<objective> Update hosts.md with the Muse Code official pages and read date, read the Claude Code, Grok Build, and Hermes Agent official pages cited there, and write the five host snippets plus a decision-note test. Documentation only; no code.

Purpose: Deliver CLI-04 with P6-D8 evidentiary discipline: every snippet field traces to a read official page. Output: Updated hosts.md, five snippet files, and the snippet test. </objective>

<execution_context> @~/.claude/gsd-core/workflows/execute-plan.md @~/.claude/gsd-core/templates/summary.md </execution_context>

<context> @.planning/PROJECT.md @.planning/ROADMAP.md @.planning/phases/06-cli-daemon-and-host-packaging/06-CONTEXT.md </context>

<tasks>

<task type="auto"> <name>Task 1: hosts.md Muse Code update with official URLs and read date (P6-D8)</name> <files>docs/integration/hosts.md</files> <read_first> - docs/integration/hosts.md lines 1-51 (gate table, read date 2026-10-21, official URL lists; Muse Code currently "no official URL was found") - docs/integration/hosts.md lines 111-113 (Muse Code Q1-Q5 not documented) and 133-140 (open questions) </read_first> <action>Fetch and read https://dev.meta.ai/docs/muse-code/ and its linked extending and configuration pages; then update docs/integration/hosts.md per P6-D8: record the exact official URLs reached, the new read date, and the sourced answers (settings.json with schema_version 1 and mcp_servers; stdio and streamable_http transports; plugin model as documented). Change only the Muse Code row, the Muse Code section, the read-date line, and the open-questions entries that the pages answer; leave every other host section byte-identical. Where a page is silent, record not-documented; invent nothing. This task writes no snippet.</action> <acceptance_criteria> - hosts.md names the dev.meta.ai URLs, carries the new read date, and records the settings.json, schema_version, mcp_servers, and transport facts with quotations or close paraphrases - Unchanged host sections are byte-identical to before (verify with git diff scoped to the Muse Code rows) </acceptance_criteria> <verify> <automated>npx tsc -p tsconfig.json && node --test dist/test/docs/host-snippets.test.js</automated> </verify> <done>hosts.md carries the Muse Code official record; other hosts untouched.</done> </task>

<task type="auto"> <name>Task 2: Omp and Muse Code snippets from documented fields (P6-D8, P6-D9)</name> <files>docs/hosts/snippets/omp.md, docs/hosts/snippets/muse-code.md</files> <read_first> - docs/integration/hosts.md (the Task 1 Muse Code update; the only field source for the Muse Code snippet) - docs/integration/omp.md Q1 (mcp.json declaration; the field source for the Omp snippet) - src/mcp/server.ts lines 21-23 (MCP_PROTOCOL_VERSION and server name the snippets point at) </read_first> <action>Write the Omp and Muse Code snippets per P6-D8: each snippet contains only fields documented in its host note (Omp: the mcp.json declaration from omp.md Q1; Muse Code: settings.json shape with schema_version 1 and mcp_servers with stdio and streamable_http transports from the Task 1 record), each pointing at the realm MCP server stdio entry (the realm mcp command, P6-D9), each citing the official URL and read date it was taken from. Any layout the pages do not document is marked not-documented in the snippet, not filled in.</action> <acceptance_criteria> - Both snippets exist, point at the realm mcp stdio entry, cite their official URLs and read dates, and contain no field their host note does not document </acceptance_criteria> <verify> <automated>npx tsc -p tsconfig.json && node --test dist/test/docs/host-snippets.test.js</automated> </verify> <done>Omp and Muse Code snippets written from documented fields only.</done> </task>

<task type="auto"> <name>Task 3: Claude Code, Grok Build, Hermes Agent snippets plus the snippet test (P6-D8)</name> <files>docs/hosts/snippets/claude-code.md, docs/hosts/snippets/grok-build.md, docs/hosts/snippets/hermes-agent.md, test/docs/host-snippets.test.ts</files> <read_first> - docs/integration/hosts.md lines 75-110 (Claude Code, Grok Build, Hermes Agent sections with their official URLs) - test/docs/phase5-notes.test.ts (the decision-note test method to copy: assert exact cited strings, not just presence) </read_first> <action>First read the official pages cited in hosts.md for Claude Code (code.claude.com MCP reference via the Extend page), Grok Build (docs.x.ai skills/plugins page), and Hermes Agent (hermes-agent.nousresearch.com MCP configuration page); then write the three snippets per P6-D8, each giving only the MCP configuration format its official page documents (Hermes: mcp_servers in ~/.hermes/config.yaml with stdio support; Claude Code and Grok Build: only what the fetched pages state, with explicit not-documented markers where the pages are silent, matching the hosts.md "not documented in the pages read" records), each pointing at the realm mcp stdio entry and citing URL plus read date. Then write test/docs/host-snippets.test.ts in the phase5-notes style: it asserts hosts.md records the Muse Code URLs and read date, all five snippet files exist, the Muse Code snippet carries schema_version and mcp_servers, and every snippet cites its official URL; it never fetches the network.</action> <acceptance_criteria> - Three snippets exist with only documented fields and explicit not-documented markers where the pages are silent - The test asserts exact cited strings (schema_version, mcp_servers, Muse Code URLs, read date), not just file presence </acceptance_criteria> <verify> <automated>npx tsc -p tsconfig.json && node --test dist/test/docs/host-snippets.test.js</automated> </verify> <done>Three snippets plus the evidentiary test complete; no field invented.</done> </task>

</tasks>

<threat_model>

Trust Boundaries

Boundary	Description
official page text -> hosts.md	Page text crosses into the repo record; URLs and read dates pin exactly what was read
hosts.md -> snippets	Only documented fields cross; anything unconfirmed is marked, never filled in

STRIDE Threat Register

Threat ID	Category	Component	Severity	Disposition	Mitigation Plan
T-06-04	T (Tampering)	docs/hosts/snippets/*.md	medium	mitigate	Every snippet field traces to a cited official URL plus read date; the test asserts the exact strings so an invented field fails the suite (P6-D8)
T-06-05	I (Information Disclosure)	docs/hosts/snippets/*.md	low	mitigate	Snippets carry only the stdio entry invocation; no token, secret, or host path appears in any snippet
</threat_model>

<verification> npx tsc -p tsconfig.json && node --test dist/test/docs/host-snippets.test.js; git diff --stat docs/integration/hosts.md shows only Muse Code rows changed. </verification>

<success_criteria> hosts.md updated with Muse Code sources and read date; five snippets exist, each matching its host note with only documented fields; the evidentiary test passes. </success_criteria>

Artifacts this phase produces (contribution of this plan)

• docs/integration/hosts.md (extended): Muse Code official URLs, read date, and sourced Q1–Q5 answers (P6-D8).
• docs/hosts/snippets/ (new): five host snippets pointing at the realm mcp stdio entry (P6-D8, P6-D9).
• test/docs/host-snippets.test.ts (new): CLI-04 evidentiary assertions.

<output> Create .planning/phases/06-cli-daemon-and-host-packaging/06-02-SUMMARY.md when done </output>