {
 	await reviewing(base, carry);
 	const risks = reviewRisks(read(".gtd/REVIEW.md") ?? "");
 	if (risks.length === 0) return;
-	await fixRisks(risks);
-	await healthy(fix, { escalations });
+	await guarded(frozen, () => fixRisks(risks), "review")();
+	await healthy(guarded(frozen, fix, "review"), { escalations });
 	await reviewing(base, carry);
 };
 /**
@@ -49822,17 +49759,17 @@ const reviewOnce = async (base, carry, escalations) => {
 * another planning lap, questions are answered in place, nits fixed in one
 * batch, praise dropped.
 */
-const review = async (base, escalations = { rounds: 0 }) => {
+const review = async (base, escalations = { rounds: 0 }, frozen) => {
 	let carry;
 	for (;;) {
-		await reviewOnce(base, carry, escalations);
+		await reviewOnce(base, carry, escalations, frozen);
 		carry = void 0;
 		let reviewed = head();
 		let collectedAt;
 		for (;;) {
 			collectedAt = await converse(base, collectedAt);
 			if (collectedAt === "missing") break;
-			const result = await finish(reviewed, collectedAt, escalations);
+			const result = await finish(reviewed, collectedAt, escalations, frozen);
 			if (!("next" in result)) return result;
 			if (result.next === "rereview") {
 				carry = result.carry;
@@ -49843,14 +49780,20 @@ const review = async (base, escalations = { rounds: 0 }) => {
 	}
 };
 /** The build tail: fix (when entered red), keep green, the quality lap, then human review since `base`. */
-const buildTail = (fixFirst, base) => scope("build", async () => {
+const buildTail = (fixFirst, base, built) => scope("build", async () => {
+	const frozen = built?.frozen;
 	const escalations = { rounds: 0 };
+	const guardedFix = guarded(frozen, () => fix());
 	let redFirst = fixFirst;
+	if (!fixFirst) await healthy(guarded(frozen, () => fix(built)), {
+		escalations,
+		sweepOnGreen: [ARCHITECTURE]
+	});
 	let lapped = false;
 	for (;;) {
 		if (redFirst) {
-			await fix();
-			await healthy(fix, {
+			await guardedFix();
+			await healthy(guardedFix, {
 				fixesSoFar: 1,
 				escalations
 			});
@@ -49858,8 +49801,8 @@ const buildTail = (fixFirst, base) => scope("build", async () => {
 		}
 		const lap = lapped ? "clean" : await qualityLap();
 		lapped = true;
-		if (lap === "clean") return review(base, escalations);
-		if (await fixQualityFindings(escalations)) await healthy(fix, { escalations });
+		if (lap === "clean") return review(base, escalations, frozen);
+		if (await fixQualityFindings(escalations, frozen)) await healthy(guardedFix, { escalations });
 		else redFirst = true;
 	}
 });
@@ -49870,14 +49813,13 @@ const defaults = {
 	reviewBase: "",
 	judgeBudgetBytes: "32768",
 	judgeIdenticalMinP: "0.7",
-	specPreJudge: "0.9",
 	reviewNoteActionable: "0.7",
-	architectureSkipMinP: "0.85",
 	qualityReviews: "correctness, owasp-security, ponytail-review, test-audit, conventions, spec-challenge"
 };
 /** Environment settings. */
 const envDefaults = {
 	testCommand: "npm test",
+	fastTestCommand: "",
 	plannerModel: "smart",
 	coderModel: "base"
 };
@@ -49893,8 +49835,6 @@ const skills = (vars) => ({
 	"architecture.decompose": ["incremental-implementation", "planning-and-task-breakdown"],
 	"packages.item": ["test-driven-development", "incremental-implementation"],
 	"packages.item.fix.suite": ["debugging-and-error-recovery"],
-	"packages.item.fix.spec": ["incremental-implementation", "code-simplification"],
-	"packages.item.spec": ["code-review-and-quality", "spec-driven-development"],
 	"packages.item.health": ["debugging-and-error-recovery"],
 	build: ["debugging-and-error-recovery"],
 	"build.health": ["debugging-and-error-recovery"],
@@ -49905,6 +49845,17 @@ const skills = (vars) => ({
 	...Object.fromEntries(lensesOf(vars.qualityReviews ?? "").map((lens) => [`build.quality.${lens}`, builtInLenses[lens]?.skills ?? [lens]]))
 });
 //#endregion
+//#region src/workflows/access.ts
+const access = (vars) => ({
+	design: { write: [] },
+	architecture: { write: [".gtd/REQUIREMENTS.md"] },
+	"architecture.decompose": { write: [".gtd/packages/**", ".gtd/ARCHITECTURE.md"] },
+	"build.review": { write: [".gtd/REVIEW.md"] },
+	"build.review.fix.nits": {},
+	"build.review.fix.risks": {},
+	...Object.fromEntries(lensesOf(vars.qualityReviews ?? "").map((lens) => [`build.quality.${lens}`, { write: [] }]))
+});
+//#endregion
 //#region src/workflows/unified.ts
 var unified_exports = /* @__PURE__ */ __exportAll({
 	ARCHITECTURE: () => ARCHITECTURE,
@@ -49914,14 +49865,15 @@ var unified_exports = /* @__PURE__ */ __exportAll({
 	QUALITY: () => QUALITY,
 	REQUIREMENTS: () => REQUIREMENTS,
 	REVIEW: () => REVIEW,
-	SPEC_FEEDBACK: () => SPEC_FEEDBACK,
+	SCENARIO_PACKAGE: () => SCENARIO_PACKAGE,
+	SETUP: () => SETUP,
+	access: () => access,
 	afterTail: () => afterTail,
 	agentWithSkills: () => agentWithSkills,
 	answerProductQuestions: () => answerProductQuestions,
 	answerReviewQuestions: () => answerReviewQuestions,
 	answerTechnicalQuestions: () => answerTechnicalQuestions,
 	architecture: () => architecture,
-	architecturePass: () => architecturePass,
 	author: () => author,
 	awaitReview: () => awaitReview,
 	base: () => base,
@@ -49930,24 +49882,29 @@ var unified_exports = /* @__PURE__ */ __exportAll({
 	buildTail: () => buildTail,
 	builtInLenses: () => builtInLenses,
 	collecting: () => collecting,
+	declaredTests: () => declaredTests,
 	decompose: () => decompose,
 	default: () => unified,
 	defaults: () => defaults,
 	describeEscalation: () => describeEscalation,
 	design: () => design,
+	driftedScenarios: () => driftedScenarios,
 	envDefaults: () => envDefaults,
 	escalate: () => escalate,
 	escalation: () => escalation,
 	escalationExhausted: () => escalationExhausted,
+	fastSuiteGuard: () => fastSuiteGuard,
 	fix: () => fix,
 	fixNits: () => fixNits,
 	fixQuality: () => fixQuality,
 	fixQualityFindings: () => fixQualityFindings,
 	fixRisks: () => fixRisks,
-	fixSpec: () => fixSpec,
 	fixSuite: () => fixSuite,
+	freezeScenarios: () => freezeScenarios,
 	gate: () => gate,
+	guarded: () => guarded,
 	healthy: () => healthy,
+	holdWording: () => holdWording,
 	lensesOf: () => lensesOf,
 	nextPackage: () => nextPackage,
 	ordinaryStart: () => ordinaryStart,
@@ -49956,19 +49913,20 @@ var unified_exports = /* @__PURE__ */ __exportAll({
 	planAndBuild: () => planAndBuild,
 	qualityLap: () => qualityLap,
 	reUnwind: () => reUnwind,
+	requireDeclaredTests: () => requireDeclaredTests,
 	retryQuestion: () => retryQuestion,
 	review: () => review,
 	reviewMissing: () => reviewMissing,
-	reviewPackage: () => reviewPackage,
 	reviewQuality: () => reviewQuality,
 	reviewing: () => reviewing,
+	scenarioText: () => scenarioText,
 	skills: () => skills,
-	specReview: () => specReview,
 	steering: () => steering,
 	summary: () => summary,
 	threads: () => threads,
 	triage: () => triage$1,
-	unwind: () => unwind
+	unwind: () => unwind,
+	wordingDrift: () => wordingDrift
 });
 /** Revert the sketch that started the process out of the working tree; its intent survives in history. */
 const unwind = () => {
@@ -49994,11 +49952,13 @@ const reUnwind = async (feedback) => {
 /** Plan, build and review until a review round signs off; feedback re-plans from scratch. */
 const planAndBuild = async (firstBase) => {
 	let base = firstBase;
+	let carried;
 	for (;;) {
 		await design(base);
-		await architecturePass();
-		await packages();
-		const outcome = await buildTail(false, base);
+		await architecture();
+		const built = await packages(carried);
+		carried = built.frozen;
+		const outcome = await buildTail(false, base, built);
 		if (outcome.verdict === "signoff") return;
 		await reUnwind(outcome);
 		base = outcome.base;
@@ -50798,6 +50758,25 @@ const skillsJsonSchema = {
 		items: { type: "string" }
 	}
 };
+/** The `access:` shape: scope full name -> `{ read?, write? }` (`compileAccessMap`). An entry REPLACES the scope's access wholesale; the key is unvalidatable here for the same reason as `skills:`. */
+const accessJsonSchema = {
+	type: "object",
+	description: "Flat scope full-name -> { read?, write? } map of glob arrays. Each entry REPLACES the named scope's declared access wholesale (never merges into it) and reaches every nested scope that sets none of its own; a missing side is unrestricted, [] allows nothing, and {} lifts every restriction. read and write are independent: write grants no read. A key that is not a scope running a turn is a load error listing the known scopes — the schema itself cannot validate a key, only a value's shape.",
+	additionalProperties: {
+		type: "object",
+		additionalProperties: false,
+		properties: {
+			read: {
+				type: "array",
+				items: { type: "string" }
+			},
+			write: {
+				type: "array",
+				items: { type: "string" }
+			}
+		}
+	}
+};
 /**
 * A real (not `Unknown`) schema, unlike `vars`/`modes`: it is a flat settings
 * struct with no per-mode map to compile, so its JSON Schema derives from the
@@ -50825,7 +50804,8 @@ const ConfigSchema = Struct({
 	judge: optional$1(JudgeSchema),
 	modes: optional$1(Unknown.annotations({ jsonSchema: modesJsonSchema })),
 	ui: optional$1(UiSchema),
-	skills: optional$1(Unknown.annotations({ jsonSchema: skillsJsonSchema }))
+	skills: optional$1(Unknown.annotations({ jsonSchema: skillsJsonSchema })),
+	access: optional$1(Unknown.annotations({ jsonSchema: accessJsonSchema }))
 });
 //#endregion
 //#region src/workflow/vars.ts
@@ -50997,6 +50977,33 @@ const compileSkillsMap = (raw) => {
 		diagnostics
 	};
 };
+/** A flat `scope full name -> { read?, write? }` map; a malformed value is a load error and is dropped. */
+const compileAccessMap = (raw) => {
+	const diagnostics = [];
+	if (raw === void 0) return {
+		access: {},
+		diagnostics
+	};
+	if (!isPlainObject$3(raw)) {
+		diagnostics.push(err(["access"], `"access" must be a mapping of scope name -> { read?, write? }, got ${describeType(raw)}`));
+		return {
+			access: {},
+			diagnostics
+		};
+	}
+	const access = Object.create(null);
+	for (const [key, value] of Object.entries(raw)) {
+		const fault = accessShapeFault(value);
+		if (fault === void 0) access[key] = value;
+		else diagnostics.push(err(["access", key], `"access.${key}": ${fault}`));
+	}
+	return {
+		access,
+		diagnostics
+	};
+};
+/** The `.gtdrc` `access:` load-error message for a key that is not a known scope. */
+const unknownAccessKeyMessage = (key, known) => `"access.${key}" is not a scope that runs a turn — known scopes: ${known.join(", ")}`;
 /** The `.gtdrc` `skills:` load-error message for a key that is not a known scope. */
 const unknownSkillsKeyMessage = (key, known) => `"skills.${key}" is not a scope that runs a turn — known scopes: ${known.join(", ")}`;
 const MODE_COMMAND_KEYS = ["format", "validate"];
@@ -51168,6 +51175,20 @@ const compileConfig = (layers) => {
 		})));
 	}
 	const { skills: rcSkills } = compileSkillsMap(mergedConfig["skills"]);
+	const accessKeys = [];
+	for (const layer of layers) {
+		if (!isPlainObject$3(layer.value)) continue;
+		const own = compileAccessMap(layer.value["access"]);
+		diagnostics.push(...own.diagnostics.map((d) => ({
+			...d,
+			origin: layer.origin
+		})));
+		accessKeys.push(...Object.keys(own.access).map((key) => ({
+			key,
+			origin: layer.origin
+		})));
+	}
+	const { access: rcAccess } = compileAccessMap(mergedConfig["access"]);
 	const seeded = Object.fromEntries(BUILT_IN_MODE_NAMES.map((name) => [name, { validate: seededValidateCommand(name) }]));
 	return {
 		rcVars,
@@ -51179,6 +51200,8 @@ const compileConfig = (layers) => {
 		...ui !== void 0 ? { ui } : {},
 		rcSkills,
 		skillsKeys,
+		access: rcAccess,
+		accessKeys,
 		diagnostics: dedupeDiagnostics(sortDiagnostics(diagnostics, layerOrder))
 	};
 };
@@ -58110,6 +58133,9 @@ const load = gen(function* () {
 			skills: loaded.skills,
 			configuredSkills: compiled.rcSkills,
 			skillsKeys: compiled.skillsKeys,
+			access: loaded.access,
+			configuredAccess: compiled.access,
+			accessKeys: compiled.accessKeys,
 			skillsOrigin: module?.filepath ?? "(built-in default)",
 			initial
 		},
@@ -58187,6 +58213,12 @@ const skillsExport = (exports) => {
 	const record = checkSkillsRecord(value);
 	return () => record;
 };
+/** Read a module's optional `access` export — a scope full name -> `{ read?, write? }` record, or a function of the vars returning one. */
+const accessExport = (exports) => {
+	const value = exports["access"] ?? {};
+	if (typeof value === "function") return (vars) => value(vars);
+	return () => value;
+};
 const optionalFunction = (exports, name) => {
 	const value = exports[name];
 	if (value === void 0) return void 0;
@@ -58215,6 +58247,7 @@ const fromModule = (exported, origin, dependencyFiles) => {
 		envDefaults,
 		steering: stringRecord(exports, "steering"),
 		skills: skillsExport(exports),
+		access: accessExport(exports),
 		summary: optionalFunction(exports, "summary"),
 		base: optionalFunction(exports, "base"),
 		origin,
@@ -58337,7 +58370,10 @@ var ConfigService = class ConfigService extends Tag("ConfigService")() {
 //#endregion
 //#region src/workflow/init.ts
 const SCHEMA_URL = "https://cdn.jsdelivr.net/npm/@pmelab/gtd/schema.json";
-const INIT_ENV = { testCommand: "npm test" };
+const INIT_ENV = {
+	testCommand: "npm test",
+	fastTestCommand: ""
+};
 const MODES_SUGGESTION = {
 	qa: { format: "npx prettier --write \"$GTD_FILE\"" },
 	review: { format: "npx prettier --write \"$GTD_FILE\"" }
@@ -58355,6 +58391,16 @@ const checkShape = (value) => {
 	for (const [scope, names] of Object.entries(value)) if (!Array.isArray(names) || names.some((n) => typeof n !== "string")) throw new Error(`skills export: "${scope}" must be an array of skill names`);
 	return value;
 };
+/** Every `.gtdrc` key that names no known scope is a load error, one per file that wrote it. */
+const checkKeys = (keys, known, message, section) => {
+	const sorted = [...known].sort();
+	return failOnErrors(dedupeDiagnostics(sortDiagnostics(keys.filter(({ key }) => !sorted.includes(key)).map(({ key, origin }) => ({
+		severity: "error",
+		path: [section, key],
+		message: message(key, sorted),
+		origin
+	})), [...new Set(keys.map((k) => k.origin))])));
+};
 /**
 * Skill lists for the settings actually in use. `.gtdrc` `skills:` keys are
 * judged here, not at config load: only now are the pinned/entry vars known.
@@ -58364,15 +58410,29 @@ const resolveScopeSkills = (def, vars) => gen(function* () {
 		try: () => checkShape(def.skills(vars)),
 		catch: (e) => fail$4(def.skillsOrigin, e instanceof Error ? e.message : String(e))
 	});
-	const known = Object.keys(skills).sort();
-	yield* failOnErrors(dedupeDiagnostics(sortDiagnostics(def.skillsKeys.filter(({ key }) => !known.includes(key)).map(({ key, origin }) => ({
-		severity: "error",
-		path: ["skills", key],
-		message: unknownSkillsKeyMessage(key, known),
-		origin
-	})), [...new Set(def.skillsKeys.map((k) => k.origin))])));
+	yield* checkKeys(def.skillsKeys, Object.keys(skills), unknownSkillsKeyMessage, "skills");
 	return skills;
 });
+const checkAccessShape = (value) => {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) throw new Error("access export must return an object of scope -> { read?, write? }");
+	for (const [scope, access] of Object.entries(value)) {
+		const fault = accessShapeFault(access);
+		if (fault !== void 0) throw new Error(`access export: "${scope}": ${fault}`);
+	}
+	return value;
+};
+/**
+* Access for the settings actually in use. A `.gtdrc` `access:` key may name
+* any scope the workflow gives skills or access to.
+*/
+const resolveScopeAccess = (def, skills, vars) => gen(function* () {
+	const access = yield* try_({
+		try: () => checkAccessShape(def.access(vars)),
+		catch: (e) => fail$4(def.skillsOrigin, e instanceof Error ? e.message : String(e))
+	});
+	yield* checkKeys(def.accessKeys, [.../* @__PURE__ */ new Set([...Object.keys(skills), ...Object.keys(access)])], unknownAccessKeyMessage, "access");
+	return access;
+});
 //#endregion
 //#region src/judges/providers/fixed.ts
 const fail$3 = (message) => {
@@ -63696,6 +63756,8 @@ const renderFormat = (fmt, ...args) => {
 	let i = 0;
 	return fmt.replace(/%s/g, () => args[i++] ?? "");
 };
+/** The first line of the landing refusal for a turn that wrote outside its `write` access — a stable marker drivers and tests grep for. */
+const ACCESS_REFUSAL = "gtd land: this turn wrote outside its write access — revert these paths, then run `gtd land` again:";
 //#endregion
 //#region src/wire/Demand.ts
 /**
@@ -63724,7 +63786,7 @@ const stallDiagnosis = (state, actor) => `stalled at "${state}": the last gtd(${
 /**
 * Assemble one `Demand` — the ONLY place a rest's resolved content becomes
 * `Demand.content` (`stallDiagnosis` at `kind === "stalled"`, the rendered
-* content otherwise), and the only place `session`/`validate`/`skills` are
+* content otherwise), and the only place `session`/`validate`/`skills`/`access` are
 * attached, which the `prompt` variant's own type makes impossible to do at
 * any other kind.
 */
@@ -63732,12 +63794,17 @@ const demandOf = (input) => {
 	const { rendered, kind, session, validate } = input;
 	const content = kind === "stalled" ? stallDiagnosis(rendered.state, rendered.actor) : rendered.content;
 	const skills = rendered.skills !== void 0 && rendered.skills.length > 0 ? rendered.skills : void 0;
+	const access = rendered.access ?? {
+		read: null,
+		write: null
+	};
 	return kind === "prompt" ? {
 		kind,
 		content,
 		session,
 		validate,
-		skills
+		skills,
+		access
 	} : {
 		kind,
 		content
@@ -63781,7 +63848,7 @@ const assertNeverDemand = (demand) => {
 };
 /**
 * The ONE exhaustive switch translating a `Demand` into its wire
-* `session`/`validate`/`skills` triple — only the `prompt` variant carries
+* `session`/`validate`/`skills`/`access` set — only the `prompt` variant carries
 * any of them, and every other member is listed explicitly (not a
 * `default:` fallthrough) so adding a sixth `BeatKind` without adding its
 * case here fails `tsc` at the `assertNeverDemand` call, not silently
@@ -63792,7 +63859,8 @@ const dispatchFieldsOf = (demand) => {
 		case "prompt": return {
 			session: demand.session,
 			validate: demand.validate,
-			skills: demand.skills
+			skills: demand.skills,
+			access: demand.access
 		};
 		case "capture":
 		case "message":
@@ -63800,19 +63868,20 @@ const dispatchFieldsOf = (demand) => {
 		case "stalled": return {
 			session: void 0,
 			validate: void 0,
-			skills: void 0
+			skills: void 0,
+			access: void 0
 		};
 		default: return assertNeverDemand(demand);
 	}
 };
 /**
-* Flatten a `Demand` plus its `BeatStatus` into the single 20-key document
+* Flatten a `Demand` plus its `BeatStatus` into the single 21-key document
 * `gtd next --json` emits — the ONLY place the two are joined. `cost`/
 * `costByModel` are omitted together, exactly when no cost was recorded
 * (`cost <= 0`).
 */
 const beatDocument = (demand, status) => {
-	const { session, validate, skills } = dispatchFieldsOf(demand);
+	const { session, validate, skills, access } = dispatchFieldsOf(demand);
 	const hasCost = status.cost > 0;
 	return {
 		kind: demand.kind,
@@ -63834,7 +63903,8 @@ const beatDocument = (demand, status) => {
 		cost: hasCost ? status.cost : void 0,
 		costByModel: hasCost ? status.costByModel : void 0,
 		judge: status.judge,
-		skills
+		skills,
+		access
 	};
 };
 const renderBeatJson = (document) => JSON.stringify(document) + "\n";
@@ -63971,6 +64041,195 @@ const renderLandPlain = (fields, command = "land") => fields.subject !== null ?
 //#region src/Workflow.ts
 const knownModes = (def) => Object.keys(def.modes);
 //#endregion
+//#region src/step/planStep.ts
+/**
+* At the human review gate an unconditional `gtd uncheck '<file>'` runs
+* ahead of the commit, resetting every checkbox before `git add -A` picks it
+* up — a tick is read-progress, never sign-off.
+*/
+const uncheckStep = (snapshot) => snapshot.stepDef.actor === "human" && snapshot.stepDef.mode === "review" && snapshot.file !== void 0 ? [{
+	kind: "uncheck",
+	file: snapshot.file
+}] : [];
+const planStep = (snapshot, opts = {}) => {
+	const landing = snapshot.landing;
+	if (landing.kind === "refusal") return {
+		kind: "refusal",
+		message: landing.message
+	};
+	if (landing.kind === "noop") return {
+		kind: "noop",
+		state: snapshot.state,
+		settled: landing.settled
+	};
+	const cost = opts.cost === void 0 ? {} : { cost: {
+		cost: opts.cost,
+		...opts.model !== void 0 ? { model: opts.model } : {}
+	} };
+	if (landing.kind === "attempt") {
+		const message = formatCommitMessage({
+			actor: snapshot.actor,
+			to: snapshot.state,
+			...cost
+		});
+		return {
+			kind: "commit",
+			state: snapshot.state,
+			to: snapshot.state,
+			subject: landing.subject,
+			steps: [{
+				kind: "gitWrite",
+				write: {
+					kind: "commitAll",
+					message
+				}
+			}, {
+				kind: "outcome",
+				outcome: {
+					kind: "commit",
+					subject: landing.subject
+				}
+			}]
+		};
+	}
+	const message = formatCommitMessage({
+		...landing.spec,
+		...cost,
+		...opts.judge !== void 0 && opts.judge.length > 0 ? { judge: opts.judge } : {}
+	});
+	const subject = message.split("\n")[0];
+	const outcome = landing.to === snapshot.state ? {
+		kind: "outcome",
+		outcome: {
+			kind: "commit",
+			subject
+		}
+	} : {
+		kind: "outcome",
+		outcome: {
+			kind: "transition",
+			from: snapshot.state,
+			to: landing.to
+		}
+	};
+	return {
+		kind: "commit",
+		state: snapshot.state,
+		to: landing.to,
+		subject,
+		steps: [
+			...uncheckStep(snapshot),
+			{
+				kind: "gitWrite",
+				write: {
+					kind: "commitAll",
+					message
+				}
+			},
+			outcome
+		]
+	};
+};
+//#endregion
+//#region src/step/accessRefusal.ts
+/**
+* The landing refusal for changes outside `write`, or `undefined` when every
+* path is allowed. `null` is unrestricted. The message is the fix prompt: gtd
+* runs no fix turn of its own.
+*/
+const accessRefusal = (changes, write) => {
+	if (write === null) return void 0;
+	const offending = [...new Set(changes.filter((c) => !write.some((glob) => globMatches(c.path, glob))).map((c) => c.path))];
+	if (offending.length === 0) return void 0;
+	return [
+		ACCESS_REFUSAL,
+		...offending.map((path) => `  - ${path}`),
+		`allowed: ${write.length === 0 ? "(nothing)" : write.join(", ")}`
+	].join("\n");
+};
+//#endregion
+//#region src/step/planEntry.ts
+const refusal = (message) => ({
+	kind: "refusal",
+	message
+});
+const checkOverrides = (commandLabel, varOverrides, declaredNames, envNames) => gen(function* () {
+	const environmentOnly = Object.keys(varOverrides).filter((n) => !declaredNames.includes(n) && envNames.includes(n));
+	if (environmentOnly.length > 0) return yield* fail$7(new GtdUsageError(`${commandLabel}: --var pins process settings only; ${environmentOnly.join(", ")} ${environmentOnly.length === 1 ? "is an environment setting" : "are environment settings"} — set it under "env:" in .gtdrc or with a GTD_<NAME> environment variable`));
+	const undeclared = Object.keys(varOverrides).filter((n) => !declaredNames.includes(n));
+	if (undeclared.length > 0) return refusal(`${commandLabel}: --var name(s) not declared by this workflow: ${undeclared.join(", ")} — declared: ${declaredNames.length > 0 ? declaredNames.join(", ") : "(none)"}`);
+});
+/**
+* `gtd --entry <name>`: start a brand NEW process at a workflow entry, writing
+* an opening commit that carries every process setting as a `Gtd-Var:` trailer, plus a
+* `Gtd-Review-Base:` trailer when the entry fixes the process's diff base.
+* All validation is a REFUSAL, not an Effect failure.
+*/
+const planEntry = (current, actor, entry) => gen(function* () {
+	const { state: name, commandLabel, vars: varOverrides } = entry;
+	if (!current.idle) return refusal(`${commandLabel}: a process is already underway (resting at "${current.state}") — finish it, or run \`gtd abandon\`, before entering`);
+	if (current.entryRefusal !== void 0) return refusal(`${commandLabel}: ${current.entryRefusal}`);
+	const config = yield* (yield* ConfigService).load;
+	const declaredNames = Object.keys({
+		...config.workflowVars,
+		...config.rcVars
+	});
+	const overrideRefusal = yield* checkOverrides(commandLabel, varOverrides, declaredNames, Object.keys({
+		...config.workflowEnv,
+		...config.rcEnv
+	}));
+	if (overrideRefusal !== void 0) return overrideRefusal;
+	let base;
+	const baseOf = current.def.base;
+	const vars = resolveVars(config.workflowVars, config.rcVars, varOverrides, (yield* Host).env);
+	const multiline = multilineSetting(vars);
+	if (multiline !== void 0) return refusal(`${commandLabel}: process setting "${multiline}" spans several lines — a process setting is pinned in a commit trailer and must be a single line`);
+	const template = yield* try_({
+		try: () => baseOf?.(name, vars),
+		catch: (e) => /* @__PURE__ */ new Error(`${commandLabel}: ${e instanceof Error ? e.message : String(e)}`)
+	});
+	if (baseOf !== void 0 && template !== void 0) {
+		const resolved = yield* resolveBase(name, commandLabel, baseOf, template);
+		if (typeof resolved !== "string") return resolved;
+		base = resolved;
+	}
+	const subject = formatSubject(actor, name);
+	return {
+		kind: "entry",
+		state: name,
+		subject,
+		steps: [{
+			kind: "gitWrite",
+			write: {
+				kind: "commitAll",
+				message: formatCommitMessage({
+					actor,
+					to: name,
+					...base !== void 0 ? { reviewBase: base } : {},
+					vars
+				})
+			}
+		}, {
+			kind: "outcome",
+			outcome: {
+				kind: "commit",
+				subject
+			}
+		}]
+	};
+});
+/** The entry's diff base: a commitish that resolves, is an ancestor of HEAD, and is not HEAD. */
+const resolveBase = (name, commandLabel, base, value) => gen(function* () {
+	const rendered = value.trim();
+	if (rendered === "") return refusal(`${commandLabel}: "${name}"'s reviewBase template rendered blank — template: ${base.toString()}; pass the base with --var`);
+	const git = yield* GitService;
+	const resolvedBase = yield* either(git.resolveRef(rendered));
+	if (resolvedBase._tag === "Left") return refusal(`${commandLabel}: "${rendered}" does not resolve to a commit`);
+	if (!(yield* git.isAncestor(resolvedBase.right, "HEAD"))) return refusal(`${commandLabel}: "${rendered}" is not an ancestor of HEAD`);
+	if (resolvedBase.right === (yield* git.resolveRef("HEAD"))) return refusal(`${commandLabel}: "${rendered}" is HEAD — nothing to review`);
+	return resolvedBase.right;
+});
+//#endregion
 //#region src/Edge.ts
 const EMPTY_TREE$1 = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
 const ACTORS = /* @__PURE__ */ new Set([
@@ -64240,6 +64499,8 @@ const replayFor = (setup, pending) => replay({
 	budgetBytes: setup.budget,
 	skills: setup.skills,
 	configuredSkills: setup.def.configuredSkills,
+	access: setup.access,
+	configuredAccess: setup.def.configuredAccess,
 	...pending !== void 0 ? { pending } : {}
 });
 const replayError = (outcome) => {
@@ -64268,14 +64529,15 @@ const commonOf = (step) => {
 		...optional("mode", options.mode)
 	};
 };
-const promptDef = (common, request, skills) => ({
+const promptDef = (common, request, skills, access) => ({
 	...common,
 	kind: "prompt",
 	content: request.prompt,
 	...optional("model", request.options.model),
 	...optional("system", request.options.system),
 	...optional("allowEmpty", request.options.allowEmpty),
-	...optional("skills", skills)
+	...optional("skills", skills),
+	...optional("access", access)
 });
 const scriptDef = (common, request) => ({
 	...common,
@@ -64301,7 +64563,7 @@ const stepDefOf = (step) => {
 	const request = step.request;
 	const common = commonOf(step);
 	switch (request.kind) {
-		case "agent": return promptDef(common, request, step.skills);
+		case "agent": return promptDef(common, request, step.skills, step.access);
 		case "run": return scriptDef(common, request);
 		case "judge": return judgeDef(common, request, step);
 		case "human": return messageDef(common, request, step);
@@ -64357,7 +64619,8 @@ const hintsOf = (def) => ({
 	...optional("judge", def.judge),
 	...optional("system", def.system),
 	...optional("mode", def.mode),
-	...optional("skills", def.skills)
+	...optional("skills", def.skills),
+	...optional("access", def.access)
 });
 const normalizeStatus = (raw) => raw === "A" ? "A" : raw === "D" ? "D" : "M";
 /** Per-model token totals, highest-cost first (ties broken by model name). */
@@ -64379,6 +64642,7 @@ const restAt = (ref, entryOverrides = {}) => gen(function* () {
 	const run = yield* computeProcessRun(git, def, ref);
 	const { vars, env } = settingsFor(config, run.pinnedVars, host.env, entryOverrides);
 	const skills = yield* resolveScopeSkills(def, vars);
+	const access = yield* resolveScopeAccess(def, skills, vars);
 	const budget = yield* try_({
 		try: () => judgeBudgetBytes(vars),
 		catch: (e) => e instanceof Error ? e : new Error(String(e))
@@ -64404,6 +64668,7 @@ const restAt = (ref, entryOverrides = {}) => gen(function* () {
 		env,
 		budget,
 		skills,
+		access,
 		workspace,
 		base,
 		episode,
@@ -64453,6 +64718,7 @@ const entryRefusal = (rest, name, entryVars) => gen(function* () {
 	const host = yield* Host;
 	const { vars, env } = settingsFor(config, {}, host.env, entryVars);
 	const skills = yield* resolveScopeSkills(rest.def, vars);
+	const access = yield* resolveScopeAccess(rest.def, skills, vars);
 	const workspace = rest.setup.workspace;
 	const outcome = yield* promise(() => replay({
 		flow: rest.def.flow,
@@ -64469,7 +64735,9 @@ const entryRefusal = (rest, name, entryVars) => gen(function* () {
 		start: "",
 		budgetBytes: rest.setup.budget,
 		skills,
-		configuredSkills: rest.def.configuredSkills
+		configuredSkills: rest.def.configuredSkills,
+		access,
+		configuredAccess: rest.def.configuredAccess
 	}));
 	if (outcome.kind === "refused") return outcome.message;
 	if (outcome.kind === "rest") return outcome.entryRead ? void 0 : `"${name}" is not an enterable state — this workflow reads no entry`;
@@ -64561,6 +64829,13 @@ const landingTo = (rest, to) => {
 const decideLanding = (rest, verdicts) => gen(function* () {
 	const early = cleanLanding(rest);
 	if (early !== void 0) return early;
+	if (rest.stepDef.kind === "prompt" && rest.stepDef.access?.write != null) {
+		const message = accessRefusal(rest.changes, rest.stepDef.access.write);
+		if (message !== void 0) return {
+			kind: "refusal",
+			message
+		};
+	}
 	const outcome = yield* promise(() => replayFor(rest.setup, {
 		tree: pendingTree(rest.setup.workspace, rest.setup.pendingWorktree(), reviewGateRewrite(rest.stepDef)),
 		...verdicts !== void 0 ? { verdicts } : {}
@@ -64604,178 +64879,6 @@ const summaryFor = (run) => gen(function* () {
 	});
 });
 //#endregion
-//#region src/step/planStep.ts
-/**
-* At the human review gate an unconditional `gtd uncheck '<file>'` runs
-* ahead of the commit, resetting every checkbox before `git add -A` picks it
-* up — a tick is read-progress, never sign-off.
-*/
-const uncheckStep = (snapshot) => snapshot.stepDef.actor === "human" && snapshot.stepDef.mode === "review" && snapshot.file !== void 0 ? [{
-	kind: "uncheck",
-	file: snapshot.file
-}] : [];
-const planStep = (snapshot, opts = {}) => {
-	const landing = snapshot.landing;
-	if (landing.kind === "refusal") return {
-		kind: "refusal",
-		message: landing.message
-	};
-	if (landing.kind === "noop") return {
-		kind: "noop",
-		state: snapshot.state,
-		settled: landing.settled
-	};
-	const cost = opts.cost === void 0 ? {} : { cost: {
-		cost: opts.cost,
-		...opts.model !== void 0 ? { model: opts.model } : {}
-	} };
-	if (landing.kind === "attempt") {
-		const message = formatCommitMessage({
-			actor: snapshot.actor,
-			to: snapshot.state,
-			...cost
-		});
-		return {
-			kind: "commit",
-			state: snapshot.state,
-			to: snapshot.state,
-			subject: landing.subject,
-			steps: [{
-				kind: "gitWrite",
-				write: {
-					kind: "commitAll",
-					message
-				}
-			}, {
-				kind: "outcome",
-				outcome: {
-					kind: "commit",
-					subject: landing.subject
-				}
-			}]
-		};
-	}
-	const message = formatCommitMessage({
-		...landing.spec,
-		...cost,
-		...opts.judge !== void 0 && opts.judge.length > 0 ? { judge: opts.judge } : {}
-	});
-	const subject = message.split("\n")[0];
-	const outcome = landing.to === snapshot.state ? {
-		kind: "outcome",
-		outcome: {
-			kind: "commit",
-			subject
-		}
-	} : {
-		kind: "outcome",
-		outcome: {
-			kind: "transition",
-			from: snapshot.state,
-			to: landing.to
-		}
-	};
-	return {
-		kind: "commit",
-		state: snapshot.state,
-		to: landing.to,
-		subject,
-		steps: [
-			...uncheckStep(snapshot),
-			{
-				kind: "gitWrite",
-				write: {
-					kind: "commitAll",
-					message
-				}
-			},
-			outcome
-		]
-	};
-};
-//#endregion
-//#region src/step/planEntry.ts
-const refusal = (message) => ({
-	kind: "refusal",
-	message
-});
-const checkOverrides = (commandLabel, varOverrides, declaredNames, envNames) => gen(function* () {
-	const environmentOnly = Object.keys(varOverrides).filter((n) => !declaredNames.includes(n) && envNames.includes(n));
-	if (environmentOnly.length > 0) return yield* fail$7(new GtdUsageError(`${commandLabel}: --var pins process settings only; ${environmentOnly.join(", ")} ${environmentOnly.length === 1 ? "is an environment setting" : "are environment settings"} — set it under "env:" in .gtdrc or with a GTD_<NAME> environment variable`));
-	const undeclared = Object.keys(varOverrides).filter((n) => !declaredNames.includes(n));
-	if (undeclared.length > 0) return refusal(`${commandLabel}: --var name(s) not declared by this workflow: ${undeclared.join(", ")} — declared: ${declaredNames.length > 0 ? declaredNames.join(", ") : "(none)"}`);
-});
-/**
-* `gtd --entry <name>`: start a brand NEW process at a workflow entry, writing
-* an opening commit that carries every process setting as a `Gtd-Var:` trailer, plus a
-* `Gtd-Review-Base:` trailer when the entry fixes the process's diff base.
-* All validation is a REFUSAL, not an Effect failure.
-*/
-const planEntry = (current, actor, entry) => gen(function* () {
-	const { state: name, commandLabel, vars: varOverrides } = entry;
-	if (!current.idle) return refusal(`${commandLabel}: a process is already underway (resting at "${current.state}") — finish it, or run \`gtd abandon\`, before entering`);
-	if (current.entryRefusal !== void 0) return refusal(`${commandLabel}: ${current.entryRefusal}`);
-	const config = yield* (yield* ConfigService).load;
-	const declaredNames = Object.keys({
-		...config.workflowVars,
-		...config.rcVars
-	});
-	const overrideRefusal = yield* checkOverrides(commandLabel, varOverrides, declaredNames, Object.keys({
-		...config.workflowEnv,
-		...config.rcEnv
-	}));
-	if (overrideRefusal !== void 0) return overrideRefusal;
-	let base;
-	const baseOf = current.def.base;
-	const vars = resolveVars(config.workflowVars, config.rcVars, varOverrides, (yield* Host).env);
-	const multiline = multilineSetting(vars);
-	if (multiline !== void 0) return refusal(`${commandLabel}: process setting "${multiline}" spans several lines — a process setting is pinned in a commit trailer and must be a single line`);
-	const template = yield* try_({
-		try: () => baseOf?.(name, vars),
-		catch: (e) => /* @__PURE__ */ new Error(`${commandLabel}: ${e instanceof Error ? e.message : String(e)}`)
-	});
-	if (baseOf !== void 0 && template !== void 0) {
-		const resolved = yield* resolveBase(name, commandLabel, baseOf, template);
-		if (typeof resolved !== "string") return resolved;
-		base = resolved;
-	}
-	const subject = formatSubject(actor, name);
-	return {
-		kind: "entry",
-		state: name,
-		subject,
-		steps: [{
-			kind: "gitWrite",
-			write: {
-				kind: "commitAll",
-				message: formatCommitMessage({
-					actor,
-					to: name,
-					...base !== void 0 ? { reviewBase: base } : {},
-					vars
-				})
-			}
-		}, {
-			kind: "outcome",
-			outcome: {
-				kind: "commit",
-				subject
-			}
-		}]
-	};
-});
-/** The entry's diff base: a commitish that resolves, is an ancestor of HEAD, and is not HEAD. */
-const resolveBase = (name, commandLabel, base, value) => gen(function* () {
-	const rendered = value.trim();
-	if (rendered === "") return refusal(`${commandLabel}: "${name}"'s reviewBase template rendered blank — template: ${base.toString()}; pass the base with --var`);
-	const git = yield* GitService;
-	const resolvedBase = yield* either(git.resolveRef(rendered));
-	if (resolvedBase._tag === "Left") return refusal(`${commandLabel}: "${rendered}" does not resolve to a commit`);
-	if (!(yield* git.isAncestor(resolvedBase.right, "HEAD"))) return refusal(`${commandLabel}: "${rendered}" is not an ancestor of HEAD`);
-	if (resolvedBase.right === (yield* git.resolveRef("HEAD"))) return refusal(`${commandLabel}: "${rendered}" is HEAD — nothing to review`);
-	return resolvedBase.right;
-});
-//#endregion
 //#region src/RetainedHistory.ts
 /** Per-worktree (`refs/worktree/gtd/*`) so linked worktrees sharing one `.git` don't clobber each other's retained history. */
 const HISTORY_REF = "refs/worktree/gtd/history";
@@ -76757,7 +76860,8 @@ never stored, so a plain peek is exactly as safe to call as a dispatch would
 be — and, when the state declares a validatable steering file, \`validate\`
 (the script that formats then validates it), and, when the turn's scope declares
 skills, \`skills\` (an array of the skill names, already trimmed and split —
-\`--json=skills.0\` reads the first). When set: \`model\`, \`memory\`,
+\`--json=skills.0\` reads the first), and always \`access\`
+(\`{read, write}\`, each an array of globs or \`null\` for unrestricted). When set: \`model\`, \`memory\`,
 \`label\`, \`file\`, \`mode\`, \`edges\`, \`judge\` (the pending judgment's rendered
 document). When a cost has been recorded (a prior \`gtd land --cost=<n>\`):
 \`cost\`, \`costByModel\`.
@@ -76856,6 +76960,13 @@ const DRIVER_OBLIGATIONS = `
     turn sees only those. An absent field means none. A CLI that cannot
     restrict relies on the preamble gtd already puts in the prompt — the
     reference body's \`claude -p\` does exactly that.
+12. Map each prompt turn's \`--json=access.read\` / \`--json=access.write\`
+    (arrays of globs, \`null\` = unrestricted) onto the chosen CLI's sandbox
+    (Codex \`workspace-write\` plus writable roots) or a container with
+    \`:ro\` / \`:rw\` bind mounts. \`access\` is a prompt-only field. A CLI
+    that cannot restrict relies on the preamble and gtd's landing check. When
+    \`gtd land\` refuses naming an access violation, re-prompt the turn with
+    the refusal text and land again, or stop.
 `;
 const RECOVERY = `
 ## Recovery