@t275005746/gse 0.1.0

package/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,42 @@
+name: Bug report
+description: Report a reproducible GSE workflow, install, validation, or host-adapter issue.
+title: "[Bug]: "
+labels: ["bug", "needs-evidence"]
+body:
+  - type: textarea
+    id: outcome
+    attributes:
+      label: Outcome
+      description: What should have happened?
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+      description: What happened instead?
+    validations:
+      required: true
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Reproduction
+      description: Minimal commands, project shape, or host steps.
+      placeholder: |
+        node scripts/validate-gse.mjs --root . --json
+    validations:
+      required: true
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Evidence
+      description: Focused logs, audit output, host invocation record, or screenshots. Do not paste secrets.
+    validations:
+      required: true
+  - type: textarea
+    id: risk
+    attributes:
+      label: Risk and claim boundary
+      description: Note whether this affects install, release, public CI, native slash commands, or host support claims.
+    validations:
+      required: true

package/.github/ISSUE_TEMPLATE/change_request.yml

@@ -0,0 +1,50 @@
+name: Change request
+description: Propose a GSE capability, adapter, gate, template, or workflow change.
+title: "[Change]: "
+labels: ["change", "needs-spec"]
+body:
+  - type: textarea
+    id: goal
+    attributes:
+      label: Goal
+      description: What durable GSE capability should become true?
+    validations:
+      required: true
+  - type: textarea
+    id: spec
+    attributes:
+      label: Spec
+      description: Outcome, scope, acceptance, evidence, risk, and next action.
+      placeholder: |
+        Outcome:
+        Scope:
+        Acceptance:
+        Evidence:
+        Risk:
+        Next action:
+    validations:
+      required: true
+  - type: dropdown
+    id: level
+    attributes:
+      label: Task level
+      options:
+        - lite
+        - standard
+        - enterprise
+    validations:
+      required: true
+  - type: textarea
+    id: tools
+    attributes:
+      label: Tool or host impact
+      description: Which hosts, scripts, adapters, CI, package, marketplace, or release gates are affected?
+    validations:
+      required: true
+  - type: textarea
+    id: evidence
+    attributes:
+      label: Proposed evidence
+      description: Which focused audit, test, or external record would prove this?
+    validations:
+      required: true

package/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Support boundary
+    url: https://github.com/
+    about: Read SUPPORT.md before filing broad usage questions. Replace this placeholder URL when the public repository URL is owner-approved.

package/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,38 @@
+## Outcome
+
+What does this change make true for GSE users or maintainers?
+
+## Scope
+
+Changed files or areas:
+
+- 
+
+Out of scope:
+
+- 
+
+## Acceptance
+
+How should reviewers know this is complete?
+
+- 
+
+## Evidence
+
+Commands, logs, screenshots, or records:
+
+- [ ] `node scripts/validate-gse.mjs --root . --json`
+- [ ] Focused audit or test:
+
+## Risk
+
+Residual risk, unsupported claims, migration notes, or rollback path:
+
+- 
+
+## Claim Boundary
+
+- [ ] This PR does not claim public release acceptance unless owner/public evidence is attached.
+- [ ] This PR does not claim host-native support unless a host invocation record is attached.
+- [ ] This PR does not duplicate `.gse/` policy in host-specific folders.

package/.github/workflows/validate-gse.yml

@@ -0,0 +1,33 @@
+name: Validate GSE
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+      - master
+  workflow_dispatch:
+
+jobs:
+  validate:
+    name: Validate skill package
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+
+      - name: Run GSE validation
+        run: node scripts/validate-gse.mjs --root . --skip-skill-validator --json
+
+      - name: Audit final readiness boundaries
+        run: node scripts/audit-final-readiness.mjs --root . --json
+
+      - name: Audit final acceptance packet
+        run: node scripts/audit-final-acceptance-packet.mjs --root . --json

package/.gse/README.md

@@ -0,0 +1,18 @@
+# GSE Self-Development Workspace
+
+This folder tracks development of the GSE skill itself.
+
+Read order:
+
+1. `SKILL.md`
+2. `.gse/state.json`
+3. `.gse/project-profile.md`
+4. `.gse/goal-map.md`
+5. `.gse/quality-gates.md`
+6. `.gse/current-slice.md`
+7. `.gse/gse-design-master-plan.md`
+8. `.gse/evidence/index.jsonl`
+
+The canonical product plan is `.gse/gse-design-master-plan.md`.
+
+Keep this folder short and evidence-driven. Long command output belongs in terminal logs, not in roadmap files.

package/.gse/gse-development-protocol.md

@@ -0,0 +1,50 @@
+# GSE Development Protocol
+
+This file governs changes to the GSE skill itself.
+
+## Purpose
+
+GSE development must be proactive. When improving this skill, do not wait for the user to discover missing workflow requirements through manual testing.
+
+## Required Loop For GSE Changes
+
+1. Read `SKILL.md`, `.gse/goal-map.md`, and `.gse/current-slice.md`.
+2. Classify the GSE change: wording, reference, template, script, scaffold, adapter, validation, or release.
+3. Run or update `references/benchmark-audit.md` for any non-trivial change.
+4. Compare against verified mature sources before adding design goals.
+5. Separate verified facts, design judgments, and open questions.
+6. Prefer scripts/templates over prose when the behavior should be repeatable.
+7. Validate the changed behavior with focused smoke tests.
+8. Update `.gse/evidence/YYYY-MM-DD.md` and the short goal map status.
+
+## Benchmark Sources To Check First
+
+- `skill-creator` for skill structure, progressive disclosure, validation, and forward testing.
+- `mattpocock/skills` snapshot for setup skill, router, domain docs, TDD, review, and architecture scan patterns.
+- `comet` for state machine, phase detection, OpenSpec/Superpowers split, verification, and archive rules.
+- `openspec-*` for proposal/design/tasks/spec lifecycle.
+- `agentic-engineering` for eval-first loop, decomposition, model routing, session strategy, and cost discipline.
+- `subagent-driven-development` for role isolation, dispatch packets, review loops, and no fake delegation.
+- `self-improvement` for reusable learning capture and promotion.
+
+## Design Bar
+
+A GSE change should improve at least one of these:
+
+- New-agent startup success.
+- Long-project continuity.
+- Requirement completeness before implementation.
+- Evidence quality.
+- Tool efficiency without hard prerequisites.
+- Cross-agent portability.
+- Failure prevention or recovery.
+- Learning reuse.
+
+## Anti-Patterns
+
+- Adding process because it sounds professional but does not prevent a real failure.
+- Copying a tool-specific folder layout as the portable source of truth.
+- Treating optional tools as required.
+- Claiming a benchmark source says something without reading it.
+- Letting GSE become only documentation with no scripts, templates, or validation.
+

package/.gse/project-profile.md

@@ -0,0 +1,29 @@
+# Project Profile
+
+## Product
+
+GSE is a portable Goal-Spec-Evidence Engineering skill for long-running agent-assisted software projects.
+
+## Canonical Plan
+
+- Master plan: `.gse/gse-design-master-plan.md`
+- Goal map: `.gse/goal-map.md`
+- Current slice: `.gse/current-slice.md`
+- Evidence index: `.gse/evidence/index.jsonl`
+
+## Commands
+
+- Full validation: `node scripts/validate-gse.mjs --root <skill-root> --json`
+- Structural audit: `node scripts/audit-gse.mjs --root <skill-root> --json`
+- Change pack audit: `node scripts/audit-change-system.mjs --root <skill-root> --json`
+- Close gate: `node scripts/audit-close-gate.mjs --target <skill-root> --json`
+
+## Tool Notes
+
+- This skill folder is not a git repository.
+- Use `py` instead of bare `python` for skill validator commands on this machine.
+- Keep OpenSpec, Superpowers, Comet, subagents, MCP, LSP, and browser automation optional unless current-session evidence proves they are available.
+
+## Ownership
+
+Do not mark GSE v1.0 complete until configured target-project evidence confirms real consumption or an explicit owner acceptance policy replaces that requirement.

package/.gse/quality-gates.md

@@ -0,0 +1,25 @@
+# Quality Gates
+
+## Universal
+
+- One slice must have outcome, scope, acceptance, evidence, risk, and next action.
+- Do not claim external tools ran unless command output or host evidence proves it.
+- Keep `result`, `verified`, and `accepted` distinct.
+- Preserve optional adapters: GSE must work without OpenSpec, Superpowers, Comet, subagents, MCP, LSP, or browser tooling.
+
+## GSE Skill Changes
+
+- Run `node scripts/validate-gse.mjs --root <skill-root> --json` before closing a GSE skill change.
+- For change/spec behavior, run `node scripts/audit-change-system.mjs --root <skill-root> --json`.
+- For README or command behavior, ensure the relevant audit remains wired into `scripts/validate-gse.mjs`.
+- Update `.gse/evidence/YYYY-MM-DD.md` and `.gse/evidence/index.jsonl` for verified slices.
+
+## Target-Project Claims
+
+- Use `scripts/audit-target-project.mjs` before claiming a target project is GSE-ready.
+- Use `scripts/audit-close-gate.mjs` before saying a slice can close.
+- Real project adoption still needs project-specific tests, smokes, or owner acceptance according to that repo's rules.
+
+## Release Boundary
+
+Local validation is not marketplace release, external install verification, CI publication, or owner acceptance.

package/.gse/releases/public-channel-publication-pending.md

@@ -0,0 +1,49 @@
+# Public Channel Publication Record
+
+Publication status: accepted
+
+Channel type: catalog
+
+Channel name: GSE GitHub Pages catalog
+
+Channel URL: https://275005746.github.io/gse/
+
+Package or listing version: 0.1.0
+
+Artifact digest: 
+
+Review or approval status: published
+
+Evidence owner: 275005746
+
+Evidence date: 2026-07-08
+
+Evidence URL or run id: https://275005746.github.io/gse/
+
+## Verification
+
+Verification command: Invoke-WebRequest https://275005746.github.io/gse/
+
+Verification result: passed
+
+## Acceptance
+
+Evidence status: accepted
+
+Accepted by: 275005746
+
+Accepted at: 2026-07-08
+
+## Boundaries
+
+- Does this prove public registry publication? unknown
+- Does this prove marketplace approval? true
+- Does this prove installability from the channel? true
+
+## Residual Risk
+
+- Public channel publication is not accepted until real external evidence is attached.
+
+## Next Action
+
+- Attach public channel publication evidence and re-run final readiness.

package/.gse/releases/public-ci-run-pending.md

@@ -0,0 +1,53 @@
+# Public CI Run Record
+
+Repository URL: https://github.com/275005746/gse
+
+Workflow name: Validate GSE
+
+Workflow file: .github/workflows/validate-gse.yml
+
+Run URL: https://github.com/275005746/gse/actions/runs/28881044974
+
+Run status: accepted
+
+Run conclusion: success
+
+Commit SHA: 81c3c5a97272bce51e65f1b4ffb15e2ff77b4569
+
+Branch: main
+
+Required checks: Validate skill package
+
+Evidence owner: 275005746
+
+Evidence date: 2026-07-08
+
+Evidence URL or run id: https://github.com/275005746/gse/actions/runs/28881044974
+
+## Verification
+
+Verification command: node scripts/validate-gse.mjs --root . --json
+
+Verification result: passed
+
+## Acceptance
+
+Evidence status: accepted
+
+Accepted by: 275005746
+
+Accepted at: 2026-07-08
+
+## Boundaries
+
+- Does this prove a public CI run? true
+- Does this prove required checks passed? true
+- Does this prove the current release commit? true
+
+## Residual Risk
+
+- Public CI run is not accepted until real external run evidence is attached.
+
+## Next Action
+
+- Attach public CI run evidence and re-run final readiness.

package/.gse/releases/public-release-owner-required.md

@@ -0,0 +1,65 @@
+# Public Release Record
+
+Release name: GSE
+
+Release version or label: public-defaults
+
+Release date: 2026-07-06
+
+Distribution channel: github-public-repo-and-release-planned
+
+Release scope: GSE public release metadata and distribution readiness
+
+## License
+
+License status: selected
+
+SPDX identifier: MIT
+
+License file: LICENSE
+
+Approved by: owner-confirmed-in-current-codex-thread
+
+Decision date: 2026-07-07
+
+Notes: Owner-selected license decision recorded.
+
+## Artifacts
+
+Package or source path: <install-skill-dir>
+
+Changelog path: CHANGELOG.md
+
+Install/update instructions: references/packaging.md
+
+Integrity or signing record: references/release-trust.md
+
+Marketplace/catalog record: references/marketplace-discovery.md
+
+## Verification
+
+Validation command: node scripts/validate-gse.mjs --root <skill> --json
+
+Validation result: pending current run
+
+Focused smoke: scripts/audit-public-release-metadata.mjs
+
+Acceptance evidence: Owner license decision accepted; public release still requires remaining public and host evidence.
+
+## Risks
+
+Known unsupported claims: public marketplace approval, public registry publication, legal suitability, and host-native slash-command runtime support are not implied by this record.
+
+Known compatibility limits: host behavior must be verified per host runtime.
+
+Rollback or unpublish path: remove public listing/package and publish corrected release record.
+
+## Acceptance
+
+Evidence status: accepted
+
+Accepted by: owner-confirmed-in-current-codex-thread
+
+Accepted at: 2026-07-07
+
+Next action: Run release validation and preserve acceptance evidence.

package/.gse/releases/public-repository-settings-owner-required.md

@@ -0,0 +1,59 @@
+# Public Repository Settings Record
+
+Repository URL: https://github.com/275005746/gse
+
+Default branch: main
+
+Visibility: public
+
+Settings status: accepted
+
+Evidence owner: 275005746
+
+Evidence date: 2026-07-07
+
+Evidence URL or run id: https://api.github.com/repos/275005746/gse/branches/main/protection
+
+## Required Public Settings
+
+- Issues enabled: true
+- Pull requests enabled: true
+- Discussions enabled: unknown
+- Security policy visible: true
+- Branch protection enabled: true
+- Required status checks enabled: true
+- Required checks: Validate skill package
+- Require review before merge: true
+- Require conversation resolution: true
+- Restrict force pushes: true
+- Restrict deletions: true
+
+## GSE-Specific Checks
+
+- CI workflow path: `.github/workflows/validate-gse.yml`
+- PR template path: `.github/PULL_REQUEST_TEMPLATE.md`
+- Issue templates path: `.github/ISSUE_TEMPLATE/`
+- Public release record path: `.gse/releases/public-release-owner-required.md`
+- Final acceptance packet path: `.gse/acceptance/final-acceptance-packet.md`
+
+## Verification
+
+Verification command: node scripts/validate-gse.mjs --root . --json
+
+Verification result: passed
+
+## Acceptance
+
+Evidence status: accepted
+
+Accepted by: 275005746
+
+Accepted at: 2026-07-07
+
+## Residual Risk
+
+- Public repository settings are not verified until owner/external evidence is attached.
+
+## Next Action
+
+- Attach public repository settings evidence and re-run repository settings audit.

package/.gse/releases/public-security-contact-owner-required.md

@@ -0,0 +1,45 @@
+# Public Security Contact Record
+
+Contact status: accepted
+
+Contact type: url
+
+Contact value: https://github.com/275005746/gse/blob/main/SECURITY.md
+
+Policy path: `SECURITY.md`
+
+Evidence owner: 275005746
+
+Evidence date: 2026-07-07
+
+Evidence URL or run id: https://github.com/275005746/gse/blob/main/SECURITY.md
+
+## Public Disclosure Policy
+
+- Is this contact public? true
+- Security policy updated? true
+- Private fallback channel: owner private coordination channel
+- Response expectation: pending owner policy
+- Embargo or disclosure notes: Do not publish exploit details until the public contact is owner-accepted.
+
+## Verification
+
+Verification command: node scripts/audit-open-source-readiness.mjs --root . --json
+
+Verification result: pending
+
+## Acceptance
+
+Evidence status: accepted
+
+Accepted by: 275005746
+
+Accepted at: 2026-07-07
+
+## Residual Risk
+
+- Public security contact is not accepted until owner evidence is attached.
+
+## Next Action
+
+- Attach owner-approved public security contact evidence and re-run final readiness.

package/.gse/state.json

@@ -0,0 +1,27 @@
+{
+  "schemaVersion": 1,
+  "projectName": "gse",
+  "mode": "enterprise",
+  "canonicalPlan": ".gse/gse-design-master-plan.md",
+  "phase": "release",
+  "currentSlice": {
+    "id": "GSE-108-public-registry-publication",
+    "outcome": "Complete the real public registry publication gate for @t275005746/gse, then record accepted publication evidence.",
+    "status": "blocked-external-auth",
+    "nextAction": "Publish @t275005746/gse to npm with an authorized token, record the accepted package-registry publication evidence, then collect real native slash-command host evidence."
+  },
+  "toolStatuses": {
+    "browser": "unknown",
+    "lsp": "unknown",
+    "mcp": "unknown",
+    "subagents": "unknown",
+    "ci": "verified-public"
+  },
+  "lastEvidence": ".gse/evidence/2026-07-07.md",
+  "residualRisks": [
+    "Public registry publication remains external-required because @t275005746/gse is not yet published on npm.",
+    "Native slash-command support remains external-required until a real host runtime proves native /gse invocation with accepted evidence.",
+    "Do not treat portable text-command routing, generated command pointers, package dry-runs, local tarball installs, or release bundles as public registry publication or native slash-command evidence.",
+    "Use /gse doctor and audit-public-acceptance-readiness.mjs as the current source of truth for pending final-form gates."
+  ]
+}

package/CHANGELOG.md

@@ -0,0 +1,24 @@
+# Changelog
+
+All notable GSE changes should be recorded here before a public package, catalog entry, or release handoff is marked ready.
+
+## Unreleased
+
+### Added
+
+- Project bootstrap modes for Lite, Standard, and Enterprise `.gse/` scaffolds.
+- Native Goal-Spec-Evidence operating model with change packs, execution-quality packs, evidence taxonomy, close gates, and target project audits.
+- Portable `/gse` command semantics plus a host-neutral command runner.
+- Local package/install, URL install with manifest integrity, Ed25519 signing, verification, and signed install audits.
+- Release trust, marketplace discovery metadata, host invocation evidence records, and public-release metadata guidance.
+
+### Verified
+
+- `validate-gse.mjs` consolidates structural, project bootstrap, adoption, host adapter, compatibility, release, distribution, signing, command, target validation, and lifecycle audits.
+- AION and MuseFlow were used as real long-running target-project validation fixtures for GSE adoption checks.
+
+### Not Yet Accepted
+
+- Public registry publication and marketplace approval are not verified.
+- Host-native slash-command execution is not verified except where a host-specific record explicitly says so.
+- Open-source license selection remains an owner decision and must be recorded before a public release is accepted.