Two blocking findings from /ship's own pass 1, both reproduced in the QA smoke before the fix: gstack-ship-receipt carry hashed the product diff with git patch-id --stable, which strips whitespace, so a space moved in a reviewed shell line carried as "no product change"; and it classed package.json and every lockfile as release metadata, so a dependency swap carried too. The patch-id is now --verbatim, package.json and VERSION are metadata only while the change is a version stamp (lib/pregate/stamp-only.ts), lockfiles are product unless the policy names them, the test globs name code extensions, a dirty working tree refuses before anything is compared, and a receipt carried twice keeps the reviewed head as carry.from. gstack-review-scope: an unresolvable base is POLICY_SOURCE_UNAVAILABLE instead of a silent working-tree read; --range-base is validated; git runs with core.quotePath=false; range_base is null on pass 1; a blocking finding with no path is fix; category "testing" is a test finding below the floor; defer searches once, files nothing on a failed search and exits 0 unfiled; summary refuses zero matching passes and the receipt write is chained to it with &&; a finding the diff causes elsewhere names the changed line in `cause` and classify follows it. Review-loop budget wording (ideas from tstack's sol-loop and pstack's interrogate, rewritten; NOTICE.md): the blocker / should / nit glossary and two stop rules in Step 9.4, the checklist and docs/review-policy.md; a lead-judgment stage in the finding merge both /review and /ship render. The core read diffs $RANGE_BASE from pass 2 on. Caps and pins re-measured with reasons. Step 7 coverage audit: four tests added in existing files, the --review-loop case moved to its own test (the shared test tripped bun's 5 s default). Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
4.7 KiB
Third-Party Notices
gstack is MIT. The files below contain material derived from Apache-2.0 and MIT
works, rewritten in gstack's voice and modified. Rewriting is not an exemption:
the license texts are in licenses/, and each file derived from an Apache-2.0
work carries a notice that it was changed. Unmodified copies (the rule-registry fixture, the
license text) carry no header and are listed here instead.
impeccable — Copyright Paul Bakaus — Apache License 2.0
https://github.com/pbakaus/impeccable
Derived, modified:
lib/design-catalog.ts: rule ids and names fromcrates/live/assets/antipatterns.json; the prose is gstack's.scripts/resolvers/design.ts: the Persuade / Operate / Read / Experience visitor modes, the craft-floor reflexes (browser surfaces, one authored motion moment, depth has an offset, tinted secondary text, space above headings, light-or-dark from the use scene), and the three-looks calibration, fromSKILL.md,reference/craft-floor.md, andreference/new-work.md, rewritten.design-consultation/sections/proposal-and-preview.md.tmpl: the font-selection procedure and the calibration paragraph, rewritten; and theSKILL.md/sections/*.mdfiles generated from these sources.
Unmodified copy:
test/fixtures/impeccable-antipatterns.json:crates/live/assets/antipatterns.jsonat commit 87d8f6d6 (engine-v0.1.3), wrapped in a_sourceprovenance object.
Not distributed: bin/gstack-design-detect.ts invokes an impeccable engine the
user installed. gstack does not ship or mirror that engine and never runs impeccable's
installer or launcher. The one download gstack can make is the engine binary
itself, only after the user accepts a design skill's one-time offer: fetched from
impeccable's own GitHub release into ~/.impeccable/bin/<version>/, verified
against the checksum pinned in lib/design-detect-contract.ts, and recorded in
the egress ledger first. gstack does not audit the engine's network behavior; the
wrapper refuses URL targets so gstack never asks it to touch the network.
ai-design-skills and redesign-skill — Copyright (c) 2026 Elaya — MIT License
https://github.com/elayadesign/ai-design-skills (skills/landing-page-design,
skills/design-to-motion, at 38bbe576) and
https://github.com/elayadesign/redesign-skill (skills/redesign-existing-projects,
at 64627f6e). License text: licenses/MIT-elaya.txt.
Derived, modified (rules rewritten in gstack's voice and reconciled with its design rules; Elaya's fixed fonts, colors, spacing values, icon sets and signature components are not carried over):
design-html/sections/craft.md.tmpl: the Persuade intake, page archetypes, page structure, conversion and copy rules, indexing and build order from landing-page-design Part A; the content-realism, ship-floor, scale-snapping, line-break and motion rules from landing-page-design Part B, the website context of design-to-motion and the redesign-skill audit; and the generateddesign-html/SKILL.md/sections/craft.md.lib/design-craft.tsandbin/gstack-design-craft: the content-realism and ship-floor tells, turned into a free check.design-shotgun/SKILL.md.tmpl: page archetypes as a variant axis.
DESIGN.md specification — Copyright Google LLC — Apache License 2.0
https://github.com/google-labs-code/design.md
lib/design-md.ts, bin/gstack-design-md.ts, and the Phase 6 template in
design-consultation/sections/proposal-and-preview.md.tmpl implement the
format (YAML token front matter in five groups, eight canonical sections in
spec order, {path} token references). No specification text is reproduced.
tstack — Copyright Theo Browne — MIT License
https://github.com/t3dotgg/tstack (skills/sol-loop, at 7de017b3). Ideas, not text: the
three-word severity glossary (blocker, should, nit) and the two stop rules (a review that
grew the diff cuts first; the end of the budget is not approval) in
ship/sections/review-army.md.tmpl, review/checklist.md and docs/review-policy.md
are written in gstack's words and mapped onto gstack's blocking floor. No sentence is copied,
so no license text is carried; this entry is a courtesy.
pstack — Copyright Lauren Tan — MIT License
https://github.com/cursor/plugins (pstack/skills/interrogate, lead-judgment.md). Ideas,
not text: the lead-judgment filters applied before a merged review finding counts (nit
gravity, hypothetical versus actual, structure for a case that does not exist, a different
design is not a defect, missing context; independent agreement as the strongest signal;
NO FINDINGS as a correct result) in scripts/resolvers/review-army.ts stage 4 and
docs/review-policy.md are written in gstack's words. No sentence is copied, so no license
text is carried; this entry is a courtesy.