@techgoblin/gobstack 0.5.0-beta.4 → 0.5.0-beta.5

package/README.md

@@ -98,7 +98,7 @@ The measurement and the vacuous-pass reading are in `docs/CONTRACTS.md`.
 | `gob doctor` | one run across the platforms below: DETECTED / NOT-DETECTED / DRIFT per platform |
 | `gob emit` | write the skills + context block for one platform (`--scope project` or `global`); `--unshadow` removes a hermes project skill whose hash equals the source; `gob sync` is the same command under its friendlier name — both spellings work |
 | `gob sync` | the emit verb, renamed (wizard v2): same engine, same flags, same exit contract; `gob emit --help` and `gob sync --help` are byte-identical apart from the verb name |
-| `gob init` | the first-run wizard: detect → class → identity → health check → ci → sync → done, one screen per question; every question has a flag (`--class software --branch main --email a@b.c --gate 'cmd' --emit hermes`), so CI runs it with zero prompts; the ci step defaults to no — nothing under .github/ unless you opt in (`--ci-gate yes|no` overrides); `--dry-run` prints the plan and writes nothing |
+| `gob init` | the first-run wizard: detect → class → identity → health check → ci → sync → done, one screen per question; every question has a flag (`--class software --branch main --email a@b.c --gate 'cmd' --emit hermes`), so CI runs it with zero prompts; the ci step defaults to no — nothing under .github/ unless you opt in (`--ci-gate yes|no` overrides); `--no-verify` skips the closing health check; `--dry-run` prints the plan and writes nothing |
 
 `goblin` remains as a legacy alias for every command above — existing scripts keep working, but
 new commands and docs use `gob`.

package/bin/goblin-emit

@@ -67,7 +67,7 @@ LEDGER="${GOBLIN_EMISSIONS:-$HOME/.goblin-stack/emissions.tsv}"
 PREIMG="${GOBLIN_PREIMAGES:-$HOME/.goblin-stack/preimages}"
 
 usage() {
-  cat <<USAGE
+  cat <<'USAGE'
 gob sync — per-platform skill sync (W4a, the seven platforms since W4b).
 
   gob sync --platform <$_PLA|hermes|copilot|cursor|opencode|codex|$_G1$_G2>
@@ -221,9 +221,18 @@ g_index_bytes() {
   local files=() n
   for n in $(selected_skills); do files+=("$SRCSKILLS/$n/SKILL.md"); done
   [ "${#files[@]}" -eq 0 ] && { printf '0'; return 0; }
-  awk 'FNR==1{c=0;n=0} /^---$/{c++; next}
-       c==1 && /^name:/{n+=length($0)+1} c==1 && /^description:/{n+=length($0)+1}
-       ENDFILE{tot+=n} END{print tot+0}' "${files[@]}" 2>/dev/null
+  # Portability (BSD catch, 2026-10-06): ENDFILE is a gawk extension. On mawk (the Debian
+  # default) and the macOS BWK awk it is a syntax error, stderr was discarded, and the
+  # run printed "procedure index size: 0 bytes" on every non-gawk machine. Sum per file
+  # with FNR==1 as the reset — the same meaning under every awk.
+  local f total=0
+  for f in "${files[@]}"; do
+    n=$(awk 'FNR==1{n=0} /^---$/{c++; next}
+         c==1 && /^name:/{n+=length($0)+1} c==1 && /^description:/{n+=length($0)+1}
+         END{print n+0}' "$f" 2>/dev/null)
+    total=$((total + ${n:-0}))
+  done
+  printf '%d' "$total"
 }
 
 # ---- the ledger (§4.4) -------------------------------------------------------------

package/bin/goblin-init

@@ -3,7 +3,8 @@
 #
 #   gob init [--target <dir>] [--class <software|service|game|research|fleet|A..E|app|agent|desktop>]
 #               [--electron] [--branch <name>] [--email <addr>] [--gate <cmd>]
-#               [--ci-gate yes|no] [--emit <p[,p..]>] [--scope project|global] [--yes] [--dry-run]
+#               [--ci-gate yes|no] [--emit <p[,p..]>] [--scope project|global] [--yes]
+#               [--no-verify] [--dry-run]
 #
 # Seven screens, one per question, answered steps collapsing into the ✔/◆/○ rail above.
 # On a tty the class and ci steps are a KEYBOARD RADIO (arrows move the ▸ pointer, Enter
@@ -270,7 +271,7 @@ ask_check_pre() {
 # ------------------------------------------------------------------ flags -----
 TARGET="" CLASS="" BRANCH="" EMAIL="" GATE="" EMIT="" SCOPE=""
 ELECTRON=0
-YES=0; DRYRUN=0
+YES=0; DRYRUN=0; NOVERIFY=0
 usage() { sed -n '2,/^$/p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'; }
 
 while [ $# -gt 0 ]; do
@@ -285,6 +286,7 @@ while [ $# -gt 0 ]; do
     --emit)    EMIT="${2:-}"; shift 2 ;;
     --scope)   SCOPE="${2:-}"; shift 2 ;;
     --yes)     YES=1; shift ;;
+    --no-verify) NOVERIFY=1; shift ;;
     --dry-run) DRYRUN=1; shift ;;
     -h|--help) usage; exit 0 ;;
     *) g_err "unknown option: $1"; usage >&2; exit 2 ;;
@@ -683,7 +685,25 @@ done
 if [ "$TTY_OUT" -eq 0 ]; then
   printf 'gob init [verify] .goblin/bin/goblin-verify\n'
 fi
-if [ "$DRYRUN" -eq 0 ]; then
+VERIFY_RC=0
+if [ "$DRYRUN" -eq 0 ] && [ "$NOVERIFY" -eq 1 ]; then
+  # --no-verify: the operator asked for the install without the health check. The skip is
+  # named, not silent — a run that says nothing reads like a run that verified.
+  if [ "$TTY_OUT" -eq 1 ]; then
+    rail_note "  ${C_MUTED}health check skipped (--no-verify) — run .goblin/bin/goblin-verify when ready${C_RESET}"
+  else
+    printf 'gob init [verify] skipped (--no-verify)\n'
+  fi
+elif [ "$DRYRUN" -eq 0 ]; then
+  # Before the run: what the operator is about to see, and whose debt a red row is. On a
+  # fresh install a dozen rows fail or skip because the repo has not earned them yet —
+  # that is the documented day-one state, not a broken install (docs/GUIDE.md, section 4).
+  local_rows=$(awk -F'\t' 'NR>1 && $2=="target" {n++} END{print n+0}' "$TARGET/.goblin/manifest/enforcement.tsv" 2>/dev/null)
+  if [ "$TTY_OUT" -eq 1 ]; then
+    rail_note "  ${C_MUTED}running the health check (${local_rows} manifest rows, about 10-30s) — red rows found here are the repo day-one debts, not install defects${C_RESET}"
+  else
+    printf 'gob init [verify] running the health check (%s manifest rows, about 10-30s); red rows are the repo day-one debts, not install defects\n' "$local_rows"
+  fi
   VERIFY_OUT=$( cd "$TARGET" && bash .goblin/bin/goblin-verify 2>&1 )
   VERIFY_RC=$?
   PASSED=$(printf '%s' "$VERIFY_OUT" | grep -oE '[0-9]+ passed' | head -n 1 | awk '{print $1}')
@@ -693,6 +713,18 @@ if [ "$DRYRUN" -eq 0 ]; then
   PASSED="${PASSED:-0}"; FAILED="${FAILED:-0}"; ADVISORY="${ADVISORY:-0}"; SKIPPED="${SKIPPED:-0}"
 
   if [ "$TTY_OUT" -eq 1 ]; then
+    # After the run: the counts and the day-one framing FIRST, the row detail after —
+    # a fresh install is red on purpose (docs/GUIDE.md section 4), so the verdict line
+    # is the headline and the rows are the evidence, not a wall that hides it.
+    if [ "$VERIFY_RC" -eq 0 ]; then
+      printf '  %sgob verify: %s passed, %s failed, %s skipped · exit 0%s\n' "$C_GREEN" "$PASSED" "$FAILED" "$SKIPPED" "$C_RESET"
+    else
+      printf '  %sgob verify: %s passed, %s failed, %s skipped · exit %s%s\n' "$C_RED" "$PASSED" "$FAILED" "$SKIPPED" "$VERIFY_RC" "$C_RESET"
+    fi
+    if [ "$FAILED" -gt 0 ]; then
+      printf '  %sthe %s failed rows are day-one debts — listed below, each says the fix%s\n' "$C_MUTED" "$FAILED" "$C_RESET"
+    fi
+    printf '\n'
     printf '%s\n' "$VERIFY_OUT" | while IFS= read -r vl; do
       case "$vl" in
         PASS*) printf '      %s%s%s\n' "$C_GREEN" "$vl" "$C_RESET" ;;
@@ -702,12 +734,6 @@ if [ "$DRYRUN" -eq 0 ]; then
         *)     printf '%s\n' "$vl" ;;
       esac
     done
-    printf '\n'
-    if [ "$VERIFY_RC" -eq 0 ]; then
-      printf '  %sgob verify: %s passed, %s failed, %s skipped · exit 0%s\n' "$C_GREEN" "$PASSED" "$FAILED" "$SKIPPED" "$C_RESET"
-    else
-      printf '  %sgob verify: %s passed, %s failed, %s skipped · exit %s%s\n' "$C_RED" "$PASSED" "$FAILED" "$SKIPPED" "$VERIFY_RC" "$C_RESET"
-    fi
   else
     g_info "gob init [verify] exit $VERIFY_RC: $PASSED passed, $FAILED failed, $ADVISORY advisory, $SKIPPED skipped"
   fi

package/bin/goblin-lib.sh

@@ -19,10 +19,66 @@
 GOBLIN_LIB_VERSION="0.5.0"
 
 # ---------------------------------------------------------------- output -----
-g_pass() { printf 'PASS  %-6s %s\n' "$1" "$2"; }
+# g_trunc <width> <text> — fold a long detail to one line at <width> columns, keeping the
+# head. Pure awk substr, no regex: the same shape under every awk (mawk, BWK, gawk).
+g_trunc() {
+  awk -v w="$1" -v t="$2" 'BEGIN{
+    if (length(t) <= w) { print t; exit }
+    print substr(t, 1, w - 1) "~"
+  }'
+}
+# g_fold <width> <indent> <text> — word-wrap <text> at <width>, continuing lines at
+# <indent> (the cannot-see footer shape). Byte-safe: awk length on bytes approximates
+# columns for ASCII prose, which is all this text is.
+g_fold() {
+  awk -v w="$1" -v ind="$2" '
+    {
+      line = $0
+      while (length(line) > w) {
+        cut = w
+        while (cut > 1 && substr(line, cut, 1) != " ") cut--
+        if (cut <= 1) cut = w
+        print substr(line, 1, cut)
+        sub(/^[ ]+/, "", substr(line, cut + 1))
+        line = substr(line, cut + 1)
+        sub(/^[ ]+/, "", line)
+        line = ind line
+      }
+      print line
+    }'
+}
+g_pass() {
+  if [ "${GOB_VERIFY_VERBOSE:-0}" -eq 1 ]; then
+    printf 'PASS  %-6s %s\n' "$1" "$(g_trunc "${GOB_REPORT_COLS:-100}" "$2")"
+  elif printf '%s' "$2" | grep -q "$(printf '\n')"; then
+    # Multi-line PASS payloads print whole: the payload often IS the pin a test reads
+    # (SK-03's advisory-ceiling line), and the collapse must not swallow it.
+    printf 'PASS  %-6s %s\n' "$1" "$2"
+  else
+    printf 'PASS  %-6s (ok)\n' "$1"
+  fi
+}
 g_fail() { printf 'FAIL  %-6s %s\n' "$1" "$2"; }
-g_adv()  { printf 'ADV   %-6s %s\n' "$1" "$2"; }
-g_skip() { printf 'SKIP  %-6s %s\n' "$1" "$2"; }
+g_adv() {
+  # Multi-line ADV payloads print whole: tests pin phrases on the SECOND line of a lane
+  # advisory (the W5-6 family statement), and the fold must not eat them. Single-line
+  # payloads are the ones the ~100-col truncation is for.
+  if printf '%s' "$2" | grep -q "$(printf '\n')"; then
+    printf 'ADV   %-6s %s\n' "$1" "$2"
+  else
+    printf 'ADV   %-6s %s\n' "$1" "$(g_trunc "${GOB_REPORT_COLS:-100}" "$2")"
+  fi
+}
+g_skip() {
+  # SKIPs keep their row line in every mode (tests and scripts read them by id). The
+  # collapse is the WIDTH, not the disappearance: the reason is truncated to the report
+  # width unless --verbose/--only asks for it whole.
+  if [ "${GOB_VERIFY_VERBOSE:-0}" -eq 1 ]; then
+    printf 'SKIP  %-6s %s\n' "$1" "$2"
+  else
+    printf 'SKIP  %-6s %s\n' "$1" "$(g_trunc "${GOB_REPORT_COLS:-100}" "$2")"
+  fi
+}
 g_info() { printf '%s\n' "$*"; }
 g_err()  { printf 'error: %s\n' "$*" >&2; }
 

package/bin/goblin-verify

@@ -28,12 +28,18 @@ ONLY=""
 JSON=0
 LIST=0
 SOURCE=""
+VERBOSE=0
+# PASS details collapse to (ok) in the default listing; --verbose (or --only, which is a
+# forensic single-row run) restores the full payload line by line.
+if [ "${ONLY:-}" != "" ]; then VERBOSE=1; fi
 
 usage() {
   cat <<'USAGE'
 goblin-verify — prove a goblin-stack install is still what it says it is.
 
   --only <id[,id...]>   run only these manifest rows
+  --verbose             print every row full-width (the default collapses PASS payloads
+                        to a count; FAIL and ADV always print in full)
   --list                list the manifest rows and exit
   --json                machine-readable output
   --source <path>       read the manifest from a goblin-stack checkout instead of .goblin/
@@ -44,9 +50,10 @@ USAGE
 
 while [ $# -gt 0 ]; do
   case "$1" in
-    --only)   ONLY="${2:-}"; shift 2 ;;
+    --only)   ONLY="${2:-}"; VERBOSE=1; shift 2 ;;
     --json)   JSON=1; shift ;;
     --list)   LIST=1; shift ;;
+    --verbose) VERBOSE=1; shift ;;
     --source) SOURCE="${2:-}"; shift 2 ;;
     -h|--help) usage; exit 0 ;;
     *) g_err "unknown option: $1"; usage >&2; exit 2 ;;
@@ -355,6 +362,14 @@ else
     export GOBLIN_HARNESS_STATE=none
   fi
 fi
+
+# ---- the report format (collapsed listing) ------------------------------------
+# The default listing is one line per row: PASS payloads collapse to (ok) and long ADV
+# sentences fold to the report width; --verbose (or --only) prints every payload
+# full-width. The lib's row printers read these.
+export GOB_VERIFY_VERBOSE="$VERBOSE"
+export GOB_REPORT_COLS="${COLUMNS:-100}"
+[ "$GOB_REPORT_COLS" -ge 40 ] 2>/dev/null || GOB_REPORT_COLS=100
 export GOBLIN_ROOT="$ROOT"
 export GOBLIN_CONFIG="$CONFIG"
 
@@ -609,8 +624,14 @@ check_hp_03() {
   names=${names% }
   rc=0
   out=$(awk -v names="$names" '
-    function hasname(line, k,   i, a, m) {
-      m = split(line, a, /[^A-Za-z0-9_./-]+/)
+    function hasname(line, k,   i, a, m, pat) {
+      # Portability (BSD catch, 2026-10-06): the split pattern must be a STRING, not a
+      # regex literal. In /[^A-Za-z0-9_./-]+/ the third slash ENDS the regex, so the
+      # macOS BWK awk dies with a syntax error ("nonterminated character class") before
+      # reading a single line; gawk accepts it. A string pattern means the same thing
+      # everywhere. (No apostrophes here: this program is a single-quoted shell string.)
+      pat = "[^A-Za-z0-9_./-]+"
+      m = split(line, a, pat)
       for (i = 1; i <= m; i++) if (a[i] == k) return 1
       return 0
     }
@@ -2761,7 +2782,10 @@ else
     printf '      of those %d advisory: the matrix labels %d row(s) advisory; the difference is the non-advisory row(s) reporting ADV by design (an unresolved lane) and any labelled row skipped by an opt-out\n' \
       "$ADV" "$adv_labelled"
   fi
-  cat <<'SEE'
+  # The collapsed listing keeps one line per row (a SKIP's reason is the row's whole
+  # point and scripts read them by id); the width discipline lives in the lib's printers.
+  if [ "$VERBOSE" -eq 1 ]; then
+    cat <<'SEE'
       cannot see: whether a check in the harness dir tests the right path rather than
       merely passing; whether the forge is bound by the workflow CL-01 found; whether a human
       read the diff;
@@ -2793,6 +2817,16 @@ else
       acquisition record EXISTS, never that the number beside it came from the store (HP-03's
       defect, one artifact over). No row here reaches a reference asset in CONTEXT either.
 SEE
+  else
+    # The same statement, folded to a pointer. The unsigned-record admission rides the
+    # short form too: a doc pin (F2-3) reads it out of every run, not only verbose ones.
+    cat <<'SEE'
+      cannot see: whether a check tests the right path rather than merely passing; whether a
+      human read the diff; whether the unsigned install record (.goblin/installed.json — it is
+      not signed) was rewritten; and the per-lane blind spots of the ban, judge/loop, CI and
+      reference lanes. Full statement: `goblin-verify --verbose`, docs/LIMITS.md #18 #27 #28 #33 #43.
+SEE
+  fi
   # ---- the engine footer (W1 §2.2, R-1's residue -> docs/LIMITS.md #43) --------
   # Every run states WHICH engine judged it: the sha256 of the running verifier and of
   # the manifest that judged this run, so a repo can name its judge. The statement is

package/docs/CONTRACTS.md

@@ -22,6 +22,8 @@ same way the fleet's own tool reads it. Everything else is line-oriented shell.
                           record already has skills installed, an OMITTED flag keeps them; an explicit
                           --skills no removes them.
     --dry-run             print the plan; write nothing
+    --no-verify           skip the health check (goblin-verify) at the end; the wizard
+                          still installs and syncs, and prints the skip notice
     --upgrade             re-install at the current version; report created/updated/unchanged/skipped
     --opt-out <part>      record the part in disabled: so its required checks are skipped
     --uninstall           remove exactly the files in installed.json

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@techgoblin/gobstack",
-  "version": "0.5.0-beta.4",
+  "version": "0.5.0-beta.5",
   "description": "Agent-discipline toolkit: one verify command, an enforcement matrix, and LIMITS. bash engine, npm shim.",
   "bin": {
     "goblin": "bin/goblin.js",