@techgoblin/gobstack 0.4.4-beta.7 → 0.5.0-beta.1

package/README.md

@@ -28,7 +28,7 @@ dependencies disagree with npm's. If you see `ERESOLVE` after a local install, r
 dependency from `package.json` and install globally instead.
 
 **The two-layer model.** The global install gives you the CLI only. `gob init` (or
-`gob install --target <dir> --class A`) then vendors a self-contained engine into the target
+`gob install --target <dir> --class software`) then vendors a self-contained engine into the target
 repo under `.goblin/` — verifier, manifest, ban probes, skills, all of it. That second layer is
 why an initialized repo keeps working on machines with **no gobstack installed at all**: the
 engine lives in the repo, not in your `node_modules`, and `bash .goblin/bin/goblin-verify` (or a
@@ -36,7 +36,7 @@ plain `git` + `bash` box) is the only runtime the repo's gate needs.
 
 Then, from any project:
 
-    gob install --target /path/to/repo --class A
+    gob install --target /path/to/repo --class software
 
 The installer writes only paths it records, hash-compares before writing, and prints `no-op` on a
 second run with the same arguments. It never overwrites `HANDOFF.md`, `AGENTS.md`, a `*-SPEC.md`,
@@ -46,18 +46,27 @@ of file it manages: `docs/CONTRACTS.md`.
 A repo that already has its own `HANDOFF.md` exits 1 on the refusal. That is the contract, not a
 failure: reconcile the file rather than forcing over it — `docs/ADOPTION.md`.
 
+`--class` picks the preset: **software** (the default — shipped features, PRs, review gates),
+**service** (backend jobs, config, unattended runs), **game** (playable builds, perf budgets),
+**research** (specs, replays, reference corpora) and **fleet** (config-of-the-agent repos).
+The single letters `A`–`E` are accepted aliases. What each preset turns on is the matrix in
+`docs/ADOPTION.md`; the older names still resolve (see `docs/CONTRACTS.md`).
+
 After installing, in this order:
 
     cd <target> && git add -A && git commit   # the install is a change like any other
     gob verify                             # or .goblin/bin/goblin-verify, inside the target
-    hermes skills trust <target>              # one-time, Hermes users, so project-tier skills load
+    gob emit --platform <p>                   # optional, per platform: the agent skills are an opt-in
     gob audit                              # once, deliberately: the ONLY network step (SC-07)
 
-**A class-A install verifies green — `43 passed, 0 failed, 11 advisory, 28 skipped`, exit 0 — once
+**A default software-class install (no agent skills — those are `gob emit`'s job) verifies green —
+`38 passed, 0 failed, 11 advisory, 33 skipped`, exit 0 — once
 `HANDOFF.md` names a commit that exists. Before that edit the scaffold's `0000000` placeholder is
-the one expected red: `42 passed, 1 failed`, `HP-05`. Both numbers measured 2026-09-25; the run and
-the fix are step 2 of `docs/GUIDE.md`.**
-Twenty-eight rows skip (`HS-02` has no pinned pre-change commit yet, so the REPLAY is not provable;
+the one expected red: `37 passed, 1 failed`, `HP-05`. Both numbers measured at W6 (neutral-first);
+the run and the fix are step 2 of `docs/GUIDE.md`.**
+Thirty-three rows skip — the five skill rows (`SK-01`..`SK-04`, `AU-04`) skip on the `playbooks`
+opt-out a skills-free install records, then the not-yet rows (`HS-02` has no pinned pre-change
+commit yet, so the REPLAY is not provable;
 `AU-02` and `AU-03` have no report to audit; `SC-06`, `SC-07` and `SC-08` have no dependency
 manifest, no lockfile and no audit record to read; `PF-01` has no measured perf baseline;
 `BN-01`/`BN-02`/`BN-05` have no `src/` for a ban to read, and `BN-03` plus the four electron bans
@@ -83,12 +92,12 @@ The measurement and the vacuous-pass reading are in `docs/CONTRACTS.md`.
 | `gob verify` | run the rule matrix against the current repo — `PASS`/`FAIL`/`SKIP` per row, exit 0 pass · 1 a check failed · 2 could not run · 3 the manifest is broken |
 | `gob bans` | run the ban list (per-pattern red lines over the source tree) |
 | `gob audit` | check recorded dependency claims against live advisory feeds — the only command that touches the network |
-| `gob install` | install the manifest, skills and verifier into a target repo |
+| `gob install` | install the harness into a target repo: manifest, verifier, gates, HANDOFF — no agent skills (those are an opt-in: `gob emit --platform <p>`, or `--skills yes`) |
 | `gob uninstall` | remove everything an install wrote, byte-exactly (`gob install --target <dir> --uninstall` is the same job) |
 | `gob upgrade` | migrate a repo to the shared global engine at `~/.goblin/engine` — 8 steps, two commits, one report |
 | `gob doctor` | one run across the platforms below: DETECTED / NOT-DETECTED / DRIFT per platform |
 | `gob emit` | write the skills + context block for one platform (`--scope project` or `global`); `--unshadow` removes a hermes project skill whose hash equals the source |
-| `gob init` | the first-run wizard: detect → class → branch/email → first gate → emit → verify, one screen per question; every question has a flag (`--class app --branch main --email a@b.c --gate 'cmd' --emit hermes`), so CI runs it with zero prompts; `--dry-run` prints the plan and writes nothing |
+| `gob init` | the first-run wizard: detect → class → branch/email → first gate → emit → verify, one screen per question; every question has a flag (`--class software --branch main --email a@b.c --gate 'cmd' --emit hermes`), so CI runs it with zero prompts; `--dry-run` prints the plan and writes nothing |
 
 `goblin` remains as a legacy alias for every command above — existing scripts keep working, but
 new commands and docs use `gob`.
@@ -111,6 +120,13 @@ One run of `gob emit --platform <p> --scope project` writes the skills and the c
 session of that platform reads; `--scope global` writes to the machine-level anchor. `--dry-run`
 prints the full write plan first.
 
+**Agent skills are opt-in.** A `gob install` writes the neutral harness only — `.goblin/`,
+`HANDOFF.md`, `AGENTS.md`, the checks and the `.gitignore` block; no skills directory, and no
+files belonging to any coding agent. The guided path is `gob init`'s emit screen; the one-shot
+path is `gob emit --platform <p>` after installing. Repos whose install predates the opt-in
+default keep their skills through `gob upgrade` (the install record names them; only an explicit
+`--skills no`, or `--uninstall`, removes them).
+
 ## What it is not
 
 Not a rules document (every rule carries a runnable check or is explicitly counted as
@@ -135,9 +151,9 @@ below is the reference material the guide points into, so the two do not compete
 | `docs/CONTRACTS.md` | the installer/verifier interface, exit codes, idempotency, uninstall |
 | `docs/INTEGRATION.md` | the board, cron, the skills precedence order, the referenced standard |
 | `docs/RISKS.md` | the risk register, the advisory rows named, the non-goals |
-| `docs/CI.md` | the CI lane: what makes a workflow a gate, the four settings a repository cannot set, and the desktop-shell class |
+| `docs/CI.md` | the CI lane: what makes a workflow a gate, the four settings a repository cannot set, and the electron opt-in |
 | `docs/LOOP.md` | the judge role and the loop contract: what a goal-mode loop actually does, the record, and what neither can see |
-| `docs/ADOPTION.md` | the six classes, the preset matrix, the adoption order |
+| `docs/ADOPTION.md` | the five classes, the preset matrix, the adoption order |
 | `docs/LIMITS.md` | where this is weaker than its sources, and what is unproven |
 
 `manifest/enforcement.tsv` is the source of truth for rules; `manifest/classes.tsv` for what a
@@ -156,7 +172,7 @@ run · `3` the manifest is broken. Every run prints what it cannot see.
     bash tests/run-tests.sh
 
 Runs the source-scope rules (PR-01..PR-05) and the test scripts, including `t-verify-red.sh` —
-one control per target-scope row (167 over 82 target rows), each required to go RED and then
+one control per target-scope row (168 over 82 target rows), each required to go RED and then
 restored, plus `t-audit.sh` for the SC-07 producer. **A verifier that only ever prints GREEN is a
 failure**, so that file is the one that matters most.
 

package/VERSION

@@ -1 +1 @@
-0.4.4
+0.5.0

package/bin/goblin-audit

@@ -23,7 +23,7 @@
 #      because an empty record reads to SC-07 as "clean" and that would be a fabricated pass
 set -uo pipefail
 
-GOBLIN_AUDIT_VERSION="0.4.4"
+GOBLIN_AUDIT_VERSION="0.5.0"
 
 usage() { sed -n '2,/^$/p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'; }
 

package/bin/goblin-bans

@@ -28,7 +28,7 @@
 
 set -uo pipefail
 
-GOBLIN_BANS_VERSION="0.4.4"
+GOBLIN_BANS_VERSION="0.5.0"
 SELF_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
 # shellcheck source=goblin-lib.sh
 . "$SELF_DIR/goblin-lib.sh"
@@ -88,6 +88,14 @@ if [ -f "$CONFIG" ]; then
   ENABLED=$(g_yaml_scalar "$CONFIG" bans)
   ENABLED=${ENABLED#[}; ENABLED=${ENABLED%]}
   ENABLED=$(printf '%s' "$ENABLED" | tr ',' ' ' | tr -s ' ' ' ')
+  # The electron opt-in (software class): `electron: true` turns the electron ban set ON even
+  # when a hand-edited bans: list omits it — the declaration is the contract, and the engine
+  # (not the LLM) is what makes a listed ban non-skippable. A repo without the key is unaffected.
+  if [ "$(g_yaml_scalar "$CONFIG" electron)" = "true" ]; then
+    for e in BN-06 BN-07 BN-08 BN-09; do
+      case " $ENABLED " in *" $e "*) ;; *) ENABLED="$ENABLED $e" ;; esac
+    done
+  fi
 fi
 enabled() {
   [ -z "$ENABLED" ] && return 1

package/bin/goblin-init

@@ -1,8 +1,8 @@
 #!/usr/bin/env bash
 # goblin-init — the W6 first-run wizard (`gob init`).
 #
-#   gob init [--target <dir>] [--class <app|service|game|research|agent|desktop|A..F>]
-#               [--branch <name>] [--email <addr>] [--gate <cmd>]
+#   gob init [--target <dir>] [--class <software|service|game|research|fleet|A..E|app|agent|desktop>]
+#               [--electron] [--branch <name>] [--email <addr>] [--gate <cmd>]
 #               [--emit <p[,p..]>] [--scope project|global] [--yes] [--dry-run]
 #
 # One screen per question, answered steps collapsing into the ✔/◆/○ rail above. On a tty
@@ -143,6 +143,7 @@ ask_value() {
 
 # ------------------------------------------------------------------ flags -----
 TARGET="" CLASS="" BRANCH="" EMAIL="" GATE="" EMIT="" SCOPE=""
+ELECTRON=0
 YES=0; DRYRUN=0
 usage() { sed -n '2,/^$/p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'; }
 
@@ -150,6 +151,7 @@ while [ $# -gt 0 ]; do
   case "$1" in
     --target)  TARGET="${2:-}"; shift 2 ;;
     --class)   CLASS="${2:-}"; shift 2 ;;
+    --electron) ELECTRON=1; shift ;;
     --branch)  BRANCH="${2:-}"; shift 2 ;;
     --email)   EMAIL="${2:-}"; shift 2 ;;
     --gate)    GATE="${2:-}"; shift 2 ;;
@@ -255,45 +257,45 @@ if [ -z "$CLASS" ]; then
   if [ "$TTY_IN" -eq 1 ]; then
     rail_say ""
     rail_say "      ${C_MUTED}what kind of work does this repo do?$C_RESET"
-    rail_say "      $C_TEXT  1 ▸ app        shipped features, PRs, review gates        ${C_DIM}(class A)$C_RESET"
+    rail_say "      $C_TEXT  1 ▸ software   shipped features, PRs, review gates        ${C_DIM}(class A)$C_RESET"
     rail_say "      $C_TEXT  2   service    backend jobs, config, unattended runs      ${C_DIM}(class B)$C_RESET"
     rail_say "      $C_TEXT  3   game       playable builds, perf budgets              ${C_DIM}(class C)$C_RESET"
     rail_say "      $C_TEXT  4   research   specs, replays, reference corpora          ${C_DIM}(class D)$C_RESET"
-    rail_say "      $C_TEXT  5   agent      fleets, loops, unattended automation       ${C_DIM}(class E)$C_RESET"
-    rail_say "      $C_TEXT  6   desktop    the shell you live in, perf budget         ${C_DIM}(class F)$C_RESET"
-    rail_say "      ${C_MUTED}↑ number + Enter · Enter = app · the class letter works too (A-F)$C_RESET"
+    rail_say "      $C_TEXT  5   fleet      fleets, loops, unattended automation       ${C_DIM}(class E)$C_RESET"
+    rail_say "      ${C_MUTED}↑ number + Enter · Enter = software · a class letter also works (A-E)$C_RESET"
+    rail_say "      ${C_DIM}an Electron desktop shell: pick software, then --electron$C_RESET"
     printf '      '
     read -r REPLY_CLASS
     ASKED_ANY=1
     rail_say ""
   else
     REPLY_CLASS="1"
-    cascade "class: app (default; --class app|service|game|research|agent|desktop or A-F)"
+    cascade "class: software (default; --class software|service|game|research|fleet or A-E)"
   fi
   case "$REPLY_CLASS" in
-    1) CLASS="app" ;; 2) CLASS="service" ;; 3) CLASS="game" ;;
-    4) CLASS="research" ;; 5) CLASS="agent" ;; 6) CLASS="desktop" ;;
-    *) CLASS="${REPLY_CLASS:-app}" ;;
+    1) CLASS="software" ;; 2) CLASS="service" ;; 3) CLASS="game" ;;
+    4) CLASS="research" ;; 5) CLASS="fleet" ;;
+    *) CLASS="${REPLY_CLASS:-software}" ;;
   esac
 fi
-# Normalise every accepted spelling to the letter goblin-install requires. Domain names,
-# the class letter, and a lowercase letter all resolve; anything else is refused here,
-# with the full enum, rather than deep inside the installer.
-case "$CLASS" in
-  app|A|a)      CLASS="A" ;;
-  service|B|b)  CLASS="B" ;;
-  game|C|c)     CLASS="C" ;;
-  research|D|d) CLASS="D" ;;
-  agent|E|e)    CLASS="E" ;;
-  desktop|F|f)  CLASS="F" ;;
-  *)
-    g_err "--class must be app|service|game|research|agent|desktop (or A-F), got '$CLASS'"
-    exit 2 ;;
+# Resolve every accepted spelling to the canonical class NAME. The letters A-E and the old
+# taught names (app/agent/desktop) are read-time aliases; anything else is refused here, with
+# the full enum, rather than deep inside the installer. `desktop`/F means the OLD desktop
+# install, so it also sets the electron opt-in.
+g_class_is_electron_alias "$CLASS" && ELECTRON=1
+CLASS_RAW="$CLASS"
+CLASS=$(g_class_canon "$CLASS") \
+  || { g_err "--class must be software|service|game|research|fleet (or A-E / app / agent / desktop), got '$CLASS_RAW'"; exit 2; }
+case "$CLASS_RAW" in
+  app|agent|desktop) g_info "note: '$CLASS_RAW' is now called '$CLASS' (accepted as an alias)";;
 esac
-CLASS_NAME=$(ls "$SRC"/presets/"$CLASS"-*.yaml 2>/dev/null | head -n 1)
-STEP_VAL[1]="$C_TEXT$CLASS ($([ -n "$CLASS_NAME" ] && basename "$CLASS_NAME" .yaml | cut -d- -f2-))$C_RESET"
+if [ "$ELECTRON" -eq 1 ]; then
+  g_info "electron: on (the desktop opt-in — the app_bundle_bytes ratchet, BN-06..09 bans, a host gate)"
+fi
+CLASS_NAME="$SRC/presets/$CLASS.yaml"
+STEP_VAL[1]="$C_TEXT$CLASS$C_RESET"
 if [ "$TTY_OUT" -eq 1 ]; then
-  rail_say "  ✔ $((CURRENT - 1)). class            $C_TEXT$CLASS$([ -n "$CLASS_NAME" ] && printf ' — %s' "$(basename "$CLASS_NAME" .yaml | cut -d- -f2-)")$C_RESET"
+  rail_say "  ✔ $((CURRENT - 1)). class            $C_TEXT$CLASS$C_RESET"
 else
   cascade "class: $CLASS"
 fi
@@ -375,29 +377,37 @@ if [ -n "$EMIT" ]; then
     [ -n "$ok" ] || { g_err "--emit: unknown platform '$w' — I ship $PLA, hermes, copilot, cursor, opencode, codex, $GEM"; exit 2; }
   done
 else
+  # neutral-first: a flags-only run with no --emit emits NOTHING. The detected rows are
+  # shown on the emit screen as pre-ticked SUGGESTIONS for the interactive path; in
+  # non-interactive mode silence means the neutral harness only.
   EMIT_SELECTED=""
-  while IFS=$'\t' read -r p _proj _glob _hit; do
-    [ -n "$p" ] || continue
-    EMIT_SELECTED="$EMIT_SELECTED $p"
-  done <<< "$DET_ROWS"
+  if [ "$YES" -eq 0 ] && [ "$TTY_IN" -eq 1 ]; then
+    while IFS=$'\t' read -r p _proj _glob _hit; do
+      [ -n "$p" ] || continue
+      EMIT_SELECTED="$EMIT_SELECTED $p"
+    done <<< "$DET_ROWS"
+  fi
 fi
 EMIT_N=$(printf '%s' "$EMIT_SELECTED" | awk 'NF' | wc -l | tr -d '[:space:]')
 
 if [ "$TTY_IN" -eq 1 ] && [ -z "$EMIT" ] && [ "$YES" -eq 0 ]; then
   rail_say ""
-  rail_say "      ${C_MUTED}emit now — the skills go into:$C_RESET"
+  rail_say "      ${C_MUTED}agent skills are opt-in, per platform — emit them into:$C_RESET"
   for p in $PLATFORMS; do
     hit=""
     while IFS=$'	' read -r dp _a _b _c; do [ "$dp" = "$p" ] && hit=1; done <<< "$DET_ROWS"
     [ -n "$hit" ] || continue
     rail_say "      ${C_GREEN}✔$C_RESET $C_TEXT$p$C_RESET"
   done
-  rail_say "      ${C_MUTED}Enter = these; or type platform names to override$C_RESET"
+  rail_say "      ${C_MUTED}the install itself writes none — the harness stays neutral$C_RESET"
+  rail_say "      ${C_MUTED}Enter = these; or type platform names to override (none: type x)$C_RESET"
   printf '      '
   read -r REPLY_EMIT
   ASKED_ANY=1
   rail_say ""
-  if [ -n "$REPLY_EMIT" ]; then
+  if [ "$REPLY_EMIT" = "x" ] || [ "$REPLY_EMIT" = "none" ]; then
+    EMIT_SELECTED=""
+  elif [ -n "$REPLY_EMIT" ]; then
     EMIT_SELECTED=""
     for w in $REPLY_EMIT; do
       ok=""
@@ -452,11 +462,15 @@ fi
 # never rewinds past its own buffer by counting lines it did not print.
 if [ "$TTY_OUT" -eq 1 ]; then
   rail_note ""
-  rail_note "  ${C_MUTED}running: goblin-install --target $TARGET --class $CLASS${C_RESET}"
+  rail_note "  ${C_MUTED}running: goblin-install --target $TARGET --class $CLASS$([ "$ELECTRON" -eq 1 ] && printf ' --electron')${C_RESET}"
 else
-  printf 'gob init [run] goblin-install --target %s --class %s\n' "$TARGET" "$CLASS"
+  printf 'gob init [run] goblin-install --target %s --class %s%s\n' "$TARGET" "$CLASS" "$([ "$ELECTRON" -eq 1 ] && printf ' --electron')"
+fi
+if [ "$ELECTRON" -eq 1 ]; then
+  bash "$SRC/bin/goblin-install" --target "$TARGET" --class "$CLASS" --electron --skills no --yes
+else
+  bash "$SRC/bin/goblin-install" --target "$TARGET" --class "$CLASS" --skills no --yes
 fi
-bash "$SRC/bin/goblin-install" --target "$TARGET" --class "$CLASS" --yes
 EXIT_INSTALL=$?
 if [ "$EXIT_INSTALL" -ne 0 ]; then
   g_err "install failed (exit $EXIT_INSTALL) — the refusals above name the path and the fix"
@@ -546,7 +560,11 @@ if [ "$DRYRUN" -eq 0 ]; then
   printf '    1. %sthe %s skipped checks ARE your checklist — gob verify names each one%s\n' "$C_TEXT" "$SKIPPED" "$C_RESET"
   printf '    2. %sreplace the placeholder gate in .goblin/goblin.yaml with your real commands (P8 step 3)%s\n' "$C_TEXT" "$C_RESET"
   printf '    3. %snot emitted here: gob emit --platform <p> --scope global%s\n' "$C_TEXT" "$C_RESET"
-  printf '    4. %shermes skills trust %s   # one-time, so the project-tier skills load%s\n' "$C_TEXT" "$TARGET" "$C_RESET"
+  if [ "$EMIT_N" -gt 0 ]; then
+    printf '    4. %shermes skills trust %s   # one-time, so the project-tier skills load%s\n' "$C_TEXT" "$TARGET" "$C_RESET"
+  else
+    printf '    4. %sagent skills are opt-in per platform: gob emit --platform <p>%s\n' "$C_TEXT" "$C_RESET"
+  fi
   printf '\n'
   if [ "$VERIFY_RC" -eq 0 ]; then
     printf '  %s▙ the goblin sees you. keep the gate green.%s\n' "$C_ACCENT" "$C_RESET"

package/bin/goblin-install

@@ -3,12 +3,17 @@
 #
 # Usage: gob install --target <dir> [options]   (script: bin/goblin-install)
 #   --target <dir>        required; the repo root to install into
-#   --class A|B|C|D|E|F    required unless --uninstall or --re-pin; anything else needs an explicit class
+#   --class <name>        required unless --uninstall or --re-pin; one of
+#                         software|service|game|research|fleet, or the aliases A-E / app / agent
+#                         / desktop (desktop/F => software + --electron); anything else is refused
+#   --electron            the electron opt-in overlay over the software class (electron: true):
+#                         the app_bundle_bytes ratchet, BN-06..09 bans, the host-gate declaration
 #   --models <path>       model mapping file   (default: $GOBLIN_MODELS -> ~/projects/fleet-model.yaml)
 #   --practice <path>     the referenced standard (default: $GOBLIN_PRACTICE -> ~/projects/PROJECT-PRACTICE.md); a named path that is absent is reported, never silently dropped
 #   --parts <list>        comma list to install; default = every part the class requires
 #   --archive             mark the project archive: verify requires no HANDOFF and no gates
-#   --skills yes|no       install .hermes/skills (default yes; needs the one-time skills trust step)
+#   --skills yes|no       install agent skills under .hermes/skills (default no; opt in per
+#                         platform with: gob emit --platform <p>)
 #   --dry-run             print the plan; write nothing
 #   --upgrade             re-install at the current version; report created/updated/unchanged/skipped
 #   --opt-out <part>      record the part in disabled: so its required checks are skipped
@@ -22,7 +27,7 @@
 
 set -uo pipefail
 
-GOBLIN_INSTALL_VERSION="0.4.4"
+GOBLIN_INSTALL_VERSION="0.5.0"
 SELF_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
 SRC=$(cd "$SELF_DIR/.." && pwd)
 # shellcheck source=goblin-lib.sh
@@ -40,13 +45,26 @@ PRACTICE="${GOBLIN_PRACTICE:-$HOME/projects/PROJECT-PRACTICE.md}"
 PRACTICE_ARG=""
 PARTS=""
 ARCHIVE="false"
-SKILLS="yes"
+# W6 neutral-first: a default install is a NEUTRAL harness (manifest + verify + HANDOFF +
+# .goblin) with NO agent skills. Agent skills are an explicit opt-in (--skills yes, or the
+# per-platform gob emit path the wizard's emit screen drives). The old default (yes) was the
+# house's own setup, not a product default: a non-agent user got a dead .hermes/ tree, and a
+# user of another agent harness got nothing at all.
+SKILLS="no"
+# Whether --skills was named on the command line: an OMITTED flag on a re-install means
+# "whatever the record says" (the migration contract below); a NAMED --skills no is an
+# explicit opt-out and is honoured verbatim.
+SKILLS_NAMED=0
 DRY_RUN=0
 UPGRADE=0
 UNINSTALL=0
 RE_PIN=0
 FORCE=0
 OPT_OUT=""
+# The electron opt-in (the merged desktop/F class): renders presets/electron-overlay.yaml over
+# the software preset. Auto-set when --class resolves via the desktop/F/f alias, so the alias
+# behaves as the old class F did rather than silently installing weaker software.
+ELECTRON=0
 
 usage() {
   # The header comment runs from line 2 to the first blank line, so adding an option cannot
@@ -63,7 +81,8 @@ while [ $# -gt 0 ]; do
     --practice)  PRACTICE="${2:-}"; PRACTICE_ARG="$PRACTICE"; shift 2 ;;
     --parts)     PARTS="${2:-}"; shift 2 ;;
     --archive)   ARCHIVE="true"; shift ;;
-    --skills)    SKILLS="${2:-}"; shift 2 ;;
+    --electron)  ELECTRON=1; shift ;;
+    --skills)    SKILLS="${2:-}"; SKILLS_NAMED=1; shift 2 ;;
     --dry-run)   DRY_RUN=1; shift ;;
     --upgrade)   UPGRADE=1; shift ;;
     --uninstall) UNINSTALL=1; shift ;;
@@ -229,14 +248,48 @@ if [ "$RE_PIN" -eq 1 ]; then
   exit 0
 fi
 
-[ -n "$CLASS" ] || { g_err "--class is required (A|B|C|D|E|F)"; exit 2; }
-case "$CLASS" in A|B|C|D|E|F) ;; *) g_err "--class must be one of A B C D E F, got '$CLASS'"; exit 2 ;; esac
+[ -n "$CLASS" ] || { g_err "--class is required (software|service|game|research|fleet, or A-E / app / agent / desktop)"; exit 2; }
+# Resolve every accepted spelling to the canonical class NAME before anything reads it. The
+# letters A-E and the old names app/agent/desktop are read-time aliases; desktop/F/f also sets
+# the electron opt-in so the merged class behaves as the old class F did.
+g_class_is_electron_alias "$CLASS" && ELECTRON=1
+CLASS_RAW="$CLASS"
+CLASS=$(g_class_canon "$CLASS") \
+  || { g_err "--class must be software|service|game|research|fleet (or A-E / app / agent / desktop), got '$CLASS_RAW'"; exit 2; }
 case "$SKILLS" in yes|no) ;; *) g_err "--skills must be yes or no"; exit 2 ;; esac
 
-PRESET=$(ls "$SRC"/presets/"$CLASS"-*.yaml 2>/dev/null | head -n 1)
-[ -n "$PRESET" ] || { g_err "no preset for class $CLASS"; exit 2; }
+# W6 migration safety: on a --upgrade (or any re-install) of a repo whose record shows skills
+# were installed, an OMITTED --skills flag must READ that state, not silently strip it. The
+# idempotence contract (created/updated/unchanged) holds only if the effective skills choice
+# for a flag-less re-install is `the record's choice`, so previously-installed skills survive
+# every upgrade unchanged. An EXPLICIT --skills no is honoured verbatim (the switch stays
+# real), and --uninstall still removes exactly what the record lists.
+if [ -f "$INSTALLED" ] && [ "$SKILLS_NAMED" -eq 0 ]; then
+  PREV_SKILLS=$(g_installed_scalar_options "$INSTALLED" skills)
+  if [ "$PREV_SKILLS" = "yes" ]; then
+    SKILLS="yes"
+    g_info "skills: this repo's install record has agent skills installed - they are kept (remove them with an explicit --skills no, or --uninstall)"
+  fi
+fi
+
+PRESET="$SRC/presets/$CLASS.yaml"
+[ -f "$PRESET" ] || { g_err "no preset for class $CLASS ($PRESET)"; exit 2; }
+
+# The electron overlay (the merged desktop/F class): every key it declares — including an empty
+# one like sec_write_routes: "" — wins over the class preset; an absent key falls through. This
+# is config, not a second code path: the same preset() reader, one layer up.
+OVERLAY=""
+if [ "$ELECTRON" -eq 1 ]; then
+  OVERLAY="$SRC/presets/electron-overlay.yaml"
+  [ -f "$OVERLAY" ] || { g_err "no electron overlay at $OVERLAY"; exit 2; }
+fi
+overlay_has() { [ -n "$OVERLAY" ] && grep -qE "^$1:" "$OVERLAY"; }
 
-preset() { local v; v=$(g_yaml_scalar "$PRESET" "$1"); printf '%s' "${v%\"}" | sed 's/^"//'; }
+preset() {
+  local v
+  if overlay_has "$1"; then v=$(g_yaml_scalar "$OVERLAY" "$1"); else v=$(g_yaml_scalar "$PRESET" "$1"); fi
+  printf '%s' "${v%\"}" | sed 's/^"//'
+}
 
 HARNESS_DIR=$(preset harness_dir); [ -n "$HARNESS_DIR" ] || HARNESS_DIR=checks
 SCAFFOLD=$(preset scaffold_checks); [ -n "$SCAFFOLD" ] || SCAFFOLD=no
@@ -464,6 +517,7 @@ render_config() {
   runtime="  - $RUNTIME_DATA"
   render "$SRC/templates/goblin.yaml.tmpl" \
     CLASS "$CLASS" \
+    ELECTRON "$( [ "$ELECTRON" -eq 1 ] && printf 'true' || printf 'false' )" \
     BRANCH "$BRANCH" \
     MODELS_FILE "$MODELS" \
     PRACTICE "$PRACTICE" \
@@ -572,6 +626,30 @@ if [ "$SKILLS" = "yes" ] && part_wanted playbooks; then
   done
 fi
 
+# W6 neutral-first: an EXPLICIT --skills no re-install of a repo that HAS recorded skills
+# removes them — the switch stays real in both directions. The paths come from the previous
+# record, so exactly what was installed is what goes; a skill file the project edited by hand
+# is refused by put's own contract (never clobbered silently), reported in the summary.
+if [ "$SKILLS_NAMED" -eq 1 ] && [ "$SKILLS" = "no" ] && [ -n "$PREV_FILES" ]; then
+  while IFS= read -r rel; do
+    case "$rel" in .hermes/skills/*) ;; *) continue ;; esac
+    dst="$TARGET/$rel"
+    [ -f "$dst" ] || { rm -f "$TARGET/.goblin/$(basename "$rel")" 2>/dev/null; continue; }
+    if [ "$DRY_RUN" -eq 1 ]; then
+      g_info "plan: remove $rel (explicit --skills no)"
+    else
+      rm -f "$dst"
+      g_info "removed $rel (explicit --skills no)"
+    fi
+  done <<EOF
+$PREV_FILES
+EOF
+  # the emptied .hermes/skills/*/<name> and .hermes/ directories go too (deepest first)
+  if [ "$DRY_RUN" -eq 0 ]; then
+    find "$TARGET/.hermes" -depth -type d -exec rmdir {} + 2>/dev/null
+  fi
+fi
+
 # The automation producers. They land in the target so the target is self-contained and
 # IN-02/SK-02 hash them like every other installed file; the cron copy step then reads from
 # here (see the "next:" block and automations/README.md).
@@ -667,12 +745,20 @@ fi
 } > "$TMP/installed.json"
 
 PREV_VERSION=""
-if [ -f "$INSTALLED" ]; then PREV_VERSION=$(g_installed_scalar "$INSTALLED" version); fi
+RECORD_SKILLS_EFFECTIVE=""
+if [ -f "$INSTALLED" ]; then
+  PREV_VERSION=$(g_installed_scalar "$INSTALLED" version)
+  # The record's own skills choice (after the migration read above): a flip of the effective
+  # choice IS a change even when no file hash moved — the explicit --skills no re-install must
+  # rewrite the record (and drop the files), never report no-op over a state change.
+  RECORD_SKILLS_EFFECTIVE=$(g_installed_scalar_options "$INSTALLED" skills)
+fi
 
 
 if [ "$DRY_RUN" -eq 0 ]; then
   mkdir -p "$TARGET/.goblin"
-  if [ "$CREATED" -eq 0 ] && [ "$UPDATED" -eq 0 ] && [ "$PREV_VERSION" = "$VERSION" ]; then
+  if [ "$CREATED" -eq 0 ] && [ "$UPDATED" -eq 0 ] && [ "$PREV_VERSION" = "$VERSION" ] \
+     && [ "$(printf '%s' "$RECORD_SKILLS_EFFECTIVE" )" = "$(printf '%s' "$SKILLS")" ]; then
     g_info "no-op: $UNCHANGED files unchanged (v$VERSION already installed)"
   else
     cp "$TMP/installed.json" "$INSTALLED"
@@ -699,6 +785,8 @@ if [ "$DRY_RUN" -eq 0 ]; then
   g_info "  3. edit .goblin/goblin.yaml: replace the default gate with your real commands (P8 step 3)"
   if [ "$SKILLS" = "yes" ]; then
     g_info "  4. hermes skills trust $TARGET   # one-time, so the project-tier skills load"
+  else
+    g_info "  4. agent skills are opt-in: gob emit --platform <p>   # run gob doctor for the platform list"
   fi
   g_info ""
   g_info "automations (optional; neither writes outside this repo, and A-02 has no agent in it):"

package/bin/goblin-lib.sh

@@ -16,7 +16,7 @@
 #     - name: typecheck        four-space-indented second member of a list entry
 #       cmd: npx tsc --noEmit
 
-GOBLIN_LIB_VERSION="0.4.4"
+GOBLIN_LIB_VERSION="0.5.0"
 
 # ---------------------------------------------------------------- output -----
 g_pass() { printf 'PASS  %-6s %s\n' "$1" "$2"; }
@@ -185,6 +185,33 @@ g_part_disabled() {
 }
 
 # ------------------------------------------------------------- class data ----
+# g_class_canon <spelling> -> the canonical class NAME
+#   software | service | game | research | fleet
+# The taxonomy is five domain-named classes. The letters A-E and the older taught domain names
+# (app, agent, desktop) stay as READ-TIME aliases so every existing installed.json / goblin.yaml
+# - which record a letter or an old name - keeps verifying with no rewrite. `desktop` / `F` / `f`
+# resolve to `software`: F was merged into A (their classes.tsv need columns are identical), and
+# what made a desktop shell different is the `electron:` opt-in + ban list, config keys the repo
+# already carries. Unknown spelling -> empty output; the caller refuses with the enum.
+g_class_canon() {
+  case "$1" in
+    software|A|a|app)    printf 'software' ;;
+    service|B|b)         printf 'service' ;;
+    game|C|c)            printf 'game' ;;
+    research|D|d)        printf 'research' ;;
+    fleet|E|e|agent)     printf 'fleet' ;;
+    desktop|F|f)         printf 'software' ;;
+    *) return 1 ;;
+  esac
+}
+
+# g_class_is_electron_alias <spelling> -> 0 when the spelling is the merged desktop/F spelling.
+# `--class desktop` (or F/f) must mean the OLD desktop install, not a silently weaker software
+# one: the installer auto-sets electron: true so the alias behaves as F did.
+g_class_is_electron_alias() {
+  case "$1" in desktop|F|f) return 0 ;; *) return 1 ;; esac
+}
+
 # g_class_need <classes.tsv> <class> <part> -> R | O | -
 g_class_need() {
   awk -F'\t' -v c="$2" -v p="$3" '
@@ -216,6 +243,37 @@ g_installed_scalar() {
   sed -n "s/^[[:space:]]*\"$2\"[[:space:]]*:[[:space:]]*\"\{0,1\}\([^\",]*\)\"\{0,1\},\{0,1\}$/\1/p" "$1" | head -n 1
 }
 
+# g_installed_scalar_options <file> <key> — the value of one key inside the "options" object
+# of an install record (e.g. skills). The installer writes options on ONE line
+# (`"options": {"skills": "yes", ...}`), so the awk reads that line's shape directly; a
+# multi-line variant is read the same way the other installed_* readers read their block.
+g_installed_scalar_options() {
+  awk -v k="$2" '
+    /^[[:space:]]*"options"[[:space:]]*:[[:space:]]*\{/ && index($0, "\"" k "\"") {
+      # single-line form: pull the value out between the key and the next , or }
+      line = $0
+      sub(/^[^{]*\{/, "", line)          # everything up to and including the opening brace
+      n = split(line, pair, ",")
+      for (i = 1; i <= n; i++) {
+        p = pair[i]
+        sub(/^[[:space:]]*/, "", p); sub(/[[:space:]]*$/, "", p)
+        key = p; sub(/[[:space:]]*:.*/, "", key); gsub(/"/, "", key)
+        if (key == k) {
+          v = p; sub(/^[^:]*:[[:space:]]*/, "", v); gsub(/"/, "", v); sub(/\}[[:space:]]*$/, "", v)
+          print v; exit
+        }
+      }
+      exit
+    }
+    /^[[:space:]]*"options"[[:space:]]*:[[:space:]]*\{/ { inf = 1; next }
+    inf && /^[[:space:]]*\}/ { inf = 0 }
+    inf && index($0, "\"" k "\"") {
+      v = $0; sub(/^[^:]*:[[:space:]]*/, "", v); sub(/,?[[:space:]]*$/, "", v); gsub(/"/, "", v)
+      print v; exit
+    }
+  ' "$1"
+}
+
 # ------------------------------------------------------------- self-test -----
 # Proves the parser actually parses. Every assertion is a real comparison against a
 # value written to a temp file in this function — blank the awk in g_yaml_scalar and

package/bin/goblin-upgrade

@@ -30,7 +30,7 @@
 # `git revert` of this command's own two commits (W3-SPEC §5).
 set -uo pipefail
 
-GOBLIN_UPGRADE_VERSION="0.4.4"
+GOBLIN_UPGRADE_VERSION="0.5.0"
 
 usage() { sed -n '2,/^$/p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'; }