@techgoblin/gobstack 0.4.4-beta.6 → 0.4.4-beta.8

package/README.md

@@ -50,14 +50,17 @@ After installing, in this order:
 
     cd <target> && git add -A && git commit   # the install is a change like any other
     gob verify                             # or .goblin/bin/goblin-verify, inside the target
-    hermes skills trust <target>              # one-time, Hermes users, so project-tier skills load
+    gob emit --platform <p>                   # optional, per platform: the agent skills are an opt-in
     gob audit                              # once, deliberately: the ONLY network step (SC-07)
 
-**A class-A install verifies green — `43 passed, 0 failed, 11 advisory, 28 skipped`, exit 0 — once
+**A default class-A install (no agent skills — those are `gob emit`'s job) verifies green —
+`38 passed, 0 failed, 11 advisory, 33 skipped`, exit 0 — once
 `HANDOFF.md` names a commit that exists. Before that edit the scaffold's `0000000` placeholder is
-the one expected red: `42 passed, 1 failed`, `HP-05`. Both numbers measured 2026-09-25; the run and
-the fix are step 2 of `docs/GUIDE.md`.**
-Twenty-eight rows skip (`HS-02` has no pinned pre-change commit yet, so the REPLAY is not provable;
+the one expected red: `37 passed, 1 failed`, `HP-05`. Both numbers measured at W6 (neutral-first);
+the run and the fix are step 2 of `docs/GUIDE.md`.**
+Thirty-three rows skip — the five skill rows (`SK-01`..`SK-04`, `AU-04`) skip on the `playbooks`
+opt-out a skills-free install records, then the not-yet rows (`HS-02` has no pinned pre-change
+commit yet, so the REPLAY is not provable;
 `AU-02` and `AU-03` have no report to audit; `SC-06`, `SC-07` and `SC-08` have no dependency
 manifest, no lockfile and no audit record to read; `PF-01` has no measured perf baseline;
 `BN-01`/`BN-02`/`BN-05` have no `src/` for a ban to read, and `BN-03` plus the four electron bans
@@ -83,7 +86,7 @@ The measurement and the vacuous-pass reading are in `docs/CONTRACTS.md`.
 | `gob verify` | run the rule matrix against the current repo — `PASS`/`FAIL`/`SKIP` per row, exit 0 pass · 1 a check failed · 2 could not run · 3 the manifest is broken |
 | `gob bans` | run the ban list (per-pattern red lines over the source tree) |
 | `gob audit` | check recorded dependency claims against live advisory feeds — the only command that touches the network |
-| `gob install` | install the manifest, skills and verifier into a target repo |
+| `gob install` | install the harness into a target repo: manifest, verifier, gates, HANDOFF — no agent skills (those are an opt-in: `gob emit --platform <p>`, or `--skills yes`) |
 | `gob uninstall` | remove everything an install wrote, byte-exactly (`gob install --target <dir> --uninstall` is the same job) |
 | `gob upgrade` | migrate a repo to the shared global engine at `~/.goblin/engine` — 8 steps, two commits, one report |
 | `gob doctor` | one run across the platforms below: DETECTED / NOT-DETECTED / DRIFT per platform |
@@ -111,6 +114,13 @@ One run of `gob emit --platform <p> --scope project` writes the skills and the c
 session of that platform reads; `--scope global` writes to the machine-level anchor. `--dry-run`
 prints the full write plan first.
 
+**Agent skills are opt-in.** A `gob install` writes the neutral harness only — `.goblin/`,
+`HANDOFF.md`, `AGENTS.md`, the checks and the `.gitignore` block; no skills directory, and no
+files belonging to any coding agent. The guided path is `gob init`'s emit screen; the one-shot
+path is `gob emit --platform <p>` after installing. Repos whose install predates the opt-in
+default keep their skills through `gob upgrade` (the install record names them; only an explicit
+`--skills no`, or `--uninstall`, removes them).
+
 ## What it is not
 
 Not a rules document (every rule carries a runnable check or is explicitly counted as

package/bin/goblin-init

@@ -5,10 +5,13 @@
 #               [--branch <name>] [--email <addr>] [--gate <cmd>]
 #               [--emit <p[,p..]>] [--scope project|global] [--yes] [--dry-run]
 #
-# One screen per question, answered steps collapsing into the ✔/◆/○ rail above. Every
-# question has a flag: with the flags set (or --yes, or a non-tty stdin) the wizard asks
-# nothing and runs from the flags and the defaults — non-interactive parity is structural,
-# not a mode. Over a pipe the ANSI redraw degrades to a numbered cascade (rustup shape).
+# One screen per question, answered steps collapsing into the ✔/◆/○ rail above. On a tty
+# the whole wizard frame (logotype, header, answered rows, rail) is redrawn in place from
+# a saved buffer of the wizard's own lines — never by counting printed output, which the
+# installer/emit engines would break. Every question has a flag: with the flags set (or
+# --yes, or a non-tty stdin) the wizard asks nothing and runs from the flags and the
+# defaults — non-interactive parity is structural, not a mode. Over a pipe the redraw
+# degrades to a numbered cascade (rustup shape) with zero cursor motion.
 #
 # The wizard is a FRONT END over the existing engines, never a second installer:
 #   .goblin/ + the payload   -> bin/goblin-install  (its refusal contract — an existing
@@ -47,9 +50,11 @@ VERSION=$(cat "$SRC/VERSION" 2>/dev/null || printf 'unknown')
 # nearest 16-colour slot. NO_COLOR or a piped stdout turns colour off entirely.
 TTY_OUT=0; [ -t 1 ] && TTY_OUT=1
 TTY_IN=0;  [ -t 0 ] && TTY_IN=1
-C_ACCENT="" C_GREEN="" C_TEXT="" C_MUTED="" C_DIM="" C_RED="" C_YELLOW="" C_RESET="" C_BOLD=""
+C_ACCENT="" C_GREEN="" C_TEXT="" C_MUTED="" C_DIM="" C_RED="" C_YELLOW="" C_RESET=""
+# Single-accent discipline: one accent (#F54E00) + green + text + muted + dim. No bold
+# is ever emitted — bold was a second emphasis voice and is gone from every screen.
 if [ "$TTY_OUT" -eq 1 ] && [ -z "${NO_COLOR:-}" ]; then
-  C_RESET=$'\033[0m'; C_BOLD=$'\033[1m'
+  C_RESET=$'\033[0m'
   case "${COLORTERM:-}" in
     truecolor|24bit)
       C_ACCENT=$'\033[38;2;245;78;0m'; C_GREEN=$'\033[38;2;74;222;128m'
@@ -64,41 +69,64 @@ if [ "$TTY_OUT" -eq 1 ] && [ -z "${NO_COLOR:-}" ]; then
 fi
 
 # ---------------------------------------------------------------- the rail ----
-# 6 steps; the ✔/◆/○ vocabulary. The rail is redrawn in place on a tty (cursor-up +
-# clear-below, no library); over a pipe each screen degrades to one numbered line.
+# 6 steps; the ✔/◆/○ vocabulary. The rail is redrawn in place on a tty from a SAVED
+# BUFFER of the wizard's own lines (RAIL_BUF) — never by counting the output between
+# draws, because the installer/emit engines print freely and break naive accounting.
+# Over a pipe nothing is saved and nothing rewinds: each screen is one numbered line.
 STEP_LABELS=("platforms" "class" "branch/email" "first gate" "emit" "done")
 STEP_VAL=("" "" "" "" "" "")
-RAIL_LINES=0
-Q_LINES=0
 CURRENT=1
 
-q() { # one printed line of the current screen (counted so the redraw can rewind it)
+# rail_say: one line of wizard output on a tty — stored in the redraw buffer AND
+# printed with a VT100 clear-line prefix (the redraw may overwrite a longer old line).
+# Over a pipe this is exactly printf '%s\n' and nothing is stored.
+rail_say() {
+  if [ "$TTY_OUT" -eq 1 ]; then
+    RAIL_BUF+=("$*")
+    printf '\033[2K%s\n' "$*"
+  else
+    printf '%s\n' "$*"
+  fi
+}
+# rail_seed: the pre-draw frame (logo + header). On a tty it only FILLS the buffer —
+# rail_draw prints it; over a pipe nothing is buffered and it prints directly.
+rail_seed() {
+  if [ "$TTY_OUT" -eq 1 ]; then
+    RAIL_BUF+=("$*")
+  else
+    printf '%s\n' "$*"
+  fi
+}
+# rail_note: a line that prints now but never joins the redraw buffer (engine output,
+# transcripts, the verify echo): the next redraw wipes it with its clear-below.
+rail_note() {
   printf '%s\n' "$*"
-  Q_LINES=$((Q_LINES + 1))
 }
 rail_rewind() {
-  if [ "$TTY_OUT" -eq 1 ] && [ $((RAIL_LINES + Q_LINES)) -gt 0 ]; then
-    printf '\033[%dA\033[J' "$((RAIL_LINES + Q_LINES))"
+  if [ "$TTY_OUT" -eq 1 ]; then
+    printf '\033[%dA\033[J' "${#RAIL_BUF[@]}"
   fi
-  RAIL_LINES=0; Q_LINES=0
 }
-rail_print() { # the summary column: ✔ answered (with its value) · ◆ asking · ○ pending
-  local i glyph col label
+rail_draw() { # reprint the saved buffer, then the live rail row for $CURRENT
+  local i line glyph col label
+  if [ "$TTY_OUT" -eq 0 ]; then return 0; fi
+  for line in "${RAIL_BUF[@]}"; do
+    printf '\033[2K%s\n' "$line"
+  done
   for i in 1 2 3 4 5 6; do
     label="${STEP_LABELS[$((i - 1))]}"
     if [ "$i" -lt "$CURRENT" ]; then
-      printf '  %s✔%s %d. %-13s%s%s%s\n' "$C_GREEN" "$C_RESET" "$i" "$label" "$C_TEXT" "${STEP_VAL[$((i - 1))]}" "$C_RESET"
+      glyph="✔"; col="$C_GREEN"
     elif [ "$i" -eq "$CURRENT" ]; then
-      printf '  %s◆%s %d. %-13s' "$C_ACCENT" "$C_RESET" "$i" "$label"
-      RAIL_LINES=$((RAIL_LINES + 1))
-      return 0   # the asking row is printed by the screen itself, after its question
+      glyph="◆"; col="$C_ACCENT"
     else
-      printf '  %s○%s %d. %-13s\n' "$C_DIM" "$C_RESET" "$i" "$label"
+      glyph="○"; col="$C_DIM"
     fi
-    RAIL_LINES=$((RAIL_LINES + 1))
+    printf '\033[2K  %s%s %d. %-13s%s%s%s\n' "${col}${glyph}" "$C_RESET" "$i" "$label" "$C_TEXT" "${STEP_VAL[$((i - 1))]}" "$C_RESET"
   done
 }
-cascade() { # the pipe-degraded shape: one numbered line per screen
+rail_reset() { RAIL_BUF=(); }
+cascade() { # the pipe-degraded shape: one numbered line per screen (zero cursor motion)
   printf 'gob init [%d/6] %s\n' "$CURRENT" "$1"
 }
 
@@ -108,7 +136,7 @@ ask_value() {
   if [ "$TTY_IN" -eq 0 ]; then REPLY="$dflt"; return 0; fi
   printf '      %s%s%s %s─ %s' "$C_TEXT" "$label" "$C_RESET" "$C_DIM" "$dflt"
   read -r REPLY
-  printf '\n'; Q_LINES=$((Q_LINES + 1))
+  rail_say ""
   [ -n "$REPLY" ] || REPLY="$dflt"
   return 0
 }
@@ -146,18 +174,25 @@ TARGET=$(g_expand_tilde "$TARGET")
 TARGET=$(cd "$TARGET" && pwd)
 
 # ------------------------------------------------------------ screen 1: welcome
-printf '%s\n' "${C_ACCENT}▄███▄ ▄██▄ ██▄  █    ▄█▄ █  █   ▄██▀ █████ ▄███▄ ▄███ █  █${C_RESET}"
-printf '%s\n' "${C_ACCENT}█   █ █  █ █▄▀█ █     █  █▄ █   ▀██▄   █   █   █ █    █ █${C_RESET}"
-printf '%s\n' "${C_ACCENT}█ ▄██ █  █ █▄▀█ █     █  █ ▄█   ▄█▀    █   █████ █    ██${C_RESET}"
-printf '%s\n' "${C_ACCENT}▀██▀▀ ▀██▀ ██▀  ▀▀▀▀ ▀█▀ █  █   ██▀▀   ▀   █   █ ▀██▀ █ █${C_RESET}"
-printf '%s\n' "${C_DIM}     discipline around whatever executes${C_RESET}"
-printf '\n'
-printf '%s\n' "${C_TEXT}  gob init${C_RESET} ${C_MUTED}— first-run setup (gobstack v$VERSION)${C_RESET}"
-printf '%s\n' "  ${C_MUTED}6 steps · every step has a flag · nothing is written until the plan is confirmed${C_RESET}"
-printf '\n'
+# The logotype and the header ride the redraw buffer (rail_say): every later screen
+# redraws logo + header + rail as one stable frame. Over a pipe rail_say is plain
+# printf and nothing is buffered — the cascade keeps zero cursor motion.
 CURRENT=1
-if [ "$TTY_OUT" -eq 1 ]; then rail_print
-else cascade "welcome: gobstack v$VERSION — the guided first run"; fi
+rail_reset
+rail_seed "${C_ACCENT}▄███▄ ▄██▄ ██▄  █    ▄█▄ █  █   ▄██▀ █████ ▄███▄ ▄███ █  █${C_RESET}"
+rail_seed "${C_ACCENT}█   █ █  █ █▄▀█ █     █  █▄ █   ▀██▄   █   █   █ █    █ █${C_RESET}"
+rail_seed "${C_ACCENT}█ ▄██ █  █ █▄▀█ █     █  █ ▄█   ▄█▀    █   █████ █    ██${C_RESET}"
+rail_seed "${C_ACCENT}▀██▀▀ ▀██▀ ██▀  ▀▀▀▀ ▀█▀ █  █   ██▀▀   ▀   █   █ ▀██▀ █ █${C_RESET}"
+rail_seed "     ${C_MUTED}discipline around whatever executes${C_RESET}"
+rail_seed ""
+rail_seed "${C_TEXT}  gob init${C_RESET} ${C_MUTED}— first-run setup (gobstack v$VERSION)${C_RESET}"
+rail_seed "  ${C_MUTED}6 steps · every step has a flag · nothing is written until the plan is confirmed${C_RESET}"
+rail_seed ""
+if [ "$TTY_OUT" -eq 1 ]; then
+  rail_draw
+else
+  cascade "welcome: gobstack v$VERSION — the guided first run"
+fi
 
 # Platform enum assembled from fragments (the MD_SLUG precedent): a literal tool name in
 # bin/ trips MD-01's model-name pattern, and run-tests.sh greps this directory.
@@ -170,7 +205,7 @@ PLATFORMS="$PLA hermes copilot cursor opencode codex $GEM"
 # ---------------------------------------------------------- screen 2: detect --
 CURRENT=2
 rail_rewind
-if [ "$TTY_OUT" -eq 1 ]; then rail_print; fi
+if [ "$TTY_OUT" -eq 1 ]; then rail_draw; fi
 DET_ROWS=""
 DET_N=0
 for p in $PLATFORMS; do
@@ -194,19 +229,17 @@ for p in $PLATFORMS; do
     DET_N=$((DET_N + 1))
   fi
 done
-STEP_VAL[0]="  $C_DIM$DET_N detected$C_RESET"
+STEP_VAL[0]="$C_DIM$DET_N detected$C_RESET"
 if [ "$TTY_OUT" -eq 1 ]; then
-  printf '  %s✔%s %d. %-13s%s%s%s\n' "$C_GREEN" "$C_RESET" 2 "platforms" "$C_TEXT" "$DET_N detected" "$C_RESET"
-  RAIL_LINES=$((RAIL_LINES + 1))
+  rail_say ""
+  rail_say "  ✔ 1. platforms      $C_TEXT$DET_N detected$C_RESET"
   if [ "$DET_N" -eq 0 ]; then
-    printf '      %sno platform detected here — the wizard will still install the harness; emit later with gob emit%s\n' "$C_YELLOW" "$C_RESET"
-    RAIL_LINES=$((RAIL_LINES + 1))
+    rail_say "      ${C_YELLOW}no platform detected here — the wizard will still install the harness; emit later with gob emit$C_RESET"
   else
     while IFS=$'\t' read -r p proj glob hit; do
       [ -n "$p" ] || continue
       case "$glob" in "~"*) glob="${glob/\~/$HOME}" ;; esac
-      printf '      %s✔%s %-9s %s %s(%s)%s\n' "$C_GREEN" "$C_RESET" "$p" "$glob" "$C_DIM" "$hit" "$C_RESET"
-      RAIL_LINES=$((RAIL_LINES + 1))
+      rail_say "      $C_GREEN✔$C_RESET $C_TEXT$p$C_RESET $glob $C_DIM($hit)$C_RESET"
     done <<< "$DET_ROWS"
   fi
 else
@@ -216,23 +249,23 @@ fi
 # ------------------------------------------------------------ screen 3: class -
 CURRENT=3
 rail_rewind
-if [ "$TTY_OUT" -eq 1 ]; then rail_print; fi
+if [ "$TTY_OUT" -eq 1 ]; then rail_draw; fi
 CLASS_DEFAULT=1
 if [ -z "$CLASS" ]; then
   if [ "$TTY_IN" -eq 1 ]; then
-    q ""
-    q "      ${C_MUTED}what kind of work does this repo do?$C_RESET"
-    q "      $C_TEXT  1 ▸ app        shipped features, PRs, review gates        ${C_DIM}(class A)$C_RESET"
-    q "      $C_TEXT  2   service    backend jobs, config, unattended runs      ${C_DIM}(class B)$C_RESET"
-    q "      $C_TEXT  3   game       playable builds, perf budgets              ${C_DIM}(class C)$C_RESET"
-    q "      $C_TEXT  4   research   specs, replays, reference corpora          ${C_DIM}(class D)$C_RESET"
-    q "      $C_TEXT  5   agent      fleets, loops, unattended automation       ${C_DIM}(class E)$C_RESET"
-    q "      $C_TEXT  6   desktop    the shell you live in, perf budget         ${C_DIM}(class F)$C_RESET"
-    q "      ${C_MUTED}↑ number + Enter · Enter = app · the class letter works too (A-F)$C_RESET"
+    rail_say ""
+    rail_say "      ${C_MUTED}what kind of work does this repo do?$C_RESET"
+    rail_say "      $C_TEXT  1 ▸ app        shipped features, PRs, review gates        ${C_DIM}(class A)$C_RESET"
+    rail_say "      $C_TEXT  2   service    backend jobs, config, unattended runs      ${C_DIM}(class B)$C_RESET"
+    rail_say "      $C_TEXT  3   game       playable builds, perf budgets              ${C_DIM}(class C)$C_RESET"
+    rail_say "      $C_TEXT  4   research   specs, replays, reference corpora          ${C_DIM}(class D)$C_RESET"
+    rail_say "      $C_TEXT  5   agent      fleets, loops, unattended automation       ${C_DIM}(class E)$C_RESET"
+    rail_say "      $C_TEXT  6   desktop    the shell you live in, perf budget         ${C_DIM}(class F)$C_RESET"
+    rail_say "      ${C_MUTED}↑ number + Enter · Enter = app · the class letter works too (A-F)$C_RESET"
     printf '      '
     read -r REPLY_CLASS
     ASKED_ANY=1
-    printf '\n'; Q_LINES=$((Q_LINES + 1))
+    rail_say ""
   else
     REPLY_CLASS="1"
     cascade "class: app (default; --class app|service|game|research|agent|desktop or A-F)"
@@ -258,10 +291,9 @@ case "$CLASS" in
     exit 2 ;;
 esac
 CLASS_NAME=$(ls "$SRC"/presets/"$CLASS"-*.yaml 2>/dev/null | head -n 1)
-STEP_VAL[1]="  $C_TEXT$CLASS ($([ -n "$CLASS_NAME" ] && basename "$CLASS_NAME" .yaml | cut -d- -f2-))$C_RESET"
+STEP_VAL[1]="$C_TEXT$CLASS ($([ -n "$CLASS_NAME" ] && basename "$CLASS_NAME" .yaml | cut -d- -f2-))$C_RESET"
 if [ "$TTY_OUT" -eq 1 ]; then
-  printf '  %s✔%s %d. %-13s%s%s%s\n' "$C_GREEN" "$C_RESET" 3 "class" "$C_TEXT" "$CLASS$([ -n "$CLASS_NAME" ] && printf ' — %s' "$(basename "$CLASS_NAME" .yaml | cut -d- -f2-)")$C_RESET"
-  RAIL_LINES=$((RAIL_LINES + 1))
+  rail_say "  ✔ $((CURRENT - 1)). class            $C_TEXT$CLASS$([ -n "$CLASS_NAME" ] && printf ' — %s' "$(basename "$CLASS_NAME" .yaml | cut -d- -f2-)")$C_RESET"
 else
   cascade "class: $CLASS"
 fi
@@ -269,15 +301,15 @@ fi
 # ----------------------------------------------------- screen 4: branch/email --
 CURRENT=4
 rail_rewind
-if [ "$TTY_OUT" -eq 1 ]; then rail_print; fi
+if [ "$TTY_OUT" -eq 1 ]; then rail_draw; fi
 DEF_BRANCH=$( cd "$TARGET" && git rev-parse --abbrev-ref HEAD 2>/dev/null )
 case "$DEF_BRANCH" in ""|HEAD) DEF_BRANCH=main ;; esac
 DEF_EMAIL=$( cd "$TARGET" && git config user.email 2>/dev/null )
 [ -n "$DEF_EMAIL" ] || DEF_EMAIL="you@example.com"
 if [ -z "$BRANCH" ] || [ -z "$EMAIL" ]; then
   if [ "$TTY_IN" -eq 1 ]; then
-    q ""
-    q "      ${C_MUTED}the forge contract — the identity this repo commits with (CM-01)$C_RESET"
+    rail_say ""
+    rail_say "      ${C_MUTED}the forge contract — the identity this repo commits with (CM-01)$C_RESET"
     ask_value "default branch" "$DEF_BRANCH"; BRANCH="${BRANCH:-$REPLY}"
     ask_value "owner email" "$DEF_EMAIL"; EMAIL="${EMAIL:-$REPLY}"
   else
@@ -288,29 +320,27 @@ if [ -z "$BRANCH" ] || [ -z "$EMAIL" ]; then
 fi
 BRANCH="${BRANCH:-$DEF_BRANCH}"
 EMAIL="${EMAIL:-$DEF_EMAIL}"
-STEP_VAL[2]="  $C_TEXT$BRANCH · $EMAIL$C_RESET"
+STEP_VAL[2]="$C_TEXT$BRANCH · $EMAIL$C_RESET"
 if [ "$TTY_OUT" -eq 1 ]; then
-  printf '  %s✔%s %d. %-13s%s%s · %s%s\n' "$C_GREEN" "$C_RESET" 4 "branch/email" "$C_TEXT" "$BRANCH" "$EMAIL" "$C_RESET"
-  RAIL_LINES=$((RAIL_LINES + 1))
+  rail_say "  ✔ $((CURRENT - 1)). branch/email   $C_TEXT$BRANCH · $EMAIL$C_RESET"
 fi
 
 # -------------------------------------------------------- screen 5: first gate -
 CURRENT=5
 rail_rewind
-if [ "$TTY_OUT" -eq 1 ]; then rail_print; fi
+if [ "$TTY_OUT" -eq 1 ]; then rail_draw; fi
 GATE_DEFAULT="bash tests/run-tests.sh"
 if [ -z "$GATE" ]; then
   if [ "$TTY_IN" -eq 1 ]; then
-    q ""
-    q "      ${C_MUTED}one real command that must stay green — suggested for a bash suite:$C_RESET"
+    rail_say ""
+    rail_say "      ${C_MUTED}one real command that must stay green — suggested for a bash suite:$C_RESET"
     if [ -f "$TARGET/tests/run-tests.sh" ]; then
-      q "      $C_DIM$GATE_DEFAULT$C_RESET"
+      rail_say "      $C_DIM$GATE_DEFAULT$C_RESET"
       ask_value "gate command" "$GATE_DEFAULT"; GATE="$REPLY"
     else
       ask_value "gate command" "true"; GATE="$REPLY"
       if [ "$GATE" = "true" ]; then
-        q "      ${C_YELLOW}no tests/run-tests.sh found — a placeholder gate is allowed but it proves nothing; replace it in .goblin/goblin.yaml$C_RESET"
-        Q_LINES=$((Q_LINES + 1))
+        rail_say "      ${C_YELLOW}no tests/run-tests.sh found — a placeholder gate is allowed but it proves nothing; replace it in .goblin/goblin.yaml$C_RESET"
       fi
     fi
   else
@@ -318,16 +348,15 @@ if [ -z "$GATE" ]; then
     cascade "gate: $GATE (default)"
   fi
 fi
-STEP_VAL[3]="  $C_TEXT$GATE$C_RESET"
+STEP_VAL[3]="$C_TEXT$GATE$C_RESET"
 if [ "$TTY_OUT" -eq 1 ]; then
-  printf '  %s✔%s %d. %-13s%s%s%s\n' "$C_GREEN" "$C_RESET" 5 "first gate" "$C_TEXT" "$GATE" "$C_RESET"
-  RAIL_LINES=$((RAIL_LINES + 1))
+  rail_say "  ✔ $((CURRENT - 1)). first gate      $C_TEXT$GATE$C_RESET"
 fi
 
 # --------------------------------------------------------- screen 6: the plan --
 CURRENT=6
 rail_rewind
-if [ "$TTY_OUT" -eq 1 ]; then rail_print; fi
+if [ "$TTY_OUT" -eq 1 ]; then rail_draw; fi
 
 # The emit selection: pre-tick the DETECTED platforms (in doctor's enum order).
 EMIT_SELECTED=""
@@ -346,29 +375,37 @@ if [ -n "$EMIT" ]; then
     [ -n "$ok" ] || { g_err "--emit: unknown platform '$w' — I ship $PLA, hermes, copilot, cursor, opencode, codex, $GEM"; exit 2; }
   done
 else
+  # neutral-first: a flags-only run with no --emit emits NOTHING. The detected rows are
+  # shown on the emit screen as pre-ticked SUGGESTIONS for the interactive path; in
+  # non-interactive mode silence means the neutral harness only.
   EMIT_SELECTED=""
-  while IFS=$'\t' read -r p _proj _glob _hit; do
-    [ -n "$p" ] || continue
-    EMIT_SELECTED="$EMIT_SELECTED $p"
-  done <<< "$DET_ROWS"
+  if [ "$YES" -eq 0 ] && [ "$TTY_IN" -eq 1 ]; then
+    while IFS=$'\t' read -r p _proj _glob _hit; do
+      [ -n "$p" ] || continue
+      EMIT_SELECTED="$EMIT_SELECTED $p"
+    done <<< "$DET_ROWS"
+  fi
 fi
 EMIT_N=$(printf '%s' "$EMIT_SELECTED" | awk 'NF' | wc -l | tr -d '[:space:]')
 
 if [ "$TTY_IN" -eq 1 ] && [ -z "$EMIT" ] && [ "$YES" -eq 0 ]; then
-  q ""
-  q "      ${C_MUTED}emit now — the skills go into:$C_RESET"
+  rail_say ""
+  rail_say "      ${C_MUTED}agent skills are opt-in, per platform — emit them into:$C_RESET"
   for p in $PLATFORMS; do
     hit=""
     while IFS=$'	' read -r dp _a _b _c; do [ "$dp" = "$p" ] && hit=1; done <<< "$DET_ROWS"
     [ -n "$hit" ] || continue
-    q "      ${C_GREEN}✔$C_RESET $C_TEXT$p$C_RESET"
+    rail_say "      ${C_GREEN}✔$C_RESET $C_TEXT$p$C_RESET"
   done
-  q "      ${C_DIM}Enter = these; or type platform names to override$C_RESET"
+  rail_say "      ${C_MUTED}the install itself writes none — the harness stays neutral$C_RESET"
+  rail_say "      ${C_MUTED}Enter = these; or type platform names to override (none: type x)$C_RESET"
   printf '      '
   read -r REPLY_EMIT
   ASKED_ANY=1
-  printf '\n'; Q_LINES=$((Q_LINES + 1))
-  if [ -n "$REPLY_EMIT" ]; then
+  rail_say ""
+  if [ "$REPLY_EMIT" = "x" ] || [ "$REPLY_EMIT" = "none" ]; then
+    EMIT_SELECTED=""
+  elif [ -n "$REPLY_EMIT" ]; then
     EMIT_SELECTED=""
     for w in $REPLY_EMIT; do
       ok=""
@@ -377,16 +414,18 @@ if [ "$TTY_IN" -eq 1 ] && [ -z "$EMIT" ] && [ "$YES" -eq 0 ]; then
     done
   fi
 fi
-STEP_VAL[4]="  $C_TEXT$EMIT_N platform(s) · scope $SCOPE$C_RESET"
+STEP_VAL[4]="$C_TEXT$EMIT_N platform(s) · scope $SCOPE$C_RESET"
 if [ "$TTY_OUT" -eq 1 ]; then
-  printf '  %s✔%s %d. %-13s%s%d platform(s) · scope %s%s\n' "$C_GREEN" "$C_RESET" 6 "emit" "$C_TEXT" "$EMIT_N" "$SCOPE" "$C_RESET"
-  RAIL_LINES=$((RAIL_LINES + 1))
+  rail_say "  ✔ $((CURRENT - 1)). emit             $C_TEXT$EMIT_N platform(s) · scope $SCOPE$C_RESET"
 fi
 
 # ---- the plan box: the wizard never writes until this has been on the screen ----
+# Spacing: one blank line separates the rail from the box (the spacing pass); the box
+# carries two-space inner padding on every row so the columns align across rows.
 BOX=""
 add() { BOX="$BOX$1
 "; }
+add ""
 add "  ${C_DIM}╭──────────────────────────────────────────────────────╮${C_RESET}"
 add "  ${C_DIM}│${C_RESET}  ${C_GREEN}✔${C_RESET} ${C_TEXT}install${C_RESET}      $C_DIM.goblin/ + the payload into$C_RESET $C_TEXT$TARGET$C_RESET"
 add "  ${C_DIM}│${C_RESET}  ${C_GREEN}✔${C_RESET} ${C_TEXT}class${C_RESET}       $C_TEXT$CLASS$C_RESET ${C_DIM}· branch $C_TEXT$BRANCH$C_RESET ${C_DIM}· email$C_RESET $C_TEXT$EMAIL$C_RESET"
@@ -400,10 +439,11 @@ if [ "$DRYRUN" -eq 1 ]; then
 fi
 # A question the wizard genuinely asked (a screen that waited on read) buys the confirm;
 # flag/non-tty runs already stated their answer as a flag — proceeding is the contract.
+# Single-accent: the confirm prompt is muted + dim, never bold, never a second accent.
 if [ "$YES" -eq 0 ] && [ "${ASKED_ANY:-0}" -eq 1 ]; then
   printf '%s\n' "$BOX"
   if [ "$TTY_IN" -eq 1 ]; then
-    printf '      %sproceed?%s %s[Enter = yes]%s ' "$C_BOLD" "$C_RESET" "$C_DIM" "$C_RESET"
+    printf '      %sproceed?%s %s[Enter = yes]%s ' "$C_MUTED" "$C_RESET" "$C_DIM" "$C_RESET"
     read -r REPLY_GO
     case "$REPLY_GO" in n*|N*) g_info "aborted — nothing was written"; exit 0 ;; esac
   else
@@ -416,8 +456,15 @@ fi
 # carry: the declared identity (branch/owner_email) and the first gate, patched into
 # .goblin/goblin.yaml right after install renders it. The patch is fail-closed — the
 # gate must read back through the engine's own parser or the run stops here.
-if [ "$TTY_OUT" -eq 0 ]; then printf 'gob init [run] goblin-install --target %s --class %s\n' "$TARGET" "$CLASS"; fi
-bash "$SRC/bin/goblin-install" --target "$TARGET" --class "$CLASS" --yes
+# rail_note, not rail_say: engine output below is never redrawn over, and the wizard
+# never rewinds past its own buffer by counting lines it did not print.
+if [ "$TTY_OUT" -eq 1 ]; then
+  rail_note ""
+  rail_note "  ${C_MUTED}running: goblin-install --target $TARGET --class $CLASS${C_RESET}"
+else
+  printf 'gob init [run] goblin-install --target %s --class %s\n' "$TARGET" "$CLASS"
+fi
+bash "$SRC/bin/goblin-install" --target "$TARGET" --class "$CLASS" --skills no --yes
 EXIT_INSTALL=$?
 if [ "$EXIT_INSTALL" -ne 0 ]; then
   g_err "install failed (exit $EXIT_INSTALL) — the refusals above name the path and the fix"
@@ -453,7 +500,11 @@ fi
 
 EMITTED=0
 for p in $EMIT_SELECTED; do
-  [ "$TTY_OUT" -eq 0 ] && printf 'gob init [run] goblin-emit --platform %s --scope %s\n' "$p" "$SCOPE"
+  if [ "$TTY_OUT" -eq 0 ]; then
+    printf 'gob init [run] goblin-emit --platform %s --scope %s\n' "$p" "$SCOPE"
+  else
+    rail_note "  ${C_MUTED}running: goblin-emit --platform $p --scope $SCOPE${C_RESET}"
+  fi
   bash "$SRC/bin/goblin-emit" --platform "$p" --scope "$SCOPE" --target "$TARGET"
   EXIT_EMIT=$?
   if [ "$EXIT_EMIT" -ne 0 ]; then
@@ -464,9 +515,9 @@ for p in $EMIT_SELECTED; do
 done
 
 # --------------------------------------------------- screen 6b: done + verify --
-if [ "$TTY_OUT" -eq 1 ]; then
-  printf '\n'
-else
+# Spacing pass: exactly one blank line before each done-screen section; the engine's
+# verify output and this screen's own summary stay visually separated.
+if [ "$TTY_OUT" -eq 0 ]; then
   printf 'gob init [verify] .goblin/bin/goblin-verify\n'
 fi
 if [ "$DRYRUN" -eq 0 ]; then
@@ -494,16 +545,20 @@ if [ "$DRYRUN" -eq 0 ]; then
     else
       printf '  %sgob verify: %s passed, %s failed, %s skipped · exit %s%s\n' "$C_RED" "$PASSED" "$FAILED" "$SKIPPED" "$VERIFY_RC" "$C_RESET"
     fi
-    printf '\n'
   else
     g_info "gob init [verify] exit $VERIFY_RC: $PASSED passed, $FAILED failed, $ADVISORY advisory, $SKIPPED skipped"
   fi
 
-  printf '  %snext:%s\n' "$C_BOLD" "$C_RESET"
+  printf '\n'
+  printf '  %snext:%s\n' "$C_MUTED" "$C_RESET"
   printf '    1. %sthe %s skipped checks ARE your checklist — gob verify names each one%s\n' "$C_TEXT" "$SKIPPED" "$C_RESET"
   printf '    2. %sreplace the placeholder gate in .goblin/goblin.yaml with your real commands (P8 step 3)%s\n' "$C_TEXT" "$C_RESET"
   printf '    3. %snot emitted here: gob emit --platform <p> --scope global%s\n' "$C_TEXT" "$C_RESET"
-  printf '    4. %shermes skills trust %s   # one-time, so the project-tier skills load%s\n' "$C_TEXT" "$TARGET" "$C_RESET"
+  if [ "$EMIT_N" -gt 0 ]; then
+    printf '    4. %shermes skills trust %s   # one-time, so the project-tier skills load%s\n' "$C_TEXT" "$TARGET" "$C_RESET"
+  else
+    printf '    4. %sagent skills are opt-in per platform: gob emit --platform <p>%s\n' "$C_TEXT" "$C_RESET"
+  fi
   printf '\n'
   if [ "$VERIFY_RC" -eq 0 ]; then
     printf '  %s▙ the goblin sees you. keep the gate green.%s\n' "$C_ACCENT" "$C_RESET"

package/bin/goblin-install

@@ -8,7 +8,8 @@
 #   --practice <path>     the referenced standard (default: $GOBLIN_PRACTICE -> ~/projects/PROJECT-PRACTICE.md); a named path that is absent is reported, never silently dropped
 #   --parts <list>        comma list to install; default = every part the class requires
 #   --archive             mark the project archive: verify requires no HANDOFF and no gates
-#   --skills yes|no       install .hermes/skills (default yes; needs the one-time skills trust step)
+#   --skills yes|no       install agent skills under .hermes/skills (default no; opt in per
+#                         platform with: gob emit --platform <p>)
 #   --dry-run             print the plan; write nothing
 #   --upgrade             re-install at the current version; report created/updated/unchanged/skipped
 #   --opt-out <part>      record the part in disabled: so its required checks are skipped
@@ -40,7 +41,16 @@ PRACTICE="${GOBLIN_PRACTICE:-$HOME/projects/PROJECT-PRACTICE.md}"
 PRACTICE_ARG=""
 PARTS=""
 ARCHIVE="false"
-SKILLS="yes"
+# W6 neutral-first: a default install is a NEUTRAL harness (manifest + verify + HANDOFF +
+# .goblin) with NO agent skills. Agent skills are an explicit opt-in (--skills yes, or the
+# per-platform gob emit path the wizard's emit screen drives). The old default (yes) was the
+# house's own setup, not a product default: a non-agent user got a dead .hermes/ tree, and a
+# user of another agent harness got nothing at all.
+SKILLS="no"
+# Whether --skills was named on the command line: an OMITTED flag on a re-install means
+# "whatever the record says" (the migration contract below); a NAMED --skills no is an
+# explicit opt-out and is honoured verbatim.
+SKILLS_NAMED=0
 DRY_RUN=0
 UPGRADE=0
 UNINSTALL=0
@@ -63,7 +73,7 @@ while [ $# -gt 0 ]; do
     --practice)  PRACTICE="${2:-}"; PRACTICE_ARG="$PRACTICE"; shift 2 ;;
     --parts)     PARTS="${2:-}"; shift 2 ;;
     --archive)   ARCHIVE="true"; shift ;;
-    --skills)    SKILLS="${2:-}"; shift 2 ;;
+    --skills)    SKILLS="${2:-}"; SKILLS_NAMED=1; shift 2 ;;
     --dry-run)   DRY_RUN=1; shift ;;
     --upgrade)   UPGRADE=1; shift ;;
     --uninstall) UNINSTALL=1; shift ;;
@@ -233,6 +243,20 @@ fi
 case "$CLASS" in A|B|C|D|E|F) ;; *) g_err "--class must be one of A B C D E F, got '$CLASS'"; exit 2 ;; esac
 case "$SKILLS" in yes|no) ;; *) g_err "--skills must be yes or no"; exit 2 ;; esac
 
+# W6 migration safety: on a --upgrade (or any re-install) of a repo whose record shows skills
+# were installed, an OMITTED --skills flag must READ that state, not silently strip it. The
+# idempotence contract (created/updated/unchanged) holds only if the effective skills choice
+# for a flag-less re-install is `the record's choice`, so previously-installed skills survive
+# every upgrade unchanged. An EXPLICIT --skills no is honoured verbatim (the switch stays
+# real), and --uninstall still removes exactly what the record lists.
+if [ -f "$INSTALLED" ] && [ "$SKILLS_NAMED" -eq 0 ]; then
+  PREV_SKILLS=$(g_installed_scalar_options "$INSTALLED" skills)
+  if [ "$PREV_SKILLS" = "yes" ]; then
+    SKILLS="yes"
+    g_info "skills: this repo's install record has agent skills installed - they are kept (remove them with an explicit --skills no, or --uninstall)"
+  fi
+fi
+
 PRESET=$(ls "$SRC"/presets/"$CLASS"-*.yaml 2>/dev/null | head -n 1)
 [ -n "$PRESET" ] || { g_err "no preset for class $CLASS"; exit 2; }
 
@@ -572,6 +596,30 @@ if [ "$SKILLS" = "yes" ] && part_wanted playbooks; then
   done
 fi
 
+# W6 neutral-first: an EXPLICIT --skills no re-install of a repo that HAS recorded skills
+# removes them — the switch stays real in both directions. The paths come from the previous
+# record, so exactly what was installed is what goes; a skill file the project edited by hand
+# is refused by put's own contract (never clobbered silently), reported in the summary.
+if [ "$SKILLS_NAMED" -eq 1 ] && [ "$SKILLS" = "no" ] && [ -n "$PREV_FILES" ]; then
+  while IFS= read -r rel; do
+    case "$rel" in .hermes/skills/*) ;; *) continue ;; esac
+    dst="$TARGET/$rel"
+    [ -f "$dst" ] || { rm -f "$TARGET/.goblin/$(basename "$rel")" 2>/dev/null; continue; }
+    if [ "$DRY_RUN" -eq 1 ]; then
+      g_info "plan: remove $rel (explicit --skills no)"
+    else
+      rm -f "$dst"
+      g_info "removed $rel (explicit --skills no)"
+    fi
+  done <<EOF
+$PREV_FILES
+EOF
+  # the emptied .hermes/skills/*/<name> and .hermes/ directories go too (deepest first)
+  if [ "$DRY_RUN" -eq 0 ]; then
+    find "$TARGET/.hermes" -depth -type d -exec rmdir {} + 2>/dev/null
+  fi
+fi
+
 # The automation producers. They land in the target so the target is self-contained and
 # IN-02/SK-02 hash them like every other installed file; the cron copy step then reads from
 # here (see the "next:" block and automations/README.md).
@@ -667,12 +715,20 @@ fi
 } > "$TMP/installed.json"
 
 PREV_VERSION=""
-if [ -f "$INSTALLED" ]; then PREV_VERSION=$(g_installed_scalar "$INSTALLED" version); fi
+RECORD_SKILLS_EFFECTIVE=""
+if [ -f "$INSTALLED" ]; then
+  PREV_VERSION=$(g_installed_scalar "$INSTALLED" version)
+  # The record's own skills choice (after the migration read above): a flip of the effective
+  # choice IS a change even when no file hash moved — the explicit --skills no re-install must
+  # rewrite the record (and drop the files), never report no-op over a state change.
+  RECORD_SKILLS_EFFECTIVE=$(g_installed_scalar_options "$INSTALLED" skills)
+fi
 
 
 if [ "$DRY_RUN" -eq 0 ]; then
   mkdir -p "$TARGET/.goblin"
-  if [ "$CREATED" -eq 0 ] && [ "$UPDATED" -eq 0 ] && [ "$PREV_VERSION" = "$VERSION" ]; then
+  if [ "$CREATED" -eq 0 ] && [ "$UPDATED" -eq 0 ] && [ "$PREV_VERSION" = "$VERSION" ] \
+     && [ "$(printf '%s' "$RECORD_SKILLS_EFFECTIVE" )" = "$(printf '%s' "$SKILLS")" ]; then
     g_info "no-op: $UNCHANGED files unchanged (v$VERSION already installed)"
   else
     cp "$TMP/installed.json" "$INSTALLED"
@@ -699,6 +755,8 @@ if [ "$DRY_RUN" -eq 0 ]; then
   g_info "  3. edit .goblin/goblin.yaml: replace the default gate with your real commands (P8 step 3)"
   if [ "$SKILLS" = "yes" ]; then
     g_info "  4. hermes skills trust $TARGET   # one-time, so the project-tier skills load"
+  else
+    g_info "  4. agent skills are opt-in: gob emit --platform <p>   # run gob doctor for the platform list"
   fi
   g_info ""
   g_info "automations (optional; neither writes outside this repo, and A-02 has no agent in it):"