@t275005746/gse 0.1.0 → 0.1.1

package/.gse/releases/public-release-owner-required.md

@@ -1,65 +1,65 @@
-# Public Release Record
-
-Release name: GSE
-
-Release version or label: public-defaults
-
-Release date: 2026-07-06
-
-Distribution channel: github-public-repo-and-release-planned
-
-Release scope: GSE public release metadata and distribution readiness
-
-## License
-
-License status: selected
-
-SPDX identifier: MIT
-
-License file: LICENSE
-
-Approved by: owner-confirmed-in-current-codex-thread
-
-Decision date: 2026-07-07
-
-Notes: Owner-selected license decision recorded.
-
-## Artifacts
-
-Package or source path: <install-skill-dir>
-
-Changelog path: CHANGELOG.md
-
-Install/update instructions: references/packaging.md
-
-Integrity or signing record: references/release-trust.md
-
-Marketplace/catalog record: references/marketplace-discovery.md
-
-## Verification
-
-Validation command: node scripts/validate-gse.mjs --root <skill> --json
-
-Validation result: pending current run
-
-Focused smoke: scripts/audit-public-release-metadata.mjs
-
-Acceptance evidence: Owner license decision accepted; public release still requires remaining public and host evidence.
-
-## Risks
-
-Known unsupported claims: public marketplace approval, public registry publication, legal suitability, and host-native slash-command runtime support are not implied by this record.
-
-Known compatibility limits: host behavior must be verified per host runtime.
-
-Rollback or unpublish path: remove public listing/package and publish corrected release record.
-
-## Acceptance
-
-Evidence status: accepted
-
-Accepted by: owner-confirmed-in-current-codex-thread
-
-Accepted at: 2026-07-07
-
-Next action: Run release validation and preserve acceptance evidence.
+# Public Release Record
+
+Release name: GSE
+
+Release version or label: public-defaults
+
+Release date: 2026-07-06
+
+Distribution channel: github-public-repo-and-release-planned
+
+Release scope: GSE public release metadata and distribution readiness
+
+## License
+
+License status: selected
+
+SPDX identifier: MIT
+
+License file: LICENSE
+
+Approved by: owner-confirmed-in-current-codex-thread
+
+Decision date: 2026-07-07
+
+Notes: Owner-selected license decision recorded.
+
+## Artifacts
+
+Package or source path: <install-skill-dir>
+
+Changelog path: CHANGELOG.md
+
+Install/update instructions: references/packaging.md
+
+Integrity or signing record: references/release-trust.md
+
+Marketplace/catalog record: references/marketplace-discovery.md
+
+## Verification
+
+Validation command: node scripts/validate-gse.mjs --root <skill> --json
+
+Validation result: pending current run
+
+Focused smoke: scripts/audit-public-release-metadata.mjs
+
+Acceptance evidence: Owner license decision accepted; public release still requires remaining public and host evidence.
+
+## Risks
+
+Known unsupported claims: public marketplace approval, public registry publication, legal suitability, and host-native slash-command runtime support are not implied by this record.
+
+Known compatibility limits: host behavior must be verified per host runtime.
+
+Rollback or unpublish path: remove public listing/package and publish corrected release record.
+
+## Acceptance
+
+Evidence status: accepted
+
+Accepted by: owner-confirmed-in-current-codex-thread
+
+Accepted at: 2026-07-07
+
+Next action: Run release validation and preserve acceptance evidence.

package/.gse/releases/public-security-contact-owner-required.md

@@ -1,45 +1,45 @@
-# Public Security Contact Record
-
-Contact status: accepted
-
-Contact type: url
-
-Contact value: https://github.com/275005746/gse/blob/main/SECURITY.md
-
-Policy path: `SECURITY.md`
-
-Evidence owner: 275005746
-
-Evidence date: 2026-07-07
-
-Evidence URL or run id: https://github.com/275005746/gse/blob/main/SECURITY.md
-
-## Public Disclosure Policy
-
-- Is this contact public? true
-- Security policy updated? true
-- Private fallback channel: owner private coordination channel
-- Response expectation: pending owner policy
-- Embargo or disclosure notes: Do not publish exploit details until the public contact is owner-accepted.
-
-## Verification
-
-Verification command: node scripts/audit-open-source-readiness.mjs --root . --json
-
-Verification result: pending
-
-## Acceptance
-
-Evidence status: accepted
-
-Accepted by: 275005746
-
-Accepted at: 2026-07-07
-
-## Residual Risk
-
-- Public security contact is not accepted until owner evidence is attached.
-
-## Next Action
-
-- Attach owner-approved public security contact evidence and re-run final readiness.
+# Public Security Contact Record
+
+Contact status: accepted
+
+Contact type: url
+
+Contact value: https://github.com/275005746/gse/blob/main/SECURITY.md
+
+Policy path: `SECURITY.md`
+
+Evidence owner: 275005746
+
+Evidence date: 2026-07-07
+
+Evidence URL or run id: https://github.com/275005746/gse/blob/main/SECURITY.md
+
+## Public Disclosure Policy
+
+- Is this contact public? true
+- Security policy updated? true
+- Private fallback channel: owner private coordination channel
+- Response expectation: pending owner policy
+- Embargo or disclosure notes: Do not publish exploit details until the public contact is owner-accepted.
+
+## Verification
+
+Verification command: node scripts/audit-open-source-readiness.mjs --root . --json
+
+Verification result: pending
+
+## Acceptance
+
+Evidence status: accepted
+
+Accepted by: 275005746
+
+Accepted at: 2026-07-07
+
+## Residual Risk
+
+- Public security contact is not accepted until owner evidence is attached.
+
+## Next Action
+
+- Attach owner-approved public security contact evidence and re-run final readiness.

package/.gse/state.json

@@ -6,9 +6,9 @@
   "phase": "release",
   "currentSlice": {
     "id": "GSE-108-public-registry-publication",
-    "outcome": "Complete the real public registry publication gate for @t275005746/gse, then record accepted publication evidence.",
-    "status": "blocked-external-auth",
-    "nextAction": "Publish @t275005746/gse to npm with an authorized token, record the accepted package-registry publication evidence, then collect real native slash-command host evidence."
+    "outcome": "Complete the real public registry publication gate for @t275005746/gse, then record accepted publication evidence.",
+    "status": "verified",
+    "nextAction": "Collect real native slash-command host evidence for /gse continue, record it as accepted host invocation evidence, then re-run the public acceptance doctor."
   },
   "toolStatuses": {
     "browser": "unknown",
@@ -19,7 +19,6 @@
   },
   "lastEvidence": ".gse/evidence/2026-07-07.md",
   "residualRisks": [
-    "Public registry publication remains external-required because @t275005746/gse is not yet published on npm.",
     "Native slash-command support remains external-required until a real host runtime proves native /gse invocation with accepted evidence.",
     "Do not treat portable text-command routing, generated command pointers, package dry-runs, local tarball installs, or release bundles as public registry publication or native slash-command evidence.",
     "Use /gse doctor and audit-public-acceptance-readiness.mjs as the current source of truth for pending final-form gates."

package/CHANGELOG.md

@@ -1,24 +1,24 @@
-# Changelog
-
-All notable GSE changes should be recorded here before a public package, catalog entry, or release handoff is marked ready.
-
-## Unreleased
-
-### Added
-
-- Project bootstrap modes for Lite, Standard, and Enterprise `.gse/` scaffolds.
-- Native Goal-Spec-Evidence operating model with change packs, execution-quality packs, evidence taxonomy, close gates, and target project audits.
-- Portable `/gse` command semantics plus a host-neutral command runner.
-- Local package/install, URL install with manifest integrity, Ed25519 signing, verification, and signed install audits.
-- Release trust, marketplace discovery metadata, host invocation evidence records, and public-release metadata guidance.
-
-### Verified
-
-- `validate-gse.mjs` consolidates structural, project bootstrap, adoption, host adapter, compatibility, release, distribution, signing, command, target validation, and lifecycle audits.
-- AION and MuseFlow were used as real long-running target-project validation fixtures for GSE adoption checks.
-
-### Not Yet Accepted
-
-- Public registry publication and marketplace approval are not verified.
-- Host-native slash-command execution is not verified except where a host-specific record explicitly says so.
-- Open-source license selection remains an owner decision and must be recorded before a public release is accepted.
+# Changelog
+
+All notable GSE changes should be recorded here before a public package, catalog entry, or release handoff is marked ready.
+
+## Unreleased
+
+### Added
+
+- Project bootstrap modes for Lite, Standard, and Enterprise `.gse/` scaffolds.
+- Native Goal-Spec-Evidence operating model with change packs, execution-quality packs, evidence taxonomy, close gates, and target project audits.
+- Portable `/gse` command semantics plus a host-neutral command runner.
+- Local package/install, URL install with manifest integrity, Ed25519 signing, verification, and signed install audits.
+- Release trust, marketplace discovery metadata, host invocation evidence records, and public-release metadata guidance.
+
+### Verified
+
+- `validate-gse.mjs` consolidates structural, project bootstrap, adoption, host adapter, compatibility, release, distribution, signing, command, target validation, and lifecycle audits.
+- AION and MuseFlow were used as real long-running target-project validation fixtures for GSE adoption checks.
+
+### Not Yet Accepted
+
+- Public registry publication and marketplace approval are not verified.
+- Host-native slash-command execution is not verified except where a host-specific record explicitly says so.
+- Open-source license selection remains an owner decision and must be recorded before a public release is accepted.

package/CONTRIBUTING.md

@@ -1,64 +1,64 @@
-# Contributing to GSE
-
-Thanks for helping improve GSE.
-
-GSE is a workflow skill and project scaffold for agent-assisted software engineering. Contributions should make long-running project work more explicit, verifiable, portable, or easier to recover.
-
-## What To Contribute
-
-Good contributions usually fit one of these paths:
-
-- Improve the Goal -> Spec -> Execute -> Evidence -> Learn workflow.
-- Add or tighten an audit script.
-- Improve project scaffold templates.
-- Clarify host adapter boundaries.
-- Add examples that prove a workflow in a small, reproducible project.
-- Fix documentation that overstates support or leaves future agents guessing.
-
-Avoid changes that make optional tools mandatory unless there is a clear fallback path.
-
-## Development Rules
-
-- Keep `SKILL.md` short and route details into `references/`.
-- Prefer scripts and templates over repeated prose when behavior must be repeatable.
-- Do not claim support for a host, marketplace, model, MCP server, subagent, or slash command unless there is evidence.
-- Keep evidence statuses honest: `result`, `verified`, or `accepted`.
-- Do not choose a public license on behalf of the owner. Use `references/public-release.md` and `scripts/record-public-release.mjs`.
-
-## Validation
-
-Before proposing a change, run:
-
-```text
-node scripts/validate-gse.mjs --root <gse-root> --json
-```
-
-For packaging or install behavior, also run:
-
-```text
-node scripts/audit-distribution.mjs --root <gse-root> --json
-node scripts/audit-remote-distribution.mjs --root <gse-root> --json
-```
-
-For public release handoff, also run:
-
-```text
-node scripts/audit-release-bundle.mjs --root <gse-root> --json
-node scripts/audit-public-release-metadata.mjs --root <gse-root> --json
-```
-
-## Evidence
-
-Record meaningful changes in `.gse/evidence/YYYY-MM-DD.md` and append a compact record to `.gse/evidence/index.jsonl`.
-
-Do not paste secrets, raw provider payloads, private reasoning, long command logs, screenshots, or noisy transient output into evidence files.
-
-## Review
-
-Review should check:
-
-- The change maps to `.gse/goal-map.md` or the design master plan.
-- Scope did not expand silently.
-- Validation covers the changed behavior.
-- Unsupported claims remain explicit.
-- Installed-copy validation still passes when package behavior changes.
+# Contributing to GSE
+
+Thanks for helping improve GSE.
+
+GSE is a workflow skill and project scaffold for agent-assisted software engineering. Contributions should make long-running project work more explicit, verifiable, portable, or easier to recover.
+
+## What To Contribute
+
+Good contributions usually fit one of these paths:
+
+- Improve the Goal -> Spec -> Execute -> Evidence -> Learn workflow.
+- Add or tighten an audit script.
+- Improve project scaffold templates.
+- Clarify host adapter boundaries.
+- Add examples that prove a workflow in a small, reproducible project.
+- Fix documentation that overstates support or leaves future agents guessing.
+
+Avoid changes that make optional tools mandatory unless there is a clear fallback path.
+
+## Development Rules
+
+- Keep `SKILL.md` short and route details into `references/`.
+- Prefer scripts and templates over repeated prose when behavior must be repeatable.
+- Do not claim support for a host, marketplace, model, MCP server, subagent, or slash command unless there is evidence.
+- Keep evidence statuses honest: `result`, `verified`, or `accepted`.
+- Do not choose a public license on behalf of the owner. Use `references/public-release.md` and `scripts/record-public-release.mjs`.
+
+## Validation
+
+Before proposing a change, run:
+
+```text
+node scripts/validate-gse.mjs --root <gse-root> --json
+```
+
+For packaging or install behavior, also run:
+
+```text
+node scripts/audit-distribution.mjs --root <gse-root> --json
+node scripts/audit-remote-distribution.mjs --root <gse-root> --json
+```
+
+For public release handoff, also run:
+
+```text
+node scripts/audit-release-bundle.mjs --root <gse-root> --json
+node scripts/audit-public-release-metadata.mjs --root <gse-root> --json
+```
+
+## Evidence
+
+Record meaningful changes in `.gse/evidence/YYYY-MM-DD.md` and append a compact record to `.gse/evidence/index.jsonl`.
+
+Do not paste secrets, raw provider payloads, private reasoning, long command logs, screenshots, or noisy transient output into evidence files.
+
+## Review
+
+Review should check:
+
+- The change maps to `.gse/goal-map.md` or the design master plan.
+- Scope did not expand silently.
+- Validation covers the changed behavior.
+- Unsupported claims remain explicit.
+- Installed-copy validation still passes when package behavior changes.

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 GSE contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 GSE contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,6 +1,6 @@
 # GSE
 
-English | [简体中文](README.zh-CN.md)
+English | [简体中文](https://github.com/275005746/gse/blob/main/README.zh-CN.md)
 
 Goal-Spec-Evidence Engineering for long-running agent-assisted software projects.
 

package/README.zh-CN.md

@@ -1,6 +1,6 @@
 # GSE
 
-[English](README.md) | 简体中文
+[English](https://github.com/275005746/gse/blob/main/README.md) | 简体中文
 
 面向长期 agent 辅助软件项目的 Goal-Spec-Evidence Engineering。
 

package/SECURITY.md

@@ -1,41 +1,41 @@
-# Security Policy
-
-GSE is an agent workflow skill and scaffold. Security reports may involve scripts, generated project files, host adapters, package/install behavior, signing, release trust, or documentation that could cause unsafe claims.
-
-## Supported Scope
-
-Security-relevant areas include:
-
-- Package, install, URL install, manifest integrity, signing, and verification scripts.
-- Generated host adapters and command pointers.
-- Tool permission guidance, MCP/tool routing guidance, and release trust policy.
-- Evidence, logs, and templates that could leak secrets or raw provider payloads.
-- Documentation that could cause agents to bypass owner approval, license decisions, or unsupported host boundaries.
-
-## Reporting
-
-Until a public security contact is chosen, do not publish exploit details in public issues.
-
-Use the project owner's private reporting channel. If no channel exists, record the issue privately in the maintainers' current coordination channel and mark the public release status as blocked until a contact path exists.
-
-Minimum report contents:
-
-- Affected GSE version, release label, or commit.
-- Affected file or generated artifact.
-- Reproduction steps.
-- Impact and likely affected users or hosts.
-- Whether secrets, credentials, private prompts, provider payloads, or user data are involved.
-- Suggested mitigation if known.
-
-## Handling
-
-- Do not claim a fix is verified until a focused reproduction or audit proves the changed behavior.
-- Do not publish a release if signing, package integrity, or owner trust evidence is contradicted.
-- If a public package may be affected, use `references/release-trust.md` and `assets/templates/release-trust-record.md` to record revocation, rotation, and follow-up.
-- If a project-local GSE scaffold is affected, notify the affected project session or maintainer with the exact files and validation commands.
-
-## Current Limits
-
-- No public vulnerability disclosure address has been owner-approved yet.
-- Public marketplace approval and registry publication are not verified.
-- Host-native slash-command support is not verified unless a host-specific invocation record exists.
+# Security Policy
+
+GSE is an agent workflow skill and scaffold. Security reports may involve scripts, generated project files, host adapters, package/install behavior, signing, release trust, or documentation that could cause unsafe claims.
+
+## Supported Scope
+
+Security-relevant areas include:
+
+- Package, install, URL install, manifest integrity, signing, and verification scripts.
+- Generated host adapters and command pointers.
+- Tool permission guidance, MCP/tool routing guidance, and release trust policy.
+- Evidence, logs, and templates that could leak secrets or raw provider payloads.
+- Documentation that could cause agents to bypass owner approval, license decisions, or unsupported host boundaries.
+
+## Reporting
+
+Until a public security contact is chosen, do not publish exploit details in public issues.
+
+Use the project owner's private reporting channel. If no channel exists, record the issue privately in the maintainers' current coordination channel and mark the public release status as blocked until a contact path exists.
+
+Minimum report contents:
+
+- Affected GSE version, release label, or commit.
+- Affected file or generated artifact.
+- Reproduction steps.
+- Impact and likely affected users or hosts.
+- Whether secrets, credentials, private prompts, provider payloads, or user data are involved.
+- Suggested mitigation if known.
+
+## Handling
+
+- Do not claim a fix is verified until a focused reproduction or audit proves the changed behavior.
+- Do not publish a release if signing, package integrity, or owner trust evidence is contradicted.
+- If a public package may be affected, use `references/release-trust.md` and `assets/templates/release-trust-record.md` to record revocation, rotation, and follow-up.
+- If a project-local GSE scaffold is affected, notify the affected project session or maintainer with the exact files and validation commands.
+
+## Current Limits
+
+- No public vulnerability disclosure address has been owner-approved yet.
+- Public marketplace approval and registry publication are not verified.
+- Host-native slash-command support is not verified unless a host-specific invocation record exists.

package/SUPPORT.md

@@ -1,38 +1,38 @@
-# Support
-
-Use this file to decide where to start when GSE behavior is confusing, incomplete, or blocked.
-
-## First Checks
-
-Run:
-
-```text
-node scripts/validate-gse.mjs --root <gse-root> --json
-```
-
-For a target project using GSE, run:
-
-```text
-node scripts/audit-target-project.mjs --target <project-root> --json
-node scripts/generate-session-prompt.mjs --target <project-root>
-node scripts/audit-close-gate.mjs --target <project-root> --json
-```
-
-For package or install issues, run:
-
-```text
-node scripts/audit-distribution.mjs --root <gse-root> --json
-node scripts/audit-remote-distribution.mjs --root <gse-root> --json
-```
-
-## What To Include In A Support Request
-
-- GSE root path or installed package path.
-- Target project path, if any.
-- Command run and the compact JSON summary.
-- Whether the problem is skill usage, project scaffold, package/install, host adapter, release, or evidence gating.
-- Whether optional tools such as OpenSpec, Comet, Superpowers, LSP, browser automation, MCP, or subagents were actually available.
-
-## Community
-
-GateHub (`https://gatehub.top/`) supports GSE development and contributor coordination.
+# Support
+
+Use this file to decide where to start when GSE behavior is confusing, incomplete, or blocked.
+
+## First Checks
+
+Run:
+
+```text
+node scripts/validate-gse.mjs --root <gse-root> --json
+```
+
+For a target project using GSE, run:
+
+```text
+node scripts/audit-target-project.mjs --target <project-root> --json
+node scripts/generate-session-prompt.mjs --target <project-root>
+node scripts/audit-close-gate.mjs --target <project-root> --json
+```
+
+For package or install issues, run:
+
+```text
+node scripts/audit-distribution.mjs --root <gse-root> --json
+node scripts/audit-remote-distribution.mjs --root <gse-root> --json
+```
+
+## What To Include In A Support Request
+
+- GSE root path or installed package path.
+- Target project path, if any.
+- Command run and the compact JSON summary.
+- Whether the problem is skill usage, project scaffold, package/install, host adapter, release, or evidence gating.
+- Whether optional tools such as OpenSpec, Comet, Superpowers, LSP, browser automation, MCP, or subagents were actually available.
+
+## Community
+
+GateHub (`https://gatehub.top/`) supports GSE development and contributor coordination.