@techgoblin/gobstack 0.5.0-beta.5 → 0.5.0-beta.6

package/README.md

@@ -62,7 +62,8 @@ After installing, in this order:
 **A default software-class install (no agent skills — those are `gob emit`'s job) verifies green —
 `38 passed, 0 failed, 11 advisory, 33 skipped`, exit 0 — once
 `HANDOFF.md` names a commit that exists. Before that edit the scaffold's `0000000` placeholder is
-the one expected red: `37 passed, 1 failed`, `HP-05`. Both numbers measured at W6 (neutral-first);
+the one expected red: `37 passed, 1 failed`, `HP-05`. Both numbers measured at the 0.5.0 neutral-first
+revision (see `docs/RECORD-NOTES.md`, V3);
 the run and the fix are step 2 of `docs/GUIDE.md`.**
 Thirty-three rows skip — the five skill rows (`SK-01`..`SK-04`, `AU-04`) skip on the `playbooks`
 opt-out a skills-free install records, then the not-yet rows (`HS-02` has no pinned pre-change
@@ -155,6 +156,8 @@ below is the reference material the guide points into, so the two do not compete
 | `docs/RISKS.md` | the risk register, the advisory rows named, the non-goals |
 | `docs/CI.md` | the CI lane: what makes a workflow a gate, the four settings a repository cannot set, and the electron opt-in |
 | `docs/LOOP.md` | the judge role and the loop contract: what a goal-mode loop actually does, the record, and what neither can see |
+| `docs/RECORD-NOTES.md` | the wave codes the changelog and the matrix parentheticals use, one line each |
+| `docs/GLOSSARY.md` | every term of art in one table (rendered from the shipped `.goblin/manifest/glossary.tsv`) |
 | `docs/ADOPTION.md` | the five classes, the preset matrix, the adoption order |
 | `docs/LIMITS.md` | where this is weaker than its sources, and what is unproven |
 
@@ -174,7 +177,7 @@ run · `3` the manifest is broken. Every run prints what it cannot see.
     bash tests/run-tests.sh
 
 Runs the source-scope rules (PR-01..PR-05) and the test scripts, including `t-verify-red.sh` —
-one control per target-scope row (168 over 82 target rows), each required to go RED and then
+one control per target-scope row (172 over 82 target rows), each required to go RED and then
 restored, plus `t-audit.sh` for the SC-07 producer. **A verifier that only ever prints GREEN is a
 failure**, so that file is the one that matters most.
 

package/bin/goblin-lib.sh

@@ -58,7 +58,31 @@ g_pass() {
     printf 'PASS  %-6s (ok)\n' "$1"
   fi
 }
-g_fail() { printf 'FAIL  %-6s %s\n' "$1" "$2"; }
+# FAIL keeps its row line whole in every mode, and the matrix's remedy column rides under it.
+# The remedy is the TSV's own cell (IN-01/IN-02/GT-03/CM-01 carry prose there; the pre-remedy
+# rows carry `—`, which prints nothing) — the JG-02 judge-lane `remedy:` line, brought to every
+# row that names one, so the fix a failure needs is printed where the failure is read. A missing
+# column (a manifest written before the column existed) is no remedy, not an error: empty is the
+# same as `—`.
+g_fail() {
+  printf 'FAIL  %-6s %s\n' "$1" "$2"
+  local rem
+  rem=$(g_remedy "$1")
+  case "$rem" in
+    —*) return 0 ;;   # an em-dash cell: history and blindness, never a remedy
+  esac
+  # Whole in verbose/--only mode (the mode that reads, not scans), width-folded otherwise —
+  # the same contract the row printers keep.
+  if [ "${GOB_VERIFY_VERBOSE:-0}" -eq 1 ]; then
+    [ -n "$rem" ] && printf 'remedy: %s\n' "$rem"
+  else
+    [ -n "$rem" ] && printf 'remedy: %s\n' "$(g_trunc "${GOB_REPORT_COLS:-100}" "$rem")"
+  fi
+}
+g_remedy() {
+  [ -f "${_GOB_MANIFEST:-}" ] || return 0
+  awk -F'\t' -v id="$1" 'NR>1 && $1==id { r = $7; if (r != "") print r; exit }' "${_GOB_MANIFEST:-}"
+}
 g_adv() {
   # Multi-line ADV payloads print whole: tests pin phrases on the SECOND line of a lane
   # advisory (the W5-6 family statement), and the fold must not eat them. Single-line

package/bin/goblin-verify

@@ -367,9 +367,12 @@ fi
 # The default listing is one line per row: PASS payloads collapse to (ok) and long ADV
 # sentences fold to the report width; --verbose (or --only) prints every payload
 # full-width. The lib's row printers read these.
+# The report width and the manifest path the row printers read (the remedy lookup is
+# manifest-driven: the tsv is the source of truth, the engine only renders it).
 export GOB_VERIFY_VERBOSE="$VERBOSE"
 export GOB_REPORT_COLS="${COLUMNS:-100}"
 [ "$GOB_REPORT_COLS" -ge 40 ] 2>/dev/null || GOB_REPORT_COLS=100
+export _GOB_MANIFEST="$MANIFEST"
 export GOBLIN_ROOT="$ROOT"
 export GOBLIN_CONFIG="$CONFIG"
 
@@ -467,7 +470,10 @@ check_in_01() {
   fi
   [ -s "$INSTALLED" ] && grep -q '"version"' "$INSTALLED" \
     && { printf 'the install record exists and names its version\n'; return 0; }
+  # IN-01 recovery line (review 1, scope 4): the record is corrupt or missing; name the two
+  # restores. The matrix's remedy: line rides under the payload via g_fail.
   printf 'installed.json is absent or records no version\n'
+  printf 'recover: gob install --upgrade, or git checkout -- .goblin/installed.json\n'
   return 1
 }
 
@@ -543,6 +549,7 @@ check_in_02() {
   # The engine hash itself is printed in the footer on every run (see the footer, below);
   # this row proves the REPO-LOCAL bytes, and a global engine answers elsewhere.
   local p h cur n=0 bad=0 pin="" detail=""
+  local DRIFTED=""
   while IFS=$'\t' read -r p h; do
     [ -n "$p" ] || continue
     if [ "$ENGINE_MODE" = "global" ]; then
@@ -568,6 +575,7 @@ check_in_02() {
     cur=$(g_sha256_file "$ROOT/$p")
     if [ "$cur" != "$h" ]; then
       printf 'drift: %s recorded %s now %s\n' "$p" "$h" "$cur"
+      DRIFTED="$p"
       bad=1
     fi
   done < <(g_installed_files_strict "$INSTALLED")
@@ -603,6 +611,12 @@ check_in_02() {
     return
   fi
   printf '%d installed files hashed%s\n' "$n" "$pin"
+  # IN-02 recovery line (review 1, scope 4): a drift FAIL carries the exact restore commands,
+  # naming the drifted file the payload above reported. Sits between the row's own lines and
+  # the summary; g_fail appends the matrix's remedy: line under the whole payload.
+  if [ "$bad" -ne 0 ] && [ -n "$DRIFTED" ]; then
+    printf 'recover: git checkout -- %s, or gob install --upgrade\n' "$DRIFTED"
+  fi
   [ "$bad" -eq 0 ]
 }
 
@@ -716,14 +730,41 @@ check_gt_01() {
 }
 
 # run the declared gates; optionally write the one-line measured numbers
+# GT-02 stderr (review 2, scope 2): a gate that fails with nothing on screen (`cmd: false`,
+# exit 127) fails in silence. The LAST ~20 lines of the failing gate's combined output are
+# kept in GT02_TAIL, and the row's FAIL payload carries them indented under the FAIL line,
+# attributed to the gate that produced them. The counts line and every other row's payload
+# are untouched (byte-stable where no gate fails).
+GT02_TAIL=""
 run_gates() {
-  local write_line="$1" name cmd rc bad=0 line=""
+  local write_line="$1" name cmd rc bad=0 line="" out
+  GT02_TAIL=""
   while IFS=$'\t' read -r name cmd; do
     [ -n "$name" ] || continue
-    ( cd "$ROOT" && bash -c "$cmd" ) >/dev/null 2>&1
+    out=$( cd "$ROOT" && bash -c "$cmd" 2>&1 )
     rc=$?
     line="$line $name=$rc"
-    [ "$rc" -eq 0 ] || { printf 'gate %s: %s -> exit %d\n' "$name" "$cmd" "$rc"; bad=1; }
+    if [ "$rc" -ne 0 ]; then
+      printf 'gate %s: %s -> exit %d\n' "$name" "$cmd" "$rc"
+      bad=1
+      local tail_lines
+      tail_lines=$(printf '%s\n' "$out" | grep -v '^[[:space:]]*$' | tail -n 20)
+      if [ -n "$tail_lines" ]; then
+        if [ -n "$GT02_TAIL" ]; then GT02_TAIL="$GT02_TAIL
+"; fi
+        GT02_TAIL="${GT02_TAIL}gate ${name} output (last 20 lines):"
+        while IFS= read -r tl; do
+          GT02_TAIL="$GT02_TAIL
+  $tl"
+        done <<EOF_TAIL
+$tail_lines
+EOF_TAIL
+      else
+        [ -n "$GT02_TAIL" ] && GT02_TAIL="$GT02_TAIL
+"
+        GT02_TAIL="${GT02_TAIL}gate ${name} printed nothing on stdout or stderr before exit ${rc} (a silent failure - the command itself is the diagnostic)"
+      fi
+    fi
   done < <(g_yaml_gates "$CONFIG")
   if [ "$write_line" = "yes" ]; then
     local rname rcmd rval
@@ -739,7 +780,12 @@ run_gates() {
   return $bad
 }
 
-check_gt_02() { run_gates yes; }
+check_gt_02() {
+  local _s=0
+  run_gates yes || _s=$?
+  if [ "$_s" -ne 0 ] && [ -n "$GT02_TAIL" ]; then printf '%s\n' "$GT02_TAIL"; fi
+  return "$_s"
+}
 
 check_gt_04() {
   local n c ceil
@@ -2671,6 +2717,33 @@ rc_hdr_field() {
   '
 }
 
+# ---- the day-one framing (review 1, scope 3) ----------------------------------
+# Two shapes are undeserved reds for a person who just cloned a repo. They are DETECTED and
+# framed — the verdict's exit semantics, the counts and every row's payload are untouched:
+#   (a) owner_email in goblin.yaml is not the current git identity -> the CM-01 red names
+#       whose email the repo actually expects (the remedy column says where to point it);
+#   (b) the repo looks freshly cloned (.goblin committed, but fewer than 3 commits) -> one
+#       banner line after the verdict. Commit count only: an mtime comparison against the
+#       reflog fired after every ordinary GT-02 write, so the banner lingered on aged repos
+#       (the verify itself refreshes last-gate-line forever); a repo under 3 commits is the
+#       only unambiguous fresh-clone shape.
+owner_mismatch() {
+  [ -f "$CONFIG" ] || return 1
+  local declared cur
+  declared=$(grep '^owner_email:' "$CONFIG" | head -n 1 | sed 's/^owner_email:[[:space:]]*//' | tr -d '"')
+  cur=$(cd "$ROOT" && git config user.email 2>/dev/null)
+  [ -n "$declared" ] && [ -n "$cur" ] && [ "$declared" != "$cur" ]
+}
+
+fresh_clone() {
+  [ -f "$INSTALLED" ] || return 1
+  [ -d "$ROOT/.git" ] || return 1
+  local n
+  n=$(cd "$ROOT" && git rev-list --count HEAD 2>/dev/null) || return 1
+  [ "$n" -lt 3 ] && return 0
+  return 1
+}
+
 # ================================================================ runner ======
 
 PASS=0; FAIL=0; ADV=0; SKIP=0; BAD=0
@@ -2752,7 +2825,14 @@ while IFS=$'\t' read -r id scope rule enforced_by artifact check why; do
       if [ "$rc" -eq 0 ]; then
         [ -n "$detail" ] || detail="($check)"
       else
-        detail="($check -> exit $rc)"
+        # GT-03's one-liner is self-explaining now (review 1, scope 5): the raw `test -f
+        # ... -nt ...` invocation dump told the reader the mechanics and nothing about what
+        # to do; the human line says both. The TSV remedy column carries the same sentence.
+        if [ "$id" = "GT-03" ]; then
+          detail="GT-03 the gate line is older than the last commit — re-run gob verify to refresh it (it rewrites .goblin/last-gate-line)"
+        else
+          detail="($check -> exit $rc)"
+        fi
         rc=1
       fi
       ;;
@@ -2772,6 +2852,18 @@ if [ "$JSON" -eq 1 ]; then
     "$(json_escape "$ROOT")" "$(json_escape "$CLASS")" "$PASS" "$FAIL" "$ADV" "$SKIP" "${JSON_ROWS%,}"
 else
   printf '      %d passed, %d failed, %d advisory, %d skipped\n' "$PASS" "$FAIL" "$ADV" "$SKIP"
+  # Day-one framing, part (a) (review 1, scope 3): the owner mismatch names whose email the
+  # repo expects, under the verdict, before the row detail. One line, no exit semantics.
+  if [ "$FAIL" -gt 0 ] && owner_mismatch; then
+    _owner_declared=$(grep '^owner_email:' "$CONFIG" | head -n 1 | sed 's/^owner_email:[[:space:]]*//' | tr -d '"')
+    printf '      note: this repo records a different owner (you are probably new here) — commit with --author or update owner_email: %s\n' "$_owner_declared"
+    unset _owner_declared
+  fi
+  # Day-one framing, part (b): a fresh clone is not your debt. One banner line, after the
+  # verdict; counts and exit codes untouched.
+  if [ "$FAIL" -gt 0 ] && fresh_clone; then
+    printf '      fresh clone detected: some of these fails are not yours — see docs/GUIDE.md §9 (day one for a new teammate)\n'
+  fi
   # Z1-7: the advisory number above counts TWO different things - the rows the matrix LABELS
   # advisory, and a row that is not advisory-labelled but whose lane cannot be resolved here
   # (JG-02's unresolved judge lane returns 2 = ADV by design). SK-03 counts the first, the ADV

package/docs/ENFORCEMENT.md

@@ -31,7 +31,7 @@ Measured shape of this table: **87 rows** - 82 target, 5 source; advisory 10, ga
 | id | scope | enforced by | rule | check | if it cannot be enforced, why |
 |---|---|---|---|---|---|
 | `IN-01` | target | script | The install exists and records its version + every file's hash. | goblin-verify --only IN-01 | — (W1: the check is a builtin so the engine.mode=global clause can run — a global, declaration-only repo has no install record and SKIPs with `global engine mode — no per-repo install record`; the vendored clauses are the old one-liner: the record exists and names its version) |
-| `IN-02` | target | script | Every installed file still matches its recorded hash. | `goblin-verify --only IN-02` (builtin) | — |
+| `IN-02` | target | script | Every installed file still matches its recorded hash. | `goblin-verify --only IN-02` (builtin) | recover: `gob install --upgrade`, or `git checkout -- .goblin/installed.json`; for a file it names drifted: `git checkout -- <path>` (if the edit is yours and intended, re-pin it: `gob install --target <dir> --re-pin`) |
 | `IN-03` | target | script | The verifier's own manifest is complete: every rule has a check or is advisory. | `goblin-verify --only IN-03` (builtin) | — (this row is the reason the matrix cannot rot; the second clause is D6's shape in general: a row that carries no check must be labelled advisory, or it claims verification it does not perform. The third clause is Z1-5: `enforced_by` is documented as a closed enum in docs/ENFORCEMENT.md and was read by NOTHING, so a typo in that cell changed nothing - `script\|lint\|gate\|advisory` plus `test`, the source-scope value whose check is tests/run-tests.sh. W1: the check runs against whichever manifest the engine actually resolved (the chain in `bin/goblin-verify`), no longer the hardcoded per-repo path — the rule's meaning is untouched, only the path input follows the engine) |
 | `IN-04` | target | script | No file goblin-stack did not create has been overwritten. | `goblin-verify --only IN-04` (builtin) | Detects a file the installer recorded as pre-existing (a `refused` entry) that has since vanished, or that is listed as installed anyway. The second clause is an internal-consistency guard: with correct code a refused path is never written, so it fires only if the installer regresses. The negative control exercises the vanished branch. |
 | `HP-01` | target | gate | HANDOFF.md exists at the root. | `test -f HANDOFF.md` | — |
@@ -50,7 +50,7 @@ Measured shape of this table: **87 rows** - 82 target, 5 source; advisory 10, ga
 | `HS-01` | target | lint | Asserting harnesses follow the house shape. | `goblin-verify --only HS-01` (builtin) | A declared harness_dir that is absent FAILS when the class scaffolds one (config `scaffold_checks: yes`, classes A and C); a class that ships no harness dir (B/D/E) SKIPs with a reason. Keying the skip off the path alone let one config line switch this row and HS-02 off. A report utility in the same dir is counted and reported separately rather than failing the run. |
 | `HS-02` | target | gate | A check green on both trees proves nothing - the REPLAY must show RED pre-change. | `goblin-verify --only HS-02` (builtin) | The declared `replay.cmd` is EXECUTED with `{name}` replaced by each harness's name, in the pre-change worktree, with `replay.env=<commit>` set (Z1-4). Two clauses that used to be unheard: a command that interpolates no `{name}` FAILs (it cannot be running the harness it names, so nothing was replayed), and a command that cannot be executed at all - exit 126 or 127 - FAILs rather than counting as a RED harness. The harness's name is substituted SHELL-QUOTED (`printf %q`), because the name is part of the command text the shell parses; unquoted, a name carrying `;` or `#` reached the shell as syntax (Z2-3, the G8-1 surface class), and the control for it carries a metacharacter-bearing file name. What it cannot see: a command that runs *something else* under the harness's name and exits non-zero, and whether the harness tests the right path rather than merely failing on this tree. |
 | `HS-03` | target | advisory | Source probes read text with comments blanked first. | `advisory` | Recognising 'this probe reads source text' is semantic; a grep for the blanking helper produces false FAILs on harnesses that do not probe source. |
-| `CM-01` | target | gate | Commits carry the owner identity, not an ambient one. Current scope: this gates the identity of HEAD (the last commit) at the moment of the run - earlier commits by other authors are not scanned. | `test "$(git log -1 --format='%ae')" = "$(grep '^owner_email:' .goblin/goblin.yaml \| cut -d' ' -f2)"` | — |
+| `CM-01` | target | gate | Commits carry the owner identity, not an ambient one. Current scope: this gates the identity of HEAD (the last commit) at the moment of the run - earlier commits by other authors are not scanned. | `test "$(git log -1 --format='%ae')"` = `"$(grep '^owner_email:' .goblin/goblin.yaml \| cut -d' ' -f2)"` | note: this repo records a different owner (you are probably new here) — commit with `git -c user.email=<owner_email> --author=<owner_email>`, or update `owner_email:` in `.goblin/goblin.yaml` |
 | `CM-02` | target | advisory | The commit message was written to a file, not passed with -m. | `advisory` | A backtick lost to command substitution leaves no trace a later check can read. Reported as a heuristic (unbalanced backticks in a body) only. |
 | `CM-03` | target | script | Commit-as-you-go: the working tree is not carrying a dead run's work. | `goblin-verify --only CM-03` (builtin) | — |
 | `MD-01` | target | lint | No model name is hardcoded in any reusable rule. | `for d in skills manifest bin templates presets .goblin .hermes; do [ -d "$d" ] \|\| continue; grep -rniE '(d[e]epseek\|cl[a]ude\|g[p]t-[0-9]\|gr[o]k\|g[e]mini\|g[l]m-[0-9]\|k[i]mi)[a-z0-9.:_-]*' "$d" && exit 1; done; exit 0` | — (the pattern is written with character classes so this row cannot match itself; tests/t-verify-red.sh proves it still catches a real model name. SCOPE, stated so a repo-wide grep is not re-reported as a hole (G8-10): this row reads the seven directories an install writes rules into - skills/ manifest/ bin/ templates/ presets/ .goblin/ .hermes/. It does NOT read tests/, docs/, or the source automations/ directory; tests/ is where a control must be free to WRITE the thing it guards, and the source directories are covered by MD-01's own body in tests/run-tests.sh, which scans skills manifest bin templates presets automations. Both control strings are assembled at run time, so a repo-wide grep over the whole tree is 0 and the row's own scope is 0 by construction.) |

package/docs/GLOSSARY.md

@@ -0,0 +1,40 @@
+# Glossary
+
+Every term of art in one table, rendered from `manifest/glossary.tsv` — that file is the source;
+edit it there and re-render (or hand-render: one row per term, alphabetical, the definition one
+sentence). A term a new reader might trip on belongs here, not in a footnote.
+
+| term | definition | source |
+|---|---|---|
+| advisory | A rule with no executable check. Counted in the verify summary and capped by advisory_ceiling; never a silent pass. | R6 sec.5 |
+| archive | A class-D flag: verify requires no HANDOFF and no gates, and the summary says so. | R7 sec.2.4 |
+| class | A project category A-E that selects which parts are required, optional or off. See manifest/classes.tsv. | R7 sec.4 |
+| drift | A file whose current bytes no longer match the hash recorded at install time. IN-02 reports it; the remedy column says how to recover. | UX-review-2026-10-06 |
+| engine | The bash programs plus the manifest a verify run actually resolved: per-repo (.goblin/bin) or global (engine_dir:). Named in every run's footer. | UX-review-2026-10-06 |
+| forge | The hosting platform a repo pushes to (GitHub, GitLab, ...). PG-05 and PG-06 read the workflow text but can never see what the forge itself enforces. | UX-review-2026-10-06 |
+| foreman | The orchestrating agent that delegates work to the fleet; the role that reads HANDOFF.md first and writes it last. | UX-review-2026-10-06 |
+| gate | A declared command that must exit 0. Declared per project, never inferred from the stack. | PP sec.4 |
+| HANDOFF | The session-boundary contract at the repo root: START HERE / State / Gates / Next steps / NOT verified. | PP sec.1 |
+| harness | An asserting check file: a failures counter, an assert(name, ok, detail) printer, and a non-zero exit on failure. | PP sec.3 |
+| judge | A role that decides whether a PROCESS met its own predicate, from a command's output and a pointer it can resolve - never from a report. One lane per verdict; never the author's lane. | docs/LOOP.md |
+| lane | A family of rules that share a mechanism and a blind spot: the ban lane, the judge/loop lane, the CI lane, the reference lane. The cannot-see footer reports per lane. | UX-review-2026-10-06 |
+| loop | One unattended run over a predicate, recorded in the committed .goblin/loop/ (predicate, pin, first-run, budget, one decisions.tsv row per iteration). | docs/LOOP.md |
+| never-relax | The predicate's digest is recorded at loop start and never updates itself; relaxing it is closing this loop and opening another, with the old predicate archived under .goblin/loop/closed-<date>/. | docs/LOOP.md |
+| opt-out | A part recorded in disabled: so its required checks report SKIP (opt-out) instead of failing. | R6 sec.6.3 |
+| overnight | P10: an unattended run over a checkable predicate written before iteration 1. | R6 sec.3 |
+| part | One installable unit a class requires or forbids: handoff, spec, gate, replay, ratchet, pr-gate, review-panel, playbooks, tokens. | R7 sec.5 |
+| patch-id | git patch-id --stable of base..head. A new head voids a verdict; a matching commit message does not restore it. | R1 sec.10 |
+| playbook | A named, ordered procedure with a measurable verification step. goblin-stack ships 15. | R6 sec.3 |
+| predicate | One shell command that exits 0 when the loop is finished. Written before iteration 1 and run once before it, so its first state is known to be red. A duration is not a predicate. | docs/LOOP.md + pstack guide/07 |
+| preimage | The input that produces a known hash. The hash checks here prove non-drift, not preimage resistance - they are tamper-evidence, not signatures (docs/LIMITS.md #18). | UX-review-2026-10-06 |
+| profile | A worker identity in the Hermes fleet (architect, coder, reviewer, ...). Owns memory and skills. | R4 |
+| review-panel | N independent verdict lanes, each its own card with its own resolved model. Only at stakes S3+. | R6 sec.4.3 |
+| REPLAY | Re-running each assertion against the pinned pre-change commit and requiring it to be RED there. A check green on both trees proves nothing. | PP sec.3 |
+| ratchet | A count that must not rise, with a declared ceiling; a rise is allowed only when re-anchored with the arithmetic (old + N new = new). | PP sec.4 |
+| role | What the work needs: code \| judgment \| review-panel \| synthesis \| investigate \| judge. A role maps to a profile; it never names a model. | R6 sec.4.1 |
+| round | One full pass of the work cycle: plan, implement, gate, replay, hand off. The unit a wave code counts. | UX-review-2026-10-06 |
+| skill | A Hermes SKILL.md directory. goblin-stack installs its skills into the target repo at .hermes/skills/ (project tier), never into a profile. | R6 sec.0.1 / sec.7.3 |
+| SPEC | A per-round document written before implementation: measured root cause plus an AC: list checkable without a human. | PP sec.2 |
+| stakes | The S0-S4 ladder that chooses the review gate strength by the change, not by the repo. | R5 sec.3.2 |
+| sweep | P11: the same change or question across many projects, enumerated by glob, one card each. | R6 sec.3 |
+| vendored | Copied into the repo rather than read from the package, so it survives offline and is hashed by IN-02 like any installed file. | UX-review-2026-10-06 |

package/docs/GUIDE.md

@@ -58,6 +58,10 @@ Everything else in gobstack follows from that sentence. If you remember one thin
 guide, remember that one — it is also the standard the harness holds itself to, and the reason it
 ships a file of things it *cannot* check (`docs/LIMITS.md`).
 
+**Words this guide uses** — gate, ratchet, class, part, replay and the rest are defined in one
+sentence each in `docs/GLOSSARY.md` (rendered from the glossary table the install ships:
+`.goblin/manifest/glossary.tsv`).
+
 ---
 
 ## 2. Before you begin
@@ -78,8 +82,8 @@ You need node ≥ 18 (for the npm shim only), beyond the row above.
 
     npm i -g @techgoblin/gobstack
 
-This puts a single command, `goblin`, on your PATH — the node shim over the bash engine, and the
-one way this guide installs it.
+This puts **two** commands on your PATH — `gob` and `goblin`, both the same node shim over the
+bash engine. The docs say `gob` throughout; either works.
 
 ---
 
@@ -113,7 +117,8 @@ or the plain installer this wizard drives, if you prefer the one-shot shape:
 
 Expected output (this is a real transcript, trimmed):
 
-    created 25 · updated 0 · unchanged 0 · skipped 0
+    created 24 · updated 0 · unchanged 0 · skipped 0
+    recorded opt-out: ci-gate
 
     next:
       1. cd /tmp/gs-try && git add -A && git commit   # the install is a change like any other
@@ -121,12 +126,13 @@ Expected output (this is a real transcript, trimmed):
       3. edit .goblin/goblin.yaml: replace the default gate with your real commands (P8 step 3)
       4. agent skills are opt-in: gob sync --platform <p>   # hermes, claude, copilot, cursor, opencode, codex, gemini
 
-**`created 25`** is the installer's count of the files it **tracks** — the 16 in its `files`
-map, the 8 it `owns`, and `.gitignore`. It writes **26**: the 26th is `.goblin/installed.json`,
-the record it keeps for itself, which it writes but does not count. It has written nothing
-outside this directory. The default install ships **no agent skills** — the harness is neutral,
-and `gob sync --platform <p>` is the per-platform opt-in (`gob emit` is the same command under
-its original name; the old `--skills yes` default is
+**`created 24`** is the installer's count of the files it **tracks** — one fewer than the plain
+installer's 25, because the wizard's unanswered ci screen defaults to an explicit **no**, which is
+recorded as an opt-out and suppresses `.github/workflows/goblin-gate.yml`. It writes **25**: the
+25th is `.goblin/installed.json`, the record it keeps for itself, which it writes but does not
+count. It has written nothing outside this directory. The default install ships **no agent
+skills** — the harness is neutral, and `gob sync --platform <p>` is the per-platform opt-in
+(`gob emit` is the same command under its original name; the old `--skills yes` default is
 still there for repos that want the Hermes project tier vendored).
 
 ### Why `git init -b main` matters
@@ -150,15 +156,16 @@ branch** (unless you want to).
 
 You will see one line per rule. The shape:
 
-    PASS  IN-01  (test -s .goblin/installed.json && grep -q '"version"' .goblin/installed.json)
-    PASS  IN-02  16 installed files hashed | practice pin ok
+    PASS  IN-01  the install record exists and names its version
+    PASS  IN-02  15 installed files hashed
     FAIL  HP-05  HANDOFF.md names no commit that exists in this repo
+    FAIL  GT-02  gate commit: bash tests/run-tests.sh -> exit 127
     SKIP  HS-02  no pinned pre-change commit yet - the REPLAY is not provable
     ADV   HP-04  A stale sentence is corrected in place... (advisory)
 
 and a summary line at the bottom:
 
-    37 passed, 1 failed, 11 advisory, 33 skipped     # the one FAIL is HP-05, below
+    35 passed, 2 failed, 11 advisory, 34 skipped     # HP-05 and GT-02, below
 
 ### How to read that output
 
@@ -178,6 +185,25 @@ one. The list of what is still skipping *is* your onboarding checklist.
 telling you the HANDOFF does not yet name a commit — fix it by naming your HEAD in the `State`
 section.
 
+### The day-one table, measured on this exact walk
+
+| Step | Command | Verify prints | The FAILs |
+|---|---|---|---|
+| 1. the wizard ran | `gob init ... --yes` | `31 passed, 6 failed, 11 advisory, 34 skipped` | the install is uncommitted (`CM-03`), `HP-05`, `GT-02` exit 127, and the identity/branch rows if you skipped the flags |
+| 2. the first commit | `git add -A && git commit` | `35 passed, 2 failed, 11 advisory, 34 skipped` | `HP-05` (the placeholder) and `GT-02` |
+| 3. name a real HEAD — and **commit that too** | edit `HANDOFF.md`, then `git add -A && git commit` | `36 passed, 1 failed, 11 advisory, 34 skipped` | `GT-02` only |
+| 4. your real gate | edit `gates:` in `.goblin/goblin.yaml` (§5) | `36 passed, 0 failed, ...` | none — green |
+
+Two of those deserve their name spelled out:
+
+- **`GT-02` exit 127 is the guide's own teaching point, not a defect.** The default gate is
+  `bash tests/run-tests.sh`, and a throwaway repo has no `tests/` — the shell's own
+  *command not found*. It stays red until §5's most valuable edit (your real `gates:`) replaces
+  it. The failure line tells you this: `gate commit: bash tests/run-tests.sh -> exit 127`.
+- **Step 3 is two steps on purpose.** Naming a real HEAD in `HANDOFF.md` without committing it
+  re-reds `CM-03` (`1 dirty entr(y|ies)`) — commit-as-you-go starts on minute one. Edit, commit,
+  then verify.
+
 ### The three-day-one failures, and why they are not a broken harness
 
 If you ran step 1 without `-b main`, or with the wrong git identity, you will see:
@@ -194,8 +220,9 @@ against a declared expectation. That is exactly what you want it to do.
 `HP-05` deserves one sentence more, because it surprises people: the scaffold ships
 `HEAD when this file was written: `0000000``, and `HP-05` **rejects that placeholder on purpose**.
 A file that names a commit which does not exist is worse than one that names none — it looks like a
-record. Commit first, then write the real short SHA in. Measured: with the placeholder left in,
-verify reports `37 passed, 1 failed`; with the real SHA, `38 passed, 0 failed`.
+record. Commit first, then write the real short SHA in. Measured on this walk: with the placeholder
+left in, verify reports `35 passed, 2 failed`; with the real SHA (and the edit committed),
+`36 passed, 1 failed` — the one FAIL being the `GT-02` exit 127 above.
 
 ---
 
@@ -402,16 +429,20 @@ the next session.
 
 ## 9. What to expect on day one (so you do not misread it)
 
-A software-class install lands on a specific shape. The scaffold ships one deliberate red — `HP-05`, the
-`0000000` placeholder in `HANDOFF.md` (§4) — so a literal first run prints:
+A software-class install through the wizard lands on a specific shape. Two of the first reds are
+the scaffold teaching on purpose — `HP-05`, the `0000000` placeholder in `HANDOFF.md` (§4), and
+`GT-02`, the default gate pointing at a test script a throwaway repo does not have. The walk in §4
+measured, step by step:
 
-    37 passed, 1 failed, 11 advisory, 33 skipped     (the one FAIL is HP-05)
+    31 passed, 6 failed, 11 advisory, 34 skipped     # straight after the wizard, nothing committed
+    35 passed, 2 failed, 11 advisory, 34 skipped     # first commit: HP-05 and GT-02 left
+    36 passed, 1 failed, 11 advisory, 34 skipped     # real HEAD named and committed: GT-02 left
 
-Name a real commit in `HANDOFF.md` and commit, and it is green:
+Name a real commit in `HANDOFF.md`, commit, and give `gates:` real commands (§5), and it is green:
 
-    38 passed, 0 failed, 11 advisory, 33 skipped     (on a real project; your numbers will differ)
+    36 passed, 0 failed, 11 advisory, 34 skipped     (on a real project; your numbers will differ)
 
-**Thirty-three rows skipping is correct**, and each skip prints its reason. In plain terms: the
+**Thirty-four rows skipping is correct**, and each skip prints its reason. In plain terms: the
 harness is telling you which of its rules have nothing to read yet. It is a checklist, not a
 scolding.
 
@@ -440,13 +471,14 @@ Two readings that are easy to get wrong:
 | `gob install: unknown subcommand` (exit 2) | you ran a bare `gob install` without the npm package installed | install the npm package first: `npm i -g @techgoblin/gobstack`, then `gob install` |
 | `IN-03` fails, "manifest is broken" | a row has a broken check column | fix the row; this is a source defect, not yours |
 | a `FAIL` you believe is wrong | the check may be weak, or your belief may be | run `--only <id>` and read the command it prints |
+| a changelog or matrix note says `W6` or `Z1-4` | that is a revision wave code | `docs/RECORD-NOTES.md` is the legend, one line per code |
 
 **The `HANDOFF.md` refusal is the most common one, and `--force` is never the answer.** `--force`
 replaces your project's own record with a blank scaffold — the exact act the refusal exists to
 prevent. Reconcile instead: keep your file, and add the five sections it is missing. The measured
 cost of that edit, on a real 2450-line handoff, was **15 lines added, none removed**.
 
-**One engine, many repos (W1):** the rule table does not have to live in every repo. A repo can
+**One engine, many repos:** the rule table does not have to live in every repo. A repo can
 point at a shared engine with one line in `.goblin/goblin.yaml`:
 
     engine_dir: ~/.goblin/engine          # absolute or ~/-prefixed; absent = per-repo engine
@@ -458,7 +490,7 @@ every run's footer (`engine: mode=… cli_sha256=… enforcement_tsv_sha256=…`
 available outside any repo through the npm CLI: `gob verify` / `gob bans` / `gob audit` /
 `gob doctor` / `gob sync` / `gob upgrade` / `gob --version`.
 
-**Migrating a repo to the global engine (W3):**
+**Migrating a repo to the global engine:**
 
     gob upgrade            # 8 steps, two commits, one report
 
@@ -532,6 +564,8 @@ Named procedures, installed as project-local skills. Each has a measurable verif
 | File | Read it for |
 |---|---|
 | `docs/DESIGN.md` | the thesis and every rejected alternative |
+| `docs/GLOSSARY.md` | every term of art in one table (rendered from `.goblin/manifest/glossary.tsv`) |
+| `docs/RECORD-NOTES.md` | the wave codes the changelog uses, one line each |
 | `docs/FLOWS.md` | the playbooks in full, with reasons |
 | `docs/ENFORCEMENT.md` | the rule matrix, rendered for a human |
 | `docs/LIMITS.md` | **what this cannot check** — read this one early |

package/docs/LIMITS.md

@@ -1,7 +1,8 @@
 # Limits — where this is weaker, and what is unproven
 
 Honest accounting. Nothing here is a hedge for a defect that could be fixed; each is either a
-deliberate trade or an unfilled gap.
+deliberate trade or an unfilled gap. (This file keeps the revision wave codes — `W6`, `Z1`, and
+the rest — in its dated parentheticals; `docs/RECORD-NOTES.md` is the legend.)
 
 ## Weaker than the Cursor harness it learns from
 

package/docs/RECORD-NOTES.md

@@ -0,0 +1,21 @@
+# Record notes — the wave codes
+
+The CHANGELOG, the enforcement matrix's parentheticals, and the older commit messages name
+revisions by a short wave code. This file is the legend: one line each, oldest last. The prose
+documents (README, GUIDE) do not use the codes; when one of these revisions matters to a reader,
+the docs name it by what it changed and point here.
+
+| code | revision | in one line |
+|---|---|---|
+| W1 | engine mode | the rule table can live in a shared engine (`engine_dir:`), not only per-repo; declared-but-unusable is exit 2 with no fallback |
+| W3 | `gob upgrade` | the 8-step migration of a repo to the global engine, two commits, refusal on every unsafe tree |
+| W4 | class + ci-gate | the five domain classes replaced the A–E letters (read-time aliases kept), and `ci-gate` became a declared part with its own workflow |
+| W5 | report width | the verify report learned columns: payloads fold at the report width, multi-line payloads print whole, `--verbose` prints everything |
+| W6 | neutral-first | a default install ships no agent skills (`gob sync --platform <p>` is the opt-in), the desktop class merged into software, and the wizard got its health-check screen |
+| G8 | audit finding 8 | the verify-UX audit's surface classes: refusals that print nothing, rows that pass vacuously, `--only` selections that run nothing |
+| G8-2 | stdout discipline | the engine banner moved to stderr; stdout carries verdict lines and the run's own annotations only |
+| X1 | exit-code audit | every refusal and every silent path got a distinct exit code and a stated reason (0 green, 1 red, 2 refusal/config, 3 skip-by-design) |
+| AB3 | claims pinned | every count a document states about this artifact is asserted against a real install (file maps, row counts, summary lines) |
+| Z1 | record integrity | the loop/judge record contract: pins, digests, the never-relax rule, and what a record proves versus what it cannot |
+| V3 | day-one framing | the verify run explains its reds to a newcomer: remedy lines under FAILs, the owner-mismatch note, the fresh-clone banner, recovery lines |
+| G9 | guide re-walk | docs/GUIDE.md re-walked on the wizard path with every number re-measured (see t-doc-guide-init.sh) |

package/manifest/enforcement.tsv

@@ -1,6 +1,6 @@
 id	scope	rule	enforced_by	artifact	check	if_not_why
 IN-01	target	The install exists and records its version + every file's hash.	script	.goblin/installed.json	goblin-verify --only IN-01	— (W1: the check is a builtin so the engine.mode=global clause can run — a global, declaration-only repo has no install record and SKIPs with `global engine mode — no per-repo install record`; the vendored clauses are the old one-liner: the record exists and names its version)
-IN-02	target	Every installed file still matches its recorded hash.	script	.goblin/installed.json	goblin-verify --only IN-02	—
+IN-02	target	Every installed file still matches its recorded hash.	script	.goblin/installed.json	goblin-verify --only IN-02	recover: gob install --upgrade, or git checkout -- .goblin/installed.json; for a file it names drifted: git checkout -- <path> (if the edit is yours and intended, re-pin it: gob install --target <dir> --re-pin)
 IN-03	target	The verifier's own manifest is complete: every rule has a check or is advisory.	script	manifest/enforcement.tsv	goblin-verify --only IN-03	— (this row is the reason the matrix cannot rot; the second clause is D6's shape in general: a row that carries no check must be labelled advisory, or it claims verification it does not perform. The third clause is Z1-5: `enforced_by` is documented as a closed enum in docs/ENFORCEMENT.md and was read by NOTHING, so a typo in that cell changed nothing - `script|lint|gate|advisory` plus `test`, the source-scope value whose check is tests/run-tests.sh. W1: the check runs against whichever manifest the engine actually resolved (the chain in bin/goblin-verify), no longer the hardcoded per-repo path — the rule's meaning is untouched, only the path input follows the engine)
 IN-04	target	No file goblin-stack did not create has been overwritten.	script	.goblin/installed.json	goblin-verify --only IN-04	Detects a file the installer recorded as pre-existing (a `refused` entry) that has since vanished, or that is listed as installed anyway. The second clause is an internal-consistency guard: with correct code a refused path is never written, so it fires only if the installer regresses. The negative control exercises the vanished branch.
 HP-01	target	HANDOFF.md exists at the root.	gate	HANDOFF.md	test -f HANDOFF.md	—
@@ -19,7 +19,7 @@ GT-05	target	The ratchet has not risen.	gate	ratchet.cmd	goblin-verify --only GT
 HS-01	target	Asserting harnesses follow the house shape.	lint	harness_dir/*	goblin-verify --only HS-01	A declared harness_dir that is absent FAILS when the class scaffolds one (config `scaffold_checks: yes`, classes A and C); a class that ships no harness dir (B/D/E) SKIPs with a reason. Keying the skip off the path alone let one config line switch this row and HS-02 off. A report utility in the same dir is counted and reported separately rather than failing the run.
 HS-02	target	A check green on both trees proves nothing - the REPLAY must show RED pre-change.	gate	harness_dir/*, replay.env, replay.cmd	goblin-verify --only HS-02	The declared `replay.cmd` is EXECUTED with `{name}` replaced by each harness's name, in the pre-change worktree, with `replay.env=<commit>` set (Z1-4). Two clauses that used to be unheard: a command that interpolates no `{name}` FAILs (it cannot be running the harness it names, so nothing was replayed), and a command that cannot be executed at all - exit 126 or 127 - FAILs rather than counting as a RED harness. The harness's name is substituted SHELL-QUOTED (`printf %q`), because the name is part of the command text the shell parses; unquoted, a name carrying `;` or `#` reached the shell as syntax (Z2-3, the G8-1 surface class), and the control for it carries a metacharacter-bearing file name. What it cannot see: a command that runs *something else* under the harness's name and exits non-zero, and whether the harness tests the right path rather than merely failing on this tree.
 HS-03	target	Source probes read text with comments blanked first.	advisory	harness_dir/*	advisory	Recognising 'this probe reads source text' is semantic; a grep for the blanking helper produces false FAILs on harnesses that do not probe source.
-CM-01	target	Commits carry the owner identity, not an ambient one. Current scope: this gates the identity of HEAD (the last commit) at the moment of the run - earlier commits by other authors are not scanned.	gate	git log	test "$(git log -1 --format='%ae')" = "$(grep '^owner_email:' .goblin/goblin.yaml | cut -d' ' -f2)"	—
+CM-01	target	Commits carry the owner identity, not an ambient one. Current scope: this gates the identity of HEAD (the last commit) at the moment of the run - earlier commits by other authors are not scanned.	gate	git log	test "$(git log -1 --format='%ae')" = "$(grep '^owner_email:' .goblin/goblin.yaml | cut -d' ' -f2)"	note: this repo records a different owner (you are probably new here) — commit with git -c user.email=<owner_email> --author=<owner_email>, or update owner_email: in .goblin/goblin.yaml
 CM-02	target	The commit message was written to a file, not passed with -m.	advisory	git log	advisory	A backtick lost to command substitution leaves no trace a later check can read. Reported as a heuristic (unbalanced backticks in a body) only.
 CM-03	target	Commit-as-you-go: the working tree is not carrying a dead run's work.	script	git status --porcelain	goblin-verify --only CM-03	—
 MD-01	target	No model name is hardcoded in any reusable rule.	lint	skills/ manifest/ bin/ templates/ presets/ .goblin/ .hermes/	for d in skills manifest bin templates presets .goblin .hermes; do [ -d "$d" ] || continue; grep -rniE '(d[e]epseek|cl[a]ude|g[p]t-[0-9]|gr[o]k|g[e]mini|g[l]m-[0-9]|k[i]mi)[a-z0-9.:_-]*' "$d" && exit 1; done; exit 0	— (the pattern is written with character classes so this row cannot match itself; tests/t-verify-red.sh proves it still catches a real model name. SCOPE, stated so a repo-wide grep is not re-reported as a hole (G8-10): this row reads the seven directories an install writes rules into - skills/ manifest/ bin/ templates/ presets/ .goblin/ .hermes/. It does NOT read tests/, docs/, or the source automations/ directory; tests/ is where a control must be free to WRITE the thing it guards, and the source directories are covered by MD-01's own body in tests/run-tests.sh, which scans skills manifest bin templates presets automations. Both control strings are assembled at run time, so a repo-wide grep over the whole tree is 0 and the row's own scope is 0 by construction.)

package/manifest/glossary.tsv

@@ -23,3 +23,11 @@ judge	A role that decides whether a PROCESS met its own predicate, from a comman
 predicate	One shell command that exits 0 when the loop is finished. Written before iteration 1 and run once before it, so its first state is known to be red. A duration is not a predicate.	docs/LOOP.md + pstack guide/07
 loop	One unattended run over a predicate, recorded in the committed .goblin/loop/ (predicate, pin, first-run, budget, one decisions.tsv row per iteration).	docs/LOOP.md
 never-relax	The predicate's digest is recorded at loop start and never updates itself; relaxing it is closing this loop and opening another, with the old predicate archived under .goblin/loop/closed-<date>/.	docs/LOOP.md
+round	One full pass of the work cycle: plan, implement, gate, replay, hand off. The unit a wave code counts.	UX-review-2026-10-06
+vendored	Copied into the repo rather than read from the package, so it survives offline and is hashed by IN-02 like any installed file.	UX-review-2026-10-06
+forge	The hosting platform a repo pushes to (GitHub, GitLab, ...). PG-05 and PG-06 read the workflow text but can never see what the forge itself enforces.	UX-review-2026-10-06
+drift	A file whose current bytes no longer match the hash recorded at install time. IN-02 reports it; the remedy column says how to recover.	UX-review-2026-10-06
+preimage	The input that produces a known hash. The hash checks here prove non-drift, not preimage resistance - they are tamper-evidence, not signatures (docs/LIMITS.md #18).	UX-review-2026-10-06
+lane	A family of rules that share a mechanism and a blind spot: the ban lane, the judge/loop lane, the CI lane, the reference lane. The cannot-see footer reports per lane.	UX-review-2026-10-06
+foreman	The orchestrating agent that delegates work to the fleet; the role that reads HANDOFF.md first and writes it last.	UX-review-2026-10-06
+engine	The bash programs plus the manifest a verify run actually resolved: per-repo (.goblin/bin) or global (engine_dir:). Named in every run's footer.	UX-review-2026-10-06

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@techgoblin/gobstack",
-  "version": "0.5.0-beta.5",
+  "version": "0.5.0-beta.6",
   "description": "Agent-discipline toolkit: one verify command, an enforcement matrix, and LIMITS. bash engine, npm shim.",
   "bin": {
     "goblin": "bin/goblin.js",

package/docs/w6-tty-redraw-pty-transcript.txt

@@ -1,334 +0,0 @@
-Script started on 2026-10-02 00:53:48+07:00 [COMMAND="bash /home/harvey/projects/goblin-stack/bin/goblin-init --target /tmp/ptyfinal/repo --yes" <not executed on terminal>]
-
-
-
-
-
-
-
-
-▄███▄ ▄██▄ ██▄  █    ▄█▄ █  █   ▄██▀ █████ ▄███▄ ▄███ █  █
-█   █ █  █ █▄▀█ █     █  █▄ █   ▀██▄   █   █   █ █    █ █
-█ ▄██ █  █ █▄▀█ █     █  █ ▄█   ▄█▀    █   █████ █    ██
-▀██▀▀ ▀██▀ ██▀  ▀▀▀▀ ▀█▀ █  █   ██▀▀   ▀   █   █ ▀██▀ █ █
-     discipline around whatever executes
-
-  gob init — first-run setup (gobstack v0.4.4)
-  6 steps · every step has a flag · nothing is written until the plan is confirmed
-
-  ◆ 1. platforms    
-  ○ 2. class        
-  ○ 3. branch/email 
-  ○ 4. first gate   
-  ○ 5. emit         
-  ○ 6. done         
-▄███▄ ▄██▄ ██▄  █    ▄█▄ █  █   ▄██▀ █████ ▄███▄ ▄███ █  █
-█   █ █  █ █▄▀█ █     █  █▄ █   ▀██▄   █   █   █ █    █ █
-█ ▄██ █  █ █▄▀█ █     █  █ ▄█   ▄█▀    █   █████ █    ██
-▀██▀▀ ▀██▀ ██▀  ▀▀▀▀ ▀█▀ █  █   ██▀▀   ▀   █   █ ▀██▀ █ █
-     discipline around whatever executes
-
-  gob init — first-run setup (gobstack v0.4.4)
-  6 steps · every step has a flag · nothing is written until the plan is confirmed
-
-  ✔ 1. platforms    
-  ◆ 2. class        
-  ○ 3. branch/email 
-  ○ 4. first gate   
-  ○ 5. emit         
-  ○ 6. done         
-
-  ✔ 1. platforms      0 detected
-      no platform detected here — the wizard will still install the harness; emit later with gob emit
-▄███▄ ▄██▄ ██▄  █    ▄█▄ █  █   ▄██▀ █████ ▄███▄ ▄███ █  █
-█   █ █  █ █▄▀█ █     █  █▄ █   ▀██▄   █   █   █ █    █ █
-█ ▄██ █  █ █▄▀█ █     █  █ ▄█   ▄█▀    █   █████ █    ██
-▀██▀▀ ▀██▀ ██▀  ▀▀▀▀ ▀█▀ █  █   ██▀▀   ▀   █   █ ▀██▀ █ █
-     discipline around whatever executes
-
-  gob init — first-run setup (gobstack v0.4.4)
-  6 steps · every step has a flag · nothing is written until the plan is confirmed
-
-
-  ✔ 1. platforms      0 detected
-      no platform detected here — the wizard will still install the harness; emit later with gob emit
-  ✔ 1. platforms    0 detected
-  ✔ 2. class        
-  ◆ 3. branch/email 
-  ○ 4. first gate   
-  ○ 5. emit         
-  ○ 6. done         
-
-      what kind of work does this repo do?
-        1 ▸ app        shipped features, PRs, review gates        (class A)
-        2   service    backend jobs, config, unattended runs      (class B)
-        3   game       playable builds, perf budgets              (class C)
-        4   research   specs, replays, reference corpora          (class D)
-        5   agent      fleets, loops, unattended automation       (class E)
-        6   desktop    the shell you live in, perf budget         (class F)
-      ↑ number + Enter · Enter = app · the class letter works too (A-F)
-      
-  ✔ 2. class            A — shipped-software
-▄███▄ ▄██▄ ██▄  █    ▄█▄ █  █   ▄██▀ █████ ▄███▄ ▄███ █  █
-█   █ █  █ █▄▀█ █     █  █▄ █   ▀██▄   █   █   █ █    █ █
-█ ▄██ █  █ █▄▀█ █     █  █ ▄█   ▄█▀    █   █████ █    ██
-▀██▀▀ ▀██▀ ██▀  ▀▀▀▀ ▀█▀ █  █   ██▀▀   ▀   █   █ ▀██▀ █ █
-     discipline around whatever executes
-
-  gob init — first-run setup (gobstack v0.4.4)
-  6 steps · every step has a flag · nothing is written until the plan is confirmed
-
-
-  ✔ 1. platforms      0 detected
-      no platform detected here — the wizard will still install the harness; emit later with gob emit
-
-      what kind of work does this repo do?
-        1 ▸ app        shipped features, PRs, review gates        (class A)
-        2   service    backend jobs, config, unattended runs      (class B)
-        3   game       playable builds, perf budgets              (class C)
-        4   research   specs, replays, reference corpora          (class D)
-        5   agent      fleets, loops, unattended automation       (class E)
-        6   desktop    the shell you live in, perf budget         (class F)
-      ↑ number + Enter · Enter = app · the class letter works too (A-F)
-
-  ✔ 2. class            A — shipped-software
-  ✔ 1. platforms    0 detected
-  ✔ 2. class        A (shipped-software)
-  ✔ 3. branch/email 
-  ◆ 4. first gate   
-  ○ 5. emit         
-  ○ 6. done         
-
-      the forge contract — the identity this repo commits with (CM-01)
-      default branch ─ main
-      owner email ─ t@t.co
-  ✔ 3. branch/email   main · t@t.co
-▄███▄ ▄██▄ ██▄  █    ▄█▄ █  █   ▄██▀ █████ ▄███▄ ▄███ █  █
-█   █ █  █ █▄▀█ █     █  █▄ █   ▀██▄   █   █   █ █    █ █
-█ ▄██ █  █ █▄▀█ █     █  █ ▄█   ▄█▀    █   █████ █    ██
-▀██▀▀ ▀██▀ ██▀  ▀▀▀▀ ▀█▀ █  █   ██▀▀   ▀   █   █ ▀██▀ █ █
-     discipline around whatever executes
-
-  gob init — first-run setup (gobstack v0.4.4)
-  6 steps · every step has a flag · nothing is written until the plan is confirmed
-
-
-  ✔ 1. platforms      0 detected
-      no platform detected here — the wizard will still install the harness; emit later with gob emit
-
-      what kind of work does this repo do?
-        1 ▸ app        shipped features, PRs, review gates        (class A)
-        2   service    backend jobs, config, unattended runs      (class B)
-        3   game       playable builds, perf budgets              (class C)
-        4   research   specs, replays, reference corpora          (class D)
-        5   agent      fleets, loops, unattended automation       (class E)
-        6   desktop    the shell you live in, perf budget         (class F)
-      ↑ number + Enter · Enter = app · the class letter works too (A-F)
-
-  ✔ 2. class            A — shipped-software
-
-      the forge contract — the identity this repo commits with (CM-01)
-
-
-  ✔ 3. branch/email   main · t@t.co
-  ✔ 1. platforms    0 detected
-  ✔ 2. class        A (shipped-software)
-  ✔ 3. branch/email main · t@t.co
-  ✔ 4. first gate   
-  ◆ 5. emit         
-  ○ 6. done         
-
-      one real command that must stay green — suggested for a bash suite:
-      bash tests/run-tests.sh
-      gate command ─ bash tests/run-tests.sh
-  ✔ 4. first gate      bash tests/run-tests.sh
-▄███▄ ▄██▄ ██▄  █    ▄█▄ █  █   ▄██▀ █████ ▄███▄ ▄███ █  █
-█   █ █  █ █▄▀█ █     █  █▄ █   ▀██▄   █   █   █ █    █ █
-█ ▄██ █  █ █▄▀█ █     █  █ ▄█   ▄█▀    █   █████ █    ██
-▀██▀▀ ▀██▀ ██▀  ▀▀▀▀ ▀█▀ █  █   ██▀▀   ▀   █   █ ▀██▀ █ █
-     discipline around whatever executes
-
-  gob init — first-run setup (gobstack v0.4.4)
-  6 steps · every step has a flag · nothing is written until the plan is confirmed
-
-
-  ✔ 1. platforms      0 detected
-      no platform detected here — the wizard will still install the harness; emit later with gob emit
-
-      what kind of work does this repo do?
-        1 ▸ app        shipped features, PRs, review gates        (class A)
-        2   service    backend jobs, config, unattended runs      (class B)
-        3   game       playable builds, perf budgets              (class C)
-        4   research   specs, replays, reference corpora          (class D)
-        5   agent      fleets, loops, unattended automation       (class E)
-        6   desktop    the shell you live in, perf budget         (class F)
-      ↑ number + Enter · Enter = app · the class letter works too (A-F)
-
-  ✔ 2. class            A — shipped-software
-
-      the forge contract — the identity this repo commits with (CM-01)
-
-
-  ✔ 3. branch/email   main · t@t.co
-
-      one real command that must stay green — suggested for a bash suite:
-      bash tests/run-tests.sh
-
-  ✔ 4. first gate      bash tests/run-tests.sh
-  ✔ 1. platforms    0 detected
-  ✔ 2. class        A (shipped-software)
-  ✔ 3. branch/email main · t@t.co
-  ✔ 4. first gate   bash tests/run-tests.sh
-  ✔ 5. emit         
-  ◆ 6. done         
-  ✔ 5. emit             0 platform(s) · scope project
-
-  running: goblin-install --target /tmp/ptyfinal/repo --class A
-created 50 · updated 0 · unchanged 0 · skipped 0
-
-next:
-  1. cd /tmp/ptyfinal/repo && git add -A && git commit   # the install is a change like any other
-  2. .goblin/bin/goblin-verify   # or add .goblin/bin to PATH
-  3. edit .goblin/goblin.yaml: replace the default gate with your real commands (P8 step 3)
-  4. hermes skills trust /tmp/ptyfinal/repo   # one-time, so the project-tier skills load
-
-automations (optional; neither writes outside this repo, and A-02 has no agent in it):
-  bash /tmp/ptyfinal/repo/.goblin/automations/drift-audit.sh --dry-run        # read the record first
-  cp /tmp/ptyfinal/repo/.goblin/automations/drift-audit.sh ~/.hermes/scripts/
-  hermes cron create "0 9 * * 1" --name "Drift audit - weekly" --no-agent \
-      --script drift-audit.sh --deliver <channel>
-  P13/P14 in docs/FLOWS.md; the whole model in automations/README.md
-      PASS  IN-01  the install record exists and names its version
-      PASS  IN-02  41 installed files hashed
-      PASS  IN-03  the manifest is complete: every rule carries a check or is advisory, inside the enum
-      PASS  IN-04  0 pre-existing file(s) left untouched
-      PASS  HP-01  (test -f HANDOFF.md)
-      PASS  HP-02  (for h in 'START HERE' 'STATE|STATUS' 'GATES?' 'NEXT STEPS|NEXT' 'NOT VERIFIED|UNVERIFIED|NOT PROVEN|UNPROVEN|PENDING[^.]*DEVICE TEST'; do grep -qiE "^#{2,3}[[:space:]]+[^[:alpha:]]*($h)\b" HANDOFF.md || { echo "missing section: $h"; exit 1; }; done)
-      PASS  HP-03  1 gate line(s) inside the Gates section, each with a measured date (anchored on the declared gate name(s): commit todo_ceiling)
-      ADV   HP-04  A stale sentence is corrected in place with a dated parenthetical, never deleted. (advisory)
-      PASS  HP-05  names 3c96403 (ancestor of HEAD 3c96403)
-      PASS  SP-01  (ls ./*-SPEC.md >/dev/null 2>&1)
-      FAIL  SP-02  (test -z "$(git ls-files --others --exclude-standard -- '*-SPEC.md')" -> exit 1)
-      PASS  SP-03  (awk '/^[[:space:]]*[-*][[:space:]]/ && /AC[0-9]*:/ && !/`|==|===|exit|<|>/ {print; bad=1} END{exit bad}' ./*-SPEC.md)
-      PASS  GT-01  2 declared gate(s), each with a cmd
-      PASS  GT-02  commit=0 todo_ceiling=0 · client_js_bytes 0 (ceiling 0) · measured 2026-10-02
-      PASS  GT-03  (test -f .goblin/last-gate-line && [ .goblin/last-gate-line -nt "$(git rev-parse --git-dir)/logs/HEAD" ])
-      PASS  GT-04  ratchet client_js_bytes ceiling 0
-      PASS  GT-05  client_js_bytes 0 (ceiling 0)
-      PASS  HS-01  not an asserting harness (report utility): gate.sh
-1 asserting harness(es), 1 report utility(ies)
-      SKIP  HS-02  no pinned pre-change commit yet (replay.commit empty or unknown) - REPLAY not provable
-      ADV   HS-03  Source probes read text with comments blanked first. (advisory)
-      PASS  CM-01  (test "$(git log -1 --format='%ae')" = "$(grep '^owner_email:' .goblin/goblin.yaml | cut -d' ' -f2)")
-      ADV   CM-02  The commit message was written to a file, not passed with -m. (advisory)
-      FAIL  CM-03  9 dirty entr(y|ies), max_dirty 0
-      PASS  MD-01  (for d in skills manifest bin templates presets .goblin .hermes; do [ -d "$d" ] || continue; grep -rniE '(d[e]epseek|cl[a]ude|g[p]t-[0-9]|gr[o]k|g[e]mini|g[l]m-[0-9]|k[i]mi)[a-z0-9.:_-]*' "$d" && exit 1; done; exit 0)
-      ADV   MD-02  no model mapping configured (/tmp/ptyfinal/home/projects/fleet-model.yaml absent) - advisory
-      ADV   MD-03  Role-pinned fan-out goes through kanban, not a model-less subagent spawn. (advisory)
-      PASS  PG-01  0 review note(s)
-      PASS  PG-02  0 review note(s) classified
-      PASS  PG-03  0 review note(s) patch-id checked
-      ADV   PG-04  Never bypass what the forge enforces. (advisory)
-      PASS  PG-05  1 workflow file(s) checked for a self-skipping required check
-      PASS  PG-06  goblin-gate.yml: runs the verifier, which executes every declared gate
-1 workflow file(s) compared with the 2 declared gate(s)
-      PASS  DS-01  unchanged: .goblin/state.json=missing
-      PASS  DS-02  snapshot .goblin/state.json=missing
-      ADV   DOC-01 A significant change updates the docs that teach it. (advisory)
-      ADV   DOC-02 System-level changes are recorded wherever the project's standard says they live. (advisory)
-      PASS  SK-01  
-      PASS  SK-02  20 installed skill file(s) hashed
-      PASS  SK-03  advisory 10 of ceiling 10 (0 free slots: the next advisory row FAILs)
-      PASS  SK-04  
-      PASS  PT-01  (for d in skills manifest bin templates presets .goblin .hermes; do [ -d "$d" ] || continue; grep -rniE --exclude=goblin.yaml --exclude=installed.json '(h[a]rvey|tech-g[o]blin|/h[o]me/[a-z]+|g[o]blin-ui|op[e]n-door|sup[r]eme|bb[t]ech|c[l]v)' "$d" && exit 1; done; exit 0)
-      PASS  PT-02  declared main, actual main
-      PASS  CL-01  part pr-gate: optional, present
-part review-panel: optional, present
-part tokens: optional, absent
-      PASS  CL-02  archive: false - the full class requirement applies
-      PASS  SC-01  0 tracked secret file(s)
-      PASS  SC-02  the whole secret family is ignored (.env, .env.local, .env.production proved by git)
-      PASS  SC-03  0 client-visible secret-shaped name(s); no build output to scan for clause 2
-      PASS  SC-04  0 cookie write(s) checked; a JS-written cookie is readable by any script - reported, not failed
-      PASS  SC-05  0 write handler(s), 0 waived; 11 dir(s) declared
-      SKIP  SC-06  no package.json - there is no dependency manifest to lock
-      SKIP  SC-07  no audit record yet. Run .goblin/bin/goblin-audit once, deliberately, then commit
-.goblin/audit.tsv: SC-07 reads the record and never the network
-      SKIP  SC-08  no package-lock.json - there is no install-hook surface to enumerate
-      ADV   SC-09  Auth is applied consistently across sibling routes. (advisory)
-      SKIP  PF-01  no perf baseline recorded yet: run `find .next/static dist/assets dist -type f -name '*.js' -exec cat {} + 2>/dev/null | wc -c` on a pinned commit, then write
-perf.baseline_commit, perf.baseline_value, perf.measured and the matching ratchet ceiling
-      PASS  AU-01  2 automation producer(s) scanned, none opens with a network or forge verb
-      SKIP  AU-02  no reports/*/report.yaml - nothing to dedup
-      SKIP  AU-03  no reports/ - no reporter run in this repo to audit
-      PASS  AU-04  
-      PASS  BN-00  8 ban(s), each with an enforcement row and a named replacement
-      SKIP  BN-01  No `any` in application TypeScript. (no matching files: src) 
-      SKIP  BN-02  No `@ts-ignore` / `@ts-expect-error` suppressions. (no matching files: src) 
-      SKIP  BN-03  No direct network call from a component. (not enabled in bans: - add BN-03 to .goblin/goblin.yaml to turn it on) 
-      SKIP  BN-05  No import across a declared layer boundary. (no matching files: src) 
-      SKIP  BN-06  No renderer with Node access (`nodeIntegration: true`). (not enabled in bans: - add BN-06 to .goblin/goblin.yaml to turn it on) 
-      SKIP  BN-07  No renderer with context isolation or the process sandbox turned off. (not enabled in bans: - add BN-07 to .goblin/goblin.yaml to turn it on) 
-      SKIP  BN-08  No dangerous webPreferences. (not enabled in bans: - add BN-08 to .goblin/goblin.yaml to turn it on) 
-      SKIP  BN-09  No synchronous IPC and no `@electron/remote`. (not enabled in bans: - add BN-09 to .goblin/goblin.yaml to turn it on) 
-      SKIP  FM-01  feature_map: is empty - no map is declared, so there is nothing to index
-      SKIP  FM-02  feature_map: is empty - no map is declared, so there are no entry paths to resolve
-      SKIP  VA-01  verify_doctor: is empty - no doctor is declared, so "the generated skill was executed once" is not provable here
-      SKIP  JG-01  no loop record in this repo - no judge verdict to check
-      ADV   JG-02  no model mapping configured (/tmp/ptyfinal/home/projects/fleet-model.yaml absent) - advisory
-remedy: add a `judge:` entry beside the code lane in the file declared as models_file: in /tmp/ptyfinal/repo/.goblin/goblin.yaml
-      ADV   JG-03  A judge lane that has never returned a non-`done` verdict is escalated. (advisory)
-      SKIP  LP-01  no loop has run in this repo
-      SKIP  LP-02  no loop has run in this repo
-      SKIP  LP-03  no loop has run in this repo
-      SKIP  LP-04  no loop has run in this repo
-      SKIP  LP-05  no loop has run in this repo
-      SKIP  RC-01  reference_manifest: is empty - no reference corpus is declared, so there is nothing for a build to match against
-      SKIP  RC-02  reference_manifest: is empty - there is no manifest to shape-check (RC-01 skips for the same reason)
-      SKIP  RC-03  no manifests/ directory - this is not a lab repo with a reference corpus, so there are no tracked bytes to check
-      SKIP  RC-04  no manifests/*.sha256 - no acquisition record is declared, so there is none to read
-      41 passed, 2 failed, 11 advisory, 28 skipped
-      of those 11 advisory: the matrix labels 10 row(s) advisory; the difference is the non-advisory row(s) reporting ADV by design (an unresolved lane) and any labelled row skipped by an opt-out
-      cannot see: whether a check in the harness dir tests the right path rather than
-      merely passing; whether the forge is bound by the workflow CL-01 found; whether a human
-      read the diff;
-      whether the model mapping names a family that actually differs (MD-02 reports it
-      and cannot change it); and whether .goblin/installed.json — the record every drift
-      check trusts — was itself rewritten. It is not signed, so one edit to it (with the
-      matching edit to the file it protects) defeats IN-02, SK-02 and HS-01 at once
-      (docs/LIMITS.md #18). The ban lane carries the same blind spot and two of its own:
-      the ban table is a manifest file under the same unsigned record, so a defanged ban
-      passes BN-00 (docs/LIMITS.md #28); a ban probe is a TEXT probe with no AST, so a
-      `Record<string, any>` is missed and a `: any` inside a string is reported
-      (docs/LIMITS.md #27); and no check here can reach a ban IN CONTEXT — the row proves
-      the forbidden path fails mechanically, never that the ban reached the agent that
-      wrote the line. The judge/loop lane adds its own: every JG-/LP- row reads a RECORD, so
-      it proves a handle, a pin, a budget and a pointer exist — never that the loop made
-      progress (a changed pointer is a proxy, docs/LIMITS.md #33), never which lane returned
-      a verdict, and never that the predicate was the right one or was really run. The CI lane
-      adds its own: PG-05 and PG-06 read a workflow's TEXT, so PG-05 sees a job whose gate step is
-      conditional and cannot see branch protection, the required-check list, or a forge that never
-      ran the job at all, and PG-06 proves a declared gate is INVOKED in a file under
-      .github/workflows/ — never that the forge marks that job required, never that it is the job
-      the forge waits on, and never that the workflow can fail (that is PG-05). A required check
-      that reports Success after skipping its gate is a green light for a commit whose gate never
-      ran (docs/CI.md). The reference-corpus lane adds its own: RC-01 matches EXACT sha256 only,
-      so a resized, recoloured or re-encoded reference asset, or copied text inside a shipped
-      string, passes it unseen; RC-02 proves the manifest is well-shaped, never that its entries
-      are the right hashes (as strong as tamper hashing, and installed.json is unsigned); RC-03
-      reads the tracked tree and cannot see a payload renamed and re-encoded; and RC-04 proves an
-      acquisition record EXISTS, never that the number beside it came from the store (HP-03's
-      defect, one artifact over). No row here reaches a reference asset in CONTEXT either.
-      engine: mode=vendored cli_sha256=2d37cf1c9f38a582ad60f3f75d2fcd53d10b743905dc3274eab6511c5c5ea008 enforcement_tsv_sha256=fd474c268b0852587c632910c503144fbcfe5e211ed2182902949a79fc5282b1
-
-  gob verify: 41 passed, 2 failed, 28 skipped · exit 1
-
-  next:
-    1. the 28 skipped checks ARE your checklist — gob verify names each one
-    2. replace the placeholder gate in .goblin/goblin.yaml with your real commands (P8 step 3)
-    3. not emitted here: gob emit --platform <p> --scope global
-    4. hermes skills trust /tmp/ptyfinal/repo   # one-time, so the project-tier skills load
-
-  ▙ the goblin sees you. the gate is RED — start there.
-
-Script done on 2026-10-02 00:53:50+07:00 [COMMAND_EXIT_CODE="0"]