@t275005746/gse 0.1.0 → 0.1.2

package/assets/templates/public-security-contact-record.md

@@ -1,45 +1,45 @@
-# Public Security Contact Record
-
-Contact status: pending | accepted
-
-Contact type: email | url | github-security-advisory | other
-
-Contact value:
-
-Policy path: `SECURITY.md`
-
-Evidence owner:
-
-Evidence date:
-
-Evidence URL or run id:
-
-## Public Disclosure Policy
-
-- Is this contact public? true | false | unknown
-- Security policy updated? true | false | unknown
-- Private fallback channel:
-- Response expectation:
-- Embargo or disclosure notes:
-
-## Verification
-
-Verification command:
-
-Verification result:
-
-## Acceptance
-
-Evidence status: pending | accepted
-
-Accepted by:
-
-Accepted at:
-
-## Residual Risk
-
--
-
-## Next Action
-
--
+# Public Security Contact Record
+
+Contact status: pending | accepted
+
+Contact type: email | url | github-security-advisory | other
+
+Contact value:
+
+Policy path: `SECURITY.md`
+
+Evidence owner:
+
+Evidence date:
+
+Evidence URL or run id:
+
+## Public Disclosure Policy
+
+- Is this contact public? true | false | unknown
+- Security policy updated? true | false | unknown
+- Private fallback channel:
+- Response expectation:
+- Embargo or disclosure notes:
+
+## Verification
+
+Verification command:
+
+Verification result:
+
+## Acceptance
+
+Evidence status: pending | accepted
+
+Accepted by:
+
+Accepted at:
+
+## Residual Risk
+
+-
+
+## Next Action
+
+-

package/assets/templates/release-trust-record.md

@@ -1,32 +1,32 @@
-# Release Trust Record
-
-Release label:
-Package digest:
-Public key fingerprint:
-Signing algorithm: ed25519
-
-## Release Owner
-
-Owner:
-Accepted by:
-Accepted at:
-
-## Key Custody
-
-Private key location:
-Signing environment:
-Rotation policy:
-Revocation path:
-
-## Verification
-
-Package URL:
-Public key URL or path:
-Signature path:
-Verification command:
-Install command:
-
-## Residual Risk
-
-## Notes
-
+# Release Trust Record
+
+Release label:
+Package digest:
+Public key fingerprint:
+Signing algorithm: ed25519
+
+## Release Owner
+
+Owner:
+Accepted by:
+Accepted at:
+
+## Key Custody
+
+Private key location:
+Signing environment:
+Rotation policy:
+Revocation path:
+
+## Verification
+
+Package URL:
+Public key URL or path:
+Signature path:
+Verification command:
+Install command:
+
+## Residual Risk
+
+## Notes
+

package/assets/templates/review.md

@@ -1,18 +1,18 @@
-# Review
-
-## Spec Compliance
-
-## Code Quality
-
-## Architecture / Ownership
-
-## Security / Privacy
-
-## Regression Risk
-
-## Evidence Review
-
-## Findings
-
-## Closure
-
+# Review
+
+## Spec Compliance
+
+## Code Quality
+
+## Architecture / Ownership
+
+## Security / Privacy
+
+## Regression Risk
+
+## Evidence Review
+
+## Findings
+
+## Closure
+

package/assets/templates/role-fallback-packet.md

@@ -0,0 +1,49 @@
+# Role Fallback Packet
+
+Use this packet for one role in a real-subagent run, sequential fallback, or handoff session.
+
+## Dispatch Boundary
+
+- Execution mode: real-subagent | sequential-role | handoff-session
+- Real delegation used: yes | no
+- Host/tool used:
+- Tool status: verified | documented | unknown | unavailable
+- Fallback reason:
+- Dispatch evidence:
+
+## Role
+
+- Role: Planner | Locator | Implementer | Verifier | Reviewer | Docs/Evidence | Release
+- Skill focus:
+- Objective:
+- Non-goals:
+
+## Ownership
+
+- Allowed files:
+- Forbidden files:
+- Read-only files:
+- Shared files requiring coordinator review:
+- Pre-existing dirty files:
+
+## Required Inputs
+
+1.
+2.
+3.
+
+## Expected Output
+
+- Role output evidence:
+- Files inspected:
+- Files changed:
+- Verification command/check:
+- Evidence level: result | verified-unit | verified-component | verified-api | verified-browser | verified-ci | accepted-owner | accepted-release | external-required
+- Residual risk:
+- Stop condition:
+- Claim boundary:
+
+## Completion
+
+- Status: DONE | DONE_WITH_CONCERNS | NEEDS_CONTEXT | BLOCKED
+- Coordinator integration required: yes | no

package/assets/templates/spec.md

@@ -1,16 +1,16 @@
-# Spec
-
-## User Outcome
-
-## Behavior
-
-## State / Data Flow
-
-## Error and Recovery
-
-## Permissions and Privacy
-
-## Acceptance Criteria
-
-## Non-goals
-
+# Spec
+
+## User Outcome
+
+## Behavior
+
+## State / Data Flow
+
+## Error and Recovery
+
+## Permissions and Privacy
+
+## Acceptance Criteria
+
+## Non-goals
+

package/assets/templates/target-adoption-evidence.md

@@ -1,29 +1,29 @@
-# Target Project Adoption Evidence
-
-Use this record when applying or testing GSE against a real target project without claiming broad certification.
-
-```text
-Target project:
-Adoption path: existing repo | fresh install | update existing GSE | host adapter | fresh session
-Project rules read:
-Files inspected:
-Files changed:
-Commands run:
-Detected project type:
-Detected package manager:
-Detected scripts:
-Host/tool statuses:
-Evidence status: result | verified | accepted | not ready
-Accepted by:
-Residual risks:
-Next action:
-```
-
-## Rules
-
-- Use `Files changed: none` for read-only adoption evidence.
-- Treat discovered commands, package scripts, config files, and host rules as `documented` until executed.
-- Treat tool availability as `unknown` unless the tool was actually checked in the current project/session.
-- Do not claim arbitrary real-repo certification from one target-project adoption record.
-- Do not claim host runtime support, subagent support, browser support, MCP support, CI support, release publication, or owner acceptance without direct evidence.
-- Keep `accepted` separate from `verified`; use `Accepted by: not accepted` unless a real acceptance gate ran.
+# Target Project Adoption Evidence
+
+Use this record when applying or testing GSE against a real target project without claiming broad certification.
+
+```text
+Target project:
+Adoption path: existing repo | fresh install | update existing GSE | host adapter | fresh session
+Project rules read:
+Files inspected:
+Files changed:
+Commands run:
+Detected project type:
+Detected package manager:
+Detected scripts:
+Host/tool statuses:
+Evidence status: result | verified | accepted | not ready
+Accepted by:
+Residual risks:
+Next action:
+```
+
+## Rules
+
+- Use `Files changed: none` for read-only adoption evidence.
+- Treat discovered commands, package scripts, config files, and host rules as `documented` until executed.
+- Treat tool availability as `unknown` unless the tool was actually checked in the current project/session.
+- Do not claim arbitrary real-repo certification from one target-project adoption record.
+- Do not claim host runtime support, subagent support, browser support, MCP support, CI support, release publication, or owner acceptance without direct evidence.
+- Keep `accepted` separate from `verified`; use `Accepted by: not accepted` unless a real acceptance gate ran.

package/assets/templates/tasks.md

@@ -1,17 +1,17 @@
-# Tasks
-
-## Slice Plan
-
-- [ ] Define outcome, scope, acceptance, evidence, risk, and next action.
-- [ ] Locate existing patterns and ownership boundaries.
-- [ ] Implement the smallest verifiable change.
-- [ ] Run focused verification.
-- [ ] Record evidence and residual risk.
-- [ ] Update state, goal map, and handoff notes when relevant.
-
-## Non-Goals
-
-## Dependencies
-
-## Stop Conditions
-
+# Tasks
+
+## Slice Plan
+
+- [ ] Define outcome, scope, acceptance, evidence, risk, and next action.
+- [ ] Locate existing patterns and ownership boundaries.
+- [ ] Implement the smallest verifiable change.
+- [ ] Run focused verification.
+- [ ] Record evidence and residual risk.
+- [ ] Update state, goal map, and handoff notes when relevant.
+
+## Non-Goals
+
+## Dependencies
+
+## Stop Conditions
+

package/assets/templates/update-release-acceptance-record.md

@@ -1,58 +1,58 @@
-# Update Or Release Acceptance Record
-
-Use this in a project evidence log when a GSE update, workflow update, scaffold change, package release, or project release needs a compact acceptance record.
-
-Keep the record short. Link to command output, CI, smoke reports, or evidence files instead of pasting long logs.
-
-```text
-Record type: update | release | scaffold | adapter | incident hotfix
-Project path:
-Goal or slice:
-Release label or change id:
-Evidence status: result | verified | accepted | not ready
-
-Local decisions preserved:
-Files changed:
-Files intentionally not changed:
-Commands run:
-Focused verification:
-Compatibility evidence:
-Migration notes:
-Rollback notes:
-Owner or acceptance gate:
-Accepted by:
-Residual risks:
-Next action:
-```
-
-## Status Rules
-
-- `result`: the update, release notes, scaffold, adapter, or record exists.
-- `verified`: focused checks prove the affected behavior in the current environment, and residual risk is recorded.
-- `accepted`: the required owner, release policy, CI gate, smoke gate, archive gate, or explicitly named acceptance policy has accepted the verified result.
-- `not ready`: required evidence is missing, contradicted, or outside the current environment.
-
-## Anti-Overclaim Rules
-
-- Do not mark `accepted` only because `validate-gse.mjs`, tests, lint, or a local smoke passed.
-- Do not claim release publication, package install, production rollout, host runtime support, registry access, subagent support, MCP support, browser support, or owner approval unless the evidence names that gate.
-- Keep unavailable or unverified tools as `unknown`, `documented`, or `unavailable`; do not convert them to `verified` through this record.
-- If rollback is unknown, say `unknown`; do not infer rollback safety from file existence.
-- If the user or release owner has not accepted a user-visible or irreversible change, write `Accepted by: not accepted`.
-
-## Minimal Examples
-
-```text
-Evidence status: verified
-Focused verification: node <skill>/scripts/validate-gse.mjs --root <skill> passed
-Owner or acceptance gate: not required for internal template wording update
-Accepted by: policy: Lite focused smoke policy
-```
-
-```text
-Evidence status: verified
-Focused verification: npm run smoke passed in target project
-Owner or acceptance gate: release owner approval required
-Accepted by: not accepted
-Residual risks: production publish not executed; rollback not exercised
-```
+# Update Or Release Acceptance Record
+
+Use this in a project evidence log when a GSE update, workflow update, scaffold change, package release, or project release needs a compact acceptance record.
+
+Keep the record short. Link to command output, CI, smoke reports, or evidence files instead of pasting long logs.
+
+```text
+Record type: update | release | scaffold | adapter | incident hotfix
+Project path:
+Goal or slice:
+Release label or change id:
+Evidence status: result | verified | accepted | not ready
+
+Local decisions preserved:
+Files changed:
+Files intentionally not changed:
+Commands run:
+Focused verification:
+Compatibility evidence:
+Migration notes:
+Rollback notes:
+Owner or acceptance gate:
+Accepted by:
+Residual risks:
+Next action:
+```
+
+## Status Rules
+
+- `result`: the update, release notes, scaffold, adapter, or record exists.
+- `verified`: focused checks prove the affected behavior in the current environment, and residual risk is recorded.
+- `accepted`: the required owner, release policy, CI gate, smoke gate, archive gate, or explicitly named acceptance policy has accepted the verified result.
+- `not ready`: required evidence is missing, contradicted, or outside the current environment.
+
+## Anti-Overclaim Rules
+
+- Do not mark `accepted` only because `validate-gse.mjs`, tests, lint, or a local smoke passed.
+- Do not claim release publication, package install, production rollout, host runtime support, registry access, subagent support, MCP support, browser support, or owner approval unless the evidence names that gate.
+- Keep unavailable or unverified tools as `unknown`, `documented`, or `unavailable`; do not convert them to `verified` through this record.
+- If rollback is unknown, say `unknown`; do not infer rollback safety from file existence.
+- If the user or release owner has not accepted a user-visible or irreversible change, write `Accepted by: not accepted`.
+
+## Minimal Examples
+
+```text
+Evidence status: verified
+Focused verification: node <skill>/scripts/validate-gse.mjs --root <skill> passed
+Owner or acceptance gate: not required for internal template wording update
+Accepted by: policy: Lite focused smoke policy
+```
+
+```text
+Evidence status: verified
+Focused verification: npm run smoke passed in target project
+Owner or acceptance gate: release owner approval required
+Accepted by: not accepted
+Residual risks: production publish not executed; rollback not exercised
+```

package/examples/README.md

@@ -1,22 +1,22 @@
-# GSE Example Fixtures
-
-These fixtures are intentionally small. They are project shapes for forward tests and future agents, not full applications.
-
-Use `references/adoption-recipes.md` to map fixture behavior to fresh install, existing repo adoption, update, or host adapter adoption paths.
-
-## Fixtures
-
-| Fixture | Shape | GSE workflows it can exercise |
-|---|---|---|
-| `small-app` | JavaScript/TypeScript app shape with package scripts, CI, Playwright config, and `.env.example` | bootstrap, project-profile discovery, quality gates, release evidence |
-| `agent-runtime-host` | Agent-runtime product shape with `.gse/`, host adapter notes, MCP config placeholder, and runtime docs | host adapter, drift audit, recovery/handoff, tool/model status classification |
-| `cli-tool` | JavaScript/TypeScript CLI package shape with `bin`, smoke, build, lint, typecheck, and package dry-run scripts | package adoption, command smoke evidence, release dry-run evidence, project-profile discovery |
-
-## Rules
-
-- No secrets. Use `.env.example` with placeholder names only.
-- No lockfiles, caches, screenshots, build outputs, or generated noise.
-- Keep fixture files short enough for a future agent to inspect quickly.
-- Treat config presence as documented, not verified, until a focused command is run.
-- Use these fixtures for structural and fixture forward tests; do not claim fresh-session acceptance from fixture presence alone.
-- Run `node scripts/audit-fixtures.mjs --root <gse-skill-root> --json` for the repeatable fixture smoke.
+# GSE Example Fixtures
+
+These fixtures are intentionally small. They are project shapes for forward tests and future agents, not full applications.
+
+Use `references/adoption-recipes.md` to map fixture behavior to fresh install, existing repo adoption, update, or host adapter adoption paths.
+
+## Fixtures
+
+| Fixture | Shape | GSE workflows it can exercise |
+|---|---|---|
+| `small-app` | JavaScript/TypeScript app shape with package scripts, CI, Playwright config, and `.env.example` | bootstrap, project-profile discovery, quality gates, release evidence |
+| `agent-runtime-host` | Agent-runtime product shape with `.gse/`, host adapter notes, MCP config placeholder, and runtime docs | host adapter, drift audit, recovery/handoff, tool/model status classification |
+| `cli-tool` | JavaScript/TypeScript CLI package shape with `bin`, smoke, build, lint, typecheck, and package dry-run scripts | package adoption, command smoke evidence, release dry-run evidence, project-profile discovery |
+
+## Rules
+
+- No secrets. Use `.env.example` with placeholder names only.
+- No lockfiles, caches, screenshots, build outputs, or generated noise.
+- Keep fixture files short enough for a future agent to inspect quickly.
+- Treat config presence as documented, not verified, until a focused command is run.
+- Use these fixtures for structural and fixture forward tests; do not claim fresh-session acceptance from fixture presence alone.
+- Run `node scripts/audit-fixtures.mjs --root <gse-skill-root> --json` for the repeatable fixture smoke.

package/examples/agent-runtime-host/.claude/gse-adapter.md

@@ -1,6 +1,6 @@
-# Claude Code Adapter
-
-Source of truth: `.gse/`.
-
-- Commands and agents should point back to `.gse/` for goals, evidence, quality gates, and learning rules.
-- Do not copy the goal map into this folder.
+# Claude Code Adapter
+
+Source of truth: `.gse/`.
+
+- Commands and agents should point back to `.gse/` for goals, evidence, quality gates, and learning rules.
+- Do not copy the goal map into this folder.

package/examples/agent-runtime-host/.codex/gse-adapter.md

@@ -1,7 +1,7 @@
-# Codex Adapter
-
-Source of truth: `.gse/`.
-
-- Read `.gse/project-profile.md` before using host-specific tools.
-- Mark subagent, MCP, browser, and LSP capabilities as verified only after current-session evidence.
-- Use `references/drift-audit.md` when adapter claims and current tools disagree.
+# Codex Adapter
+
+Source of truth: `.gse/`.
+
+- Read `.gse/project-profile.md` before using host-specific tools.
+- Mark subagent, MCP, browser, and LSP capabilities as verified only after current-session evidence.
+- Use `references/drift-audit.md` when adapter claims and current tools disagree.

package/examples/agent-runtime-host/.gse/goal-map.md

@@ -1,7 +1,7 @@
-# Goal Map
-
-## Current Focus
-
-- Priority: P1
-- Active slice: Verify host adapter and drift audit behavior.
-- Next action: Inspect host adapter notes before claiming capabilities.
+# Goal Map
+
+## Current Focus
+
+- Priority: P1
+- Active slice: Verify host adapter and drift audit behavior.
+- Next action: Inspect host adapter notes before claiming capabilities.

package/examples/agent-runtime-host/.gse/project-profile.md

@@ -1,27 +1,27 @@
-# Project Profile
-
-## Identity
-
-- Product/system name: Example Runtime
-- Repository type: agent-runtime product fixture
-- Main languages/frameworks: TypeScript, Node.js
-
-## Tool Connections
-
-| Tool | Purpose | Command/config | Status |
-|---|---|---|---|
-| MCP | external tools/data | `.mcp.json` | documented |
-| Subagents | delegated work | host-specific | unknown |
-| Browser | UI smoke | not configured | unknown |
-| Model router | provider/model routing | docs/model-routing.md | documented |
-
-## Agent Host Adapters
-
-- Codex: `.codex/gse-adapter.md` documented.
-- Claude Code: `.claude/gse-adapter.md` documented.
-- Other hosts: unknown.
-
-## Known Gotchas
-
-- Config presence is documented, not verified.
-- Drift audit is required before trusting old host capability claims.
+# Project Profile
+
+## Identity
+
+- Product/system name: Example Runtime
+- Repository type: agent-runtime product fixture
+- Main languages/frameworks: TypeScript, Node.js
+
+## Tool Connections
+
+| Tool | Purpose | Command/config | Status |
+|---|---|---|---|
+| MCP | external tools/data | `.mcp.json` | documented |
+| Subagents | delegated work | host-specific | unknown |
+| Browser | UI smoke | not configured | unknown |
+| Model router | provider/model routing | docs/model-routing.md | documented |
+
+## Agent Host Adapters
+
+- Codex: `.codex/gse-adapter.md` documented.
+- Claude Code: `.claude/gse-adapter.md` documented.
+- Other hosts: unknown.
+
+## Known Gotchas
+
+- Config presence is documented, not verified.
+- Drift audit is required before trusting old host capability claims.

package/examples/agent-runtime-host/.gse/tooling.md

@@ -1,5 +1,5 @@
-# Tooling
-
-- MCP config: documented by `.mcp.json`, not verified.
-- Model routing docs: documented by `docs/model-routing.md`, not verified.
-- Subagent capability: unknown until host tools are visible in the active session.
+# Tooling
+
+- MCP config: documented by `.mcp.json`, not verified.
+- Model routing docs: documented by `docs/model-routing.md`, not verified.
+- Subagent capability: unknown until host tools are visible in the active session.

package/examples/agent-runtime-host/.mcp.json

@@ -1,9 +1,9 @@
-{
-  "mcpServers": {
-    "fixture-docs": {
-      "command": "node",
-      "args": ["scripts/fixture-mcp.js"],
-      "status": "documented-not-verified"
-    }
-  }
-}
+{
+  "mcpServers": {
+    "fixture-docs": {
+      "command": "node",
+      "args": ["scripts/fixture-mcp.js"],
+      "status": "documented-not-verified"
+    }
+  }
+}