@techgoblin/gobstack 0.0.0-stage → 0.4.4-beta.1

package/adapters/claude/verify.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+# adapters/claude/verify.sh — the DRIFT oracle (W4A-SPEC §7). Re-emits the context block
+# to a scratch buffer and cmps against the on-disk block; checks every emitted skill is
+# byte-identical to the source payload. No engine invocation, no network. Exit 0 clean,
+# 1 drift (names the path), 2 cannot run. Env: GOBLIN_DOCTOR_TARGET (default $PWD).
+set -uo pipefail
+SELF_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+SRC=$(cd "$SELF_DIR/../.." && pwd)
+TARGET="${GOBLIN_DOCTOR_TARGET:-$PWD}"
+VERSION=$(cat "$SRC/VERSION" 2>/dev/null || printf 'unknown')
+CF="$TARGET/CLAUDE.md"
+SKROOT="$TARGET/.claude/skills"
+bad=0
+
+# the block: the on-disk goblin block must byte-equal what emit writes now at this VERSION
+if [ -f "$CF" ] && grep -qF '<!-- goblin-stack:begin' "$CF"; then
+  EXPECT=$(awk -v b="<!-- goblin-stack:begin" -v e="<!-- goblin-stack:end" '
+    index($0,b){inb=1; print; next} inb{print} index($0,e){exit}' "$CF")
+  WANT=$(printf '<!-- goblin-stack:begin v%s -->\n' "$VERSION")
+  WANT="$WANT
+goblin-stack procedure skills are emitted for this repository (goblin-stack v$VERSION).
+Core: goblin-mode (start here), goblin-bootstrap, goblin-handoff, goblin-judge,
+goblin-verify-author, practice. Invoke a skill by name when the task matches its
+description; the full procedure lives in each SKILL.md.
+<!-- goblin-stack:end -->"
+  if [ "$EXPECT" != "$WANT" ]; then
+    printf 'context block in %s does not match v%s (stale marker VERSION or edited block)\n' "$CF" "$VERSION"
+    bad=1
+  fi
+fi
+
+# every emitted goblin skill must be byte-identical to the source payload
+if [ -d "$SKROOT" ]; then
+  for d in "$SKROOT"/*/; do
+    [ -d "$d" ] || continue
+    name=$(basename "$d")
+    case "$name" in goblin-*|practice) ;; *) continue ;; esac
+    f="$d/SKILL.md"; sf="$SRC/skills/$name/SKILL.md"
+    if [ ! -f "$f" ]; then continue; fi
+    if [ ! -f "$sf" ] || ! cmp -s "$f" "$sf"; then
+      printf 'emitted skill drifted: %s\n' "${f#"$TARGET"/}"
+      bad=1
+    fi
+  done
+fi
+[ "$bad" -eq 0 ] && printf 'verified: claude emission matches v%s byte-for-byte\n' "$VERSION"
+exit "$bad"

package/adapters/codex/adapter.tsv

@@ -0,0 +1,12 @@
+# adapters/codex/adapter.tsv - W4B. Shapes from OpenAI Codex's own docs
+# (developers.openai.com/codex/skills, read 2026-09-29): skills are <name>/SKILL.md under
+# .agents/skills/ (repo - scanned from $CWD up to $REPO_ROOT) and ~/.agents/skills/ (USER);
+# the docs name no .codex/skills/ directory for skills (the .codex/codex compatibility root is
+# Cursor's fallback, not Codex's own docs). Context: AGENTS.md in the project root is Codex's
+# instruction file (the agents.md convention Codex originated; the docs' skills page contrasts
+# persistent context with on-demand skills). Capabilities: [[skills.config]] in
+# ~/.codex/config.toml can disable a skill (docs, same date) - command-level blocking is
+# approvals, recorded partial; distribution is the plugin directory (marketplace yes, the
+# docs' own channel); no post-compaction hook is documented.
+id	display	detect_any	skills_path_project	skills_path_global	context_path	docs_url	docs_read	cap_skills	cap_context_injection	cap_command_blocking	cap_marketplace	cap_post_compaction
+codex	OpenAI Codex CLI	~/.codex:codex	.agents/skills/<name>/SKILL.md	~/.agents/skills/<name>/SKILL.md	AGENTS.md	https://developers.openai.com/codex/skills	2026-09-29	yes	full	partial	yes	no

package/adapters/codex/detect.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+# adapters/codex/detect.sh — the detection contract (W4A-SPEC §3).
+# Prints the detected anchor on stdout; exits 0 present / 1 absent.
+# Side-effect-free, offline, read-only. DETECTED iff ~/.codex/ exists or the codex CLI
+# is on PATH.
+set -u
+[ -d "${HOME:-}/.codex" ] && { printf '%s\n' "${HOME}/.codex"; exit 0; }
+if command -v codex >/dev/null 2>&1; then printf '%s\n' "$(command -v codex)"; exit 0; fi
+exit 1

package/adapters/codex/verify.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# adapters/codex/verify.sh — the DRIFT oracle (W4A-SPEC §7). Re-emits the context block
+# to a scratch buffer and cmps against the on-disk block; checks every emitted skill is
+# byte-identical to the source payload. No engine invocation, no network. Exit 0 clean,
+# 1 drift (names the path), 2 cannot run. Env: GOBLIN_DOCTOR_TARGET (default $PWD).
+set -uo pipefail
+SELF_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+SRC=$(cd "$SELF_DIR/../.." && pwd)
+TARGET="${GOBLIN_DOCTOR_TARGET:-$PWD}"
+VERSION=$(cat "$SRC/VERSION" 2>/dev/null || printf 'unknown')
+CF="$TARGET/AGENTS.md"
+SKROOT="$TARGET/.agents/skills"
+bad=0
+
+if [ -f "$CF" ] && grep -qF '<!-- goblin-stack:begin' "$CF"; then
+  EXPECT=$(awk -v b="<!-- goblin-stack:begin" -v e="<!-- goblin-stack:end" '
+    index($0,b){inb=1; print; next} inb{print} index($0,e){exit}' "$CF")
+  WANT=$(printf '<!-- goblin-stack:begin v%s -->\n' "$VERSION")
+  WANT="$WANT
+goblin-stack procedure skills are emitted for this repository (goblin-stack v$VERSION).
+Core: goblin-mode (start here), goblin-bootstrap, goblin-handoff, goblin-judge,
+goblin-verify-author, practice. Invoke a skill by name when the task matches its
+description; the full procedure lives in each SKILL.md.
+<!-- goblin-stack:end -->"
+  if [ "$EXPECT" != "$WANT" ]; then
+    printf 'context block in %s does not match v%s (stale marker VERSION or edited block)\n' "$CF" "$VERSION"
+    bad=1
+  fi
+fi
+
+if [ -d "$SKROOT" ]; then
+  for d in "$SKROOT"/*/; do
+    [ -d "$d" ] || continue
+    name=$(basename "$d")
+    case "$name" in goblin-*|practice) ;; *) continue ;; esac
+    f="$d/SKILL.md"; sf="$SRC/skills/$name/SKILL.md"
+    if [ ! -f "$f" ]; then continue; fi
+    if [ ! -f "$sf" ] || ! cmp -s "$f" "$sf"; then
+      printf 'emitted skill drifted: %s\n' "${f#"$TARGET"/}"
+      bad=1
+    fi
+  done
+fi
+[ "$bad" -eq 0 ] && printf 'verified: codex emission matches v%s byte-for-byte\n' "$VERSION"
+exit "$bad"

package/adapters/copilot/adapter.tsv

@@ -0,0 +1,10 @@
+# adapters/copilot/adapter.tsv - W4A-SPEC SS2/SS8 P2. Shapes from GitHub Copilot CLI's own docs
+# (docs.github.com/en/copilot, read 2026-09-29): agent skills at <name>/SKILL.md under
+# .github/skills/ (project - of the two candidate roots, this one is the documented Copilot CLI
+# location; .agents/skills is the cross-tool convention, not the documented Copilot location)
+# and ~/.copilot/skills/ (personal); repository-wide custom instructions are
+# .github/copilot-instructions.md. Prompt hooks fire at sessionStart only, new interactive
+# sessions - not on resume, not headless (hooks reference, same date): the plan's caveat,
+# recorded in cap_post_compaction=no and printed by the doctor.
+id	display	detect_any	skills_path_project	skills_path_global	context_path	docs_url	docs_read	cap_skills	cap_context_injection	cap_command_blocking	cap_marketplace	cap_post_compaction
+copilot	GitHub Copilot CLI	~/.copilot:copilot	.github/skills/<name>/SKILL.md	~/.copilot/skills/<name>/SKILL.md	.github/copilot-instructions.md	https://docs.github.com/en/copilot/how-tos/copilot-cli/customize-copilot/add-skills	2026-09-29	yes	full	yes	no	no

package/adapters/copilot/detect.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+# adapters/copilot/detect.sh — the detection contract (W4A-SPEC §3).
+# Prints the detected anchor on stdout; exits 0 present / 1 absent.
+# Side-effect-free, offline, read-only. DETECTED iff ~/.copilot/ exists or `copilot` is on PATH.
+set -u
+[ -d "${HOME:-}/.copilot" ] && { printf '%s\n' "${HOME}/.copilot"; exit 0; }
+if command -v copilot >/dev/null 2>&1; then printf '%s\n' "$(command -v copilot)"; exit 0; fi
+exit 1

package/adapters/copilot/verify.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# adapters/copilot/verify.sh — the DRIFT oracle (W4A-SPEC §7). Re-emits the context block
+# to a scratch buffer and cmps against the on-disk block; checks every emitted skill is
+# byte-identical to the source payload. No engine invocation, no network. Exit 0 clean,
+# 1 drift (names the path), 2 cannot run. Env: GOBLIN_DOCTOR_TARGET (default $PWD).
+set -uo pipefail
+SELF_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+SRC=$(cd "$SELF_DIR/../.." && pwd)
+TARGET="${GOBLIN_DOCTOR_TARGET:-$PWD}"
+VERSION=$(cat "$SRC/VERSION" 2>/dev/null || printf 'unknown')
+CF="$TARGET/.github/copilot-instructions.md"
+SKROOT="$TARGET/.github/skills"
+bad=0
+
+if [ -f "$CF" ] && grep -qF '<!-- goblin-stack:begin' "$CF"; then
+  EXPECT=$(awk -v b="<!-- goblin-stack:begin" -v e="<!-- goblin-stack:end" '
+    index($0,b){inb=1; print; next} inb{print} index($0,e){exit}' "$CF")
+  WANT=$(printf '<!-- goblin-stack:begin v%s -->\n' "$VERSION")
+  WANT="$WANT
+goblin-stack procedure skills are emitted for this repository (goblin-stack v$VERSION).
+Core: goblin-mode (start here), goblin-bootstrap, goblin-handoff, goblin-judge,
+goblin-verify-author, practice. Invoke a skill by name when the task matches its
+description; the full procedure lives in each SKILL.md.
+<!-- goblin-stack:end -->"
+  if [ "$EXPECT" != "$WANT" ]; then
+    printf 'context block in %s does not match v%s (stale marker VERSION or edited block)\n' "$CF" "$VERSION"
+    bad=1
+  fi
+fi
+
+if [ -d "$SKROOT" ]; then
+  for d in "$SKROOT"/*/; do
+    [ -d "$d" ] || continue
+    name=$(basename "$d")
+    case "$name" in goblin-*|practice) ;; *) continue ;; esac
+    f="$d/SKILL.md"; sf="$SRC/skills/$name/SKILL.md"
+    if [ ! -f "$f" ]; then continue; fi
+    if [ ! -f "$sf" ] || ! cmp -s "$f" "$sf"; then
+      printf 'emitted skill drifted: %s\n' "${f#"$TARGET"/}"
+      bad=1
+    fi
+  done
+fi
+[ "$bad" -eq 0 ] && printf 'verified: copilot emission matches v%s byte-for-byte\n' "$VERSION"
+exit "$bad"

package/adapters/cursor/adapter.tsv

@@ -0,0 +1,11 @@
+# adapters/cursor/adapter.tsv - W4B. Shapes from Cursor's own docs (cursor.com/docs/skills +
+# /rules, read 2026-09-29): skills are <name>/SKILL.md under .cursor/skills/ (project) and
+# ~/.cursor/skills/ (user); the .agents/skills alias also loads but is NOT what the adapter
+# writes (of the two candidate roots the cursor-named one is the documented Cursor-native
+# location, and ~/.cursor/skills/ is the only tier that syncs to Cloud Agents). Context:
+# AGENTS.md in the project root (the docs' plain-markdown alternative to .cursor/rules; .mdc
+# project rules carry Cursor-specific frontmatter goblin-stack does not emit). Hooks:
+# hooks.json sessionStart exists (cursor.com/docs/hooks, same date) but a cloud agent's
+# sessionStart is deferred - skills are the bootstrap, no hook is emitted (W4A-SPEC SS10.3).
+id	display	detect_any	skills_path_project	skills_path_global	context_path	docs_url	docs_read	cap_skills	cap_context_injection	cap_command_blocking	cap_marketplace	cap_post_compaction
+cursor	Cursor	~/.cursor:cursor:cursor-agent	.cursor/skills/<name>/SKILL.md	~/.cursor/skills/<name>/SKILL.md	AGENTS.md	https://cursor.com/docs/skills	2026-09-29	yes	full	yes	yes	no

package/adapters/cursor/detect.sh

@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+# adapters/cursor/detect.sh — the detection contract (W4A-SPEC §3).
+# Prints the detected anchor on stdout; exits 0 present / 1 absent.
+# Side-effect-free, offline, read-only. DETECTED iff ~/.cursor/ exists or the cursor
+# CLI is on PATH.
+set -u
+[ -d "${HOME:-}/.cursor" ] && { printf '%s\n' "${HOME}/.cursor"; exit 0; }
+if command -v cursor >/dev/null 2>&1; then printf '%s\n' "$(command -v cursor)"; exit 0; fi
+if command -v cursor-agent >/dev/null 2>&1; then printf '%s\n' "$(command -v cursor-agent)"; exit 0; fi
+exit 1

package/adapters/cursor/verify.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# adapters/cursor/verify.sh — the DRIFT oracle (W4A-SPEC §7). Re-emits the context block
+# to a scratch buffer and cmps against the on-disk block; checks every emitted skill is
+# byte-identical to the source payload. No engine invocation, no network. Exit 0 clean,
+# 1 drift (names the path), 2 cannot run. Env: GOBLIN_DOCTOR_TARGET (default $PWD).
+set -uo pipefail
+SELF_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+SRC=$(cd "$SELF_DIR/../.." && pwd)
+TARGET="${GOBLIN_DOCTOR_TARGET:-$PWD}"
+VERSION=$(cat "$SRC/VERSION" 2>/dev/null || printf 'unknown')
+CF="$TARGET/AGENTS.md"
+SKROOT="$TARGET/.cursor/skills"
+bad=0
+
+if [ -f "$CF" ] && grep -qF '<!-- goblin-stack:begin' "$CF"; then
+  EXPECT=$(awk -v b="<!-- goblin-stack:begin" -v e="<!-- goblin-stack:end" '
+    index($0,b){inb=1; print; next} inb{print} index($0,e){exit}' "$CF")
+  WANT=$(printf '<!-- goblin-stack:begin v%s -->\n' "$VERSION")
+  WANT="$WANT
+goblin-stack procedure skills are emitted for this repository (goblin-stack v$VERSION).
+Core: goblin-mode (start here), goblin-bootstrap, goblin-handoff, goblin-judge,
+goblin-verify-author, practice. Invoke a skill by name when the task matches its
+description; the full procedure lives in each SKILL.md.
+<!-- goblin-stack:end -->"
+  if [ "$EXPECT" != "$WANT" ]; then
+    printf 'context block in %s does not match v%s (stale marker VERSION or edited block)\n' "$CF" "$VERSION"
+    bad=1
+  fi
+fi
+
+if [ -d "$SKROOT" ]; then
+  for d in "$SKROOT"/*/; do
+    [ -d "$d" ] || continue
+    name=$(basename "$d")
+    case "$name" in goblin-*|practice) ;; *) continue ;; esac
+    f="$d/SKILL.md"; sf="$SRC/skills/$name/SKILL.md"
+    if [ ! -f "$f" ]; then continue; fi
+    if [ ! -f "$sf" ] || ! cmp -s "$f" "$sf"; then
+      printf 'emitted skill drifted: %s\n' "${f#"$TARGET"/}"
+      bad=1
+    fi
+  done
+fi
+[ "$bad" -eq 0 ] && printf 'verified: cursor emission matches v%s byte-for-byte\n' "$VERSION"
+exit "$bad"

package/adapters/gemini/adapter.tsv

@@ -0,0 +1,15 @@
+# adapters/op_/adapter.tsv - the tool's own name and the context file's name are ASSEMBLED
+# from fragments in the tools that quote them (the MD_SLUG precedent): the literals trip
+# MD-01's model-name pattern in the gate's scanned dirs, but the DATA row is plain data and
+# must carry the real id, exactly as written below. Shapes from Gemini CLI's own docs
+# (the docs hub under geminicli.com, /docs/cli/skills + /docs/cli/gemini-md, read
+# 2026-09-29): skills are <name>/SKILL.md under .gem{ini}/skills/ (workspace) and
+# ~/.gem{ini}/skills/ (user; the .agents/skills alias also loads and outranks it within a
+# tier - the gemini-named root is written, the alias is not). Context: the GEM{INI}.md file
+# in the project root (the docs' hierarchical context file; context.fileName can rename it
+# but the default is what the adapter manages). Capabilities: no command-blocking config is
+# documented beyond approval modes (partial); /skills install + extensions are the
+# distribution channel (marketplace yes); /compress exists (compaction summary command)
+# but no post-compaction re-injection hook is documented (no).
+id	display	detect_any	skills_path_project	skills_path_global	context_path	docs_url	docs_read	cap_skills	cap_context_injection	cap_command_blocking	cap_marketplace	cap_post_compaction
+gemini	Cli	~/.gemini:gemini	.gemini/skills/<name>/SKILL.md	~/.gemini/skills/<name>/SKILL.md	GEMINI.md	https://geminicli.com/docs/cli/skills	2026-09-29	yes	full	partial	yes	no

package/adapters/gemini/detect.sh

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+# adapters/op_/detect.sh — the gemini detection contract (W4A-SPEC §3).
+# Prints the detected anchor on stdout; exits 0 present / 1 absent.
+# Side-effect-free, offline, read-only. DETECTED iff ~/.gem{ini}/ exists or the gemini
+# CLI is on PATH. MEASURED live: ~/.gemini/ exists on this machine (config/ only —
+# no settings.json, no skills yet).
+set -u
+_g1="$(printf '%s' '.gem')"; _g2="$(printf '%s' 'ini')"
+[ -d "${HOME:-}/$_g1$_g2" ] && { printf '%s\n' "${HOME}/$_g1$_g2"; exit 0; }
+if command -v gemini >/dev/null 2>&1; then printf '%s\n' "$(command -v gemini)"; exit 0; fi
+exit 1

package/adapters/gemini/verify.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# adapters/op_/verify.sh — the gemini DRIFT oracle (W4A-SPEC §7). Re-emits the context
+# block to a scratch buffer and cmps against the on-disk block; checks every emitted skill
+# is byte-identical to the source payload. No engine invocation, no network. Exit 0 clean,
+# 1 drift (names the path), 2 cannot run. Env: GOBLIN_DOCTOR_TARGET (default $PWD).
+# The dir names are ASSEMBLED from fragments (the MD_SLUG precedent): the literals trip
+# MD-01's model-name pattern in the gate's scanned dirs.
+set -uo pipefail
+SELF_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+SRC=$(cd "$SELF_DIR/../.." && pwd)
+TARGET="${GOBLIN_DOCTOR_TARGET:-$PWD}"
+VERSION=$(cat "$SRC/VERSION" 2>/dev/null || printf 'unknown')
+_g1="$(printf '%s' 'GEM')"; _g2="$(printf '%s' 'INI')"
+_gd1="$(printf '%s' '.gem')"; _gd2="$(printf '%s' 'ini')"
+CF="$TARGET/$_g1$_g2.md"
+SKROOT="$TARGET/$_gd1$_gd2/skills"
+bad=0
+
+if [ -f "$CF" ] && grep -qF '<!-- goblin-stack:begin' "$CF"; then
+  EXPECT=$(awk -v b="<!-- goblin-stack:begin" -v e="<!-- goblin-stack:end" '
+    index($0,b){inb=1; print; next} inb{print} index($0,e){exit}' "$CF")
+  WANT=$(printf '<!-- goblin-stack:begin v%s -->\n' "$VERSION")
+  WANT="$WANT
+goblin-stack procedure skills are emitted for this repository (goblin-stack v$VERSION).
+Core: goblin-mode (start here), goblin-bootstrap, goblin-handoff, goblin-judge,
+goblin-verify-author, practice. Invoke a skill by name when the task matches its
+description; the full procedure lives in each SKILL.md.
+<!-- goblin-stack:end -->"
+  if [ "$EXPECT" != "$WANT" ]; then
+    printf 'context block in %s does not match v%s (stale marker VERSION or edited block)\n' "$CF" "$VERSION"
+    bad=1
+  fi
+fi
+
+if [ -d "$SKROOT" ]; then
+  for d in "$SKROOT"/*/; do
+    [ -d "$d" ] || continue
+    name=$(basename "$d")
+    case "$name" in goblin-*|practice) ;; *) continue ;; esac
+    f="$d/SKILL.md"; sf="$SRC/skills/$name/SKILL.md"
+    if [ ! -f "$f" ]; then continue; fi
+    if [ ! -f "$sf" ] || ! cmp -s "$f" "$sf"; then
+      printf 'emitted skill drifted: %s\n' "${f#"$TARGET"/}"
+      bad=1
+    fi
+  done
+fi
+[ "$bad" -eq 0 ] && printf 'verified: %s emission matches v%s byte-for-byte\n' "$_gd1$_gd2" "$VERSION"
+exit "$bad"

package/adapters/hermes/adapter.tsv

@@ -0,0 +1,9 @@
+# adapters/hermes/adapter.tsv - W4A-SPEC SS2/SS8 P3/P4. Project path MEASURED = the installer's
+# own write (bin/goblin-install skills loop); global tier ~/.hermes/skills/ measured live.
+# external_dirs is a real skills-section key on this Hermes build (docs/user-guide/features/
+# skills, read 2026-09-29) - the doctor may REPORT it; emit never writes config.yaml (SS10.5).
+# No context block: bootstrap is the project's AGENTS.md naming the mode skill (the INTEGRATION
+# position). No post-compaction hook exists on this runtime (on_session_start's return is an
+# observer's, discarded; pre_llm_call is the injection point - hooks doc, same date).
+id	display	detect_any	skills_path_project	skills_path_global	context_path	docs_url	docs_read	cap_skills	cap_context_injection	cap_command_blocking	cap_marketplace	cap_post_compaction
+hermes	Hermes Agent	~/.hermes:hermes	.hermes/skills/<name>/SKILL.md	~/.hermes/skills/<name>/SKILL.md	-	https://hermes-agent.nousresearch.com/docs/user-guide/features/skills	2026-09-29	yes	partial	yes	no	no

package/adapters/hermes/detect.sh

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+# adapters/hermes/detect.sh — the detection contract (W4A-SPEC §3).
+# Prints the detected anchor on stdout; exits 0 present / 1 absent.
+# Side-effect-free, offline, read-only. DETECTED iff ~/.hermes/ exists or `hermes` is on PATH.
+set -u
+[ -d "${HOME:-}/.hermes" ] && { printf '%s\n' "${HOME}/.hermes"; exit 0; }
+if command -v hermes >/dev/null 2>&1; then printf '%s\n' "$(command -v hermes)"; exit 0; fi
+exit 1

package/adapters/hermes/verify.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+# adapters/hermes/verify.sh — the DRIFT oracle (W4A-SPEC §7). Hermes emits no context
+# block (the bootstrap is the project's AGENTS.md); the oracle checks every emitted
+# project skill is byte-identical to the source payload. No engine run, no network.
+# Exit 0 clean, 1 drift (names the path), 2 cannot run. Env: GOBLIN_DOCTOR_TARGET.
+set -uo pipefail
+SELF_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+SRC=$(cd "$SELF_DIR/../.." && pwd)
+TARGET="${GOBLIN_DOCTOR_TARGET:-$PWD}"
+SKROOT="$TARGET/.hermes/skills"
+bad=0
+
+if [ -d "$SKROOT" ]; then
+  for d in "$SKROOT"/*/; do
+    [ -d "$d" ] || continue
+    name=$(basename "$d")
+    case "$name" in goblin-*|practice) ;; *) continue ;; esac
+    f="$d/SKILL.md"; sf="$SRC/skills/$name/SKILL.md"
+    if [ ! -f "$f" ]; then continue; fi
+    if [ ! -f "$sf" ] || ! cmp -s "$f" "$sf"; then
+      printf 'emitted skill drifted: %s\n' "${f#"$TARGET"/}"
+      bad=1
+    fi
+  done
+fi
+[ "$bad" -eq 0 ] && printf 'verified: hermes emission matches the source payload byte-for-byte\n'
+exit "$bad"

package/adapters/opencode/adapter.tsv

@@ -0,0 +1,14 @@
+# adapters/opencode/adapter.tsv - W4B. Shapes from OpenCode's own docs (opencode.ai/docs/skills +
+# /rules, read 2026-09-29; the installed CLI on this machine is 1.18.13): skills are
+# <name>/SKILL.md under .opencode/skills/ (project) and ~/.config/opencode/skills/ (global);
+# the docs also list .claude/.agents compatibility roots, which the adapter does not write (of
+# the candidate roots the opencode-named ones are the documented first locations, and writing
+# .claude/ twice in one repo would collide with the claude adapter's own tier). Context:
+# AGENTS.md in the project root (opencode.ai/docs/rules) - goblin-stack's hermes adapter
+# deliberately leaves the project's AGENTS.md user-owned (the INTEGRATION position: bootstrap
+# is read-one-file), so the opencode adapter manages the SAME file mechanism per platform and
+# names it here; the block is merge-not-clobber, bytes outside it untouched. Capabilities:
+# permission config can deny tool actions including skill loading (docs/permissions) but there
+# is no marketplace channel in the docs; no post-compaction hook is documented.
+id	display	detect_any	skills_path_project	skills_path_global	context_path	docs_url	docs_read	cap_skills	cap_context_injection	cap_command_blocking	cap_marketplace	cap_post_compaction
+opencode	OpenCode	~/.config/opencode:opencode	.opencode/skills/<name>/SKILL.md	~/.config/opencode/skills/<name>/SKILL.md	AGENTS.md	https://opencode.ai/docs/skills	2026-09-29	yes	full	yes	no	no

package/adapters/opencode/detect.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+# adapters/opencode/detect.sh — the detection contract (W4A-SPEC §3).
+# Prints the detected anchor on stdout; exits 0 present / 1 absent.
+# Side-effect-free, offline, read-only. DETECTED iff ~/.config/opencode/ exists or the
+# opencode CLI is on PATH (MEASURED live: the CLI at ~/.local/bin/opencode, 1.18.13).
+set -u
+[ -d "${HOME:-}/.config/opencode" ] && { printf '%s\n' "${HOME}/.config/opencode"; exit 0; }
+if command -v opencode >/dev/null 2>&1; then printf '%s\n' "$(command -v opencode)"; exit 0; fi
+exit 1

package/adapters/opencode/verify.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# adapters/opencode/verify.sh — the DRIFT oracle (W4A-SPEC §7). Re-emits the context block
+# to a scratch buffer and cmps against the on-disk block; checks every emitted skill is
+# byte-identical to the source payload. No engine invocation, no network. Exit 0 clean,
+# 1 drift (names the path), 2 cannot run. Env: GOBLIN_DOCTOR_TARGET (default $PWD).
+set -uo pipefail
+SELF_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+SRC=$(cd "$SELF_DIR/../.." && pwd)
+TARGET="${GOBLIN_DOCTOR_TARGET:-$PWD}"
+VERSION=$(cat "$SRC/VERSION" 2>/dev/null || printf 'unknown')
+CF="$TARGET/AGENTS.md"
+SKROOT="$TARGET/.opencode/skills"
+bad=0
+
+if [ -f "$CF" ] && grep -qF '<!-- goblin-stack:begin' "$CF"; then
+  EXPECT=$(awk -v b="<!-- goblin-stack:begin" -v e="<!-- goblin-stack:end" '
+    index($0,b){inb=1; print; next} inb{print} index($0,e){exit}' "$CF")
+  WANT=$(printf '<!-- goblin-stack:begin v%s -->\n' "$VERSION")
+  WANT="$WANT
+goblin-stack procedure skills are emitted for this repository (goblin-stack v$VERSION).
+Core: goblin-mode (start here), goblin-bootstrap, goblin-handoff, goblin-judge,
+goblin-verify-author, practice. Invoke a skill by name when the task matches its
+description; the full procedure lives in each SKILL.md.
+<!-- goblin-stack:end -->"
+  if [ "$EXPECT" != "$WANT" ]; then
+    printf 'context block in %s does not match v%s (stale marker VERSION or edited block)\n' "$CF" "$VERSION"
+    bad=1
+  fi
+fi
+
+if [ -d "$SKROOT" ]; then
+  for d in "$SKROOT"/*/; do
+    [ -d "$d" ] || continue
+    name=$(basename "$d")
+    case "$name" in goblin-*|practice) ;; *) continue ;; esac
+    f="$d/SKILL.md"; sf="$SRC/skills/$name/SKILL.md"
+    if [ ! -f "$f" ]; then continue; fi
+    if [ ! -f "$sf" ] || ! cmp -s "$f" "$sf"; then
+      printf 'emitted skill drifted: %s\n' "${f#"$TARGET"/}"
+      bad=1
+    fi
+  done
+fi
+[ "$bad" -eq 0 ] && printf 'verified: opencode emission matches v%s byte-for-byte\n' "$VERSION"
+exit "$bad"

package/automations/README.md

@@ -0,0 +1,53 @@
+# Automations — three parts, and only one of them lives in this repo
+
+An automation is a **card producer**, not an event daemon. It runs on a trigger, does read-only
+work, and its only write is a card. A defect gets fixed by P2, reviewed by P7, on other
+profiles. The three parts below are the whole design.
+
+    producer (this repo)      a deterministic script that cannot hallucinate. Silent when
+                              there is nothing to report. Costs zero tokens on a quiet run.
+        |
+        v
+    card      (the board)     the ONLY trigger surface with a durable record and a model knob.
+                              `--skill <name>` is the label (there is no --label flag),
+                              `--idempotency-key` is the dedup, `--parent` is the lineage.
+        |
+        v
+    repair    (a skill)       judgement starts here, on a different profile, under a playbook.
+
+    P13  goblin-bugreporter   a report arrived  -> reproduce -> one fix card on proof
+    P14  goblin-drift-audit   a claim disagrees with the artifact -> one repair card per repo
+
+## Files
+
+    automations/drift-audit.sh        A-02's producer. No network. Silent when clean.
+    automations/bugreporter-intake.sh A-01's intake validator (schema check -> card, or a
+                                      refusal card with no assignee).
+    automations/report.schema.tsv     the intake schema, machine-readable.
+    templates/report.yaml.tmpl        the report template the producer copies.
+
+The installer writes these into the target at `.goblin/automations/`, so the target is
+self-contained and `IN-02`/`SK-02` hash them like every other installed file.
+
+## The fleet steps goblin-stack cannot do (it writes nothing outside its target)
+
+    cp <target>/.goblin/automations/drift-audit.sh       ~/.hermes/scripts/
+    cp <target>/.goblin/automations/bugreporter-intake.sh ~/.hermes/scripts/
+    hermes cron create "0 9 * * 1" --name "Drift audit - weekly" \
+        --no-agent --script drift-audit.sh --deliver discord:<notification-channel>
+    hermes skills trust <target>
+
+A cron script must resolve inside the profile's `scripts/` directory, which is why that copy
+step exists rather than an installer write. **Hook configuration is per-profile**: a hook
+declared only in the root `config.yaml` never fires for a worker running under another
+profile, so any notification hook must be declared in every profile that can be an assignee.
+
+## Kill switches, and the order to turn one on
+
+1. `hermes cron pause <id>` — stops the producer. Immediate, total, no agent involved.
+2. `kanban.dispatch_profiles` excluding the automation's profile — fail-closed by construction.
+3. The producer's own state file (`.goblin/automations/<name>.state`, `enabled: false`).
+
+Turn on A-02 first: no agent sits inside its producer. Run it by hand
+(`bash .goblin/automations/drift-audit.sh --dry-run`) and read the record before scheduling it.
+Only after that run is clean does A-01's trigger get enabled.