geneseed 3.10.0 → 3.12.0

package/js/web/server.mjs

@@ -28,7 +28,7 @@ import { which } from '../lib/paths.mjs';
 import { parseIntStrict } from '../lib/text.mjs';
 import { promptLine } from '../maintain/setup.mjs';
 import { webState } from './api.mjs';
-import { clearDaemon, openUrl, readDaemon, restartDaemon, startDaemon, statusDaemon, stopDaemon, writeDaemon } from './daemon.mjs';
+import { clearDaemon, codeStamp, openUrl, readDaemon, restartDaemon, startDaemon, statusDaemon, stopDaemon, writeDaemon } from './daemon.mjs';
 import { isFile, makeHandler } from './handler.mjs';
 import { JobManager } from './jobs.mjs';
 import { spawnSync } from 'node:child_process';
@@ -137,6 +137,9 @@ export async function serve({ theme = null, port = 4747, openBrowser = true,
     printOut('      Run `geneseed setup` first — serving anyway (read-only UI).\n');
   }
   const token = randomBytes(24).toString('base64url');
+  // The code this server loaded, compared on every overview against the files on disk now.
+  const startCode = codeStamp();
+  state.daemonStale = () => startCode !== codeStamp();
   const holder = {};
   // The console's job list survives a reload and a restart because it is a FILE on disk,
   // not held in process memory.
@@ -156,7 +159,7 @@ export async function serve({ theme = null, port = 4747, openBrowser = true,
       if (daemon) {
         writeDaemon(state.target, {
           pid: process.pid, port: hostPort, url,
-          token, theme: state.theme, started: Math.floor(Date.now() / 1000),
+          token, theme: state.theme, started: Math.floor(Date.now() / 1000), code: startCode,
         });
       }
       printOut(`[web] Geneseed UI on ${url}  (theme: ${state.theme})\n`);
@@ -197,9 +200,11 @@ export async function cmdWeb(args) {
   const port = args.port === null ? 4747 : parseIntStrict(args.port);
   const openBrowser = !args.noBrowser;
   if (args.action === 'start') return startDaemon(args.theme, port, openBrowser);
-  if (args.action === 'stop') return stopDaemon(args.theme);
-  if (args.action === 'restart') return restartDaemon(args.theme, port, openBrowser);
-  if (args.action === 'status') return statusDaemon(args.theme);
+  // Only an EXPLICIT --port scopes these three to one daemon; absent, they act on the record.
+  const named = args.port === null ? null : port;
+  if (args.action === 'stop') return stopDaemon(args.theme, named);
+  if (args.action === 'restart') return restartDaemon(args.theme, named, openBrowser);
+  if (args.action === 'status') return statusDaemon(args.theme, named);
   return serve({ theme: args.theme, port, openBrowser, daemon: args.daemonInternal });
 }
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "Every field here is argued and gated in tests/unit/package_manifest.test.mjs. `files`, `bin` and `engines` each have a test that fails when reality drifts from this file; `version` mirrors harness.config.json and is gated too. Read that docblock before editing this one.",
   "name": "geneseed",
-  "version": "3.10.0",
+  "version": "3.12.0",
   "description": "A portable, theme-able harness you implant once and use everywhere to grow a disciplined AI coding agent.",
   "keywords": [
     "ai",
@@ -38,7 +38,11 @@
     "themes/",
     "adapters/",
     "docs/*.md",
-    "docs/web/",
+    "docs/_groups.json",
+    "docs/understand/",
+    "docs/guides/",
+    "docs/concepts/",
+    "docs/reference/",
     "web/dist/",
     "web/src/pages/Laws.jsx",
     "harness.config.json",
@@ -47,8 +51,6 @@
     "geneseed.cmd",
     "CHANGELOG.md",
     "DESIGN.md",
-    "QUICKSTART.md",
-    "SETUP.md",
     "SHIPPED.md"
   ],
   "devDependencies": {

package/registry.json

@@ -134,6 +134,13 @@
       "added": "2026-06-03",
       "last_verified": "2026-09-06"
     },
+    "skills/brick-forge": {
+      "status": "experimental",
+      "version": "0.1.0",
+      "owner": "Guillaume Lemer",
+      "added": "2026-10-03",
+      "last_verified": ""
+    },
     "skills/bruno-collection-generator": {
       "status": "experimental",
       "version": "1.0.0",
@@ -295,6 +302,20 @@
       "added": "2026-06-07",
       "last_verified": "2026-09-06"
     },
+    "skills/learn-mode": {
+      "status": "experimental",
+      "version": "1.0.0",
+      "owner": "Guillaume Lemer",
+      "added": "2026-10-02",
+      "last_verified": ""
+    },
+    "skills/loop": {
+      "status": "experimental",
+      "version": "0.1.0",
+      "owner": "Guillaume Lemer",
+      "added": "2026-10-03",
+      "last_verified": ""
+    },
     "skills/migrate": {
       "status": "approved",
       "version": "1.0.0",

package/src/AGENT.md.tmpl

@@ -95,6 +95,9 @@ posture: posture is the relationship register, mode is the operating register.
 <!-- LEAN:end -->
 {{MODE_BODY}}
 
+If `.geneseed/learn.md` says `Learning mode: active`, read it first and follow
+[learn-mode]({{DIR_SKILLS}}/learn-mode.md); a restart or compaction never approves a checkpoint.
+
 ---
 
 ## 1. {{LAWS}} (always in force)
@@ -238,6 +241,7 @@ the ten council seats are convened by the [council {{SKILL}}]({{DIR_SKILLS}}/cou
 | [research]({{DIR_SKILLS}}/research.md) | a question needs answers gathered and verified from the open web |
 | [teach]({{DIR_SKILLS}}/teach.md) | the user wants to be taught — a crash course, confusing material decoded, or a day-by-day path to a deadline |
 | [quiz]({{DIR_SKILLS}}/quiz.md) | the user wants what they know tested, not explained — a drill, an explain-it-back check, or a mastery claim probed for gaps |
+| [learn-mode]({{DIR_SKILLS}}/learn-mode.md) | the user wants to learn while building — they design, you code what they approve |
 | [commit]({{DIR_SKILLS}}/commit.md) | staging and writing a commit |
 | [geneseed-code-review]({{DIR_SKILLS}}/geneseed-code-review.md) | reviewing a diff or PR |
 | [review-response]({{DIR_SKILLS}}/review-response.md) | acting on review feedback you have received |
@@ -262,6 +266,8 @@ the ten council seats are convened by the [council {{SKILL}}]({{DIR_SKILLS}}/cou
 | [council]({{DIR_SKILLS}}/council.md) | a decision, change, or discussion needs debating from several points of view before committing |
 | [workflow]({{DIR_SKILLS}}/workflow.md) | deterministic, code-driven orchestration of subagents (fan-out, find→verify, phased handoff) and the host exposes a workflow tool |
 | [pipeline]({{DIR_SKILLS}}/pipeline.md) | foreman mode triages a substantial task, or the user asks to run a crew (analyst → developer → tester) on one, isolated in its own worktree and merged on mechanical proof |
+| [loop]({{DIR_SKILLS}}/loop.md) | the user asks to run a loop |
+| [brick-forge]({{DIR_SKILLS}}/brick-forge.md) | a new or adapted loop brick |
 | [wiki]({{DIR_SKILLS}}/wiki.md) | consulting or growing the user's machine-wide knowledge base declared in `wiki.jsonc` (§8) |
 | [herdr]({{DIR_SKILLS}}/herdr.md) | running inside a [herdr](https://herdr.dev) pane (`HERDR_ENV=1`) and a task needs another pane — a sibling server, a watched build, a spawned agent |
 | [rule]({{DIR_SKILLS}}/rule.md) | anything the user wants to outlive this session — a standing rule of their own (§1) or a durable fact to remember (§5); also a recurring {{MEMORY}} lesson due for promotion |

package/src/bricks/README.md

@@ -0,0 +1,32 @@
+# Bricks
+
+A brick is one node of a loop graph: a single prompt, handed to one agent or skill, that reports
+back one of a declared set of outcomes. `geneseed loop next` reads the current node's brick and
+hands its body to the model verbatim — the model never sees this file as a file, only as the
+instructions inside it.
+
+A brick is a markdown file, `<name>.md`, with flat YAML-ish frontmatter (`name`, `description`,
+`effect`, exactly one of `agent` or `skill`, `outcomes`) and a plain-prose body. See
+`_template.md` for the field-by-field shape.
+
+## The three origins
+
+A brick's name is looked up across three levels, each one able to override the level before it
+by name:
+
+| origin | path | who writes it |
+|---|---|---|
+| shipped | `src/bricks/` (this directory) | Geneseed itself |
+| global | `$XDG_CONFIG_HOME/geneseed/bricks/` | the user, for every project on this machine |
+| project | `<repo>/.geneseed/bricks/` | a team, committed and shared |
+
+A global or project brick named `apply` replaces the shipped `apply` everywhere a loop template
+references it — the template does not have to change, and `geneseed loop check` reports the
+override rather than hiding it.
+
+## Writing one
+
+Start from `_template.md`, or ask the `brick-forge` skill to draft one for an agent or skill you
+already have. Keep the body to 4-10 lines of direct instruction, and end it with how the model
+should choose among the outcomes you declared — that sentence is what turns a vague brief into a
+loop that actually terminates.

package/src/bricks/_template.md

@@ -0,0 +1,32 @@
+<!--
+  A brick template — copy this file to `<name>.md` (kebab-case, matching the `name:` field
+  below) under `bricks/` at whichever level you are authoring for: shipped (this package's
+  `src/bricks/`), global ($XDG_CONFIG_HOME/geneseed/bricks/), or project (<repo>/.geneseed/bricks/).
+  A later level overrides an earlier one BY NAME. Leading-underscore files (like this one) and
+  README.md are never loaded as bricks.
+
+  Everything below the closing `---` is the brick's BODY: the prompt `geneseed loop next` hands
+  the agent, verbatim, plus the card fields it receives. No double-brace substitution tokens in
+  the body — the loop CLI reads this file raw and hands it straight to the model, unrendered.
+-->
+---
+name: my-brick
+# One line, shown wherever the catalogue is listed. Not the instructions themselves.
+description: One line describing what this brick does.
+# `read` never touches a file — the engine does not score or diff its iteration.
+# `mutate` may change files — its diff is scored against the declared card before commit.
+effect: read
+# Exactly one of agent OR skill (never both, never neither) — who carries out the body below.
+# `agent: <name>` names a spec under `src/agents/`.
+agent: tester
+# `skill: <name>` names a spec under `src/skills/` instead of an agent — delete `agent:` above
+# if you use this.
+# skill: some-skill
+# Every outcome the body can report, comma-separated — these become the edge labels a loop
+# template routes on (`{from, on: "<outcome>", to}`). A loop template's graph check requires
+# exactly one edge per outcome declared here.
+outcomes: pass, fail
+---
+Say, in direct instructions, what the agent or skill should do with the card it receives — 4 to
+10 lines, no more. End with exactly how to choose between the declared outcomes, so the model's
+last read is the decision it has to make.

package/src/bricks/apply.md

@@ -0,0 +1,17 @@
+---
+name: apply
+description: Implement the current card's intent, touching only its declared write set.
+effect: mutate
+agent: developer
+outcomes: pass
+---
+Implement the card's intent exactly, touching only the files in its `writeSet`. If the card
+carries an `amend`, that supersedes the original intent — follow the amendment, not the plan it
+replaced.
+
+Make no unrelated edits: no drive-by rename, no incidental cleanup, no touching a file the card
+did not declare. If the change genuinely needs a file outside the write set, stop and report that
+rather than widening scope unasked — the diff is scored against the declared set, not your
+judgement of what else looked wrong.
+
+Report `pass` once the change is made, with a short account of what changed and where.

package/src/bricks/baseline-green.md

@@ -0,0 +1,17 @@
+---
+name: baseline-green
+description: Confirm the suite and linter are green before the loop changes anything.
+effect: read
+agent: tester
+outcomes: pass, fail
+---
+Run this project's full test suite and its linter, unchanged — no fix, no skip, no retry with
+different flags. This is the loop's starting line, not a chance to tidy up first.
+
+Report `pass` only if every test and the linter both exit clean. Include the raw command output
+in your report either way, so a `fail` carries the actual failure rather than a summary of it.
+
+Report `fail` on the first red suite or linter run, and stop there: a loop that starts on a red
+baseline cannot tell its own changes apart from pre-existing breakage.
+
+Never edit, create or delete any file: this brick only reads.

package/src/bricks/bruno-test.md

@@ -0,0 +1,16 @@
+---
+name: bruno-test
+description: Write or update Bruno requests for the endpoints this iteration touched.
+effect: mutate
+skill: bruno-test-writer
+outcomes: pass, fail
+---
+Follow the bruno-test-writer skill for every endpoint this iteration's diff added or changed.
+Touch only the Bruno collection — new or updated `.bru` requests and their expectations — never
+the application code.
+
+Report `pass` once every touched endpoint has a request that exercises it and asserts on the
+response.
+
+Report `fail` if an endpoint cannot be exercised this way (missing auth fixture, no reachable
+instance, an endpoint the diff removed), naming which one and why.

package/src/bricks/ci-fix.md

@@ -0,0 +1,17 @@
+---
+name: ci-fix
+description: Fix the failing CI check named in the card.
+effect: mutate
+skill: ci-fix
+outcomes: pass, fail
+---
+Follow the ci-fix skill against the failing check the card names — read its actual log, not a
+guess from the check's title, before changing anything.
+
+Touch only what that failure requires; this is a repair, not a chance to improve the pipeline
+along the way.
+
+Report `pass` once the named check is fixed and green.
+
+Report `fail` if the check cannot be fixed from this repo alone (an infra outage, a flake with no
+reproducible cause, a required secret that is missing), naming why.

package/src/bricks/deps-audit.md

@@ -0,0 +1,14 @@
+---
+name: deps-audit
+description: Audit this iteration's dependency changes for known vulnerabilities.
+effect: read
+skill: deps-audit
+outcomes: pass, fail
+---
+Follow the deps-audit skill against the dependency manifest this iteration's diff touched (or the
+whole manifest, if nothing else scopes it). Never edit any file; this brick only observes.
+
+Report `pass` if the audit finds nothing at high severity or above.
+
+Report `fail` on any finding at high severity or above, naming the package, the version, the
+advisory, and the fix the skill recommends (upgrade, pin, or removal).

package/src/bricks/docs-update.md

@@ -0,0 +1,15 @@
+---
+name: docs-update
+description: Update the documentation this iteration's diff made stale.
+effect: mutate
+agent: docs
+outcomes: pass
+---
+Read this iteration's diff and find every doc it made stale: a changed signature, a renamed
+flag, a moved file, a behaviour the README or docs still describe the old way.
+
+Update only those docs, only to match what the diff actually changed. Do not rewrite unrelated
+prose, reorganize a page, or fix an unrelated staleness you happen to notice while in there.
+
+Report `pass` once every doc the diff touched is back in sync, naming the files you changed — or
+that none needed it, if the diff left nothing stale.

package/src/bricks/identify.md

@@ -0,0 +1,20 @@
+---
+name: identify
+description: Choose the next iteration of the loop, or declare the requirement done.
+effect: read
+agent: explorer
+outcomes: more, done
+---
+Read the requirement and the loop's history (LOOP.md, `git log --format=%(trailers)` on this
+branch). If the requirement is fully met and the suite is green, report `done`.
+
+Otherwise pick the SMALLEST next change that moves the requirement forward and can be tested on
+its own. Report `more` with a card, as JSON:
+{"intent": "<one line>", "writeSet": ["<every file you expect to touch>"],
+ "actions": ["<each of: format, imports, rename, logic, new-file, api, delete, architecture>"]}
+
+Declare every action honestly: the diff is scored again before commit, and anything outside the
+write set or under-declared escalates to a blocking stop. If LOOP.md's notes say the previous
+attempt was re-split, make this card strictly smaller than that one.
+
+Never edit, create or delete any file: this brick only reads.

package/src/bricks/lint.md

@@ -0,0 +1,14 @@
+---
+name: lint
+description: Run the project's linter alone, without the test suite.
+effect: read
+agent: tester
+outcomes: pass, fail
+---
+Run this project's linter only — not the test suite, which is `test`'s job. Never edit any file;
+this brick only observes.
+
+Report `pass` if the linter exits clean.
+
+Report `fail` otherwise, with the raw linter output (every violation, not a count or a summary)
+so the next `apply` can act on the actual finding.

package/src/bricks/plan.md

@@ -0,0 +1,17 @@
+---
+name: plan
+description: Split the requirement into an ordered list of iterations before any code changes.
+effect: read
+agent: architect
+outcomes: pass
+---
+Read the requirement and survey the code it touches. Split the work into an ordered list of
+small iterations, each one sized to a single `identify` card — one testable change apiece.
+
+Do not edit any code; this brick only plans it. Report `pass` with a card whose intent carries
+the ordered list, one iteration per line, so it lands in LOOP.md's notes for `identify` to work
+through one at a time:
+{"intent": "<iteration 1>\n<iteration 2>\n...", "writeSet": [], "actions": []}
+
+If the requirement cannot be split — it is already one atomic change — say so in the intent and
+let the loop proceed with a single iteration.

package/src/bricks/reproduce.md

@@ -0,0 +1,16 @@
+---
+name: reproduce
+description: Write the smallest test that reproduces the bug and watch it fail.
+effect: mutate
+agent: tester
+outcomes: pass, fail
+---
+Write the smallest possible test that demonstrates the bug the requirement describes. Run it and
+confirm it fails, and that it fails FOR THE STATED REASON — not for an unrelated error.
+
+Touch only the new test file; do not change any production code here, and do not try to make the
+test pass. A reproduction that already passes proves nothing.
+
+Report `pass` once a failing reproduction exists, with the test's path and the failure it shows.
+Report `fail` if the bug cannot be reproduced from the requirement as written — say what you
+tried and why each attempt did not fail the way the requirement claims.

package/src/bricks/review.md

@@ -0,0 +1,17 @@
+---
+name: review
+description: Review this iteration's diff against the card it was supposed to implement.
+effect: read
+agent: reviewer
+outcomes: pass, fail
+---
+Read the card's intent and write set, then read the diff this iteration actually produced. Check
+that the diff matches the intent, stays inside the declared write set, and does not smuggle in an
+unrelated change.
+
+Never edit any file — findings go back to `apply`, which makes the fix.
+
+Report `pass` if the diff is a faithful, scoped implementation of the card.
+
+Report `fail` with concrete findings — `file:line`, what is wrong, what to do instead — if the
+diff drifts from the intent, touches an undeclared file, or leaves an obvious defect behind.

package/src/bricks/security-scan.md

@@ -0,0 +1,17 @@
+---
+name: security-scan
+description: Security review of this iteration's diff.
+effect: read
+agent: security
+outcomes: pass, fail
+---
+Read this iteration's diff and review it for security issues: injected input reaching a
+dangerous sink, a widened trust boundary, a secret written to disk or logs, a weakened auth or
+permission check — anything that would not survive a real security review.
+
+Never edit any file; this brick only observes and reports.
+
+Report `pass` if nothing in the diff raises a security concern.
+
+Report `fail` with each finding as `file:line`, the concrete risk, and the fix — severe enough to
+block the iteration, not a style nit that belongs in `review` instead.

package/src/bricks/test.md

@@ -0,0 +1,14 @@
+---
+name: test
+description: Run the suite and linter over this iteration's change.
+effect: read
+agent: tester
+outcomes: pass, fail
+---
+Run this project's full test suite and its linter over the current change. Never edit any file —
+this brick only observes; a fix belongs in `apply`, not here.
+
+Report `pass` only if both exit clean.
+
+Report `fail` otherwise, with the raw failures (not a paraphrase) so `apply` can act on the actual
+error rather than your summary of it. Name every failing test and lint violation you saw.

package/src/doctrines/process.md

@@ -85,7 +85,9 @@ time — a personal feature branch included. A one-time approval is not standing
 consent. Consent may cover a **named batch**: "commit as you go on this branch"
 stands for commits on that branch until the session ends or the scope changes; a
 new session, a new branch, or a widened scope re-asks. Push earns no such default
-and stays per-ask unless granted in the same named form. Before each, present in
+and stays per-ask unless granted in the same named form. A launched loop's batch
+covers commit and push on its own `loop/*` branch; merging that branch into a
+shared one never is. Before each, present in
 order (1) a plain-language summary of what changed and why and (2) the exact
 commit message you intend to use, then wait. Never push on your own initiative.
 On a **shared branch** — `main`, `master`, `develop`, `development`, a
@@ -97,13 +99,14 @@ through the git-rescue {{SKILL}} behind a backup. The host gates commit and push
 the tool boundary too, so this consent cannot be lost to a sticky allowlist.
 <!-- LEAN:else -->
 Recording and sharing code is consented, never unilateral: **every** `git commit` and
-`git push` needs the user's **explicit acceptance**, on every branch, every time; a
-one-time approval is not standing consent. A named batch ("commit as you go") stands until
-the session ends or scope changes; push earns no default. Before each, present the plain
-summary of what changed and why, the exact commit message, then wait. Shared branches —
-`main`, `master`, `develop`, `development`, `release`/`hotfix`, any you are unsure of —
-take the same gate. Never force-push, hard-reset, or rebase one: undo with a revert commit
-(git-rescue {{SKILL}} for a legitimate rewrite). The host gates both at the tool boundary.
+`git push` needs **explicit acceptance**, every branch, every time; one-time approval is
+not standing consent. A named batch ("commit as you go") stands until the session ends or
+scope changes; push earns no default. A launched loop's batch covers commit and push on
+its own `loop/*` branch only; merging it never. Show the plain summary and the exact
+commit message before each, then wait. Shared branches — `main`, `master`, `develop`,
+`development`, `release`/`hotfix`, any unsure — take the same gate. Never force-push,
+hard-reset, or rebase one: undo with a revert commit (git-rescue {{SKILL}} for a
+legitimate rewrite). The host gates both at the tool boundary.
 <!-- LEAN:end -->
 
 ### {{DOCTRINE:bound-the-loop}} Bound the Loop

package/src/loops/bugfix.json

@@ -0,0 +1,22 @@
+{
+  "name": "bugfix",
+  "description": "Reproduce the bug with a failing test, then iterate: apply the fix, test, and review, until the requirement is met and the reproduction passes.",
+  "nodes": ["reproduce", "identify", "apply", "test", "review"],
+  "start": "reproduce",
+  "edges": [
+    { "from": "reproduce", "on": "pass", "to": "identify" },
+    { "from": "reproduce", "on": "fail", "to": "$stop" },
+    { "from": "identify", "on": "more", "to": "apply" },
+    { "from": "identify", "on": "done", "to": "$close" },
+    { "from": "apply", "on": "pass", "to": "test" },
+    { "from": "test", "on": "fail", "to": "apply" },
+    { "from": "test", "on": "pass", "to": "review" },
+    { "from": "review", "on": "pass", "to": "identify" },
+    { "from": "review", "on": "fail", "to": "apply" }
+  ],
+  "loops": [
+    { "name": "iterations", "nodes": ["identify", "apply", "test", "review"], "max": 20, "iteration": true },
+    { "name": "apply-test", "nodes": ["apply", "test"], "max": 5 },
+    { "name": "review-fix", "nodes": ["apply", "test", "review"], "max": 3 }
+  ]
+}

package/src/loops/feature.json

@@ -0,0 +1,21 @@
+{
+  "name": "feature",
+  "description": "Plan the feature into ordered iterations, then build each one: apply, test, and review, until the plan is complete.",
+  "nodes": ["plan", "identify", "apply", "test", "review"],
+  "start": "plan",
+  "edges": [
+    { "from": "plan", "on": "pass", "to": "identify" },
+    { "from": "identify", "on": "more", "to": "apply" },
+    { "from": "identify", "on": "done", "to": "$close" },
+    { "from": "apply", "on": "pass", "to": "test" },
+    { "from": "test", "on": "pass", "to": "review" },
+    { "from": "test", "on": "fail", "to": "apply" },
+    { "from": "review", "on": "pass", "to": "identify" },
+    { "from": "review", "on": "fail", "to": "apply" }
+  ],
+  "loops": [
+    { "name": "iterations", "nodes": ["identify", "apply", "test", "review"], "max": 20, "iteration": true },
+    { "name": "apply-test", "nodes": ["apply", "test"], "max": 5 },
+    { "name": "review-fix", "nodes": ["apply", "test", "review"], "max": 3 }
+  ]
+}

package/src/loops/refactor.json

@@ -0,0 +1,20 @@
+{
+  "name": "refactor",
+  "description": "Confirm the suite is green before touching anything, then iterate on the shape of the code alone. Tests are not edited by this template — a refactor that needs a different test is a behaviour change, not a refactor.",
+  "nodes": ["baseline-green", "identify", "apply", "test"],
+  "start": "baseline-green",
+  "edges": [
+    { "from": "baseline-green", "on": "pass", "to": "identify" },
+    { "from": "baseline-green", "on": "fail", "to": "$stop" },
+    { "from": "identify", "on": "more", "to": "apply" },
+    { "from": "identify", "on": "done", "to": "$close" },
+    { "from": "apply", "on": "pass", "to": "test" },
+    { "from": "test", "on": "pass", "to": "identify" },
+    { "from": "test", "on": "fail", "to": "apply" }
+  ],
+  "loops": [
+    { "name": "iterations", "nodes": ["identify", "apply", "test"], "max": 20, "iteration": true },
+    { "name": "apply-test", "nodes": ["apply", "test"], "max": 5 }
+  ],
+  "weights": { "logic": 0.6 }
+}

package/src/postures/mentor.md

@@ -9,3 +9,4 @@ to finish the task.
   for yourself ({{ONTOLOGY}}: {{ONT_TELOS}}) — a wrong turn is used to teach, not just reversed.
 - **What it will not do.** Hand over a black-box result, or optimise for speed at the
   cost of your understanding. If you want just-the-answer, say so — or pick Expert.
+  To design while it writes the code, turn on the learn-mode {{SKILL}}.

package/src/skills/brick-forge.md

@@ -0,0 +1,46 @@
+# {{SKILL}}: brick-forge
+
+> {{DESC_BRICK_FORGE}}
+
+**Trigger:** the user wants a new loop brick, or to adapt an existing one to their stack — "make
+a brick for…", "our tests run differently, change the `test` brick", "the loop needs a step
+that…".
+
+## Procedure
+
+1. **Interview, one question at a time:**
+   - **name** — kebab-case, the file stem.
+   - **what it does** — one line; it becomes `description`.
+   - **effect** — does it ever create, edit or delete a file? Yes → `mutate`; never → `read`;
+     unsure → `mutate`. A `read` brick that writes stops the loop.
+   - **who runs it** — exactly one of an `agent` (one of the {{AGENTS}}) or a `skill`.
+   - **outcomes** — every result it can report, comma-separated. Each becomes an edge label a
+     loop graph must route (`{from, on: "<outcome>", to}`).
+   - **level** — project `<repo>/.geneseed/bricks/` (committed, shared with the team), global
+     `$XDG_CONFIG_HOME/geneseed/bricks/` (default `~/.config/geneseed/bricks/`, every project on
+     this machine), or shipped `src/bricks/` — only inside the Geneseed repository itself.
+2. **Write `<level>/<name>.md`**, the file stem equal to `name`:
+
+   ```
+   ---
+   name: <kebab-name>
+   description: <one line>
+   effect: read | mutate
+   agent: <agent>            (or  skill: <skill> — exactly one of the two)
+   outcomes: <a>, <b>
+   ---
+   <4-10 lines of direct instructions, ending with exactly how to choose among the outcomes>
+   ```
+
+   No double-brace tokens in the body: the loop hands it to the model raw.
+3. **Overriding by name** — a project or global brick named like a shipped one replaces it in
+   every template. That is allowed; say so to the user. `geneseed loop check` lists overrides under `overridden`.
+4. **Check it:** `geneseed loop check --brick <path>` (this file alone), then
+   `geneseed loop check` from the repository (the whole catalogue, including every template that
+   now routes through it). Fix every listed problem and re-run both.
+
+## Done when
+
+- The brick file exists at the chosen level, and both checks print `ok: true`.
+
+<!-- INCLUDE: skills/_self-improvement.md -->

package/src/skills/geneseed.md

@@ -8,7 +8,7 @@
 1. **Locate.** Run `geneseed status --json` first: `installs` lists every install on this machine — host, scope, root, state, theme, footprint, posture, mode, packs, excluded rules — and `rebuild`, the command that reproduces each one exactly. `geneseed` not on PATH → ask the user before using `npx geneseed` (it downloads the package), and prefix every command below the same way. Still nothing → look for a host root file: `~/.config/opencode/AGENT.md` or `.opencode/AGENT.md` (OpenCode), `~/.claude/CLAUDE.md` or `.claude/` (Claude Code), `.openclaude/` (OpenClaude), `AGENTS.md` beside `.bob/` (Bob). None → say so; never install to "fix" it.
 2. **Read state** with the read-only verbs, cheapest first ({{DOCTRINE:context-economy}}): `geneseed status --json`, `geneseed version`, `geneseed catalog` (optionally `agents|skills|laws|ontology|doctrines`), `geneseed doctor`, `geneseed diff`, `geneseed mcp`, `geneseed memory list`, `geneseed exclude list`.
 3. **Read a piece** from disk, not from recall ({{LAW:verify-before-asserting}}): `<root>/agents/<name>.md`, `<root>/skills/<name>/SKILL.md`, `<root>/memory/`, `<root>/notebook/`. The {{ONTOLOGY}}, the {{LAWS}} and the active {{DOCTRINES}} are numbered `## N. …` sections of the install's root file.
-4. **Change an install only when the user asked for that change** ({{LAW:one-intent-one-act}}). Take that install's `rebuild` command from step 1, edit only the flag the user named (add it if the command omits it — `--posture` and `--mode` are left out at their defaults) — `--theme`, `--footprint lean|full`, `--posture`, `--mode direct|foreman`, `--doctrines craft,rigor|none`, `--exclude-rules "process 7"|none` — dry-run it first by running the same flags through `geneseed validate`, show the command, and run it once the user agrees. Never rebuild from a bare `geneseed build`: every omitted flag resets that setting to the generator default. Confirm with `geneseed status`.
+4. **Change an install only when the user asked for that change** ({{LAW:one-intent-one-act}}). Take that install's `rebuild` command from step 1, edit only the flag the user named (add it if the command omits it — `--posture`, `--mode` and `--trust` are left out at their defaults) — `--theme`, `--footprint lean|full`, `--posture`, `--mode direct|foreman`, `--trust prudent|balanced|aggressive`, `--doctrines craft,rigor|none`, `--exclude-rules "process 7"|none` — dry-run it first by running the same flags through `geneseed validate`, show the command, and run it once the user agrees. Never rebuild from a bare `geneseed build`: every omitted flag resets that setting to the generator default. Confirm with `geneseed status`.
 5. **Other writes also need the user's word:** `geneseed memory rm <name>`, `geneseed exclude add|remove <path>`, `geneseed web start|stop`, `geneseed uninstall --target <root> --yes`. Personal rules and the profile belong to their own {{SKILLS}}; do not edit `user-rules.md` or `PROFILE.md` from here.
 6. **Never on your own initiative:** `geneseed setup` (interactive only), `geneseed upgrade`, `geneseed update`, `geneseed bootstrap`, `geneseed sync-self`, `geneseed rebuild-all`, `geneseed migrate`, `geneseed link`, `geneseed unlink`. `learn`, `context` and the `*-gate` verbs are `geneseed-hook` verbs the host's hooks run — never run them by hand.
 7. Directory and section names are plain English in every theme; only prose changes. Do not search by flavour words.