Upstream: gstack updated (7fbf68b)

[github-actions]

gstack has new commits since last sync.

Latest: 7fbf68b feat: cross-model outside voice in plan reviews (v0.9.9.1) (#326)
Compare: garrytan/gstack@3e3843c...7fbf68b

New commits

• 5467711 Fix build script failure on Windows
• 1e06b6a fix: dynamic base branch detection across all SKILL templates (v0.3.10) (#81)
• 78e519e feat: await support in browse js/eval + contributor mode v2 (#104)
• 276d0cc feat: always-on ELI16 + branch detection (v0.4.3) (#108)
• a68244a feat: /document-release skill — post-ship doc updates (v0.4.3) (#109)
• c86faa7 fix: update check cache — 60min UP_TO_DATE TTL + --force flag (v0.4.4) (#110)
• 318ffdb fix: js statement wrapping + click auto-routes option to selectOption (v0.4.5) (#117)
• a30f707 feat: Fix-First Review — auto-fix obvious issues, ask about hard ones (v0.4.5) (#116)
• 4a77cc2 feat: /plan-design-review + /qa-design-review skills (v0.5.0) (#102)
• c8c2cbb docs: add /design-consultation skill to README (#127)
• 1a100a2 fix: eliminate duplicate command sets in chain, improve flush perf and type safety
• 5f41cd9 feat: show screenshots to user during QA and browse sessions (v0.5.0.1) (#129)
• 73b00b4 feat: Review Readiness Dashboard + gstack-slug helper (v0.5.1) (#130)
• c99757b feat: /design-consultation — risk-taking, visual research, ambitious preview (v0.5.2) (#131)
• 5e9f0e7 feat: SELECTIVE EXPANSION + smarter ship gates (v0.5.3) (#134)
• b65a464 feat: always-full eng review + ship review gate persistence (v0.5.4) (#135)
• a2d756f feat: Test Bootstrap + Regression Tests + Coverage Audit (v0.6.0) (#136)
• 1f3b691 feat: /gstack-upgrade detects and syncs stale vendored copies (v0.5.4.1) (#137)
• 9d47619 feat: Completeness Principle — Boil the Lake (v0.6.1) (#140)
• 17c1c06 feat: diff-based test selection for E2E and LLM-judge evals (v0.6.1.0) (#139)
• d8894b7 feat: cognitive patterns for plan-review skills (v0.6.2) (#141)
• 28becb3 feat: design review lite in /review and /ship + gstack-diff-scope (v0.6.3) (#142)
• f91222f docs: restructure README for faster conversion (#146)
• 78c207e feat: interactive /plan-design-review + CEO invokes designer + 100% coverage (v0.6.4) (#149)
• 3ce810f Merge pull request #93 from lucasbraud/fix/windows-build-glob
• 716e4c9 Merge pull request #128 from xr843/fix/chain-duplication-and-flush-perf
• bc86a66 feat: add trigger phrases to skill descriptions for better model matching (v0.6.4.1) (#169)
• 6000af4 feat: founder discovery engine + /debug skill — v0.7.0 (#185)
• 50a7cf8 docs: frame skills as sprint process, rewrite /office-hours examples (#188)
• 4fe0ce9 feat: natural language skill routing + proactive suggestions (v0.7.1) (#195)
• 2a20692 fix: /retro midnight-aligned dates + local timezone (v0.7.2) (#199)
• c4f679d feat: safety hook skills + skill usage telemetry (v0.7.1) (#189)
• 823772f feat: use AskUserQuestion for dirty working tree (v0.7.4) (#200)
• d852330 feat: /codex skill — multi-AI second opinion + proactive suggestions (#197)
• d961188 fix: /qa never refuses browser testing on backend-only changes (#202)
• 2d97ab9 feat: browse handoff — headless-to-headed browser switching (v0.7.4) (#201)
• 00cefca feat: review chaining + commit hash staleness tracking (v0.8.3) (#206)
• 3a315b3 docs: rewrite README + skills docs, auto-invoke /document-release (v0.8.4) (#207)
• c0f3c3a fix: security hardening + issue triage (v0.8.3) (#205)
• cb20377 fix: atomic review log helpers + platform-agnostic templates (v0.8.5) (#209)
• bd834ae fix: /retro bare dates use wall-clock time, not midnight (v0.8.5) (#211)
• 3b22fc3 feat: opt-in usage telemetry + community intelligence platform (v0.8.6) (#210)
• 8ddfab2 feat: multi-agent support — gstack works on Codex, Gemini CLI, and Cursor (v0.9.0) (#226)
• 91bea06 fix: plan mode exception for review log + telemetry writes (v0.9.0.1) (#234)
• ae2d841 feat: adversarial spec review loop + skill chaining (v0.9.1.0) (#249)
• 6a6b2b0 feat: Gemini CLI E2E tests (v0.9.2.0) (#252)
• d7c732b fix: Windows support — Node.js server fallback for Playwright (#255)
• 9811ed3 feat: default codex reviews in /ship and /review (v0.9.4.0) (#256)
• 1f4b6fd fix: remove PR size nagging from /retro (v0.9.4.1) (#264)
• 709bed9 feat: CEO review handoff context for /office-hours chaining (v0.9.5.0) (#288)
• f075cb7 feat: Search Before Building — builder ethos + skill integrations (v0.9.5.0) (#298)
• 6c69feb feat: auto-scaled adversarial review (v0.9.5.0) (#297)
• 8321115 feat: plan file review report + enriched JSONL logging (v0.9.7.0) (#303)
• 00bc482 feat: /land-and-deploy, /canary, /benchmark + perf review (v0.7.0) (#183)
• 2c0d4b3 docs: v0.9.8.0 — deploy pipeline docs + pre-merge readiness gate (#306)
• dbd98af feat: harden /office-hours diagnostic rigor (v0.9.9.0) (#307)
• 407b156 feat: /autoplan — auto-review pipeline (v0.10.0.0) (#327)
• 7ff0f84 feat: test coverage catalog — shared audit across plan/ship/review (v0.10.1.0) (#259)
• d0300d4 fix: /autoplan — prevent analysis compression (v0.10.2.0) (#329)
• cf3582c fix: community security + stability fixes (wave 1) (#325)
• cc9e6f8 feat: /retro global — cross-project AI coding retrospective (v0.10.2.0) (#316)
• 264c1ca feat: plan files always show review status (v0.11.1.1) (#345)
• b7a3bf1 fix: Codex compatibility — 1024-char cap, duplicate skills, repo-local installs, kiro support (v0.11.2.0) (#346)
• 4cd4d11 feat: design outside voices — cross-model design critique (v0.11.3.0) (#347)
• 5aee6db feat: Codex second opinion in /office-hours (v0.11.4.0) (#353)
• fdd4518 fix: gstack-slug bash compatibility — source to eval (#354)
• 9eb74de feat: inline /office-hours — no more "another window" (v0.11.3.1) (#352)
• 7fbf68b feat: cross-model outside voice in plan reviews (v0.9.9.1) (#326)

Affected skill files

qa/SKILL.md
qa/SKILL.md.tmpl
qa/templates/qa-report-template.md
retro/SKILL.md
retro/SKILL.md.tmpl
review/SKILL.md
review/SKILL.md.tmpl
review/checklist.md
review/design-checklist.md
ship/SKILL.md
ship/SKILL.md.tmpl

Change analysis

Prompt/logic changes (likely need porting):
None detected

Format-only changes (likely safe to skip):
qa/SKILL.md
qa/SKILL.md.tmpl
qa/templates/qa-report-template.md
retro/SKILL.md
retro/SKILL.md.tmpl
review/SKILL.md
review/SKILL.md.tmpl
review/checklist.md
review/design-checklist.md
ship/SKILL.md
ship/SKILL.md.tmpl

Mapping

gstack	kstack	Action needed?
plan-ceo-review	plan-product	Check diff
plan-eng-review	plan-eng	Check diff
review	code-review	Check diff
ship	ship	Check diff
qa / qa-only	qa	Check diff
retro	retro	Check diff
browse	N/A	Skip
setup-browser-cookies	N/A	Skip

Checklist

• Read the gstack diff
• Review prompt/logic changes above
• Adapt to Kiro CLI SKILL.md format (remove Go templates, Playwright, Greptile, slash commands)
• Update affected skills
• Run evals on changed skills
• Close this issue

[github-actions]

gstack has new commits since last sync.

Latest: 7911b7b fix: force comparison board as default variant chooser (v0.14.1.0) (#658)
Compare: garrytan/gstack@7fbf68b...7911b7b

New commits

• 3d1e8e0 feat: /cso v2 — infrastructure-first security audit (v0.11.6.0) (#384)
• faff8a2 fix: let /review satisfy ship readiness gate (#387)
• 0bff8d6 fix: add codex skill metadata for gstack skills (#339)
• 8a4afd8 fix: zsh glob compatibility in skill preamble (v0.11.7.0) (#386)
• ffd9ab2 fix: enforce Codex 1024-char description limit + auto-heal stale installs (v0.11.9.0) (#391)
• f4bbfaa feat: CI evals on Ubicloud — 12 parallel runners + Docker image (v0.11.10.0) (#360)
• 6f1bdb6 feat: Wave 3 — community bug fixes & platform support (v0.11.6.0) (#359)
• 2c5ae38 feat: triple-voice multi-model review in /autoplan (v0.11.12.0) (#424)
• dc5e053 feat: worktree isolation for E2E tests + infrastructure elegance (v0.11.12.0) (#425)
• 3501f5d fix: Windows browse — health-check-first ensureServer, detached startServer, Windows process mgmt (v0.11.11.0) (#431)
• 6156122 test: E2E tests for plan review report and Codex offering (v0.11.15.0) (#449)
• 64d5a3e fix: Supabase telemetry security lockdown (v0.11.16.0) (#460)
• 3703320 fix: verify-rls.sh matches deployed policy (inserts allowed, HTTP parsing) (#461)
• 2b85b1d fix: random UUID installation_id + verify-rls.sh edge cases (v0.11.16.1) (#462)
• 315c172 feat: 2-tier E2E test system — granular touchfiles + gate/periodic split (v0.11.16.0) (#450)
• 8500136 feat: remove trigger guard + proactive opt-out prompt (#457)
• 7e0b879 feat: test coverage gate + plan completion audit + auto-verification (v0.11.13.0) (#428)
• 70c51d5 feat: universal 'one decision per question' AskUserQuestion rule (v0.11.12.1) (#427)
• 9870a4e fix: Windows browse — stdio array format for Bun compatibility (v0.11.18.2) (#468)
• aa7daf0 fix: Codex description limit + wrong-repo bug (v0.11.19.0) (#471)
• 1bf888d feat: GitLab support for /retro, /ship, and /document-release (v0.11.20.0) (#508)
• 997f7b1 fix: review log architecture — close gaps, add attribution (v0.11.21.0) (#512)
• 7665adf feat: headed mode + sidebar agent + Chrome extension (v0.12.0) (#517)
• 4f435e4 feat: /land-and-deploy first-run dry run + staging-first + trust ladder (v0.12.2.0) (#518)
• 25e971b feat: voice directive for all skills (v0.12.3.0) (#520)
• de20228 fix: /ship CHANGELOG and PR body now cover all branch commits (v0.12.4.0) (#535)
• 1b60acd fix: Codex hang fixes — plan visibility, stdout buffering, reasoning effort (v0.12.4.0) (#536)
• 3d52382 feat: worktree parallelization strategy in /plan-eng-review (v0.12.5.1) (#547)
• dc0bae8 fix: sidebar agent uses real tab URL instead of stale Playwright URL (v0.12.6.0) (#544)
• b343ba2 fix: community PRs + security hardening + E2E stability (v0.12.7.0) (#552)
• 18bf424 fix: resolve codex exec -C repo root eagerly to prevent wrong-project reviews (v0.12.6.0) (#549)
• 60061d0 fix: zsh glob compatibility across all skill templates (v0.12.8.1) (#559)
• 5319b8a feat: community PRs — faster install, skill namespacing, uninstall, Codex fallback, Windows fix, Python patterns (v0.12.9.0) (#561)
• 22ad3e5 fix: Codex filesystem boundary — prevent skill-file prompt injection (v0.12.10.0) (#570)
• 43c078f feat: skill prefix is now a persistent user choice (v0.12.11.0) (#571)
• 11695e3 fix: security audit compliance — credentials, telemetry, bun pin, untrusted warning (v0.12.12.0) (#574)
• 78bc1d1 feat: design binary — real UI mockup generation for gstack skills (v0.13.0.0) (#551)
• 7450b51 fix: security audit remediation — 12 fixes, 20 tests (v0.13.1.0) (#595)
• 247fc3b feat: user sovereignty — AI models recommend, users decide (v0.13.2.0) (#603)
• cd66fc2 fix: 6 critical fixes + community PR guardrails (v0.13.2.0) (#602)
• ea7dbc9 fix: sidebar prompt injection defense (v0.13.4.0) (#611)
• 484cf1f feat: Factory Droid compatibility — works across Claude Code, Codex, and Factory (v0.13.5.0) (#621)
• 6689460 chore: gitignore .factory and remove tracked files (v0.13.5.1) (#642)
• ae0a9ad feat: GStack Learns — per-project self-learning infrastructure (v0.13.4.0) (#622)
• cdd6f78 feat: community wave — 7 fixes, relink, sidebar Write, discoverability (v0.13.5.0) (#641)
• 3cda8de fix: security audit round 2 (v0.13.4.0) (#640)
• 66c0964 feat: composable skills — INVOKE_SKILL resolver + factoring infrastructure (v0.13.7.0) (#644)
• 403637f feat: rotating founder resources in /office-hours closing (v0.13.10.0) (#652)
• 8151fcd feat: /design-html skill — Pretext-native HTML from approved mockups (v0.14.0.0) (#653)
• b2b380b docs: update README and skill deep dives for all 31 skills (#656)
• 7911b7b fix: force comparison board as default variant chooser (v0.14.1.0) (#658)

Affected skill files

qa/SKILL.md
qa/SKILL.md.tmpl
retro/SKILL.md
retro/SKILL.md.tmpl
review/SKILL.md
review/SKILL.md.tmpl
review/checklist.md
ship/SKILL.md
ship/SKILL.md.tmpl

Change analysis

Prompt/logic changes (likely need porting):
None detected

Format-only changes (likely safe to skip):
qa/SKILL.md
qa/SKILL.md.tmpl
retro/SKILL.md
retro/SKILL.md.tmpl
review/SKILL.md
review/SKILL.md.tmpl
review/checklist.md
ship/SKILL.md
ship/SKILL.md.tmpl

Mapping

gstack	kstack	Action needed?
plan-ceo-review	plan-product	Check diff
plan-eng-review	plan-eng	Check diff
review	code-review	Check diff
ship	ship	Check diff
qa / qa-only	qa	Check diff
retro	retro	Check diff
browse	N/A	Skip
setup-browser-cookies	N/A	Skip

Checklist

• Read the gstack diff
• Review prompt/logic changes above
• Adapt to Kiro CLI SKILL.md format (remove Go templates, Playwright, Greptile, slash commands)
• Update affected skills
• Run evals on changed skills
• Close this issue

[github-actions]

gstack has new commits since last sync.

Latest: 03973c2 fix: community security wave — 8 PRs, 4 contributors (v0.15.13.0) (#847)
Compare: garrytan/gstack@7911b7b...03973c2

New commits

• a1a9336 feat: sidebar CSS inspector + per-tab agents (v0.13.9.0) (#650)
• a0328be feat: always-on adversarial review + scope drift + plan mode design tools (v0.14.3.0) (#694)
• a4a181c feat: Review Army — parallel specialist reviewers for /review (v0.14.3.0) (#692)
• 7ea6ead fix: ship idempotency + skill prefix name patching (v0.14.3.0) (#693)
• db35b8e feat: session intelligence roadmap + design doc (#727)
• 8115951 feat: recursive self-improvement — operational learning + full skill wiring (v0.13.8.0) (#647)
• 562a675 feat: Session Intelligence Layer — /checkpoint + /health + context recovery (v0.15.0.0) (#733)
• 6169273 feat: /design-html works from any starting point (v0.15.1.0) (#734)
• 4fc64f7 fix: top-level skill dirs so Claude discovers unprefixed names (#761)
• 846269e feat: voice-friendly skill triggers for AquaVoice (v0.14.6.0) (#732)
• c620de3 fix: setup runs pending migrations so git pull + ./setup works (#774)
• 103a1b3 docs: Slate agent integration research + design doc (#782)
• be96ff5 feat: /plan-devex-review + /devex-review — DX review skills (v0.15.3.0) (#784)
• cf73db5 feat: autoplan DX integration + README docs (v0.15.4.0) (#791)
• 3f080de feat: GStack Browser — double-click AI browser with anti-bot stealth (#695)
• 4478514 feat: interactive /plan-devex-review + plan mode skill fix (v0.15.5.0) (#796)
• 04b709d feat: declarative multi-host platform + OpenCode, Slate, Cursor, OpenClaw (v0.15.5.0) (#793)
• 8038cad fix: self-healing skill prefix consistency in setup (#805)
• 31943b2 feat: anti-skip rule for all review skills (v0.15.6.1) (#804)
• 115d81d fix: security wave 1 — 14 fixes for audit #783 (v0.15.7.0) (#810)
• 9ca8f1d feat: adaptive gating + cross-review dedup for review army (v0.15.2.0) (#760)
• f91ad61 fix: user-friendly error when OpenAI org is not verified (#776)
• 1652f22 fix(discover): parse Codex sessions with large session_meta (>4KB) (#798)
• 2b08cfe fix: close redundant PRs + friendly error on all design commands (v0.15.8.1) (#817)
• e2d005c feat: OpenClaw integration v2 — prompt is the bridge (v0.15.9.0) (#816)
• bd8d44d docs: rewrite README OpenClaw install — one paste, real instructions (#818)
• b3cd3fd feat: native OpenClaw skills + ClaHub publishing (v0.15.10.0) (#832)
• 422f172 feat: ship re-run executes all verification checks (v0.15.10.0) (#833)
• 542e783 fix: snapshot -i auto-detects dropdown/popover interactive elements (#844)
• 237ae2a Revert "fix: snapshot -i auto-detects dropdown/popover interactive elements (#844)"
• a94a64f fix: snapshot -i auto-detects dropdown/popover interactive elements (#845)
• dae251e feat: team-friendly gstack install mode (v0.15.7.0) (#809)
• b3d064a fix: gstack-team-init detects and removes vendored copies (#848)
• 03973c2 fix: community security wave — 8 PRs, 4 contributors (v0.15.13.0) (#847)

Affected skill files

qa/SKILL.md
qa/SKILL.md.tmpl
retro/SKILL.md
retro/SKILL.md.tmpl
review/SKILL.md
review/SKILL.md.tmpl
review/checklist.md
review/design-checklist.md
review/specialists/api-contract.md
review/specialists/data-migration.md
review/specialists/maintainability.md
review/specialists/performance.md
review/specialists/red-team.md
review/specialists/security.md
review/specialists/testing.md
ship/SKILL.md
ship/SKILL.md.tmpl

Change analysis

Prompt/logic changes (likely need porting):
None detected

Format-only changes (likely safe to skip):
qa/SKILL.md
qa/SKILL.md.tmpl
retro/SKILL.md
retro/SKILL.md.tmpl
review/SKILL.md
review/SKILL.md.tmpl
review/checklist.md
review/design-checklist.md
review/specialists/api-contract.md
review/specialists/data-migration.md
review/specialists/maintainability.md
review/specialists/performance.md
review/specialists/red-team.md
review/specialists/security.md
review/specialists/testing.md
ship/SKILL.md
ship/SKILL.md.tmpl

Mapping

gstack	kstack	Action needed?
plan-ceo-review	plan-product	Check diff
plan-eng-review	plan-eng	Check diff
review	code-review	Check diff
ship	ship	Check diff
qa / qa-only	qa	Check diff
retro	retro	Check diff
browse	N/A	Skip
setup-browser-cookies	N/A	Skip

Checklist

• Read the gstack diff
• Review prompt/logic changes above
• Adapt to Kiro CLI SKILL.md format (remove Go templates, Playwright, Greptile, slash commands)
• Update affected skills
• Run evals on changed skills
• Close this issue

[github-actions]

gstack has new commits since last sync.

Latest: c6e6a21 refactor: AI slop reduction with cross-model quality review (v0.16.3.0) (#941)
Compare: garrytan/gstack@03973c2...c6e6a21

New commits

• 8ca950f feat: content security — 4-layer prompt injection defense for pair-agent (#815)
• 47b3ee2 fix: auto-symlink into ~/.claude/skills/ when cloned elsewhere (#865)
• 6cc094c fix: pair-agent tunnel drops after 15s (v0.15.15.1) (#868)
• 1868636 refactor: extract TabSession for per-tab state isolation (v0.15.16.0) (#873)
• 9d34baa fix: gstack-slug produces deterministic slugs across sessions (#897)
• b73f364 feat: browser data platform for AI agents (v0.16.0.0) (#907)
• a7593d7 fix: cookie picker auth token leak (v0.15.17.0) (#904)
• dbd7aee feat: relationship closing — office-hours adapts to repeat users (v0.16.2.0) (#937)
• c6e6a21 refactor: AI slop reduction with cross-model quality review (v0.16.3.0) (#941)

Affected skill files

No skill files changed

Change analysis

Prompt/logic changes (likely need porting):
None detected

Format-only changes (likely safe to skip):
None detected

Mapping

gstack	kstack	Action needed?
plan-ceo-review	plan-product	Check diff
plan-eng-review	plan-eng	Check diff
review	code-review	Check diff
ship	ship	Check diff
qa / qa-only	qa	Check diff
retro	retro	Check diff
browse	N/A	Skip
setup-browser-cookies	N/A	Skip

Checklist

• Read the gstack diff
• Review prompt/logic changes above
• Adapt to Kiro CLI SKILL.md format (remove Go templates, Playwright, Greptile, slash commands)
• Update affected skills
• Run evals on changed skills
• Close this issue