geneseed 4.4.1 → 4.6.0

package/CHANGELOG.md

@@ -8,6 +8,43 @@ label. For the capability ↔ spec map, see [SHIPPED.md](SHIPPED.md).
 
 ## [Unreleased]
 
+## [4.6.0] — 2026-10-17
+
+Minor: a refactor and cleanup pass over everything since 3.15.0, and the nine gate and counter bugs it turned up.
+
+### Upgrade notes
+- **Node 22.7.0 or newer is now required** (was 22.3.0). `doctor --probe` imports the installed OpenCode guard plugin, an ES module under a package.json with no `type`; Node detects that syntax by default only from 22.7.0 (#303).
+- Run `geneseed rebuild-all` once after updating so the installed hooks and OpenCode plugins pick up the fixes below.
+
+### Fixed
+- **Bob no longer blocks removing a secret.** The credential scan read the text being replaced (`search`, and the SEARCH half of an `apply_diff`), so an agent deleting a leaked key was hard-refused. Only what is written is scanned now; planting a key still blocks (#304).
+- **The done gate needs the whole command.** A declared check such as `npm run lint` was counted as run by `npm run lint:fix`, by `echo npm run lint`, or by a commit message naming it. The check must now open a command segment, end at a boundary and sit outside quotes, on Claude Code and OpenCode alike (#307).
+- **The OpenCode done reminder counts only edits inside the project.** An `apply_patch` outside the repo armed it, and a folder named like `..cache/` was taken for outside (#310). The wiki `put` had the same over-strict path check (#312).
+- **Usage counting.** The OpenCode guard no longer counts Skill and subagent calls in a repo listed in `excludes.json` (#308), and OpenCode 2's `subagent` tool is now counted (#311). The console's usage endpoint only reads the ledger and never rewrites it, so a concurrent append can no longer be lost (#305).
+- **The console shows *Verify Before Asserting* as hook-gated**, matching the doctor, since the done gate enforces it (#306).
+- The dead-shim warning names the release (4.0.0) instead of an internal plan step (#302).
+
+### Changed
+- Behaviour-preserving refactors across inspect, the OpenCode plugins and emitters, hosts, the web layer, and maintain/build (#297–#301). The scorecard's YAML reader moved to `js/inspect/scorecard-yaml.mjs`. Unused exports and duplicated helpers were removed, and parity tests now pin more of the code the OpenCode plugins share.
+
+## [4.5.0] — 2026-10-17
+
+Minor: gates that are proven, not just present — a done gate at turn end, `doctor --probe`, and Bob's refusals restored on Windows.
+
+### Upgrade notes
+- Run `geneseed rebuild-all` once after updating: it rewrites the Windows hook shim (Bob's gates block again) and re-emits the rule skill.
+- The done gate is off until a project lists its checks in `.geneseed/done-checks.txt`.
+
+### Added
+- **Done gate (#289).** A project that lists its checks in `.geneseed/done-checks.txt` gets *Verify Before Asserting* enforced when a turn ends: on Claude Code and OpenClaude, a turn that edited files cannot end until every listed check has passed, unpiped, after the last edit (at most one block per turn). OpenCode 1 gets a reminder on the next request; Bob and OpenCode 2 are not judged and log so. The gate lives inside `learn`, before its model call, so the emitted settings are unchanged. The list protects itself through *External Gate*.
+- **`geneseed doctor --probe`.** This is opt-in. For each live Claude Code, OpenClaude and Bob install, it runs the installed gate command exactly as the host's settings spell it, through the host's own shell. It sends `git reset --hard HEAD`, which the gate must refuse, and `git status`, which it must let through. A gate that allows both, refuses both, or does not run is a doctor failure. The probe runs under your terminal's environment, not the host app's. Its asks are kept out of the gate ledger (`GENESEED_GATE_PROBE`). The OpenCode guard plugin is probed in-process: the installed file is imported and its hook called through both plugin APIs, with `rm -rf /` as the call it must refuse, and `GENESEED_GUARD=off|warn` reported as a note. The PowerShell-fallback warning now suggests running the probe (#290).
+
+### Changed
+- **A stated rule keeps the user's own words.** The rule skill now writes `source: user <date> "<their sentence>"` for a rule the user stated, so a stale rule can be told from a changed mind. Its review flow gains two cases: a rule the user's later words contradict, and a rule only checked by reading that was broken twice (#288).
+
+### Fixed
+- **Bob gates now block on Windows.** The hook shim (`~/.geneseed/bin/geneseed-hook.cmd`) ended with a bare `exit /b`, which returns 0 under `cmd /c` whatever the gate exited. As a result, Bob's exit-2 refusals (Laws I and IV, protected checks, root scans) went through. The shim now ends with `exit /b %ERRORLEVEL%`. Claude Code and OpenClaude were not affected, because their gates answer through stdout and exit 0. Run `geneseed rebuild-all` once to rewrite the shim (#290).
+
 ## [4.4.1] — 2026-10-16
 
 A presentation skill.

package/README.md

@@ -8,7 +8,7 @@
 [![CI](https://github.com/Arylmera/Geneseed/actions/workflows/ci.yml/badge.svg)](https://github.com/Arylmera/Geneseed/actions/workflows/ci.yml)
 [![AI Harness Scorecard](https://img.shields.io/badge/AI%20Harness%20Scorecard-A%2095.3%2F100-brightgreen)](#ai-harness-scorecard)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
-[![Node >= 22.3](https://img.shields.io/badge/node-%3E%3D22.3-5fa04e)](package.json)
+[![Node >= 22.7](https://img.shields.io/badge/node-%3E%3D22.7-5fa04e)](package.json)
 [![zero dependencies](https://img.shields.io/badge/deps-zero-success)](package.json)
 [![Themes](https://img.shields.io/badge/themes-14-9cf)](themes/)
 [![Skills](https://img.shields.io/badge/skills-47-blueviolet)](src/skills/)
@@ -75,7 +75,7 @@ geneseed-build --theme imperial  # Warhammer 40k voice, identical structure
 
 ### ⚡ The short way — `npx`
 
-The harness is published on npm as **[`geneseed`](https://www.npmjs.com/package/geneseed)** — three commands (`geneseed`, `geneseed-hook`, `geneseed-build`), zero dependencies. One command, nothing cloned, nothing else to install. The only prerequisite is **Node ≥ 22.3**.
+The harness is published on npm as **[`geneseed`](https://www.npmjs.com/package/geneseed)** — three commands (`geneseed`, `geneseed-hook`, `geneseed-build`), zero dependencies. One command, nothing cloned, nothing else to install. The only prerequisite is **Node ≥ 22.7**.
 
 ```bash
 npx geneseed setup            # the guided wizard
@@ -102,9 +102,9 @@ Every other route (Claude Code, Bob, OpenClaude, plain `AGENT.md`, per-repo inst
 
 ### 🧬 The long way — a git checkout
 
-Cloning is the route when npm is out of reach (a corporate network with no registry access) or when you intend to *change* the harness rather than use it. It needs **git** and the same **Node ≥ 22.3** as everything else — there is nothing extra to install.
+Cloning is the route when npm is out of reach (a corporate network with no registry access) or when you intend to *change* the harness rather than use it. It needs **git** and the same **Node ≥ 22.7** as everything else — there is nothing extra to install.
 
-**One step: run the installer at the root of the clone.** It checks that Node ≥ 22.3 and git are there and, when one is missing, says exactly what to install and where (on a managed PC: Software Center / Company Portal) — it never installs anything itself. Then it runs the setup wizard — which opens by listing the AI coding tools it can install into (OpenCode, Claude Code, IBM Bob, OpenClaude), each `ok` or with its install link, and asks before going on when none is there — and offers to open the web console.
+**One step: run the installer at the root of the clone.** It checks that Node ≥ 22.7 and git are there and, when one is missing, says exactly what to install and where (on a managed PC: Software Center / Company Portal) — it never installs anything itself. Then it runs the setup wizard — which opens by listing the AI coding tools it can install into (OpenCode, Claude Code, IBM Bob, OpenClaude), each `ok` or with its install link, and asks before going on when none is there — and offers to open the web console.
 
 ```bash
 git clone https://github.com/Arylmera/Geneseed.git
@@ -124,11 +124,11 @@ cd Geneseed
 
 Afterwards, `./geneseed setup` (`.\geneseed.cmd setup`) re-runs the wizard and bare `./geneseed` (`.\geneseed.cmd`) opens the web console. PowerShell runs a `.cmd` directly, so that is the PowerShell spelling too.
 
-Both launchers are thin shims over the Node CLI: they need `node` (22.3+) on `PATH`, and nothing else. Set `GENESEED_NODE` to an absolute path if `node` is not on `PATH` — under a version manager that only patches interactive shells, say. The wizard is plain text prompts on every console, old or new.
+Both launchers are thin shims over the Node CLI: they need `node` (22.7+) on `PATH`, and nothing else. Set `GENESEED_NODE` to an absolute path if `node` is not on `PATH` — under a version manager that only patches interactive shells, say. The wizard is plain text prompts on every console, old or new.
 
 ### 🟩 One runtime — Node, and nothing else
 
-Node ≥ 22.3 is the entire dependency list — every command, all five hook verbs, the web console and both generators run from it, and nothing any bundle ships needs a second interpreter.
+Node ≥ 22.7 is the entire dependency list — every command, all five hook verbs, the web console and both generators run from it, and nothing any bundle ships needs a second interpreter.
 
 ### ✅ After installing
 

package/SHIPPED.md

@@ -20,7 +20,7 @@ historical references, not files distributed with the repo.
 > **On version numbers.** [`harness.config.json`](harness.config.json)'s `version` is a
 > human-readable label only. The canonical identity of an installed harness is the
 > **source fingerprint** stamped in `.geneseed-version` (see `geneseed version`), not the
-> string. Current label: **4.4.1**.
+> string. Current label: **4.6.0**.
 
 ## Capabilities
 

package/adapters/opencode/HOW-OPENCODE-LOADS.md

@@ -94,7 +94,7 @@ changed for each plugin:
 | `@opencode-ai/plugin` `tool()` helper | `@opencode/plugin`; a plain JSON-schema `input` needs no helper |
 | `todo.updated`, session `summary` diffs | no V2 event. The activity cards show no todos or files on V2 |
 | tool part carries its name | `session.tool.called` has no name; it rides on `session.tool.input.started` |
-| tools `bash`, `apply_patch`, `task` | renamed `shell`, `patch`, `subagent` (the old ids are aliases). The guard's substring classes cover both spellings |
+| tools `bash`, `apply_patch`, `task` | renamed `shell`, `patch`, `subagent` (the old ids are aliases). The guard's substring classes cover both spellings; its usage counter takes `subagent` (type under `agent`) beside `task`, since the hook sees the name before alias resolution |
 
 None of this is checked by a mock alone: `node tests/host_canary.mjs` starts the real V1 and V2
 and fails on the host's own `failed to load plugin` log line.
@@ -124,7 +124,8 @@ to native **skills**, not slash commands (same `SKILL.md` shape as Claude Code).
 | plugin on `session.created` | **context plugin (v2)** — auto-discovers & injects the repo's `eager` docs |
 | plugin on `experimental.session.compacting` | **context plugin** — re-pushes the `eager` docs so they survive compaction |
 | plugin on `session.idle` | **learn plugin** — distils memory into `memory/` (debounced to fire once, at session end) |
-| plugin on `tool.execute.before` | **guard plugin** — blocks secret-file writes and catastrophic shell (Laws I & IV; `GENESEED_GUARD=off\|warn`) |
+| plugin on `experimental.chat.messages.transform` (V1) | **context plugin** — also adds the done gate's reminder when a check in `.geneseed/done-checks.txt` has not passed since the last edit (Verify Before Asserting); OpenCode 2 turns are not judged |
+| plugin on `tool.execute.before` | **guard plugin** — blocks secret-file writes and credential-shaped write content (Sealed Secrets), writes to a protected check or the done list (External Gate), catastrophic shell (Deletion Is Deliberate), a recursive whole-filesystem scan (Commands Must Return), the first rule-store write (Persist Insight) and protected wiki folders; logs each block to the gate ledger and counts skill/subagent use (`GENESEED_GUARD=off\|warn`) |
 | plugin registering a custom tool | **workflow plugin** — the `workflow` tool runs saved orchestration scripts from `workflows/` |
 | `context.json` / `.harness/` (manifest) | *optional* override when discovery doesn't fit |
 

package/adapters/opencode/plugins/geneseed-context.js

@@ -194,8 +194,12 @@ const EXCLUDE_DIRS = new Set([
   ".venv", "__pycache__", ".opencode", ".harness",
 ])
 
-async function isFile(p) { try { return (await fs.stat(p)).isFile() } catch { return false } }
-async function isDir(p) { try { return (await fs.stat(p)).isDirectory() } catch { return false } }
+async function isFile(p) {
+  try { return (await fs.stat(p)).isFile() } catch { return false }
+}
+async function isDir(p) {
+  try { return (await fs.stat(p)).isDirectory() } catch { return false }
+}
 
 // ---- session files (the harness's own) --------------------------------------
 // The files AGENT.md names for session start, relative to the HARNESS dir — the dir that
@@ -666,8 +670,10 @@ async function wikiSets() {
 
     const recs = new Map()   // abs -> { rel, abs, load, desc }
     const put = (abs, load, desc) => {
-      let rel = path.relative(w.path, abs).split(path.sep).join("/")
-      if (rel.startsWith("..")) rel = abs.split(path.sep).join("/")   // outside the root
+      const raw = path.relative(w.path, abs)
+      // outside the root: "..", "../…" or another drive — not a name like "..cache"
+      const outside = raw === ".." || raw.startsWith(".." + path.sep) || path.isAbsolute(raw)
+      const rel = (outside ? abs : raw).split(path.sep).join("/")
       const prev = recs.get(abs)
       recs.set(abs, { rel: `${name}/${rel}`, abs, load, desc: desc || prev?.desc || "" })
     }
@@ -877,6 +883,147 @@ async function alreadyInjected(client, sid) {
   return false
 }
 
+// ---- The done gate (#289): the OpenCode twin of js/hosts/hooks-done.mjs ----------------
+// OpenCode has no turn-end event a plugin can block on, so its ceiling is a reminder: on the
+// request AFTER a turn that edited files without the project's declared checks passing
+// (`.geneseed/done-checks.txt`), one invisible user message says which checks are owed. Only V1
+// (`messages.transform`, whose tool parts carry `state.status` and the shell's
+// `metadata.exit`); OpenCode 2's message shape for tool calls is unverified, so V2 is not
+// judged and says so once. Fails open on every shape it does not recognise (ADR 0007).
+// `runsUnpiped` is a hand-mirrored twin; tests/plugins/context_done.test.mjs runs both on one table.
+const DONE_LIST = ".geneseed/done-checks.txt"
+const DONE_EDIT_TOOLS = new Set(["edit", "write", "patch", "apply_patch", "multiedit"])
+const DONE_SHELL_TOOLS = new Set(["bash", "shell"])
+
+async function readDoneChecks(root) {
+  try {
+    const text = await fs.readFile(path.join(root, DONE_LIST), "utf8")
+    return text.split(/\r?\n/).map((l) => l.trim().replace(/\s+/g, " ")).filter((l) => l && !l.startsWith("#"))
+  } catch {
+    return []
+  }
+}
+
+function runsUnpiped(command, line) {
+  const cmd = String(command).replace(/[ \t]+/g, " ")
+  for (let i = cmd.indexOf(line); i !== -1; i = cmd.indexOf(line, i + 1)) {
+    const next = cmd[i + line.length]
+    if (next !== undefined && !/[\s;&|]/.test(next)) continue
+    const head = cmd.slice(0, i)
+    if (!/(^|&&|\|\||;|\n) ?$/.test(head)) continue
+    let quote = "", esc = false
+    for (const ch of head) {
+      if (esc) esc = false
+      else if (ch === "\\" && quote !== "'") esc = true
+      else if (quote) { if (ch === quote) quote = "" }
+      else if (ch === '"' || ch === "'") quote = ch
+    }
+    if (quote) continue
+    const rest = cmd.slice(i + line.length)
+    let piped = false
+    for (let j = 0; j < rest.length; j += 1) {
+      const two = rest.slice(j, j + 2)
+      if (two === "&&" || two === "||" || rest[j] === ";" || rest[j] === "\n") break
+      if (rest[j] === "|") { piped = true; break }
+    }
+    if (!piped) return true
+  }
+  return false
+}
+
+// An `apply_patch` call names its targets only in `patchText` markers. Copied from
+// geneseed-guard.js (tests/plugins/helper_parity.test.mjs holds the copies equal); `from` is
+// the pre-move path of an `Update File` + `Move to`, `path` where the file lands.
+function patchSections(patchText) {
+  const out = []
+  let current = null
+  const flush = () => { if (current) out.push(current) }
+  const lines = String(patchText).split(/\r?\n/)
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i]
+    let m = /^\*\*\* (?:Add|Delete) File:\s*(.+)$/.exec(line)
+    if (m) { flush(); current = { from: "", path: m[1].trim(), added: [] }; continue }
+    m = /^\*\*\* Update File:\s*(.+)$/.exec(line)
+    if (m) {
+      flush()
+      let from = "", p = m[1].trim()
+      const mv = /^\*\*\* Move to:\s*(.+)$/.exec(lines[i + 1] || "")
+      if (mv) { from = p; p = mv[1].trim(); i++ }
+      current = { from, path: p, added: [] }
+      continue
+    }
+    if (current && line.startsWith("+") && !line.startsWith("+++")) current.added.push(line.slice(1))
+  }
+  flush()
+  return out
+}
+
+// The checks still owed, judged over the previous turn and the current one: a reminder lasts
+// one turn, not the whole session. Our own injected messages (`geneseed-*` ids) open no turn.
+function doneOwed(messages, checks, root) {
+  const prompts = []
+  messages.forEach((m, i) => {
+    if (m?.info?.role === "user" && !String(m.info.id ?? "").startsWith("geneseed-")) prompts.push(i)
+  })
+  const from = prompts.length >= 2 ? prompts[prompts.length - 2] : 0
+  const tools = []
+  for (const m of messages.slice(from)) {
+    for (const p of m?.parts ?? []) if (p?.type === "tool" && p.state) tools.push(p)
+  }
+  // The Node hook's `within()`: `..cache/x` is inside the root, `../x` is not.
+  const inside = (fp) => {
+    const rel = path.relative(root, path.resolve(root, fp))
+    return !(rel === ".." || rel.startsWith(".." + path.sep) || path.isAbsolute(rel))
+  }
+  let lastEdit = -1
+  tools.forEach((p, i) => {
+    if (!DONE_EDIT_TOOLS.has(String(p.tool).toLowerCase()) || p.state.status === "error") return
+    const input = p.state.input ?? {}
+    const fp = input.filePath ?? input.file_path
+    const targets = typeof fp === "string" && fp ? [fp]
+      : typeof input.patchText === "string" ? patchSections(input.patchText).flatMap((s) => [s.from, s.path]).filter(Boolean)
+      : []
+    // No derivable target: counted — the reminder is fail-open, a missed one is the worse error.
+    if (targets.length && !targets.some(inside)) return
+    lastEdit = i
+  })
+  if (lastEdit === -1) return []
+  const passed = new Set()
+  for (const p of tools.slice(lastEdit + 1)) {
+    const command = DONE_SHELL_TOOLS.has(String(p.tool).toLowerCase()) && p.state.input?.command
+    if (typeof command !== "string" || p.state.status !== "completed") continue
+    const exit = p.state.metadata?.exit
+    if (typeof exit === "number" && exit !== 0) continue
+    for (const check of checks) if (runsUnpiped(command, check)) passed.add(check)
+  }
+  return checks.filter((c) => !passed.has(c))
+}
+
+// The session-scope rule, once for both majors and both deliveries: a child/subagent session
+// inherits its parent's context, and a geneseed-* session (learn distils, geneseed-wf:*
+// children) must stay clean.
+const isSkippedSession = (meta) =>
+  Boolean(meta?.parentID ?? meta?.parentId) || String(meta?.title ?? "").startsWith("geneseed-")
+
+// The rule as a per-sid cached filter over `getMeta(sid)` (each major's own session.get shape).
+// Cached because the transform runs on EVERY request; a failed lookup is NOT cached, so the
+// next request re-checks.
+function sessionSkipper(getMeta) {
+  const cache = new Map()
+  return async (sid) => {
+    if (!sid) return false
+    const hit = cache.get(sid)
+    if (hit !== undefined) return hit
+    try {
+      const skip = isSkippedSession(await getMeta(sid))
+      cache.set(sid, skip)
+      return skip
+    } catch {
+      return false
+    }
+  }
+}
+
 export const GeneseedContext = async (ctx) => {
   const { client } = ctx
   const done = new Set()
@@ -893,15 +1040,12 @@ export const GeneseedContext = async (ctx) => {
       // context). The sid is only marked done AFTER the guards pass — marking it
       // earlier would permanently skip a session when a transient session.get
       // failure let it through the title check.
-      let title = "", parent
+      let meta
       try {
         const info = await client.session.get({ path: { id: sid } })
-        const meta = info?.data ?? info
-        title = meta?.title ?? ""
-        parent = meta?.parentID ?? meta?.parentId
+        meta = info?.data ?? info
       } catch {}
-      if (parent) { log("skipped: child/subagent session"); return }
-      if (title.startsWith("geneseed-")) { log("skipped: geneseed-* session"); return }
+      if (isSkippedSession(meta)) { log("skipped: child/subagent or geneseed-* session"); return }
 
       if (await alreadyInjected(client, sid)) { log("skipped: already injected (marker present)"); return }
       done.add(sid)
@@ -928,28 +1072,13 @@ export const GeneseedContext = async (ctx) => {
     }
   }
 
-  // Session-scope filter for the INVISIBLE delivery, mirroring injectVisible's
-  // guards: child/subagent sessions inherit the parent's context, and geneseed-*
-  // sessions (learn distils, geneseed-wf:* children) must stay clean — without this
-  // the transform prepends the full context block to every request of every session
-  // in-process. Cached per sid (the transform runs on EVERY request); a transient
-  // session.get failure is NOT cached so the next request re-checks.
-  const sessionSkip = new Map()
-  async function skipSession(sid) {
-    if (!sid) return false
-    const hit = sessionSkip.get(sid)
-    if (hit !== undefined) return hit
-    try {
-      const info = await client.session.get({ path: { id: sid } })
-      const meta = info?.data ?? info
-      const skip = Boolean(meta?.parentID ?? meta?.parentId) ||
-        String(meta?.title ?? "").startsWith("geneseed-")
-      sessionSkip.set(sid, skip)
-      return skip
-    } catch {
-      return false
-    }
-  }
+  // Session-scope filter for the INVISIBLE delivery, the same rule as injectVisible's
+  // guards — without it the transform prepends the full context block to every request of
+  // every session in-process.
+  const skipSession = sessionSkipper(async (sid) => {
+    const info = await client.session.get({ path: { id: sid } })
+    return info?.data ?? info
+  })
 
   return {
     event: async ({ event }) => {
@@ -1002,12 +1131,31 @@ export const GeneseedContext = async (ctx) => {
     // detects that and takes over with the visible delivery.
     "experimental.chat.messages.transform": async (_input, output) => {
       transformSeen = true                  // the hook exists on this build
+      // One scope decision per request, shared by the done gate and the context block:
+      // both end on an empty request, an excluded repo, or a skipped session.
+      if (!output || !Array.isArray(output.messages) || !output.messages.length) return
+      const sid = output.messages[0]?.info?.sessionID
+      if (await sovereignBypass(root) || await skipSession(sid)) return
+      // The done gate's reminder: FIRST, and independent of the context block:
+      // INJECT_OFF and the visible delivery leave it on, and no early return below can skip it.
+      // Its own function, so its early returns end the reminder, never the context injection.
+      await (async () => {
+        const checks = await readDoneChecks(root)
+        if (!checks.length) return
+        const owed = doneOwed(output.messages, checks, root)
+        if (!owed.length) return
+        const stamp = Date.now()
+        output.messages.unshift({
+          info: { id: `geneseed-done-${stamp}`, role: "user", sessionID: sid, time: { created: stamp } },
+          parts: [{ id: `geneseed-done-part-${stamp}`, type: "text", text:
+            "Geneseed (Verify Before Asserting) — files were edited, and these checks from "
+            + `${DONE_LIST} have not passed since the last edit: ${owed.join("; ")}. Run them unpiped `
+            + "before reporting the work done, or say plainly that they were not run and why." }],
+        })
+        log("transform: done-gate reminder injected")
+      })().catch((err) => log(`done-gate error: ${err?.message ?? err}`))
       if (INJECT_OFF || !TRANSFORM || fallbackVisible) return
-      if (await sovereignBypass(root)) return
       try {
-        if (!output || !Array.isArray(output.messages) || !output.messages.length) return
-        const sid = output.messages[0]?.info?.sessionID
-        if (await skipSession(sid)) return
         // Already present this request? (idempotent across plugin copies / retries.)
         const present = output.messages.some((m) =>
           (m?.parts ?? []).some((p) => typeof p?.text === "string" && p.text.includes(MARKER)))
@@ -1055,21 +1203,16 @@ const v2Model = (ref) => (ref?.providerID && ref?.id ? `${ref.providerID}/${ref.
 async function setupV2(ctx) {
   const root = repoRoot({ worktree: ctx?.location?.project?.directory, directory: ctx?.location?.directory })
   const blockCache = { text: null, at: 0 }
-  // Same scope rule as V1's skipSession: child/subagent sessions inherit the parent's
-  // context, geneseed-* sessions stay clean. A failed lookup is not cached.
-  const sessionSkip = new Map()
-  async function skipSession(sid) {
-    if (!sid) return false
-    const hit = sessionSkip.get(sid)
-    if (hit !== undefined) return hit
-    try {
-      const info = await ctx.session.get({ sessionID: sid })
-      const skip = Boolean(info?.parentID) || String(info?.title ?? "").startsWith("geneseed-")
-      sessionSkip.set(sid, skip)
-      return skip
-    } catch {
-      return false
-    }
+  // Same scope rule as V1's skipSession. V2's info names the parent `parentID` only, so only
+  // that and the title are passed on.
+  const skipSession = sessionSkipper(async (sid) => {
+    const info = await ctx.session.get({ sessionID: sid })
+    return { parentID: info?.parentID, title: info?.title }
+  })
+
+  // The done gate is not judged on OpenCode 2 (see `doneOwed`): said once, where its log goes.
+  if ((await readDoneChecks(root).catch(() => [])).length) {
+    console.error(`[geneseed-context] done gate: ${DONE_LIST} found, but OpenCode 2 turns are not judged.`)
   }
 
   if (!VISIBLE) {
@@ -1109,7 +1252,7 @@ async function setupV2(ctx) {
       if (ev?.type !== "session.created" || INJECT_OFF) continue
       const d = ev.data ?? {}
       try {
-        if (d.parentID || String(d.title ?? "").startsWith("geneseed-")) continue
+        if (isSkippedSession({ parentID: d.parentID, title: d.title })) continue
         if (await sovereignBypass(root)) continue
         const { block } = await resolveBlock(root)
         if (!block) continue

package/adapters/opencode/plugins/geneseed-guard.js

@@ -2,7 +2,10 @@
 //
 // Enforces the safety Laws at the tool boundary (`tool.execute.before`), the same
 // "enforce by injection, don't just instruct" stance as the context plugin:
-//   - Sealed Secrets:  block writes to private-key / credential files.
+//   - Sealed Secrets:  block writes to private-key / credential files, and any write whose
+//     added content carries a credential-shaped string (`.env`-shaped targets exempt).
+//   - External Gate:  block writes to a check listed in `.geneseed/protected-checks.txt`,
+//     and to the done gate's own list `.geneseed/done-checks.txt`.
 //   - Deletion Is Deliberate:  block catastrophic shell commands.
 //   - Commands Must Return:  block a recursive scan rooted at a whole filesystem (find /).
 //   - Persist Insight (rule vs memory):  speed-bump the first write to user-rules.md
@@ -10,7 +13,10 @@
 //   - Wiki (AGENT.md §8):  block mutations under a declared wiki's `protected`
 //     folders — the user's knowledge base sets its own no-go zones in geneseed-wiki.jsonc.
 // High-confidence patterns only, so legitimate work is never caught. Borderline cases
-// (.env edits, force-push) are WARNED, not blocked.
+// (.env edits, force-push) are WARNED, not blocked. Every block is recorded in the gate
+// ledger (`<cfg>/notebook/gates.jsonl`) under the hook's rule key (`law-1`, `rigor-5`,
+// `law-4`, `ops-2`, `process-1`, `wiki`); every skill or subagent call, blocked or not, is
+// counted in `<cfg>/notebook/usage.jsonl` when that `notebook/` exists and `.usage-off` does not.
 //
 // GENESEED_GUARD=off    disable entirely.
 // GENESEED_GUARD=warn   downgrade every block to a warning (log, but allow).
@@ -128,6 +134,9 @@ function log(msg) { console.error(`[geneseed-guard] ${msg}`) }
 // at the newest MAX_LEDGER_LINES like the hook's; never throws, never decides.
 const MAX_LEDGER_LINES = 1000
 async function ledger(rule) {
+  // `geneseed doctor --probe` blocks on purpose; its blocks are not the user's (the twin of
+  // the same line in js/hosts/hooks.mjs). The record only — never the decision.
+  if (process.env.GENESEED_GATE_PROBE) return
   try {
     const bases = []
     if (process.env.GENESEED_HARNESS) bases.push(process.env.GENESEED_HARNESS)
@@ -314,23 +323,10 @@ const rootArg = (t) => !/^["']/.test(t) && FS_ROOT_RE.test(t)
 // (`packages/opencode/src/patch/index.ts` `parsePatchHeader`): `*** Add File:`,
 // `*** Update File:` (optionally followed by `*** Move to:`, both the old and the new
 // path count) and `*** Delete File:`. The `+`-prefixed body lines are the new file
-// content, never a path, and are not scanned here — no gate in this file inspects
-// write content, only the target path.
+// content, never a path: `parsePatchSections` below collects them for the content secret
+// scan, and this list carries only the target paths, both sides of a move included.
 function parsePatchPaths(patchText) {
-  const out = []
-  const lines = String(patchText).split(/\r?\n/)
-  for (let i = 0; i < lines.length; i++) {
-    const line = lines[i]
-    let m = /^\*\*\* (?:Add|Delete) File:\s*(.+)$/.exec(line)
-    if (m) { out.push(m[1].trim()); continue }
-    m = /^\*\*\* Update File:\s*(.+)$/.exec(line)
-    if (m) {
-      out.push(m[1].trim())
-      const mv = /^\*\*\* Move to:\s*(.+)$/.exec(lines[i + 1] || "")
-      if (mv) { out.push(mv[1].trim()); i++ }
-    }
-  }
-  return out.filter(Boolean)
+  return patchSections(patchText).flatMap((s) => [s.from, s.path]).filter(Boolean)
 }
 
 // Returns every candidate path for this call, normalized (backslashes -> `/`) and,
@@ -359,6 +355,12 @@ function pickPath(args, cwd) {
 // land, so content is attributed to it, not the pre-move path. `*** Delete File:` sections
 // collect no `+` lines (nothing is being written).
 function parsePatchSections(patchText) {
+  return patchSections(patchText).filter((s) => s.path)
+}
+// The one marker parser both lists derive from. `from` is the pre-move path of an
+// `Update File` followed by `Move to` (empty otherwise); `path` is where the file lands.
+// Unfiltered: an empty marker path is dropped by each caller on its own terms.
+function patchSections(patchText) {
   const out = []
   let current = null
   const flush = () => { if (current) out.push(current) }
@@ -366,20 +368,20 @@ function parsePatchSections(patchText) {
   for (let i = 0; i < lines.length; i++) {
     const line = lines[i]
     let m = /^\*\*\* (?:Add|Delete) File:\s*(.+)$/.exec(line)
-    if (m) { flush(); current = { path: m[1].trim(), added: [] }; continue }
+    if (m) { flush(); current = { from: "", path: m[1].trim(), added: [] }; continue }
     m = /^\*\*\* Update File:\s*(.+)$/.exec(line)
     if (m) {
       flush()
-      let p = m[1].trim()
+      let from = "", p = m[1].trim()
       const mv = /^\*\*\* Move to:\s*(.+)$/.exec(lines[i + 1] || "")
-      if (mv) { p = mv[1].trim(); i++ }
-      current = { path: p, added: [] }
+      if (mv) { from = p; p = mv[1].trim(); i++ }
+      current = { from, path: p, added: [] }
       continue
     }
     if (current && line.startsWith("+") && !line.startsWith("+++")) current.added.push(line.slice(1))
   }
   flush()
-  return out.filter((s) => s.path)
+  return out
 }
 
 // The content a write/edit/apply_patch call would actually land on disk, per FILE — what the
@@ -425,8 +427,12 @@ const hasAny = (name, parts) => parts.some((s) => name.includes(s))
 // geneseed-wiki.jsonc (the machine-level knowledge-base manifest) may list `protected` folders
 // per wiki. Mutating anything under one is denied. Same resolution chain as the
 // context plugin: $GENESEED_WIKI -> $GENESEED_HARNESS/geneseed-wiki.jsonc -> beside the install.
-async function isFile(p) { try { return (await fs.stat(p)).isFile() } catch { return false } }
-async function isDir(p) { try { return (await fs.stat(p)).isDirectory() } catch { return false } }
+async function isFile(p) {
+  try { return (await fs.stat(p)).isFile() } catch { return false }
+}
+async function isDir(p) {
+  try { return (await fs.stat(p)).isDirectory() } catch { return false }
+}
 
 // The wiki manifest is JSONC (the seeded stub carries a commented example): strip // and
 // /* */ comments plus trailing commas before parsing — string-aware, so quoted
@@ -545,6 +551,9 @@ function ruleStoreTarget(p) {
 // line; the list protects itself. Found from the WRITE TARGET up to the first `.git`, re-read on
 // every write (a short file, read only on a write call). No ask tier here, so a hit is a deny.
 const SENSOR_LIST = ".geneseed/protected-checks.txt"
+// The done gate's list (#289, js/hosts/hooks-done.mjs) protects itself the same way, with or
+// without a protected-checks list: emptying it would disarm the gate. Twin of js/hosts/hooks.mjs.
+const DONE_LIST = ".geneseed/done-checks.txt"
 function protectedCheck(p) {
   try {
     const target = path.resolve(p)
@@ -554,9 +563,10 @@ function protectedCheck(p) {
       if (up === root) return null
       root = up
     }
-    const text = readFileSync(path.join(root, SENSOR_LIST), "utf8")
     const fold = (s) => nocase(s.replace(/\\/g, "/"))
     const rel = fold(path.relative(root, target))
+    if (rel === fold(DONE_LIST)) return DONE_LIST
+    const text = readFileSync(path.join(root, SENSOR_LIST), "utf8")
     const entries = [SENSOR_LIST, ...text.split(/\r?\n/).map((l) => l.trim().replace(/[\\/]+$/, ""))
       .filter((l) => l && !l.startsWith("#"))]
     return entries.find((e) => rel === fold(e) || rel.startsWith(fold(e) + "/")) ?? null
@@ -582,7 +592,7 @@ function usageOf(tool, args) {
   let kind = null
   let name = null
   if (!t.startsWith("mcp") && t.includes("skill")) { kind = "skill"; name = a.skill ?? a.name ?? a.skill_name }
-  else if (t === "agent" || t === "task") { kind = "agent"; name = a.subagent_type ?? a.agent }
+  else if (t === "agent" || t === "task" || t === "subagent") { kind = "agent"; name = a.subagent_type ?? a.agent }
   if (!kind || typeof name !== "string") return null
   name = name.trim().replace(/^\/+/, "")
   return USAGE_NAME_RE.test(name) ? { kind, name } : null
@@ -605,9 +615,12 @@ export const GeneseedGuard = async (ctx) => {
   const root = () => ctx?.worktree || ctx?.directory || process.cwd()
   return {
     "tool.execute.before": async (input, output) => {
+      // Bypass before counting, the order Claude's toolGate keeps: an excluded repo is
+      // dormant, so nothing is written there. GENESEED_GUARD=off still counts — Claude's
+      // hook has no such switch; GENESEED_NO_USAGE / .usage-off stop the counter.
+      if (await sovereignBypass(root())) return
       await recordUse(input?.tool || input?.name, output?.args || input?.args)
       if (OFF) return
-      if (await sovereignBypass(root())) return
       const tool = (input?.tool || input?.name || "").toLowerCase()
       const args = output?.args || input?.args || {}
       // `rule` is the ledger key, spelled as js/hosts/hooks.mjs spells it (`law-1`,
@@ -635,7 +648,7 @@ export const GeneseedGuard = async (ctx) => {
             if (SECRET_RE.some((re) => re.test(p))) { await deny(`write to secret/key file ${p} (Sealed Secrets)`, "law-1"); return }
             if (SECRET_WARN_RE.some((re) => re.test(p))) log(`WARN: writing ${p} — keep secrets out of tracked files (Sealed Secrets)`)
             const sensor = protectedCheck(p)
-            if (sensor) { await deny(`${p} is a protected check (${sensor}, listed in ${SENSOR_LIST}) — a check the agent can edit is not a check (External Gate)`, "rigor-5"); return }
+            if (sensor) { await deny(`${p} is a protected check (${sensor === DONE_LIST ? "the done gate list itself" : `${sensor}, listed in ${SENSOR_LIST}`}) — a check the agent can edit is not a check (External Gate)`, "rigor-5"); return }
             const store = ruleStoreTarget(p)
             if (store && !RULE_STORE_BUMPED.has(p)) {
               RULE_STORE_BUMPED.add(p)

package/adapters/opencode/plugins/geneseed-learn.js

@@ -304,7 +304,7 @@ function parseFrontmatter(chunk) {
 
 // A memory `name:` becomes a FILENAME and the model writes it, so it is a plain slug or
 // nothing — no separator, no `..`, no drive. The same rule as MEMORY_SLUG_RE in
-// js/hosts/hooks.mjs, inlined because this file ships standalone.
+// js/hosts/memory-files.mjs, inlined because this file ships standalone.
 const MEMORY_SLUG_RE = /^[A-Za-z0-9][A-Za-z0-9_-]{0,99}$/
 
 // The chunk without its frontmatter `action:` line, which is an instruction, not the fact.