geneseed 3.11.0 → 3.13.0

package/js/hosts/gitref.mjs

@@ -0,0 +1,99 @@
+/**
+ * js/hosts/gitref.mjs — "what branch, and is a loop running here", read straight off the
+ * filesystem. Never spawns git.
+ *
+ * ONE OWNER, fs/path ONLY, NOTHING ELSE. Before this module, `currentBranch` and the
+ * launched-loop evidence reader were duplicated in `js/hosts/hooks.mjs` (the hook's
+ * `loopExempt`) and `js/loop/cli.mjs` (the CLI's commit-message writer) — two copies of the
+ * same worktree-following walk that could silently drift apart. Both now import this one.
+ * `js/hosts/hooks.mjs` is NOT a safe shared home for it: it pulls in `node:child_process`
+ * (`spawnSync`, for the destructive-act guard's own concerns) and the hook-dispatch
+ * machinery (`jsonDumpsCompact`, the ledger), none of which `js/loop/cli.mjs` — under a hard
+ * `child_process` ban like every other closure that feeds `bin/geneseed-cli.mjs` — may ever
+ * import. A module that is fs/path only is importable from anywhere.
+ *
+ * The OpenCode guard plugin (`adapters/opencode/plugins/geneseed-guard.js`) keeps its own
+ * standalone copy — it cannot import from `js/` at all — kept in step by hand, commented as
+ * this module's twin.
+ */
+import { existsSync, statSync, lstatSync, readFileSync, openSync, readSync, closeSync } from 'node:fs';
+import path from 'node:path';
+
+/**
+ * The directory holding `.git` for `cwd` — walking up from `cwd`. A worktree's `.git` is a
+ * FILE naming its gitdir elsewhere; LOOP.md always lives beside that FILE, not beside the
+ * gitdir it points to, so this is the directory the launched-loop evidence reader looks in.
+ * null on anything unexpected.
+ */
+export function gitRootOf(cwd) {
+  try {
+    let dir = path.resolve(cwd);
+    for (;;) {
+      if (existsSync(path.join(dir, '.git'))) return dir;
+      const up = path.dirname(dir);
+      if (up === dir) return null;
+      dir = up;
+    }
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * The `.git` DIRECTORY for `root` — itself, or the gitdir a worktree's `.git` FILE names.
+ * Throws if `.git` is a file that does not name one: a malformed worktree link is a louder
+ * failure than a silent "no gitdir", and every caller here wants to know before it acts on it.
+ */
+export function gitDirOf(root) {
+  const dotgit = path.join(root, '.git');
+  if (statSync(dotgit).isFile()) {
+    const m = /^gitdir:\s*(.+?)\s*$/m.exec(readFileSync(dotgit, 'utf8'));
+    if (!m) throw new Error(`${dotgit} does not name a gitdir`);
+    return path.resolve(root, m[1]);
+  }
+  return dotgit;
+}
+
+/**
+ * The branch checked out in `cwd`, read from .git/HEAD without spawning git. null on
+ * anything unexpected (detached HEAD, no repo, a malformed worktree link, unreadable) — the
+ * caller then falls back to asking, never to allowing.
+ */
+export function currentBranch(cwd) {
+  try {
+    const root = gitRootOf(cwd);
+    if (!root) return null;
+    const ref = /^ref:\s*refs\/heads\/(.+?)\s*$/m.exec(readFileSync(path.join(gitDirOf(root), 'HEAD'), 'utf8'));
+    return ref ? ref[1] : null;
+  } catch {
+    return null;
+  }
+}
+
+const LOOP_STATE_MARKER = '<!-- loop-state:begin -->';
+
+/**
+ * Whether `<root>/LOOP.md` carries the engine's state marker — `geneseed loop init`'s mark
+ * that a loop was actually LAUNCHED here, not merely that the branch is named `loop/...`,
+ * which anyone can type. `lstatSync` (never `statSync`, which follows a link) must find an
+ * ordinary file: a FIFO would block the read, and a symlink could point anywhere outside the
+ * repo — either makes "LOOP.md says so" a claim this reader cannot stand behind. Read at
+ * most the first 64 KB: the marker is not on the first line (it follows the title and the
+ * requirement), so it must appear within those 64 KB — a huge LOOP.md (notes, history) must
+ * never make this check slow.
+ */
+export function loopLaunched(root) {
+  let fd;
+  try {
+    const p = path.join(root, 'LOOP.md');
+    if (!lstatSync(p).isFile()) return false;
+    fd = openSync(p, 'r');
+    const buf = Buffer.alloc(65536);
+    const n = readSync(fd, buf, 0, buf.length, 0);
+    return buf.toString('utf8', 0, n).includes(LOOP_STATE_MARKER);
+  } catch {
+    return false;
+  } finally {
+    if (fd !== undefined) { try { closeSync(fd); } catch { /* already gone */ } }
+  }
+}

package/js/hosts/hooks.mjs

@@ -56,6 +56,7 @@ import { NO_WINDOW } from '../lib/proc.mjs';
 import {
   GATE_LEDGER, resolveMemoryDir, resolvePath, sovereignBypass,
 } from './hosts.mjs';
+import { currentBranch, gitRootOf, loopLaunched } from './gitref.mjs';
 
 const ROOT = path.resolve(import.meta.dirname, '../..');
 
@@ -599,6 +600,88 @@ const GIT_GATE_RE = /\bgit\b[^\n]*\b(?:commit|push)\b/;
 const DESTRUCTIVE_GIT_RE =
   /\bgit\b[^\n]*\b(?:reset\s+--hard|clean\s+-[a-zA-Z]*f|branch\s+-D|checkout\s+--\s|push\s+[^\n]*--force)/;
 
+// `loopExempt` — a WHITELIST, not the blacklist this replaced. A false ask costs one prompt; a
+// false allow publishes. So the exemption holds only when the ENTIRE command is built from
+// forms read in full below, on a branch a loop was actually launched on (LOOP.md's state
+// marker, left by `geneseed loop init` — not just a name starting with `loop/`, which anyone
+// can type). `currentBranch`/`gitRootOf`/`loopLaunched` live in `./gitref.mjs` — the one
+// fs-only reader this file shares with `js/loop/cli.mjs`'s commit-message writer.
+
+// No newline, backtick, or `$(` substitution anywhere — these can smuggle a second command (or
+// a shared-branch target) past every check below, so the command is refused before it is even
+// split. `<`/`>` are refused too: a redirect can both hide a second effect and, as the review
+// found, trail off the end of an otherwise-whitelisted push (`HEAD:main>/dev/null`). A single
+// `&` — not doubled into `&&` — is refused too: a shell runs `a & b` as TWO commands just like
+// `a && b`, and the review found it unparsed by the splitter below, which only recognised the
+// doubled form. `(?<!&)&(?!&)` matches a lone `&` without also matching either half of `&&`.
+const UNSAFE_CHARS_RE = /[\n`<>]|\$\(|(?<!&)&(?!&)/;
+
+// The only three git shapes a loop's own automation ever needs: adding unquoted paths,
+// committing via `-F`/`--file` (so the message text, which may contain anything, never has to
+// be quoted on this command line at all — see `js/loop/cli.mjs`'s LOOP_COMMIT_MSG), and
+// read-only inspection. The token class `[\w./:@^~=+,-]` excludes quotes, braces, `!`, `*`,
+// `$` and `&` — a brace or glob expansion (`{a,b}`, `*`) is exactly how a shell can turn one
+// whitelisted-looking token into several unknown ones, so no pattern's path/arg tokens may
+// contain them. The SAME class is the `-F`/`--file` path, not the looser `[^\s'"]+` this once
+// was: with that loose class, `git commit -F {m,--amend}` brace-expands to `git commit -F m
+// --amend` and `git commit -F m*` glob-expands to whatever matches — either turns a commit of
+// the loop's own message file into an amend of the last one. `ARG_RE` already accepts a drive
+// letter (`C:/…`) via its `:`, so tightening it here costs nothing the loop's own writer uses.
+const ARG_RE = '[\\w./:@^~=+,-]+';
+const SEG_ADD_RE = new RegExp(`^git\\s+add(\\s+${ARG_RE})*$`);
+const SEG_COMMIT_RE = new RegExp(`^git\\s+commit(\\s+-q)?\\s+(-F\\s+|--file[=\\s])${ARG_RE}(\\s+-q)?$`);
+const SEG_READONLY_RE = new RegExp(`^git\\s+(status|diff|log|rev-parse|show)(\\s+${ARG_RE})*$`);
+
+/**
+ * `git push`, exactly: `[-u|--set-upstream] <remote> HEAD:<branch>` or
+ * `HEAD:refs/heads/<branch>` — the ONLY exempt form. Bare `git push`, a remote alone, a plain
+ * branch name, or bare `HEAD` are no longer enough: every one of those is redirectable by
+ * `push.default`/`remote.*.push`/an upstream config this read cannot see, which is exactly how
+ * the review's re-review turned "looks like it only pushes `loop/x`" into "pushes wherever the
+ * repo's config says". An EXPLICIT `HEAD:<ref>` refspec is immune to both — git ignores
+ * `push.default` once a refspec is given, and a mirror/`+`/`:`-prefixed form refuses to
+ * coexist with one. The remote's first character must be alphanumeric so a flag (`-f`,
+ * `--all`, `--delete`, …) can never be read as a remote name.
+ */
+function pushSegmentOk(seg, branch) {
+  const m = /^git\s+push(?:\s+(.*))?$/.exec(seg);
+  if (!m) return false;
+  const rest = (m[1] || '').trim();
+  if (!rest) return false;
+  const tokens = rest.split(/\s+/);
+  let i = 0;
+  if (tokens[i] === '-u' || tokens[i] === '--set-upstream') i += 1;
+  const remote = tokens[i];
+  if (remote === undefined || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(remote)) return false;
+  i += 1;
+  const ref = tokens[i];
+  i += 1;
+  if (ref === undefined || i !== tokens.length) return false;
+  return ref === `HEAD:${branch}` || ref === `HEAD:refs/heads/${branch}`;
+}
+
+/**
+ * Consent Before Push's loop/* exemption: true only when EVERY clause holds —
+ * (1) the command carries none of the characters that could smuggle a second effect past this
+ * read, (2)-(3) every `&&`/`;`/`||`/`|`-separated segment is one of the three whitelisted git
+ * shapes above, with every push segment also passing `pushSegmentOk`, and (4) the branch
+ * checked out in `cwd` starts with `loop/` AND its git root carries a launched LOOP.md. Splitting
+ * on the separators without respecting quotes is deliberate, not an oversight: (1) and the
+ * per-segment whitelist already refuse any segment a quoted separator could produce, because a
+ * quote character fails every one of the three segment patterns.
+ */
+export function loopExempt(command, cwd) {
+  if (typeof command !== 'string' || UNSAFE_CHARS_RE.test(command)) return false;
+  const branch = currentBranch(cwd);
+  if (!branch || !branch.startsWith('loop/')) return false;
+  const root = gitRootOf(cwd);
+  if (!root || !loopLaunched(root)) return false;
+  const segments = command.split(/&&|\|\||[;|]/).map((s) => s.trim()).filter(Boolean);
+  if (!segments.length) return false;
+  return segments.every((seg) => SEG_ADD_RE.test(seg) || SEG_COMMIT_RE.test(seg)
+    || SEG_READONLY_RE.test(seg) || pushSegmentOk(seg, branch));
+}
+
 /** The `permissionDecision: "ask"` document, in Python's compact `json.dumps` spelling. */
 function askDecision(reason) {
   return `${jsonDumpsCompact({
@@ -739,8 +822,12 @@ function gitDecide(args, payload) {
       + 'discarding git act needs confirmation bound to this specific command');
   }
   // `--no-consent`: the process pack (or process 5 alone) is off, so the commit/push ask has
-  // no rule behind it — but Law IV above is universal and has already run.
+  // no rule behind it — but Law IV above is universal and has already run. Checked before
+  // `loopExempt` so a non-git command, or one with consent off, never pays for the whitelist.
   if (args.noConsent || !GIT_GATE_RE.test(command)) return 0;
+  // Consent Before Push: a loop launched on its own `loop/*` branch is a named batch for a
+  // fixed set of commit/push forms on that branch only — never a merge into anything shared.
+  if (loopExempt(command, (payload && payload.cwd) || process.cwd())) return 0;
   return ask(args, 'git-gate', 'process-5', 'Geneseed (Consent Before Push) \u2014 every git '
     + 'commit/push needs explicit approval; to see the change first, use the explain-changes skill');
 }

package/js/hosts/installs.mjs

@@ -230,6 +230,27 @@ function leadOfDir(d, names) {
 export const postureOfDir = (d) => leadOfDir(d, discoverNames('postures', 'peer'));
 export const modeOfDir = (d) => leadOfDir(d, discoverNames('modes', 'direct'));
 
+/**
+ * The loop skill's default trust preset, read back off a deployed install — `null` when no
+ * loop skill is deployed there.
+ *
+ * CARRIED BY THE SKILL, NOT BY A CARRIER: `--trust` is the one build axis with zero always-on
+ * footprint, so it is not in AGENT.md to be found. The skill renders a literal
+ * `Default trust preset: **<Label>**` line, and this scans the places an emit lands it: the
+ * native layer (`skills/loop/SKILL.md`, in the root itself for a global install and under the
+ * host's `projectMarker` for a project one) and the plain bundle (`skills/loop.md`).
+ */
+const TRUST_RE = /^Default trust preset: \*\*(Prudent|Balanced|Aggressive)\*\*/m;
+export function trustOfDir(d) {
+  for (const base of ['', ...HOSTS.map((h) => h.projectMarker)]) {
+    for (const rel of [['skills', 'loop', 'SKILL.md'], ['skills', 'loop.md']]) {
+      const m = TRUST_RE.exec(readMaybe(path.join(d, base, ...rel)) ?? '');
+      if (m) return m[1].toLowerCase();
+    }
+  }
+  return null;
+}
+
 /** The `Active packs:` marker line the template emits, in one of the five carriers. */
 const ACTIVE_PACKS_RE = /^Active packs:[ \t]*(.+?)[ \t]*$/m;
 

package/js/hosts/mcp.mjs

@@ -68,7 +68,7 @@ export const MCP_PRESETS = {
       + 'install). Edit GITLAB_PERSONAL_ACCESS_TOKEN (scopes: api, read_repository) '
       + 'and GITLAB_API_URL before use. For a second instance (a self-hosted server), '
       + 'copy this block by hand under a new name and point it at the other URL — '
-      + 'docs/guides/mcp.md has the pattern.',
+      + 'docs/guides/mcp-gitlab.md has the pattern.',
     block: {
       type: 'local',
       command: ['npx', '-y', '@zereight/mcp-gitlab'],

package/js/hosts/native.mjs

@@ -149,12 +149,50 @@ function triggerOf(text) {
  * 900-char cap the catalogue weighed 22k chars (~5.6k tokens) across 51 skills, three times
  * the figure the footprint page quoted. The first sentence says WHEN; the later sentences
  * disambiguate, and the body — read as soon as the skill is chosen — still carries them.
- * Cut at the last sentence end inside the cap, never mid-word.
+ * Cut at the last sentence end inside the cap, never mid-word. The `…` fallback (no sentence
+ * end inside the cap) is a truncated routing signal: `checkBuild` reports it as a doctor
+ * failure, so the cure is a shorter first trigger sentence in the source, never a wider cap.
  */
 const DESCRIPTION_CAP = 320;
 function skillDescription(text) {
-  const desc = descOf(text);
-  const trig = triggerOf(text);
+  return withWhen(descOf(text), triggerOf(text));
+}
+
+/**
+ * The `## When to dispatch` section's FIRST bullet, flattened like `triggerOf` — the agent's
+ * WHEN. Claude Code delegates on the subagent `description:` alone, and a purpose line
+ * ("Writes, runs, and diagnoses tests.") says what an agent does but never when to hand it
+ * work; the dispatch list carried that, in a body the router never reads.
+ */
+function dispatchOf(text) {
+  const lines = text.split('\n');
+  const start = lines.findIndex((ln) => /^##\s+When to dispatch\b/.test(ln.trim()));
+  if (start < 0) return '';
+  const para = [];
+  for (let i = start + 1; i < lines.length; i += 1) {
+    const s = lines[i].trim();
+    if (!para.length) {
+      if (s.startsWith('- ')) para.push(s.slice(2));
+      else if (s.startsWith('#')) break;
+      continue;
+    }
+    if (s === '' || s.startsWith('- ') || s.startsWith('#')) break;
+    para.push(s);
+  }
+  return para.join(' ')
+    .replace(HTML_COMMENT_RE, '')
+    .replace(/\[([^\]]+)\]\([^)]*\)/g, '$1')
+    .replace(/\s+/g, ' ')
+    .trim();
+}
+
+/** The emitted `description:` of an agent — purpose + its first dispatch condition. */
+export function agentDescription(text) {
+  return withWhen(descOf(text), dispatchOf(text));
+}
+
+/** Purpose + ` Use when: ` + the first sentence of `trig`, capped — see `skillDescription`. */
+function withWhen(desc, trig) {
   if (!trig) return desc;
   const first = trig.match(/^.*?[.;](?=\s|$)/);
   const full = `${desc} Use when: ${first ? first[0] : trig}`;
@@ -302,7 +340,7 @@ const WEBFETCH_MARKER = '<!-- webfetch: allow -->';
  * Bash keeps the unmarked line byte-identical to what it was before the webfetch marker existed.
  */
 function claudeAgentFrontmatter(stem, text, overrides) {
-  const fm = [`name: ${stem}`, `description: ${jsonDumps(descOf(text))}`];
+  const fm = [`name: ${stem}`, `description: ${jsonDumps(agentDescription(text))}`];
   const ov = agentOverride(overrides, stem);
   if (isTruthy(ov.model)) fm.push(`model: ${formatValue(ov.model)}`);
   if (isReadonly(text)) {
@@ -316,7 +354,7 @@ function claudeAgentFrontmatter(stem, text, overrides) {
 
 /** `_build_emit._opencode_agent_frontmatter`. */
 function opencodeAgentFrontmatter(stem, text, overrides, theme = null) {
-  const fm = [`description: ${jsonDumps(descOf(text))}`, 'mode: subagent'];
+  const fm = [`description: ${jsonDumps(agentDescription(text))}`, 'mode: subagent'];
   fm.push(`color: ${agentColor(stem, theme)}`);
   pushOverrideLines(fm, agentOverride(overrides, stem));
   if (isReadonly(text)) {

package/js/inspect/checks-authoring.mjs

@@ -25,6 +25,7 @@ import { NO_WINDOW } from '../lib/proc.mjs';
 import {
   folderSkillProblems, registryProblems, secretProblems, vendorPinProblems,
 } from './checks-repo.mjs';
+import { catalogProblems } from '../loop/catalog.mjs';
 import { LAW_CLASS, LAW_CLASSES, SKILL_CLASS } from './inventory.mjs';
 import { NOTE, globSorted, has, isDir, isFile, rglob, srcStems } from './scan.mjs';
 import { spawnSync } from 'node:child_process';
@@ -836,6 +837,15 @@ function loadLearnPromptHead() {
     + 'When in doubt, output exactly: NOTHING.';
 }
 
+/**
+ * The shipped loop catalogue parses and every shipped template passes the engine's own graph
+ * rules. Global and project bricks are deliberately out of scope: doctor judges what this
+ * checkout ships, not what a user wrote in their config.
+ */
+export function loopProblems() {
+  return catalogProblems({ projectRoot: null, globalLevel: false });
+}
+
 /**
  * `_harness_build._authoring_problems` — author-time gates on the source specs and plugins.
  *

package/js/inspect/checks-build.mjs

@@ -81,6 +81,34 @@ export function checkBuild(themeName, out, isVendored = isVendoredPath) {
       problems.push(`[${themeName}] unresolved token ${tok} in ${rel}`);
     }
     for (const p of linkProblems(md, text, outAbs, rel)) problems.push(`[${themeName}] ${p}`);
+    for (const p of descriptionProblems(text, rel)) problems.push(`[${themeName}] ${p}`);
+  }
+  return problems;
+}
+
+/**
+ * The `description:` of an emitted native skill or agent, held to Anthropic's skill-authoring
+ * rules — it is the ONLY text a host routes on, so a defect here is a skill that silently
+ * never fires. Three arms: a `…` ending is `withWhen`'s mid-sentence fallback (the trigger
+ * was cut, cure it with a shorter first trigger sentence); an XML-looking tag is rejected
+ * outright by the Agent Skills spec; a first/second-person pronoun is the point-of-view drift
+ * the spec warns degrades discovery, since the text is injected into the system prompt.
+ * The pronoun arm reads only the `Use when:` half, and skips quoted user phrases ("teach me
+ * X" is what the user types, not the description's voice): the purpose half is the theme's
+ * persona copy ("Make your own OpenCode theme"), authored per theme on purpose.
+ * Files without frontmatter (every bundle `.md`, AGENT.md) carry no description and pass.
+ */
+const DESC_LINE_RE = /^---\n(?:.*\n)*?description: (".*")\n(?:.*\n)*?---\n/;
+export function descriptionProblems(text, rel) {
+  const m = text.match(DESC_LINE_RE);
+  if (!m) return [];
+  const desc = parseJson(m[1]);
+  const problems = [];
+  if (desc.endsWith('…')) problems.push(`description cut mid-sentence in ${rel} — shorten the first trigger sentence`);
+  if (/<\/?[A-Za-z][^>]*>/.test(desc)) problems.push(`description carries an XML-like tag in ${rel}`);
+  const when = desc.split(' Use when: ')[1] ?? '';
+  if (/\b(I|I'm|me|my|you|you're|your)\b/i.test(when.replace(/"[^"]*"|\bI\/O\b/g, ''))) {
+    problems.push(`description's "Use when" is not in the third person in ${rel}`);
   }
   return problems;
 }

package/js/inspect/diff.mjs

@@ -46,6 +46,7 @@ import {
 } from '../hosts/hosts.mjs';
 import {
   EMIT_HOST_SCOPE, defaultTheme, doctrinesForBuild, footprintOfDir, modeOfDir, postureOfDir,
+  trustOfDir,
   readJsonMaybe, readMaybe, themeOfDir,
 } from '../hosts/installs.mjs';
 import { unifiedDiff, splitLines } from '../lib/udiff.mjs';
@@ -175,6 +176,8 @@ export function diffCollect({ target = null, theme = null, emit = null, footprin
       // `null` (no marker) means unknown and renders at all four, which `doctrinesForBuild`
       // makes explicit rather than leaving to `makeCfg`'s parameter default two layers down.
       posture: postureOfDir(dir), mode: modeOfDir(dir), doctrines: doctrinesForBuild(dir),
+      // The loop skill's preset, or its `Default trust preset:` line reads as edited.
+      trust: trustOfDir(dir),
     }));
     // The one place a render depends on WHERE it is installed: a global Bob emit writes each
     // folder skill's absolute directory into its SKILL.md (see `writeNativeLayer`), so the

package/js/inspect/doctor.mjs

@@ -36,7 +36,7 @@ import { resolvePath } from '../hosts/hosts.mjs';
 import { installedDefaults, themeFiles } from '../hosts/installs.mjs';
 import { validateIsVendored } from '../hosts/native.mjs';
 import { printOut } from '../lib/fs.mjs';
-import { authoringProblems } from './checks-authoring.mjs';
+import { authoringProblems, loopProblems } from './checks-authoring.mjs';
 import {
   checkBuild, colorThemeProblems, renderedProblems, themeParityProblems,
 } from './checks-build.mjs';
@@ -217,6 +217,7 @@ export function doctorCollect({
   problems = problems.concat(ran('parity', 'Theme parity', themeParityProblems()));
   problems = problems.concat(ran('colors', 'Colour themes', colorThemeProblems()));
   problems = problems.concat(ran('authoring', 'Authoring gates', authoringProblems()));
+  problems = problems.concat(ran('loops', 'Loop catalogue', loopProblems()));
   problems = problems.concat(ran('shim', 'Hook shim', shimProbs));
   problems = problems.concat(ran('map', 'Module map', moduleMapProblems()));
   // P10c's `cli` check is GONE, and the reason is not that it stopped mattering. It hashed

package/js/inspect/inventory.mjs

@@ -91,6 +91,7 @@ export const LAW_CLASSES = ['security', 'process', 'verify', 'craft', 'context',
 export const SKILL_CLASS = {
   brainstorm: 'design', plan: 'design', council: 'design',
   workflow: 'design', 'parallel-agents': 'design', pipeline: 'design',
+  loop: 'design', 'brick-forge': 'design',
   'codebase-design': 'design', 'domain-modeling': 'design', wayfinder: 'design',
   tickets: 'design',
   develop: 'build', refactor: 'build', debug: 'build', migrate: 'build',

package/js/inspect/status.mjs

@@ -372,7 +372,7 @@ export function statusLines(d, color = false) {
     }
     const packs = p.doctrines.length ? p.doctrines.join(',') : 'no packs';
     const excl = p.excludeRules?.length ? `excluding ${p.excludeRules.join(',')}` : 'no rules excluded';
-    rows.push([`${p.host}:${p.scope}`, [p.state, p.theme, p.footprint, `${p.posture}/${p.mode}`,
+    rows.push([`${p.host}:${p.scope}`, [p.state, p.theme, p.footprint, `${p.posture}/${p.mode}/${p.trust}`,
       packs, excl].join(` ${DOT} `) + where]);
   }
 

package/js/loop/catalog.mjs

@@ -0,0 +1,127 @@
+/**
+ * Where bricks and loop templates come from, and which one wins.
+ *
+ * THREE ORIGINS, ONE LADDER. Shipped (this package's own `src/`), global (the user's, beside
+ * `installs.json` under XDG) and project (`<repo>/.geneseed/`, committed, shared with a team).
+ * A later origin replaces an earlier one BY NAME — that is the whole point: a team adapts the
+ * shipped `reproduce` to its stack without copying every template that uses it. The cost is
+ * that a fixed shipped brick stays masked by the override, so the override is reported
+ * (`overridden`), never silent.
+ *
+ * WHY SHIPPED BRICKS ARE READ FROM `src/`, NOT FROM AN INSTALL. The model never reads a brick
+ * file: `geneseed loop next` hands it the brick's prompt. So the CLI reads its own source and no
+ * host emit has to learn a new directory — four hosts get the catalogue for free and cannot drift.
+ *
+ * Templates are parsed with JSON.parse on purpose: they are read, never written back into a
+ * user's file, so the int/float distinction `parseJson` preserves has nowhere to matter.
+ */
+import { readdirSync } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { readText, isFile, isDir } from '../lib/fs.mjs';
+import { frontmatter } from '../hosts/hooks.mjs';
+import { SRC } from '../build/source.mjs';
+import { checkGraph } from './graph.mjs';
+
+export function userLoopsDir() {
+  const base = process.env.XDG_CONFIG_HOME || path.join(os.homedir(), '.config');
+  return path.join(base, 'geneseed');
+}
+
+const KEBAB = /^[a-z0-9][a-z0-9-]*$/;
+
+export function parseBrick(text, origin) {
+  const [fm, body] = frontmatter(text);
+  const get = (k) => (fm.get(k) ?? '').trim();
+  const name = get('name');
+  const problems = [];
+  if (!KEBAB.test(name)) problems.push(`name ${JSON.stringify(name)} must be kebab-case`);
+  const description = get('description');
+  if (!description) problems.push(`${name}: description is empty`);
+  const effect = get('effect');
+  if (effect !== 'read' && effect !== 'mutate') {
+    problems.push(`${name}: effect must be read or mutate, not ${JSON.stringify(effect)}`);
+  }
+  const agent = get('agent') || null;
+  const skill = get('skill') || null;
+  if (!agent === !skill) problems.push(`${name}: exactly one of agent or skill`);
+  const outcomes = get('outcomes').split(',').map((s) => s.trim()).filter(Boolean);
+  if (!outcomes.length) problems.push(`${name}: outcomes is empty`);
+  // `gate: human` holds the transition after this brick until the user answers (state.mjs).
+  // Present on the brick only when declared, so an ungated brick's shape is unchanged.
+  const gate = get('gate');
+  if (gate && gate !== 'human') problems.push(`${name}: gate must be human, not ${JSON.stringify(gate)}`);
+  // `gateOn` narrows the gate to the outcomes it lists; any other outcome follows its edge ungated.
+  const gateOn = get('gateOn').split(',').map((s) => s.trim()).filter(Boolean);
+  if (gateOn.length && gate !== 'human') problems.push(`${name}: gateOn needs gate: human`);
+  for (const o of gateOn) if (!outcomes.includes(o)) problems.push(`${name}: gateOn ${o} is not one of its outcomes`);
+  return {
+    brick: {
+      name, description, effect, agent, skill, outcomes, ...(gate ? { gate } : {}),
+      ...(gateOn.length ? { gateOn } : {}), body: body.trim(), origin,
+    },
+    problems,
+  };
+}
+
+const listFiles = (dir, ext) => (isDir(dir)
+  ? readdirSync(dir).filter((n) => n.endsWith(ext) && !n.startsWith('_') && n !== 'README.md').sort()
+  : []);
+
+function availability(brick, srcRoot) {
+  if (brick.agent && !isFile(path.join(srcRoot, 'agents', `${brick.agent}.md`))) {
+    return { available: false, reason: `agent ${brick.agent} is not shipped` };
+  }
+  if (brick.skill && !isFile(path.join(srcRoot, 'skills', `${brick.skill}.md`))
+    && !isDir(path.join(srcRoot, 'skills', brick.skill))) {
+    return { available: false, reason: `skill ${brick.skill} is not shipped` };
+  }
+  return { available: true };
+}
+
+export function loadCatalog({
+  projectRoot = process.cwd(), srcRoot = SRC, globalLevel = true,
+} = {}) {
+  const levels = [
+    ['shipped', path.join(srcRoot, 'bricks'), path.join(srcRoot, 'loops')],
+  ];
+  if (globalLevel) {
+    levels.push(['global', path.join(userLoopsDir(), 'bricks'), path.join(userLoopsDir(), 'loops')]);
+  }
+  if (projectRoot) {
+    levels.push(['project', path.join(projectRoot, '.geneseed', 'bricks'), path.join(projectRoot, '.geneseed', 'loops')]);
+  }
+  const bricks = new Map(); const templates = new Map(); const problems = []; const overridden = [];
+  for (const [origin, brickDir, loopDir] of levels) {
+    for (const f of listFiles(brickDir, '.md')) {
+      const { brick, problems: p } = parseBrick(readText(path.join(brickDir, f)), origin);
+      problems.push(...p.map((x) => `bricks/${f} (${origin}): ${x}`));
+      if (p.length) continue;
+      const prior = bricks.get(brick.name);
+      if (prior) overridden.push(`${brick.name} (${origin}, overrides ${prior.origin})`);
+      bricks.set(brick.name, { ...brick, ...availability(brick, srcRoot) });
+    }
+    for (const f of listFiles(loopDir, '.json')) {
+      let graph;
+      try { graph = JSON.parse(readText(path.join(loopDir, f))); } catch {
+        problems.push(`loops/${f}: not JSON`); continue;
+      }
+      const stem = f.slice(0, -'.json'.length);
+      if (graph.name !== stem) {
+        problems.push(`loops/${f}: name ${JSON.stringify(graph.name)} does not match the file name`);
+        continue;
+      }
+      templates.set(stem, { ...graph, origin });
+    }
+  }
+  return { bricks, templates, problems, overridden: overridden.sort() };
+}
+
+export function catalogProblems(opts = {}) {
+  const { bricks, templates, problems } = loadCatalog(opts);
+  const out = [...problems];
+  for (const [name, graph] of [...templates].sort(([a], [b]) => (a < b ? -1 : 1))) {
+    out.push(...checkGraph(graph, bricks).map((p) => `loops/${name}: ${p}`));
+  }
+  return out.sort();
+}