geneseed 3.11.0 → 3.12.0

package/js/loop/state.mjs

@@ -0,0 +1,322 @@
+/**
+ * The loop engine: a state machine over a brick graph, persisted as a JSON block in LOOP.md.
+ *
+ * WHY THE MODEL NEVER DECIDES. Every transition, ceiling, score and stop is computed here; the
+ * `loop` skill only runs the node it is handed and reports the brick's outcome. That is what
+ * makes four hosts behave identically, and what makes a stopped loop explainable afterwards.
+ *
+ * WHY A BLOCKING STOP ENDS THE RUN. A background task cannot wait for a person. So "blocking"
+ * is `status: awaiting` written to LOOP.md and the run ending; the user's answer relaunches it
+ * through `decide`. Crash recovery is the same path: relaunch from the branch and LOOP.md.
+ *
+ * UNITS. Work closes into a commit whenever the graph re-enters the iteration loop's head, so
+ * setup work before the loop (a reproduction test) is its own unit — iteration 0 — and never
+ * pollutes iteration 1's write set. Every cycle inside a unit is bounded by re-entry counting:
+ * `counters` is keyed by node name (not loop name), incremented on every transition into a
+ * non-terminal, non-head node, and capped at `1 + the largest max of a non-iteration loop
+ * containing that node` (or just `1` — no re-entry at all — when no such loop covers it). That
+ * bounds a cycle through a node the model forgot to put in an inner loop (a sibling brick
+ * looping back into a retry node it isn't declared inside), not only the loop the author
+ * remembered to declare. LOOP.md itself — the engine's own state file, rewritten by every CLI
+ * action — is excluded from every score and every read-brick porcelain check: it is never part
+ * of the work being scored, and including it would make every action's own bookkeeping look
+ * like an undeclared file touch.
+ */
+import { declaredRisk, actualRisk, decide, worst, PRESETS, DEFAULT_PRESET } from './score.mjs';
+import { iterationLoop, ENGINE_MAX_ITERATIONS } from './graph.mjs';
+
+const BEGIN = '<!-- loop-state:begin -->';
+const END = '<!-- loop-state:end -->';
+export const VERIFY_COMMAND = 'git add -A && git diff --cached --numstat | geneseed loop score --diff';
+export const LOOP_FILE = 'LOOP.md';
+const slash = (p) => String(p).replaceAll('\\', '/');
+
+export function renderLoopFile(state) {
+  return `# Loop — ${state.title}\n\n${state.requirement}\n\n`
+    + 'The block below belongs to the engine. You may change `preset` (prudent, balanced, '
+    + 'aggressive) or `contracts`: they apply from the next score on.\n\n'
+    + `${BEGIN}\n\`\`\`json\n${JSON.stringify(state, null, 2)}\n\`\`\`\n${END}\n`;
+}
+
+export function parseLoopFile(text) {
+  const t = String(text).replace(/\r\n/g, '\n');
+  const a = t.indexOf(BEGIN); const b = t.lastIndexOf(END);
+  if (a < 0 || b < a) throw new Error('LOOP.md has no loop-state block');
+  const inner = t.slice(a + BEGIN.length, b).replace(/^\s*```json\s*/, '').replace(/\s*```\s*$/, '');
+  return JSON.parse(inner);
+}
+
+const head = (state) => iterationLoop(state.graph).nodes[0];
+const fmt = (n) => Number(n).toFixed(1);
+
+export function initState({ title, requirement, graph, preset = DEFAULT_PRESET }) {
+  if (!PRESETS[preset]) throw new Error(`unknown preset ${JSON.stringify(preset)}`);
+  const loop = iterationLoop(graph);
+  const state = {
+    v: 1, title, requirement, preset, contracts: [], graph, node: graph.start,
+    status: 'running', awaiting: null, reason: null,
+    iteration: loop.nodes.includes(graph.start) ? 1 : 0,
+    card: null, validated: false, pendingVerify: false, closing: false, counters: {},
+    resplit: false, emptyStreak: 0, snapshot: '', visited: [], tests: 'n/a', current: {},
+    notes: [], history: [],
+  };
+  if (preset === 'prudent') { state.status = 'awaiting'; state.awaiting = { kind: 'launch' }; }
+  return state;
+}
+
+function stop(state, reason) {
+  state.status = 'stopped'; state.reason = reason;
+  return { stopped: reason };
+}
+
+function resetUnit(state) {
+  state.card = null; state.validated = false; state.counters = {}; state.visited = [];
+  state.current = {}; state.tests = 'n/a';
+}
+
+function summary(state) {
+  return {
+    iterations: state.history.length,
+    review: state.history.filter((h) => h.decision === 'soft').map((h) => ({ iteration: h.iteration, intent: h.intent })),
+    notes: state.notes,
+  };
+}
+
+export function trailers(state) {
+  const [silent, soft] = PRESETS[state.preset];
+  const declared = state.current.declared ?? 0;
+  return [
+    `Loop-Iteration: ${state.iteration}`,
+    `Loop-Bricks: ${[...new Set(state.visited)].join(',')}`,
+    `Loop-Risk-Declared: ${fmt(declared)}`,
+    `Loop-Risk-Actual: ${fmt(state.current.actual ?? declared)}`,
+    `Loop-Threshold: ${state.preset} ${fmt(silent)}/${fmt(soft)}`,
+    `Loop-Decision: ${state.current.decision ?? 'silent'}${state.current.amended ? ' (amended)' : ''}`,
+    `Loop-Tests: ${state.tests}`,
+  ].join('\n');
+}
+
+function finishUnit(state, committed) {
+  if (committed) {
+    state.history.push({
+      iteration: state.iteration, bricks: [...new Set(state.visited)],
+      declared: state.current.declared ?? 0, actual: state.current.actual ?? state.current.declared ?? 0,
+      decision: state.current.decision ?? 'silent', tests: state.tests, intent: state.card?.intent ?? '',
+    });
+  }
+  // The unit is committed (or was empty): the tree is clean again, so the read-brick check
+  // compares the next node against a clean status, not the last pre-commit one.
+  state.pendingVerify = false; state.resplit = false; state.snapshot = '';
+  resetUnit(state);
+  state.iteration += 1;
+  if (state.closing) { state.status = 'done'; state.node = '$close'; return; }
+  state.node = head(state);
+  const ceiling = Math.min(iterationLoop(state.graph).max, ENGINE_MAX_ITERATIONS);
+  if (state.iteration > ceiling) stop(state, `iteration ceiling of ${ceiling} reached`);
+}
+
+function commitUnit(state) {
+  const t = trailers(state); const iteration = state.iteration;
+  // Read before `finishUnit` resets the card for the next unit — the CLI needs it to name
+  // the commit message it writes to LOOP_COMMIT_MSG.
+  const intent = state.card?.intent ?? null;
+  finishUnit(state, true);
+  return { commit: true, trailers: t, iteration, intent };
+}
+
+function assertRunning(state) {
+  if (state.status !== 'running') throw new Error(`the loop is ${state.status}, not running`);
+}
+
+export function nextStep(state, bricks) {
+  if (state.status === 'awaiting') return { awaiting: state.awaiting, preset: state.preset };
+  if (state.status === 'done') return { terminal: '$close', summary: summary(state) };
+  if (state.status === 'stopped') return { terminal: '$stop', reason: state.reason, summary: summary(state) };
+  if (state.pendingVerify) return { verify: true, iteration: state.iteration, run: VERIFY_COMMAND };
+  const brick = bricks.get(state.node);
+  if (!brick) throw new Error(`no brick named ${state.node} in the catalogue`);
+  return {
+    node: state.node, iteration: state.iteration, effect: brick.effect, agent: brick.agent,
+    skill: brick.skill, outcomes: brick.outcomes, prompt: brick.body, card: state.card,
+    notes: state.notes, validate: brick.effect === 'mutate' && !state.validated,
+  };
+}
+
+export function scoreDeclared(state, { actions = null, writeSet = null, intent = null } = {}) {
+  assertRunning(state);
+  if (state.pendingVerify) throw new Error('the iteration is closed: run `geneseed loop score --diff` first');
+  if (actions) {
+    state.card = {
+      ...(state.card ?? {}), intent: intent ?? state.card?.intent ?? state.node,
+      actions, writeSet: writeSet ?? state.card?.writeSet ?? [],
+    };
+  }
+  if (!state.card?.actions?.length) {
+    throw new Error('no declared actions: the identify brick records a card, or pass --actions');
+  }
+  const score = declaredRisk(state.card.actions, state.graph.weights);
+  const decision = decide(score, state.preset);
+  state.validated = true;
+  state.current.declared = score;
+  state.current.decision = worst(state.current.decision, decision);
+  if (decision === 'blocking') {
+    state.status = 'awaiting';
+    state.awaiting = { kind: 'declared', iteration: state.iteration, score, threshold: PRESETS[state.preset], card: state.card };
+  }
+  return { score, preset: state.preset, threshold: [...PRESETS[state.preset]], decision };
+}
+
+export function scoreDiff(state, files) {
+  assertRunning(state);
+  if (!state.pendingVerify) throw new Error('no iteration to verify: `geneseed loop next` has not asked for one');
+  if (!Array.isArray(state.contracts) || state.contracts.some((c) => typeof c !== 'string')) {
+    throw new Error('LOOP.md: contracts must be a list of file paths');
+  }
+  const scored = files.filter((f) => slash(f.file) !== LOOP_FILE);
+  if (!scored.length) {
+    // A closing unit (reached $close with a mutate already visited) finishes as done even
+    // when this is its second empty diff in a row: there is nothing left to retry into.
+    if (state.closing) { finishUnit(state, false); return { empty: true, commit: false }; }
+    state.emptyStreak += 1;
+    if (state.emptyStreak >= 2) return stop(state, 'two consecutive iterations produced no diff');
+    finishUnit(state, false);
+    return { empty: true, commit: false };
+  }
+  state.emptyStreak = 0;
+  const { score, reasons } = actualRisk(state.current.declared ?? 0, scored, {
+    writeSet: state.card?.writeSet ?? [], contracts: state.contracts ?? [], overrides: state.graph.weights,
+  });
+  const decision = decide(score, state.preset);
+  state.current.actual = score;
+  state.current.decision = worst(state.current.decision, decision);
+  if (decision === 'blocking') {
+    state.status = 'awaiting';
+    state.awaiting = { kind: 'actual', iteration: state.iteration, score, reasons, threshold: PRESETS[state.preset] };
+    return { score, decision, reasons, commit: false };
+  }
+  return commitUnit(state);
+}
+
+function exhaust(state, loop) {
+  // Setup has no head to re-split into: the head belongs to the iterations after it.
+  if (isSetupUnit(state)) return stop(state, `setup ${loop.name} exhausted its max of ${loop.max}`);
+  if (state.resplit) {
+    return stop(state, `${loop.name} exhausted its max of ${loop.max} twice in iteration ${state.iteration}`);
+  }
+  state.notes.push(`iteration ${state.iteration}: ${loop.name} exhausted its max of ${loop.max}; re-split once`);
+  resetUnit(state);
+  state.resplit = true; state.snapshot = '';   // the skill stashes the attempt: clean tree
+  state.node = head(state);
+  return { discard: true, resplit: true };
+}
+
+// How many times node `v` may be entered in one unit: 1, plus the largest `max` of any
+// non-iteration loop that declares it — or just 1 (no re-entry) when no loop covers it.
+function allowedEntries(graph, v) {
+  const iteration = iterationLoop(graph);
+  let widest = null;
+  for (const m of graph.loops) {
+    if (m === iteration || !m.nodes.includes(v)) continue;
+    if (!widest || m.max > widest.max) widest = m;
+  }
+  return { allowed: widest ? 1 + widest.max : 1, loop: widest };
+}
+
+// Porcelain lines are `XY <path>`; strip the 2-char status + space, slash-normalise, drop
+// LOOP.md rows (the engine rewrites it on every action — it is never part of the scored work).
+function filterPorcelain(porcelain) {
+  const lines = porcelain.split(/\r?\n/).filter((line) => {
+    if (!line) return false;
+    const path = line.slice(3).replace(/^"|"$/g, '');
+    return slash(path) !== LOOP_FILE;
+  });
+  return lines.join('\n').trimEnd();
+}
+
+// Setup work (iteration 0, graph.start outside the iteration loop) is its own unit; rejecting
+// it has nowhere to retry back into, so it stops the loop instead of looping to the head.
+function isSetupUnit(state) {
+  return state.iteration === 0 && !iterationLoop(state.graph).nodes.includes(state.graph.start);
+}
+
+export function recordOutcome(state, bricks, outcome, { card = null, porcelain = null } = {}) {
+  assertRunning(state);
+  if (state.pendingVerify) throw new Error('the iteration is closed: run `geneseed loop score --diff` first');
+  const from = state.node;
+  const brick = bricks.get(from);
+  if (!brick) throw new Error(`no brick named ${from} in the catalogue`);
+  if (!brick.outcomes.includes(outcome)) {
+    throw new Error(`${from} cannot report ${JSON.stringify(outcome)} — one of ${brick.outcomes.join(', ')}`);
+  }
+  if (brick.effect === 'mutate' && !state.validated) {
+    throw new Error(`${from} modifies code: run \`geneseed loop score --declared\` before it, then record`);
+  }
+  const filteredPorcelain = porcelain === null ? null : filterPorcelain(porcelain);
+  if (brick.effect === 'read' && filteredPorcelain !== null && filteredPorcelain !== state.snapshot) {
+    return stop(state, `read-brick-wrote: ${from} changed the working tree`);
+  }
+  if (filteredPorcelain !== null) state.snapshot = filteredPorcelain;
+  if (card) state.card = card;
+  if (from === 'test') state.tests = outcome;
+  state.visited.push(from);
+
+  const edge = state.graph.edges.find((e) => e.from === from && e.on === outcome);
+  if (!edge) throw new Error(`no edge from ${from} on ${outcome}`);
+  if (edge.to === '$stop') return stop(state, `${from} reported ${outcome}`);
+  const mutated = state.visited.some((n) => bricks.get(n)?.effect === 'mutate');
+  if (edge.to === '$close') {
+    if (mutated) { state.closing = true; state.pendingVerify = true; return { verify: true }; }
+    state.status = 'done'; state.node = '$close';
+    return { done: true };
+  }
+  const h = head(state);
+  if (edge.to === h) {
+    if (mutated) { state.pendingVerify = true; state.node = h; return { verify: true }; }
+    // A read-only setup brick (no mutate visited) closes without asking for a diff score.
+    // `finishUnit` can itself hit the iteration ceiling and stop the loop — report that, not
+    // the head it was about to land on.
+    finishUnit(state, false);
+    return state.status === 'stopped' ? { stopped: state.reason } : { node: state.node };
+  }
+  state.counters[edge.to] = (state.counters[edge.to] ?? 0) + 1;
+  const { allowed, loop } = allowedEntries(state.graph, edge.to);
+  if (state.counters[edge.to] > allowed) return exhaust(state, loop ?? { name: edge.to, max: 0 });
+  state.node = edge.to;
+  return { node: edge.to };
+}
+
+export function decideAwaiting(state, bricks, verdict, note = '') {
+  if (state.status !== 'awaiting') throw new Error('nothing is awaiting a decision');
+  if (!['ok', 'no', 'amend'].includes(verdict)) throw new Error(`verdict must be ok, no or amend, not ${JSON.stringify(verdict)}`);
+  const { kind } = state.awaiting;
+  state.awaiting = null; state.status = 'running';
+  if (note) state.notes.push(`iteration ${state.iteration} (${kind}, ${verdict}): ${note}`);
+  if (kind === 'launch') {
+    return verdict === 'ok' ? { resumed: true } : stop(state, `graph ${verdict === 'no' ? 'rejected' : 'to amend'}${note ? `: ${note}` : ''}`);
+  }
+  if (kind === 'declared') {
+    if (verdict === 'ok') return { resumed: true };
+    if (verdict === 'amend') { state.card = { ...state.card, amend: note }; state.current.amended = true; return { resumed: true }; }
+    if (isSetupUnit(state)) return stop(state, `setup rejected${note ? `: ${note}` : ''}`);
+    resetUnit(state); state.node = head(state);
+    return { dropped: true };
+  }
+  // kind === 'actual': the diff exists, uncommitted
+  if (verdict === 'ok') return commitUnit(state);
+  state.pendingVerify = false; state.closing = false;
+  if (verdict === 'amend') {
+    state.card = { ...state.card, amend: note };
+    // The user intervened: the decision stands as blocking, said so, and the retry budget
+    // for this unit restarts (reset counters) now that the amendment changes what it does.
+    state.current = { declared: state.current.declared, decision: 'blocking', amended: true };
+    state.counters = {};
+    // A setup unit re-runs its own brick (graph.start), never the iteration's fix brick.
+    state.node = isSetupUnit(state)
+      ? state.graph.start
+      : iterationLoop(state.graph).nodes.find((n) => bricks.get(n)?.effect === 'mutate') ?? head(state);
+    return { resumed: true };
+  }
+  if (isSetupUnit(state)) return stop(state, `setup rejected${note ? `: ${note}` : ''}`);
+  resetUnit(state); state.node = head(state); state.snapshot = '';
+  return { discard: true };
+}

package/js/maintain/migrate.mjs

@@ -35,12 +35,14 @@ import { copyFileSync, existsSync, mkdirSync, readFileSync, rmSync } from 'node:
 import path from 'node:path';
 
 import { main as driverMain } from '../build/driver.mjs';
-import { ROOT } from '../build/source.mjs';
+import { PACK_ORDER, ROOT } from '../build/source.mjs';
 import {
   EMIT_HOST_SCOPE, defaultMode, defaultPosture, defaultTheme, doctrinesForBuild,
   footprintOfDir, installState, installTargets, modeOfDir, postureOfDir, readMaybe, themeOfDir,
+  trustOfDir,
 } from '../hosts/installs.mjs';
 import { DEFAULT_EMIT, setupBuildArgs } from '../build/generate.mjs';
+import { DEFAULT_PRESET } from '../loop/score.mjs';
 import {
   autostartPaths, autostartStale, hookShimPath, migrateShape, readJsonc, shimHome,
 } from '../hosts/settings.mjs';
@@ -222,7 +224,7 @@ export function cmdMigrate(args = {}) {
     const out = r.scope === 'global' ? null : r.root;
     const argv = setupBuildArgs(theme, emit, out, out, footprintOfDir(r.root),
       postureOfDir(r.root) || defaultPosture(), modeOfDir(r.root) || defaultMode(),
-      doctrinesForBuild(r.root));
+      doctrinesForBuild(r.root), PACK_ORDER, null, trustOfDir(r.root) || DEFAULT_PRESET);
     const label = `${r.host}:${r.scope} (${r.root})`;
     printOut(`[migrate] re-emitting ${label}: theme=${theme} emit=${emit}\n`);
     let rc = 1;

package/js/web/actions.mjs

@@ -39,6 +39,7 @@ import {
 import { withStdoutSwallowed } from '../inspect/diff.mjs';
 import { excludeAdd, excludeRemove } from '../inspect/excludes.mjs';
 import { setupBuildArgs } from '../build/generate.mjs';
+import { DEFAULT_PRESET, PRESETS } from '../loop/score.mjs';
 import { frontmatter, memoryDropIndex } from '../hosts/hooks.mjs';
 import {
   HOSTS, bobConfigDir, claudeConfigDir, expanduser, openclaudeConfigDir,
@@ -46,7 +47,7 @@ import {
 } from '../hosts/hosts.mjs';
 import {
   EMIT_HOST_SCOPE, doctrinesForBuild, excludedRulesOfDir, footprintOfDir, installState,
-  installTargets, modeOfDir, postureOfDir, readMaybe,
+  installTargets, modeOfDir, postureOfDir, readMaybe, trustOfDir,
 } from '../hosts/installs.mjs';
 import {
   MCP_PRESETS, isDict, mcpApply, mcpCommented, mcpInstallTargets, mcpKnownNames, mcpLoad,
@@ -777,6 +778,7 @@ export function apiRestore(state, files) {
       footprint: state.footprint,
       posture: state.posture,
       mode: state.mode,
+      trust: state.trust,
       // THE PACK SELECTION IS THE FIFTH, and it is the one that makes this verb a BOUNDARY
       // question rather than a cosmetic one. `expected` rendered at all four packs, and this
       // verb COPIES OUT OF IT: restoring AGENT.md onto an install built `--doctrines craft`
@@ -858,6 +860,8 @@ export function apiInstallCmd(state, body) {
   const bmode = bget(body, 'mode');
   const mode = discoverNames('modes', 'direct').includes(bmode)
     ? bmode : (modeOfDir(root) || 'direct');
+  const btrust = bget(body, 'trust');
+  const trust = Object.keys(PRESETS).includes(btrust) ? btrust : (trustOfDir(root) || DEFAULT_PRESET);
   // Unspecified means "keep what this install already has", exactly as theme, footprint,
   // posture and mode above do — a rebuild through the console is not a place to silently
   // re-decide the constitution. ⚠ AND A CARRIER WITH NO `Active packs:` MARKER (a pre-2.3
@@ -872,7 +876,7 @@ export function apiInstallCmd(state, body) {
   const excludeRules = bodyExcludeRules(body) ?? excludedRulesOfDir(root);
   const out = scope === 'global' ? null : String(root);
   const argv = setupBuildArgs(theme || 'neutral', emit, out, out, fp, pos, mode, doctrines,
-    PACK_ORDER, excludeRules);
+    PACK_ORDER, excludeRules, trust);
   return { cmd: [process.execPath, path.join(ROOT, 'bin', 'build-driver.mjs'), ...argv] };
 }
 
@@ -969,6 +973,8 @@ export function apiDeployCmd(state, body) {
   const pos = discoverNames('postures', 'peer').includes(bpos) ? bpos : 'peer';
   const bmode = bget(body, 'mode');
   const mode = discoverNames('modes', 'direct').includes(bmode) ? bmode : 'direct';
+  const btrust = bget(body, 'trust');
+  const trust = Object.keys(PRESETS).includes(btrust) ? btrust : DEFAULT_PRESET;
   // Same resolution as `apiInstallCmd` above, and for the same reason: the console's Deploy
   // form sends host/path/theme/footprint/posture/mode and NO pack selection, and nothing stops
   // it landing on a directory that already holds an install. Taking `bodyDoctrines` alone left
@@ -979,6 +985,6 @@ export function apiDeployCmd(state, body) {
   const excludeRules = bodyExcludeRules(body) ?? excludedRulesOfDir(root);
   // project-scope emit name == host name (opencode / claude / bob / openclaude)
   const argv = setupBuildArgs(theme || 'neutral', host, root, root, fp, pos, mode, doctrines,
-    PACK_ORDER, excludeRules);
+    PACK_ORDER, excludeRules, trust);
   return { cmd: [process.execPath, path.join(ROOT, 'bin', 'build-driver.mjs'), ...argv] };
 }

package/js/web/api.mjs

@@ -21,10 +21,12 @@ import { excludesSnapshot } from '../inspect/excludes.mjs';
 import { GLOBAL_MANIFEST, HOSTS, opencodeConfigDir, resolvePath } from '../hosts/hosts.mjs';
 import {
   doctrinesForBuild, excludedRulesOfDir, footprintOfDir, installState, installTargets,
-  installedDefaults, modeOfDir,
+  installedDefaults, modeOfDir, trustOfDir,
   postureOfDir, readJsonMaybe, readMaybe, themeOfDir,
 } from '../hosts/installs.mjs';
 import { frontmatter } from '../hosts/hooks.mjs';
+import { DEFAULT_PRESET, PRESETS } from '../loop/score.mjs';
+import { loadCatalog, catalogProblems } from '../loop/catalog.mjs';
 import {
   SKILL_CLASS, entityStatus, loadRegistry, tuiInventory,
 } from '../inspect/inventory.mjs';
@@ -87,6 +89,7 @@ export function webState(theme = null, target = null) {
     footprint: null,
     posture: null,
     mode: null,
+    trust: null,
     _inv: null,
     _doctor: null,
   };
@@ -98,6 +101,7 @@ export function webState(theme = null, target = null) {
   st.footprint = footprintOfDir(st.target);      // 'full' when no marker
   st.posture = postureOfDir(st.target) || 'peer';
   st.mode = modeOfDir(st.target) || 'direct';
+  st.trust = trustOfDir(st.target) || DEFAULT_PRESET;
 
   Object.defineProperty(st, 'inventory', {
     get() {
@@ -154,6 +158,7 @@ export function webState(theme = null, target = null) {
     st.footprint = footprintOfDir(st.root);
     st.posture = postureOfDir(st.root) || 'peer';
     st.mode = modeOfDir(st.root) || 'direct';
+    st.trust = trustOfDir(st.root) || DEFAULT_PRESET;
     st._inv = null;
     st._doctor = null;
   };
@@ -165,6 +170,7 @@ export function webState(theme = null, target = null) {
     st.footprint = footprintOfDir(st.root);
     st.posture = postureOfDir(st.root) || 'peer';
     st.mode = modeOfDir(st.root) || 'direct';
+    st.trust = trustOfDir(st.root) || DEFAULT_PRESET;
   };
   return st;
 }
@@ -741,11 +747,12 @@ export function apiInstalls(state) {
       footprint: footprintOfDir(root),
       posture: postureOfDir(root),
       mode: modeOfDir(root),
+      trust: trustOfDir(root),
       selected: samePath(viewCfg(host, scope, root), state.target),
     });
   }
   return { installs: out, postures: discoverNames('postures', 'peer'),
-    modes: discoverNames('modes', 'direct') };
+    modes: discoverNames('modes', 'direct'), trusts: Object.keys(PRESETS) };
 }
 
 /** Beside the deployed AGENT.md. */
@@ -848,6 +855,9 @@ export function apiOverview(state) {
       notebook: notebookItems(state).length,
       wiki: wikiItems(state).length,
       config: configItems(state).length,
+      // The rail's Loops badge: templates only, from the same catalogue `/api/loops` reads —
+      // a brick is a part, the template is what a person runs.
+      loops: loadCatalog({ projectRoot: state.root }).templates.size,
     },
     doctor: state.doctor,
     diff,
@@ -933,6 +943,31 @@ export function apiRecent(state) {
   return { items: items.slice(0, RECENT_LIMIT), skipped, limit: RECENT_LIMIT };
 }
 
+/**
+ * The Loops page: the brick and template catalogue the `geneseed loop` CLI reads, resolved from
+ * the install ROOT — for a project install that is the repo, where `<repo>/.geneseed/` lives; for
+ * a global one it is the config dir, which has no `.geneseed/` and so adds nothing. Read-only:
+ * the page draws templates and lists bricks, it never writes one.
+ *
+ * A template's graph is passed whole (`graph`) rather than flattened, because the page's ring
+ * layout needs `nodes`, `edges` and `loops` exactly as the engine reads them.
+ */
+export function apiLoops(state) {
+  const { bricks, templates, overridden } = loadCatalog({ projectRoot: state.root });
+  const byName = ([a], [b]) => (a < b ? -1 : 1);
+  return {
+    templates: [...templates].sort(byName).map(([name, { origin, ...graph }]) => ({
+      name, description: graph.description || '', origin, graph,
+    })),
+    bricks: [...bricks].sort(byName).map(([, b]) => ({ reason: null, ...b })),
+    overridden,
+    // A brick or template the catalogue skipped (bad frontmatter, not JSON, misnamed), and a
+    // template that fails the graph rules: the page says so — the same list `loop check`
+    // prints — or a team's broken override would just silently not be there.
+    problems: catalogProblems({ projectRoot: state.root }),
+  };
+}
+
 /** The source's release label, or null when it cannot be read. */
 function releaseLabel() {
   const v = sourceReleaseVersion({ config: CONFIG });
@@ -982,4 +1017,5 @@ export const STATE_ROUTES = {
   // answers — a daemon whose POST worked and whose GET 501'd would have no way to obtain one.
   '/api/rules': apiRules,
   '/api/mcp': apiMcp,
+  '/api/loops': apiLoops,
 };

package/js/web/daemon.mjs

@@ -267,9 +267,42 @@ export async function startDaemon(theme, port, openBrowser = true) {
   return 1;
 }
 
-export async function stopDaemon(theme = null) {
+/**
+ * `--port` NAMES WHICH DAEMON, and the record holds only one. With no `--port` (`port` null)
+ * the verbs act on whatever the record names, as they always have. With one, they act only if
+ * the record is on that port: `stop --port 4791` once POSTed shutdown to the recorded url and
+ * stopped the console on 4747. So a record on another port is refused — no request sent, record
+ * left in place — and a server answering on the named port that is NOT the record is explained,
+ * because its token is not on record and there is nothing to guess it from.
+ *
+ * Null when the verb may go ahead; otherwise the exit code, already explained on stdout.
+ */
+async function portRefusal(st, port, verb) {
+  if (port === null || port === undefined) return null;
+  const recorded = isTruthy(st) && isTruthy(st.url) ? Number(st.port) : null;
+  if (recorded === port) return null;
+  if (recorded !== null) {
+    if (verb === 'status') {
+      printOut(`[web] not running on port ${port} (the recorded daemon is on port ${recorded}).\n`);
+    } else {
+      printOut(`[web] the recorded daemon is on port ${recorded}, not ${port} — not touching it.\n`);
+      printOut(`      \`geneseed web ${verb} --port ${recorded}\` (or no --port) ${verb}s that one.\n`);
+    }
+  }
+  if (await probe(`http://127.0.0.1:${port}`)) {
+    printOut(`[web] a server answers on port ${port} but is not the recorded daemon, so its `
+      + 'token is unknown — stop it from its own page (Stop) or end its process.\n');
+    return 1;
+  }
+  // Nothing recorded and nothing on the named port: the verb's own no-daemon arm says so.
+  return recorded === null ? null : 1;
+}
+
+export async function stopDaemon(theme = null, port = null) {
   const { target } = webState(theme);
   const st = readDaemon(target);
+  const refused = await portRefusal(st, port, 'stop');
+  if (refused !== null) return refused;
   if (!isTruthy(st) || !isTruthy(st.url)) {
     // NO `clearDaemon` HERE — deliberately asymmetric with `liveDaemon`/`statusDaemon`,
     // which DO delete a record naming no url. Unifying the two would delete a file this
@@ -287,8 +320,10 @@ export async function stopDaemon(theme = null) {
   return 0;
 }
 
-export async function statusDaemon(theme = null) {
+export async function statusDaemon(theme = null, port = null) {
   const { target } = webState(theme);
+  const refused = await portRefusal(readDaemon(target), port, 'status');
+  if (refused !== null) return refused;
   const st = await liveDaemon(target);
   if (st) {
     printOut(`[web] running on ${st.url}  (theme: ${none(st.theme)}, pid ${none(st.pid)})\n`);
@@ -322,19 +357,22 @@ export async function bounceDaemonIfRunning(theme, log, { onlyIfStale = false }
     return;
   }
   try {
-    await restartDaemon(theme, 4747, false, true);
+    await restartDaemon(theme, null, false, true);
   } catch (e) {
     log(`[geneseed] ⚠️  could not refresh the web daemon (${e && e.message ? e.message : e}) — \`geneseed web restart\` manually if it was running.`);
   }
 }
 
-export async function restartDaemon(theme = null, port = 4747, openBrowser = true,
+/** `port` null keeps the recorded daemon's port (4747 if none); see `portRefusal`. */
+export async function restartDaemon(theme = null, port = null, openBrowser = true,
   onlyIfRunning = false) {
   const { target } = webState(theme);
   const st = readDaemon(target);
+  const refused = await portRefusal(st, port, 'restart');
+  if (refused !== null) return refused;
   const live = (await liveDaemon(target)) !== null;
   if (onlyIfRunning && !live) return 0;
-  const usePort = (st && isTruthy(st.port) ? st.port : null) || port;
+  const usePort = port ?? ((st && isTruthy(st.port) ? st.port : null) || 4747);
   let open = openBrowser;
   if (live) {
     // A live daemon means a tab is already open on this (preserved) port and will

package/js/web/handler.mjs

@@ -295,6 +295,7 @@ export function makeHandler(state, jm, token, dist, holder = null) {
     // packs — never to `harness.config.json`, which would drop the consent gate.
     const cmds = actionCommands(action, {
       theme, emit, footprint: state.footprint, posture: state.posture, mode: state.mode,
+      trust: state.trust,
       doctrines: doctrinesForBuild(state.target),
     });
     if (!isTruthy(cmds)) {

package/js/web/jobs.mjs

@@ -88,6 +88,7 @@ import path from 'node:path';
 
 import { ROOT, PACK_ORDER } from '../build/source.mjs';
 import { setupBuildArgs } from '../build/generate.mjs';
+import { DEFAULT_PRESET } from '../loop/score.mjs';
 import { isDict } from '../hosts/mcp.mjs';
 import { readText, writeText, isFile } from '../lib/fs.mjs';
 import { jsonDumpsCompact, parseJson, isTruthy } from '../lib/json.mjs';
@@ -402,9 +403,10 @@ export const INLINE_ACTIONS = ['restore', 'install', 'deploy'];
 function actionTable({
   theme = 'neutral', emit = 'opencode-global', footprint = 'full',
   posture = 'peer', mode = 'direct', doctrines = [...PACK_ORDER], excludeRules = [],
+  trust = DEFAULT_PRESET,
 } = {}) {
   const buildArgv = setupBuildArgs(theme, emit, null, null, footprint, posture, mode,
-    doctrines, PACK_ORDER, excludeRules);
+    doctrines, PACK_ORDER, excludeRules, trust);
   return {
     doctor: [[NODE(), CLI(), 'doctor']],
     build: [[NODE(), GEN(), ...buildArgv]],

package/js/web/server.mjs

@@ -200,9 +200,11 @@ export async function cmdWeb(args) {
   const port = args.port === null ? 4747 : parseIntStrict(args.port);
   const openBrowser = !args.noBrowser;
   if (args.action === 'start') return startDaemon(args.theme, port, openBrowser);
-  if (args.action === 'stop') return stopDaemon(args.theme);
-  if (args.action === 'restart') return restartDaemon(args.theme, port, openBrowser);
-  if (args.action === 'status') return statusDaemon(args.theme);
+  // Only an EXPLICIT --port scopes these three to one daemon; absent, they act on the record.
+  const named = args.port === null ? null : port;
+  if (args.action === 'stop') return stopDaemon(args.theme, named);
+  if (args.action === 'restart') return restartDaemon(args.theme, named, openBrowser);
+  if (args.action === 'status') return statusDaemon(args.theme, named);
   return serve({ theme: args.theme, port, openBrowser, daemon: args.daemonInternal });
 }
 

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "Every field here is argued and gated in tests/unit/package_manifest.test.mjs. `files`, `bin` and `engines` each have a test that fails when reality drifts from this file; `version` mirrors harness.config.json and is gated too. Read that docblock before editing this one.",
   "name": "geneseed",
-  "version": "3.11.0",
+  "version": "3.12.0",
   "description": "A portable, theme-able harness you implant once and use everywhere to grow a disciplined AI coding agent.",
   "keywords": [
     "ai",