@t275005746/gse 0.1.0 → 0.1.1

package/assets/templates/public-release-record.md

@@ -1,65 +1,65 @@
-# Public Release Record
-
-Release name:
-
-Release version or label:
-
-Release date:
-
-Distribution channel:
-
-Release scope:
-
-## License
-
-License status: owner-required
-
-SPDX identifier:
-
-License file:
-
-Approved by:
-
-Decision date:
-
-Notes:
-
-## Artifacts
-
-Package or source path:
-
-Changelog path:
-
-Install/update instructions:
-
-Integrity or signing record:
-
-Marketplace/catalog record:
-
-## Verification
-
-Validation command:
-
-Validation result:
-
-Focused smoke:
-
-Acceptance evidence:
-
-## Risks
-
-Known unsupported claims:
-
-Known compatibility limits:
-
-Rollback or unpublish path:
-
-## Acceptance
-
-Evidence status: result
-
-Accepted by:
-
-Accepted at:
-
-Next action:
+# Public Release Record
+
+Release name:
+
+Release version or label:
+
+Release date:
+
+Distribution channel:
+
+Release scope:
+
+## License
+
+License status: owner-required
+
+SPDX identifier:
+
+License file:
+
+Approved by:
+
+Decision date:
+
+Notes:
+
+## Artifacts
+
+Package or source path:
+
+Changelog path:
+
+Install/update instructions:
+
+Integrity or signing record:
+
+Marketplace/catalog record:
+
+## Verification
+
+Validation command:
+
+Validation result:
+
+Focused smoke:
+
+Acceptance evidence:
+
+## Risks
+
+Known unsupported claims:
+
+Known compatibility limits:
+
+Rollback or unpublish path:
+
+## Acceptance
+
+Evidence status: result
+
+Accepted by:
+
+Accepted at:
+
+Next action:

package/assets/templates/public-repository-settings-record.md

@@ -1,59 +1,59 @@
-# Public Repository Settings Record
-
-Repository URL:
-
-Default branch:
-
-Visibility: public | private | internal | unknown
-
-Settings status: pending | verified | accepted
-
-Evidence owner:
-
-Evidence date:
-
-Evidence URL or run id:
-
-## Required Public Settings
-
-- Issues enabled:
-- Pull requests enabled:
-- Discussions enabled:
-- Security policy visible:
-- Branch protection enabled:
-- Required status checks enabled:
-- Required checks:
-- Require review before merge:
-- Require conversation resolution:
-- Restrict force pushes:
-- Restrict deletions:
-
-## GSE-Specific Checks
-
-- CI workflow path: `.github/workflows/validate-gse.yml`
-- PR template path: `.github/PULL_REQUEST_TEMPLATE.md`
-- Issue templates path: `.github/ISSUE_TEMPLATE/`
-- Public release record path: `.gse/releases/public-release-owner-required.md`
-- Final acceptance packet path: `.gse/acceptance/final-acceptance-packet.md`
-
-## Verification
-
-Verification command:
-
-Verification result:
-
-## Acceptance
-
-Evidence status: pending | verified | accepted
-
-Accepted by:
-
-Accepted at:
-
-## Residual Risk
-
--
-
-## Next Action
-
--
+# Public Repository Settings Record
+
+Repository URL:
+
+Default branch:
+
+Visibility: public | private | internal | unknown
+
+Settings status: pending | verified | accepted
+
+Evidence owner:
+
+Evidence date:
+
+Evidence URL or run id:
+
+## Required Public Settings
+
+- Issues enabled:
+- Pull requests enabled:
+- Discussions enabled:
+- Security policy visible:
+- Branch protection enabled:
+- Required status checks enabled:
+- Required checks:
+- Require review before merge:
+- Require conversation resolution:
+- Restrict force pushes:
+- Restrict deletions:
+
+## GSE-Specific Checks
+
+- CI workflow path: `.github/workflows/validate-gse.yml`
+- PR template path: `.github/PULL_REQUEST_TEMPLATE.md`
+- Issue templates path: `.github/ISSUE_TEMPLATE/`
+- Public release record path: `.gse/releases/public-release-owner-required.md`
+- Final acceptance packet path: `.gse/acceptance/final-acceptance-packet.md`
+
+## Verification
+
+Verification command:
+
+Verification result:
+
+## Acceptance
+
+Evidence status: pending | verified | accepted
+
+Accepted by:
+
+Accepted at:
+
+## Residual Risk
+
+-
+
+## Next Action
+
+-

package/assets/templates/public-security-contact-record.md

@@ -1,45 +1,45 @@
-# Public Security Contact Record
-
-Contact status: pending | accepted
-
-Contact type: email | url | github-security-advisory | other
-
-Contact value:
-
-Policy path: `SECURITY.md`
-
-Evidence owner:
-
-Evidence date:
-
-Evidence URL or run id:
-
-## Public Disclosure Policy
-
-- Is this contact public? true | false | unknown
-- Security policy updated? true | false | unknown
-- Private fallback channel:
-- Response expectation:
-- Embargo or disclosure notes:
-
-## Verification
-
-Verification command:
-
-Verification result:
-
-## Acceptance
-
-Evidence status: pending | accepted
-
-Accepted by:
-
-Accepted at:
-
-## Residual Risk
-
--
-
-## Next Action
-
--
+# Public Security Contact Record
+
+Contact status: pending | accepted
+
+Contact type: email | url | github-security-advisory | other
+
+Contact value:
+
+Policy path: `SECURITY.md`
+
+Evidence owner:
+
+Evidence date:
+
+Evidence URL or run id:
+
+## Public Disclosure Policy
+
+- Is this contact public? true | false | unknown
+- Security policy updated? true | false | unknown
+- Private fallback channel:
+- Response expectation:
+- Embargo or disclosure notes:
+
+## Verification
+
+Verification command:
+
+Verification result:
+
+## Acceptance
+
+Evidence status: pending | accepted
+
+Accepted by:
+
+Accepted at:
+
+## Residual Risk
+
+-
+
+## Next Action
+
+-

package/assets/templates/release-trust-record.md

@@ -1,32 +1,32 @@
-# Release Trust Record
-
-Release label:
-Package digest:
-Public key fingerprint:
-Signing algorithm: ed25519
-
-## Release Owner
-
-Owner:
-Accepted by:
-Accepted at:
-
-## Key Custody
-
-Private key location:
-Signing environment:
-Rotation policy:
-Revocation path:
-
-## Verification
-
-Package URL:
-Public key URL or path:
-Signature path:
-Verification command:
-Install command:
-
-## Residual Risk
-
-## Notes
-
+# Release Trust Record
+
+Release label:
+Package digest:
+Public key fingerprint:
+Signing algorithm: ed25519
+
+## Release Owner
+
+Owner:
+Accepted by:
+Accepted at:
+
+## Key Custody
+
+Private key location:
+Signing environment:
+Rotation policy:
+Revocation path:
+
+## Verification
+
+Package URL:
+Public key URL or path:
+Signature path:
+Verification command:
+Install command:
+
+## Residual Risk
+
+## Notes
+

package/assets/templates/review.md

@@ -1,18 +1,18 @@
-# Review
-
-## Spec Compliance
-
-## Code Quality
-
-## Architecture / Ownership
-
-## Security / Privacy
-
-## Regression Risk
-
-## Evidence Review
-
-## Findings
-
-## Closure
-
+# Review
+
+## Spec Compliance
+
+## Code Quality
+
+## Architecture / Ownership
+
+## Security / Privacy
+
+## Regression Risk
+
+## Evidence Review
+
+## Findings
+
+## Closure
+

package/assets/templates/spec.md

@@ -1,16 +1,16 @@
-# Spec
-
-## User Outcome
-
-## Behavior
-
-## State / Data Flow
-
-## Error and Recovery
-
-## Permissions and Privacy
-
-## Acceptance Criteria
-
-## Non-goals
-
+# Spec
+
+## User Outcome
+
+## Behavior
+
+## State / Data Flow
+
+## Error and Recovery
+
+## Permissions and Privacy
+
+## Acceptance Criteria
+
+## Non-goals
+

package/assets/templates/target-adoption-evidence.md

@@ -1,29 +1,29 @@
-# Target Project Adoption Evidence
-
-Use this record when applying or testing GSE against a real target project without claiming broad certification.
-
-```text
-Target project:
-Adoption path: existing repo | fresh install | update existing GSE | host adapter | fresh session
-Project rules read:
-Files inspected:
-Files changed:
-Commands run:
-Detected project type:
-Detected package manager:
-Detected scripts:
-Host/tool statuses:
-Evidence status: result | verified | accepted | not ready
-Accepted by:
-Residual risks:
-Next action:
-```
-
-## Rules
-
-- Use `Files changed: none` for read-only adoption evidence.
-- Treat discovered commands, package scripts, config files, and host rules as `documented` until executed.
-- Treat tool availability as `unknown` unless the tool was actually checked in the current project/session.
-- Do not claim arbitrary real-repo certification from one target-project adoption record.
-- Do not claim host runtime support, subagent support, browser support, MCP support, CI support, release publication, or owner acceptance without direct evidence.
-- Keep `accepted` separate from `verified`; use `Accepted by: not accepted` unless a real acceptance gate ran.
+# Target Project Adoption Evidence
+
+Use this record when applying or testing GSE against a real target project without claiming broad certification.
+
+```text
+Target project:
+Adoption path: existing repo | fresh install | update existing GSE | host adapter | fresh session
+Project rules read:
+Files inspected:
+Files changed:
+Commands run:
+Detected project type:
+Detected package manager:
+Detected scripts:
+Host/tool statuses:
+Evidence status: result | verified | accepted | not ready
+Accepted by:
+Residual risks:
+Next action:
+```
+
+## Rules
+
+- Use `Files changed: none` for read-only adoption evidence.
+- Treat discovered commands, package scripts, config files, and host rules as `documented` until executed.
+- Treat tool availability as `unknown` unless the tool was actually checked in the current project/session.
+- Do not claim arbitrary real-repo certification from one target-project adoption record.
+- Do not claim host runtime support, subagent support, browser support, MCP support, CI support, release publication, or owner acceptance without direct evidence.
+- Keep `accepted` separate from `verified`; use `Accepted by: not accepted` unless a real acceptance gate ran.

package/assets/templates/tasks.md

@@ -1,17 +1,17 @@
-# Tasks
-
-## Slice Plan
-
-- [ ] Define outcome, scope, acceptance, evidence, risk, and next action.
-- [ ] Locate existing patterns and ownership boundaries.
-- [ ] Implement the smallest verifiable change.
-- [ ] Run focused verification.
-- [ ] Record evidence and residual risk.
-- [ ] Update state, goal map, and handoff notes when relevant.
-
-## Non-Goals
-
-## Dependencies
-
-## Stop Conditions
-
+# Tasks
+
+## Slice Plan
+
+- [ ] Define outcome, scope, acceptance, evidence, risk, and next action.
+- [ ] Locate existing patterns and ownership boundaries.
+- [ ] Implement the smallest verifiable change.
+- [ ] Run focused verification.
+- [ ] Record evidence and residual risk.
+- [ ] Update state, goal map, and handoff notes when relevant.
+
+## Non-Goals
+
+## Dependencies
+
+## Stop Conditions
+

package/assets/templates/update-release-acceptance-record.md

@@ -1,58 +1,58 @@
-# Update Or Release Acceptance Record
-
-Use this in a project evidence log when a GSE update, workflow update, scaffold change, package release, or project release needs a compact acceptance record.
-
-Keep the record short. Link to command output, CI, smoke reports, or evidence files instead of pasting long logs.
-
-```text
-Record type: update | release | scaffold | adapter | incident hotfix
-Project path:
-Goal or slice:
-Release label or change id:
-Evidence status: result | verified | accepted | not ready
-
-Local decisions preserved:
-Files changed:
-Files intentionally not changed:
-Commands run:
-Focused verification:
-Compatibility evidence:
-Migration notes:
-Rollback notes:
-Owner or acceptance gate:
-Accepted by:
-Residual risks:
-Next action:
-```
-
-## Status Rules
-
-- `result`: the update, release notes, scaffold, adapter, or record exists.
-- `verified`: focused checks prove the affected behavior in the current environment, and residual risk is recorded.
-- `accepted`: the required owner, release policy, CI gate, smoke gate, archive gate, or explicitly named acceptance policy has accepted the verified result.
-- `not ready`: required evidence is missing, contradicted, or outside the current environment.
-
-## Anti-Overclaim Rules
-
-- Do not mark `accepted` only because `validate-gse.mjs`, tests, lint, or a local smoke passed.
-- Do not claim release publication, package install, production rollout, host runtime support, registry access, subagent support, MCP support, browser support, or owner approval unless the evidence names that gate.
-- Keep unavailable or unverified tools as `unknown`, `documented`, or `unavailable`; do not convert them to `verified` through this record.
-- If rollback is unknown, say `unknown`; do not infer rollback safety from file existence.
-- If the user or release owner has not accepted a user-visible or irreversible change, write `Accepted by: not accepted`.
-
-## Minimal Examples
-
-```text
-Evidence status: verified
-Focused verification: node <skill>/scripts/validate-gse.mjs --root <skill> passed
-Owner or acceptance gate: not required for internal template wording update
-Accepted by: policy: Lite focused smoke policy
-```
-
-```text
-Evidence status: verified
-Focused verification: npm run smoke passed in target project
-Owner or acceptance gate: release owner approval required
-Accepted by: not accepted
-Residual risks: production publish not executed; rollback not exercised
-```
+# Update Or Release Acceptance Record
+
+Use this in a project evidence log when a GSE update, workflow update, scaffold change, package release, or project release needs a compact acceptance record.
+
+Keep the record short. Link to command output, CI, smoke reports, or evidence files instead of pasting long logs.
+
+```text
+Record type: update | release | scaffold | adapter | incident hotfix
+Project path:
+Goal or slice:
+Release label or change id:
+Evidence status: result | verified | accepted | not ready
+
+Local decisions preserved:
+Files changed:
+Files intentionally not changed:
+Commands run:
+Focused verification:
+Compatibility evidence:
+Migration notes:
+Rollback notes:
+Owner or acceptance gate:
+Accepted by:
+Residual risks:
+Next action:
+```
+
+## Status Rules
+
+- `result`: the update, release notes, scaffold, adapter, or record exists.
+- `verified`: focused checks prove the affected behavior in the current environment, and residual risk is recorded.
+- `accepted`: the required owner, release policy, CI gate, smoke gate, archive gate, or explicitly named acceptance policy has accepted the verified result.
+- `not ready`: required evidence is missing, contradicted, or outside the current environment.
+
+## Anti-Overclaim Rules
+
+- Do not mark `accepted` only because `validate-gse.mjs`, tests, lint, or a local smoke passed.
+- Do not claim release publication, package install, production rollout, host runtime support, registry access, subagent support, MCP support, browser support, or owner approval unless the evidence names that gate.
+- Keep unavailable or unverified tools as `unknown`, `documented`, or `unavailable`; do not convert them to `verified` through this record.
+- If rollback is unknown, say `unknown`; do not infer rollback safety from file existence.
+- If the user or release owner has not accepted a user-visible or irreversible change, write `Accepted by: not accepted`.
+
+## Minimal Examples
+
+```text
+Evidence status: verified
+Focused verification: node <skill>/scripts/validate-gse.mjs --root <skill> passed
+Owner or acceptance gate: not required for internal template wording update
+Accepted by: policy: Lite focused smoke policy
+```
+
+```text
+Evidence status: verified
+Focused verification: npm run smoke passed in target project
+Owner or acceptance gate: release owner approval required
+Accepted by: not accepted
+Residual risks: production publish not executed; rollback not exercised
+```