@t275005746/gse 0.1.0

package/assets/templates/host-ui-invocation-record.md

@@ -0,0 +1,42 @@
+# Host UI Invocation Record
+
+Use this when a real host UI, slash-command runtime, command palette, plugin UI, or background-thread host invokes GSE.
+
+## Host
+
+- Host name:
+- Host version:
+- Project:
+- Adapter path:
+- Invocation method:
+
+## Command
+
+```text
+/gse help
+```
+
+## Result
+
+- Status: result | verified | accepted | failed
+- Started at:
+- Finished at:
+- Evidence owner:
+
+## Evidence
+
+- Screenshot, transcript, thread id, terminal output, or host log:
+- Files read by the host:
+- Files written by the host:
+- Verification command:
+
+## Boundaries
+
+- Does this prove native slash-command support? true | false | unknown
+- Does this prove portable text-command routing only? true | false | unknown
+- Does this rely on a generated pointer file? true | false | unknown
+- Does this require owner acceptance before being called trusted? true | false | unknown
+
+## Residual Risk
+
+- 

package/assets/templates/incident-review.md

@@ -0,0 +1,60 @@
+# Incident Review
+
+## Summary
+
+- Incident title:
+- Date/time range:
+- Status: investigating | mitigated | resolved | follow-up
+- Owner:
+- Evidence status: result | verified | accepted
+
+## Impact
+
+- Affected users/systems:
+- Severity:
+- User-visible symptoms:
+- Data/security/privacy impact:
+- Release or rollback impact:
+
+## Timeline
+
+- Detected at:
+- Mitigated at:
+- Resolved at:
+- Key events:
+
+## Root Cause
+
+- Direct cause:
+- Contributing factors:
+- Why existing gates missed it:
+
+## What Detected It
+
+- Signal, report, test, monitor, or user feedback:
+- Detection gap:
+
+## Stabilization
+
+- Immediate action taken:
+- Rollback, revert, or mitigation:
+- Verification that stabilization worked:
+
+## What Prevents Recurrence
+
+- Prevention change:
+- New or updated gate:
+- Documentation, script, test, monitor, or ownership update:
+
+## Action Items
+
+| Action | Owner | Evidence needed | Due | Status |
+|---|---|---|---|---|
+|  |  |  |  |  |
+
+## Follow-Up Evidence
+
+- Evidence log:
+- Release/recovery record:
+- Remaining risk:
+- Next action:

package/assets/templates/public-channel-publication-record.md

@@ -0,0 +1,49 @@
+# Public Channel Publication Record
+
+Publication status: pending | accepted
+
+Channel type: github-release | package-registry | marketplace | catalog | other
+
+Channel name:
+
+Channel URL:
+
+Package or listing version:
+
+Artifact digest:
+
+Review or approval status:
+
+Evidence owner:
+
+Evidence date:
+
+Evidence URL or run id:
+
+## Verification
+
+Verification command:
+
+Verification result:
+
+## Acceptance
+
+Evidence status: pending | accepted
+
+Accepted by:
+
+Accepted at:
+
+## Boundaries
+
+- Does this prove public registry publication? true | false | unknown
+- Does this prove marketplace approval? true | false | unknown
+- Does this prove installability from the channel? true | false | unknown
+
+## Residual Risk
+
+-
+
+## Next Action
+
+-

package/assets/templates/public-ci-run-record.md

@@ -0,0 +1,53 @@
+# Public CI Run Record
+
+Repository URL:
+
+Workflow name:
+
+Workflow file:
+
+Run URL:
+
+Run status: pending | accepted
+
+Run conclusion: pending | success | failure | cancelled | skipped | timed_out | unknown
+
+Commit SHA:
+
+Branch:
+
+Required checks:
+
+Evidence owner:
+
+Evidence date:
+
+Evidence URL or run id:
+
+## Verification
+
+Verification command:
+
+Verification result:
+
+## Acceptance
+
+Evidence status: pending | accepted
+
+Accepted by:
+
+Accepted at:
+
+## Boundaries
+
+- Does this prove a public CI run?
+- Does this prove required checks passed?
+- Does this prove the current release commit?
+
+## Residual Risk
+
+-
+
+## Next Action
+
+-

package/assets/templates/public-release-record.md

@@ -0,0 +1,65 @@
+# Public Release Record
+
+Release name:
+
+Release version or label:
+
+Release date:
+
+Distribution channel:
+
+Release scope:
+
+## License
+
+License status: owner-required
+
+SPDX identifier:
+
+License file:
+
+Approved by:
+
+Decision date:
+
+Notes:
+
+## Artifacts
+
+Package or source path:
+
+Changelog path:
+
+Install/update instructions:
+
+Integrity or signing record:
+
+Marketplace/catalog record:
+
+## Verification
+
+Validation command:
+
+Validation result:
+
+Focused smoke:
+
+Acceptance evidence:
+
+## Risks
+
+Known unsupported claims:
+
+Known compatibility limits:
+
+Rollback or unpublish path:
+
+## Acceptance
+
+Evidence status: result
+
+Accepted by:
+
+Accepted at:
+
+Next action:

package/assets/templates/public-repository-settings-record.md

@@ -0,0 +1,59 @@
+# Public Repository Settings Record
+
+Repository URL:
+
+Default branch:
+
+Visibility: public | private | internal | unknown
+
+Settings status: pending | verified | accepted
+
+Evidence owner:
+
+Evidence date:
+
+Evidence URL or run id:
+
+## Required Public Settings
+
+- Issues enabled:
+- Pull requests enabled:
+- Discussions enabled:
+- Security policy visible:
+- Branch protection enabled:
+- Required status checks enabled:
+- Required checks:
+- Require review before merge:
+- Require conversation resolution:
+- Restrict force pushes:
+- Restrict deletions:
+
+## GSE-Specific Checks
+
+- CI workflow path: `.github/workflows/validate-gse.yml`
+- PR template path: `.github/PULL_REQUEST_TEMPLATE.md`
+- Issue templates path: `.github/ISSUE_TEMPLATE/`
+- Public release record path: `.gse/releases/public-release-owner-required.md`
+- Final acceptance packet path: `.gse/acceptance/final-acceptance-packet.md`
+
+## Verification
+
+Verification command:
+
+Verification result:
+
+## Acceptance
+
+Evidence status: pending | verified | accepted
+
+Accepted by:
+
+Accepted at:
+
+## Residual Risk
+
+-
+
+## Next Action
+
+-

package/assets/templates/public-security-contact-record.md

@@ -0,0 +1,45 @@
+# Public Security Contact Record
+
+Contact status: pending | accepted
+
+Contact type: email | url | github-security-advisory | other
+
+Contact value:
+
+Policy path: `SECURITY.md`
+
+Evidence owner:
+
+Evidence date:
+
+Evidence URL or run id:
+
+## Public Disclosure Policy
+
+- Is this contact public? true | false | unknown
+- Security policy updated? true | false | unknown
+- Private fallback channel:
+- Response expectation:
+- Embargo or disclosure notes:
+
+## Verification
+
+Verification command:
+
+Verification result:
+
+## Acceptance
+
+Evidence status: pending | accepted
+
+Accepted by:
+
+Accepted at:
+
+## Residual Risk
+
+-
+
+## Next Action
+
+-

package/assets/templates/release-trust-record.md

@@ -0,0 +1,32 @@
+# Release Trust Record
+
+Release label:
+Package digest:
+Public key fingerprint:
+Signing algorithm: ed25519
+
+## Release Owner
+
+Owner:
+Accepted by:
+Accepted at:
+
+## Key Custody
+
+Private key location:
+Signing environment:
+Rotation policy:
+Revocation path:
+
+## Verification
+
+Package URL:
+Public key URL or path:
+Signature path:
+Verification command:
+Install command:
+
+## Residual Risk
+
+## Notes
+

package/assets/templates/review.md

@@ -0,0 +1,18 @@
+# Review
+
+## Spec Compliance
+
+## Code Quality
+
+## Architecture / Ownership
+
+## Security / Privacy
+
+## Regression Risk
+
+## Evidence Review
+
+## Findings
+
+## Closure
+

package/assets/templates/spec.md

@@ -0,0 +1,16 @@
+# Spec
+
+## User Outcome
+
+## Behavior
+
+## State / Data Flow
+
+## Error and Recovery
+
+## Permissions and Privacy
+
+## Acceptance Criteria
+
+## Non-goals
+

package/assets/templates/target-adoption-evidence.md

@@ -0,0 +1,29 @@
+# Target Project Adoption Evidence
+
+Use this record when applying or testing GSE against a real target project without claiming broad certification.
+
+```text
+Target project:
+Adoption path: existing repo | fresh install | update existing GSE | host adapter | fresh session
+Project rules read:
+Files inspected:
+Files changed:
+Commands run:
+Detected project type:
+Detected package manager:
+Detected scripts:
+Host/tool statuses:
+Evidence status: result | verified | accepted | not ready
+Accepted by:
+Residual risks:
+Next action:
+```
+
+## Rules
+
+- Use `Files changed: none` for read-only adoption evidence.
+- Treat discovered commands, package scripts, config files, and host rules as `documented` until executed.
+- Treat tool availability as `unknown` unless the tool was actually checked in the current project/session.
+- Do not claim arbitrary real-repo certification from one target-project adoption record.
+- Do not claim host runtime support, subagent support, browser support, MCP support, CI support, release publication, or owner acceptance without direct evidence.
+- Keep `accepted` separate from `verified`; use `Accepted by: not accepted` unless a real acceptance gate ran.

package/assets/templates/tasks.md

@@ -0,0 +1,17 @@
+# Tasks
+
+## Slice Plan
+
+- [ ] Define outcome, scope, acceptance, evidence, risk, and next action.
+- [ ] Locate existing patterns and ownership boundaries.
+- [ ] Implement the smallest verifiable change.
+- [ ] Run focused verification.
+- [ ] Record evidence and residual risk.
+- [ ] Update state, goal map, and handoff notes when relevant.
+
+## Non-Goals
+
+## Dependencies
+
+## Stop Conditions
+

package/assets/templates/update-release-acceptance-record.md

@@ -0,0 +1,58 @@
+# Update Or Release Acceptance Record
+
+Use this in a project evidence log when a GSE update, workflow update, scaffold change, package release, or project release needs a compact acceptance record.
+
+Keep the record short. Link to command output, CI, smoke reports, or evidence files instead of pasting long logs.
+
+```text
+Record type: update | release | scaffold | adapter | incident hotfix
+Project path:
+Goal or slice:
+Release label or change id:
+Evidence status: result | verified | accepted | not ready
+
+Local decisions preserved:
+Files changed:
+Files intentionally not changed:
+Commands run:
+Focused verification:
+Compatibility evidence:
+Migration notes:
+Rollback notes:
+Owner or acceptance gate:
+Accepted by:
+Residual risks:
+Next action:
+```
+
+## Status Rules
+
+- `result`: the update, release notes, scaffold, adapter, or record exists.
+- `verified`: focused checks prove the affected behavior in the current environment, and residual risk is recorded.
+- `accepted`: the required owner, release policy, CI gate, smoke gate, archive gate, or explicitly named acceptance policy has accepted the verified result.
+- `not ready`: required evidence is missing, contradicted, or outside the current environment.
+
+## Anti-Overclaim Rules
+
+- Do not mark `accepted` only because `validate-gse.mjs`, tests, lint, or a local smoke passed.
+- Do not claim release publication, package install, production rollout, host runtime support, registry access, subagent support, MCP support, browser support, or owner approval unless the evidence names that gate.
+- Keep unavailable or unverified tools as `unknown`, `documented`, or `unavailable`; do not convert them to `verified` through this record.
+- If rollback is unknown, say `unknown`; do not infer rollback safety from file existence.
+- If the user or release owner has not accepted a user-visible or irreversible change, write `Accepted by: not accepted`.
+
+## Minimal Examples
+
+```text
+Evidence status: verified
+Focused verification: node <skill>/scripts/validate-gse.mjs --root <skill> passed
+Owner or acceptance gate: not required for internal template wording update
+Accepted by: policy: Lite focused smoke policy
+```
+
+```text
+Evidence status: verified
+Focused verification: npm run smoke passed in target project
+Owner or acceptance gate: release owner approval required
+Accepted by: not accepted
+Residual risks: production publish not executed; rollback not exercised
+```

package/examples/README.md

@@ -0,0 +1,22 @@
+# GSE Example Fixtures
+
+These fixtures are intentionally small. They are project shapes for forward tests and future agents, not full applications.
+
+Use `references/adoption-recipes.md` to map fixture behavior to fresh install, existing repo adoption, update, or host adapter adoption paths.
+
+## Fixtures
+
+| Fixture | Shape | GSE workflows it can exercise |
+|---|---|---|
+| `small-app` | JavaScript/TypeScript app shape with package scripts, CI, Playwright config, and `.env.example` | bootstrap, project-profile discovery, quality gates, release evidence |
+| `agent-runtime-host` | Agent-runtime product shape with `.gse/`, host adapter notes, MCP config placeholder, and runtime docs | host adapter, drift audit, recovery/handoff, tool/model status classification |
+| `cli-tool` | JavaScript/TypeScript CLI package shape with `bin`, smoke, build, lint, typecheck, and package dry-run scripts | package adoption, command smoke evidence, release dry-run evidence, project-profile discovery |
+
+## Rules
+
+- No secrets. Use `.env.example` with placeholder names only.
+- No lockfiles, caches, screenshots, build outputs, or generated noise.
+- Keep fixture files short enough for a future agent to inspect quickly.
+- Treat config presence as documented, not verified, until a focused command is run.
+- Use these fixtures for structural and fixture forward tests; do not claim fresh-session acceptance from fixture presence alone.
+- Run `node scripts/audit-fixtures.mjs --root <gse-skill-root> --json` for the repeatable fixture smoke.

package/examples/agent-runtime-host/.claude/gse-adapter.md

@@ -0,0 +1,6 @@
+# Claude Code Adapter
+
+Source of truth: `.gse/`.
+
+- Commands and agents should point back to `.gse/` for goals, evidence, quality gates, and learning rules.
+- Do not copy the goal map into this folder.

package/examples/agent-runtime-host/.codex/gse-adapter.md

@@ -0,0 +1,7 @@
+# Codex Adapter
+
+Source of truth: `.gse/`.
+
+- Read `.gse/project-profile.md` before using host-specific tools.
+- Mark subagent, MCP, browser, and LSP capabilities as verified only after current-session evidence.
+- Use `references/drift-audit.md` when adapter claims and current tools disagree.

package/examples/agent-runtime-host/.gse/goal-map.md

@@ -0,0 +1,7 @@
+# Goal Map
+
+## Current Focus
+
+- Priority: P1
+- Active slice: Verify host adapter and drift audit behavior.
+- Next action: Inspect host adapter notes before claiming capabilities.

package/examples/agent-runtime-host/.gse/project-profile.md

@@ -0,0 +1,27 @@
+# Project Profile
+
+## Identity
+
+- Product/system name: Example Runtime
+- Repository type: agent-runtime product fixture
+- Main languages/frameworks: TypeScript, Node.js
+
+## Tool Connections
+
+| Tool | Purpose | Command/config | Status |
+|---|---|---|---|
+| MCP | external tools/data | `.mcp.json` | documented |
+| Subagents | delegated work | host-specific | unknown |
+| Browser | UI smoke | not configured | unknown |
+| Model router | provider/model routing | docs/model-routing.md | documented |
+
+## Agent Host Adapters
+
+- Codex: `.codex/gse-adapter.md` documented.
+- Claude Code: `.claude/gse-adapter.md` documented.
+- Other hosts: unknown.
+
+## Known Gotchas
+
+- Config presence is documented, not verified.
+- Drift audit is required before trusting old host capability claims.

package/examples/agent-runtime-host/.gse/tooling.md

@@ -0,0 +1,5 @@
+# Tooling
+
+- MCP config: documented by `.mcp.json`, not verified.
+- Model routing docs: documented by `docs/model-routing.md`, not verified.
+- Subagent capability: unknown until host tools are visible in the active session.

package/examples/agent-runtime-host/.mcp.json

@@ -0,0 +1,9 @@
+{
+  "mcpServers": {
+    "fixture-docs": {
+      "command": "node",
+      "args": ["scripts/fixture-mcp.js"],
+      "status": "documented-not-verified"
+    }
+  }
+}

package/examples/agent-runtime-host/AGENTS.md

@@ -0,0 +1,5 @@
+# Fixture Agent Runtime Rules
+
+- Product identity in this fixture is `Example Runtime`; runtime internals are not user-facing product names.
+- `.gse/` is the portable source of truth.
+- Host folders are adapters and must not duplicate the goal map or evidence log.

package/examples/agent-runtime-host/README.md

@@ -0,0 +1,10 @@
+# agent-runtime-host fixture
+
+Purpose: representative agent-runtime product shape for host adapter, drift audit, recovery/handoff, and model/tool status tests.
+
+Suggested checks:
+
+- Inspect `.gse/project-profile.md` for host/tool status vocabulary.
+- Inspect `.codex/gse-adapter.md` and `.claude/gse-adapter.md` for `.gse/` source-of-truth pointers.
+- Run drift audit guidance against host capability claims and `.gse/tooling.md`.
+- Confirm no runtime or subagent capability is marked verified without evidence.

package/examples/agent-runtime-host/docs/model-routing.md

@@ -0,0 +1,5 @@
+# Model Routing Fixture
+
+- Default model route: unknown until provider config is verified.
+- Fallback policy: do not claim provider support from docs alone.
+- Privacy: avoid sending secrets or raw internal traces to model providers.

package/examples/cli-tool/.gse/project-profile.md

@@ -0,0 +1,21 @@
+# CLI Tool Project Profile
+
+Status: fixture documentation only.
+
+## Identity
+
+- Repository type: JavaScript/TypeScript CLI package.
+- Primary interface: package `bin` command.
+- User-visible risk: command output, exit codes, package install/update, and release notes.
+
+## Adoption Notes
+
+- Preserve existing package scripts and release metadata.
+- Treat `smoke`, `release:dry-run`, and `bin` entries as `documented` until executed.
+- Keep package manager, registry, signing, and publish permissions as `unknown` unless checked in the target project.
+
+## Suggested Evidence
+
+- Profile discovery result from `scripts/discover-project-profile.mjs`.
+- Focused CLI smoke such as `npm run smoke` or project equivalent.
+- Package dry-run evidence such as `npm pack --dry-run` when release scope is involved.