@techgoblin/gobstack 0.4.4-beta.7 → 0.5.0-beta.1

package/docs/LIMITS.md

@@ -111,7 +111,7 @@ deliberate trade or an unfilled gap.
     drift check — `IN-02`, `SK-02`, and `HS-01`'s hash of the harness dir — reads its expected
     hash out of that one file, and that file is the one file no check protects. Measured: append a
     byte to `.goblin/bin/goblin-verify`, rewrite its recorded hash in `installed.json`, commit, and
-    the run is **fully GREEN** (`43 passed, 0 failed`, exit 0). One edit defeats three rows at
+    the run is **fully GREEN** (`38 passed, 0 failed`, exit 0). One edit defeats three rows at
     once, and it is the cheapest way to fake a green run. Doing better needs an anchor the target
     cannot edit — a signature, or a hash held outside the repo — and goblin-stack has no such
     trust root: the source checkout is not guaranteed to exist at verify time, and any value
@@ -275,7 +275,8 @@ Electron perf number is a host gate, and the ratchet deliberately carries a diff
     flow-style `jobs: {…}` mapping is refused, and a `#` inside a quoted string truncates the line
     it is on. Two further measured gaps: the template's job is `ubuntu-latest` with no cache, so a
     repo whose gate needs a display, a licence, a GPU or a signed-in session cannot use it at all
-    (that is a **host** gate — the class-C rule, restated for class F), and a private repo's
+    (that is a **host** gate — the class-C rule, restated for class F; **corrected 2026-10-02 (W6):**
+    F is merged into `software`, so this is the electron opt-in), and a private repo's
     Actions minutes are billed to the account (2,000/month free). Measured ground truth at W4:
     **one** first-party workflow exists in the whole estate and it self-skips; five of the six
     repos with a remote have none.
@@ -295,7 +296,9 @@ Electron perf number is a host gate, and the ratchet deliberately carries a diff
     while the main thread went from 1.8 % to 54.5 % busy, `docs/CI.md` §3.3); an absolute FPS
     claim is not. Three further Electron failure modes are **recorded, not mechanised**, and
     `docs/CI.md` §4 says why: the dependency-graph boundary check, `ipcMain` sender validation,
-    and fuses at package time.
+    and fuses at package time. **Corrected 2026-10-02 (W6):** this preset is now
+    `presets/electron-overlay.yaml`, rendered over `presets/software.yaml` by `--electron` (or the
+    `desktop`/`F` install alias) — the old `F` class was merged into `software`.
 36. **A ban's exemption reaches the probe through its environment, so a custom probe can ignore it.**
     `bans_exempt:` and the inline `// BAN-OK(<id>): <reason>` are filtered *before* the exit code is
     chosen, because a filter applied to a probe's stdout afterwards cannot change a verdict — that
@@ -589,3 +592,17 @@ the Node the gates ran under.
     a source row can never fail a user's repo, and a target row can never substitute for the
     framework's own suite. Recorded as a definition; `docs/ENFORCEMENT.md`'s scope paragraph
     carries the same sentence for the reader who arrives there first.
+
+53. **The sixth class is gone: the desktop shell is `software` + `electron: true`, and `A`..`E` are
+    read-time aliases.** W6 merged `F` into `software` because their `manifest/classes.tsv` need
+    columns were measured identical on all ten parts — the old column added config (the electron
+    `bans:`, the `perf.host_gate:`, the `app_bundle_bytes` ratchet, the `dist out release`
+    build-output scope), never a part. Measured on the merge tree (2026-10-02): the tsv is 50 rows
+    over five classes; `gob init --class desktop`, `--class F` and `--class software --electron`
+    render byte-identical `goblin.yaml` (`class: software`, `electron: true`); and a pre-merge repo
+    carrying `class: F` with no `electron:` key verifies unchanged, `38 passed, 0 failed, 11
+    advisory, 33 skipped`, exit 0, with `git status --porcelain` empty — zero writes, because its
+    bans and host gate live in its own config. What this costs, recorded rather than fixed: such a
+    repo gets the merge's declaration-time host-gate check only after hand-adding `electron: true`;
+    its bans and host gate keep running either way, so nothing fails closed, and the CLI keeps
+    accepting `desktop`/`F` as aliases.

package/manifest/classes.tsv

@@ -1,61 +1,51 @@
 class	part	need
-A	handoff	R
-B	handoff	R
-C	handoff	R
-D	handoff	R
-E	handoff	R
-F	handoff	R
-A	spec	R
-B	spec	R
-C	spec	R
-D	spec	-
-E	spec	R
-F	spec	R
-A	gate	R
-B	gate	R
-C	gate	R
-D	gate	O
-E	gate	R
-F	gate	R
-A	replay	R
-B	replay	-
-C	replay	R
-D	replay	-
-E	replay	O
-F	replay	R
-A	ratchet	R
-B	ratchet	O
-C	ratchet	O
-D	ratchet	-
-E	ratchet	O
-F	ratchet	R
-A	pr-gate	O
-B	pr-gate	-
-C	pr-gate	O
-D	pr-gate	-
-E	pr-gate	O
-F	pr-gate	O
-A	review-panel	O
-B	review-panel	-
-C	review-panel	R
-D	review-panel	-
-E	review-panel	O
-F	review-panel	O
-A	playbooks	R
-B	playbooks	R
-C	playbooks	R
-D	playbooks	R
-E	playbooks	R
-F	playbooks	R
-A	tokens	O
-B	tokens	-
-C	tokens	-
-D	tokens	-
-E	tokens	-
-F	tokens	O
-A	ci-gate	R
-B	ci-gate	-
-C	ci-gate	O
-D	ci-gate	-
-E	ci-gate	O
-F	ci-gate	R
+software	handoff	R
+service	handoff	R
+game	handoff	R
+research	handoff	R
+fleet	handoff	R
+software	spec	R
+service	spec	R
+game	spec	R
+research	spec	-
+fleet	spec	R
+software	gate	R
+service	gate	R
+game	gate	R
+research	gate	O
+fleet	gate	R
+software	replay	R
+service	replay	-
+game	replay	R
+research	replay	-
+fleet	replay	O
+software	ratchet	R
+service	ratchet	O
+game	ratchet	O
+research	ratchet	-
+fleet	ratchet	O
+software	pr-gate	O
+service	pr-gate	-
+game	pr-gate	O
+research	pr-gate	-
+fleet	pr-gate	O
+software	review-panel	O
+service	review-panel	-
+game	review-panel	R
+research	review-panel	-
+fleet	review-panel	O
+software	playbooks	R
+service	playbooks	R
+game	playbooks	R
+research	playbooks	R
+fleet	playbooks	R
+software	tokens	O
+service	tokens	-
+game	tokens	-
+research	tokens	-
+fleet	tokens	O
+software	ci-gate	R
+service	ci-gate	-
+game	ci-gate	O
+research	ci-gate	-
+fleet	ci-gate	O

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@techgoblin/gobstack",
-  "version": "0.4.4-beta.7",
+  "version": "0.5.0-beta.1",
   "description": "Agent-discipline toolkit: one verify command, an enforcement matrix, and LIMITS. bash engine, npm shim.",
   "bin": {
     "goblin": "bin/goblin.js",

package/presets/electron-overlay.yaml

@@ -0,0 +1,38 @@
+# presets/electron-overlay.yaml — the electron opt-in for the `software` class.
+#
+# The `desktop` class is gone; F was merged into software because their classes.tsv need
+# columns are IDENTICAL on all 10 parts (measured). Everything F added beyond software lives in
+# plain goblin.yaml config keys, so it is an OVERLAY, not a class: `gob install --class software
+# --electron` (or the `--class desktop` / `F` alias, which sets --electron) renders the keys
+# below OVER the software preset. An absent key falls through to presets/software.yaml; a key
+# present here — including an empty one like sec_write_routes: "" — wins.
+#
+# The prose F carried (label / done_means / notes) is preserved here for the record; it is not a
+# rendered template key, so it never reaches a target's goblin.yaml.
+label: Desktop shell
+done_means: the renderer is isolated from Node, the main process is not busy, and the packaged bundle ships no dev dependency
+# software's A-only second gate (the TODO ceiling) is NOT applied: F never had it.
+gate2_name: ""
+gate2_cmd: ""
+# The perf lane is the shipped ratchet, reused verbatim; the hermetic number here is the
+# packaged bundle's byte count (a fat bundle is a slow cold start on every machine).
+ratchet_name: app_bundle_bytes
+ratchet_cmd: find dist out release -type f -exec cat {} + 2>/dev/null | wc -c
+sec_build_output: dist out release
+# A renderer that reaches the filesystem or Node directly is forbidden, so there are no write
+# routes to allow (software allows app/ and src/app/; the overlay blanks that).
+sec_write_routes: ""
+# perf_metric must EQUAL ratchet_name (PF-01 fails when the budget and the measurement disagree).
+perf_metric: app_bundle_bytes
+perf_cmd: find dist out release -type f -exec cat {} + 2>/dev/null | wc -c
+# THE FPS NUMBER IS A HOST GATE, not the ratchet: the instrument that produces
+# main_thread_busy_pct needs Playwright or Electron plus a GUI, which the no-npm contract
+# forbids a shipped rule to launch. It is DECLARED here and carried in the HANDOFF with its date
+# (docs/LIMITS.md #34, docs/CI.md carries the sweep). `electron: true` with this empty FAILs PF-01.
+perf_host_gate: "Electron run - main_thread_busy_pct with a window open (app.getAppMetrics()[i].cpu.percentCPUUsage, or CDP Performance.getMetrics), on a machine with a display"
+# The nine electron bans (G5's mechanism, G6's failure surface): nodeIntegration, context
+# isolation / sandbox, the dangerous webPreferences, and synchronous IPC / @electron/remote. An
+# unlisted ban SKIPs with a reason, so the other classes are unaffected; with electron: true the
+# engine also treats BN-06..09 as enabled even if a hand-edited bans: list omits them.
+bans: BN-01, BN-02, BN-05, BN-06, BN-07, BN-08, BN-09
+notes: a perf number measured on one box is not a user's experience - the renderer half can be a CI job, the Electron half is a host gate and cannot be.

package/presets/{E-fleet-config.yaml → fleet.yaml}

@@ -1,4 +1,4 @@
-# presets/E-fleet-config.yaml — class E: agent-fleet configuration.
+# presets/fleet.yaml — the `fleet` class (letters/aliases E, agent).
 #
 # "Done" means a config change is applied, verified against the ARTIFACT, and versioned.
 # The gate therefore checks the artifact (a commit exists, dated), never the intention.

package/presets/{C-game.yaml → game.yaml}

@@ -1,4 +1,4 @@
-# presets/C-game.yaml — class C: game.
+# presets/game.yaml — the `game` class (letter/alias C).
 #
 # "Done" means a suite green in the Editor AND a human feel verdict. The verdict is a
 # first-class deliverable, which is why this class requires the review-panel part: the panel

package/presets/{D-knowledge.yaml → research.yaml}

@@ -1,4 +1,4 @@
-# presets/D-knowledge.yaml — class D: knowledge / research.
+# presets/research.yaml — the `research` class (letter/alias D).
 #
 # "Done" means a question is answered with sources and the answer is findable. A research
 # note is not a spec, so the SPEC part is OFF, not optional. So are the REPLAY and the PR

package/presets/{B-service-config.yaml → service.yaml}

@@ -1,4 +1,4 @@
-# presets/B-service-config.yaml — class B: service / configuration.
+# presets/service.yaml — the `service` class (letter/alias B).
 #
 # "Done" means a contract (schema, route, API) is unchanged, or the change is intentional
 # and migrated. The class turns off the REPLAY and the PR gate, because a config repo has no

package/presets/{A-shipped-software.yaml → software.yaml}

@@ -1,4 +1,4 @@
-# presets/A-shipped-software.yaml — class A: shipped software.
+# presets/software.yaml — the `software` class (letters/aliases A, app).
 #
 # A class is not a stringency level. It selects WHICH PARTS are required, optional or off
 # (manifest/classes.tsv), and it supplies the default gate/ratchet shape below. The gate

package/skills/goblin-bootstrap/SKILL.md

@@ -7,13 +7,21 @@ description: P8: adopt goblin-stack in a repo - classify, install, verify, then
 
 Use when adopting goblin-stack in a repo, or starting one.
 
-1. **Classify the project A-F.** The class selects which parts are required, optional or off;
-   it is not a stringency level. F is a desktop shell: it adds the electron bans and a host gate.
-2. **`goblin-install --target <dir> --class <x>`**
-3. **`goblin-verify`** — a class-A install verifies green: `43 passed, 0 failed, 11
-   advisory, 28 skipped`, exit 0, once `HANDOFF.md` names a commit that exists; before that edit the
-   scaffold's `0000000` placeholder is `HP-05`'s one expected day-one red (`42 passed, 1 failed`).
-   Twenty-eight rows skip with a reason, and the reason matters: `HS-02`
+1. **Classify the project into one of five classes.** `software`, `service`, `game`, `research` or
+   `fleet` — the class selects which parts are required, optional or off; it is not a stringency
+   level. `software` also carries the electron opt-in (`--electron`): an Electron app is `software`
+   with the electron bans and a host gate, not a sixth class. The letters `A`-`E` and the older
+   names are read-time aliases.
+2. **`goblin-install --target <dir> --class <x>`** — the default install is a NEUTRAL harness:
+   no agent skills. Opt in per platform afterwards with `gob emit --platform <p>` (or vendor the
+   Hermes project tier with `--skills yes`).
+3. **`goblin-verify`** — a default software-class install (no agent skills) verifies green:
+   `38 passed, 0 failed, 11 advisory, 33 skipped`, exit 0, once `HANDOFF.md` names a commit that
+   exists; before that edit the
+   scaffold's `0000000` placeholder is `HP-05`'s one expected day-one red (`37 passed, 1 failed`).
+   Thirty-three rows skip with a reason, and the reason matters: the five skill rows
+   (`SK-01`..`SK-04`, `AU-04`) skip on the `playbooks` opt-out a skills-free install records,
+   then `HS-02`
    (no pinned pre-change commit yet, so the REPLAY is not provable), `AU-02`/`AU-03` (no report
    has been filed in this repo), `SC-06`/`SC-07`/`SC-08` (no dependency manifest, no lockfile, no
    audit record), `PF-01` (no perf baseline measured yet), `BN-01`/`BN-02`/`BN-05` (the ban table is

package/templates/AGENTS.md.tmpl

@@ -1,23 +1,32 @@
 # AGENTS.md
 
-This repository uses **goblin-stack** (class `{{CLASS}}`, installed {{DATE}}). It is a pointer,
+This repository uses **gobstack** (class `{{CLASS}}`, installed {{DATE}}). It is a pointer,
 not a rule dump — the rules live in one executable place, and facts beat requirements.
 
+- **Harness entry point:** `.goblin/bin/goblin-verify` — exit 0 pass, 1 a check failed,
+  2 could not run, 3 the manifest is broken. Run it before you commit; the gate is the
+  same run.
 - **Rules and their checks:** `.goblin/manifest/enforcement.tsv` (one row per rule; every row
   carries a runnable check or the literal `advisory`).
 - **Forbidden code (the ban list):** `.goblin/bin/goblin-bans` runs the bans named by `bans:` in
   `.goblin/goblin.yaml`; each ban's mechanism lives in `.goblin/manifest/bans.tsv`. Run it before
   you write the line, not after — a ban is a gate, and `goblin-verify` only reports it once the
   code exists.
-- **Verify:** `.goblin/bin/goblin-verify` — exit 0 pass, 1 a check failed, 2 could not run,
-  3 the manifest is broken.
-- **Procedures:** the skills installed at `.hermes/skills/` (Hermes project tier — highest
-  precedence, repo-owned). Start with `goblin-mode`, which routes a request to a playbook.
 - **Session state:** `HANDOFF.md` at the repo root. Read it before touching anything.
 - **Project config:** `.goblin/goblin.yaml` (class, branch, gates, ratchet, runtime data,
   replay, opt-outs). Edit it in place; the installer never overwrites it.
 - **The referenced standard**, if configured, is named by `practice:` in `.goblin/goblin.yaml`.
   Read it before starting work; this repo carries no copy of it.
 
+**Agent skills are opt-in, per platform.** A default install ships none — this is a neutral
+harness on purpose, so nothing here assumes which coding agent you use. To install the
+procedure skills for your tool:
+
+    gob emit --platform <p>
+
+(`--scope project` writes them inside this repo; `--scope global` writes them for your user.)
+Run `gob emit` with no platform to see the list. If skills were installed here, they live
+under the platform's own directory, and `gob verify` hashes them.
+
 Two things this repo does not do: it does not choose models (a role resolves through the
 mapping file named by `models_file:`), and it does not write outside its own tree.

package/templates/goblin.yaml.tmpl

@@ -4,9 +4,17 @@
 # Format: a flat, line-oriented YAML subset, parsed by .goblin/bin/goblin-lib.sh. No YAML
 # library, no network, no npm. Keep one key per line and keep comments on their own line.
 
-# Which class this project is (A|B|C|D|E). Selects the required parts (manifest/classes.tsv).
+# Which class this project is: software | service | game | research | fleet.
+# The letters A-E and the older names app/agent/desktop are READ-TIME aliases, so an old
+# value keeps verifying; `desktop`/`F` resolve to software. Selects the required parts
+# (manifest/classes.tsv).
 class: {{CLASS}}
 
+# Electron opt-in (software class). true turns on the electron ban set (BN-06..09) even if the
+# bans: list below omits them, and requires a declared perf.host_gate (PF-01 fails without one).
+# The `desktop`/`F` install alias sets this true; a text-editor app leaves it false.
+electron: {{ELECTRON}}
+
 # The default branch, DECLARED, never assumed. A preset that assumes the wrong branch
 # silently skips a repo.
 branch: {{BRANCH}}

package/presets/F-electron.yaml

@@ -1,67 +0,0 @@
-# presets/F-electron.yaml — class F: desktop shell (Electron).
-#
-# A class is not a stringency level: it selects WHICH PARTS are required, optional or off
-# (manifest/classes.tsv) and supplies the default gate/ratchet shape. A desktop shell needs a
-# part no other class has — a HOST gate, a number measured on a machine with a display — and it
-# forbids a thing the others allow: a renderer that reaches the filesystem or Node directly.
-# That is a new row-set, not a flag on class A (G6 section B.2, Part B).
-#
-# THE PERF LANE IS THE SHIPPED RATCHET, NOT A SECOND ONE (G6 section B.3). There is one
-# mechanism — `ratchet: {name, cmd, ceiling}`, enforced by GT-04/GT-05 and pinned to a commit by
-# PF-01 — and this class reuses it verbatim. What the ratchet measures here is the one hermetic
-# perf number a desktop shell has: the packaged bundle's byte count. A fat bundle is a slow
-# cold start on every machine, and the number needs no browser, no display and no dependency.
-#
-# THE FPS NUMBER IS A HOST GATE, and this is a DEVIATION from G6 section B.3, recorded with its
-# measured reason. G6 wants `main_thread_busy_pct` in the ratchet. It cannot be: the instrument
-# that produces it (CDP `Performance.getMetrics` over a real Chromium, or
-# `app.getAppMetrics()[i].cpu.percentCPUUsage` inside a real Electron) needs Playwright or
-# Electron plus a GUI, and the dependency contract (docs/CONTRACTS.md) allows a shipped rule
-# nothing but bash/git/awk/sed/grep/python3. A `ratchet.cmd` that cannot run on a fresh install
-# makes a fresh install BORN RED, which is the one thing every class must not be. So the probe
-# belongs to the project, next to the code it measures, and the number it produces is declared
-# here as a host gate and carried in the HANDOFF with its date (the class C pattern).
-#
-# Why frame time is the WRONG number, measured in G6 on a real Chromium (CDP, 0 to 32 ms of
-# work per frame): p50 frame time stayed FLAT at 16.70 ms while the main thread went from 1.8%
-# to 54.5% busy, and the dropped-frame count was non-monotone (0,0,0,1,3,11,0 — the worst
-# workload read 0). A frame-time gate at 16.7 ms is green on the idle tree AND on the loaded
-# tree: PROJECT-PRACTICE section 3, reproduced live in the exact metric the note proposed.
-# `main_thread_busy_pct` is the only monotone instrument in that sweep (1.8 -> 13.5 -> 26.0 ->
-# 54.5 -> 76.9 -> 99.5%), which is why it is named here as the host gate's metric.
-# docs/CI.md carries the sweep; docs/LIMITS.md #34 carries the gap.
-label: Desktop shell
-done_means: the renderer is isolated from Node, the main process is not busy, and the packaged bundle ships no dev dependency
-harness_dir: checks
-scaffold_checks: yes
-gate_name: commit
-gate_cmd: git rev-parse --verify --quiet HEAD
-ratchet_name: app_bundle_bytes
-ratchet_cmd: find dist out release -type f -exec cat {} + 2>/dev/null | wc -c
-ratchet_ceiling: measure
-replay_env: GOBLIN_PRE_COMMIT
-replay_cmd: node checks/{name}.mjs
-runtime_data: .goblin/state.json
-sec_gitignore_family: yes
-sec_build_output: dist out release
-sec_audit_cmd: npm audit --json
-sec_audit_max_age_days: 90
-sec_waiver_max_age_days: 180
-sec_write_routes: ""
-# perf_metric must EQUAL ratchet_name (PF-01 fails when the budget and the measurement disagree),
-# so the hermetic metric is named here too, and the host gate carries the FPS number beside it.
-perf_metric: app_bundle_bytes
-perf_cmd: find dist out release -type f -exec cat {} + 2>/dev/null | wc -c
-perf_baseline_commit: ""
-perf_baseline_value: 0
-perf_measured: ""
-perf_host_gate: "Electron run - main_thread_busy_pct with a window open (app.getAppMetrics()[i].cpu.percentCPUUsage, or CDP Performance.getMetrics), on a machine with a display"
-# The nine electron bans (G5's mechanism, G6's failure surface): nodeIntegration, context
-# isolation / sandbox, the dangerous webPreferences, and synchronous IPC / @electron/remote.
-# An unlisted ban SKIPs with a reason, so the other classes are unaffected by this list.
-bans: BN-01, BN-02, BN-05, BN-06, BN-07, BN-08, BN-09
-notes: a perf number measured on one box is not a user's experience - the renderer half can be a CI job, the Electron half is a host gate and cannot be.
-
-# The loop ceiling (G2, LP-03): the most turns ONE loop record may declare in its budget.
-# The same number for every class - a ceiling, not a per-class policy. 20 is the engine default.
-loop_max_turns_ceiling: 20