geneseed 4.4.0 → 4.5.0

package/js/hosts/hooks.mjs

@@ -255,8 +255,12 @@ const BLOCK_RULES = new Set(['law-1', 'law-4', 'rigor-5', 'ops-2']);
  * information a trimmed file loses. The re-read happens on the ask path only.
  */
 const MAX_LEDGER_LINES = 1000;
+// Exported for the done gate (`./hooks-done.mjs`), which records from Stop, not from `ask`.
+export function recordGate(root, verb, rule) { ledger(root, verb, rule); }
 function ledger(root, verb, rule) {
-  if (!root) return;
+  // `doctor --probe` asks on purpose; its asks are not the user's. Read here, on the rare ask
+  // path only: the variable silences the RECORD, never the decision.
+  if (!root || process.env.GENESEED_GATE_PROBE) return;
   try {
     const file = path.join(root, GATE_LEDGER);
     appendFileSync(file, `${JSON.stringify({
@@ -533,11 +537,15 @@ const DOTENV_RE = /(^|[\\/])\.env(\.[^\\/]*)?$/;
  * not seen here; CI running the checks is the boundary that holds against that.
  */
 export const SENSOR_LIST = '.geneseed/protected-checks.txt';
+// The done gate's list (`./hooks-done.mjs`, #289) protects itself too, with or without a
+// protected-checks list: emptying it would disarm the gate it feeds.
+export const DONE_LIST = '.geneseed/done-checks.txt';
 function protectedCheck(p) {
   try {
     const target = resolvePath(p);
     const root = gitRootOf(path.dirname(target));
     if (!root) return null;
+    if (normcase(path.relative(root, target)) === normcase(DONE_LIST)) return DONE_LIST;
     const text = readFileSync(path.join(root, SENSOR_LIST), 'utf8');
     // `normcase` folds case AND slashes on Windows, so both sides go through it, the trailing
     // separator of the prefix included.
@@ -579,7 +587,8 @@ function ruleDecide(args, payload) {
   const sensor = protectedCheck(p);
   if (sensor) {
     return ask(args, 'rule-gate', 'rigor-5', `Geneseed (External Gate) — ${p} is a protected `
-      + `check (${sensor}, listed in ${SENSOR_LIST}). A check the agent can edit is not a `
+      + `check (${sensor === DONE_LIST ? 'the done gate list itself'
+        : `${sensor}, listed in ${SENSOR_LIST}`}). A check the agent can edit is not a `
       + 'check: fix the code, not the check, unless the user asks for this edit.');
   }
   const target = ruleGateTarget(p, args.root);

package/js/hosts/installs.mjs

@@ -763,7 +763,8 @@ export function hookShellProblems(targets = installTargets(), platform = process
     out.push(was === 'bash'
       ? `[hooks] ${cfg}: hooks were emitted for Git Bash, which is no longer found, so Claude `
         + 'Code runs them under PowerShell where context/learn fail open (no effect) and '
-        + 'git-gate/rule-gate now BLOCK every call instead of gating it - run: geneseed rebuild-all'
+        + 'git-gate/rule-gate now BLOCK every call instead of gating it - run: geneseed rebuild-all, '
+        + 'then confirm with: geneseed doctor --probe'
       : `[note] ${cfg}: hooks were emitted for PowerShell, but Git Bash is now found - they work, `
         + 'and pay PowerShell startup on every call; geneseed rebuild-all switches them back');
   }

package/js/hosts/shim.mjs

@@ -118,14 +118,18 @@ export function shimDead() {
  */
 export function hookShimBody(runner, entry, platform = process.platform) {
   if (platform === 'win32') {
-    // Bare `exit /b` propagates the LIVE errorlevel; `%ERRORLEVEL%` would expand at parse
-    // time and return a stale one. Never plain `exit` — that kills the parent cmd.exe, so
+    // `exit /b %ERRORLEVEL%`, on its OWN line. A bare `exit /b` was here, on the claim that it
+    // propagates the live errorlevel, and that is false under `cmd /d /s /c` — Bob's hook
+    // shell, and Node's `shell: true`: the batch returned 0 after the gate exited 2, so every
+    // Bob block on Windows went through (#290; measured, see hook_form.test.mjs). `%ERRORLEVEL%`
+    // expands when ITS line is parsed, which is after the runner line has finished, so the value
+    // is the runner's, not a stale one. Never plain `exit` — that kills the parent cmd.exe, so
     // the emitted `|| exit 0` would never get to evaluate.
     return '@echo off\r\n'
       + 'rem Generated by Geneseed - do not edit. Rewritten on every emit.\r\n'
       + 'setlocal\r\n'
       + `"${runner}" "${entry}" %*\r\n`
-      + 'exit /b\r\n';
+      + 'exit /b %ERRORLEVEL%\r\n';
   }
   return '#!/bin/sh\n'
     + '# Generated by Geneseed - do not edit. Rewritten on every emit.\n'
@@ -281,18 +285,27 @@ const GIT_BASH_NAMES = new Set(['bash.exe', 'sh.exe', 'bash', 'sh']);
  */
 export function claudeHookShell(env = process.env, platform = process.platform) {
   if (platform !== 'win32') return 'bash';
+  return claudeGitBashPath(env) ? 'bash' : 'powershell';
+}
+
+/**
+ * The Git Bash `claudeHookShell` finds on Windows, as a path — or null. One rule, two readers:
+ * the emit only needs to know WHETHER, `doctor --probe` (`js/inspect/checks-probe.mjs`) needs
+ * the file itself, to run a gate through the same shell Claude would.
+ */
+export function claudeGitBashPath(env = process.env) {
   const read = (name) => Object.entries(env).find(([k]) => k.toUpperCase() === name)?.[1];
   const isFile = (p) => { try { return statSync(p).isFile(); } catch { return false; } };
   const forced = read('CLAUDE_CODE_GIT_BASH_PATH');
   if (forced && GIT_BASH_NAMES.has(path.basename(forced).toLowerCase()) && isFile(forced)) {
-    return 'bash';
+    return forced;
   }
   for (const raw of (read('PATH') || '').split(';')) {
     const dir = raw.replace(/"/g, '');
-    if (dir && isFile(path.join(dir, 'git.exe'))
-      && isFile(path.join(dir, '..', 'bin', 'bash.exe'))) return 'bash';
+    const bash = dir ? path.join(dir, '..', 'bin', 'bash.exe') : '';
+    if (dir && isFile(path.join(dir, 'git.exe')) && isFile(bash)) return path.resolve(bash);
   }
-  return 'powershell';
+  return null;
 }
 
 /**

package/js/inspect/checks-constitution.mjs

@@ -170,12 +170,12 @@ const DOCTRINE_TOKEN_RE = /\{\{DOCTRINE(?:\}\}|:)/;
  * The rules the hooks enforce at the tool boundary, and the address each is bound to there. The
  * hook path cannot afford to read the canon on every tool call, so its gate-ledger keys
  * (`law-1`, `law-4`, `process-1`, `process-5`, `rigor-5`, `ops-2` in `js/hosts/hooks.mjs` and the OpenCode guard
- * plugin), `CONSENT_RULE` in `js/hosts/settings.mjs` and the console's `HOOK_GATED` stay
+ * plugin; `law-3` in the done gate, `js/hosts/hooks-done.mjs`), `CONSENT_RULE` in `js/hosts/settings.mjs` and the console's `HOOK_GATED` stay
  * number-keyed — and this pin is what turns a renumber that moves one of these rules into a
  * doctor failure instead of a gate silently guarding its neighbour.
  */
 export const HOOK_PINNED = {
-  'sealed-secrets': 'I', 'deletion-is-deliberate': 'IV',
+  'sealed-secrets': 'I', 'verify-before-asserting': 'III', 'deletion-is-deliberate': 'IV',
   'persist-insight': 'process 1', 'consent-before-push': 'process 5', 'external-gate': 'rigor 5',
   'commands-must-return': 'ops 2',
 };

package/js/inspect/checks-probe.mjs

@@ -0,0 +1,295 @@
+/**
+ * `geneseed doctor --probe` — prove each installed gate still REFUSES, not just that it exists.
+ *
+ * A gate that is registered, launches and then allows everything looks exactly like a working
+ * one: `onFailure: "block"` (ADR 0007) covers a gate that never starts, `shimProblems` covers the
+ * shim's paths and `hookShellProblems` infers shell drift — none of them observes a verdict. So
+ * this runs each live install's own gate command, AS ITS SETTINGS SPELL IT, through the shell
+ * the host would use, on two canned payloads: one Law IV call that every build must refuse
+ * (`git reset --hard HEAD`, also in Bob's `BLOCK_RULES`) and one that must pass (`git status`).
+ * Both directions are judged, because "allows everything" and "refuses everything" (the
+ * PowerShell-fallback case `hookShellProblems` can only infer) are both broken gates.
+ *
+ * WHY THIS SPAWNS, and why it is opt-in. ADR 0002 allows a CLI spawn only as a declared row of
+ * `ALLOWED_SPAWNS` (`tests/unit/hook_cli.test.mjs`); this is the row that runs INSTALLED code
+ * rather than the checkout's, which is why it waits for `--probe` instead of riding every
+ * `doctor`. It runs only a command that `liveRecordedHooks` returns — recorded in our own
+ * manifest AND live in the settings — and that still carries `geneseed-hook`, a gate verb and
+ * `--root`; anything else is reported and never run. Nothing the payloads name is executed:
+ * the gate only reads them, from an empty temp dir.
+ *
+ * WHAT A PASS DOES NOT CLAIM. The probe runs under doctor's environment — this terminal's PATH
+ * and HOME — not the host app's. A host launched with a different environment (an empty HOME, a
+ * PATH without the shell's tools) can still break a gate that passes here.
+ *
+ * `GENESEED_GATE_PROBE=1` keeps the probe's asks out of the gate ledger (`ledger()` in
+ * `js/hosts/hooks.mjs`), so `status` never counts a doctor run as a refusal.
+ */
+import { existsSync, mkdtempSync, rmSync } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { liveRecordedHooks } from '../hosts/hosts.mjs';
+import { claudeCfg, installState, installTargets } from '../hosts/installs.mjs';
+import { SHIM_MARK, claudeGitBashPath } from '../hosts/shim.mjs';
+import { which } from '../lib/paths.mjs';
+import { NO_WINDOW } from '../lib/proc.mjs';
+import { NOTE, withTempDir } from './scan.mjs';
+import { spawnSync } from 'node:child_process';
+
+/**
+ * The gate that refuses Law IV on each host (`claudeHookGroups`, `js/hosts/settings.mjs`). On
+ * Claude and OpenClaude it is `git-gate`; `tool-gate` there only counts Skill/Agent calls. Bob
+ * runs everything through `tool-gate --host bob`. OpenCode's guard is an in-process plugin with
+ * no command: `guardProbe` below imports it instead.
+ */
+export const PROBED_VERB = { claude: 'git-gate', openclaude: 'git-gate', bob: 'tool-gate' };
+
+export const BAD_COMMAND = 'git reset --hard HEAD';
+export const GOOD_COMMAND = 'git status';
+
+const PROBE_TIMEOUT_MS = 20_000;
+
+/** A PreToolUse payload in Claude's shape — the shape every probed host's gate reads. */
+export function probePayload(command, cwd) {
+  return JSON.stringify({
+    session_id: 'geneseed-probe', hook_event_name: 'PreToolUse', tool_name: 'Bash',
+    tool_input: { command }, cwd,
+  });
+}
+
+/**
+ * The shell a host runs this handler under, as `{ exe, argv, label, verbatim }` — or null when
+ * that shell is not on this machine. Mirrors the emit's own rule: an explicit
+ * `shell: "powershell"` wins; Bob runs `cmd /c` on Windows; Claude/OpenClaude run Git Bash
+ * there (`claudeGitBashPath`, the rule `claudeHookShell` uses); `sh -c` everywhere else.
+ */
+export function probeShell(host, handler, platform = process.platform, env = process.env) {
+  const cmd = handler.command;
+  if (handler.shell === 'powershell') {
+    const ps = which('powershell') || which('pwsh');
+    return ps ? { exe: ps, argv: ['-NoProfile', '-NonInteractive', '-Command', cmd], label: 'PowerShell' }
+      : null;
+  }
+  if (platform !== 'win32') return { exe: which('sh') || '/bin/sh', argv: ['-c', cmd], label: 'sh' };
+  if (host === 'bob') {
+    // `/s /c "<cmd>"` with verbatim arguments: cmd strips the outer quotes and keeps the
+    // command's own quoting. Node's default quoting would turn its `"` into `\"`, which cmd
+    // does not unescape.
+    const cmdExe = env.ComSpec || env.COMSPEC || which('cmd');
+    return cmdExe ? { exe: cmdExe, argv: ['/d', '/s', '/c', `"${cmd}"`], label: 'cmd', verbatim: true }
+      : null;
+  }
+  const bash = claudeGitBashPath(env);
+  return bash ? { exe: bash, argv: ['-c', cmd], label: 'Git Bash' } : null;
+}
+
+const ASK_RE = /"permissionDecision":\s*"(?:ask|deny)"/;
+
+/** Did the gate refuse? Exit 2 on Bob; on Claude-shaped hosts exit 2 or an ask/deny verdict. */
+export function refused(host, r) {
+  if (host === 'bob') return r.status === 2;
+  return r.status === 2 || (r.status === 0 && ASK_RE.test(r.stdout || ''));
+}
+
+/**
+ * The verdict for one gate, from its two runs — null when the gate is sound, or the problem.
+ * Pure, so the whole verdict table is pinned without spawning.
+ */
+export function probeVerdict(host, bad, good) {
+  for (const r of [bad, good]) {
+    if (r.status !== 0 && r.status !== 2) {
+      const why = r.error ? r.error : `exit ${r.status}`;
+      const tail = (r.stderr || '').trim().split(/\r?\n/).pop();
+      return `does not run (${why}${tail ? `: ${tail}` : ''})${host === 'claude'
+        ? ' — Claude blocks every matching call while this lasts (onFailure: block)'
+        : ' — the host lets every call through while this lasts'}`;
+    }
+  }
+  if (!refused(host, bad)) return `registered but not refusing — \`${BAD_COMMAND}\` went through`;
+  if (refused(host, good)) return `refuses everything — \`${GOOD_COMMAND}\` was refused too`;
+  return null;
+}
+
+/** Is this recorded command one of ours for `verb`? A gate verb, `--root`, and our shim. */
+export function isOurGate(command, verb) {
+  return command.includes(` ${verb} --root`) && command.includes(SHIM_MARK);
+}
+
+/** One spawn of one handler on one payload. THE ONE SPAWN of this module. */
+function runOnce(shell, payload, cwd, env) {
+  const r = spawnSync(shell.exe, shell.argv, {
+    input: payload, cwd, env, encoding: 'utf-8', timeout: PROBE_TIMEOUT_MS,
+    windowsVerbatimArguments: Boolean(shell.verbatim), ...NO_WINDOW,
+  });
+  const e = /** @type {NodeJS.ErrnoException | undefined} */ (r.error);
+  const error = e ? (e.code === 'ETIMEDOUT' ? 'timed out' : e.message) : null;
+  return { status: r.status, stdout: r.stdout, stderr: r.stderr, error };
+}
+
+/**
+ * Probe every live Claude-shaped install. Returns `{ problems, probed }`: `problems` in
+ * doctor's line format, `probed` the labels of the gates that ran and behaved.
+ * `targets`, `platform` and `env` are parameters so a test hands it a sandboxed install.
+ */
+export function gateProbe(targets = installTargets(), { platform = process.platform, env = process.env } = {}) {
+  const problems = [];
+  const probed = [];
+  for (const [host, scope, root] of targets) {
+    const verb = PROBED_VERB[host];
+    if (!verb || installState(root, host, scope) !== 'active') continue;
+    const cfg = claudeCfg(root, scope, host);
+    const gates = liveRecordedHooks(cfg)
+      .filter(([event, h]) => event === 'PreToolUse' && h.command.includes(` ${verb} --root`));
+    if (!gates.length) {
+      problems.push(`[probe] ${cfg}: no live ${verb} hook in its settings — nothing refuses `
+        + 'a destructive call at the boundary — run: geneseed rebuild-all');
+      continue;
+    }
+    for (const [, handler] of gates) {
+      const label = `[probe] ${cfg}: ${verb}`;
+      if (!isOurGate(handler.command, verb)) {
+        problems.push(`${label} not probed — its command does not run ${SHIM_MARK}, and doctor `
+          + 'runs nothing else from a settings file');
+        continue;
+      }
+      const shell = probeShell(host, handler, platform, env);
+      if (!shell) {
+        problems.push(`${label} does not run — the shell ${host} would use is not on this machine`);
+        continue;
+      }
+      const verdict = withTempDir((tmp) => {
+        const runEnv = { ...env, GENESEED_GATE_PROBE: '1', CLAUDE_PROJECT_DIR: tmp };
+        const bad = runOnce(shell, probePayload(BAD_COMMAND, tmp), tmp, runEnv);
+        const good = runOnce(shell, probePayload(GOOD_COMMAND, tmp), tmp, runEnv);
+        return probeVerdict(host, bad, good);
+      }, 'geneseed-probe-');
+      if (verdict) problems.push(`${label} under ${shell.label} ${verdict}`);
+      else probed.push(`${path.normalize(cfg)} (${verb}, ${shell.label})`);
+    }
+  }
+  return { problems, probed };
+}
+
+// ---- OpenCode: the guard plugin, probed in-process ------------------------------------------
+
+export const GUARD_PLUGIN = 'geneseed-guard.js';
+/** The guard blocks catastrophic shell (`SHELL_BLOCK_RE`); destructive git is the permission
+ * prompt's job there, and only WARNS in the guard — so its must-refuse payload is this one. */
+export const GUARD_BAD_COMMAND = 'rm -rf /';
+
+/** The guard plugin of an OpenCode install: `<global>/plugins/` or `<repo>/.opencode/plugins/`
+ * (`emitOpencodeInto` copies the plugins to `<dir>/plugins`). */
+export function guardPluginPath(root, scope) {
+  return path.join(scope === 'global' ? root : path.join(root, '.opencode'), 'plugins', GUARD_PLUGIN);
+}
+
+/** Run `fn` with stderr swallowed and `GENESEED_GATE_PROBE` set, both restored after. */
+async function quietProbe(fn) {
+  const write = process.stderr.write;
+  const saved = process.env.GENESEED_GATE_PROBE;
+  process.stderr.write = () => true;
+  process.env.GENESEED_GATE_PROBE = '1';
+  try { return await fn(); } finally {
+    process.stderr.write = write;
+    if (saved === undefined) delete process.env.GENESEED_GATE_PROBE;
+    else process.env.GENESEED_GATE_PROBE = saved;
+  }
+}
+
+/**
+ * Both plugin APIs, each on both payloads: `{ v1: [badRefused, goodRefused], v2: [...] }`.
+ * V1 (`server`) refuses by THROWING `[geneseed-guard] …`; V2 (`setup`) by RENAMING the call
+ * (`setupV2`'s docblock). An unexpected throw is not a refusal — it is rethrown, and the caller
+ * reports the guard as broken.
+ */
+export async function runGuard(mod, cwd) {
+  const v1 = async (command) => {
+    const hooks = await mod.server({ worktree: cwd, directory: cwd });
+    try {
+      await hooks['tool.execute.before']({ tool: 'bash' }, { args: { command } });
+      return false;
+    } catch (e) {
+      if (String(e?.message || '').startsWith('[geneseed-guard]')) return true;
+      throw e;
+    }
+  };
+  const v2 = async (command) => {
+    /** @type {((event: { tool: string }) => Promise<void>) | null} */
+    let hook = null;
+    await mod.setup({
+      location: { project: { directory: cwd }, directory: cwd },
+      tool: { hook: (name, fn) => { if (name === 'execute.before') hook = fn; } },
+    });
+    if (!hook) throw new Error('setup registered no execute.before hook');
+    const event = { tool: 'bash', input: { command } };
+    await hook(event);
+    return event.tool !== 'bash';
+  };
+  return {
+    v1: [await v1(GUARD_BAD_COMMAND), await v1(GOOD_COMMAND)],
+    v2: [await v2(GUARD_BAD_COMMAND), await v2(GOOD_COMMAND)],
+  };
+}
+
+/** The verdict for one API's pair — null when sound. */
+export function guardVerdict([badRefused, goodRefused]) {
+  if (!badRefused) return `registered but not refusing — \`${GUARD_BAD_COMMAND}\` went through`;
+  if (goodRefused) return `refuses everything — \`${GOOD_COMMAND}\` was refused too`;
+  return null;
+}
+
+/**
+ * Probe every live OpenCode install's guard plugin by importing it into this process and
+ * calling its hooks — no spawn. Proves the installed FILE and its logic under Node, not under
+ * OpenCode's runtime (the weekly host canary proves the plugin loads there). Returns
+ * `{ problems, probed }` like `gateProbe`; a guard this environment switched off
+ * (`GENESEED_GUARD=off|warn`) is a NOTE, not a failure — that switch is the user's.
+ *
+ * Only a file named `geneseed-guard.js` in an install `installState` recognises is imported,
+ * and only one whose default export is `{ id: 'geneseed-guard', server, setup }`.
+ */
+export async function guardProbe(targets = installTargets(), env = process.env) {
+  const problems = [];
+  const probed = [];
+  for (const [host, scope, root] of targets) {
+    if (host !== 'opencode' || installState(root, host, scope) !== 'active') continue;
+    const file = guardPluginPath(root, scope);
+    const label = `[probe] ${file}`;
+    if (!existsSync(file)) {
+      problems.push(`${label}: no guard plugin — nothing refuses a catastrophic command at the `
+        + 'boundary — run: geneseed rebuild-all');
+      continue;
+    }
+    const mode = String(env.GENESEED_GUARD || 'on').toLowerCase();
+    if (['off', '0', 'false', 'no', 'warn'].includes(mode)) {
+      problems.push(`${NOTE}${label}: not probed — GENESEED_GUARD=${mode} in this environment `
+        + 'switches the guard off');
+      continue;
+    }
+    let verdicts;
+    try {
+      const mod = (await import(pathToFileURL(file).href)).default;
+      if (mod?.id !== 'geneseed-guard' || typeof mod.server !== 'function' || typeof mod.setup !== 'function') {
+        problems.push(`${label}: not probed — it does not export the Geneseed guard `
+          + '({ id, server, setup }) — run: geneseed rebuild-all');
+        continue;
+      }
+      verdicts = await withTempDirAsync((tmp) => quietProbe(() => runGuard(mod, tmp)));
+    } catch (e) {
+      problems.push(`${label}: does not run (${e?.message || e})`);
+      continue;
+    }
+    const bad = [['V1', guardVerdict(verdicts.v1)], ['V2', guardVerdict(verdicts.v2)]]
+      .filter(([, v]) => v);
+    for (const [api, v] of bad) problems.push(`${label}: guard (OpenCode ${api} hook) ${v}`);
+    if (!bad.length) probed.push(`${path.normalize(file)} (guard, in-process)`);
+  }
+  return { problems, probed };
+}
+
+/** `withTempDir` for an async body: the dir outlives the promise, then goes. */
+async function withTempDirAsync(fn) {
+  const tmp = mkdtempSync(path.join(os.tmpdir(), 'geneseed-probe-'));
+  try { return await fn(tmp); } finally { rmSync(tmp, { recursive: true, force: true }); }
+}

package/js/inspect/cost.mjs

@@ -28,7 +28,7 @@ import { isFile, readText } from '../lib/fs.mjs';
  * console draws it on the cost chart, so it lives here, once, where both read it. Raise it by
  * exactly the measured overrun and say why in that test's docblock, which keeps its history.
  */
-export const CARRIER_CEILING = { full: 62_107, lean: 38_976 };
+export const CARRIER_CEILING = { full: 62_219, lean: 39_088 };
 
 const decode = (p) => readText(p).split('\r\n').join('\n');
 

package/js/inspect/doctor.mjs

@@ -39,6 +39,7 @@ import {
 import { validateIsVendored } from '../hosts/native.mjs';
 import { printOut } from '../lib/fs.mjs';
 import { authoringProblems, loopProblems } from './checks-authoring.mjs';
+import { gateProbe, guardProbe } from './checks-probe.mjs';
 import {
   checkBuild, colorThemeProblems, renderedProblems, themeParityProblems,
 } from './checks-build.mjs';
@@ -188,6 +189,7 @@ export function claudeBobEmitProblems(themeName) {
  */
 export function doctorCollect({
   theme = null, allThemes = false, bundle = null, noBundle = false, groups = null,
+  probe = false, probed = null, extraProbeProblems = [],
 } = {}) {
   const available = themeFiles().map(stemOf);
   if (!available.length) return [[], ['[doctor] no themes found']];
@@ -208,6 +210,11 @@ export function doctorCollect({
   // placed after them could only ever observe the freshly repaired file and would be dead
   // code that always reports clean. Reported in its usual slot further down.
   const shimProbs = shimProblems();
+  // `--probe` (js/inspect/checks-probe.mjs) runs the installed gates THROUGH the shim, so it is
+  // sampled here for the same reason: after the emits it could only meet a repaired shim.
+  // `probed` collects the gates that behaved, for `cmdDoctor`'s summary line.
+  const probeRun = probe ? gateProbe() : null;
+  if (probeRun && probed) probed.push(...probeRun.probed);
   let problems = [];
   withTempDir((tmp) => {
     for (const themeName of themes) {
@@ -237,6 +244,9 @@ export function doctorCollect({
   // misbehave under PowerShell (Task 15) — context/learn fail open, and since Task 1 the two
   // gates fail CLOSED instead (`onFailure: "block"`). The reverse direction is a note.
   problems = problems.concat(ran('hook_shell', 'Hook shell', hookShellProblems()));
+  if (probeRun) {
+    problems = problems.concat(ran('probe', 'Gate probe', [...probeRun.problems, ...extraProbeProblems]));
+  }
   // A machine check like the shim's: OPENCODE_CONFIG_DIR adds a dir, it does not replace one.
   const shadow = opencodeShadowedInstall();
   problems = problems.concat(ran('opencode_dirs', 'OpenCode config dirs', shadow
@@ -281,9 +291,19 @@ function captureBoth(fn) {
  * maintainer sweep. The cross-theme parity check runs in every mode.
  */
 export function cmdDoctor(args) {
+  // `--probe` alone is asynchronous: the OpenCode guard is probed by importing the installed
+  // plugin (`guardProbe`), and `import()` has no synchronous form. Every other path stays
+  // synchronous, because `validate` and `setup` call this and read its number directly.
+  if (args.probe) return guardProbe().then((guard) => doctorReport(args, guard));
+  return doctorReport(args, null);
+}
+
+function doctorReport(args, guard) {
+  const probed = guard ? [...guard.probed] : [];
   const [themes, collected] = doctorCollect({
     theme: args.theme, allThemes: Boolean(args.all), bundle: args.bundle,
-    noBundle: Boolean(args.noBundle),
+    noBundle: Boolean(args.noBundle), probe: Boolean(args.probe), probed,
+    extraProbeProblems: guard ? guard.problems : [],
   });
   if (!themes.length) {
     printOut(`${collected.length ? collected[0] : '[doctor] no themes found'}\n`);
@@ -303,6 +323,12 @@ export function cmdDoctor(args) {
   const note = scoped
     ? `  (scoped to installed theme '${themes[0]}'; run with --all to sweep every theme)` : '';
   for (const n of notes) printOut(`${n}\n`);
+  // The probe's line on success, and the limit it cannot see past, said every time.
+  if (args.probe) {
+    printOut(`[probe] ${probed.length} gate(s) refused a destructive call and let a safe one `
+      + `through${probed.length ? `: ${probed.join(', ')}` : ''} — under this terminal's `
+      + 'environment, not the host app\'s\n');
+  }
   if (problems.length) {
     printOut(`[doctor] ${problems.length} problem(s) across ${themes.length} theme(s):\n`);
     for (const p of problems) printOut(`  - ${p}\n`);

package/js/inspect/inventory.mjs

@@ -94,7 +94,7 @@ export const SKILL_CLASS = {
   loop: 'design', 'brick-forge': 'design',
   'codebase-design': 'design', wayfinder: 'design',
   develop: 'build', refactor: 'build', debug: 'build', dependencies: 'build',
-  'frontend-design': 'build', prototype: 'build',
+  'frontend-design': 'build', prototype: 'build', deck: 'build',
   'forge-mcp': 'build', bruno: 'build', worktree: 'build',
   'geneseed-code-review': 'review', 'fresh-eyes': 'review', 'security-audit': 'review',
   'roast-me': 'review', 'review-response': 'review', ponytail: 'review',

package/package.json

@@ -1,7 +1,7 @@
 {
   "//": "Every field here is argued and gated in tests/unit/package_manifest.test.mjs. `files`, `bin` and `engines` each have a test that fails when reality drifts from this file; `version` mirrors harness.config.json and is gated too. Read that docblock before editing this one.",
   "name": "geneseed",
-  "version": "4.4.0",
+  "version": "4.5.0",
   "description": "A portable, theme-able harness you implant once and use everywhere to grow a disciplined AI coding agent.",
   "keywords": [
     "ai",

package/registry.json

@@ -197,6 +197,13 @@
       "added": "2026-06-03",
       "last_verified": "2026-09-06"
     },
+    "skills/deck": {
+      "status": "experimental",
+      "version": "1.0.0",
+      "owner": "Guillaume Lemer",
+      "added": "2026-10-16",
+      "last_verified": ""
+    },
     "skills/dependencies": {
       "status": "approved",
       "version": "1.0.0",

package/src/AGENT.md.tmpl

@@ -256,6 +256,7 @@ the ten council seats are convened by the [council {{SKILL}}]({{DIR_SKILLS}}/cou
 | [bruno]({{DIR_SKILLS}}/bruno.md) | creating, converting, or testing a Bruno API collection — requests, environments, assertions, chaining — from routes, OpenAPI, curl, or an endpoint list |
 | [prose]({{DIR_SKILLS}}/prose.md) | writing prose for a human — a commit body, PR, doc, comment, memory note, or reply — that should not read like a model wrote it |
 | [frontend-design]({{DIR_SKILLS}}/frontend-design.md) | building or reshaping a UI that should carry a deliberate point of view, not a templated default |
+| [deck]({{DIR_SKILLS}}/deck.md) | a presentation, slides or a deck with no file format named — one offline HTML file |
 | [handoff]({{DIR_SKILLS}}/handoff.md) | context filling, or passing work to another agent or session |
 | [roast-me]({{DIR_SKILLS}}/roast-me.md) | you want your own ask, plan or idea torn apart, brutally and actionably (code goes to code review) |
 | [council]({{DIR_SKILLS}}/council.md) | a decision, change, or discussion needs debating from several points of view before committing |

package/src/skills/deck.md

@@ -0,0 +1,56 @@
+# {{SKILL}}: deck
+
+> {{DESC_DECK}}
+<!-- aliases: slides, presentation -->
+
+**Trigger:** the user asks for a presentation, slides or a deck without naming a file format.
+An explicit `.pptx` request belongs to the host's pptx skill. To change an existing deck, edit
+its HTML file in place rather than regenerating it.
+
+## Procedure
+1. **Interview, one question at a time**, each with a recommended default the user can accept
+   with "ok": subject and source; audience (technical peers); goal — inform, convince, train,
+   report (inform); length as duration or slide count (~10); style — sober, editorial, dark
+   technical, playful, or an imposed brand's colours and logo (sober, follows system light/dark);
+   usage — projected live, read alone, or both (both); speaker notes (no); PDF export (yes);
+   density (from usage: projected 1-3 bullets a slide, read alone 4-8); a browser render check
+   (only if asked). Given a source or outline, skip what it answers, batch the rest in one
+   message, and go to step 2.
+2. **Propose the outline** — parts and one line per slide — and generate only once the user
+   validates or corrects it. Write the slides in the user's language unless asked otherwise.
+3. **Write the whole deck by hand as ONE self-contained file** — no bundled shell, no CDN, no
+   external script; all CSS and JS inline:
+   - A fixed 1920x1080 stage scaled uniformly to the window, letterboxed, never reflowed; each
+     slide a `<section>` with that fixed size, never `height: auto`. Inactive slides hidden with
+     `visibility`/`opacity`, not layout tricks.
+   - Keys ←/→, Space, PageUp/PageDown, Home/End, and touch swipe; the URL hash `#N` tracks the
+     slide, with back/forward working.
+   - `@media print` plus `@page` size so each slide prints as one page (`@page` size is Baseline
+     2024; animations never reach the PDF).
+   - Speaker notes in `<aside class="notes">`, hidden, toggled with N.
+   - A system font stack; a web font only with a system fallback, so the deck degrades offline.
+   - Diagrams as inline SVG; raster images base64 only when small (base64 adds ~33%).
+   - Colours as `:root` variables with a `prefers-color-scheme: dark` set and checked contrast;
+     one real heading per slide in a sane order; `prefers-reduced-motion` honoured; animations
+     off unless asked for.
+   - Palette, type and avoiding templated defaults: follow the
+     [frontend-design {{SKILL}}](../{{DIR_SKILLS}}/frontend-design.md) — not repeated here.
+4. **Write** `<slug>.html` in the working directory unless the user gives a path; ask before
+   overwriting an existing file. Open it in the default browser with the platform's opener
+   (`open`, `xdg-open`, or `start ""` on Windows).
+5. **Verify.** By default, hold every slide to the density limit and say plainly that the render
+   was not checked. Only on request, open the deck in a browser the host offers (Chrome MCP,
+   Orca browser, Playwright) and run this — it works because inactive slides keep their layout:
+   ```js
+   [...document.querySelectorAll('section')].map((s, i) => [i + 1, s])
+     .filter(([, s]) => s.scrollHeight > s.clientHeight || s.scrollWidth > s.clientWidth)
+     .map(([i]) => i)
+   ```
+   Fix each flagged slide and re-run, two repair rounds at most ({{DOCTRINE:bound-the-loop}}).
+6. Reply in one line: the file, slide count, ←/→ to move, N for notes, Ctrl+P for PDF.
+
+## Done when
+- One offline HTML file opens in the browser, navigates by key, swipe and hash, prints one slide
+  per page, and the reply states whether the render was checked.
+
+<!-- INCLUDE: skills/_self-improvement.md -->

package/src/skills/frontend-design.md

@@ -4,6 +4,7 @@
 
 **Trigger:** building a new UI or reshaping an existing one, and it should carry a
 deliberate point of view rather than read as a templated default.
+A presentation or slide deck goes to the [deck {{SKILL}}](../{{DIR_SKILLS}}/deck.md).
 
 **Requires:** a way to render and screenshot the result (a browser or the host's
 preview tool) — the second-pass critique in step 6 cannot run without one.

package/src/skills/rule.md

@@ -73,7 +73,11 @@ re-derived. Then take exactly one branch.
    rebuild would have seeded it.
 6. **Draft in the file's own format**: the next free `## R<n> — Title` heading, an
    optional `(scope: user|project | source: …)` metadata line, then the rule in one
-   short paragraph, plain and testable. For a promotion from {{MEMORY}}, set
+   short paragraph, plain and testable. For a rule the user stated, `source:` keeps
+   their own words and the day they said them — `source: user 2026-10-16 "never push
+   red"` — one sentence at most: it is what later tells a stale rule from a changed
+   mind. The metadata line splits on `|`, so write any `|` inside the quote as `/` and
+   say so when you show the draft. For a promotion from {{MEMORY}}, set
    `source:` to the memory's name and add `trial until:` about a month out — a
    promoted rule starts on probation.
 7. Show the exact text to the user and wait for explicit consent ({{LAW:deletion-is-deliberate}}) before
@@ -90,7 +94,12 @@ the user picks "rule" out of impatience and the set inflates.
 **Review flow** (on request, or when a `trial until:` date has passed): for each rule
 due, ask whether it actually fired since adoption — graduate it (drop the trial
 marker), demote it back to a {{MEMORY}} fact, or delete it. Same consent gate as
-adoption.
+adoption. Two more cases are due at any time:
+- **Contradicted.** The user's later words contradict a rule: the rule is the suspect.
+  Quote both — its `source:` and the new words — and ask which stands.
+- **Broken while only read.** A rule nothing checks but reading it, broken twice
+  anyway, is step 1's mechanical case: propose the hook or check rather than
+  rewording it.
 
 **Consolidation flow** → read [rule/consolidate.md](rule/consolidate.md) and follow it.
 

package/themes/_TEMPLATE.json

@@ -142,6 +142,7 @@
   "DESC_BRUNO": "<one-line description: build, reorganise or test a Bruno API collection — requests, environments, assertions, chaining — every secret a placeholder>",
   "DESC_PROSE": "<one-line description: write prose for a human that doesn't read like a model — cut filler, active voice, vary rhythm, trust the reader>",
   "DESC_FRONTEND_DESIGN": "<one-line description: design a UI with intent — palette/type/layout chosen for the brief, not templated defaults; plan tokens, critique against the brief, keep one bold move>",
+  "DESC_DECK": "<one-line description: build slides or a presentation as one self-contained offline HTML file — short interview, outline approved first, keys, URL hash, one slide per printed page>",
   "DESC_WORKFLOW": "<one-line description: run a saved, code-driven workflow that orchestrates subagents deterministically>",
   "AGENT_COLORS": {
     "architect": "primary",