Garry Tanandcapy-ai[bot]
10b77de4f2
* feat(absorb-tstack): /modernize skill, per-skill Codex default prompts, gstack-post --attribute, the unattended grant and a CONTRIBUTING porting section Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix(modernize): read the PR text through gstack-issue-guard; re-measure the context ceiling Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix: pre-landing review fixes - gstack-post: with --attribute, report scan findings at the body file's own line numbers and a finding inside the callout as PART: attribute (the coordinates were shifted by the three callout lines) - /modernize: route commit messages through gstack-issue-guard with the rest of the PR text, read isCrossRepository and maintainerCanModify, fetch a fork head from pull/N/head, refuse a PR whose head is the base branch, and list moved files NUL-safely - docs/unattended.md: say that /ship never rebases or force-pushes and an unattended /modernize stops at its verdict - CHANGELOG: seven skills carry a codex_default_prompt, not six Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix: /modernize fetches a fork head with a forced refspec and stops when the PR moved A rerun after the author force-pushed left refs/modernize/pr-N stale (the non-forced refspec is rejected with exit 0 through the pipe), and the lease pinned to the current remote head would then have let the rebased stale head overwrite the author's newer commits. The fetch is forced, Steps 2 and 4 stop when the head is not the one observed in Step 1, and the head-is-base guard applies only to same-repository PRs (a fork's main into main is a valid head). Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix: /modernize stops on merge commits in the PR range and pushes a fork head to the fork A plain git rebase drops merge commits and git range-diff compares only the non-merge patches, so a change authored in a PR's merge commit disappeared while the proof printed = for every patch and Step 5 force-pushed the loss. Step 4 now counts merges in $MERGE_BASE..$OLD_HEAD and stops when there are any, switches with -C so a rerun after a refused lease does not fail on the existing branch, and asks for a cross-repository diff to be read as untrusted input before the repository's test command runs it. Step 5 pushes a fork head to the fork's URL with the same pinned lease instead of to origin, where the lease could never match. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * test: cover the Codex default-prompt render, the openai.yaml ownership proof and the unattended grant Adds the /ship coverage audit's tests: test/host-renders-openai-yaml-proof.test.ts drives bin/gstack-host-renders.sh's weakened proof against a rendered yaml, a hand-written one and a generic-prompt one; test/unattended-grant.test.ts pins the docs/unattended.md grant section and the handoff pointer; test/gen-skill-docs.test.ts adds modernize to the skills whose codex_default_prompt must reach openai.yaml. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * docs: name the static lists a new skill still needs and the Codex metadata file From the ship documentation audit: CONTRIBUTING's new-skill checklist said no static list needs a row, which this PR disproved (lib/doctor-components.ts SKILL_REQUIREMENTS and the catalog rows); the host comparison table and docs/ADDING_A_HOST.md gain the agents/openai.yaml default_prompt source; a blank line before the new docs/unattended.md grant heading. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix: pre-landing review fixes CHANGELOG [Unreleased] gate-integrity record: the catalog and context-budget figures re-measured on top of main (1,314 -> 1,359; modernize 9466; alwaysOnTotal 7458 -> 7880), as the merge commit's ratchets state. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * docs: name the optional codex_default_prompt key in the new-skill checklist Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * test(parity): re-pin the ship union cap at 1.7405 after the main merge GSTA-36 grant 2026-10-27. On the tree merged withf27a7605the ship union is 326,691 / 187,706 = 1.7404 against #3487's 1.7400; the only ship bytes this PR adds are the handoff section's one-line pointer. Cap 1.7400 -> 1.7405, measurement appended to the comment. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * docs(changelog): the [Unreleased] gate-integrity bullet names the ship cap re-pin Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix: pre-landing review fixes CHANGELOG [Unreleased]: end the Codex default-prompts sentence at "generator input only." so bin/gstack-prose-lint --unreleased --gate (main's new quality-gate step) passes, and restate the gate-integrity bullet's figures for the tree merged with1f246e35: ship cap 1.7524 -> 1.7528 (329,005 / 187,706), modernize 9466 -> 3772 after the preamble hoist, alwaysOnTotal 7769 -> 7880, catalog 1,359 unchanged. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix: pre-landing review fixes CHANGELOG [Unreleased] gate-integrity bullet names the current ship cap pin (1.7525 -> 1.7529, measured 329,024 / 187,706 on the392f50d4merge) and keeps the 1.7528 pin in the earlier-merges clause. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --------- Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
11 KiB
Third-Party Notices
gstack is MIT. The files below contain material derived from Apache-2.0 and MIT
works, rewritten in gstack's voice and modified. Rewriting is not an exemption:
the license texts are in licenses/, and each file derived from an Apache-2.0
work carries a notice that it was changed. Unmodified copies (the rule-registry fixture, the
license text) carry no header and are listed here instead.
impeccable — Copyright Paul Bakaus — Apache License 2.0
https://github.com/pbakaus/impeccable
Derived, modified:
lib/design-catalog.ts: rule ids and names fromcrates/live/assets/antipatterns.json; the prose is gstack's.scripts/resolvers/design.ts: the Persuade / Operate / Read / Experience visitor modes, the craft-floor reflexes (browser surfaces, one authored motion moment, depth has an offset, tinted secondary text, space above headings, light-or-dark from the use scene), and the three-looks calibration, fromSKILL.md,reference/craft-floor.md, andreference/new-work.md, rewritten.design-consultation/sections/proposal-and-preview.md.tmpl: the font-selection procedure and the calibration paragraph, rewritten; and theSKILL.md/sections/*.mdfiles generated from these sources.
Unmodified copy:
test/fixtures/impeccable-antipatterns.json:crates/live/assets/antipatterns.jsonat commit 87d8f6d6 (engine-v0.1.3), wrapped in a_sourceprovenance object.
Not distributed: bin/gstack-design-detect.ts invokes an impeccable engine the
user installed. gstack does not ship or mirror that engine and never runs impeccable's
installer or launcher. The one download gstack can make is the engine binary
itself, only after the user accepts a design skill's one-time offer: fetched from
impeccable's own GitHub release into ~/.impeccable/bin/<version>/, verified
against the checksum pinned in lib/design-detect-contract.ts, and recorded in
the egress ledger first. gstack does not audit the engine's network behavior; the
wrapper refuses URL targets so gstack never asks it to touch the network.
ai-design-skills and redesign-skill — Copyright (c) 2026 Elaya — MIT License
https://github.com/elayadesign/ai-design-skills (skills/landing-page-design,
skills/design-to-motion, at 38bbe576) and
https://github.com/elayadesign/redesign-skill (skills/redesign-existing-projects,
at 64627f6e). License text: licenses/MIT-elaya.txt.
Derived, modified (rules rewritten in gstack's voice and reconciled with its design rules; Elaya's fixed fonts, colors, spacing values, icon sets and signature components are not carried over):
design-html/sections/craft.md.tmpl: the Persuade intake, page archetypes, page structure, conversion and copy rules, indexing and build order from landing-page-design Part A; the content-realism, ship-floor, scale-snapping, line-break and motion rules from landing-page-design Part B, the website context of design-to-motion and the redesign-skill audit; and the generateddesign-html/SKILL.md/sections/craft.md.lib/design-lint/rules/copy.ts: the content-realism and ship-floor tells, the design lint's copy tier.design-shotgun/SKILL.md.tmpl: page archetypes as a variant axis.design-review/sections/craft-audit.md.tmpl(and the generatedsections/craft-audit.md): the redesign-skill audit of an existing site, its fix-priority order and Tailwind version check;scripts/resolvers/design-craft.ts: the Persuade conversion checks, also rendered intoplan-design-review/sections/review-sections.md; and the craft-tell entries inlib/design-catalog.ts.design-motion/SKILL.md.tmplanddesign-motion/sections/fidelity.md.tmpl,motion.md.tmplandfigma.md.tmpl(and the generateddesign-motion/SKILL.mdandsections/*.md): design-to-motion's fidelity rules, Figma layer-export table (now an optional source path), loading choreography, story loops, loop cycle, easing, checks and export formats, reconciled with gstack's one authored motion moment, content visible without script, and the slop catalog's motion tells.lib/motion-capture.tsandbin/gstack-motion-capture.ts: design-to-motion's deterministic capture (fake clock, whole-millisecond steps averaging 1000/60, the__start/__tick/__ltpage contract, PRE frames).lib/motion-encode.tsandbin/gstack-motion-encode: design-to-motion's ffmpeg recipes for the MP4, loop GIF and 800x500 GIF, and its seam, empty-beat, rest and overflow checks as ffmpeg PSNR comparisons.
hallmark — Copyright (c) 2026 Hallmark contributors — MIT License
https://github.com/Nutlope/hallmark (skills/hallmark/scripts/sloplint.mjs,
sloplint-render.mjs, references/gates.md, scripts/fixtures/, at 7ec8682).
License text: licenses/MIT-hallmark.txt.
Derived, modified (every gate rewritten in TypeScript and in gstack's voice, mapped onto gstack's severity words; hallmark's theme stamp, genres, posture guards, photo index and judged gates are not carried over):
lib/design-lint/andbin/gstack-design-lint: the static tier's parsers (CSS rules and tokens, HTML and component pseudo-HTML, Tailwind class strings), the colour maths, the waiver record, and the rule families underlib/design-lint/rules/; the render tier inlib/design-lint/render*.ts, driving gstack's own browser instead of puppeteer.test/fixtures/design-lint/{slopped.html,eyebrow-pass,eyebrow-fail,tailwind-pass,tailwind-fail,waiver}: the fixtures, with their waiver comments rewritten to the lint's form.
DESIGN.md specification — Copyright Google LLC — Apache License 2.0
https://github.com/google-labs-code/design.md
lib/design-md.ts, bin/gstack-design-md.ts, and the Phase 6 template in
design-consultation/sections/proposal-and-preview.md.tmpl implement the
format (YAML token front matter in five groups, eight canonical sections in
spec order, {path} token references). No specification text is reproduced.
tstack — Copyright Theo Browne — MIT License
https://github.com/t3dotgg/tstack (skills/sol-loop, at 7de017b3). Ideas, not text: the
three-word severity glossary (blocker, should, nit) and the two stop rules (a review that
grew the diff cuts first; the end of the budget is not approval) in
ship/sections/review-army.md.tmpl, review/checklist.md and docs/review-policy.md
are written in gstack's words and mapped onto gstack's blocking floor. No sentence is copied,
so no license text is carried; this entry is a courtesy.
Also ideas, not text (skills/modernize, skills/leaving-pr-comments, skills/full-send,
agents/openai.yaml, at 7de017b3): the MODERNIZE / REWORK / CLOSE verdict names in
modernize/SKILL.md.tmpl, the > [!NOTE] author callout behind gstack-post --attribute, the
three-bullet unattended grant in docs/unattended.md, and a per-skill Codex default_prompt;
all written fresh in gstack's words.
Design port (skills/babysit-pr/scripts/pr-wait, at 7de017b3; license text:
licenses/MIT-tstack.txt): bin/gstack-pr-wait, lib/pr-wait.ts and
lib/pr-wait-github.ts follow pr-wait's design (one stdout line per real event,
--until green|ready|any-change, exit 0/1/2, required checks from rulesets and
classic protection, two identical polls before green, the base-moved-and-touches-
this-PR event, BEHIND and DIRTY, a per-PR lock, a 6-hour baseline), rewritten in
TypeScript on gstack's bun shebang, state root, result codes and config keys;
no Python line is carried. Each file names the source in its header.
pstack — Copyright Lauren Tan — MIT License
https://github.com/cursor/plugins (pstack/skills/interrogate, lead-judgment.md). Ideas,
not text: the lead-judgment filters applied before a merged review finding counts (nit
gravity, hypothetical versus actual, structure for a case that does not exist, a different
design is not a defect, missing context; independent agreement as the strongest signal;
NO FINDINGS as a correct result) in scripts/resolvers/review-army.ts stage 4 and
docs/review-policy.md are written in gstack's words. No sentence is copied, so no license
text is carried; this entry is a courtesy.
Also ideas, not text, from pstack/skills/blast-radius, recall, benchmark-checklist,
architect (references/design-red-flags.md) and principle-attack-the-premise
(Garry, 2026-10-26: "Do it, send"): the one safety fact, the five-rung evidence ladder and
the shared-premise red flag in investigate/sections/blast-radius.md.tmpl and
investigate/SKILL.md.tmpl; the transcript-mining fallback and its status-tagged brief in
context-restore/sections/transcripts.md.tmpl; the seven questions in
benchmark/sections/vet-the-number.md.tmpl; the second-shape comparison and the eight
design red flags in Section 1 of plan-eng-review/sections/review-sections.md.tmpl; and the generated
SKILL.md / sections/*.md files. Each section names its source in a first-line comment.
Written in gstack's words; no sentence is copied, so no license text is carried.
Also ideas, not text, from pstack/skills/principle-*, poteto-mode and its eval playbook: ETHOS.md principles 5 to 8, the observable-questions rule in plan-tune/SKILL.md.tmpl and docs/proactive.md, the blinding rules in eval-plan/SKILL.md.tmpl and docs/TESTING_INTERNALS.md, and the limiter sentence in AGENTS.md step 4 (GSTA-124).
pstack, ported scripts — Copyright (c) 2026 Lauren Tan — MIT License
https://github.com/cursor/plugins (pstack/ at 99b609a7). License text:
licenses/MIT-pstack.txt. Unlike the ideas entry above, these two are code
ports, so the license text is carried and each file's header names its source.
Derived, modified:
bin/gstack-decision-trail:pstack/skills/show-me-your-work/scripts/log.shin TypeScript: the header-once append, the one-line cells and the spreadsheet formula guard (a leading quote on cells starting with=,+,-or@). Thestartsubcommand and the--runadmission check are gstack's.bin/gstack-worktree-audit:pstack/skills/poteto-mode/scripts/worktree-audit.sh, with the PR column read throughgh --jqalone, the chat column read from Claude Code's per-worktree transcript directory, and a--no-fetchflag.
pstack (unslop) — Copyright Lauren Tan — MIT License
https://github.com/cursor/plugins (pstack/skills/unslop/SKILL.md, at 99b609a7). The
word lists in lib/prose-lint.ts (the autopilot vocabulary and the metaphor nouns with
their plain replacements) are facts taken from unslop's rules 7 and 26; the rules a
regular expression decides (the "not just X, but Y" shape, the mid-sentence colon, the
bold label that restates its line, arrows and dropped articles) are written in gstack's
words, scoped to the CHANGELOG entry and PR body /ship writes, and report-only elsewhere.
No sentence is copied, so no license text is carried; this entry is a courtesy.