geneseed 3.1.0 → 3.1.2

package/CHANGELOG.md

@@ -6,6 +6,116 @@ labels in `harness.config.json`. The canonical identity of an *installed* harnes
 is the source fingerprint in `.geneseed-version` (see `geneseed version`), not this
 label. For the capability ↔ spec map, see [SHIPPED.md](SHIPPED.md).
 
+## [3.1.2] — 2026-08-24
+
+### Changed
+
+
+- **`js/` is now domain folders, not a flat drawer.** The tree splits into `build/`, `hosts/`,
+  `inspect/`, and `main/`, and the four largest modules split with it: `server.mjs` into
+  routes / handler / daemon / server, `emit.mjs` into common / stubs / version / bundle,
+  `doctor.mjs` into scan plus three check groups, and `fs.mjs` into fs / json / paths / text.
+  The Node generator driver is renamed to `bin/build-driver.mjs`; the `geneseed-build` bin name
+  is unchanged, so nothing on an installed harness has to move.
+
+  **No emitted byte moves.** The 261-cell corpus replays identical across all 14 themes, which
+  is the whole warrant for a reorganization this size — 151 files, 8502 insertions, 6481
+  deletions, and zero observable difference for anyone who installed 3.1.1.
+
+- **Docs point at the code that exists.** A module map and front door in `js/README.md`, with a
+  doctor arm that keeps them honest; 201 stale paths repointed in prose, the 35 split-module
+  pointers resolved, and 69 docblock claims corrected where the code had stopped supporting
+  what the comment promised. The vestigial `emit.mjs` is deleted.
+
+- **The Python-era `py` identifier prefix is retired**, and `js/ bin/ tests/ adapters/` are now
+  linted — the half of the tree that never was.
+
+
+- **Two of "the four things that are genuinely hard" are resolved rather than rewritten.**
+  `docs/extending.md` §5.2 — seven theme keys pinned byte-for-byte, so restyling a tagline was a
+  red gate — and §5.4 — *a snapshot red is a finding, not a step*. Theme text is free to edit,
+  and a red test is a step again. Editing a CLI verb's help text or flags is an ordinary edit.
+
+- **The standing rule is now "expected values are written out, not recorded"**: change the
+  expectation and the sentence that explains it in the same commit, and say why in the message.
+
+### Added
+
+
+- **A gate on how a runtime dependency may enter**: vendored under `js/vendor/<name>/` as tracked
+  source behind a relative import, never installed. Fixtures run from the OS temp root and cannot
+  resolve a bare specifier, and neither can a fresh `git clone`; devDependencies are unaffected.
+
+### Removed
+
+
+- **The recorded corpora, and the notion of a corpus with them.** `tests/__snapshots__/` held
+  2.6 MB of transcripts taken from the CPython reference before it was deleted, replayed by
+  `tests/snapshot/`. With no recorder left they could never be re-blessed, so a red run could
+  only ever mean *you changed something*, never *you broke something* — and every deliberate
+  change to emitted text arrived as a red gate. The 1381-cell retirement of 2026-08-17 had
+  already made the argument; this finishes it.
+
+  **What they owned is now written out.** `wrapText`, `dwidth` and `formatHelp` had zero unit
+  coverage — the recordings were their only gate — so `tests/unit/text_layout.test.mjs` states
+  their rules explicitly and renders all 29 verbs. The JSONC, Windows-PATH and token-report
+  tables moved inline; `sync_themes` became an owned fixture with plain-text expectations. The
+  "corpus contains what it is named for" gates went with them: when the apostrophe is visible in
+  the file, nothing has to assert it is there.
+
+  Recoverable at tag `corpus-reference-v3.1.2`. Nothing can regenerate them.
+
+- **Three migration statistics.** "N of the M subcommands run from Node", "0 commands have no
+  Node twin", and a native-verb list duplicated across two files purely so each could police the
+  other. A migration percentage is not a fact about a finished tool. The durable property under
+  the first two — every declared verb is dispatched by an entry point — is now asserted directly.
+
+- **`golden.mjs --against`**, which could not have worked since the emit corpus was retired, and
+  `orphanCheck`, `narrowingReason` and `tests/helpers/snapshot_io.mjs` with it. The three
+  surviving modes are all self-comparisons.
+
+
+## [3.1.1] — 2026-08-21
+
+### Added
+
+- **Doctrines toggle per RULE, not per pack.** A second build-time axis,
+  `geneseed-build --exclude-rules "process 7"`, drops individual rules from the packs that
+  survive `--doctrines`. Either spelling of an address is accepted — `process 7` as the
+  constitution writes it, `process.7` as the console addresses it — and `none` is the explicit
+  empty selection.
+
+  **This supersedes the pack-level switch 3.1.0 shipped one day earlier.** That control could
+  only say *all of Observance or none of it*; the case it could not express — *keep the pack,
+  drop one rule* — is the one people actually have. The console's switches are now one per rule,
+  still staged locally and still applied in a single rebuild, and there is no pack switch at all:
+  the pack axis is DERIVED at Apply time from whichever rules survive. A pack whose every rule is
+  off leaves `--doctrines` entirely, so `AGENT.md` never renders a pack header with nothing under
+  it.
+
+  An install records its exclusions in a second marker line, `Excluded rules: process 7`,
+  **written only when something is excluded**. That asymmetry is load-bearing rather than tidy: a
+  default build is byte-identical to one from before this axis existed — 261 golden cells, nine
+  emit modes, both footprints, all unmoved, nothing re-blessed — and the line's absence is a
+  complete answer, so `excludedRulesOfDir` reads a missing line as `[]` where `doctrinesOfDir`
+  must read one as `null`. Every rebuild path (`upgrade`, `rebuild-all`, the console's Build and
+  Deploy) reads the line back and preserves it, or an upgrade would silently hand back every rule
+  its owner switched off.
+
+  ⚠ **The consent gate is re-keyed from the pack to the rule.** `process 5` carries commit/push
+  consent, and the `git-gate` hook plus the `git commit*` / `git push*` permission are now wired
+  on that rule rather than on its pack — so excluding it alone unwires them, and excluding
+  `process 7` beside it does not. Prompt and boundary are never allowed to disagree; `doctor`
+  gained a gate that fails if `js/settings.mjs`'s hardcoded `process.5` ever stops naming the
+  consent rule. `rm -rf` and force-push refusals remain Rule IV's territory and ride no axis.
+
+### Fixed
+
+- **Independent doctrine controls.** Each Constitution doctrine row now keeps its detail
+  disclosure separate from the right-aligned switch. Toggling a staged rule no longer opens or
+  closes its detail, and the existing bottom **Apply** action remains the sole point at which a
+  selection changes the deployed harness.
+
 ## [3.1.0] — 2026-08-20
 
 ### Added

package/DESIGN.md

@@ -35,7 +35,7 @@ vault or a specific tool's hooks.
      names (`ONT_TELOS`, `ONT_EVIDENCE`, `ONT_DECISIONS`, `ONT_CONDUCT`), a few rare
      technical nouns (`Context`, `Scripts`, `Charter`), and the folder names (`laws/`,
      `ontology/`, `doctrines/`, `agents/`, `skills/`, `memory/`, `notebook/` via `DIR_*`).
-     These live in the `STRUCTURE` map in `js/render.mjs` and are laid on top of every
+     These live in the `STRUCTURE` map in `js/build/render.mjs` and are laid on top of every
      render, so a theme can never move a path, a link, or a heading number. No theme file
      defines a `DIR_*` or an `ONT_*` key, and none may: an ontology citation spells the
      section on both sides (`{{ONTOLOGY}}: {{ONT_TELOS}}`), so heading and reference move
@@ -102,22 +102,33 @@ vault or a specific tool's hooks.
      Rules, `I`..`IX`, headed `### {{LAW}} <roman> — {{LEX_<roman>}}`.
    - **Doctrines** (`src/doctrines/{craft,rigor,ops,process}.md`) — *how work is done
      here*. Practice rules addressed by pack and number, cited as `Doctrine process 5`.
-     `PACK_ORDER` (`js/checkout.mjs`) fixes the order craft → rigor → ops → process, which
+     `PACK_ORDER` (`js/build/source.mjs`) fixes the order craft → rigor → ops → process, which
      is narrative and deliberately not alphabetical.
 
    **The Ontology and the Invariants are never toggleable** — every build carries both,
-   whole. The Doctrine packs are the only tier a repository may narrow, chosen once at
-   build time (`--doctrines craft,rigor`, `--doctrines none`, or the setup wizard) and
-   defaulting to all four on. There is no runtime toggle. Every pack file ships on disk at
-   both footprints whether or not it was built in, which is what lets a citation into an
-   inactive pack still resolve.
+   whole. The Doctrine tier is the only one a repository may narrow, and it narrows on
+   **two axes**, both chosen once at build time and both defaulting to everything on:
+   `--doctrines craft,rigor` (or `none`, or the wizard) selects PACKS, and
+   `--exclude-rules "process 7"` drops individual RULES from the packs that survive. They
+   compose in one direction only — a pack whose every rule is excluded leaves the active
+   set, so no pack header is ever rendered empty. There is no runtime toggle for either.
+   Every pack file ships on disk at both footprints whether or not it was built in, which
+   is what lets a citation into an inactive pack still resolve.
+
+   Each axis leaves its own marker line in the carrier for later readers (`upgrade`,
+   `rebuild-all`, the console) to parse back: `Active packs:` always, and
+   `Excluded rules:` **only when something is excluded**. That asymmetry is deliberate and
+   load-bearing — the second line's absence is a complete answer ("nothing"), so a default
+   build is byte-identical to one from before the axis existed and no recording had to be
+   re-blessed; `excludedRulesOfDir` accordingly reads a missing line as `[]` where
+   `doctrinesOfDir` must read one as `null`.
 
    **Conflict order, exactly:** Ontology + Invariants → the user's own `user-rules.md` →
    the active Doctrines → `PROFILE.md`. A doctrine rule may *tighten* an invariant, never
    repeal one; a user rule outranks a doctrine rule outright; nothing outranks an
    invariant. And an always-on tier may never cite a toggleable one — a `--doctrines craft`
    build would otherwise ship an invariant pointing at text its `AGENT.md` does not
-   contain — so `constitutionProblems` (`js/doctor.mjs`) refuses a `{{DOCTRINE}}` token
+   contain — so `constitutionProblems` (`js/inspect/checks-authoring.mjs`) refuses a `{{DOCTRINE}}` token
    anywhere under `src/ontology/` or `src/laws/`.
 
    The bar for a **new invariant** is the highest in the tree: universal (it binds *every*
@@ -135,9 +146,9 @@ vault or a specific tool's hooks.
    |---|---|---|---|
    | body | append to `src/laws/universal.md` — never insert; nothing resolves a cross-reference against the canon | append to `src/doctrines/<pack>.md`, `### {{DOCTRINE}} <pack> <n> — {{DOC_<PACK>_<n>}}`; ids must run contiguously from 1 | a new `src/doctrines/<pack>.md` with its `**Name** — lead line` |
    | themed title | `LEX_<roman>` in all 15 theme files | `DOC_<PACK>_<n>` in all 15 theme files | `PACK_<NAME>` in all 15, plus each rule's `DOC_*` |
-   | class | `LAW_CLASS` in `js/inventory.mjs`, one of the six in `LAW_CLASSES` | **none** — a doctrine rule's class *is* its pack, and there is no second taxonomy over it | — |
+   | class | `LAW_CLASS` in `js/inspect/inventory.mjs`, one of the six in `LAW_CLASSES` | **none** — a doctrine rule's class *is* its pack, and there is no second taxonomy over it | — |
    | console copy | a `LAW_META` row in `web/src/pages/Laws.jsx` (keyed by arabic number) | a `DOCTRINE_META` row in the same file (keyed `<pack>.<n>`) | one `DOCTRINE_META` row per rule |
-   | registration | the numeral is the registration | the number is the registration | the pack name in `PACK_ORDER`, `js/checkout.mjs` |
+   | registration | the numeral is the registration | the number is the registration | the pack name in `PACK_ORDER`, `js/build/source.mjs` |
    | renumber risk | high — appending is the only safe move | none — packs are numbered independently | none |
    | counts | README badge + the `N universal laws` prose, `SHIPPED.md`'s triple, the web onboarding copy | **none** — the console spends the `N_PACKS` / `N_PACKS_ACTIVE` / `N_DOCTRINE_RULES` count tokens, all computed at request time | none, same reason |
    | changelog | `CHANGELOG.md` | `CHANGELOG.md` | `CHANGELOG.md` |
@@ -149,7 +160,7 @@ vault or a specific tool's hooks.
    synonym. `--sync-themes` writes the template's placeholder and only *prints* which keys
    to restyle; a shipped placeholder passes every gate.
 
-   Almost all of it is gated, across six named checks in `js/doctor.mjs` —
+   Almost all of it is gated, across six named checks in `js/inspect/checks-build.mjs` —
    `themeParityProblems` (key parity across the voices), `lawMetaProblems` and
    `doctrineMetaProblems` (the console's Principle column, in both directions),
    `constitutionProblems` (pack numbering and filing, `LEX_I..LEX_IX` as an *equality*, the
@@ -184,11 +195,11 @@ theme file defines a `DIR_*` key, so `laws/` is `laws/` in all fourteen voices.
 | Notebook | `src/notebook/` | `notebook/` | the agent's sovereign space — any medium, seed-once charter the agent may rewrite; only `.gitignore` re-asserted |
 | Posture | `src/postures/` | inlined into `AGENT.md` | how much ceremony the agent brings to a task |
 | Mode | `src/modes/` | inlined into `AGENT.md` | the working axis (solo, foreman, …) — orthogonal to posture |
-| Context | `js/emit.mjs` | `context.json` | empty per-repo manifest, written once and never overwritten; git-ignore it |
+| Context | `js/build/stubs.mjs` | `context.json` | empty per-repo manifest, written once and never overwritten; git-ignore it |
 | Themes | `themes/*.json` | — | token → label maps; `themes/opencode/` is a separate colour system |
 | Release label | `harness.config.json` | `.geneseed-version` | the theme and the human-readable version the driver reads; the canonical identity is the source fingerprint, not this string |
 | Lifecycle | `registry.json` | — | maintainer-side status/version/owner per agent and skill; never rendered into a bundle |
-| Generator | `bin/geneseed.mjs` (`geneseed-build`) | — | substitution + `<!-- INCLUDE: -->` inlining, and the nine `--emit` targets |
+| Generator | `bin/build-driver.mjs` (`geneseed-build`) | — | substitution + `<!-- INCLUDE: -->` inlining, and the nine `--emit` targets |
 | CLI, as data | `js/cli-table.json` | — | the owned document the entry point parses its own argv from |
 | Automation | `bin/geneseed-cli.mjs` (`geneseed`) | — | 25 verbs — `build` / `doctor` / `status` / `prompt` / `diff` / `setup` / `web` / `upgrade` / … |
 | Hooks | `bin/geneseed-hook.mjs` (`geneseed-hook`) | — | the four verbs an emitted `settings.json` invokes: `context` / `git-gate` / `rule-gate` / `learn` |
@@ -201,28 +212,28 @@ theme file defines a `DIR_*` key, so `laws/` is `laws/` in all fourteen voices.
 - Unknown tokens are left visible (debugging aid); `doctor` flags them.
 - Node built-ins only; no third-party dependencies, ever. (`package.json` carries neither a
   `dependencies` nor a `devDependencies` key, and a test asserts it.)
-- **`js/settings.mjs` is the half of the emit that edits files you co-own** — the
+- **`js/hosts/settings.mjs` is the half of the emit that edits files you co-own** — the
   `settings.json` / `opencode.json` merges, JSONC parsing, the hook shim and the managed
   CLAUDE.md block. It is a separate module because every function in it reconciles
   Geneseed's claim with content Geneseed did not write, and because eleven of its names are
-  driven by the *runtime* as well as by an emit (`js/mcp.mjs` uses ten of them
+  driven by the *runtime* as well as by an emit (`js/hosts/mcp.mjs` uses ten of them
   for deactivate, remerge, reactivate and uninstall; `exclude` and `doctor` use the rest).
-  Its dependency closure points one way only: nothing in it calls into `js/render.mjs` or
-  `js/emit.mjs`. Keep it that way — that closure is what makes it a unit.
+  Its dependency closure points one way only: nothing in it calls into `js/build/render.mjs` or
+  `js/build/bundle.mjs`. Keep it that way — that closure is what makes it a unit.
 - **Every emit runs five stages in one order: `RENDER* → WIRE* → PRUNE → MANIFEST →
-  VERIFY`.** RENDER writes files Geneseed owns wholesale; WIRE is `js/settings.mjs`
+  VERIFY`.** RENDER writes files Geneseed owns wholesale; WIRE is `js/hosts/settings.mjs`
   reconciling files you co-own; PRUNE removes what the previous manifest owned and this
   emit no longer produces; MANIFEST records both; VERIFY re-reads the merge to confirm it
   stuck. WIRE must precede MANIFEST because wiring is what fills the `managed` record the
   manifest stores, and no RENDER may follow a WIRE because a render writes wholesale a file
   a wire has just reconciled. `tests/unit/emit_phase_order.test.mjs` fails the build if any of
   the nine emits drifts out of that order, or if a new file-mutating routine in
-  `js/settings.mjs` is called from an emit without being classified. RENDER and WIRE now run
+  `js/hosts/settings.mjs` is called from an emit without being classified. RENDER and WIRE now run
   in the *same process* — the seam that once spawned a second runtime per emit is gone — so
   the render and wire dispatchers stay two separate functions and two separate statements on
   purpose: that shape is the only thing left for the walker to check, and a gate refuses an
   emit whose sequence has lost its WIRE.
-  `bin/geneseed.mjs`'s `main()` is classified too, as the one stage no per-emit gate can see: it
+  `bin/build-driver.mjs`'s `main()` is classified too, as the one stage no per-emit gate can see: it
   writes the `.geneseed-emit` / `-footprint` / `-theme` markers and the install-registry
   record *after* every emit returns, and nothing that reconciles a file you co-own may run
   there, because there is no manifest to record the claim and no teardown able to undo it.

package/README.md

@@ -93,7 +93,7 @@ Both launchers are thin shims over the Node CLI: they need `node` (22.3+) on `PA
 
 Node ≥ 22.3 is the entire dependency list. Every subcommand, all four hooks, every web-console endpoint and both generators run from it, and every commit runs the whole unit suite plus `doctor --all` across every theme × host × footprint, on Linux and Windows both. So an install needs no second interpreter — not for the harness, and not for anything it ships. (Until 2026-08-17 the generator's output was also replayed byte for byte against recordings taken from the Python implementation. Those were retired — see [`docs/limits.md`](docs/limits.md) for the measurement that licensed it and the coverage it cost.)
 
-- **0 commands have no Node twin**: 25 of the 25 subcommands, and all four hook verbs, answer from the Node entry points. `catalog`, `mcp` and `memory` are Node-native faces the CLI table declares on top of that roster. There is no full-screen browse panel — `geneseed tui` and `geneseed menu` are verbs that refuse it by name and print the command list instead, off a terminal as well as on one.
+- **One runtime, no second one to install**: every command and all four hook verbs answer from the Node entry points. `catalog`, `mcp` and `memory` are console-facing verbs the CLI table declares alongside them. There is no full-screen browse panel — `geneseed tui` and `geneseed menu` are verbs that refuse it by name and print the command list instead, off a terminal as well as on one.
 - **Nothing you install needs an interpreter.** The `token-report` skill is a script rather than prose, and it ships as `scripts/token_report.mjs`, run with `node`; `daydream` and `herdr` hand their inline code to `node -e`. So **every bundle carries** nothing that needs one: no Python file, and no skill that shells out to an interpreter, on any host, theme or footprint. Three tests freeze that — one scans every tracked file for inline code handed to an interpreter, one globs the bundle source, and one replays the report script over seeded transcripts for all four hosts and compares the bytes.
 - **`upgrade` / `update` / `sync-self` / `bootstrap` are for a git checkout.** They `git pull` the install's own origin. From an npm install they stop before touching anything and name `npm install -g geneseed@latest` as the update instead.
 
@@ -154,7 +154,7 @@ The harness ships as a small set of layers, and the web console's rail is the sa
 | --- | --- |
 | **🧭 Ontology** (`ontology/`) | the mind the rules govern, in four prose sections — **Telos** (the Pact: protect the user, the truth, the agent), **Evidence** (every claim graded by how it was obtained), **Decisions** (classify and tier by reversibility, show the real forks), **Conduct** (answer what was asked, once). Always in force, never toggleable |
 | **🛡️ Rules** (`laws/`) | 9 universal laws the agent obeys — always in force, never toggleable: sealed-secrets, one-intent-one-act, verify-before-assert, deletion-is-deliberate, surface-failures, data-not-orders, least-privilege, root-cause, external-gate |
-| **📐 Doctrines** (`doctrines/`) | practice packs, chosen per install at build time: **craft** (how code is written), **rigor** (how work is proven), **ops** (how the machine is operated), **process** (how a task is run). A doctrine rule may tighten a Rule, never repeal one, and the user's own `user-rules.md` outranks it. Pick with `geneseed-build --doctrines craft,rigor` (or `none`), or in the setup wizard; all four pack files ship on disk either way, so a citation into a pack you left out still resolves |
+| **📐 Doctrines** (`doctrines/`) | practice packs, chosen per install at build time: **craft** (how code is written), **rigor** (how work is proven), **ops** (how the machine is operated), **process** (how a task is run). A doctrine rule may tighten a Rule, never repeal one, and the user's own `user-rules.md` outranks it. Pick with `geneseed-build --doctrines craft,rigor` (or `none`), a single rule with `--exclude-rules "process 7"`, in the setup wizard, or through the switches on the console's Constitution page; all four pack files ship on disk either way, so a citation into a pack you left out still resolves |
 | **🤖 Agents** (17) | capability specialists: `reviewer`, `tester`, `architect`, `docs`, `security`, `explorer`, `developer` — plus a debate **council** the `council` skill convenes: `advocate`, `skeptic`, `pragmatist`, `steward`, `visionary`, `user-advocate`, `framer`, `empiricist`, `operator`, `historian` |
 | **🛠 Skills** (47) | repeatable workflows: brainstorm · **clarify** · plan · **codebase-design** · **domain-modeling** · **wayfinder** · **tickets** · tdd · **develop** · debug · **prototype** · refactor · **ponytail** · **forge-mcp** · geneseed-code-review · **fresh-eyes** · **review-response** · commit · **ship** · **release** · **migrate** · **git-archaeology** · **git-rescue** · repo-map · document-project · **frontend-design** · **prose** · **ingest** · **research** · **learning-path** · **gap-detector** · **feynman** · **crash-course** · **drill** · **decode** · handoff · roast-me · **council** · parallel-agents · **workflow** · **wiki** · **geneseed** · **rule** · **profile** · **opencode-theme** · **herdr** · **pipeline** |
 | **🔌 Plugins** (OpenCode) | `geneseed-context` injects project docs *and your machine wiki* every session (and across compaction); `geneseed-learn` distils memory at session end; `geneseed-guard` enforces the safety Laws and protected wiki folders at the tool boundary; `geneseed-workflow` registers the `workflow` tool that runs saved orchestration scripts; `geneseed-notify` sends a native OS notification when a long run finishes; `geneseed-ponytail` holds a minimal-code mode (`/ponytail lite\|full\|ultra\|off`), opt-in, injecting the laziest-that-works ruleset every turn so it doesn't drift; `geneseed-activity` streams what each session is doing to the web console's Activity view |

package/SETUP.md

@@ -100,7 +100,7 @@ hand? Pick a path below.
 > **Every `geneseed-build …` below is the generator.** `npm install -g geneseed` puts it
 > on your `PATH`; without installing anything, `npx -p geneseed geneseed-build --emit
 > opencode-global` is the same command. From a checkout it is
-> `node bin/geneseed.mjs` with the same flags. Every commit re-emits with it across every
+> `node bin/build-driver.mjs` with the same flags. Every commit re-emits with it across every
 > theme × host × footprint combination and checks the result with `doctor --all`, on Linux
 > and Windows both. Until 2026-08-17 that output was also compared byte for byte against
 > recordings taken from the Python implementation; those were retired, and `docs/limits.md`
@@ -168,8 +168,10 @@ It wires:
   for Doctrine `process 5`. The hook inspects the command and forces an `ask` on every
   `git commit` or `git push` (even chained or `-C`-flagged), un-suppressible by a
   one-time "don't ask again". Every other Bash command is deferred to the normal
-  permission flow. It is wired only when the **process** pack is active — build with
-  `--doctrines` leaving `process` out and this hook is not installed at all.
+  permission flow. It is wired only when **Doctrine process 5 itself** is active — build
+  with `--doctrines` leaving `process` out, or with `--exclude-rules "process 5"`, and this
+  hook is not installed at all. The prompt and the boundary move together by construction:
+  the gate is keyed on the rule, not on its pack.
 - **SessionStart** (`startup`/`clear`) — prints `AGENT.md` and injects the project
   context (`harness context`, which auto-discovers the repo's docs);
 - **SessionStart** (`resume`) — refreshes the project context only, without re-printing
@@ -313,6 +315,31 @@ the default is all four:
 refuses one that names a pack the checkout does not ship. Order is fixed by the harness
 (craft → rigor → ops → process) regardless of the order you type.
 
+### One rule at a time
+
+A pack is coarse: `--doctrines` can only keep all of **process** or none of it.
+`--exclude-rules` is the finer axis, and it takes rule addresses:
+
+    geneseed-build --exclude-rules "process 7"            # keep the pack, drop one rule
+    geneseed-build --exclude-rules "process 5,craft 2"    # several
+    geneseed-build --exclude-rules none                   # exclude nothing (the default)
+
+Both spellings of an address work — `process 7` as the constitution writes it, or `process.7`
+as the console addresses it. The two axes compose: a pack whose every rule is excluded drops
+out of `Active packs:` entirely, so you never get a pack header with nothing under it.
+
+An install records what it excluded in a second marker line, `Excluded rules: process 7`,
+written **only when something is excluded** — so a build with the default keeps every byte it
+had before this axis existed. `upgrade`, `rebuild-all` and the web console all read that line
+back and preserve it, exactly as they preserve the pack list.
+
+⚠ **`process 5` is special**: excluding it also unwires the commit/push consent hook, because
+the tool boundary is keyed on that rule. That is by design — the prompt and the boundary must
+never disagree — and both the console and the wizard say so before applying it.
+
+The web console has the switches: **Constitution → Doctrines**, one per rule, staged locally
+with a single **Apply** that rebuilds the install once.
+
 The setup wizard asks too — one *all* / *choose* gate, then a yes/no per pack with its
 one-line description — and it **pre-selects what the install already carries**, read off the
 `Active packs:` marker line in the deployed `AGENT.md`. So re-running the wizard and holding

package/SHIPPED.md

@@ -20,7 +20,7 @@ historical pointers, not files distributed with the repo.
 > **On version numbers.** [`harness.config.json`](harness.config.json)'s `version` is a
 > human-readable label only. The canonical identity of an installed harness is the
 > **source fingerprint** stamped in `.geneseed-version` (see `geneseed version`), not the
-> string. Current label: **3.1.0**.
+> string. Current label: **3.1.2**.
 
 > **Spec status audit (2026-06-15).** Every dated spec authored before today was
 > verified against the source tree and confirmed implemented (code + tests + docs);