Merge pull request #52 from time-attack/release/gstack2-public-beta

release: GStack 2 public beta — v2.0.0.0

Author: time-attack

.github/workflows/evals.yml

@@ -179,9 +179,9 @@ jobs:
       # a fresh CI checkout has NO registry — claude prints "Unknown command:
       # /plan-ceo-review". Mirror setup's --no-prefix registry minimally: a gstack
       # root symlink (resolves the preamble's absolute ~/.claude/skills/gstack/bin/*
-      # and ~/.claude/skills/gstack/<skill>/sections/* paths) plus a per-skill
-      # top-level dir holding SKILL.md (+ sections) symlinks for the two skills
-      # these tests invoke. No ./setup (it builds binaries, launches Chromium,
+      # paths and the dispatchers' skills/*/references/* reads) plus a per-skill
+      # top-level dir holding the compat alias SKILL.md for the two commands these
+      # tests invoke. No ./setup (it builds binaries, launches Chromium,
       # installs fonts, reads a /dev/tty prompt) and no binary build (SKILL.md +
       # bin/ + sections/ are committed). $HOME is /github/home here; the spawned
       # claude inherits it (this runner adds no HOME/CLAUDE_CONFIG_DIR override,
@@ -205,11 +205,15 @@ jobs:
           # registry recognized it, isolating the failure to the container's
           # cross-mount symlink). Copy SKILL.md + sections as real files so the TUI
           # reads them directly.
+          # Source is skills/.compat/<s>/SKILL.md: the GStack 2 alias that routes
+          # /office-hours and /plan-ceo-review to a $plan invocation. The retired
+          # 1.x root dirs are gone, and their frontmatter was `gstack-1-<name>`
+          # anyway, so the TUI never matched the bare slash command from them.
+          # Aliases carry no sections/ — the judgment lives in the dispatcher.
           for s in office-hours plan-ceo-review; do
             rm -rf "${SKILLS_DIR:?}/$s"
             mkdir -p "$SKILLS_DIR/$s"
-            cp "$REPO/$s/SKILL.md" "$SKILLS_DIR/$s/SKILL.md"
-            cp -R "$REPO/$s/sections" "$SKILLS_DIR/$s/sections"
+            cp "$REPO/skills/.compat/$s/SKILL.md" "$SKILLS_DIR/$s/SKILL.md"
           done
           # Also register PROJECT-scoped (cwd) skills. claude's interactive TUI
           # surfaces /slash commands from <cwd>/.claude/skills, and the smokes run
@@ -223,8 +227,7 @@ jobs:
           for s in office-hours plan-ceo-review; do
             rm -rf "${PROJ_SKILLS:?}/$s"
             mkdir -p "$PROJ_SKILLS/$s"
-            cp "$REPO/$s/SKILL.md" "$PROJ_SKILLS/$s/SKILL.md"
-            cp -R "$REPO/$s/sections" "$PROJ_SKILLS/$s/sections"
+            cp "$REPO/skills/.compat/$s/SKILL.md" "$PROJ_SKILLS/$s/SKILL.md"
           done
           echo "--- registry under $SKILLS_DIR ---"
           ls -la "$SKILLS_DIR/gstack" "$SKILLS_DIR/office-hours" "$SKILLS_DIR/plan-ceo-review"
@@ -234,8 +237,9 @@ jobs:
             "$SKILLS_DIR/office-hours/SKILL.md" \
             "$SKILLS_DIR/plan-ceo-review/SKILL.md" \
             "$SKILLS_DIR/gstack/bin/gstack-update-check" \
-            "$SKILLS_DIR/gstack/office-hours/sections/doc-and-handoff.md" \
-            "$SKILLS_DIR/gstack/plan-ceo-review/sections/review-sections.md"; do
+            "$SKILLS_DIR/gstack/skills/plan/SKILL.md" \
+            "$SKILLS_DIR/gstack/skills/plan/references/legacy/office-hours.md" \
+            "$SKILLS_DIR/gstack/skills/plan/references/legacy/plan-ceo-review.md"; do
             if [ ! -e "$f" ]; then
               echo "ERROR: skill-registry target missing (symlink dangles): $f" >&2
               exit 1

.github/workflows/gstack2-gate.yml

@@ -55,5 +55,9 @@ jobs:
       - run: bun install --frozen-lockfile
       - name: Install Playwright Chromium (locked version, browse integration tests)
         run: ./node_modules/.bin/playwright-core install --with-deps chromium
+      - name: Build compiled binaries (the diagram gate hard-requires make-pdf/dist/pdf in CI)
+        run: bun run build
+      - name: Install poppler-utils (the emoji render gate hard-requires pdffonts in CI)
+        run: sudo apt-get update -qq && sudo apt-get install -y -qq poppler-utils
       - name: Run the free suite
         run: bun run test

CHANGELOG.md

@@ -1,11 +1,73 @@
 # Changelog
 
-> **GStack 2 draft in progress.** `main` carries the working draft of GStack 2
-> — not a released version. Current status is **BLOCKED** pending the remaining
-> release gates. See
-> [`docs/gstack-2/STATUS.md`](docs/gstack-2/STATUS.md) for the authoritative
-> completion state and remaining P0 gates. No GStack 2 release claim is made
-> here while that status holds.
+## [2.0.0.0] - 2026-08-09
+
+**GStack 2, public beta. Six skills. Everything else had to earn its way in.**
+
+GStack 1 was forty-four skills and a pile of scaffolding that billed your
+context window whether you needed it or not. GStack 2 is six things you can
+actually name: `/plan`, `/qa`, `/debug`, `/review`, `/ship`, and `/make-pdf`.
+Each one is a lazy dispatcher — the catalog your agent reads at discovery is
+pinned at least 70% below the 1.x baseline, and the specialist judgment loads
+only when a workflow actually reaches it. Install is the standard one-liner:
+`npx skills add time-attack/gstack/skills`. No runtime required, nothing
+phones home, and your 39 old slash commands still route to their new homes.
+
+### The numbers that matter
+
+Source: the committed install artifact
+([install-verify-2026-08-09.json](evals/installation/install-verify-2026-08-09.json)),
+the first completed paid gate runs
+([TEST-EVIDENCE.md](docs/gstack-2/TEST-EVIDENCE.md)), and the egress re-audit
+([EGRESS-AUDIT.md](docs/gstack-2/EGRESS-AUDIT.md)).
+
+| Metric | GStack 1 | GStack 2 beta |
+|---|---|---|
+| Discoverable skills | 44 | 6 |
+| Discovery catalog cost | ~1,100 token-equivalents | pinned ≥70% below that, every suite run |
+| Judgment loaded for a trivial ask | the monolith | the dispatcher's fast path only |
+| Hosts verified byte-identical | — | 7 (claude-code, codex, cursor, pi, openclaw, github-copilot, kimi) |
+| Open egress-audit findings | 8 | 0 — each fix ships with a test that fails without it |
+| Paid gate tier terminal summaries, ever | 0 | 3 completed runs, every failure attributed |
+
+### What you can do now
+
+- **Ask for judgment, not a catalog.** Name the task and the right skill
+  self-routes; the keyword router is gone because the six descriptions do its
+  job. Old muscle memory (`/office-hours`, `/qa-only`, `/retro`, …) still
+  resolves through opt-in compatibility aliases that carry zero copied prose.
+- **Trust what leaves your machine.** Session tokens never appear raw on any
+  local endpoint, boot tokens log private, previews fire no image beacons,
+  memory ingest secret-scans by default at the exact bytes it stages, cloud
+  eval uploads require explicit opt-in instead of an ambient API key, and an
+  unattested runtime download refuses instead of silently downgrading.
+- **Come back to a project and get context.** Session start recovers your
+  recent artifacts, last session, and active decisions again — the
+  welcome-back summary that quietly vanished during the 1.x migration is
+  restored and gate-tested.
+- **Ship the optional runtime later, or never.** The managed
+  browser/iOS/PDF runtime stays opt-in, fails closed until its signed release
+  exists, and now discloses its attestation state before asking for consent.
+
+### For contributors
+
+- The paid gate tier is sharded (one file per shard, external group-kill
+  timeouts) and produced its first terminal summaries in project history;
+  judge-threshold quality benchmarks moved to the periodic tier where the
+  tiering policy always said they belonged.
+- A per-module ablation instrument ships (`scripts/ablate.ts`): deterministic
+  scoring against planted ground truth, ablate/solo/set arms, resume, and a
+  verdict layer that cannot be talked into false deletions. Cuts now cite
+  measurements, not vibes — three modules and ~43KB of duplicated prose left
+  the tree this way, each with a named loss-check.
+- Hermetic PTY children can opt into registered skills
+  (`hermeticSkillsConfigDir()`), which un-silenced seven slash-command gates
+  that had been measuring nothing.
+
+> The optional managed runtime's signed `v2.0.0-rc.6` component release
+> publishes with the release tag; until then `setup` fails closed and the
+> Markdown-only install above is the supported path. Authoritative status:
+> [`docs/gstack-2/STATUS.md`](docs/gstack-2/STATUS.md).
 
 ## [1.66.0.0] - 2026-08-01