v1.0.0 — Guardian Driven Development goes GA

Guardian Driven Development reaches General Availability. This first release versions the reference implementation — the yggdrasil workspace, the ws CLI, the skills, and the methodology docs — as one coherent snapshot: Claude-first, with a published roadmap for cross-harness support and beyond. The gate it cleared is recorded in the GA readiness doc.

Added

• The ws CLI — unified workspace verbs (commit, push, cr, issue, review, test, lint, log, clone, clone-fork, pull, status, exec, clean, diagnose, preflight, orient, and friends) with bodyfile-driven commit/CR/issue flows, Co-Authored-By attribution, fork-aware remote selection, and multi-kind target resolution (components, realms, hoards, the workspace itself) via ws_resolve_target (#40, #44, #62, #92, #94).
• Session-scoped identity and configuration — commit attribution resolves per session (ws whoami --set at orientation, --co-author-file for sub-agents, --human for humans, hard error over silent mis-attribution), and stance/role/mentoring are established per session via ws session instead of Thalamus frontmatter (#100, #103, #107, #111).
• The ws k8s guard — a kubectl safety scope: arm a context + namespaces and out-of-scope writes are rejected before kubectl runs, with class-aware messages (scope / unbounded / precondition); the hook extends the guard to raw agent kubectl, and ambient aggregation covers plain human terminals (#111, #112).
• Token-injected remote git auth — ws push / clone / clone-fork / pull inject the matching .env token per process so HTTPS operations never fall through to OS credential managers; ws push pushes tags; ws gh / ws glab run one-off provider commands with the right token loaded (#100, #106, #112, #116). Requires git ≥ 2.31, now enforced by ws preflight — older git silently ignores the env-config injection mechanism and falls through to the OS credential manager after all (caught live on a git 2.28 host during the GA clone-fork e2e).
• Realms and hoards — community config layer (realms/, three-layer ecosystem merge, per-component adapters) and personal containers (hoards/, thalami + Obsidian-vault flavors, ws hoard init/list/scan/cadence/upgrade) with provenance-tracked, plan/apply/rollback template upgrades (#43, #59, #63, #74–#76).
• The PreToolUse permission hook — tiered Bash governance: shell-composition deny, raw-command redirect-to-ws with session-scoped human-gated bypass, adapter-aware test/lint redirect, guarded-kubectl tier, destructive-command ask-tier, settings-allow and per-machine allow-extras; PowerShell matcher coverage (#47, #61, #64, #71, #91, #95, #111, #114).
• ws audit-permissions — startup allowlist breadth audit with watchlist severities, ws-wrapper normalization scoped to in-repo paths, and per-machine [audit-acknowledged] allowances (#94, #96).
• Orientation and discovery — ws orient (subcommand survey, active realm, adapter wiring, skill index), the gdd-orientation startup skill, post-dispatch discoverability footer, and the ws:use-when marker convention (#84, #88–#91).
• Skills catalog — workspace skills under .agent/skills/ (orientation, permissions, scribe, housekeeping, review-triage, mentoring, BDD, zen/quick/flow modes, and more) with the skill→script extraction principle codified (#48, #85).
• Thalamus system — per-machine shared thinking files in a thalami hoard, arcs with cross-host stitching, ArcDashboard with filter/sort controls, commit-cadence nudges (#49, #60, #76).
• Component templates and tutorial — ws component init flavors including the flagship gh-pages scaffold-to-live tutorial and getting-started docs (#45, plus the gh-pages tutorial lineage).
• Tutorials section + Guarded Kubernetes walkthrough — chaptered hands-on tutorials under docs/tutorials/, opening with the ws k8s guard (#113, #115, #119).
• Docs site — docs/gdd/ methodology pages (features tour, trust and safety, permissions, agent training, organization stack, samples, vendor component role) and the ecosystem/CLI/setup reference docs (#53, #55–#57, #66, #70, #86, #93, #99).
• Versioning machinery — SemVer policy for the workspace + ws CLI, this changelog, and the change-note tooling decision record (#97).
• Onboarding hardening — scope-preselected PAT creation links in ws diagnose token misses, ws realm init fork-and-rename guidance for newcomers, .env token-setup docs (#119).
• Codex harness hooks — Codex gets focused PreToolUse counterparts to the Claude hook: a Kubernetes-guard hook (#118) and a workflow-redirect hook that reads the same committed [redirect-commands] rules — redirect policy is shared platform-neutral data, so adding a rule affects both agents without editing either hook; raw gh/glab provider commands gained redirect rows in the same pass (#126).
• ws k8s context-only scope mode — arm just a context with all namespaces in scope, for deep work on a local throwaway cluster where per-namespace scoping is friction without safety (#126).
• Realm activation trust gate — ws realm use shows a trust summary of what the realm brings (repository hosts, adapter commands, credential-mapping requests, MCP endpoints — with URL credentials redacted and terminal control sequences stripped so the summary can't be spoofed) and requires confirmation; --trust covers non-interactive runs and is itself hook ask-gated for agents (#129).
• Shared Git remote validation — clone/realm/hoard URL sinks reject option injection, executable remote-helper syntax (ext::), control characters, unsupported schemes, and filesystem paths (including Windows drive-letter forms) outside explicit local flows; provider-API-returned clone URLs are pinned to the configured source host (#129).
• Kustomize local-only preflight — the k8s guard validates a -k target's whole reference graph (resources, bases, patches incl. legacy JSON6902, generators) as local, non-symlinked, and root-contained before rendering (#129).
• MCP endpoint validation at ws mcp-setup time: absolute HTTP(S) shape required, plain-HTTP-on-nonlocal-host and embedded-credential warnings (#129).
• ws docker wrapper — a scoped passthrough that sets MSYS_NO_PATHCONV=1 for a single docker invocation on Git Bash, replacing the global env toggle that broke every yq/gh path; ws file-path arguments to native CLIs route through cygpath, so ws commands survive either MSYS conversion state (#131).
• ws cr accepts an explicitly selected non-HEAD source branch — a pushed branch from a linked worktree can open a CR without disturbing the canonical checkout. The local and selected remote-tracking tips must match before any provider call, so a stale same-named remote branch cannot open a review of code other than what the operator selected.
• The published post-1.0 roadmap grew dedicated tracks for assisted access and support (PR previews + visual diffs, chat-channel agents, sanitized release/support records, ws share handoffs, guided onboarding) and sandboxed workspaces (containerized, trust-scaled execution).
• Optional shellcheck linting for the workspace's own scripts (#98).

Changed

• Permission allowlist collapsed from per-arg-count ladders to Claude Code's :* prefix form (~200 → ~95 entries), with deliberate pins kept for subcommands whose tightness is intentional (#96).
• ws review side-effect forms (reply, threads … --resolve*) moved behind the hook's ask-tier — outward-facing review actions now always prompt, while read-only triage stays frictionless (#96).
• Resolver renamed ws_validate_component → ws_resolve_target with a kind-neutral miss-message; ws diagnose accepts realm/hoard targets (#94).
• Help handling unified: --help/-h works at every level for every target-taking subcommand (#94).
• ws exec is ask-gated — every invocation requires human approval, with the trust model documented (#110).
• git mv redirects to the plain-mv + bodyfile pattern, which keeps ws commit's declared staging intact (#114).
• docs/dev-setup.md renamed to docs/workspace-setup.md with an onboarding front-door polish pass (#109).
• Hard-wrapped prose de-wrapped workspace-wide per the single-line-paragraph convention (#104).
• Methodology docs consistency pass — the "good-enough" posture named as a first-class design statement, hook-doc altitude dedup, skills-reference taxonomy fix, link-shape cleanups (#120).
• ws realm use without --trust now presents the review as step one of the designed two-step activation flow — summary shown, nothing activated, exact re-run command named — instead of a bare error.
• Newcomer-language pass from fresh-laptop GA testing: the canonical Guardian Driven Development expansion + mutual-guardianship framing at agent eye-level (AGENTS.md, docs index, orientation greeting), Newcomer language rules in the orientation skill (primer before plumbing, "we" not "you", realms introduced as the augment layer, narrow diagrams, roles equip the session), the adapter-in-realm rationale, and a sharpened Thalamus pitch; six further findings recorded as roadmap entries.
• Realm auto-detection removed — with no realm: selector in ecosystem.local.yaml, no realm is active, including the upstream realm-template. Existing workspaces that relied on an implicitly selected realm should run ws realm use <name> once (#129, #130).
• The permission hook anchors all policy (rules files, allowlists, scratch and sensitive paths) to the workspace root instead of walking up from the command cwd; Edit/Write route through the hook, and security-sensitive state (.claude/, .env, ecosystem.local.yaml, hook-bypass markers, agent session files)...