Garry Tanandcapy-ai[bot]
576839cb8c
* feat(ship): review loop converges (frozen finding scope, 3-pass cap, NO FINDINGS first-class) and receipts carry across conflict-only merges
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* test(ship): keep the Step 9 first-entry and Fix-First phrasing the skip/requeue contract asserts; fill the review record's pass, review_scope and range_base placeholders in the caller template test; narrow a test type
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix: pre-landing review fixes (pass 1) and the review-loop budget wording
Two blocking findings from /ship's own pass 1, both reproduced in the QA smoke before the fix:
gstack-ship-receipt carry hashed the product diff with git patch-id --stable, which strips
whitespace, so a space moved in a reviewed shell line carried as "no product change"; and it
classed package.json and every lockfile as release metadata, so a dependency swap carried too.
The patch-id is now --verbatim, package.json and VERSION are metadata only while the change is a
version stamp (lib/pregate/stamp-only.ts), lockfiles are product unless the policy names them,
the test globs name code extensions, a dirty working tree refuses before anything is compared,
and a receipt carried twice keeps the reviewed head as carry.from.
gstack-review-scope: an unresolvable base is POLICY_SOURCE_UNAVAILABLE instead of a silent
working-tree read; --range-base is validated; git runs with core.quotePath=false; range_base is
null on pass 1; a blocking finding with no path is fix; category "testing" is a test finding
below the floor; defer searches once, files nothing on a failed search and exits 0 unfiled;
summary refuses zero matching passes and the receipt write is chained to it with &&; a finding
the diff causes elsewhere names the changed line in `cause` and classify follows it.
Review-loop budget wording (ideas from tstack's sol-loop and pstack's interrogate, rewritten;
NOTICE.md): the blocker / should / nit glossary and two stop rules in Step 9.4, the checklist
and docs/review-policy.md; a lead-judgment stage in the finding merge both /review and /ship
render. The core read diffs $RANGE_BASE from pass 2 on. Caps and pins re-measured with reasons.
Step 7 coverage audit: four tests added in existing files, the --review-loop case moved to its
own test (the shared test tripped bun's 5 s default).
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix: pin the renumbered review-army stages and point the wording test at product code
CI at c3e27fc failed three free-tier tests, all this branch's own: the
workflow-required-steps fixture and shared-libs-rendering still pinned the
pre-Lead-judgment stage numbers, and test-of-test-ratchet counted
review-loop-budget-wording.test.ts as test-only code because it read only
generated markdown. The fixture and rendering test now pin stages 1-8, and the
wording test renders both armies through generateReviewArmy and reads the
authored ship template as well as the generated sections.
Pass-2 maintainability notes folded in: docs/troubleshooting.md names the two
new RECEIPT_CARRY_REFUSED causes (dirty tree, unreadable status) and the two new
REVIEW_SCOPE_INPUT causes (non-hex --range-base, summary with no matching
pass); gstack-review-scope's help states that classify reads the base branch's
policy and refuses an unresolvable base unless --policy is passed.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix: date a review-log row from its binding start when it has no timestamp
The Step 9.4 template asks the writer to fill `timestamp`; the logger stamps
`review_binding.started_at` but never `timestamp`. `gstack-review-scope
summary` dropped such a row silently, so this PR's own pass 2 was missing from
REVIEW_LOOP (passes=1 for a two-pass loop). A row now dates from `timestamp`,
else from its binding start; a row with neither is still not counted.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* fix: pass-4 review fixes (carry stamp rule, deleted-file locus, scanned defer, diff prefixes, row time)
Five findings at the blocking floor from the Step 11 outside voice (gpt-6.1-sol)
and the native adversarial pass, fixed as a fourth pass approved by GStack
Minder under the three-pass policy:
- carry: a path the policy names under stamp_files, stamp_paths or
release_outputs is metadata only while its change is a stamp (versionStampOnly
for a manifest kind, stampOnlyText otherwise), the rule the tree receipt
applies; a logic change in a stamped source file is product. Every
metadata-listed path is read at both heads and a non-stamp change drops its
globs from the product exclusion.
- review-scope: parseHunks keeps a deleted file as a whole changed location, so
a cause anchored in a removed export is the diff's to fix, not deferred.
- defer: issues are filed through lib/gstack-post's publication scan; a HIGH
finding in the title or body refuses and a MEDIUM one needs a human, both
recorded as unfiled with the reason; --repo names the destination.
- classify: both diffs pin --src-prefix=a/ --dst-prefix=b/ --no-textconv, so
diff.mnemonicPrefix cannot send every finding outside.
- summary: a row dates from review_binding.started_at before the writer-typed
timestamp, so a date-only value cannot drop a real pass.
Docs: ship-policy.md#receipt-carry, review-policy.md, the Step 9.4 template
and the CHANGELOG gate-integrity note record the rule and the pass.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* test(review-army): assert the Red Team branch the run took in the N+1 case
Under the blocking floor the Performance specialist rates a 12-line N+1
INFORMATIONAL, so the conditional Red Team does not activate; the case
encoded the old severity (N+1 is CRITICAL, a Red Team always follows). It
now asserts the branch the run took: a Red Team that ran must follow the
Performance specialist; no Red Team is correct only when the report's own
count says 0 critical and its Red Team line names that reason. The N+1
detection assertion is unchanged. The free contract test gains the
informational-not-activated and informational-claimed controls and the
budget test's synthetic report carries the count line.
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
* v1.91.256.0 stamp
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
---------
Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
5.7 KiB
Third-Party Notices
gstack is MIT. The files below contain material derived from Apache-2.0 and MIT
works, rewritten in gstack's voice and modified. Rewriting is not an exemption:
the license texts are in licenses/, and each file derived from an Apache-2.0
work carries a notice that it was changed. Unmodified copies (the rule-registry fixture, the
license text) carry no header and are listed here instead.
impeccable — Copyright Paul Bakaus — Apache License 2.0
https://github.com/pbakaus/impeccable
Derived, modified:
lib/design-catalog.ts: rule ids and names fromcrates/live/assets/antipatterns.json; the prose is gstack's.scripts/resolvers/design.ts: the Persuade / Operate / Read / Experience visitor modes, the craft-floor reflexes (browser surfaces, one authored motion moment, depth has an offset, tinted secondary text, space above headings, light-or-dark from the use scene), and the three-looks calibration, fromSKILL.md,reference/craft-floor.md, andreference/new-work.md, rewritten.design-consultation/sections/proposal-and-preview.md.tmpl: the font-selection procedure and the calibration paragraph, rewritten; and theSKILL.md/sections/*.mdfiles generated from these sources.
Unmodified copy:
test/fixtures/impeccable-antipatterns.json:crates/live/assets/antipatterns.jsonat commit 87d8f6d6 (engine-v0.1.3), wrapped in a_sourceprovenance object.
Not distributed: bin/gstack-design-detect.ts invokes an impeccable engine the
user installed. gstack does not ship or mirror that engine and never runs impeccable's
installer or launcher. The one download gstack can make is the engine binary
itself, only after the user accepts a design skill's one-time offer: fetched from
impeccable's own GitHub release into ~/.impeccable/bin/<version>/, verified
against the checksum pinned in lib/design-detect-contract.ts, and recorded in
the egress ledger first. gstack does not audit the engine's network behavior; the
wrapper refuses URL targets so gstack never asks it to touch the network.
ai-design-skills and redesign-skill — Copyright (c) 2026 Elaya — MIT License
https://github.com/elayadesign/ai-design-skills (skills/landing-page-design,
skills/design-to-motion, at 38bbe576) and
https://github.com/elayadesign/redesign-skill (skills/redesign-existing-projects,
at 64627f6e). License text: licenses/MIT-elaya.txt.
Derived, modified (rules rewritten in gstack's voice and reconciled with its design rules; Elaya's fixed fonts, colors, spacing values, icon sets and signature components are not carried over):
design-html/sections/craft.md.tmpl: the Persuade intake, page archetypes, page structure, conversion and copy rules, indexing and build order from landing-page-design Part A; the content-realism, ship-floor, scale-snapping, line-break and motion rules from landing-page-design Part B, the website context of design-to-motion and the redesign-skill audit; and the generateddesign-html/SKILL.md/sections/craft.md.lib/design-craft.tsandbin/gstack-design-craft: the content-realism and ship-floor tells, turned into a free check.design-shotgun/SKILL.md.tmpl: page archetypes as a variant axis.
hallmark — Copyright (c) 2026 Hallmark contributors — MIT License
https://github.com/Nutlope/hallmark (skills/hallmark/scripts/sloplint.mjs,
sloplint-render.mjs, references/gates.md, scripts/fixtures/, at 7ec8682).
License text: licenses/MIT-hallmark.txt.
Derived, modified (every gate rewritten in TypeScript and in gstack's voice, mapped onto gstack's severity words; hallmark's theme stamp, genres, posture guards, photo index and judged gates are not carried over):
lib/design-lint/andbin/gstack-design-lint: the static tier's parsers (CSS rules and tokens, HTML and component pseudo-HTML, Tailwind class strings), the colour maths, the waiver record, and the rule families underlib/design-lint/rules/; the render tier inlib/design-lint/render*.ts, driving gstack's own browser instead of puppeteer.test/fixtures/design-lint/{slopped.html,eyebrow-pass,eyebrow-fail,tailwind-pass,tailwind-fail,waiver}: the fixtures, with their waiver comments rewritten to the lint's form.
DESIGN.md specification — Copyright Google LLC — Apache License 2.0
https://github.com/google-labs-code/design.md
lib/design-md.ts, bin/gstack-design-md.ts, and the Phase 6 template in
design-consultation/sections/proposal-and-preview.md.tmpl implement the
format (YAML token front matter in five groups, eight canonical sections in
spec order, {path} token references). No specification text is reproduced.
tstack — Copyright Theo Browne — MIT License
https://github.com/t3dotgg/tstack (skills/sol-loop, at 7de017b3). Ideas, not text: the
three-word severity glossary (blocker, should, nit) and the two stop rules (a review that
grew the diff cuts first; the end of the budget is not approval) in
ship/sections/review-army.md.tmpl, review/checklist.md and docs/review-policy.md
are written in gstack's words and mapped onto gstack's blocking floor. No sentence is copied,
so no license text is carried; this entry is a courtesy.
pstack — Copyright Lauren Tan — MIT License
https://github.com/cursor/plugins (pstack/skills/interrogate, lead-judgment.md). Ideas,
not text: the lead-judgment filters applied before a merged review finding counts (nit
gravity, hypothetical versus actual, structure for a case that does not exist, a different
design is not a defect, missing context; independent agreement as the strongest signal;
NO FINDINGS as a correct result) in scripts/resolvers/review-army.ts stage 4 and
docs/review-policy.md are written in gstack's words. No sentence is copied, so no license
text is carried; this entry is a courtesy.