geneseed 4.14.0 → 4.16.0

package/CHANGELOG.md

@@ -8,6 +8,44 @@ label. For the capability ↔ spec map, see [SHIPPED.md](SHIPPED.md).
 
 ## [Unreleased]
 
+## [4.16.0] — 2026-10-23
+
+Minor: foreman mode now really delegates, and the web console updates and rebuilds a clone without a manual restart.
+
+### Upgrade notes
+- Run `geneseed rebuild-all`; nothing changes on a machine until something re-emits. The precedence table changes in every install, not only in foreman ones.
+
+### Changed
+- Foreman mode: the mode now binds how work runs. It has its own row in the precedence table; `PROFILE.md`, posture and theme still only inform.
+- Foreman triage is a count, not a judgement: a task is substantial when it changes 2 or more files, needs a new or changed test, needs about 5 reads before the first edit, or asks for a feature, a fix, a review, an audit or an investigation. When unsure, the session delegates.
+- Pipelines: the parent session dispatches one background crew lead and goes back to the user. The crew lead picks the crew from the whole agent roster (the floor is only the minimum) and runs the relay. `pipeline` now has a per-host table; on a host where the crew lead cannot start subagents, it plays each role in turn.
+
+### Fixed
+- Web console: a git clone always gets the **Update** button, also when the npm release check gets no answer.
+- Web console: a rebuild on a console running old code (after a manual `git pull`) now restarts it and reloads the page.
+- Docs: the pipeline loop limit is 2 repair rounds, then one fresh developer, not "five rounds".
+
+## [4.15.1] — 2026-10-23
+
+Patch: two host fixes. The first npm release since 4.14.0, so it also carries 4.15.0's comms 4 doctrine.
+
+### Upgrade notes
+- Run `geneseed rebuild-all`; nothing changes on a machine until something re-emits.
+
+### Fixed
+- OpenCode 1.x: the guard and learn plugins no longer write `[geneseed-guard] …` / `[geneseed-learn] …` lines in red over the TUI input box. Their messages now go to OpenCode's own log (`client.app.log`, service `geneseed-guard` / `geneseed-learn`). OpenCode 2 and a refused log call still use stderr. The workflow plugin's one-line load banner stays on stderr.
+- IBM Bob: the first reply now starts with the theme's readiness line. Both Bob carriers (global `rules/geneseed.md`, the project's `AGENTS.md` block) open with a short first-reply override; without it, Bob's own greeting won. A bare "hi" still gets Bob's fixed welcome. Run `geneseed rebuild-all` to pick it up.
+
+## [4.15.0] — 2026-10-22
+
+Minor: a new comms doctrine rule makes every generated agent write its prose in ASD-STE100 Simplified Technical English.
+
+### Upgrade notes
+- Run `geneseed rebuild-all` to get the new rule; nothing changes on a machine until something re-emits. To keep the old behaviour on one install, rebuild it with `--exclude-rules "comms 4"`.
+
+### Added
+- **Doctrine comms 4, Simplified Technical English.** Every generated agent writes the prose of its replies and reports in ASD-STE100: one topic per sentence (at most 20 words in an instruction, 25 in a description), imperative steps with one action each and the condition first, the active voice, no -ing forms, no dropped articles, and one word per meaning. Code, commands, paths, identifiers and quoted output stay as they are. STE is an English standard and the ontology imposes no language, so an answer in another language keeps that language and the same sentence rules; the theme keeps its voice. It is in the toggleable comms pack, not a law, per DESIGN.md Decision 7: `--exclude-rules "comms 4"` turns it off. The carrier ceilings rise by 1 003 characters (full) and 472 (lean). Run `geneseed rebuild-all` to get it.
+
 ## [4.14.0] — 2026-10-22
 
 Minor: the React kit supports webpack projects as well as Vite.

package/README.md

@@ -13,7 +13,7 @@
 [![Themes](https://img.shields.io/badge/themes-14-9cf)](themes/)
 [![Skills](https://img.shields.io/badge/skills-47-blueviolet)](src/skills/)
 [![Agents](https://img.shields.io/badge/agents-20-orange)](src/agents/)
-[![Laws and doctrines](https://img.shields.io/badge/laws-9%20%2B%2029%20doctrines-critical)](src/doctrines/)
+[![Laws and doctrines](https://img.shields.io/badge/laws-9%20%2B%2030%20doctrines-critical)](src/doctrines/)
 [![Plugins](https://img.shields.io/badge/plugins-7-teal)](adapters/opencode/plugins/)
 [![OpenCode · Claude Code · Bob · OpenClaude · AGENT.md](https://img.shields.io/badge/works%20with-OpenCode%20·%20Claude%20Code%20·%20Bob%20·%20OpenClaude%20·%20AGENT.md-1f6feb)](#-supported-harnesses)
 

package/SHIPPED.md

@@ -20,7 +20,7 @@ historical references, not files distributed with the repo.
 > **On version numbers.** [`harness.config.json`](harness.config.json)'s `version` is a
 > human-readable label only. The canonical identity of an installed harness is the
 > **source fingerprint** stamped in `.geneseed-version` (see `geneseed version`), not the
-> string. Current label: **4.14.0**.
+> string. Current label: **4.16.0**.
 
 ## Capabilities
 

package/adapters/opencode/plugins/geneseed-guard.js

@@ -153,7 +153,21 @@ const gateOff = (marker) => new RegExp(`^${marker}:[ \\t]*off[ \\t]*\\r?$`, "m")
 const DELETION_GATE_OFF = gateOff("Deletion gate")
 const SECRETS_GATE_OFF = gateOff("Secrets gate")
 
-function log(msg) { console.error(`[geneseed-guard] ${msg}`) }
+// OpenCode 1.x paints a plugin's stderr over its TUI input box (in red); its own log API
+// writes to the log file instead. The V1 entry sets LOG_CLIENT; V2 and tests have no
+// client and keep stderr, as does a refused log call, so no line is lost. Never throws:
+// a log line must not break a tool call.
+let LOG_CLIENT = null
+function say(msg, level = "warn") {
+  try {
+    if (LOG_CLIENT?.app?.log) {
+      Promise.resolve(LOG_CLIENT.app.log({ body: { service: "geneseed-guard", level, message: msg } })).catch(() => console.error(`[geneseed-guard] ${msg}`))
+      return
+    }
+  } catch { /* fall through to stderr */ }
+  console.error(`[geneseed-guard] ${msg}`)
+}
+const log = (msg) => say(msg)
 
 // ---- the gate ledger ------------------------------------------------------------
 // The twin of `ledger()` in js/hosts/hooks.mjs: one JSON line per BLOCK into
@@ -1369,6 +1383,7 @@ async function recordUse(tool, args) {
 }
 
 export const GeneseedGuard = async (ctx) => {
+  if (ctx?.client) LOG_CLIENT = ctx.client
   // The session's working directory, the same resolution the context plugin uses.
   const root = () => ctx?.worktree || ctx?.directory || process.cwd()
   return {

package/adapters/opencode/plugins/geneseed-learn.js

@@ -38,6 +38,21 @@ import * as path from "node:path"
 import { fileURLToPath } from "node:url"
 import { homedir } from "node:os"
 
+// OpenCode 1.x paints a plugin's stderr over its TUI input box (in red); its own log API
+// writes to the log file instead. The V1 entry sets LOG_CLIENT; V2 and tests have no
+// client and keep stderr, as does a refused log call, so no line is lost. Never throws:
+// a log line must not break a tool call.
+let LOG_CLIENT = null
+function say(msg, level = "warn") {
+  try {
+    if (LOG_CLIENT?.app?.log) {
+      Promise.resolve(LOG_CLIENT.app.log({ body: { service: "geneseed-learn", level, message: msg } })).catch(() => console.error(`[geneseed-learn] ${msg}`))
+      return
+    }
+  } catch { /* fall through to stderr */ }
+  console.error(`[geneseed-learn] ${msg}`)
+}
+
 // The plugin's own directory. In the global install the layout is
 // <cfg>/plugins/geneseed-learn.js beside <cfg>/memory, so the store can be found
 // relative to this file — no manual `export GENESEED_HARNESS` needed.
@@ -471,17 +486,18 @@ async function storeDistil(output, { isChild, memDir, agentName, existing }) {
     const lesson = output.trim().split("\n")[0].replace(/^[-*]\s*/, "").trim()
     if (lesson.length < 10 || lesson.length > 300) return // junk / truncation guard
     const f = await appendAgentLesson(memDir, agentName, lesson)
-    console.error(`[geneseed-learn] agent lesson -> ${f}`)
+    say(`agent lesson -> ${f}`, "info")
     return
   }
   const res = await writeMemories(output, memDir, existing)
   for (const [verb, slugs] of [["wrote", res.created], ["updated", res.updated], ["archived", res.archived]]) {
-    if (slugs.length) console.error(`[geneseed-learn] ${verb} ${slugs.length} memory file(s): ${slugs.join(", ")}`)
+    if (slugs.length) say(`${verb} ${slugs.length} memory file(s): ${slugs.join(", ")}`, "info")
   }
 }
 
 export const GeneseedLearn = async (ctx) => {
   const { client } = ctx ?? {}
+  if (client) LOG_CLIENT = client
   const ours = new Set()       // throwaway distil sessions — never mine our own output
   const timers = new Map()     // sid -> debounce timer, re-armed on each idle
   const inFlight = new Set()   // sid currently being distilled (guards against overlap)
@@ -510,8 +526,8 @@ export const GeneseedLearn = async (ctx) => {
       if (!memDir) {
         if (!warnedNoDir) {
           warnedNoDir = true
-          console.error(
-            "[geneseed-learn] no memory dir — set $GENESEED_HARNESS or $GENESEED_MEMORY."
+          say(
+            "no memory dir — set $GENESEED_HARNESS or $GENESEED_MEMORY."
           )
         }
         return
@@ -524,8 +540,8 @@ export const GeneseedLearn = async (ctx) => {
       notes = notes.slice(-MAX_NOTES_CHARS)
       model = model ?? envModel()
       if (!model) {
-        console.error(
-          "[geneseed-learn] could not determine a model — set $GENESEED_MODEL=provider/model."
+        say(
+          "could not determine a model — set $GENESEED_MODEL=provider/model."
         )
         return
       }
@@ -540,7 +556,7 @@ export const GeneseedLearn = async (ctx) => {
       const newId = session?.id ?? session?.data?.id
       if (!newId) {
         // Prompting with {id: undefined} would 404 silently on every idle.
-        console.error("[geneseed-learn] session.create returned no id — skipping this distil.")
+        say("session.create returned no id — skipping this distil.")
         return
       }
       ours.add(newId)
@@ -558,7 +574,7 @@ export const GeneseedLearn = async (ctx) => {
       await storeDistil(output, { isChild, memDir, agentName, existing })
     } catch (err) {
       // Never break the session over a memory write.
-      console.error(`[geneseed-learn] skipped: ${err?.message ?? err}`)
+      say(`skipped: ${err?.message ?? err}`)
     } finally {
       inFlight.delete(sid)
     }
@@ -647,7 +663,7 @@ async function setupV2(ctx) {
       if (!memDir) {
         if (!warnedNoDir) {
           warnedNoDir = true
-          console.error("[geneseed-learn] no memory dir — set $GENESEED_HARNESS or $GENESEED_MEMORY.")
+          say("no memory dir — set $GENESEED_HARNESS or $GENESEED_MEMORY.")
         }
         return
       }
@@ -660,7 +676,7 @@ async function setupV2(ctx) {
         model = env ? { providerID: env.providerID, id: env.modelID } : null
       }
       if (!model) {
-        console.error("[geneseed-learn] could not determine a model — set $GENESEED_MODEL=provider/model.")
+        say("could not determine a model — set $GENESEED_MODEL=provider/model.")
         return
       }
 
@@ -673,7 +689,7 @@ async function setupV2(ctx) {
       })
       await storeDistil(String(reply?.text ?? ""), { isChild, memDir, agentName, existing })
     } catch (err) {
-      console.error(`[geneseed-learn] skipped: ${err?.message ?? err}`)
+      say(`skipped: ${err?.message ?? err}`)
     } finally {
       inFlight.delete(sid)
     }
@@ -695,7 +711,7 @@ async function setupV2(ctx) {
       if (prev) clearTimeout(prev)
       timers.set(sid, setTimeout(() => { timers.delete(sid); runDistill(sid) }, DEBOUNCE_MS))
     }
-  })().catch((err) => console.error(`[geneseed-learn] event stream ended: ${err?.message ?? err}`))
+  })().catch((err) => say(`event stream ended: ${err?.message ?? err}`))
   return () => {
     controller.abort()
     for (const t of timers.values()) clearTimeout(t)

package/adapters/opencode/plugins/geneseed-workflow.js

@@ -25,7 +25,21 @@ import * as path from "node:path"
 import { fileURLToPath, pathToFileURL } from "node:url"
 
 const DEBUG = !!process.env.GENESEED_DEBUG
-function dlog(m) { if (DEBUG) console.error(`[geneseed-workflow] ${m}`) }
+function dlog(m) { if (DEBUG) say(m, "debug") }
+// OpenCode 1.x paints a plugin's stderr over its TUI input box (in red); its own log API
+// writes to the log file instead. The V1 entry sets LOG_CLIENT; V2 and tests have no
+// client and keep stderr, as does a refused log call, so no line is lost. Never throws:
+// a log line must not break a tool call.
+let LOG_CLIENT = null
+function say(msg, level = "warn") {
+  try {
+    if (LOG_CLIENT?.app?.log) {
+      Promise.resolve(LOG_CLIENT.app.log({ body: { service: "geneseed-workflow", level, message: msg } })).catch(() => console.error(`[geneseed-workflow] ${msg}`))
+      return
+    }
+  } catch { /* fall through to stderr */ }
+  console.error(`[geneseed-workflow] ${msg}`)
+}
 
 const __dir = path.dirname(fileURLToPath(import.meta.url))
 const WORKFLOWS_DIR = process.env.GENESEED_WORKFLOWS_DIR
@@ -184,7 +198,9 @@ const NAME_DESCRIPTION = "saved workflow name; omit to list available"
 const ARGS_DESCRIPTION = "inputs passed to the workflow script as `args` (object, or a JSON object string)"
 
 // One-line load banner (always on) so a restart visibly confirms the plugin loaded and the
-// `workflow` tool is registered. tests/host_canary.mjs reads it as V1's proof of load.
+// `workflow` tool is registered. tests/host_canary.mjs reads it as V1's proof of load, so it
+// stays on stderr, not `say`: `opencode debug config` never prints a `client.app.log` line. It
+// runs once, before the TUI draws, so it does not land in the input box as `say`'s lines did.
 async function loadBanner(warn = "") {
   try {
     const names = await listWorkflows()
@@ -194,6 +210,7 @@ async function loadBanner(warn = "") {
 
 export const GeneseedWorkflow = async (ctx) => {
   const { client, directory, worktree } = ctx
+  if (client) LOG_CLIENT = client
   let toolHelper
   try { ({ tool: toolHelper } = await import("@opencode-ai/plugin")) }
   catch { dlog("@opencode-ai/plugin tool helper unavailable — registering a raw tool def") }

package/docs/concepts/foreman-mode.md

@@ -21,8 +21,10 @@ The agent works every task itself, turn by turn. Nothing is spawned; you talk to
 
 The session sorts every request:
 
-- **Trivial** — a quick answer, a one-file tweak, a question: done directly, as in direct mode.
-- **Substantial** — handed to a **pipeline** running in the background. The session tells you it is running and stays free to answer you.
+- **Substantial** — handed to a **pipeline** running in the background. The session tells you it is running and stays free to answer you. A task counts as substantial when any one of these holds: it changes two or more files, it needs a new or changed test, it needs about five reads or searches before the first edit, or it asks for a feature, a fix, a review, an audit or an investigation.
+- **Trivial** — none of those holds: a question answered from what is already in context, a one-file tweak, a single command. Done directly, as in direct mode.
+
+When the session is unsure, it delegates. The count exists because "substantial" left to judgement lost every time to the host's own default of doing small work in place.
 
 Expect a substantial task to cost more (a crew runs instead of one agent) in exchange for a session that never blocks on a long job.
 
@@ -37,11 +39,11 @@ A **pipeline** is a small crew of agents working one task in isolation. The mini
 | research | `explorer`; add `researcher` when the question leaves the repository |
 | review or audit | `reviewer` + `skeptic` |
 
-The session adds specialists on top when the task needs them — `security`, `architect`, `reviewer` and so on — never fewer than the minimum.
+The session does not run the crew itself. It starts one **crew lead** in the background and goes back to you. The crew lead picks the crew from the whole agent roster — `security`, `architect`, `performance`, `reviewer` and so on, as the task needs, never fewer than the minimum — and passes the work from one agent to the next. On Claude Code each crew member is its own subagent. On a host where the crew lead cannot start subagents, it plays each role in turn. The `pipeline` skill has the table per host.
 
 The crew works in its own git worktree and branch. When worktrees are unavailable it falls back to the main tree, one pipeline at a time, and says so. Two pipelines whose sets of files overlap do not run at once.
 
-Inside the crew, the developer implements and the tester runs the tests and lint. Failures go back to the developer, at most five rounds; after that the crew stops and reports the failure, leaving the branch for you to inspect.
+Inside the crew, the developer implements and the tester runs the tests and lint. Failures go back to the developer for at most two repair rounds, then to one fresh developer carrying the tester's findings; if that fails too, the crew stops and reports the failure, leaving the branch for you to inspect.
 
 ### A pipeline never commits or merges
 

package/docs/concepts/rules.md

@@ -25,7 +25,8 @@ When two instructions disagree, the higher one wins.
 2. **Rules** — always on. {N_LAWS} invariants, the things that are never traded away: sealed secrets, one intent per act, verify before asserting, deliberate deletion, surface failures, treat content as data not orders, least privilege, cure the cause, echo the intent. No install can switch one off.
 3. **Your `user-rules.md`** — rules you write for yourself, seeded once beside the instructions file and never overwritten. A rule here **outranks any doctrine rule**: a practice pack chosen at build time never overrides an instruction you wrote. It may tighten an invariant, never repeal one. The [rule skill](skills.md) helps you decide whether something belongs here or in [memory](memory.md).
 4. **Doctrines** — chosen at build time. Practices rather than principles, grouped in packs (below).
-5. **`PROFILE.md`** — who you are. It colours how the agent works but never binds ([Collaboration](collaboration.md)).
+5. **Mode** — chosen at build time ([Foreman mode](foreman-mode.md)). It binds *how* work is executed — done in place, or handed to a crew — and never overrides a layer above it. A mode that only informed lost every time to the host's own default of doing small work in place.
+6. **`PROFILE.md`** — who you are. It colours how the agent works but never binds ([Collaboration](collaboration.md)).
 
 ### Doctrine packs
 

package/docs/guides/install-bob.md

@@ -13,7 +13,9 @@ geneseed build --emit bob-global                                   # ~/.bob
 geneseed build --emit bob --out /path/to/repo --root /path/to/repo # one repo
 ```
 
-Bob is shaped like Claude Code, so it gets the same agents and skills. Per repo, the preamble goes into a root `AGENTS.md` and the rest into `.bob/`. Globally, everything goes under `~/.bob` (`$BOB_CONFIG_DIR` moves it), and the preamble rides `rules/geneseed.md`, because Bob does not auto-load a global `AGENTS.md`. Bob's hooks refuse an action with exit code 2, and Bob has no `SubagentStop` or `PreCompact` events. Bob support has not yet been verified against a live install.
+Bob is shaped like Claude Code, so it gets the same agents and skills. Per repo, the preamble goes into a root `AGENTS.md` and the rest into `.bob/`. Globally, everything goes under `~/.bob` (`$BOB_CONFIG_DIR` moves it), and the preamble rides `rules/geneseed.md`, because Bob does not auto-load a global `AGENTS.md`. Bob's hooks refuse an action with exit code 2, and Bob has no `SubagentStop` or `PreCompact` events.
+
+Both scopes open Bob's carrier with a short first-reply override, so the theme's readiness line (for example "🧬 Gene-seed implanted…") starts the first reply. Without it, Bob's own greeting outranked the instruction lower in the file. A bare greeting such as "hi" still gets Bob's fixed welcome; the line appears on the first real request. That much was checked by hand in the Bob IDE (2026-10); the rest of the Bob support has not been verified against a live install.
 
 ---
 

package/docs/guides/upgrade.md

@@ -34,6 +34,8 @@ geneseed upgrade imperial     # the same, switching the theme
 
 A dirty working tree, or a folder that is not a git clone, is reported rather than force-updated. `update` and `sync-self` are aliases of `upgrade`. `bootstrap` does the same and then opens the setup wizard (`--no-setup` skips the wizard).
 
+In the web console, the **Update** button on the Overview runs `upgrade`. On a clone it is always there, also when the release check cannot reach npm, because `main` moves between releases. When the update is done, the console restarts and the page reloads. If you ran `git pull` yourself, the Overview shows a banner that the console runs old code. Click **Rebuild** on an install that is behind: the console restarts after the rebuild and reloads the page. If no install is behind, click **Restart** in the banner.
+
 ## What an upgrade keeps
 
 A rebuild only replaces files the install's manifest says Geneseed owns. It leaves these alone:

package/harness.config.json

@@ -2,5 +2,5 @@
   "_comment": "version is a human-readable release label only; the canonical identity of an installed harness is the source fingerprint stamped in .geneseed-version (see `harness version`), not this string.",
   "theme": "neutral",
   "product": "Geneseed",
-  "version": "4.14.0"
+  "version": "4.16.0"
 }

package/js/build/emit-claude.mjs

@@ -21,7 +21,7 @@ import {
 } from './emit-common.mjs';
 import { kitsBody, renderAll, renderFile } from './render.mjs';
 import {
-  BOB_RULES_STUB, ensureContextStub, ensureExcludesStub, ensureNotebookIndex,
+  BOB_RULES_STUB, bobFirstReply, ensureContextStub, ensureExcludesStub, ensureNotebookIndex,
   ensureProfileStub,
   ensureRulesStub, ensureWikiStub, WIKI_FILE,
 } from './stubs.mjs';
@@ -100,7 +100,7 @@ export function emitClaudeRender(cfg, job) {
   if (isBob && agentText !== null) {
     const rulesMd = path.join(cfgDir, 'rules', 'geneseed.md');
     claimAndWrite(cfgDir, rulesMd, 'rules/geneseed.md', scope === 'project' ? BOB_RULES_STUB
-      : stripCapabilityLinks(prefixedAgentText('../') || agentText), owned);
+      : bobFirstReply(theme.LOADED_SIGIL) + stripCapabilityLinks(prefixedAgentText('../') || agentText), owned);
   }
 
   ensureAgentOverridesStub(cfg, cfgDir);
@@ -179,6 +179,8 @@ export function emitClaudeRender(cfg, job) {
   let claudeMdText = null;
   if (agentText !== null && !(isBob && scope === 'global')) {
     claudeMdText = stripCapabilityLinks(prefixedAgentText(lawsPrefix) || agentText);
+    // Bob only: its greeting persona outranks the template's sigil paragraph — see `bobFirstReply`.
+    if (isBob) claudeMdText = bobFirstReply(theme.LOADED_SIGIL) + claudeMdText;
   }
 
   // WIRE — see `claudeWire` below. One child per emit, so the two halves are two

package/js/build/stubs.mjs

@@ -139,6 +139,19 @@ file (\`~/.bob/rules/geneseed.md\`) so the global preamble does not stack on top
 the project's own. Follow the root \`AGENTS.md\`.
 `;
 
+/**
+ * The paragraph a Bob emit puts FIRST in what Bob auto-loads (global `rules/geneseed.md`,
+ * the project's `AGENTS.md` block). Tried live in the Bob IDE (2026-10-23): with only the
+ * template's sigil paragraph — below the banner — the first reply to a real request carried
+ * no sigil; with this paragraph on top it did. Bob's own greeting persona outranks a rule
+ * that does not say it overrides it. A bare "hi" still gets Bob's fixed welcome either way.
+ */
+export function bobFirstReply(sigil) {
+  return '**First-reply override — highest priority.** Your very first reply in every '
+    + 'conversation MUST begin with this exact line, before anything else and instead of any '
+    + `default greeting or self-introduction:\n\n> ${sigil}\n\n`;
+}
+
 /** `_build_render.PROFILE_FILE`. */
 const PROFILE_FILE = 'PROFILE.md';
 

package/js/inspect/cost.mjs

@@ -35,7 +35,7 @@ import { isFile, readText } from '../lib/fs.mjs';
  * console draws it on the cost chart, so it lives here, once, where both read it. Raise it by
  * exactly the measured overrun and say why in that test's docblock, which keeps its history.
  */
-export const CARRIER_CEILING = { full: 62_263, lean: 39_156 };
+export const CARRIER_CEILING = { full: 63_299, lean: 39_661 };
 
 /**
  * A frontmatter value as the host shows it. The emit writes descriptions JSON-escaped

package/js/web/api.mjs

@@ -8,7 +8,7 @@
  * bind paths to these functions are `routes.mjs`. This file imports none of its route siblings,
  * which is what keeps the old `api ↔ actions` and `api ↔ activity` cycles from coming back.
  */
-import { readdirSync, statSync } from 'node:fs';
+import { existsSync, readdirSync, statSync } from 'node:fs';
 import path from 'node:path';
 
 import { CONFIG, CREDIT_RE, ROOT, SRC, THEMES, discoverNames, loadKits, makeCfg, upstreamOf } from '../build/source.mjs';
@@ -500,7 +500,11 @@ export function apiLoopsActive() {
 }
 
 /** Is a newer release on npm than the source this console serves? See update-check.mjs. */
-export const apiUpdate = (state) => updateStatus(state, releaseLabel());
+// `git`: a clone updates by `git pull` whatever npm says — main moves between releases, and a
+// work proxy can leave the release check unanswered — so the console always offers Update there.
+// `.git` is a file in a worktree, a folder in a clone; existence covers both.
+export const apiUpdate = (state) => ({ ...updateStatus(state, releaseLabel()),
+  git: existsSync(path.join(ROOT, '.git')) });
 
 /** The source's release label, or null when it cannot be read. */
 function releaseLabel() {

package/js/web/daemon.mjs

@@ -357,7 +357,7 @@ export async function statusDaemon(theme = null, port = null) {
  * `rebuild-all` when the running one is stale. EXCEPT inside a web job (`GENESEED_WEB_JOB`,
  * set by `js/web/jobs.mjs`): restarting here would kill the process tracking that very job,
  * leaving the console stuck on 'running'; the server restarts itself after an update job, and
- * shows its stale banner otherwise. `onlyIfStale` is `rebuild-all`'s: after an `upgrade`
+ * after a rebuild-all job when it is stale (`js/web/handler.mjs`). `onlyIfStale` is `rebuild-all`'s: after an `upgrade`
  * (which bounces, then runs `rebuild-all`) the console is current, and bouncing it again
  * would drop the open tab for nothing. Never throws — no rebuild fails over a console.
  */
@@ -368,7 +368,7 @@ export async function bounceDaemonIfRunning(theme, log, { onlyIfStale = false }
   }
   if (process.env.GENESEED_WEB_JOB) {
     log(onlyIfStale
-      ? '[geneseed] the web console is running old code — use its Restart banner.'
+      ? '[geneseed] the web console is running old code — it restarts itself after this job.'
       : '[geneseed] web daemon will restart itself after this job to load the new code.');
     return;
   }

package/js/web/handler.mjs

@@ -300,6 +300,17 @@ export function makeHandler(state, jm, token, dist, holder = null) {
       if (jid === null) return sendJson(res, { error: 'busy' }, 409, ae);
       return sendJson(res, { job_id: jid }, 202, ae);
     }
+    // A rebuild-all on a STALE server (a manual `git pull` under it) restarts it afterwards, as
+    // an update does: otherwise the rebuild lands and the page keeps serving the old code.
+    // `restarts` tells the console to wait for the new server and reload.
+    if (action === 'build-all' && state.daemonStale?.()) {
+      const jid = jm.start(action, actionCommands(action), (rc) => {
+        state.refresh();
+        if (rc === 0) requestRestart(state.theme);
+      });
+      if (jid === null) return sendJson(res, { error: 'busy' }, 409, ae);
+      return sendJson(res, { job_id: jid, restarts: true }, 202, ae);
+    }
     // Build resolves its argv off the install (`buildActionCmds`); the other actions take no
     // axes and self-resolve the deployed theme downstream.
     const cmds = action === 'build' ? buildActionCmds(state, body) : actionCommands(action);

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "Every field here is argued and gated in tests/unit/package_manifest.test.mjs. `files`, `bin` and `engines` each have a test that fails when reality drifts from this file; `version` mirrors harness.config.json and is gated too. Read that docblock before editing this one.",
   "name": "geneseed",
-  "version": "4.14.0",
+  "version": "4.16.0",
   "description": "A portable, theme-able harness you implant once and use everywhere to grow a disciplined AI coding agent.",
   "keywords": [
     "ai",

package/src/AGENT.md.tmpl

@@ -59,7 +59,8 @@ never move.
 | 2 | `user-rules.md` (§1) | may tighten a {{LAW}}, never repeal one |
 | 3 | The {{ONTOLOGY}} | never against a user rule |
 | 4 | The active {{DOCTRINES}} (§2) | may tighten, never repeal |
-| 5 | `PROFILE.md`, posture, mode, theme | inform only; never bind |
+| 5 | The mode | binds how work runs |
+| 6 | `PROFILE.md`, posture, theme | inform only; never bind |
 
 ---
 

package/src/doctrines/comms.md

@@ -70,3 +70,24 @@ interfaces first. Genuine forks only, never naming or formatting; trivial work o
 Where {{LAW:echo-the-intent}} checks the goal before, this exposes the choices made during —
 never a call it says to ask about.
 <!-- LEAN:end -->
+
+### {{DOCTRINE:simplified-technical-english}} Simplified Technical English
+<!-- LEAN:begin -->
+Write every prose reply and report in ASD-STE100 Simplified Technical English, the
+controlled language of aerospace maintenance: a tired reader, or one reading a second
+language, gets one meaning on the first read. Code, commands, paths, identifiers and quoted
+output stay as they are. One topic per sentence: at most 20 words in an instruction, 25 in
+a description, six sentences per paragraph. Write an instruction in the imperative, one
+action per sentence, condition first (`If the test fails, read the log.`); a warning comes
+before its step. Use the active voice and simple tenses, no -ing forms, no dropped
+articles. Use one word per meaning, every time: `use`, not `utilize`; `stop`, not
+`terminate`. Project names are technical names and stay. Keep noun clusters to three words.
+In another language, answer in it ({{ONT_CONDUCT}}) and keep these sentence rules; the
+theme keeps its voice, and this rule governs the sentences that carry the content.
+<!-- LEAN:else -->
+Write every prose reply and report in ASD-STE100 Simplified Technical English; code,
+commands, paths and quoted output stay as they are. One topic per sentence: 20 words at
+most in an instruction, 25 in a description. Instructions: imperative, one action each,
+condition first. Active voice, no -ing forms, no dropped articles, one word per meaning
+(`use`, not `utilize`). In another language, keep it and these rules.
+<!-- LEAN:end -->

package/src/modes/foreman.md

@@ -3,11 +3,19 @@ crews for what's substantial, and keeps answering the user without blocking.
 
 - **Stay responsive.** Answer the user immediately; never let a running pipeline
   block the conversation.
-- **Triage every incoming task.** *Trivial* (a quick answer, a one-file tweak, a
-  question) → do it directly, no pipeline. *Substantial* → spawn a pipeline (the
-  `pipeline` {{SKILL}}) in the background and tell the user it's running.
-- **Compose the crew dynamically** from the agent roster, never below the floor
-  for the task type — floors and roles live in the pipeline {{SKILL}}, not here.
+- **Triage every incoming task by count, not by feel.** A task is *substantial* when
+  any one of these holds: it will change two or more files; it needs a new or changed
+  test; it needs about five reads or searches before the first edit; or it asks for a
+  feature, a fix, a review, an audit or an investigation. Substantial → spawn a
+  pipeline (the `pipeline` {{SKILL}}) in the background and tell the user it's
+  running. *Trivial* — none of these holds: a question answered from what is already
+  in context, a one-file tweak, a single command → do it directly, no pipeline.
+  **When unsure, delegate.** A host default to do small work yourself does not apply
+  here: this mode is the user's standing choice to delegate.
+- **Dispatch one crew lead, then step away.** The crew lead composes the crew from
+  the whole agent roster, never below the floor for the task type, and runs the relay
+  itself. Never run the hand-offs from this session. Floors, roles and per-host
+  mechanics live in the pipeline {{SKILL}}, not here.
 - **Isolate.** Each pipeline works in its own git worktree/branch; falls back to a
   single tree, one pipeline at a time, when worktrees are unavailable.
 - **Merge on proof you re-ran.** A pipeline hands back its worktree, uncommitted, with

package/src/skills/pipeline.md

@@ -8,11 +8,13 @@
 
 ## What it is
 
-A pipeline is a small crew of {{AGENTS}} — analyst, developer, tester, plus whatever specialists the task demands — working a single task in isolation from the rest of the session, so the parent can keep answering the user while the crew runs. The parent never merges on the crew's word: it re-runs the crew's proof commands itself and merges only once the user accepts.
+A pipeline is a small crew of {{AGENTS}} working a single task in isolation from the rest of the session, so the parent can keep answering the user while the crew runs. The parent dispatches **one crew lead** in the background and steps away. The crew lead composes the crew, runs the relay, and returns one result envelope. The parent never merges on the crew's word: it re-runs the crew's proof commands itself and merges only once the user accepts.
+
+The parent does not run the relay itself. Each hand-off it ran would pull it back from the user, which is the one thing this {{SKILL}} exists to prevent.
 
 ## Crew floors
 
-The minimum roster per task type. The parent may add specialists on top — security, architect, reviewer, docs, historian, or any other {{AGENT}} the task genuinely needs — but never dispatches below the floor.
+The minimum roster per task type. The crew lead chooses the crew from the whole {{AGENT}} roster: any {{AGENT}} the task genuinely needs — security, architect, performance, reviewer, docs, historian, researcher, or any other — in any order the task needs. The floor is the least it may dispatch, never the most.
 
 | Task type | Floor |
 |---|---|
@@ -23,14 +25,24 @@ The minimum roster per task type. The parent may add specialists on top — secu
 
 ## Procedure
 
-1. Confirm the task is genuinely substantial — a trivial one-file tweak or a question does not warrant a crew; do it directly instead.
-2. Compose the crew from the floor above, adding specialists only where the task demands them.
-3. Isolate the crew's work in its own git worktree/branch. Where worktrees are unavailable, fall back to a single tree, one pipeline at a time, and say so. Give the crew a **write set** and check it against every other pipeline in flight ({{DOCTRINE:one-writer-per-file}}): two crews whose sets overlap do not run at once, and shared append files (registries, index tables, lockfiles, generated bundles) are the parent's to apply, never a crew's.
-4. **The dev↔tester loop:** the developer implements, the tester validates — runs the tests and lint, produces raw logs. On failure, the findings go back to the developer — two repair rounds at most, then one fresh developer (a higher model tier where the host offers one) carrying the tester's findings ({{DOCTRINE:bound-the-loop}}); if that fails too, stop, do not merge, and report the failure with the branch left in place for inspection. A conflict or ambiguity between the plan, the findings and the code is yours to decide: decide it, record `Ruling: <choice> — <why> — <cost if wrong>` in the worklog, and continue. Stop only for what {{LAW:echo-the-intent}}, {{LAW:deletion-is-deliberate}} or {{DOCTRINE:consent-before-push}} names; every ruling goes in the final report ({{DOCTRINE:declare-the-judgment-calls}}). When the plan names a `Spec:`, the analyst reads it once; the spec outranks the plan.
-5. **Two execution shapes**, chosen by host capability (same pattern as the [workflow {{SKILL}}](workflow.md)):
-   - *Deterministic:* where the host exposes a `workflow` tool, run a saved script encoding analyst → developer → (tester ⇄ developer)×≤2 → fresh developer → proof.
-   - *Model-driven fallback:* everywhere else, run the same stages via the [parallel-agents {{SKILL}}](parallel-agents.md) or sequential personas, with the same handoff envelopes and the same delivery contract.
-6. On success, hand the worktree back to the parent uncommitted, with the mechanical proof (test + lint output, exit codes) and the list of files it changed in the result envelope, rebased on the current base so a conflict with a sibling resolves on the crew's branch. The pipeline never commits, pushes, or merges ({{DOCTRINE:consent-before-push}}): the parent records BASE before dispatch and, before re-running the proof, confirms the branch descends from it and the diff is non-empty (an empty diff is a failure; never `HEAD~1`); it re-runs the proof commands itself, shows the user the diff and the output, and commits and merges once the user accepts.
+1. Take the triage as given. Under foreman mode the task reached you because it met the mode's count; invoked directly, the user's request is the trigger. Do not weigh it again and fall back to doing the work yourself.
+2. **Dispatch the crew lead** in the background, using the host's general-purpose {{AGENT}}. Before dispatch, record BASE and set the crew's **write set**; check it against every other pipeline in flight ({{DOCTRINE:one-writer-per-file}}) — two crews whose sets overlap do not run at once. The brief carries: the task as the user stated it, the task type, BASE, the write set, the proof commands, a pointer to this {{SKILL}}, and the rule that it never commits, pushes or merges. Tell the user the pipeline is running, then go back to the user. Do not wait on the crew lead.
+3. **The crew lead composes the crew** from the floor above and adds any {{AGENT}} the task needs. It dispatches each crew member as its own subagent, each handed what the previous one produced. Where the crew lead holds no dispatch tool (see *Hosts* below), it plays each role in turn itself, with the same hand-offs and the same envelope. Steps 4 to 7 are the crew lead's, except where they name the parent.
+4. Isolate the crew's work in its own git worktree/branch. Where worktrees are unavailable, fall back to a single tree, one pipeline at a time, and say so. The crew writes only inside its write set; shared append files (registries, index tables, lockfiles, generated bundles) are the parent's to apply, never a crew's.
+5. **The dev↔tester loop:** the developer implements, the tester validates — runs the tests and lint, produces raw logs. On failure, the findings go back to the developer — two repair rounds at most, then one fresh developer (a higher model tier where the host offers one) carrying the tester's findings ({{DOCTRINE:bound-the-loop}}); if that fails too, stop, do not merge, and report the failure with the branch left in place for inspection. A conflict or ambiguity between the plan, the findings and the code is yours to decide: decide it, record `Ruling: <choice> — <why> — <cost if wrong>` in the worklog, and continue. Stop only for what {{LAW:echo-the-intent}}, {{LAW:deletion-is-deliberate}} or {{DOCTRINE:consent-before-push}} names; every ruling goes in the final report ({{DOCTRINE:declare-the-judgment-calls}}). When the plan names a `Spec:`, the analyst reads it once; the spec outranks the plan.
+6. **Pick the shape by host** (table below). Where the host offers a workflow tool the {{SKILL}} may use without a fresh opt-in, a saved script may stand in for the crew lead: analyst → developer → (tester ⇄ developer)×≤2 → fresh developer → proof ([workflow {{SKILL}}](workflow.md)). Everywhere else the crew lead runs the same stages, with the same hand-offs and the same delivery contract.
+7. On success, hand the worktree back to the parent uncommitted, with the mechanical proof (test + lint output, exit codes) and the list of files it changed in the result envelope, rebased on the current base so a conflict with a sibling resolves on the crew's branch. The pipeline never commits, pushes, or merges ({{DOCTRINE:consent-before-push}}): the parent records BASE before dispatch and, before re-running the proof, confirms the branch descends from it and the diff is non-empty (an empty diff is a failure; never `HEAD~1`); it re-runs the proof commands itself, shows the user the diff and the output, and commits and merges once the user accepts.
+
+## Hosts
+
+| Host | Crew lead runs in the background | Crew lead can dispatch the crew | Shape |
+|---|---|---|---|
+| Claude Code | yes — a subagent started from the main conversation runs in the background by default | yes — subagents nest up to three layers by default (`CLAUDE_CODE_MAX_SUBAGENT_SPAWN_DEPTH`), and a background subagent keeps the `Agent` tool | crew lead → crew subagents. Not the `Workflow` tool: it refuses without the user's opt-in for that task, and the mode is not one |
+| OpenCode | the `task` tool starts a child session; whether the parent's turn waits is unverified | unverified — `permission.task` decides which subagents an agent may start | crew lead → crew subagents where it holds `task`; else roles in turn. A saved `workflow` script (no opt-in needed) may stand in for the crew lead |
+| OpenClaude | expected as Claude Code (it reads Claude's subagent dialect); unverified | unverified | as Claude Code; else roles in turn |
+| Bob | unverified — Bob reads Claude's subagent dialect | unverified | crew lead plays the roles in turn |
+
+Check, do not assume: before the first pipeline of a session on a host marked unverified, look at the tools you and the crew lead actually hold ({{DOCTRINE:tool-discovery}}). When a fact above proves wrong, report it through this {{SKILL}}'s self-improvement loop.
 
 ## Delivery contract
 

package/themes/_TEMPLATE.json

@@ -122,6 +122,7 @@
   "DOC_CODES_THAT_PERSIST": "<themed title for the comms rule Codes That Persist>",
   "DOC_STRUCTURE_BESIDE_PROSE": "<themed title for the comms rule Structure Beside Prose>",
   "DOC_DECLARE_THE_JUDGMENT_CALLS": "<themed title for the comms rule Declare the Judgment Calls>",
+  "DOC_SIMPLIFIED_TECHNICAL_ENGLISH": "<themed title for the comms rule Simplified Technical English>",
   "INTRO_DOC": "<themed intro: this file is the entry point an AI agent reads in this repo>",
   "INTRO_AGENTS": "<themed intro to the Agents section — delegate focused work to a specialist>",
   "INTRO_SKILLS": "<themed intro to the Skills section — run the written procedure before improvising>",

package/themes/biker.json

@@ -122,6 +122,7 @@
   "DOC_CODES_THAT_PERSIST": "Tag Every Part on the Bench · Codes That Persist",
   "DOC_STRUCTURE_BESIDE_PROSE": "Draw the Route Only If It Turns · Structure Beside Prose",
   "DOC_DECLARE_THE_JUDGMENT_CALLS": "Own Up to Every Back Road Taken · Declare the Judgment Calls",
+  "DOC_SIMPLIFIED_TECHNICAL_ENGLISH": "Short Words, Clear Signals · Simplified Technical English",
   "INTRO_DOC": "This file is the route briefing a coding rider reads when it joins this repository.",
   "INTRO_AGENTS": "Send the right rider for focused work instead of riding the whole run yourself; each has one job and reports exactly what it did.",
   "INTRO_SKILLS": "A Skill is a move you've drilled for a recurring task. Run the matching move before you wing it.",