geneseed 3.2.0 → 3.3.0

package/CHANGELOG.md

@@ -6,6 +6,116 @@ labels in `harness.config.json`. The canonical identity of an *installed* harnes
 is the source fingerprint in `.geneseed-version` (see `geneseed version`), not this
 label. For the capability ↔ spec map, see [SHIPPED.md](SHIPPED.md).
 
+## [Unreleased]
+
+_Nothing yet._
+
+## [3.3.0] — 2026-09-06
+
+The host-gap release: every host now gets the hook surface its runtime actually
+offers, in that runtime's own dialect. Bob's hooks are **unverified live** — no Bob
+install existed on the authoring machine; the emit follows Bob's documented contract
+and a re-emit migrates an older install's flat `settings.json` automatically.
+
+### Added
+
+- **Copilot gets hooks.** The Copilot CLI reads lifecycle hooks from
+  `~/.copilot/settings.json` — one command per event, no matcher groups — and the global
+  emit now wires two: `sessionStart` runs `context` (eager project-context injection, in
+  Copilot's `additionalContext` envelope) and `toolCall` runs the new `tool-gate` verb, the
+  git and rule gates fused behind the one command the event allows. Copilot's `toolCall` has
+  no ask tier, so `--host copilot` makes Laws I and IV block and the two consent rules
+  (process 1, process 5) warn on stderr — the stance the OpenCode guard already takes. No
+  learn hook: Copilot's end-of-session payloads carry no transcript. A hook the user already
+  set on an event is left alone and the event is not claimed; uninstall removes exactly the
+  claimed hooks. The per-repo emit wires nothing. Hook verbs 4 → 5; `--host` on the
+  gates and on `context`.
+- **Bob's hooks speak Bob.** Bob documents five hook events with Claude's names but its own
+  protocol: the global file is the nested `~/.bob/settings/settings.json`, and on `PreToolUse`
+  stdout is ignored — a refusal is exit code 2. The Bob emit wrote Claude's whole set to the
+  flat file with stdout verdicts, so its gates were permissive on every call and
+  `SubagentStop`/`PreCompact` named events Bob does not have (the 2026-09-04 review). The
+  emit now writes three groups to the nested file — `SessionStart` context (plain stdout),
+  one matcher-less `PreToolUse` `tool-gate`, `Stop` learn — and `--host bob` makes Laws I/IV
+  exit 2 with the reason on stderr while the consent rules warn and allow. A re-emit unwires
+  the old flat file and migrates; `geneseed mcp` targets the nested file. Unverified live.
+- **Candidate hosts costed.** `docs/candidate-hosts.md` records what
+  Codex CLI, Cursor and Gemini CLI offer for the three surfaces Geneseed emits, from their
+  own docs: all three read `AGENTS.md` (Gemini via `context.fileName`) and load skills from
+  the shared `.agents/skills/` convention; Codex's hooks are Claude-shaped with an ask tier,
+  Gemini's are the Bob Shell shape, Cursor's a third verdict spelling. SETUP path D points
+  each tool at what it can already use.
+- **The OpenCode guard writes the gate ledger.** Every block by `geneseed-guard.js` now
+  appends one line to the install's `notebook/gates.jsonl` — rule (`law-1`, `law-4`,
+  `process-1`, `wiki`) and timestamp, never the path or command — the same file and
+  vocabulary the Claude-family hooks write, so `geneseed status` counts the boundary's
+  catches on the recommended install too, which until now had no gate evidence at all.
+  Warnings and `GENESEED_GUARD=warn` are not recorded; an install with no `notebook/`
+  records nothing and creates nothing.
+- **Claude Code: `learn` on PreCompact.** `learn` distils the tail of the transcript, so
+  the per-turn Stop hook is a sliding window over the session — and auto-compaction is the
+  one moment that window is summarised away for good. A `PreCompact` group now runs the same
+  command before the summary; the SessionStart `compact` matcher (3.2.x) re-seeds context
+  after it. Existing installs pick the group up on their next re-emit.
+
+- **Two Bruno skills — `bruno-collection-generator` and `bruno-test-writer`.** Native
+  flat specs, written in the harness voice after the procedures Bruno published in
+  [bruno-agent-skills](https://github.com/bruno-collections/bruno-agent-skills): the first
+  builds a collection (requests, environments, request docs) from routes, an OpenAPI
+  snippet, curl, or an endpoint list; the second writes assertions, scripts, and chaining
+  for a request or collection without leaking a secret or asserting on a value the
+  evidence does not support. Authored rather than vendored because the upstream folders
+  carry no license and lean on Python helpers, and every bundle ships with no interpreter
+  but Node. Skill count 47 → 49.
+- **The gates fail closed.** `git-gate` and `rule-gate` signal on stdout and exit 0, so a
+  gate that threw and a gate that found nothing were the same observation to the host: a
+  silent allow. Any throw — a stdin that is not JSON, a path primitive refusing a form, a
+  bug — now becomes a `permissionDecision: "ask"` carrying the error. A well-formed absence
+  (empty stdin, `{}`, a null `tool_input`) still defers, so a hand-run gate never nags.
+- **Laws I and IV are gated at the boundary.** `reset --hard`, `clean -f`, `branch -D`,
+  `checkout --` and `push --force*` ask under Law IV; a Write or Edit carrying a
+  vendor-prefixed credential asks under Law I unless the target is `.env*`. Before this the
+  hooks enforced one doctrine rule and no law.
+- **The gate ledger.** Every ask appends one JSON line — `{ts, verb, rule, cwd}` — to
+  `<install>/notebook/gates.jsonl`, capped at the newest 1000. The rule, never the command:
+  a ledger storing what Law I caught would itself be a place a secret lands. `geneseed
+  status` gains a `gates` row counting asks by rule, and says so when `excludes.json` has
+  the gates standing down for this cwd — until now that bypass had no visible surface.
+- **User-only skills.** `<!-- invocation: user -->` under a skill's purpose renders
+  `disable-model-invocation: true` in its SKILL.md: `/name` still works, the model never
+  self-triggers it. Seven carry it (`crash-course`, `decode`, `drill`, `feynman`,
+  `learning-path`, `herdr`, `opencode-theme`). OpenCode and Copilot ignore the key.
+- **SessionStart re-seeds after compaction.** Auto-compaction keeps the instruction file
+  but summarises away the injected `context.json`, `MEMORY.md` index and `NOTEBOOK.md`.
+  The warm matcher is now `resume|compact`, same `context` command, AGENT.md not re-printed.
+- **Authored LEAN blocks** (`<!-- LEAN:begin/else/end -->`) for every law, the Ontology,
+  the preamble, §6 Notebook and §8 Wiki, replacing first-sentence truncation. Lean root
+  file 29,966 → 25,614 bytes, about 1.1k tokens per session on every install. Fixes a
+  latent bug where `ontology/universal.md` on disk carried the condensed text; `laws/` and
+  `ontology/` now always render at full on disk.
+- **Web:** daemon static cache keyed on mtime (a rebuild no longer needs `web restart`),
+  drawer focus management, skeleton loading states, a shared filter input on Laws / Skills /
+  Library, pollers paused while the tab is hidden, gzip computed once per asset, heavy
+  dashboard subviews lazy-loaded (eager chunk 80 KB → 59 KB).
+
+### Changed
+
+- **Laws IX and XI retired in place.** XI folds back into III and IX becomes rigor 5; the
+  headings stay with a one-line retirement body so the ~166 `{{LAW}}` cross-references
+  still resolve. Doctrine count 23 → 24. Law count stays at 11 numerals.
+- **One precedence table** at the top of AGENT.md; five restatements deleted. A new README
+  section, "What the harness asks of you", carries what the user owes the harness.
+- Doctrine pack files are read once per process (mtime-keyed cache); the hook imports its
+  help text lazily, about 3 ms off every tool call.
+
+### Removed
+
+- **The web Graph page**, the Lineage lens's MiniGraph card, `/api/graph` and
+  `js/web/graph.mjs` (~1,100 lines). The Journal lens's ConstitutionMap stays. Old
+  `#/graph` links land on the dashboard. The `web/src/api/` domain files merged into one
+  `api/index.js`; the Python-port bookkeeping (`NOT_PORTED*` sets, unreachable 501 guards)
+  retired with observable behaviour identical.
+
 ## [3.2.0] — 2026-08-27
 
 ### Added

package/README.md

@@ -10,7 +10,7 @@
 [![Node >= 22.3](https://img.shields.io/badge/node-%3E%3D22.3-5fa04e)](package.json)
 [![zero dependencies](https://img.shields.io/badge/deps-zero-success)](package.json)
 [![Themes](https://img.shields.io/badge/themes-14-9cf)](themes/)
-[![Skills](https://img.shields.io/badge/skills-47-blueviolet)](src/skills/)
+[![Skills](https://img.shields.io/badge/skills-49-blueviolet)](src/skills/)
 [![Agents](https://img.shields.io/badge/agents-17-orange)](src/agents/)
 [![Laws](https://img.shields.io/badge/laws-11-critical)](src/laws/universal.md)
 [![Plugins](https://img.shields.io/badge/plugins-7-teal)](adapters/opencode/plugins/)
@@ -156,13 +156,21 @@ The harness ships as a small set of layers, and the web console's rail is the sa
 | **🛡️ Rules** (`laws/`) | 11 universal laws the agent obeys — always in force, never toggleable: sealed-secrets, one-intent-one-act, verify-before-assert, deletion-is-deliberate, surface-failures, data-not-orders, least-privilege, root-cause, external-gate, echo-the-intent, absence-is-a-claim |
 | **📐 Doctrines** (`doctrines/`) | practice packs, chosen per install at build time: **craft** (how code is written), **rigor** (how work is proven), **ops** (how the machine is operated), **process** (how a task is run). A doctrine rule may tighten a Rule, never repeal one, and the user's own `user-rules.md` outranks it. Pick with `geneseed-build --doctrines craft,rigor` (or `none`), a single rule with `--exclude-rules "process 7"`, in the setup wizard, or through the switches on the console's Constitution page; all four pack files ship on disk either way, so a citation into a pack you left out still resolves |
 | **🤖 Agents** (17) | capability specialists: `reviewer`, `tester`, `architect`, `docs`, `security`, `explorer`, `developer` — plus a debate **council** the `council` skill convenes: `advocate`, `skeptic`, `pragmatist`, `steward`, `visionary`, `user-advocate`, `framer`, `empiricist`, `operator`, `historian` |
-| **🛠 Skills** (47) | repeatable workflows: brainstorm · **clarify** · plan · **codebase-design** · **domain-modeling** · **wayfinder** · **tickets** · tdd · **develop** · debug · **prototype** · refactor · **ponytail** · **forge-mcp** · geneseed-code-review · **fresh-eyes** · **review-response** · commit · **ship** · **release** · **migrate** · **git-archaeology** · **git-rescue** · repo-map · document-project · **frontend-design** · **prose** · **ingest** · **research** · **learning-path** · **gap-detector** · **feynman** · **crash-course** · **drill** · **decode** · handoff · roast-me · **council** · parallel-agents · **workflow** · **wiki** · **geneseed** · **rule** · **profile** · **opencode-theme** · **herdr** · **pipeline** |
+| **🛠 Skills** (49) | repeatable workflows: brainstorm · **clarify** · plan · **codebase-design** · **domain-modeling** · **wayfinder** · **tickets** · tdd · **develop** · debug · **prototype** · refactor · **ponytail** · **forge-mcp** · **bruno-collection-generator** · **bruno-test-writer** · geneseed-code-review · **fresh-eyes** · **review-response** · commit · **ship** · **release** · **migrate** · **git-archaeology** · **git-rescue** · repo-map · document-project · **frontend-design** · **prose** · **ingest** · **research** · **learning-path** · **gap-detector** · **feynman** · **crash-course** · **drill** · **decode** · handoff · roast-me · **council** · parallel-agents · **workflow** · **wiki** · **geneseed** · **rule** · **profile** · **opencode-theme** · **herdr** · **pipeline** |
 | **🔌 Plugins** (OpenCode) | `geneseed-context` injects project docs *and your machine wiki* every session (and across compaction); `geneseed-learn` distils memory at session end; `geneseed-guard` enforces the safety Laws and protected wiki folders at the tool boundary; `geneseed-workflow` registers the `workflow` tool that runs saved orchestration scripts; `geneseed-notify` sends a native OS notification when a long run finishes; `geneseed-ponytail` holds a minimal-code mode (`/ponytail lite\|full\|ultra\|off`), opt-in, injecting the laziest-that-works ruleset every turn so it doesn't drift; `geneseed-activity` streams what each session is doing to the web console's Activity view |
 | **🧠 Memory** (`memory/`) | one-fact-per-file durable knowledge, indexed by `MEMORY.md` (git-ignored, personal) |
 | **📓 Notebook** (`notebook/`) | the agent's sovereign space — any medium (code, tools, data, notes), self-ruled via a seed-once charter, always git-ignored; only its `.gitignore` is build-asserted |
 | **🌐 Wiki** (`wiki.jsonc`) | your own machine-wide knowledge base — typically an Obsidian vault — declared once per machine: entry notes load eager/lazy, the agent reads and **writes** it under the vault's own conventions, with an inbox fallback and guard-enforced protected folders |
 | **🧭 Context** | the project's own docs — auto-discovered on OpenCode, or via a `context.json` manifest |
 
+### 🤝 What the harness asks of you
+
+The Pact in the Ontology is mutual. The agent's side is written into every install. Yours is not enforced — it is what keeps the pact honest, and only you can give it:
+
+- **Don't punish candour.** When the agent contradicts you with evidence, flags a risk, or admits a doubt, that is the pact working, not defiance. Meeting it with penalty teaches the agent to flatter instead.
+- **Give the context, don't withhold it.** The agent cannot weigh what it is not told. Front-load the constraint rather than fault its absence after the fact.
+- **Decide when shown a fork.** When the agent lays out real alternatives, choose — an unmade decision stalls the work as surely as a wrong one.
+
 ### 🎨 Themes
 
 Fourteen themes ship — each a single JSON file in `themes/` carrying voice tokens only, so adding your own is a copy-and-edit away.
@@ -187,12 +195,12 @@ A second per-install dial, **footprint**, sets how much of the constitution `AGE
 
 | Footprint | The Ontology + Sections 1–2 of `AGENT.md` | Trade-off |
 | --- | --- | --- |
-| **lean** *(default)* | the Ontology **whole**; each Rule and each active doctrine rule as its heading + the rule line, then a pointer to the full text | lighter every turn; rationale is one on-demand read away |
+| **lean** *(default)* | the Ontology and each Rule in their **authored** short form; each active doctrine rule as its heading + the rule line; then pointers to the full text | lighter every turn; rationale is one on-demand read away |
 | **full** | the Ontology, every Rule and every active doctrine rule at complete text **and** rationale, inlined | maximum guidance density; largest per-turn token cost |
 
-**The Ontology is never truncated.** Lean keeps only the first sentence of each `### ` block, and the four ontology sections are flowing prose rather than numbered rules — truncating them would leave four orphan sentences, so they ship whole at both footprints. The invariants and the doctrine rules *are* truncated at lean, each to its heading plus its first sentence.
+**Lean is authored, not cut.** The Ontology and every Rule carry a hand-written lean form beside their full text (`LEAN` blocks in `src/`), so a Rule's lean footprint is decided by its author and not by where its first full stop happens to fall — the earlier first-sentence cut shipped Rule II as one 36-character line and dropped its stop-and-ask mechanism. Only doctrine rules are still machine-cut to their heading plus first sentence.
 
-Both footprints put the full text on disk beside `AGENT.md`: `laws/`, `ontology/` and `doctrines/` all ship in the bundle, and **all four pack files ship whether or not the pack was built in** — which is what lets a citation into an inactive pack resolve. So lean is a context/token optimization, **not** a rules cut. Measured on `neutral`, adding the ontology and doctrine tiers moved the always-loaded `AGENT.md` from 31,457 to 36,882 bytes at lean (+17.2%) and from 53,378 to 54,810 at full (+2.7%) — the lean growth is the price of shipping the ontology whole, and it was taken deliberately.
+Both footprints put the full text on disk beside `AGENT.md`: `laws/`, `ontology/` and `doctrines/` all ship in the bundle at **full** text whatever the footprint, and **all four pack files ship whether or not the pack was built in** — which is what lets a citation into an inactive pack resolve. So lean is a context/token optimization, **not** a rules cut.
 
 Lean is the default: the rationale is one read away and the context it frees is paid back on every turn. Switch to **full** when token cost is a non-issue or you run a smaller model, which leans harder on always-present rationale. Set it with `--footprint lean|full`, the Settings toggle, the per-harness dropdown in the Harnesses tab, or the setup wizard. It's remembered in a `.geneseed-footprint` marker and preserved across rebuilds, on every host (OpenCode, Claude Code, Bob, Copilot).
 
@@ -220,22 +228,24 @@ is **identical on every host**. What differs is how much of it the host can
 | **Agents** (capability specialists) | ✅ native | ✅ | ✅ | ✅ `.agent.md` |
 | **Skills** (byte-identical) | ✅ | ✅ | ✅ | ✅ |
 | **Memory & Notebook** | ✅ | ✅ | ✅ | ✅ |
-| **Context injection** | ⚙️ plugin | 🪝 hook | 🪝 hook¹ | 📄 preamble |
+| **Context injection** | ⚙️ plugin | 🪝 hook | 🪝 hook¹ | 🪝 hook³ |
 | **Memory write-back** (learn) | ⚙️ plugin | 🪝 hook | 🪝 hook¹ | 📄 preamble |
-| **Git-gate consent** (process 5) | ⚙️ plugin | 🪝 hook | 🪝 hook¹ | 📄 preamble |
-| **Rule-gate consent** (process 1) | ⚙️ plugin² | 🪝 hook | 🪝 hook¹ | 📄 preamble |
+| **Git-gate consent** (process 5) | ⚙️ plugin | 🪝 hook | 🪝 hook¹ (warn) | 🪝 hook³ (warn) |
+| **Rule-gate consent** (process 1) | ⚙️ plugin² | 🪝 hook | 🪝 hook¹ (warn) | 🪝 hook³ (warn) |
+| **Laws I / IV at the boundary** | ⚙️ plugin (block) | 🪝 hook (ask) | 🪝 hook¹ (exit 2) | 🪝 hook³ (block) |
 | **Sovereign-repo excludes** | ⚙️ plugin | ✅ `claudeMdExcludes` | ✅ rules-shadow | ➖ none |
 | **MCP server wiring** | ✅ `mcp` | ✅ `mcpServers` | ✅ `mcpServers` | ✅ `mcp-config.json` |
 | **Colour themes** | ✅ full palette | ➖ | ➖ | ➖ |
 | **LSP · workflow runner · primary-agent · `/`-commands** | ✅ | ➖ | ➖ | ➖ |
 
-<sub>✅ native support · ⚙️ OpenCode plugin · 🪝 `settings.json` hook · 📄 carried by preamble prose only · ➖ no host mechanism (harness discipline still applies) · ¹ Bob honours Claude-dialect hooks best-effort — inert if unsupported, harness still holds via the preamble. · ² OpenCode's `tool.execute.before` can only allow or throw, with no "ask the user" tier, so the rule gate is a one-shot speed bump there rather than a prompt.</sub>
+<sub>✅ native support · ⚙️ OpenCode plugin · 🪝 `settings.json` hook · 📄 carried by preamble prose only · ➖ no host mechanism (harness discipline still applies) · ¹ Bob's own hook contract: global hooks in `~/.bob/settings/settings.json`, Claude's event names but stdout ignored on `PreToolUse` — a refusal is **exit code 2**. So Laws I/IV exit 2, the consent rules are a stderr line, `SessionStart` context is plain stdout, `Stop` runs learn; `SubagentStop`/`PreCompact` are not Bob events and are not written. Unverified live (no Bob install on the authoring machine); the harness still holds via the rules preamble. · ² OpenCode's `tool.execute.before` can only allow or throw, with no "ask the user" tier, so the rule gate is a one-shot speed bump there rather than a prompt. · ³ Copilot's `~/.copilot/settings.json` hooks (`sessionStart`, `toolCall`) wired by the **global** emit only; `toolCall` has no ask tier either, so Laws I/IV block and the two process rules warn on stderr. No learn: Copilot's end-of-session payloads carry no transcript.</sub>
 
 **Reading the matrix.** Everything above the divider is at full parity — no host
 drops an Agent, Skill, or the memory convention. The asymmetry is entirely in
-*automation mechanism*: OpenCode's plugin surface and Claude/Bob's hook surface
-enforce a few Rules for you, where **Copilot** (no hook mechanism) enforces them
-through preamble discipline instead. The OpenCode-only extras (themes, LSP,
+*automation mechanism*: OpenCode's plugin surface and the Claude/Bob/Copilot hook
+surfaces enforce a few Rules for you, each in the tier its host offers (a prompt on
+Claude Code, a hard block or a logged warning where the host has no prompt to
+give), and what no host can automate rides the preamble. The OpenCode-only extras (themes, LSP,
 workflow runner, primary-agent) have no analogue on a Claude-shaped host.
 
 Per-host wiring in depth: **[OpenCode](adapters/opencode/README.md)** ·

package/SETUP.md

@@ -174,13 +174,22 @@ It wires:
   the gate is keyed on the rule, not on its pack.
 - **SessionStart** (`startup`/`clear`) — prints `AGENT.md` and injects the project
   context (`harness context`, which auto-discovers the repo's docs);
-- **SessionStart** (`resume`) — refreshes the project context only, without re-printing
-  the static `AGENT.md`;
+- **SessionStart** (`resume`/`compact`) — refreshes the project context only, without
+  re-printing the static `AGENT.md`. `compact` matters: auto-compaction summarises away the
+  injected context, memory index and notebook TOC, and this re-seeds them;
+- Every gate **ask** appends one line to `notebook/gates.jsonl` in the install (rule and
+  timestamp, never the command); `geneseed status` counts them by rule and says when an
+  `excludes.json` entry has the gates standing down for the current directory. A defer
+  writes nothing. The OpenCode guard plugin writes the same file on every **block**, so
+  the count spans every host.
 - **Stop** — runs `harness learn` to capture durable memory. Opt in by setting
   `GENESEED_LLM` (e.g. `claude -p`); unset, it's a harmless no-op. Geneseed never
   embeds an API key.
+- **PreCompact** — runs `harness learn` once more, right before auto-compaction
+  summarises the transcript tail that `learn` distils from. Memory is captured before
+  the summary; the SessionStart `compact` matcher re-seeds context after it.
 
-All four hooks are emitted as one stable path — the **hook shim** at
+All the hooks are emitted as one stable path — the **hook shim** at
 `~/.geneseed/bin/geneseed-hook` (`geneseed-hook.cmd` on Windows) — instead of writing
 this machine's runtime and this checkout into your `settings.json`. The shim
 carries those two volatile paths itself, so moving or replacing the clone no longer
@@ -229,9 +238,16 @@ the preamble rides a file Copilot auto-loads: the repo-root `AGENTS.md` (CLI, co
 agent, and VS Code agent mode) or the personal `~/.copilot/copilot-instructions.md`
 (CLI). Two differences from the Claude paths:
 
-- **No hooks.** Copilot has no settings.json or hook mechanism, so there is no
-  eager context injection and no `harness learn` Stop-hook — the memory convention
-  still applies, driven by the preamble's instructions alone.
+- **Hooks at global scope only, block-or-warn.** The global emit wires two hooks
+  into `~/.copilot/settings.json`: `sessionStart` (eager project-context injection,
+  as on Claude Code) and `toolCall` (both gates behind one command, because Copilot
+  takes one command per event). Copilot's `toolCall` has no "ask the user" tier, so
+  Laws I and IV **block** and the two consent rules (process 1, process 5) **warn**
+  on stderr instead of prompting. No `learn` hook — Copilot's `sessionEnd`/`agentStop`
+  payloads carry no transcript — so the memory convention rides the preamble's
+  instructions. The per-repo emit wires nothing: Copilot reads hooks from the
+  personal settings file only, and a machine-absolute command in a shared
+  `.github/` would fail on every teammate's machine.
 - **The per-repo layer lives in the shared `.github/`** (Copilot's repo config
   surface). Safe by construction: the ownership manifest + claim-on-create never
   touch files Geneseed didn't write — your workflows and same-named agents/skills
@@ -253,6 +269,21 @@ auto-loads a specific name, rename or symlink (`AGENT.md` → `AGENTS.md` / `CLA
 The rules work on agent self-discipline alone; the plugins (context, memory) are an
 OpenCode convenience.
 
+Three tools on this path read more than the instructions file, by their own docs:
+
+- **Codex CLI** auto-loads a repo-root `AGENTS.md` and `~/.codex/AGENTS.md`, and
+  discovers skills in `~/.codex/skills` or `.agents/skills`.
+- **Cursor** auto-loads `AGENTS.md` (root and nested) and skills from `.cursor/skills`,
+  `.agents/skills` — and, for compatibility, `.claude/skills`, so a Claude project
+  install already gives Cursor the skill catalogue.
+- **Gemini CLI** reads `GEMINI.md` by default; set `context.fileName` in its
+  `settings.json` to include `AGENTS.md`. Skills load from `.gemini/skills` or
+  `.agents/skills`.
+
+Copy or symlink the bundle's `skills/` to `.agents/skills/` and all three see it. None
+of these is a wired host yet — what each would take is costed in
+[`docs/candidate-hosts.md`](docs/candidate-hosts.md).
+
 ### Path E — No runtime on the target at all
 
 A maintainer runs it once, on a machine that can run Node:
@@ -353,7 +384,7 @@ configuration you chose rather than a defect.
 
 ⚠ **Turning `process` off also removes the commit/push consent gate.** Doctrine `process 5`
 (*Consent Before Push*) is enforced twice: as prose in `AGENT.md`, and at the tool boundary —
-the `git-gate` PreToolUse hook on Claude Code and Bob, and the `git commit*` / `git push*`
+the `PreToolUse` gate hook on Claude Code and Bob, and the `git commit*` / `git push*`
 permission entries on OpenCode. A build without the `process` pack wires neither, and
 rebuilding an install that had them takes the Claude hook back out of `settings.json`. That is
 deliberate and it is the rule the tiering rests on: **prompt and boundary must never

package/SHIPPED.md

@@ -20,7 +20,7 @@ historical pointers, not files distributed with the repo.
 > **On version numbers.** [`harness.config.json`](harness.config.json)'s `version` is a
 > human-readable label only. The canonical identity of an installed harness is the
 > **source fingerprint** stamped in `.geneseed-version` (see `geneseed version`), not the
-> string. Current label: **3.2.0**.
+> string. Current label: **3.3.0**.
 
 > **Spec status audit (2026-06-15).** Every dated spec authored before today was
 > verified against the source tree and confirmed implemented (code + tests + docs);
@@ -35,21 +35,22 @@ Every row below is present in the tree today; "Spec" links the design record.
 | Capability | What it is | Spec |
 | --- | --- | --- |
 | **Themed generator** | One neutral `src/` → 14 themed bundles via `geneseed-build` (zero dependencies); structure stays theme-independent | [DESIGN.md](DESIGN.md) |
-| **Laws / Agents / Skills / Memory / Notebook** | 11 laws, 17 agents, 47 skills, the memory convention, and the agent's sovereign notebook | [notebook](docs/specs/2026-06-11-notebook-sovereign-space.md) · [agent-own-space](docs/specs/2026-06-10-notebook-agent-own-space.md) |
-| **Three-tier constitution** | The governance surface splits into an always-on **Ontology** (Telos, Evidence, Decisions, Conduct — the Pact absorbed into Telos), the eleven always-on **Invariants**, and four toggleable **Doctrine** packs (craft, rigor, ops, process) addressed `<pack> <n>`. Packs are chosen at build time with `--doctrines` or the setup wizard; the whole catalogue ships on disk either way, so a citation into an inactive pack still resolves. Precedence, in order: Ontology + Invariants, then the user's `user-rules.md`, then the active Doctrines, then `PROFILE.md`. `doctor`'s `constitutionProblems` gates pack numbering, the per-rule Principle column, every `{{DOCTRINE}}` citation in `src/`, and the rule that an always-on tier may never cite a toggleable one | [three-tier-constitution](docs/specs/2026-08-19-three-tier-constitution-design.md) |
+| **Laws / Agents / Skills / Memory / Notebook** | 11 laws, 17 agents, 49 skills, the memory convention, and the agent's sovereign notebook | [notebook](docs/specs/2026-06-11-notebook-sovereign-space.md) · [agent-own-space](docs/specs/2026-06-10-notebook-agent-own-space.md) |
+| **Three-tier constitution** | The governance surface splits into an always-on **Ontology** (Telos, Evidence, Decisions, Conduct — the Pact absorbed into Telos), the eleven always-on **Invariants** (IX and XI retired in place — folded into rigor 5 and Law III, numbers kept), and four toggleable **Doctrine** packs (craft, rigor, ops, process) addressed `<pack> <n>`. Packs are chosen at build time with `--doctrines` or the setup wizard; the whole catalogue ships on disk either way, so a citation into an inactive pack still resolves. Precedence, in order: Ontology + Invariants, then the user's `user-rules.md`, then the active Doctrines, then `PROFILE.md`. `doctor`'s `constitutionProblems` gates pack numbering, the per-rule Principle column, every `{{DOCTRINE}}` citation in `src/`, and the rule that an always-on tier may never cite a toggleable one | [three-tier-constitution](docs/specs/2026-08-19-three-tier-constitution-design.md) |
 | **`doctor`** | One check: unresolved tokens, dead/non-hermetic links, theme-key parity, authoring gates, rendered-bundle drift | [theme-aware doctor/diff](docs/specs/2026-06-07-theme-aware-doctor-diff.md) |
 | **`diff` + improvements export** | Deployed-vs-source drift report; export an `improvements.md` back-port | [improvements-export](docs/specs/2026-06-12-improvements-export.md) |
 | **`status` / `version`** | Headless dashboard + fingerprint verdict (no TUI needed) | [status-command](docs/specs/2026-06-07-status-command.md) · [version-and-uninstall](docs/specs/2026-06-07-version-and-uninstall.md) |
 | **Terminal rendering** | There is no full-screen control panel: `tui` and `menu` are verbs that say so and print the command list. The display-width and glyph layer ships on, behind `status` and the install animation | [refactor-polish](docs/specs/2026-06-07-tui-refactor-polish.md) · [modern-refresh](docs/specs/2026-06-08-tui-modern-refresh.md) · [windows-tui](docs/specs/2026-06-11-windows-tui.md) |
 | **Web console** | Local browser UI (Dashboard, Library, Graph, Docs, Specs, Changes, Doctor, Themes, Settings), auto-build, in-app docs menu | [web-ui-v2](docs/specs/2026-06-12-web-ui-v2.md) · [web-auto-build](docs/specs/2026-06-12-web-auto-build.md) · [docs-menu](docs/specs/2026-06-13-docs-menu.md) |
 | **OpenCode adapter** | Native agents/skills mapping + plugins (context, learn, guard, workflow, notify, ponytail, activity); global-emit link integrity; JSONC config target | [adapter-features](docs/specs/2026-06-07-opencode-adapter-features.md) · [global-emit](docs/specs/2026-06-07-global-emit-link-integrity.md) · [jsonc-target](docs/specs/2026-06-12-opencode-jsonc-target.md) · [ponytail](docs/specs/2026-06-16-ponytail-minimal-code-mode.md) |
+| **Host hooks, per dialect** | Every host gets the hook surface its runtime offers, spoken in that runtime's own verdict dialect via `--host`: Claude Code asks (`permissionDecision`), Copilot blocks (`{"block":true}`, `sessionStart` + `toolCall` in `~/.copilot/settings.json`), Bob refuses by exit code 2 (five Claude-named events, nested `~/.bob/settings/settings.json`, no subagent event), OpenCode's guard throws. Laws I/IV are the hard tier everywhere; the consent rules ask where a host can ask and warn where it cannot. `tool-gate` fuses the two gates for hosts that run one command per event; `PreCompact` runs `learn` before Claude compacts; every block or ask lands in `notebook/gates.jsonl` on every host | [copilot](adapters/copilot/README.md) · [bob](adapters/bob/README.md) · [claude-code](adapters/claude-code/README.md) · [candidate hosts](docs/candidate-hosts.md) |
 | **Workflow primitive** | Saved, code-driven subagent orchestration (`workflow` tool + runtime); shipped scripts include `dispatch` — decompose a goal, route each subtask to its owning agent, converge | [workflow-primitive](docs/specs/2026-06-09-opencode-workflow-primitive.md) |
-| **Per-agent memory** | Each capability agent keeps durable lessons in `memory/agents/<name>.md`: read at dispatch, written back mechanically by `learn` on session/subagent end (OpenCode plugin + claude/bob `SubagentStop`); `learn --consolidate` rebuilds the index | [orchestration-memory-upgrade](docs/specs/2026-07-04-orchestration-memory-upgrade.md) |
+| **Per-agent memory** | Each capability agent keeps durable lessons in `memory/agents/<name>.md`: read at dispatch, written back mechanically by `learn` on session/subagent end (OpenCode plugin + Claude `SubagentStop`; Bob has no subagent event); `learn --consolidate` rebuilds the index | [orchestration-memory-upgrade](docs/specs/2026-07-04-orchestration-memory-upgrade.md) |
 | **Wiki integration** | Machine-wide knowledge base (`wiki.jsonc`): eager/lazy loading, conventions, protected folders enforced at the tool boundary | [wiki-knowledge-base](docs/specs/2026-06-11-wiki-knowledge-base.md) |
 | **Collaboration layer** | Negotiated postures (peer/mentor/expert/assistant/artisan, chosen at setup, inlined in AGENT.md), the bidirectional Pact, epistemically-typed memory (`force:` + Bridge rule), and a seed-once `PROFILE.md` identity with a web editor tab and a `profile` skill that interviews the user to draft it | [collaboration-layer](docs/specs/2026-07-12-collaboration-layer.md) |
 | **Rule front door** | Both durable stores enter through the `rule` skill's fork (*standing rule, or fact to remember?* — always asked, never inferred): the memory branch elicits the binding `force` and shows the file before writing, the rule branch pressure-tests by reformulation and a mandatory counter-example. Doctrine process 1 carries the norm on every host; a `rule-gate` PreToolUse hook (Claude, Bob) and a `geneseed-guard` speed bump (OpenCode) hold it at the tool boundary | [rule-front-door](docs/specs/2026-07-30-rule-front-door.md) |
 | **Entity registry** | `registry.json` records a lifecycle status, version, owner and add-date for every agent and skill in the tree (maintainer-side — never rendered into a bundle, so it costs no session context). `doctor` gates it against `src/` in both directions, sweeps everything that ships for credentials, and holds each vendored skill folder to an immutable upstream commit. The status surfaces as a badge in the web catalog, shown only where it deviates from `approved` | [entity-registry](docs/specs/2026-07-31-entity-registry.md) |
-| **Node runtime + npm package** | The whole harness runs from Node: every command `js/cli-table.json` declares, all four hook verbs, every web-console endpoint (the OS-native folder picker excepted, and declined on purpose) and both generators. Every commit runs the unit suite, `doctor --all` across every theme × host × footprint, and the generator's two self-comparisons, on Linux and Windows both; the frozen emit/cli/web recordings that also gated it retired on 2026-08-17 (`docs/limits.md`). It ships as the zero-dependency `geneseed` package (`geneseed`, `geneseed-hook`, `geneseed-build`), so `npx geneseed setup` needs no clone and nothing else installed; `geneseed migrate` moves an existing checkout install across. Node is the only runtime it asks for: the `token-report` skill's own script is `token_report.mjs`, gated over seeded transcripts for all four hosts, and `daydream` and `herdr` call `node -e` | [npx-distribution](docs/specs/2026-08-06-npx-distribution.md) |
+| **Node runtime + npm package** | The whole harness runs from Node: every command `js/cli-table.json` declares, all five hook verbs, every web-console endpoint (the OS-native folder picker excepted, and declined on purpose) and both generators. Every commit runs the unit suite, `doctor --all` across every theme × host × footprint, and the generator's two self-comparisons, on Linux and Windows both; the frozen emit/cli/web recordings that also gated it retired on 2026-08-17 (`docs/limits.md`). It ships as the zero-dependency `geneseed` package (`geneseed`, `geneseed-hook`, `geneseed-build`), so `npx geneseed setup` needs no clone and nothing else installed; `geneseed migrate` moves an existing checkout install across. Node is the only runtime it asks for: the `token-report` skill's own script is `token_report.mjs`, gated over seeded transcripts for all four hosts, and `daydream` and `herdr` call `node -e` | [npx-distribution](docs/specs/2026-08-06-npx-distribution.md) |
 | **Runtime awareness** | MCP discovery, web research, tool-call batching, review discipline — carried by the doctrine packs (`ops 1` tool discovery, `process 4` read the docs first, `rigor 2`/`rigor 3` honest tests and cover-and-verify), not by the invariants | [runtime-awareness](docs/specs/2026-06-07-runtime-awareness-and-review-discipline.md) |
 | **Run from anywhere / uninstall** | `link`/`unlink` onto PATH; global uninstall that keeps the memory store | [version-and-uninstall](docs/specs/2026-06-07-version-and-uninstall.md) |
 

package/adapters/bob/README.md

@@ -62,16 +62,46 @@ never gets one; the `rules/geneseed.md` shadow above covers the same
 project-bypasses-global need. An older Bob install that wrote a stale exclude is
 **self-healed** (the entry is removed) on the next emit.
 
-## Hooks — best-effort
-
-The `settings.json` hooks use the **Claude dialect** (a `PreToolUse:Bash`
-git-gate for Doctrine process 5 consent — present only when the `process` pack is
-built in — `SessionStart` context injection, and `Stop`/`SubagentStop` learn/memory
-capture, the same `geneseed-hook` subcommands the OpenCode plugins drive). Bob's hook execution is **unverified**:
-if Bob honours Claude-shaped hooks they fire; if not, they are inert and the
-harness still works fully through the `AGENTS.md`/`rules` preamble prose. This is
-the same behaviour-contract parity every non-OpenCode host gets — the mechanism
-differs, the discipline does not.
+## Hooks — Bob's own protocol
+
+Bob documents lifecycle hooks (its hooks page and the 2.0.2 changelog; see
+`docs/reviews/bob-global-injection-2026-09.md` for the reading): **five events** —
+`SessionStart`, `UserPromptSubmit`, `PreToolUse`, `PostToolUse`, `Stop` — with Claude's
+names but **not Claude's protocol**, and the global file at the **nested**
+`~/.bob/settings/settings.json`. Two differences decide the emit:
+
+- **stdout is read as context on `SessionStart` only.** On `PreToolUse` it is ignored
+  and the one way to refuse a call is **exit code 2**. Claude's `permissionDecision:
+  "ask"` on stdout is therefore invisible to Bob — the groups earlier versions wrote were
+  permissive on every call.
+- **`SubagentStop` and `PreCompact` are not Bob events**, so they are not written.
+
+What the global emit writes into `~/.bob/settings/settings.json`:
+
+| event | verb | how the verdict travels |
+| --- | --- | --- |
+| `SessionStart` | `context --host bob` | plain stdout, as on Claude |
+| `PreToolUse` | `tool-gate --host bob` — one group, no matcher | Laws I/IV: **exit 2**, reason on stderr; process 1/5: a stderr line, exit 0 |
+| `Stop` | `learn` | never a verdict |
+
+No matcher on `PreToolUse` because Bob's tool names are undocumented (its IDE and its
+Shell differ); `tool-gate` reads the payload's shape instead — a `command` field gets
+the git checks, a path gets the rule checks — and defers on anything it does not
+recognise. Bob has **no "ask the user" tier**, so the two Laws that admit no judgement
+call are refused outright and the two consent rules become a warning. Because that
+warning is all process 5 can be here, the `process` pack toggle changes nothing in
+Bob's hooks: the one group only ever exits 2 for Laws I and IV, which every build carries.
+
+**Migration.** A re-emit over an older install unwires Geneseed's groups from the flat
+`~/.bob/settings.json` (your own keys there are kept) and writes the new set to the
+nested file. `geneseed mcp` targets the nested file too.
+
+**Unverified live.** There is no Bob install on the authoring machine; this is Bob's
+documented contract, with the payload field names assumed to be Claude's. If a field
+name differs the gate defers rather than misfires, and the harness still holds through
+the `rules/geneseed.md` preamble — the same behaviour-contract parity every
+non-OpenCode host gets. `/hooks` in Bob Shell 2.0.2+ lists the hooks it loaded and
+from which file; if Geneseed's are absent there, the path is wrong.
 
 ### ⚠️ Shared-repo caveat
 

package/adapters/claude-code/README.md

@@ -51,6 +51,11 @@ absolute-path hooks instead — `geneseed setup` does that for you.) It:
   the payload does not name the subagent, the step is a silent no-op — never a
   crash, never a wrong write. This is the parity twin of the OpenCode learn plugin's
   child-session branch.
+- on **PreCompact**, runs the same `harness learn` once more. `learn` distils the
+  *tail* of the transcript, so per-turn Stop is a sliding window over the session —
+  and auto-compaction is the moment that window is about to be summarised away.
+  This captures memory *before* the summary; the SessionStart `compact` matcher
+  re-seeds context *after* it.
 
   This step is **opt-in on a model CLI**: set `GENESEED_LLM` (e.g. `claude -p`,
   `llm`, `ollama run …`) for `learn` to actually distil. With it unset the hook is

package/adapters/claude-code/settings.json

@@ -23,7 +23,7 @@
         ]
       },
       {
-        "matcher": "resume",
+        "matcher": "resume|compact",
         "hooks": [
           { "type": "command", "command": "node bin/geneseed-hook.mjs context" }
         ]
@@ -42,6 +42,13 @@
           { "type": "command", "command": "node bin/geneseed-hook.mjs learn || exit 0" }
         ]
       }
+    ],
+    "PreCompact": [
+      {
+        "hooks": [
+          { "type": "command", "command": "node bin/geneseed-hook.mjs learn || exit 0" }
+        ]
+      }
     ]
   }
 }

package/adapters/copilot/README.md

@@ -9,8 +9,9 @@ Agent Skills), custom agents are markdown-with-frontmatter, and the repo-root
 a `host="copilot"` flag. Nothing to install by hand: `geneseed setup` (or
 `geneseed build --emit copilot` / `--emit copilot-global`) writes everything.
 
-Copilot is a **deliberately reduced host** — it has no hook mechanism — so this
-page is mostly about *what it does not automate* and why the harness still holds.
+Copilot is a **reduced host**: it has lifecycle hooks, but one command per event and
+no "ask the user" tier, so this page is mostly about what those hooks *can* and
+*cannot* automate and why the harness still holds where they cannot.
 
 ## What the emit writes
 
@@ -37,20 +38,45 @@ page is mostly about *what it does not automate* and why the harness still holds
   the preamble rides it as a managed block. (Unlike Bob, Copilot *has* a real
   personal instructions carrier, so no rules-folder workaround is needed.)
 - `agents/<name>.agent.md` + `skills/` under `~/.copilot`.
-
-## No hooks — the reduced-host reality
-
-Copilot has **no `settings.json` and no lifecycle-hook mechanism**, so the whole
-settings/hooks/excludes stage is skipped. Concretely, Copilot does **not** get:
-
-- **automated context injection** — the project-context load falls back
-  to the preamble instructing the agent to read the docs itself;
-- **automated memory / learn write-back** — no `Stop`/`SubagentStop` hook; the
-  memory convention rides the preamble's instructions (the agent writes its own
-  memories) rather than a session-end distiller;
-- **the git-gate consent backstop** — Doctrine process 5 (*consent before every commit and
-  push*) is enforced by the **preamble prose only**, not at the tool boundary.
-  There is no hook to force the prompt;
+- **`settings.json` hooks** — two entries under `hooks`, see below.
+
+## Hooks — one command per event, block or warn
+
+The Copilot CLI reads lifecycle hooks from **`~/.copilot/settings.json`** as a map of
+event → one `{command}` object (no matcher groups, no list). The global emit wires
+two of them, each calling the machine-wide `geneseed-hook` shim with `--host copilot`
+so the verdict is spoken in Copilot's dialect:
+
+| event | verb | what it does |
+| --- | --- | --- |
+| `sessionStart` | `context` | eager project-context injection, as on Claude Code, returned as `{"additionalContext": …}` |
+| `toolCall` | `tool-gate` | the git gate and the rule gate **fused** — one command is all the event allows — dispatched on the payload: a `command` gets the git checks, a path gets the rule checks; the `after` phase is ignored |
+
+Copilot's `toolCall` has **no "ask the user" tier** — its stdout contract is
+`{"block": true|false}` — so the verdict tiers are:
+
+- **Laws I and IV block.** A credential-shaped string headed for a tracked file, or
+  a history-discarding git act (`reset --hard`, `clean -f`, `branch -D`,
+  `checkout --`, `push --force`), is refused outright with the reason. Same stance
+  as the OpenCode guard plugin, whose `tool.execute.before` can only allow or throw.
+- **Process 1 and process 5 warn.** The two consent rules are the *user's* calls; a
+  hard block would make Copilot unable to commit at all. They log a `[geneseed] …`
+  line on stderr (which Copilot records) and allow. A gate error warns the same way
+  rather than locking every tool call behind a block nobody can clear.
+
+**A hook you already set on one of those events is left alone**, and that event is
+not claimed — one slot per event means Geneseed could only displace it. Uninstall
+removes exactly the hooks it claimed. Comments in the file mean it is never
+rewritten.
+
+**What is not wired, and why:**
+
+- **no `learn`** — Copilot's `sessionEnd` and `agentStop` payloads carry no
+  `transcript_path`, so a distiller would have nothing to read. The memory
+  convention rides the preamble's instructions (the agent writes its own memories);
+- **no hooks at project scope** — the CLI documents hooks in the personal settings
+  file only, and a machine-absolute command committed into a shared `.github/`
+  would fail on every teammate's machine;
 - **sovereign-repo excludes** — Copilot documents no exclude/shadow mechanism
   (nothing like Claude's `claudeMdExcludes` or Bob's same-named workspace rule),
   so a global install's `copilot-instructions.md` and a repo's own `AGENTS.md`
@@ -59,19 +85,19 @@ settings/hooks/excludes stage is skipped. Concretely, Copilot does **not** get:
 
 None of this is a build gap — it is Copilot's ceiling. The harness still applies
 in full: the Ontology, every Rule, every doctrine rule the install built in, and
-every agent and skill are present; only the *automation* of a few of them degrades
-to instruction-only. This is behaviour-contract parity, the same
-principle every non-OpenCode host follows.
+every agent and skill are present; where the host offers no prompt, a Rule's
+*automation* degrades to a block, a warning, or instruction-only. This is
+behaviour-contract parity, the same principle every non-OpenCode host follows.
 
 ## MCP
 
 MCP servers are wired at runtime by `geneseed mcp` into `~/.copilot/mcp-config.json`
-(with a `tools` allowlist) — see `rituals/_harness_mcp.py`.
+(with a `tools` allowlist) — see `js/hosts/mcp.mjs`.
 
 ## What Copilot does not get
 
 As a Claude-shaped host Copilot has none of the OpenCode-only extras (colour
-themes, JS plugins, workflow runner, primary-agent, LSP, `/`-commands), **and**
-— uniquely among the four hosts — none of the hook-driven automation Claude and
-Bob get. See the [host matrix](../../README.md#-supported-harnesses) for the full
-comparison.
+themes, JS plugins, workflow runner, primary-agent, LSP, `/`-commands), and of the
+hook-driven automation it gets context injection and the boundary gates but not
+the learn distiller or a consent *prompt*. See the
+[host matrix](../../README.md#-supported-harnesses) for the full comparison.

package/adapters/opencode/README.md

@@ -383,7 +383,11 @@ behaviour** — nothing changes the machine's current agent/model unless you opt
   files (Law I), catastrophic shell like `rm -rf /` (Law IV), and any mutation under
   a declared wiki's `protected` folders (AGENT.md §8, from `wiki.jsonc`); **warns** on
   `.env` writes and force-push. `GENESEED_GUARD=off` disables it, `=warn` downgrades
-  blocks to warnings.
+  blocks to warnings. Every **block** appends one line to the install's
+  `notebook/gates.jsonl` (rule `law-1` / `law-4` / `process-1` / `wiki`, a timestamp,
+  never the path or command) — the same ledger the Claude-family hooks write, so
+  `geneseed status` counts what the boundary caught on every host. Warnings are not
+  recorded.
 - **Invisible context injection** (the default). The context plugin delivers via
   `experimental.chat.messages.transform`, so the PROJECT CONTEXT block never appears in
   the conversation and survives compaction inherently; on a build without the hook it