v1.1.0 — Sandboxed workspaces

The 1.1 headliner: sandboxed workspaces went from roadmap track to working capability. gdd-sandbox runs a scoped GDD agent in a Docker container, reachable over chat and pointed at one target component — a chat message becomes a reviewed pull request, and merging stays human. It ships as an optional companion component fetched independently of the workspace; see the features tour entry.

Added

• Sandboxed workspaces — the gdd-sandbox companion component (optional, fetched separately). A Docker image running a supervised chat-driven agent scoped to one component: subscription auth, scope by absence, an identity that can open pull requests but never merge, and decisions asked in chat as outcomes rather than tool prompts. See the features tour.
• Headless permission mode — with GDD_SANDBOX=<component> set, a prompt nobody can answer resolves as a deny instead of hanging the session, and [headless-allow] names what may run unreviewed: committed policy only, scoped to that component, shipping empty. See the hook README (#158).
• CI for the workspace itself — full bats suite on Ubuntu per push/PR, plus a weekly serial Windows Git Bash job (#147).
• The Apache-2.0 LICENSE, scoped to the workspace itself (#147).
• ws test parallelizes itself when rush or GNU parallel is on PATH — ~1,000 tests in 1:10 rather than 3:48, serial and unchanged otherwise (#144).
• ws cr refuses a stale base, naming the rebase commands; --stale-base-ok covers deliberately stacked reviews (#142).
• ws cr reminds you about the changelog when a branch touches none and the repository keeps one — advisory, never blocking. The branch-workflow skill carries the same step.
• ws hoard lock — refresh verified checksums for a hoard's pinned plugin assets; upgrades gained preview-then-apply, and Obsidian vaults gained Project and Area notes (#148).
• ws orient --check — orient's adapter pointers with an exit code, so realm-doc drift can be caught on a schedule. Plain ws orient stays exit-zero.
• Change-note budgets in the commit/CR/issue templates, with a style.changeNotes ecosystem knob (terse | standard | detailed) surfaced by ws orient (#138).
• Case studies — docs/gdd/samples/ becomes docs/gdd/case-studies/ (#138), now carrying three long-form studies with the addition of module attribution in Terasology.
• Scoped kubectl dry-runs pass the guard — --dry-run=client|server is no longer classified as the write it never performs (#156).

Changed

• Docs entry points reorganized — philosophy on its own page, the index leading with what GDD does, getting-started flattened, stale IDE guidance removed (#138); a length pass across docs and skills followed (#140).
• Hook Tier 1 reads quoted spans as data, removing 85 false-positive asks in a day — mostly regex inside grep patterns — with committed bash -c / sh -c ask entries as the compensating control (#138).
• ws exec no longer reaches past the verbs it wraps — the wrapped forms of git commit / git push / gh pr create deny like the raw ones, and review reading routes back through ws review (#156).
• gh repo fork redirects to ws clone-fork, which gained --url <source> --add-to-ecosystem for adopting an undeclared component in one step (#138).
• The line-wrap guard covers docs/gdd/ and skills, with a shrink-only grandfather list for legacy-wrapped files (#142).

Fixed

• The Kubernetes write floor stops false-asking on first-party scripts/ files that merely carry kubectl as data (#142).
• An [audit-acknowledged] section in hook-rules.local no longer abandons the rest of the file, silently dropping the [allow-extras] patterns after it (#156).
• ws clone-fork creates renamed GitLab forks instead of ignoring a configured fork slug (#136).

Security

A sustained review-driven hardening pass (#145, #146, #148, #149, #150), tightening the boundaries where external input becomes consequential:

• Ambiguous target names error instead of resolving by precedence, so a command cannot reach the wrong checkout (#149).
• Terminal control sequences are neutralized in provider output and realm trust summaries, malformed payloads included (#146, #149).
• The Kubernetes guard rejects unsafe wrappers, shell expansions, constructed commands and ambiguous option shapes (#146).
• Credential handling is centralized across clone/pull/push/review with host-scoped isolation; environment files load as literal data on the validation path too (#146, #150).
• Pushes are restricted to exact local branches or tags; clone and component-template identity validation tightened (#145).
• Hoard plugin downloads are checksum-verified before installation (#148).
• ws audit-permissions detects wildcard breadth and privilege-escalation shapes it previously missed (#145).

What's Changed

Everything else

• fix(clone-fork): create renamed GitLab forks by @agent-refr in #136
• feat: case-study graduation, doc reorg, change-note budgets, quote-aware hook by @agent-refr in #138
• docs: trim GDD docs and skills for length, with load-bearing lines restored by @agent-refr in #140
• fix: k8s floor first-party exemption, ws cr stale-base preflight, wrap-guard extension by @agent-refr in #142
• Harden workspace execution and repository boundaries by @agent-refr in #145
• fix: strengthen runtime trust boundaries by @agent-refr in #146
• feat(ws-test): auto-parallelize bats suite when a parallel backend is available by @soloturn in #144
• feat(ci): full-suite GitHub Actions + Apache-2.0 license by @agent-refr in #147
• fix: strengthen workspace trust boundaries by @agent-refr in #148
• fix: validate command boundaries by @agent-refr in #149
• fix(env): load validator credentials as literal data by @agent-refr in #150
• fix(hook): ws exec boundary, scoped kubectl dry-runs, and hook-rules.local parsing by @agent-refr in #156
• feat(hook): stop asking when there is nobody to ask by @agent-refr in #158
• docs: v1.1 finalizing — sandbox arrival, module-attribution study, changelog curation by @agent-refr in #160

New Contributors

• @soloturn made their first contribution in #144

Full Changelog: v1.0.0...v1.1.0