- bin/gstack-wtree provides working-tree content fingerprinting with temp-index and stat-cache-seeded optimization (~40x faster than naive hashing)
- bin/gstack-evidence ledger wraps commands transparently to record verification evidence with exit code passthrough, per-run logs capped at 2MB with 30-day pruning, and redaction of HIGH credentials
- bin/gstack-issue-guard implements trust envelope for tracker text with NFKC normalization, Unicode format-character detection, banner-forgery defusal, and numeric argv validation
- /careful gains HIGH tier with hard deny for recursive deletes of root/home and force-pushes to default branch including plus-refspec forms
- Review claims now bind to working-tree content fingerprint, grading CURRENT through rebases, amends, and squashes of identical content
- Test results now carry working-tree content fingerprint, command hash, and max-age instead of prose claims, staying citable only while content is byte-identical
- /ship and /land-and-deploy cite fresh evidence instead of re-running, and re-run live when anything moved
- PR bodies, PR comments, and model-judged issue titles enter agent context only through trust envelope at 8 ingress points with CI-scanner enforcement
- /freeze now fails closed on unparseable payloads, quote or newline paths, boundaries with spaces, symlinks pointing outside boundary, and broken install instead of silently no-oping
- Tracker-text ingress points increased from 0 to 8 with CI-scanner enforced envelope protection
Every claim gstack makes now binds to the content it was made on.
Tracker text is data. Guard hooks actually guard.
Reviews and test results used to be prose claims: "review is recent" meant a commit-count guess that a rebase could crash, and "tests passed" meant trusting output from a tree that may have changed since. Both now carry a working-tree content fingerprint (bin/gstack-wtree, ~0.2s). A review of identical content grades CURRENT through rebases, amends, and squashes. A test run recorded by the new bin/gstack-evidence ledger stays citable at /ship's verification gate only while the content is byte-identical (release files carve out), the command hash matches, and nothing edited the tree mid-run. /ship and /land-and-deploy cite fresh evidence instead of re-running, and re-run live when anything moved. PR bodies, PR comments, and model-judged issue titles now enter agent context only through a trust envelope (bin/gstack-issue-guard): content is data even when clean, injection-shaped lines get labeled through fullwidth and invisible-character evasion, forged envelope banners are defused, and a CI scanner fails the suite on any raw tracker-text read at all 8 ingress points. Write-backs keep a raw artifact so envelope markup can never reach a live PR. /freeze now fails closed: unparseable payloads, quote or newline paths (the deny used to silently no-op on them), boundaries with spaces, symlinks pointing outside the boundary, and a broken install all block instead of passing. /careful gains a hard-deny tier for rm -rf /-class deletes and force-pushes to the default branch — including the flag-less git push origin +main form and quoted or refspec targets — plus additive-only custom warn patterns that can never weaken the built-ins.
The numbers that matter
Measured on this branch; re-run with bun test, time bin/gstack-wtree, and the commands in each bin's header.
Review staleness on rebased/amended identical content: crash or STALE → CURRENT (correct)
"Tests passed" binding: none (prose) → content fingerprint + command hash + max-age (new)
Tracker-text ingress points enveloped: 0 → 8, CI-scanner enforced (new)
/freeze deny on hostile/edge paths: silent no-op → blocks, fail-closed (fixed)
Working-tree fingerprint cost: — → ~0.09s warm (stat-cache seeded, 40x vs naive) (new)
Adversarial findings fixed pre-merge: — → 50 (4 specialists + red team + fresh-context pass), 6 critical
The fingerprint survives commits of identical content, so the common flow — test on a dirty tree, commit, ship — keeps its evidence valid, while one untracked new source file invalidates it.
What this means for you
/ship stops re-running suites the content already proved green and stops trusting suites the content has outgrown — the IRON LAW is now a mechanical check, not an honor system. A hostile PR comment can no longer speak to your agent with authority, and /guard's boundary actually holds on the paths where it used to silently fail. Nothing to configure: the bins ship wired into /ship, /land-and-deploy, /review, /spec, and /document-release.
Added
bin/gstack-wtree — working-tree content fingerprint (temp-index, stat-cache-seeded; identical hash to a full re-hash at ~40x less cost).
bin/gstack-evidence — verification-evidence ledger: run wraps any command transparently (exit code always passes through; 0600 per-run logs with 2MB cap and 30-day prune; HIGH credentials in commands stored redacted; mid-run tree edits void the fingerprint) and check grades FRESH/STALE/MISSING per label with --expect-cmd, --max-age, and --allow-paths binding.
lib/tracker-guard.ts + bin/gstack-issue-guard — trust envelope for tracker text: envelope-always, detection-only NFKC + full Unicode format-character sweep, banner-forgery defusal, no-envelope-on-fetch-failure, numeric argv validation.
/careful HIGH tier (hard deny: root/home recursive deletes incl. --no-preserve-root and /* forms; default-branch force-pushes incl. plus-refspec