gsdd-cli 0.27.0 → 0.29.0

package/bin/lib/workspace-root.mjs

@@ -1,13 +1,14 @@
 import { existsSync } from 'fs';
 import { dirname, join, resolve } from 'path';
 import { fileURLToPath } from 'url';
+import { hasStateMarker, resolveStateDir } from './state-dir.mjs';
 
 function normalizePath(value, cwd) {
   return resolve(cwd, String(value));
 }
 
 function hasPlanningMarker(root) {
-  return existsSync(join(root, '.planning', 'config.json')) || existsSync(join(root, '.planning'));
+  return hasStateMarker(root);
 }
 
 export function consumeWorkspaceRootArg(rawArgs = []) {
@@ -71,7 +72,7 @@ export function resolveWorkspaceContext(rawArgs = [], { cwd = process.cwd(), env
       invalid: true,
       error: 'Usage: --workspace-root <path>',
       workspaceRoot: resolve(cwd),
-      planningDir: join(resolve(cwd), '.planning'),
+      planningDir: resolveStateDir(resolve(cwd)).dir,
     };
   }
 
@@ -81,9 +82,9 @@ export function resolveWorkspaceContext(rawArgs = [], { cwd = process.cwd(), env
       return {
         args,
         invalid: true,
-        error: `Workspace root does not contain .planning/: ${workspaceRootArg}`,
+        error: `Workspace root does not contain .work/ or .planning/: ${workspaceRootArg}`,
         workspaceRoot: explicitRoot,
-        planningDir: join(explicitRoot, '.planning'),
+        planningDir: resolveStateDir(explicitRoot).dir,
       };
     }
   }
@@ -105,7 +106,9 @@ export function resolveWorkspaceContext(rawArgs = [], { cwd = process.cwd(), env
         args,
         invalid: false,
         workspaceRoot: candidate,
-        planningDir: join(candidate, '.planning'),
+        planningDir: resolveStateDir(candidate).dir,
+        stateDirName: resolveStateDir(candidate).name,
+        migrationNotice: resolveStateDir(candidate).migrationNotice,
       };
     }
   }
@@ -115,7 +118,9 @@ export function resolveWorkspaceContext(rawArgs = [], { cwd = process.cwd(), env
     args,
     invalid: false,
     workspaceRoot: fallbackRoot,
-    planningDir: join(fallbackRoot, '.planning'),
+    planningDir: resolveStateDir(fallbackRoot).dir,
+    stateDirName: resolveStateDir(fallbackRoot).name,
+    migrationNotice: resolveStateDir(fallbackRoot).migrationNotice,
   };
 }
 

package/distilled/DESIGN.md

@@ -72,8 +72,9 @@
 59. [Continuity Authority And Planning-State Drift](#d59---continuity-authority-and-planning-state-drift)
 60. [Release Closeout Contract](#d60---release-closeout-contract)
 61. [Deliberate Subagent Contract](#d61---deliberate-subagent-contract)
-62. [Repo-Native UI Proof Contract](#d62---repo-native-ui-proof-contract)
+62. [Repo-Native Browser Proof Contract](#d62---repo-native-browser-proof-contract)
 63. [Computed-First Control Map](#d63---computed-first-control-map)
+64. [Work-Native Continuity Authority](#d64---work-native-continuity-authority)
 
 ---
 
@@ -960,7 +961,7 @@ Implementation lives under `bin/lib/`:
 | E7 | ERROR | `.planning/templates/codebase/` missing or empty |
 | E8 | ERROR | `.planning/templates/` missing critical root files (`spec.md`, `roadmap.md`, `auth-matrix.md`, `ui-proof.md`) |
 | E9 | ERROR | `.planning/templates/brownfield-change/` missing or missing critical files (`CHANGE.md`, `HANDOFF.md`, `VERIFICATION.md`) |
-| E10 | ERROR | Known UI proof bundle metadata is unparseable or fails deterministic privacy/claim validation |
+| E10 | RETIRED | Retired UI proof bundle metadata validator; current browser proof uses plan declarations and markdown observation records |
 | W1 | WARN | `generation-manifest.json` missing |
 | W2 | WARN | Manifest-tracked installed templates/helpers modified locally (hash mismatch vs manifest) |
 | W3 | WARN | Manifest-tracked installed templates/helpers missing from disk but listed in manifest |
@@ -2371,9 +2372,13 @@ Sub-gap (b) was closed by D28's `<persistence>` mandate and guarded by G30. Sub-
   - `escalation_triggers`
   - `approval_gates`
   - `anti_regression_targets`
-  - `closure_claim_limit`
-  - `parallelism_budget`
-  - `leverage` (`lost / kept / gained`)
+  - `known_unknowns`
+  - `browser_proof_required`
+  - `browser_proof_rationale`
+  - `must_haves`
+- Keep high-risk review pressure in the plan body through Evidence Contract,
+  Stop-And-Challenge, Approval Gates, and Second-Pass Review sections instead
+  of expanding the frontmatter into a control-plane schema.
 - Upgrade planner checking to block missing anti-drift contract fields instead of treating them as optional prose quality.
 - Thread the new contract through execution and verification so the fields constrain what execution may do and what closure may claim.
 
@@ -2507,7 +2512,7 @@ Sub-gap (b) was closed by D28's `<persistence>` mandate and guarded by G30. Sub-
 
 ## D56 - Executable Brownfield Routing And Widen-Only Escalation
 
-**Decision (2026-04-21):** Brownfield routing should treat `CHANGE.md` as the default operational anchor and allow a surviving `phase` or `quick` checkpoint to outrank it only when one strict-match rule proves the checkpoint is still the active execution surface. From concrete brownfield state, `/gsdd-new-project` remains available only as an intentional widen path into full milestone setup, not as an accidental fallback recommendation.
+**Decision (2026-04-21; revised 2026-06-30):** Brownfield routing should treat `CHANGE.md` as the default operational anchor and allow a surviving `phase` or `quick` checkpoint to outrank it only when one strict-match rule proves the checkpoint is still the active execution surface. From concrete brownfield state, `/gsdd-new-project` remains available only as an intentional widen path into full milestone setup, not as an accidental fallback recommendation. Active bounded brownfield planning uses the existing `gsdd-plan` workflow with explicit `brownfield-change` authority instead of being forced through unrelated ROADMAP phase membership.
 
 **Context:**
 - D54 defined the bounded `brownfield-change/` contract and D55 established its continuity floor, but the routing matrix above those artifacts was still inconsistent: `progress` could still route back through stale checkpoint residue, `resume` could still make a non-matching checkpoint primary, and `quick` / `map-codebase` / `new-project` still risked implying that full lifecycle initialization was the normal fallback from already-concrete bounded work.
@@ -2524,12 +2529,17 @@ Sub-gap (b) was closed by D28's `<persistence>` mandate and guarded by G30. Sub-
   - `quick` uses it when the bounded change is still undefined or when the user intentionally widens scope
   - `map-codebase` frames it as full lifecycle setup only when the user wants to widen beyond bounded brownfield work
   - `new-project` itself recognizes existing `CHANGE.md` continuity and treats invocation from that state as deliberate promotion, not mistaken routing
+- Keep `gsdd-plan` as the bounded brownfield planning entrypoint when an active `.planning/brownfield-change/CHANGE.md` exists:
+  - `gsdd next --json` reports `authority: brownfield_change` and routes to `gsdd-plan`
+  - `gsdd-plan` classifies the target before phase preflight
+  - `lifecycle-preflight plan brownfield-change` authorizes the change-folder lane without requiring the active ROADMAP phase to match a PBI or consumer ticket
 - Lock the contract with helper, guard, and generated-surface scenario coverage.
 
 **Why this fits the codebase:**
 - It extends the existing provenance helper and generated-surface workflow model instead of inventing another routing registry or hidden state store.
 - It preserves the D55 one-anchor split: checkpoints stay visible and resume-owned, but they do not silently demote the active brownfield contract unless the repo can prove the checkpoint is still current.
 - It keeps the brownfield lane bounded by removing accidental fallback escalation while still preserving an intentional route into milestone planning.
+- It fixes the consumer failure mode where PBI/ticket-sized brownfield work was blocked by an unrelated active ROADMAP phase while still avoiding a new workflow or auto-runner surface.
 - It matches the repo's anti-drift posture: ambiguous or weak routing proof fails closed in favor of the current operational anchor.
 
 **Evidence:**
@@ -2549,7 +2559,7 @@ Sub-gap (b) was closed by D28's `<persistence>` mandate and guarded by G30. Sub-
 - `get-shit-done/workflows/progress.md`, `get-shit-done/workflows/resume.md`, `get-shit-done/workflows/quick.md`, `get-shit-done/workflows/new-project.md`
 
 **Consequences:**
-- Brownfield next-step routing now has one deterministic precedence rule instead of five workflow-local interpretations.
+- Brownfield next-step routing now has one deterministic precedence rule instead of five workflow-local interpretations, and active bounded brownfield planning has one explicit preflight authority.
 - A stale or unrelated `phase` / `quick` checkpoint can remain reviewable without automatically hijacking the current brownfield lane.
 - `/gsdd-new-project` remains part of the system, but as deliberate promotion from concrete brownfield work rather than as a generic fallback.
 - Phase 43 can now focus on bounded growth and milestone handoff instead of first repairing invalid routing recommendations.
@@ -2816,49 +2826,47 @@ Posture compatibility is part of that closeout contract: `repo_closeout` and `ru
 
 ---
 
-## D62 - Repo-Native UI Proof Contract
+## D62 - Repo-Native Browser Proof Contract
 
-**Decision (2026-04-28; revised 2026-05-09):** UI-sensitive work should carry a compact planned proof-slot contract and, when executed, an observed UI proof bundle that references artifacts by path or link while preserving the existing closure evidence kinds: `code`, `test`, `runtime`, `delivery`, and `human`. For live rendered UI proof, `agent-browser` is the default runtime evidence path for consumers, while existing Playwright tests remain the canonical repeatable browser-regression path when present. The deterministic `ui-proof` validator remains provider-agnostic structural validation, but it now validates planned slot specificity, concise tool provenance, local artifact path existence when validating from files, raw-artifact safety for paths and URLs, and failed/partial proof classification so the workflow cannot degrade back into unstructured "looks good" review. Direct phase verification also treats plan frontmatter as the UI-proof declaration authority and fails closed on missing phase prerequisites, empty `ui_proof_slots: []` without `no_ui_proof_rationale`, and invalid required UI proof.
+**Decision (2026-04-28; revised 2026-05-09; revised 2026-07-08):** UI-sensitive work should carry a compact browser-proof declaration in plan frontmatter and, when executed, a plain markdown observation record that references artifacts by path or link while preserving the existing closure evidence kinds: `code`, `test`, `runtime`, `delivery`, and `human`. For live rendered UI proof, `agent-browser` is the default runtime evidence path for consumers, while existing Playwright tests remain the canonical repeatable browser-regression path when present. Direct phase verification treats `browser_proof_required` and `browser_proof_rationale` as the declaration authority and fails closed on missing phase prerequisites, invalid browser-proof frontmatter, a missing `## Browser Proof Plan` when proof is required, or a required browser-proof plan that omits route/state, viewport, runtime path, evidence kind, evidence command or no-command rationale, observations, artifacts with privacy/safety posture, and claim limit.
 
 **Context:**
-- UI proof targets the recurring failure mode where agents claim a UI works or looks good without rendered proof, matched observations, or explicit human judgment.
-- The contract defines proof slots, proof bundles, comparison statuses, fail-closed agent guardrails, deterministic metadata validation, privacy metadata, and health visibility without adding a browser-provider framework.
-- GSD's archived planner, executor, and verifier roles preserve strong lifecycle discipline, but they do not provide this UI-specific planned-vs-observed proof model. GSDD keeps the lifecycle leverage and adds a repo-native UI proof substrate without adding a browser-provider framework.
+- Browser proof targets the recurring failure mode where agents claim a UI works or looks good without rendered proof, matched observations, or explicit human judgment.
+- The contract defines plan declarations, Browser Proof Plan sections, observation records, fail-closed agent guardrails, privacy/safety notes, and claim limits without adding a browser-provider framework or a separate JSON validator.
+- GSD's archived planner, executor, and verifier roles preserve strong lifecycle discipline, but they do not provide this UI-specific browser observation model. GSDD keeps the lifecycle leverage and adds a repo-native browser proof substrate without adding a browser-provider framework.
 - OneShot's QC guidance and Vercel's `agent-browser` skill converge on an interactive browser loop for snapshots, ref-based interaction, screenshots, and network/console-adjacent inspection. GSDD adapts that as a default workflow instruction, not as a hard validator dependency.
 
 **Decision:**
-- Planning must classify UI-sensitive work and require either `ui_proof_slots` or an explicit `no_ui_proof_rationale`.
-- Direct phase verification must read `ui_proof_slots` and `no_ui_proof_rationale` from plan frontmatter only; body prose, fenced examples, and stale sidecars are not declaration authority.
-- Direct phase verification must fail nonzero with structured blockers when no matching plan or summary exists, or when `ui_proof_slots: []` lacks a nonblank `no_ui_proof_rationale`.
-- When an explicit no-UI rationale exists, stale UI-proof sidecars are warning-level cleanup signals, not proof and not blockers.
-- Planned slots record claim, route/state, required evidence kinds, minimum observations, expected artifact types, runnable validation command, environment/viewport, manual-acceptance requirement, claim limit, and requirement IDs.
-- Observed proof bundles record claim, requirement/slot IDs, route/state, environment, viewport, evidence inputs, commands/manual steps, observations, artifacts, privacy metadata, result, and claim limits.
-- Planned slots must be tight enough for the plan checker to reject vague proof: specific route/state, viewport rationale or narrowed claim limit, minimum observations, expected artifact types, runnable validation, and matchability back to the exact UI claim.
+- Planning must classify UI-sensitive work with `browser_proof_required: true|false` and a nonblank `browser_proof_rationale`.
+- Direct phase verification must read browser-proof declaration authority from plan frontmatter only. Body prose and stale sidecars are not declaration authority.
+- Direct phase verification must fail nonzero with structured blockers when no matching plan or summary exists, when browser-proof frontmatter is invalid, or when a required Browser Proof Plan is missing or incomplete.
+- When browser proof is not required and the rationale is explicit, stale browser-proof observations are warning-level cleanup signals, not proof and not blockers. Legacy `ui_proof_slots: []` with a meaningful `no_ui_proof_rationale` is treated as a compatibility warning rather than a blocker; legacy non-empty `ui_proof_slots` still require migration because required rendered proof cannot be inferred losslessly.
+- Browser Proof Plan sections record route/state, viewport coverage, runtime path, evidence kind, evidence command or narrowed no-command rationale, observations, artifacts, privacy/safety note, and claim limit.
+- Observation records record the exact plan artifact, actual route/state, viewport, runtime path, evidence kind, command/manual step, rendered observations, artifacts, result, privacy/safety note, stale-after trigger, and claim limit.
+- Browser Proof Plan sections must be tight enough for the plan checker to reject vague proof: specific route/state, viewport coverage or narrowed claim, runtime path, supported evidence kind, rendered observations, artifacts/privacy notes, evidence command or no-command rationale, and claim limit.
 - The planner chooses viewport coverage, but responsive or layout-sensitive claims require desktop/mobile or equivalent state coverage unless the claim is explicitly narrowed.
 - Execution defaults to `agent-browser` for live UI runtime proof: open the route/state, capture interactive snapshots/refs where relevant, exercise the changed flow, capture screenshots for planned viewport(s), and record relevant console/network observations.
 - Existing Playwright tests or package scripts remain the canonical repeatable browser-regression evidence when present. Playwright scripting is reserved for checks `agent-browser` cannot cover cleanly, such as JS-disabled behavior, structured console listeners, or multi-context testing.
-- Verification compares planned slots to observed bundles using `satisfied`, `partial`, `missing`, `waived`, `deferred`, and `not_applicable`; waiver and deferral are not proof.
-- UI correctness claims fail closed unless rendered proof is matched exactly to claim, route/state, observation, evidence kind, artifact path or manual step, privacy metadata, result, and claim limit, or an explicit waiver/deferment narrows the claim.
-- Human acceptance may close a narrowed claim and record proof debt, but it must not convert missing or mismatched non-human evidence into `satisfied` proof.
+- Direct verification fails closed unless each required browser-proof plan has a repo-local, parser-compatible, explicitly passing observation that names the exact plan artifact and carries supported evidence semantics, privacy/safety posture, and bounded claim scope. The workflow verifier still owns substantive judgment about whether the recorded observation actually supports the route/state, viewport, artifact, and claim.
+- Human acceptance may close a narrowed claim and record proof debt, but it must not convert missing or mismatched non-human evidence into satisfied proof.
 - Screenshots, traces, videos, reports, accessibility scans, Gherkin, and visual diffs are artifact types or activities mapped onto the five existing evidence kinds, not new evidence kinds.
-- Source annotations, AST/cAST findings, semantic search hits, comments, and Semble-like retrieval may discover proof obligations, but they are discovery hints only and do not satisfy proof slots.
+- Source annotations, AST/cAST findings, semantic search hits, comments, and Semble-like retrieval may discover proof obligations, but they are discovery hints only and do not satisfy browser proof.
 - Visual taste, accessibility judgment, baseline acceptance, subjective polish/layout quality, and privacy publication require human evidence or explicit waiver, and human approval does not replace required `code`, `test`, `runtime`, or `delivery` evidence.
-- Deterministic validation keeps the evidence and comparison-status vocabularies unchanged: planned slots require specific claim, route/state, evidence, expected artifacts, validation, viewport, and claim-limit fields; artifact entries require `visibility`, `retention`, `sensitivity`, and `safe_to_publish`; raw screenshots, traces, videos, DOM snapshots, and reports default to `local_only` plus `safe_to_publish: false`; `bin/lib/ui-proof.mjs` validates required bundle/observation fields, structured command/manual-step entries, fixed evidence kinds, concise `tools_used` IDs, claim/result statuses, comparison statuses, failure classification for failed/partial proof, claim limits, privacy metadata, safe artifact references, local artifact path existence when validating file-backed bundles, and public/tracked/delivery proof claims backed by local-only, unsafe, unsanitized, or privacy-contradictory artifacts.
-- `gsdd health` reports invalid known UI proof bundles as E10 using the same validator, staying read-only and avoiding raw artifact content inspection.
-- Failed UI proof is reported through existing GSDD gap/proof-debt language. Product behavior defects, missing or blocked infrastructure, flaky harnesses, and ambiguous specs explain causes, but they do not add new evidence kinds, result statuses, or comparison statuses.
+- The current contract is validator-light by design: direct phase verification checks declaration shape, required Browser Proof Plan fields, observation record shape, safe linked-record boundaries, exact plan references, explicit pass/fail posture, supported evidence-kind labels, and bounded claim wording. It does not inspect raw screenshot pixels, report contents, or visual quality; substantive rendered proof remains a workflow/role obligation captured in summaries or observation records.
+- Failed browser proof is reported through the failure-cause names in `distilled/references/proof-rules.md`: product behavior defects, missing or blocked infrastructure, flaky harnesses, and ambiguous specs explain causes, but they do not add new evidence kinds.
 
 **Leverage:**
-- Lost: UI-sensitive work now carries a small proof-contract burden, and default live proof guidance adds slightly more specificity for planners/checkers to enforce.
-- Kept: repo-native markdown artifacts, optional project tooling, fixed closure evidence kinds, generated-surface freshness, the plan/execute/verify separation, and provider-agnostic deterministic metadata validation.
-- Gained: exact claim-to-proof traceability, strict comparison statuses, privacy and claim-limit metadata, fail-closed overclaim guardrails, deterministic metadata validation, a concrete live browser evidence path, and health-visible protection against unsafe public proof claims.
+- Lost: UI-sensitive work still carries a small proof-contract burden, and direct verification checks only shape rather than raw screenshot/report contents.
+- Kept: repo-native markdown artifacts, optional project tooling, fixed closure evidence kinds, generated-surface freshness, the plan/execute/verify separation, and a concrete live browser evidence path.
+- Gained: a much simpler consumer contract, exact claim-to-observation traceability, privacy/safety notes, claim limits, and fail-closed overclaim guardrails without a non-existent validator command.
 
 **Evidence:**
 - `distilled/templates/ui-proof.md`
 - `distilled/workflows/plan.md`, `distilled/workflows/execute.md`, `distilled/workflows/quick.md`, `distilled/workflows/verify.md`
 - `agents/planner.md`, `agents/executor.md`, `agents/verifier.md`, `distilled/templates/delegates/plan-checker.md`
-- `bin/lib/templates.mjs`, `bin/lib/ui-proof.mjs`, `bin/lib/health.mjs`, `bin/lib/phase.mjs`, `bin/lib/rendering.mjs`
+- `bin/lib/templates.mjs`, `bin/lib/health.mjs`, `bin/lib/phase.mjs`, `bin/lib/rendering.mjs`
 - `tests/phase.test.cjs`, `tests/gsdd.guards.test.cjs`, `tests/gsdd.health.test.cjs`, `tests/gsdd.init.test.cjs`
-- GSD comparison: the upstream planner, executor, and verifier role patterns preserve lifecycle rigor, but they do not define UI proof slots or planned-vs-observed UI proof bundles.
+- GSD comparison: the upstream planner, executor, and verifier role patterns preserve lifecycle rigor, but they do not define browser-proof plan declarations or observation records.
 - OneShot QC source: `https://github.com/oneshot-repo/OneShot/tree/main/skills`
 - Vercel `agent-browser` docs: `https://github.com/vercel-labs/agent-browser/blob/main/skill-data/core/SKILL.md` and `https://agent-browser.dev/snapshots`
 - Playwright docs: `https://playwright.dev/docs/trace-viewer`, `https://playwright.dev/docs/next/screenshots`, and `https://playwright.dev/mcp/tools/tracing`
@@ -2919,6 +2927,56 @@ Posture compatibility is part of that closeout contract: `repo_closeout` and `ru
 - `closeout-report` is a compact replay/report helper, not `progress`, `verify`, milestone audit, release automation, cleanup, or a dashboard. The source CLI path includes full health diagnostics; the generated helper reports health availability as a typed warning if the full health builder is not present in that helper runtime.
 - Future health hardening can consume the same helper output for stricter reporting, but must avoid turning local annotations into product truth.
 
+## D64 - Work-Native Continuity Authority
+
+**Decision (2026-06-29; revised 2026-06-30):** `.work` becomes the canonical continuity surface for `gsdd next` and future work-native state, while `.planning` remains readable legacy lifecycle input during migration and for existing workflows that still own their write paths. The authority used by routing, preflight, verification, and auto-gate packets must be explicit in machine-readable output. Repo policy, not Workspine itself, decides whether `.work` is committed or local-only; in the Workspine framework repo, `.work` is local dogfood/runtime state and should not be tracked. During migration, `gsdd next` may also route existing `.planning` brownfield-change authority into `gsdd-plan` without treating `.planning` ROADMAP phases as the only valid plan target.
+
+**Context:**
+- PR #116 merged the first `gsdd next` / `.work` continuity slice, but the framework repo still had split truth: `.work/milestone` described a locally implemented continuity milestone while `.planning` still described v2.0.0 parallel orchestration and P65/P66.
+- Old v2.0.0 parallel orchestration is too distant to migrate wholesale. Its useful ideas are partial extraction candidates: write ownership and closeout truth gates move into work-native auto-gate safety now; the PR #113 registry material remains parked for later extraction or rescue.
+- OpenSpec's change/archive model and LeanSpec's compact spec guidance both reinforce that long-lived state needs clear ownership and small, reviewable truth surfaces rather than scattered status prose.
+- The cited OpenAI and Anthropic agent-orchestration guidance favors manager-owned orchestration, explicit handoffs, guardrails, evaluator loops, and bounded tool authority rather than an unbounded agent loop.
+- MCP and agent-tooling security guidance reinforce that tool/resource outputs and local memory surfaces are untrusted inputs unless their provenance, privacy posture, and authority boundary are explicit.
+
+**Decision:**
+- Treat `.work` as the source of truth for `gsdd next` continuity routing, focus packets, work-native milestone state, decisions, questions, evidence pointers, dogfood findings, and bounded auto-gate state.
+- Keep `.planning` readable as legacy lifecycle input. Existing `gsdd-plan`, `gsdd-execute`, `gsdd-verify`, audit, complete-milestone, phase-status, and helper write paths continue to work against `.planning` until each surface is deliberately bridged or migrated.
+- Require routing and preflight output to report authority explicitly, using scoped values such as `work_milestone`, `planning`, or `blocked/conflict`; `.work` authority must not silently mask repo truth, PR truth, or unrelated `.planning` blockers.
+- Include `brownfield_change` as an explicit scoped authority for existing bounded-change artifacts. This is a compatibility bridge, not a new lifecycle root: it reuses the current `gsdd-plan` workflow and the brownfield-change folder contract.
+- Preserve repo/control-map truth as the highest authority for branch, PR, worktree, dirty-state, and delivery claims. `.work` can carry intent and continuity; it cannot convert local prose into integrated repo truth.
+- Define execute-until-gate as task-bounded automation, not session-bounded autonomy. Auto mode may run typed, reviewed, `type=auto` tasks and bounded verification/repair cycles only until a human gate, verification gap, repeated blocker, authority conflict, trust boundary, or scope expansion stops it.
+- Keep milestone completion user-owned. `gsdd next` may route to completion approval, but it must not mark a milestone complete autonomously.
+- Treat `.work` tracking as repo policy. Consumer projects may commit `.work` if that fits their privacy and collaboration model. The Workspine framework repo keeps `.work` local-only because it is dogfooding its own runtime state while developing the framework.
+- Reframe the old v2.0.0 parallel-orchestration milestone as legacy input rather than the active next milestone. Preserve write-set ownership and closeout truth gates in the new work-native authority milestone; park PR #113/P65 registry material as extract-later.
+
+**Leverage:**
+- Lost: the old clean "v2.0.0 parallel PR orchestration next" story and the convenience of treating `.planning` as the only lifecycle state root.
+- Kept: repo-native files, plain markdown workflow contracts, existing `.planning` compatibility, computed-first control-map authority, plan/execute/verify separation, and human-owned completion.
+- Gained: a clear continuity authority for `gsdd next`, explicit migration semantics, safer execute-until-gate foundations, repo-policy-driven tracking, a brownfield compatibility bridge for bounded consumer changes, and a typed authority boundary that prevents future auto mode from running on stale or contradictory state.
+
+**Evidence:**
+- `bin/lib/next.mjs`, `bin/lib/work-context.mjs`, `bin/lib/lifecycle-preflight.mjs`
+- `tests/gsdd.next.test.cjs` and `tests/phase.test.cjs`
+- `README.md` for the public `.work` tracking policy
+- PR #116, merged 2026-06-29 with merge commit `b91a138c42f2ab3ff7376317031208c7a716decd`: `https://github.com/PatrickSys/workspine/pull/116`
+- PR #113, still open as the parked registry extraction candidate: `https://github.com/PatrickSys/workspine/pull/113`
+- GSD comparison sources: `agents/_archive/gsd-roadmapper.md`, `agents/_archive/gsd-planner.md`, `agents/_archive/gsd-executor.md`, and `agents/_archive/gsd-verifier.md`. These preserve lifecycle rigor around requirements, plans, state, execution, and verification, but they do not define a separate work-native `next` authority root; GSDD preserves the rigor while moving agent-facing continuity into `.work`.
+- OpenSpec docs: `https://openspec.dev/`
+- LeanSpec docs: `https://www.lean-spec.dev/docs/guide/first-principles`
+- OpenAI Agents SDK orchestration docs: `https://developers.openai.com/api/docs/guides/agents/orchestration`
+- OpenAI guardrails and approvals docs: `https://developers.openai.com/api/docs/guides/agents/guardrails-approvals`
+- OpenAI agent evals docs: `https://developers.openai.com/api/docs/guides/agent-evals`
+- Anthropic agent engineering guidance: `https://www.anthropic.com/engineering/building-effective-agents`
+- Anthropic long-running harness guidance: `https://www.anthropic.com/engineering/harness-design-long-running-apps`
+- Model Context Protocol security guidance: `https://modelcontextprotocol.io/specification/2025-06-18/basic/security_best_practices`
+- GitHub Copilot repository instructions docs: `https://docs.github.com/en/copilot/concepts/prompting/response-customization`
+
+**Consequences:**
+- Future `gsdd next` and auto-gate work should start by reconciling `.work`, `.planning`, repo/control-map, PR truth, and active brownfield-change authority into one conservative next action or one explicit blocker.
+- Future milestones must not say "P65 shipped, start P66" unless repo, PR, `.work`, and legacy `.planning` truth agree.
+- Future auto mode must expose typed gates, loop guards, evidence requirements, stop reasons, and authority source in JSON. It must never rely on prose such as "continue autonomously" as execution permission.
+- Future framework work should not add tracked `.work` runtime state by default. Durable product changes belong in source/design/workflow/test files; `.work` dogfood state remains local unless explicitly promoted.
+
 ---
 
 ## Maintenance

package/distilled/EVIDENCE-INDEX.md

@@ -430,10 +430,11 @@
 ## D56 — Executable Brownfield Routing And Widen-Only Escalation
 - `.planning/SPEC.md` (`BROWNFIELD-03`, Current State, key decision row)
 - `.planning/phases/42-executable-brownfield-routing/42-PLAN.md`
-- `bin/lib/provenance.mjs`
+- `bin/lib/provenance.mjs`, `bin/lib/lifecycle-state.mjs`, `bin/lib/next.mjs`, `bin/lib/work-context.mjs`, `bin/lib/lifecycle-preflight.mjs`
 - `distilled/workflows/progress.md`, `distilled/workflows/resume.md`, `distilled/workflows/quick.md`, `distilled/workflows/map-codebase.md`, `distilled/workflows/new-project.md`
+- `distilled/workflows/plan.md`
 - `.internal-research/TODO.md`, `.internal-research/gaps.md`
-- `tests/phase.test.cjs`, `tests/gsdd.guards.test.cjs`, `tests/gsdd.scenarios.test.cjs`
+- `tests/phase.test.cjs`, `tests/gsdd.next.test.cjs`, `tests/gsdd.init.test.cjs`, `tests/gsdd.guards.test.cjs`, `tests/gsdd.scenarios.test.cjs`
 - `get-shit-done/workflows/progress.md`, `get-shit-done/workflows/resume.md`, `get-shit-done/workflows/quick.md`, `get-shit-done/workflows/new-project.md`
 
 ## D57 — Bounded Brownfield Growth And Context-Preserving Milestone Handoff
@@ -485,11 +486,11 @@
 - GSD comparison source: `get-shit-done/workflows/new-project.md`
 - `tests/gsdd.guards.test.cjs`, `tests/gsdd.invariants.test.cjs`
 
-## D62 — Repo-Native UI Proof Contract
+## D62 — Repo-Native Browser Proof Contract
 - `distilled/templates/ui-proof.md`
 - `distilled/workflows/plan.md`, `distilled/workflows/execute.md`, `distilled/workflows/quick.md`, `distilled/workflows/verify.md`
 - `agents/planner.md`, `agents/executor.md`, `agents/verifier.md`, `distilled/templates/delegates/plan-checker.md`
-- `bin/lib/templates.mjs`, `bin/lib/ui-proof.mjs`, `bin/lib/health.mjs`, `bin/lib/rendering.mjs`
+- `bin/lib/templates.mjs`, `bin/lib/health.mjs`, `bin/lib/phase.mjs`, `bin/lib/rendering.mjs`
 - `tests/phase.test.cjs`, `tests/gsdd.guards.test.cjs`, `tests/gsdd.health.test.cjs`, `tests/gsdd.init.test.cjs`
 - OneShot QC/browser policy: https://github.com/oneshot-repo/OneShot/tree/main/skills
 - Vercel agent-browser docs: https://github.com/vercel-labs/agent-browser/blob/main/skill-data/core/SKILL.md, https://agent-browser.dev/snapshots
@@ -502,7 +503,7 @@
 - Agent-hostile UI semantics source: https://dev.to/ratikkoka/your-ui-is-invisible-to-ai-agents-heres-how-to-fix-it-1ib3
 - Browser-harness efficiency source: https://dev.to/louaiboumediene/the-ai-harness-why-your-ai-coding-agent-is-only-as-smart-as-the-repo-you-put-it-in-cml
 - Dynamic-UI harness brittleness source: https://tessl.io/blog/webmcp-making-web-apps-faster-and-cheaper-for-ai-agents/
-- Long-term pitfalls carried forward: do not accept screenshot-free "looks good" claims, weak planned slots, unverified artifact paths, stale interactive refs after page mutation, partial/failed proof without failure classification, raw artifact publication without privacy metadata, browser contention in parallel checks, or semantic/selector-poor UI that forces fragile coordinate inspection.
+- Long-term pitfalls carried forward: do not accept screenshot-free "looks good" claims, weak browser-proof plans, unverified artifact paths, stale interactive refs after page mutation, partial/failed proof without failure classification, raw artifact publication without privacy/safety notes, browser contention in parallel checks, or semantic/selector-poor UI that forces fragile coordinate inspection.
 - Supporting spec/runtime docs: https://openspec.dev/, https://www.lean-spec.dev/docs/guide/first-principles, https://help.openai.com/en/articles/11369540-codex-in-chatgpt, https://docs.claude.com/en/docs/agents-and-tools/agent-skills, https://docs.github.com/en/copilot/concepts/prompting/response-customization
 
 ## D63 — Computed-First Control Map
@@ -515,6 +516,18 @@
 - OpenSpec comparison: OpenSpec change archive flow does not own long-running multi-worktree local-state reconciliation as a portable harness surface
 - Harness sources: https://www.anthropic.com/engineering/harness-design-long-running-apps, https://code.claude.com/docs/en/worktrees, https://developers.openai.com/codex/cloud, https://developers.openai.com/api/docs/guides/agents/orchestration, https://developers.openai.com/api/docs/guides/agents/guardrails-approvals, https://developers.openai.com/api/docs/guides/agent-evals, https://docs.github.com/en/copilot/concepts/agents/cloud-agent/about-cloud-agent, https://agent-browser.dev/sessions, https://developer.chrome.com/docs/devtools/agents
 
+## D64 — Work-Native Continuity Authority
+- `bin/lib/next.mjs`, `bin/lib/work-context.mjs`, `bin/lib/lifecycle-preflight.mjs`, `bin/lib/rendering.mjs`
+- `distilled/workflows/plan.md`
+- `tests/gsdd.next.test.cjs`, `tests/phase.test.cjs`, `tests/gsdd.init.test.cjs`, `tests/gsdd.guards.test.cjs`, `tests/gsdd.scenarios.test.cjs`
+- `README.md` for the public `.work` tracking policy
+- PR #116 merged 2026-06-29, merge commit `b91a138c42f2ab3ff7376317031208c7a716decd`: https://github.com/PatrickSys/workspine/pull/116
+- PR #113 remains open as parked registry extraction input: https://github.com/PatrickSys/workspine/pull/113
+- GSD comparison sources: `agents/_archive/gsd-roadmapper.md`, `agents/_archive/gsd-planner.md`, `agents/_archive/gsd-executor.md`, `agents/_archive/gsd-verifier.md`; upstream GSD lifecycle rigor does not define a separate work-native `next` authority root, so GSDD keeps the lifecycle rigor while moving agent-facing continuity into `.work`
+- Spec framework sources: https://openspec.dev/, https://www.lean-spec.dev/docs/guide/first-principles
+- Orchestrator sources: https://developers.openai.com/api/docs/guides/agents/orchestration, https://www.anthropic.com/engineering/building-effective-agents
+- Industry guidance sources: https://developers.openai.com/api/docs/guides/agents/guardrails-approvals, https://developers.openai.com/api/docs/guides/agent-evals, https://www.anthropic.com/engineering/harness-design-long-running-apps, https://modelcontextprotocol.io/specification/2025-06-18/basic/security_best_practices, https://docs.github.com/en/copilot/concepts/prompting/response-customization
+
 ---
 
 ## Maintenance

package/distilled/README.md

@@ -1,6 +1,6 @@
 # Workspine
 
-A repo-native delivery spine for the part of AI coding that still needs human judgment: planning, checking, execution, verification, and handoff.
+Plan, execute, and verify AI-assisted work from files in your repo — for the part of AI coding that still needs human judgment: planning, checking, execution, verification, and handoff.
 
 Workspine keeps planning, execution, verification, handoff, and progress state in the repo so work survives cold starts, runtime switches, and session loss. The retained package and CLI contracts remain `gsdd-cli` / `gsdd`.
 
@@ -25,20 +25,20 @@ Skip the full lifecycle for tiny, obvious edits. Direct prompting in your usual
 ## What This Is
 
 Workspine is a small set of workflow sources plus a CLI (`gsdd`) that:
-- scaffolds a project planning workspace (`.planning/`)
+- scaffolds a project planning workspace (`.work/`)
 - generates compact open-standard workflow entrypoints as skills (`.agents/skills/gsdd-*/SKILL.md`)
-- generates an internal repo-local helper runtime at `.planning/bin/gsdd.mjs` for deterministic workflow commands run from the repo root
+- generates an internal repo-local helper runtime at `.work/bin/gsdd.mjs` for deterministic workflow commands run from the repo root
 - optionally generates tool-specific adapters for runtimes that need extra native surfaces (root `AGENTS.md`, Claude skills + plan-command alias + native agents, OpenCode commands + native agents, Codex CLI checker agent)
 
-It gives serious AI-assisted work one durable repo workflow spine for planning, checking, execution, verification, and handoff without pretending to be a hosted orchestration layer.
+It gives serious AI-assisted work one durable, repo-native workflow for planning, checking, execution, verification, and handoff — plain files, no hosted service.
 
-Workspine is the product name. The package, CLI commands, workflow prefixes, and workspace directory remain `gsdd-cli`, `gsdd`, `gsdd-*`, and `.planning/` — these are retained technical contracts, not rename residue.
+Workspine is the product name. The package, CLI commands, workflow prefixes, and workspace directory remain `gsdd-cli`, `gsdd`, `gsdd-*`, and `.work/`; legacy `.planning/` workspaces are still read.
 
-Workspine began as a fork of Get Shit Done, whose long-horizon delivery spine proved the problem was real. Since the fork, upstream GSD has continued evolving into a broad multi-runtime framework. Workspine took a different path: a smaller repo-native delivery spine with fewer public workflow surfaces, generated runtime surfaces from a portable core, evidence-gated closure, and provenance-aware continuity.
+Workspine began as a fork of Get Shit Done, whose long-horizon workflow proved the problem was real. Since the fork, upstream GSD has continued evolving into a broad multi-runtime framework. Workspine took a different path: a smaller repo-native tool with fewer public workflows, generated runtime surfaces from a portable core, proof required before closing work, and decisions that keep their why.
 
 Launch proof posture:
-- Directly validated in repo truth: Claude Code, Codex CLI, OpenCode
-- Qualified support only: Cursor, Copilot, Gemini CLI can use the shared `.agents/skills/` surface plus optional governance when their skill or slash discovery sees it; proof and ergonomics differ from the directly validated runtimes
+- Recorded launch proof in repo truth currently covers Claude Code, Codex CLI, and OpenCode paths
+- Qualified support only: Cursor, Copilot, Gemini CLI can use the shared `.agents/skills/` surface plus optional governance when their skill or slash discovery sees it; proof and ergonomics differ from the recorded paths above
 - Codex CLI validation does not automatically cover Codex VS Code or the Codex app; use native discovery there when available, otherwise open or paste `.agents/skills/gsdd-*/SKILL.md`
 - Repo-local generated runtime surfaces are renderer-checked through `npx -y gsdd-cli health`, with deterministic repair through `npx -y gsdd-cli update` (bare `gsdd ...` is equivalent only when globally installed)
 - Public proof entrypoints: `docs/BROWNFIELD-PROOF.md`, `docs/proof/consumer-node-cli/README.md`, `docs/RUNTIME-SUPPORT.md`, `docs/VERIFICATION-DISCIPLINE.md`
@@ -59,7 +59,7 @@ npx -y gsdd-cli install --global
 npx -y gsdd-cli install --global --tools claude,opencode,codex,copilot
 ```
 
-Global install writes selected Workspine skills and native agent surfaces into user-level agent homes. It does not create `.planning/` in the current repo.
+Global install writes selected Workspine skills and native agent surfaces into user-level agent homes. It does not create `.work/` in the current repo.
 
 Optional adapters:
 ```bash
@@ -72,18 +72,18 @@ npx -y gsdd-cli init --tools all
 ```
 
 Notes:
-- `npx -y gsdd-cli init` always generates open-standard skills at `.agents/skills/gsdd-*` plus the repo-local helper runtime at `.planning/bin/gsdd.mjs`. Workflow helper commands assume the repo root as the current working directory.
+- `npx -y gsdd-cli init` always generates open-standard skills at `.agents/skills/gsdd-*` plus the repo-local helper runtime at `.work/bin/gsdd.mjs`. Workflow helper commands assume the repo root as the current working directory.
 - `--tools ...` remains the manual/headless path; legacy runtime aliases such as `cursor`, `copilot`, and `gemini` are still supported for backward compatibility.
 - `--tools claude` also generates native agents at `.claude/agents/gsdd-*.md` and a compatibility plan command alias at `.claude/commands/gsdd-plan.md`.
 - `--tools opencode` also generates native agents at `.opencode/agents/gsdd-*.md`.
-- `--tools codex` generates `.codex/agents/gsdd-plan-checker.toml`; the portable `.agents/skills/gsdd-plan/` surface remains the Codex entry path and internal helper commands route through `.planning/bin/gsdd.mjs`.
+- `--tools codex` generates `.codex/agents/gsdd-plan-checker.toml`; the portable `.agents/skills/gsdd-plan/` surface remains the Codex entry path and internal helper commands route through `.work/bin/gsdd.mjs`.
 - Root `AGENTS.md` is only written when explicitly requested (`--tools agents`, `--tools all`, legacy runtime aliases, or the wizard governance opt-in). Governance and native adapter surfaces are optional ergonomics; the compact `.agents/skills/` files remain the baseline agent entrypoints.
 
 ## The Workflow
 
 ```
-npx -y gsdd-cli init       -> bootstrap (create .planning/, copy templates, generate skills/adapters)
-/gsdd-new-project          -> .planning/SPEC.md + .planning/ROADMAP.md  (questioning + codebase audit + research)
+npx -y gsdd-cli init       -> bootstrap (create .work/, copy templates, generate skills/adapters)
+/gsdd-new-project          -> .work/SPEC.md + .work/ROADMAP.md  (questioning + codebase audit + research)
 /gsdd-plan N               -> phases/N/PLAN.md      (task breakdown + research)
 /gsdd-execute N            -> code changes           (plan execution with quality gates)
 /gsdd-verify N             -> VERIFICATION.md        (goal-backward validation)
@@ -91,23 +91,15 @@ npx -y gsdd-cli init       -> bootstrap (create .planning/, copy templates, gene
 /gsdd-audit-milestone      -> MILESTONE-AUDIT.md     (cross-phase integration + requirements coverage)
 /gsdd-complete-milestone   -> milestones/vX.Y-*      (archive, evolve spec, collapse roadmap)
 /gsdd-new-milestone        -> updated SPEC.md + ROADMAP.md  (next milestone goals + phases)
-/gsdd-plan-milestone-gaps  -> gap closure phases in ROADMAP.md  (from audit results)
-/gsdd-quick                -> .planning/quick/NNN/   (sub-hour task outside phases)
-/gsdd-pause                -> .planning/.continue-here.md  (session checkpoint)
+/gsdd-plan                 -> amend/extend gap closure phases in ROADMAP.md  (from audit results)
+/gsdd-quick                -> .work/quick/NNN/   (sub-hour task outside phases)
+/gsdd-pause                -> .work/.continue-here.md  (session checkpoint)
 /gsdd-resume               -> restore context, route to next action
 /gsdd-progress             -> show status, route to next action
 ```
 
 The main operator spine is four workflow moves after bootstrap: `new-project -> plan -> execute -> verify`. The other public workflow surfaces are support lanes for milestone closeout, quick work, progress, pause/resume, and brownfield orientation.
 
-Helper command for long-running sessions:
-
-```
-npx -y gsdd-cli control-map [--json] [--with-ignored] -> computed repo/worktree/planning state plus local annotations
-npx -y gsdd-cli control-map annotate set|clear -> optional stale-aware local intent maintenance
-npx -y gsdd-cli closeout-report [--json] [--phase <N>] -> read-only replay of closeout blockers, warnings, fixes, and next safe action
-```
-
 ## Brownfield Entry Contract
 
 Use the same three-way routing everywhere:
@@ -127,7 +119,7 @@ Use the same three-way routing everywhere:
 | `audit-milestone.md` | Cross-phase integration audit, auth protection checks, requirement reconciliation, and orphan detection into `MILESTONE-AUDIT.md` |
 | `complete-milestone.md` | Milestone archive, spec evolution, and roadmap collapse |
 | `new-milestone.md` | Brownfield milestone continuation: goals, requirements, and roadmap phases |
-| `plan-milestone-gaps.md` | Gap-closure phases from `MILESTONE-AUDIT.md` results |
+| `plan.md` amend/extend mode | Gap-closure phases from `MILESTONE-AUDIT.md`, verification gaps, tech debt, brownfield amendments, or incident docs |
 | `quick.md` | Quick-work lane for sub-hour tasks outside the phase cycle |
 | `pause.md` | Session checkpoint writer with conversational handoff |
 | `resume.md` | Session context restorer with priority-ordered routing |
@@ -137,8 +129,8 @@ Use the same three-way routing everywhere:
 
 Architecture notes:
 - `bin/gsdd.mjs` remains the thin generator entrypoint, while vendor-specific rendering lives in adapter modules.
-- Codex CLI uses the always-generated `.agents/skills/gsdd-*` surface as its entry path, relies on `.planning/bin/gsdd.mjs` for deterministic helper calls, and can add a native `.codex/agents/gsdd-plan-checker.toml` checker agent.
-- `control-map` is a helper command, not a lifecycle workflow: it computes repo/worktree/planning truth first and treats `.planning/.local/` annotations as local intent only. `control-map annotate` can maintain those annotations, but cannot create ownership, cleanup, or lifecycle authority.
+- Codex CLI uses the always-generated `.agents/skills/gsdd-*` surface as its entry path, relies on `.work/bin/gsdd.mjs` for deterministic helper calls, and can add a native `.codex/agents/gsdd-plan-checker.toml` checker agent.
+- Repo/worktree status helpers compute from git and local workflow state first; local annotations are intent hints only and cannot create ownership, cleanup, or lifecycle authority.
 - Codex VS Code/app are separate surfaces from Codex CLI; do not claim the CLI proof for them unless they expose compatible skill discovery. Fallback is opening or pasting the generated `SKILL.md`.
 - `npx -y gsdd-cli health` now compares any installed generated runtime surfaces against current render output and routes repairs back through `npx -y gsdd-cli update`.
 - Portable lifecycle contracts now align to the roadmap template status grammar: `[ ]`, `[-]`, `[x]`.
@@ -162,7 +154,7 @@ Note: `parallelization: false` keeps the same mapper/researcher set but runs the
 ## What Gets Created (Project Output)
 
 ```
-.planning/
+.work/
   SPEC.md
   ROADMAP.md
   config.json
@@ -173,7 +165,6 @@ Note: `parallelization: false` keeps the same mapper/researcher set but runs the
   gsdd-new-project/SKILL.md
   gsdd-new-milestone/SKILL.md
   gsdd-plan/SKILL.md
-  gsdd-plan-milestone-gaps/SKILL.md
   gsdd-execute/SKILL.md
   gsdd-verify/SKILL.md
   gsdd-verify-work/SKILL.md
@@ -196,7 +187,7 @@ Note: `parallelization: false` keeps the same mapper/researcher set but runs the
   gsdd-plan.md              # OpenCode-native specialized planner -> checker command surface
 .codex/agents/
   gsdd-plan-checker.toml    # Codex-native checker agent (read-only, high reasoning effort)
-.planning/
+.work/
   quick/              # quick task directories and LOG.md
   .continue-here.md   # session checkpoint (created by pause)
 ```
@@ -217,7 +208,6 @@ distilled/
     new-milestone.md
     pause.md
     plan.md
-    plan-milestone-gaps.md
     progress.md
     quick.md
     resume.md
@@ -227,8 +217,8 @@ distilled/
     spec.md
     roadmap.md
     agents.md              # full AGENTS.md template (for tool adapters)
-    agents.block.md        # bounded block payload for root AGENTS.md insertion
-    delegates/             # delegate instruction files (copied to .planning/templates/delegates/)
+    agents.block.md        # managed payload for root AGENTS.md insertion
+    delegates/             # delegate instruction files (copied to .work/templates/delegates/)
       mapper-tech.md
       mapper-arch.md
       mapper-quality.md

package/distilled/SKILL.md

@@ -31,13 +31,12 @@ Read only the file for the phase you are in:
 - audit-milestone: `workflows/audit-milestone.md`
 - complete-milestone: `workflows/complete-milestone.md`
 - new-milestone: `workflows/new-milestone.md`
-- plan-milestone-gaps: `workflows/plan-milestone-gaps.md`
 - quick: `workflows/quick.md`
 </workflow>
 
 <governance>
 Mandatory:
-- Read before you write. If `.planning/` exists, read `.planning/SPEC.md`, `.planning/ROADMAP.md`, `.planning/config.json`.
+- Read before you write. If `.work/` exists, read `.work/SPEC.md`, `.work/ROADMAP.md`, `.work/config.json`; use matching `.planning/` paths only in legacy workspaces.
 - Stay in scope. Implement only what the current phase plan describes.
 - Never hallucinate. Confirm paths and APIs from repo or docs before use.
 - Research-first when unfamiliar. Log evidence, then plan.
@@ -45,10 +44,10 @@ Mandatory:
 </governance>
 
 <project_structure>
-Workspine uses `.planning/` as the durable workspace:
+Workspine uses `.work/` as the durable workspace. Legacy `.planning/` workspaces are still read and supported.
 
 ```
-.planning/
+.work/
   SPEC.md
   ROADMAP.md
   config.json
@@ -69,22 +68,22 @@ npx -y gsdd-cli init --tools agents
 ```
 
 Behavior:
-- Always: generates open-standard skills at `.agents/skills/gsdd-*/SKILL.md` by embedding `distilled/workflows/*.md`, plus repo-local deterministic helpers at `.planning/bin/gsdd.mjs`.
+- Always: generates open-standard skills at `.agents/skills/gsdd-*/SKILL.md` by embedding `distilled/workflows/*.md`, plus repo-local deterministic helpers at `.work/bin/gsdd.mjs` (or `.planning/bin/gsdd.mjs` in legacy workspaces).
 - Optional: generates tool adapters (root `AGENTS.md`, Claude `.claude/skills` + `.claude/commands` alias + `.claude/agents`, OpenCode `.opencode/commands` + `.opencode/agents`, Codex CLI `.codex/agents/gsdd-plan-checker.toml`).
 - Codex CLI: uses the portable skill entry surface and the generated `.codex/agents/` checker/approach-explorer agents; it does not use `.codex/AGENTS.md` as the primary integration path.
 - Root `AGENTS.md` is only written when explicitly requested (so we do not pollute existing user governance).
 </adapters>
 
 <templates>
-Use templates from `.planning/templates/` (copied from `distilled/templates/`) when producing planning artifacts.
+Use templates from `.work/templates/` (copied from `distilled/templates/`) when producing planning artifacts; use `.planning/templates/` only in legacy workspaces.
 
 Core:
-- `.planning/templates/spec.md` -> `.planning/SPEC.md`
-- `.planning/templates/roadmap.md` -> `.planning/ROADMAP.md`
+- `.work/templates/spec.md` -> `.work/SPEC.md`
+- `.work/templates/roadmap.md` -> `.work/ROADMAP.md`
 
 Research:
-- `.planning/templates/research/*.md` -> `.planning/research/*.md`
+- `.work/templates/research/*.md` -> `.work/research/*.md`
 
 Brownfield codebase mapping:
-- `.planning/templates/codebase/*.md` -> `.planning/codebase/*.md`
+- `.work/templates/codebase/*.md` -> `.work/codebase/*.md`
 </templates>

package/distilled/templates/agents.block.md

@@ -5,17 +5,17 @@ Managed by `gsdd`; edit the framework template, not this block.
 Lifecycle: `new-project -> plan -> execute -> verify -> audit-milestone`.
 
 Core skills: `gsdd-new-project`, `gsdd-plan`, `gsdd-execute`, `gsdd-verify`, `gsdd-progress`.
-Planning state: `.planning/`. Portable workflows: `.agents/skills/gsdd-*/SKILL.md`.
+Planning state: `.work/` (legacy `.planning/` workspaces are still read). Portable workflows: `.agents/skills/gsdd-*/SKILL.md`.
 Install/repair: `npx -y gsdd-cli init` creates repo-local skills and planning state; `npx -y gsdd-cli health` verifies repo-local generated surfaces; `npx -y gsdd-cli update` repairs repo-local drift. Global personal skills use `npx -y gsdd-cli install --global` and are repaired by rerunning that install for the selected targets.
 
 Invoke: `/gsdd-plan` (Claude, OpenCode; Cursor/Copilot/Gemini when skill discovery is available) · `$gsdd-plan` (Codex CLI, plan-only until `$gsdd-execute`) · open SKILL.md directly elsewhere.
 
 Rules:
-1. Read before writing roadmap work: `.planning/SPEC.md`, `.planning/ROADMAP.md`, `.planning/config.json`, and the relevant phase plan when one exists.
+1. Read before writing roadmap work: `.work/SPEC.md`, `.work/ROADMAP.md`, `.work/config.json`, and the relevant phase plan when one exists; use matching `.planning/` paths only in legacy workspaces.
 2. Stay in scope. Implement only what the approved plan or direct user request says. Record unrelated ideas as TODOs.
 3. Verify before claiming done: artifact exists, content is substantive, and it is wired into the system.
 4. Research unfamiliar domains from real docs and code; never hallucinate paths or APIs.
-5. Do not pollute core workflows with vendor-specific syntax; workflow entry lives in `.agents/skills/`, helpers in `.planning/bin/`, and native adapters in their tool-specific directories.
-6. Git guidance in `.planning/config.json` -> `gitProtocol` is advisory; follow the repo's own conventions first.
+5. Do not pollute core workflows with vendor-specific syntax; workflow entry lives in `.agents/skills/`, helpers in `.work/bin/`, and native adapters in their tool-specific directories.
+6. Git guidance in `.work/config.json` -> `gitProtocol` is advisory; follow the repo's own conventions first.
 
-If `.planning/` is missing, run `npx -y gsdd-cli init` then `gsdd-new-project`; bare `gsdd init` is equivalent only when globally installed.
+If `.work/` is missing, run `npx -y gsdd-cli init` then `gsdd-new-project`; bare `gsdd init` is equivalent only when globally installed.