geneseed 3.19.0 → 4.0.0

package/CHANGELOG.md

@@ -8,6 +8,47 @@ label. For the capability ↔ spec map, see [SHIPPED.md](SHIPPED.md).
 
 ## [Unreleased]
 
+## [4.0.0] — 2026-10-11
+
+Major: a host-compatibility pass against the current IBM Bob, Claude Code, OpenCode and OpenClaude docs (#240), the host opportunities and a root-scan guard (#241), and author notes kept out of what the agent reads (#242). It is a major because three behaviours change visibly: Claude Code gates now block when they cannot run, OpenCode no longer falls back to `~/.claude/CLAUDE.md`, and the silent *process 8* migration is gone.
+
+### Upgrade notes
+- Run `geneseed rebuild-all` once after updating: nothing on a machine changes until an install is re-emitted.
+- An install built before the comms pack (3.7.0) is now skipped by `rebuild-all`, `migrate` and `upgrade`; run `geneseed setup` for it.
+- If a Claude Code session suddenly refuses every Bash or Write call, the machine-wide hook shim is missing or stale: run `! geneseed rebuild-all` (see docs/reference/troubleshoot-hooks.md).
+
+### Added
+- A Claude Code plugin marketplace: `/plugin marketplace add Arylmera/Geneseed`, then `/plugin install geneseed@geneseed`. The plugin carries one skill, `/geneseed:setup`, which asks for scope and theme and runs the published CLI (`npm install -g geneseed`, `geneseed build --emit claude-global` or `--emit claude`). It carries no harness of its own, so nothing in it can drift from the build.
+- Bob gets `/`-commands: each skill alias and each user-only skill is a `.bob/commands/<name>.md`, and a user-only skill writes no SKILL.md on Bob, so the model cannot start it there.
+- OpenCode hides user-only skills from the model: each one gets a `permission.skill` deny in `opencode.json`, and `/name` still runs it. Geneseed records the denies it writes in its manifest (`skill_denies`); a rebuild removes a recorded deny once the skill is no longer user-only, and uninstall takes the recorded ones back. A deny you set yourself, even on a Geneseed skill, is never touched.
+- A root-scan check in the shell gate: a recursive scan whose argument is a whole filesystem root (`find /`, `du -sh /`, `grep -r foo /`, `rg x C:\`, `Get-ChildItem C:\ -Recurse`) now asks on Claude Code and OpenClaude and is refused on Bob and by the OpenCode guard plugin, citing *Commands Must Return* (ops 2), which gains a sentence saying so in both halves. In Git Bash `/` mounts every drive and share: a `find / … | head -5` ran for 3.5 hours on 2026-10-10. A deeper path, `ls /` without `-R`, a quoted argument, a comment, and the remote half of an `ssh` command pass. It runs inside `git-gate`/`tool-gate`, so no emitted hook command changes. Separators inside quotes and heredoc bodies are data, so a commit message that names such a scan is not one.
+- A dedicated author-note prefix: an HTML comment in `src/` whose body starts with `note:` (`<!-- note: ... -->`, single or multi-line) is stripped before any render sees it — `resolveRuleIds` in `js/build/source.mjs` is the one function every text file threads through (and `parseBrick` in `js/loop/catalog.mjs` calls the same `stripAuthorNotes` directly, since a brick body is handed to the model raw and never goes through `resolveRuleIds` at all), so the strip covers the carrier, the on-disk `laws/`/`doctrines/` copies, every skill, and every brick alike. A comment shown only as a literal example — inside a fenced code block or an inline code span — is left un-stripped, via `blankCodeSpans` (`js/lib/text.mjs`, shared with the doctor arm below so the two can never disagree about what counts as "shown as an example"). Maintainer-only prose that used to ship verbatim (`src/laws/universal.md`'s "Amend BOTH halves", `src/skills/herdr.md`'s "Authoring note") is migrated to the prefix and no longer reaches the agent; the full carrier gains ~176 characters of headroom against its ceiling (unchanged, not lowered), lean is unaffected. `js/inspect/checks-authoring.mjs`'s new `authorNoteProblems` (wired into `doctor --all`) flags any other bare HTML comment in `src/` that is not the `note:` prefix and not a known functional marker (`LEAN:`/`CATALOG:`/`INCLUDE:`, `invocation: user`, `aliases:`, `webfetch: allow`, `harness:` followed by one or more of OpenCode/Claude Code/OpenClaude/Bob's ids, `bash: allow`), the same fence/code-span exemption applied, and separately refuses a `note:` comment whose own prose quotes a literal `<!--`/`-->` — HTML comments do not nest, so such a comment closes at its own inner marker and leaks the rest as live text (the landmine `src/skills/_template.md` hit once, fixed there by rewording the example to prose).
+
+### Changed
+- Claude Code gates now block the tool call when the gate itself fails: `git-gate` and `rule-gate` carry `onFailure: "block"`, so a dead or missing shim, a gate process that crashes or a timeout refuses every Bash, PowerShell, Write, Edit and NotebookEdit call instead of letting it through. This needs Claude Code v2.1.295 or later; whether an older version ignores the key or rejects the settings file is unverified. `doctor` and `status` now report a deleted shim. To recover from inside a blocked session, see [Troubleshoot hooks](docs/reference/troubleshoot-hooks.md). OpenClaude and Bob are unchanged.
+
+### Removed
+- The automatic *process 8* migration. An install built before the comms pack (3.7.0, 2026-09-27) used to be silently rewritten on every rebuild: `doctrinesOfDir` added `comms` so the codes rule it carried inside `process` was not lost, and `excludedRulesOfDir` re-addressed any `process 7`/`process 8` exclusion. Both relied on sniffing `process 8` in the rendered carrier, which breaks the day the process pack ever regains an eighth rule for an unrelated reason — it would then fire on a current install and rewrite data nobody asked rewritten. 4.0.0 removes the rewrite: a pre-comms carrier is now read exactly as written, and reading it (`doctor`, `diff`, `status`, `uninstall`) prints a warning on stderr instead, once per process. `rebuild-all` (and `upgrade`, which shells into it) now **skips** a pre-comms install entirely rather than re-emitting it — re-emitting would have written a fresh carrier that still drops `comms` and still carries unaddressed `process 7`/`process 8` exclusions, except now permanently, with no `process 8` text left for anything to ever catch again. **Upgrading:** if your install predates 3.7.0 and still names `process 8` in its carrier, run `geneseed setup` for it — `rebuild-all`/`upgrade` will skip it and name it in their summary until you do.
+
+### Fixed
+- Bob gates read Bob's own payload (`{event, tool, input}`); they used to read only `tool_input`, so on Bob no gate ever fired. Bob also scans `apply_diff` and `search_and_replace` bodies.
+- The Claude Code and OpenClaude git gate also matches the PowerShell tool (`Bash|PowerShell`); on Windows a destructive git command run through PowerShell used to pass unchecked. Read-only agents deny PowerShell too.
+- A hook argv error never exits 2: a stale machine-wide shim handed a newer flag used to block every tool call.
+- Windows without Git Bash: Claude Code runs hooks under PowerShell, where the emitted command was a parse error. The emit now detects Git Bash and writes a PowerShell form when it is absent; `doctor` and `status` warn when the machine changes after the emit.
+- `CLAUDE_CONFIG_DIR` is honoured. A global hook stands down only for a live project install in `$CLAUDE_PROJECT_DIR` whose settings file still runs the same hook, never for a parent folder, another global install, a deactivated install or a manifest alone.
+- The destructive-git gate also covers `clean --force`, `restore`, `push --delete` and `:branch`, `checkout -f`, `switch -f`, `stash drop/clear`, `worktree remove --force`, `reflog expire` and `gc --prune`, in the hook, the OpenCode guard and OpenCode's permissions.
+- OpenCode: the guard checks every path an `apply_patch` touches (the only edit tool of gpt-* models) and scans written content for secrets; per-repo builds honour `--footprint lean`; plugins, workflows and themes are claimed on create, so a same-named user file survives emit and uninstall; a one-line managed `AGENTS.md` stops OpenCode loading the harness a second time through `~/.claude/CLAUDE.md`; a shadowed install under `OPENCODE_CONFIG_DIR` is reported. The dead `permission.ask` loop exemption is removed; pushes to `loop/*` are allowed by a static rule, and force, delete, an extra refspec and commits still ask.
+- Settings are read back per host, so `rebuild-all`, `upgrade` and the console keep an OpenClaude per-repo install's theme, posture, packs and exclusions, also in a repo shared with another host.
+- Uninstalling one host from a shared repo hands the root marker to the surviving host instead of deleting it; `migrate` reads the settings file the install really wired.
+- `learn` cannot recurse through `claude -p`, reads nothing when `GENESEED_LLM` is unset, and returns at once on Bob, which sends no transcript.
+- `learn` on `SubagentStop` reads the subagent's own transcript (`agent_transcript_path`); it used to distil a lesson from the main session's. When the transcript cannot be read, or lags behind the final turn, it falls back to or appends `last_assistant_message`.
+
+## [3.20.0] — 2026-10-09
+
+### Changed
+- Loops repair twice before giving up: the test repair rings (`apply-test`, `fix-test`, `write-run`, `stabilise`) now allow two repairs instead of one, then the attempt is discarded for one fresh try, then the loop stops for you. The first revision carries most of the gain, but a second still lands fixes the first missed. Bound the Loop, the `apply` and `test` bricks and the loops concept page say two. Review rings are unchanged.
+- The fallback to the old wiki manifest name (`wiki.jsonc`) stays for now, against the 3.18.0 note that it would go in the next release: nothing yet reports an install that missed the rename, so removing it could drop a wiki in silence.
+
 ## [3.19.0] — 2026-10-09
 
 ### Added

package/README.md

@@ -90,6 +90,14 @@ npm install -g geneseed       # then plain `geneseed <command>` from any directo
 npm install -g geneseed@latest   # …and that is also the update
 ```
 
+Already in Claude Code? Add the plugin marketplace and let Claude run the install:
+
+```
+/plugin marketplace add Arylmera/Geneseed
+/plugin install geneseed@geneseed
+/geneseed:setup
+```
+
 Every other route (Claude Code, Bob, OpenClaude, plain `AGENT.md`, per-repo installs) is in the **[install guide](docs/guides/install.md)**.
 
 ### 🧬 The long way — a git checkout
@@ -238,7 +246,7 @@ is **identical on every host**. What differs is how much of it the host can
 | **Colour themes** | ✅ full palette | ➖ | ➖ | ➖ |
 | **LSP · workflow runner · primary-agent · `/`-commands** | ✅ | ➖ | ➖ | ➖ |
 
-<sub>✅ native support · ⚙️ OpenCode plugin · 🪝 `settings.json` hook · 📄 carried by preamble prose only · ➖ no host mechanism (harness discipline still applies) · ¹ Bob's own hook contract: global hooks in `~/.bob/settings/settings.json`, Claude's event names but stdout ignored on `PreToolUse` — a refusal is **exit code 2**. So Laws I/IV exit 2, the consent rules are a stderr line, `SessionStart` context is plain stdout, `Stop` runs learn; `SubagentStop`/`PreCompact` are not Bob events and are not written. Unverified live (no Bob install on the authoring machine); the harness still holds via the rules preamble. · ² OpenCode's `tool.execute.before` can only allow or throw, with no "ask the user" tier, so the rule gate is a one-shot speed bump there rather than a prompt. · ³ OpenClaude is a Claude Code fork: Claude's hook groups and verdicts verbatim, in `~/.openclaude/settings.json` (global) or `.openclaude/settings.local.json` (per repo). Unverified live (no OpenClaude install on the authoring machine).</sub>
+<sub>✅ native support · ⚙️ OpenCode plugin · 🪝 `settings.json` hook · 📄 carried by preamble prose only · ➖ no host mechanism (harness discipline still applies) · ¹ Bob's own hook contract: global hooks in `~/.bob/settings/settings.json`, Claude's event names but stdout ignored on `PreToolUse` — a refusal is **exit code 2**. So Laws I/IV, rigor-5 (External Gate) and ops-2 (a recursive scan of a whole filesystem) exit 2, the consent rules are a stderr line, `SessionStart` context is plain stdout, `Stop` runs learn; `SubagentStop`/`PreCompact` are not Bob events and are not written. Unverified live (no Bob install on the authoring machine); the harness still holds via the rules preamble. · ² OpenCode's `tool.execute.before` can only allow or throw, with no "ask the user" tier, so the rule gate is a one-shot speed bump there rather than a prompt. · ³ OpenClaude is a Claude Code fork: Claude's hook groups and verdicts verbatim, in `~/.openclaude/settings.json` (global) or `.openclaude/settings.local.json` (per repo). Unverified live (no OpenClaude install on the authoring machine).</sub>
 
 **Reading the matrix.** Everything above the divider is at full parity — no host
 drops an Agent, Skill, or the memory convention. The asymmetry is entirely in

package/SHIPPED.md

@@ -20,7 +20,7 @@ historical references, not files distributed with the repo.
 > **On version numbers.** [`harness.config.json`](harness.config.json)'s `version` is a
 > human-readable label only. The canonical identity of an installed harness is the
 > **source fingerprint** stamped in `.geneseed-version` (see `geneseed version`), not the
-> string. Current label: **3.19.0**.
+> string. Current label: **4.0.0**.
 
 ## Capabilities
 

package/adapters/bob/README.md

@@ -99,16 +99,22 @@ What the global emit writes into `~/.bob/settings/settings.json`:
 | event | verb | how the verdict travels |
 | --- | --- | --- |
 | `SessionStart` | `context --host bob` | plain stdout, as on Claude |
-| `PreToolUse` | `tool-gate --host bob` — one group, no matcher | Laws I/IV: **exit 2**, reason on stderr; process 1/5: a stderr line, exit 0 |
+| `PreToolUse` | `tool-gate --host bob` — one group, no matcher | Laws I/IV, rigor-5 and ops-2: **exit 2**, reason on stderr; process 1/5: a stderr line, exit 0 |
 | `Stop` | `learn` | never a verdict |
 
-No matcher on `PreToolUse` because Bob's tool names are undocumented (its IDE and its
-Shell differ); `tool-gate` reads the payload's shape instead — a `command` field gets
-the git checks, a path gets the rule checks — and defers on anything it does not
-recognise. Bob has **no "ask the user" tier**, so the two Laws that admit no judgement
-call are refused outright and the two consent rules become a warning. Because that
-warning is all process 5 can be here, the `process` pack toggle changes nothing in
-Bob's hooks: the one group only ever exits 2 for Laws I and IV, which every build carries.
+No matcher on `PreToolUse`, deliberately: Bob's tools page already drifts from its own
+changelog (`web_fetch`, the 2.1.0 Office/IBM-docs tools are undocumented there), so an
+allow-list built from it would fail open on the next tool Bob adds, and a deny-list needs a
+regex dialect (lookahead) the docs never confirm — bob-verdict.md O1 rates the matcher's own
+upside "low, performance only", not worth either risk. `tool-gate` reads the payload's shape
+instead — a `command` field gets the git checks, a path gets the rule checks — and defers on
+anything it does not recognise. Bob has **no "ask the user" tier**, so the Laws and checks
+that admit no judgement call — Laws I and IV, rigor-5 (External Gate, when a project
+opts in) and ops-2 (Commands Must Return: a recursive scan rooted at a whole filesystem) —
+are refused outright, and the two consent rules become a warning. Because that
+warning is all process 5 can be here, the `process` pack toggle changes nothing in Bob's
+hooks: the one group only ever exits 2 for Laws I and IV, rigor-5 and ops-2, which every build
+carries.
 
 **Migration.** A re-emit over an older install unwires Geneseed's groups from the flat
 `~/.bob/settings.json` (your own keys there are kept) and writes the new set to the
@@ -140,10 +146,23 @@ MCP servers are wired at runtime (web console, listed by `geneseed mcp`) into th
 `~/.bob/settings/mcp.json` global — never `settings.json`, which Bob does not read
 servers from ([Bob docs](https://bob.ibm.com/docs/ide/configuration/mcp/mcp-in-bob)).
 
+## Slash commands
+
+Bob documents `.bob/commands/*.md` (project) and `~/.bob/commands/*.md` (global), with
+`description` frontmatter (bob-docs.md §6 — no use for `argument-hint` yet: no Geneseed
+skill takes positional arguments). Geneseed writes one command per merged skill's OLD name
+(`/old-name`, the same alias problem OpenCode's `command/` layer solves) and one per
+genuinely user-only skill (host-compat O2/R1): Bob's skills page documents only
+`name`/`description`, no model-invocation key, so a user-only skill gets **no** SKILL.md on
+Bob at all — `/its-name` is the only way to run it, and the model never sees it in its
+`use_skill` catalogue. Claim-on-create and manifest-owned like every other native file;
+uninstall removes them the same way.
+
 ## What Bob does not get
 
 Bob rides the Claude engine, so — like Claude — it has no OpenCode-only extras:
-colour themes, JS plugins, the saved-workflow runner, the primary-agent
-orchestrator, LSP enablement, or the `/`-command layer. Those capabilities have
-no analogue on a Claude-shaped host; the harness discipline is carried by the
-preamble and skills instead. See the [host matrix](../../README.md#-supported-harnesses).
+colour themes, JS plugins, the saved-workflow runner, the primary-agent orchestrator,
+LSP enablement, or OpenCode's full `/`-command layer (`COMMAND_SET`, `/ponytail`) — only
+the narrow alias/user-only-skill commands above. Those capabilities have no analogue on a
+Claude-shaped host; the harness discipline is carried by the preamble and skills instead.
+See the [host matrix](../../README.md#-supported-harnesses).

package/adapters/claude-code/README.md

@@ -14,7 +14,7 @@ bin/geneseed-hook.mjs …` — so at user scope they would fire and fail in ever
 repo that doesn't vendor the harness. A generated global install wires
 absolute-path hooks instead — `geneseed setup` does that for you.) It:
 
-- on **PreToolUse** (matcher `Bash`), runs `geneseed-hook git-gate` — the tool-boundary
+- on **PreToolUse** (matcher `Bash|PowerShell`), runs `geneseed-hook git-gate` — the tool-boundary
   half of Doctrine process 5 (*consent before every commit and push*) and of the
   destructive-git Rule. Drop the `process` pack (or exclude process 5) and the hook stays,
   wired with `--no-consent`: commits and pushes pass without asking, while the
@@ -27,22 +27,27 @@ absolute-path hooks instead — `geneseed setup` does that for you.) It:
   next time regardless. Every other Bash command (and any unreadable payload) is
   deferred to the normal permission flow — the hook never blocks unrelated work.
 
-  **Caveat — the GitHub MCP vector.** The hook matches the `Bash` tool only. If your
-  session has the GitHub MCP server, an agent can commit/push via `push_files` /
-  `create_or_update_file` / `merge_pull_request`, which bypass Bash. To gate those too,
-  widen the matcher to `"Bash|mcp__github__.*"` — `git-gate` ignores any payload it
-  doesn't recognise as a commit/push, so over-matching the tool surface is harmless.
-- on **PreToolUse** (matcher `Write|Edit|MultiEdit|NotebookEdit`), runs
+  **Caveat — the GitHub MCP vector.** The hook matches the `Bash` and `PowerShell` tools
+  only. If your session has the GitHub MCP server, an agent can commit/push via
+  `push_files` / `create_or_update_file` / `merge_pull_request`, which bypass both. To
+  gate those too, widen the matcher to `"Bash|PowerShell|mcp__github__.*"` —
+  `git-gate` ignores any payload it doesn't recognise as a commit/push, so
+  over-matching the tool surface is harmless.
+- on **PreToolUse** (matcher `Write|Edit|NotebookEdit`), runs
   `geneseed-hook rule-gate` — refuses a write that would put a credential into a tracked
   file, and asks first on the first write to `user-rules.md` or a memory file (whether
   something you want kept is a rule or a fact is your call). Ordinary edits pass.
-- on **SessionStart** (`startup`/`clear` only — a fresh context), prints `AGENT.md`
-  so the harness is in context from the first turn, then runs `geneseed-hook context` to
-  **inject the project context** directly into the session — so the project-context load is
-  by the hook, not left to the agent to remember (lazy entries are only listed). On
-  **`resume`** it runs `geneseed-hook context` *without* re-`cat`ting `AGENT.md`: the resumed
-  conversation already carries the harness, so re-injecting the static file each resume
-  is pure token waste — only the (possibly changed) project context is refreshed;
+  (`MultiEdit` is not a Claude Code tool and is not in the matcher; the gate reads
+  `edits[].new_string` as a cheap guard regardless.)
+- on **SessionStart**, every source (`startup`, `resume`, `clear`, `compact`, `fork`), runs
+  `geneseed-hook context` to **inject the project context** directly into the session — so
+  the project-context load is by the hook, not left to the agent to remember (lazy entries
+  are only listed). This is one matcher-less group, exactly as a generated install wires it:
+  a matcher list is one more place to miss a source (`fork` once was). A second group,
+  `startup`/`clear` only — a fresh context — prints `AGENT.md` so the vendored harness is in
+  context from the first turn. A generated install has no such group: its root file is
+  `CLAUDE.md`, which Claude Code loads by itself. A resumed or forked conversation already
+  carries the harness, so re-printing the static file there is pure token waste;
 - on **Stop**, runs `geneseed-hook learn` over the session to capture durable memories.
   Claude Code pipes the hook payload (with the session's `transcript_path`) to the
   command on stdin; `learn` reads that, flattens the transcript, distils new
@@ -59,12 +64,14 @@ absolute-path hooks instead — `geneseed setup` does that for you.) It:
 - on **PreCompact**, runs the same `geneseed-hook learn` once more. `learn` distils the
   *tail* of the transcript, so per-turn Stop is a sliding window over the session —
   and auto-compaction is the moment that window is about to be summarised away.
-  This captures memory *before* the summary; the SessionStart `compact` matcher
-  re-seeds context *after* it.
+  This captures memory *before* the summary; the SessionStart `context` hook (which
+  also fires on the `compact` source) re-seeds context *after* it.
 
   This step is **opt-in on a model CLI**: set `GENESEED_LLM` (e.g. `claude -p`,
   `llm`, `ollama run …`) for `learn` to actually distil. With it unset the hook is
-  a harmless no-op that just prints the prompt. Geneseed never embeds an API key.
+  a harmless no-op — it returns immediately rather than reading the transcript for
+  nothing; running `learn` by hand with notes piped in still prints the prompt it
+  would have sent. Geneseed never embeds an API key.
   If your bundle's `memory/` is not at `./memory` or `./Harness/memory`, point at
   it with `GENESEED_MEMORY=/abs/path/to/memory`.
 

package/adapters/claude-code/settings.json

@@ -2,13 +2,13 @@
   "hooks": {
     "PreToolUse": [
       {
-        "matcher": "Bash",
+        "matcher": "Bash|PowerShell",
         "hooks": [
           { "type": "command", "command": "node bin/geneseed-hook.mjs git-gate" }
         ]
       },
       {
-        "matcher": "Write|Edit|MultiEdit|NotebookEdit",
+        "matcher": "Write|Edit|NotebookEdit",
         "hooks": [
           { "type": "command", "command": "node bin/geneseed-hook.mjs rule-gate" }
         ]
@@ -16,16 +16,14 @@
     ],
     "SessionStart": [
       {
-        "matcher": "startup|clear",
         "hooks": [
-          { "type": "command", "command": "node -e \"process.stdout.write(require('fs').readFileSync('AGENT.md','utf8'))\"" },
           { "type": "command", "command": "node bin/geneseed-hook.mjs context" }
         ]
       },
       {
-        "matcher": "resume|compact",
+        "matcher": "startup|clear",
         "hooks": [
-          { "type": "command", "command": "node bin/geneseed-hook.mjs context" }
+          { "type": "command", "command": "node -e \"process.stdout.write(require('fs').readFileSync('AGENT.md','utf8'))\"" }
         ]
       }
     ],

package/adapters/openclaude/README.md

@@ -12,14 +12,21 @@ There is nothing to install by hand: `geneseed setup` (or `geneseed-build --emit
 openclaude` / `--emit openclaude-global`) writes everything.
 
 **OpenClaude never reads `~/.claude`, a project `.claude/`, or `$CLAUDE_CONFIG_DIR`.**
-A Claude Code install is invisible to it, so it gets its own. The two coexist on one
-machine and in one repo without touching each other.
+A Claude Code install is invisible to it, so it gets its own, and neither emit
+overwrites the other's files. On one machine the two coexist cleanly. In one
+repo they do not fully: OpenClaude also reads the root `CLAUDE.md`/`AGENTS.md`
+a Claude Code or Bob per-repo install already wrote there, on top of its own
+`.openclaude/CLAUDE.md` — both harnesses load, and there is no clean exclusion
+(excluding the root file would hide your own content in it too). `geneseed status`
+and `geneseed doctor` warn when this is happening in your repo.
 
 ## What the emit writes
 
 ### Per-repo (`--emit openclaude`)
 
-Everything lives under **`.openclaude/`**. Nothing is written at the repo root.
+Everything lives under **`.openclaude/`**, except the `.geneseed-emit`/
+`.geneseed-footprint` markers and `.mcp.json` below, which the driver writes at the
+repo root like every other host.
 
 - `CLAUDE.md`: the harness preamble as a delimited **managed block**. OpenClaude
   loads the root `AGENTS.md`, or the root `CLAUDE.md` only when `AGENTS.md` is
@@ -47,8 +54,9 @@ global config file.
 
 ## Hooks
 
-The Claude group set, unchanged: `PreToolUse` (git gate on `Bash`, rule gate on
-writes), `SessionStart` (context on `startup|clear` and `resume|compact`), `Stop`,
+The Claude group set, unchanged: `PreToolUse` (git gate on `Bash|PowerShell`, rule gate on
+writes), `SessionStart` (context on every source — one matcher-less group covers
+`startup`, `resume`, `clear`, `compact` and `fork` alike), `Stop`,
 `SubagentStop` and `PreCompact` (learn). OpenClaude reads Claude's
 `hookSpecificOutput.permissionDecision`, so the gates **ask** where Claude asks.
 The context hook carries `--host openclaude` for one reason. It tells the hook