geneseed 3.2.0 → 3.3.0

package/js/web/handler.mjs

@@ -19,10 +19,10 @@ import { apiDeployCmd, apiInstallCmd, apiPickFolder, apiRestore, buildOverride,
 import { NotFound, PREFIX_ROUTES, STATE_ROUTES } from './api.mjs';
 import { openUrl, requestRestart } from './daemon.mjs';
 import { apiDocs, apiDocsPage } from './docs.mjs';
-import { NOT_PORTED_ACTIONS, actionCommands } from './jobs.mjs';
-import { POST_ROUTES, notPorted, notPortedPost, readJsonBody } from './routes.mjs';
+import { actionCommands } from './jobs.mjs';
+import { POST_ROUTES, readJsonBody } from './routes.mjs';
 import { isFile } from '../lib/fs.mjs';
-import { readFileSync } from 'node:fs';
+import { readFileSync, statSync } from 'node:fs';
 import { basename, dirname, extname, join, sep } from 'node:path';
 import { gzipSync } from 'node:zlib';
 
@@ -57,13 +57,17 @@ const CTYPES = {
 // ---- the request handler ---------------------------------------------------
 
 export function makeHandler(state, jm, token, dist, holder = null) {
+  // fp -> { mtime, data, gz }. Keyed by path but VALIDATED by mtime on every hit, so a
+  // rebuilt web/dist serves fresh bytes without `web restart` — the re-stat costs one
+  // syscall against the readFileSync + gzipSync it saves. `gz` is the gzipped body,
+  // computed once on the first gzip-accepting request instead of per request.
   const staticCache = new Map();
 
-  function sendBytes(res, body, ctype, code = 200, extra = null, acceptEncoding = '') {
+  function sendBytes(res, body, ctype, code = 200, extra = null, acceptEncoding = '', gzStore = null) {
     const headers = { ...(extra || {}) };
     if (body.length >= GZIP_MIN && GZIP_TYPES.some((t) => ctype.startsWith(t))
         && (acceptEncoding || '').includes('gzip')) {
-      body = gzipSync(body, { level: 6 });
+      body = gzStore ? (gzStore.gz ??= gzipSync(body, { level: 6 })) : gzipSync(body, { level: 6 });
       headers['Content-Encoding'] = 'gzip';
       headers.Vary = 'Accept-Encoding';
     }
@@ -91,21 +95,25 @@ export function makeHandler(state, jm, token, dist, holder = null) {
     if (!isFile(fp)) {
       return sendJson(res, { error: 'web/dist missing — run the UI build' }, 500, acceptEncoding);
     }
-    let data = staticCache.get(fp);
-    if (data === undefined) {
-      data = readFileSync(fp);
-      staticCache.set(fp, data);
+    const mtime = statSync(fp).mtimeMs;
+    let entry = staticCache.get(fp);
+    if (entry === undefined || entry.mtime !== mtime) {
+      entry = { mtime, data: readFileSync(fp), gz: null };
+      staticCache.set(fp, entry);
     }
+    let data = entry.data;
     let extra = null;
     if (basename(fp) === 'index.html') {
       const inject = Buffer.from(`<script>window.__GENESEED_TOKEN__="${token}";</script>`, 'utf-8');
       data = replaceOnce(data, Buffer.from('</head>'), Buffer.concat([inject, Buffer.from('</head>')]));
       extra = { 'Cache-Control': 'no-store' };
+      // The injected bytes differ from `entry.data`, so the gz cache must not serve them.
+      entry = null;
     } else if (path.includes('/assets/')) {
       extra = { 'Cache-Control': 'public, max-age=31536000, immutable' };
     }
     return sendBytes(res, data, CTYPES[extname(fp)] || 'application/octet-stream',
-      200, extra, acceptEncoding);
+      200, extra, acceptEncoding, entry);
   }
 
   function doGet(req, res, path, ae) {
@@ -120,14 +128,7 @@ export function makeHandler(state, jm, token, dist, holder = null) {
     }
     if (path.startsWith('/api/docs/page/')) {
       const pid = percentDecode(path.slice('/api/docs/page/'.length));
-      try {
-        return sendJson(res, apiDocsPage(state, pid, harnessParam(req.url)), 200, ae);
-      } catch (e) {
-        // An unimplemented doc kind says so explicitly (501), rather than falling through
-        // to the `NotFound` at the bottom of `apiDocsPage` and claiming the page is missing.
-        if (e && e.notPorted) return sendJson(res, { error: e.message }, 501, ae);
-        throw e;
-      }
+      return sendJson(res, apiDocsPage(state, pid, harnessParam(req.url)), 200, ae);
     }
     if (path === '/api/jobs') return sendJson(res, { jobs: jm.recent() }, 200, ae);
     if (path.startsWith('/api/jobs/')) {
@@ -137,9 +138,6 @@ export function makeHandler(state, jm, token, dist, holder = null) {
       return j ? sendJson(res, j, 200, ae)
         : sendJson(res, { error: 'no such job' }, 404, ae);
     }
-    if (notPorted(path)) {
-      return sendJson(res, { error: `not ported yet: ${path}` }, 501, ae);
-    }
     return serveStatic(res, path, ae);
   }
 
@@ -230,9 +228,6 @@ export function makeHandler(state, jm, token, dist, holder = null) {
     if (path.startsWith('/api/actions/')) {
       return doAction(res, path.slice(path.lastIndexOf('/') + 1), readJsonBody(body), ae);
     }
-    if (notPortedPost(path)) {
-      return sendJson(res, { error: `not ported yet: ${path}` }, 501, ae);
-    }
     return sendJson(res, { error: 'not found' }, 404, ae);
   }
 
@@ -253,9 +248,7 @@ export function makeHandler(state, jm, token, dist, holder = null) {
    * it succeeded: a failed update changed nothing worth reloading and bouncing would disconnect
    * the PWA for no reason.
    *
-   * THEN the unported rows, and only then the table. Order matters: `link`/`unlink` are REAL
-   * actions whose verb has not crossed, and letting them fall through to `actionCommands` would
-   * answer `{"error": "unknown action link"}` — the same thing a typo gets.
+   * THEN the table, which answers a 404 for any action it does not name.
    */
   function doAction(res, action, body, ae) {
     if (action === 'restore') {
@@ -284,9 +277,6 @@ export function makeHandler(state, jm, token, dist, holder = null) {
       if (jid === null) return sendJson(res, { error: 'busy' }, 409, ae);
       return sendJson(res, { job_id: jid }, 202, ae);
     }
-    if (NOT_PORTED_ACTIONS.has(action)) {
-      return sendJson(res, { error: `not ported yet: /api/actions/${action}` }, 501, ae);
-    }
     // Build can be re-themed/re-targeted from the UI picker; the other actions self-resolve
     // the deployed theme downstream. Footprint, posture and mode always follow the current
     // install, so a re-theme preserves lean/full, the register and the operating mode.

package/js/web/jobs.mjs

@@ -44,14 +44,10 @@
  * `taskkill /T` is a machine primitive here, not this program.
  *
  * ---------------------------------------------------------------------------------------
- * THE PARTITION — all eight action rows cross, and the declaration outlives them.
- *
- * `doctor`, `build`, `build-all`, `export`, `uninstall`, `update`, `link` and `unlink` each
- * name a verb `bin/geneseed-cli.mjs` runs.
- *
- * `NOT_PORTED_ACTIONS` IS EMPTY AND STILL DECLARED, which is the point of it: a ninth action
- * added later cannot quietly answer "unknown action", because `tests/unit/web_jobs.test.mjs`
- * holds the two sets against `actionCommands`' own keys.
+ * THE ACTION SURFACE — `doctor`, `build`, `build-all`, `export`, `uninstall`, `update`,
+ * `link` and `unlink` each name a verb `bin/geneseed-cli.mjs` runs, plus the three
+ * `INLINE_ACTIONS` the dispatcher answers without the table. `tests/unit/web_jobs.test.mjs`
+ * holds the union against a written-out list, so a ninth action cannot appear unchecked.
  *
  * ---------------------------------------------------------------------------------------
  * THREE DETAILS OF `_run`, EACH A COMMENT EXPLAINING A BUG IT ALREADY FIXED.
@@ -381,27 +377,10 @@ const NODE = () => process.execPath;
 const CLI = () => path.join(ROOT, 'bin', 'geneseed-cli.mjs');
 const GEN = () => path.join(ROOT, 'bin', 'build-driver.mjs');
 
-/**
- * The rows whose VERB has not crossed. EMPTY, AND STILL DECLARED.
- *
- * WHY AN EMPTY SET RATHER THAN A DELETED ONE. This set is cross-checked against
- * `actionCommands`' own keys, and an empty set is the strongest form that check ever takes:
- * it asserts that EVERY action this daemon knows how to dispatch on is answered by the
- * runner. Deleting the declaration would delete that assertion, and the next unported
- * action would come back as a silent 404 — the thing the 501 exists to prevent.
- *
- * A 501 AND NOT THE 404 THE TABLE WOULD PRODUCE. `actionCommands` returns `null` for an
- * unknown action, mapped to `{"error": "unknown action <x>"}` at 404 — so a
- * real-but-unported action falling through would answer the same thing a typo gets. With
- * this set empty the 501 branch is UNREACHABLE by construction: every real action answers
- * 202 and only an invented one answers 404.
- */
-export const NOT_PORTED_ACTIONS = new Set();
-
 /**
  * The three actions the dispatcher answers INLINE, without consulting the table above:
  * `restore` is synchronous and returns a result rather than a job id, and `install`/`deploy`
- * resolve their argv from the request body first. Declared so the partition covers every
+ * resolve their argv from the request body first. Declared so the surface check covers every
  * action the dispatcher answers, not only the table's keys.
  */
 export const INLINE_ACTIONS = ['restore', 'install', 'deploy'];

package/js/web/routes.mjs

@@ -1,10 +1,15 @@
 /**
  * WHAT THE WEB API ANSWERS — as a declaration, separate from the dispatcher that honours it.
  *
- * Eight exported sets and one map. They are not documentation: `tests/unit/web_server.mjs` reads
- * them as a TWO-SIDED PARTITION and probes the real handler against them, because a declaration is
- * not a dispatcher — a route can be declared in one and missing from the other, and nothing but
- * a probe notices.
+ * Two tables and two inline lists. They are not documentation: `tests/unit/web_server.test.mjs`
+ * holds their union against a surface list written out in the test, and probes the real handler,
+ * because a declaration is not a dispatcher — a route can be declared here and missing from the
+ * dispatch, and nothing but a probe notices.
+ *
+ * This file used to also carry the Python→Node port's NOT_PORTED / DECLINED partition — five
+ * sets, all empty once the port finished. They were deleted when the port bookkeeping retired
+ * (see git history); an unmatched GET falls through to `serveStatic`'s SPA fallback and an
+ * unmatched POST answers 404, which is what the empty sets already produced.
  *
  * Split out of `server.mjs` because it is the half a reader consults to answer "does the console
  * expose X?", which has nothing to do with sockets, daemons or gzip.
@@ -13,43 +18,6 @@ import { formatValue, isTruthy, parseJson } from '../lib/json.mjs';
 import { apiExcludesMutate, apiInstallToggle, apiMcpToggle, apiMemoryDelete, apiProfileSave, apiRulesMutate, apiRulesPromote, apiSelectView } from './actions.mjs';
 import { apiActivityToggle } from './activity.mjs';
 
-/**
- * The API paths this daemon does not answer — currently empty, but the DECLARATION STAYS:
- * without it, an unmatched GET falls through to `serveStatic`'s SPA fallback (200 +
- * index.html) instead of a clear failure. Half of a partition test, so an empty set still
- * asserts there is nothing left to declare.
- *
- * Declared separately from the POST sets below because five paths — `/api/mcp`,
- * `/api/excludes`, `/api/rules`, `/api/profile`, `/api/activity` — answer both verbs with
- * different bodies, so one set keyed on path alone could not track GET and POST status
- * independently.
- */
-export const NOT_PORTED = new Set([]);
-export const NOT_PORTED_PREFIXES = [];
-
-/**
- * The POSTs that have not crossed yet — currently empty, for the same reason the GET pair
- * above stays declared: deleting it would let an unrouted POST fall through to a
- * plausible-looking 404 instead of the 501 this set exists to produce.
- */
-export const NOT_PORTED_POST = new Set([]);
-export const NOT_PORTED_POST_PREFIXES = [];
-
-/**
- * The POSTs that will NEVER cross, which is a different claim from the set above — currently
- * EMPTY. `/api/pick-folder` was its one member (an OS-native folder chooser, "declined rather
- * than deferred" because there was no Node twin that was not a new GUI dependency) until the
- * user overrode that decision 2026-08-27; it now dispatches inline from `js/web/handler.mjs`'s
- * `doPost` — see `apiPickFolder` in `js/web/actions.mjs`.
- *
- * KEPT DECLARED AND EMPTY FOR THE SAME REASON `NOT_PORTED_POST` STAYS DECLARED WHEN IT EMPTIES
- * (see that set, just above): an empty set here is the partition asserting there is nothing
- * PERMANENTLY refused, not an omission a later reader has to double-check. `notPortedPost`
- * below still consults it, so a genuinely permanent decline — if one is ever added again —
- * needs no dispatcher change, only a member here.
- */
-export const DECLINED_POST = new Set([]);
-
 /**
  * The POSTs this daemon answers — and this table IS the dispatch, not a declaration beside
  * it: `doPost` looks routes up HERE, so a hand-kept declaration and the running dispatcher
@@ -79,8 +47,6 @@ export const POST_ROUTES = new Map([
   ['/api/profile', [apiProfileSave, true]],
 ]);
 
-export const PORTED_POST = [...POST_ROUTES.keys()];
-
 /**
  * The 409 column, exported so a test can assert it directly. Giving `/api/activity` the 409
  * treatment is the invisible mutation: nothing in normal use can force the `ok: false` arm
@@ -92,59 +58,27 @@ export const POST_ROUTES_CONVENTION = Object.fromEntries(
 );
 
 /**
- * The GET paths answered OUTSIDE the two tables, declared so the partition cross-check can
+ * The GET paths answered OUTSIDE the two tables, declared so the surface cross-check can
  * see them: `/api/ping` is the shell's own, and the two Docs routes take the `?harness=`
  * query param, which a `(state)` table entry has no way to receive. A probe checks all
  * three against the running handler too, not merely against this list.
  */
-export const PORTED_INLINE = ['/api/ping', '/api/docs', '/api/docs/page/',
+export const GET_INLINE = ['/api/ping', '/api/docs', '/api/docs/page/',
   '/api/jobs', '/api/jobs/'];
 
 /**
  * The POSTs that answer outside `POST_ROUTES`, because they don't fit its shape:
  * `/api/jobs/<id>/cancel` answers 200 or 404 on a lookup, not an `ok` field, and
- * `/api/actions/<x>` spans six statuses (202, 409, 404, 501, 400, 200) over one prefix, none
+ * `/api/actions/<x>` spans five statuses (202, 409, 404, 400, 200) over one prefix, none
  * read off `ok`. Bending the 409 column to fit either would make it lie about the routes it
- * already describes correctly.
- *
- * `/api/pick-folder` joined 2026-08-27 for a THIRD reason: `POST_ROUTES`'s `fn(state, body)
- * -> object` shape answers the instant `fn` returns, and this endpoint cannot — it spawns a
- * native folder dialog and answers only once a human (or a timeout) closes it. See
+ * already describes correctly. `/api/reveal` answers 200/404 on an allowlist lookup, and
+ * `/api/pick-folder` cannot fit the table's `fn(state, body) -> object` shape at all: it
+ * spawns a native folder dialog and answers only once a human (or a timeout) closes it. See
  * `apiPickFolder` in `js/web/actions.mjs`, dispatched inline from `js/web/handler.mjs`'s
- * `doPost` the same way the other three rows here are.
- */
-export const PORTED_POST_INLINE = ['/api/shutdown', '/api/restart', '/api/jobs/',
-  '/api/actions/', '/api/pick-folder'];
-
-/**
- * POST routes added after the ported reference surface was frozen. Kept separate from
- * `NOT_PORTED_POST` so that frozen record stays honest, while a new route is still
- * enumerated rather than appearing unchecked. Belongs here only once dispatched below — a
- * probe, not just this declaration, is what keeps that true.
+ * `doPost` the same way the other rows here are.
  */
-export const POST_BEYOND_REF = new Set([
-  '/api/reveal',
-]);
-
-/**
- * GET routes added after the ported reference surface was frozen — the same reason
- * `POST_BEYOND_REF` above exists, one verb over. `/api/recent` is a genuine gap: no catalog
- * row carries a date and a browser cannot stat the `source` path it is handed, so "what
- * changed lately" needed a server that looks. See `apiRecent` in `api.mjs` for what it will
- * and will not date.
- */
-export const GET_BEYOND_REF = new Set([
-  '/api/recent',
-]);
-
-export function notPorted(path) {
-  return NOT_PORTED.has(path) || NOT_PORTED_PREFIXES.some((p) => path.startsWith(p));
-}
-
-export function notPortedPost(path) {
-  return NOT_PORTED_POST.has(path) || DECLINED_POST.has(path)
-    || NOT_PORTED_POST_PREFIXES.some((p) => path.startsWith(p));
-}
+export const POST_INLINE = ['/api/shutdown', '/api/restart', '/api/jobs/',
+  '/api/actions/', '/api/pick-folder', '/api/reveal'];
 
 /**
  * The drained request body as a plain object, `{}` for ANYTHING else — never a raise, so a

package/js/web/server.mjs

@@ -18,9 +18,9 @@
  * WHAT WAS STILL NOT HERE, SINCE P6i UNTIL 2026-08-27: `/api/pick-folder`, DECLINED rather
  * than deferred — an OS-native folder chooser had no Node twin that was not a new GUI
  * dependency. The user overrode that decline; the endpoint now dispatches inline from
- * `js/web/handler.mjs`'s `doPost` (see `apiPickFolder` in `js/web/actions.mjs`). Both
- * `NOT_PORTED_POST` and `DECLINED_POST` are empty now and stay declared regardless, because an
- * empty half of a partition is the partition asserting there is nothing left, not an omission.
+ * `js/web/handler.mjs`'s `doPost` (see `apiPickFolder` in `js/web/actions.mjs`). With it, the
+ * port's NOT_PORTED / DECLINED partition emptied for good and was retired — the declared
+ * surface now lives in `js/web/routes.mjs` and `tests/unit/web_server.test.mjs`.
  */
 import { GLOBAL_MANIFEST, resolvePath } from '../hosts/hosts.mjs';
 import { printOut } from '../lib/fs.mjs';

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "Every field here is argued and gated in tests/unit/package_manifest.test.mjs. `files`, `bin` and `engines` each have a test that fails when reality drifts from this file; `version` mirrors harness.config.json and is gated too. Read that docblock before editing this one.",
   "name": "geneseed",
-  "version": "3.2.0",
+  "version": "3.3.0",
   "description": "A portable, theme-able harness you implant once and use everywhere to grow a disciplined AI coding agent.",
   "keywords": [
     "ai",

package/registry.json

@@ -127,6 +127,20 @@
       "added": "2026-06-03",
       "last_verified": ""
     },
+    "skills/bruno-collection-generator": {
+      "status": "experimental",
+      "version": "1.0.0",
+      "owner": "Guillaume Lemer",
+      "added": "2026-09-03",
+      "last_verified": ""
+    },
+    "skills/bruno-test-writer": {
+      "status": "experimental",
+      "version": "1.0.0",
+      "owner": "Guillaume Lemer",
+      "added": "2026-09-03",
+      "last_verified": ""
+    },
     "skills/clarify": {
       "status": "approved",
       "version": "1.0.0",

package/src/AGENT.md.tmpl

@@ -11,12 +11,19 @@ delegate to, the **{{SKILLS}}** it can run, how it keeps **{{MEMORY}}**, the
 **{{NOTEBOOK}}** it keeps as a space of its own, and how it draws on the surrounding
 **{{VAULT}}**.
 
+<!-- LEAN:begin -->
 It is tool-agnostic: it works with any assistant that reads a root instructions
 file. This entrypoint is named `AGENT.md`; a tool that only auto-loads `AGENTS.md`
 or `CLAUDE.md` just needs to be pointed here — rename or symlink this file to that
 name, or reference it from the tool's config. Where a tool supports sub-agents,
 the {{AGENTS}} below are dispatched as real sub-agents; where it does not, treat
 each as a *persona* the single agent adopts for that slice of work.
+<!-- LEAN:else -->
+It is tool-agnostic: any assistant that reads a root instructions file can be
+pointed here. Where the tool supports sub-agents, the {{AGENTS}} below are
+dispatched as real sub-agents; where it does not, treat each as a *persona* the
+single agent adopts for that slice of work.
+<!-- LEAN:end -->
 
 **Readiness sigil — required.** Before your first reply, complete the startup
 ritual: read this file and its {{LAWS}}, then **load the project context** — if a
@@ -32,6 +39,16 @@ it certifies you have loaded the {{LAWS}} *and* the project context.
 the law *numbers*, file paths, and folder names stay plain English so tooling and links
 never move.
 
+**Precedence.** Stated once, here; nothing below restates it.
+
+| Rank | Source | Against the rank above it |
+| --- | --- | --- |
+| 1 | The {{LAWS}} (§1) | — |
+| 2 | `user-rules.md` (§1) | may tighten a {{LAW}}, never repeal one |
+| 3 | The {{ONTOLOGY}} | never against a user rule |
+| 4 | The active {{DOCTRINES}} (§2) | may tighten, never repeal |
+| 5 | `PROFILE.md`, posture, mode, theme | inform only; never bind |
+
 ---
 
 ## {{ONTOLOGY}}
@@ -69,10 +86,7 @@ posture: posture is the relationship register, mode is the operating register.
 
 **The user's own rules.** If a `user-rules.md` sits beside this file, read it at
 session start and obey every rule in it with the same force as the {{LAWS}} above
-— always, in every task. A user rule may *tighten* a {{LAW}}, never repeal one:
-where the two conflict, the {{LAW}} wins. Against a {{DOCTRINE}} rule the user's
-file wins outright — a practice pack chosen at build time never overrides an
-instruction the user wrote for their own repo. That file belongs
+— always, in every task (its rank is in the precedence table above). That file belongs
 to the user — the build seeds it once, never overwrites it, and no update touches
 it — and it is the **only** place standing rules are ever written: when the user
 asks for a standing rule, or a recurring {{MEMORY}} lesson has earned promotion,
@@ -84,10 +98,7 @@ update, and an edit to either is silently lost.
 **The user's profile.** If a `PROFILE.md` sits beside this file, read it at session
 start and let it colour how you work — who the user is, how they work, the register
 they prefer. Unlike `user-rules.md`, it is *identity, not rules*: it never binds,
-it only informs. Precedence is unambiguous — the {{ONTOLOGY}} and the {{LAWS}}
-first, then `user-rules.md`, then the active {{DOCTRINES}} (§2), then this
-profile; where a preference here meets a rule, a {{DOCTRINE}} rule or a {{LAW}},
-the rule wins. It too belongs to the user: seeded once, never overwritten. Never
+it only informs. It too belongs to the user: seeded once, never overwritten. Never
 write standing rules into it — those go to `user-rules.md`. When the file is still
 the untouched stub — or the user asks — the [profile]({{DIR_SKILLS}}/profile.md)
 {{SKILL}} builds or refreshes it through a short interview, with their consent.
@@ -99,9 +110,7 @@ the untouched stub — or the user asks — the [profile]({{DIR_SKILLS}}/profile
 *{{EPI_DOCTRINES}}*
 
 Practices, not principles: how work is done here, chosen by this repository at
-build time. They sit under the {{LAWS}} and under the user's own `user-rules.md`
-— a {{DOCTRINE}} rule may *tighten* a {{LAW}}, never repeal one, and a user rule
-outranks it — and only the packs enabled for this install appear
+build time. Only the packs enabled for this install appear
 below. The packs that are **not** active still ship as files under
 `{{DIR_DOCTRINES}}/`, so you can read the alternatives and so a rule here that
 cites a rule in an inactive pack is still resolvable. Change the set by
@@ -214,6 +223,8 @@ subset that productively clashes on a given motion.
 | [refactor]({{DIR_SKILLS}}/refactor.md) | improving code structure without changing behaviour |
 | [ponytail]({{DIR_SKILLS}}/ponytail.md) | the user wants the minimal, laziest-that-works solution — "ponytail", "be lazy", "simplest path", or a complaint about over-engineering, bloat, or needless dependencies |
 | [forge-mcp]({{DIR_SKILLS}}/forge-mcp.md) | building, extending, or hardening a Model Context Protocol (MCP) server |
+| [bruno-collection-generator]({{DIR_SKILLS}}/bruno-collection-generator.md) | creating or converting a Bruno API collection — requests, environments, docs — from routes, an OpenAPI snippet, curl commands, or an endpoint list |
+| [bruno-test-writer]({{DIR_SKILLS}}/bruno-test-writer.md) | writing or strengthening Bruno tests, assertions, scripts, and request chaining for a request or collection |
 | [prose]({{DIR_SKILLS}}/prose.md) | writing prose for a human — a commit body, PR, doc, comment, memory note, or reply — that should not read like a model wrote it |
 | [frontend-design]({{DIR_SKILLS}}/frontend-design.md) | building or reshaping a UI that should carry a deliberate point of view, not a templated default |
 | [handoff]({{DIR_SKILLS}}/handoff.md) | context filling, or passing work to another agent or session |
@@ -229,20 +240,20 @@ subset that productively clashes on a given motion.
 | [opencode-theme]({{DIR_SKILLS}}/opencode-theme.md) | the user wants their own OpenCode colour theme — pick or tweak a palette, get solid + transparent variants that survive rebuilds |
 <!-- CATALOG:else -->
 Your host lists every {{SKILL}} it can invoke, with its trigger, in your own
-inventory — that list is the catalogue and it is authoritative. Run the matching
-{{SKILL}} before improvising; its written procedure is in
-[`{{DIR_SKILLS}}/`]({{DIR_SKILLS}}/) and the host loads it on demand.
+inventory — that list is the catalogue and it is authoritative. Each written
+procedure is in [`{{DIR_SKILLS}}/`]({{DIR_SKILLS}}/) and the host loads it on
+demand.
 <!-- CATALOG:end -->
 
 When a task repeats and no {{SKILL}} covers it, forge one: copy
 [`{{DIR_SKILLS}}/_template.md`]({{DIR_SKILLS}}/_template.md), keep it to one coherent
-domain ({{DOCTRINE}} craft 1), and register it in this table. Every {{SKILL}} ends with a
+domain ({{DOCTRINE}} craft 1), and register it in the catalogue above. Every {{SKILL}} ends with a
 **self-improvement loop** — honour it: fold what a run teaches back into the
 file, or into {{MEMORY}} ({{DOCTRINE}} process 1).
 
 **Folder {{SKILLS}}.** Some {{SKILLS}} ship as self-contained folders under
 `{{DIR_SKILLS}}/`, each with its own format and provenance (`VENDOR.md`) —
-third-party vendors plus first-party ones bundling scripts. Not in the table
+third-party vendors plus first-party ones bundling scripts. Not in the catalogue
 above — reach for one only when its domain comes up:
 - [react-view-transitions]({{DIR_SKILLS}}/react-view-transitions/SKILL.md) — animating
   React UIs with the View Transition API (`<ViewTransition>`, shared elements, Next.js).
@@ -278,6 +289,7 @@ convention: [`{{DIR_MEMORY}}/README.md`]({{DIR_MEMORY}}/README.md).
 
 *{{EPI_NOTEBOOK}}*
 
+<!-- LEAN:begin -->
 {{INTRO_NOTEBOOK}} It lives in [`{{DIR_NOTEBOOK}}/`]({{DIR_NOTEBOOK}}/). This is
 **not** {{MEMORY}}: {{MEMORY}} (§5) is a curated store of durable *facts*, one per
 file in a fixed format, written for recall. The {{NOTEBOOK}} has **no imposed
@@ -299,6 +311,19 @@ format: {{MEMORY}} holds durable insight for future sessions, the {{NOTEBOOK}}
 holds your working artifacts. The one fixed law: `{{DIR_NOTEBOOK}}/` is **personal and
 git-ignored** — never committed or shared, and the `.gitignore` that guarantees
 it is not yours to lift.
+<!-- LEAN:else -->
+{{INTRO_NOTEBOOK}} It lives in [`{{DIR_NOTEBOOK}}/`]({{DIR_NOTEBOOK}}/), with
+**no imposed format and no imposed medium** — notes, plans, scratch code,
+datasets, experiments. It is not {{MEMORY}} (§5): {{MEMORY}} holds curated
+durable facts for recall, the {{NOTEBOOK}} holds your working artifacts, and a
+note that hardens into a durable fact is promoted there ({{DOCTRINE}} process 1).
+Any file you create for your own benefit belongs here, never in the host tree.
+Read `NOTEBOOK.md` at the start of a session to recall what you keep; the
+charter at [`{{DIR_NOTEBOOK}}/README.md`]({{DIR_NOTEBOOK}}/README.md) is yours
+to rewrite. The one fixed law: `{{DIR_NOTEBOOK}}/` is **personal and
+git-ignored** — never committed or shared, and the `.gitignore` that guarantees
+it is not yours to lift.
+<!-- LEAN:end -->
 
 ---
 
@@ -331,6 +356,7 @@ scratch scripts, analysis dumps, drafts, experiments — are made in the
 
 *{{EPI_WIKI}}*
 
+<!-- LEAN:begin -->
 {{INTRO_WIKI}} It is declared in `wiki.jsonc`, **beside this AGENT.md** like
 `context.json` (§9) — or wherever `$GENESEED_WIKI` points. An empty `wikis` list
 means none is declared and this section stays dormant. (On OpenCode its `eager`
@@ -358,6 +384,19 @@ outside `protected`, but its conventions outrank your defaults: wikilinks
 durable fact worth sharing across projects goes here via the
 [wiki]({{DIR_SKILLS}}/wiki.md) {{SKILL}}; one that matters only to you stays in
 {{MEMORY}} (§5).
+<!-- LEAN:else -->
+{{INTRO_WIKI}} It is declared in `wiki.jsonc`, **beside this AGENT.md** — or
+wherever `$GENESEED_WIKI` points; an empty `wikis` list means this section
+stays dormant. Read `wiki.jsonc` at the start of every session and honour each
+declared wiki: load its `entries` by their `load` mode exactly as in
+`context.json` (§9); read its `conventions` before your first write there and
+follow them over your own habits; drop a note you cannot place into `inbox`
+rather than guess a home; never write inside `protected`. The wiki is **the
+user's**, not yours — wikilinks (`[[Note Name]]`) over bare paths, every new
+note linked into the graph. A durable fact worth sharing across projects goes
+here via the [wiki]({{DIR_SKILLS}}/wiki.md) {{SKILL}}; one that matters only to
+you stays in {{MEMORY}} (§5).
+<!-- LEAN:end -->
 
 ---
 

package/src/agents/explorer.md

@@ -32,7 +32,7 @@
   it, and any open questions. Never the full contents of what was read.
 - If the search comes up empty, report what was searched and where, and answer
   not-found — a confident wrong location costs more than an honest blank
-  ({{LAW}} XI).
+  ({{LAW}} III).
 
 ## Pipeline role
 

package/src/doctrines/README.md

@@ -27,9 +27,9 @@ catalogue ships in every bundle** — all four pack files are installed whether
 their pack is built into `AGENT.md` — so a cross-pack reference is always readable
 even when the pack it names is not active.
 
-Every doctrine rule still sits under the invariants and the ontology: a pack changes
-which *practices* are in force, never the principles. A rule may tighten an
-invariant, never repeal one; where they conflict, the invariant wins.
+A pack changes which *practices* are in force, never the principles: a rule may
+tighten an invariant, never repeal one. The full precedence order is stated once, in
+the table at the top of `AGENT.md.tmpl`.
 
 To add a pack, drop a `<name>.md` here (body only, no top-level heading — it is
 inlined under `AGENT.md`'s own Doctrines heading), open it with a bold pack name and

package/src/doctrines/rigor.md

@@ -50,3 +50,16 @@ hour it is needed, so read the reference at the moment of checking. Where a rule
 in two directions, the gate must be able to fail in both, or it is satisfied by excess.
 Where {{DOCTRINE}} rigor 3 has you write the test, this governs whether the test is
 worth trusting ({{DOCTRINE}} rigor 2).
+
+### {{DOCTRINE}} rigor 5 — {{DOC_RIGOR_5}}
+A gate you build stands outside the mind it governs. Wherever a system lets an
+agent — this one or another — act on the world, approval is asked of a party the
+agent cannot satisfy alone, the allowlist is enforced at the boundary the call must
+cross, and validation runs against real state, not the model's account of it.
+Permission must never live in the governed agent's own prompt or judgement. Anything
+gaining autonomous control over physical state, money, or production ships disarmed,
+armed only by explicit human act. A rule in a prompt is a request; a rule at a
+boundary is a constraint — and only the second holds when the model is wrong,
+confused, or steered by untrusted input ({{LAW}} VI). Where {{LAW}} VII governs the
+power you take, this governs the power you hand out; {{DOCTRINE}} rigor 4 proves the
+gate once it stands.