geneseed 3.17.0 → 3.19.0

package/js/cli-table.json

@@ -1079,6 +1079,59 @@
       ],
       "mutex": []
     },
+    {
+      "name": "scorecard",
+      "help": "grade a repo with the AI Harness Scorecard (31 checks, five pillars) — scores the repo itself (CI, tests, docs), not the harness files; a reading, never a gate",
+      "description": "",
+      "positionals": [
+        {
+          "names": [],
+          "dest": "path",
+          "metavar": null,
+          "help": "the repo to score (default: the current directory)",
+          "choices": null,
+          "default": null,
+          "required": false,
+          "nargs": "?",
+          "is_flag": false,
+          "type": null,
+          "hidden": false
+        }
+      ],
+      "options": [
+        {
+          "names": [
+            "--json"
+          ],
+          "dest": "json",
+          "metavar": null,
+          "help": "print the full assessment as JSON — every check with its score, evidence and fix",
+          "choices": null,
+          "default": false,
+          "required": false,
+          "nargs": "0",
+          "is_flag": true,
+          "type": null,
+          "hidden": false
+        },
+        {
+          "names": [
+            "--svg"
+          ],
+          "dest": "svg",
+          "metavar": "PATH",
+          "help": "write the scorecard as an SVG card (grade + one bar per pillar) to PATH instead of printing — the README card is docs/assets/scorecard.svg",
+          "choices": null,
+          "default": null,
+          "required": false,
+          "nargs": null,
+          "is_flag": false,
+          "type": null,
+          "hidden": false
+        }
+      ],
+      "mutex": []
+    },
     {
       "name": "setup",
       "help": "interactive install wizard (dependency-free, all OSes)",

package/js/hosts/hooks-context.mjs

@@ -81,8 +81,8 @@ let HOST = 'claude';
 // Kept in step with adapters/opencode/plugins/geneseed-context.js.
 const EAGER_ROOT = ['AGENTS.md', 'AGENT.md', 'CLAUDE.md', '.cursorrules',
   'README.md', 'README.adoc', 'CONTRIBUTING.md', 'CONTRIBUTING.adoc', 'user-rules.md', 'PROFILE.md'];
-// Project docs are Markdown or AsciiDoc: the document-project skill writes AsciiDoc by default
-// when a project has no docs yet, so a loader blind to `.adoc` would hide every doc it wrote.
+// Project docs are Markdown or AsciiDoc: the document-project skill writes AsciiDoc when the
+// user asks for it or the docs already are, so a loader blind to `.adoc` would hide those docs.
 // Agent-runtime files (AGENTS.md, CLAUDE.md, specs) stay Markdown whatever the project uses.
 const DOC_EXT = new Set(['.md', '.adoc']);
 const isDoc = (name) => DOC_EXT.has(path.extname(name).toLowerCase());
@@ -126,7 +126,10 @@ const cost = (s) => s.length + (s.match(/\n/g) || []).length + 2;
 // honoured by `resolveContextSets` (the harness dir is its last candidate). The OpenCode
 // context plugin carries the same list.
 const SESSION_FILES = ['user-rules.md', 'PROFILE.md', 'memory/MEMORY.md', 'anamnesis/MEMORY.md',
-  'notebook/NOTEBOOK.md', 'wiki.jsonc'];
+  'notebook/NOTEBOOK.md', 'geneseed-wiki.jsonc'];
+// The wiki manifest's earlier name, read when the new one is absent (an install not yet re-emitted,
+// or a rename that failed). One release; `wiki.json`, older still, is the build's to rename.
+const LEGACY_WIKI = 'wiki.jsonc';
 // SHA-256 of each seed body in `js/build/stubs.mjs` (`SESSION_SEEDS`), CRLF folded. A file still
 // byte-identical to its seed says nothing, so it is skipped rather than injected as noise.
 // Hashes, not an import: stubs.mjs pulls in the build's writers, and this module loads on every
@@ -134,7 +137,9 @@ const SESSION_FILES = ['user-rules.md', 'PROFILE.md', 'memory/MEMORY.md', 'anamn
 const SEED_SHA256 = new Set([
   '5c2e92fb1acde041e02d9ebf158460d8ff7a07cbc2b447859631604610130721', // user-rules.md
   '29e012c3c4349ea62a9082cbd04bb25599a0ec280d62c33f6e10742809471816', // PROFILE.md
-  'cccc917c34e6b990e821620bdb4739090151885ab71b6e85046f30a3b71fa5e8', // wiki.jsonc
+  '3a82c78ccc5d745033c16c354f5eda9d79350c704e9da8d605d380fb1e108d7a', // geneseed-wiki.jsonc
+  // The wiki seed before the rename: the build renames an untouched one byte for byte.
+  'cccc917c34e6b990e821620bdb4739090151885ab71b6e85046f30a3b71fa5e8', // wiki.jsonc (legacy)
   '99c786049c260f6baf7aec68a5c0f59907861afe9b867da009440613bdddb907', // MEMORY.md
   '9acb5c9d9cb5dac572104480f05b48cc144e676869bd60e86d8a15b1f6308184', // NOTEBOOK.md
 ]);
@@ -150,8 +155,9 @@ export function sessionFiles(hookRoot) {
   const found = [];
   for (const rel of SESSION_FILES) {
     let abs = path.join(hookRoot, rel);
-    if (rel === 'wiki.jsonc' && process.env.GENESEED_WIKI && isFile(process.env.GENESEED_WIKI)) {
-      abs = process.env.GENESEED_WIKI;
+    if (rel === 'geneseed-wiki.jsonc') {
+      if (process.env.GENESEED_WIKI && isFile(process.env.GENESEED_WIKI)) abs = process.env.GENESEED_WIKI;
+      else if (!isFile(abs)) abs = path.join(hookRoot, LEGACY_WIKI);
     }
     if (!isFile(abs)) continue;
     let text;
@@ -256,6 +262,7 @@ export function discoverContext(root, host = HOST) {
  *
  * `recs` is a Map, not an object: JS reorders integer-like keys on a plain object, and
  * these keys are absolute paths whose iteration order becomes the printed order.
+ * @returns {[Array<{path: string, description: string}>, Array<{path: string, description: string}>, string]}
  */
 export function resolveContextSets(root, hookRoot = null) {
   let manifest = null;

package/js/hosts/hosts.mjs

@@ -128,9 +128,7 @@ export function expanduser(p) {
       + "ntpath/posixpath would guess a home directory for 'user' — this port does not); "
       + 'pass an absolute path, or "~" / "~/…" for your own home directory';
     printErr(`${msg}\n`);
-    const e = new Error(msg);
-    e.exitCode = 1;
-    throw e;
+    throw Object.assign(new Error(msg), { exitCode: 1 });
   }
   return p;
 }

package/js/hosts/installs.mjs

@@ -35,7 +35,7 @@
 import { existsSync, readdirSync } from 'node:fs';
 import path from 'node:path';
 
-import { CONFIG, PACK_ORDER, THEMES, discoverNames, knownSkillIds } from '../build/source.mjs';
+import { CONFIG, PACK_ORDER, THEMES, discoverNames, resolveSkillNames } from '../build/source.mjs';
 import { CLAUDE_STYLE, GLOBAL_MANIFEST, HOSTS, resolvePath } from './hosts.mjs';
 import { registryRoots } from '../inspect/registry.mjs';
 import { printErr, readText, isFile, isDir } from '../lib/fs.mjs';
@@ -408,7 +408,7 @@ export function excludedRulesOfDir(d) {
   }, []);
 }
 
-/** `Excluded skills: bruno-test-writer, daydream` — written only when something is excluded. */
+/** `Excluded skills: bruno, daydream` — written only when something is excluded. */
 const EXCLUDED_SKILLS_RE = /^Excluded skills:[ \t]*(.+?)[ \t]*$/m;
 
 /**
@@ -416,17 +416,23 @@ const EXCLUDED_SKILLS_RE = /^Excluded skills:[ \t]*(.+?)[ \t]*$/m;
  * re-render the same set. Same semantics as `excludedRulesOfDir`: a missing line is `[]`
  * (nothing excluded), and a name this checkout does not ship condemns the whole line to `[]`
  * — re-admitting a skill is the safe direction, and the flag would refuse the name anyway.
+ *
+ * A name that only got OLDER is not unknown: an alias reads back as its target and a retired
+ * name drops out (`resolveSkillNames`), so a skill merge does not quietly re-admit everything
+ * else the install left out. Silent unless the caller passes `notify` — status, diff and the
+ * console call this on every read; the replays that rebuild an install (`rebuild-all`,
+ * `upgrade`, `migrate`) pass it.
  */
-export function excludedSkillsOfDir(d) {
+export function excludedSkillsOfDir(d, notify = null) {
   return firstCarrier(d, (carrierPath) => {
     const text = readMaybe(carrierPath);
     if (text === null) return undefined;
     const m = EXCLUDED_SKILLS_RE.exec(text);
     if (!m) return undefined;
-    const names = m[1].split(',').map((s) => s.trim()).filter(Boolean);
-    const known = knownSkillIds();
-    if (!names.every((n) => known.includes(n))) return [];
-    return [...new Set(names)].sort();
+    const { ids, notices, unknown } = resolveSkillNames(m[1].split(',').map((s) => s.trim()).filter(Boolean));
+    if (unknown.length) return [];
+    if (notify) for (const n of notices) notify(n);
+    return ids;
   }, []);
 }
 

package/js/hosts/mcp.mjs

@@ -5,7 +5,7 @@
  * at "~90 new, already in js/: `_mcp_load`/`readJsonc` (P6c), `settings.mjs`'s atomic write".
  * Measured against `js/`: `readJsonc` had crossed and NOTHING ELSE HAD. `js/web/api.mjs`
  * carries a five-line `mcpLoad` that is the no-host, comment-tolerant reader P6c needed for
- * `wiki.jsonc`, which is one arm of one of these thirteen functions. `_MCP_PRESETS`,
+ * `geneseed-wiki.jsonc`, which is one arm of one of these thirteen functions. `_MCP_PRESETS`,
  * `_mcp_servers_key`, `_mcp_preset_block`, `_mcp_apply`, `_mcp_state`, `_mcp_set_enabled`,
  * `_mcp_load`'s host fork, `_mcp_commented`, `_mcp_save`, `_mcp_config_for`,
  * `_mcp_install_targets`, `_mcp_known_names` and `_mcp_meta` are 168 lines of Python, all

package/js/hosts/native.mjs

@@ -32,6 +32,7 @@ import path from 'node:path';
 import { writeText, copyFile, readText } from '../lib/fs.mjs';
 import { jsonDumps, parseJson, formatValue, formatRepr, isTruthy, isDict } from '../lib/json.mjs';
 import { relPosix } from '../lib/text.mjs';
+import { aliasesOf } from '../build/source.mjs';
 
 /** What a folder skill writes where it needs its own directory — see `writeNativeLayer`. */
 const SKILL_DIR_PLACEHOLDER = '<this-skill-directory>';
@@ -253,6 +254,25 @@ export function stripSkillBodyLinks(body) {
   return body.replace(SKILL_BODY_LINK_RE, '$1');
 }
 
+/**
+ * A first-party skill's SIDE FILES (`src/skills/<stem>/<file>`, beside the flat spec) are
+ * linked from the spec as `[…](<stem>/<file>)` — the path that resolves in `src/` and in the
+ * flat bundle, where doctor's dead-link scan proves it. A native skill sits one level deeper
+ * (`skills/<stem>/SKILL.md`), and an alias or a command copies the body somewhere else again,
+ * so there the link becomes a code-span path under `dir`: the placeholder a host that
+ * announces the skill's base directory resolves, or the answer for one that does not.
+ *
+ * A link with an `#anchor` (which `sideFileProblems` accepts) gets the same pointer with the
+ * anchor DROPPED: the pointer is a path the agent hands to a file-read tool, and
+ * `deep.md#two` names no file. Left unmatched, `stripSkillBodyLinks` would reduce the link to
+ * its label and the agent would never learn where the file is.
+ */
+export function pointSideFiles(body, stem, dir) {
+  // A function, not a `$1` string: `dir` is a real path and may itself hold a `$`.
+  return body.replace(new RegExp(`\\[[^\\]]+\\]\\(${stem}/([^)\\s#]+)(?:#[^)\\s]*)?\\)`, 'g'),
+    (_m, f) => `\`${dir}/${f}\``);
+}
+
 /** `_build_emit._agent_color_map` — validated, always a valid OpenCode slot. */
 function agentColorMap(theme) {
   let raw = null;
@@ -479,8 +499,8 @@ export function claimer(oldOwned, cfg, manifestExisted = true) {
  * `<this-skill-directory>/…`; Claude Code resolves that because it announces each skill's
  * base directory on load, while on Bob the model got the text with a hole in it and went
  * hunting through the filesystem. With the option, every rendered `.md` of a vendored folder
- * has the placeholder replaced by the answer. Only vendored folders carry the placeholder — a
- * flat skill has no siblings to point at.
+ * has the placeholder replaced by the answer. A flat skill with side files points at them
+ * through the same option (`pointSideFiles`), placeholder when it is absent.
  *
  * `opts.claim` — a `claimer` closure the caller shares with its other writers; built from
  * `oldOwned`/`cfg`/`manifestExisted` when absent.
@@ -498,13 +518,15 @@ export function claimer(oldOwned, cfg, manifestExisted = true) {
  */
 export function writeNativeLayer(items, agentsDir, skillsDir, overrides = null, {
   host = 'opencode', oldOwned = null, cfg = null, manifestExisted = true,
-  theme = null, src, skillDirOf = null, claim = claimer(oldOwned, cfg, manifestExisted),
+  theme = null, src = undefined, skillDirOf = null, claim = claimer(oldOwned, cfg, manifestExisted),
 } = {}) {
   const ov = overrides || {};
   if (host === 'claude') warnClaudeIgnored(ov);
   let nAgents = 0;
   let nSkills = 0;
   const written = [];
+  const sideFiles = [];            // [stem, dest, text], written after the loop
+  const claimedSkills = new Set(); // stems whose own SKILL.md claim held
 
   const write = (dest, text) => {
     mkdirSync(path.dirname(dest), { recursive: true });
@@ -534,6 +556,15 @@ export function writeNativeLayer(items, agentsDir, skillsDir, overrides = null,
       continue;
     }
     if (text === null) continue;
+    // A first-party side file rides next to its skill's SKILL.md, read only when the body
+    // points the agent at it; not a skill, so not counted. `sideFileProblems` holds the
+    // layout (a flat spec beside it, one level, `.md`, linked from the body). Held until the
+    // loop ends: written only once its skill's own SKILL.md claim held (the alias rule), so a
+    // user's file at the target never gets a geneseed side file dropped beside it.
+    if (sparts.length === 3 && sparts[0] === 'skills') {
+      sideFiles.push([sparts[1], path.join(skillsDir, sparts[1], sparts[2]), text]);
+      continue;
+    }
     if (sparts.length !== 2 || !sparts[1].endsWith('.md')) continue;
     const [folder, fname] = sparts;
     const targetDir = { agents: agentsDir, skills: skillsDir }[folder];
@@ -567,18 +598,42 @@ export function writeNativeLayer(items, agentsDir, skillsDir, overrides = null,
     } else {
       // Skills are BYTE-IDENTICAL across hosts: name + description, body link-stripped.
       // The user-only key is emitted for every host too — Claude Code and Bob honour it,
-      // OpenCode ignores an unknown key — so the identity holds.
+      // OpenCode ignores an unknown key — so the identity holds. ALIASES are the one
+      // exception: OpenCode has no user-only skill, so an alias skill there would land in the
+      // model's catalogue as a duplicate; it gets a command instead (`writeAliasCommands`).
       fm = [`name: ${stem}`, `description: ${jsonDumps(skillDescription(text))}`];
       if (isUserInvokedOnly(text)) fm.push('disable-model-invocation: true');
-      body = stripSkillBodyLinks(body);
+      body = stripSkillBodyLinks(pointSideFiles(body, stem, skillDirOf ? skillDirOf(stem)
+        : SKILL_DIR_PLACEHOLDER));
       dest = path.join(skillsDir, stem, 'SKILL.md');
       kind = 'skill';
     }
     if (!claim(dest)) continue;
     write(dest, `---\n${fm.join('\n')}\n---\n\n${body}`);
+    if (kind === 'skill') claimedSkills.add(stem);
+    // An old name keeps answering `/name`: user-only, so the model's catalogue lists the
+    // skill once. Read off the already-filtered items, so excluding the target drops its
+    // aliases; through `claim`, so manifest, prune and uninstall own them; not counted.
+    // Only once the target's own claim held: a user's file at the target gets no alias
+    // pointing at a skill this install never wrote.
+    if (kind === 'skill' && host === 'claude') {
+      // The host announces the ALIAS's folder as the base directory, so a side-file pointer
+      // climbs back to the target's.
+      const aliasBody = skillDirOf ? body : stripSkillBodyLinks(
+        pointSideFiles(lstripNewlines(text), stem, `${SKILL_DIR_PLACEHOLDER}/../${stem}`));
+      for (const alias of aliasesOf(text)) {
+        const aliasDest = path.join(skillsDir, alias, 'SKILL.md');
+        if (!claim(aliasDest)) continue;
+        write(aliasDest, `---\nname: ${alias}\ndescription: ${jsonDumps(`Alias of ${stem}.`)}\n`
+          + `disable-model-invocation: true\n---\n\n${aliasBody}`);
+      }
+    }
     if (kind === 'agent') nAgents += 1;
     else nSkills += 1;
   }
+  for (const [stem, dest, text] of sideFiles) {
+    if (claimedSkills.has(stem) && claim(dest)) write(dest, stripSkillBodyLinks(text));
+  }
   return { nAgents, nSkills, written };
 }
 

package/js/hosts/opencode.mjs

@@ -27,7 +27,8 @@ import { writeText, readText, copyFile } from '../lib/fs.mjs';
 import { jsonDumps, jsonDumpsIndent, parseJson } from '../lib/json.mjs';
 import { comparePaths } from '../lib/paths.mjs';
 import { sourceReleaseVersion } from '../build/version.mjs';
-import { firstBlockquote, stripSkillBodyLinks, pushOverrideLines } from './native.mjs';
+import { aliasesOf } from '../build/source.mjs';
+import { firstBlockquote, stripSkillBodyLinks, pointSideFiles, pushOverrideLines } from './native.mjs';
 
 // Re-exported for `js/web/api.mjs` and the tests, which import it from here.
 export { sourceReleaseVersion };
@@ -104,7 +105,7 @@ const AGENT_OVERRIDES_STUB = {
  * `/code-review`. As a list the renamed entry missed its skill and was dropped in silence, so a
  * missing skill is now a thrown error in `writeCommandLayer`.
  */
-const COMMAND_SET = {
+export const COMMAND_SET = {
   commit: 'commit', plan: 'plan', 'code-review': 'geneseed-code-review',
   'review-response': 'review-response', ship: 'ship', debug: 'debug', research: 'research',
 };
@@ -276,7 +277,7 @@ export function ensureAgentOverridesStub(cfg, base) {
  * `command/commit.md` without the check made uninstall delete it. Default: claim everything,
  * for a caller with no manifest to consult.
  */
-export function writePrimaryAgent(cfg, agentsDir, overrides, claim = () => true) {
+export function writePrimaryAgent(cfg, agentsDir, overrides, claim = (_dest) => true) {
   if (!truthyEnv('GENESEED_PRIMARY') || !existsSync(cfg.primaryAgentSrc)
       || !statSync(cfg.primaryAgentSrc).isFile()) {
     return null;
@@ -296,7 +297,8 @@ export function writePrimaryAgent(cfg, agentsDir, overrides, claim = () => true)
 }
 
 /** `_build_emit._write_command_layer` — the opt-in /slash commands. */
-export function writeCommandLayer(cfg, items, commandDir, claim = () => true) {
+export function writeCommandLayer(cfg, items, commandDir, claim = (_dest) => true,
+  skillDirOf = (n) => path.join(path.dirname(commandDir), 'skills', n).split(path.sep).join('/')) {
   if (!truthyEnv('GENESEED_COMMANDS')) return [];
   const byName = new Map();
   for (const { text, src } of items) {
@@ -318,7 +320,8 @@ export function writeCommandLayer(cfg, items, commandDir, claim = () => true) {
     const dest = path.join(commandDir, `${name}.md`);
     if (!claim(dest)) continue;
     const desc = firstBlockquote(text);
-    const body = stripSkillBodyLinks(text.replace(/^\n+/, ''));
+    // A command has no base directory, so a side-file pointer names the skill's own.
+    const body = stripSkillBodyLinks(pointSideFiles(text.replace(/^\n+/, ''), skill, skillDirOf(skill)));
     mkdirSync(path.dirname(dest), { recursive: true });
     writeText(dest, `---\ndescription: ${jsonDumps(desc)}\n---\n\n${body}`);
     written.push(dest);
@@ -326,8 +329,36 @@ export function writeCommandLayer(cfg, items, commandDir, claim = () => true) {
   return written;
 }
 
+/**
+ * A merged skill's OLD names as `/alias` commands — OpenCode's form of the user-only alias
+ * skill `writeNativeLayer` writes for the Claude dialect. A command, not a skill, because
+ * OpenCode has no user-only skill: an alias skill would sit in the model's catalogue as a
+ * second copy of its target. UNCONDITIONAL, unlike the `GENESEED_COMMANDS` set — an old name
+ * that only works behind an opt-in is a name that broke. Read off the already-filtered
+ * `items`, so excluding the target drops its aliases.
+ */
+export function writeAliasCommands(cfg, items, commandDir, claim = (_dest) => true,
+  skillDirOf = (n) => path.join(path.dirname(commandDir), 'skills', n).split(path.sep).join('/')) {
+  const written = [];
+  for (const { text, src } of items) {
+    if (text === null) continue;
+    const sp = path.relative(cfg.src, src).split(path.sep);
+    if (sp.length !== 2 || sp[0] !== 'skills' || !sp[1].endsWith('.md') || sp[1].startsWith('_')) continue;
+    const stem = sp[1].slice(0, -3);
+    const body = stripSkillBodyLinks(pointSideFiles(text.replace(/^\n+/, ''), stem, skillDirOf(stem)));
+    for (const alias of aliasesOf(text)) {
+      const dest = path.join(commandDir, `${alias}.md`);
+      if (!claim(dest)) continue;
+      mkdirSync(path.dirname(dest), { recursive: true });
+      writeText(dest, `---\ndescription: ${jsonDumps(`Alias of ${sp[1].slice(0, -3)}.`)}\n---\n\n${body}`);
+      written.push(dest);
+    }
+  }
+  return written;
+}
+
 /** `_build_emit._write_ponytail_command` — registered UNCONDITIONALLY; null when the user's. */
-export function writePonytailCommand(commandDir, claim = () => true) {
+export function writePonytailCommand(commandDir, claim = (_dest) => true) {
   const dest = path.join(commandDir, 'ponytail.md');
   if (!claim(dest)) return null;
   mkdirSync(path.dirname(dest), { recursive: true });

package/js/hosts/settings.mjs

@@ -165,6 +165,7 @@ const OWNED_BASH = ['rm -rf *', 'git commit*', 'git push*', ...LAW_IV_BASH];
  * caller warns on it. This is the one branch where the boundary can end up with NO Geneseed
  * gate at all while the constitution states the rule — the unsafe direction — so it must not
  * also be the silent one.
+ * @returns {[boolean, string[], string | null]}
  */
 function reconcileOpencodePermission(perm, want) {
   // A `permission` that is not an object, or whose `bash` is not one — OpenCode also accepts a

package/js/hosts/shim.mjs

@@ -215,6 +215,7 @@ function shimIsLive(p) {
  * The fallback is strictly no worse than the old behaviour and far better than emitting
  * commands naming a shim that does not exist — those fail on every hook (9009 under
  * cmd.exe, 127 under sh) and take both gates down with them.
+ * @param {{ runner?: string, entry?: string, platform?: NodeJS.Platform }} [opts]
  */
 export function hookPrefix({ runner, entry, platform = process.platform } = {}) {
   // NOT a default. `runner`/`entry` have no computable fallback on this side — this process's

package/js/inspect/checks-authoring.mjs

@@ -19,7 +19,8 @@ import { readText } from '../lib/fs.mjs';
 import { which } from '../lib/paths.mjs';
 import { NO_WINDOW } from '../lib/proc.mjs';
 import {
-  folderSkillProblems, registryProblems, secretProblems, vendorPinProblems,
+  aliasProblems, folderSkillProblems, registryProblems, secretProblems, sideFileProblems,
+  vendorPinProblems,
 } from './checks-repo.mjs';
 import { constitutionProblems, leanBlockProblems } from './checks-constitution.mjs';
 import { countTableProblems } from './checks-counts.mjs';
@@ -109,6 +110,8 @@ export function authoringProblems() {
   problems.push(...secretProblems());
   problems.push(...vendorPinProblems());
   problems.push(...folderSkillProblems());
+  problems.push(...aliasProblems());
+  problems.push(...sideFileProblems());
   problems.push(...constitutionProblems());
   problems.push(...leanBlockProblems());
   problems.push(...countTableProblems());

package/js/inspect/checks-counts.mjs

@@ -116,7 +116,7 @@ const TMPL_SPEC_RE = /\{\{DIR_(AGENTS|SKILLS)\}\}\/([A-Za-z0-9_-]+)\.md/g;
  * badges, against `src/`.
  *
  * The tables must list EXACTLY the spec files (no dead row, no orphaned spec) and each
- * `agents`/`skills`/`laws`/`themes` badge must equal the real count. This is the
+ * `agents`/`skills`/`laws`/`doctrines`/`themes` badge must equal the real count. This is the
  * authoring-time guarantee that lets tables, badges and prose stay hand-written without
  * silently drifting from the source tree.
  */
@@ -151,7 +151,8 @@ export function countTableProblems() {
 
   // The numerals the laws RENDER with — positional, off the canon — because LAW_CLASS and the
   // console's LAW_META are keyed the way the rendered catalogue numbers them.
-  const lawRules = ruleCanon(SRC).rules.filter((r) => r.kind === 'LAW');
+  const canonRules = ruleCanon(SRC).rules;
+  const lawRules = canonRules.filter((r) => r.kind === 'LAW');
   const lawNums = lawRules.map((r) => r.label);
   for (const num of lawNums) {
     if (!has(LAW_CLASS, num)) {
@@ -179,6 +180,9 @@ export function countTableProblems() {
     agents: srcStems('agents').size,
     skills: shippedSkills.size,
     laws: lawNums.length,
+    // Every doctrine rule in every pack, opt-in ones included: the laws badge alone told a
+    // reader the harness has 9 rules. It rides the laws badge (`laws-9 + 28 doctrines`).
+    doctrines: canonRules.filter((r) => r.kind === 'DOCTRINE').length,
     themes: themeFiles().length,
     plugins: existsSync(PLUGIN_SRC)
       ? readdirSync(PLUGIN_SRC).filter((f) => f.startsWith('geneseed-') && f.endsWith('.js')).length
@@ -190,7 +194,8 @@ export function countTableProblems() {
   // same reason: `if (m && …)` is green when there is no badge, so deleting a badge silences its
   // own gate.
   for (const [key, n] of Object.entries(counts)) {
-    const m = new RegExp(`badge/${key}-(\\d+)`).exec(readme);
+    const m = (key === 'doctrines' ? /badge\/laws-\d+%20%2B%20(\d+)%20doctrines/
+      : new RegExp(`badge/${key}-(\\d+)`)).exec(readme);
     if (!m) {
       problems.push(`[authoring] README has no ${key} badge — deleting one is how this gate `
         + 'goes green while the reader is told nothing');