geneseed 2.0.0 → 3.0.0

package/js/generate.mjs

@@ -33,11 +33,11 @@ import { existsSync, mkdirSync, statSync } from 'node:fs';
 import path from 'node:path';
 
 import { main as driverMain } from '../bin/geneseed.mjs';
-import { makeCfg } from './checkout.mjs';
+import { makeCfg, PACK_ORDER } from './checkout.mjs';
 import { opencodeConfigDir, pyResolve } from './hosts.mjs';
 import {
-  EMIT_HOST_SCOPE, defaultMode, defaultPosture, defaultTheme, footprintOfDir, installState,
-  installTargets, modeOfDir, postureOfDir, readMaybe, themeOfDir,
+  EMIT_HOST_SCOPE, defaultMode, defaultPosture, defaultTheme, doctrinesForBuild,
+  footprintOfDir, installState, installTargets, modeOfDir, postureOfDir, readMaybe, themeOfDir,
 } from './installs.mjs';
 import { colorThemeFiles, colorThemeJson, PALETTE_ROLES } from './opencode.mjs';
 import { renderAll } from './render.mjs';
@@ -101,9 +101,28 @@ export function cmdBuild(args) {
  * because omitting it when it matched the generator's default silently coupled the answer to
  * whatever that default happened to be — the moment the default moved, picking the old one
  * produced the new one. `posture` and `mode` still elide at theirs, and neither has moved.
+ *
+ * ⚠ `doctrines` DOES NOT ELIDE, AND THAT IS THE SAFETY DECISION, NOT A STYLE ONE. It used to
+ * elide on the full set, by analogy with posture and mode — but those two compare against a
+ * FROZEN LITERAL (`'peer'`, `'direct'`), while the default a missing `--doctrines` actually
+ * lands on is `configDefaults()`, which reads `harness.config.json`. With `{"doctrines":
+ * ["craft"]}` in that file, an install carrying all four packs re-emitted by `upgrade` was
+ * silently narrowed to one — and the narrowing takes the commit/push consent gate off an
+ * install whose owner never asked for that. Same trap as `footprint`, one axis over, with a
+ * boundary behind it. A caller that knows the selection now always says so.
+ *
+ * `allPacks` survives the elision's removal because it is still what CANONICALISES the value:
+ * the flag is emitted in the checkout's pack order, not the order handed in, and this function
+ * is pure and has no discovery of its own.
+ *
+ * Two states: `null` means "the caller expressed no opinion" and emits no flag at all, so the
+ * generator falls back to `harness.config.json` — the only route left to that fallback, and it
+ * is reached only where nothing was read back off an install; `[]` is a deliberate empty
+ * selection and emits `--doctrines none`, which is the spelling the driver's `parseDoctrines`
+ * accepts (an empty `--doctrines ` is a usage error there, so it can never be produced here).
  */
 export function setupBuildArgs(theme, emit, out = null, root = null, footprint = 'lean',
-  posture = 'peer', mode = 'direct') {
+  posture = 'peer', mode = 'direct', doctrines = null, allPacks = PACK_ORDER) {
   const argv = ['--theme', theme, '--emit', emit];
   if (!['opencode-global', 'claude-global', 'bob-global', 'copilot-global'].includes(emit)) {
     if (out) argv.push('--out', out);
@@ -112,6 +131,13 @@ export function setupBuildArgs(theme, emit, out = null, root = null, footprint =
   if (footprint) argv.push('--footprint', footprint);
   if (posture && posture !== 'peer') argv.push('--posture', posture);
   if (mode && mode !== 'direct') argv.push('--mode', mode);
+  if (Array.isArray(doctrines)) {
+    // Emitted in `allPacks` order, not the order handed in: a caller may legitimately pass an
+    // unsorted list, and the flag has to be canonical for the same reason the driver
+    // re-normalises on parse — the `Active packs:` marker is compared against itself.
+    const picked = allPacks.filter((p) => doctrines.includes(p));
+    argv.push('--doctrines', picked.length ? picked.join(',') : 'none');
+  }
   return argv;
 }
 
@@ -167,7 +193,15 @@ export function cmdRebuildAll() {
     const posture = postureOfDir(root) || defaultPosture();
     const mode = modeOfDir(root) || defaultMode();
     const out = scope === 'global' ? null : root;
-    const argv = setupBuildArgs(theme, emit, out, out, footprint, posture, mode);
+    // SIX values now, not five. A rebuild that defaulted the pack selection would re-emit an
+    // install into a constitution its owner did not choose — and in one direction that is not
+    // merely surprising: dropping the process pack takes the commit/push consent RULES out of
+    // AGENT.md while `claudeHookGroups` keeps the gate wired, or the reverse. ⚠ AND THE
+    // FALLBACK IS NOT `harness.config.json`: a pre-migration carrier has no marker, and
+    // resolving that silence out of a machine-wide config narrows every such install on its
+    // first upgrade. `doctrinesForBuild` resolves unknown to ALL packs — see its docblock.
+    const doctrines = doctrinesForBuild(root);
+    const argv = setupBuildArgs(theme, emit, out, out, footprint, posture, mode, doctrines);
     const label = `${host}:${scope} (${root})`;
     pyPrint(`[rebuild-all] ${label}: theme=${theme} emit=${emit} footprint=${footprint} `
       + `posture=${posture} mode=${mode}\n`);

package/js/hooks.mjs

@@ -214,7 +214,7 @@ const out = pyPrint;
 const err = pyPrintErr;
 
 // ======================================================================================
-// context — project-context discovery (Rule XVIII)
+// context — project-context discovery
 // ======================================================================================
 
 // Kept in step with adapters/opencode/plugins/geneseed-context.js, same as the Python.
@@ -494,7 +494,7 @@ export function cmdContext(args) {
   }
 
   const lines = [
-    `=== PROJECT CONTEXT \u2014 binding for this repo per Rule XVIII (via ${source}) ===`,
+    `=== PROJECT CONTEXT \u2014 binding for this repo (via ${source}) ===`,
     '',
   ];
   for (const entry of eager) {
@@ -525,7 +525,7 @@ export function cmdContext(args) {
 }
 
 // ======================================================================================
-// git-gate — Law XX's tool-boundary backstop
+// git-gate — Doctrine process 5's tool-boundary backstop
 // ======================================================================================
 
 // A `git` verb ANYWHERE in the command trips the gate, including the chained
@@ -555,12 +555,13 @@ export function cmdGitGate(args) {
     return 0;
   }
   if (typeof command !== 'string' || !GIT_GATE_RE.test(command)) return 0;
-  out(askDecision('Geneseed Law XX \u2014 every git commit/push needs explicit approval'));
+  out(askDecision('Geneseed Doctrine process 5 \u2014 every git commit/push needs explicit '
+    + 'approval'));
   return 0;
 }
 
 // ======================================================================================
-// rule-gate — Law VI's tool-boundary backstop
+// rule-gate — Doctrine process 1's tool-boundary backstop
 // ======================================================================================
 
 /**
@@ -604,8 +605,8 @@ export function cmdRuleGate(args) {
   if (typeof p !== 'string' || !p) return 0;
   const target = ruleGateTarget(p, args.root);
   if (!target) return 0;
-  out(askDecision(`Geneseed Law VI \u2014 writing to ${target}: a standing rule, or a fact to `
-    + "remember? That choice is the user's. Run the rule skill first."));
+  out(askDecision(`Geneseed Doctrine process 1 \u2014 writing to ${target}: a standing rule, or a `
+    + "fact to remember? That choice is the user's. Run the rule skill first."));
   return 0;
 }
 

package/js/installs.mjs

@@ -35,7 +35,7 @@
 import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
 import path from 'node:path';
 
-import { CONFIG, THEMES, discoverNames } from './checkout.mjs';
+import { CONFIG, PACK_ORDER, THEMES, discoverNames } from './checkout.mjs';
 import { GLOBAL_MANIFEST, HOSTS, pyResolve } from './hosts.mjs';
 import { registryRoots } from './registry.mjs';
 import { comparePaths, pyPrintErr, pyRepr, readText } from './lib/fs.mjs';
@@ -91,6 +91,17 @@ export const defaultTheme = () => configuredDefault('theme', 'neutral');
 export const defaultPosture = () => configuredDefault('posture', 'peer');
 export const defaultMode = () => configuredDefault('mode', 'direct');
 
+// There is deliberately no `defaultDoctrines()` beside the three above, and its absence is
+// the invariant. `theme`, `posture` and `mode` may fall back to `harness.config.json` when an
+// install does not say, because the worst a wrong answer does there is cosmetic. The pack
+// selection is not like them: it decides whether the commit/push consent gate is wired, so
+// resolving "this install does not say" out of a MACHINE-WIDE config file narrows every
+// pre-2.3 install on its first upgrade — `{"doctrines":["craft"]}` and the gate is gone from
+// carriers that never asked. Unknown resolves to ALL packs; see `doctrinesForBuild` below.
+// The config value keeps exactly one legitimate reader: `configDefaults()` in
+// `bin/geneseed.mjs`, which answers `geneseed build` — the case where there is no install to
+// ask in the first place.
+
 // ---- theme, footprint, posture, mode, read back off a deployed tree -----------------------
 
 /**
@@ -159,7 +170,8 @@ const FOOTPRINTS = ['lean', 'full'];
  *
  * `status` reads no footprint row at all; the WARN is why this function is ported there, and
  * `diff` and `rebuild-all` read the RETURN value as well. An unrecognised marker is reported
- * rather than swallowed (Rule VII), and a compared stderr is what makes that observable —
+ * rather than swallowed (Rule V, *Surface Failures* — VII before the three-tier renumber, and
+ * VII now names *Least Privilege*), and a compared stderr is what makes that observable —
  * `status/a-bogus-footprint-marker-warns-on-stderr` is the cell.
  */
 export function footprintOfDir(d) {
@@ -208,6 +220,76 @@ function leadOfDir(d, names) {
 export const postureOfDir = (d) => leadOfDir(d, discoverNames('postures', 'peer'));
 export const modeOfDir = (d) => leadOfDir(d, discoverNames('modes', 'direct'));
 
+/** The `Active packs:` marker line the template emits, in one of the five carriers. */
+const ACTIVE_PACKS_RE = /^Active packs:[ \t]*(.+?)[ \t]*$/m;
+
+/**
+ * The doctrine packs a DEPLOYED install carries — the third register read back off disk,
+ * beside `postureOfDir` and `modeOfDir`, and the first that is a SET.
+ *
+ * MARKERED IN PROSE, like posture and mode and unlike theme/footprint: `src/AGENT.md.tmpl`
+ * writes a literal `Active packs: <list>` line under the doctrines section, so no extra dotfile
+ * has to survive a copy. The label is NOT token-substituted, so a themed bundle still answers.
+ *
+ * ⚠ THREE RETURN STATES, AND THE NULL IS THE SAFETY ONE.
+ *   - `null` — no marker in any carrier. That is a pre-migration install, or a carrier that
+ *     never had one, and it means "unknown", NOT "no packs". Every consumer must read it as
+ *     the process pack being ACTIVE, so the commit/push consent gate stays installed. Write
+ *     `doctrinesOfDir(root)` into an explicit `=== null` / `??` test — never
+ *     `doctrinesOfDir(root)?.includes('process')`, which is falsy on `null` and would strip
+ *     the gate from every existing install on its next upgrade.
+ *   - `[]` — the marker is present and reads `none`. A deliberate empty selection (invariants
+ *     and ontology only) and a real configuration: the gate comes OFF.
+ *   - a list — the packs named, re-ordered through `PACK_ORDER`, because this value is
+ *     compared against a marker the build writes in that order.
+ *
+ * A marker line this checkout cannot read WHOLE falls back to `null` rather than to whatever
+ * part of it did parse, for the same reason: a corrupt line is unknown, and unknown fails
+ * closed. ⚠ "Whole" is the strict word and it is what the first cut of this got wrong. The
+ * regex is single-line, so a marker a wrapper had folded — `Active packs: craft, rigor,\nops,
+ * process` — matched its first half, every name in that half was known, and the function
+ * answered the NARROWED set `['craft','rigor']` with no complaint. That is fail-OPEN against
+ * this docblock's own promise: the process pack disappears from an install that has it, and
+ * the gate goes with it. So every comma-separated field must be non-empty AND a pack this
+ * checkout ships; one that is not condemns the whole line to `null`. A trailing comma is
+ * exactly the empty field a fold leaves behind, which is what makes this catch it.
+ */
+export function doctrinesOfDir(d) {
+  for (const carrier of CARRIERS) {
+    const text = readMaybe(path.join(d, carrier));
+    if (text === null) continue;
+    const m = ACTIVE_PACKS_RE.exec(text);
+    if (!m) continue;
+    if (m[1] === 'none') return [];
+    const named = m[1].split(',').map((s) => s.trim());
+    if (!named.every((n) => PACK_ORDER.includes(n))) return null;
+    return PACK_ORDER.filter((p) => named.includes(p));
+  }
+  return null;
+}
+
+/**
+ * `doctrinesOfDir` with the `null` RESOLVED — the one spelling every build-side consumer uses.
+ *
+ * ⚠ UNKNOWN RESOLVES TO ALL PACKS, NEVER TO A CONFIG VALUE. `doctrinesOfDir`'s docblock puts
+ * the rule on the reader; this function is what makes it true of the readers, because the
+ * previous shape (`doctrinesOfDir(root) ?? defaultDoctrines()`) left every consumer free to
+ * pick its own fallback and all five of them picked `harness.config.json`. With
+ * `{"doctrines":["craft"]}` in that file, an `upgrade`/`rebuild-all`/`migrate` re-emitted every
+ * pre-2.3 install at ONE pack and took the commit/push consent gate off installs whose owners
+ * had never been asked — the exact outcome the fail-closed reading exists to prevent, and it
+ * got WIDER when the reader was hardened, because more inputs now answer `null`.
+ *
+ * A config value is a legitimate default only where there is NO INSTALL TO ASK: a fresh
+ * `geneseed build`, which `configDefaults()` in `bin/geneseed.mjs` answers. Anything holding a
+ * directory has an install to ask, so it calls this and never the config.
+ *
+ * `[]` still passes through untouched — a marker that reads `none` is an answer, not a silence.
+ */
+export function doctrinesForBuild(d) {
+  return doctrinesOfDir(d) ?? [...PACK_ORDER];
+}
+
 // ---- what host a deployed dir belongs to (`_harness_mcp`) ---------------------------------
 
 /** `_harness_mcp._claude_read_manifest`. */
@@ -333,7 +415,7 @@ export function installTargets() {
 // ---- what this machine installed (`_harness_setup._installed_defaults`) --------------------
 
 /**
- * `_harness_setup._installed_defaults` — all five keys, as of P5i.
+ * `_harness_setup._installed_defaults` — all six keys.
  *
  * It carried only `theme` and `emit` for four phases because those are the two `status`
  * prints and the two `doctor` reads, and the port's keep-vs-delete rule is "part of an
@@ -342,9 +424,20 @@ export function installTargets() {
  * `inst.posture` / `inst.mode` / `inst.footprint`, so a three-key answer would have silently
  * pre-selected the CONFIGURED default over the DEPLOYED one on three of its five questions.
  * Nothing in `status` or `doctor` moves: both read the keys they already read.
+ *
+ * `doctrines` joined last, for the same reason and one phase later: the wizard's pack question
+ * shipped before the marker reader existed, so it defaulted to `all` for everyone and re-asked
+ * an installer who had already narrowed their selection. ⚠ THIS KEY IS THE ONE WITH THREE
+ * STATES, and the `=== null` tests below preserve all three: `null` is "no carrier on this
+ * machine said", `[]` is a carrier that said `none`, a list is a carrier that named packs.
+ * Only a WIZARD may read it — it is a pre-selection shown to a human who then answers. No
+ * build-side consumer resolves a pack set from here; that is `doctrinesForBuild(dir)`, which
+ * asks one named install rather than whichever candidate this walk happens to reach first.
  */
 export function installedDefaults() {
-  const found = { theme: null, posture: null, mode: null, emit: null, footprint: null };
+  const found = {
+    theme: null, posture: null, mode: null, emit: null, footprint: null, doctrines: null,
+  };
   const candidates = [];
   for (const { host, configDir } of HOSTS) {
     try { candidates.push([configDir(), `${host}-global`]); } catch { /* as the Python */ }
@@ -373,6 +466,10 @@ export function installedDefaults() {
     if (found.footprint === null && isFile(path.join(base, '.geneseed-footprint'))) {
       found.footprint = footprintOfDir(base);
     }
+    // `doctrinesOfDir` and not `doctrinesForBuild`: the resolved form answers `[...PACK_ORDER]`
+    // for a carrier with no marker, which would end this walk at the FIRST candidate and hide
+    // a later carrier that does say. The null has to survive to the caller here.
+    if (found.doctrines === null) found.doctrines = doctrinesOfDir(base);
   }
   return found;
 }

package/js/inventory.mjs

@@ -21,7 +21,7 @@
  */
 import path from 'node:path';
 
-import { ROOT, SRC, makeCfg } from './checkout.mjs';
+import { ROOT, SRC, makeCfg, PACK_ORDER } from './checkout.mjs';
 import { firstBlockquote } from './native.mjs';
 import { renderAll } from './render.mjs';
 import { pyResolve } from './hosts.mjs';
@@ -29,29 +29,59 @@ import { parseJson, readText } from './lib/fs.mjs';
 
 /**
  * `_harness_tui.LAW_HEADING_RE` — a heading in the RENDERED laws file, e.g.
- * `### Rule XVIII — Load the Project Context`.
+ * `### Rule IV — Deletion Is Deliberate`.
  *
  * Not `js/doctor.mjs`'s `LAW_HEADING_RE`, which matches the `{{LAW}}` token in the
  * unrendered source. Two patterns, two inputs, two names in Python as well.
  */
 export const LAW_HEADING_RE = /^###\s+\S+\s+([IVXLCDM]+)\s+[—-]\s+(.+?)\s*$/;
 
+/**
+ * A heading in a RENDERED doctrine pack, e.g. `### Doctrine craft 1 — Automate Repetition`.
+ *
+ * THE TIER NOUN IS THEMED AND THE ADDRESS IS NOT, exactly as the invariants work: `{{LAW}}`
+ * plus a Roman numeral there, `{{DOCTRINE}}` plus `<pack> <n>` here. So `\S+` for the noun —
+ * ⚠ which is why a theme's `DOCTRINE` value must be ONE WORD, and why `doctor` asserts it in
+ * all fourteen. A two-word noun does not error; it silently stops matching, and a pack quietly
+ * parses to zero rules.
+ *
+ * It cannot collide with `LAW_HEADING_RE` in either direction and the reason is case:
+ * `([a-z]+)` refuses `Rule I`'s uppercase numeral, and `([IVXLCDM]+)` refuses a lowercase pack
+ * id. Measured across all fourteen themes — zero cross-matches either way.
+ */
+export const DOCTRINE_HEADING_RE = /^###\s+\S+\s+([a-z]+)\s+(\d+)\s+[—-]\s+(.+?)\s*$/;
+
+/**
+ * A section heading in the RENDERED ontology, e.g. `#### Telos`.
+ *
+ * FOUR HASHES, and that is the whole reason the ontology can share `universal.md`'s basename
+ * with the laws file without either parser seeing the other's headings. The section names come
+ * from `STRUCTURE` rather than from a theme, so the id below is stable across all fourteen
+ * voices and is safe to put in a deep link.
+ */
+export const ONTOLOGY_HEADING_RE = /^####\s+(.+?)\s*$/;
+
+/** The lead line of a pack file — `**Craft** — how code is written.` */
+const PACK_LEAD_RE = /^\*\*(.+?)\*\*\s+[—-]\s+(.+?)\s*$/;
+
 /** `_harness_tui.LAW_CLASS` — each rule's class, keyed by Roman numeral. */
 export const LAW_CLASS = {
-  I: 'security', II: 'process', III: 'verify', IV: 'security', V: 'craft',
-  VI: 'context', VII: 'verify', VIII: 'comms', IX: 'comms', X: 'comms',
-  XI: 'craft', XII: 'craft', XIII: 'craft', XIV: 'process', XV: 'process',
-  XVI: 'context', XVII: 'context', XVIII: 'context', XIX: 'context', XX: 'security',
-  XXI: 'process', XXII: 'security', XXIII: 'security', XXIV: 'craft', XXV: 'craft',
-  XXVI: 'craft', XXVII: 'verify', XXVIII: 'process', XXIX: 'comms', XXX: 'comms',
-  XXXI: 'comms', XXXII: 'craft', XXXIII: 'craft', XXXIV: 'verify', XXXV: 'verify',
-  XXXVI: 'security', XXXVII: 'process',
+  I: 'security', II: 'process', III: 'verify', IV: 'security', V: 'verify',
+  VI: 'security', VII: 'security', VIII: 'craft', IX: 'security',
 };
 
 /** `_harness_tui.ENTITY_STATUSES` — the lifecycle statuses `registry.json` may carry. */
 export const ENTITY_STATUSES = ['experimental', 'approved', 'deprecated'];
 
-/** `_harness_tui.LAW_CLASSES` — the six governance classes a law may carry. */
+/**
+ * `_harness_tui.LAW_CLASSES` — the six governance classes a law may carry.
+ *
+ * ⚠ SIX, THOUGH ONLY FOUR ARE IN USE. When the corpus became nine invariants, `context` and
+ * `comms` stopped having a member — that material moved to the ontology and the doctrine packs,
+ * neither of which is classed here. The list stays six because it is the VOCABULARY, not a
+ * census: `doctor` quotes it verbatim in the message a bad class earns, and two recorded cells
+ * in `tests/helpers/matrix/cli.*.json` hold that message byte for byte.
+ */
 export const LAW_CLASSES = ['security', 'process', 'verify', 'craft', 'context', 'comms'];
 
 /** `_harness_tui.SKILL_CLASS` — each skill's category, keyed by file stem. */
@@ -105,6 +135,68 @@ export function parseLaws(text) {
   return laws;
 }
 
+/**
+ * One rendered doctrine pack file split into `{pack, n, title, klass, body}` rows.
+ *
+ * Same accumulator as `parseLaws`, and deliberately so: text before the first heading — the
+ * pack's own lead line — is dropped on the floor because `cur` is still null, and each body is
+ * trimmed at its ends only.
+ *
+ * `klass` IS THE PACK ID, not one of `LAW_CLASSES`. A doctrine rule is grouped by the pack it
+ * belongs to and there is no second taxonomy over it; the six-class chip is the invariants'.
+ * The collision with the class names `craft` and `process` is real and harmless — the two
+ * lists are separate end to end and nothing ever unions them.
+ *
+ * `pack` is read from the HEADING and not from the filename, so a rule filed under the wrong
+ * pack is visible rather than silently renamed by its container. `doctor` is what compares the
+ * two; this function just reports what the text says.
+ */
+export function parseDoctrines(text) {
+  const rules = [];
+  let cur = null;
+  for (const line of text.split('\n')) {
+    const m = DOCTRINE_HEADING_RE.exec(line);
+    if (m) {
+      if (cur) rules.push(cur);
+      cur = { pack: m[1], n: Number(m[2]), title: m[3], klass: m[1], body: '' };
+    } else if (cur !== null) {
+      cur.body += `${line}\n`;
+    }
+  }
+  if (cur) rules.push(cur);
+  for (const rule of rules) rule.body = rule.body.trim();
+  return rules;
+}
+
+/**
+ * The rendered ontology split into `{id, title, body}` sections.
+ *
+ * `id` is the slugified title, and it is an ADDRESS: `#/item/law/ont:telos` is how the console
+ * deep-links a section, so it has to survive a theme change. It does, because the four titles
+ * come from `STRUCTURE` in `js/render.mjs` and not from any theme file — the same reason a
+ * citation can spell itself `({{ONTOLOGY}}: {{ONT_TELOS}})` with a token on both sides.
+ *
+ * The preamble above the first `####` is dropped, as in the two parsers above. It is the
+ * paragraph that states the tier order, and it renders into AGENT.md whole — the catalogue
+ * lists sections, and the preamble is not one.
+ */
+export function parseOntology(text) {
+  const sections = [];
+  let cur = null;
+  for (const line of text.split('\n')) {
+    const m = ONTOLOGY_HEADING_RE.exec(line);
+    if (m) {
+      if (cur) sections.push(cur);
+      cur = { id: m[1].toLowerCase().replace(/\s+/g, '-'), title: m[1], body: '' };
+    } else if (cur !== null) {
+      cur.body += `${line}\n`;
+    }
+  }
+  if (cur) sections.push(cur);
+  for (const s of sections) s.body = s.body.trim();
+  return sections;
+}
+
 /**
  * `_harness_tui.load_registry` — the `entities` map from `registry.json`, or `{}`.
  *
@@ -143,33 +235,71 @@ export function entityStatus(registry, key) {
 }
 
 /**
- * `_harness_tui._tui_inventory` — render-accurate inventory: every agent and skill with
- * its one-line purpose, full rendered spec, source path and lifecycle badge, and every law
- * with its title, body and governance class.
+ * `_harness_tui._tui_inventory` — render-accurate inventory of all three constitutional tiers,
+ * plus every agent and skill with its one-line purpose, rendered spec, source and badge.
+ *
+ * THE WHOLE CATALOGUE, NOT THE BUILT SUBSET. All four pack files ship in every bundle
+ * (`OWNED_SRC_DIRS`), which is what lets a cross-pack citation resolve when its pack is not
+ * built into AGENT.md — and it is also what lets the console show an inactive pack greyed out
+ * with the command that would enable it. So the packs are always all parsed; `doctrines` only
+ * decides which of them carry `active: true`. Passing `null` — the default, and what `catalog`,
+ * `status` and the graph do — means "no install to ask", and every pack reads active, matching
+ * `makeCfg()`'s own default and `doctrinesForBuild`'s resolution of unknown.
+ *
+ * `laws` KEEPS ITS NAME and means the invariants. Renaming it to `invariants` would churn
+ * `status`, `catalog`, `tui`, the web API, its `SECTIONS` id, three test fixtures and two
+ * recorded corpora to say the same thing in a different word.
  */
-export function tuiInventory(themeName) {
+export function tuiInventory(themeName, doctrines = null) {
   const { items } = renderAll(makeCfg(), themeName);
   const registry = loadRegistry();
   const agents = [];
   const skills = [];
   let laws = [];
+  let ontology = [];
+  const packs = new Map();
   for (const { text, src } of items) {
     if (text === null) continue;
     const parts = path.relative(SRC, src).split(path.sep);
-    if (parts.length === 2 && parts[1].endsWith('.md') && !parts[1].startsWith('_')) {
-      const name = parts[1].slice(0, -3);
+    const two = parts.length === 2 && parts[1].endsWith('.md') && !parts[1].startsWith('_');
+    const name = two ? parts[1].slice(0, -3) : null;
+    if (two && (parts[0] === 'agents' || parts[0] === 'skills')) {
       const entry = { name, desc: firstBlockquote(text), body: text,
         source: pyResolve(src), status: entityStatus(registry, `${parts[0]}/${name}`) };
       if (parts[0] === 'agents') agents.push(entry);
-      else if (parts[0] === 'skills') {
+      else {
         entry.klass = has(SKILL_CLASS, name) ? SKILL_CLASS[name] : 'build';
         skills.push(entry);
       }
     }
-    if (parts[parts.length - 1] === 'universal.md') laws = parseLaws(text);
+    // Every `.md` in the dir is read; `PACK_ORDER` below decides which of them is a pack. The
+    // dir also holds a `README.md`, which passes the `_`-scaffold filter, and a second
+    // membership test here would be a second owner of the same rule — one that has to agree
+    // with the one that actually publishes the list.
+    if (two && parts[0] === 'doctrines') {
+      const lead = text.split('\n').map((l) => PACK_LEAD_RE.exec(l)).find(Boolean);
+      packs.set(name, { pack: name, title: lead ? lead[1] : name, desc: lead ? lead[2] : '',
+        source: pyResolve(src), rules: parseDoctrines(text) });
+    }
+    // Scoped to the laws dir, not matched on the basename: `src/ontology/universal.md`
+    // shares the name, sorts after `laws/`, and would clobber the parse with `[]` —
+    // `LAW_HEADING_RE` wants `###` and the ontology uses `####`. Same spelling as the
+    // already-scoped sites at `js/render.mjs`'s `rel === 'laws/universal.md'`.
+    if (parts.join('/') === 'laws/universal.md') laws = parseLaws(text);
+    if (parts.join('/') === 'ontology/universal.md') ontology = parseOntology(text);
   }
   const byName = (a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
   agents.sort(byName);
   skills.sort(byName);
-  return { agents, skills, laws, theme: themeName };
+  // ⚠ `PACK_ORDER` IS THE SINGLE OWNER OF THE SET, and of its order. Filtering the order by
+  // what was found — rather than publishing what was found — is what keeps `README.md` and any
+  // other stray `.md` in that directory out of the catalogue, and it is the same membership
+  // rule `js/render.mjs` refuses the build over, so a fifth pack cannot be silently dropped
+  // here either. Order because `sortedSourceFiles` walks alphabetically, which puts `ops`
+  // second: the narrative order is the reading order, and it is what the marker line, the
+  // wizard and the rendered section all use.
+  const on = Array.isArray(doctrines) ? doctrines : PACK_ORDER;
+  const built = PACK_ORDER.filter((p) => packs.has(p))
+    .map((p) => ({ ...packs.get(p), active: on.includes(p) }));
+  return { agents, skills, laws, ontology, doctrines: built, theme: themeName };
 }

package/js/lib/fs.mjs

@@ -281,10 +281,14 @@ export const normcase = process.platform === 'win32'
  *     flat cmp  : the reverse again
  *
  * Nothing in the emitted tree could see it: `js/render.mjs` sorts a list whose members share
- * a directory depth, and `golden.py` compares CONTENT rather than order. It became visible
+ * a directory depth, and `golden.py` compared CONTENT rather than order. It became visible
  * the first time a full path list was PRINTED \u2014 `geneseed validate -v` \u2014 against a real
  * skills tree that happens to contain both `skills/geneseed/` and `skills/geneseed-code-review/`.
- * `tests/test_maintainer_tools_parity.py` is the gate that found it and the one that holds it.
+ * `tests/test_maintainer_tools_parity.py` found it and died with the reference it compared
+ * against. What HOLDS it now is `tests/unit/maintainer_tools.test.mjs`, and specifically its
+ * `theme files are visited in THIS platform's Path collation order` test: it re-derives Python's
+ * `sorted(Path)` order for the running platform instead of replaying a recording, so it cannot
+ * agree with a drift \u2014 and it is the measured killer of this function's mutation (M3).
  */
 export function comparePaths(a, b) {
   const A = normcase(a).split(/[\\/]/);

package/js/mcp.mjs

@@ -75,8 +75,9 @@ export const MCP_PRESETS = {
     label: 'GitLab',
     desc: 'GitLab repo / MR / issue / CI tools via @zereight/mcp-gitlab (npx, no '
       + 'install). Edit GITLAB_PERSONAL_ACCESS_TOKEN (scopes: api, read_repository) '
-      + 'and GITLAB_API_URL before use. Add a second entry (gitlab-2) for another '
-      + 'instance.',
+      + 'and GITLAB_API_URL before use. For a second instance (a self-hosted server), '
+      + 'copy this block by hand under a new name and point it at the other URL — '
+      + 'SETUP.md has the pattern.',
     block: {
       type: 'local',
       command: ['npx', '-y', '@zereight/mcp-gitlab'],
@@ -85,19 +86,6 @@ export const MCP_PRESETS = {
       enabled: true,
     },
   },
-  'gitlab-2': {
-    label: 'GitLab (2nd instance)',
-    desc: 'A second GitLab instance (e.g. a self-hosted server) via the same '
-      + '@zereight/mcp-gitlab command. Point GITLAB_API_URL at the other instance '
-      + "and give it that instance's own token.",
-    block: {
-      type: 'local',
-      command: ['npx', '-y', '@zereight/mcp-gitlab'],
-      environment: { GITLAB_PERSONAL_ACCESS_TOKEN: '',
-        GITLAB_API_URL: 'https://gitlab.example.com/api/v4' },
-      enabled: true,
-    },
-  },
   filesystem: {
     label: 'Filesystem',
     desc: 'Read/write files under explicitly allowed directories via '

package/js/migrate.mjs

@@ -35,8 +35,8 @@ import path from 'node:path';
 import { main as driverMain } from '../bin/geneseed.mjs';
 import { ROOT } from './checkout.mjs';
 import {
-  EMIT_HOST_SCOPE, defaultMode, defaultPosture, defaultTheme, footprintOfDir, installState,
-  installTargets, modeOfDir, postureOfDir, readMaybe, themeOfDir,
+  EMIT_HOST_SCOPE, defaultMode, defaultPosture, defaultTheme, doctrinesForBuild,
+  footprintOfDir, installState, installTargets, modeOfDir, postureOfDir, readMaybe, themeOfDir,
 } from './installs.mjs';
 import { DEFAULT_EMIT, setupBuildArgs } from './generate.mjs';
 import {
@@ -206,7 +206,12 @@ export function cmdMigrate(args = {}) {
     try { rmSync(stash, { recursive: true, force: true }); } catch { /* nothing to undo */ }
   };
 
-  // Step 3 — re-emit, in each install's OWN five values. Same reads as `cmdRebuildAll`.
+  // Step 3 — re-emit, in each install's OWN six values. Same reads as `cmdRebuildAll`, and
+  // the pack selection is the sixth: leaving it out re-emitted a narrowed install at whatever
+  // `harness.config.json` said, which WIDENS a constitution its owner had cut down (and, the
+  // other way, can strip the consent gate). `null` — a pre-marker carrier, which on a MIGRATION
+  // is the common case and not the rare one — resolves to ALL packs through
+  // `doctrinesForBuild`, never to `harness.config.json`, which is what makes it fail-closed.
   for (const r of rows) {
     const marker = r.marker && (EMIT_HOST_SCOPE.get(r.marker) ?? ['', ''])[0] === r.host
       ? r.marker : '';
@@ -214,7 +219,8 @@ export function cmdMigrate(args = {}) {
     const theme = themeOfDir(r.root) || defaultTheme();
     const out = r.scope === 'global' ? null : r.root;
     const argv = setupBuildArgs(theme, emit, out, out, footprintOfDir(r.root),
-      postureOfDir(r.root) || defaultPosture(), modeOfDir(r.root) || defaultMode());
+      postureOfDir(r.root) || defaultPosture(), modeOfDir(r.root) || defaultMode(),
+      doctrinesForBuild(r.root));
     const label = `${r.host}:${r.scope} (${r.root})`;
     pyPrint(`[migrate] re-emitting ${label}: theme=${theme} emit=${emit}\n`);
     let rc = 1;