godplans v1.13.0

Plans could satisfy every structural contract and still carry unsupported
attribution, mechanism-free quality claims, indirect verbs, false symmetry,
actorless sentences, and vocabulary drift. The substitution test caught the
worst generic paragraphs, but it did not give the author a meaning-preserving
editorial procedure after traceability was fixed. This release adds that
procedure before independent scoring.

Added

• Phase 5b, a prose-integrity pass that freezes IDs, decisions, hypotheses,
  sources, numbers, scope boundaries, requirement references, commands, task
  dependencies, and lifecycle state before rewriting human-facing prose. It
  re-runs the substitution and three-label tests after the rewrite and rejects
  any wording change that alters a commitment or uncertainty label.
• A prose-integrity gate in references/exemplar.md with failing and passing
  webhook-relay examples plus ten contextual checks for attribution,
  mechanisms, causal language, plain verbs, real list structure, canonical
  vocabulary, named actors, sentence density, honest hedging, and decorative
  explanation.
• The prose-integrity behavioral evaluation. It supplies unsupported draft
  marketing copy beside concrete webhook constraints and requires the plan to
  retain the signature header, throughput, retry count, and terminal-failure
  behavior without repeating the unsupported claims. The publishable matrix
  now contains eleven cases, and the harness checks that count.

Changed

• Plan handoffs now lead with the result and omit canned greetings, praise,
  sycophantic agreement, generic disclaimers, and generic closing lines.
• README.md and docs/ABOUT.md document the nine-stage method, the semantics
  frozen by the prose pass, the eleven-case matrix, and the pstack unslop
  lineage. The concepts are re-expressed for executable plans; no source text
  or catalog is copied.
• Published version surfaces and the generated portable prompt now report
  1.13.0.

godplans v1.12.3

A documentation release. No skill, prompt, template, schema, validator, or
plan-format change; PROMPT.md is regenerated only because it carries the version
string.

The published documentation was written for readers who already accept the
premise. README.md opened with two paragraphs of positioning before showing the
command, described the plan format entirely in the abstract, and put the
applicability-matrix paragraph in the first screen. A founder evaluating whether
to spend a build on this could not reach the argument, and the argument is the
product: an audit is a building inspection after the walls are up, and the
inspector hands back a demolition estimate rather than a fix. That claim needs no
technical vocabulary, and nothing on the page made it in under a minute.

Nothing was cut to make room. The dense material moved into <details> blocks,
so the maintainer-facing detail is one click away rather than one scroll past the
pitch.

Added

• assets/hero.jpg, a text-free isometric banner: a structure as a blueprint on
  the left, the same structure built on the right. It carries the plan-first
  argument the README opens with instead of decorating it. It lives outside the
  files array in package.json, so it does not enter the npm tarball, and the
  README references it by absolute raw URL so it renders on npm as well as on
  GitHub.
• A "Who this is for" table in README.md with a row for founders and product
  leads who do not code, and a FAQ entry answering whether a non-engineer can
  use godplans (they can read, question, and approve the output; running the
  command still needs a coding agent).
• A concrete GP-101 task block in README.md. The plan format was previously
  described only in prose, so a reader could not tell what a task looks like
  without installing the skill.
• A "What godplans deliberately does not do" section in docs/ABOUT.md, naming
  four limits: it does not build, does not guarantee a clean audit, does not
  replace judgment, and does not run after the fact.
• A "Good first contributions" section and a five-minute orientation table in
  CONTRIBUTING.md, plus a worked example of the substitution test. The rule had
  been stated without an illustration of a passing and a failing sentence.

Changed

• README.md restructured for a reader who does not yet accept the premise: the
  command appears above the fold, the plan-first argument is made through the
  inspection analogy before any domain vocabulary, and the evidence section
  leads with the head-to-head Critical and High counts as a table with the token
  cost stated immediately after. The complete plan contents, the evaluation
  method, and the repository map moved into <details> blocks verbatim.
• docs/ABOUT.md restructured: a one-paragraph summary at the top, the problem
  stated as four before-and-after pairs in a table, the eight-phase method drawn
  as a mermaid diagram rather than listed in a sentence, and every design
  decision given a plain-language summary line above its existing paragraph so
  the section can be skimmed and then entered.
• CONTRIBUTING.md now opens by naming what surprises new contributors: this is a
  prompt-engineering repository with no application to run and no build step.
  The scope refusal explains its reason (godplans that builds is a godplans
  whose plans stop surviving tool switches) rather than only stating the
  boundary.

Fixed

• docs/ABOUT.md said godplans combines eleven skills. It is fifteen, as
  README.md has recorded since the ADHD lineage row landed, and the same
  paragraph omitted ADHD from the external sources it names.
• CONTRIBUTING.md instructed contributors to bump every version surface for a
  behavior change without naming npm run version:sync, which is the only
  supported way to do it; scripts/version-sync.js holds the authoritative
  surface list and a hand-edit misses whatever was added to it last.
• SECURITY.md offered git clone --branch v1.1.0 as the reproducible-install
  example, eleven minor versions stale.

godplans v1.12.2

A correctness patch on 1.12.0. That release moved cache policy and queue policy
upstream into R-ARCH-23 and R-ARCH-24, and updated database.md to defer to them
by name. It did not update code-quality.md, which had owned both subjects since
before the architecture module reached them. Two modules therefore forced the
same two decisions with different obligations, and the weaker pair won wherever
a plan satisfied it first: R-CODE-16 asked a cache for an invalidation rule
alone, which is one of the four fields R-ARCH-23 requires, so a plan could clear
code quality carrying a cache with no tier, no staleness budget, and no
stampede protection. Its queue clause was satisfied by a depth alone, where
R-ARCH-24 requires a depth bound and a named full policy. Its gate, caching
"only where obviously beneficial", also contradicted R-ARCH-23's arithmetic
gate, which asks whether the latency budget fails without the cache.

Found by an audit of every module against the 1.12.0 change rather than
reported from use. No plan-format, schema, validator, or task-grammar change.

Fixed

• R-CODE-16 now defers to R-ARCH-23 and R-ARCH-24 by name and keeps only what
  this module owns in code: non-blocking I/O on request and hot paths, and a
  growth bound on every long-lived in-process structure. Its criterion requires
  the four R-ARCH-23 fields on a cached read path rather than an invalidation
  rule alone, and the R-ARCH-24 depth bound and full policy on a queue. This
  restores the module's own convention, already used by R-CODE-15 for index
  details and R-CODE-19 for observability depth, where a requirement names the
  owning module instead of re-deciding.
• The 1.12.0 entry described four new task seeds. Two shipped: the four were
  consolidated into two under the prompt-budget gate, which that same entry
  records twelve bullets later. The Added bullet described the draft rather than
  the release and contradicted its own Changed section.

godplans v1.12.1

A CI patch. 1.12.0 landed the portable core at 329947 bytes against a
330000-byte gate, 53 bytes of headroom, which meant the next edit of any size
failed the build: a typo fix, a clarifying clause, a single added character.
That is not the gate doing its job. The invariant it was built to hold is that
headroom stays under one core module, so a module-sized addition trips it while
an ordinary edit does not. At 53 bytes it could no longer tell those apart, and
a gate that fires on everything measures nothing. No skill content, module,
validator, schema, or plan-format change; a plan valid under 1.12.0 is valid
here, and PROMPT.md differs only in its version line, at the same 329947 bytes.

Changed

• The portable-core budget moves from 330000 to 337000, the second deliberate
  raise. 1.12.0 paid the gate's stated price before the number moved: the four
  new requirements were compressed and four task seeds consolidated into two,
  roughly 3 KB cut. 337000 leaves 7053 bytes against a 7070-byte smallest core
  module (compliance.md), so the invariant is restored rather than relaxed. The
  number is derived from that rule, not picked to fit.
• The gate's comment now states the invariant first and the number second,
  records both raises with what each one bought, and tells the next maintainer
  to read module sizes out of evals/metrics/context-cost.json via
  npm run metrics:context rather than guessing at the third raise.

godplans v1.12.0

The architecture module planned the structural half of system design well and
the runtime half not at all. It forced system shape, bounded contexts, data
ownership, trust boundaries, integration idempotency, ADRs, and NFR arithmetic,
then stopped: a plan could carry an availability chain requiring 99.97 percent
per component without ever naming redundancy, cache a read path without ever
naming how stale is acceptable, state a throughput ceiling without ever saying
what happens above it, and settle single-writer ownership without ever settling
what a read is allowed to see. The pieces existed downstream as mechanics with
no upstream decision: caching as a stack slot pick and a database invalidation
rule, partitioning and read-your-writes routing as database mechanics, abuse
rate limiting as a security control that is not a capacity control. Four
requirements move those decisions to the pass that already holds the numbers
they depend on. No plan-format, schema, or task-grammar change; a plan valid
under 1.11.1 is valid here, and the validator's ARCH catalog max moves 20 to 24.

Added

• R-ARCH-21 settles read consistency and horizontal partitioning per entity
  group, because R-ARCH-8 settles writes and leaves reads unstated. Each group
  declares a stance (strong, read-your-writes, bounded staleness with a number
  in seconds, or eventual), names the read paths pinned to the primary, and
  carries single-node capacity arithmetic against the 12-month ceiling already
  recorded under R-ARCH-3. Where the arithmetic fails, the partition key and its
  skew risk are named in the architecture section, because a partition key is a
  data-model decision that shapes every query rather than a database feature
  switched on later. Where it holds, the plan records the number and the
  threshold that would change the answer.
• R-ARCH-22 turns each availability number from R-ARCH-11 into a topology. Per
  critical-path component: the redundancy posture (single instance with an
  annual downtime budget, N instances behind a health-checked routing tier,
  active-passive with a failover time, or multi-zone with the zone-loss behavior
  named), whether request handling is stateless or sticky and where session
  state lives if it is, and the routing tier's health-check and removal rule.
  Remaining single points of failure are listed by name, each accepted with a
  downtime number or removed.
• R-ARCH-23 treats caching as a consistency change rather than a performance
  afterthought. Every cached read path carries a tier, a numeric staleness
  budget, an invalidation trigger, and stampede protection, and names the
  R-ARCH-11 budget it closes, so no cache enters a plan as a reflex. A path
  whose R-ARCH-21 stance is strong or read-your-writes is excluded from the
  cache or routed to the primary, on the record.
• R-ARCH-24 states the overload posture per entry surface, because R-ARCH-9
  covers a failing dependency and leaves a saturating system unstated. Every
  entry surface gets a behavior at and above the throughput ceiling (shed with a
  retryable status and Retry-After, queue with a bounded depth and maximum wait,
  or degrade to a named path), every queue gets a depth bound and a full policy,
  and every limiter is labeled capacity or abuse, because a threshold sized for
  fraud control is not a capacity control and reading it as one hides the
  saturation case entirely.
• Four task seeds carrying these to build time: the capacity model document,
  admission control with bounded queues, the cache tier with staleness budgets
  and single-flight protection, and primary-pinned read routing with a
  read-your-writes test that proves the pinning holds.
• design.capacity-model joins the documentation set, owned by architecture,
  selected when an availability or throughput target binds or the plan caches,
  replicates, or partitions.
• Four anti-patterns refused by name: availability theater (an uptime number
  with no redundancy behind it), silent staleness (a cache that changes the
  consistency contract because nobody wrote down the tolerance), the
  infinite-capacity assumption (no stated behavior above the ceiling, so the
  untaken decision becomes unbounded queueing), and the deferred partition key
  (sharding postponed until the access patterns have calcified around one node).

Changed

• Decisions to force grows from 7 to 11 and stays ordered hardest-to-reverse
  first: read consistency and partition key enter at position 4, next to
  tenancy and storage shape, because a partition key chosen late means re-keying
  live data while every query that assumed one node is rewritten. Runtime
  topology, cache tiering, and overload posture close the list as the more
  reversible bets, each forced anyway because the untaken decision has a bad
  default.
• The self-audit rubric adds a 15-point runtime topology, caching, and overload
  dimension and re-weights the existing eight to keep the total at 100.
  Components and data architecture absorbs the R-ARCH-21 consistency and ceiling
  arithmetic.
• R-ARCH-17 names the database pass as a consumer of the architecture section,
  so replication, partitioning, and read routing are implemented from stances
  already set rather than reopened downstream. R-ARCH-19's three-page prose cap
  excludes the new consistency, topology, cache, and overload tables, so the cap
  stays honest instead of penalizing tabular decisions.
• The post-build drift audit compares redundancy posture, cache staleness
  budgets, and entry-surface overload behavior against the plan, alongside the
  components, data owners, and boundaries it already compared.
• The portable core prompt lands at 329947 bytes against the 330000-byte gate,
  53 bytes of headroom. The budget was not raised. The four requirements were
  written tight and the four task seeds consolidated into two to fit beneath it,
  per the gate's own instruction to cut content rather than move the number a
  second time. The next core addition of any size fires the gate, which is the
  point of it.
• database.md R-DB-15 and R-DB-21 defer upstream by name: cache invalidation and
  stampede policy implement the tier, staleness budget, and trigger set by
  R-ARCH-23, and partitioning and read routing implement the key and stances set
  by R-ARCH-21. Both remain the owner of the physical mechanics; neither reopens
  the decision.

godplans v1.11.1

A documentation patch. 1.11.0 gated scored archetypes, overlays, and cited
absence claims in the reference modules and the validator, but the README still
described archetype selection as a closest-match step and named neither of the
other two. The packaged README is the first thing a reader sees, so it shipped
describing behavior the release had replaced. No skill content, validator,
schema, or plan-format changes; a plan valid under 1.11.0 is valid here.

Changed

• README documents scored archetype detection: weighted signals with vetoes, a
  recorded primary and runner-up, the margin between them, and what changes if
  the runner-up is right, priced in tasks and phases. The confidence label is
  recomputed by the validator from those numbers rather than asserted, and below
  the 0.45 floor the archetype is unknown, goes to Open Questions, and
  withholds every assure-stage document from being marked not-applicable.
• README documents overlays (ai-system, public-ui, shipped-artifact,
  operated-by-others, regulated-data, agent-skill-package) and the rule
  that separates them from archetypes: an archetype says what a project is, an
  overlay says what extra obligations it carries, and an overlay raises a
  domain's disposition without ever lowering it.
• README's brownfield mode names the two evidence rules it was missing: an
  absent: exclusion cites the search that came back empty, and a fresh
  .godaudits/EVIDENCE.json may be reused as [recheck] provenance while a
  stale one is refused, because a stale inventory reads exactly like a fresh
  one. godplans neither requires nor calls godaudits.

godplans v1.11.0

This release ports two disciplines from sibling projects. From hannsxpeter/docdna,
the selection engine that decides which documents a repository owes and defends
every absence: plans now carry a documentation set, and every exclusion, of a
domain or a document, records the evidence state that licensed it and the
predicate that reverses it. From hannsxpeter/codedna, whose style fingerprinting
already backed the style-genome module: the AI-tells catalog and the measurement
script now ship rather than being cited. Both are ported by copy. godplans
depends on nothing from either repository at runtime, and neither depends on
godplans; fixes travel as edits, never as references.

Plans emitted by 1.10.0 do not validate under 1.11.0 without the new sections.
Add ## Documentation set, add ### Module disposition under the applicability
matrix, and give every excluded matrix row an evidence state and a tripwire.

Added

• references/doc-set.md, the documentation-set contract: a 42-row catalog
  keyed by lifecycle stage, the durability split that keeps evidence artifacts
  from being edited in place, the verdict-by-state lattice that names adopt
  and orphan as real brownfield results, lifecycle frontmatter, the four
  independent staleness verdicts, and the system-of-record boundary.
• ## Documentation set as a required plan section, with R-REPO-21 rewritten
  and R-REPO-22 through R-REPO-25 added for tripwires on excluded rows, single
  ownership per document, lifecycle frontmatter on every planned document, and
  the repository-boundary statement. The validator checks catalog ids, stages,
  verdicts, owners, task references, and exclusion grammar.
• Exclusion tripwires on the applicability matrix. An excluded row now carries
  an evidence state (absent: or by-design:), a project-specific reason, and
  a revisit when: predicate held to the same observability bar as a deferral
  trigger. unknown: and hint: are refused, because neither licenses an
  exclusion: they make the domain applicable or become an open question.
• ### Module disposition as a machine-checked block. Each applicable module
  reports what it landed and what it dropped, and dropped-by names the layer
  that dropped it (scale, archetype, or form). A dropped requirement may
  not appear on any task, a landed one must be referenced somewhere, and the
  two sets may not overlap. Without the layer name, a requirement cut to fit an
  appetite is indistinguishable from one nobody considered.
• The blast-radius rule on the assumptions ledger. Every assumption is priced
  in tasks and phases, so "answer defaults" is an informed choice.
• scripts/style-stats.py, vendored from codedna, plus R-DNA-21 through
  R-DNA-24: measured naming histograms, comment density, and function-length
  medians instead of eyeballed numbers; a config map that makes R-DNA-1
  checkable; the 15-item AI-tells catalog carried in full so the anti-tells
  appendix selects from it; and an enforcement loop with an executable Verify
  command rather than an instruction no command can fail.
• R-OBS-22 and the plan-format claims-and-evidence contract: no invented
  availability targets, recovery objectives, retention periods, error budgets,
  or review cadences, and exhaustive or negative claims about existing code
  need a command rather than a file citation.
• Scored archetype detection with vetoes, replacing the closest-match table. A
  plan records primary and runner-up scores, a margin, the vetoes applied, and
  what changes if the runner-up is right, priced in tasks and phases. Margin and
  confidence are recomputed by the validator from those scores, so a confident
  label that does not follow from the plan's own arithmetic fails. Below the
  0.45 floor the archetype is unknown, goes to Open Questions, and withholds
  every assure-stage documentation row from being marked not-applicable,
  because a misread archetype deletes threat models silently.
• Overlays (ai-system, public-ui, shipped-artifact, operated-by-others,
  regulated-data, agent-skill-package) as an additive frontmatter list. An
  archetype says what a project is; an overlay says what extra obligations it
  carries. Overlays raise and never lower: a domain an overlay covers may be
  applicable or deferred, never excluded.
• A brownfield or replan absent: exclusion must carry a backticked command or
  evidence artifact. It is a negative claim about existing code, and the
  claims-and-evidence rule already refuses those without a search.
• Optional reuse of .godaudits/EVIDENCE.json when it is fresh for the revision
  being planned, cited as [recheck] provenance. godplans neither requires nor
  calls godaudits; a stale inventory is refused because it reads like a fresh one.
• archetype_confidence, overlays, evidence_state, revisit_when,
  module_disposition, and documentation in the generated PLAN.json sidecar,
  with matching schema entries.

Changed

• Load-bearing domains (security, code-quality, style-genome, repo, roadmap)
  can no longer be excluded by the validator, only scaled down. The rule was
  already stated in discovery.md; now it is gated.
• ADR ownership is settled. decide.adr belongs to the architecture module
  (R-ARCH-14), which also fixes ADR immutability, and R-REPO-14 defers to it
  instead of adding a second ADR task at tier 4.
• Replan leads with tripwires that have become true, and reports drift as leads
  rather than findings: a moved digest establishes that something changed and
  never why, and presenting a rename and a regression as one verdict trains the
  reader to skip the section.
• The repo rubric adds a documentation-set dimension worth 15, and scores zero
  on it when any exclusion is unexplained. The style-genome rubric adds a
  measured-evidence dimension worth 10.
• The portable-core byte budget moves from 300000 to 330000, once and on the
  record. This release adds the archetype and overlay contract, the
  documentation-set grammar, and about 25 KB of machine checks the core inlines
  whole. The core now measures 320783 bytes, so the new ceiling leaves under
  9 KB of headroom, less than any single core module: the next addition of this
  size fires the gate rather than sliding past it.

godplans v1.10.0

This release applies one discipline borrowed from mattpocock/skills wayfinder:
a fact lives in exactly one place, and the edge of what is safe to work on is
proved rather than asserted. Three places where godplans stated a rule but did
not gate it are now gated. No new plan sections, no new domains, and no change
to the scale ceilings.

Fixed

• The validator accepted a plan whose domains_applicable, domains_deferred,
  and domains_excluded frontmatter flatly contradicted its own applicability
  matrix. A plan declaring security and database excluded while the matrix
  marked both applicable validated ok and exited 0, so the never-excluded-set
  check (which reads only the matrix) could be bypassed by the summary that was
  supposed to index it. The three lists are now recomputed from the matrix rows
  and any disagreement fails, the same parity already enforced between the
  ## Plan provenance block and its frontmatter values.
• The frontmatter form documented in references/plan-format.md could not
  validate. The block-mapping shape for domains_deferred and
  domains_excluded (- name: / trigger: / reason:) failed with
  frontmatter field is empty: domains_deferred. The documentation now shows
  the single inline list every emitted plan actually uses, and the trigger and
  reversibility reason live only in the matrix row that decides them.
• [P] promised an executor that a task was safe to run beside its wave
  siblings, and nothing checked it. Two [P] tasks in one wave writing the
  same file validated ok and exited 0, despite the task grammar, R-ROAD-8,
  and the fictional-parallelism refusal all forbidding it. A [P] task whose
  Files list intersects another unchecked task in its wave now fails.
• references/plan-format.md told replans to cut completed phases into
  .godplans/archive/PLAN-v<n>.mdx while R-ROAD-18 requires completed phases to
  be archived in place and never overwritten. Cutting them out would delete the
  execution history the drift check and the supersession metric read. The
  archive path now holds whole superseded plan versions, and the live plan keeps
  its finished phases.
• The validator's own golden fixture declared two applicable domains while its
  matrix marked ten applicable and eight excluded. It passed because nothing
  compared them; it is now consistent and the new parity check covers it.

Added

• A question grammar in references/plan-format.md and the PLAN template that
  carries the four fields R-PRD-10 already required and the format contract did
  not state: owner, blocking flag, decide-by, and recommended default. The
  contract also now says plainly that ## Open Questions holds the residual
  unknowns a plan can execute past on a default, and that an unknown dependent
  work cannot start without is a flagged hypothesis whose R-ROAD-7 validation
  task carries a real Depends on edge.
• parallel on every task in the generated PLAN.json, so a runner can schedule
  a wave from the validated marker instead of re-deriving which tasks are safe
  to run at once. It is a required property in schemas/PLAN.schema.json;
  consumers pinned to the previous schema must regenerate their sidecar.
• Seven validator regression checks covering frontmatter-matrix drift in both
  directions, an invented deferral, an unknown domain name, the rejected
  block-mapping form, a [P] file collision, and a passing disjoint [P] pair.
• A presentation rule in Phase 7: name tasks, decisions, and questions by title
  with the ID in support. IDs are how the machine addresses the plan; a wall of
  them is how a human loses it.
• A disposition for an empty hard-to-reverse-bets list in references/discovery.md.
  Empty is a finding that each of the four bet categories was examined and
  located, not permission to skip the pass.

Changed

• Lineage credits mattpocock/skills wayfinder for the two ideas taken: one fact
  in one place, and a frontier that is proved rather than asserted. No text,
  prompt, or code was copied, and godplans takes none of its issue-tracker map,
  ticket types, or session protocol.

godplans v1.9.0

godplans 1.9.0 turns the evidence critique into product contracts and publishes the first direct build-outcome result. The project remains a skill-only package. Running the skill requires no provider credential, SDK, service, or runtime dependency. Optional evaluation runners reuse normal authentication from already configured host CLIs.

Direct outcome evidence

The retained tenant-notes-api evaluation used gpt-5.6-sol for both arms, the same no-skill builder, the same verifier, and blinded static godaudits 2.12.0 passes.

Arm	Verify	Critical	High	Critical plus High
godplans	pass	0	1	1
no-skill control	pass	1	4	5

The treatment delta is -4 Critical plus High findings. The control's Critical finding was a missing storage-enforced tenant boundary. Its High findings covered token rotation and revocation, unredacted exception logging, repository and CI provenance, and missing agent memory.

This is directional evidence from one security-sensitive API case and one model family, not a universal claim. All plans, built repositories, verifier logs, audits, runner metadata, and CLI event logs are retained in the repository.

The cost is published too

Treatment planning reported 11,236,025 cumulative input plus output tokens versus 162,816 for control, including cached input. Combined plan plus build usage was 13,461,224 versus 880,004. The outcome supports risk reduction on this case, while context cost remains the clearest weakness.

The portable prompt is now a measured 247,631-byte core instead of the historical 551,875-byte full form. Discovery, plan format, product, architecture, stack, database, and security stay in core; other domains load lazily. evals/metrics/context-cost.json publishes byte counts, estimates, hashes, and per-module costs.

Planning is incremental

Hard-to-reverse domains still plan fully. SEO, launch, observability, UI, and deployment may defer only with an observable trigger and a reversibility argument. Every major decision now carries a signal, failure boundary, and explicit return-to-planning action.

Execution closes the loop

• .godplans/PLAN.json is generated from PLAN.mdx with a content digest, structured decisions, requirements, dependencies, active tasks, superseded tasks, and plan half-life metrics.
• --drift-check N reruns a deterministic sample of completed Verify commands, checks provenance staleness, and reproves the phase checkpoint.
• scripts/plan-halflife.sh reports overall and per-domain task survival and supersession rates.

Evaluation is harder to game

• A ten-case, three-profile matrix contract retains both arms, raw artifacts, model identity, and actual token usage.
• A blind external grader supports at least five plan pairs, at least two isolated no-skill judges, and a published inter-rater gap.
• The build-outcome coordinator gives matched plans to the same builder, removes the plan and arm label, and compares verifier status plus open Critical and High findings.
• A tie or loss must be published with equal prominence.

The broad ten-case, three-family run and real external n=5 grading remain future evidence work.

Verification

• npm run check
• npm run release:check
• pinned official Agent Skills validator
• 97 plan-validator regression checks
• post-merge GitHub release-quality workflow
• npm dry run: 117 files and 1,073,818 unpacked bytes

Assets

• godplans-1.9.0.zip: the full repository at this tag.
• godplans-1.9.0.tgz: the npm package tarball.

godplans v1.8.0

Two defects fixed and one measurement gap closed, prompted by reading UditAkhourii/adhd (MIT) and re-expressing its two load-bearing ideas for planning: the critic must not be the author, and a menu of options is not a set of alternatives. No ADHD text, prompt, or code is copied, and nothing here adds a dependency, a network call, or a harness-specific primitive.

Phase 6 is now an independent audit gate

The author graded the author, and ground rule 8 makes the author read the module rubric before authoring, so the generator saw the grading key. Phase 6 now splits into 6a score, 6b name every deduction, 6c revise and rescore, run under critic posture in a separate turn and an isolated context where the harness offers one. Every deduction cites the section, quotes the sentence that lost the points, and names the rubric line; a deduction with no quoted text is not a deduction. Every revision quotes the deduction it answers, and a rescore with no corresponding revision is discarded.

Decisions are no longer capped by the menu

R-ARCH-4 required exactly one of seven system shapes, so an apt eighth shape failed a requirement rather than losing on merit. The seven stay presumptive; an eighth is permitted when the plan names the constraint no listed shape satisfies. New R-STACK-21 makes the plan name one viable runner-up generated outside the pre-combined bundles, with the condition it would have won under, without promoting it: the incumbent bias in R-STACK-7 and R-STACK-12 is deliberate and stands. Open Questions must now escape their own framing or name the constraint that eliminated the outside option.

The evaluation harness has a control arm

Every case previously scored godplans against godplans' own expectations, proving conformance but never value. scripts/eval.sh --baseline runs each case a second time through the same agent and model with no skill loaded, scores it against identical expectations, and reports per-case and aggregate deltas. It is a measurement, never a gate. The shipped evals/runners/codex-baseline.sh is deliberately fair: identical agent, model, effort, workspace, fixture, and request, a plain ask for a thorough plan, and no leaked format contract, requirement IDs, validator, or phase method.

What was rejected

The npm package and Agent SDK dependency (contradicts the no-network posture and is unreachable from PROMPT.md surfaces), the novelty scoring axis (fights godplans' deliberate bias toward proven defaults), mandatory subagent fan-out (absent in T3 Chat, Aider, and pasted prompts, so it would ship a placebo there), and randomized frame selection (plans are bound to a SHA-256 input digest, which nondeterminism would reduce to decoration).

Verification

npm run check green: unicode-clean, version parity across all six surfaces, 69 validator regression checks, install regression, and the eval-harness suite including new control-arm coverage for both misuse guards, artifact retention, delta reporting, and the invariant that control misses never change the exit code.

Assets

• godplans-1.8.0.zip: the full repository at this tag.
• godplans-1.8.0.tgz: the npm package tarball.