geneseed 4.2.0 → 4.3.1

package/CHANGELOG.md

@@ -8,6 +8,30 @@ label. For the capability ↔ spec map, see [SHIPPED.md](SHIPPED.md).
 
 ## [Unreleased]
 
+## [4.3.1] — 2026-10-15
+
+Patch: a folder excluded from the global harness now stays excluded in its git worktrees.
+
+### Upgrade notes
+- Run `geneseed rebuild-all` once after updating so installed hooks and OpenCode plugins carry the fix.
+- On Claude Code and OpenClaude, a worktree still loads the global `CLAUDE.md` until you commit the `claudeMdExcludes` snippet that `geneseed exclude list` prints into the repo's tracked settings file.
+
+### Fixed
+- **Exclusions cover git worktrees.** A session in a linked worktree of an excluded repo (`git worktree add`, or a tool that keeps worktrees elsewhere on disk) got the whole global harness, because the bypass only matched the working directory's path. The hooks and the three OpenCode plugins now follow the worktree's `.git` file back to the main repository, reading files only. `exclude add` and `exclude list` warn that `settings.local.json` never reaches a worktree and print the snippet to commit; Geneseed writes no tracked file. (#280)
+
+## [4.3.0] — 2026-10-15
+
+Minor: a performance agent, and Deletion Is Deliberate says what counts as recoverable.
+
+### Upgrade notes
+- Run `geneseed rebuild-all` once after updating so installed harnesses carry the new agent and the amended law.
+
+### Added
+- **performance agent.** Measures where time is spent before it names a bottleneck, and answers "cannot measure" rather than guess. Read-only with a shell, so it can run benchmarks and profilers; it reports and leaves the fix to the developer. Dispatched on a reported slowdown, a change on a hot path, or as a council seat. Registered as experimental.
+
+### Changed
+- **Deletion Is Deliberate** defines recoverable: deleting work committed and pushed to a branch runs freely; deleting uncommitted, unpushed or untracked work asks. History-rewriting git verbs (force-push, `reset --hard`, `clean -f`) stay gated.
+
 ## [4.2.0] — 2026-10-14
 
 Minor: the web console's Overview becomes a control panel over every installed harness, rebuild, prune and uninstall keep owned files you edited, and skill and subagent calls are counted.

package/README.md

@@ -12,7 +12,7 @@
 [![zero dependencies](https://img.shields.io/badge/deps-zero-success)](package.json)
 [![Themes](https://img.shields.io/badge/themes-14-9cf)](themes/)
 [![Skills](https://img.shields.io/badge/skills-46-blueviolet)](src/skills/)
-[![Agents](https://img.shields.io/badge/agents-18-orange)](src/agents/)
+[![Agents](https://img.shields.io/badge/agents-19-orange)](src/agents/)
 [![Laws and doctrines](https://img.shields.io/badge/laws-9%20%2B%2029%20doctrines-critical)](src/doctrines/)
 [![Plugins](https://img.shields.io/badge/plugins-7-teal)](adapters/opencode/plugins/)
 [![OpenCode · Claude Code · Bob · OpenClaude · AGENT.md](https://img.shields.io/badge/works%20with-OpenCode%20·%20Claude%20Code%20·%20Bob%20·%20OpenClaude%20·%20AGENT.md-1f6feb)](#-supported-harnesses)
@@ -178,7 +178,7 @@ The harness ships as a small set of layers, and the web console's rail is the sa
 | **🧭 Ethos** (`ontology/`) | the mind the rules govern, in four prose sections — **Telos** (the Pact: three ranked laws — protect the user, serve their intent, keep your own honesty), **Evidence** (every claim graded by how it was obtained), **Decisions** (classify and tier by reversibility, show the real forks), **Conduct** (answer what was asked, once). Always in force, never toggleable |
 | **🛡️ Rules** (`laws/`) | 9 universal laws — always in force, never toggleable: sealed-secrets, one-intent-one-act, verify-before-asserting, deletion-is-deliberate, surface-failures, data-not-orders, least-privilege, cure-the-cause, echo-the-intent. Each rule has a permanent id; its number is only its position, and the harness cites rules by name |
 | **📐 Doctrines** (`doctrines/`) | practice packs, chosen per install at build time: **craft** (how code is written), **rigor** (how work is proven), **ops** (how the machine is operated), **process** (how a task is run), **comms** (how answers are presented). A doctrine rule may tighten a Rule, never repeal one, and the user's own `user-rules.md` outranks it. Pick with `geneseed-build --doctrines craft,rigor` (or `none`), a single rule with `--exclude-rules "process 7"`, in the setup wizard, or through the switches on the console's Constitution page; all five pack files ship on disk either way, so a citation into a pack you left out still resolves |
-| **🤖 Agents** (18) | capability specialists: `reviewer`, `tester`, `architect`, `docs`, `security`, `explorer`, `researcher`, `developer` — plus a debate **council** the `council` skill convenes: `advocate`, `skeptic`, `pragmatist`, `steward`, `visionary`, `user-advocate`, `framer`, `empiricist`, `operator`, `historian` |
+| **🤖 Agents** (19) | capability specialists: `reviewer`, `tester`, `architect`, `docs`, `security`, `performance`, `explorer`, `researcher`, `developer` — plus a debate **council** the `council` skill convenes: `advocate`, `skeptic`, `pragmatist`, `steward`, `visionary`, `user-advocate`, `framer`, `empiricist`, `operator`, `historian` |
 | **🛠 Skills** (46) | repeatable workflows: brainstorm · plan · **codebase-design** · **wayfinder** · **develop** · **worktree** · debug · **prototype** · refactor · **ponytail** · **forge-mcp** · **bruno** · geneseed-code-review · **fresh-eyes** · **security-audit** · **dependencies** · **review-response** · commit · **ship** · **release** · **git-history** · document-project · **frontend-design** · **prose** · **ingest** · **research** · **teach** · **quiz** · **learn-mode** · handoff · roast-me · **council** · parallel-agents · **workflow** · **wiki** · **geneseed** · **rule** · **profile** · **skill-forge** · **pipeline** · **loop** · **brick-forge** · **daydream** · **react-view-transitions** · **token-report** · **explain-changes** |
 | **🔌 Plugins** (OpenCode) | `geneseed-context` injects project docs *and your machine wiki* every session (and across compaction); `geneseed-learn` distils memory at session end; `geneseed-guard` enforces the safety Laws and protected wiki folders at the tool boundary; `geneseed-workflow` registers the `workflow` tool that runs saved orchestration scripts; `geneseed-notify` sends a native OS notification when a long run finishes; `geneseed-ponytail` holds a minimal-code mode (`/ponytail lite\|full\|ultra\|off`), opt-in, injecting the laziest-that-works ruleset every turn so it doesn't drift; `geneseed-activity` streams what each session is doing to the web console's Activity view |
 | **🧠 Memory** (`memory/`) | one-fact-per-file durable knowledge, indexed by `MEMORY.md` (git-ignored, personal) |

package/SHIPPED.md

@@ -20,7 +20,7 @@ historical references, not files distributed with the repo.
 > **On version numbers.** [`harness.config.json`](harness.config.json)'s `version` is a
 > human-readable label only. The canonical identity of an installed harness is the
 > **source fingerprint** stamped in `.geneseed-version` (see `geneseed version`), not the
-> string. Current label: **4.2.0**.
+> string. Current label: **4.3.1**.
 
 ## Capabilities
 
@@ -29,7 +29,7 @@ Every row below is present in the tree today; "Spec" names the design record.
 | Capability | What it is | Spec |
 | --- | --- | --- |
 | **Themed generator** | One neutral `src/` → 14 themed bundles via `geneseed-build` (zero dependencies); structure stays theme-independent | [DESIGN.md](DESIGN.md) |
-| **Laws / Agents / Skills / Memory / Notebook** | 9 laws, 18 agents, 46 skills, the memory convention, and the agent's sovereign notebook | `2026-06-11-notebook-sovereign-space` · `2026-06-10-notebook-agent-own-space` |
+| **Laws / Agents / Skills / Memory / Notebook** | 9 laws, 19 agents, 46 skills, the memory convention, and the agent's sovereign notebook | `2026-06-11-notebook-sovereign-space` · `2026-06-10-notebook-agent-own-space` |
 | **Three-tier constitution** | The governance surface splits into an always-on **Ontology** (Telos, Evidence, Decisions, Conduct — the Pact absorbed into Telos), the nine always-on **Invariants**, and five toggleable **Doctrine** packs (craft, rigor, ops, process, comms) addressed `<pack> <n>`. Every rule carries a permanent id; its number is its position, computed at render time, and a citation renders as the rule's principle name. Packs are chosen at build time with `--doctrines` or the setup wizard; the whole catalogue ships on disk either way, so a citation into an inactive pack still resolves. Precedence, in order: Ontology + Invariants, then the user's `user-rules.md`, then the active Doctrines, then `PROFILE.md`. `doctor`'s `constitutionProblems` gates rule ids (declared, unique, never a retired one), the per-rule Principle column, every `{{LAW:<id>}}` / `{{DOCTRINE:<id>}}` citation in `src/`, and the rule that an always-on tier may never cite a toggleable one | `2026-08-19-three-tier-constitution-design` |
 | **`doctor`** | One check: unresolved tokens, dead/non-hermetic links, theme-key parity, authoring gates, rendered-bundle drift | `2026-06-07-theme-aware-doctor-diff` |
 | **`diff` + improvements export** | Deployed-vs-source drift report; export an `improvements.md` back-port | `2026-06-12-improvements-export` |

package/adapters/opencode/plugins/geneseed-context.js

@@ -85,17 +85,41 @@ const norm = (p) => {
   }
   return process.platform === "win32" ? s.toLowerCase() : s
 }
+// A linked git worktree of an excluded repo is excluded too, wherever it sits on disk — twin of
+// js/hosts/gitref.mjs `mainWorktreeOf`: the worktree's `.git` FILE names its gitdir, whose
+// `commondir` names the shared `.git`; that directory's parent is the main worktree. null for
+// a main worktree, a submodule, a bare repo's worktree, or anything malformed.
+async function mainWorktreeOf(dir) {
+  try {
+    let root = path.resolve(dir)
+    for (;;) {
+      try { await fs.stat(path.join(root, ".git")); break } catch { /* walk up */ }
+      const up = path.dirname(root)
+      if (up === root) return null
+      root = up
+    }
+    const dotgit = path.join(root, ".git")
+    if (!(await fs.stat(dotgit)).isFile()) return null
+    const m = /^gitdir:\s*(.+?)\s*$/m.exec(await fs.readFile(dotgit, "utf8"))
+    if (!m) return null
+    const gitdir = path.resolve(root, m[1])
+    const common = path.resolve(gitdir, (await fs.readFile(path.join(gitdir, "commondir"), "utf8")).trim())
+    return path.basename(common) === ".git" ? path.dirname(common) : null
+  } catch { return null }
+}
 async function sovereignBypass(cwd) {
   try {
     const cfg = path.dirname(PLUGIN_DIR)           // plugins/ sits directly in <cfg>
     const raw = await fs.readFile(path.join(cfg, "excludes.json"), "utf8")
     const entries = (JSON.parse(raw).excludes) || []
     const here = norm(cwd || process.cwd())
+    const main = await mainWorktreeOf(cwd || process.cwd())
+    const heres = main ? [here, norm(main)] : [here]
     for (const e of entries) {
       const p = typeof e === "string" ? e : e && e.path
       if (typeof p !== "string" || !p.trim()) continue
       const base = norm(p.trim()).replace(/[\\/]+$/, "")
-      if (here === base || here.startsWith(base + path.sep)) return true
+      if (heres.some((h) => h === base || h.startsWith(base + path.sep))) return true
     }
   } catch { /* degrade to active */ }
   return false

package/adapters/opencode/plugins/geneseed-guard.js

@@ -72,17 +72,41 @@ const norm = (p) => {
   }
   return process.platform === "win32" ? s.toLowerCase() : s
 }
+// A linked git worktree of an excluded repo is excluded too, wherever it sits on disk — twin of
+// js/hosts/gitref.mjs `mainWorktreeOf`: the worktree's `.git` FILE names its gitdir, whose
+// `commondir` names the shared `.git`; that directory's parent is the main worktree. null for
+// a main worktree, a submodule, a bare repo's worktree, or anything malformed.
+async function mainWorktreeOf(dir) {
+  try {
+    let root = path.resolve(dir)
+    for (;;) {
+      try { await fs.stat(path.join(root, ".git")); break } catch { /* walk up */ }
+      const up = path.dirname(root)
+      if (up === root) return null
+      root = up
+    }
+    const dotgit = path.join(root, ".git")
+    if (!(await fs.stat(dotgit)).isFile()) return null
+    const m = /^gitdir:\s*(.+?)\s*$/m.exec(await fs.readFile(dotgit, "utf8"))
+    if (!m) return null
+    const gitdir = path.resolve(root, m[1])
+    const common = path.resolve(gitdir, (await fs.readFile(path.join(gitdir, "commondir"), "utf8")).trim())
+    return path.basename(common) === ".git" ? path.dirname(common) : null
+  } catch { return null }
+}
 async function sovereignBypass(cwd) {
   try {
     const cfg = path.dirname(PLUGIN_DIR)           // plugins/ sits directly in <cfg>
     const raw = await fs.readFile(path.join(cfg, "excludes.json"), "utf8")
     const entries = (JSON.parse(raw).excludes) || []
     const here = norm(cwd || process.cwd())
+    const main = await mainWorktreeOf(cwd || process.cwd())
+    const heres = main ? [here, norm(main)] : [here]
     for (const e of entries) {
       const p = typeof e === "string" ? e : e && e.path
       if (typeof p !== "string" || !p.trim()) continue
       const base = norm(p.trim()).replace(/[\\/]+$/, "")
-      if (here === base || here.startsWith(base + path.sep)) return true
+      if (heres.some((h) => h === base || h.startsWith(base + path.sep))) return true
     }
   } catch { /* degrade to active */ }
   return false

package/adapters/opencode/plugins/geneseed-learn.js

@@ -67,17 +67,41 @@ const norm = (p) => {
   }
   return process.platform === "win32" ? s.toLowerCase() : s
 }
+// A linked git worktree of an excluded repo is excluded too, wherever it sits on disk — twin of
+// js/hosts/gitref.mjs `mainWorktreeOf`: the worktree's `.git` FILE names its gitdir, whose
+// `commondir` names the shared `.git`; that directory's parent is the main worktree. null for
+// a main worktree, a submodule, a bare repo's worktree, or anything malformed.
+async function mainWorktreeOf(dir) {
+  try {
+    let root = path.resolve(dir)
+    for (;;) {
+      try { await fs.stat(path.join(root, ".git")); break } catch { /* walk up */ }
+      const up = path.dirname(root)
+      if (up === root) return null
+      root = up
+    }
+    const dotgit = path.join(root, ".git")
+    if (!(await fs.stat(dotgit)).isFile()) return null
+    const m = /^gitdir:\s*(.+?)\s*$/m.exec(await fs.readFile(dotgit, "utf8"))
+    if (!m) return null
+    const gitdir = path.resolve(root, m[1])
+    const common = path.resolve(gitdir, (await fs.readFile(path.join(gitdir, "commondir"), "utf8")).trim())
+    return path.basename(common) === ".git" ? path.dirname(common) : null
+  } catch { return null }
+}
 async function sovereignBypass(cwd) {
   try {
     const cfg = path.dirname(PLUGIN_DIR)           // plugins/ sits directly in <cfg>
     const raw = await fs.readFile(path.join(cfg, "excludes.json"), "utf8")
     const entries = (JSON.parse(raw).excludes) || []
     const here = norm(cwd || process.cwd())
+    const main = await mainWorktreeOf(cwd || process.cwd())
+    const heres = main ? [here, norm(main)] : [here]
     for (const e of entries) {
       const p = typeof e === "string" ? e : e && e.path
       if (typeof p !== "string" || !p.trim()) continue
       const base = norm(p.trim()).replace(/[\\/]+$/, "")
-      if (here === base || here.startsWith(base + path.sep)) return true
+      if (heres.some((h) => h === base || h.startsWith(base + path.sep))) return true
     }
   } catch { /* degrade to active */ }
   return false

package/docs/concepts/agents.md

@@ -24,6 +24,7 @@ An **agent** is a specialist the main session can hand a piece of work to. Each
 | `tester` | writes, runs and diagnoses tests |
 | `reviewer` | reviews a change for correctness and quality before it merges |
 | `security` | audits changes that touch the security surface |
+| `performance` | measures where time and memory go, names the bottleneck with numbers, proposes the fix |
 | `docs` | writes and updates user-facing documentation after code lands |
 
 ### The council

package/docs/concepts/exclusions.md

@@ -42,6 +42,8 @@ What "dormant" means per host:
 
 `geneseed exclude remove` undoes all of it.
 
+**Git worktrees.** A linked worktree of an excluded repo (`git worktree add`) is excluded too, wherever it sits on disk: the hooks and plugins follow its `.git` file back to the main repository. The global `CLAUDE.md` is the exception on Claude Code and OpenClaude: `settings.local.json` is gitignored, so a worktree never gets it. Geneseed writes no tracked file in a repo you told it to leave alone, so `exclude add` and `exclude list` print the snippet to commit yourself in the repo's tracked `.claude/settings.json` (`.openclaude/` for OpenClaude): `"claudeMdExcludes": ["<path to the global CLAUDE.md>"]`.
+
 **Limits.** Globally installed skills and agents stay *listed* by the host — no host offers a per-repo switch for them. And a global install created *after* you added exclusions starts with an empty list: run `geneseed exclude add` again (`geneseed exclude list` flags installs whose lists differ).
 
 The web console has the same controls in the **Excluded folders** card on the Harness page, shown once a global install exists.

package/docs/concepts/host-matrix.md

@@ -19,7 +19,7 @@ Every [host](hosts.md) gets the same content. This table is what each one lets G
 | Consent before every commit and push | 🔒 permission ask | 🪝 ask | 🪝 warning¹ | 🪝 ask² |
 | Rule-or-memory write needs your call | ⚙️ speed bump³ | 🪝 ask | 🪝 warning¹ | 🪝 ask² |
 | User-only skills hidden from the model | 🔒 `permission.skill` deny | ✅ `disable-model-invocation` | ✅ `/`-command, no skill | ✅ `disable-model-invocation` |
-| Sovereign-repo exclusions | ⚙️ plugins stand down | ✅ `claudeMdExcludes` | ✅ rules shadow stub | ✅ `claudeMdExcludes` |
+| Sovereign-repo exclusions⁵ | ⚙️ plugins stand down | ✅ `claudeMdExcludes` | ✅ rules shadow stub | ✅ `claudeMdExcludes` |
 | MCP server wiring | ✅ `mcp` | ✅ `mcpServers` | ✅ `mcp.json` | ✅ `mcpServers` |
 | Colour themes · LSP · workflow runner · primary agent · `/`-commands | ✅ | ➖ | ➖ | ➖ |
 
@@ -29,6 +29,7 @@ Every [host](hosts.md) gets the same content. This table is what each one lets G
 ² **OpenClaude** is a Claude Code fork and gets Claude's hooks and verdicts verbatim, in `~/.openclaude/settings.json` (global) or `.openclaude/settings.local.json` (per repo). **Unverified live** for the same reason.
 ³ OpenCode's plugin hook can only allow or throw — there is no "ask the user" — so this check stops the first such write once rather than prompting.
 ⁴ The checks differ in shape: OpenCode's guard plugin blocks writes *to* private-key and credential files by path; the Claude-shaped hook looks at the *content* being written for credential-shaped strings (cloud keys, tokens, private-key blocks) and asks. A `.env` file is exempt on the hook side — that is where a secret is allowed to live.
+⁵ A linked git worktree of an excluded repo is excluded too: the hooks and plugins follow its `.git` file back to the main repository. `claudeMdExcludes` is the exception — it lives in the gitignored `settings.local.json`, which a worktree never gets — so `geneseed exclude add` and `exclude list` print the snippet to commit yourself. See [Exclusions](exclusions.md).
 
 ## The one conditional row
 

package/docs/reference/opencode-plugins.md

@@ -35,4 +35,4 @@ If a plugin seems silent on OpenCode 2, check that `~/.config/opencode/plugins/`
 
 ## Excluded folders
 
-`geneseed-context`, `geneseed-guard` and `geneseed-learn` go dormant inside a folder listed in the global install's `excludes.json` (managed by `geneseed exclude`). See [Exclusions](../concepts/exclusions.md).
+`geneseed-context`, `geneseed-guard` and `geneseed-learn` go dormant inside a folder listed in the global install's `excludes.json` (managed by `geneseed exclude`), and inside any linked git worktree of such a folder. See [Exclusions](../concepts/exclusions.md).

package/harness.config.json

@@ -2,5 +2,5 @@
   "_comment": "version is a human-readable release label only; the canonical identity of an installed harness is the source fingerprint stamped in .geneseed-version (see `harness version`), not this string.",
   "theme": "neutral",
   "product": "Geneseed",
-  "version": "4.2.0"
+  "version": "4.3.1"
 }

package/js/hosts/gitref.mjs

@@ -6,7 +6,7 @@
  * launched-loop evidence reader were duplicated in `js/hosts/hooks.mjs` (the hook's
  * `loopExempt`) and `js/loop/cli.mjs` (the CLI's commit-message writer) — two copies of the
  * same worktree-following walk that could silently drift apart. Both now import this one.
- * `js/hosts/hooks.mjs` is NOT a safe shared home for it: it pulls in `node:child_process`
+ * `js/hosts/hooks.mjs` is NOT a safe shared home for it: it pulls in `child_process`
  * (`spawnSync`, for the destructive-act guard's own concerns) and the hook-dispatch
  * machinery (`jsonDumpsCompact`, the ledger), none of which `js/loop/cli.mjs` — under a hard
  * `child_process` ban like every other closure that feeds `bin/geneseed-cli.mjs` — may ever
@@ -54,6 +54,30 @@ export function gitDirOf(root) {
   return dotgit;
 }
 
+/**
+ * The MAIN worktree's root when `cwd` stands in a LINKED worktree (`git worktree add`), else
+ * null — a main worktree, a submodule (its gitdir has no `commondir`), a bare repository's
+ * worktree, no repo, or a malformed link. Never throws.
+ *
+ * WHY: a linked worktree can live anywhere on disk (Orca puts them under its own workspaces
+ * folder), so a path-prefix test against the repo the user EXCLUDED never matches it, and the
+ * global harness woke up inside a sovereign repo's worktree. The worktree's `.git` FILE names
+ * `<common>/.git/worktrees/<n>`, whose `commondir` (relative to it, usually `../..`) names the
+ * shared `.git`; that directory's parent is the main worktree. Read off disk, never by
+ * spawning git: `sovereignBypass` runs on every hook call and feeds the CLI's `child_process` ban.
+ */
+export function mainWorktreeOf(cwd) {
+  try {
+    const root = gitRootOf(cwd);
+    if (!root || !statSync(path.join(root, '.git')).isFile()) return null;
+    const gitdir = gitDirOf(root);
+    const common = path.resolve(gitdir, readFileSync(path.join(gitdir, 'commondir'), 'utf8').trim());
+    return path.basename(common) === '.git' ? path.dirname(common) : null;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * The branch checked out in `cwd`, read from .git/HEAD without spawning git. null on
  * anything unexpected (detached HEAD, no repo, a malformed worktree link, unreadable) — the

package/js/hosts/hosts.mjs

@@ -19,6 +19,7 @@ import path from 'node:path';
 import os from 'node:os';
 import { printErr, withDiscardableStderr, isDir, isFile, readText } from '../lib/fs.mjs';
 import { toPlatformPath, normcase } from '../lib/paths.mjs';
+import { mainWorktreeOf } from './gitref.mjs';
 
 /** `_build_global.GLOBAL_MANIFEST` — the file whose presence means "a global install". */
 export const GLOBAL_MANIFEST = '.geneseed-manifest.json';
@@ -39,6 +40,11 @@ export const GATE_LEDGER = path.join('notebook', 'gates.jsonl');
  * under the transitive `child_process` ban that `hooks.mjs`'s `learn` verb breaks). A
  * second copy in `js/inspect/` was the alternative, and a copy is what let the `~user`
  * refusal diverge between the two CLIs once already (see `hooks.mjs`'s header).
+ *
+ * A LINKED GIT WORKTREE OF AN EXCLUDED REPO IS EXCLUDED TOO, wherever it sits on disk: the
+ * cwd matches, or the main worktree `mainWorktreeOf` reads off the `.git` file does. An
+ * exclusion names a repository the user keeps sovereign, not a folder; a worktree elsewhere
+ * (Orca's workspaces) otherwise woke the full global harness inside it.
  */
 export function sovereignBypass(root) {
   if (!root) return false;
@@ -49,12 +55,16 @@ export function sovereignBypass(root) {
   } catch {
     return false;
   }
-  let cwd;
+  let heres;
   try {
-    cwd = normcase(resolvePath(process.cwd()));
+    heres = [normcase(resolvePath(process.cwd()))];
   } catch {
     return false;
   }
+  try {
+    const main = mainWorktreeOf(process.cwd());
+    if (main) heres.push(normcase(resolvePath(main)));
+  } catch { /* an unresolvable main worktree degrades to the cwd test alone */ }
   for (const entry of entries) {
     const raw = (entry && typeof entry === 'object' ? entry.path : entry) || '';
     if (typeof raw !== 'string' || !raw.trim()) continue;
@@ -67,7 +77,7 @@ export function sovereignBypass(root) {
       // and this caller catches: the reference prints nothing here, so replaying the
       // message would be a stderr divergence on every hook call for one bad entry.
       //
-      // `resolvePath`, the same resolution as `cwd` above: symlinks and junctions are followed on
+      // `resolvePath`, the same resolution as `heres` above: symlinks and junctions are followed on
       // BOTH sides, so an entry spelled through a link matches the real directory the session
       // stands in (and the OpenCode plugins' `norm` applies the identical rule).
       base = withDiscardableStderr(
@@ -79,7 +89,7 @@ export function sovereignBypass(root) {
       // Skipping errs toward the gate staying ACTIVE, which is the safe direction.
       continue;
     }
-    if (cwd === base || cwd.startsWith(base + path.sep)) return true;
+    if (heres.some((h) => h === base || h.startsWith(base + path.sep))) return true;
   }
   return false;
 }

package/js/inspect/excludes.mjs

@@ -32,6 +32,28 @@ import { normcase, toPlatformPath } from '../lib/paths.mjs';
 const localSettings = (repo, host) =>
   path.join(repo, HOSTS.find((h) => h.host === host).projectMarker, 'settings.local.json');
 
+/** The `claudeMdExcludes` entry naming a Claude-family global install's CLAUDE.md, as wired. */
+const claudeMdEntry = (cfg) => resolvePath(path.join(cfg, 'CLAUDE.md')).split(path.sep).join('/');
+
+/**
+ * The worktree caveat, or null when it does not apply: a Claude-family install and an
+ * excluded folder that is a git repository (a `.git` there — no repo, no worktrees).
+ *
+ * WHY A WARNING AND NOT A WRITE: `settings.local.json` is gitignored, so a `git worktree add`
+ * of the excluded repo never carries it and the global CLAUDE.md loads there again (the hooks
+ * do stand down — `sovereignBypass` follows the worktree to its main repo). The one durable
+ * fix is the repo's TRACKED `settings.json`, and the user decided (2026-10) Geneseed never
+ * writes a tracked file in a repo it was told to leave alone — so it prints the snippet.
+ */
+function worktreeNote(host, cfg, repo) {
+  if (host !== 'claude' && host !== 'openclaude') return null;
+  if (!existsSync(path.join(repo, '.git'))) return null;
+  const marker = HOSTS.find((h) => h.host === host).projectMarker;
+  return `${host}: git worktrees of this repo do not get the gitignored `
+    + `${marker}/settings.local.json and still load the global CLAUDE.md — to stop that, commit `
+    + `to the repo's ${marker}/settings.json: "claudeMdExcludes": ["${claudeMdEntry(cfg)}"]`;
+}
+
 /** `_global_installs` — every host whose GLOBAL config dir carries a Geneseed manifest. */
 function globalInstalls() {
   const out = [];
@@ -112,8 +134,7 @@ export function excludeAdd(target) {
     const priorWired = (isDict(prior) ? get(prior, 'wired') : null) || {};
     const wired = {};
     if ((host === 'claude' || host === 'openclaude') && isDir(repo)) {
-      const entry = resolvePath(path.join(cfg, 'CLAUDE.md')).split(path.sep).join('/');
-      const added = wireClaudeExcludes(localSettings(repo, host), [entry]);
+      const added = wireClaudeExcludes(localSettings(repo, host), [claudeMdEntry(cfg)]);
       if (added.length) {
         wired.claude_md_excludes = added;
       } else if (get(priorWired, 'claude_md_excludes')) {
@@ -126,6 +147,8 @@ export function excludeAdd(target) {
       // own project-bypasses-global wiring, or a bailed write) — do NOT fabricate ownership,
       // or a later excludeRemove would strip wiring we never created.
       if (!added.length) messages.push(`${host}: claudeMdExcludes already present (kept)`);
+      const note = worktreeNote(host, cfg, repo);
+      if (note) messages.push(note);
     }
     if (host === 'bob' && isDir(repo)) {
       const stub = path.join(repo, '.bob', 'rules', 'geneseed.md');
@@ -249,6 +272,14 @@ export function cmdExclude(args) {
       const flag = missing.length
         ? `  (MISSING from: ${missing.join(', ')} — re-run \`geneseed exclude add\`)` : '';
       printOut(`  ${rec.path}  [${rec.hosts.slice().sort().join(', ')}]${flag}\n`);
+      for (const { host, cfg } of snap.installs) {
+        if (!rec.hosts.includes(host)) continue;
+        let note = null;
+        try {
+          note = worktreeNote(host, cfg, toPlatformPath(rec.path));
+        } catch { /* a broken resolver: the listing itself must still print */ }
+        if (note) printOut(`    note: ${note}\n`);
+      }
     }
     return 0;
   }

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "Every field here is argued and gated in tests/unit/package_manifest.test.mjs. `files`, `bin` and `engines` each have a test that fails when reality drifts from this file; `version` mirrors harness.config.json and is gated too. Read that docblock before editing this one.",
   "name": "geneseed",
-  "version": "4.2.0",
+  "version": "4.3.1",
   "description": "A portable, theme-able harness you implant once and use everywhere to grow a disciplined AI coding agent.",
   "keywords": [
     "ai",

package/registry.json

@@ -85,6 +85,13 @@
       "added": "2026-06-01",
       "last_verified": ""
     },
+    "agents/performance": {
+      "status": "experimental",
+      "version": "1.0.0",
+      "owner": "Guillaume Lemer",
+      "added": "2026-10-14",
+      "last_verified": ""
+    },
     "agents/security": {
       "status": "approved",
       "version": "1.0.0",

package/src/AGENT.md.tmpl

@@ -163,6 +163,7 @@ Active packs: {{DOCTRINES_LIST}}{{EXCLUDED_RULES_LINE}}
 | [architect]({{DIR_AGENTS}}/architect.md) | a task needs a design/plan before any code is written |
 | [docs]({{DIR_AGENTS}}/docs.md) | code is done and user-facing docs/READMEs must follow |
 | [security]({{DIR_AGENTS}}/security.md) | a change touches auth, input handling, secrets, or dependencies — or anything outward-facing is about to ship |
+| [performance]({{DIR_AGENTS}}/performance.md) | something is reported slow or heavy, or a diff touches a hot path — measured, never guessed |
 | [explorer]({{DIR_AGENTS}}/explorer.md) | you must sweep many files for an answer but only want the conclusion |
 | [researcher]({{DIR_AGENTS}}/researcher.md) | a question needs the open web — fetched, cross-checked, and returned as sourced findings, not pages |
 | [advocate]({{DIR_AGENTS}}/advocate.md) | a council debate needs the strongest case **for** the motion argued in isolation |

package/src/agents/performance.md

@@ -0,0 +1,72 @@
+# {{AGENT}}: performance
+
+> {{DESC_PERFORMANCE}}
+
+## When to dispatch
+- The user reports something slow, heavy or timing out — a latency, throughput,
+  memory or startup complaint, or a regression against an earlier version.
+- A diff touches a hot path: a loop over unbounded data, a query inside a loop,
+  synchronous I/O on a request or render path, startup, or code run on every call.
+- A council debate turns on a performance trade-off and needs one seat that
+  speaks only from measurements.
+
+## When NOT to dispatch
+- No one has measured anything and nothing is slow — speculative tuning is the
+  waste this {{AGENT}} exists to refuse.
+- The code is wrong, not slow — that is the debug {{SKILL}}.
+
+## Inputs
+- The symptom or the diff, the workload it runs under (data size, call rate,
+  environment), and the command that reproduces it, if known.
+
+## Allowed tools
+- **Read-only.** May run the code, benchmarks and profilers to measure. Reports;
+  does not patch — the fix goes to the [developer](developer.md).
+<!-- bash: allow -->
+
+## Procedure
+0. If `{{DIR_MEMORY}}/agents/<your-name>.md` exists, read it first — your durable lessons from prior dispatches ({{DOCTRINE:persist-insight}}).
+1. Pin the question: which metric (wall time, p95 latency, peak memory, allocations,
+   query count), under which workload, and what number would count as fixed.
+2. Take a baseline with the project's own tooling where it has some, run several
+   times, and report the spread — one run is an anecdote ({{LAW:verify-before-asserting}}).
+3. Profile before naming a cause: a CPU or memory profile, a query log, a flame
+   graph, or timing at each layer boundary to find which layer owns the time.
+4. Name the bottleneck with its share of the total. A cost under a few percent is
+   not the bottleneck, however ugly the code.
+5. For a diff, check the usual shapes against the real data size: work inside a
+   loop that belongs outside it, N+1 queries, quadratic scans, unbounded caches or
+   buffers, blocking I/O on a hot path, repeated parsing or allocation.
+6. Propose the smallest fix that removes the measured cost, with the expected gain
+   and how to re-measure it; when a fix was tried, report before/after on the same
+   workload.
+
+## Output contract
+- Findings as `metric — location — measured cost — proposed fix — expected gain`,
+  largest cost first, each with the command that produced its number. End with:
+  within budget / fix-recommended / cannot-measure.
+- If the code could not be run, the workload is unknown, or the measurements are
+  noisier than the effect, report `cannot-measure` and what is missing — a
+  bottleneck named without a measurement is the one finding this {{AGENT}} must
+  never return.
+
+## Pipeline role
+
+*(Ignored outside pipelines — this section only tells pipeline orchestration who
+to recruit; it changes nothing about how this {{AGENT}} behaves when dispatched
+independently.)*
+
+- **Seat(s):** specialist add-on — recruited above the floor when the task is a
+  performance complaint or the diff touches a hot path.
+- **Receives:** the crew's diff, the workload, and the reproduce command.
+- **Delivers:** measured findings and a verdict, same shape as its own output
+  contract above.
+
+## Self-improvement
+
+If this spec misled you — an input you needed but were not given, a boundary
+that proved wrong, a step you could not execute — end your report with one line:
+`spec-feedback: <what failed — the one-line fix>`. Omit it when there is no
+friction. The caller weighs the feedback, folds a real flaw back into this file
+with the user's assent, and records it to {{MEMORY}} only if it clears
+{{DOCTRINE:persist-insight}}'s bar — most reports carry no feedback at all.

package/src/laws/universal.md

@@ -75,16 +75,18 @@ requires explicit confirmation bound to that specific act, or a durable
 authorization the user gave that already covers it; a yes to one act is never
 stretched to the next. Classify every action as Create, Read, Update, or Delete
 before acting, and tier it by reversibility: a read-only or easily-reversible
-action — an edit or a delete that version control can undo — runs freely; an
-irreversible, financial, externally-visible, or privilege-changing one needs
-that confirmation.
+action — an edit, or a delete of what is committed and pushed to a branch —
+runs freely; an irreversible, financial, externally-visible, or
+privilege-changing one needs that confirmation. Uncommitted, unpushed, or
+untracked work is not recoverable.
 <!-- LEAN:else -->
 Deleting what version control cannot restore, and any irreversible or
 outward-facing act — publishing, force-push, sending data to a third party —
 needs explicit confirmation bound to that act, or a durable authorization that
 covers it; one yes never stretches to the next act. A read-only or
-easily-reversed action runs freely; an irreversible, financial,
-externally-visible, or privilege-changing one asks.
+easily-reversed action — deleting work pushed to a branch — runs freely; an
+irreversible, financial, externally-visible, or privilege-changing one asks.
+Deleting unpushed work asks.
 <!-- LEAN:end -->
 
 ### {{LAW:surface-failures}} Surface Failures

package/src/skills/council.md

@@ -12,7 +12,7 @@
    - [visionary](../{{DIR_AGENTS}}/visionary.md) — the bold, transformative version; [framer](../{{DIR_AGENTS}}/framer.md) — whether it's even the right problem; [empiricist](../{{DIR_AGENTS}}/empiricist.md) — every claim held to evidence; [historian](../{{DIR_AGENTS}}/historian.md) — what was tried before.
    - [user-advocate](../{{DIR_AGENTS}}/user-advocate.md) — whoever consumes the outcome.
 
-   Hand each chosen seat the motion and a one-line charter scoped to this topic; skip the seats with nothing to say here, and add an ad-hoc seat (e.g. the [security](../{{DIR_AGENTS}}/security.md) surface) only when the topic plainly demands a voice the roster doesn't cover.
+   Hand each chosen seat the motion and a one-line charter scoped to this topic; skip the seats with nothing to say here, and add an ad-hoc seat (e.g. the [security](../{{DIR_AGENTS}}/security.md) surface, or [performance](../{{DIR_AGENTS}}/performance.md) for a speed or memory trade-off) only when the topic plainly demands a voice the roster doesn't cover.
 3. Round one — positions: convene the seats by dispatching each stance {{AGENT}} as its own subagent in one batch where the tool supports it (the [parallel-agents {{SKILL}}](parallel-agents.md)), so each argues in an isolated context with no groupthink; where no subagent capability exists, voice each seat in turn as a persona. Each returns its steelmanned brief ({{ONTOLOGY}}: {{ONT_CONDUCT}}) — no hedging, no strawmen.
 4. Round two — clash: put the briefs in front of each other and have the seats rebut only on the points that actually conflict, surfacing the cruxes, the load-bearing assumptions, and where the evidence is thin. Hold to a fixed number of rounds so the debate converges instead of looping; the skeptic already pairs every objection with what would resolve it (the [roast-me {{SKILL}}](roast-me.md) discipline).
 5. The chair synthesises in neutral voice: state the verdict and its reasoning, record the strongest surviving dissent verbatim so it is not lost, list what would change the verdict, and name the single next action. Surface it for the user to decide — the council advises, it does not commit: write no code and push nothing on its own ({{LAW:deletion-is-deliberate}}, {{DOCTRINE:consent-before-push}}).

package/themes/_TEMPLATE.json

@@ -20,6 +20,7 @@
   "DESC_ARCHITECT": "<one-line description: produces a design/plan before code>",
   "DESC_DOCS": "<one-line description: writes user-facing docs after code lands>",
   "DESC_SECURITY": "<one-line description: audits changes touching the security surface>",
+  "DESC_PERFORMANCE": "<one-line description: measures where the time and memory go, names the bottleneck with numbers, never guesses>",
   "DESC_EXPLORER": "<one-line description: reads/searches widely, returns only distilled findings>",
   "DESC_RESEARCHER": "<one-line description: searches and fetches the open web, cross-checks every claim, returns sourced findings>",
   "DESC_ADVOCATE": "<council seat: argues the strongest case FOR the proposal>",

package/themes/biker.json

@@ -20,6 +20,7 @@
   "DESC_ARCHITECT": "Plans the route before a single line is committed.",
   "DESC_DOCS": "Keeps the roadbook and the notes once the work is done.",
   "DESC_SECURITY": "Goes over anything touching the security surface, bolt by bolt.",
+  "DESC_PERFORMANCE": "Puts it on the dyno — measures where the power goes before anyone touches the engine.",
   "DESC_EXPLORER": "Sends the scout ahead — sweeps wide on a throwaway recon run, brings back only the read.",
   "DESC_RESEARCHER": "Rides out past the county line — reads the road signs everyone else skipped, checks each one twice, brings back only what held up.",
   "DESC_ADVOCATE": "Argues for the run — the ground to be gained, the opening, the cost of staying parked.",

package/themes/commentator.json

@@ -20,6 +20,7 @@
   "DESC_ARCHITECT": "Walks the circuit and plots the strategy before a single line is committed.",
   "DESC_DOCS": "Files the race report and updates the notes once the chequered flag falls.",
   "DESC_SECURITY": "Runs the safety inspection on anything touching the security surface.",
+  "DESC_PERFORMANCE": "Brings out the stopwatch — times every lap and names the slow sector with the split.",
   "DESC_EXPLORER": "Sends the track scout — sweeps wide from a throwaway recon lap, returns only the read.",
   "DESC_RESEARCHER": "Sends the pit reporter down the paddock — checks every rumour against two sources before it goes on air.",
   "DESC_ADVOCATE": "Calls for the overtake — the place to be gained, the gap, the cost of staying put.",

package/themes/cyberpunk.json

@@ -20,6 +20,7 @@
   "DESC_ARCHITECT": "Maps the run before a single line hits the deck.",
   "DESC_DOCS": "Writes the user-facing data once the code goes live.",
   "DESC_SECURITY": "Breaks and checks ICE — audits anything on the security surface.",
+  "DESC_PERFORMANCE": "Traces the lag in the net — profiles the run and names the choke point with numbers.",
   "DESC_EXPLORER": "Scouts the net — sweeps wide in a throwaway shell, returns only the intel.",
   "DESC_RESEARCHER": "Jacks into the open net — pulls the intel, cross-checks it against two nodes, returns only what verified.",
   "DESC_ADVOCATE": "Pushes the build — the upside, the opening, the cost of sitting on it.",

package/themes/gamer.json

@@ -20,6 +20,7 @@
   "DESC_ARCHITECT": "Plans the route before the run starts.",
   "DESC_DOCS": "Writes the wiki and patch notes once the feature ships.",
   "DESC_SECURITY": "Runs the anti-cheat pass on anything touching the security surface.",
+  "DESC_PERFORMANCE": "Checks the frame times — profiles the run and names the bottleneck before any tuning.",
   "DESC_EXPLORER": "Scouts the map — sweeps wide in a throwaway scout run, returns only the intel.",
   "DESC_RESEARCHER": "Reads the wiki and the patch notes — cross-checks every claim against two sources before it goes in the build guide.",
   "DESC_ADVOCATE": "Calls for the play — the upside, the opening, the cost of passing it up.",

package/themes/imperial.json

@@ -20,6 +20,7 @@
   "DESC_ARCHITECT": "Draws the battle-plan before a single line is committed to war.",
   "DESC_DOCS": "Inscribes the records for those who come after, once the work is done.",
   "DESC_SECURITY": "Wards the gates, auditing every change that touches the security surface.",
+  "DESC_PERFORMANCE": "Weighs the machine-spirit’s labour — measures where time is spent and names the burden, never guessing.",
   "DESC_EXPLORER": "Ranges far and wide through a throwaway context, returning only the distilled truth.",
   "DESC_RESEARCHER": "Ranges beyond the archives into the wider realm, holding every claim to two witnesses before it is entered as truth.",
   "DESC_ADVOCATE": "Champions the proposal — presses its strongest case, the prize to be won, the cost of staying the hand.",