geneseed 3.2.0 → 3.4.0

package/docs/token-footprint.md

@@ -4,10 +4,11 @@ What a deployed harness costs in context-window tokens, per host. Token counts a
 chars/4 estimates and shift a little with theme and version.
 
 **Treat every number below as a floor, not a reading.** They were measured on a
-`--footprint full` build of the neutral theme when the tree carried 41 skills and 17
-agents; it carries more skills than that now, and nothing re-measures this page
-automatically. For a live figure on your own install, ask the agent for the
-`token-report` skill — that is what it is for.
+`--footprint lean` build (the default) of the neutral theme when the tree carried
+47 skills and 17 agents, and nothing re-measures this page automatically. For a
+live figure on your own install, ask the agent for the `token-report` skill —
+that is what it is for. A `--footprint full` build runs roughly 5k tokens
+heavier on the root file.
 
 ## Always-on cost per session
 
@@ -15,40 +16,50 @@ The context every host injects at session start, before you type anything:
 
 | Component | Claude Code | OpenCode | Bob | Copilot |
 |---|---|---|---|---|
-| Root instruction file | ~10.7k (`CLAUDE.md`) | ~10.6k (`AGENT.md`) | ~10.7k (`AGENTS.md`) | ~10.7k (`AGENTS.md`) |
-| Skill metadata (name + description) | ~1.6k | ~1.6k | ~1.6k | ~1.6k |
-| Agent metadata | ~0.45k | ~0.55k | ~0.45k | ~0.45k |
+| Root instruction file | ~6.4k (`CLAUDE.md`) | ~6.4k (`AGENT.md`) | ~8.3k (`AGENTS.md`) | ~8.3k (`AGENTS.md`) |
+| Skill metadata (name + description) | ~1.7k | ~1.7k | ~1.7k | ~1.7k |
+| Agent metadata | ~0.5k | ~0.55k | ~0.5k | ~0.5k |
 | Eager memory/notebook injection | ~1.2k (SessionStart hook) | ~1.2k (context plugin) | ~1.2k (SessionStart hook) | — (no hooks; read on demand) |
-| **Total** | **~14k** | **~14k** | **~14k** | **~12.8k** |
+| **Total** | **~9.8k** | **~9.9k** | **~11.7k** | **~10.5k** |
 
-The emits are at parity by design: ~14k tokens, about 7% of a 200k
-window (Copilot runs slightly lighter because it has no hook mechanism — the
-memory/notebook indexes load when the agent reads them, not eagerly). The
+The emits are at parity by design: ~10–12k tokens, about 5–6% of a 200k
+window. Bob and Copilot carry the §3/§4 catalogue tables inline because their
+hosts expose no native skill/agent inventory; Claude Code and OpenCode ship a
+pointer to the host's own inventory instead, ~1.9k tokens lighter. Copilot also
+runs without eager injection — it has no hook mechanism, so the
+memory/notebook indexes load when the agent reads them, not eagerly. The
 eager-injection path is budget-capped identically everywhere
 (16 KB per file, 48 KB total ≈ 12k tokens ceiling), so growing Memory degrades
 every host the same way instead of one silently falling behind.
 
 ## Where the tokens go
 
-- **The root file is ~76% of the bill**, and the constitution inside it is the
+- **The root file is ~65% of the bill**, and the constitution inside it is the
   bulk of that — no longer one section but three: the Ontology, the nine Rules,
   and the doctrine packs this install built in. **Two** levers move it, not one.
-  The [footprint dial](#/docs/footprint) (`lean`, the default, keeps each Rule
-  and each doctrine rule as its heading plus first line, and ships the Ontology
-  *whole*; `full` inlines every rationale). And the
+  The [footprint dial](#/docs/footprint) (`lean`, the default, swaps each Rule,
+  the Ontology and the longest prose sections — the preamble, §6 Notebook, §8
+  Wiki — for their hand-written condensations, and cuts each doctrine rule to its
+  heading plus first line; `full` inlines every rationale). And the
   [doctrine packs](#/docs/setup-choices) — `geneseed-build --doctrines craft,rigor`
   drops whole blocks of §2 at build time, which removes far more than the
   footprint dial trims. Anything else is noise.
 
-  The three-tier split grew the root file: measured on `neutral`, `AGENT.md`
-  went from 31,457 bytes to 36,882 at `lean` (+17.2%) and 53,378 to 54,810 at
-  `full` (+2.7%). The lean growth is the larger one *by design* — the Ontology
-  is prose, and truncating four flowing sections to four orphan sentences would
-  have shipped a worldview nobody could read.
+  The lean condensations are authored, not generated. An earlier design shipped
+  the Ontology *whole* under `lean` on the grounds that truncating four flowing
+  sections to four orphan sentences would ship a worldview nobody could read —
+  the `LEAN:` blocks answer that by hand-writing the short form instead
+  (measured on `neutral`, the root file at `lean` went from 29,966 bytes to
+  25,614 with them).
 - **Skill bodies (~53k) and agent bodies (~10k) are lazy** on every host —
   loaded only when invoked. A typical skill costs ≤3k per invocation; the
   heaviest (`react-view-transitions`, ~17.5k with its reference files) loads
   its references progressively.
+- **User-only skills leave the catalogue.** A skill whose source carries
+  `<!-- invocation: user -->` renders `disable-model-invocation: true`; Claude
+  Code and Bob then drop its description from the always-on skill metadata and
+  only `/name` opens it. Seven skills carry it today (the five teaching drills,
+  `herdr`, `opencode-theme`), roughly a seventh of the ~1.7k skill-metadata line.
 - Plugin JavaScript (OpenCode, ~26k on disk) runs in the host runtime and
   never enters the context window.
 
@@ -73,7 +84,7 @@ token counter also includes, none of which Geneseed controls:
    per-repo install, a personal `~/.claude/CLAUDE.md`, or MCP servers each add
    their own share.
 
-So a ~34k session on a work repo is normal arithmetic: ~14k harness +
+So a ~30k session on a work repo is normal arithmetic: ~10k harness +
 ~10k repo docs + ~5–10k host overhead. Set `GENESEED_DEBUG=1` (OpenCode) to
 log exactly which files the context plugin injected, or run the SessionStart
 command by hand to see the hook's payload.

package/docs/web/agents.md

@@ -5,4 +5,4 @@ title: "Agents"
 kind: "concept"
 link: {"hash": "#/section/agents", "label": "Browse the catalog →"}
 ---
-{N_AGENTS} capability specialists — `reviewer`, `tester`, `architect`, `developer`, `docs`, `security`, `explorer`, plus a debate **council** the [[council]] skill convenes (`advocate`, `skeptic`, `pragmatist`, `steward`, `visionary`, `user-advocate`, `framer`, `empiricist`, `operator`, `historian`). You delegate by capability, not by folder: the harness picks the right specialist from the request.
+{N_AGENTS} capability specialists — `reviewer`, `tester`, `architect`, `developer`, `docs`, `security`, `explorer`, `researcher`, plus a debate **council** the [[council]] skill convenes (`advocate`, `skeptic`, `pragmatist`, `steward`, `visionary`, `user-advocate`, `framer`, `empiricist`, `operator`, `historian`). You delegate by capability, not by folder: the harness picks the right specialist from the request.

package/docs/web/first-session.md

@@ -16,7 +16,7 @@ Once installed, the agent doesn't change *how* you talk to your tool — it chan
 ### Try these prompts
 
 - *"Use the **profile** skill"* — a short interview that drafts `PROFILE.md` (seeded empty at install), so the agent knows who you are and how you like answers pitched.
-- *"Use the **clarify** skill on this feature request."*
+- *"Use the **brainstorm** skill on this feature request."*
 - *"Delegate to the **reviewer** agent on the staged diff."*
 - *"Use **brainstorm** then **plan** for how to add X."*
 - *"Use **council** to debate whether we should ship Y now."*

package/docs/web/skills.md

@@ -5,4 +5,4 @@ title: "Skills"
 kind: "concept"
 link: {"hash": "#/section/skills", "label": "Browse the catalog →"}
 ---
-{N_SKILLS} repeatable workflows the agent can invoke by name — from [[brainstorm]], [[clarify]], [[plan]], [[tdd]] and [[debug]] through [[council]], [[research]] and [[ship]] to [[roast-me]]. A skill is a markdown playbook under `src/skills/`; the agent reads it before acting. The catalog link lists every one, live.
+{N_SKILLS} repeatable workflows the agent can invoke by name — from [[brainstorm]], [[plan]], [[develop]] and [[debug]] through [[council]], [[research]] and [[ship]] to [[roast-me]]. A skill is a markdown playbook under `src/skills/`; the agent reads it before acting. The catalog link lists every one, live.

package/docs/web-ui.md

@@ -51,7 +51,7 @@ The left rail mirrors the harness's own shape:
 | Group | Views |
 | --- | --- |
 | *(ungrouped)* | Dashboard |
-| **📖 Codex** | Constitution · Rules · Profile · Skills · Agents · Library · Docs · Graph |
+| **📖 Codex** | Constitution · Rules · Profile · Skills · Agents · Library · Docs |
 | **🩺 Care** | Activity · Changes · Doctor |
 | **🎨 Setup** | Harness · Settings |
 
@@ -72,9 +72,10 @@ streams the output of background jobs and keeps their history across reloads.
 ### 🧬 Harness
 
 - **Dashboard** (`#/`) — a live readout of what's deployed. Three lenses: **Status**
-  (readiness ring, a KPI band, a genome grid, recent activity), **Lineage** (a mini
-  cross-link graph), and **Operator** (a searchable table of every deployed capability).
-  Headlines reflect the active theme's voice.
+  (readiness ring, a KPI band, a genome grid, recent activity), **Lineage** (the
+  source → render → deployed timeline and the genome-by-volume strand chart), and
+  **Operator** (a searchable table of every deployed capability). Headlines reflect the
+  active theme's voice.
 
   The KPI band reads **Agents · Skills · Invariants · Local edits**. That third tile is
   labelled *Invariants* and not *Constitution* on purpose: its value is the invariant count
@@ -107,15 +108,6 @@ streams the output of background jobs and keeps their history across reloads.
   **Promote to rule** control turns a recurring lesson into a trial rule in
   `user-rules.md` — provenance recorded, the source fact deleted so it isn't loaded
   twice — landing you on the Rules page.
-- **Graph** (`#/graph`) — the cross-link constellation across agents, skills and the
-  **invariants only**: every `[[wikilink]]` between agents/skills, plus every `Rule N`
-  mention that lands on a real invariant. ⚠ The reference pattern matches the tier noun
-  followed by a **Roman numeral** — `Rule`, `Law`, or whatever the active theme calls one,
-  which is how `Dictate III` still resolves under `imperial`. A doctrine address is
-  `<pack> <n>` and matches nothing, so **doctrine cross-links are not drawn**; the graph is
-  a view of the invariant backbone, not of the whole constitution. Hover to isolate a
-  neighbourhood, scroll to zoom, drag to pan, search to highlight; orphans dim out. Click a
-  node to open its spec.
 
 ### 📚 Learn
 

package/harness.config.json

@@ -2,5 +2,5 @@
   "_comment": "version is a human-readable release label only; the canonical identity of an installed harness is the source fingerprint stamped in .geneseed-version (see `harness version`), not this string.",
   "theme": "neutral",
   "product": "Geneseed",
-  "version": "3.2.0"
+  "version": "3.4.0"
 }

package/js/README.md

@@ -13,7 +13,7 @@ a module that does not exist, is a test failure. `geneseed doctor` reports the s
 
 ```
 bin/geneseed-cli.mjs     the `geneseed` CLI — 20+ verbs, may NOT spawn
-bin/geneseed-hook.mjs    the hook entry — 4 verbs, loads on EVERY tool call (~14 ms)
+bin/geneseed-hook.mjs    the hook entry — 5 verbs, loads on EVERY tool call (~14 ms)
 bin/build-driver.mjs     `geneseed-build` — the generator's flags and emit targets
 
 js/build/     src/ + themes/  →  rendered text  →  a bundle  →  a per-host install
@@ -66,7 +66,7 @@ user co-owns, and the hook verbs those emitted configs then run.
 | module | owns |
 |---|---|
 | `hosts.mjs` | The four host config dirs (opencode/claude/bob/copilot), plus `resolvePath`/`expanduser` |
-| `hooks.mjs` | The verbs the emitted hooks run every session: `context`, `git-gate`, `rule-gate`, `learn` |
+| `hooks.mjs` | The verbs the emitted hooks run every session: `context`, `git-gate`, `rule-gate`, `tool-gate` (the two gates fused, for Copilot), `learn`. `--host` picks the verdict dialect |
 | `settings.mjs` | Merges into user-owned `settings.json`/`opencode.json`; owns the hook shim and the managed blocks |
 | `native.mjs` | Capability specs → host-native subagents and skills. The impure half of the emit |
 | `opencode.mjs` | OpenCode-only extras: colour themes, primary agent, `/commands`, plugins, overrides stub |
@@ -168,13 +168,12 @@ the deployed harness as JSON.
 | `daemon.mjs` | Detached web start/stop/status/restart, the `.geneseed-web.json` record, and `openUrl` |
 | `jobs.mjs` | `JobManager` and the action→argv table. The only module here that spawns job children |
 | `docs.mjs` | The Docs tab: the `docs/web/` page registry, `?harness=` filtering, the five page kinds |
-| `graph.mjs` | `/api/graph` alone — the agent/skill/law cross-link matrix built from rendered bodies |
 | `activity.mjs` | The `activity/` session files: pid-liveness prune, list, detail, and the on/off flag |
 
 **Before editing:** `makeHandler(state, jm, token, dist, holder)`'s arity is load-bearing — three
-test call sites construct one directly and drive it without a socket. Five of `routes.mjs`'s
-exported sets are deliberately EMPTY and must stay declared: each is half of a partition test.
-`graph.mjs` contains a literal NUL byte, so `grep`/`ripgrep` treat it as binary and skip it.
+test call sites construct one directly and drive it without a socket. `routes.mjs`'s tables
+and inline lists are held against a surface list written out in
+`tests/unit/web_server.test.mjs` — growing or shrinking the API edits both, in one commit.
 
 ---
 

package/js/build/emit-claude.mjs

@@ -10,8 +10,8 @@ import { VERSION_MARKER } from '../hosts/hosts.mjs';
 import { loadAgentOverrides, writeNativeLayer } from '../hosts/native.mjs';
 import { ensureAgentOverridesStub } from '../hosts/opencode.mjs';
 import {
-  managedBlockRemove, managedBlockWrite, mergeClaudeSettings, unwireClaudeExcludes,
-  unwireClaudeSettings, wireClaudeExcludes,
+  managedBlockRemove, managedBlockWrite, mergeClaudeSettings, mergeCopilotSettings,
+  unwireClaudeExcludes, unwireClaudeSettings, wireClaudeExcludes,
 } from '../hosts/settings.mjs';
 import { writeText } from '../lib/fs.mjs';
 import { isTruthy } from '../lib/json.mjs';
@@ -225,12 +225,19 @@ function claudeWire(job, claudeMdText, hasAgentText, doctrines = null, excludeRu
   // settings.local.json — the personal, untracked file — never the team-shared
   // settings.json, which would hand every teammate failing hooks pointing at this machine's
   // node and this machine's checkout. (Bob documents no local variant, so it keeps
-  // settings.json.) Copilot has NO
-  // settings.json and no hook mechanism at all, so the whole stage is skipped: nothing
-  // written, no settings_* keys recorded for the lifecycle to unwire.
+  // settings.json.) Copilot's settings are a different shape entirely (one command per
+  // event, no matcher groups) and take the `else` branch below; its PROJECT scope wires
+  // nothing, because the CLI documents hooks in `~/.copilot/settings.json` only and a
+  // machine-absolute hook committed into `.github/` would fail on every teammate's machine.
   if (!isCopilot) {
-    const settingsName = scope === 'project' && !isBob ? 'settings.local.json' : 'settings.json';
+    // Bob GLOBAL: its hooks doc puts the global file at `~/.bob/settings/settings.json`
+    // (nested), where an older emit wrote `~/.bob/settings.json`; the `oldSf !==
+    // settingsName` branch below unwires the old file, so a re-emit migrates. Bob's project
+    // file stays `.bob/settings.json`.
+    const settingsName = scope === 'project' && !isBob ? 'settings.local.json'
+      : isBob && scope === 'global' ? path.join('settings', 'settings.json') : 'settings.json';
     const settingsPath = path.join(cfgDir, settingsName);
+    mkdirSync(path.dirname(settingsPath), { recursive: true });
     managed.settings_file = settingsName;
     // Migration: an older install wired hooks/excludes into a different file — unwire the
     // recorded claims there, or they linger (and run) forever.
@@ -247,7 +254,7 @@ function claudeWire(job, claudeMdText, hasAgentText, doctrines = null, excludeRu
     // DECIDES the install's packs, so the marker on disk is still the previous build's.
     const [, managedHooks] = mergeClaudeSettings(
       settingsPath, scope, oldSf === settingsName ? get(old, 'settings_hooks') : null, hookOpts,
-      doctrines, excludeRules,
+      doctrines, excludeRules, host,
     );
     managed.settings_hooks = managedHooks;
 
@@ -280,6 +287,14 @@ function claudeWire(job, claudeMdText, hasAgentText, doctrines = null, excludeRu
     } else if (priorExcl.length) {
       managed.settings_excludes = priorExcl;
     }
+  } else if (scope === 'global') {
+    // `copilot_hooks`, not `settings_hooks`: a distinct key so the Claude-shaped unwire and
+    // integrity code, which walks `settings_hooks` as event→group arrays, never sees a
+    // Copilot record it would misread.
+    const settingsPath = path.join(cfgDir, 'settings.json');
+    managed.settings_file = 'settings.json';
+    const [, claims] = mergeCopilotSettings(settingsPath, get(old, 'copilot_hooks'), hookOpts);
+    managed.copilot_hooks = claims;
   }
   return managed;
 }

package/js/build/render.mjs

@@ -34,7 +34,7 @@ import { readText } from '../lib/fs.mjs';
 import { parseJson } from '../lib/json.mjs';
 import { normcase, comparePaths } from '../lib/paths.mjs';
 // `js/build/source.mjs` imports nothing but node builtins, so this direction cannot cycle.
-import { PACK_ORDER } from './source.mjs';
+import { PACK_ORDER, readPackText } from './source.mjs';
 
 /** Document STRUCTURE is theme-INDEPENDENT — mirrors `_build_render.STRUCTURE`. */
 export const STRUCTURE = {
@@ -69,6 +69,16 @@ const TOKEN_RE = /\{\{([A-Z_][A-Z0-9_]*)\}\}/g;
 const INCLUDE_RE = /^[ \t]*<!--[ \t]*INCLUDE:[ \t]*(?<path>[^ \t]+)[ \t]*-->[ \t]*$/gm;
 const CATALOG_BLOCK_RE =
   /[ \t]*<!-- CATALOG:begin -->\n(?<table>[\s\S]*?)[ \t]*<!-- CATALOG:else -->\n(?<pointer>[\s\S]*?)[ \t]*<!-- CATALOG:end -->\n/g;
+// The footprint twin of CATALOG. Before it existed, `lean` could only reach the two
+// include-driven corpora (`laws/universal.md` and the doctrine packs, both truncated
+// mechanically to heading + first sentence); every other section of the root template was
+// byte-identical across footprints, which is how ~1.5k tokens of §-level prose rode into
+// every lean install. A LEAN block ships a HAND-WRITTEN condensation instead of a
+// truncation — the objection `docs/token-footprint.md` raised against terse-ing the
+// Ontology ("four orphan sentences") is answered by authoring the short form, not
+// generating it. Same marker grammar as CATALOG so the two stay learnable as one idea.
+const LEAN_BLOCK_RE =
+  /[ \t]*<!-- LEAN:begin -->\n(?<full>[\s\S]*?)[ \t]*<!-- LEAN:else -->\n(?<lean>[\s\S]*?)[ \t]*<!-- LEAN:end -->\n/g;
 
 /**
  * `PurePath.suffix`. Not `path.extname`: Python returns '' for a name whose only dot is
@@ -147,6 +157,11 @@ function resolveCatalogs(text, nativeCatalog) {
   return text.replace(CATALOG_BLOCK_RE, (_m, table, pointer) => (nativeCatalog ? pointer : table));
 }
 
+/** LEAN blocks — full text or the hand-written condensation, by footprint. */
+function resolveLean(text, footprint) {
+  return text.replace(LEAN_BLOCK_RE, (_m, full, lean) => (footprint === 'lean' ? lean : full));
+}
+
 /**
  * `re.split(r"(?m)^(?=### )", text)`.
  *
@@ -168,15 +183,15 @@ function splitAtLawHeadings(text) {
 }
 
 /**
- * `_terse_laws` minus its pointer paragraph — heading + first sentence, per `### ` block.
+ * Heading + first sentence, per `### ` block. DOCTRINES ONLY, now.
  *
- * Split out rather than parameterised. The pointer was baked into the function body, and
- * the doctrines axis needs the same truncation under a DIFFERENT closing paragraph (one
- * that names the pack catalogue, not `laws/universal.md`, and drops the
- * secrets/deletion/git-history clause, which is the invariants' domain and not a pack's).
- * An extraction leaves `terseLaws` byte-identical for the laws path — the recorded lean
- * AGENT.md does not move — where a fourth parameter would have put a branch inside the one
- * function every frozen lean render already goes through.
+ * The laws used to go through this too, and it made a law's lean footprint a function of its
+ * punctuation: Law II shipped as one 36-character sentence and lost its stop-and-ask
+ * mechanism, while a law written as one colon-chained run-on shipped nearly whole. The laws
+ * now carry authored LEAN blocks in `src/laws/universal.md`, the way the ontology already did,
+ * and `resolveLean` picks the half. Doctrine rules stay machine-cut: there are ~23 of them
+ * across four packs, and a pack is a practice catalogue whose first sentence is written to
+ * stand alone.
  */
 function terseBlocks(text) {
   const blocks = splitAtLawHeadings(text);
@@ -197,16 +212,14 @@ function terseBlocks(text) {
   return out.join('\n\n');
 }
 
-/** `_build_render._terse_laws`. */
-export function terseLaws(text, theme, lawsPrefix = '') {
+/** The pointer under §1 at lean. The laws' lean text itself is authored in LEAN blocks. */
+export function lawsPointer(theme, lawsPrefix = '') {
   const law = theme.LAW ?? 'Law';
   const lawsDir = theme.DIR_LAWS ?? 'laws';
-  const pointer =
-    `> Each ${law} above is given in brief — the rule, not its reasoning. The `
+  return `> Each ${law} above is given in brief — the rule, not its reasoning. The `
     + `complete, binding text of every ${law} is in \`${lawsPrefix}${lawsDir}/universal.md\`; `
     + `read it whenever a ${law}'s application is unclear, and before any act touching `
-    + `secrets, deletion, git history, scope, or untrusted content.`;
-  return terseBlocks(text) + '\n\n' + pointer;
+    + 'secrets, deletion, git history, scope, or untrusted content.';
 }
 
 /** `_build_render.render_file`. */
@@ -225,12 +238,13 @@ export function renderFile(cfg, filePath, theme, footprint = 'full', lawsPrefix
                           new Set(visiting).add(normcase(here)), nativeCatalog)
       .replace(/\n+$/, '');                              // `.rstrip("\n")`
     if (footprint === 'lean' && rel === 'laws/universal.md') {
-      inner = terseLaws(inner, theme, lawsPrefix);
+      inner = `${inner}\n\n${lawsPointer(theme, lawsPrefix)}`;
     }
     return inner;
   });
 
   text = resolveCatalogs(text, nativeCatalog);
+  text = resolveLean(text, footprint);
   return substitute(text, theme);
 }
 
@@ -291,7 +305,7 @@ function activeDoctrines(cfg) {
   // `Active packs:` marker a later reader parses back — agrees with what was rendered.
   const excluded = new Set(cfg.excludeRules ?? []);
   const survives = (pack) => {
-    const ids = [...readText(path.join(dir, `${pack}.md`))
+    const ids = [...readPackText(path.join(dir, `${pack}.md`))
       .matchAll(/^### \{\{DOCTRINE\}\} ([a-z]+) (\d+)\b/gm)]
       .map((m) => `${m[1]}.${Number(m[2])}`);
     return ids.some((id) => !excluded.has(id));
@@ -340,7 +354,7 @@ function doctrinesBody(cfg, theme, active, footprint, lawsPrefix) {
   if (!active.length) return '';
   const excluded = new Set(cfg.excludeRules ?? []);
   const parts = active.map((name) => {
-    const raw = dropExcludedRules(readText(path.join(cfg.src, 'doctrines', `${name}.md`)),
+    const raw = dropExcludedRules(readPackText(path.join(cfg.src, 'doctrines', `${name}.md`)),
       name, excluded);
     const body = substitute(raw, theme).trim();
     return footprint === 'lean' ? terseBlocks(body) : body;
@@ -440,8 +454,12 @@ export function renderAll(cfg, themeName, {
   for (const file of sortedSourceFiles(cfg.src)) {
     const rel = path.relative(cfg.src, file);
     const outRel = destRel(themedRel(rel, theme)).split(path.sep).join('/');  // as_posix()
+    // The on-disk `laws/` and `ontology/` are the "complete, binding text" the lean pointer
+    // promises. They render at full whatever the footprint; only what AGENT.md INLINES leans.
+    // Keyed on the SOURCE rel, not the themed one, so a DIR_* rename cannot un-exempt them.
+    const fp = /^(?:laws|ontology)[\\/]/.test(rel) ? 'full' : footprint;
     items.push(TEXT_SUFFIXES.has(suffixOf(path.basename(file)))
-      ? { rel: outRel, text: renderFile(cfg, file, theme, footprint, lawsPrefix, new Set(), nativeCatalog), src: file }
+      ? { rel: outRel, text: renderFile(cfg, file, theme, fp, lawsPrefix, new Set(), nativeCatalog), src: file }
       : { rel: outRel, text: null, src: file });
   }
   return { theme, items };

package/js/build/source.mjs

@@ -24,9 +24,29 @@
  * over 259 cells and compares the tree byte-for-byte, and every one of them builds a cfg
  * from these paths. A depth error or a renamed key fails 259 cells, not zero.
  */
-import { readdirSync, readFileSync } from 'node:fs';
+import { readdirSync, readFileSync, statSync } from 'node:fs';
 import path from 'node:path';
 
+/**
+ * One doctrine pack file used to be read three times per render — the survives gate and the
+ * body in `js/build/render.mjs`, plus `knownRuleIds` below — and the golden matrix multiplies
+ * that by 261 cells. Keyed on mtime, not just path, because the one long-lived process (the
+ * web daemon) renders previews of a `src/` the user may be editing between requests; a
+ * path-only memo would serve yesterday's pack forever. Newlines come back folded to LF, the
+ * same normalisation `readText` gave the render callers — `knownRuleIds` matched identically
+ * on raw or folded text, so one behaviour serves both.
+ */
+const _packTexts = new Map();
+export function readPackText(file) {
+  const key = path.resolve(file);
+  const mtime = statSync(file).mtimeMs;
+  const hit = _packTexts.get(key);
+  if (hit && hit.mtime === mtime) return hit.text;
+  const text = readFileSync(file, 'utf8').replace(/\r\n?/g, '\n');
+  _packTexts.set(key, { mtime, text });
+  return text;
+}
+
 /**
  * `_build_core.ROOT` — the checkout, from this file's own location (`js/..`).
  *
@@ -104,7 +124,7 @@ export function knownRuleIds() {
   for (const pack of PACK_ORDER) {
     const file = path.join(SRC, 'doctrines', `${pack}.md`);
     let text = '';
-    try { text = readFileSync(file, 'utf8'); } catch { continue; }
+    try { text = readPackText(file); } catch { continue; }
     for (const m of text.matchAll(/^### \{\{DOCTRINE\}\} ([a-z]+) (\d+)\b/gm)) {
       if (m[1] === pack) out.push(`${pack}.${Number(m[2])}`);
     }

package/js/cli-table.json

@@ -155,6 +155,21 @@
           "is_flag": false,
           "type": null,
           "hidden": false
+        },
+        {
+          "names": [
+            "--host"
+          ],
+          "dest": "host",
+          "metavar": null,
+          "help": "the host that reads the verdict (set by the emitted hook): 'claude' (default) asks; 'copilot' has no ask tier, so Laws I/IV block and everything else is a stderr warning",
+          "choices": null,
+          "default": null,
+          "required": false,
+          "nargs": null,
+          "is_flag": false,
+          "type": null,
+          "hidden": false
         }
       ],
       "mutex": []
@@ -356,6 +371,21 @@
           "is_flag": false,
           "type": null,
           "hidden": false
+        },
+        {
+          "names": [
+            "--host"
+          ],
+          "dest": "host",
+          "metavar": null,
+          "help": "the host that reads the verdict (set by the emitted hook): 'claude' (default) asks; 'copilot' has no ask tier, so Laws I/IV block and everything else is a stderr warning",
+          "choices": null,
+          "default": null,
+          "required": false,
+          "nargs": null,
+          "is_flag": false,
+          "type": null,
+          "hidden": false
         }
       ],
       "mutex": []
@@ -604,6 +634,21 @@
           "is_flag": false,
           "type": null,
           "hidden": false
+        },
+        {
+          "names": [
+            "--host"
+          ],
+          "dest": "host",
+          "metavar": null,
+          "help": "the host that reads the verdict (set by the emitted hook): 'claude' (default) asks; 'copilot' has no ask tier, so Laws I/IV block and everything else is a stderr warning",
+          "choices": null,
+          "default": null,
+          "required": false,
+          "nargs": null,
+          "is_flag": false,
+          "type": null,
+          "hidden": false
         }
       ],
       "mutex": []
@@ -764,6 +809,45 @@
         ]
       ]
     },
+    {
+      "name": "tool-gate",
+      "help": "toolCall hook (Copilot): git-gate and rule-gate fused behind one command, dispatched on the payload",
+      "description": "",
+      "positionals": [],
+      "options": [
+        {
+          "names": [
+            "--root"
+          ],
+          "dest": "root",
+          "metavar": null,
+          "help": "the install's own dir (set by the emitted hook); enables the sovereign-repo bypass from <root>/excludes.json",
+          "choices": null,
+          "default": null,
+          "required": false,
+          "nargs": null,
+          "is_flag": false,
+          "type": null,
+          "hidden": false
+        },
+        {
+          "names": [
+            "--host"
+          ],
+          "dest": "host",
+          "metavar": null,
+          "help": "the host that reads the verdict (set by the emitted hook): 'claude' (default) asks; 'copilot' has no ask tier, so Laws I/IV block and everything else is a stderr warning",
+          "choices": null,
+          "default": null,
+          "required": false,
+          "nargs": null,
+          "is_flag": false,
+          "type": null,
+          "hidden": false
+        }
+      ],
+      "mutex": []
+    },
     {
       "name": "tui",
       "help": "print the harness at a glance (interactive terminals only)",