geneseed 4.7.0 → 4.9.0

package/CHANGELOG.md

@@ -8,6 +8,44 @@ label. For the capability ↔ spec map, see [SHIPPED.md](SHIPPED.md).
 
 ## [Unreleased]
 
+## [4.9.0] — 2026-10-18
+
+Minor: on/off switches for the Sealed Secrets and done gates, and the console calls the laws Dictates.
+
+### Added
+- **On/off switches for the Sealed Secrets and Verify Before Asserting gates**, beside Law IV's. `geneseed build --no-secrets-gate` stands down the credential scan (`rule-gate` on Claude Code and OpenClaude, `tool-gate` on Bob, the OpenCode guard's key-file block and content scan); `--no-done-gate` stands down the done check in `learn` on Stop (and OpenCode's reminder), while learning still runs. Both armed by default; the Rule's text still binds. The install records `Secrets gate: off` / `Done gate: off` beside its pack list; rebuilds, upgrades, `status`, `diff`, `validate` and the console keep them. The console's Constitution page now has a toggle column on every Rule: a switch on Rules I, III and IV, *no gate* on the others.
+
+### Upgrade notes
+- The secrets and done gate switches: run `geneseed rebuild-all` before switching either off. While the machine's hook shim points at an older checkout, a disarmed install's `rule-gate`/`tool-gate` refuses the new flag and lets every write through (External Gate and Persist Insight too, and on Bob every check), and its `learn` refuses `--no-done-gate`, so that install stops learning as well. OpenCode reads both switches when it starts: restart it after flipping one.
+
+### Changed
+- **The console calls the laws Dictates**, the name AGENT.md gives them, instead of Invariants: the Laws tab and band, the dashboard KPI tile, the constitution map, Greenhouse and the Operator HUD. Routes and internal keys are unchanged (#321).
+
+## [4.8.0] — 2026-10-18
+
+Minor: Deletion Is Deliberate asks only on real data loss, and can be switched off per install.
+
+### Added
+- **An on/off switch for the Deletion Is Deliberate gate.** `geneseed build --no-deletion-gate` (or the switch on Rule IV's row of the console's Constitution page, which then reads *Gate off*) stops the real-loss check from asking on that install: `git-gate`/`tool-gate` are wired with `--no-deletion-gate` on Claude Code, OpenClaude and Bob, the OpenCode guard plugin stops blocking real loss, and OpenCode's `permission.bash` drops its Law IV keys. Armed by default. The Rule's text still binds, and Sealed Secrets, the root-scan check, Consent Before Push, External Gate and the OpenCode guard's catastrophic-command block stay. The install records `Deletion gate: off` beside its pack list; rebuilds and upgrades keep it, `geneseed status` shows it, and `doctor --probe` checks a disarmed gate on a root-wide scan instead. On Claude Code, OpenClaude and Bob a removal outside a repository, `rm -rf /` included, is caught only by the real-loss check, so it no longer asks there while the gate is off.
+
+### Upgrade notes
+- Run `geneseed rebuild-all` once after updating, before switching the deletion gate off: an older hook shim given the new flag silently drops the whole gate call.
+- The deletion gate switch: an existing `opencode.json` keeps its Law IV `permission.bash` keys when the gate is switched off (the build warns and names them); delete them by hand. OpenCode reads the switch when it starts, so restart it after flipping. While the machine's hook shim points at an older checkout, a disarmed install's gate verb refuses the new flag and lets every call through — the root-scan and consent checks too, and on Bob Sealed Secrets and External Gate — until `geneseed rebuild-all` points the shim at this version.
+- OpenCode: as with the 4.7.0 worktree keys, an existing `opencode.json` keeps the state-dependent Law IV keys the calibration below removed from `permission.bash` — the force-push forms (`git push --force*`, `git push -f*`, `git push *--force*`, `git push * -f*`, `git push *+*`), `git reset --hard*`, `git reset * --hard*`, the `git clean` force forms, `git branch -D*` and both `--delete`/`--force` orders, `git checkout -- *`, the `git checkout`/`git switch` force and `--discard-changes` forms, `git stash drop*`, `git stash clear*`, `git push *--delete*` and `git push * :*`. An existing `opencode.json` keeps them and they keep asking; delete them by hand to get the calibrated behaviour. `git reflog expire*` and `git gc --prune*` stay Geneseed's, and new keys ask for a force push to, or a delete of, `main`/`master` by name, so those still ask with the guard plugin off.
+- OpenCode: `rm -rf *` leaves `permission.bash` too. The guard plugin now decides every `rm`: it lets through a removal of tracked, unmodified files and blocks one git cannot restore, and it still blocks `rm -rf /`, `~` and drive roots outright. An existing `opencode.json` keeps its `rm -rf *` key, which keeps asking; Geneseed no longer claims it, so it neither removes nor reports it. Delete it by hand to get the calibrated behaviour. With the guard plugin off (`GENESEED_GUARD=off`) or in `warn` mode, an `rm` no longer meets any prompt.
+- `geneseed doctor --probe` now sends `git reflog expire --expire=now --all` as the call a gate must refuse, instead of `git reset --hard HEAD`, which passes on a clean tree.
+
+### Changed
+- **Deletion Is Deliberate asks only on real data loss.** The gate used to ask on every destructive-looking git form. It now reads the repository's state and asks only when a command would destroy something nothing else holds:
+  - deleting or force-pushing `main`, `master` or a remote's default branch, locally or remotely;
+  - `branch -D` of a branch whose commits are on no remote and not merged into HEAD;
+  - `reset --hard`, `checkout -f`/`-- <paths>`, `switch --discard-changes`, `restore` and `clean -f` over uncommitted or untracked work that actually exists;
+  - `stash drop`/`clear` while a stash exists, and `reflog expire` and `gc --prune` always;
+  - **new:** removing files (`rm`, `rmdir`, `del`, `erase`, `Remove-Item`/`ri`/`rd`) that git cannot restore — untracked, ignored or modified files, a `.git`, or anything outside a repository.
+  - **new, on a protected branch only:** `checkout <paths>` without `--` and `git rm -f` over changed files while `main`, `master` or the default branch is checked out, and `branch -f`/`checkout -B`/`switch -C` moving a protected branch off commits no remote and not the new target holds (asks when it cannot verify). On a feature branch, and for a new branch (`checkout -b`, `switch -c`, `branch x`), these pass.
+  The same commands on a clean tree, a pushed or merged branch, a feature-branch force push and an `rm` of tracked, unmodified files pass. When the gate cannot tell — a glob or variable it would have to expand, a `cd` it cannot follow, `sh -c`/`xargs`, git failing or missing — it asks and says it could not verify. To read the state the git gate runs `git` itself (ADR 0002 amended), only once a command already looked destructive; ordinary tool calls are unaffected. On every host: an ask on Claude Code and OpenClaude, exit 2 on Bob, and on OpenCode a block by the guard plugin, which has no ask tier (`GENESEED_GUARD=warn` downgrades it), with `reflog expire`/`gc --prune` and the `main`/`master` force/delete forms also asked by static `permission.bash` globs.
+- **The Deletion Is Deliberate law text says the same.** Both halves of the rule now name real data loss as what needs confirmation — deleting what version control cannot restore (untracked, modified, unpushed or unmerged work), discarding uncommitted changes, deleting or force-moving `main`, `master` or the default branch, pruning the reflog — beside irreversible, financial, privilege-changing and outward-facing acts. They say that what git can restore runs freely: removing tracked clean files, a worktree, a force-push to a feature branch. Force-push is no longer listed as an outward-facing act that always asks.
+
 ## [4.7.0] — 2026-10-17
 
 Minor: the Deletion Is Deliberate gate stops asking on worktree removal.

package/README.md

@@ -37,7 +37,7 @@ Want to read what it leaves behind before installing anything? [**geneseed-demo*
 
 A hand-written instructions file is prose the model may or may not honour, copied into every repo and drifting in each one. Geneseed is a build, and that changes four things:
 
-- **Laws are enforced, not suggested.** A force-push, a `reset --hard`, or a credential written into a tracked file is caught by a hook *before* the tool runs, in the host's own dialect — a prompt on Claude Code and OpenClaude, a hard block on OpenCode, exit 2 on Bob. The gates fail closed, and every catch is one line in a ledger that `geneseed status` counts.
+- **Laws are enforced, not suggested.** A force-push to `main`, a `reset --hard` over uncommitted work, or a credential written into a tracked file is caught by a hook *before* the tool runs, in the host's own dialect — a prompt on Claude Code and OpenClaude, a hard block on OpenCode, exit 2 on Bob. The gates fail closed, and every catch is one line in a ledger that `geneseed status` counts.
 - **One source, five targets.** Skills are byte-identical on every host; only the wiring differs. Every commit renders all 263 emit configurations, and a second emit into the same tree must change nothing.
 - **Costs are measured, not guessed.** Zero runtime dependencies. The hook path loads in about 14 ms per tool call. The default *lean* footprint keeps the always-on context small and puts the full rationale one read away — the numbers are in [docs/token-footprint.md](docs/token-footprint.md).
 - **It follows you.** Install once, globally; every repo inherits it. One `git pull` or `npm install -g geneseed@latest` rebuilds every active install.

package/SHIPPED.md

@@ -20,7 +20,7 @@ historical references, not files distributed with the repo.
 > **On version numbers.** [`harness.config.json`](harness.config.json)'s `version` is a
 > human-readable label only. The canonical identity of an installed harness is the
 > **source fingerprint** stamped in `.geneseed-version` (see `geneseed version`), not the
-> string. Current label: **4.7.0**.
+> string. Current label: **4.9.0**.
 
 ## Capabilities
 

package/adapters/claude-code/README.md

@@ -18,7 +18,11 @@ absolute-path hooks instead — `geneseed setup` does that for you.) It:
   half of Doctrine process 5 (*consent before every commit and push*) and of the
   destructive-git Rule. Drop the `process` pack (or exclude process 5) and the hook stays,
   wired with `--no-consent`: commits and pushes pass without asking, while the
-  invariant-territory refusals (force-push, `reset --hard`) stay in every build. The hook inspects
+  Law IV refusals (asked only on real data loss: a force-push to `main`, a `reset --hard`
+  over uncommitted work, an `rm` git cannot undo) stay in every build unless the install is
+  built `--no-deletion-gate`, which appends that flag and stands the real-loss check down
+  (`--no-secrets-gate` does the same for `rule-gate`'s credential scan, `--no-done-gate` for
+  `learn`'s done check). The hook inspects
   command and, when it runs a `git commit` or `git push` (bare, flagged, `-C <path>`,
   or chained like `git add . && git commit … && git push`), returns
   `permissionDecision: "ask"` so Claude Code **prompts on every such call**. Crucially

package/adapters/opencode/HOW-OPENCODE-LOADS.md

@@ -125,7 +125,7 @@ to native **skills**, not slash commands (same `SKILL.md` shape as Claude Code).
 | plugin on `experimental.session.compacting` | **context plugin** — re-pushes the `eager` docs so they survive compaction |
 | plugin on `session.idle` | **learn plugin** — distils memory into `memory/` (debounced to fire once, at session end) |
 | plugin on `experimental.chat.messages.transform` (V1) | **context plugin** — also adds the done gate's reminder when a check in `.geneseed/done-checks.txt` has not passed since the last edit (Verify Before Asserting); OpenCode 2 turns are not judged |
-| plugin on `tool.execute.before` | **guard plugin** — blocks secret-file writes and credential-shaped write content (Sealed Secrets), writes to a protected check or the done list (External Gate), catastrophic shell (Deletion Is Deliberate), a recursive whole-filesystem scan (Commands Must Return), the first rule-store write (Persist Insight) and protected wiki folders; logs each block to the gate ledger and counts skill/subagent use (`GENESEED_GUARD=off\|warn`) |
+| plugin on `tool.execute.before` | **guard plugin** — blocks secret-file writes and credential-shaped write content (Sealed Secrets), writes to a protected check or the done list (External Gate), catastrophic shell and every other real data loss, judged against the repository's state (Deletion Is Deliberate), a recursive whole-filesystem scan (Commands Must Return), the first rule-store write (Persist Insight) and protected wiki folders; logs each block to the gate ledger and counts skill/subagent use (`GENESEED_GUARD=off\|warn`) |
 | plugin registering a custom tool | **workflow plugin** — the `workflow` tool runs saved orchestration scripts from `workflows/` |
 | `context.json` / `.harness/` (manifest) | *optional* override when discovery doesn't fit |
 

package/adapters/opencode/README.md

@@ -384,9 +384,10 @@ behaviour** — nothing changes the machine's current agent/model unless you opt
   `2026-06-17-opencode-color-themes` spec).
 - **Runtime guard plugin** (`geneseed-guard.js`, installed with the others). Enforces
   the safety Laws at the tool boundary: **blocks** writes to private-key/credential
-  files (Sealed Secrets), catastrophic shell like `rm -rf /` (Deletion Is Deliberate), and any mutation under
+  files (Sealed Secrets), catastrophic shell like `rm -rf /` and every command that would really lose data, judged
+  against the repository's state (Deletion Is Deliberate), and any mutation under
   a declared wiki's `protected` folders (AGENT.md §8, from `geneseed-wiki.jsonc`); **warns** on
-  `.env` writes and force-push. `GENESEED_GUARD=off` disables it, `=warn` downgrades
+  `.env` writes. `GENESEED_GUARD=off` disables it, `=warn` downgrades
   blocks to warnings. Every **block** appends one line to the install's
   `notebook/gates.jsonl` (rule `law-1` / `law-4` / `process-1` / `wiki`, a timestamp,
   never the path or command) — the same ledger the Claude-family hooks write, so
@@ -398,8 +399,8 @@ behaviour** — nothing changes the machine's current agent/model unless you opt
   auto-falls back to the visible `session.created` message. `GENESEED_CONTEXT_VISIBLE=1`
   forces the visible block (legacy `GENESEED_CONTEXT_TRANSFORM=0/off` does the same).
 - **Default permissions.** A fresh `opencode.json` gets a minimal policy that **asks**
-  before `rm -rf *` and a force-push — those are **Rule IV**'s territory and are in every
-  build — and, **on an install that built the `process` pack in**, before every
+  before `git reflog expire`, `git gc --prune` and a force-push or delete of `main`/`master` —
+  **Rule IV**'s territory, in every build; the guard plugin decides every other data loss — and, **on an install that built the `process` pack in**, before every
   `git commit` and `git push` (the host-level backstop for **Consent Before Push**: the
   agent never records or shares code unprompted, on any branch). Build with
   `--doctrines` leaving `process` out and those two entries are simply not written.

package/adapters/opencode/plugins/geneseed-context.js

@@ -895,6 +895,21 @@ const DONE_LIST = ".geneseed/done-checks.txt"
 const DONE_EDIT_TOOLS = new Set(["edit", "write", "patch", "apply_patch", "multiedit"])
 const DONE_SHELL_TOOLS = new Set(["bash", "shell"])
 
+// Law III's gate switch (`--no-done-gate`, user decision 2026-10-18): the build writes
+// `Done gate: off` into the install's AGENT.md only when the gate is off. Read ONCE, at the first
+// use, from the harness dir (a switch flip takes an OpenCode restart); anything unreadable reads
+// as ARMED. Off silences the reminder and the V2 notice, nothing else.
+let doneGateOffOnce = null
+function doneGateOff() {
+  doneGateOffOnce ??= (async () => {
+    const dir = await harnessDir()
+    if (!dir) return false
+    const text = await fs.readFile(path.join(dir, "AGENT.md"), "utf8")
+    return /^Done gate:[ \t]*off[ \t]*\r?$/m.test(text)
+  })().catch(() => false)
+  return doneGateOffOnce
+}
+
 async function readDoneChecks(root) {
   try {
     const text = await fs.readFile(path.join(root, DONE_LIST), "utf8")
@@ -1140,6 +1155,7 @@ export const GeneseedContext = async (ctx) => {
       // INJECT_OFF and the visible delivery leave it on, and no early return below can skip it.
       // Its own function, so its early returns end the reminder, never the context injection.
       await (async () => {
+        if (await doneGateOff()) return
         const checks = await readDoneChecks(root)
         if (!checks.length) return
         const owed = doneOwed(output.messages, checks, root)
@@ -1211,7 +1227,7 @@ async function setupV2(ctx) {
   })
 
   // The done gate is not judged on OpenCode 2 (see `doneOwed`): said once, where its log goes.
-  if ((await readDoneChecks(root).catch(() => [])).length) {
+  if (!(await doneGateOff()) && (await readDoneChecks(root).catch(() => [])).length) {
     console.error(`[geneseed-context] done gate: ${DONE_LIST} found, but OpenCode 2 turns are not judged.`)
   }