GDS Agent Repository Estate

GDS is the agent-first control plane for the NDDev-it-com and rldyourmnd repository estate. It separates repository identity, logical classification, Git topology, device placement, observed state, and agent context so none of those concerns is inferred from a directory tree.

Canonical model

canonical source
  -> deterministic policy and context compiler
  -> immutable bundle and repository-local projections
  -> profiled agent harness adapters
  -> plan / approval / apply / verify / journal

• Reusable implementation lives in core/, policies/, schemas/, skills/canonical/, harnesses/, and templates/.
• Estate-specific intent lives in estate/.
• This repository owns its facts in .gds/repository.yaml.
• Generated files are AGENTS.md, .claude/CLAUDE.md, .gds/compiled-policy.json, .gds/bundle.lock.yaml, and the declared thin reusable-workflow caller under .github/workflows/.
• Device placement is declared in estate/devices/; workspace directories are locators, not Git parents or policy boundaries.
• Runtime observations and operation journals live under XDG state, never in tracked desired configuration.
• One device-local XDG registration binds every independent checkout to this control plane by stable repository ID and exact anchor digest; it is a locator, not a second policy source.

The former nddev-monorepo, forks-monorepo, and rldyourmnd-monorepo metadata repositories are not part of the active topology. Their migration evidence is retained in docs/migration/.

Local development

GOTOOLCHAIN=go1.26.5 go build -trimpath -o /tmp/gds ./core/cmd/gds
GOTOOLCHAIN=go1.26.5 go build -trimpath -o /tmp/gds-codex-runtime-driver \
  ./core/cmd/gds-codex-runtime-driver
/tmp/gds --json context
/tmp/gds --json status
/tmp/gds --json validate
/tmp/gds --json generate repository --check
/tmp/gds --json workspace audit \
  --root "$HOME/Developer" \
  --root "$HOME/Desktop/github" \
  --device estate/devices/rldyourmnd-mac2.yaml
/tmp/gds --json workspace register-estate --plan \
  --device-id device_01KX817TGDBHTE66KZS0AT8BEZ \
  --session-id device-bootstrap

The CLI is JSON-first and fail-closed. Read-only commands do not refresh or integrate Git refs. Every enabled mutation uses an exact stored plan, scoped approval evidence, precondition recheck, verification, and an append-only journal.

workspace audit distinguishes standalone checkouts from embedded Git submodules. Device selectors govern standalone targets; embedded modules are validated against their Git-reported superproject and typed git-submodule-consumer relationship instead of being misclassified as top-level placement drift.

Verification

scripts/validate_go_core.sh
scripts/validate_assurance.sh
scripts/validate_release.sh
uv run --with-requirements requirements/test.txt --with pytest-cov python -m pytest
tools/test-sync.sh

validate_release.sh is intentionally stricter than the development gate: it also runs the source-bound 2000-repository assurance scenario, requires current source evidence, and requires passing recorded runtime contracts for all ten supported harness profiles before any artifact can be attested.

tools/test-sync.sh is a hermetic parity gate for the quarantined pre-GDS engine. The legacy engine cannot run against a real workspace.

Architecture, contracts, migration evidence, and the remaining acceptance order are in docs/architecture/, docs/contracts/, and docs/migration/.