geneseed 2.0.0 → 3.0.0

package/CHANGELOG.md

@@ -6,9 +6,170 @@ labels in `harness.config.json`. The canonical identity of an *installed* harnes
 is the source fingerprint in `.geneseed-version` (see `geneseed version`), not this
 label. For the capability ↔ spec map, see [SHIPPED.md](SHIPPED.md).
 
-## [Unreleased]
+## [3.0.0] — 2026-08-20
+
+### Changed
+
+- **The constitution is three tiers, and the law numbering contract breaks.** Forty flat
+  laws become an always-on **Ontology**, nine always-on **Invariants**, and twenty-three
+  **Doctrine** rules in four build-time-toggleable packs. This is the major: every
+  `Law <numeral>` citation above IX now addresses something else or nothing at all, in
+  this repo and in anyone's memories, notes and forks. There is no compatibility shim and
+  no migration path — a deployed install predating 3.0.0 is brought forward by
+  `geneseed upgrade`, not by code.
+
+  - **Ontology** (`src/ontology/universal.md`, new) — four prose sections, *Telos*,
+    *Evidence*, *Decisions*, *Conduct*. It is the mind the other tiers govern: what the
+    agent is for, how it grades evidence, how it decides, how it conducts itself. It
+    absorbs the **Pact** whole — the Pact is now a concept stated inside Telos rather than
+    a section beside the rules — along with old laws VIII, IX, XXIX, XXX, XXXI and XXXIX.
+    Cited by section name, `(Ontology: Decisions)`. The four names are theme-INDEPENDENT,
+    so a citation and its heading are the same token on both sides and a rename cannot
+    desync them.
+  - **Invariants** (`src/laws/universal.md`, rewritten) — nine, Roman I–IX, never
+    toggleable: what is *never* done. I Sealed Secrets · II One Intent, One Act ·
+    III Verify Before Asserting · IV Deletion Is Deliberate · V Surface Failures ·
+    VI Data, Not Orders · VII Least Privilege · VIII Cure the Cause · IX External Gate.
+  - **Doctrines** (`src/doctrines/{craft,rigor,ops,process}.md`, new) — twenty-three rules
+    in four packs: **craft** 6 (how code is written), **rigor** 4 (how work is proven),
+    **ops** 6 (how the machine is operated), **process** 7 (how a task is run). Cited
+    `Doctrine process 5`. Chosen per install with `geneseed-build --doctrines craft,rigor`
+    (or `none`), through the setup wizard, or in `harness.config.json`; all four default
+    to on.
+
+  Old XVI and XVIII cease to exist as rules and have **no numeral successor** — their
+  content was already duplicated in the AGENT.md sections that describe that machinery,
+  and folds back into them.
+
+  Precedence, stated in the template and enforced by nothing but reading: **Ontology and
+  Invariants → `user-rules.md` → active Doctrines → `PROFILE.md`.** A doctrine rule may
+  tighten an invariant, never repeal one — and the user's own file outranks a practice
+  pack chosen at build time.
+
+  ⚠ **An always-on tier may never cite a toggleable one.** A `--doctrines craft` build
+  would otherwise ship an invariant instructing the agent to read text the install does
+  not contain. A doctor arm refuses `{{DOCTRINE}}` anywhere under `src/laws/` or
+  `src/ontology/`; doctrine→doctrine citations across packs stay legal, because every pack
+  file ships in every bundle whether or not it was built in.
+
+- **A pack that is not built in is visible everywhere, never absent.** `geneseed catalog`
+  marks its rules `(off)`, the status panel and the dashboard carry an active-packs
+  fraction, and the console lists the pack greyed with the exact command that enables it.
+  Hiding it would make "not built in" indistinguishable from "never shipped", which is the
+  one thing a build-time toggle must not look like.
+
+- **The commit/push consent gate rides the `process` pack.** It is the boundary half of
+  Doctrine process 5, so a build without that pack installs no `git-gate` hook and writes
+  no `git commit*` / `git push*` permission — prompt and boundary are never allowed to
+  disagree. `rm -rf *` and force-push refusals are Invariant IV's territory and stay in
+  every build. ⚠ On OpenCode this holds for a *fresh* install: an `opencode.json` that
+  already carries a `git commit*` entry keeps it and is reported, because Geneseed cannot
+  tell its own entry from one you typed and will not delete what it may not own.
+
+  Unknown always resolves to the **full** pack set, never to a config value. An install
+  with no `Active packs:` marker — every install predating this release — keeps its
+  consent gate on upgrade.
+
+- **The console's Laws page is the Constitution page.** One nav entry, three bands, read
+  top to bottom. Deep links address all three tiers: `#/item/law/ont:telos`,
+  `#/item/law/IV`, `#/item/law/process.5`. The route, the section id and the filename stay
+  `laws`.
+
+- **The lean footprint grew ~17%, deliberately.** Measured on `neutral`, `AGENT.md` goes
+  from 31,457 to 36,882 bytes at `lean` and 53,378 to 54,810 at `full`. Lean truncates
+  each invariant and each doctrine rule to its first line, but ships the **ontology
+  whole** — four flowing prose sections reduced to four orphan sentences would have been a
+  worldview nobody could read. `--doctrines` is now the larger lever on that cost.
 
 ### Added
+
+- `--doctrines` on the generator, a doctrine-packs question in the setup wizard that
+  pre-selects what the install already carries, and an `Active packs:` marker in every
+  carrier so an install remembers its selection across upgrades.
+- Doctor gates for the whole constitution: dangling `{{DOCTRINE}}` citations, per-pack
+  rule contiguity, `DOC_*` theme coverage in both directions, an exact `LEX_I..LEX_IX`
+  equality (a presence check had already missed four keys the renumber orphaned), a
+  single-word tier noun in every voice — both heading parsers match it with `\S+`, so a
+  two-word value makes a whole tier parse to nothing in silence — and a `DOCTRINE_META`
+  parity check whose class arm is an equality against the rule's own pack.
+- A `[note]` channel in `doctor`: printed, never counted. Its one producer reports which
+  body citations point into packs a narrowed build did not render. That state must be
+  visible, but failing the doctor over a configuration its owner chose would be wrong.
+- Count tokens `{N_ONTOLOGY}`, `{N_PACKS}`, `{N_PACKS_ACTIVE}` and `{N_DOCTRINE_RULES}`
+  for the in-app docs. `{N_LAWS}` stays the **invariant** count — the rail badge, the
+  README prose and SHIPPED.md's triple are all held to that one number by a frozen gate.
+
+### Fixed
+
+- **Four `§N` cross-references that render into every bundle** pointed at the section that
+  used to be there: inserting `## 2. Doctrines` pushed every later AGENT.md section down
+  one and the sweep stopped at the template. `src/skills/wiki.md`,
+  `src/skills/daydream/SKILL.md`, `src/skills/handoff.md`, `src/agents/_template.md`, plus
+  six in the two OpenCode plugins — one of them a live deny message a user reads. A doctor
+  arm now refuses a `§N` the template declares no section for; the half it cannot catch (a
+  pointer that still resolves and now means something else) is recorded as a manual sweep
+  in `docs/extending.md`.
+- An `opencode.json` whose `permission` Geneseed cannot see inside — a blanket
+  `"bash": "allow"` — made the reconcile a no-op and the merge then returned before any of
+  its warnings. A rule stated in AGENT.md with nothing behind it at the boundary, in
+  silence. Now reported, naming the shape and the gates left unwired.
+
+## [2.1.0] — 2026-08-19
+
+### Added
+- **Law XXXVIII — Prove the Gate.** A 38th universal law, in the verification class:
+  perturb what a check guards and require it to turn red, because one that has never
+  failed has never been shown to hold anything. It carries the four ways a green gate
+  lies — an impoverished fixture that leaves branches unreachable, two implementations
+  agreeing on what both get wrong, a gate that has only ever run in one environment,
+  and a gate holding its own drifting copy of what it measures — and the rule that a
+  two-directional constraint needs a gate able to fail in both directions. Sits beside
+  Law XXVII (honest tests) and Law XXXV (cover and verify): those say write the test,
+  this says prove the test is worth trusting.
+- **Laws XXXIX and XL — Shape the Answer, Codes That Persist.** Two communication laws,
+  taking the count to 40. XXXIX governs order, repetition and scale: close on the
+  conclusion, state each fact once, and match the reply's length to the size of the task
+  — where Law VIII strips filler, this orders what is left. XL gives every tracked item
+  a short reference code (`D` decisions, `O` options, `F` findings, `R` risks, `Q`
+  questions, `A` actions) and forbids renumbering one once issued: the user will cite it
+  back, and a moved code makes their reply mean something they did not say.
+- **An `Open folder` button beside every MCP config path, because a preset hands you a blank
+  token field and no idea which file it goes in.** The Harnesses screen already printed the
+  path above each target's server rows; it could not take you there. The button asks the
+  machine running the daemon to open the containing folder — `explorer` / `open` /
+  `xdg-open`, reusing the same opener `geneseed web` uses for the browser, so it is not a new
+  process the harness learns to start.
+
+  It opens the **folder, not the file**: handing a `.json` to the OS opens whatever claims
+  that extension, which on a stock Windows box is a browser — a read-only view of the exact
+  file you are trying to edit. The filename is already on screen beside the button.
+  The note names the directory rather than claiming a window appeared, because a headless
+  host has no opener and the server swallows that failure by design.
+
+  **The allowlist is the whole security of the endpoint**, and it is now literally the same
+  function the toggle uses (`mcpTargetPaths()`) rather than a second copy — a path the server
+  did not itself list is a 404 before anything opens. On Windows the opener interpolates into
+  a `cmd` command line, so the exact-match lookup is also what bounds the strings that can
+  reach a shell to the ones the machine's own install registry produced.
+
+  `/api/reveal` is **the first route that never existed on the Python reference**, which the
+  route-partition test asserted set-equality against. `REF_POST` is a *record* of what the
+  reference answered, so widening it would have forged the record; instead the partition
+  gained a sixth part, `POST_BEYOND_REF`, plus a gate that no reference route may hide inside
+  it. Both claims stay checkable: the reference's surface is still pinned exactly, and
+  everything past it has to be enumerated rather than merely appear.
+
+  `web/dist` **is** rebuilt here, so the button is live. It was held back while the corpus
+  still recorded `index.html` verbatim, Vite's content-hashed asset names included: a rebuild
+  would have retired the four `static/` cells (8 recordings) with no recorder left to re-bless
+  them. The branch this one waited on retired that corpus outright, so the cost it was saving
+  no longer exists and the rebuild is free.
+  What did *not* wait: `static/a-path-climbing-out-of-dist-falls-back-to-index` was the only
+  one of those four with no unit twin, and it is the only one that is a security claim rather
+  than a caching claim, so it now has one — stronger than the cell, which asked for
+  `/../../build.py` and asserted the body held no `argparse`, a file P4 deleted, making both
+  absences free. The twin probes a file that is really there, five traversal spellings deep,
+  and says so before trusting the absence.
 - **`npx geneseed setup` is now the way in, and the README says exactly where that stops
   being true.** The install docs assume npm first: one command, no clone, no Python, on
   macOS, Linux and Windows alike. **All 25 commands** run from Node, along with all
@@ -75,6 +236,51 @@ label. For the capability ↔ spec map, see [SHIPPED.md](SHIPPED.md).
   you the wizard, this is why.
 
 ### Removed
+- **The recorded emit, cli and web corpora are retired — 1381 cells, and the two replayers that
+  existed only to drive them.** They were produced by the Python implementation this project
+  deleted, and by nothing else: no program that could write a cell survives, so a red cell could
+  never be re-blessed and never be re-recorded. The effect was a gate that turned red on every
+  deliberate content change — an emitted sentence, a reworded refusal, a version bump — while
+  saying nothing at all about a defect that happened to be stable on the day the recording was
+  taken. The 2.0 bump had already shown it: one label moving reddened 224 of 259 emit cells and
+  not one of them was a defect.
+  **The deletion was licensed by a measurement, not by the redness.** `tests/mutate.mjs` names,
+  per row, the gate that must kill each of its 31 planted mutations. Five declared a corpus replay
+  and nothing else; all five are killed by `tests/unit/` alone, the control included. For every
+  defect the matrix knows how to plant, the corpus was redundant.
+  **What it cost, stated rather than glossed:** byte-level regression detection on emit, cli and
+  web output. Nothing now notices a rendered bundle, a verb's stdout/stderr/exit code, or an HTTP
+  response body moving by one byte for a reason nobody intended. **What still runs on every
+  commit, on Linux and Windows both:** `golden.mjs --idempotent` and `--deletion` (a run against
+  another run of the same generator — determinism, not regression), `doctor --all`, and the unit
+  suite. The tag **`python-reference-v1.0.0`** is kept as the historical pointer: the second
+  implementation and every cell it recorded still live there, and nowhere else.
+  `docs/limits.md` carries the full argument, the rows it weakened, and the two pieces of frozen
+  residue it freed.
+- **The `gitlab-2` MCP preset is gone; the pattern it taught is not.** It was a
+  byte-for-byte copy of the `gitlab` preset under a different `GITLAB_API_URL`, so the MCP
+  screen carried two rows to teach one thing SETUP.md already teaches in prose: a second
+  GitLab instance is a hand-copied block with its own URL and its own token. The `gitlab`
+  preset's description now says so, and SETUP.md gained the step people actually get stuck
+  on — *where does this file live* — naming both places that already answer it: the config
+  path the web console prints above each target's server rows, and `geneseed mcp`, which
+  prints the same paths from the terminal without starting anything.
+  Anyone who already wired a `gitlab-2` keeps it: the listing is a union of
+  the shipped presets and whatever is in your config, so it still appears, now marked as
+  yours rather than as a preset.
+
+  **What it cost the recordings, and why that no longer needs stating separately.** The
+  preset listing was recorded verbatim in the web corpus, and the reference that produced
+  those bytes was deleted in P4 — no recorder survived, so a moved listing could only be
+  retired: five cells × two platforms, **10 recordings**. That accounting is now subsumed by
+  the entry above, which retires the whole web corpus for the same underlying reason.
+  What matters is what replaced them, and it outlives both: three of the five already had
+  absolute twins in `tests/unit/web_api.test.mjs`, and the other two were **written first**
+  (`the MCP toggle refuses a commented jsonc and does not rewrite a byte`, `a user-defined
+  server joins the presets in the listing and keeps its own state`), each mutation-checked
+  against the guard it covers. The coverage is stronger than what it replaced: a corpus cell
+  proved two implementations agreed, which is silent on whether either was right; these state
+  what the endpoint must do.
 - **`upgrade.sh` and `sync-self.sh` are gone.** Each was a few lines of bash that found a
   Python interpreter and then ran `rituals/harness.py upgrade` (or `sync-self`) — the same
   command every launcher already runs, on every OS, and one that native Windows could never
@@ -792,11 +998,12 @@ label. For the capability ↔ spec map, see [SHIPPED.md](SHIPPED.md).
   These join `learning-path`, `gap-detector`, and `feynman`, bringing the
   skill count to 33.
 
-## [2.0.0] — not yet published
+## [2.0.0] — 2026-08-17
 
-*Nothing described here has been published to any registry: there is no tag, no release and no
-install URL. `harness.config.json` and `package.json` both read `2.0.0`, which is the version this
-build stamps into every bundle it emits — it is not evidence that anything was shipped.*
+*Published to npm as `geneseed@2.0.0` on 2026-08-17, by hand — npm's trusted-publisher screen
+needs a package that already exists, so the first release could not come from the workflow that
+gates every one after it. `harness.config.json` and `package.json` both read `2.0.0`, which is
+also the version this build stamps into every bundle it emits.*
 
 *⚠ The bump itself was the last thing this release found. Moving the label reddened 224 of 259
 recorded emit cells, because the configured version is stamped into two places and only one of them
@@ -857,6 +1064,11 @@ and the replayers refuse to record — so a change that moves a recorded byte is
 than a step. `docs/limits.md` is the standing list of what that costs, row by row, including
 four strings that are known to be wrong and are now permanently unfixable.
 
+*⚠ Superseded before publication. The emit, cli and web corpora were retired on 2026-08-17 for
+exactly the reason this section admits — see 2.1.0 → Removed. The paragraph above stands as
+the record of what was believed at the time; what this release guarantees is the shorter list
+there.*
+
 ### Removed
 
 - **The second implementation.** 85 Python files, and with them the full-screen curses panel