geneseed 2.1.0 → 3.1.0

package/js/settings.mjs

@@ -67,17 +67,120 @@ function isDict(v) {
   return Boolean(v) && typeof v === 'object' && !Array.isArray(v);
 }
 
-/** `_build_settings._default_permission`. */
-export function defaultPermission() {
-  return {
-    bash: {
-      'rm -rf *': 'ask',
-      'git commit*': 'ask',
-      'git push*': 'ask',
-      'git push --force*': 'ask',
-      'git push -f*': 'ask',
-    },
-  };
+/**
+ * Is the `process` doctrine pack active for the install being emitted?
+ *
+ * ⚠ FAIL CLOSED, and the shape of the test is the whole point. Anything that is not an
+ * explicit array — `null`, `undefined`, a caller that never learned about packs — means
+ * "unknown", and unknown keeps the consent gate wired. `doctrinesOfDir` returns exactly that
+ * `null` for a pre-migration install, and `d?.includes('process')` would read it as "off" and
+ * silently unwire the gate from every carrier on disk. An empty array is NOT unknown: it is a
+ * deliberate `--doctrines none`, and it turns the gate off.
+ */
+const processPackOn = (d) => !Array.isArray(d) || d.includes('process');
+
+/**
+ * `_build_settings._default_permission`.
+ *
+ * WHAT THE PACK TOGGLE REACHES AND WHAT IT MUST NOT. `git commit*` and `git push*` are the
+ * BOUNDARY HALF of doctrine process 5 (consent before recording or sharing); with the process
+ * pack off, that rule is no longer binding — its text is not rendered into the carrier's
+ * doctrine section — and a boundary that keeps asking for a rule the install did not adopt is
+ * the one disagreement the tiering is not allowed to produce. (It does NOT follow that the
+ * string is gone from the bundle; see `claudeHookGroups` for what D5 ships anyway and why.)
+ * `rm -rf *`, `git push --force*` and `git push -f*` stay in EVERY build: they are
+ * Law IV's territory — an always-on invariant — not the process pack's, and the guard
+ * plugin's own force-push arm is unconditional for the same reason.
+ */
+export function defaultPermission(doctrines = null) {
+  const bash = { 'rm -rf *': 'ask' };
+  if (processPackOn(doctrines)) {
+    bash['git commit*'] = 'ask';
+    bash['git push*'] = 'ask';
+  }
+  bash['git push --force*'] = 'ask';
+  bash['git push -f*'] = 'ask';
+  return { bash };
+}
+
+/**
+ * Every `permission.bash` key Geneseed has ever written — the OWNED set, which is not the same
+ * as the set `defaultPermission` returns for a given selection. The two process-pack keys are
+ * in it whether or not this build wants them, because reconciling an EXISTING opencode.json
+ * has to be able to recognise a key that is Geneseed's business at all — to add it back when
+ * the pack returns, and to name it when this build no longer wants it but will not remove it.
+ */
+const OWNED_BASH = ['rm -rf *', 'git commit*', 'git push*', 'git push --force*', 'git push -f*'];
+
+/**
+ * Bring an ALREADY-WRITTEN `permission` block back into line with the pack selection, and
+ * touch nothing else. Returns `[changed, stranded]` — whether anything moved, and the owned
+ * keys this build does NOT want but refuses to take away.
+ *
+ * ⚠ THIS IS THE FIX FOR A BOUNDARY FROZEN AT FIRST WRITE. `mergeOpencodeJson` used to add the
+ * whole block only when the key was absent, so on a file that already had one the git gate was
+ * whatever the FIRST emit happened to write, forever — and the direction that matters is
+ * turning the process pack back ON, which left the gate ABSENT while AGENT.md stated the rule.
+ * That direction is pure ADDITION and it is fixed here. Claude's side never had the hole;
+ * `mergeClaudeSettings` prunes and re-adds its managed groups on every emit, because that file
+ * has a MANAGED BLOCK and this one does not.
+ *
+ * ⚠ REMOVAL IS GUARDED BY OWNERSHIP, NOT BY VALUE — and this is the second thing the first cut
+ * got wrong. `opencode.json` is USER CO-OWNED: the WIRE stage reconciles it, it does not own
+ * it. Geneseed may take back an entry it wrote; it may never take back one the user wrote.
+ * Dropping every unwanted key that still read `'ask'` treated the VALUE as the ownership
+ * record, so a user who had typed their own `"git commit*": "ask"` — a perfectly ordinary
+ * thing to want, and the value Geneseed writes precisely because it is the obvious one — had
+ * it DELETED by a pack-off build.
+ *
+ * NOTHING ON DISK RECORDS PROVENANCE, and none of the candidates survived contact: the value
+ * is what a user would write too; the carrier's `Active packs:` marker is rewritten by this
+ * same emit BEFORE `mergeOpencodeJson` runs (`emitOpencodeGlobalRender` writes AGENT.md at the
+ * top and wires the config at the bottom), so it answers with the NEW selection and would
+ * licence every removal; and a per-install ownership record would be a new marker file joining
+ * the owned set, the reversal markers and the deletion corpus — a much larger change than the
+ * defect. So removal is CONSERVATIVE: an unwanted owned key that is already on disk stays, and
+ * is reported to the caller as `stranded` so the user is told rather than left to discover it.
+ *
+ * That leaves a gate wired for a rule this build does not make binding, which is the
+ * FAIL-CLOSED direction — the boundary asks for a confirmation the constitution no longer
+ * compels, exactly as the commit skill's own consent step does with the pack off. The unsafe
+ * direction, a rule with no gate behind it, cannot occur here. A FRESH file is unaffected:
+ * `mergeOpencodeJson` writes `defaultPermission(doctrines)` whole, so a new pack-off install
+ * has no git gate at all.
+ *
+ * ⚠ KEY ORDER IS NOT RECONCILED, DELIBERATELY. `defaultPermission` emits its keys in a fixed
+ * order, so a FRESH write is tidy; an off→on reconcile appends the two process keys after the
+ * force-push pair and the block reads out of order from then on. Restoring the order means
+ * rewriting a map whose other entries belong to the user — sorting THEIR keys to tidy OURS is
+ * the value-over-ownership mistake in a second suit, and JSON object order carries no meaning
+ * to OpenCode. So the order is left as found and only membership is reconciled.
+ *
+ * Returns a third element, `opaque`: the shape reason wiring was impossible, or `null`. The
+ * caller warns on it. This is the one branch where the boundary can end up with NO Geneseed
+ * gate at all while the constitution states the rule — the unsafe direction — so it must not
+ * also be the silent one.
+ */
+function reconcileOpencodePermission(perm, want) {
+  // A `permission` that is not an object, or whose `bash` is not one — OpenCode also accepts a
+  // bare `"bash": "allow"` — is a shape this function has no owned keys inside of. Leaving it
+  // exactly as found is the whole point; rewriting it into a map would DELETE a blanket policy
+  // the user wrote, which is a bigger change than the one being reconciled.
+  if (!isDict(perm)) return [false, [], 'is not an object'];
+  if (has(perm, 'bash') && !isDict(get(perm, 'bash'))) {
+    return [false, [], 'has a "bash" that is not an object'];
+  }
+  const fresh = !has(perm, 'bash');
+  const bash = fresh ? {} : get(perm, 'bash');
+  let changed = false;
+  const stranded = [];
+  for (const k of OWNED_BASH) {
+    if (has(want.bash, k)) {
+      if (!has(bash, k)) { bash[k] = want.bash[k]; changed = true; }
+    } else if (has(bash, k)) stranded.push(k);
+  }
+  if (changed && fresh) perm.bash = bash;
+  return [changed, stranded, null];
 }
 
 /**
@@ -170,16 +273,27 @@ export function readJsonc(text) {
   }
 }
 
-/** `_build_settings._warn_commented_jsonc`. Prints to STDOUT — the Python's own choice. */
-export function warnCommentedJsonc(target, agentPath, includePermission,
-  includeLsp = false, prefix = 'geneseed') {
+/**
+ * `_build_settings._warn_commented_jsonc`. Prints to STDOUT — the Python's own choice.
+ *
+ * `permission` is THREE-STATE, not a boolean: `'add'` for a file with no `permission` key,
+ * `'reconcile'` for one that has a block this build would have wired gates into, and falsy for
+ * neither. A commented `.jsonc` is never rewritten — that is what "your edits are kept" buys —
+ * so the only thing this branch can do about a stale block is SAY SO, and telling a file that
+ * already has a `permission` key to add one is not saying so. Any other truthy value is read as
+ * `'add'`, which is what the boolean callers this replaced meant.
+ */
+export function warnCommentedJsonc(target, agentPath, permission,
+  includeLsp = false, prefix = 'geneseed', doctrines = null) {
   process.stdout.write(`[${prefix}] ${path.basename(target)} has comments — not rewriting `
     + 'it (your edits are kept). Add this to its "instructions" array by hand:\n');
   process.stdout.write(`[${prefix}]     ${jsonDumps(agentPath)}\n`);
-  if (includePermission) {
-    process.stdout.write(`[${prefix}] and, for Geneseed's default ask-gates, a `
-      + '"permission" key:\n');
-    for (const line of jsonDumpsIndent(defaultPermission()).split('\n')) {
+  if (permission) {
+    process.stdout.write(permission === 'reconcile'
+      ? `[${prefix}] and its "permission".bash is missing gates this build wires — `
+        + 'reconcile it by hand against:\n'
+      : `[${prefix}] and, for Geneseed's default ask-gates, a "permission" key:\n`);
+    for (const line of jsonDumpsIndent(defaultPermission(doctrines)).split('\n')) {
       process.stdout.write(`[${prefix}]     ${line}\n`);
     }
   }
@@ -208,7 +322,7 @@ export function atomicWriteJson(p, config) {
  * re-implements the inverse itself rather than inherit this one's permission/lsp side
  * effects, so the only crossings are the two emit-tree ones (`_build_emit.emit_opencode`,
  * `_build_global.emit_opencode_global`). */
-export function mergeOpencodeJson(p, agentPath) {
+export function mergeOpencodeJson(p, agentPath, doctrines = null) {
   const target = opencodeTarget(p);
   let config = { $schema: OPENCODE_SCHEMA, instructions: [] };
   let hadComments = false;
@@ -239,13 +353,58 @@ export function mergeOpencodeJson(p, agentPath) {
   const addInstr = indexOfEq(instr, agentPath) < 0;
   if (addInstr) instr.push(agentPath);
   config.instructions = instr;
+  // Absent ⇒ write the whole block; present ⇒ reconcile Geneseed's own git keys. Adding is
+  // unconditional; removal is not this stage's to make (see `reconcileOpencodePermission`), so
+  // the second return value is what it declined to take away. `addPerm` stays a separate flag
+  // from "something changed" because the two produce DIFFERENT advice on a commented file.
   const addPerm = !has(config, 'permission');
-  if (addPerm) config.permission = defaultPermission();
+  let permChanged = addPerm;
+  let stranded = [];
+  let opaque = null;
+  if (addPerm) config.permission = defaultPermission(doctrines);
+  else {
+    [permChanged, stranded, opaque] = reconcileOpencodePermission(get(config, 'permission'),
+      defaultPermission(doctrines));
+  }
+  // The shape said no. This is the direction the residue warning above is NOT — a rule stated
+  // in AGENT.md with nothing behind it — and it used to pass in silence, because a blanket
+  // `"permission": {"bash": "allow"}` makes every reconcile a no-op and the whole merge then
+  // short-circuits before any of the three WARNs below. Reported, never rewritten: the blanket
+  // policy is the user's answer and it wins (`generate.test.mjs` pins that it survives).
+  if (opaque) {
+    process.stderr.write(`[geneseed] WARN: "permission" in ${path.basename(target)} `
+      + `${opaque}, so Geneseed cannot wire its own gates into it — including `
+      + `${OWNED_BASH.filter((k) => has(defaultPermission(doctrines).bash, k))
+        .map((k) => jsonDumps(k)).join(', ')}. Your policy is left exactly as written; the `
+      + 'harness states those rules but nothing enforces them at this boundary.\n');
+  }
+  // Told, not silently left: these are gates for a rule this build does not make binding, kept
+  // because Geneseed cannot prove it was the one that wrote them. stderr, like the other two
+  // WARNs here — the emit's stdout is byte-compared by the golden corpus.
+  if (stranded.length) {
+    process.stderr.write(`[geneseed] WARN: ${path.basename(target)} keeps `
+      + `${stranded.map((k) => jsonDumps(k)).join(', ')} under "permission".bash — the `
+      + 'doctrine pack behind those gates is off in this build, but Geneseed cannot tell its '
+      + 'own entry from one you wrote, so it removes neither. Delete them by hand if you want '
+      + 'them gone.\n');
+  }
   const addLsp = !has(config, 'lsp');
   if (addLsp) config.lsp = true;
-  if (!addInstr && !addPerm && !addLsp) return target;
+  if (!addInstr && !permChanged && !addLsp) return target;
   if (path.extname(target) === '.jsonc' && hadComments) {
-    warnCommentedJsonc(target, agentPath, addPerm, addLsp);
+    // ⚠ THE TWO CASES GIVE OPPOSITE ADVICE, and telling a file that HAS a `permission` key to
+    // add one is how the first cut of this got it wrong. `add` = there is no block, here is the
+    // whole one; `reconcile` = there is a block and it is missing gates this build wires, and
+    // this branch cannot write them because rewriting would drop the user's comments.
+    //
+    // DECIDED, NOT DEFERRED: a commented `.jsonc` is never rewritten and never will be. A
+    // comment-preserving JSONC writer is a parser, an AST and a printer — a dependency-free
+    // one, since this package ships zero — to keep formatting nobody asked us to touch, in a
+    // file Geneseed co-owns rather than owns. The advice above is the whole remedy: the exact
+    // block to paste, split by which of the two situations the reader is actually in. It is
+    // stdout, not stderr, because on this path the paste-in IS the output.
+    warnCommentedJsonc(target, agentPath, addPerm ? 'add' : (permChanged && 'reconcile'),
+      addLsp, 'geneseed', doctrines);
     return target;
   }
   try {
@@ -508,8 +667,38 @@ export function hookPrefix({ runner, entry, platform = process.platform } = {})
   return `"${runner}" "${entry}"`;
 }
 
-/** `_build_settings._claude_hook_groups` — Geneseed's Claude hooks, keyed by event. */
-export function claudeHookGroups(cfg, hookOpts) {
+/**
+ * `_build_settings._claude_hook_groups` — Geneseed's Claude hooks, keyed by event.
+ *
+ * ⚠ `doctrines` IS WHERE PROMPT AND BOUNDARY ARE KEPT IN AGREEMENT. The `git-gate` group is
+ * the tool-boundary half of doctrine process 5. With the process pack off, that rule is no
+ * longer BINDING — `src/doctrines/process.md` is not rendered into the carrier's doctrine
+ * section and nothing in the constitution obliges the agent to it — so a gate that stopped
+ * every Bash call to ask for consent to a rule the install did not adopt is the disagreement
+ * the three-tier split forbids. Omitting the group here is also what UNWIRES it from an
+ * install that had it: `mergeClaudeSettings` prunes every previously-managed group that is not
+ * in this return value, so flipping the pack off and rebuilding takes the hook out of
+ * settings.json rather than leaving it orphaned.
+ *
+ * ⚠ WHAT THIS DOES **NOT** CLAIM, because it was written here once and it was false: that the
+ * string `process 5` is absent from a pack-off bundle. It is not — 18 emitted files still cite
+ * it (`grep -rl 'process 5' <off-bundle>`), and by owner decision D5 that is deliberate: the
+ * whole pack CATALOGUE ships in every build (`<bundle>/doctrines/process.md` is byte-identical
+ * on and off), so body-prose citations from craft, from the agents and from the skills stay
+ * RESOLVABLE rather than dangling. A citation is not an obligation.
+ *
+ * The one place that distinction is thin is `skills/commit.md`, which carries the operative
+ * procedure ("get explicit consent before committing") and not merely a pointer. It is left
+ * unconditional ON PURPOSE: a skill that asks before committing when nothing compelled it is
+ * never unsafe, whereas conditionalising it would put a second copy of the pack switch in the
+ * prose layer for no gain in safety. Asymmetric risk, asymmetric answer — the BOUNDARY follows
+ * the pack, the ASKING does not have to.
+ *
+ * The `rule-gate` group stays in every build. Its subject is which durable store a write
+ * belongs in — the user's call — not how work is run, so it is not the process pack's to
+ * remove. `default` here means unknown, and unknown keeps the gate (see `processPackOn`).
+ */
+export function claudeHookGroups(cfg, hookOpts, doctrines = null) {
   const run = hookPrefix(hookOpts);
   const mem = `--memory "${path.join(cfg, 'memory')}"`;
   // --root carries the install's own dir so a GLOBAL hook can stand down when a project
@@ -520,7 +709,8 @@ export function claudeHookGroups(cfg, hookOpts) {
   const learn = `${run} learn ${mem} || exit 0`;
   return {
     PreToolUse: [
-      { matcher: 'Bash', hooks: [{ type: 'command', command: gate }] },
+      ...(processPackOn(doctrines)
+        ? [{ matcher: 'Bash', hooks: [{ type: 'command', command: gate }] }] : []),
       {
         matcher: 'Write|Edit|MultiEdit|NotebookEdit',
         hooks: [{ type: 'command', command: ruleGate }],
@@ -550,7 +740,8 @@ export function claudeHookGroups(cfg, hookOpts) {
  *
  * `scope` is accepted and unused, exactly as in the Python.
  */
-export function mergeClaudeSettings(p, scope = 'global', priorHooks = null, hookOpts = {}) {
+export function mergeClaudeSettings(p, scope = 'global', priorHooks = null, hookOpts = {},
+  doctrines = null) {
   const prior = (priorHooks || []).filter(isDict);
   let config = {};
   let hadComments = false;
@@ -570,7 +761,7 @@ export function mergeClaudeSettings(p, scope = 'global', priorHooks = null, hook
   }
   let hooks = get(config, 'hooks');
   if (!isDict(hooks)) hooks = {};
-  const canonical = claudeHookGroups(path.dirname(p), hookOpts);
+  const canonical = claudeHookGroups(path.dirname(p), hookOpts, doctrines);
   const canonFlat = [];
   for (const [event, groups] of Object.entries(canonical)) {
     for (const g of groups) canonFlat.push({ event, group: g });

package/js/setup.mjs

@@ -46,7 +46,7 @@ import path from 'node:path';
 
 import { main as driverMain, resolveOut } from '../bin/geneseed.mjs';
 import { playLine } from './anim.mjs';
-import { discoverNames } from './checkout.mjs';
+import { discoverNames, PACK_ORDER } from './checkout.mjs';
 import { exportImprovements } from './diff.mjs';
 import { cmdDoctor } from './doctor.mjs';
 import { setupBuildArgs } from './generate.mjs';
@@ -211,6 +211,23 @@ const MODE_BLURBS = {
   foreman: 'triages tasks, spawns pipelines for substantial work',
 };
 
+/**
+ * One line per doctrine pack, written for someone who has never read `src/doctrines/README.md`
+ * — this is the only description of a pack an installer ever sees.
+ *
+ * `process` says what turning it OFF costs, and it is the only one that has to. The other three
+ * trade practices for context; process 5 is the commit/push consent gate, so dropping the pack
+ * drops the rule that every commit and every push is asked for. A blurb that read "planning and
+ * context economy" would have sold that away in a menu.
+ */
+const DOCTRINE_BLURBS = {
+  craft: 'how code is written — reuse first, house conventions, docs, the smallest diff',
+  rigor: 'how work is proven — idempotence, honest tests, coverage, gates that can fail',
+  ops: 'how the machine is driven — tool discovery, non-blocking commands, teardown',
+  process: 'how a session runs — planning, context economy, docs first, and the consent gate '
+    + 'on every commit and push (drop this pack and that gate goes with it)',
+};
+
 /**
  * `_harness_setup._theme_options`.
  *
@@ -243,6 +260,20 @@ export function modeOptions() {
   return discoverNames('modes', 'direct').map((n) => [n, MODE_BLURBS[n] ?? '']);
 }
 
+/**
+ * The doctrine packs, in `PACK_ORDER` — the third option table, and the one that is a SET.
+ *
+ * The order is NARRATIVE and comes from `PACK_ORDER`; `discoverNames` only says which packs
+ * this checkout actually ships. Ordering by discovery instead would read `craft, ops, process,
+ * rigor` — it `.sort()`s — and the menu a human answers would stop matching the `Active packs:`
+ * line the build writes, which is normalised into `PACK_ORDER` at the driver. Same intersection
+ * the driver's `parseDoctrines` and the config loader take, for the same reason.
+ */
+export function doctrineOptions() {
+  const known = discoverNames('doctrines', PACK_ORDER[0]);
+  return PACK_ORDER.filter((n) => known.includes(n)).map((n) => [n, DOCTRINE_BLURBS[n] ?? '']);
+}
+
 /**
  * `_harness_setup.EMIT_OPTIONS`.
  *
@@ -272,12 +303,60 @@ const FOOTPRINT_OPTIONS = [
 // --------------------------------------------------------------------------------------
 
 /**
- * `_harness_setup._collect_setup_lines` — the five questions, the plan, the confirm.
+ * The Doctrine-packs question — one `all`/`choose` gate, then a y/n per pack.
+ *
+ * TWO LEVELS RATHER THAN FOUR QUESTIONS, because the overwhelmingly common answer is "all of
+ * them" and a wizard that asks four yes/nos to get there taxes every install for the rare one.
+ * The gate's default is `all`, so an installer who holds Enter through the whole wizard gets
+ * the full set — which is what every pre-packs install already had.
+ *
+ * `askChoice` and not `confirm` for the per-pack question: `confirm` reads the first character
+ * and prints no description, so the pack's blurb — the only place a reader is told what the
+ * pack costs — would have nowhere to go. Two named options give it a line.
+ *
+ * Answering `no` to all four is legal and yields `[]`, which `setupBuildArgs` spells
+ * `--doctrines none`. That is a real configuration (invariants and ontology only), not a
+ * mistake to guard against, so it is not second-guessed here.
+ *
+ * `deployed` is what the machine's carriers already say (`installedDefaults().doctrines`), and
+ * it drives BOTH levels: a narrowed install opens on `choose` with its own packs pre-ticked,
+ * so holding Enter through the wizard KEEPS the selection instead of silently widening it back
+ * to all four. `null` — no carrier said — still opens on `all`, which is the same resolution
+ * `doctrinesForBuild` gives unknown, so the wizard and the build agree about silence.
+ *
+ * ⚠ It never returns `null`, at either level, and `tests/unit/setup.test.mjs` pins that: this
+ * is the one call site allowed to reach `setupBuildArgs` without a `doctrinesForBuild`
+ * fallback, and that exemption is only sound while the function is total.
+ */
+function askDoctrines(deployed = null) {
+  const opts = doctrineOptions();
+  const all = opts.map(([n]) => n);
+  const known = Array.isArray(deployed) ? all.filter((n) => deployed.includes(n)) : null;
+  const narrowed = known !== null && known.length !== all.length;
+  const pick = askChoice('Doctrine packs', [
+    ['all', `${all.join(' + ')}${narrowed ? '' : ' (default)'}`],
+    ['choose', `pick packs${narrowed ? ` (installed: ${known.join(', ') || 'none'})` : ''}`],
+  ], narrowed ? 'choose' : 'all');
+  if (pick !== 'choose') return all;
+  return all.filter((name) => askChoice(`Include ${name} — ${DOCTRINE_BLURBS[name] ?? name}`,
+    [['yes', `build ${name} into AGENT.md`], ['no', `leave ${name} out`]],
+    known === null || known.includes(name) ? 'yes' : 'no') === 'yes');
+}
+
+/**
+ * `_harness_setup._collect_setup_lines` — the six questions, the plan, the confirm.
  *
  * Returns the selection, or null when the confirm is declined. Every default is the
  * DEPLOYED value first (`installedDefaults`) and the CONFIGURED one second, which is why
  * P5i is the phase that had to give `installedDefaults` its posture, mode and footprint keys
  * back: three of the five questions read them.
+ *
+ * Doctrines reads the same walk, and joined it last because the `Active packs:` marker reader
+ * did not exist when the question shipped. Until it did, every re-run of the wizard offered
+ * `all` to an installer who had deliberately narrowed their packs — the one register where
+ * holding Enter SILENTLY WIDENED a selection instead of keeping it. `inst.doctrines` is passed
+ * whole, `null` included, because `askDoctrines` distinguishes "no carrier said" from "a
+ * carrier said none" and the two open the question differently.
  */
 export function collectSetupLines() {
   pyPrint('Geneseed setup — answer a few questions; nothing is written until you confirm.\n');
@@ -285,6 +364,7 @@ export function collectSetupLines() {
   const theme = askChoice('Theme', themeOptions(), inst.theme || defaultTheme());
   const posture = askChoice('Posture', postureOptions(), inst.posture || defaultPosture());
   const mode = askChoice('Mode', modeOptions(), inst.mode || defaultMode());
+  const doctrines = askDoctrines(inst.doctrines);
   const emit = askChoice('Install mode', EMIT_OPTIONS, inst.emit || 'opencode-global');
   const footprint = askChoice('Footprint', FOOTPRINT_OPTIONS.map(([k, d]) => [k, d]),
     inst.footprint || 'lean');
@@ -299,10 +379,15 @@ export function collectSetupLines() {
   } else if (emit === 'files') {
     out = ask('Output dir for the bundle', 'Harness');
   }
+  // The full pack list is passed as the elision default rather than left to `setupBuildArgs`'s
+  // own: the menu the user just answered was built from `doctrineOptions()`, so "they picked
+  // everything" must be judged against that same list, not against a second one.
+  const allPacks = doctrineOptions().map(([n]) => n);
   pyPrint(`\nAbout to run:  geneseed build ${
-    setupBuildArgs(theme, emit, out, root, footprint, posture, mode).join(' ')}\n`);
+    setupBuildArgs(theme, emit, out, root, footprint, posture, mode, doctrines, allPacks)
+      .join(' ')}\n`);
   if (!confirm('Proceed?', true)) return null;
-  return { theme, posture, mode, emit, out, root, footprint };
+  return { theme, posture, mode, doctrines, emit, out, root, footprint };
 }
 
 // --------------------------------------------------------------------------------------
@@ -441,6 +526,7 @@ export function setupLines() {
   }
   const {
     theme, emit, out, root, footprint = 'lean', posture = 'peer', mode = 'direct',
+    doctrines = null,
   } = sel;
   if (emit === 'opencode-global') {
     // The build below overwrites the deployed global harness, and the self-improvement loops
@@ -455,7 +541,11 @@ export function setupLines() {
       pyPrint(`! could not export local edits (${e && e.message}) — continuing.\n`);
     }
   }
-  const argv = setupBuildArgs(theme, emit, out, root, footprint, posture, mode);
+  // Same list the question was built from — see `collectSetupLines`. The build that actually
+  // runs must carry the pack selection the plan line just previewed, or the wizard would print
+  // one command and run another.
+  const argv = setupBuildArgs(theme, emit, out, root, footprint, posture, mode, doctrines,
+    doctrineOptions().map(([n]) => n));
   pyPrint(`Running:  geneseed build ${argv.join(' ')}\n`);
   const rc = driverMain(argv);
   if (rc !== 0) {

package/js/status.mjs

@@ -125,9 +125,24 @@ export function cmdVersion(args) {
  * it, and the eleven `status` cells and the catalog cells now gate the same classifier
  * from opposite ends.
  */
-export function inventoryCounts(themeName) {
-  const inv = tuiInventory(themeName);
-  return { agents: inv.agents.length, skills: inv.skills.length, laws: inv.laws.length };
+export function inventoryCounts(themeName, doctrines = null) {
+  const inv = tuiInventory(themeName, doctrines);
+  const on = inv.doctrines.filter((p) => p.active);
+  return {
+    agents: inv.agents.length,
+    skills: inv.skills.length,
+    laws: inv.laws.length,
+    ontology: inv.ontology.length,
+    // ⚠ THREE NUMBERS AND NOT ONE, because a pack-off install is a real configuration and
+    // "23 rules" would be a lie in it. `packs`/`packsTotal` is the fraction the console and
+    // the panel both print; `doctrineRules` counts only the ACTIVE packs' rules — what this
+    // install is actually bound by, not what its bundle happens to carry. The catalogue is
+    // always whole (every pack file ships), so the total is recoverable from `tuiInventory`
+    // by anything that needs it and is not duplicated here.
+    packs: on.length,
+    packsTotal: inv.doctrines.length,
+    doctrineRules: on.reduce((n, p) => n + p.rules.length, 0),
+  };
 }
 
 /**
@@ -163,7 +178,10 @@ export function statusData() {
   const inst = installedDefaults();
   const theme = inst.theme || defaultTheme();
   const mdir = resolveMemoryDir(null);
-  const inv = inventoryCounts(theme);
+  // `inst.doctrines` is what the machine's carriers say — `null` when none of them does, which
+  // `tuiInventory` reads as every pack, the same resolution `doctrinesForBuild` gives unknown.
+  // This is a DISPLAY read: nothing here decides what a build emits.
+  const inv = inventoryCounts(theme, inst.doctrines);
   let cfgDir = null;
   try { cfgDir = opencodeConfigDir(); } catch { cfgDir = null; }
   const sourceFp = sourceFingerprint(makeCfg());
@@ -189,6 +207,15 @@ export function statusData() {
     agents: inv.agents,
     skills: inv.skills,
     laws: inv.laws,
+    // ⚠ NAMED ONE BY ONE, AND THAT IS THE TRAP THIS FUNCTION SETS TWICE. `inv` is already
+    // `inventoryCounts`' reduction, and this literal names its keys again — so a count added
+    // to the inventory and not to BOTH places is dropped here in silence, with nothing to
+    // fail. There is deliberately no spread: the panel's payload is a stated contract, and
+    // `js/web/api.mjs` spreads THIS, so anything reaching that endpoint passes through here.
+    ontology: inv.ontology,
+    packs: inv.packs,
+    packs_total: inv.packsTotal,
+    doctrine_rules: inv.doctrineRules,
     memory_dir: mdir ? String(mdir) : null,
     facts: mdir ? memoryFactCount(mdir) : 0,
     source_fp: sourceFp,
@@ -248,6 +275,20 @@ export function statusLines(d, color = false) {
       + `(${d.facts} fact${d.facts === 1 ? '' : 's'})`],
     ['version', `${d.installed_fp || '(none)'}  ${DOT}  source ${d.source_fp}`],
   ];
+  // ⚠ A ROW, NOT A WIDER `components` LINE, AND THE REASON IS THAT THE CORPUS CANNOT BE
+  // RE-BLESSED. `statusLines` has 30 recorded cases per platform in
+  // `tests/__snapshots__/primitives/`, every one of them holding the box's exact bytes —
+  // including `17 agents · 47 skills · 37 laws` — and the recorder was Python and is gone.
+  // Touching `components` moves all 30; adding a row would too, since the box width is
+  // measured over `rows`. So the row is CONDITIONAL on a key the recorded arguments do not
+  // carry, exactly as `agent_md` below already is, and the recording renders unchanged.
+  //
+  // It carries the two tiers `components` cannot: `components` counts the invariants as
+  // `laws`, which is still true, and says nothing about the ontology or the packs.
+  if (d.packs_total !== undefined) {
+    rows.push(['constitution', `${d.ontology} ontology sections ${DOT} ${d.doctrine_rules} `
+      + `doctrine rules in ${d.packs}/${d.packs_total} packs`]);
+  }
   if (d.agent_md) {
     rows.push(['AGENT.md',
       `${d.agent_md}  (${d.agent_md_present ? 'present' : 'MISSING'})`]);

package/js/tui.mjs

@@ -246,6 +246,11 @@ const ICONS = {
   agent: ['🤖', '◆', '@'],
   skill: ['✨', '✦', '*'],
   law: ['📜', '§', '#'],
+  // The other two tiers. Safe to add: `icon` has 32 recorded cases and none of them names a
+  // key that did not exist, so a new entry changes no recorded answer — unlike `glyphs`,
+  // whose recorded results are the whole object and which is therefore left alone.
+  ontology: ['🧭', '◉', 'O'],
+  doctrine: ['📐', '⌘', 'D'],
   library: ['📚', '❒', 'L'],
   notebook: ['📓', '✎', 'N'],
   wiki: ['📘', '▥', 'W'],
@@ -387,14 +392,47 @@ export function themeFlair(theme) {
 /**
  * `_tui_entries` — the ordered (kind, label, data) rows for the left list. `head` is a
  * section divider and is not selectable.
+ *
+ * ⚠ THE TWO NEW TIERS ARE GUARDED, AND THE GUARD IS NOT DEFENSIVENESS. This function has two
+ * recorded cases per platform in `tests/__snapshots__/primitives/`, replayed under
+ * `deepStrictEqual`, and their argument is a synthetic inventory carrying exactly
+ * `{agents, skills, laws, theme}` — no recorder survives to re-bless them. Reading
+ * `inv.doctrines.length` there THROWS; emitting a head unconditionally changes the recorded
+ * result array. Keyed on presence, the recording renders byte-identical and a real inventory
+ * gets all three tiers.
+ *
+ * The order is CONSTITUTIONAL and not alphabetical: ontology, then invariants, then doctrines
+ * — the order they are read in, the order AGENT.md renders them, and the order the console's
+ * three bands appear in. `Rule` and `Doctrine` are hardcoded English here, as `Rule` already
+ * was: this function receives an inventory, not a theme's nouns.
  */
 export function tuiEntries(inv) {
   const rows = [['head', `AGENTS (${inv.agents.length})`, null]];
   for (const e of inv.agents) rows.push(['agent', e.name, e]);
   rows.push(['head', `SKILLS (${inv.skills.length})`, null]);
   for (const e of inv.skills) rows.push(['skill', e.name, e]);
+  if (inv.ontology?.length) {
+    rows.push(['head', `ONTOLOGY (${inv.ontology.length})`, null]);
+    for (const e of inv.ontology) rows.push(['ontology', e.title, e]);
+  }
   rows.push(['head', `LAWS (${inv.laws.length})`, null]);
   for (const e of inv.laws) rows.push(['law', `Rule ${e.num} — ${e.title}`, e]);
+  if (inv.doctrines?.length) {
+    // The head counts the ACTIVE packs' rules and names the fraction, because a pack that is
+    // not built in is still listed — greyed rather than absent, so "off" never looks like
+    // "gone" — and a head reading `DOCTRINES (23)` over an install bound by six would be the
+    // one number in this panel that lies.
+    const on = inv.doctrines.filter((p) => p.active);
+    const n = on.reduce((a, p) => a + p.rules.length, 0);
+    rows.push(['head',
+      `DOCTRINES (${n} in ${on.length}/${inv.doctrines.length} packs)`, null]);
+    for (const p of inv.doctrines) {
+      for (const r of p.rules) {
+        rows.push(['doctrine', `Doctrine ${r.pack} ${r.n} — ${r.title}`,
+          { ...r, active: p.active, source: p.source }]);
+      }
+    }
+  }
   return rows;
 }
 
@@ -420,7 +458,12 @@ export function tuiEntries(inv) {
  * the fix is one `or []` at the call site, and it belongs in the same change as the port.
  */
 export function detailLines(kind, label, data) {
-  if (kind === 'law') return [label, ''].concat(data ? pySplitLines(data.body) : []);
+  // The three constitutional tiers share one treatment — the label, a blank, then the body —
+  // because all three are a titled rule rather than a rendered spec. New kinds only: the nine
+  // recorded cases name kinds that already existed, so no recorded answer moves.
+  if (kind === 'law' || kind === 'doctrine' || kind === 'ontology') {
+    return [label, ''].concat(data ? pySplitLines(data.body) : []);
+  }
   if ((kind === 'agent' || kind === 'skill') && data) return pySplitLines(data.body);
   return null;
 }