geneseed 4.4.0 → 4.5.0

package/CHANGELOG.md

@@ -8,6 +8,34 @@ label. For the capability ↔ spec map, see [SHIPPED.md](SHIPPED.md).
 
 ## [Unreleased]
 
+## [4.5.0] — 2026-10-17
+
+Minor: gates that are proven, not just present — a done gate at turn end, `doctor --probe`, and Bob's refusals restored on Windows.
+
+### Upgrade notes
+- Run `geneseed rebuild-all` once after updating: it rewrites the Windows hook shim (Bob's gates block again) and re-emits the rule skill.
+- The done gate is off until a project lists its checks in `.geneseed/done-checks.txt`.
+
+### Added
+- **Done gate (#289).** A project that lists its checks in `.geneseed/done-checks.txt` gets *Verify Before Asserting* enforced when a turn ends: on Claude Code and OpenClaude, a turn that edited files cannot end until every listed check has passed, unpiped, after the last edit (at most one block per turn). OpenCode 1 gets a reminder on the next request; Bob and OpenCode 2 are not judged and log so. The gate lives inside `learn`, before its model call, so the emitted settings are unchanged. The list protects itself through *External Gate*.
+- **`geneseed doctor --probe`.** This is opt-in. For each live Claude Code, OpenClaude and Bob install, it runs the installed gate command exactly as the host's settings spell it, through the host's own shell. It sends `git reset --hard HEAD`, which the gate must refuse, and `git status`, which it must let through. A gate that allows both, refuses both, or does not run is a doctor failure. The probe runs under your terminal's environment, not the host app's. Its asks are kept out of the gate ledger (`GENESEED_GATE_PROBE`). The OpenCode guard plugin is probed in-process: the installed file is imported and its hook called through both plugin APIs, with `rm -rf /` as the call it must refuse, and `GENESEED_GUARD=off|warn` reported as a note. The PowerShell-fallback warning now suggests running the probe (#290).
+
+### Changed
+- **A stated rule keeps the user's own words.** The rule skill now writes `source: user <date> "<their sentence>"` for a rule the user stated, so a stale rule can be told from a changed mind. Its review flow gains two cases: a rule the user's later words contradict, and a rule only checked by reading that was broken twice (#288).
+
+### Fixed
+- **Bob gates now block on Windows.** The hook shim (`~/.geneseed/bin/geneseed-hook.cmd`) ended with a bare `exit /b`, which returns 0 under `cmd /c` whatever the gate exited. As a result, Bob's exit-2 refusals (Laws I and IV, protected checks, root scans) went through. The shim now ends with `exit /b %ERRORLEVEL%`. Claude Code and OpenClaude were not affected, because their gates answer through stdout and exit 0. Run `geneseed rebuild-all` once to rewrite the shim (#290).
+
+## [4.4.1] — 2026-10-16
+
+A presentation skill.
+
+### Upgrade notes
+- Run `geneseed rebuild-all` once after updating so installs list the new skill.
+
+### Added
+- **deck skill.** Builds slides or a presentation as one self-contained offline HTML file: a short interview with defaults, the outline approved before generation, arrow-key, swipe and `#N` navigation, speaker notes on N, one slide per printed page; `/slides` and `/presentation` answer too. A `.pptx` request stays with the host's pptx skill.
+
 ## [4.4.0] — 2026-10-16
 
 Minor: the memory store scales — a two-level index, merge and archive at creation, and a memory-curator agent.

package/README.md

@@ -11,7 +11,7 @@
 [![Node >= 22.3](https://img.shields.io/badge/node-%3E%3D22.3-5fa04e)](package.json)
 [![zero dependencies](https://img.shields.io/badge/deps-zero-success)](package.json)
 [![Themes](https://img.shields.io/badge/themes-14-9cf)](themes/)
-[![Skills](https://img.shields.io/badge/skills-46-blueviolet)](src/skills/)
+[![Skills](https://img.shields.io/badge/skills-47-blueviolet)](src/skills/)
 [![Agents](https://img.shields.io/badge/agents-20-orange)](src/agents/)
 [![Laws and doctrines](https://img.shields.io/badge/laws-9%20%2B%2029%20doctrines-critical)](src/doctrines/)
 [![Plugins](https://img.shields.io/badge/plugins-7-teal)](adapters/opencode/plugins/)
@@ -179,7 +179,7 @@ The harness ships as a small set of layers, and the web console's rail is the sa
 | **🛡️ Rules** (`laws/`) | 9 universal laws — always in force, never toggleable: sealed-secrets, one-intent-one-act, verify-before-asserting, deletion-is-deliberate, surface-failures, data-not-orders, least-privilege, cure-the-cause, echo-the-intent. Each rule has a permanent id; its number is only its position, and the harness cites rules by name |
 | **📐 Doctrines** (`doctrines/`) | practice packs, chosen per install at build time: **craft** (how code is written), **rigor** (how work is proven), **ops** (how the machine is operated), **process** (how a task is run), **comms** (how answers are presented). A doctrine rule may tighten a Rule, never repeal one, and the user's own `user-rules.md` outranks it. Pick with `geneseed-build --doctrines craft,rigor` (or `none`), a single rule with `--exclude-rules "process 7"`, in the setup wizard, or through the switches on the console's Constitution page; all five pack files ship on disk either way, so a citation into a pack you left out still resolves |
 | **🤖 Agents** (20) | capability specialists: `reviewer`, `tester`, `architect`, `docs`, `security`, `performance`, `explorer`, `researcher`, `developer`, `memory-curator` — plus a debate **council** the `council` skill convenes: `advocate`, `skeptic`, `pragmatist`, `steward`, `visionary`, `user-advocate`, `framer`, `empiricist`, `operator`, `historian` |
-| **🛠 Skills** (46) | repeatable workflows: brainstorm · plan · **codebase-design** · **wayfinder** · **develop** · **worktree** · debug · **prototype** · refactor · **ponytail** · **forge-mcp** · **bruno** · geneseed-code-review · **fresh-eyes** · **security-audit** · **dependencies** · **review-response** · commit · **ship** · **release** · **git-history** · document-project · **frontend-design** · **prose** · **ingest** · **research** · **teach** · **quiz** · **learn-mode** · handoff · roast-me · **council** · parallel-agents · **workflow** · **wiki** · **geneseed** · **rule** · **profile** · **skill-forge** · **pipeline** · **loop** · **brick-forge** · **daydream** · **react-view-transitions** · **token-report** · **explain-changes** |
+| **🛠 Skills** (47) | repeatable workflows: brainstorm · plan · **codebase-design** · **wayfinder** · **develop** · **worktree** · debug · **prototype** · refactor · **ponytail** · **forge-mcp** · **bruno** · geneseed-code-review · **fresh-eyes** · **security-audit** · **dependencies** · **review-response** · commit · **ship** · **release** · **git-history** · document-project · **frontend-design** · **deck** · **prose** · **ingest** · **research** · **teach** · **quiz** · **learn-mode** · handoff · roast-me · **council** · parallel-agents · **workflow** · **wiki** · **geneseed** · **rule** · **profile** · **skill-forge** · **pipeline** · **loop** · **brick-forge** · **daydream** · **react-view-transitions** · **token-report** · **explain-changes** |
 | **🔌 Plugins** (OpenCode) | `geneseed-context` injects project docs *and your machine wiki* every session (and across compaction); `geneseed-learn` distils memory at session end; `geneseed-guard` enforces the safety Laws and protected wiki folders at the tool boundary; `geneseed-workflow` registers the `workflow` tool that runs saved orchestration scripts; `geneseed-notify` sends a native OS notification when a long run finishes; `geneseed-ponytail` holds a minimal-code mode (`/ponytail lite\|full\|ultra\|off`), opt-in, injecting the laziest-that-works ruleset every turn so it doesn't drift; `geneseed-activity` streams what each session is doing to the web console's Activity view |
 | **🧠 Memory** (`memory/`) | one-fact-per-file durable knowledge, indexed by `MEMORY.md` (git-ignored, personal) |
 | **📓 Notebook** (`notebook/`) | the agent's sovereign space — any medium (code, tools, data, notes), self-ruled via a seed-once charter, always git-ignored; only its `.gitignore` is build-asserted |

package/SHIPPED.md

@@ -20,7 +20,7 @@ historical references, not files distributed with the repo.
 > **On version numbers.** [`harness.config.json`](harness.config.json)'s `version` is a
 > human-readable label only. The canonical identity of an installed harness is the
 > **source fingerprint** stamped in `.geneseed-version` (see `geneseed version`), not the
-> string. Current label: **4.4.0**.
+> string. Current label: **4.5.0**.
 
 ## Capabilities
 
@@ -29,7 +29,7 @@ Every row below is present in the tree today; "Spec" names the design record.
 | Capability | What it is | Spec |
 | --- | --- | --- |
 | **Themed generator** | One neutral `src/` → 14 themed bundles via `geneseed-build` (zero dependencies); structure stays theme-independent | [DESIGN.md](DESIGN.md) |
-| **Laws / Agents / Skills / Memory / Notebook** | 9 laws, 20 agents, 46 skills, the memory convention, and the agent's sovereign notebook | `2026-06-11-notebook-sovereign-space` · `2026-06-10-notebook-agent-own-space` |
+| **Laws / Agents / Skills / Memory / Notebook** | 9 laws, 20 agents, 47 skills, the memory convention, and the agent's sovereign notebook | `2026-06-11-notebook-sovereign-space` · `2026-06-10-notebook-agent-own-space` |
 | **Three-tier constitution** | The governance surface splits into an always-on **Ontology** (Telos, Evidence, Decisions, Conduct — the Pact absorbed into Telos), the nine always-on **Invariants**, and five toggleable **Doctrine** packs (craft, rigor, ops, process, comms) addressed `<pack> <n>`. Every rule carries a permanent id; its number is its position, computed at render time, and a citation renders as the rule's principle name. Packs are chosen at build time with `--doctrines` or the setup wizard; the whole catalogue ships on disk either way, so a citation into an inactive pack still resolves. Precedence, in order: Ontology + Invariants, then the user's `user-rules.md`, then the active Doctrines, then `PROFILE.md`. `doctor`'s `constitutionProblems` gates rule ids (declared, unique, never a retired one), the per-rule Principle column, every `{{LAW:<id>}}` / `{{DOCTRINE:<id>}}` citation in `src/`, and the rule that an always-on tier may never cite a toggleable one | `2026-08-19-three-tier-constitution-design` |
 | **`doctor`** | One check: unresolved tokens, dead/non-hermetic links, theme-key parity, authoring gates, rendered-bundle drift | `2026-06-07-theme-aware-doctor-diff` |
 | **`diff` + improvements export** | Deployed-vs-source drift report; export an `improvements.md` back-port | `2026-06-12-improvements-export` |

package/adapters/opencode/plugins/geneseed-context.js

@@ -877,6 +877,76 @@ async function alreadyInjected(client, sid) {
   return false
 }
 
+// ---- The done gate (#289): the OpenCode twin of js/hosts/hooks-done.mjs ----------------
+// OpenCode has no turn-end event a plugin can block on, so its ceiling is a reminder: on the
+// request AFTER a turn that edited files without the project's declared checks passing
+// (`.geneseed/done-checks.txt`), one invisible user message says which checks are owed. Only V1
+// (`messages.transform`, whose tool parts carry `state.status` and the shell's
+// `metadata.exit`); OpenCode 2's message shape for tool calls is unverified, so V2 is not
+// judged and says so once. Fails open on every shape it does not recognise (ADR 0007).
+// `runsUnpiped` is a hand-mirrored twin; tests/plugins/context_done.test.mjs runs both on one table.
+const DONE_LIST = ".geneseed/done-checks.txt"
+const DONE_EDIT_TOOLS = new Set(["edit", "write", "patch", "apply_patch", "multiedit"])
+const DONE_SHELL_TOOLS = new Set(["bash", "shell"])
+
+async function readDoneChecks(root) {
+  try {
+    const text = await fs.readFile(path.join(root, DONE_LIST), "utf8")
+    return text.split(/\r?\n/).map((l) => l.trim().replace(/\s+/g, " ")).filter((l) => l && !l.startsWith("#"))
+  } catch {
+    return []
+  }
+}
+
+function runsUnpiped(command, line) {
+  const cmd = String(command).replace(/[ \t]+/g, " ")
+  for (let i = cmd.indexOf(line); i !== -1; i = cmd.indexOf(line, i + 1)) {
+    const rest = cmd.slice(i + line.length)
+    let piped = false
+    for (let j = 0; j < rest.length; j += 1) {
+      const two = rest.slice(j, j + 2)
+      if (two === "&&" || two === "||" || rest[j] === ";" || rest[j] === "\n") break
+      if (rest[j] === "|") { piped = true; break }
+    }
+    if (!piped) return true
+  }
+  return false
+}
+
+// The checks still owed, judged over the previous turn and the current one: a reminder lasts
+// one turn, not the whole session. Our own injected messages (`geneseed-*` ids) open no turn.
+function doneOwed(messages, checks, root) {
+  const prompts = []
+  messages.forEach((m, i) => {
+    if (m?.info?.role === "user" && !String(m.info.id ?? "").startsWith("geneseed-")) prompts.push(i)
+  })
+  const from = prompts.length >= 2 ? prompts[prompts.length - 2] : 0
+  const tools = []
+  for (const m of messages.slice(from)) {
+    for (const p of m?.parts ?? []) if (p?.type === "tool" && p.state) tools.push(p)
+  }
+  let lastEdit = -1
+  tools.forEach((p, i) => {
+    if (!DONE_EDIT_TOOLS.has(String(p.tool).toLowerCase()) || p.state.status === "error") return
+    const fp = p.state.input?.filePath ?? p.state.input?.file_path
+    if (typeof fp === "string" && fp) {
+      const rel = path.relative(root, path.resolve(root, fp))
+      if (rel.startsWith("..") || path.isAbsolute(rel)) return
+    }
+    lastEdit = i
+  })
+  if (lastEdit === -1) return []
+  const passed = new Set()
+  for (const p of tools.slice(lastEdit + 1)) {
+    const command = DONE_SHELL_TOOLS.has(String(p.tool).toLowerCase()) && p.state.input?.command
+    if (typeof command !== "string" || p.state.status !== "completed") continue
+    const exit = p.state.metadata?.exit
+    if (typeof exit === "number" && exit !== 0) continue
+    for (const check of checks) if (runsUnpiped(command, check)) passed.add(check)
+  }
+  return checks.filter((c) => !passed.has(c))
+}
+
 export const GeneseedContext = async (ctx) => {
   const { client } = ctx
   const done = new Set()
@@ -1002,6 +1072,27 @@ export const GeneseedContext = async (ctx) => {
     // detects that and takes over with the visible delivery.
     "experimental.chat.messages.transform": async (_input, output) => {
       transformSeen = true                  // the hook exists on this build
+      // The done gate's reminder: FIRST, and independent of the context block:
+      // INJECT_OFF and the visible delivery leave it on, and no early return below can skip it.
+      // Its own function, so its early returns end the reminder, never the context injection.
+      await (async () => {
+        if (!output || !Array.isArray(output.messages) || !output.messages.length) return
+        const sid = output.messages[0]?.info?.sessionID
+        if (await sovereignBypass(root) || await skipSession(sid)) return
+        const checks = await readDoneChecks(root)
+        if (!checks.length) return
+        const owed = doneOwed(output.messages, checks, root)
+        if (!owed.length) return
+        const stamp = Date.now()
+        output.messages.unshift({
+          info: { id: `geneseed-done-${stamp}`, role: "user", sessionID: sid, time: { created: stamp } },
+          parts: [{ id: `geneseed-done-part-${stamp}`, type: "text", text:
+            "Geneseed (Verify Before Asserting) — files were edited, and these checks from "
+            + `${DONE_LIST} have not passed since the last edit: ${owed.join("; ")}. Run them unpiped `
+            + "before reporting the work done, or say plainly that they were not run and why." }],
+        })
+        log("transform: done-gate reminder injected")
+      })().catch((err) => log(`done-gate error: ${err?.message ?? err}`))
       if (INJECT_OFF || !TRANSFORM || fallbackVisible) return
       if (await sovereignBypass(root)) return
       try {
@@ -1072,6 +1163,11 @@ async function setupV2(ctx) {
     }
   }
 
+  // The done gate is not judged on OpenCode 2 (see `doneOwed`): said once, where its log goes.
+  if ((await readDoneChecks(root).catch(() => [])).length) {
+    console.error(`[geneseed-context] done gate: ${DONE_LIST} found, but OpenCode 2 turns are not judged.`)
+  }
+
   if (!VISIBLE) {
     await ctx.session.hook("context", async (event) => {
       if (INJECT_OFF) return

package/adapters/opencode/plugins/geneseed-guard.js

@@ -128,6 +128,9 @@ function log(msg) { console.error(`[geneseed-guard] ${msg}`) }
 // at the newest MAX_LEDGER_LINES like the hook's; never throws, never decides.
 const MAX_LEDGER_LINES = 1000
 async function ledger(rule) {
+  // `geneseed doctor --probe` blocks on purpose; its blocks are not the user's (the twin of
+  // the same line in js/hosts/hooks.mjs). The record only — never the decision.
+  if (process.env.GENESEED_GATE_PROBE) return
   try {
     const bases = []
     if (process.env.GENESEED_HARNESS) bases.push(process.env.GENESEED_HARNESS)
@@ -545,6 +548,9 @@ function ruleStoreTarget(p) {
 // line; the list protects itself. Found from the WRITE TARGET up to the first `.git`, re-read on
 // every write (a short file, read only on a write call). No ask tier here, so a hit is a deny.
 const SENSOR_LIST = ".geneseed/protected-checks.txt"
+// The done gate's list (#289, js/hosts/hooks-done.mjs) protects itself the same way, with or
+// without a protected-checks list: emptying it would disarm the gate. Twin of js/hosts/hooks.mjs.
+const DONE_LIST = ".geneseed/done-checks.txt"
 function protectedCheck(p) {
   try {
     const target = path.resolve(p)
@@ -554,9 +560,10 @@ function protectedCheck(p) {
       if (up === root) return null
       root = up
     }
-    const text = readFileSync(path.join(root, SENSOR_LIST), "utf8")
     const fold = (s) => nocase(s.replace(/\\/g, "/"))
     const rel = fold(path.relative(root, target))
+    if (rel === fold(DONE_LIST)) return DONE_LIST
+    const text = readFileSync(path.join(root, SENSOR_LIST), "utf8")
     const entries = [SENSOR_LIST, ...text.split(/\r?\n/).map((l) => l.trim().replace(/[\\/]+$/, ""))
       .filter((l) => l && !l.startsWith("#"))]
     return entries.find((e) => rel === fold(e) || rel.startsWith(fold(e) + "/")) ?? null
@@ -635,7 +642,7 @@ export const GeneseedGuard = async (ctx) => {
             if (SECRET_RE.some((re) => re.test(p))) { await deny(`write to secret/key file ${p} (Sealed Secrets)`, "law-1"); return }
             if (SECRET_WARN_RE.some((re) => re.test(p))) log(`WARN: writing ${p} — keep secrets out of tracked files (Sealed Secrets)`)
             const sensor = protectedCheck(p)
-            if (sensor) { await deny(`${p} is a protected check (${sensor}, listed in ${SENSOR_LIST}) — a check the agent can edit is not a check (External Gate)`, "rigor-5"); return }
+            if (sensor) { await deny(`${p} is a protected check (${sensor === DONE_LIST ? "the done gate list itself" : `${sensor}, listed in ${SENSOR_LIST}`}) — a check the agent can edit is not a check (External Gate)`, "rigor-5"); return }
             const store = ruleStoreTarget(p)
             if (store && !RULE_STORE_BUMPED.has(p)) {
               RULE_STORE_BUMPED.add(p)

package/docs/concepts/enforcement-table.md

@@ -13,8 +13,8 @@ few rules are enforced; the rest are asked on every host, through the root rules
 
 Derived from the code, not from this project's own planning notes: `js/hosts/hooks.mjs`'s
 `BLOCK_RULES` and gate functions, `HOOK_PINNED` in `js/inspect/checks-constitution.mjs`,
-`LAW_IV_BASH` and `CONSENT_RULE` in `js/hosts/settings.mjs`, and
-`adapters/opencode/plugins/geneseed-guard.js`. `HOOK_PINNED` is what keeps this table from
+`LAW_IV_BASH` and `CONSENT_RULE` in `js/hosts/settings.mjs`, `js/hosts/hooks-done.mjs`, and
+`adapters/opencode/plugins/geneseed-guard.js` and `geneseed-context.js`. `HOOK_PINNED` is what keeps this table from
 silently guarding the wrong rule after a renumber. See [ADR 0005](../adr/0005-stable-rule-ids.md).
 
 ### The enforced rules
@@ -26,6 +26,7 @@ silently guarding the wrong rule after a renumber. See [ADR 0005](../adr/0005-st
 | `persist-insight` | process | ask: rule-gate (a write to `user-rules.md` or the memory store) | same as Claude Code | ask once: guard plugin (refuses the *first* write to that path; a re-issued write goes through) | log only (warning, call goes through) |
 | `consent-before-push` | process | ask: git-gate (every `git commit`/`git push`). Togglable: build without the process pack, or drop this rule alone with `--exclude-rules` (see [Exclusions](exclusions.md)). Only this question drops; the `deletion-is-deliberate` gate stays. | same as Claude Code | ask: permission prompt (`git commit*`/`git push*`), wired only when the process pack is on; a `loop/*` push is statically allowed | log only |
 | `external-gate` | rigor | ask: rule-gate (a write under a project's `.geneseed/protected-checks.txt` list) | same as Claude Code | block: guard plugin (same list) | block (exit 2) |
+| `verify-before-asserting` | law | block at Stop, once per turn: the done gate in `learn` (a turn that edited files, while a check in the project's `.geneseed/done-checks.txt` has not passed since the last edit). Opt-in per project | same as Claude Code (**unverified live**: a frozen fork, and no check runs a model turn) | remind: context plugin, on the next request (OpenCode 1 only; OpenCode 2 is not judged, and logs so) | not judged: Stop carries no transcript (log line) |
 | `commands-must-return` | ops | ask: git-gate (a recursive scan rooted at a filesystem root: `find /`, `du`, `grep -r`, `rg`, `Get-ChildItem -Recurse` at `/`, `/c`, `C:\`) | same as Claude Code | block: guard plugin (same root-scan pattern) | block (exit 2) |
 
 Bob has no "ask" tier (see [ADR 0007](../adr/0007-gates-fail-closed-per-host-ceiling.md)), so a
@@ -37,12 +38,17 @@ mechanisms: its own permission prompt (`opencode.json`, static globs) and the gu
 See [ADR 0008](../adr/0008-host-parity-ceiling-of-the-weakest-host.md) for why a gate that only
 one host can run still ships for every host it can.
 
+A gate that is registered but broken looks exactly like a working one. `geneseed doctor --probe`
+runs the installed Claude Code, OpenClaude and Bob gates through each host's own shell, and calls
+the OpenCode guard plugin in-process, on one call each must refuse and one it must let through
+([Doctor findings](../reference/troubleshoot-doctor.md)).
+
 ### Everything else: asked only, on every host
 
 Every other rule carries no gate on any host. A human reads them because the model was told to
 follow them, not because a tool call was ever inspected.
 
-**Laws** — `one-intent-one-act` · `verify-before-asserting` · `surface-failures` ·
+**Laws** — `one-intent-one-act` · `verify-before-asserting` (in a project without a done list) · `surface-failures` ·
 `data-not-orders` · `least-privilege` · `cure-the-cause` · `echo-the-intent`.
 
 **Doctrine: process** — `plan-before-acting` · `context-economy` · `read-the-docs-first` ·

package/docs/concepts/hooks.md

@@ -37,8 +37,11 @@ Geneseed writes its hooks into the host's settings file. Every hook calls one pr
 - Content that looks like a credential (a cloud access key, a GitHub or Anthropic token, a Slack token, a private-key block) going into any file other than `.env*` gets a prompt citing *Sealed Secrets*.
 - A write to `user-rules.md`, `MEMORY.md` or a file in the install's `memory/` gets a prompt citing *Persist Insight*: whether something is a standing rule or a fact to remember is your call, settled through the `rule` [skill](skills.md).
 - A write to a check the project protects gets a prompt citing *External Gate* (on Bob, it is blocked). A project opts in with `.geneseed/protected-checks.txt` at its git root: one repo-relative file or folder per line, `#` for comments — the checks and tests the agent is judged by. A check the agent can edit is not a check. The list protects itself. Only file-write tools are seen: a shell `sed -i` or redirect is not, so run the same checks in CI as the boundary that holds.
+- A write to `.geneseed/done-checks.txt`, the done gate's own list (below), gets the same *External Gate* prompt: emptying it would disarm the gate.
 - Ordinary edits pass untouched.
 
+**The done gate.** Runs when a turn ends, inside `learn` and before it calls any model. A project opts in with `.geneseed/done-checks.txt` at its git root: one command per line, `#` for comments — the checks that prove the work, for example `npm run lint` and `node --test`. If the turn edited a file under that root and a listed check has not passed since the last edit, the turn does not end: the agent is told which checks are owed, citing *Verify Before Asserting*. A check counts when it ran as a shell command, unpiped (`npm test | tail` exits with `tail`'s code, so it proves nothing), and its result was not an error. The gate never runs a check itself. It blocks at most once per turn; the second stop ends the turn and leaves a line in the gate ledger. Only file-write tools count as edits: a shell `sed -i` or redirect is not seen. Without the file, nothing changes. On OpenCode the gate is a reminder on the next request (OpenCode 1 only); on Bob, whose Stop carries no transcript, the turn is not judged and a log line says so.
+
 **learn.** Takes the tail of the transcript and asks a model to distil what is worth keeping into one-fact-per-file entries under `memory/`. It is shown the facts already stored, so it updates one with the merged text rather than writing a twin (the old version is kept in `memory/archive/`), and moves one the session proved obsolete into `memory/archive/`. It needs `GENESEED_LLM` set to a model command, for example:
 
 ```bash

package/docs/concepts/skills.md

@@ -30,6 +30,7 @@ A **skill** is a repeatable workflow written as a markdown playbook: when it app
 | answer a question from the open web, every claim cross-checked | `research` |
 | have several viewpoints debate a decision | `council` |
 | get an adversarial critique of your own ask, plan or idea | `roast-me` |
+| present a subject as slides in one offline HTML file | `deck` |
 | see what a change does before you agree to commit it | `explain-changes` |
 | stage the right paths and write a focused commit | `commit` |
 | open a pull request, or finish and merge a branch | `ship` |

package/docs/extending.md

@@ -125,7 +125,7 @@ Notes that matter:
 
 ### The gates CI does not run
 
-- **The mutation matrix itself.** `tests/mutate.mjs` — 33 rows, each a one-string edit to a
+- **The mutation matrix itself.** `tests/mutate.mjs` — 35 rows, each a one-string edit to a
   product file with a written argument for which gate should catch it. The full run is **in no
   workflow** and should not be: it mutates the product tree 33 times and runs a gate per edit.
   Run `node tests/mutate.mjs --all` (or `--only M7`) by hand when you change something a gate is

package/docs/reference/plugin-context.md

@@ -17,6 +17,8 @@ One of the [OpenCode plugins](opencode-plugins.md). Its switches are also listed
 
 **When it runs.** On every request: the context rides invisibly in the request's message list, so it also survives compaction. If your OpenCode build lacks that (experimental) hook, the plugin notices and falls back to one visible message at session start, re-pushed when the session compacts.
 
+**The done gate's reminder.** In a project with `.geneseed/done-checks.txt` (see [Hooks](../concepts/hooks.md)), a request that follows a turn which edited files without every listed check passing since gets one more invisible message naming the checks owed. OpenCode has no turn-end event a plugin can block on, so this is a reminder, not a block. OpenCode 1 only: on OpenCode 2 the turn is not judged, and the plugin logs that once. `GENESEED_CONTEXT_INJECT=off` does not turn it off; removing the file does.
+
 **What you see.** Normally nothing — the context is there, but not shown. With the visible fallback, a `PROJECT CONTEXT` block at the top of the session.
 
 **Switches.**

package/docs/reference/troubleshoot-doctor.md

@@ -35,6 +35,37 @@ If the drift is your own edits, export them first — `geneseed diff` (or the co
 
 **Confirm.** `geneseed doctor` no longer reports the bundle.
 
+## `[probe] … registered but not refusing` / `refuses everything` / `does not run`
+
+> `[probe] ~/.claude: git-gate under Git Bash registered but not refusing — …`
+
+These come only from `geneseed doctor --probe`. It runs each installed gate exactly as the host's
+settings spell it, through the host's own shell, on `git reset --hard HEAD` (which must be refused)
+and `git status` (which must go through). An OpenCode install's guard plugin has no command to
+run: the probe imports it and calls its hook through both plugin APIs (V1 and V2), with `rm -rf /`
+as the call it must refuse. `GENESEED_GUARD=off` or `warn` in your terminal makes that a note,
+not a failure.
+
+**Cause.**
+- **Not refusing:** the gate launches but lets a destructive call through. Usually something in
+  the install tells it to stand down: an exclusion covering the temp folder, or a command that
+  lost its `--host bob`.
+- **Refuses everything:** the gate asks on every call. This is typically the hooks emitted for
+  one shell and run under another.
+- **Does not run:** the shim or its runner is gone, or the shell is missing.
+
+**Fix.**
+
+```bash
+geneseed rebuild-all
+```
+
+**Confirm.** `geneseed doctor --probe` prints `[probe] N gate(s) refused a destructive call and let
+a safe one through`.
+
+The probe runs under *this terminal's* environment (PATH, HOME), not the host app's. A host started
+with a different environment can still break a gate that passes here.
+
 ## `registry.json unreadable` / `registry.json is not valid JSON`
 
 > `[authoring] registry.json unreadable: …`

package/docs/understand/enforced-vs-asked.md

@@ -27,6 +27,7 @@ On Claude Code and OpenClaude the hooks never block silently. They make the host
 - **A scan of a whole filesystem**: a recursive `find`, `du`, `grep -r`, `rg` or `Get-ChildItem -Recurse` rooted at `/`, `/c` or `C:\`, which in Git Bash walks every drive for hours. Wired in every build.
 - **Credentials**: a write or edit whose content looks like a real key (AWS, GitHub, Anthropic, Slack, or a private-key block), anywhere except a `.env` file.
 - **Your rules and memory**: any write by the agent to `user-rules.md` or to the memory store. Whether something is a standing rule or a fact to remember is your call.
+- **Ending a turn without the proof**: only in a project that lists its checks in `.geneseed/done-checks.txt`. A turn that edited files cannot end until every listed check has passed since the last edit. The agent is stopped once, then the turn may end.
 
 If a gate crashes, it asks instead of letting the call through. If it cannot start at all (a deleted or broken shim) or times out, Claude Code blocks the call instead: see [Troubleshoot hooks](../reference/troubleshoot-hooks.md) to recover. Other shell commands, `rm -rf` included, go through Claude Code's normal permission flow.
 

package/harness.config.json

@@ -2,5 +2,5 @@
   "_comment": "version is a human-readable release label only; the canonical identity of an installed harness is the source fingerprint stamped in .geneseed-version (see `harness version`), not this string.",
   "theme": "neutral",
   "product": "Geneseed",
-  "version": "4.4.0"
+  "version": "4.5.0"
 }

package/js/README.md

@@ -71,6 +71,7 @@ user co-owns, and the hook verbs those emitted configs then run.
 | `hosts.mjs` | The four host config dirs (opencode/claude/bob/openclaude), their `family` (`CLAUDE_STYLE`), plus `resolvePath`/`expanduser` |
 | `hooks.mjs` | The gate verbs, run on every tool call: `git-gate`, `rule-gate`, `tool-gate` (the two gates fused, for Bob), plus `ask`/the gate ledger/`guardGate`. `--host` picks the verdict dialect |
 | `hooks-context.mjs` | The `context` verb — SessionStart: session files plus the repo's context docs |
+| `hooks-done.mjs` | The done gate (#289): on Stop, inside `learn` and before its spawn, blocks a turn that edited files until `.geneseed/done-checks.txt`'s checks passed after the last edit |
 | `hooks-learn.mjs` | The `learn` verb — Stop/SubagentStop/PreCompact distiller; the hook path's ONE spawn (`$GENESEED_LLM`) |
 | `hooks-prims.mjs` | The Python path/text primitives the hook verbs share (`splitLines`, `readStdin`, a never-throwing `isFile`) |
 | `usage.mjs` | The usage counter `tool-gate` runs: one `{day, kind, name}` line per Skill or subagent call into `notebook/usage.jsonl`. Hook path: builtins only, silent, never throws |
@@ -101,7 +102,8 @@ Everything that inspects an already-built or already-deployed harness and report
 | `doctor.mjs` | The `geneseed doctor` **driver** only: picks themes, runs the checks, prints the verdict |
 | `checks-build.mjs` | Gates over what the build PRODUCED: links, tokens, theme parity, OpenCode colours, bundle drift |
 | `checks-repo.mjs` | Gates over the repo's own records: `registry.json`, committed secrets, the hook shim, vendored pins |
-| `checks-authoring.mjs` | `authoringProblems`, the aggregate self-consistency gate: spec purpose lines, the learn-prompt literal, `node --check` over the plugins (the doctor's one spawn), then the groups below |
+| `checks-authoring.mjs` | `authoringProblems`, the aggregate self-consistency gate: spec purpose lines, the learn-prompt literal, `node --check` over the plugins (the doctor's one default spawn), then the groups below |
+| `checks-probe.mjs` | `doctor --probe` (opt-in): runs each live install's own gate command through the host's shell on a must-refuse and a must-pass payload — the doctor's second spawn; the OpenCode guard plugin is imported and called in-process instead, through both plugin APIs |
 | `checks-constitution.mjs` | The constitution: rule declarations and citations, LEAN blocks, `HOOK_PINNED`, theme vocabulary, the console's `LAW_META`/`DOCTRINE_META` |
 | `checks-counts.mjs` | The hand-written counts: AGENT.md tables, README badges and prose, `SHIPPED.md`, held against `src/` |
 | `scan.mjs` | The shared walk/sort/strip/test primitives every `checks-*` uses. Owns no judgement itself |

package/js/cli-table.json

@@ -473,6 +473,21 @@
           "is_flag": true,
           "type": null,
           "hidden": false
+        },
+        {
+          "names": [
+            "--probe"
+          ],
+          "dest": "probe",
+          "metavar": null,
+          "help": "also run each installed gate on a destructive and a safe payload: it must refuse the first and let the second through. Claude Code, OpenClaude and Bob gates run as their settings spell them, through the host's shell; the OpenCode guard plugin is imported and called in-process (runs under this terminal's environment, not the host app's)",
+          "choices": null,
+          "default": false,
+          "required": false,
+          "nargs": "0",
+          "is_flag": true,
+          "type": null,
+          "hidden": false
         }
       ],
       "mutex": []

package/js/hosts/hooks-done.mjs

@@ -0,0 +1,169 @@
+/**
+ * The done gate — Verify Before Asserting's boundary half, at the moment a turn ends (#289).
+ *
+ * Every other gate sits before an act. This one sits at Stop: a turn that edited files under a
+ * project which lists its proof in `.geneseed/done-checks.txt` may not end until every listed
+ * check has run AND passed after the last edit. The gate never runs a check itself — the hook
+ * path starts no process of its own (ADR 0002) — it reads the turn's own tool calls in the transcript.
+ *
+ * WHY IT RIDES `learn` AND NOT A VERB OR A FLAG OF ITS OWN (ADR 0010). The machine-wide shim is
+ * last-writer-wins: an older `geneseed-hook` would refuse a new verb or flag, and the Stop
+ * command's `|| exit 0` would then skip learning too, silently. Arming on a project FILE keeps
+ * every emitted settings file byte-identical, so a stale shim only means "no done gate".
+ *
+ * WHY STDOUT JSON AND NOT EXIT 2. The emitted Stop command ends in `|| exit 0`, which swallows
+ * a 2. `{"decision":"block"}` on exit 0 is the one signal that survives the existing wiring.
+ * Allowing prints NOTHING — on Stop a stray stdout byte is read as a verdict.
+ *
+ * WHAT COUNTS (shortcut: write tools only; a shell `sed -i` or redirect is not an edit here —
+ * seeing those would need `git status`, a spawn. Same limit as `protected-checks.txt`):
+ *   - an edit is a Write/Edit/NotebookEdit/MultiEdit whose target is under the project root and
+ *     whose result is not an error (a denied write changed nothing);
+ *   - a pass is a Bash/PowerShell call whose command contains the declared line UNPIPED (a pipe
+ *     takes the exit code of its last stage: `npm test | tail` exits 0 on a red suite) and whose
+ *     result is not `is_error` — every non-zero exit, denial and timeout carries it (checked on
+ *     14 000+ real Claude Code results, 2026-10-17).
+ *
+ * At most one block per turn: `stop_hook_active` is true when this Stop follows a block, and the
+ * gate then lets the turn end and leaves a ledger line, so a gate that cries wolf gets found.
+ */
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+import { readText, printOut as out, printErr as err } from '../lib/fs.mjs';
+import { within } from '../lib/paths.mjs';
+import { gitRootOf } from './gitref.mjs';
+import { DONE_LIST, recordGate } from './hooks.mjs';
+import { splitLines } from './hooks-prims.mjs';
+
+const EDIT_TOOLS = new Set(['Write', 'Edit', 'NotebookEdit', 'MultiEdit']);
+const SHELL_TOOLS = new Set(['Bash', 'PowerShell']);
+
+/** The declared checks, one per line, `#` comments; null when the project has no list. */
+export function readDoneChecks(root) {
+  const file = path.join(root, DONE_LIST);
+  if (!existsSync(file)) return null;
+  try {
+    return splitLines(readText(file)).map((l) => l.trim().replace(/\s+/g, ' '))
+      .filter((l) => l && !l.startsWith('#'));
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * True when `command` runs `line` with no pipe after it in the same segment. A segment ends at
+ * `&&`, `||`, `;` or a newline; a single `|` before that end is a pipe. Whitespace is collapsed
+ * on both sides. shortcut: quotes are not parsed — a `|` inside a quoted argument after the
+ * check reads as a pipe, which only ever refuses a pass, never grants one.
+ */
+export function runsUnpiped(command, line) {
+  const cmd = String(command).replace(/[ \t]+/g, ' ');
+  for (let i = cmd.indexOf(line); i !== -1; i = cmd.indexOf(line, i + 1)) {
+    const rest = cmd.slice(i + line.length);
+    let piped = false;
+    for (let j = 0; j < rest.length; j += 1) {
+      const two = rest.slice(j, j + 2);
+      if (two === '&&' || two === '||' || rest[j] === ';' || rest[j] === '\n') break;
+      if (rest[j] === '|') { piped = true; break; }
+    }
+    if (!piped) return true;
+  }
+  return false;
+}
+
+/** A user line that opens a turn: the user typed it, it is not a tool result or a meta note. */
+function isPrompt(obj) {
+  if (obj.type !== 'user' || obj.isMeta || obj.isSidechain) return false;
+  const c = obj.message && obj.message.content;
+  if (typeof c === 'string') return true;
+  return Array.isArray(c) && c.length > 0 && !c.some((b) => b && b.type === 'tool_result');
+}
+
+/**
+ * The decision, over transcript TEXT: the checks that have not passed since the turn's last
+ * edit, or [] when the turn may end (no edit, or every check passed after it). Exported for the
+ * unit tier — a transcript is text no CLI cell can vary cheaply.
+ */
+export function doneDecide(transcript, checks, root, cwd = root) {
+  const entries = [];
+  for (const line of splitLines(transcript)) {
+    if (!line.trim()) continue;
+    try { entries.push(JSON.parse(line)); } catch { /* a torn last line is not evidence */ }
+  }
+  let start = 0;
+  for (let i = entries.length - 1; i >= 0; i -= 1) {
+    if (isPrompt(entries[i])) { start = i + 1; break; }
+  }
+  const calls = [];                      // tool_use blocks, in order
+  const results = new Map();             // tool_use_id -> is_error
+  for (const obj of entries.slice(start)) {
+    if (obj.isSidechain) continue;
+    const content = obj.message && obj.message.content;
+    if (!Array.isArray(content)) continue;
+    for (const b of content) {
+      if (!b || typeof b !== 'object') continue;
+      if (b.type === 'tool_use') calls.push(b);
+      else if (b.type === 'tool_result') results.set(b.tool_use_id, b.is_error === true);
+    }
+  }
+  let lastEdit = -1;
+  calls.forEach((c, i) => {
+    if (!EDIT_TOOLS.has(c.name) || results.get(c.id) === true) return;
+    const p = c.input && (c.input.file_path || c.input.notebook_path || c.input.path);
+    if (typeof p === 'string' && p && within(path.resolve(cwd, p), root)) lastEdit = i;
+  });
+  if (lastEdit === -1) return [];
+  const passed = new Set();
+  calls.slice(lastEdit + 1).forEach((c) => {
+    const command = SHELL_TOOLS.has(c.name) && c.input && c.input.command;
+    // A call with no result yet (the host has not flushed it) is not a pass.
+    if (typeof command !== 'string' || results.get(c.id) !== false) return;
+    for (const check of checks) if (runsUnpiped(command, check)) passed.add(check);
+  });
+  return checks.filter((c) => !passed.has(c));
+}
+
+/**
+ * The Stop-side wrapper `cmdLearn` calls first. Returns true when it printed a block (the turn
+ * goes on, so `learn` must not distil yet); false in every other case, with nothing on stdout.
+ */
+export function doneGate(meta, args) {
+  try {
+    const cwd = typeof meta.cwd === 'string' && meta.cwd ? meta.cwd : process.cwd();
+    const root = gitRootOf(cwd);
+    const checks = root ? readDoneChecks(root) : null;
+    if (!checks || !checks.length) return false;
+    // Bob's Stop payload carries no transcript (learn's I2): nothing to judge, and it says so.
+    if (args.host === 'bob' || typeof meta.transcript_path !== 'string') {
+      err(`[done-gate] no transcript${args.host === 'bob' ? ' (bob)' : ''} — turn not judged.\n`);
+      return false;
+    }
+    let transcript;
+    try {
+      transcript = readText(meta.transcript_path);
+    } catch {
+      // No ask tier on Stop: blocking on an unreadable transcript would trap the user.
+      err('[done-gate] transcript unreadable — turn not judged.\n');
+      return false;
+    }
+    const missing = doneDecide(transcript, checks, root, cwd);
+    if (!missing.length) return false;
+    const install = args.memory ? path.dirname(args.memory) : null;
+    if (meta.stop_hook_active === true) {
+      recordGate(install, 'done-gate-cap', 'law-3');
+      err(`[done-gate] cap reached — turn ends with unproven checks: ${missing.join('; ')}\n`);
+      return false;
+    }
+    recordGate(install, 'done-gate', 'law-3');
+    out(`${JSON.stringify({
+      decision: 'block',
+      reason: 'Geneseed (Verify Before Asserting) — this turn edited files, and these '
+        + `checks from ${DONE_LIST} have not passed since the last edit: ${missing.join('; ')}. `
+        + 'Run them unpiped, or say plainly that they were not run and why.',
+    })}\n`);
+    return true;
+  } catch (e) {
+    err(`[done-gate] skipped: ${e && e.message}\n`);
+    return false;
+  }
+}

package/js/hosts/hooks-learn.mjs

@@ -13,6 +13,7 @@ import {
   globalHookStandingDown, hookProjectDir, resolveMemoryDir, sovereignBypass,
 } from './hosts.mjs';
 import { readStdin, splitLines, splitWords } from './hooks-prims.mjs';
+import { doneGate } from './hooks-done.mjs';
 import {
   existingSlugs, readFacts, writeMemories, consolidateMemory, appendAgentLesson,
 } from './memory-files.mjs';
@@ -309,6 +310,10 @@ export function cmdLearn(args) {
   const hookEvent = typeof meta.hook_event_name === 'string' ? meta.hook_event_name
     : (typeof meta.event === 'string' ? meta.event : null);
 
+  // The done gate (#289) judges the turn BEFORE anything here spawns, and only on Stop. A block
+  // means the turn goes on, so there is nothing to distil yet: the next Stop will.
+  if (hookEvent === 'Stop' && !args.file && doneGate(meta, args)) return 0;
+
   // I2 (Bob): its Stop payload never carries `transcript_path`, so there is never a transcript
   // to distil — and the bare envelope itself is not notes text (that would waste a model call
   // on `{"event":"Stop","session_id":"s"}`). Scoped to `--host bob`: every other host's Stop/