gm-skill 2.0.2087 → 2.0.2089

package/README.md

@@ -87,7 +87,7 @@ Every tool the agent uses is a dispatch verb. No direct shell, no direct file wr
 - **`recall`**: vector + KV recall against `rs-learn`, scored by cosine x recency, namespace-aware
 - **`codesearch`**: semantic vector search across the project
 - **`memorize`**: write to the recall index (with the BGE query/passage prefix asymmetry)
-- **`browser`**: headful-by-default Chrome session driven natively by `agentplug` (CDP direct, no JS wrapper) -- a process-wide session registry keeps the launched Chrome child + CDP port alive across dispatches instead of relaunching per-call, profile persisted at `.gm/browser-chrome-profile-<session_id>/`; `session new|list|close|reset <id>` manages sessions explicitly
+- **`browser`**: headful-by-default Chrome session driven natively by `agentplug` (CDP direct, no JS wrapper) -- a process-wide session registry keeps the launched Chrome child + CDP port alive across dispatches instead of relaunching per-call, profile persisted at `.gm/browser-chrome-profile-<session_id>/`; `session new|list|close|reset <id>` manages sessions explicitly; `screenshot[=name]`/`dom=<selector>`/`timeout=<ms>` body prefixes stack with a plain eval body for capture and DOM-scoped queries
 - **`git_status` / `branch_status` / `git_push`**: git verbs that gate on porcelain
 - **`filter`**: in-wasm stdout-compaction (grep/ls/tree/json/diff)
 
@@ -99,6 +99,10 @@ Orchestration state is tracked via `.gm/` marker files, not hook events. The gat
 - **turn entry**: the `instruction` verb reminds the agent to dispatch first and attaches the per-prompt auto-recall pack
 - **pre-tool-use**: blocks Write/Edit/git before the gm skill fires for the turn
 - **stop**: blocks session end while `.gm/prd.yml` has open items, mutables are unresolved, residual-scan hasn't fired, or the worktree is dirty or unpushed
+- **VERIFY -> CONSOLIDATE**: `residual-scan-fired`, `prd-all-closed`, `mutables-all-resolved`, `claim-audit-clean` (every AGENTS.md/recall claim naming a commit hash resolves against real git log), `submodules-clean` (every tracked submodule gitlink matches that submodule's own live HEAD)
+- **CONSOLIDATE -> COMPLETE**: `prd-all-closed`, `mutables-all-resolved`, `worktree-clean`, `residual-scan-fired`, `ci-validated-fresh` (`.gm/exec-spool/.ci-validated` matches current HEAD sha), `browser-witness-coverage`, `submodules-clean`
+
+The gate graph itself is data, not hardcoded Rust: a project's `.gm/instructions/fsm/graph.json` (written by the `fsm-vendor` verb) can add states, rewire edges, or swap which gates guard which transition, including a `policy` block that externalizes previously-hardcoded behavior (status vocabularies, witness-requirement toggles, CAS retry attempts) as project-overridable JSON.
 
 ### ground truth
 
@@ -143,3 +147,7 @@ Empty submodule directories after a normal `git clone` are expected, not a bug -
 ## license
 
 MIT
+
+## donations
+
+BTC: `15FLMay4of9rk4jK2davzzL4HDdGQtscGX`

package/bin/plugkit-slim.wasm.sha256

@@ -1 +1 @@
-45b48b0ab0d6e87742499e779eb662bd2b4620070760e397d77a15f99fd22a65  plugkit-slim.wasm
+679ca6886f25de4843570a38e52d153afae973ce0fa0837cdfdae85b60230fb9  plugkit-slim.wasm

package/bin/plugkit.version

@@ -1 +1 @@
-0.1.961
+0.1.962

package/bin/plugkit.wasm.sha256

@@ -1 +1 @@
-e60d087a568e33418ad9f934c4c12c87357e94f987853248f36d9dea0c8a807f  plugkit.wasm
+12bf61f61d47fddffc6ad0d7d1ced8e6d2616959a2813547da00ee913abc50cd  plugkit.wasm

package/gm-plugkit/bootstrap.js

@@ -659,7 +659,6 @@ function spawnPinnedBoot(extraArgs) {
 
 function discoverBundledSkillsAndSources() {
   const found = new Map();
-  found.set('gm', path.join(__dirname, 'SKILL.md'));
   try {
     for (const f of fs.readdirSync(__dirname)) {
       const m = f.match(/^SKILL-(.+)\.md$/);

package/gm-plugkit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gm-plugkit",
-  "version": "2.0.2087",
+  "version": "2.0.2089",
   "description": "Bootstrap and daemon-spawn tool for gm plugkit binary. Downloads the correct platform wasm, verifies SHA256, and launches agentplug-runner (the native wasm host) as the spool watcher daemon.",
   "main": "index.js",
   "bin": {

package/gm-plugkit/plugkit-slim.wasm.sha256

@@ -1 +1 @@
-45b48b0ab0d6e87742499e779eb662bd2b4620070760e397d77a15f99fd22a65  plugkit-slim.wasm
+679ca6886f25de4843570a38e52d153afae973ce0fa0837cdfdae85b60230fb9  plugkit-slim.wasm

package/gm-plugkit/plugkit.version

@@ -1 +1 @@
-0.1.961
+0.1.962

package/gm.json

@@ -1,6 +1,6 @@
 {
   "name": "gm",
-  "version": "2.0.2087",
+  "version": "2.0.2089",
   "description": "Spool-dispatch orchestration engine with unified state machine, skills, and automated git enforcement",
   "author": "AnEntrypoint",
   "license": "MIT",
@@ -17,5 +17,5 @@
   "publishConfig": {
     "access": "public"
   },
-  "plugkitVersion": "0.1.961"
+  "plugkitVersion": "0.1.962"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gm-skill",
-  "version": "2.0.2087",
+  "version": "2.0.2089",
   "description": "Canonical universal harness — AI-native software engineering via skill-driven orchestration; bootstraps plugkit for task execution and session isolation. Install in any AI coding agent host.",
   "author": "AnEntrypoint",
   "license": "MIT",

package/scripts/check-prose-bundle.mjs

@@ -5,142 +5,139 @@ import process from 'node:process';
 const root = path.resolve(path.dirname(new URL(import.meta.url).pathname.replace(/^\/([A-Za-z]:)/, '$1')), '..');
 const bundleDir = path.join(root, 'gm-plugkit', 'instructions');
 
-const KEYS = [
+const GATE_AND_RESIDUAL_KEYS = [
   'gates/long-gap-no-instruction',
   'residual/prd-open', 'residual/browser-open', 'residual/tasks-running',
   'residual/dirty-tree', 'residual/imperative',
 ];
 
-const missing = [];
-const empty = [];
-for (const key of KEYS) {
-  const fp = path.join(bundleDir, `${key}.md`);
-  if (!fs.existsSync(fp)) { missing.push(key); continue; }
-  if (fs.readFileSync(fp, 'utf8').trim() === '') empty.push(key);
+function validateBundleCompleteness() {
+  const missing = [];
+  const empty = [];
+  for (const key of GATE_AND_RESIDUAL_KEYS) {
+    const fp = path.join(bundleDir, `${key}.md`);
+    if (!fs.existsSync(fp)) { missing.push(key); continue; }
+    if (fs.readFileSync(fp, 'utf8').trim() === '') empty.push(key);
+  }
+  if (missing.length || empty.length) {
+    if (missing.length) console.error(`prose bundle missing entries: ${missing.join(', ')}`);
+    if (empty.length) console.error(`prose bundle empty entries: ${empty.join(', ')}`);
+    return false;
+  }
+  console.log(`prose bundle complete: ${GATE_AND_RESIDUAL_KEYS.length} keys present and non-empty`);
+  return true;
+}
+
+function resolveConformancePaths() {
+  const proseSourceDir = path.join(root, 'rs-plugkit', 'crates', 'plugkit-core', 'src', 'orchestrator', 'instructions', 'prose');
+  return {
+    proseSourceDir,
+    browserMdPath: path.join(proseSourceDir, 'browser.md'),
+    executeMdPath: path.join(proseSourceDir, 'execute.md'),
+    browserRsPath: path.join(root, 'agentplug', 'crates', 'agentplug-host', 'src', 'browser.rs'),
+    cdpEvalJsPath: path.join(root, 'agentplug', 'crates', 'agentplug-host', 'src', 'cdp_eval.js'),
+    execJsRsPath: path.join(root, 'agentplug', 'crates', 'agentplug-host', 'src', 'exec_js.rs'),
+  };
 }
 
-let bundleFailed = false;
-if (missing.length || empty.length) {
-  bundleFailed = true;
-  if (missing.length) console.error(`prose bundle missing entries: ${missing.join(', ')}`);
-  if (empty.length) console.error(`prose bundle empty entries: ${empty.join(', ')}`);
-} else {
-  console.log(`prose bundle complete: ${KEYS.length} keys present and non-empty`);
+function checkEveryRequiredFileExists(requiredFiles) {
+  return requiredFiles.filter((p) => !fs.existsSync(p));
 }
 
-// Real conformance run: extract every `browser` verb mode-prefix and
-// exec_js `opts.*` field the served prose promises, and check that the
-// implementing native source (agentplug-host, the sole loader per this
-// repo's own architecture) actually references it. Static, not a live
-// dispatch -- this is a "did anyone even write the code" check, not a
-// behavioral one, but that is exactly what catches a "documented, zero
-// implementing code" gap: this check is what found the browser.md
-// screenshot/dom= gap live (agentplug-host/src/browser.rs had zero
-// BrowserMode variant for either, confirmed by grep before this script
-// was written). Runs against the checked-out submodules, so it only fires
-// in CI/local contexts where they're actually populated (a plain `git
-// clone` without --recurse-submodules leaves them empty per README.md's
-// own documented note -- absence there is skipped, not failed, matching
-// this repo's existing plain-clone tolerance).
-const proseSourceDir = path.join(root, 'rs-plugkit', 'crates', 'plugkit-core', 'src', 'orchestrator', 'instructions', 'prose');
-const browserMdPath = path.join(proseSourceDir, 'browser.md');
-const executeMdPath = path.join(proseSourceDir, 'execute.md');
-const browserRsPath = path.join(root, 'agentplug', 'crates', 'agentplug-host', 'src', 'browser.rs');
-const cdpEvalJsPath = path.join(root, 'agentplug', 'crates', 'agentplug-host', 'src', 'cdp_eval.js');
-const execJsRsPath = path.join(root, 'agentplug', 'crates', 'agentplug-host', 'src', 'exec_js.rs');
-
-// Every INDIVIDUAL file this check reads, not just the containing
-// directories -- a submodule can be present but shallow/partial (a
-// degenerate state distinct from "not cloned at all"), and the directory-
-// only check previously crashed with an unhandled ENOENT the moment any one
-// file was individually missing (live-reproduced this session: temporarily
-// removing browser.md alone, with every directory still present, crashed
-// the script instead of skipping gracefully).
-const requiredFiles = [browserMdPath, executeMdPath, browserRsPath, cdpEvalJsPath, execJsRsPath];
-const missingFiles = requiredFiles.filter((p) => !fs.existsSync(p));
-const submodulesPresent = missingFiles.length === 0;
-
-let conformanceFailed = false;
-if (!submodulesPresent) {
-  console.log(`prose-conformance: skipping -- missing file(s) (submodules not populated, or a partial/shallow checkout): ${missingFiles.map((p) => path.relative(root, p)).join(', ')}`);
-} else {
-  const browserMd = fs.readFileSync(path.join(proseSourceDir, 'browser.md'), 'utf8');
-  const browserRs = fs.readFileSync(browserRsPath, 'utf8');
-  const cdpEvalJs = fs.readFileSync(cdpEvalJsPath, 'utf8');
-  const executeMd = fs.readFileSync(path.join(proseSourceDir, 'execute.md'), 'utf8');
-  const execJsRs = fs.readFileSync(execJsRsPath, 'utf8');
-
-  // Extract every backtick-quoted `<word>\n<expression>` / `<word>=` mode
-  // prefix from browser.md's "Body shapes" code block -- the exact syntax
-  // the served prose promises as a real body-shape prefix.
+function extractBrowserModePrefixesFromProse(browserMd) {
   const bodyShapesMatch = browserMd.match(/## Body shapes[\s\S]*?```\r?\n([\s\S]*?)```/);
   const promisedPrefixes = [];
-  if (bodyShapesMatch) {
-    for (const line of bodyShapesMatch[1].split(/\r?\n/)) {
-      const t = line.trim();
-      if (!t) continue;
-      // "session new" / "session list" / "session close <id>" -> session subcommands
-      const sessionMatch = t.match(/^session (\w+)/);
-      if (sessionMatch) { promisedPrefixes.push({ kind: 'session', name: sessionMatch[1] }); continue; }
-      // "<word>\n<expression>" or "<word> interval=...\n<expression>" -> bare mode word
-      const modeMatch = t.match(/^(\w+)(?:\s+\w+=<[^>]+>)*\\n/);
-      if (modeMatch && !['url', 'timeout', 'dom'].includes(modeMatch[1])) { promisedPrefixes.push({ kind: 'mode', name: modeMatch[1] }); continue; }
-      // "<word>=<...>" -> key= prefix (url=, timeout=, dom=)
-      const kvMatch = t.match(/^(\w+)=</);
-      if (kvMatch) { promisedPrefixes.push({ kind: 'kv', name: kvMatch[1] }); continue; }
-    }
+  if (!bodyShapesMatch) return promisedPrefixes;
+
+  for (const line of bodyShapesMatch[1].split(/\r?\n/)) {
+    const t = line.trim();
+    if (!t) continue;
+
+    const sessionMatch = t.match(/^session (\w+)/);
+    if (sessionMatch) { promisedPrefixes.push({ kind: 'session', name: sessionMatch[1] }); continue; }
+
+    const modeMatch = t.match(/^(\w+)(?:\s+\w+=<[^>]+>)*\\n/);
+    if (modeMatch && !['url', 'timeout', 'dom'].includes(modeMatch[1])) { promisedPrefixes.push({ kind: 'mode', name: modeMatch[1] }); continue; }
+
+    const kvMatch = t.match(/^(\w+)=</);
+    if (kvMatch) { promisedPrefixes.push({ kind: 'kv', name: kvMatch[1] }); continue; }
   }
+  return promisedPrefixes;
+}
+
+function checkPrefixInImplementingCode(kind, name, browserRs, cdpEvalJs) {
+  if (kind === 'session') return browserRs.includes(`"session ${name}`);
+  if (kind === 'kv') return browserRs.includes(`"${name}="`) || cdpEvalJs.includes(`${name}=`);
+  return browserRs.includes(`"${name}\\n"`) || browserRs.includes(`"${name}"`) || cdpEvalJs.includes(`'${name}'`) || cdpEvalJs.includes(`"${name}"`);
+}
 
+function crossReferenceBrowserPrefixes(browserMd, browserRs, cdpEvalJs) {
+  const promisedPrefixes = extractBrowserModePrefixesFromProse(browserMd);
   const conformanceFindings = [];
+
   for (const { kind, name } of promisedPrefixes) {
-    // Every promised prefix must appear as a real string literal in either
-    // the Rust prefix-stripping logic or the JS mode-dispatch logic -- one
-    // hit in either is sufficient (some prefixes are parsed Rust-side,
-    // others are only checked JS-side against the `mode` string agentplug
-    // passes through). `session <word>` prefixes are matched as the real
-    // "session <word>" literal parse_session_command uses, not the bare
-    // word alone (which would false-positive-pass on any incidental
-    // substring match).
-    let inRust, inJs;
-    if (kind === 'session') {
-      inRust = browserRs.includes(`"session ${name}`);
-      inJs = false;
-    } else if (kind === 'kv') {
-      inRust = browserRs.includes(`"${name}="`);
-      inJs = cdpEvalJs.includes(`${name}=`);
-    } else {
-      inRust = browserRs.includes(`"${name}\\n"`) || browserRs.includes(`"${name}"`);
-      inJs = cdpEvalJs.includes(`'${name}'`) || cdpEvalJs.includes(`"${name}"`);
-    }
-    if (!inRust && !inJs) {
+    if (!checkPrefixInImplementingCode(kind, name, browserRs, cdpEvalJs)) {
       conformanceFindings.push(`browser.md promises ${kind} prefix "${name}" with zero implementing-code reference in browser.rs or cdp_eval.js`);
     }
   }
+  return { conformanceFindings, promisedPrefixCount: promisedPrefixes.length };
+}
 
-  // exec_js opts.* fields: extract every `opts.<fieldName>` token referenced
-  // in execute.md's prose and check exec_js.rs actually reads it via
-  // opts.get("<fieldName>").
+function extractExecJsOptsFieldsFromProse(executeMd) {
   const optsFieldRe = /opts\.([a-zA-Z][a-zA-Z0-9]*)/g;
   const promisedOptsFields = new Set();
   let m;
-  while ((m = optsFieldRe.exec(executeMd)) !== null) promisedOptsFields.add(m[1]);
+  while ((m = optsFieldRe.exec(executeMd)) !== null) {
+    if (m[1] !== 'true' && m[1] !== 'false') promisedOptsFields.add(m[1]);
+  }
+  return promisedOptsFields;
+}
+
+function crossReferenceExecJsOptsFields(executeMd, execJsRs) {
+  const promisedOptsFields = extractExecJsOptsFieldsFromProse(executeMd);
+  const conformanceFindings = [];
+
   for (const field of promisedOptsFields) {
-    if (field === 'true' || field === 'false') continue;
-    const needle = `opts.get("${field}")`;
-    if (!execJsRs.includes(needle)) {
+    if (!execJsRs.includes(`opts.get("${field}")`)) {
       conformanceFindings.push(`execute.md promises exec_js opts.${field} with no matching opts.get("${field}") in exec_js.rs`);
     }
   }
+  return { conformanceFindings, promisedOptsFieldCount: promisedOptsFields.size };
+}
+
+function runConformanceCheck() {
+  const paths = resolveConformancePaths();
+  const requiredFiles = [paths.browserMdPath, paths.executeMdPath, paths.browserRsPath, paths.cdpEvalJsPath, paths.execJsRsPath];
+  const missingFiles = checkEveryRequiredFileExists(requiredFiles);
+
+  if (missingFiles.length > 0) {
+    console.log(`prose-conformance: skipping -- missing file(s) (submodules not populated, or a partial/shallow checkout): ${missingFiles.map((p) => path.relative(root, p)).join(', ')}`);
+    return false;
+  }
+
+  const browserMd = fs.readFileSync(paths.browserMdPath, 'utf8');
+  const browserRs = fs.readFileSync(paths.browserRsPath, 'utf8');
+  const cdpEvalJs = fs.readFileSync(paths.cdpEvalJsPath, 'utf8');
+  const executeMd = fs.readFileSync(paths.executeMdPath, 'utf8');
+  const execJsRs = fs.readFileSync(paths.execJsRsPath, 'utf8');
+
+  const browserResult = crossReferenceBrowserPrefixes(browserMd, browserRs, cdpEvalJs);
+  const execJsResult = crossReferenceExecJsOptsFields(executeMd, execJsRs);
+  const allFindings = [...browserResult.conformanceFindings, ...execJsResult.conformanceFindings];
 
-  if (conformanceFindings.length) {
-    conformanceFailed = true;
+  if (allFindings.length) {
     console.error('prose-conformance FAILED -- prose promises capabilities with no confirmed implementing-code reference:');
-    for (const f of conformanceFindings) console.error(`  - ${f}`);
-  } else {
-    console.log(`prose-conformance: ${promisedPrefixes.length} browser mode-prefixes + ${promisedOptsFields.size} exec_js opts fields all have a matching implementing-code reference`);
+    for (const f of allFindings) console.error(`  - ${f}`);
+    return true;
   }
+
+  console.log(`prose-conformance: ${browserResult.promisedPrefixCount} browser mode-prefixes + ${execJsResult.promisedOptsFieldCount} exec_js opts fields all have a matching implementing-code reference`);
+  return false;
 }
 
+const bundleFailed = !validateBundleCompleteness();
+const conformanceFailed = runConformanceCheck();
+
 if (bundleFailed || conformanceFailed) {
   process.exit(1);
-}
+}