gsd-remix 1.0.2 → 1.1.1

package/README.md

@@ -72,6 +72,7 @@ npx gsd-remix@latest
 All remix-specific changes are tracked in [docs/REMIX-DIFFERENCES.md](docs/REMIX-DIFFERENCES.md). If this fork changes upstream behavior, installation, prompts, queries, or workflow defaults, it should be recorded there.
 
 Current highlights:
+- **Slimmed to a focused core (1.1.0)** — trimmed the command/agent surface down to the essential discuss → plan → execute → verify loop. Removed the update-check system (`/gsd-update`, `/gsd-reapply-patches`, background update hook) and the heavyweight ceremonies (AI-integration wizard, Nyquist validation, secure-phase, multi-workspace/workstreams, spike/sketch, intel/graphify). Unified the model profiles and folded security review into execution. Docs maintained in **English + 简体中文** only.
 - Published independently on npm as `gsd-remix`, while keeping the `/gsd-*` command surface and core planning layout compatible
 - Isolates the bundled SDK namespace as `@gsd-remix/sdk` / `gsd-remix-sdk`, so remix installs no longer collide with upstream `@gsd-build/sdk`
 - Token-efficiency changes in the main workflow path, including summary-first discuss history loading and low-complexity inline execution routing
@@ -106,15 +107,16 @@ GSD fixes that. It's the context engineering layer that makes Claude Code reliab
 
 People who want to describe what they want and have it built correctly — without pretending they're running a 50-person engineering org.
 
-Built-in quality gates catch real problems: schema drift detection flags ORM changes missing migrations, security enforcement anchors verification to threat models, and scope reduction detection prevents the planner from silently dropping your requirements.
+Built-in quality gates catch real problems: schema drift detection flags ORM changes missing migrations, a diff-scoped security review gate runs during execution, and scope reduction detection prevents the planner from silently dropping your requirements.
 
-### v1.37.0 Highlights
+### 1.1.0 Highlights — The Slim Release
 
-- **Spiking & sketching** — `/gsd-spike` runs 2–5 focused experiments with Given/When/Then verdicts; `/gsd-sketch` produces 2–3 interactive HTML mockup variants per design question — both store artifacts in `.planning/` and pair with wrap-up commands to package findings into project-local skills
-- **Agent size-budget enforcement** — Tiered line-count limits (XL: 1 600, Large: 1 000, Default: 500) keep agent prompts lean; violations surface in CI
-- **Shared boilerplate extraction** — Mandatory-initial-read and project-skills-discovery logic extracted to reference files, reducing duplication across a dozen agents
-- **Runtime health checks** — `discuss-phase`, `plan-phase`, and `execute-phase` now run deterministic runtime preflight checks up front; `/gsd-health --runtime` diagnoses install/runtime drift and `/gsd-health --runtime --repair` rebuilds the bundled SDK
-- **Isolated SDK package/binary** — the remix now builds its bundled SDK as `@gsd-remix/sdk` with the `gsd-remix-sdk` binary, avoiding PATH/package collisions with upstream installs
+- **Focused command surface** — Removed ~44 legacy commands and the ceremonies behind them (AI-integration wizard, Nyquist validation, secure-phase, multi-workspace/workstreams, spike/sketch, intel/graphify/scan, docs-ingest, developer profiling, ship/stats/manager/forensics). What remains is the core loop plus the utilities that earn their keep.
+- **No more update machinery** — Dropped `/gsd-update`, `/gsd-reapply-patches`, and the background update-check hook. Update by re-running `npx gsd-remix@latest`.
+- **Unified model profiles** — All named profiles resolve to one allocation: Opus for planning/research/debugging, Sonnet for everything else. Use `inherit` for non-Anthropic providers.
+- **Security review folded into execution** — A diff-scoped security review gate runs during `/gsd-execute-phase` instead of a separate secure-phase command; it prefers an installed company security skill and falls back to the bundled generic reviewer.
+- **18 focused agents** and **English + 简体中文** docs only.
+- **Runtime health + isolated SDK** — `/gsd-health --runtime` diagnoses install drift and `/gsd-health --runtime --repair` rebuilds the bundled `@gsd-remix/sdk` (`gsd-remix-sdk` binary), avoiding collisions with upstream installs.
 
 ---
 
@@ -429,14 +431,13 @@ If everything passes, you move on. If something's broken, you don't manually deb
 
 ---
 
-### 6. Repeat → Ship → Complete → Next Milestone
+### 6. Repeat → Complete → Next Milestone
 
 ```
 /gsd-discuss-phase 2
 /gsd-plan-phase 2
 /gsd-execute-phase 2
 /gsd-verify-work 2
-/gsd-ship 2                  # Create PR from verified work
 ...
 /gsd-complete-milestone
 /gsd-new-milestone
@@ -448,7 +449,7 @@ Or let GSD figure out the next step automatically:
 /gsd-next                    # Auto-detect and run next step
 ```
 
-Loop **discuss → plan → execute → verify → ship** until milestone complete.
+Loop **discuss → plan → execute → verify** until milestone complete.
 
 If you want faster intake during discussion, use `/gsd-discuss-phase <n> --batch` to answer a small grouped set of questions at once instead of one-by-one. Use `--chain` to auto-chain discuss into plan+execute without stopping between steps.
 
@@ -511,8 +512,6 @@ GSD handles it for you:
 | `PLAN.md` | Atomic task with XML structure, verification steps |
 | `SUMMARY.md` | What happened, what changed, committed to history |
 | `todos/` | Captured ideas and tasks for later work |
-| `threads/` | Persistent context threads for cross-session work |
-| `seeds/` | Forward-looking ideas that surface at the right milestone |
 
 Size limits based on where Claude's quality degrades. Stay under, get consistent excellence.
 
@@ -586,50 +585,13 @@ You're never locked in. The system adapts.
 |---------|--------------|
 | `/gsd-new-project [--auto]` | Full initialization: questions → research → requirements → roadmap |
 | `/gsd-discuss-phase [N] [--auto] [--analyze] [--chain]` | Capture implementation decisions before planning (`--analyze` adds trade-off analysis, `--chain` auto-chains into plan+execute) |
-| `/gsd-plan-phase [N] [--auto] [--reviews]` | Research + plan + verify for a phase (`--reviews` loads codebase review findings) |
+| `/gsd-plan-phase [N] [--auto]` | Research + plan + verify for a phase |
 | `/gsd-execute-phase <N>` | Execute all plans in parallel waves, verify when complete |
 | `/gsd-verify-work [N]` | Manual user acceptance testing ¹ |
-| `/gsd-ship [N] [--draft]` | Create PR from verified phase work with auto-generated body |
 | `/gsd-next` | Automatically advance to the next logical workflow step |
 | `/gsd-fast <text>` | Inline trivial tasks — skips planning entirely, executes immediately |
-| `/gsd-audit-milestone` | Verify milestone achieved its definition of done |
 | `/gsd-complete-milestone` | Archive milestone, tag release |
 | `/gsd-new-milestone [name]` | Start next version: questions → research → requirements → roadmap |
-| `/gsd-forensics [desc]` | Post-mortem investigation of failed workflow runs (diagnoses stuck loops, missing artifacts, git anomalies) |
-| `/gsd-milestone-summary [version]` | Generate comprehensive project summary for team onboarding and review |
-
-### Workstreams
-
-| Command | What it does |
-|---------|--------------|
-| `/gsd-workstreams list` | Show all workstreams and their status |
-| `/gsd-workstreams create <name>` | Create a namespaced workstream for parallel milestone work |
-| `/gsd-workstreams switch <name>` | Switch active workstream |
-| `/gsd-workstreams complete <name>` | Complete and merge a workstream |
-
-### Multi-Project Workspaces
-
-| Command | What it does |
-|---------|--------------|
-| `/gsd-new-workspace` | Create isolated workspace with repo copies (worktrees or clones) |
-| `/gsd-list-workspaces` | Show all GSD workspaces and their status |
-| `/gsd-remove-workspace` | Remove workspace and clean up worktrees |
-
-### Spiking & Sketching
-
-| Command | What it does |
-|---------|--------------|
-| `/gsd-spike [idea] [--quick]` | Throwaway experiments to validate feasibility before planning — no project init required |
-| `/gsd-sketch [idea] [--quick]` | Throwaway HTML mockups with multi-variant exploration — no project init required |
-| `/gsd-spike-wrap-up` | Package spike findings into a project-local skill for future build conversations |
-| `/gsd-sketch-wrap-up` | Package sketch design findings into a project-local skill for future builds |
-
-### UI Design
-
-| Command | What it does |
-|---------|--------------|
-| `/gsd-ui-phase [N]` | Generate UI design contract (UI-SPEC.md) for frontend phases |
-| `/gsd-ui-review [N]` | Retroactive 6-pillar visual audit of implemented frontend code |
 
 ### Navigation
 
@@ -638,16 +600,12 @@ You're never locked in. The system adapts.
 | `/gsd-progress` | Where am I? What's next? |
 | `/gsd-next` | Auto-detect state and run the next step |
 | `/gsd-help` | Show all commands and usage guide |
-| `/gsd-update` | Update GSD with changelog preview |
-| `/gsd-join-discord` | Join the GSD Discord community |
-| `/gsd-manager` | Interactive command center for managing multiple phases |
 
 ### Brownfield
 
 | Command | What it does |
 |---------|--------------|
 | `/gsd-map-codebase [area]` | Analyze existing codebase before new-project |
-| `/gsd-ingest-docs [dir]` | Scan a repo of mixed ADRs, PRDs, SPECs, and DOCs and bootstrap or merge the full `.planning/` setup in one pass — parallel classification, synthesis with precedence rules, and a three-bucket conflicts report |
 
 ### Phase Management
 
@@ -656,8 +614,6 @@ You're never locked in. The system adapts.
 | `/gsd-add-phase` | Append phase to roadmap |
 | `/gsd-insert-phase [N]` | Insert urgent work between phases |
 | `/gsd-remove-phase [N]` | Remove future phase, renumber |
-| `/gsd-list-phase-assumptions [N]` | See Claude's intended approach before planning |
-| `/gsd-plan-milestone-gaps` | Create phases to close gaps from audit |
 
 ### Session
 
@@ -665,39 +621,27 @@ You're never locked in. The system adapts.
 |---------|--------------|
 | `/gsd-pause-work` | Create handoff when stopping mid-phase (writes HANDOFF.json) |
 | `/gsd-resume-work` | Restore from last session |
-| `/gsd-session-report` | Generate session summary with work performed and outcomes |
-
-### Workstreams
-
-| Command | What it does |
-|---------|--------------|
-| `/gsd-workstreams` | Manage parallel workstreams (list, create, switch, status, progress, complete) |
 
 ### Code Quality
 
 | Command | What it does |
 |---------|--------------|
-| `/gsd-review` | Cross-AI peer review of current phase or branch |
-| `/gsd-secure-phase [N]` | Security enforcement with threat-model-anchored verification |
+| `/gsd-code-review [N]` | Review phase-changed source files for bugs, security issues, and quality problems |
+| `/gsd-code-review-fix [N]` | Auto-fix issues found by code review, one atomic commit per fix |
 | `/gsd-pr-branch` | Create clean PR branch filtering `.planning/` commits |
-| `/gsd-audit-uat` | Audit verification debt — find phases missing UAT |
-| `/gsd-docs-update` | Verified documentation generation with doc-writer and doc-verifier agents |
 
-### Backlog & Threads
+### Backlog
 
 | Command | What it does |
 |---------|--------------|
-| `/gsd-plant-seed <idea>` | Capture forward-looking ideas with trigger conditions — surfaces at the right milestone |
 | `/gsd-add-backlog <desc>` | Add idea to backlog parking lot (999.x numbering, outside active sequence) |
 | `/gsd-review-backlog` | Review and promote backlog items to active milestone or remove stale entries |
-| `/gsd-thread [name]` | Persistent context threads — lightweight cross-session knowledge for work spanning multiple sessions |
 
 ### Utilities
 
 | Command | What it does |
 |---------|--------------|
 | `/gsd-settings` | Configure model profile and workflow agents |
-| `/gsd-set-profile <profile>` | Switch model profile (quality/balanced/budget/inherit) |
 | `/gsd-add-todo [desc]` | Capture idea for later |
 | `/gsd-check-todos` | List pending todos |
 | `/gsd-debug [desc]` | Systematic debugging with persistent state |
@@ -705,8 +649,6 @@ You're never locked in. The system adapts.
 | `/gsd-note <text>` | Zero-friction idea capture — append, list, or promote notes to todos |
 | `/gsd-quick [--full] [--validate] [--discuss] [--research]` | Execute ad-hoc task with GSD guarantees (`--full` enables all phases, `--validate` adds plan-checking and verification, `--discuss` gathers context first, `--research` investigates approaches before planning) |
 | `/gsd-health [--runtime] [--repair]` | Validate `.planning/` integrity, auto-repair planning issues, confirm runtime identity, or rebuild `gsd-remix-sdk` with `--runtime --repair` |
-| `/gsd-stats` | Display project statistics — phases, plans, requirements, git metrics |
-| `/gsd-profile-user [--questionnaire] [--refresh]` | Generate developer behavioral profile from session analysis for personalized responses |
 
 <sup>¹ Contributed by reddit user OracleGreyBeard</sup>
 
@@ -726,23 +668,16 @@ GSD stores project settings in `.planning/config.json`. Configure during `/gsd-n
 
 ### Model Profiles
 
-Control which Claude model each agent uses. Balance quality vs token spend.
-
-| Profile | Planning | Execution | Verification |
-|---------|----------|-----------|--------------|
-| `quality` | Opus | Opus | Sonnet |
-| `balanced` (default) | Opus | Sonnet | Sonnet |
-| `budget` | Sonnet | Sonnet | Haiku |
-| `inherit` | Inherit | Inherit | Inherit |
+Control which Claude model each agent uses. All named profiles (`quality`, `balanced`, `budget`) resolve to the same unified allocation — Opus for planning, roadmapping, research, and debugging agents; Sonnet for execution, verification, checking, and mapping agents. The profile keys are kept for config compatibility.
 
-Switch profiles:
-```
-/gsd-set-profile budget
-```
+| Profile | Planning / Research / Debugging | Everything else |
+|---------|--------------------------------|-----------------|
+| named profiles | Opus | Sonnet |
+| `inherit` | Inherit | Inherit |
 
 Use `inherit` when using non-Anthropic providers (OpenRouter, local models) or to follow the current runtime model selection (e.g. OpenCode `/model`).
 
-Or configure via `/gsd-settings`.
+Configure via `/gsd-settings`.
 
 ### Workflow Agents
 

package/README.zh-CN.md

@@ -108,7 +108,6 @@ GSD 解决的就是这个问题。它是让 Claude Code 变得可靠的上下文
 
 ### v1.37.0 亮点
 
-- **Spiking 与 sketching** — `/gsd-spike` 可运行 2–5 个聚焦实验并给出 Given/When/Then 结论；`/gsd-sketch` 可围绕设计问题产出 2–3 个交互式 HTML 方案，这两类产物都会落到 `.planning/`，并可配合 wrap-up 命令整理成项目本地 skills
 - **Agent 大小预算约束** — 分级行数上限（XL: 1600、Large: 1000、Default: 500）用于压缩 agent prompt，超限会在 CI 中暴露
 - **共享 boilerplate 抽取** — 将 mandatory-initial-read 和 project-skills-discovery 等逻辑提取到 reference 文件，减少多个 agent 之间的重复内容
 - **Runtime health 检查** — `discuss-phase`、`plan-phase` 和 `execute-phase` 现在都会先运行确定性的 runtime 预检；`/gsd-health --runtime` 可手动诊断安装/runtime 漂移，`/gsd-health --runtime --repair` 可重建内置 SDK
@@ -420,14 +419,13 @@ claude --dangerously-skip-permissions
 
 ---
 
-### 6. 重复 → 发布 → 完成 → 下一个里程碑
+### 6. 重复 → 完成 → 下一个里程碑
 
 ```
 /gsd-discuss-phase 2
 /gsd-plan-phase 2
 /gsd-execute-phase 2
 /gsd-verify-work 2
-/gsd-ship 2                  # 从已验证的工作创建 PR
 ...
 /gsd-complete-milestone
 /gsd-new-milestone
@@ -439,7 +437,7 @@ claude --dangerously-skip-permissions
 /gsd-next                    # 自动检测并执行下一步
 ```
 
-循环执行 **讨论 → 规划 → 执行 → 验证 → 发布**，直到整个里程碑完成。
+循环执行 **讨论 → 规划 → 执行 → 验证**，直到整个里程碑完成。
 
 如果你希望在讨论阶段更快收集信息，可以用 `/gsd-discuss-phase <n> --batch`，一次回答一小组问题，而不是逐个问答。
 
@@ -573,41 +571,13 @@ lmn012o feat(08-02): create registration endpoint
 |------|------|
 | `/gsd-new-project [--auto]` | 完整初始化：提问 → 研究 → 需求 → 路线图 |
 | `/gsd-discuss-phase [N] [--auto] [--analyze]` | 在规划前收集实现决策（`--analyze` 增加权衡分析） |
-| `/gsd-plan-phase [N] [--auto] [--reviews]` | 为某个阶段执行研究 + 规划 + 验证（`--reviews` 加载代码库审查结果） |
+| `/gsd-plan-phase [N] [--auto]` | 为某个阶段执行研究 + 规划 + 验证 |
 | `/gsd-execute-phase <N>` | 以并行 wave 执行全部计划，完成后验证 |
 | `/gsd-verify-work [N]` | 人工用户验收测试 ¹ |
-| `/gsd-ship [N] [--draft]` | 从已验证的阶段工作创建 PR，自动生成 PR 描述 |
 | `/gsd-fast <text>` | 内联处理琐碎任务——完全跳过规划，立即执行 |
 | `/gsd-next` | 自动推进到下一个逻辑工作流步骤 |
-| `/gsd-audit-milestone` | 验证里程碑是否达到完成定义 |
 | `/gsd-complete-milestone` | 归档里程碑并打 release tag |
 | `/gsd-new-milestone [name]` | 开始下一个版本：提问 → 研究 → 需求 → 路线图 |
-| `/gsd-milestone-summary` | 从已完成的里程碑产物生成项目概览，用于团队上手 |
-| `/gsd-forensics` | 对失败或卡住的工作流进行事后调查 |
-
-### 工作流（Workstreams）
-
-| 命令 | 作用 |
-|------|------|
-| `/gsd-workstreams list` | 显示所有工作流及其状态 |
-| `/gsd-workstreams create <name>` | 创建命名空间工作流，用于并行里程碑工作 |
-| `/gsd-workstreams switch <name>` | 切换当前活跃工作流 |
-| `/gsd-workstreams complete <name>` | 完成并合并工作流 |
-
-### 多项目工作区
-
-| 命令 | 作用 |
-|------|------|
-| `/gsd-new-workspace` | 创建隔离工作区，包含仓库副本（worktree 或 clone） |
-| `/gsd-list-workspaces` | 显示所有 GSD 工作区及其状态 |
-| `/gsd-remove-workspace` | 移除工作区并清理 worktree |
-
-### UI 设计
-
-| 命令 | 作用 |
-|------|------|
-| `/gsd-ui-phase [N]` | 为前端阶段生成 UI 设计合约（UI-SPEC.md） |
-| `/gsd-ui-review [N]` | 对已实现前端代码进行 6 维视觉审计 |
 
 ### 导航
 
@@ -616,8 +586,6 @@ lmn012o feat(08-02): create registration endpoint
 | `/gsd-progress` | 我现在在哪？下一步是什么？ |
 | `/gsd-next` | 自动检测状态并执行下一步 |
 | `/gsd-help` | 显示全部命令和使用指南 |
-| `/gsd-update` | 更新 GSD，并预览变更日志 |
-| `/gsd-join-discord` | 加入 GSD Discord 社区 |
 
 ### Brownfield
 
@@ -632,22 +600,21 @@ lmn012o feat(08-02): create registration endpoint
 | `/gsd-add-phase` | 在路线图末尾追加 phase |
 | `/gsd-insert-phase [N]` | 在 phase 之间插入紧急工作 |
 | `/gsd-remove-phase [N]` | 删除未来 phase，并重编号 |
-| `/gsd-list-phase-assumptions [N]` | 在规划前查看 Claude 打算采用的方案 |
-| `/gsd-plan-milestone-gaps` | 为 audit 发现的缺口创建 phase |
 
 ### 代码质量
 
 | 命令 | 作用 |
 |------|------|
-| `/gsd-review` | 对当前阶段或分支进行跨 AI 同行评审 |
+| `/gsd-code-review [N]` | 审查阶段改动的源码文件，发现 bug、安全和质量问题 |
+| `/gsd-code-review-fix [N]` | 自动修复代码审查发现的问题，每个修复独立提交 |
 | `/gsd-pr-branch` | 创建过滤 `.planning/` 提交的干净 PR 分支 |
-| `/gsd-audit-uat` | 审计验证债务——找出缺少 UAT 的阶段 |
 
 ### 积压
 
 | 命令 | 作用 |
 |------|------|
-| `/gsd-plant-seed <idea>` | 将想法存入积压停车场，留待未来里程碑 |
+| `/gsd-add-backlog <desc>` | 将想法加入积压停车场（999.x 编号，独立于活跃序列） |
+| `/gsd-review-backlog` | 审查积压项，提升到当前里程碑或清除过期条目 |
 
 ### 会话
 
@@ -655,14 +622,12 @@ lmn012o feat(08-02): create registration endpoint
 |------|------|
 | `/gsd-pause-work` | 在中途暂停时创建交接上下文（写入 HANDOFF.json） |
 | `/gsd-resume-work` | 从上一次会话恢复 |
-| `/gsd-session-report` | 生成会话摘要，包含已完成工作和结果 |
 
 ### 工具
 
 | 命令 | 作用 |
 |------|------|
 | `/gsd-settings` | 配置模型 profile 和工作流代理 |
-| `/gsd-set-profile <profile>` | 切换模型 profile（quality / balanced / budget / inherit） |
 | `/gsd-add-todo [desc]` | 记录一个待办想法 |
 | `/gsd-check-todos` | 查看待办列表 |
 | `/gsd-debug [desc]` | 使用持久状态进行系统化调试 |
@@ -670,8 +635,6 @@ lmn012o feat(08-02): create registration endpoint
 | `/gsd-note <text>` | 零摩擦想法捕捉——追加、列出或提升为待办 |
 | `/gsd-quick [--full] [--discuss] [--research]` | 以 GSD 保障执行临时任务（`--full` 增加计划检查和验证，`--discuss` 先补上下文，`--research` 在规划前先调研） |
 | `/gsd-health [--runtime] [--repair]` | 校验 `.planning/` 完整性、自动修复 planning 问题、确认 runtime 身份，或用 `--runtime --repair` 重建 `gsd-remix-sdk` |
-| `/gsd-stats` | 显示项目统计——阶段、计划、需求、git 指标 |
-| `/gsd-profile-user [--questionnaire] [--refresh]` | 从会话分析生成开发者行为档案，用于个性化响应 |
 
 <sup>¹ 由 reddit 用户 OracleGreyBeard 贡献</sup>
 
@@ -690,23 +653,16 @@ GSD 将项目设置保存在 `.planning/config.json`。你可以在 `/gsd-new-pr
 
 ### 模型 Profile
 
-控制各代理使用哪种 Claude 模型，在质量和 token 成本之间平衡。
+控制各代理使用哪种 Claude 模型。所有命名 profile（`quality`、`balanced`、`budget`）现在都解析为同一套统一分配——规划、路线图、研究和调试类代理使用 Opus，执行、验证、检查和映射类代理使用 Sonnet。profile 键名保留只是为了配置兼容。
 
-| Profile | Planning | Execution | Verification |
-|---------|----------|-----------|--------------|
-| `quality` | Opus | Opus | Sonnet |
-| `balanced`（默认） | Opus | Sonnet | Sonnet |
-| `budget` | Sonnet | Sonnet | Haiku |
-| `inherit` | Inherit | Inherit | Inherit |
-
-切换方式：
-```
-/gsd-set-profile budget
-```
+| Profile | 规划 / 研究 / 调试 | 其余代理 |
+|---------|--------------------|----------|
+| 命名 profile | Opus | Sonnet |
+| `inherit` | Inherit | Inherit |
 
 使用非 Anthropic 提供商（OpenRouter、本地模型）时，或想跟随当前运行时的模型选择时（如 OpenCode 的 `/model`），可用 `inherit`。
 
-也可以通过 `/gsd-settings` 配置。
+通过 `/gsd-settings` 配置。
 
 ### 工作流代理
 

package/agents/gsd-debugger.md

@@ -958,9 +958,6 @@ Gather symptoms through questioning. Update file after EACH answer.
 </step>
 
 <step name="investigation_loop">
-At investigation decision points, apply structured reasoning:
-@~/.claude/get-shit-done/references/thinking-models-debug.md
-
 **Autonomous investigation. Update file continuously.**
 
 **Phase 0: Check knowledge base**

package/agents/gsd-executor.md

@@ -110,9 +110,6 @@ grep -n "type=\"checkpoint" [plan-path]
 </step>
 
 <step name="execute_tasks">
-At execution decision points, apply structured reasoning:
-@~/.claude/get-shit-done/references/thinking-models-execution.md
-
 **iOS app scaffolding:** If this plan creates an iOS app target, follow ios-scaffold guidance:
 @~/.claude/get-shit-done/references/ios-scaffold.md
 
@@ -160,8 +157,6 @@ No user permission needed for Rules 1-3.
 
 **Critical = required for correct/secure/performant operation.** These aren't "features" — they're correctness requirements.
 
-**Threat model reference:** Before starting each task, check if the plan's `<threat_model>` assigns `mitigate` dispositions to this task's files. Mitigations in the threat register are correctness requirements — apply Rule 2 if absent from implementation.
-
 ---
 
 **RULE 3: Auto-fix blocking issues**
@@ -478,17 +473,16 @@ Or: "None - plan executed exactly as written."
 
 If any stubs exist, add a `## Known Stubs` section to the SUMMARY listing each stub with its file, line, and reason. These are tracked for the verifier to catch. Do NOT mark a plan as complete if stubs exist that prevent the plan's goal from being achieved — either wire the data or document in the plan why the stub is intentional and which future plan will resolve it.
 
-**Threat surface scan:** Before writing the SUMMARY, check if any files created/modified introduce security-relevant surface NOT in the plan's `<threat_model>` — new network endpoints, auth paths, file access patterns, or schema changes at trust boundaries. If found, add:
+**Security-relevant surface:** Before writing the SUMMARY, check if any files created/modified introduce security-relevant surface — new network endpoints, auth paths, user input handling, secrets access, outbound requests, or schema changes at trust boundaries. If found, add:
 
 ```markdown
-## Threat Flags
+## Security-Relevant Surface
 
-| Flag | File | Description |
-|------|------|-------------|
-| threat_flag: {type} | {file} | {new surface description} |
+- {file}: {one-line description of the new surface}
 ```
 
-Omit section if nothing found.
+Omit the section if nothing found. This feeds the execute-phase security review trigger — one line per item is enough.
+
 </summary_creation>
 
 <self_check>

package/agents/gsd-phase-researcher.md

@@ -246,8 +246,6 @@ Priority: Context7 > Exa (verified) > Firecrawl (official docs) > Official GitHu
 - [ ] Confidence levels assigned honestly
 - [ ] "What might I have missed?" review completed
 - [ ] **If rename/refactor phase:** Runtime State Inventory completed — all 5 categories answered explicitly (not left blank)
-- [ ] Security domain included (or `security_enforcement: false` confirmed)
-- [ ] ASVS categories verified against phase tech stack
 
 </verification_protocol>
 
@@ -421,56 +419,6 @@ Verified patterns from official sources:
 **Missing dependencies with fallback:**
 - [items with viable alternatives]
 
-## Validation Architecture
-
-> Skip this section entirely if workflow.nyquist_validation is explicitly set to false in .planning/config.json. If the key is absent, treat as enabled.
-
-### Test Framework
-| Property | Value |
-|----------|-------|
-| Framework | {framework name + version} |
-| Config file | {path or "none — see Wave 0"} |
-| Quick run command | `{command}` |
-| Full suite command | `{command}` |
-
-### Phase Requirements → Test Map
-| Req ID | Behavior | Test Type | Automated Command | File Exists? |
-|--------|----------|-----------|-------------------|-------------|
-| REQ-XX | {behavior} | unit | `pytest tests/test_{module}.py::test_{name} -x` | ✅ / ❌ Wave 0 |
-
-### Sampling Rate
-- **Per task commit:** `{quick run command}`
-- **Per wave merge:** `{full suite command}`
-- **Phase gate:** Full suite green before `/gsd-verify-work`
-
-### Wave 0 Gaps
-- [ ] `{tests/test_file.py}` — covers REQ-{XX}
-- [ ] `{tests/conftest.py}` — shared fixtures
-- [ ] Framework install: `{command}` — if none detected
-
-*(If no gaps: "None — existing test infrastructure covers all phase requirements")*
-
-## Security Domain
-
-> Required when `security_enforcement` is enabled (absent = enabled). Omit only if explicitly `false` in config.
-
-### Applicable ASVS Categories
-
-| ASVS Category | Applies | Standard Control |
-|---------------|---------|-----------------|
-| V2 Authentication | {yes/no} | {library or pattern} |
-| V3 Session Management | {yes/no} | {library or pattern} |
-| V4 Access Control | {yes/no} | {library or pattern} |
-| V5 Input Validation | yes | {e.g., zod / joi / pydantic} |
-| V6 Cryptography | {yes/no} | {library — never hand-roll} |
-
-### Known Threat Patterns for {stack}
-
-| Pattern | STRIDE | Standard Mitigation |
-|---------|--------|---------------------|
-| {e.g., SQL injection} | Tampering | {parameterized queries / ORM} |
-| {pattern} | {category} | {mitigation} |
-
 ## Sources
 
 ### Primary (HIGH confidence)
@@ -498,9 +446,6 @@ Verified patterns from official sources:
 
 <execution_flow>
 
-At research decision points, apply structured reasoning:
-@~/.claude/get-shit-done/references/thinking-models-research.md
-
 ## Step 1: Receive Scope and Load Context
 
 Orchestrator provides: phase number/name, description/goal, requirements, constraints, output path.
@@ -514,7 +459,6 @@ if [[ "$INIT" == @file:* ]]; then INIT=$(cat "${INIT#@file:}"); fi
 
 Extract from init JSON: `phase_dir`, `padded_phase`, `phase_number`, `commit_docs`.
 
-Also read `.planning/config.json` — include Validation Architecture section in RESEARCH.md unless `workflow.nyquist_validation` is explicitly `false`. If the key is absent or `true`, include the section.
 
 Then read CONTEXT.md if exists:
 ```bash
@@ -534,41 +478,6 @@ cat "$phase_dir"/*-CONTEXT.md 2>/dev/null
 - User decided "simple UI, no animations" → don't research animation libraries
 - Marked as Claude's discretion → research options and recommend
 
-## Step 1.3: Load Graph Context
-
-Check for knowledge graph:
-
-```bash
-ls .planning/graphs/graph.json 2>/dev/null
-```
-
-If graph.json exists, check freshness:
-
-```bash
-node "$HOME/.claude/get-shit-done/bin/gsd-tools.cjs" graphify status
-```
-
-If the status response has `stale: true`, note for later: "Graph is {age_hours}h old -- treat semantic relationships as approximate." Include this annotation inline with any graph context injected below.
-
-Query the graph for each major capability in the phase scope (2-3 queries per D-05, discovery-focused):
-
-```bash
-node "$HOME/.claude/get-shit-done/bin/gsd-tools.cjs" graphify query "<capability-keyword>" --budget 1500
-```
-
-Derive query terms from the phase goal and requirement descriptions. Examples:
-- Phase "user authentication and session management" -> query "authentication", "session", "token"
-- Phase "payment integration" -> query "payment", "billing"
-- Phase "build pipeline" -> query "build", "compile"
-
-Use graph results to:
-- Discover non-obvious cross-document relationships (e.g., a config file related to an API module)
-- Identify architectural boundaries that affect the phase
-- Surface dependencies the phase description does not explicitly mention
-- Inform which subsystems to investigate more deeply in subsequent research steps
-
-If no results or graph.json absent, continue to Step 1.5 without graph context.
-
 ## Step 1.5: Architectural Responsibility Mapping
 
 Before diving into framework-specific research, map each capability in this phase to its standard architectural tier owner. This is a pure reasoning step — no tool calls needed.
@@ -692,20 +601,7 @@ docker info 2>/dev/null | head -3
 
 For each domain: Context7 first → Official docs → WebSearch → Cross-verify. Document findings with confidence levels as you go.
 
-## Step 4: Validation Architecture Research (if nyquist_validation enabled)
-
-**Skip if** workflow.nyquist_validation is explicitly set to false. If absent, treat as enabled.
-
-### Detect Test Infrastructure
-Scan for: test config files (pytest.ini, jest.config.*, vitest.config.*), test directories (test/, tests/, __tests__/), test files (*.test.*, *.spec.*), package.json test scripts.
-
-### Map Requirements to Tests
-For each phase requirement: identify behavior, determine test type (unit/integration/smoke/e2e/manual-only), specify automated command runnable in < 30 seconds, flag manual-only with justification.
-
-### Identify Wave 0 Gaps
-List missing test files, framework config, or shared fixtures needed before implementation.
-
-## Step 5: Quality Check
+## Step 4: Quality Check
 
 - [ ] All domains investigated
 - [ ] Negative claims verified
@@ -713,7 +609,7 @@ List missing test files, framework config, or shared fixtures needed before impl
 - [ ] Confidence levels assigned honestly
 - [ ] "What might I have missed?" review
 
-## Step 6: Write RESEARCH.md
+## Step 5: Write RESEARCH.md
 
 Use the Write tool to create files — never use `Bash(cat << 'EOF')` or heredoc commands for file creation. This rule applies regardless of `commit_docs` setting.
 
@@ -752,7 +648,7 @@ Write to: `$PHASE_DIR/$PADDED_PHASE-RESEARCH.md`
 
 ⚠️ `commit_docs` controls git only, NOT file writing. Always write first.
 
-## Step 7: Commit Research (optional)
+## Step 6: Commit Research (optional)
 
 ```bash
 gsd-remix-sdk query commit "docs($PHASE): research phase domain" "$PHASE_DIR/$PADDED_PHASE-RESEARCH.md"