geneseed 2.0.0 → 3.0.0

package/QUICKSTART.md

@@ -10,7 +10,7 @@ repo inherits it, nothing committed into your projects. The only prerequisite is
 
 Same command on macOS, Linux and Windows (cmd, PowerShell, or any POSIX shell).
 
-Pick a **theme**, pick **OpenCode global** when asked for the install mode, confirm.
+Pick a **theme**, then accept the defaults for posture, mode, doctrine packs and footprint (or pick deliberately — see [setup choices](docs/web/setup-choices.md)), pick **OpenCode global** when asked for the install mode, confirm.
 The wizard builds the harness and offers a health check.
 
 Want the command to stay? `npm install -g geneseed`, then plain `geneseed …` from

package/README.md

@@ -4,6 +4,7 @@
 
 **A portable, theme-able harness you implant once and use everywhere to grow a disciplined AI coding agent.**
 
+[![npm](https://img.shields.io/npm/v/geneseed?color=cb3837&logo=npm)](https://www.npmjs.com/package/geneseed)
 [![CI](https://github.com/Arylmera/Geneseed/actions/workflows/ci.yml/badge.svg)](https://github.com/Arylmera/Geneseed/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
 [![Node >= 22.3](https://img.shields.io/badge/node-%3E%3D22.3-5fa04e)](package.json)
@@ -11,7 +12,7 @@
 [![Themes](https://img.shields.io/badge/themes-14-9cf)](themes/)
 [![Skills](https://img.shields.io/badge/skills-47-blueviolet)](src/skills/)
 [![Agents](https://img.shields.io/badge/agents-17-orange)](src/agents/)
-[![Laws](https://img.shields.io/badge/laws-37-critical)](src/laws/universal.md)
+[![Laws](https://img.shields.io/badge/laws-9-critical)](src/laws/universal.md)
 [![Plugins](https://img.shields.io/badge/plugins-7-teal)](adapters/opencode/plugins/)
 [![OpenCode · Claude Code · Bob · Copilot · AGENT.md](https://img.shields.io/badge/works%20with-OpenCode%20·%20Claude%20Code%20·%20Bob%20·%20Copilot%20·%20AGENT.md-1f6feb)](#-supported-harnesses)
 
@@ -37,7 +38,7 @@ The lineage is also why an **imperial** theme ships alongside the neutral one: i
 
 ### How it works
 
-One canonical source in `src/` renders, via a tiny zero-dependency generator (`geneseed-build`), into a ready-to-use bundle. **A theme controls only *voice*** — how the AI responds and how the prose inside the docs reads (tagline, greeting, descriptions). **Structure is theme-independent**: section names (Rules, Agents, Skills, Memory…) and folder names (`laws/`, `agents/`, `skills/`, `memory/`, `notebook/`) are always plain English, so the scaffolding stays tool-friendly while the flavour lives in the words.
+One canonical source in `src/` renders, via a tiny zero-dependency generator (`geneseed-build`), into a ready-to-use bundle. **A theme controls only *voice*** — how the AI responds and how the prose inside the docs reads (tagline, greeting, descriptions). **Structure is theme-independent**: section names (Rules, Agents, Skills, Memory…), folder names (`laws/`, `ontology/`, `doctrines/`, `agents/`, `skills/`, `memory/`, `notebook/`) and the four ontology section headings (Telos, Evidence, Decisions, Conduct) are always plain English, so the scaffolding stays tool-friendly while the flavour lives in the words.
 
 ```bash
 geneseed-build                   # default theme (neutral)
@@ -50,7 +51,7 @@ geneseed-build --theme imperial  # Warhammer 40k voice, identical structure
 
 ### ⚡ The short way — `npx`
 
-One command, nothing cloned, nothing else to install. The only prerequisite is **Node ≥ 22.3**.
+The harness is published on npm as **[`geneseed`](https://www.npmjs.com/package/geneseed)** — three commands (`geneseed`, `geneseed-hook`, `geneseed-build`), zero dependencies. One command, nothing cloned, nothing else to install. The only prerequisite is **Node ≥ 22.3**.
 
 ```bash
 npx geneseed setup            # the guided wizard
@@ -88,13 +89,11 @@ cd Geneseed
 
 Both launchers are thin shims over the Node CLI: they need `node` (22.3+) on `PATH`, and nothing else. Set `GENESEED_NODE` to an absolute path if `node` is not on `PATH` — under a version manager that only patches interactive shells, say. The wizard is plain text prompts on every console, old or new.
 
-**Already installed from a clone?** `geneseed migrate` moves every install you have onto the npm shape in one pass, all-or-nothing, without touching hooks or login items it did not write. Your old clone keeps working for a full release — there is no cliff. See [Migrate an existing install](docs/web/migrate.md).
-
 ### 🟩 One runtime — Node, and nothing else
 
-Node ≥ 22.3 is the entire dependency list. Every subcommand, all four hooks, every web-console endpoint and both generators run from it, and what each of them emits is replayed against frozen recordings on every commit, across every theme × host × footprint. So an install needs no second interpreter — not for the harness, and not for anything it ships.
+Node ≥ 22.3 is the entire dependency list. Every subcommand, all four hooks, every web-console endpoint and both generators run from it, and every commit runs the whole unit suite plus `doctor --all` across every theme × host × footprint, on Linux and Windows both. So an install needs no second interpreter — not for the harness, and not for anything it ships. (Until 2026-08-17 the generator's output was also replayed byte for byte against recordings taken from the Python implementation. Those were retired — see [`docs/limits.md`](docs/limits.md) for the measurement that licensed it and the coverage it cost.)
 
-- **0 commands have no Node twin**: 25 of the 25 subcommands, and all four hook verbs, answer from the Node entry points. `catalog`, `mcp` and `memory` are Node-native faces the CLI table declares on top of that roster. There is no full-screen browse panel — `geneseed tui` and `geneseed menu` are verbs that refuse it by name and print the command list instead. Off a terminal, which is how scripts and CI run them, the bytes and the exit code are the recorded ones.
+- **0 commands have no Node twin**: 25 of the 25 subcommands, and all four hook verbs, answer from the Node entry points. `catalog`, `mcp` and `memory` are Node-native faces the CLI table declares on top of that roster. There is no full-screen browse panel — `geneseed tui` and `geneseed menu` are verbs that refuse it by name and print the command list instead, off a terminal as well as on one.
 - **Nothing you install needs an interpreter.** The `token-report` skill is a script rather than prose, and it ships as `scripts/token_report.mjs`, run with `node`; `daydream` and `herdr` hand their inline code to `node -e`. So **every bundle carries** nothing that needs one: no Python file, and no skill that shells out to an interpreter, on any host, theme or footprint. Three tests freeze that — one scans every tracked file for inline code handed to an interpreter, one globs the bundle source, and one replays the report script over seeded transcripts for all four hosts and compares the bytes.
 - **`upgrade` / `update` / `sync-self` / `bootstrap` are for a git checkout.** They `git pull` the install's own origin. From an npm install they stop before touching anything and name `npm install -g geneseed@latest` as the update instead.
 
@@ -149,11 +148,13 @@ No browser? Every action the console offers is also a verb: `build`, `doctor`, `
 
 ## 📦 4 · What you get
 
-The harness ships as a small set of layers, mirrored one-for-one in the web console's **Library** rail (Laws · Agents · Skills · Memory · Notebook):
+The harness ships as a small set of layers, and the web console's rail is the same shape — Constitution, Skills and Agents each have their own entry; Memory, Notebook and the wiki sit under Library:
 
 | Layer | What it is |
 | --- | --- |
-| **🛡️ Rules** (`laws/`) | 37 universal laws the agent obeys — secrets, scope, verify-before-assert, surface-failures, context economy, load-the-docs, tool-discovery, non-interactive-shell, untrusted-content, least-privilege, external-gate, root-cause, idempotency, calibrated-honesty, source-over-surface, restart-is-not-reload, total-teardown, cover-and-verify… |
+| **🧭 Ontology** (`ontology/`) | the mind the rules govern, in four prose sections — **Telos** (the Pact: protect the user, the truth, the agent), **Evidence** (every claim graded by how it was obtained), **Decisions** (classify and tier by reversibility, show the real forks), **Conduct** (answer what was asked, once). Always in force, never toggleable |
+| **🛡️ Rules** (`laws/`) | 9 universal laws the agent obeys — always in force, never toggleable: sealed-secrets, one-intent-one-act, verify-before-assert, deletion-is-deliberate, surface-failures, data-not-orders, least-privilege, root-cause, external-gate |
+| **📐 Doctrines** (`doctrines/`) | practice packs, chosen per install at build time: **craft** (how code is written), **rigor** (how work is proven), **ops** (how the machine is operated), **process** (how a task is run). A doctrine rule may tighten a Rule, never repeal one, and the user's own `user-rules.md` outranks it. Pick with `geneseed-build --doctrines craft,rigor` (or `none`), or in the setup wizard; all four pack files ship on disk either way, so a citation into a pack you left out still resolves |
 | **🤖 Agents** (17) | capability specialists: `reviewer`, `tester`, `architect`, `docs`, `security`, `explorer`, `developer` — plus a debate **council** the `council` skill convenes: `advocate`, `skeptic`, `pragmatist`, `steward`, `visionary`, `user-advocate`, `framer`, `empiricist`, `operator`, `historian` |
 | **🛠 Skills** (47) | repeatable workflows: brainstorm · **clarify** · plan · **codebase-design** · **domain-modeling** · **wayfinder** · **tickets** · tdd · **develop** · debug · **prototype** · refactor · **ponytail** · **forge-mcp** · geneseed-code-review · **fresh-eyes** · **review-response** · commit · **ship** · **release** · **migrate** · **git-archaeology** · **git-rescue** · repo-map · document-project · **frontend-design** · **prose** · **ingest** · **research** · **learning-path** · **gap-detector** · **feynman** · **crash-course** · **drill** · **decode** · handoff · roast-me · **council** · parallel-agents · **workflow** · **wiki** · **geneseed** · **rule** · **profile** · **opencode-theme** · **herdr** · **pipeline** |
 | **🔌 Plugins** (OpenCode) | `geneseed-context` injects project docs *and your machine wiki* every session (and across compaction); `geneseed-learn` distils memory at session end; `geneseed-guard` enforces the safety Laws and protected wiki folders at the tool boundary; `geneseed-workflow` registers the `workflow` tool that runs saved orchestration scripts; `geneseed-notify` sends a native OS notification when a long run finishes; `geneseed-ponytail` holds a minimal-code mode (`/ponytail lite\|full\|ultra\|off`), opt-in, injecting the laziest-that-works ruleset every turn so it doesn't drift; `geneseed-activity` streams what each session is doing to the web console's Activity view |
@@ -182,16 +183,20 @@ Pick with `--theme NAME` or via the setup wizard. The theme is remembered in a `
 
 ### 🪶 Footprint (lean vs full)
 
-A second per-install dial, **footprint**, sets how much of the Rules `AGENT.md` carries *inline* every turn — a token-cost knob, not a change to which Rules apply (every Rule is always in force).
+A second per-install dial, **footprint**, sets how much of the constitution `AGENT.md` carries *inline* every turn — a token-cost knob, not a change to which Rules apply (every Rule is always in force, and so is the whole of the Ontology).
 
-| Footprint | Section 1 of `AGENT.md` | Trade-off |
+| Footprint | The Ontology + Sections 1–2 of `AGENT.md` | Trade-off |
 | --- | --- | --- |
-| **lean** *(default)* | each Rule's heading + the rule line, then a pointer to the full law file | ~40% smaller; rationale is one on-demand read away |
-| **full** | every Rule's complete text **and** rationale, inlined | maximum guidance density; largest per-turn token cost |
+| **lean** *(default)* | the Ontology **whole**; each Rule and each active doctrine rule as its heading + the rule line, then a pointer to the full text | lighter every turn; rationale is one on-demand read away |
+| **full** | the Ontology, every Rule and every active doctrine rule at complete text **and** rationale, inlined | maximum guidance density; largest per-turn token cost |
+
+**The Ontology is never truncated.** Lean keeps only the first sentence of each `### ` block, and the four ontology sections are flowing prose rather than numbered rules — truncating them would leave four orphan sentences, so they ship whole at both footprints. The invariants and the doctrine rules *are* truncated at lean, each to its heading plus its first sentence.
 
-Lean still ships the complete `laws/universal.md` beside `AGENT.md` and points the agent there before acting on secrets, deletion, git history, scope, or untrusted content — so it's a context/token optimization, **not** a rules cut. Lean is the default: the rationale is one read away and the context it frees is paid back on every turn. Switch to **full** when token cost is a non-issue or you run a smaller model, which leans harder on always-present rationale. Set it with `--footprint lean|full`, the Settings toggle, the per-harness dropdown in the Harnesses tab, or the setup wizard. It's remembered in a `.geneseed-footprint` marker and preserved across rebuilds, on every host (OpenCode, Claude Code, Bob, Copilot).
+Both footprints put the full text on disk beside `AGENT.md`: `laws/`, `ontology/` and `doctrines/` all ship in the bundle, and **all four pack files ship whether or not the pack was built in** — which is what lets a citation into an inactive pack resolve. So lean is a context/token optimization, **not** a rules cut. Measured on `neutral`, adding the ontology and doctrine tiers moved the always-loaded `AGENT.md` from 31,457 to 36,882 bytes at lean (+17.2%) and from 53,378 to 54,810 at full (+2.7%) — the lean growth is the price of shipping the ontology whole, and it was taken deliberately.
 
-Either way the harness is otherwise identical — same files, Rules, capabilities, and guards; lean only relocates each Rule's *reasoning* to on-demand (and adds the standalone laws file to global/Claude/Bob installs). The one behavioural edge: with the rationale always in context, **full** applies a rule's nuance more reliably on subtle edge cases — or with a weaker model that may not reach for the pointer — which is why it stays the default.
+Lean is the default: the rationale is one read away and the context it frees is paid back on every turn. Switch to **full** when token cost is a non-issue or you run a smaller model, which leans harder on always-present rationale. Set it with `--footprint lean|full`, the Settings toggle, the per-harness dropdown in the Harnesses tab, or the setup wizard. It's remembered in a `.geneseed-footprint` marker and preserved across rebuilds, on every host (OpenCode, Claude Code, Bob, Copilot).
+
+Either way the harness is otherwise identical — same files, Rules, capabilities, and guards; lean only relocates the *reasoning* to on-demand (and adds the standalone law, ontology and doctrine files to global/Claude/Bob installs). The one behavioural edge: with the rationale always in context, **full** applies a rule's nuance more reliably on subtle edge cases — or with a weaker model that may not reach for the pointer.
 
 Want to check a build before it touches anything real? `geneseed-build --validate-only --theme NAME --emit MODE --out TARGET` renders and validates into a throwaway sandbox — nothing under `--out`/`--root` is written — and exits non-zero on any problem. Details: [SETUP.md](SETUP.md#dry-run-a-build-validate).
 
@@ -215,10 +220,10 @@ is **identical on every host**. What differs is how much of it the host can
 | **Agents** (capability specialists) | ✅ native | ✅ | ✅ | ✅ `.agent.md` |
 | **Skills** (byte-identical) | ✅ | ✅ | ✅ | ✅ |
 | **Memory & Notebook** | ✅ | ✅ | ✅ | ✅ |
-| **Context injection** (Rule XVIII) | ⚙️ plugin | 🪝 hook | 🪝 hook¹ | 📄 preamble |
+| **Context injection** | ⚙️ plugin | 🪝 hook | 🪝 hook¹ | 📄 preamble |
 | **Memory write-back** (learn) | ⚙️ plugin | 🪝 hook | 🪝 hook¹ | 📄 preamble |
-| **Git-gate consent** (Rule XX) | ⚙️ plugin | 🪝 hook | 🪝 hook¹ | 📄 preamble |
-| **Rule-gate consent** (Rule VI) | ⚙️ plugin² | 🪝 hook | 🪝 hook¹ | 📄 preamble |
+| **Git-gate consent** (process 5) | ⚙️ plugin | 🪝 hook | 🪝 hook¹ | 📄 preamble |
+| **Rule-gate consent** (process 1) | ⚙️ plugin² | 🪝 hook | 🪝 hook¹ | 📄 preamble |
 | **Sovereign-repo excludes** | ⚙️ plugin | ✅ `claudeMdExcludes` | ✅ rules-shadow | ➖ none |
 | **MCP server wiring** | ✅ `mcp` | ✅ `mcpServers` | ✅ `mcpServers` | ✅ `mcp-config.json` |
 | **Colour themes** | ✅ full palette | ➖ | ➖ | ➖ |
@@ -254,14 +259,19 @@ Geneseed/
 ├── harness.config.json   default theme + metadata (the one owner of the version)
 ├── src/                  canonical source — edit here
 │   ├── AGENT.md.tmpl     the entrypoint, rendered to AGENT.md
-│   ├── laws/             governance rules
+│   ├── ontology/         how the agent thinks — Telos, Evidence, Decisions, Conduct
+│   ├── laws/             the universal invariants
+│   ├── doctrines/        the four practice packs (craft, rigor, ops, process)
+│   ├── postures/         the relationship register, inlined into AGENT.md
+│   ├── modes/            the operating register, inlined into AGENT.md
 │   ├── agents/           capability specialists
 │   ├── skills/           repeatable workflows
 │   ├── memory/           memory convention + index
 │   └── notebook/         the agent's own freeform space — convention + index
 ├── themes/               voice token maps (14 themes shipped)
 ├── web/                  Vite + React UI source; the committed web/dist/ build is what ships
-├── tests/                Node test suites + the frozen corpora they replay (tests/__snapshots__/)
+├── tests/                Node test suites + the pure-function/help recordings they replay
+│                         (tests/__snapshots__/ — the emit/cli/web corpora retired 2026-08-17)
 ├── docs/                 guides (web-ui, wiki, …) + docs/web/ (the console's Docs pages);
 │                         specs/, reviews/, superpowers/ are local working docs — git-ignored
 ├── adapters/             per-host glue (opencode/, claude-code/, bob/, copilot/)
@@ -294,8 +304,6 @@ geneseed rebuild-all   # re-render every registered install in its own theme + m
 ./geneseed upgrade     # just the content refresh (remembers theme + emit mode)
 ```
 
-**Moving from a clone to npm** — `geneseed migrate` re-emits every install you already have onto the npm shape, all-or-nothing, and reports (never rewrites) the hooks and login items it did not write. `--dry-run` prints the plan first. See [Migrate an existing install](docs/web/migrate.md).
-
 **Local edits survive.** The self-improvement loops let the agent refine its deployed agent/skill files in place. Before setup, re-theme, or upgrade overwrites them, any drift is auto-exported to a markdown **improvements file** under `improvements/` *inside the deployed harness dir* (e.g. `~/.config/opencode/improvements/` for the global install) — beside the install it describes, untouched by rebuilds and uninstall. Hand it to an agent in this repo to back-port the changes into `src/`. On demand: `./geneseed diff --out FILE`, or the **Changes** page in the web console.
 
 Details and precedence rules: [SETUP.md → Upgrade](SETUP.md#upgrade).

package/SETUP.md

@@ -100,9 +100,11 @@ hand? Pick a path below.
 > **Every `geneseed-build …` below is the generator.** `npm install -g geneseed` puts it
 > on your `PATH`; without installing anything, `npx -p geneseed geneseed-build --emit
 > opencode-global` is the same command. From a checkout it is
-> `node bin/geneseed.mjs` with the same flags. Its output is replayed byte for byte
-> against frozen recordings on every commit, across every theme × host × footprint
-> combination.
+> `node bin/geneseed.mjs` with the same flags. Every commit re-emits with it across every
+> theme × host × footprint combination and checks the result with `doctor --all`, on Linux
+> and Windows both. Until 2026-08-17 that output was also compared byte for byte against
+> recordings taken from the Python implementation; those were retired, and `docs/limits.md`
+> says why and what it cost.
 
 ---
 
@@ -163,9 +165,11 @@ your repo's `.claude/settings.json` (paths assume the bundle is at the repo root
 It wires:
 
 - **PreToolUse** (matcher `Bash`) — runs `harness git-gate`, a tool-boundary backstop
-  for Law XX. The hook inspects the command and forces an `ask` on every `git commit`
-  or `git push` (even chained or `-C`-flagged), un-suppressible by a one-time "don't
-  ask again". Every other Bash command is deferred to the normal permission flow.
+  for Doctrine `process 5`. The hook inspects the command and forces an `ask` on every
+  `git commit` or `git push` (even chained or `-C`-flagged), un-suppressible by a
+  one-time "don't ask again". Every other Bash command is deferred to the normal
+  permission flow. It is wired only when the **process** pack is active — build with
+  `--doctrines` leaving `process` out and this hook is not installed at all.
 - **SessionStart** (`startup`/`clear`) — prints `AGENT.md` and injects the project
   context (`harness context`, which auto-discovers the repo's docs);
 - **SessionStart** (`resume`) — refreshes the project context only, without re-printing
@@ -284,17 +288,79 @@ doubles as a CI drift check: `1` when it had to change files, `0` when every the
 already in sync, and `2` when `_TEMPLATE.json` itself is missing or unreadable — the one
 case where a `0` would have meant "in sync" without having checked anything.
 
+### Doctrine packs
+
+The constitution is three tiers, and only one of them is a choice. The **Ontology** (how the
+agent thinks — Telos, Evidence, Decisions, Conduct) and the nine **Rules** (what it never
+trades away) are always on and cannot be switched off. The **Doctrines** are practices rather
+than principles, and they ship as four packs:
+
+| Pack | What it governs |
+| --- | --- |
+| **craft** | how code is written — reuse first, house conventions, docs in the same change, the smallest diff |
+| **rigor** | how work is proven — idempotence, honest tests, cover-and-verify, gates that can actually fail |
+| **ops** | how the machine is driven — tool discovery, commands that return, complete teardowns, restart is not reload |
+| **process** | how a session runs — planning, context economy, docs first, bounded loops, and the consent gate on every commit and push |
+
+They are picked **at build time**, once, on the generator — there is no runtime toggle — and
+the default is all four:
+
+    geneseed-build --doctrines craft,rigor   # two packs
+    geneseed-build --doctrines none          # ontology and the nine Rules only
+    geneseed-build                           # all four (the default)
+
+`harness.config.json`'s `doctrines` array sets this checkout's own default, and `doctor`
+refuses one that names a pack the checkout does not ship. Order is fixed by the harness
+(craft → rigor → ops → process) regardless of the order you type.
+
+The setup wizard asks too — one *all* / *choose* gate, then a yes/no per pack with its
+one-line description — and it **pre-selects what the install already carries**, read off the
+`Active packs:` marker line in the deployed `AGENT.md`. So re-running the wizard and holding
+Enter cannot silently widen a set you deliberately narrowed.
+
+**The whole catalogue always ships.** Every pack file lands under `doctrines/` beside
+`AGENT.md` at both footprints whether or not it was built in, so a rule that cites a pack you
+left out is still readable on disk — only the rendered `AGENT.md` is narrower. `doctor` reports
+such citations as a `[note]`, printed and not counted, because a narrowed build is a
+configuration you chose rather than a defect.
+
+⚠ **Turning `process` off also removes the commit/push consent gate.** Doctrine `process 5`
+(*Consent Before Push*) is enforced twice: as prose in `AGENT.md`, and at the tool boundary —
+the `git-gate` PreToolUse hook on Claude Code and Bob, and the `git commit*` / `git push*`
+permission entries on OpenCode. A build without the `process` pack wires neither, and
+rebuilding an install that had them takes the Claude hook back out of `settings.json`. That is
+deliberate and it is the rule the tiering rests on: **prompt and boundary must never
+disagree.** A gate that stops every command to ask consent for a rule the install did not adopt
+is a gate the agent cannot explain and you did not ask for. Two details worth knowing:
+
+- **What stays in every build regardless:** `rm -rf *`, `git push --force*` and `git push -f*`.
+  Those are Rule IV's territory — an always-on invariant — not the process pack's.
+- **On OpenCode, an existing `opencode.json` is not stripped.** That file is co-owned, nothing
+  on disk records who wrote a given permission entry, and Geneseed will not delete a line you
+  might have typed yourself. A pack-off rebuild leaves an already-written `git commit*` in
+  place and *reports* it instead. A fresh install has no git gate at all.
+
+`process` is the only pack whose removal changes what the machine does rather than only what
+the agent reads — which is why the wizard's blurb for it says so.
+
 ### Footprint (lean vs full)
 
-**Footprint** sets how much of the Rules `AGENT.md` carries *inline* on every turn — a
+**Footprint** sets how much of the constitution `AGENT.md` carries *inline* on every turn — a
 token-cost dial, not a change to which Rules apply. Both states keep all Rules in force:
 
-- **full** (default) — Section 1 inlines every Rule's complete text *and* rationale.
-  Maximum guidance density; the largest always-loaded block in the harness.
-- **lean** — Section 1 carries each Rule's heading + the rule line, then a pointer to the
-  full law file. ~40% smaller; the complete `laws/universal.md` still ships beside
-  `AGENT.md` and the agent reads it on demand (and is told to before acting on secrets,
-  deletion, git history, scope, or untrusted content).
+- **lean** (default) — Sections 1–2 carry the heading and rule line of each Rule and each
+  active doctrine rule, then a pointer to the full text. Lighter every turn; the complete
+  `laws/universal.md`, `ontology/` and `doctrines/` still ship beside `AGENT.md` and the agent
+  reads them on demand (and is told to before acting on secrets, deletion, git history, scope,
+  or untrusted content).
+- **full** — Sections 1–2 inline every Rule's and every active doctrine rule's complete text
+  *and* rationale. Maximum guidance density; the largest always-loaded block in the harness.
+
+**The Ontology is never truncated.** Lean keeps only the first sentence of each `### ` block,
+and the four ontology sections are flowing prose rather than numbered rules — cutting them
+would leave four orphan sentences, so they ship whole at both footprints. That is why adding
+the ontology tier grew the lean carrier proportionally more than the full one; it was taken as
+a deliberate cost.
 
 **Why:** context is scarce and metered. Lean reclaims that budget — and the tokens you
 pay for it — for the task, moving the *rationale* one read away while keeping the rules
@@ -308,10 +374,11 @@ you run a smaller model.
 can *do*: lean and full emit identical files (same agents, skills, plugins, commands, memory,
 notebook, hooks) and every Rule is present and binding. The only structural difference is
 that a lean install on a global / Claude / Bob / Copilot target also ships the standalone
-`laws/universal.md` (project bundles already carry it); the only behavioural difference is
-that each Rule's reasoning loads on demand instead of every turn. Lean is the default;
-full, with the rationale always in front of the model, applies a rule's nuance more
-reliably on subtle edge cases or with a weaker model, and is one flag away.
+`laws/universal.md` and `ontology/` (project bundles already carry them, and `doctrines/`
+ships at both footprints on every target); the only behavioural difference is that the
+reasoning loads on demand instead of every turn. Lean is the default; full, with the rationale
+always in front of the model, applies a rule's nuance more reliably on subtle edge cases or
+with a weaker model, and is one flag away.
 
 Set it with `--footprint lean|full` (alongside any `--emit`), the **Footprint** toggle in
 the web Settings, the per-harness dropdown in the Harnesses tab, or the setup wizard. It is
@@ -416,7 +483,7 @@ opt-in, now simply matches the default. To drop injection entirely, set
 If you keep a personal knowledge base on this machine — an Obsidian vault, or any
 folder of interlinked markdown — declare it once in **`wiki.jsonc`** and the agent
 becomes a citizen of it: entry notes load each session (eager) or on demand (lazy),
-and it reads *and writes* notes under your vault's own conventions (AGENT.md §7,
+and it reads *and writes* notes under your vault's own conventions (AGENT.md §8,
 the `wiki` skill). Unlike `context.json` this is **per machine, not per repo**.
 
 The build seeds `wiki.jsonc` beside `AGENT.md` (for a global install:
@@ -460,7 +527,7 @@ list keeps the feature off. The file may hold private paths — it is host-speci
 covered by the bundle `.gitignore`, and never committed.
 
 On tools without the plugins (plain `AGENT.md`, Claude Code), the same contract
-holds through prose: AGENT.md §7 instructs the agent to read `wiki.jsonc` at session
+holds through prose: AGENT.md §8 instructs the agent to read `wiki.jsonc` at session
 start and honour it.
 
 ### Memory
@@ -602,7 +669,9 @@ command serves gitlab.com and any private instance.
 scopes `api` and `read_repository`. Treat it like a password.
 
 **2. Register one entry per instance** — same command, different `GITLAB_API_URL`
-and token. Two instances (e.g. gitlab.com plus a self-hosted server) → two entries:
+and token. Two instances (e.g. gitlab.com plus a self-hosted server) → two entries.
+The MCP screen ships a one-click row for the **first** entry only; a second instance is a
+hand-added copy of that block, which is all it ever was:
 
 <!--harness:opencode-->
 On OpenCode, under the `mcp` key of `opencode.json`:
@@ -642,6 +711,11 @@ The entry key is just a label — name them `gitlab` / `gitlab-2`, or after each
 (`gitlab`, `gitlab-acme`). What separates the two is the `GITLAB_API_URL` + token pair;
 keep the `/api/v4` suffix on the URL.
 
+**Don't know where this file lives?** Run `geneseed web`, open **Harnesses**, and expand an
+active install — each MCP target prints the full path of the config file it writes, right
+above its server rows. That is the file the token and the URL go into. From the terminal,
+`geneseed mcp` prints the same paths without starting anything.
+
 #### Filesystem
 
 Give the agent scoped file access via
@@ -954,7 +1028,8 @@ capability agent. Notes:
 
 - **Permissions still gate.** The consent-before-commit/push / `rm -rf` `ask` rules
   will *block* in a non-interactive run (nothing to answer the prompt). Both
-  `git commit` and `git push` are gated now (Law XX, every branch), so a CI job that
+  `git commit` and `git push` are gated on every branch whenever the **process** pack
+  is active (Doctrine `process 5`; a build without it wires neither), so a CI job that
   commits must opt those commands back to `"allow"` in its own `permission.bash` map,
   or scope the run to read-only work — don't blanket-disable the guards.
 - **`--pure`** runs OpenCode ignoring local/global config — handy to reproduce a bug
@@ -981,9 +1056,8 @@ anything, naming the `npm install -g` line above instead.
 **Installed from a clone:**
 
 ```
-./geneseed upgrade                 # track main; keep the remembered theme + emit mode
-./geneseed upgrade v1.0.0          # pin to a tag
-./geneseed upgrade main imperial   # force a theme
+./geneseed upgrade                 # track the checkout's current branch; keep theme + emit mode
+./geneseed upgrade imperial        # force a theme
 ```
 
 It git-pulls the install's own origin (fast-forward only), validates it (a blocking

package/SHIPPED.md

@@ -20,7 +20,7 @@ historical pointers, not files distributed with the repo.
 > **On version numbers.** [`harness.config.json`](harness.config.json)'s `version` is a
 > human-readable label only. The canonical identity of an installed harness is the
 > **source fingerprint** stamped in `.geneseed-version` (see `geneseed version`), not the
-> string. Current label: **2.0.0**.
+> string. Current label: **3.0.0**.
 
 > **Spec status audit (2026-06-15).** Every dated spec authored before today was
 > verified against the source tree and confirmed implemented (code + tests + docs);
@@ -35,7 +35,8 @@ Every row below is present in the tree today; "Spec" links the design record.
 | Capability | What it is | Spec |
 | --- | --- | --- |
 | **Themed generator** | One neutral `src/` → 14 themed bundles via `geneseed-build` (zero dependencies); structure stays theme-independent | [DESIGN.md](DESIGN.md) |
-| **Laws / Agents / Skills / Memory / Notebook** | 37 laws, 17 agents, 47 skills, the memory convention, and the agent's sovereign notebook | [notebook](docs/specs/2026-06-11-notebook-sovereign-space.md) · [agent-own-space](docs/specs/2026-06-10-notebook-agent-own-space.md) |
+| **Laws / Agents / Skills / Memory / Notebook** | 9 laws, 17 agents, 47 skills, the memory convention, and the agent's sovereign notebook | [notebook](docs/specs/2026-06-11-notebook-sovereign-space.md) · [agent-own-space](docs/specs/2026-06-10-notebook-agent-own-space.md) |
+| **Three-tier constitution** | The governance surface splits into an always-on **Ontology** (Telos, Evidence, Decisions, Conduct — the Pact absorbed into Telos), the nine always-on **Invariants**, and four toggleable **Doctrine** packs (craft, rigor, ops, process) addressed `<pack> <n>`. Packs are chosen at build time with `--doctrines` or the setup wizard; the whole catalogue ships on disk either way, so a citation into an inactive pack still resolves. Precedence, in order: Ontology + Invariants, then the user's `user-rules.md`, then the active Doctrines, then `PROFILE.md`. `doctor`'s `constitutionProblems` gates pack numbering, the per-rule Principle column, every `{{DOCTRINE}}` citation in `src/`, and the rule that an always-on tier may never cite a toggleable one | [three-tier-constitution](docs/specs/2026-08-19-three-tier-constitution-design.md) |
 | **`doctor`** | One check: unresolved tokens, dead/non-hermetic links, theme-key parity, authoring gates, rendered-bundle drift | [theme-aware doctor/diff](docs/specs/2026-06-07-theme-aware-doctor-diff.md) |
 | **`diff` + improvements export** | Deployed-vs-source drift report; export an `improvements.md` back-port | [improvements-export](docs/specs/2026-06-12-improvements-export.md) |
 | **`status` / `version`** | Headless dashboard + fingerprint verdict (no TUI needed) | [status-command](docs/specs/2026-06-07-status-command.md) · [version-and-uninstall](docs/specs/2026-06-07-version-and-uninstall.md) |
@@ -46,10 +47,10 @@ Every row below is present in the tree today; "Spec" links the design record.
 | **Per-agent memory** | Each capability agent keeps durable lessons in `memory/agents/<name>.md`: read at dispatch, written back mechanically by `learn` on session/subagent end (OpenCode plugin + claude/bob `SubagentStop`); `learn --consolidate` rebuilds the index | [orchestration-memory-upgrade](docs/specs/2026-07-04-orchestration-memory-upgrade.md) |
 | **Wiki integration** | Machine-wide knowledge base (`wiki.jsonc`): eager/lazy loading, conventions, protected folders enforced at the tool boundary | [wiki-knowledge-base](docs/specs/2026-06-11-wiki-knowledge-base.md) |
 | **Collaboration layer** | Negotiated postures (peer/mentor/expert/assistant/artisan, chosen at setup, inlined in AGENT.md), the bidirectional Pact, epistemically-typed memory (`force:` + Bridge rule), and a seed-once `PROFILE.md` identity with a web editor tab and a `profile` skill that interviews the user to draft it | [collaboration-layer](docs/specs/2026-07-12-collaboration-layer.md) |
-| **Rule front door** | Both durable stores enter through the `rule` skill's fork (*standing rule, or fact to remember?* — always asked, never inferred): the memory branch elicits the binding `force` and shows the file before writing, the rule branch pressure-tests by reformulation and a mandatory counter-example. Law VI carries the norm on every host; a `rule-gate` PreToolUse hook (Claude, Bob) and a `geneseed-guard` speed bump (OpenCode) hold it at the tool boundary | [rule-front-door](docs/specs/2026-07-30-rule-front-door.md) |
+| **Rule front door** | Both durable stores enter through the `rule` skill's fork (*standing rule, or fact to remember?* — always asked, never inferred): the memory branch elicits the binding `force` and shows the file before writing, the rule branch pressure-tests by reformulation and a mandatory counter-example. Doctrine process 1 carries the norm on every host; a `rule-gate` PreToolUse hook (Claude, Bob) and a `geneseed-guard` speed bump (OpenCode) hold it at the tool boundary | [rule-front-door](docs/specs/2026-07-30-rule-front-door.md) |
 | **Entity registry** | `registry.json` records a lifecycle status, version, owner and add-date for every agent and skill in the tree (maintainer-side — never rendered into a bundle, so it costs no session context). `doctor` gates it against `src/` in both directions, sweeps everything that ships for credentials, and holds each vendored skill folder to an immutable upstream commit. The status surfaces as a badge in the web catalog, shown only where it deviates from `approved` | [entity-registry](docs/specs/2026-07-31-entity-registry.md) |
-| **Node runtime + npm package** | The whole harness runs from Node: every command `js/cli-table.json` declares, all four hook verbs, every web-console endpoint (the OS-native folder picker excepted, and declined on purpose) and both generators. What each of them emits is replayed against frozen recordings on every commit, across every theme × host × footprint. It ships as the zero-dependency `geneseed` package (`geneseed`, `geneseed-hook`, `geneseed-build`), so `npx geneseed setup` needs no clone and nothing else installed; `geneseed migrate` moves an existing checkout install across. Node is the only runtime it asks for: the `token-report` skill's own script is `token_report.mjs`, gated over seeded transcripts for all four hosts, and `daydream` and `herdr` call `node -e` | [npx-distribution](docs/specs/2026-08-06-npx-distribution.md) |
-| **Runtime awareness** | MCP discovery, web research, tool-call batching, review discipline baked into the laws | [runtime-awareness](docs/specs/2026-06-07-runtime-awareness-and-review-discipline.md) |
+| **Node runtime + npm package** | The whole harness runs from Node: every command `js/cli-table.json` declares, all four hook verbs, every web-console endpoint (the OS-native folder picker excepted, and declined on purpose) and both generators. Every commit runs the unit suite, `doctor --all` across every theme × host × footprint, and the generator's two self-comparisons, on Linux and Windows both; the frozen emit/cli/web recordings that also gated it retired on 2026-08-17 (`docs/limits.md`). It ships as the zero-dependency `geneseed` package (`geneseed`, `geneseed-hook`, `geneseed-build`), so `npx geneseed setup` needs no clone and nothing else installed; `geneseed migrate` moves an existing checkout install across. Node is the only runtime it asks for: the `token-report` skill's own script is `token_report.mjs`, gated over seeded transcripts for all four hosts, and `daydream` and `herdr` call `node -e` | [npx-distribution](docs/specs/2026-08-06-npx-distribution.md) |
+| **Runtime awareness** | MCP discovery, web research, tool-call batching, review discipline — carried by the doctrine packs (`ops 1` tool discovery, `process 4` read the docs first, `rigor 2`/`rigor 3` honest tests and cover-and-verify), not by the invariants | [runtime-awareness](docs/specs/2026-06-07-runtime-awareness-and-review-discipline.md) |
 | **Run from anywhere / uninstall** | `link`/`unlink` onto PATH; global uninstall that keeps the memory store | [version-and-uninstall](docs/specs/2026-06-07-version-and-uninstall.md) |
 
 ## Workplans (not features)

package/adapters/bob/README.md

@@ -65,9 +65,9 @@ project-bypasses-global need. An older Bob install that wrote a stale exclude is
 ## Hooks — best-effort
 
 The `settings.json` hooks use the **Claude dialect** (a `PreToolUse:Bash`
-git-gate for Rule XX consent, `SessionStart` context injection, and
-`Stop`/`SubagentStop` learn/memory capture — the same three `harness.py`
-subcommands the OpenCode plugins drive). Bob's hook execution is **unverified**:
+git-gate for Doctrine process 5 consent — present only when the `process` pack is
+built in — `SessionStart` context injection, and `Stop`/`SubagentStop` learn/memory
+capture, the same `geneseed-hook` subcommands the OpenCode plugins drive). Bob's hook execution is **unverified**:
 if Bob honours Claude-shaped hooks they fire; if not, they are inert and the
 harness still works fully through the `AGENTS.md`/`rules` preamble prose. This is
 the same behaviour-contract parity every non-OpenCode host gets — the mechanism

package/adapters/claude-code/README.md

@@ -14,8 +14,10 @@ bin/geneseed-hook.mjs …` — so at user scope they would fire and fail in ever
 repo that doesn't vendor the harness. A generated global install wires
 absolute-path hooks instead — `geneseed setup` does that for you.) It:
 
-- on **PreToolUse** (matcher `Bash`), runs `harness git-gate` — a tool-boundary
-  backstop for Rule XX (*consent before every commit and push*). The hook inspects the
+- on **PreToolUse** (matcher `Bash`), **on an install that built the `process` pack in**,
+  runs `harness git-gate` — the tool-boundary half of Doctrine process 5 (*consent before
+  every commit and push*). Drop that pack and this hook is not written at all; the
+  invariant-territory refusals (`rm -rf`, force-push) stay in every build. The hook inspects
   command and, when it runs a `git commit` or `git push` (bare, flagged, `-C <path>`,
   or chained like `git add . && git commit … && git push`), returns
   `permissionDecision: "ask"` so Claude Code **prompts on every such call**. Crucially
@@ -31,7 +33,7 @@ absolute-path hooks instead — `geneseed setup` does that for you.) It:
   doesn't recognise as a commit/push, so over-matching the tool surface is harmless.
 - on **SessionStart** (`startup`/`clear` only — a fresh context), prints `AGENT.md`
   so the harness is in context from the first turn, then runs `harness context` to
-  **inject the project context** directly into the session — so Rule XVIII is enforced
+  **inject the project context** directly into the session — so the project-context load is
   by the hook, not left to the agent to remember (lazy entries are only listed). On
   **`resume`** it runs `harness context` *without* re-`cat`ting `AGENT.md`: the resumed
   conversation already carries the harness, so re-injecting the static file each resume
@@ -59,7 +61,7 @@ absolute-path hooks instead — `geneseed setup` does that for you.) It:
 Adjust the paths if your harness bundle is not at the repository root. On Windows
 the commands are identical (`node bin/geneseed-hook.mjs …`).
 
-Why inject rather than instruct? Rule XVIII tells the agent to read the project
+Why inject rather than instruct? The constitution tells the agent to read the project
 context at startup, but startup rituals are exactly what agents skip. The
 `harness context` hook removes the choice: the eager files' contents land in
 context before the first turn regardless of agent discipline. On tools without

package/adapters/claude-code/skills/geneseed/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: geneseed
-description: "Interact with a deployed Geneseed harness from any repo — locate the install, read its laws/agents/skills/memory/notebook by name, run status/doctor/diff, distill memory with learn, and manage the local web UI. Use when the user mentions Geneseed, AGENT.md, the harness, an agent operating system, or asks you to inspect, refresh, or read from the deployed bundle."
+description: "Interact with a deployed Geneseed harness from any repo — locate the install, read its ontology/rules/doctrines/agents/skills/memory/notebook by name, run status/doctor/diff, distill memory with learn, and manage the local web UI. Use when the user mentions Geneseed, AGENT.md, the harness, an agent operating system, or asks you to inspect, refresh, or read from the deployed bundle."
 ---
 
 # geneseed — agent skill
 
-Geneseed is a portable AI-agent harness deployed once and used everywhere. This skill lets you talk to whichever deployment is in scope from any repo: read the canonical files (laws, agents, skills, memory, notebook), probe state (status, version, doctor, diff), distill durable memory, and drive the local web UI. The harness is theme-independent in structure — directory and section names are always plain English — so the paths below are stable across themes.
+Geneseed is a portable AI-agent harness deployed once and used everywhere. This skill lets you talk to whichever deployment is in scope from any repo: read the canonical files (the three constitution tiers, agents, skills, memory, notebook), probe state (status, version, doctor, diff), distill durable memory, and drive the local web UI. The harness is theme-independent in structure — directory and section names are always plain English — so the paths below are stable across themes.
 
 ## Find the deployed harness before doing anything
 
@@ -19,7 +19,9 @@ Pick the first that resolves; remember the path for the rest of the session.
 
 If none resolve, the user does not have Geneseed deployed here — say so and stop. Do not run `setup`, `build`, or `upgrade` on your own to "fix" this; that is a user decision.
 
-A live harness root contains: `AGENT.md`, `agents/<name>.md`, `skills/<name>/SKILL.md`, `memory/MEMORY.md`, `notebook/NOTEBOOK.md`, `themes/`, and (on OpenCode) `plugins/`, `workflows/`, `opencode.jsonc`, `wiki.jsonc`. Laws live as numbered sections inside `AGENT.md`, not as separate files in the deployed bundle — read them from `AGENT.md` directly.
+A live harness root contains: `AGENT.md`, `ontology/universal.md`, `laws/universal.md`, `doctrines/<pack>.md`, `agents/<name>.md`, `skills/<name>/SKILL.md`, `memory/MEMORY.md`, `notebook/NOTEBOOK.md`, `themes/`, and (on OpenCode) `plugins/`, `workflows/`, `opencode.jsonc`, `wiki.jsonc`.
+
+The constitution is **three tiers**: an always-on **Ontology** (four prose sections — Telos, Evidence, Decisions, Conduct), nine always-on **Rules** numbered I–IX, and the **Doctrines** — practice packs (`craft`, `rigor`, `ops`, `process`) chosen per install at build time. `AGENT.md` carries all three inline (whole at the `full` footprint, heading-plus-first-line at `lean`), *and* the complete text ships as files beside it. All four pack files ship even when a pack was not built in, so a citation into an inactive pack still resolves on disk — which is why a question about a rule is answered from the tier file, never only from `AGENT.md`.
 
 ## Read-only verbs (safe, no confirmation needed)
 
@@ -32,11 +34,13 @@ A live harness root contains: `AGENT.md`, `agents/<name>.md`, `skills/<name>/SKI
 - **Read a specific piece** — read the file directly:
   - Agent by name: `<harness>/agents/<name>.md`
   - Skill by name: `<harness>/skills/<name>/SKILL.md`
-  - Law by number: section `## N. …` inside `<harness>/AGENT.md`
+  - Ontology section by name: `<harness>/ontology/universal.md` — `#### Telos` / `Evidence` / `Decisions` / `Conduct` (theme-independent names)
+  - Rule by numeral I–IX: `<harness>/laws/universal.md` — heading `### <Rule-noun> <ROMAN> — <title>`
+  - Doctrine rule by pack and number: `<harness>/doctrines/<pack>.md` — heading `### <Doctrine-noun> <pack> <n> — <title>`
   - Memory fact: `<harness>/memory/<file>.md`; index at `MEMORY.md`
   - Notebook entry: `<harness>/notebook/<file>.md`; index at `NOTEBOOK.md`
 
-When the user asks "what does the X skill say" or "what's law VI", read the file directly — do not summarise from memory.
+When the user asks "what does the X skill say", "what's Rule VI" or "what does Doctrine process 5 say", read the file directly — do not summarise from memory.
 
 ## Side-effecting verbs (confirm with the user first)
 
@@ -59,7 +63,7 @@ If the user asks for any of these, run them as requested. Do not run them as a s
 ## Common patterns
 
 - **"What harness do I have here?"** — `geneseed status` (if launcher on PATH); else resolve via the fallback list and report theme, install mode, path, and version.
-- **"What does the `<X>` skill / agent / law say?"** — read the file directly. For laws, grep `AGENT.md` for `## N\.` or `Law N`.
+- **"What does the `<X>` skill / agent / rule say?"** — read the file directly. A Rule is `### <Rule-noun> <ROMAN> —` in `laws/universal.md`; a doctrine rule is `### <Doctrine-noun> <pack> <n> —` in `doctrines/<pack>.md`; an ontology section is `#### <Name>` in `ontology/universal.md`. The tier noun is themed, the address never is.
 - **"Show me what's drifted in my install."** — `geneseed diff`. Offer to write the output to a file (`--out`) if it's long.
 - **"Distill what we did today into memory."** — confirm scope, then `geneseed learn`. Afterwards, `git status` inside the harness dir to show what landed.
 - **"Open the dashboard / web UI."** — `geneseed web start`. Tell the user the URL it printed and that it binds to localhost only.

package/adapters/copilot/README.md

@@ -43,12 +43,12 @@ page is mostly about *what it does not automate* and why the harness still holds
 Copilot has **no `settings.json` and no lifecycle-hook mechanism**, so the whole
 settings/hooks/excludes stage is skipped. Concretely, Copilot does **not** get:
 
-- **automated context injection** — Rule XVIII's project-context load falls back
+- **automated context injection** — the project-context load falls back
   to the preamble instructing the agent to read the docs itself;
 - **automated memory / learn write-back** — no `Stop`/`SubagentStop` hook; the
   memory convention rides the preamble's instructions (the agent writes its own
   memories) rather than a session-end distiller;
-- **the git-gate consent backstop** — Rule XX (*consent before every commit and
+- **the git-gate consent backstop** — Doctrine process 5 (*consent before every commit and
   push*) is enforced by the **preamble prose only**, not at the tool boundary.
   There is no hook to force the prompt;
 - **sovereign-repo excludes** — Copilot documents no exclude/shadow mechanism
@@ -58,8 +58,9 @@ settings/hooks/excludes stage is skipped. Concretely, Copilot does **not** get:
   installs already exist.
 
 None of this is a build gap — it is Copilot's ceiling. The harness still applies
-in full: every Rule, agent, and skill is present; only the *automation* of a few
-Rules degrades to instruction-only. This is behaviour-contract parity, the same
+in full: the Ontology, every Rule, every doctrine rule the install built in, and
+every agent and skill are present; only the *automation* of a few of them degrades
+to instruction-only. This is behaviour-contract parity, the same
 principle every non-OpenCode host follows.
 
 ## MCP

package/adapters/opencode/GLOBAL-HARNESS-SPEC.md

@@ -190,7 +190,7 @@ enforcement paths read the same. Adds a machine marker (first line) for §4.
 
 ```
 <!-- geneseed-context:v2 -->
-=== PROJECT CONTEXT — binding for this repo per Law XVIII ===
+=== PROJECT CONTEXT — binding for this repo ===
 
 ----- <path> — <description> -----
 <full file contents, trailing newlines stripped>
@@ -204,7 +204,7 @@ enforcement paths read the same. Adds a machine marker (first line) for §4.
   - [demoted: README.md exceeded 16 KB — read on demand]
 ```
 
-- Header keeps the exact `=== PROJECT CONTEXT … Law XVIII ===` wording.
+- Header keeps the exact `=== PROJECT CONTEXT — binding for this repo ===` wording.
 - A `MISSING` eager file emits `[context] MISSING eager file: <err>` inline (as today).
 - The `<!-- geneseed-context:v2 -->` marker is the idempotency sentinel.
 
@@ -269,12 +269,17 @@ exactly one copy and the setup guide (§10) removes project copies. Document thi
 
 ---
 
-## 8. Fallback Law (for tools without the plugin)
+## 8. Fallback rule (for tools without the plugin)
 
-Add to the universal laws so non-OpenCode tools and uncovered repos still get
-project context — the *instruction* tier behind the *injection* tier:
+⚠ HISTORICAL. This was written when the corpus was a flat, open-ended list of laws.
+It is not one now: the invariants are a closed set of nine, and project-context
+discovery is one of the two old laws absorbed into AGENT.md's own **§9 Context**
+section, which every build carries as prose. Nothing an adapter spec writes is
+added to the invariants. The text below survives as the *instruction* tier behind
+the *injection* tier, and `{{DOCTRINE}} process 4` (Read the Docs First) is its
+nearest live citation:
 
-> **Law (Project Context Discovery).** When project context has not already been
+> **Rule (Project Context Discovery).** When project context has not already been
 > injected, before substantive work read the repo's agent-directed rules and entry
 > docs — `AGENTS.md`/`AGENT.md`/`CLAUDE.md`, root `README.md`, and any `.harness/`
 > manifest — and treat `docs/`, `adr/`, and architecture notes as lazy: consult

package/adapters/opencode/HOW-OPENCODE-LOADS.md

@@ -30,7 +30,7 @@ rules. It accepts:
 - globs (`"laws/*.md"`),
 - URLs.
 
-Geneseed points it at the bundle's **`AGENT.md`** (which inlines the laws). That is
+Geneseed points it at the bundle's **`AGENT.md`** (which inlines all three constitution tiers — the Ontology, the nine Rules and the active doctrine packs; at the default `lean` footprint the rules are heading-plus-first-line, with the complete text in `ontology/`, `laws/` and `doctrines/` beside it). That is
 all you need there — the rest of the harness is loaded by the plugins below.
 
 ## 3. Plugins — event-driven JS/TS