@techgoblin/gobstack 0.4.4-beta.4 → 0.4.4-beta.7

package/docs/GUIDE.md

@@ -31,7 +31,8 @@ design on day one.
 
 ## 1. What this actually is, in plain language
 
-goblin-stack (published as the npm package **`@techgoblin/gobstack`**, product name **gobstack**)
+gobstack (published on npm as **`@techgoblin/gobstack`**) — this guide, the README and the CLI
+all call it **gobstack**
 is **a folder of files you install into a project** from npm. Once
 installed, three things change:
 
@@ -53,7 +54,7 @@ deliberately, and §8 and §11 say why.
 > **A rule that cannot fail is worse than no rule**, because it takes credit for verification it
 > does not perform.
 
-Everything else in goblin-stack follows from that sentence. If you remember one thing from this
+Everything else in gobstack follows from that sentence. If you remember one thing from this
 guide, remember that one — it is also the standard the harness holds itself to, and the reason it
 ships a file of things it *cannot* check (`docs/LIMITS.md`).
 
@@ -87,7 +88,7 @@ one way this guide installs it.
 **Do not install into a real project yet.** You want to see what it does before it touches
 something you care about.
 
-The guided path is `goblin init` — one screen per question (class, branch/email, first
+The guided path is `gob init` — one screen per question (class, branch/email, first
 gate, which platforms to emit), every question also answerable by flag, `--dry-run` to
 see the plan first:
 
@@ -96,12 +97,12 @@ see the plan first:
     git config user.email "you@example.com"
     git config user.name "you"
 
-    goblin init --target . --class app --branch main --email "you@example.com" \
+    gob init --target . --class app --branch main --email "you@example.com" \
         --gate "bash tests/run-tests.sh" --yes
 
 or the plain installer this wizard drives, if you prefer the one-shot shape:
 
-    goblin install --target . --class A
+    gob install --target . --class A
 
 Expected output (this is a real transcript, trimmed):
 
@@ -134,7 +135,7 @@ branch** (unless you want to).
 ## 4. Step 2 — Commit, then verify (the moment it earns its keep)
 
     cd /tmp/gs-try
-    git add -A && git commit -m "chore: install goblin-stack"
+    git add -A && git commit -m "chore: install gobstack"
     .goblin/bin/goblin-verify
 
 You will see one line per rule. The shape:
@@ -219,7 +220,7 @@ without you remembering to. And the gate numbers are recorded with a date, so a
 ### The `practice:` key — the part that makes it yours
 
 If you already have a house standard — a `CONTRIBUTING.md`, a `PROJECT-PRACTICE.md`, anything
-written down — point `practice:` at it. goblin-stack does **not** copy its text. It records a
+written down — point `practice:` at it. gobstack does **not** copy its text. It records a
 **hash** of the file and re-checks that hash on every verify.
 
 That buys you one specific, valuable thing: **if someone edits your standard, every project that
@@ -228,7 +229,7 @@ repos follow an old version.
 
 When *you* legitimately edit your own standard:
 
-    goblin install --target . --re-pin
+    gob install --target . --re-pin
 
 It re-records the hash and prints the old and new value. Nothing re-pins automatically — an
 edited standard is never a silent no-op.
@@ -329,7 +330,7 @@ own the same way, once that gate is real: declare it in `.goblin/goblin.yaml` an
 can see.
 
 A check that is green on **both** the broken and the fixed tree proves nothing — it would have been
-green anyway. goblin-stack calls this the **REPLAY** rule, and it is the single practice that has
+green anyway. gobstack calls this the **REPLAY** rule, and it is the single practice that has
 caught every real regression in this repository's own development history.
 
 ---
@@ -424,7 +425,7 @@ Two readings that are easy to get wrong:
 | `refused to overwrite: HANDOFF.md`, exit 1 | your repo already had a HANDOFF | **do not `--force`** — reconcile it (below) |
 | `PT-02 declared main, actual master` | branch mismatch | set `branch:` in the config |
 | `IN-02 ... practice EDITED` | someone changed the pinned standard | re-pin deliberately: `--re-pin` |
-| `goblin install: unknown subcommand` (exit 2) | you ran a bare `goblin install` without the npm package installed | install the npm package first: `npm i -g @techgoblin/gobstack`, then `goblin install` |
+| `gob install: unknown subcommand` (exit 2) | you ran a bare `gob install` without the npm package installed | install the npm package first: `npm i -g @techgoblin/gobstack`, then `gob install` |
 | `IN-03` fails, "manifest is broken" | a row has a broken check column | fix the row; this is a source defect, not yours |
 | a `FAIL` you believe is wrong | the check may be weak, or your belief may be | run `--only <id>` and read the command it prints |
 
@@ -442,12 +443,12 @@ Declared but unusable (relative path, missing directory, no manifest inside) is
 with no fallback** — a repo is never judged by an engine it did not declare. A repo whose record
 says `mode=global` keeps hashing whatever files it still holds; the engine's own identity prints in
 every run's footer (`engine: mode=… cli_sha256=… enforcement_tsv_sha256=…`). The same commands are
-available outside any repo through the npm CLI: `goblin verify` / `goblin bans` / `goblin audit` /
-`goblin doctor` / `goblin emit` / `goblin upgrade` / `goblin --version`.
+available outside any repo through the npm CLI: `gob verify` / `gob bans` / `gob audit` /
+`gob doctor` / `gob emit` / `gob upgrade` / `gob --version`.
 
 **Migrating a repo to the global engine (W3):**
 
-    goblin upgrade            # 8 steps, two commits, one report
+    gob upgrade            # 8 steps, two commits, one report
 
 It refuses on a dirty tree, a detached HEAD, a red repo, or a global engine holding different
 bytes — each refusal names the fix. What it does: verifies every recorded hash, lands the engine
@@ -461,7 +462,7 @@ again. Nothing is deleted before the engine is safely landed and the tree is gre
     git revert <commit-A-sha> <commit-B-sha>
 
 reverses byte-for-byte: the vendored payload returns, the record drops its `engine:` block, and
-`goblin verify` is the 43-green it was before. A second `goblin upgrade` on a migrated repo is a
+`gob verify` is the 43-green it was before. A second `gob upgrade` on a migrated repo is a
 no-op; `goblin-install` onto one refuses with the revert remedy (re-installing would re-shadow the
 engine and silently de-migrate the record).
 
@@ -474,7 +475,7 @@ engine and silently de-migrate the record).
 | `goblin` (npm CLI) | propagates the subcommand's codes verbatim — `verify`/`bans`/`audit`/`--version`; `install`/`uninstall`/`re-pin`/`upgrade` route into `goblin-install` (`upgrade` migrates to the global engine: `0` ok · `1` refusal · `2` bad input); `doctor`/`emit` carry the same contract: `doctor` exits `0` every probed platform DETECTED and clean · `1` any DRIFT · `2` nothing to probe, and `emit` exits `0` ok or no-op · `1` refusal (with the path and the fix) · `2` bad input or unknown platform |
 | platforms (W4b) | `emit`/`doctor` cover seven: `claude`, `hermes`, `copilot`, `cursor`, `opencode`, `codex`, `gemini` — each detected via its own anchor (`~/.claude`, `~/.hermes`, `~/.copilot`, `~/.cursor`, `~/.config/opencode`, `~/.codex`, `~/.gemini`); codex and gemini carry `partial` command-blocking (see LIMITS #47) |
 
-`3` is the one to notice: it means goblin-stack's own rule table is malformed, not your project.
+`3` is the one to notice: it means gobstack's own rule table is malformed, not your project.
 
 ---
 
@@ -482,10 +483,10 @@ engine and silently de-migrate the record).
 
 ### Commands
 
-    goblin install --target <dir> --class A|B|C|D|E|F [options]
-    goblin install --target <dir> --uninstall
-    goblin install --target <dir> --re-pin
-    goblin install --target <dir> --upgrade
+    gob install --target <dir> --class A|B|C|D|E|F [options]
+    gob install --target <dir> --uninstall
+    gob install --target <dir> --re-pin
+    gob install --target <dir> --upgrade
 
     .goblin/bin/goblin-verify [--only <id[,id...]>] [--json] [--list]
     .goblin/bin/goblin-audit        # the only network step
@@ -505,7 +506,7 @@ Named procedures, installed as project-local skills. Each has a measurable verif
 | P5 | `goblin-tdd-repro` | a defect where a regression test is cheap |
 | P6 | `goblin-verify-author` | a project has no live check lane, or its gates drift |
 | P7 | `goblin-pr-gate` | anything that should be reviewed before landing |
-| P8 | `goblin-bootstrap` | adopting goblin-stack, or starting a project |
+| P8 | `goblin-bootstrap` | adopting gobstack, or starting a project |
 | P9 | `goblin-handoff` | ending a session, or picking up another's |
 | P10 | `goblin-overnight` | an unattended run over a predicate |
 | P11 | `goblin-sweep` | the same change across many projects |
@@ -578,10 +579,10 @@ with *"prove it was broken first"* — it is the one practice that survives cont
     # 1. try it somewhere disposable
     mkdir -p /tmp/gs-try && cd /tmp/gs-try
     git init -b main
-    goblin install --target . --class A                     # expect: created 50
+    gob install --target . --class A                     # expect: created 50
 
     # 2. commit and check
-    git add -A && git commit -m "chore: install goblin-stack"
+    git add -A && git commit -m "chore: install gobstack"
     .goblin/bin/goblin-verify                                # expect: mostly PASS, some SKIP
 
     # 3. make it yours
@@ -599,12 +600,12 @@ with *"prove it was broken first"* — it is the one practice that survives cont
 
     # 5. do it for real, in a repo you care about
     cd ~/projects/your-project
-    goblin install --target . --class A
-    git add -A && git commit -m "chore: adopt goblin-stack"
+    gob install --target . --class A
+    git add -A && git commit -m "chore: adopt gobstack"
     .goblin/bin/goblin-verify
     $EDITOR HANDOFF.md              # state / gates (dated!) / next / NOT verified
 
 ---
 
-*This guide is part of goblin-stack. If you find a step that does not work as written, that is a
+*This guide is part of gobstack. If you find a step that does not work as written, that is a
 defect in the guide — report it the same way you would report one in the code.*

package/docs/w6-tty-redraw-pty-transcript.txt

@@ -0,0 +1,334 @@
+Script started on 2026-10-02 00:53:48+07:00 [COMMAND="bash /home/harvey/projects/goblin-stack/bin/goblin-init --target /tmp/ptyfinal/repo --yes" <not executed on terminal>]
+
+
+
+
+
+
+
+
+▄███▄ ▄██▄ ██▄  █    ▄█▄ █  █   ▄██▀ █████ ▄███▄ ▄███ █  █
+█   █ █  █ █▄▀█ █     █  █▄ █   ▀██▄   █   █   █ █    █ █
+█ ▄██ █  █ █▄▀█ █     █  █ ▄█   ▄█▀    █   █████ █    ██
+▀██▀▀ ▀██▀ ██▀  ▀▀▀▀ ▀█▀ █  █   ██▀▀   ▀   █   █ ▀██▀ █ █
+     discipline around whatever executes
+
+  gob init — first-run setup (gobstack v0.4.4)
+  6 steps · every step has a flag · nothing is written until the plan is confirmed
+
+  ◆ 1. platforms    
+  ○ 2. class        
+  ○ 3. branch/email 
+  ○ 4. first gate   
+  ○ 5. emit         
+  ○ 6. done         
+▄███▄ ▄██▄ ██▄  █    ▄█▄ █  █   ▄██▀ █████ ▄███▄ ▄███ █  █
+█   █ █  █ █▄▀█ █     █  █▄ █   ▀██▄   █   █   █ █    █ █
+█ ▄██ █  █ █▄▀█ █     █  █ ▄█   ▄█▀    █   █████ █    ██
+▀██▀▀ ▀██▀ ██▀  ▀▀▀▀ ▀█▀ █  █   ██▀▀   ▀   █   █ ▀██▀ █ █
+     discipline around whatever executes
+
+  gob init — first-run setup (gobstack v0.4.4)
+  6 steps · every step has a flag · nothing is written until the plan is confirmed
+
+  ✔ 1. platforms    
+  ◆ 2. class        
+  ○ 3. branch/email 
+  ○ 4. first gate   
+  ○ 5. emit         
+  ○ 6. done         
+
+  ✔ 1. platforms      0 detected
+      no platform detected here — the wizard will still install the harness; emit later with gob emit
+▄███▄ ▄██▄ ██▄  █    ▄█▄ █  █   ▄██▀ █████ ▄███▄ ▄███ █  █
+█   █ █  █ █▄▀█ █     █  █▄ █   ▀██▄   █   █   █ █    █ █
+█ ▄██ █  █ █▄▀█ █     █  █ ▄█   ▄█▀    █   █████ █    ██
+▀██▀▀ ▀██▀ ██▀  ▀▀▀▀ ▀█▀ █  █   ██▀▀   ▀   █   █ ▀██▀ █ █
+     discipline around whatever executes
+
+  gob init — first-run setup (gobstack v0.4.4)
+  6 steps · every step has a flag · nothing is written until the plan is confirmed
+
+
+  ✔ 1. platforms      0 detected
+      no platform detected here — the wizard will still install the harness; emit later with gob emit
+  ✔ 1. platforms    0 detected
+  ✔ 2. class        
+  ◆ 3. branch/email 
+  ○ 4. first gate   
+  ○ 5. emit         
+  ○ 6. done         
+
+      what kind of work does this repo do?
+        1 ▸ app        shipped features, PRs, review gates        (class A)
+        2   service    backend jobs, config, unattended runs      (class B)
+        3   game       playable builds, perf budgets              (class C)
+        4   research   specs, replays, reference corpora          (class D)
+        5   agent      fleets, loops, unattended automation       (class E)
+        6   desktop    the shell you live in, perf budget         (class F)
+      ↑ number + Enter · Enter = app · the class letter works too (A-F)
+      
+  ✔ 2. class            A — shipped-software
+▄███▄ ▄██▄ ██▄  █    ▄█▄ █  █   ▄██▀ █████ ▄███▄ ▄███ █  █
+█   █ █  █ █▄▀█ █     █  █▄ █   ▀██▄   █   █   █ █    █ █
+█ ▄██ █  █ █▄▀█ █     █  █ ▄█   ▄█▀    █   █████ █    ██
+▀██▀▀ ▀██▀ ██▀  ▀▀▀▀ ▀█▀ █  █   ██▀▀   ▀   █   █ ▀██▀ █ █
+     discipline around whatever executes
+
+  gob init — first-run setup (gobstack v0.4.4)
+  6 steps · every step has a flag · nothing is written until the plan is confirmed
+
+
+  ✔ 1. platforms      0 detected
+      no platform detected here — the wizard will still install the harness; emit later with gob emit
+
+      what kind of work does this repo do?
+        1 ▸ app        shipped features, PRs, review gates        (class A)
+        2   service    backend jobs, config, unattended runs      (class B)
+        3   game       playable builds, perf budgets              (class C)
+        4   research   specs, replays, reference corpora          (class D)
+        5   agent      fleets, loops, unattended automation       (class E)
+        6   desktop    the shell you live in, perf budget         (class F)
+      ↑ number + Enter · Enter = app · the class letter works too (A-F)
+
+  ✔ 2. class            A — shipped-software
+  ✔ 1. platforms    0 detected
+  ✔ 2. class        A (shipped-software)
+  ✔ 3. branch/email 
+  ◆ 4. first gate   
+  ○ 5. emit         
+  ○ 6. done         
+
+      the forge contract — the identity this repo commits with (CM-01)
+      default branch ─ main
+      owner email ─ t@t.co
+  ✔ 3. branch/email   main · t@t.co
+▄███▄ ▄██▄ ██▄  █    ▄█▄ █  █   ▄██▀ █████ ▄███▄ ▄███ █  █
+█   █ █  █ █▄▀█ █     █  █▄ █   ▀██▄   █   █   █ █    █ █
+█ ▄██ █  █ █▄▀█ █     █  █ ▄█   ▄█▀    █   █████ █    ██
+▀██▀▀ ▀██▀ ██▀  ▀▀▀▀ ▀█▀ █  █   ██▀▀   ▀   █   █ ▀██▀ █ █
+     discipline around whatever executes
+
+  gob init — first-run setup (gobstack v0.4.4)
+  6 steps · every step has a flag · nothing is written until the plan is confirmed
+
+
+  ✔ 1. platforms      0 detected
+      no platform detected here — the wizard will still install the harness; emit later with gob emit
+
+      what kind of work does this repo do?
+        1 ▸ app        shipped features, PRs, review gates        (class A)
+        2   service    backend jobs, config, unattended runs      (class B)
+        3   game       playable builds, perf budgets              (class C)
+        4   research   specs, replays, reference corpora          (class D)
+        5   agent      fleets, loops, unattended automation       (class E)
+        6   desktop    the shell you live in, perf budget         (class F)
+      ↑ number + Enter · Enter = app · the class letter works too (A-F)
+
+  ✔ 2. class            A — shipped-software
+
+      the forge contract — the identity this repo commits with (CM-01)
+
+
+  ✔ 3. branch/email   main · t@t.co
+  ✔ 1. platforms    0 detected
+  ✔ 2. class        A (shipped-software)
+  ✔ 3. branch/email main · t@t.co
+  ✔ 4. first gate   
+  ◆ 5. emit         
+  ○ 6. done         
+
+      one real command that must stay green — suggested for a bash suite:
+      bash tests/run-tests.sh
+      gate command ─ bash tests/run-tests.sh
+  ✔ 4. first gate      bash tests/run-tests.sh
+▄███▄ ▄██▄ ██▄  █    ▄█▄ █  █   ▄██▀ █████ ▄███▄ ▄███ █  █
+█   █ █  █ █▄▀█ █     █  █▄ █   ▀██▄   █   █   █ █    █ █
+█ ▄██ █  █ █▄▀█ █     █  █ ▄█   ▄█▀    █   █████ █    ██
+▀██▀▀ ▀██▀ ██▀  ▀▀▀▀ ▀█▀ █  █   ██▀▀   ▀   █   █ ▀██▀ █ █
+     discipline around whatever executes
+
+  gob init — first-run setup (gobstack v0.4.4)
+  6 steps · every step has a flag · nothing is written until the plan is confirmed
+
+
+  ✔ 1. platforms      0 detected
+      no platform detected here — the wizard will still install the harness; emit later with gob emit
+
+      what kind of work does this repo do?
+        1 ▸ app        shipped features, PRs, review gates        (class A)
+        2   service    backend jobs, config, unattended runs      (class B)
+        3   game       playable builds, perf budgets              (class C)
+        4   research   specs, replays, reference corpora          (class D)
+        5   agent      fleets, loops, unattended automation       (class E)
+        6   desktop    the shell you live in, perf budget         (class F)
+      ↑ number + Enter · Enter = app · the class letter works too (A-F)
+
+  ✔ 2. class            A — shipped-software
+
+      the forge contract — the identity this repo commits with (CM-01)
+
+
+  ✔ 3. branch/email   main · t@t.co
+
+      one real command that must stay green — suggested for a bash suite:
+      bash tests/run-tests.sh
+
+  ✔ 4. first gate      bash tests/run-tests.sh
+  ✔ 1. platforms    0 detected
+  ✔ 2. class        A (shipped-software)
+  ✔ 3. branch/email main · t@t.co
+  ✔ 4. first gate   bash tests/run-tests.sh
+  ✔ 5. emit         
+  ◆ 6. done         
+  ✔ 5. emit             0 platform(s) · scope project
+
+  running: goblin-install --target /tmp/ptyfinal/repo --class A
+created 50 · updated 0 · unchanged 0 · skipped 0
+
+next:
+  1. cd /tmp/ptyfinal/repo && git add -A && git commit   # the install is a change like any other
+  2. .goblin/bin/goblin-verify   # or add .goblin/bin to PATH
+  3. edit .goblin/goblin.yaml: replace the default gate with your real commands (P8 step 3)
+  4. hermes skills trust /tmp/ptyfinal/repo   # one-time, so the project-tier skills load
+
+automations (optional; neither writes outside this repo, and A-02 has no agent in it):
+  bash /tmp/ptyfinal/repo/.goblin/automations/drift-audit.sh --dry-run        # read the record first
+  cp /tmp/ptyfinal/repo/.goblin/automations/drift-audit.sh ~/.hermes/scripts/
+  hermes cron create "0 9 * * 1" --name "Drift audit - weekly" --no-agent \
+      --script drift-audit.sh --deliver <channel>
+  P13/P14 in docs/FLOWS.md; the whole model in automations/README.md
+      PASS  IN-01  the install record exists and names its version
+      PASS  IN-02  41 installed files hashed
+      PASS  IN-03  the manifest is complete: every rule carries a check or is advisory, inside the enum
+      PASS  IN-04  0 pre-existing file(s) left untouched
+      PASS  HP-01  (test -f HANDOFF.md)
+      PASS  HP-02  (for h in 'START HERE' 'STATE|STATUS' 'GATES?' 'NEXT STEPS|NEXT' 'NOT VERIFIED|UNVERIFIED|NOT PROVEN|UNPROVEN|PENDING[^.]*DEVICE TEST'; do grep -qiE "^#{2,3}[[:space:]]+[^[:alpha:]]*($h)\b" HANDOFF.md || { echo "missing section: $h"; exit 1; }; done)
+      PASS  HP-03  1 gate line(s) inside the Gates section, each with a measured date (anchored on the declared gate name(s): commit todo_ceiling)
+      ADV   HP-04  A stale sentence is corrected in place with a dated parenthetical, never deleted. (advisory)
+      PASS  HP-05  names 3c96403 (ancestor of HEAD 3c96403)
+      PASS  SP-01  (ls ./*-SPEC.md >/dev/null 2>&1)
+      FAIL  SP-02  (test -z "$(git ls-files --others --exclude-standard -- '*-SPEC.md')" -> exit 1)
+      PASS  SP-03  (awk '/^[[:space:]]*[-*][[:space:]]/ && /AC[0-9]*:/ && !/`|==|===|exit|<|>/ {print; bad=1} END{exit bad}' ./*-SPEC.md)
+      PASS  GT-01  2 declared gate(s), each with a cmd
+      PASS  GT-02  commit=0 todo_ceiling=0 · client_js_bytes 0 (ceiling 0) · measured 2026-10-02
+      PASS  GT-03  (test -f .goblin/last-gate-line && [ .goblin/last-gate-line -nt "$(git rev-parse --git-dir)/logs/HEAD" ])
+      PASS  GT-04  ratchet client_js_bytes ceiling 0
+      PASS  GT-05  client_js_bytes 0 (ceiling 0)
+      PASS  HS-01  not an asserting harness (report utility): gate.sh
+1 asserting harness(es), 1 report utility(ies)
+      SKIP  HS-02  no pinned pre-change commit yet (replay.commit empty or unknown) - REPLAY not provable
+      ADV   HS-03  Source probes read text with comments blanked first. (advisory)
+      PASS  CM-01  (test "$(git log -1 --format='%ae')" = "$(grep '^owner_email:' .goblin/goblin.yaml | cut -d' ' -f2)")
+      ADV   CM-02  The commit message was written to a file, not passed with -m. (advisory)
+      FAIL  CM-03  9 dirty entr(y|ies), max_dirty 0
+      PASS  MD-01  (for d in skills manifest bin templates presets .goblin .hermes; do [ -d "$d" ] || continue; grep -rniE '(d[e]epseek|cl[a]ude|g[p]t-[0-9]|gr[o]k|g[e]mini|g[l]m-[0-9]|k[i]mi)[a-z0-9.:_-]*' "$d" && exit 1; done; exit 0)
+      ADV   MD-02  no model mapping configured (/tmp/ptyfinal/home/projects/fleet-model.yaml absent) - advisory
+      ADV   MD-03  Role-pinned fan-out goes through kanban, not a model-less subagent spawn. (advisory)
+      PASS  PG-01  0 review note(s)
+      PASS  PG-02  0 review note(s) classified
+      PASS  PG-03  0 review note(s) patch-id checked
+      ADV   PG-04  Never bypass what the forge enforces. (advisory)
+      PASS  PG-05  1 workflow file(s) checked for a self-skipping required check
+      PASS  PG-06  goblin-gate.yml: runs the verifier, which executes every declared gate
+1 workflow file(s) compared with the 2 declared gate(s)
+      PASS  DS-01  unchanged: .goblin/state.json=missing
+      PASS  DS-02  snapshot .goblin/state.json=missing
+      ADV   DOC-01 A significant change updates the docs that teach it. (advisory)
+      ADV   DOC-02 System-level changes are recorded wherever the project's standard says they live. (advisory)
+      PASS  SK-01  
+      PASS  SK-02  20 installed skill file(s) hashed
+      PASS  SK-03  advisory 10 of ceiling 10 (0 free slots: the next advisory row FAILs)
+      PASS  SK-04  
+      PASS  PT-01  (for d in skills manifest bin templates presets .goblin .hermes; do [ -d "$d" ] || continue; grep -rniE --exclude=goblin.yaml --exclude=installed.json '(h[a]rvey|tech-g[o]blin|/h[o]me/[a-z]+|g[o]blin-ui|op[e]n-door|sup[r]eme|bb[t]ech|c[l]v)' "$d" && exit 1; done; exit 0)
+      PASS  PT-02  declared main, actual main
+      PASS  CL-01  part pr-gate: optional, present
+part review-panel: optional, present
+part tokens: optional, absent
+      PASS  CL-02  archive: false - the full class requirement applies
+      PASS  SC-01  0 tracked secret file(s)
+      PASS  SC-02  the whole secret family is ignored (.env, .env.local, .env.production proved by git)
+      PASS  SC-03  0 client-visible secret-shaped name(s); no build output to scan for clause 2
+      PASS  SC-04  0 cookie write(s) checked; a JS-written cookie is readable by any script - reported, not failed
+      PASS  SC-05  0 write handler(s), 0 waived; 11 dir(s) declared
+      SKIP  SC-06  no package.json - there is no dependency manifest to lock
+      SKIP  SC-07  no audit record yet. Run .goblin/bin/goblin-audit once, deliberately, then commit
+.goblin/audit.tsv: SC-07 reads the record and never the network
+      SKIP  SC-08  no package-lock.json - there is no install-hook surface to enumerate
+      ADV   SC-09  Auth is applied consistently across sibling routes. (advisory)
+      SKIP  PF-01  no perf baseline recorded yet: run `find .next/static dist/assets dist -type f -name '*.js' -exec cat {} + 2>/dev/null | wc -c` on a pinned commit, then write
+perf.baseline_commit, perf.baseline_value, perf.measured and the matching ratchet ceiling
+      PASS  AU-01  2 automation producer(s) scanned, none opens with a network or forge verb
+      SKIP  AU-02  no reports/*/report.yaml - nothing to dedup
+      SKIP  AU-03  no reports/ - no reporter run in this repo to audit
+      PASS  AU-04  
+      PASS  BN-00  8 ban(s), each with an enforcement row and a named replacement
+      SKIP  BN-01  No `any` in application TypeScript. (no matching files: src) 
+      SKIP  BN-02  No `@ts-ignore` / `@ts-expect-error` suppressions. (no matching files: src) 
+      SKIP  BN-03  No direct network call from a component. (not enabled in bans: - add BN-03 to .goblin/goblin.yaml to turn it on) 
+      SKIP  BN-05  No import across a declared layer boundary. (no matching files: src) 
+      SKIP  BN-06  No renderer with Node access (`nodeIntegration: true`). (not enabled in bans: - add BN-06 to .goblin/goblin.yaml to turn it on) 
+      SKIP  BN-07  No renderer with context isolation or the process sandbox turned off. (not enabled in bans: - add BN-07 to .goblin/goblin.yaml to turn it on) 
+      SKIP  BN-08  No dangerous webPreferences. (not enabled in bans: - add BN-08 to .goblin/goblin.yaml to turn it on) 
+      SKIP  BN-09  No synchronous IPC and no `@electron/remote`. (not enabled in bans: - add BN-09 to .goblin/goblin.yaml to turn it on) 
+      SKIP  FM-01  feature_map: is empty - no map is declared, so there is nothing to index
+      SKIP  FM-02  feature_map: is empty - no map is declared, so there are no entry paths to resolve
+      SKIP  VA-01  verify_doctor: is empty - no doctor is declared, so "the generated skill was executed once" is not provable here
+      SKIP  JG-01  no loop record in this repo - no judge verdict to check
+      ADV   JG-02  no model mapping configured (/tmp/ptyfinal/home/projects/fleet-model.yaml absent) - advisory
+remedy: add a `judge:` entry beside the code lane in the file declared as models_file: in /tmp/ptyfinal/repo/.goblin/goblin.yaml
+      ADV   JG-03  A judge lane that has never returned a non-`done` verdict is escalated. (advisory)
+      SKIP  LP-01  no loop has run in this repo
+      SKIP  LP-02  no loop has run in this repo
+      SKIP  LP-03  no loop has run in this repo
+      SKIP  LP-04  no loop has run in this repo
+      SKIP  LP-05  no loop has run in this repo
+      SKIP  RC-01  reference_manifest: is empty - no reference corpus is declared, so there is nothing for a build to match against
+      SKIP  RC-02  reference_manifest: is empty - there is no manifest to shape-check (RC-01 skips for the same reason)
+      SKIP  RC-03  no manifests/ directory - this is not a lab repo with a reference corpus, so there are no tracked bytes to check
+      SKIP  RC-04  no manifests/*.sha256 - no acquisition record is declared, so there is none to read
+      41 passed, 2 failed, 11 advisory, 28 skipped
+      of those 11 advisory: the matrix labels 10 row(s) advisory; the difference is the non-advisory row(s) reporting ADV by design (an unresolved lane) and any labelled row skipped by an opt-out
+      cannot see: whether a check in the harness dir tests the right path rather than
+      merely passing; whether the forge is bound by the workflow CL-01 found; whether a human
+      read the diff;
+      whether the model mapping names a family that actually differs (MD-02 reports it
+      and cannot change it); and whether .goblin/installed.json — the record every drift
+      check trusts — was itself rewritten. It is not signed, so one edit to it (with the
+      matching edit to the file it protects) defeats IN-02, SK-02 and HS-01 at once
+      (docs/LIMITS.md #18). The ban lane carries the same blind spot and two of its own:
+      the ban table is a manifest file under the same unsigned record, so a defanged ban
+      passes BN-00 (docs/LIMITS.md #28); a ban probe is a TEXT probe with no AST, so a
+      `Record<string, any>` is missed and a `: any` inside a string is reported
+      (docs/LIMITS.md #27); and no check here can reach a ban IN CONTEXT — the row proves
+      the forbidden path fails mechanically, never that the ban reached the agent that
+      wrote the line. The judge/loop lane adds its own: every JG-/LP- row reads a RECORD, so
+      it proves a handle, a pin, a budget and a pointer exist — never that the loop made
+      progress (a changed pointer is a proxy, docs/LIMITS.md #33), never which lane returned
+      a verdict, and never that the predicate was the right one or was really run. The CI lane
+      adds its own: PG-05 and PG-06 read a workflow's TEXT, so PG-05 sees a job whose gate step is
+      conditional and cannot see branch protection, the required-check list, or a forge that never
+      ran the job at all, and PG-06 proves a declared gate is INVOKED in a file under
+      .github/workflows/ — never that the forge marks that job required, never that it is the job
+      the forge waits on, and never that the workflow can fail (that is PG-05). A required check
+      that reports Success after skipping its gate is a green light for a commit whose gate never
+      ran (docs/CI.md). The reference-corpus lane adds its own: RC-01 matches EXACT sha256 only,
+      so a resized, recoloured or re-encoded reference asset, or copied text inside a shipped
+      string, passes it unseen; RC-02 proves the manifest is well-shaped, never that its entries
+      are the right hashes (as strong as tamper hashing, and installed.json is unsigned); RC-03
+      reads the tracked tree and cannot see a payload renamed and re-encoded; and RC-04 proves an
+      acquisition record EXISTS, never that the number beside it came from the store (HP-03's
+      defect, one artifact over). No row here reaches a reference asset in CONTEXT either.
+      engine: mode=vendored cli_sha256=2d37cf1c9f38a582ad60f3f75d2fcd53d10b743905dc3274eab6511c5c5ea008 enforcement_tsv_sha256=fd474c268b0852587c632910c503144fbcfe5e211ed2182902949a79fc5282b1
+
+  gob verify: 41 passed, 2 failed, 28 skipped · exit 1
+
+  next:
+    1. the 28 skipped checks ARE your checklist — gob verify names each one
+    2. replace the placeholder gate in .goblin/goblin.yaml with your real commands (P8 step 3)
+    3. not emitted here: gob emit --platform <p> --scope global
+    4. hermes skills trust /tmp/ptyfinal/repo   # one-time, so the project-tier skills load
+
+  ▙ the goblin sees you. the gate is RED — start there.
+
+Script done on 2026-10-02 00:53:50+07:00 [COMMAND_EXIT_CODE="0"]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@techgoblin/gobstack",
-  "version": "0.4.4-beta.4",
+  "version": "0.4.4-beta.7",
   "description": "Agent-discipline toolkit: one verify command, an enforcement matrix, and LIMITS. bash engine, npm shim.",
   "bin": {
     "goblin": "bin/goblin.js",