
Security News
Federal Audit Finds NIST Wasted Funds With No Plan to Clear NVD Backlog
Federal audit finds NIST lacked a plan to clear the NVD backlog, wasted funds on duplicate work, and delayed use of CISA data.
AI orchestration tool for Claude Code — GSD management shell + Superpowers quality core
Get Shit Done — AI orchestration for Claude Code
GSD-Lite is an AI orchestration tool for Claude Code. It combines structured project management with built-in quality discipline: TDD enforcement, anti-rationalization guards, multi-level code review, and automatic failure recovery — all driven by a 12-state workflow machine that keeps multi-phase projects on track.
Discuss thoroughly, execute automatically. Have as many rounds of requirement discussion as needed. Once the plan is approved, GSD-Lite auto-executes: coding, self-review, independent review, verification, and phase advancement — with minimal human intervention.
planning → executing_task → reviewing_task → reviewing_phase → completed with precise transitions, persistent to state.jsonUser → discuss + research (confirm requirements) → approve plan → auto-execute
↑ ↑ ↑
Interaction 1 Interaction 2 Autonomous execution
(code→review→verify→advance)
| Command | Purpose |
|---|---|
/gsd:start | Interactive start — discuss requirements, research, plan, then auto-execute |
/gsd:prd <input> | Start from a requirements doc or description text |
/gsd:resume | Resume execution from saved state with workspace validation |
/gsd:status | View project progress dashboard (derived from canonical state fields) |
/gsd:stop | Save state and pause execution |
/gsd:doctor | Diagnostic checks on GSD-Lite installation and project health |
| Agent | Role | Built-in Discipline |
|---|---|---|
| executor | Execute a single task (TDD + self-review + checkpoint) | Iron Law + Red Flags + Deviation Rules |
| reviewer | Two-stage review (spec check → quality check) | Independent verification + Hard Gates |
| researcher | Ecosystem research (Context7 → official docs → web) | Confidence scoring + TTL |
| debugger | 4-phase systematic root cause analysis | Root Cause Iron Law |
| Workflow | Purpose |
|---|---|
tdd-cycle | RED-GREEN-REFACTOR TDD cycle enforcement |
review-cycle | Two-level review gates and accept/rework decisions |
debugging | 4-phase root cause analysis process |
research | Research with confidence scoring and TTL expiration |
deviation-rules | Anti-rationalization guards and red-flag checklists |
execution-flow | Complete task execution cycle from dispatch to checkpoint |
| Tool | Purpose |
|---|---|
health | Server status and state existence check |
state-init | Initialize .gsd/ directory with project structure |
state-read | Read state with optional field filtering |
state-update | Update canonical fields with lifecycle validation |
state-patch | Incrementally modify plan (add/remove/reorder tasks, update fields, add dependencies) |
phase-complete | Complete a phase after verifying handoff gates |
orchestrator-resume | Resume orchestration from current state |
orchestrator-handle-executor-result | Process executor output, advance lifecycle |
orchestrator-handle-reviewer-result | Process review, trigger accept/rework |
orchestrator-handle-researcher-result | Store research artifacts and decisions |
orchestrator-handle-debugger-result | Process root cause analysis, re-dispatch executor |
| Reference | Content |
|---|---|
execution-loop | 9-step execution loop specification (single source of truth) |
review-classification | Review level classification decision tree (L0/L1/L2) |
evidence-spec | Evidence validation and citation rules |
state-diagram | 12-state lifecycle workflow machine diagram |
testing-patterns | Test structure and patterns |
anti-rationalization-full | Full red-flag checklist for agents |
git-worktrees | Git worktree isolation strategy |
questioning | Requirements clarification patterns |
# Step 1: Add the marketplace
/plugin marketplace add sdsrss/gsd-lite
# Step 2: Install the plugin
/plugin install gsd
Automatically registers all commands, agents, workflows, MCP server, hooks, and auto-update. Run these commands inside a Claude Code session.
npx gsd-lite install
git clone https://github.com/sdsrss/gsd-lite.git
cd gsd-lite && npm install && node cli.js install
Methods 2 & 3 write components to ~/.claude/ and register the MCP server in settings.json.
The installer copies commands, agents, workflows, references, and hooks to ~/.claude/, and sets up the MCP server runtime in ~/.claude/gsd/.
Uninstall: node cli.js uninstall or npx gsd-lite uninstall
# Plugin (auto-update checks GitHub Releases every 24h)
/plugin update gsd
# npx
npx gsd-lite install
# Manual
git pull && npm install && node cli.js install
/gsd:start
GSD-Lite will:
# From a requirements document
/gsd:prd docs/requirements.md
# From a description
/gsd:prd "Build a REST API with JWT auth, rate limiting, and PostgreSQL"
/gsd:resume
Validates workspace consistency (git HEAD, file integrity), then resumes from the exact task and workflow mode where execution stopped.
/gsd:status
Shows phase completion, task lifecycle states, review status, and blockers — all derived from canonical state fields in real-time.
1. orchestrator-resume → determines next action
2. dispatch executor → runs task with TDD discipline
3. executor checkpoints → saves work + evidence
4. dispatch reviewer → independent spec + quality review
5. reviewer accepts → task done, schedule next
reviewer rejects → rework with specific feedback
6. all tasks done → phase handoff gate check
7. gate passes → advance to next phase
8. all phases done → project complete
executor fails (attempt 1) → retry with context
executor fails (attempt 2) → retry with accumulated context
executor fails (attempt 3) → dispatch debugger
debugger analyzes → root cause + fix direction
executor retries → with debugger guidance injected
All state lives in .gsd/state.json — a single source of truth with:
_version field with VERSION_CONFLICT detection)| Dimension | GSD | GSD-Lite |
|---|---|---|
| Commands | 32 | 6 |
| Agents | 12 | 4 |
| Source files | 100+ | ~15 |
| Installer | 2465 lines | ~290 lines |
| User interactions | 6+ confirmations | Typically 2 |
| TDD / Anti-rationalization | No | Yes |
| State machine recovery | Partial | Full (12 modes) |
| Evidence-based verification | No | Yes |
| Auto-update | No | Yes |
| Context health monitoring | No | Yes |
gsd-lite/
├── src/ # MCP Server + tools (15 source files)
│ ├── server.js # MCP Server entry (11 tools + version drift detection)
│ ├── schema.js # State schema + lifecycle validation + incremental validation
│ ├── utils.js # Shared utilities (atomic writes, git, file lock)
│ └── tools/
│ ├── state/ # State management (modular)
│ │ ├── constants.js # Error codes, lock infrastructure
│ │ ├── crud.js # CRUD operations + plan patching
│ │ ├── logic.js # Task scheduling, propagation, research
│ │ └── index.js # Re-exports
│ ├── orchestrator/ # Orchestration logic (modular)
│ │ ├── helpers.js # Shared constants, preflight, dispatch
│ │ ├── resume.js # Workflow resume state machine (12 modes)
│ │ ├── executor.js # Executor result handler
│ │ ├── reviewer.js # Reviewer result handler
│ │ ├── debugger.js # Debugger result handler
│ │ ├── researcher.js # Researcher result handler
│ │ └── index.js # Re-exports
│ └── verify.js # lint/typecheck/test verification
├── commands/ # 6 slash commands (start, prd, resume, status, stop, doctor)
├── agents/ # 4 subagent prompts (executor, reviewer, researcher, debugger)
├── workflows/ # 6 core workflows (TDD, review, debug, research, deviation, execution-flow)
├── references/ # 8 reference docs (execution-loop, state-diagram, evidence-spec, etc.)
├── hooks/ # Session lifecycle hooks
│ ├── gsd-auto-update.cjs # Auto-update from GitHub Releases (24h check interval)
│ ├── gsd-context-monitor.cjs # Real-time context health monitoring
│ ├── gsd-session-init.cjs # Session initialization + CLAUDE.md status injection
│ ├── gsd-session-stop.cjs # Graceful shutdown with crash markers
│ ├── gsd-statusline.cjs # StatusLine display (composite-aware)
│ └── lib/ # Shared hook utilities (gsd-finder, composite statusline, semver)
├── tests/ # 972 tests (unit + simulation + E2E integration)
├── cli.js # Install/uninstall CLI entry
├── install.js # Installation script (plugin-aware, idempotent)
└── uninstall.js # Uninstall script
npm test # Run all 972 tests
npm run test:coverage # Tests + coverage report (94%+ lines, 83%+ branches)
npm run lint # Biome lint
node --test tests/file.js # Run a single test file
MIT
FAQs
AI orchestration tool for Claude Code — GSD management shell + Superpowers quality core
The npm package gsd-lite receives a total of 216 weekly downloads. As such, gsd-lite popularity was classified as not popular.
We found that gsd-lite demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Federal audit finds NIST lacked a plan to clear the NVD backlog, wasted funds on duplicate work, and delayed use of CISA data.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.

Research
/Security News
The North Korean malware loader hides in a Packagist-listed package and its GitHub branch to fetch and execute remote code in a likely Contagious Interview-style lure.