@techgoblin/gobstack 0.5.0-beta.2 → 0.5.0-beta.4

package/README.md

@@ -56,7 +56,7 @@ After installing, in this order:
 
     cd <target> && git add -A && git commit   # the install is a change like any other
     gob verify                             # or .goblin/bin/goblin-verify, inside the target
-    gob emit --platform <p>                   # optional, per platform: the agent skills are an opt-in
+    gob sync --platform <p>                   # optional, per platform: the agent skills are an opt-in (gob emit is the same verb)
     gob audit                              # once, deliberately: the ONLY network step (SC-07)
 
 **A default software-class install (no agent skills — those are `gob emit`'s job) verifies green —
@@ -92,12 +92,13 @@ The measurement and the vacuous-pass reading are in `docs/CONTRACTS.md`.
 | `gob verify` | run the rule matrix against the current repo — `PASS`/`FAIL`/`SKIP` per row, exit 0 pass · 1 a check failed · 2 could not run · 3 the manifest is broken |
 | `gob bans` | run the ban list (per-pattern red lines over the source tree) |
 | `gob audit` | check recorded dependency claims against live advisory feeds — the only command that touches the network |
-| `gob install` | install the harness into a target repo: manifest, verifier, gates, HANDOFF — no agent skills (those are an opt-in: `gob emit --platform <p>`, or `--skills yes`) |
+| `gob install` | install the harness into a target repo: manifest, verifier, gates, HANDOFF — no agent skills (those are an opt-in: `gob sync --platform <p>`, or `--skills yes`); `--ci-gate yes|no` opts the CI lane in or out (default: the class decides) |
 | `gob uninstall` | remove everything an install wrote, byte-exactly (`gob install --target <dir> --uninstall` is the same job) |
 | `gob upgrade` | migrate a repo to the shared global engine at `~/.goblin/engine` — 8 steps, two commits, one report |
 | `gob doctor` | one run across the platforms below: DETECTED / NOT-DETECTED / DRIFT per platform |
-| `gob emit` | write the skills + context block for one platform (`--scope project` or `global`); `--unshadow` removes a hermes project skill whose hash equals the source |
-| `gob init` | the first-run wizard: detect → class → branch/email → first gate → emit → verify, one screen per question; every question has a flag (`--class software --branch main --email a@b.c --gate 'cmd' --emit hermes`), so CI runs it with zero prompts; `--dry-run` prints the plan and writes nothing |
+| `gob emit` | write the skills + context block for one platform (`--scope project` or `global`); `--unshadow` removes a hermes project skill whose hash equals the source; `gob sync` is the same command under its friendlier name — both spellings work |
+| `gob sync` | the emit verb, renamed (wizard v2): same engine, same flags, same exit contract; `gob emit --help` and `gob sync --help` are byte-identical apart from the verb name |
+| `gob init` | the first-run wizard: detect → class → identity → health check → ci → sync → done, one screen per question; every question has a flag (`--class software --branch main --email a@b.c --gate 'cmd' --emit hermes`), so CI runs it with zero prompts; the ci step defaults to no — nothing under .github/ unless you opt in (`--ci-gate yes|no` overrides); `--dry-run` prints the plan and writes nothing |
 
 `goblin` remains as a legacy alias for every command above — existing scripts keep working, but
 new commands and docs use `gob`.
@@ -122,10 +123,11 @@ prints the full write plan first.
 
 **Agent skills are opt-in.** A `gob install` writes the neutral harness only — `.goblin/`,
 `HANDOFF.md`, `AGENTS.md`, the checks and the `.gitignore` block; no skills directory, and no
-files belonging to any coding agent. The guided path is `gob init`'s emit screen; the one-shot
-path is `gob emit --platform <p>` after installing. Repos whose install predates the opt-in
-default keep their skills through `gob upgrade` (the install record names them; only an explicit
-`--skills no`, or `--uninstall`, removes them).
+files belonging to any coding agent. The guided path is `gob init`'s sync screen; the one-shot
+path is `gob sync --platform <p>` after installing (`gob emit --platform <p>` is the same
+command under its original name — both work byte-identically). Repos whose install predates the
+opt-in default keep their skills through `gob upgrade` (the install record names them; only an
+explicit `--skills no`, or `--uninstall`, removes them).
 
 ## What it is not
 

package/bin/goblin

@@ -5,7 +5,7 @@
 #   gob bans   [--only <id[,id...]>] [--list]
 #   gob audit  [--target <dir>] [--print]
 #   gob doctor [--platform <p>]      # W4a
-#   gob emit   --platform <p> [...]  # W4a/W4b
+#   gob emit   --platform <p> [...]  # W4a/W4b; `gob sync` is the same verb, renamed
 #   gob init   [...]                 # W6: the first-run wizard
 #   gob upgrade [--target .] [...]   # W3
 #   gob --version
@@ -46,7 +46,8 @@ gob — the gobstack command line.
   gob bans   [--only <id[,id...]>] [--list]
   gob audit  [--target <dir>] [--print]
   gob doctor [--platform <p>] [--target <dir>]
-  gob emit   --platform <p> --scope project|global [...]
+  gob emit   --platform <p> --scope project|global [...]   # alias: gob sync
+  gob sync   --platform <p> --scope project|global [...]   # the same verb, friendlier name
   gob init   [--target <dir>] [--class app|A-F] [--dry-run]
   gob upgrade [--target .] [--dry-run] [--yes] [--engine-dir <path>]
   gob --version
@@ -94,6 +95,11 @@ case "$CMD" in
     # same three values verify's wrapper states, propagated verbatim.
     exec bash "$SRC/bin/goblin-emit" "$@"
     ;;
+  sync)
+    # Wizard v2: the friendlier name for the same emission engine. `emit` stays a
+    # first-class verb; this case only adds the alias and propagates identically.
+    exec bash "$SRC/bin/goblin-emit" "$@"
+    ;;
   init)
     # W6: the first-run wizard. It drives install/emit/verify and propagates their
     # exit contract verbatim, like every other subcommand here.

package/bin/goblin-emit

@@ -68,9 +68,9 @@ PREIMG="${GOBLIN_PREIMAGES:-$HOME/.goblin-stack/preimages}"
 
 usage() {
   cat <<USAGE
-gob emit — per-platform emission (W4a, the seven platforms since W4b).
+gob sync — per-platform skill sync (W4a, the seven platforms since W4b).
 
-  gob emit --platform <$_PLA|hermes|copilot|cursor|opencode|codex|$_G1$_G2>
+  gob sync --platform <$_PLA|hermes|copilot|cursor|opencode|codex|$_G1$_G2>
               --scope project|global
               [--skills core|all|none] [--target <dir>] [--source <path>]
               [--uninstall] [--unshadow] [--dry-run] [--strict]
@@ -86,6 +86,8 @@ gob emit — per-platform emission (W4a, the seven platforms since W4b).
   --dry-run    print the full write plan (every path + the priced index size), write nothing
   --strict     make a NOT-DETECTED platform a hard error instead of a project-scope allowance
 
+`gob emit` is the same command under its original name — both names work, byte-identically.
+
 Exit codes: 0 ok or no-op | 1 refusal (with the path and the fix) | 2 bad input.
 USAGE
 }
@@ -143,7 +145,7 @@ case "$PLATFORM" in
   "")      printf 'error: emit: --platform is required\n' >&2; usage >&2; exit 2 ;;
   $_PLA|hermes|copilot|cursor|opencode|codex|$_G1$_G2) ;;
   *)
-    die "unknown platform '$PLATFORM' - gob emit ships $_PLA, hermes, copilot, cursor, opencode, codex, $_G1$_G2" 2
+    die "unknown platform '$PLATFORM' - gob sync ships $_PLA, hermes, copilot, cursor, opencode, codex, $_G1$_G2" 2
     ;;
 esac
 TSV="$ADAPTERS_DIR/$PLATFORM/adapter.tsv"

package/bin/goblin-init

@@ -3,9 +3,13 @@
 #
 #   gob init [--target <dir>] [--class <software|service|game|research|fleet|A..E|app|agent|desktop>]
 #               [--electron] [--branch <name>] [--email <addr>] [--gate <cmd>]
-#               [--emit <p[,p..]>] [--scope project|global] [--yes] [--dry-run]
+#               [--ci-gate yes|no] [--emit <p[,p..]>] [--scope project|global] [--yes] [--dry-run]
 #
-# One screen per question, answered steps collapsing into the ✔/◆/○ rail above. On a tty
+# Seven screens, one per question, answered steps collapsing into the ✔/◆/○ rail above.
+# On a tty the class and ci steps are a KEYBOARD RADIO (arrows move the ▸ pointer, Enter
+# commits; a typed number still works), the emit step is CHECKBOXES (space toggles ☑/☐,
+# Enter commits), and the health check and identity prompts show their accepted default in
+# the [default] form. On a tty
 # the whole wizard frame (logotype, header, answered rows, rail) is redrawn in place from
 # a saved buffer of the wizard's own lines — never by counting printed output, which the
 # installer/emit engines would break. Every question has a flag: with the flags set (or
@@ -16,7 +20,7 @@
 # The wizard is a FRONT END over the existing engines, never a second installer:
 #   .goblin/ + the payload   -> bin/goblin-install  (its refusal contract — an existing
 #                               HANDOFF.md is never overwritten — applies verbatim)
-#   skills + context blocks  -> bin/goblin-emit --scope project (the same code path)
+#   skills + context blocks  -> gob sync (= gob emit; the same code path, friendlier name)
 #   the verdict              -> bin/goblin-verify
 #
 # Exit codes: 0 done | 1 a refusal (named path + fix) | 2 bad input, or verify could
@@ -69,13 +73,14 @@ if [ "$TTY_OUT" -eq 1 ] && [ -z "${NO_COLOR:-}" ]; then
 fi
 
 # ---------------------------------------------------------------- the rail ----
-# 6 steps; the ✔/◆/○ vocabulary. The rail is redrawn in place on a tty from a SAVED
+# 7 steps; the ✔/◆/○ vocabulary. The rail is redrawn in place on a tty from a SAVED
 # BUFFER of the wizard's own lines (RAIL_BUF) — never by counting the output between
 # draws, because the installer/emit engines print freely and break naive accounting.
 # Over a pipe nothing is saved and nothing rewinds: each screen is one numbered line.
-STEP_LABELS=("platforms" "class" "branch/email" "first gate" "emit" "done")
-STEP_VAL=("" "" "" "" "" "")
+STEP_LABELS=("detect" "class" "identity" "health check" "ci" "sync" "done")
+STEP_VAL=("" "" "" "" "" "" "")
 CURRENT=1
+N_STEPS=7
 
 # rail_say: one line of wizard output on a tty — stored in the redraw buffer AND
 # printed with a VT100 clear-line prefix (the redraw may overwrite a longer old line).
@@ -104,12 +109,13 @@ rail_note() {
 }
 rail_rewind() {
   if [ "$TTY_OUT" -eq 1 ]; then
-    # The drawn frame is the buffer PLUS the 6 rail rows rail_draw prints under it.
-    # Rewinding by the buffer count alone left the 6 rail rows painted on screen, so the
-    # next draw stacked a second frame under them — the duplicate-banner the client caught
-    # on a Mac (2026-10-06): every screen ≥2 grew the stack by one frame. Rewind the full
-    # drawn height. (Clean-room catch, second fixture round.)
-    printf '\033[%dA\033[J' "$(( ${#RAIL_BUF[@]} + 6 ))"
+    # The drawn frame is the buffer PLUS the N_STEPS rail rows rail_draw prints under
+    # it. Rewinding by the buffer count alone left the rail rows painted on screen, so
+    # the next draw stacked a second frame under them — the duplicate-banner the client
+    # caught on a Mac (2026-10-06): every screen ≥2 grew the stack by one frame. Rewind
+    # the full drawn height; the count is N_STEPS, so the rail growing again (wizard v2:
+    # 6 steps to 7) cannot reintroduce the stack.
+    printf '\033[%dA\033[J' "$(( ${#RAIL_BUF[@]} + N_STEPS ))"
   fi
 }
 rail_draw() { # reprint the saved buffer, then the live rail row for $CURRENT
@@ -118,7 +124,7 @@ rail_draw() { # reprint the saved buffer, then the live rail row for $CURRENT
   for line in "${RAIL_BUF[@]}"; do
     printf '\033[2K%s\n' "$line"
   done
-  for i in 1 2 3 4 5 6; do
+  for i in 1 2 3 4 5 6 7; do
     label="${STEP_LABELS[$((i - 1))]}"
     if [ "$i" -lt "$CURRENT" ]; then
       glyph="✔"; col="$C_GREEN"
@@ -132,20 +138,135 @@ rail_draw() { # reprint the saved buffer, then the live rail row for $CURRENT
 }
 rail_reset() { RAIL_BUF=(); }
 cascade() { # the pipe-degraded shape: one numbered line per screen (zero cursor motion)
-  printf 'gob init [%d/6] %s\n' "$CURRENT" "$1"
+  printf 'gob init [%d/%d] %s\n' "$CURRENT" "$N_STEPS" "$1"
 }
 
-# ask_value <label> <default> -> REPLY (Enter = default; non-tty stdin = default)
 ask_value() {
   local label="$1" dflt="$2"
   if [ "$TTY_IN" -eq 0 ]; then REPLY="$dflt"; return 0; fi
-  printf '      %s%s%s %s─ %s' "$C_TEXT" "$label" "$C_RESET" "$C_DIM" "$dflt"
+  # The [default] form: what Enter accepts sits on the line, in brackets, before the cursor.
+  printf '      %s%s%s %s[%s]%s ' "$C_TEXT" "$label" "$C_RESET" "$C_DIM" "$dflt" "$C_RESET"
   read -r REPLY
   rail_say ""
   [ -n "$REPLY" ] || REPLY="$dflt"
   return 0
 }
 
+# ---- the interactive selection primitives (tty only) --------------------------
+# The class and ci steps are a RADIO: one ▸ pointer, arrows move it, Enter commits
+# (the number-then-Enter path keeps working). The emit step is CHECKBOXES: space toggles
+# the pointed row between ☑ and ☐, Enter commits. Raw mode is taken for one key and
+# ALWAYS restored on the same line — a wizard that dies in raw mode bricks the shell.
+KEY_UP=$'\033[A'; KEY_DOWN=$'\033[B'
+tty_key() { # -> REPLY_KEY: UP | DOWN | SPACE | ENTER | <char>
+  local k rest
+  REPLY_KEY="ENTER"
+  [ "$TTY_IN" -eq 1 ] || return 0
+  stty raw -echo 2>/dev/null
+  k=$(dd bs=1 count=1 2>/dev/null)
+  rest=""
+  if [ "$k" = "$(printf '\033')" ]; then
+    rest=$(dd bs=1 count=2 2>/dev/null)
+  fi
+  stty sane 2>/dev/null
+  case "$k" in
+    "$(printf '\033')")
+      case "$rest" in
+        "[A") REPLY_KEY="UP" ;;
+        "[B") REPLY_KEY="DOWN" ;;
+        *)    REPLY_KEY="OTHER" ;;
+      esac ;;
+    ""|$(printf '\r')|$(printf '\n'))  # Enter: CR raw, LF cooked/ICRNL, LF from script(1)
+      REPLY_KEY="ENTER" ;;
+    " ")  # a literal space byte — dd bs=1 count=1 hands it through unreduced
+      REPLY_KEY="SPACE" ;;
+    *)   REPLY_KEY="$k" ;;
+  esac
+  return 0
+}
+
+# ask_radio <prompt> <var-out> <option-label>...  -> sets <var-out> to the CHOSEN LABEL.
+# Space/Enter on the pointed row commits; arrows move; a digit pre-positions then commits.
+ask_radio() {
+  local prompt="$1" out="$2"; shift 2
+  local opts=("$@") n=$# sel=0 i key redraw
+  if [ "$TTY_IN" -ne 1 ]; then sel=0; printf -v "$out" '%s' "${opts[$sel]}"; return 0; fi
+  redraw=1
+  while :; do
+    if [ "$redraw" -eq 1 ]; then
+      printf '\033[2K\r'
+      printf '      %s\n' "$prompt"
+      for i in "${!opts[@]}"; do
+        if [ "$i" -eq "$sel" ]; then
+          printf '  %s▸ %s%s%s\n' "$C_ACCENT" "$C_TEXT" "${opts[$i]}" "$C_RESET"
+        else
+          printf '    %s%s%s\n' "$C_DIM" "${opts[$i]}" "$C_RESET"
+        fi
+      done
+      redraw=0
+    fi
+    tty_key; key="$REPLY_KEY"
+    case "$key" in
+      UP)    [ "$sel" -gt 0 ] && sel=$((sel - 1)) && redraw=1 ;;
+      DOWN)  [ "$sel" -lt $((n - 1)) ] && sel=$((sel + 1)) && redraw=1 ;;
+      ENTER) break ;;
+      SPACE) break ;;
+      [1-9]) [ "$key" -le "$n" ] 2>/dev/null && { sel=$((key - 1)); break; } ;;
+    esac
+    if [ "$redraw" -eq 1 ]; then
+      # rewind the option rows + the prompt line, then redraw
+      printf '\033[%dA' "$(( n + 1 ))"
+    fi
+  done
+  printf -v "$out" '%s' "${opts[$sel]}"
+  return 0
+}
+
+# ask_check_pre <prompt> <pre-ticked-space-list> <label>... -> CHOOSE_FLAGS parallel to
+# the labels, 1 = on (a label named in the pre-tick list starts ☑). Space toggles the
+# pointed row (☑/☐), arrows move, Enter commits. Non-tty stdin leaves the flags exactly
+# as pre-ticked (the caller already decided them).
+CHOOSE_FLAGS=()
+ask_check_pre() {
+  local prompt="$1" pretick="$2"; shift 2
+  local opts=("$@") n=$# sel=0 i key redraw w
+  CHOOSE_FLAGS=()
+  for i in "${!opts[@]}"; do
+    CHOOSE_FLAGS[i]=0
+    for w in $pretick; do [ "${opts[$i]}" = "$w" ] && CHOOSE_FLAGS[i]=1; done
+  done
+  if [ "$TTY_IN" -ne 1 ]; then return 0; fi
+  redraw=1
+  while :; do
+    if [ "$redraw" -eq 1 ]; then
+      printf '\033[2K\r'
+      printf '      %s\n' "$prompt"
+      for i in "${!opts[@]}"; do
+        local mark pointer
+        if [ "${CHOOSE_FLAGS[$i]}" -eq 1 ]; then mark="☑"; else mark="☐"; fi
+        if [ "$i" -eq "$sel" ]; then
+          printf '  %s▸ %s%s %s%s\n' "$C_ACCENT" "$C_TEXT" "$mark" "${opts[$i]}" "$C_RESET"
+        else
+          printf '    %s%s %s%s\n' "$C_DIM" "$mark" "${opts[$i]}" "$C_RESET"
+        fi
+      done
+      redraw=0
+    fi
+    tty_key; key="$REPLY_KEY"
+    case "$key" in
+      UP)    [ "$sel" -gt 0 ] && sel=$((sel - 1)) && redraw=1 ;;
+      DOWN)  [ "$sel" -lt $((n - 1)) ] && sel=$((sel + 1)) && redraw=1 ;;
+      SPACE) CHOOSE_FLAGS[$sel]=$(( 1 - CHOOSE_FLAGS[$sel] )); redraw=1 ;;
+      ENTER) break ;;
+      [1-9]) [ "$key" -le "$n" ] 2>/dev/null && { sel=$((key - 1)); break; } ;;
+    esac
+    if [ "$redraw" -eq 1 ]; then
+      printf '\033[%dA' "$(( n + 1 ))"
+    fi
+  done
+  return 0
+}
+
 # ------------------------------------------------------------------ flags -----
 TARGET="" CLASS="" BRANCH="" EMAIL="" GATE="" EMIT="" SCOPE=""
 ELECTRON=0
@@ -160,6 +281,7 @@ while [ $# -gt 0 ]; do
     --branch)  BRANCH="${2:-}"; shift 2 ;;
     --email)   EMAIL="${2:-}"; shift 2 ;;
     --gate)    GATE="${2:-}"; shift 2 ;;
+    --ci-gate) CI_GATE="${2:-}"; shift 2 ;;
     --emit)    EMIT="${2:-}"; shift 2 ;;
     --scope)   SCOPE="${2:-}"; shift 2 ;;
     --yes)     YES=1; shift ;;
@@ -193,7 +315,7 @@ rail_seed "${C_ACCENT}▀██▀▀ ▀██▀ ██▀  ▀▀▀▀ ▀
 rail_seed "     ${C_MUTED}discipline around whatever executes${C_RESET}"
 rail_seed ""
 rail_seed "${C_TEXT}  gob init${C_RESET} ${C_MUTED}— first-run setup (gobstack v$VERSION)${C_RESET}"
-rail_seed "  ${C_MUTED}6 steps · every step has a flag · nothing is written until the plan is confirmed${C_RESET}"
+rail_seed "  ${C_MUTED}7 steps · every step has a flag · nothing is written until the plan is confirmed${C_RESET}"
 rail_seed ""
 if [ "$TTY_OUT" -eq 1 ]; then
   rail_draw
@@ -239,9 +361,9 @@ done
 STEP_VAL[0]="$C_DIM$DET_N detected$C_RESET"
 if [ "$TTY_OUT" -eq 1 ]; then
   rail_say ""
-  rail_say "  ✔ 1. platforms      $C_TEXT$DET_N detected$C_RESET"
+  rail_say "  ✔ 1. detect        $C_TEXT$DET_N platform(s) clean$C_RESET"
   if [ "$DET_N" -eq 0 ]; then
-    rail_say "      ${C_YELLOW}no platform detected here — the wizard will still install the harness; emit later with gob emit$C_RESET"
+    rail_say "      ${C_YELLOW}no platform detected here — the wizard will still install the harness; sync later with gob sync$C_RESET"
   else
     while IFS=$'\t' read -r p proj glob hit; do
       [ -n "$p" ] || continue
@@ -250,7 +372,7 @@ if [ "$TTY_OUT" -eq 1 ]; then
     done <<< "$DET_ROWS"
   fi
 else
-  cascade "platforms: $DET_N detected ($(printf '%s' "$DET_ROWS" | awk -F'\t' '{printf "%s ", $1}'))"
+  cascade "detect: $DET_N platform(s) detected ($(printf '%s' "$DET_ROWS" | awk -F'\t' '{printf "%s ", $1}'))"
 fi
 
 # ------------------------------------------------------------ screen 3: class -
@@ -261,27 +383,21 @@ CLASS_DEFAULT=1
 if [ -z "$CLASS" ]; then
   if [ "$TTY_IN" -eq 1 ]; then
     rail_say ""
-    rail_say "      ${C_MUTED}what kind of work does this repo do?$C_RESET"
-    rail_say "      $C_TEXT  1 ▸ software   shipped features, PRs, review gates        ${C_DIM}(class A)$C_RESET"
-    rail_say "      $C_TEXT  2   service    backend jobs, config, unattended runs      ${C_DIM}(class B)$C_RESET"
-    rail_say "      $C_TEXT  3   game       playable builds, perf budgets              ${C_DIM}(class C)$C_RESET"
-    rail_say "      $C_TEXT  4   research   specs, replays, reference corpora          ${C_DIM}(class D)$C_RESET"
-    rail_say "      $C_TEXT  5   fleet      fleets, loops, unattended automation       ${C_DIM}(class E)$C_RESET"
-    rail_say "      ${C_MUTED}↑ number + Enter · Enter = software · a class letter also works (A-E)$C_RESET"
-    rail_say "      ${C_DIM}an Electron desktop shell: pick software, then --electron$C_RESET"
-    printf '      '
-    read -r REPLY_CLASS
     ASKED_ANY=1
+    # The keyboard radio: arrows move the ▸ pointer, Enter commits, a typed number
+    # pre-positions and commits. Non-tty stdin never reaches this branch.
+    ask_radio "what kind of work does this repo do?" REPLY_CLASS \
+      "software — shipped features, PRs, review gates" \
+      "service — backend jobs, config, unattended runs" \
+      "game — playable builds, perf budgets" \
+      "research — specs, replays, reference corpora" \
+      "fleet — fleets, loops, unattended automation"
+    CLASS="${REPLY_CLASS%% —*}"
     rail_say ""
   else
-    REPLY_CLASS="1"
+    CLASS="software"
     cascade "class: software (default; --class software|service|game|research|fleet or A-E)"
   fi
-  case "$REPLY_CLASS" in
-    1) CLASS="software" ;; 2) CLASS="service" ;; 3) CLASS="game" ;;
-    4) CLASS="research" ;; 5) CLASS="fleet" ;;
-    *) CLASS="${REPLY_CLASS:-software}" ;;
-  esac
 fi
 # Resolve every accepted spelling to the canonical class NAME. The letters A-E and the old
 # taught names (app/agent/desktop) are read-time aliases; anything else is refused here, with
@@ -340,12 +456,12 @@ GATE_DEFAULT="bash tests/run-tests.sh"
 if [ -z "$GATE" ]; then
   if [ "$TTY_IN" -eq 1 ]; then
     rail_say ""
-    rail_say "      ${C_MUTED}one real command that must stay green — suggested for a bash suite:$C_RESET"
+    rail_say "      ${C_MUTED}what command proves this repo is healthy? it must stay green:$C_RESET"
     if [ -f "$TARGET/tests/run-tests.sh" ]; then
       rail_say "      $C_DIM$GATE_DEFAULT$C_RESET"
-      ask_value "gate command" "$GATE_DEFAULT"; GATE="$REPLY"
+      ask_value "health check" "$GATE_DEFAULT"; GATE="$REPLY"
     else
-      ask_value "gate command" "true"; GATE="$REPLY"
+      ask_value "health check" "true"; GATE="$REPLY"
       if [ "$GATE" = "true" ]; then
         rail_say "      ${C_YELLOW}no tests/run-tests.sh found — a placeholder gate is allowed but it proves nothing; replace it in .goblin/goblin.yaml$C_RESET"
       fi
@@ -357,13 +473,49 @@ if [ -z "$GATE" ]; then
 fi
 STEP_VAL[3]="$C_TEXT$GATE$C_RESET"
 if [ "$TTY_OUT" -eq 1 ]; then
-  rail_say "  ✔ $((CURRENT - 1)). first gate      $C_TEXT$GATE$C_RESET"
+  rail_say "  ✔ $((CURRENT - 1)). health check  $C_TEXT$GATE$C_RESET"
 fi
 
-# --------------------------------------------------------- screen 6: the plan --
+# -------------------------------------------------------- screen 6: ci gate ----
+# The CI opt-in. The class decides by default (ci-gate R/O places the workflow, '-'
+# never does); an explicit no opts the part out through --ci-gate no, which the installer
+# records in disabled: so CL-01 reports the opt-out rather than a silent absence.
 CURRENT=6
 rail_rewind
 if [ "$TTY_OUT" -eq 1 ]; then rail_draw; fi
+CI_DEFAULT="no — nothing under .github/ (the default)"
+if [ "${CI_GATE:-}" = "" ] && [ "$TTY_IN" -eq 1 ] && [ "$YES" -eq 0 ]; then
+  rail_say ""
+  ASKED_ANY=1
+  ask_radio "install a CI workflow that runs the health check on every pull request?" REPLY_CI \
+    "no — nothing under .github/ (the default)" \
+    "yes — write the CI workflow" \
+    "class decides — follow the class contract"
+  case "$REPLY_CI" in
+    "yes"*)   CI_GATE="yes" ;;
+    "no"*)    CI_GATE="no" ;;
+    *)        CI_GATE="" ;;
+  esac
+  rail_say ""
+fi
+CI_GATE="${CI_GATE:-}"   # empty = the class decides; yes/no ride the installer's --ci-gate
+case "$CI_GATE" in
+  "")     CI_CHOICE="no (the default)"; CI_FLAG="--ci-gate no" ;;
+  yes)    CI_CHOICE="yes";           CI_FLAG="--ci-gate yes" ;;
+  no)     CI_CHOICE="no (explicit opt-out)"; CI_FLAG="--ci-gate no" ;;
+  *)      g_err "--ci-gate must be yes or no, got '$CI_GATE'"; exit 2 ;;
+esac
+STEP_VAL[4]="$C_DIM$CI_CHOICE$C_RESET"
+if [ "$TTY_OUT" -eq 1 ]; then
+  rail_say "  ✔ $((CURRENT - 1)). ci              $C_DIM$CI_CHOICE$C_RESET"
+else
+  cascade "ci: $CI_CHOICE"
+fi
+
+# -------------------------------------------------------- screen 7: the plan ---
+CURRENT=7
+rail_rewind
+if [ "$TTY_OUT" -eq 1 ]; then rail_draw; fi
 
 # The emit selection: pre-tick the DETECTED platforms (in doctor's enum order).
 EMIT_SELECTED=""
@@ -397,33 +549,33 @@ EMIT_N=$(printf '%s' "$EMIT_SELECTED" | awk 'NF' | wc -l | tr -d '[:space:]')
 
 if [ "$TTY_IN" -eq 1 ] && [ -z "$EMIT" ] && [ "$YES" -eq 0 ]; then
   rail_say ""
-  rail_say "      ${C_MUTED}agent skills are opt-in, per platform — emit them into:$C_RESET"
+  ASKED_ANY=1
+  # The checkboxes: the detected platforms pre-tick, space toggles the pointed row between
+  # ☑ and ☐, arrows move, Enter commits. The install itself writes none either way — the
+  # harness stays neutral; these are the per-platform skills opt-in.
+  EMIT_OPTS=()
   for p in $PLATFORMS; do
     hit=""
-    while IFS=$'	' read -r dp _a _b _c; do [ "$dp" = "$p" ] && hit=1; done <<< "$DET_ROWS"
+    while IFS=$'\t' read -r dp _a _b _c; do [ "$dp" = "$p" ] && hit=1; done <<< "$DET_ROWS"
     [ -n "$hit" ] || continue
-    rail_say "      ${C_GREEN}✔$C_RESET $C_TEXT$p$C_RESET"
+    EMIT_OPTS+=("$p")
   done
-  rail_say "      ${C_MUTED}the install itself writes none — the harness stays neutral$C_RESET"
-  rail_say "      ${C_MUTED}Enter = these; or type platform names to override (none: type x)$C_RESET"
-  printf '      '
-  read -r REPLY_EMIT
-  ASKED_ANY=1
-  rail_say ""
-  if [ "$REPLY_EMIT" = "x" ] || [ "$REPLY_EMIT" = "none" ]; then
-    EMIT_SELECTED=""
-  elif [ -n "$REPLY_EMIT" ]; then
+  if [ "${#EMIT_OPTS[@]}" -gt 0 ]; then
+    ask_check_pre "agent skills are opt-in, per platform — sync them into:" "$EMIT_SELECTED" "${EMIT_OPTS[@]}"
     EMIT_SELECTED=""
-    for w in $REPLY_EMIT; do
-      ok=""
-      for p in $PLATFORMS; do [ "$p" = "$w" ] && ok=1; done
-      [ -n "$ok" ] && EMIT_SELECTED="$EMIT_SELECTED $w" || { g_err "unknown platform '$w' — I ship $PLA, hermes, copilot, cursor, opencode, codex, $GEM"; exit 2; }
+    i=0
+    for p in "${EMIT_OPTS[@]}"; do
+      [ "${CHOOSE_FLAGS[$i]}" -eq 1 ] && EMIT_SELECTED="$EMIT_SELECTED $p"
+      i=$((i + 1))
     done
+  else
+    rail_say "      ${C_MUTED}no platform detected — nothing to pre-tick; sync later with gob sync --platform <p>$C_RESET"
   fi
+  rail_say ""
 fi
-STEP_VAL[4]="$C_TEXT$EMIT_N platform(s) · scope $SCOPE$C_RESET"
+STEP_VAL[5]="$C_TEXT$EMIT_N platform(s) · scope $SCOPE$C_RESET"
 if [ "$TTY_OUT" -eq 1 ]; then
-  rail_say "  ✔ $((CURRENT - 1)). emit             $C_TEXT$EMIT_N platform(s) · scope $SCOPE$C_RESET"
+  rail_say "  ✔ $((CURRENT - 1)). sync            $C_TEXT$EMIT_N platform(s) · scope $SCOPE$C_RESET"
 fi
 
 # ---- the plan box: the wizard never writes until this has been on the screen ----
@@ -437,7 +589,8 @@ add "  ${C_DIM}╭────────────────────
 add "  ${C_DIM}│${C_RESET}  ${C_GREEN}✔${C_RESET} ${C_TEXT}install${C_RESET}      $C_DIM.goblin/ + the payload into$C_RESET $C_TEXT$TARGET$C_RESET"
 add "  ${C_DIM}│${C_RESET}  ${C_GREEN}✔${C_RESET} ${C_TEXT}class${C_RESET}       $C_TEXT$CLASS$C_RESET ${C_DIM}· branch $C_TEXT$BRANCH$C_RESET ${C_DIM}· email$C_RESET $C_TEXT$EMAIL$C_RESET"
 add "  ${C_DIM}│${C_RESET}  ${C_GREEN}✔${C_RESET} ${C_TEXT}gate${C_RESET}        $C_TEXT$GATE$C_RESET"
-add "  ${C_DIM}│${C_RESET}  ${C_GREEN}✔${C_RESET} ${C_TEXT}emit${C_RESET}        $C_TEXT$EMIT_N platform(s), scope $SCOPE$C_RESET$([ "$EMIT_N" -gt 0 ] && printf '%s' " $C_DIM($(printf '%s' "$EMIT_SELECTED" | awk '{$1=$1};1'))$C_RESET")"
+add "  ${C_DIM}│${C_RESET}  ${C_GREEN}✔${C_RESET} ${C_TEXT}ci${C_RESET}          $C_DIM$CI_CHOICE$C_RESET"
+add "  ${C_DIM}│${C_RESET}  ${C_GREEN}✔${C_RESET} ${C_TEXT}sync${C_RESET}        $C_TEXT$EMIT_N platform(s), scope $SCOPE$C_RESET$([ "$EMIT_N" -gt 0 ] && printf '%s' " $C_DIM($(printf '%s' "$EMIT_SELECTED" | awk '{$1=$1};1'))$C_RESET")"
 add "  ${C_DIM}╰──────────────────────────────────────────────────────╯${C_RESET}"
 if [ "$DRYRUN" -eq 1 ]; then
   printf '%s\n' "$BOX"
@@ -467,15 +620,14 @@ fi
 # never rewinds past its own buffer by counting lines it did not print.
 if [ "$TTY_OUT" -eq 1 ]; then
   rail_note ""
-  rail_note "  ${C_MUTED}running: goblin-install --target $TARGET --class $CLASS$([ "$ELECTRON" -eq 1 ] && printf ' --electron')${C_RESET}"
-else
-  printf 'gob init [run] goblin-install --target %s --class %s%s\n' "$TARGET" "$CLASS" "$([ "$ELECTRON" -eq 1 ] && printf ' --electron')"
-fi
-if [ "$ELECTRON" -eq 1 ]; then
-  bash "$SRC/bin/goblin-install" --target "$TARGET" --class "$CLASS" --electron --skills no --yes
+  rail_note "  ${C_MUTED}running: goblin-install --target $TARGET --class $CLASS$([ "$ELECTRON" -eq 1 ] && printf ' --electron')$([ -n "$CI_FLAG" ] && printf ' %s' "$CI_FLAG")${C_RESET}"
 else
-  bash "$SRC/bin/goblin-install" --target "$TARGET" --class "$CLASS" --skills no --yes
+  printf 'gob init [run] goblin-install --target %s --class %s%s%s\n' "$TARGET" "$CLASS" "$([ "$ELECTRON" -eq 1 ] && printf ' --electron')" "$([ -n "$CI_FLAG" ] && printf ' %s' "$CI_FLAG")"
 fi
+INSTALL_ARGS=(--target "$TARGET" --class "$CLASS" --skills no --yes)
+[ "$ELECTRON" -eq 1 ] && INSTALL_ARGS+=(--electron)
+[ -n "$CI_FLAG" ] && INSTALL_ARGS+=($CI_FLAG)
+bash "$SRC/bin/goblin-install" "${INSTALL_ARGS[@]}"
 EXIT_INSTALL=$?
 if [ "$EXIT_INSTALL" -ne 0 ]; then
   g_err "install failed (exit $EXIT_INSTALL) — the refusals above name the path and the fix"
@@ -484,8 +636,8 @@ fi
 CONFIG="$TARGET/.goblin/goblin.yaml"
 [ -f "$CONFIG" ] || { g_err "install wrote no .goblin/goblin.yaml at $TARGET"; exit 1; }
 if [ "$DRYRUN" -eq 0 ]; then
-  sed -i "s|^branch:.*|branch: $BRANCH|" "$CONFIG" || { g_err "cannot write the declared branch into $CONFIG"; exit 1; }
-  sed -i "s|^owner_email:.*|owner_email: $EMAIL|" "$CONFIG" || { g_err "cannot write the owner email into $CONFIG"; exit 1; }
+  g_sed_i "s|^branch:.*|branch: $BRANCH|" "$CONFIG" || { g_err "cannot write the declared branch into $CONFIG"; exit 1; }
+  g_sed_i "s|^owner_email:.*|owner_email: $EMAIL|" "$CONFIG" || { g_err "cannot write the owner email into $CONFIG"; exit 1; }
   TMP_CFG=$(mktemp) || { g_err "mktemp failed"; exit 2; }
   GATE_SUB=$(mktemp) || { g_err "mktemp failed"; exit 2; }
   # print the gate body once, read it as data: an & or / inside the command must not
@@ -512,20 +664,20 @@ fi
 EMITTED=0
 for p in $EMIT_SELECTED; do
   if [ "$TTY_OUT" -eq 0 ]; then
-    printf 'gob init [run] goblin-emit --platform %s --scope %s\n' "$p" "$SCOPE"
+    printf 'gob init [run] gob sync --platform %s --scope %s\n' "$p" "$SCOPE"
   else
-    rail_note "  ${C_MUTED}running: goblin-emit --platform $p --scope $SCOPE${C_RESET}"
+    rail_note "  ${C_MUTED}running: gob sync --platform $p --scope $SCOPE${C_RESET}"
   fi
   bash "$SRC/bin/goblin-emit" --platform "$p" --scope "$SCOPE" --target "$TARGET"
   EXIT_EMIT=$?
   if [ "$EXIT_EMIT" -ne 0 ]; then
-    g_err "emit $p failed (exit $EXIT_EMIT) — run 'gob emit --platform $p --scope $SCOPE' to see the refusal again"
+    g_err "sync $p failed (exit $EXIT_EMIT) — run 'gob sync --platform $p --scope $SCOPE' to see the refusal again"
     exit "$EXIT_EMIT"
   fi
   EMITTED=$((EMITTED + 1))
 done
 
-# --------------------------------------------------- screen 6b: done + verify --
+# --------------------------------------------------- screen 7b: done + verify --
 # Spacing pass: exactly one blank line before each done-screen section; the engine's
 # verify output and this screen's own summary stay visually separated.
 if [ "$TTY_OUT" -eq 0 ]; then
@@ -564,11 +716,11 @@ if [ "$DRYRUN" -eq 0 ]; then
   printf '  %snext:%s\n' "$C_MUTED" "$C_RESET"
   printf '    1. %sthe %s skipped checks ARE your checklist — gob verify names each one%s\n' "$C_TEXT" "$SKIPPED" "$C_RESET"
   printf '    2. %sreplace the placeholder gate in .goblin/goblin.yaml with your real commands (P8 step 3)%s\n' "$C_TEXT" "$C_RESET"
-  printf '    3. %snot emitted here: gob emit --platform <p> --scope global%s\n' "$C_TEXT" "$C_RESET"
+  printf '    3. %snot synced here: gob sync --platform <p> --scope global%s\n' "$C_TEXT" "$C_RESET"
   if [ "$EMIT_N" -gt 0 ]; then
     printf '    4. %shermes skills trust %s   # one-time, so the project-tier skills load%s\n' "$C_TEXT" "$TARGET" "$C_RESET"
   else
-    printf '    4. %sagent skills are opt-in per platform: gob emit --platform <p>%s\n' "$C_TEXT" "$C_RESET"
+    printf '    4. %sagent skills are opt-in per platform: gob sync --platform <p>%s\n' "$C_TEXT" "$C_RESET"
   fi
   printf '\n'
   if [ "$VERIFY_RC" -eq 0 ]; then

package/bin/goblin-install

@@ -19,6 +19,11 @@
 #   --opt-out <part>      record the part in disabled: so its required checks are skipped
 #   --uninstall           remove exactly the files in installed.json
 #   --re-pin              re-record practice_sha256: for an edited standard; nothing else changes
+#   --ci-gate yes|no      the CI lane opt-in (default: the class decides - ci-gate R/O places
+#                         .github/workflows/goblin-gate.yml, ci-gate '-' never does). An
+#                         explicit no opts the part out (recorded in disabled: so CL-01
+#                         reports the opt-out, never a silent absence); an explicit yes is
+#                         refused for a class that forbids the part.
 #   --force               allow overwriting a file goblin-stack did not create
 #   --yes                 non-interactive; take the defaults above
 #
@@ -61,6 +66,11 @@ UNINSTALL=0
 RE_PIN=0
 FORCE=0
 OPT_OUT=""
+# The CI lane opt-in (wizard v2). Empty = the class decides, exactly as before this flag
+# existed: every pre-existing invocation (and every pipe) keeps its byte-identical shape.
+# "no" is an explicit opt-out of the ci-gate part; "yes" is an explicit opt-in, refused for
+# a class that forbids the part (CL-01 would fail it on the very first verify).
+CI_GATE_OPT=""
 # The electron opt-in (the merged desktop/F class): renders presets/electron-overlay.yaml over
 # the software preset. Auto-set when --class resolves via the desktop/F/f alias, so the alias
 # behaves as the old class F did rather than silently installing weaker software.
@@ -88,6 +98,7 @@ while [ $# -gt 0 ]; do
     --uninstall) UNINSTALL=1; shift ;;
     --re-pin)    RE_PIN=1; shift ;;
     --opt-out)   OPT_OUT="${2:-}"; shift 2 ;;
+    --ci-gate)   CI_GATE_OPT="${2:-}"; shift 2 ;;
     --force)     FORCE=1; shift ;;
     --yes)       shift ;;
     -h|--help)   usage; exit 0 ;;
@@ -230,7 +241,7 @@ if [ "$RE_PIN" -eq 1 ]; then
   fi
   # One line, in place. Every other line of the config - comments included - is untouched, so
   # the `owned` contract holds for everything except the single value just asked for.
-  sed -i "s|^practice_sha256:.*|practice_sha256: $NEW_SHA|" "$CONFIG" \
+  g_sed_i "s|^practice_sha256:.*|practice_sha256: $NEW_SHA|" "$CONFIG" \
     || { g_err "could not rewrite the pin in $CONFIG"; exit 1; }
   # Fail closed: never report a re-pin that did not land. The failure this command exists to
   # remove is a hash nobody verified (measured at bf7e9c9: sed -i could not write to a read-only
@@ -257,6 +268,7 @@ CLASS_RAW="$CLASS"
 CLASS=$(g_class_canon "$CLASS") \
   || { g_err "--class must be software|service|game|research|fleet (or A-E / app / agent / desktop), got '$CLASS_RAW'"; exit 2; }
 case "$SKILLS" in yes|no) ;; *) g_err "--skills must be yes or no"; exit 2 ;; esac
+case "$CI_GATE_OPT" in ""|yes|no) ;; *) g_err "--ci-gate must be yes or no, got '$CI_GATE_OPT'"; exit 2 ;; esac
 
 # W6 migration safety: on a --upgrade (or any re-install) of a repo whose record shows skills
 # were installed, an OMITTED --skills flag must READ that state, not silently strip it. The
@@ -354,7 +366,15 @@ WANT_RATCHET=1; [ "$(need ratchet)" = "-" ] && WANT_RATCHET=0
 # The CI lane (G6 A.6). Installed for a class that requires or permits it (A, C, E, F) and never
 # for one that forbids it (B, D) - where CL-01 then requires the file to be ABSENT, which is why
 # class_part_artifact keys off this exact path rather than off .github/workflows/.
+# Wizard v2 adds the explicit opt-in/out: the empty default keeps the class-driven shape
+# byte-identical for every existing invocation; `no` opts the part out (recorded in disabled:
+# so CL-01 reports the opt-out rather than a silent absence, the --skills no precedent); `yes`
+# is refused for a class that forbids the part, because the file could never survive verify.
 WANT_CI_GATE=1; [ "$(need ci-gate)" = "-" ] && WANT_CI_GATE=0
+case "$CI_GATE_OPT" in
+  no)  WANT_CI_GATE=0; OPT_OUT="${OPT_OUT:+$OPT_OUT,}ci-gate" ;;
+  yes) [ "$WANT_CI_GATE" -eq 1 ] || { g_err "--ci-gate yes: class $CLASS forbids the ci-gate part - CI is not in this class's contract (see docs/CI.md)"; exit 2; } ;;
+esac
 [ "$ARCHIVE" = "true" ] && { WANT_SPEC=0; WANT_REVIEWS=0; SCAFFOLD=no; }
 
 OWNER_EMAIL=$( cd "$TARGET" && git config user.email 2>/dev/null )
@@ -731,7 +751,7 @@ fi
   printf '  "source_sha": "%s",\n' "$( cd "$SRC" && git rev-parse HEAD 2>/dev/null || echo unknown )"
   printf '  "class": "%s",\n' "$CLASS"
   printf '  "installed_at": "%s",\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)"
-  printf '  "options": {"skills": "%s", "archive": %s, "parts": "%s"},\n' "$SKILLS" "$ARCHIVE" "${PARTS:-all}"
+  printf '  "options": {"skills": "%s", "archive": %s, "parts": "%s", "ci_gate": "%s"},\n' "$SKILLS" "$ARCHIVE" "${PARTS:-all}" "${CI_GATE_OPT:-class}"
   printf '  "files": {\n'
   awk -F'\t' 'NF==2 {printf "    \"%s\": \"%s\",\n", $1, $2}' "$TMP/files.tsv" | sed '$ s/,$//'
   printf '  },\n'
@@ -773,7 +793,7 @@ if [ "$DRY_RUN" -eq 0 ]; then
         cur=$(g_yaml_scalar "$CONFIG" disabled)
         cur=${cur#[}; cur=${cur%]}
         new=$(printf '%s,%s' "$cur" "$p" | tr ',' '\n' | grep -v '^$' | sort -u | paste -sd, -)
-        sed -i "s|^disabled:.*|disabled: [$new]|" "$CONFIG"
+        g_sed_i "s|^disabled:.*|disabled: [$new]|" "$CONFIG"
       fi
     done
     g_info "recorded opt-out: $OPT_OUT"

package/bin/goblin-lib.sh

@@ -274,6 +274,21 @@ g_installed_scalar_options() {
   ' "$1"
 }
 
+# g_sed_i <sed-script> <file...> — in-place sed that works on BOTH sed families.
+# GNU sed takes -i with an optional suffix attached; BSD sed (macOS) REQUIRES an argument
+# after -i (the backup suffix), so a bare `sed -i 's|…|…|' file` makes BSD read the script
+# as the suffix and the file as the program — the client's `sed: 1: "...": command a
+# expects \ followed by text` (Mac, 2026-10-06). The empty-suffix form `-i ''` is a syntax
+# error on GNU, hence the branch. Callers: g_sed_i 's|a|b|' file
+g_sed_i() {
+  local script="$1"; shift
+  if sed --version >/dev/null 2>&1; then
+    sed -i "$script" "$@"
+  else
+    sed -i '' "$script" "$@"
+  fi
+}
+
 # ------------------------------------------------------------- self-test -----
 # Proves the parser actually parses. Every assertion is a real comparison against a
 # value written to a temp file in this function — blank the awk in g_yaml_scalar and

package/bin/goblin-upgrade

@@ -36,6 +36,14 @@ usage() { sed -n '2,/^$/p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'; }
 
 g_err() { printf 'error: %s\n' "$*" >&2; }
 
+# g_sed_i <sed-script> <file...> — in-place sed on BOTH sed families (goblin-lib's
+# helper; duplicated here because this command is deliberately self-contained and
+# does not source goblin-lib.sh — the BSD sed bomb, client Mac 2026-10-06).
+g_sed_i() {
+  local script="$1"; shift
+  if sed --version >/dev/null 2>&1; then sed -i "$script" "$@"; else sed -i '' "$script" "$@"; fi
+}
+
 # g_expand_tilde <path> — ~ and ~/... to $HOME (the goblin-install:81 idiom).
 g_expand_tilde() {
   case "$1" in
@@ -403,7 +411,7 @@ else
     g_err "upgrade: $CONFIG has neither an active nor a commented engine_dir: line - not a 0.4.4 template; aborting"
     exit 2
   fi
-  sed -i "s|^# engine_dir:.*|$(active_engine_line | sed 's/[&|]/\\&/g')|" "$CONFIG"
+  g_sed_i "s|^# engine_dir:.*|$(active_engine_line | sed 's/[&|]/\\&/g')|" "$CONFIG"
 fi
 
 # ---- installed.json: engine block + drop exactly the 18 engine entries ----
@@ -476,7 +484,7 @@ if [ -f "$WF" ] && grep -q 'run: bash .goblin/bin/goblin-verify' "$WF"; then
   # a files-RECORDED artifact, so this rewrite re-hashes its record entry here,
   # in the same commit (IN-02 hashes every recorded file; a rewritten artifact
   # with a stale recorded hash would fail verify #2 — measured this session).
-  sed -i "s|run: bash .goblin/bin/goblin-verify|run: npx @techgoblin/gobstack@$CLI_VERSION run goblin-verify|" "$WF"
+  g_sed_i "s|run: bash .goblin/bin/goblin-verify|run: npx @techgoblin/gobstack@$CLI_VERSION run goblin-verify|" "$WF"
   WF_NEW=$(sha256 "$WF")
   python3 "$PYJ/rehash_record.py" "$INSTALLED" ".github/workflows/goblin-gate.yml" "$WF_NEW" || {
     g_err "upgrade: re-hashing the rewritten workflow in $INSTALLED failed - the tree is uncommitted; fix: git checkout ."

package/bin/goblin.js

@@ -44,7 +44,9 @@ if (arg0 === "--version" || arg0 === "-V" || arg0 === "-v") {
   process.exit(0);
 }
 
-const SCRIPT = { verify: "goblin-verify", bans: "goblin-bans", audit: "goblin-audit", upgrade: "goblin-upgrade", doctor: "goblin-doctor", emit: "goblin-emit", init: "goblin-init" };
+const SCRIPT = { verify: "goblin-verify", bans: "goblin-bans", audit: "goblin-audit", upgrade: "goblin-upgrade", doctor: "goblin-doctor", emit: "goblin-emit", sync: "goblin-emit", init: "goblin-init" };
+// `sync` is the friendlier name for `emit` (wizard v2): same engine, same flags, same exit
+// contract. `emit` stays a first-class verb - nothing is removed, this row only adds an alias.
 const [cmd, ...rest] = process.argv.slice(2);
 
 // No args, a help flag, or an unrecognized first arg: short usage, exit 2. The one survivor of
@@ -57,13 +59,13 @@ function usage() {
 [
 "gob <command>",
 "",
-"  gob init      start here — the guided first step (detect, class, emit, first verify)",
+"  gob init      start here — the guided first step (health, class, gate, ci, sync, verify)",
 "  gob verify    run the rule matrix against the current repo",
 "  gob bans      run the ban list (per-pattern red lines over the source tree)",
 "  gob audit     check recorded dependency claims against live advisory feeds",
 "  gob upgrade   migrate a repo to the shared global engine at ~/.goblin/engine",
 "  gob doctor    one detection/drift run across the agent platforms",
-"  gob emit      write the skills + context block for one platform",
+"  gob sync      write the skills + context block for one platform (alias: gob emit)",
 "  gob uninstall --target .          remove exactly what an install wrote (preimages)",
 "",
 "start here: gob init",

package/docs/GUIDE.md

@@ -88,9 +88,9 @@ one way this guide installs it.
 **Do not install into a real project yet.** You want to see what it does before it touches
 something you care about.
 
-The guided path is `gob init` — one screen per question (class, branch/email, first
-gate, which platforms to emit), every question also answerable by flag, `--dry-run` to
-see the plan first:
+The guided path is `gob init` — one screen per question (health check, class,
+identity (branch/email), the health check, the CI opt-in, which platforms to sync), every question also
+answerable by flag, `--dry-run` to see the plan first:
 
     mkdir -p /tmp/gs-try && cd /tmp/gs-try
     git init -b main
@@ -100,6 +100,13 @@ see the plan first:
     gob init --target . --class software --branch main --email "you@example.com" \
         --gate "bash tests/run-tests.sh" --yes
 
+The wizard's ci step asks whether the gate should also run in CI
+(`.github/workflows/goblin-gate.yml`). The wizard's default is **no** — nothing lands under `.github/` unless you opt in. (Outside the wizard, `gob install`'s own default is the class decides: a class whose
+contract requires or permits the ci-gate part gets the workflow, one that forbids it never does.)
+`--ci-gate yes|no` overrides: an explicit `no` is recorded as an opt-out (so verify reports the
+opt-out, never a silent absence), and an explicit `yes` is refused for a class that forbids the
+part.
+
 or the plain installer this wizard drives, if you prefer the one-shot shape:
 
     gob install --target . --class software
@@ -112,13 +119,14 @@ Expected output (this is a real transcript, trimmed):
       1. cd /tmp/gs-try && git add -A && git commit   # the install is a change like any other
       2. .goblin/bin/goblin-verify   # or add .goblin/bin to PATH
       3. edit .goblin/goblin.yaml: replace the default gate with your real commands (P8 step 3)
-      4. agent skills are opt-in: gob emit --platform <p>   # hermes, claude, copilot, cursor, opencode, codex, gemini
+      4. agent skills are opt-in: gob sync --platform <p>   # hermes, claude, copilot, cursor, opencode, codex, gemini
 
 **`created 25`** is the installer's count of the files it **tracks** — the 16 in its `files`
 map, the 8 it `owns`, and `.gitignore`. It writes **26**: the 26th is `.goblin/installed.json`,
 the record it keeps for itself, which it writes but does not count. It has written nothing
 outside this directory. The default install ships **no agent skills** — the harness is neutral,
-and `gob emit --platform <p>` is the per-platform opt-in (the old `--skills yes` default is
+and `gob sync --platform <p>` is the per-platform opt-in (`gob emit` is the same command under
+its original name; the old `--skills yes` default is
 still there for repos that want the Hermes project tier vendored).
 
 ### Why `git init -b main` matters
@@ -448,7 +456,7 @@ with no fallback** — a repo is never judged by an engine it did not declare. A
 says `mode=global` keeps hashing whatever files it still holds; the engine's own identity prints in
 every run's footer (`engine: mode=… cli_sha256=… enforcement_tsv_sha256=…`). The same commands are
 available outside any repo through the npm CLI: `gob verify` / `gob bans` / `gob audit` /
-`gob doctor` / `gob emit` / `gob upgrade` / `gob --version`.
+`gob doctor` / `gob sync` / `gob upgrade` / `gob --version`.
 
 **Migrating a repo to the global engine (W3):**
 
@@ -476,7 +484,7 @@ engine and silently de-migrate the record).
 |---|---|
 | `goblin-install` | `0` ok · `1` a refusal (with the path and the fix) · `2` bad input |
 | `goblin-verify` | `0` all checks passed · `1` a check failed · `2` could not run · `3` the manifest itself is broken |
-| `goblin` (npm CLI) | propagates the subcommand's codes verbatim — `verify`/`bans`/`audit`/`--version`; `install`/`uninstall`/`re-pin`/`upgrade` route into `goblin-install` (`upgrade` migrates to the global engine: `0` ok · `1` refusal · `2` bad input); `doctor`/`emit` carry the same contract: `doctor` exits `0` every probed platform DETECTED and clean · `1` any DRIFT · `2` nothing to probe, and `emit` exits `0` ok or no-op · `1` refusal (with the path and the fix) · `2` bad input or unknown platform |
+| `goblin` (npm CLI) | propagates the subcommand's codes verbatim — `verify`/`bans`/`audit`/`--version`; `install`/`uninstall`/`re-pin`/`upgrade` route into `goblin-install` (`upgrade` migrates to the global engine: `0` ok · `1` refusal · `2` bad input); `doctor`/`emit` carry the same contract: `doctor` exits `0` every probed platform DETECTED and clean · `1` any DRIFT · `2` nothing to probe, and `emit` exits `0` ok or no-op · `1` refusal (with the path and the fix) · `2` bad input or unknown platform; `sync` is the same verb renamed and propagates identically |
 | platforms (W4b) | `emit`/`doctor` cover seven: `claude`, `hermes`, `copilot`, `cursor`, `opencode`, `codex`, `gemini` — each detected via its own anchor (`~/.claude`, `~/.hermes`, `~/.copilot`, `~/.cursor`, `~/.config/opencode`, `~/.codex`, `~/.gemini`); codex and gemini carry `partial` command-blocking (see LIMITS #47) |
 
 `3` is the one to notice: it means gobstack's own rule table is malformed, not your project.
@@ -583,7 +591,7 @@ with *"prove it was broken first"* — it is the one practice that survives cont
     # 1. try it somewhere disposable
     mkdir -p /tmp/gs-try && cd /tmp/gs-try
     git init -b main
-    gob install --target . --class software              # expect: created 25 (no skills — those are gob emit)
+    gob install --target . --class software              # expect: created 25 (no skills — those are gob sync)
 
     # 2. commit and check
     git add -A && git commit -m "chore: install gobstack"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@techgoblin/gobstack",
-  "version": "0.5.0-beta.2",
+  "version": "0.5.0-beta.4",
   "description": "Agent-discipline toolkit: one verify command, an enforcement matrix, and LIMITS. bash engine, npm shim.",
   "bin": {
     "goblin": "bin/goblin.js",

package/templates/AGENTS.md.tmpl

@@ -22,10 +22,11 @@ not a rule dump — the rules live in one executable place, and facts beat requi
 harness on purpose, so nothing here assumes which coding agent you use. To install the
 procedure skills for your tool:
 
-    gob emit --platform <p>
+    gob sync --platform <p>
 
 (`--scope project` writes them inside this repo; `--scope global` writes them for your user.)
-Run `gob emit` with no platform to see the list. If skills were installed here, they live
+Run `gob sync` with no platform to see the list (`gob emit` is the same command under its
+original name). If skills were installed here, they live
 under the platform's own directory, and `gob verify` hashes them.
 
 Two things this repo does not do: it does not choose models (a role resolves through the