geneseed 3.0.0 → 3.1.1

package/CHANGELOG.md

@@ -6,6 +6,96 @@ labels in `harness.config.json`. The canonical identity of an *installed* harnes
 is the source fingerprint in `.geneseed-version` (see `geneseed version`), not this
 label. For the capability ↔ spec map, see [SHIPPED.md](SHIPPED.md).
 
+## [Unreleased]
+
+## [3.1.1] — 2026-08-21
+
+### Added
+
+- **Doctrines toggle per RULE, not per pack.** A second build-time axis,
+  `geneseed-build --exclude-rules "process 7"`, drops individual rules from the packs that
+  survive `--doctrines`. Either spelling of an address is accepted — `process 7` as the
+  constitution writes it, `process.7` as the console addresses it — and `none` is the explicit
+  empty selection.
+
+  **This supersedes the pack-level switch 3.1.0 shipped one day earlier.** That control could
+  only say *all of Observance or none of it*; the case it could not express — *keep the pack,
+  drop one rule* — is the one people actually have. The console's switches are now one per rule,
+  still staged locally and still applied in a single rebuild, and there is no pack switch at all:
+  the pack axis is DERIVED at Apply time from whichever rules survive. A pack whose every rule is
+  off leaves `--doctrines` entirely, so `AGENT.md` never renders a pack header with nothing under
+  it.
+
+  An install records its exclusions in a second marker line, `Excluded rules: process 7`,
+  **written only when something is excluded**. That asymmetry is load-bearing rather than tidy: a
+  default build is byte-identical to one from before this axis existed — 261 golden cells, nine
+  emit modes, both footprints, all unmoved, nothing re-blessed — and the line's absence is a
+  complete answer, so `excludedRulesOfDir` reads a missing line as `[]` where `doctrinesOfDir`
+  must read one as `null`. Every rebuild path (`upgrade`, `rebuild-all`, the console's Build and
+  Deploy) reads the line back and preserves it, or an upgrade would silently hand back every rule
+  its owner switched off.
+
+  ⚠ **The consent gate is re-keyed from the pack to the rule.** `process 5` carries commit/push
+  consent, and the `git-gate` hook plus the `git commit*` / `git push*` permission are now wired
+  on that rule rather than on its pack — so excluding it alone unwires them, and excluding
+  `process 7` beside it does not. Prompt and boundary are never allowed to disagree; `doctor`
+  gained a gate that fails if `js/settings.mjs`'s hardcoded `process.5` ever stops naming the
+  consent rule. `rm -rf` and force-push refusals remain Rule IV's territory and ride no axis.
+
+### Fixed
+
+- **Independent doctrine controls.** Each Constitution doctrine row now keeps its detail
+  disclosure separate from the right-aligned switch. Toggling a staged rule no longer opens or
+  closes its detail, and the existing bottom **Apply** action remains the sole point at which a
+  selection changes the deployed harness.
+
+## [3.1.0] — 2026-08-20
+
+### Added
+
+- **Doctrine packs are toggleable from the console.** The Constitution page gains a switch on
+  each pack header — beside its name, blurb and rule count — staged locally and committed by a
+  single **Apply** below the last pack, with **Revert** beside it. Until now the console could
+  *show* pack state and not change it: dropping a pack meant `geneseed-build --doctrines`, the
+  setup wizard, or editing `harness.config.json` by hand.
+
+  **On the Constitution page and not in Settings**, because that is where a reader is already
+  looking at what each pack contains — dropping `ops` is a decision about the six rules listed
+  directly under its header, and a switch three screens away makes it a decision taken blind. A
+  staged pack reads `staged on` / `staged off` and greys immediately, so the page never claims a
+  change has been applied when it has not.
+
+  **Staged rather than per-click, and that is the design.** A pack selection is a SET: acting per
+  toggle would re-emit the install once per switch — four rebuilds to get from all four packs to
+  one, three of them describing a state nobody asked for, each writing a different
+  `Active packs:` marker for the next reader to parse.
+
+  It acts on whichever install the Topbar harness selector points at, so it is already
+  per-harness. Pushing one selection to several installs at once is not here.
+
+  ⚠ **`process` toggles like any other pack, and the consequence is named rather than refused.**
+  That pack carries commit/push consent, so dropping it also drops the `git-gate` hook and the
+  `git commit*` / `git push*` permission — prompt and boundary are never allowed to disagree. An
+  inline warning says so while the change is staged, and the confirm repeats it. `rm -rf` and
+  force-push refusals are Rule IV's territory, ride no pack, and stay in every build.
+
+### Fixed
+
+- **The Constitution page printed a command that errors.** An inactive pack's enable hint read
+  `geneseed build --doctrines …`; the CLI's `build` verb forwards `--theme` and nothing else, so
+  that spelling answers `unrecognized arguments`. It is `geneseed-build` — the same trap
+  `DESIGN.md` already documents for `--sync-themes`. Shipped in 3.0.0. With an install to
+  rebuild the switches replace the hint entirely; it survives only where there is nothing to act
+  on.
+
+- **A page reachable from three routes remounted on every row expand.** `Laws`, `Skills` and
+  `Library` are each reachable from the flat view, `#/section/<name>` and
+  `#/item/<type>/<name>`, and each was rendered from three different positions in `App`'s tree.
+  Crossing between them is not a prop change to React — it is an unmount and a remount, so the
+  page threw away its state, refetched its catalogue and re-entered Suspense. Expanding a row
+  does exactly that, because the row IS the route (`#/laws` → `#/item/law/craft.1`). Measured in
+  the browser: one refetch of `/api/catalog/laws` per expand *and* per collapse, now zero.
+
 ## [3.0.0] — 2026-08-20
 
 ### Changed

package/DESIGN.md

@@ -106,11 +106,22 @@ vault or a specific tool's hooks.
      is narrative and deliberately not alphabetical.
 
    **The Ontology and the Invariants are never toggleable** — every build carries both,
-   whole. The Doctrine packs are the only tier a repository may narrow, chosen once at
-   build time (`--doctrines craft,rigor`, `--doctrines none`, or the setup wizard) and
-   defaulting to all four on. There is no runtime toggle. Every pack file ships on disk at
-   both footprints whether or not it was built in, which is what lets a citation into an
-   inactive pack still resolve.
+   whole. The Doctrine tier is the only one a repository may narrow, and it narrows on
+   **two axes**, both chosen once at build time and both defaulting to everything on:
+   `--doctrines craft,rigor` (or `none`, or the wizard) selects PACKS, and
+   `--exclude-rules "process 7"` drops individual RULES from the packs that survive. They
+   compose in one direction only — a pack whose every rule is excluded leaves the active
+   set, so no pack header is ever rendered empty. There is no runtime toggle for either.
+   Every pack file ships on disk at both footprints whether or not it was built in, which
+   is what lets a citation into an inactive pack still resolve.
+
+   Each axis leaves its own marker line in the carrier for later readers (`upgrade`,
+   `rebuild-all`, the console) to parse back: `Active packs:` always, and
+   `Excluded rules:` **only when something is excluded**. That asymmetry is deliberate and
+   load-bearing — the second line's absence is a complete answer ("nothing"), so a default
+   build is byte-identical to one from before the axis existed and no recording had to be
+   re-blessed; `excludedRulesOfDir` accordingly reads a missing line as `[]` where
+   `doctrinesOfDir` must read one as `null`.
 
    **Conflict order, exactly:** Ontology + Invariants → the user's own `user-rules.md` →
    the active Doctrines → `PROFILE.md`. A doctrine rule may *tighten* an invariant, never

package/README.md

@@ -154,7 +154,7 @@ The harness ships as a small set of layers, and the web console's rail is the sa
 | --- | --- |
 | **🧭 Ontology** (`ontology/`) | the mind the rules govern, in four prose sections — **Telos** (the Pact: protect the user, the truth, the agent), **Evidence** (every claim graded by how it was obtained), **Decisions** (classify and tier by reversibility, show the real forks), **Conduct** (answer what was asked, once). Always in force, never toggleable |
 | **🛡️ Rules** (`laws/`) | 9 universal laws the agent obeys — always in force, never toggleable: sealed-secrets, one-intent-one-act, verify-before-assert, deletion-is-deliberate, surface-failures, data-not-orders, least-privilege, root-cause, external-gate |
-| **📐 Doctrines** (`doctrines/`) | practice packs, chosen per install at build time: **craft** (how code is written), **rigor** (how work is proven), **ops** (how the machine is operated), **process** (how a task is run). A doctrine rule may tighten a Rule, never repeal one, and the user's own `user-rules.md` outranks it. Pick with `geneseed-build --doctrines craft,rigor` (or `none`), or in the setup wizard; all four pack files ship on disk either way, so a citation into a pack you left out still resolves |
+| **📐 Doctrines** (`doctrines/`) | practice packs, chosen per install at build time: **craft** (how code is written), **rigor** (how work is proven), **ops** (how the machine is operated), **process** (how a task is run). A doctrine rule may tighten a Rule, never repeal one, and the user's own `user-rules.md` outranks it. Pick with `geneseed-build --doctrines craft,rigor` (or `none`), a single rule with `--exclude-rules "process 7"`, in the setup wizard, or through the switches on the console's Constitution page; all four pack files ship on disk either way, so a citation into a pack you left out still resolves |
 | **🤖 Agents** (17) | capability specialists: `reviewer`, `tester`, `architect`, `docs`, `security`, `explorer`, `developer` — plus a debate **council** the `council` skill convenes: `advocate`, `skeptic`, `pragmatist`, `steward`, `visionary`, `user-advocate`, `framer`, `empiricist`, `operator`, `historian` |
 | **🛠 Skills** (47) | repeatable workflows: brainstorm · **clarify** · plan · **codebase-design** · **domain-modeling** · **wayfinder** · **tickets** · tdd · **develop** · debug · **prototype** · refactor · **ponytail** · **forge-mcp** · geneseed-code-review · **fresh-eyes** · **review-response** · commit · **ship** · **release** · **migrate** · **git-archaeology** · **git-rescue** · repo-map · document-project · **frontend-design** · **prose** · **ingest** · **research** · **learning-path** · **gap-detector** · **feynman** · **crash-course** · **drill** · **decode** · handoff · roast-me · **council** · parallel-agents · **workflow** · **wiki** · **geneseed** · **rule** · **profile** · **opencode-theme** · **herdr** · **pipeline** |
 | **🔌 Plugins** (OpenCode) | `geneseed-context` injects project docs *and your machine wiki* every session (and across compaction); `geneseed-learn` distils memory at session end; `geneseed-guard` enforces the safety Laws and protected wiki folders at the tool boundary; `geneseed-workflow` registers the `workflow` tool that runs saved orchestration scripts; `geneseed-notify` sends a native OS notification when a long run finishes; `geneseed-ponytail` holds a minimal-code mode (`/ponytail lite\|full\|ultra\|off`), opt-in, injecting the laziest-that-works ruleset every turn so it doesn't drift; `geneseed-activity` streams what each session is doing to the web console's Activity view |

package/SETUP.md

@@ -168,8 +168,10 @@ It wires:
   for Doctrine `process 5`. The hook inspects the command and forces an `ask` on every
   `git commit` or `git push` (even chained or `-C`-flagged), un-suppressible by a
   one-time "don't ask again". Every other Bash command is deferred to the normal
-  permission flow. It is wired only when the **process** pack is active — build with
-  `--doctrines` leaving `process` out and this hook is not installed at all.
+  permission flow. It is wired only when **Doctrine process 5 itself** is active — build
+  with `--doctrines` leaving `process` out, or with `--exclude-rules "process 5"`, and this
+  hook is not installed at all. The prompt and the boundary move together by construction:
+  the gate is keyed on the rule, not on its pack.
 - **SessionStart** (`startup`/`clear`) — prints `AGENT.md` and injects the project
   context (`harness context`, which auto-discovers the repo's docs);
 - **SessionStart** (`resume`) — refreshes the project context only, without re-printing
@@ -313,6 +315,31 @@ the default is all four:
 refuses one that names a pack the checkout does not ship. Order is fixed by the harness
 (craft → rigor → ops → process) regardless of the order you type.
 
+### One rule at a time
+
+A pack is coarse: `--doctrines` can only keep all of **process** or none of it.
+`--exclude-rules` is the finer axis, and it takes rule addresses:
+
+    geneseed-build --exclude-rules "process 7"            # keep the pack, drop one rule
+    geneseed-build --exclude-rules "process 5,craft 2"    # several
+    geneseed-build --exclude-rules none                   # exclude nothing (the default)
+
+Both spellings of an address work — `process 7` as the constitution writes it, or `process.7`
+as the console addresses it. The two axes compose: a pack whose every rule is excluded drops
+out of `Active packs:` entirely, so you never get a pack header with nothing under it.
+
+An install records what it excluded in a second marker line, `Excluded rules: process 7`,
+written **only when something is excluded** — so a build with the default keeps every byte it
+had before this axis existed. `upgrade`, `rebuild-all` and the web console all read that line
+back and preserve it, exactly as they preserve the pack list.
+
+⚠ **`process 5` is special**: excluding it also unwires the commit/push consent hook, because
+the tool boundary is keyed on that rule. That is by design — the prompt and the boundary must
+never disagree — and both the console and the wizard say so before applying it.
+
+The web console has the switches: **Constitution → Doctrines**, one per rule, staged locally
+with a single **Apply** that rebuilds the install once.
+
 The setup wizard asks too — one *all* / *choose* gate, then a yes/no per pack with its
 one-line description — and it **pre-selects what the install already carries**, read off the
 `Active packs:` marker line in the deployed `AGENT.md`. So re-running the wizard and holding

package/SHIPPED.md

@@ -20,7 +20,7 @@ historical pointers, not files distributed with the repo.
 > **On version numbers.** [`harness.config.json`](harness.config.json)'s `version` is a
 > human-readable label only. The canonical identity of an installed harness is the
 > **source fingerprint** stamped in `.geneseed-version` (see `geneseed version`), not the
-> string. Current label: **3.0.0**.
+> string. Current label: **3.1.0**.
 
 > **Spec status audit (2026-06-15).** Every dated spec authored before today was
 > verified against the source tree and confirmed implemented (code + tests + docs);

package/bin/geneseed.mjs

@@ -52,7 +52,9 @@ import {
 // P5d moved these out of this file for the reason P5c moved the host resolvers: `harness
 // status` renders to count, so `bin/geneseed-cli.mjs` needs the same checkout paths and the
 // same cfg. golden.py's 259 cells all build one, which is what made the move safe.
-import { ROOT, CONFIG, THEMES, discoverNames, makeCfg, PACK_ORDER } from '../js/checkout.mjs';
+import {
+  ROOT, CONFIG, THEMES, discoverNames, makeCfg, PACK_ORDER, knownRuleIds,
+} from '../js/checkout.mjs';
 
 // P5f moved these, for the same arithmetic a third time: `harness rebuild-all` reads the
 // registry to find every install it must re-emit, and a CLI verb may not reach into a driver
@@ -124,6 +126,7 @@ export function resolveOut(raw) {
 function configDefaults() {
   const d = {
     theme: 'neutral', posture: 'peer', mode: 'direct', doctrines: [...PACK_ORDER],
+    excludeRules: [],
   };
   if (!existsSync(CONFIG)) return d;
   try {
@@ -146,6 +149,19 @@ function configDefaults() {
             + 'list of known pack names — using all packs.\n');
         }
       }
+      // The second axis, read the same forgiving way and defaulting the OTHER direction: a
+      // bad value excludes NOTHING, because the safe answer for a list of things to take
+      // away is to take nothing away. Same reasoning as `doctrines` defaulting to all.
+      if (data.excludeRules !== undefined) {
+        if (Array.isArray(data.excludeRules)
+          && data.excludeRules.every((x) => typeof x === 'string')) {
+          d.excludeRules = [...new Set(data.excludeRules.map((x) => x.replace(/[ \t]+/, '.')))]
+            .sort();
+        } else {
+          process.stderr.write(`[geneseed] WARN: ${path.basename(CONFIG)} "excludeRules" is `
+            + 'not a list of rule addresses — excluding nothing.\n');
+        }
+      }
     }
   } catch {
     process.stderr.write(`[geneseed] WARN: ${path.basename(CONFIG)} is unreadable — `
@@ -162,7 +178,7 @@ function configDefaults() {
  */
 const VALUED = {
   '--theme': 'theme', '--posture': 'posture', '--mode': 'mode',
-  '--doctrines': 'doctrines',
+  '--doctrines': 'doctrines', '--exclude-rules': 'excludeRules',
   '--out': 'out', '--target': 'out', '--emit': 'emit',
   '--footprint': 'footprint', '--root': 'root',
 };
@@ -204,6 +220,37 @@ function choicesFor() {
  * packs the checkout actually has; a discovered pack missing from `PACK_ORDER` is a
  * different fault and `js/render.mjs` refuses the whole build for it.
  */
+/**
+ * `--exclude-rules "process 7,craft 3"` (or `process.7`) -> the cfg's exclusion array.
+ *
+ * BOTH SPELLINGS ACCEPTED ON THE WAY IN, ONE ON THE WAY OUT. The carrier's marker line and
+ * every citation in the corpus spell a rule `process 7`; the console's deep link and the
+ * catalogue spell it `process.7`. A flag that took only one of them would be wrong for
+ * whichever half of the documentation the reader had open, so it takes either and normalises
+ * to the dotted form the code compares.
+ *
+ * ⚠ VALIDATED AGAINST THE PACK FILES, NOT A RANGE. `process 9` and `craft 0` are both
+ * refusals, and so is a pack this checkout does not ship — an exclusion that names nothing is
+ * a typo that would otherwise take away nothing in silence, which is the failure this flag
+ * can least afford: the user asked for a rule to STOP binding and it would keep binding.
+ * Sorted, deduped, for the same marker-stability reason `--doctrines` is.
+ */
+function parseExcludeRules(value) {
+  const s = value.trim();
+  if (s === 'none' || s === '') return [];
+  const known = knownRuleIds();
+  const out = [];
+  for (const raw of s.split(',').map((x) => x.trim()).filter(Boolean)) {
+    const id = raw.replace(/[ \t]+/, '.');
+    if (!known.includes(id)) {
+      die(2, `argument --exclude-rules: invalid choice: '${raw}' (choose from `
+        + `${known.map((c) => `'${c.replace('.', ' ')}'`).join(', ')}, or 'none')`);
+    }
+    out.push(id);
+  }
+  return [...new Set(out)].sort();
+}
+
 function parseDoctrines(value) {
   const s = value.trim();
   const known = discoverNames('doctrines', PACK_ORDER[0]);
@@ -264,6 +311,7 @@ function parseArgs(argv, defaults) {
   const args = {
     theme: defaults.theme, posture: defaults.posture, mode: defaults.mode,
     doctrines: defaults.doctrines,
+    excludeRules: defaults.excludeRules,
     out: 'Harness', emit: 'files', footprint: 'lean', root: null,
     syncThemes: false, validateOnly: false, verbose: false,
   };
@@ -296,6 +344,7 @@ function parseArgs(argv, defaults) {
   // Only when the flag was actually PASSED is this a string; left at its default it is
   // already the array `configDefaults` built, and re-parsing an array would stringify it.
   if (typeof args.doctrines === 'string') args.doctrines = parseDoctrines(args.doctrines);
+  if (typeof args.excludeRules === 'string') args.excludeRules = parseExcludeRules(args.excludeRules);
   return args;
 }
 

package/docs/extending.md

@@ -116,9 +116,9 @@ Notes that matter:
 
 ### The gates CI does not run
 
-- **The mutation matrix itself.** `tests/mutate.mjs` — 31 rows, each a one-string edit to a
+- **The mutation matrix itself.** `tests/mutate.mjs` — 33 rows, each a one-string edit to a
   product file with a written argument for which gate should catch it. The full run is **in no
-  workflow** and should not be: it mutates the product tree 31 times and runs a gate per edit.
+  workflow** and should not be: it mutates the product tree 33 times and runs a gate per edit.
   Run `node tests/mutate.mjs --all` (or `--only M7`) by hand when you change something a gate is
   supposed to be watching. ⚠ An interrupted run leaves the **product tree mutated** — check
   `git status` before doing anything else.

package/docs/web/rules.md

@@ -21,6 +21,8 @@ Practices rather than principles: **craft** (how code is written), **rigor** (ho
 
 A pack you leave out **still ships in the bundle**: every pack file lands under `doctrines/` beside `AGENT.md` whether or not it was built in. So a rule that cites one in an inactive pack still resolves on disk, and you can read the alternatives before turning one on. What an inactive pack loses is bindingness, not availability.
 
+Rules toggle **individually** too — `geneseed-build --exclude-rules "process 7"`, or the switches on this page — so *keep all of process except one rule* is a state you can build. A pack whose every rule is excluded drops out of the active set on its own. What an install excluded is recorded beside the pack list, as `Excluded rules: process 7`, and every rebuild preserves it.
+
 ### Which outranks which
 
 Ontology and Invariants first, then your own `user-rules.md`, then the active Doctrines, then `PROFILE.md`. A rule you write in `user-rules.md` **outranks a doctrine rule** — a practice pack chosen at build time never overrides an instruction you wrote for your own repo — and nothing outranks an invariant: a user rule or a doctrine rule may tighten one, never repeal it.

package/docs/web/setup-choices.md

@@ -36,10 +36,22 @@ Which practice rules this install adopts, fixed at build time. Unlike the dials
 - **ops** — how the machine is driven: tool discovery, commands that return, complete teardowns.
 - **process** — how a session runs: planning, context economy, docs first, and the **consent gate on every commit and push**.
 
-Turning **process** off takes that consent gate with it, at the tool boundary as well as in the prose: the OpenCode permission block and the Claude/Bob `PreToolUse` hook that ask before a commit or a push are wired only when the pack is built in, because a boundary that keeps asking for a rule the install never adopted is a gate arguing with its own harness. The invariant-territory refusals — `rm -rf`, a force-push — stay in every build; they are the Rules' territory, not the pack's.
+Turning **process 5** off takes that consent gate with it, at the tool boundary as well as in the prose: the OpenCode permission block and the Claude/Bob `PreToolUse` hook that ask before a commit or a push are wired only when that rule is built in, because a boundary that keeps asking for a rule the install never adopted is a gate arguing with its own harness. The invariant-territory refusals — `rm -rf`, a force-push — stay in every build; they are the Rules' territory, not the pack's.
 
 A pack you leave out still ships in the bundle under `doctrines/`, so you can read it before turning it on, and a rule that cites it still resolves. Change the set with `geneseed-build --doctrines craft,rigor` (or `--doctrines none`), or in `harness.config.json`.
 
+### One rule at a time
+
+The pack is the coarse axis. `--exclude-rules` is the fine one, and it takes rule addresses — so *keep all of process, drop just `process 7`* is expressible:
+
+    geneseed-build --exclude-rules "process 7"
+    geneseed-build --exclude-rules "process 5,craft 2"
+    geneseed-build --exclude-rules none
+
+Either spelling of an address works, `process 7` or `process.7`. The two axes compose: a pack whose every rule is excluded leaves `Active packs:` entirely, so no pack header is ever rendered with nothing under it. An install records its exclusions in a second marker line — `Excluded rules: process 7` — written only when something *is* excluded, and every rebuild path reads it back and preserves it.
+
+The switches are on the **Constitution** page, one per rule, staged locally and applied in a single rebuild.
+
 ### Footprint — how much of the constitution loads inline
 
 How much of the constitution `AGENT.md` carries inline every turn. A token-cost dial, not a rules cut — whatever this install adopted always applies:

package/harness.config.json

@@ -2,5 +2,5 @@
   "_comment": "version is a human-readable release label only; the canonical identity of an installed harness is the source fingerprint stamped in .geneseed-version (see `harness version`), not this string.",
   "theme": "neutral",
   "product": "Geneseed",
-  "version": "3.0.0"
+  "version": "3.1.1"
 }

package/js/checkout.mjs

@@ -22,7 +22,7 @@
  * over 259 cells and compares the tree byte-for-byte, and every one of them builds a cfg
  * from these paths. A depth error or a renamed key fails 259 cells, not zero.
  */
-import { readdirSync } from 'node:fs';
+import { readdirSync, readFileSync } from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
@@ -83,6 +83,34 @@ export function discoverNames(dir, first) {
  */
 export const PACK_ORDER = ['craft', 'rigor', 'ops', 'process'];
 
+/**
+ * Every doctrine rule address this checkout ships — `pack.n`, in render order.
+ *
+ * The ONE enumerator, for the same arithmetic reason `PACK_ORDER` is one array: the CLI
+ * flag, the console's trust boundary and the doctor all have to close `--exclude-rules`
+ * against the SAME set, and a second copy is a set that drifts by one rule the day a pack
+ * grows. Read from the UNRENDERED source (`### {{DOCTRINE}} <pack> <n>`) rather than from a
+ * built tree, because an address is a property of the source and the rendered heading is
+ * themed — fourteen spellings of a thing that must compare equal to itself.
+ *
+ * Ordered by `PACK_ORDER`, then by the order the headings stand in the pack file — NOT sorted.
+ * The file is what renders, so mirroring it is what keeps this list and the rendered
+ * constitution in the same sequence; a sort would silently disagree with a file whose headings
+ * were ever out of order, and disagree in the direction that reads as correct.
+ */
+export function knownRuleIds() {
+  const out = [];
+  for (const pack of PACK_ORDER) {
+    const file = path.join(SRC, 'doctrines', `${pack}.md`);
+    let text = '';
+    try { text = readFileSync(file, 'utf8'); } catch { continue; }
+    for (const m of text.matchAll(/^### \{\{DOCTRINE\}\} ([a-z]+) (\d+)\b/gm)) {
+      if (m[1] === pack) out.push(`${pack}.${Number(m[2])}`);
+    }
+  }
+  return out;
+}
+
 /**
  * `_build_core.js_cfg()`, originated rather than received.
  *
@@ -95,7 +123,9 @@ export const PACK_ORDER = ['craft', 'rigor', 'ops', 'process'];
  * out to renderers and a caller that sorted or spliced it in place would rewrite
  * `PACK_ORDER` for the whole process.
  */
-export function makeCfg({ posture = 'peer', mode = 'direct', doctrines = PACK_ORDER } = {}) {
+export function makeCfg({
+  posture = 'peer', mode = 'direct', doctrines = PACK_ORDER, excludeRules = [],
+} = {}) {
   return {
     root: ROOT,
     src: SRC,
@@ -107,5 +137,16 @@ export function makeCfg({ posture = 'peer', mode = 'direct', doctrines = PACK_OR
     posture,
     mode,
     doctrines: Array.isArray(doctrines) ? [...doctrines] : [...PACK_ORDER],
+    // ⚠ THE SECOND DOCTRINE AXIS, AND ITS DEFAULT IS THE OPPOSITE WAY ROUND. `doctrines`
+    // defaults to EVERYTHING because an unknown selection must bind the most; `excludeRules`
+    // defaults to NOTHING for exactly the same reason — an exclusion is a rule taken AWAY, so
+    // "unspecified" has to mean "nothing taken away". Both defaults fail closed; they only
+    // look inconsistent until you ask which direction is the safe one for each.
+    //
+    // Addresses are `<pack>.<n>`, the same spelling the console deep-links and the catalogue
+    // publishes. An exclusion whose pack is not in `doctrines` is harmless and stays: the pack
+    // is already absent, and dropping the exclusion would silently re-admit the rule the day
+    // the pack came back.
+    excludeRules: Array.isArray(excludeRules) ? [...excludeRules] : [],
   };
 }

package/js/doctor.mjs

@@ -34,7 +34,7 @@ import os from 'node:os';
 import path from 'node:path';
 
 import {
-  CONFIG, PACK_ORDER, PLUGIN_SRC, ROOT, SRC, THEMES, WORKFLOW_SRC, makeCfg,
+  CONFIG, PACK_ORDER, PLUGIN_SRC, ROOT, SRC, THEMES, WORKFLOW_SRC, knownRuleIds, makeCfg,
 } from './checkout.mjs';
 import {
   buildInto, main as driverMain, emitGlobalInto, emitProjectInto,
@@ -900,6 +900,44 @@ export function constitutionProblems() {
   // notices a blank description in the browser.
   problems.push(...doctrineMetaProblems([...rules.keys()]));
 
+  // ---- `--exclude-rules` closes against the SAME rules this walk just found.
+  //
+  // `knownRuleIds` is what the CLI flag, the console's trust boundary and every wizard prompt
+  // validate an address against; the walk above is what the constitution actually renders.
+  // Two readers of one directory is the shape that lets a rule be authored, rendered, cited —
+  // and rejected by the only flag that can switch it off, with `invalid choice` naming a set
+  // that visibly contains it. An equality, not containment: a stale id in the enumerator is a
+  // rule the console offers a switch for and the build cannot drop.
+  const enumerated = knownRuleIds();
+  const walked = [...rules.keys()];
+  for (const id of enumerated.filter((i) => !walked.includes(i))) {
+    problems.push(`[authoring] knownRuleIds() offers '${id.replace('.', ' ')}', which no pack `
+      + 'file defines — --exclude-rules accepts an address the build cannot drop');
+  }
+  for (const id of walked.filter((i) => !enumerated.includes(i))) {
+    problems.push(`[authoring] doctrine ${id.replace('.', ' ')} is defined but knownRuleIds() `
+      + 'does not offer it — --exclude-rules refuses a rule that exists, and the console has '
+      + 'no switch for it');
+  }
+
+  // ---- the consent gate's address still names the consent rule.
+  //
+  // ⚠ THE ONE HARDCODED ADDRESS IN THE CODEBASE, and the one whose drift is silent AND unsafe.
+  // `js/settings.mjs` keys the git-gate hooks on `process.5` by literal; a renumber of the
+  // process pack moves that rule's neighbours under it, and the boundary would then follow
+  // whatever rule inherited the number while the prompt still said `process 5`. Checked
+  // against the pack file's own title token rather than against prose, so a reworded rule is
+  // not a false alarm and a MOVED one is not a silent pass.
+  const consentTitle = 'DOC_PROCESS_5';
+  let processText = '';
+  try { processText = readText(path.join(dir, 'process.md')); } catch { /* reported above */ }
+  if (processText && !new RegExp(`^### \\{\\{DOCTRINE\\}\\} process 5 — \\{\\{${consentTitle}\\}\\}`,
+    'm').test(processText)) {
+    problems.push('[authoring] js/settings.mjs gates git commit/push on doctrine \'process 5\', '
+      + `but doctrines/process.md does not number {${consentTitle}} 5 — the tool boundary and `
+      + 'the prompt now name different rules');
+  }
+
   // ---- every `{{DOCTRINE}} <pack> <n>` anywhere in src/ resolves to a rule that exists.
   //
   // The whole tree, not the template: a skill footer citing `process 9` is as broken as a

package/js/emit.mjs

@@ -846,7 +846,7 @@ export function emitOpencodeRender(cfg, job) {
   // downstream: `opencode.json`, or the `.jsonc` sibling when that is what is on disk.
   phaseLog('WIRE');
   const cfgName = path.basename(mergeOpencodeJson(path.join(root, 'opencode.json'), agentPath,
-    cfg.doctrines));
+    cfg.doctrines, cfg.excludeRules));
 
   return {
     owned,
@@ -1080,7 +1080,7 @@ export function emitOpencodeGlobalRender(cfg, job) {
   // that split is what `tests/test_emit_phase_order.py` walks, and it walks the Python.
   phaseLog('WIRE');
   const cfgName = path.basename(mergeOpencodeJson(path.join(cfgDir, 'opencode.json'),
-    agentPath, cfg.doctrines));
+    agentPath, cfg.doctrines, cfg.excludeRules));
 
   return {
     owned,
@@ -1216,7 +1216,8 @@ export function emitClaudeRender(cfg, job) {
 
   // WIRE — see `claudeWire` below. One child per emit, so the two halves are two
   // functions rather than two spawns; the seam between them is a call, not a process.
-  const managed = claudeWire(job, claudeMdText, agentText !== null, cfg.doctrines);
+  const managed = claudeWire(job, claudeMdText, agentText !== null, cfg.doctrines,
+    cfg.excludeRules);
 
   return {
     owned,
@@ -1251,7 +1252,7 @@ export function emitClaudeRender(cfg, job) {
  * not needed for it: Python tests `os.environ.get(...)` for truthiness and an env var is
  * always a string, so `''` is the only falsy value either language sees.
  */
-function claudeWire(job, claudeMdText, hasAgentText, doctrines = null) {
+function claudeWire(job, claudeMdText, hasAgentText, doctrines = null, excludeRules = []) {
   phaseLog('WIRE');
   const { cfgDir, claudeMd, scope, host, oldManaged, preambleExclude, hookOpts } = job;
   const old = oldManaged && typeof oldManaged === 'object' && !Array.isArray(oldManaged)
@@ -1312,7 +1313,7 @@ function claudeWire(job, claudeMdText, hasAgentText, doctrines = null) {
     // DECIDES the install's packs, so the marker on disk is still the previous build's.
     const [, managedHooks] = mergeClaudeSettings(
       settingsPath, scope, oldSf === settingsName ? get(old, 'settings_hooks') : null, hookOpts,
-      doctrines,
+      doctrines, excludeRules,
     );
     managed.settings_hooks = managedHooks;
 

package/js/generate.mjs

@@ -37,7 +37,8 @@ import { makeCfg, PACK_ORDER } from './checkout.mjs';
 import { opencodeConfigDir, pyResolve } from './hosts.mjs';
 import {
   EMIT_HOST_SCOPE, defaultMode, defaultPosture, defaultTheme, doctrinesForBuild,
-  footprintOfDir, installState, installTargets, modeOfDir, postureOfDir, readMaybe, themeOfDir,
+  excludedRulesOfDir, footprintOfDir, installState, installTargets, modeOfDir, postureOfDir,
+  readMaybe, themeOfDir,
 } from './installs.mjs';
 import { colorThemeFiles, colorThemeJson, PALETTE_ROLES } from './opencode.mjs';
 import { renderAll } from './render.mjs';
@@ -122,7 +123,8 @@ export function cmdBuild(args) {
  * accepts (an empty `--doctrines ` is a usage error there, so it can never be produced here).
  */
 export function setupBuildArgs(theme, emit, out = null, root = null, footprint = 'lean',
-  posture = 'peer', mode = 'direct', doctrines = null, allPacks = PACK_ORDER) {
+  posture = 'peer', mode = 'direct', doctrines = null, allPacks = PACK_ORDER,
+  excludeRules = null) {
   const argv = ['--theme', theme, '--emit', emit];
   if (!['opencode-global', 'claude-global', 'bob-global', 'copilot-global'].includes(emit)) {
     if (out) argv.push('--out', out);
@@ -138,6 +140,13 @@ export function setupBuildArgs(theme, emit, out = null, root = null, footprint =
     const picked = allPacks.filter((p) => doctrines.includes(p));
     argv.push('--doctrines', picked.length ? picked.join(',') : 'none');
   }
+  // The second axis, emitted the same way and for the same reason — but ALWAYS when the
+  // caller passed a list, empty included. An omitted flag reads as "no opinion" and the
+  // driver's config fallback fills it in; `none` is the caller saying "exclude nothing",
+  // which is exactly what a rebuild that just re-enabled the last rule has to say.
+  if (Array.isArray(excludeRules)) {
+    argv.push('--exclude-rules', excludeRules.length ? excludeRules.join(',') : 'none');
+  }
   return argv;
 }
 
@@ -201,7 +210,13 @@ export function cmdRebuildAll() {
     // resolving that silence out of a machine-wide config narrows every such install on its
     // first upgrade. `doctrinesForBuild` resolves unknown to ALL packs — see its docblock.
     const doctrines = doctrinesForBuild(root);
-    const argv = setupBuildArgs(theme, emit, out, out, footprint, posture, mode, doctrines);
+    // SEVEN. The per-rule axis is preserved for the same reason and with sharper teeth: an
+    // upgrade that dropped it would quietly hand back every rule its owner switched off, and
+    // `process 5` is one of them — the consent gate would return to a harness that had been
+    // built without it. No `doctrinesForBuild` rescue is needed here; see `apiInstallCmd`.
+    const excludeRules = excludedRulesOfDir(root);
+    const argv = setupBuildArgs(theme, emit, out, out, footprint, posture, mode, doctrines,
+      PACK_ORDER, excludeRules);
     const label = `${host}:${scope} (${root})`;
     pyPrint(`[rebuild-all] ${label}: theme=${theme} emit=${emit} footprint=${footprint} `
       + `posture=${posture} mode=${mode}\n`);