@tekyzinc/gsd-t 2.20.7 → 2.22.0

package/README.md

@@ -18,7 +18,7 @@ A methodology for reliable, parallelizable development using Claude Code with op
 npx @tekyzinc/gsd-t install
 ```
 
-This installs 38 GSD-T commands + 3 utility commands to `~/.claude/commands/` and the global CLAUDE.md to `~/.claude/CLAUDE.md`. Works on Windows, Mac, and Linux.
+This installs 39 GSD-T commands + 3 utility commands to `~/.claude/commands/` and the global CLAUDE.md to `~/.claude/CLAUDE.md`. Works on Windows, Mac, and Linux.
 
 ### Start Using It
 
@@ -129,6 +129,7 @@ This will replace changed command files, back up your CLAUDE.md if customized, a
 | `/user:gsd-t-impact` | Analyze downstream effects | In wave |
 | `/user:gsd-t-execute` | Run tasks (solo or team) | In wave |
 | `/user:gsd-t-test-sync` | Sync tests with code changes | In wave |
+| `/user:gsd-t-qa` | QA agent — test generation, execution, gap reporting | Auto-spawned |
 | `/user:gsd-t-integrate` | Wire domains together | In wave |
 | `/user:gsd-t-verify` | Run quality gates | In wave |
 | `/user:gsd-t-complete-milestone` | Archive + git tag | In wave |
@@ -145,6 +146,7 @@ This will replace changed command files, back up your CLAUDE.md if customized, a
 | `/user:gsd-t-log` | Sync progress Decision Log with recent git activity | Manual |
 | `/user:gsd-t-version-update` | Update GSD-T to latest version | Manual |
 | `/user:gsd-t-version-update-all` | Update GSD-T + all registered projects | Manual |
+| `/user:gsd-t-triage-and-merge` | Auto-review, merge, and publish GitHub branches | Manual |
 
 ### Backlog Management
 
@@ -281,8 +283,9 @@ get-stuff-done-teams/
 ├── LICENSE
 ├── bin/
 │   └── gsd-t.js                       # CLI installer
-├── commands/                          # 41 slash commands
+├── commands/                          # 42 slash commands
 │   ├── gsd-t-*.md                     # 38 GSD-T workflow commands
+│   ├── gsd.md                         # GSD-T smart router
 │   ├── branch.md                      # Git branch helper
 │   ├── checkin.md                     # Auto-version + commit/push helper
 │   └── Claude-md.md                   # Reload CLAUDE.md directives

package/bin/gsd-t.js

@@ -104,6 +104,10 @@ function ensureDir(dir) {
     fs.mkdirSync(dir, { recursive: true });
     return true;
   }
+  if (isSymlink(dir)) {
+    warn(`Refusing to use symlinked directory: ${dir}`);
+    return false;
+  }
   return false;
 }
 
@@ -133,7 +137,12 @@ function validateVersion(ver) {
 
 function validateProjectPath(p) {
   try {
-    return path.isAbsolute(p) && fs.existsSync(p) && fs.statSync(p).isDirectory();
+    if (!path.isAbsolute(p) || !fs.existsSync(p)) return false;
+    const stat = fs.statSync(p);
+    if (!stat.isDirectory()) return false;
+    // On Unix, verify directory is owned by current user (defense-in-depth)
+    if (typeof process.getuid === "function" && stat.uid !== process.getuid()) return false;
+    return true;
   } catch {
     return false;
   }
@@ -381,19 +390,7 @@ function configureHeartbeatHooks(scriptPath) {
 
 // ─── Commands ────────────────────────────────────────────────────────────────
 
-function doInstall(opts = {}) {
-  const isUpdate = opts.update || false;
-  const verb = isUpdate ? "Updating" : "Installing";
-
-  heading(`${verb} GSD-T ${versionLink()}`);
-  log("");
-
-  // 1. Create ~/.claude/commands/ if needed
-  if (ensureDir(COMMANDS_DIR)) {
-    success("Created ~/.claude/commands/");
-  }
-
-  // 2. Copy all command files
+function installCommands(isUpdate) {
   heading("Slash Commands");
   const commandFiles = getCommandFiles();
   const gsdtCommands = getGsdtCommands();
@@ -406,7 +403,6 @@ function doInstall(opts = {}) {
     const dest = path.join(COMMANDS_DIR, file);
 
     if (isUpdate && fs.existsSync(dest)) {
-      // Compare content — only overwrite if changed
       const srcContent = fs.readFileSync(src, "utf8");
       const destContent = fs.readFileSync(dest, "utf8");
       if (normalizeEol(srcContent) === normalizeEol(destContent)) {
@@ -423,8 +419,10 @@ function doInstall(opts = {}) {
     info(`${skipped} commands unchanged`);
   }
   success(`${gsdtCommands.length} GSD-T commands + ${utilityCommands.length} utilities ${isUpdate ? "updated" : "installed"} → ~/.claude/commands/`);
+  return { gsdtCommands, utilityCommands };
+}
 
-  // 3. Handle global CLAUDE.md
+function installGlobalClaudeMd(isUpdate) {
   heading("Global CLAUDE.md");
   const globalSrc = path.join(PKG_TEMPLATES, "CLAUDE-global.md");
 
@@ -433,12 +431,10 @@ function doInstall(opts = {}) {
 
     if (existing.includes("GSD-T: Contract-Driven Development")) {
       if (isUpdate) {
-        // Check if there are customizations (lines not in our template)
         const template = fs.readFileSync(globalSrc, "utf8");
         if (normalizeEol(existing) === normalizeEol(template)) {
           copyFile(globalSrc, GLOBAL_CLAUDE_MD, "CLAUDE.md updated (no customizations detected)");
         } else {
-          // Backup and replace, warn about customizations
           const backupPath = GLOBAL_CLAUDE_MD + ".backup-" + Date.now();
           if (isSymlink(backupPath)) {
             warn("Skipping backup — target is a symlink");
@@ -454,7 +450,6 @@ function doInstall(opts = {}) {
         info("Run 'gsd-t update' to overwrite with latest version");
       }
     } else {
-      // Existing CLAUDE.md without GSD-T — append
       if (isSymlink(GLOBAL_CLAUDE_MD)) {
         warn("Skipping CLAUDE.md append — target is a symlink");
       } else {
@@ -468,15 +463,26 @@ function doInstall(opts = {}) {
   } else {
     copyFile(globalSrc, GLOBAL_CLAUDE_MD, "CLAUDE.md installed → ~/.claude/CLAUDE.md");
   }
+}
+
+function doInstall(opts = {}) {
+  const isUpdate = opts.update || false;
+  const verb = isUpdate ? "Updating" : "Installing";
+
+  heading(`${verb} GSD-T ${versionLink()}`);
+  log("");
+
+  if (ensureDir(COMMANDS_DIR)) {
+    success("Created ~/.claude/commands/");
+  }
+
+  const { gsdtCommands, utilityCommands } = installCommands(isUpdate);
+  installGlobalClaudeMd(isUpdate);
 
-  // 4. Install heartbeat script + hooks
   heading("Heartbeat (Real-time Events)");
   installHeartbeat();
-
-  // 5. Save version
   saveInstalledVersion();
 
-  // 6. Summary
   heading("Installation Complete!");
   log("");
   log(`  Commands: ${gsdtCommands.length} GSD-T + ${utilityCommands.length} utility commands in ~/.claude/commands/`);
@@ -518,53 +524,35 @@ function doUpdate() {
   doInstall({ update: true });
 }
 
-function doInit(projectName) {
-  if (!projectName) {
-    // Use current directory name
-    projectName = path.basename(process.cwd());
-  }
-
-  if (!validateProjectName(projectName)) {
-    error(`Invalid project name: "${projectName}"`);
-    info("Project names must start with a letter or number and contain only letters, numbers, dots, hyphens, underscores, or spaces (max 101 chars)");
-    return;
-  }
-
-  heading(`Initializing GSD-T project: ${projectName}`);
-  log("");
-
-  const projectDir = process.cwd();
-  const today = new Date().toISOString().split("T")[0];
-
-  // 1. Create project CLAUDE.md
+function initClaudeMd(projectDir, projectName, today) {
   const claudeMdPath = path.join(projectDir, "CLAUDE.md");
   if (isSymlink(claudeMdPath)) {
     warn("Skipping CLAUDE.md — target is a symlink");
-  } else {
-    try {
-      const template = fs.readFileSync(path.join(PKG_TEMPLATES, "CLAUDE-project.md"), "utf8");
-      const content = applyTokens(template, projectName, today);
-      fs.writeFileSync(claudeMdPath, content, { flag: "wx" });
-      success("CLAUDE.md created");
-    } catch (e) {
-      if (e.code === "EEXIST") {
-        const content = fs.readFileSync(claudeMdPath, "utf8");
-        if (content.includes("GSD-T Workflow")) {
-          info("CLAUDE.md already contains GSD-T section — skipping");
-        } else {
-          warn("CLAUDE.md exists but doesn't reference GSD-T");
-          info("Run /user:gsd-t-init inside Claude Code to add GSD-T section");
-        }
-      } else { throw e; }
-    }
+    return;
+  }
+  try {
+    const template = fs.readFileSync(path.join(PKG_TEMPLATES, "CLAUDE-project.md"), "utf8");
+    const content = applyTokens(template, projectName, today);
+    fs.writeFileSync(claudeMdPath, content, { flag: "wx" });
+    success("CLAUDE.md created");
+  } catch (e) {
+    if (e.code === "EEXIST") {
+      const content = fs.readFileSync(claudeMdPath, "utf8");
+      if (content.includes("GSD-T Workflow")) {
+        info("CLAUDE.md already contains GSD-T section — skipping");
+      } else {
+        warn("CLAUDE.md exists but doesn't reference GSD-T");
+        info("Run /user:gsd-t-init inside Claude Code to add GSD-T section");
+      }
+    } else { throw e; }
   }
+}
 
-  // 2. Create docs/ with templates
+function initDocs(projectDir, projectName, today) {
   const docsDir = path.join(projectDir, "docs");
   ensureDir(docsDir);
 
   const docTemplates = ["requirements.md", "architecture.md", "workflows.md", "infrastructure.md"];
-
   for (const file of docTemplates) {
     const destPath = path.join(docsDir, file);
     if (isSymlink(destPath)) {
@@ -581,8 +569,9 @@ function doInit(projectName) {
       else { throw e; }
     }
   }
+}
 
-  // 3. Create .gsd-t/ structure
+function initGsdtDir(projectDir, projectName, today) {
   const gsdtDir = path.join(projectDir, ".gsd-t");
   const contractsDir = path.join(gsdtDir, "contracts");
   const domainsDir = path.join(gsdtDir, "domains");
@@ -590,7 +579,6 @@ function doInit(projectName) {
   ensureDir(contractsDir);
   ensureDir(domainsDir);
 
-  // .gitkeep files so empty dirs are tracked
   for (const dir of [contractsDir, domainsDir]) {
     const gitkeep = path.join(dir, ".gitkeep");
     if (isSymlink(gitkeep)) continue;
@@ -618,8 +606,7 @@ function doInit(projectName) {
   }
 
   // Backlog files
-  const backlogFiles = ["backlog.md", "backlog-settings.md"];
-  for (const file of backlogFiles) {
+  for (const file of ["backlog.md", "backlog-settings.md"]) {
     const destPath = path.join(gsdtDir, file);
     if (isSymlink(destPath)) {
       warn(`Skipping .gsd-t/${file} — target is a symlink`);
@@ -634,13 +621,33 @@ function doInit(projectName) {
       else { throw e; }
     }
   }
+}
+
+function doInit(projectName) {
+  if (!projectName) {
+    projectName = path.basename(process.cwd());
+  }
+
+  if (!validateProjectName(projectName)) {
+    error(`Invalid project name: "${projectName}"`);
+    info("Project names must start with a letter or number and contain only letters, numbers, dots, hyphens, underscores, or spaces (max 101 chars)");
+    return;
+  }
+
+  heading(`Initializing GSD-T project: ${projectName}`);
+  log("");
+
+  const projectDir = process.cwd();
+  const today = new Date().toISOString().split("T")[0];
+
+  initClaudeMd(projectDir, projectName, today);
+  initDocs(projectDir, projectName, today);
+  initGsdtDir(projectDir, projectName, today);
 
-  // 4. Register in project index
   if (registerProject(projectDir)) {
     success("Registered in ~/.claude/.gsd-t-projects");
   }
 
-  // 5. Summary
   heading("Project Initialized!");
   log("");
   log(`  ${projectDir}/`);
@@ -773,8 +780,10 @@ function doUninstall() {
   const commands = getInstalledCommands();
   let removed = 0;
   for (const file of commands) {
+    const fp = path.join(COMMANDS_DIR, file);
+    if (isSymlink(fp)) { warn(`Skipping symlink: ${file}`); continue; }
     try {
-      fs.unlinkSync(path.join(COMMANDS_DIR, file));
+      fs.unlinkSync(fp);
       removed++;
     } catch (e) {
       error(`Failed to remove ${file}: ${e.message}`);
@@ -786,7 +795,7 @@ function doUninstall() {
 
   // Remove version file
   try {
-    if (fs.existsSync(VERSION_FILE)) {
+    if (fs.existsSync(VERSION_FILE) && !isSymlink(VERSION_FILE)) {
       fs.unlinkSync(VERSION_FILE);
     }
   } catch (e) {
@@ -971,13 +980,8 @@ function doUpdateAll() {
   log("");
 }
 
-function doDoctor() {
-  heading("GSD-T Doctor");
-  log("");
-
+function checkDoctorEnvironment() {
   let issues = 0;
-
-  // 1. Node version
   const nodeVersion = parseInt(process.version.slice(1));
   if (nodeVersion >= 16) {
     success(`Node.js ${process.version}`);
@@ -985,8 +989,6 @@ function doDoctor() {
     error(`Node.js ${process.version} — requires >= 16`);
     issues++;
   }
-
-  // 2. Claude Code installed?
   try {
     const claudeVersion = execFileSync("claude", ["--version"], { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] }).trim();
     success(`Claude Code: ${claudeVersion}`);
@@ -995,8 +997,6 @@ function doDoctor() {
     info("Install with: npm install -g @anthropic-ai/claude-code");
     issues++;
   }
-
-  // 3. ~/.claude/ exists?
   if (fs.existsSync(CLAUDE_DIR)) {
     success("~/.claude/ directory exists");
   } else {
@@ -1004,8 +1004,11 @@ function doDoctor() {
     info("Run 'npx @tekyzinc/gsd-t install' to create it");
     issues++;
   }
+  return issues;
+}
 
-  // 4. Commands installed?
+function checkDoctorInstallation() {
+  let issues = 0;
   const installed = getInstalledCommands();
   const expected = getCommandFiles();
   if (installed.length === expected.length) {
@@ -1019,8 +1022,6 @@ function doDoctor() {
     error("No GSD-T commands installed");
     issues++;
   }
-
-  // 5. CLAUDE.md
   if (fs.existsSync(GLOBAL_CLAUDE_MD)) {
     const content = fs.readFileSync(GLOBAL_CLAUDE_MD, "utf8");
     if (content.includes("GSD-T")) {
@@ -1033,8 +1034,6 @@ function doDoctor() {
     error("No global CLAUDE.md");
     issues++;
   }
-
-  // 6. settings.json valid?
   if (fs.existsSync(SETTINGS_JSON)) {
     try {
       JSON.parse(fs.readFileSync(SETTINGS_JSON, "utf8"));
@@ -1046,8 +1045,25 @@ function doDoctor() {
   } else {
     info("No settings.json (not required)");
   }
+  let encodingIssues = 0;
+  for (const file of installed) {
+    const content = fs.readFileSync(path.join(COMMANDS_DIR, file), "utf8");
+    if (content.includes("\u00e2\u20ac") || content.includes("\u00c3")) {
+      encodingIssues++;
+    }
+  }
+  if (encodingIssues > 0) {
+    error(`${encodingIssues} command files have encoding issues (corrupted characters)`);
+    info("Run 'npx @tekyzinc/gsd-t update' to replace with clean versions");
+    issues++;
+  } else if (installed.length > 0) {
+    success("No encoding issues in command files");
+  }
+  return issues;
+}
 
-  // 7. Playwright check (current project)
+function checkDoctorProject() {
+  let issues = 0;
   const cwd = process.cwd();
   if (hasPlaywright(cwd)) {
     success("Playwright configured");
@@ -1056,8 +1072,6 @@ function doDoctor() {
     info("Will be auto-installed when you run a GSD-T testing command");
     issues++;
   }
-
-  // 8. Swagger/OpenAPI check (current project)
   if (hasApi(cwd)) {
     if (hasSwagger(cwd)) {
       success("Swagger/OpenAPI configured");
@@ -1069,24 +1083,16 @@ function doDoctor() {
   } else {
     info("No API framework detected (Swagger check skipped)");
   }
+  return issues;
+}
 
-  // 9. Check for encoding issues in command files
-  let encodingIssues = 0;
-  for (const file of installed) {
-    const content = fs.readFileSync(path.join(COMMANDS_DIR, file), "utf8");
-    if (content.includes("â€") || content.includes("Ã")) {
-      encodingIssues++;
-    }
-  }
-  if (encodingIssues > 0) {
-    error(`${encodingIssues} command files have encoding issues (corrupted characters)`);
-    info("Run 'npx @tekyzinc/gsd-t update' to replace with clean versions");
-    issues++;
-  } else if (installed.length > 0) {
-    success("No encoding issues in command files");
-  }
-
-  // Summary
+function doDoctor() {
+  heading("GSD-T Doctor");
+  log("");
+  let issues = 0;
+  issues += checkDoctorEnvironment();
+  issues += checkDoctorInstallation();
+  issues += checkDoctorProject();
   log("");
   if (issues === 0) {
     log(`${GREEN}${BOLD}  All checks passed!${RESET}`);
@@ -1175,24 +1181,8 @@ function checkForUpdates() {
     } catch { /* timeout or network error — skip */ }
   } else if (isStale) {
     // Cache exists but stale — refresh in background (non-blocking)
-    const script = `
-      const https = require("https");
-      const fs = require("fs");
-      https.get("https://registry.npmjs.org/@tekyzinc/gsd-t/latest",
-        { timeout: 5000 }, (res) => {
-        let d = "";
-        res.on("data", (c) => d += c);
-        res.on("end", () => {
-          try {
-            const v = JSON.parse(d).version;
-            fs.writeFileSync(${JSON.stringify(UPDATE_CHECK_FILE)},
-              JSON.stringify({ latest: v, timestamp: Date.now() }));
-          } catch {}
-        });
-      }).on("error", () => {});
-    `.replace(/\n/g, "");
-    const { spawn } = require("child_process");
-    const child = spawn(process.execPath, ["-e", script], {
+    const updateScript = path.join(__dirname, "..", "scripts", "npm-update-check.js");
+    const child = cpSpawn(process.execPath, [updateScript, UPDATE_CHECK_FILE], {
       detached: true,
       stdio: "ignore",
     });
@@ -1213,7 +1203,8 @@ function showUpdateNotice(latest) {
 function doChangelog() {
   try {
     if (process.platform === "win32") {
-      // "start" is a cmd built-in — must go through cmd.exe, but with safe array args
+      // SAFETY: CHANGELOG_URL is a hardcoded constant (line 43). If it ever becomes
+      // dynamic/user-provided, this cmd.exe call would need URL validation to prevent injection.
       execFileSync("cmd", ["/c", "start", "", CHANGELOG_URL], { stdio: "ignore" });
     } else {
       const openCmd = process.platform === "darwin" ? "open" : "xdg-open";

package/commands/gsd-t-complete-milestone.md

@@ -175,9 +175,20 @@ Before creating the git tag, verify all documentation is up to date:
 
 ### This is the LAST GATE before tagging — nothing should be undocumented.
 
-## Step 7.6: Test Verification
+## Step 7.6: Spawn QA Agent and Test Verification
 
-Before creating the git tag, verify the milestone is truly complete:
+Before creating the git tag, spawn the QA teammate for a final test audit:
+
+```
+Teammate "qa": Read commands/gsd-t-qa.md for your full instructions.
+  Phase context: complete-milestone. Read .gsd-t/contracts/ for contract definitions.
+  Run final test audit before milestone archive. Verify all contract tests pass.
+  Report: final test pass/fail counts and any unresolved gaps.
+```
+
+Wait for QA agent to complete. QA failure blocks milestone completion.
+
+Then verify the milestone is truly complete:
 
 1. **Run the full test suite**: Execute ALL tests — unit, integration, and E2E
 2. **Run Playwright E2E** (if configured): Detect `playwright.config.*` or Playwright in dependencies. If present, run the full Playwright suite. If specs are missing or stale, invoke `gsd-t-test-sync` first.

package/commands/gsd-t-debug.md

@@ -40,6 +40,19 @@ The contract didn't specify something it should have. Symptoms:
 
 → Update the contract, then fix implementations on both sides.
 
+## Step 2.5: Spawn QA Agent
+
+Spawn the QA teammate to handle regression testing:
+
+```
+Teammate "qa": Read commands/gsd-t-qa.md for your full instructions.
+  Phase context: debug. Read .gsd-t/contracts/ for relevant contracts.
+  Write a regression test for the bug once root cause is identified.
+  Report: regression test status and related test coverage.
+```
+
+QA failure blocks the commit.
+
 ## Step 3: Debug (Solo or Team)
 
 ### Solo Mode

package/commands/gsd-t-execute.md

@@ -19,6 +19,19 @@ Identify:
 - Which tasks are unblocked (no pending dependencies)
 - Which tasks are blocked (waiting on checkpoints)
 
+## Step 1.5: Spawn QA Agent
+
+Spawn the QA teammate to handle testing alongside execution:
+
+```
+Teammate "qa": Read commands/gsd-t-qa.md for your full instructions.
+  Phase context: execute. Read .gsd-t/contracts/ for contract definitions.
+  Run tests continuously as tasks complete. Write edge case tests for new code paths.
+  Report: test pass/fail status after each task completion.
+```
+
+The QA agent runs in parallel — it writes and executes tests while you implement tasks. QA failure on any task blocks proceeding to the next task.
+
 ## Step 2: Choose Execution Mode
 
 ### Solo Mode (default)
@@ -79,6 +92,10 @@ Teammate assignments:
 - Teammate "{domain-1}": Execute .gsd-t/domains/{domain-1}/tasks.md
 - Teammate "{domain-2}": Execute .gsd-t/domains/{domain-2}/tasks.md
 - Teammate "{domain-3}": Execute .gsd-t/domains/{domain-3}/tasks.md
+- Teammate "qa": Read commands/gsd-t-qa.md for your full instructions.
+  Phase context: execute. Read .gsd-t/contracts/ for contract definitions.
+  Run tests continuously as tasks complete. Write edge case tests.
+  Report: test pass/fail status after each task completion.
 
 Lead responsibilities:
 - Use delegate mode (Shift+Tab)

package/commands/gsd-t-help.md

@@ -36,6 +36,7 @@ MILESTONE WORKFLOW                                          [auto] = in wave
   impact       [auto] Analyze downstream effects before execution
   execute      [auto] Run tasks (solo or team mode)
   test-sync    [auto] Sync tests with code changes
+  qa           [auto] QA agent — test generation, execution, gap reporting
   integrate    [auto] Wire domains together at boundaries
   verify       [auto] Run quality gates
   complete-milestone [auto] Archive milestone + git tag
@@ -55,6 +56,7 @@ UTILITIES                                                              Manual
   log                 Sync progress Decision Log with recent git activity
   version-update      Update GSD-T package to latest version
   version-update-all  Update GSD-T package + all registered projects
+  triage-and-merge    Auto-review, merge, and publish GitHub branches
 
 BACKLOG                                                                Manual
 ───────────────────────────────────────────────────────────────────────────────
@@ -236,6 +238,12 @@ Use these when user asks for help on a specific command:
 - **Creates**: `.gsd-t/test-coverage.md`, test tasks
 - **Use when**: After code changes, to maintain test health
 
+### qa
+- **Summary**: QA agent — test generation, execution, and gap reporting
+- **Auto-invoked**: Yes (spawned as teammate by partition, plan, execute, verify, quick, debug, integrate, complete-milestone)
+- **Creates**: Contract test skeletons, acceptance tests, edge case tests, test audit reports
+- **Use when**: Automatically spawned — never needs manual invocation. Standalone use for ad-hoc test audits.
+
 ### integrate
 - **Summary**: Wire domains together at their boundaries
 - **Auto-invoked**: Yes (in wave, after execute)
@@ -303,6 +311,13 @@ Use these when user asks for help on a specific command:
 - **Use when**: Progress.md Decision Log is behind — catches up by scanning git commits since the last logged entry
 - **Features**: Incremental updates, first-time full reconstruction from git history, groups same-day changes
 
+### triage-and-merge
+- **Summary**: Auto-review unmerged GitHub branches, merge safe ones, and optionally publish
+- **Auto-invoked**: No
+- **Files**: Reads `CLAUDE.md`, `.gsd-t/progress.md`, `package.json`; updates `package.json`, `.gsd-t/progress.md`, `CHANGELOG.md`
+- **Use when**: Collaborators have pushed branches and you want to batch-review, merge, and publish without manual per-branch ceremony
+- **Features**: 3-tier impact scoring (auto-merge / review / skip), publish gate (auto in Level 3, prompted otherwise), conflict detection, sensitive file detection
+
 ### backlog-add
 - **Summary**: Capture a new backlog item with auto-categorization
 - **Auto-invoked**: No

package/commands/gsd-t-integrate.md

@@ -88,6 +88,19 @@ Result: PASS
 Result: PARTIAL — needs pagination contract addition
 ```
 
+## Step 4.5: Spawn QA Agent
+
+Spawn the QA teammate to verify contract compliance at domain boundaries:
+
+```
+Teammate "qa": Read commands/gsd-t-qa.md for your full instructions.
+  Phase context: integrate. Read .gsd-t/contracts/ for all contract definitions.
+  Run contract compliance tests at every domain boundary.
+  Report: boundary-by-boundary test results.
+```
+
+QA failure blocks integration completion.
+
 ## Step 5: Document Ripple
 
 Integration is where the real system takes shape. Verify documentation matches reality:

package/commands/gsd-t-partition.md

@@ -175,6 +175,19 @@ Before finalizing the partition:
 2. **Verify passing**: If any tests fail, assign them to the appropriate domain as pre-existing issues
 3. **Map tests to domains**: Note which test files belong to which domain — this informs task planning
 
+## Step 4.7: Spawn QA Agent
+
+After contracts are written, spawn the QA teammate to generate contract test skeletons:
+
+```
+Teammate "qa": Read commands/gsd-t-qa.md for your full instructions.
+  Phase context: partition. Read .gsd-t/contracts/ for contract definitions.
+  Generate contract test skeleton files for every contract.
+  Report: number of test files generated and total test cases.
+```
+
+Wait for QA agent to complete before proceeding. QA failure blocks partition completion.
+
 ## Step 5: Validate
 
 Before finishing, verify:

package/commands/gsd-t-plan.md

@@ -118,6 +118,19 @@ Before finalizing the plan:
 2. **Verify passing**: Document any pre-existing failures — assign them to appropriate domain tasks
 3. **Include test tasks**: Ensure each domain's task list includes test creation/update tasks where acceptance criteria require verification
 
+## Step 4.7: Spawn QA Agent
+
+After task lists are created, spawn the QA teammate to generate acceptance test scenarios:
+
+```
+Teammate "qa": Read commands/gsd-t-qa.md for your full instructions.
+  Phase context: plan. Read .gsd-t/domains/*/tasks.md for task lists.
+  Generate acceptance test scenarios for tasks with user-facing deliverables.
+  Report: number of acceptance test scenarios generated.
+```
+
+Wait for QA agent to complete before proceeding.
+
 ## Step 5: Update Progress
 
 Update `.gsd-t/progress.md`: