geneseed 2.1.0 → 3.1.0

package/js/uninstall.mjs

@@ -50,7 +50,7 @@ import path from 'node:path';
 import { hookRunnerEntry } from '../bin/geneseed.mjs';
 import { confirm } from './setup.mjs';
 import {
-  claudeCfg, claudeReadManifest, emitHostScopeOf, installKind, installState,
+  claudeCfg, claudeReadManifest, doctrinesOfDir, emitHostScopeOf, installKind, installState,
   registeredTargets, readMaybe, DISABLED_STASH,
 } from './installs.mjs';
 import {
@@ -1013,15 +1013,27 @@ function cleanHostStash(cfg, host = 'claude') {
  * file and swallows its own OSError, exactly as the reference does — a failed bookkeeping
  * write must not fail the reactivate that has already moved every file back.
  */
-function remergeClaudeHooks(cfg) {
+function remergeClaudeHooks(cfg, root = cfg) {
   const data = claudeReadManifest(cfg);
   const managed = managedOf(data);
   // `hookOpts` is the one argument `mergeClaudeSettings` will not default, and it is right
   // not to: there is no computable fallback for the runner/entry the shim bakes. The
   // emitter's own originator is imported rather than restated — a reactivate that wired a
   // different shim path would point every re-added hook at a file the emitter never writes.
+  // The pack selection is read back off the reactivated carrier, not defaulted: a reactivate
+  // that re-wired the git-gate into an install whose owner had turned the process pack off
+  // would put the boundary back at odds with the prompt. `null` (no marker) keeps the gate.
+  //
+  // ⚠ THE CARRIER IS NOT ALWAYS UNDER `cfg`, WHICH IS WHY `root` IS A SECOND PARAMETER. On a
+  // PROJECT install `cfg` is `<repo>/.claude` and the carrier is `<repo>/CLAUDE.md`, so
+  // reading `cfg` alone answered `null` for every project reactivate and re-wired the gate
+  // unconditionally (fail-closed, so not a hole — but wrong, and it made the toggle one-way
+  // for project installs). `root` first, `cfg` second: copilot keeps its carrier INSIDE the
+  // config dir (`.github/copilot-instructions.md`), and on a global install the two are the
+  // same directory anyway. Both silent ⇒ `null` ⇒ the gate stays.
+  const doctrines = doctrinesOfDir(root) ?? doctrinesOfDir(cfg);
   const [, claims] = mergeClaudeSettings(settingsFile(cfg, managed), 'global',
-    managed.settings_hooks ?? null, hookRunnerEntry());
+    managed.settings_hooks ?? null, hookRunnerEntry(), doctrines);
   // `and data` — a manifest that did not parse is not one to write back.
   if (!pyEq(claims, managed.settings_hooks ?? null) && Object.keys(data).length > 0) {
     managed.settings_hooks = claims;
@@ -1106,7 +1118,7 @@ function claudeReactivate(root, scope = 'global', host = 'claude') {
       && isFile(path.join(cfg, 'rules', 'geneseed.md'));
   }
   if (relive) {
-    remergeClaudeHooks(cfg);   // ensure the hooks are present (and the claims exact)
+    remergeClaudeHooks(cfg, root);   // ensure the hooks are present (and the claims exact)
     cleanHostStash(cfg, host);
     return { ok: true,
       note: 'install was re-created while disabled; discarded the stashed snapshot' };
@@ -1126,12 +1138,19 @@ function claudeReactivate(root, scope = 'global', host = 'claude') {
     moved += 1;
   }
   if (leftovers.length) return { ok: false, failed: leftovers, moved };
-  remergeClaudeHooks(cfg);
   const managed = claudeReadManifest(cfg).managed || {};
-  wireClaudeExcludes(settingsFile(cfg, managed), managed.settings_excludes || []);
+  // ⚠ THE CARRIER IS RESTORED BEFORE THE HOOKS ARE RE-MERGED, AND THE ORDER IS LOAD-BEARING.
+  // `remergeClaudeHooks` reads the install's pack selection back off the carrier, and on a
+  // Claude-style host that selection lives inside the MANAGED BLOCK — which the deactivate
+  // stashed. Re-merging first therefore asked a CLAUDE.md with its block cut out, got `null`
+  // ("unknown"), and fail-closed straight back to the consent gate: every reactivate re-wired a
+  // git-gate the owner had turned off, in both scopes. The two writes touch different files
+  // (`CLAUDE.md` vs `settings*.json`), so nothing else depends on which goes first.
   if (existsSync(blockFile)) {
     managedBlockWrite(claudeMdPath(cfg, managed), readText(blockFile));
   }
+  remergeClaudeHooks(cfg, root);
+  wireClaudeExcludes(settingsFile(cfg, managed), managed.settings_excludes || []);
   cleanHostStash(cfg, host);
   return { ok: true, kind: host, moved };
 }

package/js/web/actions.mjs

@@ -104,7 +104,7 @@ import os from 'node:os';
 import path from 'node:path';
 
 import { emitGlobalInto } from '../../bin/geneseed.mjs';
-import { ROOT, discoverNames } from '../checkout.mjs';
+import { ROOT, discoverNames, PACK_ORDER } from '../checkout.mjs';
 import { withStdoutSwallowed } from '../diff.mjs';
 import { excludeAdd, excludeRemove } from '../excludes.mjs';
 import { setupBuildArgs } from '../generate.mjs';
@@ -114,8 +114,8 @@ import {
   pyResolve,
 } from '../hosts.mjs';
 import {
-  EMIT_HOST_SCOPE, footprintOfDir, installState, installTargets, modeOfDir, postureOfDir,
-  readMaybe,
+  EMIT_HOST_SCOPE, doctrinesForBuild, footprintOfDir, installState, installTargets, modeOfDir,
+  postureOfDir, readMaybe,
 } from '../installs.mjs';
 import {
   MCP_PRESETS, isDict, mcpApply, mcpCommented, mcpInstallTargets, mcpKnownNames, mcpLoad,
@@ -140,6 +140,36 @@ const bget = (body, key, dflt = null) => (isDict(body) && Object.hasOwn(body, ke
 /** `str(x or "")` — Python's truthiness, then Python's `str`. */
 const strOr = (v) => (pyTruthy(v) ? pyStr(v) : '');
 
+/**
+ * A request body's `doctrines` -> a normalised pack list, or `null` for "said nothing usable".
+ *
+ * THE SAME TRUST BOUNDARY THE THEME CROSSES, and it needs more care than posture or mode do
+ * because this value is a LIST: `discoverNames(...).includes(x)` closes a scalar in one call,
+ * but a list has to be closed member by member or one bogus element rides in beside three good
+ * ones and reaches an argv. Every name is checked against DISCOVERY — what this checkout
+ * actually ships — and the result is re-ordered through `PACK_ORDER`, because the
+ * `Active packs:` line the build writes is a marker that a later reader parses back out and a
+ * marker whose contents depend on request-body order compares unequal to itself.
+ *
+ * `null` rather than a substituted default on every rejection, so the caller decides what
+ * "unspecified" means for its own endpoint — a rebuild keeps the deployment's answer, a fresh
+ * deploy takes the configured one. That mirrors the bogus-theme fallback right beside it.
+ *
+ * Accepts an array (what the console sends) or a comma string (what a curl by hand sends), and
+ * `none`/`[]` both mean the deliberate empty selection — a real configuration, not a rejection.
+ */
+function bodyDoctrines(body) {
+  const raw = bget(body, 'doctrines');
+  if (Array.isArray(raw) && !raw.length) return [];
+  const names = Array.isArray(raw) ? raw
+    : (typeof raw === 'string' ? raw.split(',').map((s) => s.trim()).filter(Boolean) : null);
+  if (names === null || !names.length) return null;
+  if (names.length === 1 && names[0] === 'none') return [];
+  const known = discoverNames('doctrines', PACK_ORDER[0]);
+  if (!names.every((n) => typeof n === 'string' && known.includes(n))) return null;
+  return PACK_ORDER.filter((p) => names.includes(p));
+}
+
 /** `str.split()` with no argument — runs of PYTHON whitespace, no empties. */
 const pyWords = (s) => s.split(new RegExp(`[${PY_SPACE}]+`)).filter(Boolean);
 
@@ -702,6 +732,13 @@ export function apiRestore(state, files) {
       footprint: state.footprint,
       posture: state.posture,
       mode: state.mode,
+      // THE PACK SELECTION IS THE FIFTH, and it is the one that makes this verb a BOUNDARY
+      // question rather than a cosmetic one. `expected` rendered at all four packs, and this
+      // verb COPIES OUT OF IT: restoring AGENT.md onto an install built `--doctrines craft`
+      // wrote a carrier stating doctrine process 5 while `claudeHookGroups` had wired no gate
+      // behind it — prompt and boundary disagreeing by a WRITE, the write-side twin of the
+      // read-side hole `diffCollect` had (and the reason the panel offered the file at all).
+      doctrines: doctrinesForBuild(target),
     }));
     for (const raw of (pyTruthy(files) ? files : [])) {
       const rel = pyStripSpace(pyStr(raw).replace(/\\/g, '/')).replace(/^\/+/, '');
@@ -781,8 +818,15 @@ export function apiInstallCmd(state, body) {
   const bmode = bget(body, 'mode');
   const mode = discoverNames('modes', 'direct').includes(bmode)
     ? bmode : (modeOfDir(root) || 'direct');
+  // Unspecified means "keep what this install already has", exactly as theme, footprint,
+  // posture and mode above do — a rebuild through the console is not a place to silently
+  // re-decide the constitution. ⚠ AND A CARRIER WITH NO `Active packs:` MARKER (a pre-2.3
+  // install) MUST NOT LAND ON `harness.config.json`: `doctrinesOfDir` answers `null` there,
+  // `null` elided the flag, and the generator's config fallback then narrowed the install and
+  // took its consent gate with it. `doctrinesForBuild` resolves unknown to ALL packs.
+  const doctrines = bodyDoctrines(body) ?? doctrinesForBuild(root);
   const out = scope === 'global' ? null : String(root);
-  const argv = setupBuildArgs(theme || 'neutral', emit, out, out, fp, pos, mode);
+  const argv = setupBuildArgs(theme || 'neutral', emit, out, out, fp, pos, mode, doctrines);
   return { cmd: [process.execPath, path.join(ROOT, 'bin', 'geneseed.mjs'), ...argv] };
 }
 
@@ -878,7 +922,14 @@ export function apiDeployCmd(state, body) {
   const pos = discoverNames('postures', 'peer').includes(bpos) ? bpos : 'peer';
   const bmode = bget(body, 'mode');
   const mode = discoverNames('modes', 'direct').includes(bmode) ? bmode : 'direct';
+  // Same resolution as `apiInstallCmd` above, and for the same reason: the console's Deploy
+  // form sends host/path/theme/footprint/posture/mode and NO pack selection, and nothing stops
+  // it landing on a directory that already holds an install. Taking `bodyDoctrines` alone left
+  // the flag off, the generator fell back to `harness.config.json`, and deploying onto an
+  // existing all-four Claude install dropped it to one pack — measured: 6 hook groups became 5
+  // and `PreToolUse::Bash` went with them. `doctrinesForBuild` resolves unknown to ALL packs.
+  const doctrines = bodyDoctrines(body) ?? doctrinesForBuild(root);
   // project-scope emit name == host name (opencode / claude / bob / copilot)
-  const argv = setupBuildArgs(theme || 'neutral', host, root, root, fp, pos, mode);
+  const argv = setupBuildArgs(theme || 'neutral', host, root, root, fp, pos, mode, doctrines);
   return { cmd: [process.execPath, path.join(ROOT, 'bin', 'geneseed.mjs'), ...argv] };
 }

package/js/web/api.mjs

@@ -61,7 +61,7 @@ import { doctorCollect } from '../doctor.mjs';
 import { excludesSnapshot } from '../excludes.mjs';
 import { GLOBAL_MANIFEST, HOSTS, opencodeConfigDir, pyResolve } from '../hosts.mjs';
 import {
-  footprintOfDir, installState, installTargets, installedDefaults, modeOfDir,
+  doctrinesForBuild, footprintOfDir, installState, installTargets, installedDefaults, modeOfDir,
   postureOfDir, readJsonMaybe, readMaybe, themeOfDir,
 } from '../installs.mjs';
 import { frontmatter } from '../hooks.mjs';
@@ -273,16 +273,22 @@ export function specEntries(root, nested) {
  * `_web_core._deployed_inventory` — the agents and skills actually installed at
  * `state.target`, not a fresh render of `src/`.
  *
- * Laws still come from the render: once deployed they live inside AGENT.md rather than as
- * separate files, so the deployed arm replaces two of the three and not all three. A
- * deployed spec file carries neither a category nor a lifecycle status, so each is tagged
- * BY NAME from the same two sources the source render uses — and an entity the registry
- * does not know reads "personal" for both, which is the honest answer rather than a
- * borrowed one: filing it under the `build` fallback would claim a Geneseed taxonomy slot
- * it was never given.
+ * All three constitutional tiers still come from the render: once deployed they live inside
+ * AGENT.md rather than as separate files, so the deployed arm replaces the two ENTITY rosters
+ * and none of the constitution. A deployed spec file carries neither a category nor a
+ * lifecycle status, so each is tagged BY NAME from the same two sources the source render
+ * uses — and an entity the registry does not know reads "personal" for both, which is the
+ * honest answer rather than a borrowed one: filing it under the `build` fallback would claim
+ * a Geneseed taxonomy slot it was never given.
+ *
+ * ⚠ THE PACK SELECTION IS THE ONE THING THE RENDER CANNOT KNOW. `renderAll` emits all four
+ * pack files whatever `cfg.doctrines` says — measured: `makeCfg({doctrines:['craft']})` yields
+ * the same 105 items — because the filtering happens when AGENT.md's §2 is assembled, not in
+ * the walk. So the catalogue is always whole, and which packs this INSTALL built in comes from
+ * its own carrier via `doctrinesForBuild`, which resolves "no marker" to every pack.
  */
 export function deployedInventory(state) {
-  const render = tuiInventory(state.theme);
+  const render = tuiInventory(state.theme, doctrinesForBuild(state.target));
   const registry = loadRegistry();
   const skills = specEntries(path.join(state.target, 'skills'), true);
   for (const e of skills) {
@@ -292,7 +298,12 @@ export function deployedInventory(state) {
   }
   const agents = specEntries(path.join(state.target, 'agents'), false);
   for (const e of agents) e.status = entityStatus(registry, `agents/${e.name}`);
-  return { agents, skills, laws: render.laws, theme: state.theme };
+  return { agents,
+    skills,
+    laws: render.laws,
+    ontology: render.ontology,
+    doctrines: render.doctrines,
+    theme: state.theme };
 }
 
 /** `WebState.inventory` — the deployed record when there is one, else the source render. */
@@ -592,9 +603,53 @@ function configManifest(name, p) {
   return null;
 }
 
-/** `_web_core.SECTIONS` — a closed list; anything else is a 404. */
+/**
+ * `_web_core.SECTIONS` — a closed list; anything else is a 404.
+ *
+ * ⚠ `laws` STAYS ONE SECTION FOR ALL THREE TIERS, and that is a decision rather than an
+ * oversight. The console has ONE Constitution entry, not three, so a reader keeps the "read it
+ * top to bottom" property; the id stays `laws` because `tests/helpers/cli_golden.mjs`
+ * hard-requires `web/src/pages/Laws.jsx` and because a route rename buys nothing and costs a
+ * redirect. The tier lives on the ITEM (`tier: 'ontology' | 'invariant' | 'doctrine'`), which
+ * is where a consumer can act on it.
+ */
 export const SECTIONS = ['agents', 'skills', 'laws', 'memory', 'notebook', 'wiki', 'config'];
 
+/**
+ * The `laws` section's items — the whole constitution, in constitutional order, one flat list.
+ *
+ * FLAT AND NOT NESTED, because every other section is `{section, items}` and a second shape
+ * for one section is a second client path for one roster. The pack's grouping metadata rides
+ * on each doctrine row (`pack`, `packTitle`, `packDesc`, `active`), so a consumer groups by
+ * `pack` and has everything a header needs without a second fetch.
+ *
+ * Names are ADDRESSES and the three shapes cannot collide: `ont:<slug>` carries a colon no
+ * numeral has, an invariant is `[IVXLCDM]+`, a doctrine rule is `<pack>.<n>`. `apiItem`
+ * resolves all three off the same list.
+ */
+function constitutionItems(inv) {
+  return [
+    ...(inv.ontology ?? []).map((e) => ({ name: `ont:${e.id}`, title: e.title, desc: '',
+      tier: 'ontology' })),
+    ...inv.laws.map((e) => ({ name: e.num, title: `Rule ${e.num} — ${e.title}`, desc: '',
+      klass: e.klass ?? 'craft', tier: 'invariant' })),
+    ...(inv.doctrines ?? []).flatMap((p) => p.rules.map((r) => ({
+      name: `${r.pack}.${r.n}`,
+      title: `Doctrine ${r.pack} ${r.n} — ${r.title}`,
+      desc: '',
+      klass: r.klass ?? p.pack,
+      tier: 'doctrine',
+      pack: p.pack,
+      packTitle: p.title,
+      packDesc: p.desc,
+      // ⚠ EVERY RULE IS LISTED WHETHER OR NOT ITS PACK IS BUILT IN. An inactive pack that
+      // vanished from the payload would be indistinguishable from one that never shipped, and
+      // the console could not then offer the command that turns it back on.
+      active: p.active,
+    }))),
+  ];
+}
+
 /** `_web_catalog.api_catalog`. */
 export function apiCatalog(state, section) {
   if (!SECTIONS.includes(section)) throw new NotFound(section);
@@ -607,8 +662,7 @@ export function apiCatalog(state, section) {
     items = inv.skills.map((e) => ({ name: e.name, title: e.name, desc: e.desc,
       source: e.source ?? null, klass: e.klass ?? 'build', status: e.status ?? 'unknown' }));
   } else if (section === 'laws') {
-    items = inv.laws.map((e) => ({ name: e.num, title: `Rule ${e.num} — ${e.title}`,
-      desc: '', klass: e.klass ?? 'craft' }));
+    items = constitutionItems(inv);
   } else if (section === 'memory') {
     items = memoryItems(state);
   } else if (section === 'notebook') {
@@ -634,10 +688,21 @@ export function apiItem(state, type, name) {
     return out;
   }
   if (type === 'law') {
-    const e = inv.laws.find((x) => x.num === name);
+    // ONE ARM FOR THREE TIERS, resolved off the same list the catalogue publishes — so a name
+    // that appears in `/api/catalog/laws` always opens, and one that does not always 404s.
+    // Building the list twice is what would let the two drift.
+    const e = constitutionItems(inv).find((x) => x.name === name);
     if (!e) throw new NotFound(name);
-    return { type, name, title: `Rule ${e.num} — ${e.title}`, desc: '', body: e.body,
-      links: [], klass: e.klass ?? 'craft' };
+    const body = e.tier === 'ontology'
+      ? (inv.ontology.find((s) => `ont:${s.id}` === name)?.body ?? '')
+      : (e.tier === 'invariant'
+        ? (inv.laws.find((x) => x.num === name)?.body ?? '')
+        : (inv.doctrines.flatMap((p) => p.rules)
+          .find((r) => `${r.pack}.${r.n}` === name)?.body ?? ''));
+    // `links: []` — a constitution body is not link-resolved. It cites its siblings by
+    // ADDRESS (`Rule IV`, `Doctrine ops 1`, `Ontology: Telos`), not by path, and there is no
+    // file behind those to resolve to.
+    return { ...e, type, name, body, links: [] };
   }
   if (type === 'memory' || type === 'notebook') {
     flatName(name);
@@ -789,13 +854,34 @@ export function apiOverview(state) {
     accent: accentFor(state.theme),
     emit: state.emit,
     footprint: install ? install.footprint : state.footprint,
+    // ⚠ NO PACK ROSTER HERE, DELIBERATELY. One was added when the toggle lived in Settings,
+    // which has no other source for the pack names. The control moved to the Constitution
+    // page, which already holds the whole catalogue — `/api/catalog/laws` carries `pack`,
+    // `packTitle`, `packDesc` and `active` on every doctrine row — so a second copy of the
+    // roster on this endpoint would be API surface with no reader, and two places for the
+    // same fact to disagree. The SUMMARY stays, under `counts.doctrines`: the dashboard
+    // tiles need the fraction and must not fetch a catalogue to draw it.
     install,
     target: state.target,
     deployed: deployed(state),
     counts: {
       agents: inv.agents.length,
       skills: inv.skills.length,
+      // ⚠ `laws` STAYS THE INVARIANT COUNT. The rail badge reads it, `docCounts` mirrors it as
+      // `{N_LAWS}`, and the doctor's frozen `proseMirrorProblems` compares README and
+      // SHIPPED.md prose against the same number. Widening it to "the whole constitution"
+      // would silently move all four at once.
       laws: inv.laws.length,
+      ontology: (inv.ontology ?? []).length,
+      // The tier's own summary, kept out of the section counts because it is not a section:
+      // `active`/`total` is the fraction the dashboard shows, `rules` counts only the packs
+      // this install built in — what it is bound by, not what its bundle carries.
+      doctrines: {
+        active: (inv.doctrines ?? []).filter((p) => p.active).length,
+        total: (inv.doctrines ?? []).length,
+        rules: (inv.doctrines ?? []).filter((p) => p.active)
+          .reduce((n, p) => n + p.rules.length, 0),
+      },
       memory: memoryItems(state).length,
       notebook: notebookItems(state).length,
       wiki: wikiItems(state).length,

package/js/web/docs.mjs

@@ -130,8 +130,15 @@ export function docGroups() {
  * the one-line description. A key of `null` marks a term no theme renames.
  */
 const GLOSSARY_KEYS = [
-  ['Rule (Law)', 'LAW', 'the governance rules the agent obeys'],
-  ['Rules (Laws)', 'LAWS', 'the body of governance rules'],
+  // The three tiers, in constitutional order and before the entities — a reader who does not
+  // know what an Ontology is here cannot read the rest of the glossary's first rows.
+  ['Ontology', 'ONTOLOGY', 'the always-on worldview under the rules — telos, evidence, '
+    + 'decisions, conduct; it holds the Pact'],
+  ['Rule (Law)', 'LAW', 'one of the nine always-on invariants: what is never done'],
+  ['Rules (Laws)', 'LAWS', 'the body of always-on invariants'],
+  ['Doctrine', 'DOCTRINE', 'one practice rule, cited `<pack> <n>` — how work is done here'],
+  ['Doctrines', 'DOCTRINES', 'the practice packs, chosen at build time; inactive packs still '
+    + 'ship in the bundle'],
   ['Agent', 'AGENT', 'a capability specialist'],
   ['Agents', 'AGENTS', 'the roster of specialists'],
   ['Skill', 'SKILL', 'a repeatable workflow'],
@@ -139,7 +146,10 @@ const GLOSSARY_KEYS = [
   ['Memory', 'MEMORY', 'durable, one-fact-per-file knowledge'],
   ['Notebook', 'NOTEBOOK', "the agent's sovereign space"],
   ['Wiki', 'WIKI', 'the machine-wide knowledge base'],
-  ['Pact', 'PACT', 'the two-way collaboration contract'],
+  // Still a token, still themed, but it names a CONCEPT INSIDE the ontology's Telos now
+  // rather than a peer of the Rules — `src/postures/peer.md` cites it and the section that
+  // used to carry it is the Ontology.
+  ['Pact', 'PACT', "the two-way collaboration contract, stated in the Ontology's Telos"],
   ['Posture', null, 'the relationship register the agent works in '
     + '(peer, mentor, expert, assistant, artisan)'],
   ['Mode', null, 'how work gets executed — direct (the agent works every '
@@ -156,8 +166,14 @@ const GLOSSARY_KEYS = [
 
 // ---- counts substituted into concept bodies -------------------------------------------
 
-/** `_web_docs._doc_counts`. */
-function docCounts(state) {
+/**
+ * `_web_docs._doc_counts`.
+ *
+ * Exported so the tier tokens can be gated on the day they are ADDED rather than on the day a
+ * page first spends one. Only one page carries `{N_LAWS}` today; a test that could only reach
+ * these through a rendered body would leave four of the seven untested until Task 6.2.
+ */
+export function docCounts(state) {
   const inv = state.inventory;
   const plugins = path.join(ROOT, 'adapters', 'opencode', 'plugins');
   let n = 0;
@@ -165,11 +181,23 @@ function docCounts(state) {
     n = readdirSync(plugins).filter((f) => f.startsWith('geneseed-') && f.endsWith('.js'))
       .length;
   } catch { n = 0; }
+  // `{N_LAWS}` IS THE INVARIANT COUNT AND NOTHING ELSE. The doctor's frozen
+  // `proseMirrorProblems` holds README and SHIPPED.md prose to the same number, so a token
+  // that quietly meant "the whole constitution" would put the docs and the gate at odds with
+  // no way to re-bless either. The other three tiers get their own tokens.
+  const packs = inv.doctrines ?? [];
+  const on = packs.filter((p) => p.active);
   return {
     '{N_LAWS}': (inv.laws || []).length,
     '{N_AGENTS}': (inv.agents || []).length,
     '{N_SKILLS}': (inv.skills || []).length,
     '{N_PLUGINS}': n,
+    '{N_ONTOLOGY}': (inv.ontology ?? []).length,
+    '{N_PACKS}': packs.length,
+    '{N_PACKS_ACTIVE}': on.length,
+    // Rules in the packs this install BUILT IN — the number a reader of these pages is
+    // actually bound by. The catalogue always ships whole, so it is never the smaller claim.
+    '{N_DOCTRINE_RULES}': on.reduce((t, p) => t + p.rules.length, 0),
   };
 }
 

package/js/web/jobs.mjs

@@ -107,7 +107,7 @@ import { statSync } from 'node:fs';
 import { StringDecoder } from 'node:string_decoder';
 import path from 'node:path';
 
-import { ROOT } from '../checkout.mjs';
+import { ROOT, PACK_ORDER } from '../checkout.mjs';
 import { setupBuildArgs } from '../generate.mjs';
 import { isDict } from '../mcp.mjs';
 import { jsonDumpsCompact, parseJson, pyTruthy, readText, writeText } from '../lib/fs.mjs';
@@ -444,11 +444,20 @@ export const NOT_PORTED_ACTIONS = new Set();
  */
 export const INLINE_ACTIONS = ['restore', 'install', 'deploy'];
 
+/**
+ * ⚠ `doctrines` DEFAULTS TO THE FULL SET, and it is the one axis here whose default is not the
+ * generator's own. `theme`/`emit`/`footprint`/`posture`/`mode` fall back to a frozen literal
+ * that costs nothing when it is wrong; a missing `--doctrines` falls through to
+ * `harness.config.json`, and a `{"doctrines":["craft"]}` there re-emits the deployed install
+ * without its commit/push consent gate. So a caller that forgets the axis gets ALL packs —
+ * unknown resolves to the full set, never to a config value (`doctrinesForBuild`).
+ */
 function actionTable({
   theme = 'neutral', emit = 'opencode-global', footprint = 'full',
-  posture = 'peer', mode = 'direct',
+  posture = 'peer', mode = 'direct', doctrines = [...PACK_ORDER],
 } = {}) {
-  const buildArgv = setupBuildArgs(theme, emit, null, null, footprint, posture, mode);
+  const buildArgv = setupBuildArgs(theme, emit, null, null, footprint, posture, mode,
+    doctrines);
   return {
     doctor: [[NODE(), CLI(), 'doctor']],
     build: [[NODE(), GEN(), ...buildArgv]],

package/js/web/server.mjs

@@ -60,6 +60,7 @@ import { promptLine } from '../setup.mjs';
 // which resolves because everything either side needs of the other is a hoisted function
 // declaration, not a value read at module-evaluation time.
 import { preflight } from '../update.mjs';
+import { doctrinesForBuild } from '../installs.mjs';
 import { NotFound, PREFIX_ROUTES, STATE_ROUTES, webState } from './api.mjs';
 import {
   apiDeployCmd, apiExcludesMutate, apiInstallCmd, apiInstallToggle, apiMcpToggle,
@@ -549,8 +550,13 @@ export function makeHandler(state, jm, token, dist, holder = null) {
     // install, so a re-theme preserves lean/full, the register and the operating mode.
     const [theme, emit] = action === 'build'
       ? buildOverride(state, body) : [state.theme, state.emit];
+    // The pack selection follows the install like footprint/posture/mode, and is read here
+    // rather than left to the table's default: a console Build must re-emit the constitution
+    // the deployment already carries. Unknown (no `Active packs:` marker) resolves to ALL
+    // packs — never to `harness.config.json`, which would drop the consent gate.
     const cmds = actionCommands(action, {
       theme, emit, footprint: state.footprint, posture: state.posture, mode: state.mode,
+      doctrines: doctrinesForBuild(state.target),
     });
     if (!pyTruthy(cmds)) {
       return sendJson(res, { error: `unknown action ${action}` }, 404, ae);

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "Every field here is argued and gated in tests/unit/package_manifest.test.mjs. `files`, `bin` and `engines` each have a test that fails when reality drifts from this file; `version` mirrors harness.config.json and is gated too. Read that docblock before editing this one.",
   "name": "geneseed",
-  "version": "2.1.0",
+  "version": "3.1.0",
   "description": "A portable, theme-able harness you implant once and use everywhere to grow a disciplined AI coding agent.",
   "keywords": [
     "ai",