@t275005746/gse 0.1.0

package/SKILL.md

@@ -0,0 +1,148 @@
+---
+name: gse
+description: Use GSE (Goal-Spec-Evidence Engineering) to initialize, operate, audit, or improve a commercial-grade agentic engineering workflow for long-running software projects. Use when starting or standardizing a project, planning complex work, coordinating multiple coding agents, creating goal maps/specs/evidence gates, setting project quality gates, or converting ad hoc development into a durable workflow across Codex, Claude Code, Hermes, WorkBuddy, and similar agents.
+---
+
+# GSE - Goal-Spec-Evidence Engineering
+
+GSE is a lightweight, tool-adaptive engineering operating model for AI-agent-assisted software projects.
+
+Core loop:
+
+```text
+Goal -> Spec -> Execute -> Evidence -> Learn
+```
+
+Default stance: keep the workflow as light as the task allows and as rigorous as the risk requires.
+
+## Start Here
+
+1. Use `references/router.md` to select the GSE route.
+2. Classify the task level using `references/task-levels.md`.
+3. If the user writes `/gse ...` or `gse: ...`, route through `references/commands.md`.
+4. For human-facing setup or overview, use `README.md` and `README.zh-CN.md`.
+5. If the project has `.gse/README.md`, read it before making changes.
+6. If the project has `.gse/state.json`, read it as the machine-readable project phase, current slice, tool status, last evidence, and residual-risk summary.
+7. If the project lacks `.gse/`, offer or run `node <skill>/scripts/init-project.mjs --target <project-root>`.
+   The default is `--mode auto`; use `--mode lite`, `--mode standard`, or `--mode enterprise` when the owner wants a specific scaffold.
+8. Read or create `.gse/project-profile.md` for project-specific standards, commands, tools, and permissions.
+9. For project adoption drift, run `node <skill>/scripts/audit-target-project.mjs --target <project-root>` before claiming a target project is GSE-ready.
+10. Use `references/operating-model.md` for the workflow and `references/tool-adapters.md` for optional tool routing.
+11. Use `references/host-adapters.md` when host-specific folders, hooks, skills, MCP, subagents, or runtime adapters are involved.
+12. For GSE improvements, run `references/benchmark-audit.md` to proactively find missing skill coverage.
+13. Before declaring GSE skill changes complete, run `node <skill>/scripts/validate-gse.mjs --root <skill>`.
+14. Before declaring completion, check `references/quality-gates.md`.
+15. Record reusable lessons using `references/learning-system.md`.
+
+Portable command helpers:
+
+- Short CLI wrapper: `node <skill>/scripts/gse.mjs status --target <project-root> --json`
+- Short continuation prompt: `node <skill>/scripts/generate-session-prompt.mjs --target <project-root>`
+- Portable command runner: `node <skill>/scripts/run-gse-command.mjs --target <project-root> --command "/gse continue"`
+- Validation profile runner: `node <skill>/scripts/run-validation-profile.mjs --target <project-root> --profile lite|standard|enterprise|release`
+- Command execution audit: `node <skill>/scripts/audit-command-execution.mjs --root <skill> --profile lite|full`
+- Close readiness check: `node <skill>/scripts/audit-close-gate.mjs --target <project-root>`
+- GSE owner/external action list: `node <skill>/scripts/run-gse-command.mjs --target <skill> --command "/gse owner-actions" --json --compact`
+- Owner/external live evidence probe: `node <skill>/scripts/run-gse-command.mjs --target <skill> --command "/gse probe --public-repo-url <url>" --json`
+- Release bundle dry-run/write route: `node <skill>/scripts/run-gse-command.mjs --target <skill> --command "/gse release" --json`
+- Package dry-run/write route: `node <skill>/scripts/run-gse-command.mjs --target <skill> --command "/gse package" --json`
+- Install dry-run/write route: `node <skill>/scripts/run-gse-command.mjs --target <skill> --command "/gse install --source <package-dir> --install-target <install-skill-dir>" --json`
+- Public release checklist route: `node <skill>/scripts/run-gse-command.mjs --target <skill> --command "/gse public-release" --json`
+- Learning capture route: `node <skill>/scripts/run-gse-command.mjs --target <project-root> --command "/gse learn --summary <lesson>" --execute --json`
+- Existing project state/index update: `node <skill>/scripts/update-project-state.mjs --target <project-root>`
+- Change spec pack: `node <skill>/scripts/init-change.mjs --target <project-root> --change-id <id> --level lite|standard|enterprise`
+- Public release record: `node <skill>/scripts/record-public-release.mjs --root <project-root> --license-status owner-required`
+- Release bundle: `node <skill>/scripts/generate-release-bundle.mjs --root <skill> --label <release-label> --out <bundle-dir>`
+- Owner/external gate kit: `node <skill>/scripts/generate-owner-external-gate-kit.mjs --root <skill-or-project>`
+
+## Required Questions Before Adding Process
+
+For every new GSE artifact, rule, or gate, answer briefly:
+
+- Is this step necessary for this task level?
+- Can it be shorter?
+- Can it be automated?
+- Can it degrade by project scale?
+- Is it friendly to future agents with limited context?
+- Does it prevent a real failure or improve quality measurably?
+
+If the answer is weak, defer the artifact or make it optional.
+
+## Evidence Rules
+
+- Do not state unverified tool behavior as fact. Label inferred behavior as an assumption.
+- Prefer local tool help, installed skill docs, project files, official docs, and focused experiments as evidence.
+- If a tool is unavailable, use the markdown fallback and say which enhancement was skipped.
+- Do not require OpenSpec, Comet, Superpowers, subagents, LSP, or browser automation. Use them when available and appropriate.
+
+## Minimal Outputs
+
+For normal work, always keep these five fields visible:
+
+```text
+Outcome:
+Scope:
+Acceptance:
+Evidence:
+Next action:
+```
+
+For long-running projects, bind the work to `.gse/goal-map.md` or the project's existing goal map.
+
+## Reference Routing
+
+- Project bootstrap: `references/project-bootstrap.md`
+- Command semantics: `references/commands.md`
+- Project adoption recipes: `references/adoption-recipes.md`
+- Validation profile runner: `scripts/run-validation-profile.mjs`, `scripts/audit-validation-profiles.mjs`
+- Target project doctor: `scripts/audit-target-project.mjs`
+- Route selection: `references/router.md`
+- Project-specific standards and tools: `references/project-profile.md`
+- Project-local agent workspace: `references/project-agent-workspace.md`
+- Host-specific adapters: `references/host-adapters.md`, `references/compatibility.md`
+- Benchmark and gap audit: `references/benchmark-audit.md`
+- Task level selection: `references/task-levels.md`
+- Goal maps: `references/goal-map.md`
+- Specs and change folders: `references/spec-workflow.md`
+- Agent roles and ownership: `references/agent-roles.md`, `references/file-ownership.md`
+- Tool acceleration and model routing: `references/tool-adapters.md`, `references/model-routing.md`
+- Review protocol: `references/review.md`
+- Architecture health scans: `references/architecture-health.md`
+- Quality gates: `references/quality-gates.md`
+- Domain quality gates: `references/domain-quality-gates.md`
+- Release workflow: `references/release.md`
+- Public release metadata: `references/public-release.md`
+- Open-source defaults: `references/open-source-defaults.md`
+- Community channels: `references/community-channels.md`
+- Public release decision audit: `scripts/audit-public-release-decision.mjs`
+- Public CI run: `scripts/record-public-ci-run.mjs`, `scripts/audit-public-ci-run.mjs`
+- Public security contact: `scripts/record-public-security-contact.mjs`, `scripts/audit-public-security-contact.mjs`
+- Public repository settings: `scripts/record-public-repository-settings.mjs`, `scripts/audit-public-repository-settings.mjs`
+- Public channel publication: `scripts/record-public-channel-publication.mjs`, `scripts/audit-public-channel-publication.mjs`
+- Public acceptance doctor: `scripts/audit-public-acceptance-readiness.mjs`
+- Public external gate probe: `scripts/probe-public-external-gates.mjs`, `scripts/audit-public-external-gate-probe.mjs`
+- Public acceptance handoff: `scripts/generate-public-acceptance-handoff.mjs`, `scripts/audit-public-acceptance-handoff.mjs`
+- Owner/external gate kit: `scripts/generate-owner-external-gate-kit.mjs`, `scripts/audit-owner-external-gate-kit.mjs`
+- Release status manifest: `scripts/generate-release-status-manifest.mjs`, `scripts/audit-release-status-manifest.mjs`
+- Release owner action plan: `scripts/generate-release-owner-action-plan.mjs`, `scripts/audit-release-owner-action-plan.mjs`
+- Release owner action plan drill: `scripts/audit-release-owner-action-plan-drill.mjs`
+- Public release checklist: `scripts/generate-public-release-checklist.mjs`, `scripts/audit-public-release-checklist.mjs`
+- Final-form progress report: `scripts/generate-final-form-progress-report.mjs`, `scripts/audit-final-form-progress-report.mjs`
+- Packaging and maintenance: `references/packaging.md`
+- CI readiness: `.github/workflows/validate-gse.yml`, `scripts/audit-ci-readiness.mjs`
+- Public collaboration templates: `.github/PULL_REQUEST_TEMPLATE.md`, `.github/ISSUE_TEMPLATE/`, `scripts/audit-public-collaboration-templates.mjs`
+- Release trust and key custody: `references/release-trust.md`
+- Marketplace discovery: `references/marketplace-discovery.md`
+- Host UI invocation record: `assets/templates/host-ui-invocation-record.md`
+- Host runtime invocation records: `scripts/record-host-invocation.mjs`, `scripts/audit-host-runtime-invocations.mjs`
+- Host runtime invocation drill: `scripts/audit-host-runtime-invocation-drill.mjs`
+- Host runtime evidence handoff: `scripts/generate-host-runtime-evidence-handoff.mjs`, `scripts/audit-host-runtime-evidence-handoff.mjs`
+- Final readiness matrix: `references/final-readiness.md`, `scripts/audit-final-readiness.mjs`
+- Final readiness promotion: `scripts/audit-final-readiness-promotion.mjs`
+- Final acceptance packet: `scripts/generate-final-acceptance-packet.mjs`, `scripts/audit-final-acceptance-packet.mjs`
+- Recovery and handoff: `references/recovery.md`
+- Forward testing: `references/forward-test.md`
+- Learning loop: `references/learning-system.md`
+- Learning capture: `scripts/record-learning.mjs`, `scripts/audit-learning-system.mjs`
+- Drift audit: `references/drift-audit.md`
+- Design basis and source boundaries: `references/design-basis.md`

package/SUPPORT.md

@@ -0,0 +1,38 @@
+# Support
+
+Use this file to decide where to start when GSE behavior is confusing, incomplete, or blocked.
+
+## First Checks
+
+Run:
+
+```text
+node scripts/validate-gse.mjs --root <gse-root> --json
+```
+
+For a target project using GSE, run:
+
+```text
+node scripts/audit-target-project.mjs --target <project-root> --json
+node scripts/generate-session-prompt.mjs --target <project-root>
+node scripts/audit-close-gate.mjs --target <project-root> --json
+```
+
+For package or install issues, run:
+
+```text
+node scripts/audit-distribution.mjs --root <gse-root> --json
+node scripts/audit-remote-distribution.mjs --root <gse-root> --json
+```
+
+## What To Include In A Support Request
+
+- GSE root path or installed package path.
+- Target project path, if any.
+- Command run and the compact JSON summary.
+- Whether the problem is skill usage, project scaffold, package/install, host adapter, release, or evidence gating.
+- Whether optional tools such as OpenSpec, Comet, Superpowers, LSP, browser automation, MCP, or subagents were actually available.
+
+## Community
+
+GateHub (`https://gatehub.top/`) supports GSE development and contributor coordination.

package/agents/openai.yaml

@@ -0,0 +1,4 @@
+interface:
+  display_name: "GSE"
+  short_description: "Goal-Spec-Evidence workflow system"
+  default_prompt: "Use $gse to standardize this project with goal maps, specs, evidence gates, and focused verification."

package/assets/marketplace/README.md

@@ -0,0 +1,7 @@
+# Marketplace Metadata
+
+This folder contains portable discovery metadata for publishing or listing GSE in a skill, plugin, or agent-workflow catalog.
+
+The metadata is intentionally host-neutral. It describes what GSE is, how to validate it, which entrypoints matter, and which host capabilities still require separate runtime evidence.
+
+Do not add maintainer secrets, local machine paths, private project names, or unverified marketplace approval claims here.

package/assets/marketplace/gse-listing.json

@@ -0,0 +1,75 @@
+{
+  "schemaVersion": 1,
+  "name": "gse",
+  "displayName": "GSE",
+  "tagline": "Goal-Spec-Evidence Engineering for long-running agentic software projects.",
+  "summary": "Goal-Spec-Evidence workflow skill for AI coding agents that turns ad hoc development into goal maps, scoped specs, focused execution, evidence gates, and reusable learning.",
+  "categories": [
+    "agentic engineering",
+    "software development workflow",
+    "spec-driven development",
+    "AI coding agents",
+    "project governance"
+  ],
+  "keywords": [
+    "GSE",
+    "Goal-Spec-Evidence",
+    "agentic engineering",
+    "spec-driven development",
+    "SDD",
+    "AI coding agent workflow",
+    "evidence gates",
+    "goal map",
+    "project scaffolding",
+    "OpenSpec-style changes",
+    "Superpowers-style execution"
+  ],
+  "hostSupport": [
+    {
+      "host": "Codex-style agents",
+      "status": "documented",
+      "adapter": ".codex/gse-command.md",
+      "notes": "Portable runner and pointer adapter are verified; project-level native slash-command execution is host-specific."
+    },
+    {
+      "host": "Claude Code-style agents",
+      "status": "documented",
+      "adapter": ".claude/commands/gse.md",
+      "notes": "Generated command file shape is verified in fixtures; real host invocation requires host runtime evidence."
+    },
+    {
+      "host": "Custom agent runtimes",
+      "status": "documented",
+      "adapter": "runtime-specific bridge",
+      "notes": "Runtime capabilities should be verified inside the target project before being marked verified."
+    }
+  ],
+  "entrypoints": [
+    "SKILL.md",
+    "package.json",
+    "README.md",
+    "README.zh-CN.md",
+    "scripts/init-project.mjs",
+    "scripts/run-gse-command.mjs",
+    "scripts/validate-gse.mjs",
+    "scripts/audit-npm-package-metadata.mjs",
+    "scripts/audit-npm-tarball-install.mjs"
+  ],
+  "verification": [
+    "node scripts/validate-gse.mjs --root . --json",
+    "node scripts/audit-npm-package-metadata.mjs --root . --json",
+    "node scripts/audit-marketplace-discovery.mjs --root . --json",
+    "node scripts/audit-host-ui-invocation.mjs --root . --json"
+  ],
+  "distribution": {
+    "packageScript": "scripts/package-gse.mjs",
+    "installScript": "scripts/install-gse.mjs",
+    "signingScript": "scripts/sign-gse-package.mjs",
+    "trustPolicy": "references/release-trust.md"
+  },
+  "boundaries": [
+    "GSE is not a hosted service.",
+    "GSE does not require OpenSpec, Superpowers, Comet, MCP, LSP, browser automation, or subagents.",
+    "Marketplace approval, maintainer identity, and native host UI invocation require separate evidence."
+  ]
+}

package/assets/templates/acceptance-execution-packet.md

@@ -0,0 +1,73 @@
+# Acceptance Execution Packet
+
+Use this packet when GSE needs external acceptance evidence instead of another structural audit.
+
+Choose exactly one path per packet.
+
+```text
+Acceptance path: fresh-session | owner-approved project write
+Target project or session:
+Purpose:
+Required inputs:
+Allowed files:
+Forbidden files:
+Allowed commands:
+Forbidden commands:
+Expected output:
+Evidence record path:
+Acceptance gate:
+Accepted by:
+Stop conditions:
+Residual risk if incomplete:
+Next action after completion:
+```
+
+## Fresh-Session Path
+
+Use when a separate session, thread, host worker, or equivalent can run the GSE continuation path without hidden conversation history.
+
+Required inputs:
+
+- `SKILL.md`
+- `.gse/gse-design-master-plan.md`
+- `.gse/goal-map.md`
+- `.gse/current-slice.md`
+- `references/forward-test.md`
+- `references/evidence-taxonomy.md`
+
+Acceptance gate: the separate session identifies the current slice, states outcome/scope/acceptance/evidence/risk/next action, runs or describes the smallest valid verification, and records `Accepted by: fresh-session` only if it actually executed the packet.
+
+## Owner-Approved Project Write Path
+
+Use when a target project owner explicitly allows GSE to write project-local `.gse/` adoption or update artifacts.
+
+Required inputs:
+
+- Project owner approval text or issue/task link.
+- Target project rule file such as `AGENTS.md`, `CLAUDE.md`, or README.
+- `references/adoption-recipes.md`
+- `assets/templates/target-adoption-evidence.md`
+- `assets/templates/update-release-acceptance-record.md`
+
+Default allowed files:
+
+- `.gse/README.md`
+- `.gse/project-profile.md`
+- `.gse/goal-map.md`
+- `.gse/quality-gates.md`
+- `.gse/tooling.md`
+- `.gse/evidence/YYYY-MM-DD.md`
+
+Default forbidden files:
+
+- Source code, lockfiles, secrets, generated outputs, screenshots, build artifacts, and unrelated host config.
+
+Acceptance gate: the owner-approved project record exists, project-local verification ran, residual risks are recorded, and the owner or named policy accepts the verified record.
+
+## Anti-Overclaim Rules
+
+- Do not write `Accepted by: fresh-session` unless a separate session actually ran the packet.
+- Do not write `Accepted by: owner` unless owner approval is explicit and recorded.
+- Do not treat a generated packet, local validation, fixture audit, or read-only discovery as acceptance.
+- Do not expand allowed files or commands without updating the packet and recording why.
+- If a stop condition occurs, record `Evidence status: not ready` or `verified` with `Accepted by: not accepted`.

package/assets/templates/adr.md

@@ -0,0 +1,14 @@
+# ADR-0000: Title
+
+## Status
+
+Proposed
+
+## Context
+
+## Decision
+
+## Consequences
+
+## Alternatives Considered
+

package/assets/templates/change-brief.md

@@ -0,0 +1,16 @@
+# Change Brief
+
+## Outcome
+
+## Scope
+
+## Non-goals
+
+## Acceptance
+
+## Evidence Plan
+
+## Risks
+
+## Next Action
+

package/assets/templates/design.md

@@ -0,0 +1,18 @@
+# Design
+
+## Approach
+
+## State / Data Flow
+
+## Interfaces And Contracts
+
+## Permissions And Privacy
+
+## Error And Recovery
+
+## Alternatives Considered
+
+## Rollback
+
+## Open Questions
+

package/assets/templates/dispatch-packet.md

@@ -0,0 +1,104 @@
+# Dispatch Packet
+
+Use this when assigning work to a real subagent, another human/agent session, or a sequential role simulation in the main session.
+
+Do not require this packet for tiny single-agent edits. Use it when delegation, role separation, file ownership, or review evidence matters.
+
+## Execution Mode
+
+- Mode: real-subagent | sequential-role | handoff-session
+- Host/tool used:
+- Tool status: verified | documented | unknown | unavailable
+- If not real-subagent, state fallback reason:
+
+## Role
+
+- Role: Coordinator | Product Analyst | Architect | Code Locator | Builder | Reviewer | QA | Docs/Evidence | Other:
+- Skill focus:
+- Model/tool preference, if project-approved:
+
+## Objective
+
+- Outcome:
+- Scope:
+- Non-goals:
+- User-visible impact:
+
+## Required Context
+
+Read these first:
+
+1.
+2.
+3.
+
+Do not read:
+
+- Generated outputs:
+- Historical logs:
+- Unrelated modules:
+
+Known assumptions:
+
+- Verified facts:
+- Design judgments:
+- Open questions:
+
+## File Ownership
+
+- Allowed files:
+- Forbidden files:
+- Read-only files:
+- Shared files requiring coordinator review:
+- Pre-existing dirty files:
+- Release condition:
+
+Follow `references/file-ownership.md`. Do not overwrite user or unrelated agent changes.
+
+## Task Instructions
+
+- Steps to perform:
+- Existing patterns to follow:
+- Constraints:
+- Performance/security/accessibility/privacy notes:
+
+## Expected Output
+
+Return a concise report with:
+
+- Status: DONE | DONE_WITH_CONCERNS | NEEDS_CONTEXT | BLOCKED
+- Files inspected:
+- Files changed:
+- Summary of work:
+- Verification run:
+- Evidence produced:
+- Residual risks:
+- Questions or blockers:
+
+## Verification
+
+- Required focused test/smoke/check:
+- Acceptable evidence level: result | verified | accepted
+- What proves success:
+- What would fail the task:
+
+## Stop Conditions
+
+Stop and report `NEEDS_CONTEXT` or `BLOCKED` if:
+
+- Required context is missing or contradictory.
+- Allowed files are insufficient for the requested change.
+- Target files contain unrelated dirty changes that make merging unsafe.
+- A tool claimed by the packet is unavailable.
+- The task requires broader architecture or product judgment than assigned.
+
+## Review Requirements
+
+- Spec compliance review required: yes | no
+- Code quality review required: yes | no
+- QA/evidence review required: yes | no
+- Coordinator integration required: yes | no
+
+## Notes For Sequential Fallback
+
+When no real subagent tool exists, use this packet as a role checklist in the main session. Say that no real delegation occurred if reporting delegation status matters. Keep role boundaries honest.

package/assets/templates/evidence.md

@@ -0,0 +1,14 @@
+# Evidence
+
+## Verification Commands
+
+## Results
+
+## Files Changed
+
+## User-Visible Outcome
+
+## Residual Risk
+
+## Follow-up
+

package/assets/templates/execution-quality-pack.md

@@ -0,0 +1,65 @@
+# Execution Quality Pack
+
+Use this when a change needs explicit execution skills, tool routing, quality gates, and review boundaries.
+
+## Task Profile
+
+- Level: lite | standard | enterprise
+- Change type:
+- User-visible impact:
+- Data/security/release impact:
+
+## Required Skills Or Roles
+
+| Role / Skill | Purpose | Required | Evidence |
+|---|---|---|---|
+| Coordinator | Scope, final judgment, integration | yes | plan/state/evidence |
+| Code Locator | Files, symbols, existing tests | when code changes | search/LSP notes |
+| Builder | Bounded implementation | when files change | diff + focused check |
+| QA / Verification | Focused proof | yes | command/browser/API smoke |
+| Reviewer | Spec, quality, architecture, security | risk-based | review notes |
+
+## Tool Routing
+
+| Tool | Use When | Status | Fallback |
+|---|---|---|---|
+| rg / rg --files | Code and doc location | recommended | shell listing |
+| LSP / index | Large or typed codebase | unknown | rg + existing tests |
+| Browser / Playwright | UI or user-visible flow | unknown | component/API smoke plus notes |
+| OpenSpec | Capability/API/state contract change | optional | .gse/changes/ markdown |
+| Comet | Full lifecycle change | optional | GSE phase/status files |
+| Superpowers | Complex staged execution/review | optional | GSE roles + quality gates |
+| Subagents | Parallel bounded work | unknown | sequential role execution |
+
+## Quality Gates Selected
+
+```text
+Universal:
+Code:
+UI:
+API/state:
+Security/privacy:
+Performance/cost:
+Resilience/recovery:
+Release/operations:
+```
+
+## Evidence Plan
+
+```text
+Focused command:
+Browser/API smoke:
+Manual inspection:
+Not run and why:
+Evidence status: result | verified | accepted | not ready
+```
+
+## Review And Closure
+
+- Spec compliance:
+- Code quality:
+- Architecture/ownership:
+- Residual risk:
+- Close gate command:
+- Next action:
+

package/assets/templates/goal-map.md

@@ -0,0 +1,21 @@
+# Goal Map
+
+Updated: YYYY-MM-DD
+
+## North Star
+
+## Current Focus
+
+- Priority:
+- Active slice:
+- Next action:
+
+## Goal Nodes
+
+| ID | Goal | Status | Priority | Evidence | Next Slice |
+|---|---|---|---|---|---|
+
+## Risks
+
+## Next 3 Slices
+

package/assets/templates/host-adapter.md

@@ -0,0 +1,48 @@
+# Host Adapter
+
+## Host
+
+- Name:
+- Adapter path:
+- Maintainer:
+- Last checked:
+
+## Source Of Truth
+
+Portable workflow source: `.gse/`
+
+Read first:
+
+1. `.gse/project-profile.md`
+2. `.gse/goal-map.md`
+3. `.gse/quality-gates.md`
+4. Relevant `.gse/changes/` or `.gse/evidence/` files
+
+## Verified Capabilities
+
+| Capability | Command/config | Status | Evidence |
+|---|---|---|---|
+| Project rules | - | unknown | - |
+| Skills/commands | - | unknown | - |
+| Subagents | - | unknown | - |
+| MCP/tools | - | unknown | - |
+| LSP/index | - | unknown | - |
+| Browser/UI verification | - | unknown | - |
+| CI/build/test | - | unknown | - |
+
+## Host-Specific Start
+
+Describe the shortest host-specific instruction that makes this host read `.gse/` first.
+
+## Safety And Permissions
+
+- Secrets:
+- Write-capable tools:
+- Destructive commands:
+- Network/external services:
+
+## Drift Check
+
+- Check cadence:
+- What must stay in `.gse/`:
+- What may stay host-specific: