gstack

gstack's design skills now start with 61 deterministic anti-pattern checks, in your voice, then spend their judgment where a detector cannot. DESIGN.md is written in the open format that impeccable and Google Stitch read, and the AI-slop list lives in one typed catalog instead of four drifting copies. If you have impeccable installed, /design-review, /design-html, /review, and /ship run its engine first and hand you its findings as FINDING-NNN [rule-id] rows with file:line and a handoff before the LLM pass reads a page. gstack never runs impeccable's installer or launcher. The first time a design skill finds no engine it asks once: download the 16 MB engine binary from impeccable's own GitHub release into ~/.impeccable, checked against a checksum gstack pins and recorded in your egress ledger first, or not. Say no and nothing changes and nothing nags; gstack-config set design_detector off silences every trace. The probe only reads files, the engine runs only from under your home directory, and a checked-out repository can never make gstack execute one of its own files. On a live URL, /design-review scans the rendered page: the DOM is dumped with linked stylesheets inlined and scripts, input values, handlers, and query strings stripped, redaction-checked, kept owner-only, and the engine reads that, so Rule 4 holds on a deployed site. /design-consultation writes the open DESIGN.md spec (tokens in front matter, eight canonical sections, your Motion and Decisions Log kept). An existing file is converted only when you say so, once, and the answer is recorded in the file.

Memorable's workflow memory plugs into Claude Code through gstack, behind a consent key you control. Every prompt it sees is receipted, secret-scanned and enveloped. The switch is off until you flip it. Memorable (memorable.sh) is a third-party CLI that remembers how you did a task and recalls it the next time you ask for something similar. Its own installer registers a Claude Code hook directly. This release lets you register that hook through gstack instead, with gstack-memorable enable, and nothing changes until you run it. When you do, gstack records its own consent key (memorable_recall, listed by gstack-egress grants with its revoke command), writes an egress receipt before every prompt it hands to the vendor binary and skips the hand-off if the receipt cannot be written, refuses to hand over a prompt carrying a live-shaped credential, skips repositories whose trust policy is deny or read-only, runs the binary in an allowlisted environment inside its own process group under a 4.5 second budget, and wraps whatever comes back in the trust envelope so recalled text can never block a prompt or speak as gstack. gstack-memorable status shows the vendor CLI, the gate, who registered the hook (by identity, so it stays correct after Claude Code rewrites settings.json), receipt counts and recent errors. disable turns it off and verifies both the consent and the registration before it says so. Claude Code only; Windows is refused for now because there are no process groups to contain the vendor.

Codex reviews, consultations, and evals now default to GPT-6 Astra. Choose another model with GSTACK_CODEX_MODEL or an explicit model in your request; the readiness probe checks that same selection. Claude outside voices and eval capture/judging now default to Fable 5.1. Outside voices accept GSTACK_CLAUDE_MODEL; evals retain their explicit and environment model overrides. Warmup and distillation keep their cheaper defaults. Native Codex reviews honor the selected model even when the CLI has a separate review-model pin. Claude judges parse text after thinking blocks, and arm judgments omit the temperature setting Fable does not support. Frontier judges have enough output budget for thinking and JSON. Workflow evals read generated sections in execution order, without duplicated content. Ship and plan reviews keep approval gates with the parent agent, preserve readiness checks, and use project-native test commands. QA scoring and monitoring rules are explicit; Aside drive options wait for a successful readiness probe. Benchmark timing uses the navigation entry's actual fields. Deploy setup collects missing configuration, and failed vendored upgrades restore their backup instead of deleting it. Retro reports distinguish verified merges from PR references, use the session date for snapshots, and define report ordering. The quality eval includes compare-mode instructions instead of cutting them off. Documentation review runs before publication so approved fixes reach the PR. Changelog protection, unavailable-review handling, and raw/enveloped PR-body handling are consistent across the workflow.

Aside is the browser gstack drives first. Every browsing skill, the PDF and diagram renderer, and web research go through it. gstack's own headless browser stays as the automatic fallback, so nothing stops working without Aside. Since v1.72 Aside was the recommended driver for third-party sites. This release makes it the first driver everywhere. /qa, /qa-only, /design-review, /scrape, /benchmark, /canary, /browse, /devex-review, /land-and-deploy's post-deploy check, and /design-consultation's competitor research now run inside the Aside AI browser (macOS 15+, aside.com), in the sessions you are already signed in to. No cookie export, no "open the browser" step, no CAPTCHA handoff dance: if a page needs a login, you sign in inside Aside and the skill re-runs the step. /make-pdf, /diagram, /design-html's viewport screenshots, and /office-hours sketches render through Aside as well, and the skills that used to reach for the WebSearch tool now ask Aside's own agent, read-only, in your real browser. When Aside is not there, nothing breaks. Every browsing skill carries a fallback section that translates its Aside steps onto gstack's own headless Chromium ($B), step for step: same evidence lines, same report, same consent rules, with cookie import or a handoff for authenticated pages. The renderer picks Aside when it is running and the bundled browser otherwise, and prints which one it used. Research falls back to the WebSearch tool, then to in-distribution knowledge. Linux and Windows users keep the bundled browser exactly as before; the Third-Party Web Actions contract keeps gstack's visible browser as its fallback driver.

Setup finishes even when Chromium cannot be installed. gstack never deletes or overwrites a skill it did not create. Three defects that a downstream fork kept tripping over are fixed at the source. ./setup used to abort at the Playwright step on any box where the Chromium download failed or hung (offline, proxied, AppArmor-restricted), and because that step ran before skills were registered, those users ended with zero skills. The /freeze deny hook read a different state directory than /freeze wrote whenever GSTACK_HOME was set, so the boundary silently allowed everything. And both ./setup and gstack-relink would replace or delete any skill entry that happened to share a name with a gstack skill, including a skill you wrote yourself. Now the Chromium install is best-effort and bounded. It runs under a 600 second deadline you can change with GSTACK_PLAYWRIGHT_INSTALL_TIMEOUT, skip outright with GSTACK_SKIP_PLAYWRIGHT=1, and every failure becomes a reason code in the final summary that names the skills that need a browser. Skills always register. Both PreToolUse hooks resolve the same state root the writers use, and freeze fails closed on any unexpected death instead of exiting with no decision. Ownership is proven, never assumed from a name: an entry is only touched when it is a symlink into gstack, carries the .gstack-owned marker gstack writes for directories it creates, or is a real file gstack generated. Even then a generated file you have since customized is moved to ~/.gstack/backups/skills/ / before gstack links over it, and a directory is only removed whole when nothing of yours is inside.

/ship can no longer be stranded by a backgrounded subagent. The bug class that came back twice is pinned everywhere it lives. Claude Code v2.1.198 made Agent-tool subagents launch in the background by default. Four /ship steps (7, 8, 10, 18) hand work to a subagent and parse its final line as JSON, and none of them passed run_in_background: false, so a ship run could park forever on Step 18 waiting for doc-sync output that was never coming. This is the third time this class has bitten. Every synchronous dispatch site in the skill tree now carries the explicit flag, and the flag is test-pinned per file so a fourth recurrence fails CI the moment it lands. The doc-sync dispatch also got real failure handling. If the dispatch gets backgrounded anyway, the parent polls for about 10 minutes, stops the runaway task, reconciles any commit the subagent made against the pre-dispatch HEAD, and ships the PR without the Documentation section instead of hanging. The subagent itself is scope-guarded to docs only: it never changes VERSION, never merges the base branch, skips the Codex doc review (the parent owns review passes), and reports a rejected push as pushed:false for the parent to reconcile.

Plan reviews ask their questions again, the OSV lane is green from 105 advisories, and 18 community fixes land with credit. The upgrade path can no longer delete your install. The fix wave. The weekly periodic eval lane broke at v1.76: the spawned-session rule let the model infer "nobody is reading this" from any scripted-looking prompt and silently auto-decide every review question, so plan reviews stopped asking. reviewCount collapsed to 0 across four skills. The trigger is now machine-verifiable and nothing else: the preamble's own echoed SESSION_KIND: spawned status line. No text from a dispatch prompt, file, or page can flip a session to auto-choose; a spawned subagent that missed the env marker is still caught at failure time by the AUQ hooks' spawned escape. The reproduced failure went from 0 review questions to a full question flow on the same harness. The weekly OSV lane had been red for three weeks with 105 advisories, and its suppression file had been silently inert since v1.65 (wrong filename for auto-discovery, and per-directory configs never covered the nested lockfile anyway). The workflow now passes an explicit global --config, a dependency pass cleared 102 advisories through in-range bumps and overrides that actually reach nested exact pins, and the 3 survivors carry reasons plus ignoreUntil expiries. The diagram-render bundle lost its duplicate mermaid on the way: 9.96 MB to 7.59 MB. Eighteen community PRs are absorbed with authorship preserved, twelve of them with wave amendments that finish a gap or fix a defect found in review. Nine more confirmed bugs are fixed directly, led by a failed mktemp in the vendored upgrade path that used to rm -rf your install's backup after a failed swap. The swap now aborts loudly and restores the backup.

Ship's doc-sync now survives Conductor. Spawned subagents finally know they're spawned. Every Conductor-hosted /ship used to lose its PR ## Documentation section the moment the document-release subagent hit an interactive gate: the subagent inherited the parent's environment, classified itself as a session a human was watching, rendered a decision brief nobody could answer, and stopped. The JSON contract broke, every time a gate fired (#2733). This release makes the spawned classification reachable: /ship marks its subagent with GSTACK_SESSION_KIND=spawned, and the whole stack (preamble, AskUserQuestion rules, both AUQ hooks) now resolves gates by auto-choosing the recommended option instead of writing prose to nobody. Destructive options are never auto-chosen, on any surface: the conservative choice wins and gets recorded. Auto-chosen decisions come back in a decisions array the parent prints to your console, so nothing is decided invisibly. Added: GSTACK_SESSION_KIND=spawned, decisions in the doc-sync contract, Proactive spawned rule, Gate-tier E2E. Changed: bin/gstack-skill-start, AUQ hooks, Ship Step 18 dispatch prompt. Fixed: #2733 - Conductor-hosted /ship runs no longer lose their Documentation section. For contributors: New test files and measurements.

Every PR stops paying for evals twice. Flakes are now measured, killed at the root, and fenced. The test infrastructure got its overhaul, wave 1. The legacy 17-row eval matrix that ran serialized AHEAD of the sliced lane on every PR is deleted: one paid lane, its gate census derived from the runner itself, so a new gate test is in the census the moment its file lands. No hand-enumerated rows to drift, and the drift already tried, a new matrix row landed on main mid-branch and the merge resolved to the derived census that covers it by construction. The flake war moved from anecdotes to instruments. Every retried pass is now recorded where it cannot hide, the free lane retries a failing file once, loudly, and appends every flaky pass to a per-project ledger uploaded from CI on green runs. And the wedge class that hit main, a hung child under a blocking spawnSync that no in-process timeout can interrupt, is extinct: 499 timeout-less sync-spawn sites across 146 files swept to zero, with a ratcheted tripwire that failed its first real offender the day a timeout-less spawn arrived from a merge.

Your review now hunts over-built code, not just broken code. And every skill's advice starts with "reuse before you build." This release imports the best of ponytail, the code-minimalism ruleset, without importing its build-less posture. /review gains an eighth lens: a simplification specialist that flags unrequested structure (hand-rolled stdlib, one-implementation abstractions, dead flexibility, dependencies duplicating platform features) in a closed five-tag vocabulary. It is advisory only. It cannot dent your quality score, its fixes are never auto-applied, and on a lean diff it tells you something no reviewer ever says: "lean already — nothing to cut." Every tier-2+ skill also gains the reuse ladder (stop at the first rung that holds: this repo, stdlib, native platform, an installed dependency... then build the complete version of what remains) and a bounded closer, so completion reports stop touring every edit. Accepted shortcuts now leave a durable trail: a decision-ledger entry plus a gstack-shortcut(dec- ) marker in code, harvested into a debt ledger by /retro. Agent hosts without a full install (Zed, Amp, Cursor side projects) get a 1.8KB rules digest to copy into their own rules file. And /autoplan now runs the Eng review last, always, so the required shipping gate reviews the final amended plan instead of a stale one. Added: Simplification review specialist, Reuse ladder, Bounded closer, Shortcut debt ledger, Instruction-only host tier, With/without-skill arm benchmark, /autoplan runs Eng last. Changed: AskUserQuestion preamble section, Terse-mode label, /review checklist. Fixed: Version bumps no longer strand the agents digest, The free-suite flaky retry, Version allocation, Browse temp paths, Setup's instruction-tier pointer, /retro's shortcut harvest. For contributors: New benchmarks and test improvements.

The suites got faster by deleting lies, not by skipping work. This release is a full audit and overhaul of gstack's own test and CI system. The audit found the safety net lying in specific ways: three CI eval jobs ran zero tests and passed on every PR, four paid test files could never execute in any lane, the required free-tests check silently skipped nine make-pdf gates on Linux for their entire life, and about 57 E2E files ran in no scheduled lane at all. All of it is fixed, and each fixed class now has a tripwire so it cannot quietly return. Speed came from structure. The free suite packs shards by recorded per-file durations instead of file counts, and the serial tree-mutating shard is gone entirely: the generator gained a main() guard and renders every host into out-dirs, so the suite never writes the live tree. The paid lane re-platforms CI onto the same sharded runner you use locally, with one planner manifest, sliced executors, and a report that fails closed when a slice's artifact never lands.

Aside is the recommended driver, consent asked every single time. When a workflow hits a third-party website moment, registering an API key, creating a vendor account, wiring a webhook, gstack now checks for the Aside AI browser and offers to drive it: your real logged-in sessions, no cookie export, no re-auth. You approve each drive per task, by name and by site. Passwords, payment, CAPTCHAs, and identity stay yours; Apple credential creation is never a drive target in any skill. No Aside installed? On a Mac you get one download pointer (aside.com, macOS 15+), once, and gstack's own visible browser remains the fallback everywhere. gstack never runs an installer for you, and a detected binary is never treated as consent. This release also fixes a real hardening bug: on hosts where the process holds CAP_FOWNER (Docker as root, CI sandboxes), the browse daemon's owner-only chmod could land on /tmp itself when a state file was configured there, locking the whole machine's access(2) checks out for everyone. The permission code now refuses shared, sticky, symlinked, or foreign-owned directories, warns instead of going silent, and pins the check and the chmod to one inode.

Every skill invocation just got half the prompt bill. Same behavior, measured by A/B evals, locked by CI ceilings. Every gstack skill pays a fixed prompt cost before doing any work. This release cuts that cost across all 62 skills and pins the wins so they can't creep back. The shared preamble's bash moved into two runtime scripts (bin/gstack-skill-start, bin/gstack-skill-end) that echo the same STATUS lines the prose always interpreted. One-time onboarding text now appears only when its gate actually fires, emitted as session-bound instruction blocks instead of riding along in every render. Eleven more skills got the section carve and office-hours' existing carve went deeper, taking the carved roster from 9 to 20: heavy reference bodies load on demand at the step that needs them, never before. bin/gstack-skill-start / bin/gstack-skill-end: the preamble and telemetry runtime, replacing ~18KB of inline bash per tier-2+ skill. Emits a SKILL_START_PROTO: 1 handshake, STATUS lines, and gated one-time onboarding as GSTACK_INSTRUCTION blocks bound to a per-run session ID with a random suffix.

The handoff is now pinned by tests that fail loud if it ever goes quiet. /ship has dispatched /document-release as Step 18 since v0.18.2.0, but the v1.54.0.0 carve moved that step into an on-demand section and the always-loaded skeleton stopped saying "document-release" at any decision point (one mention survived, buried in the re-run checklist). The wiring was intact. The visibility was gone, and nothing tested the handoff. This release restores the visibility and locks it in: the section index, the STOP pointer, the Step 17 handoff line, and a new hoisted doc-sync invariant all name "the /document-release subagent" (subagent-framed on purpose, so an agent dispatches the isolated worker instead of running a weaker inline copy). A free tripwire pins the wording, carve-guard anchors pin each touchpoint independently, and a new gate-tier E2E proves a live agent actually fires the dispatch before creating the PR. /ship's Claude-host skeleton names "the /document-release subagent" at all three Step 18 decision points (manifest trigger rendering into the section index and STOP pointer, the Step 17 handoff line, and a hoisted doc-sync invariant beside the PR-title invariant). The invariant states the contract plainly: the dispatch itself is never skipped; only a failed subagent is non-blocking.

Or the wrong thing — now do what they say, or say loudly that they couldn't. Every fix in this wave closes the same failure shape. gstack-evidence — the tool other tools believe — certified runs whose environment differed from CI's, because bun auto-loaded the repo's .env files into every child it spawned. The gbrain wireup's first sync targeted the brain's default source, which could silently repoint a user's primary knowledge source at the gstack worktree while the just-registered source got zero pages — and still print a success line. ./setup --host slate exited 0 having installed nothing. land-and-deploy's merge recovery re-established everything except the --delete-branch half it had promised, and said nothing. A _unattributed → deny ingest policy never applied to exactly the pages it names. Skill-dir cleanup structurally could not find orphans. And a false-green test fixture meant the gbrain missing case could never fail on any machine with a real gbrain installed.

Revoke frees the agent's tabs, and root is a reserved client name. Tightening a paired agent is supposed to be one re-pair away. It wasn't. POST /pair minted a fresh setup key but never touched the agent's live session, so pair-agent --client codex --restrict read against an agent that had already connected (or whose new 5-minute key simply expired unexchanged) left the original full-access session, eval included, alive for up to 24 hours. Revocation also never released tab ownership, so an agent re-paired under the same name inherited the previous one's authenticated tabs. And because root is the sentinel the scope, domain, rate, and tab checks use for the omnipotent caller, --client root minted a scoped token that skipped all of them.

The documented kill switch is real: tunnel revoke deletes, then proves it. Revoking a remote agent was broken twice over. revokeToken deleted only the first token matching the agent's name, and the spent setup key kept for connection retries always sat first in line. So DELETE /token/ returned 200 while the live session kept working, a leftover unspent setup key could mint a brand-new session for a revoked agent (inside the key's 5-minute validity), and a second DELETE returned 200 again. Meanwhile the documented way out, $B tunnel revoke, did not exist: the CLI forwarded it to the daemon as an unknown command. The pairing docs also promised a read+write sandbox three releases after pairing deliberately switched to full page access.

No ephemeral path can ever be baked in again. If you work in Conductor workspaces or git worktrees, you have probably seen it: PostToolUse:AskUserQuestion hook error ... No such file or directory spraying on every question, pointing at a workspace you deleted last week. The cause was a three-part failure. Setup baked the running tree's physical path into your global ~/.claude/settings.json, the Conductor auto-opt-in overrode the exact flag bin/dev-setup passes to prevent that, and the dedupe tag gstack relied on gets stripped by Claude Code itself, so every new workspace appended a fresh dead entry instead of replacing the old one. All three are fixed at the root. Hook registration is now canonical-only: commands point at the stable ~/.claude/skills/gstack install or are not registered at all. Ownership is decided by a fixed identity table in bin/gstack-settings-hook, per hook item, so it survives tag-stripping and can never claim a hook you wrote yourself. And every ./setup run now heals first: gstack-settings-hook prune-stale --repoint removes dead gstack entries, re-points stale ones, restores stripped tags, and collapses duplicates, printing one line only when it changed something.

The next tracker wave: 16 verified fixes in, 90 stale PRs and 21 issues out. Six community contributors credited, one queue race killed for good. This release lands the full next-wave queue: six community PRs ported with authorship intact, ten fixes of our own, and the six adversarial-review residuals the last wave deferred. The headline internals: the brain-sync queue moved to a per-record spool directory, so the enqueue/drain race class is structurally gone, not narrowed. The session-update lock records the process that actually holds it, heartbeats while it works, and expires on a hard TTL, so concurrent updaters can no longer trample a live install. And a live bug caught during this wave's own review, a stray ~/.git directory silently misfiling decisions and learnings into the wrong project store, is fixed with a self-healing cache and a ten-case parity suite.

./setup --host codex reads the top-level model from ${CODEX_HOME:-~/.codex}/config.toml and renders the matching profile. gpt-5.6-sol model profile created with explicit task boundary, report-only adjacent work, bounded investigation, terminate on verified completion. Codex model detection at setup via scripts/resolve-codex-generation-model.ts reads config.toml, validates against model allowlist, treats config values as data, falls back to generic GPT profile with warning. ./setup --host codex --model overrides for that run. Per-host generation defaults: HostConfig.defaultModel validated at generation time. Codex renders the GPT profile when no --model passed; every other host keeps claude. Periodic scope-termination E2E installs the FULL generated investigate skill, plants a one-line bug beside decoy security and migration TODOs, asserts fix lands inside boundary within 30 tool calls, decoys stay byte-identical, regression oracle survives unweakened, nothing gets committed. Sol-specific Completeness Principle and first-run intro copy added. Generated upgrade skills reinstall their own host: ./setup --host codex in Codex renders, --host kiro in Kiro copies. Kiro installs render the claude profile before copying skills, then restore resolved Codex profile. Kiro never ships GPT-family behavioral text and live ~/.codex symlinks stay correct. The Codex skills path honors $CODEX_HOME. Hermetic Codex E2E runner copies auth.json only; operator plugins, MCP servers, rules, skills no longer leak. Per-run model, TOML config overrides, and --ignore-user-config supported. Setup resolves the Codex generation model on every run so any install path preserves a Sol user's rendered profile. Codex install summary prints the active profile and its source. New free-tier coverage for every resolver branch including hostile-config shapes, overlay content pins, explicit --model override through real generation CLI, real-file periodic-tier classification. Static pins in test/setup-codex-model.test.ts hold load-bearing setup properties. Sol E2E snapshots the exact prior .agents render and restores it in beforeAll.

gstack ran an explicit security sweep over all external-contributor code merged since mid-June. No backdoor, no exfiltration path, no live secret leak. Six real findings confirmed and hardened with regression tests. The pre-push secret scanner now catches all-caps database passwords. DSN with an all-caps password at pre-push now blocks at HIGH gate (exit 3). The USER:PASSWORD documentation convention still suppresses, pinned in both directions. Persisted browser sessions stay out of git whether or not repo has a .gitignore. The browse state directory carries a self-contained .gitignore written unconditionally when created. Persisted session-state.json cookies and browse-network.log / browse-audit.jsonl request headers can never be committed. The App Store Connect key is scoped to the one app you are shipping. The exit report tells you it exists and how to revoke it. The App Store Connect upload key minted during Apple release scoped to target app with allAppsVisible:false. The iOS test bridge's Release compile-out is pinned by a free-tier static tripwire. Any regression to a platform-only gate, reordered guard, or dropped define fails CI. The browser server's Node spawn shim regains its exited promise, eager stdout/stderr drain, and 16MB output cap. Correct child-process handling restored on Windows Node fallback. Bearer-token comparison is constant-time. Loopback bearer-token comparison in browse server is constant-time. gstack-egress verify documents that ledger truncation and deletion are out of scope for forensic-observability threat model. New regression guards pin each security property against silent revert. Static tripwire for constant-time validateAuth, table-driven suppression test, unconditional-write test for state-dir ignore, static tripwire for iOS Release compile-out, restored Bun.spawn contract tests.

Reviews and test results used to be prose claims: review is recent meant a commit-count guess that a rebase could crash. Both now carry a working-tree content fingerprint. A review of identical content grades CURRENT through rebases, amends, and squashes. A test run recorded by the new bin/gstack-evidence ledger stays citable at /ship's verification gate only while the content is byte-identical, the command hash matches, and nothing edited the tree mid-run.

Added: bin/gstack-wtree — working-tree content fingerprint. bin/gstack-evidence — verification-evidence ledger: run wraps any command transparently; check grades FRESH/STALE/MISSING per label. lib/tracker-guard.ts + bin/gstack-issue-guard — trust envelope for tracker text. /careful HIGH tier and additive-only project warn patterns. CI wiring scanner failing the suite on raw tracker-text reads outside the guard.

Changed: Review records stamp commit_full/tree/dirty/wtree authoritatively. /ship Step 5 test lanes run wrapped with per-lane labels and per-run logs. /land-and-deploy checks the ledger first and cites fresh evidence. /document-release PR/MR body updates use a two-artifact flow with a banner tripwire.

Fixed: /freeze: five boundary defects — deny JSON silently no-oped on quote/newline paths, internal spaces in the boundary path were stripped, symlink final components weren't resolved, the JSON extractor truncated at escaped quotes and failed open, and a missing helper file passed edits through instead of blocking.

Browse now classifies a macOS XProtect kill at Chromium launch and heals itself. It clears the quarantine flag, reinstalls the pinned browser revision from the right install root, and retries, all bounded and logged. Fresh installs link every runtime asset a skill references so /review and friends work on clean machine the first time. Brain-sync's queue is drained with a classified disposition. Privacy-held records are retained and labeled. A failed push keeps its commit and re-delivers it on the next run. The retry only ever publishes commits it authored itself. Twenty-five community PRs landed with credit. Roughly thirty-five issues close on merge. Browse launch on macOS with XProtect kill now classified and self-healed automatically instead of requiring manual reinstall. Skill runtime assets on fresh install include every referenced asset so /review works day one. Brain-sync queue at push failure retained and re-delivered with no data loss. Detector push with interleaved user commit refused to protect author boundary. Gate evals from 41/43 to 43/43 with both reds root-caused. Free suite runs approximately 7,000 tests, 90-100 seconds, green at HEAD. Brain-sync queue only rewritten by subtracting exact records staged against a live re-read so record enqueued mid-drain survives to next boundary.

bun run test used to take 454 seconds. It now runs as up to six concurrent shard processes and finishes in about 90 to 100 seconds, under a strict output contract.

/autoplan, /codex on macOS, and memory ingest work again. And every consent gate now means what it says. This is the second and final wave of the GStack 2 fork port. Wave one took the audit infrastructure; this wave takes the fixes and the features. Three skills that failed silently on every run now work. /autoplan's task aggregation emits real tasks. /codex creates its temporary workspace under CODEX_HOME instead of silently failing. /memory-ingest's second-pass classifiers run without hanging the agent. Eight missing aliases make skills discoverable without explicit docs. Browser re-pair and session revocation use the standard token API instead of a phantom endpoint. Three new team-share gates (project-first security in 50 glyphs) let an admin turn the share on and off. Terminal agent refactored to match the daemon's quality bar: errors are propagated and named, not silently swallowed; memory use is bounded; and the architecture can be tested without running Playwright.

Enforcement guards /freeze, /careful, and team-init required mode now actually block. /careful parses tool payload with real JSON parser, handles quoted arguments, asks on IFS/base64 obfuscation, fails closed on unreadable input. Investigate scope lock resolves check-freeze via $HOME. Specialist review agents run with run_in_background: false. Pre-push scanning improved with line-aligned chunked scans, real push-base resolution, byte-exact stdin for chained hooks, --no-ext-diff/--no-textconv, hunk-aware header parsing, fail-closed ref parsing. pair-agent walks through ngrok auth in user terminal. Extension denies token/port reads to content scripts and foreign extensions. diff upgraded to 9.0.0. OpenAI key file written 0600-at-create. Injection-denylist and phone-pattern false positives calibrated. All delayed process.exit teardown bombs removed with static no-suicide tripwire. design/test/ joins free suite and sharded runner. Orphaned sidebar chat-queue suites removed. Fork PRs skip eval jobs deterministically. memory-ingest imports gitignored staging and reconciles counts. lib/ ships beside bin/ on every host install. Native AskUserQuestion answers parse correctly with (Recommended) suffix support. Autoplan task aggregator returns real tasks. Auto-upgrade pulls with --autostash over locally-patched installs. gstack-slug resolves project root by marker walk-up and canonicalizes slash branches. Design image generation fixed with honest timeout reporting. Windows icacls grants by SID. windowsHide forwarded through every spawn shim. All plan-tune hooks spawn bins through shared Windows-aware helper. mktemp templates keep X-run trailing for /codex on macOS. codex review receives explicit diff args with timeouts. Review mode runs sandboxed read-only. Artifacts Sync and telemetry-finalize un-deadened in 49 skills. update_check:false silences preamble prose. Codex hosts read AGENTS.md. setup --help prints help. Model overlays for current Claude generation. Plus ~20 more small fixes for deploy-config, artifacts-init, keychain auth, catalog description, tracked-file tests, update-check, Ubuntu detection, CRLF generation, telemetry errors, server-lock diagnostics, shell-quoted paths, benchmark validation.

Hash-chained egress receipts for every off-machine send with gstack-egress list/verify/grants commands. gstack-context-bill for offline token bill-of-materials for skills trees. Sharded paid-gate runner with one process per test file and wall-clock timeout with group-SIGKILL. Browser /health endpoint no longer carries root auth token. Token bootstrap moved to pinned-origin POST /extension-token. Hermetic PTY test children can register shipped skills. Discovery-surface cost gated with ratchet protocol. Eval harness auto-comparison fixed to compare against latest completed same-tier run instead of in-progress accumulator. Shared modules replace duplicated logic across skill-census helpers. External-service E2E tests declared periodic-tier. PTY test runner parses reflowed AskUserQuestion prompts and strips DEC cursor-visibility residue. New follow-ups filed for egress ledger rotation and launch-nonce token bootstrap.

Plan-mode auto-select in scope gate for plan-eng-review and plan-design-review with one-line announcement. Render-shape PTY detectors for scope gate question and auto-select announcement. Tier-alignment invariant test ensures self-gated paid test files match declared tier. Exceptions drift-guard for identical gate templates. /autoplan section skip list includes scope gate. Plan-mode preamble wording clarified. Finding-floor harness no longer counts scope-gate render toward question floor. Four stochastic plan-mode/finding-floor smokes now run via periodic tier. CI eval containers register plan-eng-review and plan-design-review as discoverable skills. /ship credential pre-push guard installs correctly from git worktrees. PlanSkillObservation.outcome includes wrote_findings_before_asking. Skeleton/ratio ceilings ratcheted with attribution comments.

eval-list-cli test now spawns from neutral directory so slug detection cannot route reads away from fixture store. benchmark-cli remediation-hint check made case-insensitive. session-runner observability floor adjusted to expect 5 wrapped I/O sites. P1 filed for browse test files force-exiting shared bun process masking failures.

/autoplan dual-voice eval now registers skills at project level matching real slash-command resolution on Claude Code 2.x. Transcript filter reads raw stream-json shapes for tool_use detection. Hang protection accepts Phase 1 review dispatch as progress evidence. Budget raised to 10 min / 40 turns. Session-runner cancels stdout reader on spawn timeout and races stderr drain against child exit plus 5s grace window. Regression-locked by session-runner-timeout test.

AskUserQuestion fixed for Claude Code 2.1.89+ with pass-through exit 0 and empty stdout or additionalContext-only output. /careful chained-rm bypass fixed with safe-exception shortlist improvements. /context-restore loading sibling worktree checkpoint improved. /sync-gbrain drift re-register on gbrain 0.42+ with --confirm-destructive. Developer-profile double counting fixed. Credential net plurals and runtime wiring for one-way-door detection. design CLI silent NaN flags fixed with loud contract. Thin-client brains misclassified as broken now have new thin-client engine state. Closed issues #1965, #1950, #1964 already fixed with receipts. 72 new test cases across 9 files verified failing before fix and passing after. Four community PRs absorbed with authorship preserved.

First-run project scaffold classifies repo into buckets using local git and file markers. Returning-session loop tip nudges plan→review→ship once. Setup first-move nudge prints intent-routed starting point. office-hours handoff offers to launch next review via Skill tool. Top-level gstack skill is now pure router sending browse/QA work to /browse. Activation telemetry event types onboarding, first_task_scaffold_shown, handoff, route accepted by ingest. New unit coverage for detection buckets and eval-safe enum contract. Browse-content test assertions repointed to browse/SKILL.md. Parity/carve-guard size caps bumped 1-2KB per skill.

gbrain no longer force-enables GBRAIN_PREPARE on transaction-mode poolers. Slow-but-healthy probe now classifies as timeout and lets sync proceed. Redaction engine gained six credential patterns for GitLab, HuggingFace, npm, DigitalOcean, Bearer, and GCP service accounts. Telemetry error_message passes through redaction engine. Security and community dashboards stop reporting fake zero on backend error. Windows git-bash bins resolve imports correctly. Plan-mode test gate detects rendered AskUserQuestion in collapsed form. Haiku state-judge stops coin-flipping on leftover spinner. /plan-eng-review and /plan-design-review confirm what to review before grinding full audit. Pre-push guard fails closed on git error and catches six more credential types. PTY plan-mode smokes timeout on questions fixed. ios-qa E2E isolated under concurrent testing. Collapsed-form prose-AUQ detector with 95 unit tests. PTY model pinned to EVALS_MODEL or claude-sonnet-4-6. Stochastic ask-first smokes reclassified periodic.

Always-on Layer C stealth masks webdriver, window.chrome.* shape, Notification.permission, per-install hardwareConcurrency/deviceMemory, Function.prototype.toString proxy surviving depth-3 check. Selenium/Phantom/Nightmare/Playwright globals swept. GSTACK_STEALTH=extended layers on top of Layer C. Stealth applies on every context-creation path launch, launchHeaded, handoff, recreateContext. buildGStackLaunchArgs emits per-install cmdline switches for gbrowser Pack 1 C++ patches. Real-Chromium runtime coverage for webdriver, chrome.* shape, Notification/Permissions, toString depth-3, per-install hardware, extended-mode blend with 80 stealth tests. cdc_/__webdriver cleanup and Permissions notifications shim in applyStealth. --gstack-suppress-prepare-stack-trace opt-in via GSTACK_CDP_STEALTH=on. --disable-blink-features=AutomationControlled from shared STEALTH_LAUNCH_ARGS constant.

Spawned agent runners get allowlist-scrubbed environment, fresh seeded CLAUDE_CONFIG_DIR, temp GSTACK_HOME, and --strict-mcp-config. Hermetic-env.ts allowlist builder with pure promotedEnv() shared with lib/conductor-env-shim.ts. Sync-memoized singleton temp dir and seeded .claude.json for non-interactive first run. Pid-aware GC of crashed runs. Hermetic-canary and hermetic-sentinel gate-tier isolation canaries. Static wiring tripwire for all five runners. gstack-detach with SIGTERM-proof, caffeinate-wrapped eval runs with machine-wide lock and per-run logs. Conductor prose AskUserQuestion renders as prose brief with reply-with-a-letter enforcement. All five E2E runners spawn children through hermeticChildEnv(). EVALS_HERMETIC=0 restores legacy env. LLM-judge re-appends body-carved sections/*.md after marker slice. ios-qa daemon uses unique pidfiles fixing already_running collisions. CLAUDE.md documents hermetic-by-default local evals.

Mermaid and excalidraw fences render as vector diagrams in PDF and HTML output. Broken fence prints diagnostic block with parse error. /diagram skill generates mermaid source, editable .excalidraw file, and SVG+PNG from English description. Local image paths inline automatically and never truncate. Phone photos downscale to print resolution. Wide small-text diagrams get own vertically centered landscape page. Three output formats from one markdown: --to pdf|html|docx. HTML is self-contained with zero network references. Type is bigger with 12pt body, 56pt cover titles. TOC links jump correctly. --strict makes missing, remote, out-of-tree, or oversized images fail CI. Vendored offline bundle with mermaid 11.12.2 and excalidraw 0.18.0. Per-image directives for width and page orientation. Conservative auto-landscape for wide and diagram-like images. docs/howto-diagrams-and-formats.md walkthrough. Relative image paths render correctly in PDFs.

codex_reviews master switch across /review, /ship, /document-release, all plan reviews, /autoplan Default enabled Invalid values on set rejected Existing value preserved on typo Typo cannot flip paid Codex calls Document-release Codex doc audit new Doc audit reviews touched docs against release diff Checks for stale claims Checks for undocumented new surface Checks for over/under-sold CHANGELOG entries Informational with explicit apply-fixes decision Never auto-edits docs codexPreflight shared helper One self-contained bash block Reads switch and sources probe Checks install and auth separately Emits canonical mode: ready, not_installed, not_authed, or disabled Plan-review outside voice default-on Want an outside voice question removed Automatic run with Claude subagent fallback Cross-model tension presented never auto-applied Adversarial review detects auth not just install Distinct guidance for not installed vs not authenticated 200-line threshold unchanged /autoplan honors codex_reviews=disabled Switch truly global 3 gstack-config test fixes get and list print documented defaults Size-budget guards widened Each with rationale comment Static guards added Plan reviews must not carry opt-in question Plan reviews must render default-on voice /document-release must carry doc review Codex host strips all of it

Brain-aware skill blocks render to an untracked spot, never into tracked source. Before this, finishing a Conductor or dev-workspace setup with gbrain installed rewrote 16 planning and review SKILL.md files in place, adding 326 lines of brain-aware blocks straight into tracked source. Your working tree came back dirty, one stray git add away from committing a token regression for everyone who does not run gbrain. Now gen-skill-docs --out-dir renders the brain-aware variant into an untracked per-workspace directory, and bin/dev-setup repoints the workspace's skill symlinks at it. Added: gen-skill-docs --out-dir. gstack-gbrain-detect --is-ok. gstack-config gbrain-refresh. Changed: bin/dev-setup renders the brain-aware variant into .claude/gstack-rendered.

js/eval --out writes a render straight to disk, so skills stop bundling their own puppeteer. You can now turn your own local HTML or JSON into a PNG (or any bytes) on disk through the same headless browse Chromium you already run, with no second browser install. js " " --out out.png and eval script.js --out out.png write the evaluate result to a file instead of returning it. When the result is a base64 data URL (the shape Excalidraw exports, og-image generators, and card renderers hand back), --out decodes it to raw bytes for you; pass --raw to write the literal string. Added: js / eval --out render-to-file. --raw flag. Offline render mode docs. Changed: --out is a per-invocation WRITE capability.

One name across the ETHOS file, every skill, and the developer-profile dial. The principle that tells gstack to do the complete thing was called "Boil the Lake" in ETHOS.md and in every generated skill, with the ocean cast as the anti-pattern. The developer-profile system and the completeness intro link already used "boil the ocean" as the good, ship-the-whole-thing pole. This renames the principle to Boil the Ocean everywhere and reframes the metaphor: the ocean is the complete destination, and lakes are the boilable units you ship on the way there.

The GSTACK REVIEW REPORT closes with the open decisions, or "NO UNRESOLVED DECISIONS" in plain sight, before you approve. When a plan-review skill (/plan-ceo-review, /plan-eng-review, /plan-design-review, /plan-devex-review, and /codex) finishes and hands you the plan to approve, its report now ends with a mandatory unresolved-decisions verdict. If decisions are still open, it lists each one and what breaks if you ship it deferred. If nothing is open, it prints the exact line NO UNRESOLVED DECISIONS. Added: Mandatory unresolved-decisions status in the GSTACK REVIEW REPORT. Blocking approval gate.

Your redaction gate now catches modern OpenAI keys, and /ship's adversarial review stops choking on your own security tests. This is a fix wave. The throughline: guards that reported success while doing nothing. The secret-redaction gate that every /spec, /ship, /cso, and /document-* run passes through was blind to modern sk-proj-/sk-svcacct-/sk-admin- OpenAI keys and silently dropped its size cap on a bad flag. The cross-project learnings trust gate was an allowlist on paper and a denylist in code, so untrusted rows leaked between projects. The destructive-action classifier waved through "rotate the database password." Each one looked like it was protecting you. None of them were. All four now fail closed, with tests that pin the exact case that used to slip by. Fixed: Redaction misses modern OpenAI keys. Redaction size cap fails open on a bad flag. Cross-project learnings trust gate leaked. Destructive-action classifier missed rotate password pattern.

The rule rides in the always-loaded part of the skill now, and a guard keeps it there. /ship stamps vX.Y.Z.W onto the title of every PR or MR it creates or updates, so the version is the first thing you read in the PR list. That rule now lives in the always-loaded core of the ship skill instead of an on-demand section, so the agent applies it whether or not it opened the section that spells out the full procedure. A CI workflow backs this up: it rewrites a title to match VERSION on every PR that bumps the version, and it now reaches fork and agent PRs too.

The durable calls you make, and the "why" behind them, are captured, curated, and resurfaced across sessions, with no daemon to run. Added: Cross-session decision memory. An event-sourced (decide/supersede/redact) store at ~/.gstack/projects/ /decisions.jsonl. gstack-decision-log — capture a durable decision, reverse one (--supersede ), expunge an accidental secret (--redact ), or rewrite the log to its active set (--compact). gstack-decision-search — read active decisions, scope-filtered to the current branch/issue, with --recent N, --scope, --query, --all, --json. Session-start resurfacing. Context Recovery shows the scope-relevant active decisions at the top of a session. Skill capture. /plan-ceo-review, /plan-eng-review, /spec, and /ship record their structured decisions automatically. A ## Cross-session decision memory section in CLAUDE.md. /sync-gbrain call-graph build (--dream). Changed: Decision text that resurfaces into agent context is datamarked so stored text can never masquerade as instructions. /sync-gbrain pin guidance is accurate for current gbrain. Fixed: /sync-gbrain no longer wedges forever on a crashed autopilot daemon's stale lock.