gm-skill 0.1.2 → 2.0.1081

package/lib/spool.js

@@ -1,8 +1,10 @@
 const fs = require('fs');
 const path = require('path');
+const os = require('os');
 
 function getSpoolBaseDir() {
-  return path.join(process.cwd(), '.gm', 'exec-spool');
+  const cwd = process.cwd();
+  return path.join(cwd, '.gm', 'exec-spool');
 }
 
 function generateTaskId() {
@@ -16,8 +18,16 @@ function validateLang(lang) {
 
 function getExtForLang(lang) {
   const langExt = {
-    nodejs: 'js', python: 'py', bash: 'sh', typescript: 'ts', go: 'go',
-    rust: 'rs', c: 'c', cpp: 'cpp', java: 'java', deno: 'ts'
+    nodejs: 'js',
+    python: 'py',
+    bash: 'sh',
+    typescript: 'ts',
+    go: 'go',
+    rust: 'rs',
+    c: 'c',
+    cpp: 'cpp',
+    java: 'java',
+    deno: 'ts'
   };
   return langExt[lang] || 'js';
 }
@@ -29,32 +39,43 @@ function validateVerb(verb) {
 
 function writeSpool(body, lang = 'nodejs', options = {}) {
   const validLang = validateLang(lang);
+  const ext = getExtForLang(validLang);
   const taskId = options.taskId || generateTaskId();
-  const inDir = path.join(getSpoolBaseDir(), 'in', validLang);
-  const inFile = path.join(inDir, `${taskId}.${getExtForLang(validLang)}`);
+
+  const baseDir = getSpoolBaseDir();
+  const inDir = path.join(baseDir, 'in', validLang);
+  const inFile = path.join(inDir, `${taskId}.${ext}`);
 
   fs.mkdirSync(inDir, { recursive: true });
 
   const sessionId = options.sessionId || process.env.CLAUDE_SESSION_ID;
   const code = sessionId ? `const SESSION_ID = '${sessionId}';\n${body}` : body;
+
   fs.writeFileSync(inFile, code, 'utf8');
 
-  return { id: taskId, path: inFile, lang: validLang, ext: getExtForLang(validLang) };
+  return {
+    id: taskId,
+    path: inFile,
+    lang: validLang,
+    ext
+  };
 }
 
 function writeSpoolVerb(body, verb, options = {}) {
   const validVerb = validateVerb(verb);
   const taskId = options.taskId || generateTaskId();
-  const inDir = path.join(getSpoolBaseDir(), 'in', validVerb);
+  const baseDir = getSpoolBaseDir();
+  const inDir = path.join(baseDir, 'in', validVerb);
   const inFile = path.join(inDir, `${taskId}.txt`);
-
   fs.mkdirSync(inDir, { recursive: true });
   fs.writeFileSync(inFile, body, 'utf8');
   return { id: taskId, path: inFile, verb: validVerb };
 }
 
 function readSpoolOutput(id) {
-  const outDir = path.join(getSpoolBaseDir(), 'out');
+  const baseDir = getSpoolBaseDir();
+  const outDir = path.join(baseDir, 'out');
+
   const outFile = path.join(outDir, `${id}.out`);
   const errFile = path.join(outDir, `${id}.err`);
   const jsonFile = path.join(outDir, `${id}.json`);
@@ -72,7 +93,10 @@ function readSpoolOutput(id) {
   }
 
   return {
-    id, stdout, stderr, metadata,
+    id,
+    stdout,
+    stderr,
+    metadata,
     exitCode: metadata.exitCode,
     durationMs: metadata.durationMs,
     timedOut: metadata.timedOut || false
@@ -80,25 +104,37 @@ function readSpoolOutput(id) {
 }
 
 async function waitForCompletion(id, timeoutMs = 30000) {
-  const jsonFile = path.join(getSpoolBaseDir(), 'out', `${id}.json`);
+  const baseDir = getSpoolBaseDir();
+  const outDir = path.join(baseDir, 'out');
+  const jsonFile = path.join(outDir, `${id}.json`);
+
   const start = Date.now();
+  const interval = 50;
 
   while (Date.now() - start < timeoutMs) {
     if (fs.existsSync(jsonFile)) {
       try {
         const metadata = JSON.parse(fs.readFileSync(jsonFile, 'utf8'));
         const output = readSpoolOutput(id);
-        return { ok: metadata.exitCode === 0 && !metadata.timedOut, ...output };
+        return {
+          ok: metadata.exitCode === 0 && !metadata.timedOut,
+          ...output
+        };
       } catch (e) {
-        await new Promise(r => setTimeout(r, 50));
+        await new Promise(r => setTimeout(r, interval));
       }
     } else {
-      await new Promise(r => setTimeout(r, 50));
+      await new Promise(r => setTimeout(r, interval));
     }
   }
 
   const output = readSpoolOutput(id);
-  return { ok: false, ...output, timedOut: true, stderr: output.stderr + `\n[timeout ${timeoutMs}ms]` };
+  return {
+    ok: false,
+    ...output,
+    timedOut: true,
+    stderr: output.stderr + `\n[spool timeout after ${timeoutMs}ms]`
+  };
 }
 
 async function execSpool(body, lang, options = {}) {
@@ -112,52 +148,54 @@ async function execSpool(body, lang, options = {}) {
   return result;
 }
 
-async function execNodejs(body, options = {}) {
-  return execSpool(body, 'nodejs', options);
-}
-
-async function execBash(body, options = {}) {
-  return execSpool(body, 'bash', options);
-}
-
-async function execCodesearch(query, options = {}) {
-  return execSpool(query, 'codesearch', options);
-}
-
-async function execRecall(query, options = {}) {
-  return execSpool(query, 'recall', options);
-}
-
-async function execMemorize(fact, options = {}) {
-  return execSpool(fact, 'memorize', options);
-}
+async function execCodesearch(query, options = {}) { return execSpool(query, 'codesearch', options); }
+async function execRecall(query, options = {}) { return execSpool(query, 'recall', options); }
+async function execMemorize(fact, options = {}) { return execSpool(fact, 'memorize', options); }
 
 function getAllOutputs() {
-  const outDir = path.join(getSpoolBaseDir(), 'out');
-  if (!fs.existsSync(outDir)) return [];
+  const baseDir = getSpoolBaseDir();
+  const outDir = path.join(baseDir, 'out');
+
+  if (!fs.existsSync(outDir)) {
+    return [];
+  }
 
   const files = fs.readdirSync(outDir);
   const taskIds = new Set();
+
   files.forEach(file => {
     const match = file.match(/^(.+?)\.(out|err|json)$/);
-    if (match) taskIds.add(match[1]);
+    if (match) {
+      taskIds.add(match[1]);
+    }
   });
+
   return Array.from(taskIds).map(id => readSpoolOutput(id));
 }
 
-function cleanupTempFiles(taskId) {
-  const outDir = path.join(getSpoolBaseDir(), 'out');
-  ['.out', '.err', '.json'].forEach(ext => {
-    try {
-      const file = path.join(outDir, `${taskId}${ext}`);
-      if (fs.existsSync(file)) fs.unlinkSync(file);
-    } catch (e) {}
-  });
+async function getEvents(sessionId, cwd) {
+  try {
+    const { getSnapshot } = require('./skill-bootstrap');
+    return await getSnapshot(sessionId, cwd);
+  } catch (e) {
+    return { error: e.message };
+  }
 }
 
 module.exports = {
-  writeSpool, writeSpoolVerb, readSpoolOutput, waitForCompletion,
-  execNodejs, execBash, execCodesearch, execRecall, execMemorize,
-  getAllOutputs, cleanupTempFiles, getSpoolBaseDir, generateTaskId,
-  validateLang, getExtForLang, validateVerb
+  writeSpool,
+  writeSpoolVerb,
+  readSpoolOutput,
+  waitForCompletion,
+  execSpool,
+  execCodesearch,
+  execRecall,
+  execMemorize,
+  getAllOutputs,
+  getSpoolBaseDir,
+  generateTaskId,
+  validateLang,
+  getExtForLang,
+  validateVerb,
+  getEvents
 };

package/lib/wasm-host.js

@@ -0,0 +1,241 @@
+const fs = require('fs');
+const path = require('path');
+const { execSync, spawnSync } = require('child_process');
+const fetch = (...args) => import('node-fetch').then(({ default: fetch }) => fetch(...args));
+
+class WasmHost {
+  constructor(wasmPath) {
+    this.wasmPath = wasmPath;
+    this.instance = null;
+    this.memory = null;
+  }
+
+  async init() {
+    try {
+      const wasmBuffer = fs.readFileSync(this.wasmPath);
+      const wasmModule = new WebAssembly.Module(wasmBuffer);
+
+      const importObject = {
+        host: {
+          host_fs_read: this.hostFsRead.bind(this),
+          host_fs_write: this.hostFsWrite.bind(this),
+          host_fs_readdir: this.hostFsReaddir.bind(this),
+          host_fs_stat: this.hostFsStat.bind(this),
+          host_kv_get: this.hostKvGet.bind(this),
+          host_kv_put: this.hostKvPut.bind(this),
+          host_kv_query: this.hostKvQuery.bind(this),
+          host_fetch: this.hostFetch.bind(this),
+          host_vec_search: this.hostVecSearch.bind(this),
+          host_vec_embed: this.hostVecEmbed.bind(this),
+          host_browser_spawn: this.hostBrowserSpawn.bind(this),
+          host_browser_eval: this.hostBrowserEval.bind(this),
+          host_browser_close: this.hostBrowserClose.bind(this),
+          host_exec_js: this.hostExecJs.bind(this),
+          host_log: this.hostLog.bind(this),
+          host_now_ms: this.hostNowMs.bind(this),
+          host_env_get: this.hostEnvGet.bind(this),
+        },
+        env: {
+          memory: new WebAssembly.Memory({ initial: 256, maximum: 512 }),
+        }
+      };
+
+      this.instance = new WebAssembly.Instance(wasmModule, importObject);
+      this.memory = importObject.env.memory;
+      return { ok: true };
+    } catch (err) {
+      return { ok: false, error: err.message };
+    }
+  }
+
+  readString(offset, len) {
+    const buf = new Uint8Array(this.memory.buffer, offset, len);
+    return new TextDecoder().decode(buf);
+  }
+
+  writeString(str) {
+    const encoder = new TextEncoder();
+    const encoded = encoder.encode(str);
+    const len = encoded.length;
+    const offset = this.instance.exports.plugkit_alloc(len);
+    const buf = new Uint8Array(this.memory.buffer, offset, len);
+    buf.set(encoded);
+    return [offset, len];
+  }
+
+  hostFsRead(pathPtr, pathLen) {
+    try {
+      const pathStr = this.readString(pathPtr, pathLen);
+      const content = fs.readFileSync(pathStr, 'utf8');
+      const [offset, len] = this.writeString(content);
+      return offset;
+    } catch (err) {
+      return 0;
+    }
+  }
+
+  hostFsWrite(pathPtr, pathLen, dataPtr, dataLen) {
+    try {
+      const pathStr = this.readString(pathPtr, pathLen);
+      const data = this.readString(dataPtr, dataLen);
+      fs.writeFileSync(pathStr, data, 'utf8');
+      return 1;
+    } catch (err) {
+      return 0;
+    }
+  }
+
+  hostFsReaddir(pathPtr, pathLen) {
+    try {
+      const pathStr = this.readString(pathPtr, pathLen);
+      const entries = fs.readdirSync(pathStr);
+      const result = JSON.stringify(entries);
+      const [offset] = this.writeString(result);
+      return offset;
+    } catch (err) {
+      return 0;
+    }
+  }
+
+  hostFsStat(pathPtr, pathLen) {
+    try {
+      const pathStr = this.readString(pathPtr, pathLen);
+      const stat = fs.statSync(pathStr);
+      const result = JSON.stringify({
+        isFile: stat.isFile(),
+        isDirectory: stat.isDirectory(),
+        size: stat.size,
+        mtime: stat.mtime.getTime(),
+      });
+      const [offset] = this.writeString(result);
+      return offset;
+    } catch (err) {
+      return 0;
+    }
+  }
+
+  hostKvGet(keyPtr, keyLen) {
+    return 0;
+  }
+
+  hostKvPut(keyPtr, keyLen, valPtr, valLen) {
+    return 1;
+  }
+
+  hostKvQuery(queryPtr, queryLen) {
+    return 0;
+  }
+
+  hostFetch(urlPtr, urlLen, optsPtr, optsLen) {
+    return 0;
+  }
+
+  hostVecSearch(queryPtr, queryLen) {
+    return 0;
+  }
+
+  hostVecEmbed(textPtr, textLen) {
+    return 0;
+  }
+
+  hostBrowserSpawn(urlPtr, urlLen) {
+    return 0;
+  }
+
+  hostBrowserEval(sessionPtr, sessionLen, jsPtr, jsLen) {
+    return 0;
+  }
+
+  hostBrowserClose(sessionPtr, sessionLen) {
+    return 1;
+  }
+
+  hostExecJs(codePtr, codeLen) {
+    try {
+      const code = this.readString(codePtr, codeLen);
+      const result = eval(`(${code})`);
+      const [offset] = this.writeString(JSON.stringify(result));
+      return offset;
+    } catch (err) {
+      return 0;
+    }
+  }
+
+  hostLog(msgPtr, msgLen) {
+    const msg = this.readString(msgPtr, msgLen);
+    console.log(msg);
+    return 1;
+  }
+
+  hostNowMs() {
+    return Date.now();
+  }
+
+  hostEnvGet(keyPtr, keyLen) {
+    const key = this.readString(keyPtr, keyLen);
+    const val = process.env[key] || '';
+    const [offset] = this.writeString(val);
+    return offset;
+  }
+
+  async dispatch(verb, body) {
+    if (!this.instance) {
+      const initResult = await this.init();
+      if (!initResult.ok) return initResult;
+    }
+
+    try {
+      const bodyStr = typeof body === 'string' ? body : JSON.stringify(body);
+      const [verbOffset, verbLen] = this.writeString(verb);
+      const [bodyOffset, bodyLen] = this.writeString(bodyStr);
+
+      const resultPtr = this.instance.exports.dispatch_verb(verbOffset, verbLen, bodyOffset, bodyLen);
+      if (resultPtr === 0) {
+        return { ok: false, error: 'dispatch_verb returned null' };
+      }
+
+      const resultStr = this.readString(resultPtr, 1024);
+      try {
+        return JSON.parse(resultStr);
+      } catch {
+        return { ok: true, output: resultStr };
+      }
+    } catch (err) {
+      return { ok: false, error: err.message };
+    }
+  }
+
+  async hook(name, body) {
+    if (!this.instance) {
+      const initResult = await this.init();
+      if (!initResult.ok) return initResult;
+    }
+
+    try {
+      const bodyStr = typeof body === 'string' ? body : JSON.stringify(body);
+      const [nameOffset, nameLen] = this.writeString(name);
+      const [bodyOffset, bodyLen] = this.writeString(bodyStr);
+
+      const hookFn = this.instance.exports[`hook_${name}`];
+      if (!hookFn) {
+        return { ok: false, error: `hook_${name} not found` };
+      }
+
+      const resultPtr = hookFn(bodyOffset, bodyLen);
+      if (resultPtr === 0) {
+        return { ok: false, error: `hook_${name} returned null` };
+      }
+
+      const resultStr = this.readString(resultPtr, 1024);
+      try {
+        return JSON.parse(resultStr);
+      } catch {
+        return { ok: true, output: resultStr };
+      }
+    } catch (err) {
+      return { ok: false, error: err.message };
+    }
+  }
+}
+
+module.exports = WasmHost;

package/package.json

@@ -1,32 +1,50 @@
 {
   "name": "gm-skill",
-  "version": "0.1.2",
-  "description": "Unified skill library for gm platform implementations",
-  "main": "lib/index.js",
-  "exports": {
-    ".": "./lib/index.js",
-    "./daemon-bootstrap": "./lib/daemon-bootstrap.js",
-    "./manifest": "./lib/manifest.js",
-    "./prepare": "./lib/prepare.js",
-    "./loader": "./lib/loader.js"
-  },
-  "scripts": {
-    "test": "node test.js"
-  },
+  "version": "2.0.1081",
+  "description": "Canonical universal harness — AI-native software engineering via skill-driven orchestration; bootstraps plugkit for task execution and session isolation. Install in any AI coding agent host.",
+  "author": "AnEntrypoint",
+  "license": "MIT",
   "keywords": [
     "gm",
-    "skills",
-    "daemon",
-    "bootstrap"
+    "skill",
+    "harness",
+    "plugkit",
+    "orchestration",
+    "ai-coding",
+    "canonical"
   ],
-  "author": "AnEntrypoint",
-  "license": "MIT",
+  "homepage": "https://github.com/AnEntrypoint/gm-skill#readme",
+  "bugs": {
+    "url": "https://github.com/AnEntrypoint/gm-skill/issues"
+  },
   "repository": {
     "type": "git",
-    "url": "https://github.com/AnEntrypoint/gm.git"
+    "url": "https://github.com/AnEntrypoint/gm-skill.git"
+  },
+  "main": "bin/bootstrap.js",
+  "bin": {
+    "gm-skill-bootstrap": "./bin/bootstrap.js"
+  },
+  "files": [
+    "skills/",
+    "agents/",
+    "prompts/",
+    "lib/",
+    "lang/",
+    "scripts/",
+    "bin/",
+    "gm-plugkit/",
+    "AGENTS.md",
+    "README.md",
+    "gm.json"
+  ],
+  "dependencies": {
+    "gm-plugkit": "^2.0.1081"
   },
-  "homepage": "https://github.com/AnEntrypoint/gm#readme",
   "engines": {
     "node": ">=16.0.0"
+  },
+  "publishConfig": {
+    "access": "public"
   }
 }

package/prompts/bash-deny.txt

@@ -0,0 +1,22 @@
+The Bash tool accepts ONLY git commands directly (no exec: prefix): `git status`, `git commit -m "msg"`, `git push`, etc.
+
+Everything else — code execution AND utility verbs — goes through the file-spool. Write a file at:
+
+  .gm/exec-spool/in/<lang-or-verb>/<N>.<ext>
+
+Examples:
+  in/nodejs/42.js              in/python/43.py            in/bash/44.sh
+  in/codesearch/45.txt         in/recall/46.txt           in/memorize/47.md
+  in/wait/48.txt               in/browser/49.js           in/runner/50.txt
+
+Languages: nodejs, python, bash, typescript, go, rust, c, cpp, java, deno
+Verbs: codesearch, recall, memorize, wait, sleep, status, close, browser, runner, type, kill-port, forget, feedback, learn-status, learn-debug, learn-build, discipline, pause
+
+The spool watcher executes the request and streams output:
+  - .gm/exec-spool/out/<N>.out      (stdout, written line-by-line)
+  - .gm/exec-spool/out/<N>.err      (stderr, written line-by-line)
+  - .gm/exec-spool/out/<N>.json     (metadata: exitCode, durationMs, timedOut, startedAt, endedAt — written once at completion)
+
+Result returns as systemMessage on next tool use with `--- stdout ---` and `--- stderr ---` separators. Both `in/` and `out/` are wiped at session start and session end (real-exit reasons only).
+
+Anything else via Bash is blocked.

package/prompts/pre-compact.txt

@@ -0,0 +1,21 @@
+=== RESPONSE POLICY — ALWAYS ACTIVE (post-compact reinforcement) ===
+
+Terse. Technical substance stays. Fluff dies. Drop: articles, filler, pleasantries, hedging. Fragments OK. Short synonyms. Technical terms exact. Code unchanged. Pattern: [thing] [action] [reason]. [next step].
+
+Auto-Clarity: drop terse style for security warnings, irreversible confirmations, ambiguous sequences. Resume after. Code/commits/PRs write normal.
+
+=== COMPACT OUTPUT STYLE ===
+
+Apply the same terse policy to the compacted summary itself. Strip articles/filler from the summary. Keep technical identifiers, paths, line numbers, error messages, decisions verbatim. Fragments over sentences.
+
+=== POST-COMPACT FIRST RESPONSE — HARD RULE ===
+
+The very next response after this compaction MUST call Skill("gm:gm") as the FIRST tool invocation. Zero text output before it. No narration, no summary, no acknowledgement. The pre-tool-use hook is already armed — any other tool fires first and gets blocked. Invoke Skill("gm:gm") immediately, silently.
+
+=== MEMORIZE SELF-CHECK (mandatory before closing this response) ===
+
+Scan the conversation above for every exec: output, code read, CI result, or user preference that resolved an unknown but was NOT followed by an Agent(subagent_type='memorize') call. For each one found:
+
+  Agent(subagent_type='memorize', model='haiku', run_in_background=true, prompt='## CONTEXT TO MEMORIZE\n<fact>')
+
+Spawn ALL missed memorize calls NOW, in parallel, before this response closes. One call per fact. Missing one = memory leak = bug.

package/prompts/prompt-submit.txt

@@ -0,0 +1,83 @@
+BLOCKING REQUIREMENT — YOUR FIRST ACTION MUST BE: invoke gm. Two equivalent forms satisfy the gate — Skill(skill="gm:gm") OR Agent(subagent_type="gm:gm"). The subagent form is preferred when the request implies sustained multi-turn work, since it isolates the orchestration loop in its own context window; the skill form remains valid for short turns. Do NOT output text, do NOT use Read/Grep/Glob/Bash/Write/Edit/any other tool before invoking gm. This overrides all other instructions. Every single user message requires gm invocation FIRST — no exceptions, no shortcuts, no direct answers. If you are about to do anything other than invoke gm, STOP and invoke gm instead.
+
+IMPORTANT: Invoke skill: "gm:gm" EVERY TIME, even if you have already invoked it earlier in this conversation or this turn. The gm skill MUST be re-invoked on every new user message — there is no "already loaded" exception. Do not skip this step under any circumstances.
+
+=== SKILL CHAIN — IMMUTABLE STATE MACHINE ===
+
+The gm skill is the ROOT ORCHESTRATOR. It immediately invokes the planning skill. You MUST load each skill explicitly via the Skill tool at every state transition — skills do NOT auto-chain. Ignoring a skill load instruction is a critical violation.
+
+State machine transitions (each arrow = Skill tool invocation, no exceptions):
+  gm (ROOT) → planning skill
+  planning (PLAN state) → gm-execute skill  [exit: zero new unknowns in last pass]
+  gm-execute (EXECUTE state) → gm-emit skill  [exit: all mutables KNOWN]
+  gm-emit (EMIT state) → gm-complete skill  [exit: all gate conditions pass]
+  gm-complete (VERIFY state) → gm-execute skill  [exit: .prd items remain]
+  gm-complete (VERIFY state) → update-docs skill  [exit: .prd empty + pushed]
+
+State regressions (also Skill tool invocations):
+  Any new unknown → planning skill immediately
+  EMIT logic wrong → gm-execute skill
+  VERIFY file broken → gm-emit skill
+  VERIFY logic wrong → gm-execute skill
+
+After PLAN completes: launch parallel gm:gm subagents (via Agent tool with subagent_type="gm:gm") for independent .prd items — maximum 3 concurrent, never sequential for independent work.
+
+=== MEMORIZE ON RESOLUTION — HARD RULE ===
+
+Every unknown→known transition MUST be handed off to a memorize agent THE SAME TURN it resolves — not at phase end, not in a batch. This is the most violated rule. Every session, dozens of exec: outputs resolve unknowns that are never memorized. Those facts die on compaction.
+
+The ONLY acceptable memorize call form:
+
+  Agent(subagent_type='gm:memorize', model='haiku', run_in_background=true, prompt='## CONTEXT TO MEMORIZE\n<single fact with enough context for a cold-start agent>')
+
+Trigger (any = fire NOW, same turn, before next tool):
+- exec: output answers ANY prior "let me check" / "does this API take X" / "what version is installed"
+- Code read confirms or refutes an assumption about existing structure
+- CI log or error output reveals a root cause
+- User states a preference, constraint, deadline, or judgment call
+- Fix works for non-obvious reason
+- Tool / env quirk observed (blocked commands, path oddities, platform differences)
+
+Parallel spawn: N facts in one turn → N Agent(memorize) calls in ONE message, parallel tool blocks. NEVER serialize.
+
+End-of-turn self-check (mandatory, no exceptions): before closing ANY response, scan the entire turn for exec: outputs and code reads that resolved an unknown but were NOT followed by Agent(memorize). Spawn ALL missed ones now. "I'll memorize this" in text is NOT a memorize call — only the Agent tool call counts.
+
+Skipping memorize = memory leak = critical bug. Saying you will memorize ≠ memorizing.
+
+=== NO NARRATION BEFORE EXECUTION ===
+
+Do NOT output text describing what you are about to do before doing it. Run the tool first. State findings AFTER. Pattern: tool call → tool result → brief text summary of what was found. NOT: text describing upcoming tool → tool call.
+
+"I'll check the file:" followed by Read = violation.
+"Let me search for X" followed by exec:codesearch = violation.
+"Now I'll fix Y" followed by Edit = violation.
+
+Every sentence of text output must be AFTER at least one tool result that justifies it. No pre-announcement narration.
+
+=== AUTONOMY — HARD RULE ===
+
+A written PRD is the user's authorization. EXECUTE owns the work to COMPLETE. Resolve every doubt that arises during execution by witnessed probe, by recall, or by re-reading the PRD — never by routing the doubt back to the user. Any question whose answer the agent could obtain itself belongs to the agent, not the user.
+
+Asking is permitted only as last resort — destructive-irreversible action with no PRD coverage, OR user intent genuinely irrecoverable from PRD/memory/code. Channel: `exec:pause` (renames .gm/prd.yml → .gm/prd.paused.yml; question in header). In-conversation asking is last-resort beneath last-resort.
+
+The size of the task, the cost of context, the duration of CI, and the number of repos involved are never grounds to ask.
+
+=== REFUSAL BAN — MAXIMAL COVER INSTEAD ===
+
+When scope exceeds reach, expand the cover. Don't refuse. Don't ship one slice with the rest deferred to "follow-up" — that's the same failure as bluffing strength, just dressed differently.
+
+Refusal has two shapes, both forbidden, both structurally identical to bluffing strength:
+- TOTAL refusal — no work delivered toward the request.
+- DISTRIBUTED refusal — one bounded subset delivered while other witnessable subsets of the same request are abandoned as "follow-up".
+
+Required move: construct the covering family — every bounded subset of the request that is witnessable from this session — write it into the PRD, execute every member. Single-subset delivery is legitimate only when no other witnessable subset exists. At end-of-turn, name the residual complement explicitly with the reason each excluded piece falls outside reach.
+
+Enforcement is on what is delivered, not on which words appear. Before closing the turn, check that committed work + named complement = witnessable closure of the request. Anything witnessable that falls in neither set means the cover is not yet maximal — re-enter planning to expand it. Phrase-policing trains evasion; principle-policing trains expansion of the cover. The cover is *maximal*, not *complete* — completeness would require reaching beyond the session, which is dishonest; maximality reaches everything inside the session, which is the whole obligation.
+
+=== MUTABLES.YML — MACHINE-CHECKED DISCIPLINE ===
+
+`.gm/mutables.yml` is co-equal with `.gm/prd.yml`. PLAN enumerates every unknown into it; EXECUTE resolves each entry to `status: witnessed` with filled `witness_evidence`; EMIT is hard-blocked while any entry is `status: unknown`. The pre-tool-use hook denies Write/Edit/NotebookEdit and `git commit`/`git push` while unresolved entries exist; the stop hook denies turn-stop the same way. Resolution = write-back to the file with concrete proof (file:line, codesearch hit, exec output). Saying "I resolved it" without updating the file leaves the gate closed.
+
+=== SMOKE-PAGE BAN — USE window.__debug ===
+
+`window.__debug` is the in-page observability registry. Each module registers on mount, deregisters on unmount. Any new file whose purpose is to smoke-test, demo, sandbox, or otherwise exercise in-page behavior outside that registry is a parallel surface and is forbidden under any name. Extend the registry instead and exercise it from `test.js` at project root.

package/prompts/session-start.txt

@@ -0,0 +1,15 @@
+BLOCKING REQUIREMENT — READ THIS FIRST: Your VERY FIRST action on EVERY user message MUST be to invoke the Skill tool with skill: "gm:gm". Do NOT read files, do NOT search, do NOT answer, do NOT plan, do NOT use any other tool before invoking skill: "gm:gm". This is non-negotiable. If you respond without invoking gm:gm first, you are violating a hard constraint.
+
+=== TOOL RULES ===
+
+Skill tool: invoke skills by name (e.g. skill: "gm:gm"). Never use the Agent tool to load skills.
+
+Bash tool: only these formats are allowed —
+  exec:nodejs / exec:python / exec:bash / exec:typescript / exec:go / exec:rust / exec:c / exec:cpp / exec:java
+  exec:browser  (JS automation against `page`)
+  exec:codesearch  (natural language search)
+  exec:status / exec:sleep / exec:close / exec:runner / exec:type
+  git <args>  (git commands directly, no exec: prefix)
+  Everything else is blocked. Never Bash(node ...) or Bash(npm ...) or Bash(npx ...).
+
+Glob/Grep/Find/Explore: blocked — use exec:codesearch instead.