geneseed 2.0.0 → 2.1.0

package/CHANGELOG.md

@@ -6,9 +6,62 @@ labels in `harness.config.json`. The canonical identity of an *installed* harnes
 is the source fingerprint in `.geneseed-version` (see `geneseed version`), not this
 label. For the capability ↔ spec map, see [SHIPPED.md](SHIPPED.md).
 
-## [Unreleased]
+## [2.1.0] — 2026-08-19
 
 ### Added
+- **Law XXXVIII — Prove the Gate.** A 38th universal law, in the verification class:
+  perturb what a check guards and require it to turn red, because one that has never
+  failed has never been shown to hold anything. It carries the four ways a green gate
+  lies — an impoverished fixture that leaves branches unreachable, two implementations
+  agreeing on what both get wrong, a gate that has only ever run in one environment,
+  and a gate holding its own drifting copy of what it measures — and the rule that a
+  two-directional constraint needs a gate able to fail in both directions. Sits beside
+  Law XXVII (honest tests) and Law XXXV (cover and verify): those say write the test,
+  this says prove the test is worth trusting.
+- **Laws XXXIX and XL — Shape the Answer, Codes That Persist.** Two communication laws,
+  taking the count to 40. XXXIX governs order, repetition and scale: close on the
+  conclusion, state each fact once, and match the reply's length to the size of the task
+  — where Law VIII strips filler, this orders what is left. XL gives every tracked item
+  a short reference code (`D` decisions, `O` options, `F` findings, `R` risks, `Q`
+  questions, `A` actions) and forbids renumbering one once issued: the user will cite it
+  back, and a moved code makes their reply mean something they did not say.
+- **An `Open folder` button beside every MCP config path, because a preset hands you a blank
+  token field and no idea which file it goes in.** The Harnesses screen already printed the
+  path above each target's server rows; it could not take you there. The button asks the
+  machine running the daemon to open the containing folder — `explorer` / `open` /
+  `xdg-open`, reusing the same opener `geneseed web` uses for the browser, so it is not a new
+  process the harness learns to start.
+
+  It opens the **folder, not the file**: handing a `.json` to the OS opens whatever claims
+  that extension, which on a stock Windows box is a browser — a read-only view of the exact
+  file you are trying to edit. The filename is already on screen beside the button.
+  The note names the directory rather than claiming a window appeared, because a headless
+  host has no opener and the server swallows that failure by design.
+
+  **The allowlist is the whole security of the endpoint**, and it is now literally the same
+  function the toggle uses (`mcpTargetPaths()`) rather than a second copy — a path the server
+  did not itself list is a 404 before anything opens. On Windows the opener interpolates into
+  a `cmd` command line, so the exact-match lookup is also what bounds the strings that can
+  reach a shell to the ones the machine's own install registry produced.
+
+  `/api/reveal` is **the first route that never existed on the Python reference**, which the
+  route-partition test asserted set-equality against. `REF_POST` is a *record* of what the
+  reference answered, so widening it would have forged the record; instead the partition
+  gained a sixth part, `POST_BEYOND_REF`, plus a gate that no reference route may hide inside
+  it. Both claims stay checkable: the reference's surface is still pinned exactly, and
+  everything past it has to be enumerated rather than merely appear.
+
+  `web/dist` **is** rebuilt here, so the button is live. It was held back while the corpus
+  still recorded `index.html` verbatim, Vite's content-hashed asset names included: a rebuild
+  would have retired the four `static/` cells (8 recordings) with no recorder left to re-bless
+  them. The branch this one waited on retired that corpus outright, so the cost it was saving
+  no longer exists and the rebuild is free.
+  What did *not* wait: `static/a-path-climbing-out-of-dist-falls-back-to-index` was the only
+  one of those four with no unit twin, and it is the only one that is a security claim rather
+  than a caching claim, so it now has one — stronger than the cell, which asked for
+  `/../../build.py` and asserted the body held no `argparse`, a file P4 deleted, making both
+  absences free. The twin probes a file that is really there, five traversal spellings deep,
+  and says so before trusting the absence.
 - **`npx geneseed setup` is now the way in, and the README says exactly where that stops
   being true.** The install docs assume npm first: one command, no clone, no Python, on
   macOS, Linux and Windows alike. **All 25 commands** run from Node, along with all
@@ -75,6 +128,51 @@ label. For the capability ↔ spec map, see [SHIPPED.md](SHIPPED.md).
   you the wizard, this is why.
 
 ### Removed
+- **The recorded emit, cli and web corpora are retired — 1381 cells, and the two replayers that
+  existed only to drive them.** They were produced by the Python implementation this project
+  deleted, and by nothing else: no program that could write a cell survives, so a red cell could
+  never be re-blessed and never be re-recorded. The effect was a gate that turned red on every
+  deliberate content change — an emitted sentence, a reworded refusal, a version bump — while
+  saying nothing at all about a defect that happened to be stable on the day the recording was
+  taken. The 2.0 bump had already shown it: one label moving reddened 224 of 259 emit cells and
+  not one of them was a defect.
+  **The deletion was licensed by a measurement, not by the redness.** `tests/mutate.mjs` names,
+  per row, the gate that must kill each of its 31 planted mutations. Five declared a corpus replay
+  and nothing else; all five are killed by `tests/unit/` alone, the control included. For every
+  defect the matrix knows how to plant, the corpus was redundant.
+  **What it cost, stated rather than glossed:** byte-level regression detection on emit, cli and
+  web output. Nothing now notices a rendered bundle, a verb's stdout/stderr/exit code, or an HTTP
+  response body moving by one byte for a reason nobody intended. **What still runs on every
+  commit, on Linux and Windows both:** `golden.mjs --idempotent` and `--deletion` (a run against
+  another run of the same generator — determinism, not regression), `doctor --all`, and the unit
+  suite. The tag **`python-reference-v1.0.0`** is kept as the historical pointer: the second
+  implementation and every cell it recorded still live there, and nowhere else.
+  `docs/limits.md` carries the full argument, the rows it weakened, and the two pieces of frozen
+  residue it freed.
+- **The `gitlab-2` MCP preset is gone; the pattern it taught is not.** It was a
+  byte-for-byte copy of the `gitlab` preset under a different `GITLAB_API_URL`, so the MCP
+  screen carried two rows to teach one thing SETUP.md already teaches in prose: a second
+  GitLab instance is a hand-copied block with its own URL and its own token. The `gitlab`
+  preset's description now says so, and SETUP.md gained the step people actually get stuck
+  on — *where does this file live* — naming both places that already answer it: the config
+  path the web console prints above each target's server rows, and `geneseed mcp`, which
+  prints the same paths from the terminal without starting anything.
+  Anyone who already wired a `gitlab-2` keeps it: the listing is a union of
+  the shipped presets and whatever is in your config, so it still appears, now marked as
+  yours rather than as a preset.
+
+  **What it cost the recordings, and why that no longer needs stating separately.** The
+  preset listing was recorded verbatim in the web corpus, and the reference that produced
+  those bytes was deleted in P4 — no recorder survived, so a moved listing could only be
+  retired: five cells × two platforms, **10 recordings**. That accounting is now subsumed by
+  the entry above, which retires the whole web corpus for the same underlying reason.
+  What matters is what replaced them, and it outlives both: three of the five already had
+  absolute twins in `tests/unit/web_api.test.mjs`, and the other two were **written first**
+  (`the MCP toggle refuses a commented jsonc and does not rewrite a byte`, `a user-defined
+  server joins the presets in the listing and keeps its own state`), each mutation-checked
+  against the guard it covers. The coverage is stronger than what it replaced: a corpus cell
+  proved two implementations agreed, which is silent on whether either was right; these state
+  what the endpoint must do.
 - **`upgrade.sh` and `sync-self.sh` are gone.** Each was a few lines of bash that found a
   Python interpreter and then ran `rituals/harness.py upgrade` (or `sync-self`) — the same
   command every launcher already runs, on every OS, and one that native Windows could never
@@ -792,11 +890,12 @@ label. For the capability ↔ spec map, see [SHIPPED.md](SHIPPED.md).
   These join `learning-path`, `gap-detector`, and `feynman`, bringing the
   skill count to 33.
 
-## [2.0.0] — not yet published
+## [2.0.0] — 2026-08-17
 
-*Nothing described here has been published to any registry: there is no tag, no release and no
-install URL. `harness.config.json` and `package.json` both read `2.0.0`, which is the version this
-build stamps into every bundle it emits — it is not evidence that anything was shipped.*
+*Published to npm as `geneseed@2.0.0` on 2026-08-17, by hand — npm's trusted-publisher screen
+needs a package that already exists, so the first release could not come from the workflow that
+gates every one after it. `harness.config.json` and `package.json` both read `2.0.0`, which is
+also the version this build stamps into every bundle it emits.*
 
 *⚠ The bump itself was the last thing this release found. Moving the label reddened 224 of 259
 recorded emit cells, because the configured version is stamped into two places and only one of them
@@ -857,6 +956,11 @@ and the replayers refuse to record — so a change that moves a recorded byte is
 than a step. `docs/limits.md` is the standing list of what that costs, row by row, including
 four strings that are known to be wrong and are now permanently unfixable.
 
+*⚠ Superseded before publication. The emit, cli and web corpora were retired on 2026-08-17 for
+exactly the reason this section admits — see 2.1.0 → Removed. The paragraph above stands as
+the record of what was believed at the time; what this release guarantees is the shorter list
+there.*
+
 ### Removed
 
 - **The second implementation.** 85 Python files, and with them the full-screen curses panel