gm-skill 2.0.2244 → 2.0.2246

package/AGENTS.md

@@ -101,7 +101,7 @@ Every skill's `allowed-tools:` reduced to `Skill, Read, Write` (plus SKILL.md bo
 
 A task that reduces to read/investigate/report, or a change confined to files the subagent owns for the turn, dispatches straight through -- stating the read-only boundary explicitly ("report only, no writes") is task-scope, not gm-protocol restatement, so it's not a violation of the rule above. A task whose plain description asks for an irreversible or shared-state-affecting action (remove data, force-push, merge/close a PR, deploy, rename a shared branch) is not silently handed off -- name the risk in the prompt and require the subagent to surface it back rather than execute it, the same blast-radius judgment the top-level agent applies to its own actions; the action still routes through the gm-driven skill invocation, never a prompt-authored imperative sequence that bypasses it. Contrast: "find every caller of X and summarize" dispatches as-is; "drop the staging table and reseed it" gets confirmed before any subagent is scoped to carry it out.
 
-**A subagent dispatched to build/commit/push in a submodule (`agentplug`, `rs-plugkit`, `rs-codeinsight`, `agentplug-bert`, `agentplug-libsql`, `agentplug-treesitter`, `rs-search`) closes the loop back to gm's own pin as its last step, every time, no exceptions.** These repos are checked out INSIDE this repo's own tree as git submodules -- a commit landed and pushed only to the submodule's standalone remote leaves gm's own tracked pointer silently pointing at the prior commit, invisible until the next explicit `git rev-parse HEAD` (submodule) vs `git rev-parse origin/main` comparison surfaces the drift. Incident history: the recall store (`recall: gm submodule-pin-drift incident history`). Every subagent prompt dispatching work into one of these submodules must include, as an explicit final step: after pushing the submodule's own commit, `cd` back to gm's root, `git add <submodule-path>`, and commit+push gm's own updated pointer in the SAME turn -- never leave that as an implicit "someone will notice." A top-level `gm` session that itself lands a submodule-touching commit (directly or via a subagent) checks `git status --porcelain` for the submodule path specifically before calling the turn done.
+**A subagent dispatched to build/commit/push in a submodule (`agentplug`, `rs-plugkit`, `rs-codeinsight`, `agentplug-bert`, `agentplug-libsql`, `agentplug-treesitter`, `rs-search`, `gm-config`) closes the loop back to gm's own pin as its last step, every time, no exceptions.** These repos are checked out INSIDE this repo's own tree as git submodules -- a commit landed and pushed only to the submodule's standalone remote leaves gm's own tracked pointer silently pointing at the prior commit, invisible until the next explicit `git rev-parse HEAD` (submodule) vs `git rev-parse origin/main` comparison surfaces the drift. Incident history: the recall store (`recall: gm submodule-pin-drift incident history`). Every subagent prompt dispatching work into one of these submodules must include, as an explicit final step: after pushing the submodule's own commit, `cd` back to gm's root, `git add <submodule-path>`, and commit+push gm's own updated pointer in the SAME turn -- never leave that as an implicit "someone will notice." A top-level `gm` session that itself lands a submodule-touching commit (directly or via a subagent) checks `git status --porcelain` for the submodule path specifically before calling the turn done.
 
 ## Core Rules
 

package/README.md

@@ -139,7 +139,9 @@ Any project using gm can override its instruction prose, gate-denial text, resid
 { "repo": "https://github.com/your-org/your-gm-config", "branch": "main", "path": "" }
 ```
 
-The daemon clones and re-syncs that repo on a poll interval (default 600s, `.gm/daemon-config-reference.md`'s `plugin_update_poll_interval_secs`), so a push to your config repo reaches every project pointing at it within that window -- not instant, eventually consistent. Resolution order per key is always: your project's own `.gm/instructions/<key>.md` file wins outright, then your config repo's synced copy, then gm's compiled default. Gate hooks (arbitrary JS) only ever run from the local file tier, never from a synced config repo, so a remote you don't control can restyle prose but never gain code execution on your machine. A malformed `source.json` or unreachable repo degrades to the compiled default and logs why -- it never crashes a dispatch.
+The daemon clones and re-syncs that repo on a poll interval (default 600s, `.gm/daemon-config-reference.md`'s `plugin_update_poll_interval_secs`), so a push to your config repo reaches every project pointing at it within that window -- not instant, eventually consistent. Resolution order per key is always: your project's own `.gm/instructions/<key>.md` file wins outright, then your config repo's synced copy, then gm's compiled default. A malformed `source.json` or unreachable repo degrades to the compiled default and logs why -- it never crashes a dispatch. No project sets up `source.json` for itself before checking: gm ships pointed at `AnEntrypoint/gm-config` by default, so every fresh install already pulls from a shared config repo unless a project's own `source.json` says otherwise.
+
+**WARNING: a config repo has the same authority as your own local git history, including code execution.** Gate hooks (arbitrary JS run at gate evaluation) execute from a synced config repo exactly as they would from a file in your own project. Anyone who can push to that repo, or compromise it, gets code execution on every machine syncing it -- there is no sandboxing, no local review step, no confirmation prompt. Only point `source.json` at a repo you trust with that level of access; the same trust model applies whether the repo is `AnEntrypoint/gm-config` or one your own org runs.
 
 ### ground truth
 
@@ -164,14 +166,15 @@ The plugkit wasm itself is built and released by [rs-plugkit](https://github.com
 
 ## developing gm itself
 
-Seven git submodules, source only, none compiled artifacts:
+Eight git submodules, source only, none compiled artifacts:
 
 - **`rs-plugkit/`** -- the wasm guest: orchestrator, gates, spool dispatch (the gm "brain")
 - **`agentplug/`** -- the native host that loads that wasm and drives `browser`/`task` natively via CDP, plus the shared-plugin loader
 - **`agentplug-bert`**, **`agentplug-libsql`**, **`agentplug-treesitter`** -- the shared native plugins agentplug loads alongside the gm wasm (embeddings, vector storage, syntax parsing)
 - **`rs-codeinsight`**, **`rs-search`** -- codebase-indexing and search backends the `codesearch` verb consumes
+- **`gm-config/`** -- the default remote-config repo (prose, FSM graph, gate hooks, policy), a regenerated snapshot of the compiled defaults; gm points at it out of the box unless a project or user configures its own
 
-A plain `git clone` leaves all seven empty -- clone with submodules, or init them after the fact:
+A plain `git clone` leaves all eight empty -- clone with submodules, or init them after the fact:
 
 ```
 git clone --recurse-submodules https://github.com/AnEntrypoint/gm.git

package/gm-plugkit/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gm-plugkit",
-  "version": "2.0.2244",
+  "version": "2.0.2246",
   "description": "Bootstrap and daemon-spawn tool for gm plugkit binary. Downloads the correct platform wasm, verifies SHA256, and launches agentplug-runner (the native wasm host) as the spool watcher daemon.",
   "main": "index.js",
   "bin": {

package/gm.json

@@ -1,6 +1,6 @@
 {
   "name": "gm",
-  "version": "2.0.2244",
+  "version": "2.0.2246",
   "description": "Spool-dispatch orchestration engine with unified state machine, skills, and automated git enforcement",
   "author": "AnEntrypoint",
   "license": "MIT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gm-skill",
-  "version": "2.0.2244",
+  "version": "2.0.2246",
   "description": "Canonical universal harness — AI-native software engineering via skill-driven orchestration; bootstraps plugkit for task execution and session isolation. Install in any AI coding agent host.",
   "author": "AnEntrypoint",
   "license": "MIT",