@techgoblin/gobstack 0.4.4-beta.7 → 0.5.0-beta.1

package/bin/goblin-verify

@@ -19,7 +19,7 @@
 
 set -uo pipefail
 
-GOBLIN_VERIFY_VERSION="0.4.4"
+GOBLIN_VERIFY_VERSION="0.5.0"
 SELF_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
 # shellcheck source=goblin-lib.sh
 . "$SELF_DIR/goblin-lib.sh"
@@ -261,15 +261,17 @@ if [ -n "$ONLY" ]; then
 fi
 
 if [ ! -f "$CONFIG" ]; then
-  g_err "not installed: $CONFIG is absent. Run: goblin-install --target $ROOT --class <A|B|C|D|E>"
+  g_err "not installed: $CONFIG is absent. Run: goblin-install --target $ROOT --class <software|service|game|research|fleet>"
   exit 2
 fi
 
-CLASS=$(g_yaml_scalar "$CONFIG" class)
-case "$CLASS" in
-  A|B|C|D|E|F) ;;
-  *) g_err "unknown class '${CLASS:-<empty>}' in $CONFIG (expected A|B|C|D|E|F)"; exit 2 ;;
-esac
+# The class is read-time resolved: goblin.yaml records the canonical name on new installs, but
+# every repo installed before the 5-class merge records a letter (A..F) or an old name
+# (app/agent/desktop). g_class_canon maps them all to the five canonical names; the tsv carries
+# the canonical names, so nothing else in this file has to know about letters. `desktop`/F -> software.
+CLASS_RAW=$(g_yaml_scalar "$CONFIG" class)
+CLASS=$(g_class_canon "$CLASS_RAW") \
+  || { g_err "unknown class '${CLASS_RAW:-<empty>}' in $CONFIG (expected software|service|game|research|fleet, or A-E / app / agent / desktop)"; exit 2; }
 
 # Root vs git toplevel. find_installed_root resolves the CONFIG lookup correctly, but the
 # rows that shell out to git run in $ROOT and git resolves that to the ENCLOSING repo when
@@ -374,8 +376,12 @@ PERF_BASELINE_COMMIT=$(g_unquote "$(g_yaml_block_scalar "$CONFIG" perf baseline_
 PERF_BASELINE_VALUE=$(g_yaml_block_scalar "$CONFIG" perf baseline_value)
 PERF_MEASURED=$(g_unquote "$(g_yaml_block_scalar "$CONFIG" perf measured)")
 PERF_HOST_GATE=$(g_yaml_block_scalar "$CONFIG" perf host_gate)
+# The electron opt-in (software class): true means the electron ban set stays on regardless of a
+# hand-edited bans: list, and a perf host gate must be declared (PF-01). Absent on a repo
+# installed before the merge — read as off, so a legacy class-F repo verifies with no rewrite.
+ELECTRON=$(g_yaml_scalar "$CONFIG" electron)
 export SEC_GITIGNORE_FAMILY SEC_BUILD_OUTPUT SEC_AUDIT_CMD SEC_AUDIT_MAX_AGE SEC_WAIVER_MAX_AGE
-export SEC_WRITE_ROUTES PERF_METRIC PERF_CMD PERF_BASELINE_VALUE PERF_HOST_GATE
+export SEC_WRITE_ROUTES PERF_METRIC PERF_CMD PERF_BASELINE_VALUE PERF_HOST_GATE ELECTRON
 
 # Whole days between an ISO date and today, or empty when the date does not parse on this host
 # (`date -d` is GNU; the row FAILS rather than assuming, because an unreadable date is not a
@@ -536,6 +542,13 @@ check_in_02() {
           [ -e "$ROOT/$p" ] || continue ;;
       esac
     fi
+    # W6 neutral-first: an EXPLICIT --skills no re-install removes the recorded skill files
+    # by design (the record follows the switch). Their absence on a record whose options now
+    # say skills=no is the documented opt-out, not drift - the same clause W4a wrote for the
+    # global tier, scoped to the record's own declared choice.
+    case "$p" in
+      .hermes/skills/*) [ -e "$ROOT/$p" ] || [ "$(g_installed_scalar_options "$INSTALLED" skills)" = "yes" ] || continue ;;
+    esac
     n=$((n + 1))
     cur=$(g_sha256_file "$ROOT/$p")
     if [ "$cur" != "$h" ]; then
@@ -606,8 +619,14 @@ check_hp_03() {
       m = split(names, dn, " ")
       for (i = 1; i <= m; i++) if (dn[i] != "") decl[dn[i]] = 1
     }
-    tolower($0) ~ /^#{2,3}[[:space:]]+[^[:alpha:]]*gates?([^[:alpha:]]|$)/ { g = 1; next }
-    g && /^#{1,3}[[:space:]]/ { g = 0 }
+    # Portability (clean-room catch, 2026-10-05): the Debian default awk (mawk) has no
+    # interval expressions ({2,3}) — the header rule matched nothing and HP-03 went red on
+    # every fresh Debian install. The hash-header variants are spelled out as two pattern
+    # statements, and the date as repeated [0-9] groups. (No apostrophes here: this
+    # program is a single-quoted shell string.)
+    tolower($0) ~ /^###[[:space:]]+[^[:alpha:]]*gates?([^[:alpha:]]|$)/ { g = 1; next }
+    tolower($0) ~ /^##[[:space:]]+[^[:alpha:]]*gates?([^[:alpha:]]|$)/ { g = 1; next }
+    g && (/^###[[:space:]]/ || /^##[[:space:]]/ || /^#[[:space:]]/) { g = 0 }
     !g { next }
     tolower($0) ~ /example of the required form/ { next }
     $0 !~ /=/ { next }
@@ -617,7 +636,7 @@ check_hp_03() {
       if (!hit) for (k in decl) if (hasname($0, k)) { hit = 1; break }
       if (hit) {
         n++
-        if ($0 !~ /measured [0-9]{4}-[0-9]{2}-[0-9]{2}/) {
+        if ($0 !~ /measured [0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]/) {
           print "a gate line carries no measured date: " $0
           bad = 1
         }
@@ -1587,6 +1606,13 @@ check_pf_01() {
   # to ignore it.
   local rname bad=0
   rname=$(g_yaml_block_scalar "$CONFIG" ratchet name)
+  # The electron opt-in's done-definition: an Electron repo declares its host gate (the FPS /
+  # main_thread_busy_pct number a hermetic rule cannot measure). `electron: true` with no host
+  # gate is a repo missing half its definition — FAIL, before the baseline skip below can mask it.
+  if [ "$ELECTRON" = "true" ] && [ -z "$PERF_HOST_GATE" ]; then
+    printf 'electron: true requires a declared perf.host_gate — declare the host-gate probe (the number no hermetic rule can measure) or drop electron: true\n'
+    return 1
+  fi
   [ -n "$PERF_METRIC" ] || {
     printf 'this class declares no perf metric (perf.metric is empty). The ratchet still carries\n%s; declare metric/cmd here the day you pick one\n' "${rname:-nothing}"
     return 3
@@ -2661,6 +2687,21 @@ while IFS=$'\t' read -r id scope rule enforced_by artifact check why; do
   only_selected "$id" || continue
 
   part=$(row_part "$id")
+  # W6 neutral-first: in global engine mode AU-01's subject is the PRODUCER glob, which
+  # global mode reads from the engine dir — the row must run there even when the repo's
+  # skills opt-out (playbooks) is set, or the W1 control below it is skip-masked. This
+  # clause precedes the opt-out branch on purpose. SK-01/SK-02/SK-04 and AU-02..AU-04 keep
+  # their opt-out semantics.
+  if [ "$id" = "AU-01" ] && [ "$ENGINE_MODE" = "global" ]; then
+    out=$(check_au_01 2>&1); rc=$?
+    case "$rc" in
+      0) PASS=$((PASS + 1)); emit "$id" PASS "$out" ;;
+      1) FAIL=$((FAIL + 1)); emit "$id" FAIL "$out" ;;
+      2) ADV=$((ADV + 1));  emit "$id" ADV "$out" ;;
+      3) SKIP=$((SKIP + 1)); emit "$id" SKIP "$out" ;;
+    esac
+    continue
+  fi
   if [ -n "$part" ] && g_part_disabled "$CONFIG" "$part"; then
     SKIP=$((SKIP + 1)); emit "$id" SKIP "$rule (opt-out: $part)"; continue
   fi

package/docs/ADOPTION.md

@@ -1,26 +1,25 @@
 # Adoption — classes, presets, and the order
 
-## The six classes
+## The five classes
 
 A class is **not** a stringency level. It selects which parts are required, optional or off, and
 it supplies the default gate and ratchet shape. The gate vocabulary differs by class; the
-harness does not.
+harness does not. The names are words; the letters `A`..`E` are read-time aliases.
 
 | Class | What "done" means |
 |---|---|
-| **A. Shipped software** | a gate set reports measured numbers, a round lands, the artifact deploys or publishes |
-| **B. Service / configuration** | a contract (schema, route, API) is unchanged, or the change is intentional and migrated |
-| **C. Game** | a suite green in the Editor **and** a human feel verdict — the verdict is a first-class deliverable |
-| **D. Knowledge / research** | a question is answered with sources and the answer is findable |
-| **E. Agent-fleet config** | a config change is applied, verified against the **artifact**, and versioned |
-| **F. Desktop shell** | the renderer is isolated from Node, the main process is not busy, and the packaged bundle ships no dev dependency |
+| **software** (A) | a gate set reports measured numbers, a round lands, the artifact deploys or publishes |
+| **service** (B) | a contract (schema, route, API) is unchanged, or the change is intentional and migrated |
+| **game** (C) | a suite green in the Editor **and** a human feel verdict — the verdict is a first-class deliverable |
+| **research** (D) | a question is answered with sources and the answer is findable |
+| **fleet** (E) | a config change is applied, verified against the **artifact**, and versioned |
 
 Two placements worth arguing about:
 
 - A repo whose code is small and lives elsewhere, while the repo holds *output*, belongs in
-  **D**, not A — gating it like an application gates the wrong artifact; its gate is freshness,
-  not compilation.
-- An input directory that is not a build target at all belongs in **D** with **`--archive`**.
+  **research**, not **software** — gating it like an application gates the wrong artifact; its gate
+  is freshness, not compilation.
+- An input directory that is not a build target at all belongs in **research** with **`--archive`**.
   Without the flag the installer keeps producing HANDOFFs for a directory whose own design
   folders are empty.
 
@@ -29,25 +28,28 @@ Two placements worth arguing about:
 `R` = required · `O` = optional (installed, reported) · `—` = off. The same data is in
 `manifest/classes.tsv`, and `CL-01` checks it against the repo.
 
-| Part | A | B | C | D | E | F |
-|---|---|---|---|---|---|---|
-| HANDOFF | R | R | R | R | R | R |
-| SPEC before change | R | R | R | — | R | R |
-| Verification gate | R | R | R | O | R | R |
-| Pinned-commit REPLAY | R | — | R | — | O | R |
-| Ratchet | R | O | O | — | O | R |
-| PR gate | O | — | O | — | O | O |
-| Review panel | O | — | R | — | O | O |
-| Playbooks (the skills) | R | R | R | R | R | R |
-| Design tokens | O | — | — | — | — | O |
-| CI lane | R | — | O | — | O | R |
-
-**F is the desktop shell**, added at W4: it declares the Electron failure surface as bans
-(`BN-06`..`BN-09`) and declares its FPS number as a **host gate** rather than a ratchet, because
-the probe that measures it needs Playwright or Electron plus a display — neither of which a
-shipped rule may depend on. Its ratchet carries `app_bundle_bytes` instead. `docs/CI.md` §3 argues
-that in full, including why frame time is the wrong number (measured flat at 16.70 ms while the
-main thread went from 1.8 % to 54.5 % busy).
+| Part | software | service | game | research | fleet |
+|---|---|---|---|---|---|
+| HANDOFF | R | R | R | R | R |
+| SPEC before change | R | R | R | — | R |
+| Verification gate | R | R | R | O | R |
+| Pinned-commit REPLAY | R | — | R | — | O |
+| Ratchet | R | O | O | — | O |
+| PR gate | O | — | O | — | O |
+| Review panel | O | — | R | — | O |
+| Playbooks (the skills) | R | R | R | R | R |
+| Design tokens | O | — | — | — | O |
+| CI lane | R | — | O | — | O |
+
+**The electron opt-in, not a class**, added at W4: an Electron app is the **software** class with
+`electron: true`, which declares the Electron failure surface as bans (`BN-06`..`BN-09`) and
+declares its FPS number as a **host gate** rather than a ratchet, because the probe that measures
+it needs Playwright or Electron plus a display — neither of which a shipped rule may depend on. Its
+ratchet carries `app_bundle_bytes` instead. The old sixth class was merged into `software` (its need
+column measured identical on all ten parts), and the old `F` letter remains an install-time alias
+that selects `software` **with** the opt-in. `docs/CI.md` §3 argues it in full, including why frame
+time is the wrong number (measured flat at 16.70 ms while the main thread went from 1.8 % to 54.5 %
+busy).
 
 **`—` is a real, enforced option.** The installer records every off part in `disabled:`, so its
 rows report `SKIP (opt-out)`; `CL-01` fails if a forbidden part's artifact exists. A repo with
@@ -102,13 +104,16 @@ Each step is independently useful and the later ones build on the earlier:
 Then, in order:
 
     git add -A && git commit          # the install is a change like any other
-    .goblin/bin/goblin-verify         # 42 passed, 1 failed - HP-05, until HANDOFF names a commit
-    hermes skills trust <target>      # one-time, so the project-tier skills load
+    .goblin/bin/goblin-verify         # 37 passed, 1 failed - HP-05, until HANDOFF names a commit
+    gob emit --platform <p>           # optional, per platform: the agent skills are an opt-in
 
-A class-A install is **green** — `43 passed, 0 failed, 11 advisory, 28 skipped`, exit 0 — once
+A default software-class install (no agent skills) is **green** — `38 passed, 0 failed, 11 advisory,
+33 skipped`, exit 0 — once
 `HANDOFF.md` names a commit that exists; before that edit the scaffold's `0000000` placeholder is
-the one expected red (`42 passed, 1 failed`). Both numbers are measured, not assumed
-(`docs/CONTRACTS.md`; step 2 of `docs/GUIDE.md`). Twenty-eight rows skip with a reason: `HS-02` (no
+the one expected red (`37 passed, 1 failed`). Both numbers are measured, not assumed
+(`docs/CONTRACTS.md`; step 2 of `docs/GUIDE.md`). Thirty-three rows skip with a reason: the
+five skill rows (`SK-01`..`SK-04`, `AU-04`) skip on the `playbooks` opt-out a skills-free
+install records, plus the not-yet rows: `HS-02` (no
 pinned pre-change commit yet), `AU-02`/`AU-03` (no report has been filed, so there is nothing to
 dedup and no reporter run to audit), `SC-06`/`SC-07`/`SC-08` (no dependency manifest, no lockfile,
 no audit record), `PF-01` (no measured perf baseline), `BN-01`/`BN-02`/`BN-05` (no `src/` for a ban
@@ -160,8 +165,8 @@ The remedy is a reconciliation. The project's file stays the file of record; not
        git add -A && git commit
        .goblin/bin/goblin-verify        # HP-02, HP-03, HP-05 go green
 
-   Success is the class's full green path (`43 passed, 0 failed, 11 advisory, 28 skipped`, exit 0 for
-   class A) with `git status --short` empty.
+   Success is the class's full green path (`38 passed, 0 failed, 11 advisory, 33 skipped`, exit 0 for
+   the software class) with `git status --short` empty.
 
 The edit is additive and small — measured on the model repo (§1's exemplar, 2450 lines): three
 headings plus a `State` block, one dated gate line and a `Not verified` block, 15 lines, no line

package/docs/CI.md

@@ -43,8 +43,8 @@ not the model.
 
 ## 2. What goblin-stack places, and what it checks
 
-The `ci-gate` part is `R` for classes A and F, `O` for C and E, and `-` for B and D
-(`manifest/classes.tsv`). When it is installed, the installer renders
+The `ci-gate` part is `R` for **software**, `O` for **game** and **fleet**, and `-` for **service**
+and **research** (`manifest/classes.tsv`). When it is installed, the installer renders
 `templates/ci/goblin-gate.yml.tmpl` into `.github/workflows/goblin-gate.yml` — one job, no `if:` at
 any level, whose only step runs `.goblin/bin/goblin-verify`. It is `owned`, so a second install is a
 no-op and a hand-edited copy is never overwritten.
@@ -70,11 +70,14 @@ comment and cannot count toward a pass.
 
 ---
 
-## 3. The Electron / desktop-shell class (F)
+## 3. The Electron opt-in (software class)
 
-Class F exists because a desktop shell needs a part no other class has — a **host gate**, a number
-measured on a machine with a display — and forbids a thing the others allow: a **renderer that
-reaches Node or the filesystem directly**. That is a new row-set, not a flag on class A.
+An Electron app is the **`software`** class with `electron: true`. The opt-in exists because such an
+app needs a part no other shape has — a **host gate**, a number measured on a machine with a display
+— and forbids a thing the plain software class allows: a **renderer that reaches Node or the
+filesystem directly**. The merge measured the old sixth class's part needs identical to `software` on
+all ten parts, so none of this is a sixth column in `manifest/classes.tsv`: it is the `bans:` list and
+the `perf.host_gate:` key, rendered over the software preset by `presets/electron-overlay.yaml`.
 
 ### 3.1 The failure surface, and the check for each
 
@@ -94,14 +97,14 @@ reaches Node or the filesystem directly**. That is a new row-set, not a flag on
 
 ### 3.2 The perf lane: one ratchet, and a host gate beside it
 
-There is **one** mechanism, and class F reuses it unchanged: `ratchet: {name, cmd, ceiling}`,
+There is **one** mechanism, and the opt-in reuses it unchanged: `ratchet: {name, cmd, ceiling}`,
 enforced by `GT-04`/`GT-05` and pinned to a commit by `PF-01`. A second perf mechanism is not
 introduced.
 
 What the ratchet measures here is `app_bundle_bytes` — the packaged bundle's byte count. It is
 hermetic, it needs no browser, no display and no dependency, and a fat bundle is a slow cold start on
 every machine. **The FPS number is declared as a host gate instead** (`perf_host_gate:` in
-`presets/F-electron.yaml`), and carried in the HANDOFF with the date it was measured.
+`presets/electron-overlay.yaml`), and carried in the HANDOFF with the date it was measured.
 
 This is a **deviation from G6 §B.3**, which put `main_thread_busy_pct` in the ratchet, and the reason
 is measured: the instrument that produces it — CDP `Performance.getMetrics`, or

package/docs/CONTRACTS.md

@@ -9,12 +9,18 @@ same way the fleet's own tool reads it. Everything else is line-oriented shell.
     goblin-install --target <dir> [options]
 
     --target <dir>        required; the repo root to install into
-    --class A|B|C|D|E|F  required unless --uninstall or --re-pin
+    --class <class>       required unless --uninstall or --re-pin. One of the five domain classes:
+                          software · service · game · research · fleet. The letters A-E and the
+                          older names app (software), agent (fleet) and desktop/F (software + the
+                          electron opt-in) are read-time aliases.
     --models <path>       model mapping file   (default: $GOBLIN_MODELS -> ~/projects/fleet-model.yaml)
     --practice <path>     the referenced standard (default: $GOBLIN_PRACTICE -> ~/projects/PROJECT-PRACTICE.md)
     --parts <list>        comma list to install; default = every part the class requires
     --archive             mark the project archive: verify requires no HANDOFF and no gates
-    --skills yes|no       install .hermes/skills (default yes; needs the one-time trust step)
+    --skills yes|no       install agent skills under .hermes/skills (default no — the harness is
+                          neutral; opt in per platform with: gob emit --platform <p>). On a repo whose
+                          record already has skills installed, an OMITTED flag keeps them; an explicit
+                          --skills no removes them.
     --dry-run             print the plan; write nothing
     --upgrade             re-install at the current version; report created/updated/unchanged/skipped
     --opt-out <part>      record the part in disabled: so its required checks are skipped
@@ -37,7 +43,7 @@ files whose hash changed and prints `created C · updated U · unchanged N · sk
 
 | kind | recorded as | overwritten? | hash-checked? | removed by `--uninstall`? |
 |---|---|---|---|---|
-| installed artifact (bin, manifest, roles, skills, harness scaffold) | `files` | yes, on upgrade | yes — IN-02, SK-02 | yes |
+| installed artifact (bin, manifest, roles, opt-in skills, harness scaffold) | `files` | yes, on upgrade | yes — IN-02, SK-02 | yes |
 | created once, then yours (`.goblin/goblin.yaml`, `HANDOFF.md`, `AGENTS.md`, `*-SPEC.md`, `reviews/.gitkeep`) | `owned` | never | no — you are meant to edit them | no, except the config |
 | pre-existing, left alone | `refused` | never | no — IN-04 only proves it was not taken over | no |
 
@@ -112,9 +118,9 @@ Output is one line per executed row, in manifest order, plus a summary line at t
     ADV   MD-02  code lane and review lane both resolve to the same family
     SKIP  HS-02  no pinned pre-change commit yet - REPLAY not provable
 
-Those four lines are one row of each marking. The summary line of a green class-A run is:
+Those four lines are one row of each marking. The summary line of a green default software-class run is:
 
-          43 passed, 0 failed, 11 advisory, 28 skipped
+          38 passed, 0 failed, 11 advisory, 33 skipped
 
 **Exit codes:** `0` every executed check passed (advisories and skips do not fail the run) ·
 `1` at least one check FAILED · `2` verify could not run (not installed, a missing dependency,
@@ -135,8 +141,10 @@ settings that make a workflow a **gate** are written down.
 
 ### A fresh install verifies green
 
-Measured on a fresh class-A install, committed with no hand edit: **`43 passed, 0 failed,
-11 advisory, 28 skipped`, exit 0.** Twenty-eight rows skip with a reason: `HS-02` — no pre-change commit
+Measured on a fresh DEFAULT software-class install (skills opt-in, W6 neutral-first), committed with no
+hand edit: **`38 passed, 0 failed, 11 advisory, 33 skipped`, exit 0.** Thirty-three rows skip with
+a reason — the same not-yet rows as before, plus the five skill rows (`SK-01`..`SK-04`,
+`AU-04`) that skip on the `playbooks` opt-out a skills-free install records: `HS-02` — no pre-change commit
 is pinned yet, so the REPLAY is not provable (`docs/LIMITS.md` #11) — `AU-02` and `AU-03`, which
 have no report to audit in a repo where no reporter has run — `SC-06`, `SC-07` and `SC-08`, which
 have no dependency manifest, no lockfile and no audit record to read yet — `PF-01`, which has
@@ -173,13 +181,20 @@ verifier is reporting FAILs.
 - **Per part:** `--opt-out <part>` records the part in `disabled:`. `goblin-verify` then reports
   the part's rows as `SKIP (opt-out)` in the summary, so the opt-out is **visible rather than
   absent**. The same mechanism is what makes a class's `-` (off) real.
-- **The opt-out numbers are pinned (V3-3).** A fresh class-A install with `--skills no` verifies
-  `39 passed, 0 failed, 11 advisory, 28 skipped`, exit 0, and `tests/t-install-off-switch.sh`
-  asserts that line: a silent drift in the opt-out path is caught rather than left as a number
-  nobody wrote down (the `--skills no` count moved from `37/0/9/11` at v0.2 to here when the ban
-  rows landed, and no file recorded the shift; **the skipped count moved 15 → 18 on 2026-09-25
-  (G1)** — the three new feature-map rows skip on the same path for the same reason, measured;
-  **and 18 → 24 on 2026-09-25 (W3)** — the six judge/loop rows skip there too, measured).
+- **The opt-out numbers are pinned (V3-3).** A software-class install with an explicit `--skills no`
+  verifies `38 passed, 0 failed, 11 advisory, 33 skipped`, exit 0, and
+  `tests/t-install-off-switch.sh` asserts that line: a silent drift in the opt-out path is caught
+  rather than left as a number nobody wrote down (the `--skills no` count moved from `37/0/9/11`
+  at v0.2 when the ban rows landed, **15 → 18 on 2026-09-25 (G1)** — the feature-map rows,
+  **18 → 24 on 2026-09-25 (W3)** — the judge/loop rows, and **to `38/0/11/33` at W6
+  (neutral-first)**, when this opt-out shape BECAME the default and the two lines converged:
+  the old default install measured `43/0/11/28`).
+- **Skills, W6 neutral-first.** A default install ships no agent skills. A repo whose record has
+  `skills: yes` keeps them through every flag-less re-install and `--upgrade` (the installer
+  reads the record's choice and says so out loud); an explicit `--skills no` removes exactly the
+  recorded skill files; `--uninstall` removes everything recorded, as always.
+  `tests/t-install-off-switch.sh` walks that migration: install `--skills yes`, upgrade flag-less,
+  the skills survive byte-identical; uninstall, and they are all gone.
 - **Whole harness:** `--uninstall` deletes the `files` list plus `.goblin/goblin.yaml`, removes
   every directory that leaves empty (deepest first, after `installed.json` itself is gone — the
   order that used to leave `.goblin/` and the sixteen `.hermes/skills/*` directories behind),
@@ -189,7 +204,7 @@ verifier is reporting FAILs.
 
 ## The two commands, verbatim
 
-    bash bin/goblin-install --target /path/to/repo --class A
+    bash bin/goblin-install --target /path/to/repo --class software
     .goblin/bin/goblin-verify
 
 From a checkout, without installing anything:

package/docs/ENFORCEMENT.md

@@ -164,26 +164,30 @@ OR its `enforced_by` cell does.
 the installer records every `-` part in `disabled:`, so its rows report `SKIP (opt-out)`
 instead of silently passing, and `CL-01` fails if a forbidden part's artifact exists.
 
-| part | A | B | C | D | E | F |
-|---|---|---|---|---|---|---|
-| handoff | R | R | R | R | R | R |
-| spec | R | R | R | - | R | R |
-| gate | R | R | R | O | R | R |
-| replay | R | - | R | - | O | R |
-| ratchet | R | O | O | - | O | R |
-| pr-gate | O | - | O | - | O | O |
-| review-panel | O | - | R | - | O | O |
-| playbooks | R | R | R | R | R | R |
-| tokens | O | - | - | - | - | O |
-| ci-gate | R | - | O | - | O | R |
-
-Class **F** is the desktop shell: it needs a part no other class has — a **host gate**, a number
-measured on a machine with a display — and forbids nothing the others allow except a renderer that
-reaches Node directly, which its ban list catches. `ci-gate` is the one part added at W4: when it
-is required or optional the installer renders `templates/ci/goblin-gate.yml.tmpl` into
-`.github/workflows/goblin-gate.yml`, and when it is `-` the artifact must be **absent** (which is
-why `CL-01` keys off that exact path, not the `.github/` directory — a repo is still allowed CI of
-its own). `docs/CI.md` is the contract for what that file does and does not make true.
+| part | software | service | game | research | fleet |
+|---|---|---|---|---|---|
+| handoff | R | R | R | R | R |
+| spec | R | R | R | - | R |
+| gate | R | R | R | O | R |
+| replay | R | - | R | - | O |
+| ratchet | R | O | O | - | O |
+| pr-gate | O | - | O | - | O |
+| review-panel | O | - | R | - | O |
+| playbooks | R | R | R | R | R |
+| tokens | O | - | - | - | O |
+| ci-gate | R | - | O | - | O |
+
+The five columns carry the domain names; the letters `A`..`E` and the older names `app` (software)
+and `agent` (fleet) are read-time aliases. The old `F` class — the Electron shell — was merged into
+`software`: the merge measured the two need columns identical on all ten parts, so what it added
+lives in config, not in this table. The **electron opt-in** (`electron: true`) turns the electron
+bans `BN-06`..`BN-09` on even when a hand-edited `bans:` list omits them, and requires a declared
+**host gate** — a number measured on a machine with a display; `docs/CI.md` §3 is the contract for
+it. `ci-gate` is the one part added at W4: when it is required or optional the installer renders
+`templates/ci/goblin-gate.yml.tmpl` into `.github/workflows/goblin-gate.yml`, and when it is `-` the
+artifact must be **absent** (which is why `CL-01` keys off that exact path, not the `.github/`
+directory — a repo is still allowed CI of its own). `docs/CI.md` is the contract for what that file
+does and does not make true.
 
 ## The ban list (G5)
 

package/docs/GUIDE.md

@@ -3,7 +3,7 @@
 A step-by-step guide for your first week. **Read this before the README.** The README tells you
 what the pieces are; this tells you what to *do*, in order, and what you should see when it works.
 
-Version: `0.4.4` · Last measured: 2026-09-25 · Every command and every output below was run on a
+Version: `0.5.0` · Last measured: 2026-10-05 · Every command and every output below was run on a
 real repository while writing this guide.
 
 ---
@@ -97,27 +97,29 @@ see the plan first:
     git config user.email "you@example.com"
     git config user.name "you"
 
-    gob init --target . --class app --branch main --email "you@example.com" \
+    gob init --target . --class software --branch main --email "you@example.com" \
         --gate "bash tests/run-tests.sh" --yes
 
 or the plain installer this wizard drives, if you prefer the one-shot shape:
 
-    gob install --target . --class A
+    gob install --target . --class software
 
 Expected output (this is a real transcript, trimmed):
 
-    created 50 · updated 0 · unchanged 0 · skipped 0
+    created 25 · updated 0 · unchanged 0 · skipped 0
 
     next:
       1. cd /tmp/gs-try && git add -A && git commit   # the install is a change like any other
       2. .goblin/bin/goblin-verify   # or add .goblin/bin to PATH
       3. edit .goblin/goblin.yaml: replace the default gate with your real commands (P8 step 3)
-      4. hermes skills trust /tmp/gs-try   # one-time, so the project-tier skills load
+      4. agent skills are opt-in: gob emit --platform <p>   # hermes, claude, copilot, cursor, opencode, codex, gemini
 
-**`created 50`** is the installer's count of the files it **tracks** — the 41 in its `files` map,
-the 8 it `owns`, and `.gitignore`. It writes **51**: the 51st is `.goblin/installed.json`, the
-record it keeps for itself, which it writes but does not count. It has written nothing outside this
-directory.
+**`created 25`** is the installer's count of the files it **tracks** — the 16 in its `files`
+map, the 8 it `owns`, and `.gitignore`. It writes **26**: the 26th is `.goblin/installed.json`,
+the record it keeps for itself, which it writes but does not count. It has written nothing
+outside this directory. The default install ships **no agent skills** — the harness is neutral,
+and `gob emit --platform <p>` is the per-platform opt-in (the old `--skills yes` default is
+still there for repos that want the Hermes project tier vendored).
 
 ### Why `git init -b main` matters
 
@@ -141,14 +143,14 @@ branch** (unless you want to).
 You will see one line per rule. The shape:
 
     PASS  IN-01  (test -s .goblin/installed.json && grep -q '"version"' .goblin/installed.json)
-    PASS  IN-02  40 installed files hashed | practice pin ok
+    PASS  IN-02  16 installed files hashed | practice pin ok
     FAIL  HP-05  HANDOFF.md names no commit that exists in this repo
     SKIP  HS-02  no pinned pre-change commit yet - the REPLAY is not provable
     ADV   HP-04  A stale sentence is corrected in place... (advisory)
 
 and a summary line at the bottom:
 
-    42 passed, 1 failed, 11 advisory, 28 skipped     # the one FAIL is HP-05, below
+    37 passed, 1 failed, 11 advisory, 33 skipped     # the one FAIL is HP-05, below
 
 ### How to read that output
 
@@ -185,7 +187,7 @@ against a declared expectation. That is exactly what you want it to do.
 `HEAD when this file was written: `0000000``, and `HP-05` **rejects that placeholder on purpose**.
 A file that names a commit which does not exist is worse than one that names none — it looks like a
 record. Commit first, then write the real short SHA in. Measured: with the placeholder left in,
-verify reports `42 passed, 1 failed`; with the real SHA, `43 passed, 0 failed`.
+verify reports `37 passed, 1 failed`; with the real SHA, `38 passed, 0 failed`.
 
 ---
 
@@ -197,7 +199,7 @@ Everything you configure lives in **one file**, created once and then never over
 
 Open it. The keys that matter on day one:
 
-    class: A                              # A|B|C|D|E|F - what kind of project this is (step 6)
+    class: software                       # software|service|game|research|fleet (A-E are aliases) - what kind of project this is (step 6)
     branch: main                          # DECLARED, never assumed
     owner_email: you@example.com          # the commit identity this repo expects
     practice: /path/to/your-standard.md   # optional: your own house rules, hash-pinned
@@ -243,19 +245,21 @@ supplies the default gate shape. Choose by asking *what does "done" mean here?*
 
 | Class | Choose it when | "Done" means |
 |---|---|---|
-| **A · Shipped software** | an app, library, or tool users run | a gate set reports measured numbers and a round lands |
-| **B · Service / config** | an API, schema, route, or deployment config | the contract is unchanged, or the change is deliberate and migrated |
-| **C · Game** | a game | a suite is green **and** a human feel verdict exists |
-| **D · Knowledge / research** | notes, a vault, a research directory | a question is answered with sources and is findable |
-| **E · Agent-fleet config** | your agent's own config (`~/.hermes`) | the change is applied, verified against the artifact, versioned |
-| **F · Desktop shell** | an Electron / desktop app | renderer isolated from Node, main process not busy, no dev dependency shipped |
+| **software** (A) | an app, library, or tool users run | a gate set reports measured numbers and a round lands |
+| **service** (B) | an API, schema, route, or deployment config | the contract is unchanged, or the change is deliberate and migrated |
+| **game** (C) | a game | a suite is green **and** a human feel verdict exists |
+| **research** (D) | notes, a vault, a research directory | a question is answered with sources and is findable |
+| **fleet** (E) | your agent's own config (`~/.hermes`) | the change is applied, verified against the artifact, versioned |
+
+An Electron app is **software** with `electron: true` — the opt-in adds the electron bans and a host
+gate, not a sixth class. The old `F` letter still resolves there as an install alias.
 
 **Two placements people get wrong:**
 
-- A repo that holds *output* while the code lives elsewhere → **D**, not A. Gating it like an
-  application gates the wrong artifact.
-- A plain input directory that is not a build target → **D** with `--archive`, which tells verify to
-  expect no HANDOFF and no gates, and to say so.
+- A repo that holds *output* while the code lives elsewhere → **research**, not **software**. Gating
+  it like an application gates the wrong artifact.
+- A plain input directory that is not a build target → **research** with `--archive`, which tells
+  verify to expect no HANDOFF and no gates, and to say so.
 
 Switch class later by editing `class:` in the config and re-running install. The parts you no longer
 need are recorded as **disabled** and will report `SKIP (opt-out)` rather than failing.
@@ -305,9 +309,9 @@ honest entry, and the harness treats it as one.
 > **Prove it was broken first.**
 
 Before you trust a check, break the thing it checks and watch it go red — then put it back and watch
-it go green. Break it on a row this walkthrough can actually break: `IN-02` hashes the **41 files it
+it go green. Break it on a row this walkthrough can actually break: `IN-02` hashes the **16 files it
 tracks** — not the 8 it `owns` (including `.goblin/goblin.yaml`, which §5 has you editing) and not
-`.goblin/installed.json`; edit one of the 41 — the exercise below uses `.goblin/bans/README.md`.
+`.goblin/installed.json`; edit one of the 16 — the exercise below uses `.goblin/bans/README.md`.
 
     # REPLAY-BEGIN (this exact block is run by tests/t-doc-guide.sh - keep the two copies identical)
     .goblin/bin/goblin-verify --only IN-02                 # expect PASS
@@ -390,16 +394,16 @@ the next session.
 
 ## 9. What to expect on day one (so you do not misread it)
 
-A class-A install lands on a specific shape. The scaffold ships one deliberate red — `HP-05`, the
+A software-class install lands on a specific shape. The scaffold ships one deliberate red — `HP-05`, the
 `0000000` placeholder in `HANDOFF.md` (§4) — so a literal first run prints:
 
-    42 passed, 1 failed, 11 advisory, 28 skipped     (the one FAIL is HP-05)
+    37 passed, 1 failed, 11 advisory, 33 skipped     (the one FAIL is HP-05)
 
 Name a real commit in `HANDOFF.md` and commit, and it is green:
 
-    43 passed, 0 failed, 11 advisory, 28 skipped     (on a real project; your numbers will differ)
+    38 passed, 0 failed, 11 advisory, 33 skipped     (on a real project; your numbers will differ)
 
-**Twenty-eight rows skipping is correct**, and each skip prints its reason. In plain terms: the
+**Thirty-three rows skipping is correct**, and each skip prints its reason. In plain terms: the
 harness is telling you which of its rules have nothing to read yet. It is a checklist, not a
 scolding.
 
@@ -407,7 +411,7 @@ Two readings that are easy to get wrong:
 
 - **Advisory rows are not passes.** Ten rules are labelled `advisory` — counted, not enforced, and
   nine of them carry no executable check at all. The count is capped by `advisory_ceiling: 10`, and
-  a class-A install already sits at 10 of 10: adding another unenforceable rule fails verify until
+  a software-class install already sits at 10 of 10: adding another unenforceable rule fails verify until
   one is removed. That is intentional. (The summary line can print `11 advisory`: the eleventh ADV
   line is `JG-02`, a row with a real command of its own that reports ADV here because your model
   file declares no `judge:` lane — it prints the remedy rather than failing a repo for a fleet's
@@ -483,7 +487,7 @@ engine and silently de-migrate the record).
 
 ### Commands
 
-    gob install --target <dir> --class A|B|C|D|E|F [options]
+    gob install --target <dir> --class <software|service|game|research|fleet> [options]
     gob install --target <dir> --uninstall
     gob install --target <dir> --re-pin
     gob install --target <dir> --upgrade
@@ -579,7 +583,7 @@ with *"prove it was broken first"* — it is the one practice that survives cont
     # 1. try it somewhere disposable
     mkdir -p /tmp/gs-try && cd /tmp/gs-try
     git init -b main
-    gob install --target . --class A                     # expect: created 50
+    gob install --target . --class software              # expect: created 25 (no skills — those are gob emit)
 
     # 2. commit and check
     git add -A && git commit -m "chore: install gobstack"
@@ -600,7 +604,7 @@ with *"prove it was broken first"* — it is the one practice that survives cont
 
     # 5. do it for real, in a repo you care about
     cd ~/projects/your-project
-    gob install --target . --class A
+    gob install --target . --class software
     git add -A && git commit -m "chore: adopt gobstack"
     .goblin/bin/goblin-verify
     $EDITOR HANDOFF.md              # state / gates (dated!) / next / NOT verified