geneseed 4.6.0 → 4.8.0

package/CHANGELOG.md

@@ -8,6 +8,42 @@ label. For the capability ↔ spec map, see [SHIPPED.md](SHIPPED.md).
 
 ## [Unreleased]
 
+## [4.8.0] — 2026-10-18
+
+Minor: Deletion Is Deliberate asks only on real data loss, and can be switched off per install.
+
+### Added
+- **An on/off switch for the Deletion Is Deliberate gate.** `geneseed build --no-deletion-gate` (or the switch on Rule IV's row of the console's Constitution page, which then reads *Gate off*) stops the real-loss check from asking on that install: `git-gate`/`tool-gate` are wired with `--no-deletion-gate` on Claude Code, OpenClaude and Bob, the OpenCode guard plugin stops blocking real loss, and OpenCode's `permission.bash` drops its Law IV keys. Armed by default. The Rule's text still binds, and Sealed Secrets, the root-scan check, Consent Before Push, External Gate and the OpenCode guard's catastrophic-command block stay. The install records `Deletion gate: off` beside its pack list; rebuilds and upgrades keep it, `geneseed status` shows it, and `doctor --probe` checks a disarmed gate on a root-wide scan instead. On Claude Code, OpenClaude and Bob a removal outside a repository, `rm -rf /` included, is caught only by the real-loss check, so it no longer asks there while the gate is off.
+
+### Upgrade notes
+- Run `geneseed rebuild-all` once after updating, before switching the deletion gate off: an older hook shim given the new flag silently drops the whole gate call.
+- The deletion gate switch: an existing `opencode.json` keeps its Law IV `permission.bash` keys when the gate is switched off (the build warns and names them); delete them by hand. OpenCode reads the switch when it starts, so restart it after flipping. While the machine's hook shim points at an older checkout, a disarmed install's gate verb refuses the new flag and lets every call through — the root-scan and consent checks too, and on Bob Sealed Secrets and External Gate — until `geneseed rebuild-all` points the shim at this version.
+- OpenCode: as with the 4.7.0 worktree keys, an existing `opencode.json` keeps the state-dependent Law IV keys the calibration below removed from `permission.bash` — the force-push forms (`git push --force*`, `git push -f*`, `git push *--force*`, `git push * -f*`, `git push *+*`), `git reset --hard*`, `git reset * --hard*`, the `git clean` force forms, `git branch -D*` and both `--delete`/`--force` orders, `git checkout -- *`, the `git checkout`/`git switch` force and `--discard-changes` forms, `git stash drop*`, `git stash clear*`, `git push *--delete*` and `git push * :*`. An existing `opencode.json` keeps them and they keep asking; delete them by hand to get the calibrated behaviour. `git reflog expire*` and `git gc --prune*` stay Geneseed's, and new keys ask for a force push to, or a delete of, `main`/`master` by name, so those still ask with the guard plugin off.
+- OpenCode: `rm -rf *` leaves `permission.bash` too. The guard plugin now decides every `rm`: it lets through a removal of tracked, unmodified files and blocks one git cannot restore, and it still blocks `rm -rf /`, `~` and drive roots outright. An existing `opencode.json` keeps its `rm -rf *` key, which keeps asking; Geneseed no longer claims it, so it neither removes nor reports it. Delete it by hand to get the calibrated behaviour. With the guard plugin off (`GENESEED_GUARD=off`) or in `warn` mode, an `rm` no longer meets any prompt.
+- `geneseed doctor --probe` now sends `git reflog expire --expire=now --all` as the call a gate must refuse, instead of `git reset --hard HEAD`, which passes on a clean tree.
+
+### Changed
+- **Deletion Is Deliberate asks only on real data loss.** The gate used to ask on every destructive-looking git form. It now reads the repository's state and asks only when a command would destroy something nothing else holds:
+  - deleting or force-pushing `main`, `master` or a remote's default branch, locally or remotely;
+  - `branch -D` of a branch whose commits are on no remote and not merged into HEAD;
+  - `reset --hard`, `checkout -f`/`-- <paths>`, `switch --discard-changes`, `restore` and `clean -f` over uncommitted or untracked work that actually exists;
+  - `stash drop`/`clear` while a stash exists, and `reflog expire` and `gc --prune` always;
+  - **new:** removing files (`rm`, `rmdir`, `del`, `erase`, `Remove-Item`/`ri`/`rd`) that git cannot restore — untracked, ignored or modified files, a `.git`, or anything outside a repository.
+  - **new, on a protected branch only:** `checkout <paths>` without `--` and `git rm -f` over changed files while `main`, `master` or the default branch is checked out, and `branch -f`/`checkout -B`/`switch -C` moving a protected branch off commits no remote and not the new target holds (asks when it cannot verify). On a feature branch, and for a new branch (`checkout -b`, `switch -c`, `branch x`), these pass.
+  The same commands on a clean tree, a pushed or merged branch, a feature-branch force push and an `rm` of tracked, unmodified files pass. When the gate cannot tell — a glob or variable it would have to expand, a `cd` it cannot follow, `sh -c`/`xargs`, git failing or missing — it asks and says it could not verify. To read the state the git gate runs `git` itself (ADR 0002 amended), only once a command already looked destructive; ordinary tool calls are unaffected. On every host: an ask on Claude Code and OpenClaude, exit 2 on Bob, and on OpenCode a block by the guard plugin, which has no ask tier (`GENESEED_GUARD=warn` downgrades it), with `reflog expire`/`gc --prune` and the `main`/`master` force/delete forms also asked by static `permission.bash` globs.
+- **The Deletion Is Deliberate law text says the same.** Both halves of the rule now name real data loss as what needs confirmation — deleting what version control cannot restore (untracked, modified, unpushed or unmerged work), discarding uncommitted changes, deleting or force-moving `main`, `master` or the default branch, pruning the reflog — beside irreversible, financial, privilege-changing and outward-facing acts. They say that what git can restore runs freely: removing tracked clean files, a worktree, a force-push to a feature branch. Force-push is no longer listed as an outward-facing act that always asks.
+
+## [4.7.0] — 2026-10-17
+
+Minor: the Deletion Is Deliberate gate stops asking on worktree removal.
+
+### Upgrade notes
+- Run `geneseed rebuild-all` once after updating so installed hooks and OpenCode plugins pick up the change.
+- OpenCode: an `opencode.json` written by an earlier version keeps the four `git worktree remove … -f`/`--force` keys under `permission.bash`. Geneseed no longer claims them, so it neither removes nor reports them; delete them by hand to stop the prompt.
+
+### Changed
+- **`git worktree remove --force` no longer asks.** Removing a worktree is routine agent housekeeping, so the *Deletion Is Deliberate* gate now lets `worktree remove -f`/`--force` through like a plain `worktree remove`, on every host: the Claude Code/OpenClaude/Bob git-gate, OpenCode's permission globs and the guard plugin's warning. Every other destructive git form is gated as before.
+
 ## [4.6.0] — 2026-10-17
 
 Minor: a refactor and cleanup pass over everything since 3.15.0, and the nine gate and counter bugs it turned up.

package/README.md

@@ -37,7 +37,7 @@ Want to read what it leaves behind before installing anything? [**geneseed-demo*
 
 A hand-written instructions file is prose the model may or may not honour, copied into every repo and drifting in each one. Geneseed is a build, and that changes four things:
 
-- **Laws are enforced, not suggested.** A force-push, a `reset --hard`, or a credential written into a tracked file is caught by a hook *before* the tool runs, in the host's own dialect — a prompt on Claude Code and OpenClaude, a hard block on OpenCode, exit 2 on Bob. The gates fail closed, and every catch is one line in a ledger that `geneseed status` counts.
+- **Laws are enforced, not suggested.** A force-push to `main`, a `reset --hard` over uncommitted work, or a credential written into a tracked file is caught by a hook *before* the tool runs, in the host's own dialect — a prompt on Claude Code and OpenClaude, a hard block on OpenCode, exit 2 on Bob. The gates fail closed, and every catch is one line in a ledger that `geneseed status` counts.
 - **One source, five targets.** Skills are byte-identical on every host; only the wiring differs. Every commit renders all 263 emit configurations, and a second emit into the same tree must change nothing.
 - **Costs are measured, not guessed.** Zero runtime dependencies. The hook path loads in about 14 ms per tool call. The default *lean* footprint keeps the always-on context small and puts the full rationale one read away — the numbers are in [docs/token-footprint.md](docs/token-footprint.md).
 - **It follows you.** Install once, globally; every repo inherits it. One `git pull` or `npm install -g geneseed@latest` rebuilds every active install.

package/SHIPPED.md

@@ -20,7 +20,7 @@ historical references, not files distributed with the repo.
 > **On version numbers.** [`harness.config.json`](harness.config.json)'s `version` is a
 > human-readable label only. The canonical identity of an installed harness is the
 > **source fingerprint** stamped in `.geneseed-version` (see `geneseed version`), not the
-> string. Current label: **4.6.0**.
+> string. Current label: **4.8.0**.
 
 ## Capabilities
 

package/adapters/claude-code/README.md

@@ -18,7 +18,9 @@ absolute-path hooks instead — `geneseed setup` does that for you.) It:
   half of Doctrine process 5 (*consent before every commit and push*) and of the
   destructive-git Rule. Drop the `process` pack (or exclude process 5) and the hook stays,
   wired with `--no-consent`: commits and pushes pass without asking, while the
-  invariant-territory refusals (force-push, `reset --hard`) stay in every build. The hook inspects
+  Law IV refusals (asked only on real data loss: a force-push to `main`, a `reset --hard`
+  over uncommitted work, an `rm` git cannot undo) stay in every build unless the install is
+  built `--no-deletion-gate`, which appends that flag and stands the real-loss check down. The hook inspects
   command and, when it runs a `git commit` or `git push` (bare, flagged, `-C <path>`,
   or chained like `git add . && git commit … && git push`), returns
   `permissionDecision: "ask"` so Claude Code **prompts on every such call**. Crucially

package/adapters/opencode/HOW-OPENCODE-LOADS.md

@@ -125,7 +125,7 @@ to native **skills**, not slash commands (same `SKILL.md` shape as Claude Code).
 | plugin on `experimental.session.compacting` | **context plugin** — re-pushes the `eager` docs so they survive compaction |
 | plugin on `session.idle` | **learn plugin** — distils memory into `memory/` (debounced to fire once, at session end) |
 | plugin on `experimental.chat.messages.transform` (V1) | **context plugin** — also adds the done gate's reminder when a check in `.geneseed/done-checks.txt` has not passed since the last edit (Verify Before Asserting); OpenCode 2 turns are not judged |
-| plugin on `tool.execute.before` | **guard plugin** — blocks secret-file writes and credential-shaped write content (Sealed Secrets), writes to a protected check or the done list (External Gate), catastrophic shell (Deletion Is Deliberate), a recursive whole-filesystem scan (Commands Must Return), the first rule-store write (Persist Insight) and protected wiki folders; logs each block to the gate ledger and counts skill/subagent use (`GENESEED_GUARD=off\|warn`) |
+| plugin on `tool.execute.before` | **guard plugin** — blocks secret-file writes and credential-shaped write content (Sealed Secrets), writes to a protected check or the done list (External Gate), catastrophic shell and every other real data loss, judged against the repository's state (Deletion Is Deliberate), a recursive whole-filesystem scan (Commands Must Return), the first rule-store write (Persist Insight) and protected wiki folders; logs each block to the gate ledger and counts skill/subagent use (`GENESEED_GUARD=off\|warn`) |
 | plugin registering a custom tool | **workflow plugin** — the `workflow` tool runs saved orchestration scripts from `workflows/` |
 | `context.json` / `.harness/` (manifest) | *optional* override when discovery doesn't fit |
 

package/adapters/opencode/README.md

@@ -384,9 +384,10 @@ behaviour** — nothing changes the machine's current agent/model unless you opt
   `2026-06-17-opencode-color-themes` spec).
 - **Runtime guard plugin** (`geneseed-guard.js`, installed with the others). Enforces
   the safety Laws at the tool boundary: **blocks** writes to private-key/credential
-  files (Sealed Secrets), catastrophic shell like `rm -rf /` (Deletion Is Deliberate), and any mutation under
+  files (Sealed Secrets), catastrophic shell like `rm -rf /` and every command that would really lose data, judged
+  against the repository's state (Deletion Is Deliberate), and any mutation under
   a declared wiki's `protected` folders (AGENT.md §8, from `geneseed-wiki.jsonc`); **warns** on
-  `.env` writes and force-push. `GENESEED_GUARD=off` disables it, `=warn` downgrades
+  `.env` writes. `GENESEED_GUARD=off` disables it, `=warn` downgrades
   blocks to warnings. Every **block** appends one line to the install's
   `notebook/gates.jsonl` (rule `law-1` / `law-4` / `process-1` / `wiki`, a timestamp,
   never the path or command) — the same ledger the Claude-family hooks write, so
@@ -398,8 +399,8 @@ behaviour** — nothing changes the machine's current agent/model unless you opt
   auto-falls back to the visible `session.created` message. `GENESEED_CONTEXT_VISIBLE=1`
   forces the visible block (legacy `GENESEED_CONTEXT_TRANSFORM=0/off` does the same).
 - **Default permissions.** A fresh `opencode.json` gets a minimal policy that **asks**
-  before `rm -rf *` and a force-push — those are **Rule IV**'s territory and are in every
-  build — and, **on an install that built the `process` pack in**, before every
+  before `git reflog expire`, `git gc --prune` and a force-push or delete of `main`/`master` —
+  **Rule IV**'s territory, in every build; the guard plugin decides every other data loss — and, **on an install that built the `process` pack in**, before every
   `git commit` and `git push` (the host-level backstop for **Consent Before Push**: the
   agent never records or shares code unprompted, on any branch). Build with
   `--doctrines` leaving `process` out and those two entries are simply not written.