geneseed 4.8.0 → 4.9.0

package/CHANGELOG.md

@@ -8,6 +8,19 @@ label. For the capability ↔ spec map, see [SHIPPED.md](SHIPPED.md).
 
 ## [Unreleased]
 
+## [4.9.0] — 2026-10-18
+
+Minor: on/off switches for the Sealed Secrets and done gates, and the console calls the laws Dictates.
+
+### Added
+- **On/off switches for the Sealed Secrets and Verify Before Asserting gates**, beside Law IV's. `geneseed build --no-secrets-gate` stands down the credential scan (`rule-gate` on Claude Code and OpenClaude, `tool-gate` on Bob, the OpenCode guard's key-file block and content scan); `--no-done-gate` stands down the done check in `learn` on Stop (and OpenCode's reminder), while learning still runs. Both armed by default; the Rule's text still binds. The install records `Secrets gate: off` / `Done gate: off` beside its pack list; rebuilds, upgrades, `status`, `diff`, `validate` and the console keep them. The console's Constitution page now has a toggle column on every Rule: a switch on Rules I, III and IV, *no gate* on the others.
+
+### Upgrade notes
+- The secrets and done gate switches: run `geneseed rebuild-all` before switching either off. While the machine's hook shim points at an older checkout, a disarmed install's `rule-gate`/`tool-gate` refuses the new flag and lets every write through (External Gate and Persist Insight too, and on Bob every check), and its `learn` refuses `--no-done-gate`, so that install stops learning as well. OpenCode reads both switches when it starts: restart it after flipping one.
+
+### Changed
+- **The console calls the laws Dictates**, the name AGENT.md gives them, instead of Invariants: the Laws tab and band, the dashboard KPI tile, the constitution map, Greenhouse and the Operator HUD. Routes and internal keys are unchanged (#321).
+
 ## [4.8.0] — 2026-10-18
 
 Minor: Deletion Is Deliberate asks only on real data loss, and can be switched off per install.

package/SHIPPED.md

@@ -20,7 +20,7 @@ historical references, not files distributed with the repo.
 > **On version numbers.** [`harness.config.json`](harness.config.json)'s `version` is a
 > human-readable label only. The canonical identity of an installed harness is the
 > **source fingerprint** stamped in `.geneseed-version` (see `geneseed version`), not the
-> string. Current label: **4.8.0**.
+> string. Current label: **4.9.0**.
 
 ## Capabilities
 

package/adapters/claude-code/README.md

@@ -20,7 +20,9 @@ absolute-path hooks instead — `geneseed setup` does that for you.) It:
   wired with `--no-consent`: commits and pushes pass without asking, while the
   Law IV refusals (asked only on real data loss: a force-push to `main`, a `reset --hard`
   over uncommitted work, an `rm` git cannot undo) stay in every build unless the install is
-  built `--no-deletion-gate`, which appends that flag and stands the real-loss check down. The hook inspects
+  built `--no-deletion-gate`, which appends that flag and stands the real-loss check down
+  (`--no-secrets-gate` does the same for `rule-gate`'s credential scan, `--no-done-gate` for
+  `learn`'s done check). The hook inspects
   command and, when it runs a `git commit` or `git push` (bare, flagged, `-C <path>`,
   or chained like `git add . && git commit … && git push`), returns
   `permissionDecision: "ask"` so Claude Code **prompts on every such call**. Crucially

package/adapters/opencode/plugins/geneseed-context.js

@@ -895,6 +895,21 @@ const DONE_LIST = ".geneseed/done-checks.txt"
 const DONE_EDIT_TOOLS = new Set(["edit", "write", "patch", "apply_patch", "multiedit"])
 const DONE_SHELL_TOOLS = new Set(["bash", "shell"])
 
+// Law III's gate switch (`--no-done-gate`, user decision 2026-10-18): the build writes
+// `Done gate: off` into the install's AGENT.md only when the gate is off. Read ONCE, at the first
+// use, from the harness dir (a switch flip takes an OpenCode restart); anything unreadable reads
+// as ARMED. Off silences the reminder and the V2 notice, nothing else.
+let doneGateOffOnce = null
+function doneGateOff() {
+  doneGateOffOnce ??= (async () => {
+    const dir = await harnessDir()
+    if (!dir) return false
+    const text = await fs.readFile(path.join(dir, "AGENT.md"), "utf8")
+    return /^Done gate:[ \t]*off[ \t]*\r?$/m.test(text)
+  })().catch(() => false)
+  return doneGateOffOnce
+}
+
 async function readDoneChecks(root) {
   try {
     const text = await fs.readFile(path.join(root, DONE_LIST), "utf8")
@@ -1140,6 +1155,7 @@ export const GeneseedContext = async (ctx) => {
       // INJECT_OFF and the visible delivery leave it on, and no early return below can skip it.
       // Its own function, so its early returns end the reminder, never the context injection.
       await (async () => {
+        if (await doneGateOff()) return
         const checks = await readDoneChecks(root)
         if (!checks.length) return
         const owed = doneOwed(output.messages, checks, root)
@@ -1211,7 +1227,7 @@ async function setupV2(ctx) {
   })
 
   // The done gate is not judged on OpenCode 2 (see `doneOwed`): said once, where its log goes.
-  if ((await readDoneChecks(root).catch(() => [])).length) {
+  if (!(await doneGateOff()) && (await readDoneChecks(root).catch(() => [])).length) {
     console.error(`[geneseed-context] done gate: ${DONE_LIST} found, but OpenCode 2 turns are not judged.`)
   }
 

package/adapters/opencode/plugins/geneseed-guard.js

@@ -124,26 +124,28 @@ const MODE = (process.env.GENESEED_GUARD || "on").toLowerCase()
 const OFF = ["off", "0", "false", "no"].includes(MODE)
 const WARN_ONLY = MODE === "warn"
 
-// Law IV's gate switch (`--no-deletion-gate`, user decision 2026-10-17). The build writes
-// `Deletion gate: off` into the install's AGENT.md only when the gate is off; this reads it ONCE
-// at load, from the same harness dir the context plugin resolves ($GENESEED_HARNESS, else
-// <plugin dir>/.. for a global install, else <plugin dir>/../.. for a project one), so flipping
-// the switch takes an OpenCode restart. Anything unreadable or unexpected reads as ARMED. It
-// stands down only the real-loss check below — catastrophic commands, root scans, secrets and
-// protected checks still block.
-function deletionGateOff() {
+// The gate switches (`--no-deletion-gate` 2026-10-17, `--no-secrets-gate` 2026-10-18, user
+// decisions). The build writes `Deletion gate: off` / `Secrets gate: off` into the install's
+// AGENT.md only when that gate is off; this reads the carrier ONCE at load, from the same
+// harness dir the context plugin resolves ($GENESEED_HARNESS, else <plugin dir>/.. for a global
+// install, else <plugin dir>/../.. for a project one), so flipping a switch takes an OpenCode
+// restart. Anything unreadable or unexpected reads as ARMED. Each stands down only its own check
+// below (the real-loss check; the Sealed Secrets path block and content scan) — catastrophic
+// commands, root scans and protected checks still block.
+function carrierText() {
   try {
     const dirs = [path.resolve(PLUGIN_DIR, ".."), path.resolve(PLUGIN_DIR, "..", "..")]
     if (process.env.GENESEED_HARNESS) dirs.unshift(process.env.GENESEED_HARNESS)
     for (const d of dirs) {
-      let text
-      try { text = readFileSync(path.join(d, "AGENT.md"), "utf8") } catch { continue }
-      return /^Deletion gate:[ \t]*off[ \t]*\r?$/m.test(text)
+      try { return readFileSync(path.join(d, "AGENT.md"), "utf8") } catch { continue }
     }
   } catch { /* fall through: armed */ }
-  return false
+  return ""
 }
-const DELETION_GATE_OFF = deletionGateOff()
+const CARRIER_TEXT = carrierText()
+const gateOff = (marker) => new RegExp(`^${marker}:[ \\t]*off[ \\t]*\\r?$`, "m").test(CARRIER_TEXT)
+const DELETION_GATE_OFF = gateOff("Deletion gate")
+const SECRETS_GATE_OFF = gateOff("Secrets gate")
 
 function log(msg) { console.error(`[geneseed-guard] ${msg}`) }
 
@@ -1168,7 +1170,7 @@ export const GeneseedGuard = async (ctx) => {
           // blocks the whole call (see `pickPath` for why this is not a single path).
           const paths = pickPath(args, cwd)
           for (const p of paths) {
-            if (SECRET_RE.some((re) => re.test(p))) { await deny(`write to secret/key file ${p} (Sealed Secrets)`, "law-1"); return }
+            if (!SECRETS_GATE_OFF && SECRET_RE.some((re) => re.test(p))) { await deny(`write to secret/key file ${p} (Sealed Secrets)`, "law-1"); return }
             if (SECRET_WARN_RE.some((re) => re.test(p))) log(`WARN: writing ${p} — keep secrets out of tracked files (Sealed Secrets)`)
             const sensor = protectedCheck(p)
             if (sensor) { await deny(`${p} is a protected check (${sensor === DONE_LIST ? "the done gate list itself" : `${sensor}, listed in ${SENSOR_LIST}`}) — a check the agent can edit is not a check (External Gate)`, "rigor-5"); return }
@@ -1185,7 +1187,7 @@ export const GeneseedGuard = async (ctx) => {
           // FILE, not pooled — a patch touching `.env` AND an ordinary file must still catch a
           // secret in the ordinary file; only the hunk whose OWN path is `.env`-shaped is
           // exempt, same as the path WARN tier above.
-          for (const { path: cp, content } of pickAddedContentByPath(args, cwd)) {
+          for (const { path: cp, content } of SECRETS_GATE_OFF ? [] : pickAddedContentByPath(args, cwd)) {
             if (SECRET_WARN_RE.some((re) => re.test(cp))) continue
             if (SECRET_CONTENT_RE.test(content)) {
               await deny(`${cp} would carry a credential-shaped string (Sealed Secrets) — secrets `

package/bin/geneseed-hook.mjs

@@ -75,16 +75,21 @@ const VERBS = {
     flags: HOSTED,
     switches: { '--no-consent': 'noConsent', '--no-deletion-gate': 'noDeletionGate' },
   },
-  'rule-gate': { load: gates, fn: 'cmdRuleGate', flags: HOSTED },
+  'rule-gate': {
+    load: gates, fn: 'cmdRuleGate', flags: HOSTED, switches: { '--no-secrets-gate': 'noSecretsGate' },
+  },
   'tool-gate': {
-    load: gates, fn: 'cmdToolGate', flags: HOSTED, switches: { '--no-deletion-gate': 'noDeletionGate' },
+    load: gates,
+    fn: 'cmdToolGate',
+    flags: HOSTED,
+    switches: { '--no-deletion-gate': 'noDeletionGate', '--no-secrets-gate': 'noSecretsGate' },
   },
   learn: {
     load: () => import('../js/hosts/hooks-learn.mjs'),
     fn: 'cmdLearn',
     // `--host` only keys the global stand-down's marker (js/hosts/hosts.mjs); learn has no dialect.
     flags: { '--memory': 'memory', '--host': 'host' },
-    switches: { '--consolidate': 'consolidate' },
+    switches: { '--consolidate': 'consolidate', '--no-done-gate': 'noDoneGate' },
     positional: 'file',
   },
 };
@@ -104,7 +109,7 @@ function die(code, msg) {
 function parse(spec, argv) {
   const args = {
     root: null, host: null, memory: null, consolidate: false, noConsent: false,
-    noDeletionGate: false, file: null,
+    noDeletionGate: false, noSecretsGate: false, noDoneGate: false, file: null,
   };
   for (let i = 0; i < argv.length; i += 1) {
     const tok = argv[i];

package/docs/concepts/enforcement-table.md

@@ -21,12 +21,12 @@ silently guarding the wrong rule after a renumber. See [ADR 0005](../adr/0005-st
 
 | id | Pack | Claude Code | OpenClaude | OpenCode | Bob |
 |---|---|---|---|---|---|
-| `sealed-secrets` | law | ask: rule-gate (credential-shaped content outside `.env*`) | same as Claude Code | block: guard plugin (key/credential file path, or vendor-prefixed secret content); warns only on `.env*` | block (exit 2) |
+| `sealed-secrets` | law | ask: rule-gate (credential-shaped content outside `.env*`). Switchable per install with `--no-secrets-gate` (see [Exclusions](exclusions.md)): this scan stands down on every host, the guard plugin's path block included | same as Claude Code | block: guard plugin (key/credential file path, or vendor-prefixed secret content); warns only on `.env*` | block (exit 2) |
 | `deletion-is-deliberate` | law | ask: git-gate, only on real data loss judged against the repository's state (the list in [Hooks](hooks.md): a protected branch deleted or force-pushed, an unpushed unmerged branch deleted, uncommitted work discarded, a stash dropped, the reflog pruned, files git cannot restore removed); asks when it cannot verify. Switchable per install with `--no-deletion-gate` (see [Exclusions](exclusions.md)): the real-loss check and the Law IV `permission.bash` keys stand down, everything else in this table stays | same as Claude Code | ask: permission prompt (`git reflog expire*`, `git gc --prune*`, a force push or delete of `main`/`master` by name) **+** block: guard plugin (catastrophic shell: `rm -rf /`, fork bomb, `format`, `dd` over a raw disk) **+** block: guard plugin (every other real-loss case, the same state-aware decisions as the hook) | block (exit 2) |
 | `persist-insight` | process | ask: rule-gate (a write to `user-rules.md` or the memory store) | same as Claude Code | ask once: guard plugin (refuses the *first* write to that path; a re-issued write goes through) | log only (warning, call goes through) |
 | `consent-before-push` | process | ask: git-gate (every `git commit`/`git push`). Togglable: build without the process pack, or drop this rule alone with `--exclude-rules` (see [Exclusions](exclusions.md)). Only this question drops; the `deletion-is-deliberate` gate stays. | same as Claude Code | ask: permission prompt (`git commit*`/`git push*`), wired only when the process pack is on; a `loop/*` push is statically allowed | log only |
 | `external-gate` | rigor | ask: rule-gate (a write under a project's `.geneseed/protected-checks.txt` list) | same as Claude Code | block: guard plugin (same list) | block (exit 2) |
-| `verify-before-asserting` | law | block at Stop, once per turn: the done gate in `learn` (a turn that edited files, while a check in the project's `.geneseed/done-checks.txt` has not passed since the last edit). Opt-in per project | same as Claude Code (**unverified live**: a frozen fork, and no check runs a model turn) | remind: context plugin, on the next request (OpenCode 1 only; OpenCode 2 is not judged, and logs so) | not judged: Stop carries no transcript (log line) |
+| `verify-before-asserting` | law | block at Stop, once per turn: the done gate in `learn` (a turn that edited files, while a check in the project's `.geneseed/done-checks.txt` has not passed since the last edit). Opt-in per project; switchable per install with `--no-done-gate` (see [Exclusions](exclusions.md)) | same as Claude Code (**unverified live**: a frozen fork, and no check runs a model turn) | remind: context plugin, on the next request (OpenCode 1 only; OpenCode 2 is not judged, and logs so) | not judged: Stop carries no transcript (log line) |
 | `commands-must-return` | ops | ask: git-gate (a recursive scan rooted at a filesystem root: `find /`, `du`, `grep -r`, `rg`, `Get-ChildItem -Recurse` at `/`, `/c`, `C:\`) | same as Claude Code | block: guard plugin (same root-scan pattern) | block (exit 2) |
 
 Bob has no "ask" tier (see [ADR 0007](../adr/0007-gates-fail-closed-per-host-ceiling.md)), so a

package/docs/concepts/exclusions.md

@@ -7,7 +7,7 @@ section: "Configuration"
 description: "Three ways to switch things off: one rule, one skill, or every hook in a folder."
 link: {"hash": "#/harness", "label": "Manage in Harness →"}
 ---
-Geneseed has three ways to switch something off, and they work at different scales (plus one on/off switch for Law IV's gate, below):
+Geneseed has three ways to switch something off, and they work at different scales (plus an on/off switch for the hook gates of Laws I, III and IV, below):
 
 | | Sovereign repo | Per-rule exclusion | Per-skill exclusion |
 | --- | --- | --- | --- |
@@ -88,3 +88,20 @@ Limits:
 - **A global install beside a project install.** On Claude Code and OpenClaude the global `git-gate` stands down for a project install, so the project's switch decides. Bob's `tool-gate` and the OpenCode guard do not stand down: an armed global install still refuses real loss inside a project whose own install is off.
 - **An existing `opencode.json` keeps its Law IV keys.** Switching off does not remove `permission.bash` entries already written — Geneseed cannot tell its own from yours — so the build warns that it keeps them and they keep asking. Delete them by hand.
 - **An older hook shim silences the whole gate.** The flag is new. While the machine's shared hook shim still points at an older checkout, that checkout refuses the flag and the gate verb lets every call through on a disarmed install — on Claude Code and OpenClaude the root-scan and consent checks too, on Bob also *Sealed Secrets* and *External Gate*. Update the checkout the shim points at (`geneseed rebuild-all`) before switching the gate off.
+
+### Law I secrets gate and Law III done gate — on or off
+
+The same switch, for two more gates. Both are armed by default, and the Rule's text in the carrier still binds the agent with either off.
+
+```bash
+geneseed build --emit claude-global --no-secrets-gate   # Sealed Secrets
+geneseed build --emit claude-global --no-done-gate      # Verify Before Asserting
+```
+
+The console's Constitution page has a switch on Rule I's and Rule III's rows too (*Enforced by* reads **Gate off** while one is off); the other Rules show *no gate*, because only their text enforces them. The install records `Secrets gate: off` / `Done gate: off` beside `Deletion gate:`, written only when off; rebuilds, upgrades and `geneseed status` carry them like Law IV's.
+
+What stops, per host:
+- **`--no-secrets-gate`**: the credential scan of `rule-gate` (Claude Code, OpenClaude) and of `tool-gate` (Bob, which then no longer exits 2 for it), and on OpenCode the guard plugin's *Sealed Secrets* block — both the key/credential file path block and the content scan. *External Gate*, *Persist Insight*, the deletion gate and the root-scan check stay.
+- **`--no-done-gate`**: the done check `learn` runs on Stop (Claude Code, OpenClaude; on Bob, the "turn not judged" log line), and on OpenCode the context plugin's reminder (OpenCode 1) and its one-line notice (OpenCode 2). Learning itself still runs, and `.geneseed/done-checks.txt` stays protected by *External Gate*.
+
+Limits: OpenCode reads both switches from the install's `AGENT.md` when it starts, so restart it after flipping one. A global install beside a project install: `rule-gate` and Bob's `tool-gate` do not stand down for a project install on any host, and neither does the OpenCode guard, so an armed global install still asks about (or blocks) a credential write inside a project whose own install has the secrets gate off. `learn` does stand down on Claude Code and OpenClaude, so there the project's done gate switch decides. And the older-shim limit above is sharper for the done gate: its flag rides on `learn`, so while the shim points at an older checkout an install with the done gate off **loses learning too**, not only the gate. Run `geneseed rebuild-all` before switching either gate off.

package/docs/concepts/hooks.md

@@ -42,13 +42,13 @@ Geneseed writes its hooks into the host's settings file. Every hook calls one pr
 - Any other command passes untouched.
 
 **rule-gate.** Runs before every file write.
-- Content that looks like a credential (a cloud access key, a GitHub or Anthropic token, a Slack token, a private-key block) going into any file other than `.env*` gets a prompt citing *Sealed Secrets*.
+- Content that looks like a credential (a cloud access key, a GitHub or Anthropic token, a Slack token, a private-key block) going into any file other than `.env*` gets a prompt citing *Sealed Secrets*. An install built `--no-secrets-gate` wires the hook with that flag and this check alone stands down ([Exclusions](exclusions.md)).
 - A write to `user-rules.md`, `MEMORY.md` or a file in the install's `memory/` gets a prompt citing *Persist Insight*: whether something is a standing rule or a fact to remember is your call, settled through the `rule` [skill](skills.md).
 - A write to a check the project protects gets a prompt citing *External Gate* (on Bob, it is blocked). A project opts in with `.geneseed/protected-checks.txt` at its git root: one repo-relative file or folder per line, `#` for comments — the checks and tests the agent is judged by. A check the agent can edit is not a check. The list protects itself. Only file-write tools are seen: a shell `sed -i` or redirect is not, so run the same checks in CI as the boundary that holds.
 - A write to `.geneseed/done-checks.txt`, the done gate's own list (below), gets the same *External Gate* prompt: emptying it would disarm the gate.
 - Ordinary edits pass untouched.
 
-**The done gate.** Runs when a turn ends, inside `learn` and before it calls any model. A project opts in with `.geneseed/done-checks.txt` at its git root: one command per line, `#` for comments — the checks that prove the work, for example `npm run lint` and `node --test`. If the turn edited a file under that root and a listed check has not passed since the last edit, the turn does not end: the agent is told which checks are owed, citing *Verify Before Asserting*. A check counts when it ran as a shell command, unpiped (`npm test | tail` exits with `tail`'s code, so it proves nothing), and its result was not an error. The gate never runs a check itself. It blocks at most once per turn; the second stop ends the turn and leaves a line in the gate ledger. Only file-write tools count as edits: a shell `sed -i` or redirect is not seen. Without the file, nothing changes. On OpenCode the gate is a reminder on the next request (OpenCode 1 only); on Bob, whose Stop carries no transcript, the turn is not judged and a log line says so.
+**The done gate.** Runs when a turn ends, inside `learn` and before it calls any model. A project opts in with `.geneseed/done-checks.txt` at its git root: one command per line, `#` for comments — the checks that prove the work, for example `npm run lint` and `node --test`. If the turn edited a file under that root and a listed check has not passed since the last edit, the turn does not end: the agent is told which checks are owed, citing *Verify Before Asserting*. A check counts when it ran as a shell command, unpiped (`npm test | tail` exits with `tail`'s code, so it proves nothing), and its result was not an error. The gate never runs a check itself. It blocks at most once per turn; the second stop ends the turn and leaves a line in the gate ledger. Only file-write tools count as edits: a shell `sed -i` or redirect is not seen. Without the file, nothing changes. On OpenCode the gate is a reminder on the next request (OpenCode 1 only); on Bob, whose Stop carries no transcript, the turn is not judged and a log line says so. An install built `--no-done-gate` wires `learn` with that flag: the check is skipped, learning still runs ([Exclusions](exclusions.md)).
 
 **learn.** Takes the tail of the transcript and asks a model to distil what is worth keeping into one-fact-per-file entries under `memory/`. It is shown the facts already stored, so it updates one with the merged text rather than writing a twin (the old version is kept in `memory/archive/`), and moves one the session proved obsolete into `memory/archive/`. It needs `GENESEED_LLM` set to a model command, for example:
 

package/docs/reference/plugin-context.md

@@ -17,7 +17,7 @@ One of the [OpenCode plugins](opencode-plugins.md). Its switches are also listed
 
 **When it runs.** On every request: the context rides invisibly in the request's message list, so it also survives compaction. If your OpenCode build lacks that (experimental) hook, the plugin notices and falls back to one visible message at session start, re-pushed when the session compacts.
 
-**The done gate's reminder.** In a project with `.geneseed/done-checks.txt` (see [Hooks](../concepts/hooks.md)), a request that follows a turn which edited files without every listed check passing since gets one more invisible message naming the checks owed. OpenCode has no turn-end event a plugin can block on, so this is a reminder, not a block. OpenCode 1 only: on OpenCode 2 the turn is not judged, and the plugin logs that once. `GENESEED_CONTEXT_INJECT=off` does not turn it off; removing the file does.
+**The done gate's reminder.** In a project with `.geneseed/done-checks.txt` (see [Hooks](../concepts/hooks.md)), a request that follows a turn which edited files without every listed check passing since gets one more invisible message naming the checks owed. OpenCode has no turn-end event a plugin can block on, so this is a reminder, not a block. OpenCode 1 only: on OpenCode 2 the turn is not judged, and the plugin logs that once. `GENESEED_CONTEXT_INJECT=off` does not turn it off; removing the file does, and so does an install built `--no-done-gate` (`Done gate: off` in its `AGENT.md`, read once when OpenCode starts), which also silences the OpenCode 2 log line.
 
 **What you see.** Normally nothing — the context is there, but not shown. With the visible fallback, a `PROJECT CONTEXT` block at the top of the session.
 

package/docs/reference/plugin-guard.md

@@ -10,7 +10,7 @@ One of the [OpenCode plugins](opencode-plugins.md). [Environment variables](envi
 
 **What it does.** Enforces the safety rules at the tool boundary — before a tool call runs, not after. High-confidence patterns only, so legitimate work is not caught.
 
-- **Blocks** writes to private-key and credential files (*Sealed Secrets*), catastrophic shell commands such as deleting the filesystem root and every command that would really lose data — a protected branch deleted or force-pushed, an unpushed unmerged branch deleted, a protected branch force-moved off commits nothing else holds, uncommitted work discarded, a stash dropped, files git cannot restore removed — judged against the repository's state, the same decisions the Claude/Bob hook makes (*Deletion Is Deliberate*; `reflog expire` and `gc --prune` are left to the `permission.bash` ask; an install built `--no-deletion-gate` carries `Deletion gate: off` in its `AGENT.md`, which the plugin reads once at load and then stops blocking real loss — catastrophic commands still block), a recursive scan rooted at a whole filesystem such as `find /` (*Commands Must Return* — search a specific directory instead), and any change — write, move, rename, delete — under a wiki folder declared `protected` in `geneseed-wiki.jsonc`, and writes to a check listed in the project's `.geneseed/protected-checks.txt` (*External Gate* — see [Hooks](../concepts/hooks.md)).
+- **Blocks** writes to private-key and credential files and writes whose content carries a credential (*Sealed Secrets*; an install built `--no-secrets-gate` carries `Secrets gate: off` in its `AGENT.md`, read once at load, and both stop blocking), catastrophic shell commands such as deleting the filesystem root and every command that would really lose data — a protected branch deleted or force-pushed, an unpushed unmerged branch deleted, a protected branch force-moved off commits nothing else holds, uncommitted work discarded, a stash dropped, files git cannot restore removed — judged against the repository's state, the same decisions the Claude/Bob hook makes (*Deletion Is Deliberate*; `reflog expire` and `gc --prune` are left to the `permission.bash` ask; an install built `--no-deletion-gate` carries `Deletion gate: off` in its `AGENT.md`, which the plugin reads once at load and then stops blocking real loss — catastrophic commands still block), a recursive scan rooted at a whole filesystem such as `find /` (*Commands Must Return* — search a specific directory instead), and any change — write, move, rename, delete — under a wiki folder declared `protected` in `geneseed-wiki.jsonc`, and writes to a check listed in the project's `.geneseed/protected-checks.txt` (*External Gate* — see [Hooks](../concepts/hooks.md)).
 - **Warns** (logged, allowed) on `.env` writes.
 - **Speed-bumps** the *first* write to `user-rules.md` or a memory file: it is refused once, naming *Persist Insight* — whether something is a standing rule or a fact to remember is your call, settled through the `rule` skill. The re-issued write goes through.
 

package/docs/reference/troubleshoot-doctor.md

@@ -43,7 +43,8 @@ These come only from `geneseed doctor --probe`. It runs each installed gate exac
 settings spell it, through the host's own shell, on `git reflog expire --expire=now --all` (which must be refused)
 and `git status` (which must go through). A gate wired with `--no-deletion-gate` lets the first one
 through by design, so it is probed on `find / -name geneseed-probe` instead — a root-wide scan it
-must still refuse. An OpenCode install's guard plugin has no command to
+must still refuse. `--no-secrets-gate` and `--no-done-gate` change nothing here: neither judges a
+shell command. An OpenCode install's guard plugin has no command to
 run: the probe imports it and calls its hook through both plugin APIs (V1 and V2), with `rm -rf /`
 as the call it must refuse. `GENESEED_GUARD=off` or `warn` in your terminal makes that a note,
 not a failure.

package/docs/web-ui.md

@@ -77,8 +77,8 @@ streams the output of background jobs and keeps their history across reloads.
   **Operator** (a searchable table of every deployed capability). Headlines reflect the
   active theme's voice.
 
-  The KPI band reads **Agents · Skills · Invariants · Local edits**. That third tile is
-  labelled *Invariants* and not *Constitution* on purpose: its value is the invariant count
+  The KPI band reads **Agents · Skills · Dictates · Local edits**. That third tile is
+  labelled *Dictates* (the name AGENT.md gives the laws) and not *Constitution* on purpose: its value is the law count
   alone, and calling it the constitution would under-report the ontology and the doctrine
   packs. The two Status *layouts* that have room for it add the missing half: Greenhouse
   puts an active-packs fraction under the tile (`3/4 packs · N rules`), and the Operator HUD
@@ -95,12 +95,13 @@ streams the output of background jobs and keeps their history across reloads.
   content the page last read — if an agent session edited the file meanwhile, the save
   409s and the page reloads instead of clobbering it.
 - **Constitution** (`#/laws`) — the whole governance surface on one page, in three bands:
-  the **Ethos** (four prose sections), the **Invariants** (the nine numbered Rules, with
+  the **Ethos** (four prose sections), the **Dictates** (the nine numbered Rules, with
   a class facet — only non-empty classes render, and two of the six have had no invariant
   since the split), and the **Doctrines** (one group per pack, each marked active or not for
-  this install). Rule IV carries one switch of its own, the install's deletion gate
-  (`--no-deletion-gate`; *Enforced by* reads *Gate off* while it is off) — flipping it asks,
-  then rebuilds the install once. Every row expands to its full body, lazily fetched. The rail entry is
+  this install). Rules I, III and IV each carry a switch for the install's hook gate — the
+  secrets gate, the done gate and the deletion gate (`--no-secrets-gate`, `--no-done-gate`,
+  `--no-deletion-gate`; *Enforced by* reads *Gate off* while one is off) — flipping one asks,
+  then rebuilds the install once; the other Rules read *no gate*. Every row expands to its full body, lazily fetched. The rail entry is
   labelled *Constitution* while the route, the id and the badge key stay `laws`; deep links
   are `#/item/law/ont:telos`, `#/item/law/IV` and `#/item/law/process.5` — three address
   shapes that cannot collide, because a slug carries a colon no numeral has and a doctrine

package/harness.config.json

@@ -2,5 +2,5 @@
   "_comment": "version is a human-readable release label only; the canonical identity of an installed harness is the source fingerprint stamped in .geneseed-version (see `harness version`), not this string.",
   "theme": "neutral",
   "product": "Geneseed",
-  "version": "4.8.0"
+  "version": "4.9.0"
 }

package/js/build/args.mjs

@@ -104,6 +104,8 @@ const FLAGS = {
   // Law IV's gate switch. No `harness.config.json` key feeds it, deliberately: a rebuild elides
   // the flag when armed, so a config default could disarm an armed install on its next upgrade.
   '--no-deletion-gate': 'noDeletionGate',
+  // Laws I and III, the same contract (`GATE_SWITCHES` in source.mjs).
+  '--no-secrets-gate': 'noSecretsGate', '--no-done-gate': 'noDoneGate',
   '-v': 'verbose', '--verbose': 'verbose',
 };
 
@@ -312,6 +314,7 @@ export function parseArgs(argv, defaults) {
     excludeSkills: defaults.excludeSkills ?? [],
     out: 'Harness', emit: 'files', footprint: 'lean', root: null,
     syncThemes: false, validateOnly: false, verbose: false, noDeletionGate: false,
+    noSecretsGate: false, noDoneGate: false,
   };
   const { tokens } = nodeParseArgs({
     args: argv, options: PARSE_OPTIONS, allowPositionals: true, strict: false, tokens: true,

package/js/build/driver.mjs

@@ -647,19 +647,25 @@ const PROJECT_EMITS = {
  * mode readers return `null` for "undetectable" too, which an explicit `posture: null` would
  * carry straight past the parameter default.
  */
-function axesCfg({ posture, mode, trust, doctrines, excludeRules, excludeSkills, deletionGate = null }) {
+function axesCfg({
+  posture, mode, trust, doctrines, excludeRules, excludeSkills,
+  deletionGate = null, secretsGate = null, doneGate = null,
+}) {
   return makeCfg({
     ...(posture ? { posture } : {}), ...(mode ? { mode } : {}), ...(trust ? { trust } : {}),
     ...(doctrines ? { doctrines } : {}), ...(excludeRules ? { excludeRules } : {}),
     ...(excludeSkills ? { excludeSkills } : {}),
     // Only an explicit `false` disarms; `null` (no opinion) keeps the gate.
     ...(deletionGate === false ? { noDeletionGate: true } : {}),
+    ...(secretsGate === false ? { noSecretsGate: true } : {}),
+    ...(doneGate === false ? { noDoneGate: true } : {}),
   });
 }
 
 export function emitProjectInto(host, {
   theme, out, root, footprint = 'full', posture = null, mode = null, trust = null,
   doctrines = null, excludeRules = null, excludeSkills = null, deletionGate = null,
+  secretsGate = null, doneGate = null,
 }) {
   const emit = PROJECT_EMITS[host];
   // The axes ride the same rail into every `*Into`, and for the same reason: a drift reader
@@ -667,7 +673,8 @@ export function emitProjectInto(host, {
   // edited on every narrowed install, and `validate --doctrines craft` that ignored its flag
   // checked an all-packs render nobody asked for.
   return withPlatformNewlines(() => emit(
-    axesCfg({ posture, mode, trust, doctrines, excludeRules, excludeSkills, deletionGate }),
+    axesCfg({
+      posture, mode, trust, doctrines, excludeRules, excludeSkills, deletionGate, secretsGate, doneGate }),
     { theme, footprint, root }, out,
   ));
 }
@@ -682,16 +689,16 @@ export function emitProjectInto(host, {
  */
 export function buildInto({
   theme, out, footprint = 'lean', posture = null, mode = null, trust = null, doctrines = null,
-  excludeRules = null, excludeSkills = null, deletionGate = null,
+  excludeRules = null, excludeSkills = null, deletionGate = null, secretsGate = null, doneGate = null,
 }) {
   return withPlatformNewlines(() => build(axesCfg({
-    posture, mode, trust, doctrines, excludeRules, excludeSkills, deletionGate }),
+    posture, mode, trust, doctrines, excludeRules, excludeSkills, deletionGate, secretsGate, doneGate }),
     theme, out, { footprint, nativeCatalog: false }));
 }
 
 export function emitGlobalInto(host, {
   theme, out, cfgDir, footprint, posture = null, mode = null, doctrines = null, trust = null,
-  excludeRules = null, excludeSkills = null, deletionGate = null,
+  excludeRules = null, excludeSkills = null, deletionGate = null, secretsGate = null, doneGate = null,
 }) {
   // `build.HOSTS.get(host, build.HOSTS["opencode"])` — an unknown host falls back rather than
   // raising, because the host comes from a marker file a user can edit.
@@ -707,7 +714,8 @@ export function emitGlobalInto(host, {
   // edited on every install that chose a register, narrowed its packs or excluded a rule —
   // the same scar the footprint left in `diffCollect`, one axis over each time.
   return withPlatformNewlines(() => emit(
-    axesCfg({ posture, mode, trust, doctrines, excludeRules, excludeSkills, deletionGate }),
+    axesCfg({
+      posture, mode, trust, doctrines, excludeRules, excludeSkills, deletionGate, secretsGate, doneGate }),
     { theme, footprint, root: null, cfgDir }, out,
   ));
 }

package/js/build/emit-claude.mjs

@@ -182,7 +182,7 @@ export function emitClaudeRender(cfg, job) {
   // WIRE — see `claudeWire` below. One child per emit, so the two halves are two
   // functions rather than two spawns; the seam between them is a call, not a process.
   const managed = claudeWire(job, claudeMdText, agentText !== null, cfg.doctrines,
-    cfg.excludeRules, cfg.deletionGate);
+    cfg.excludeRules, cfg.deletionGate, { secretsGate: cfg.secretsGate, doneGate: cfg.doneGate });
 
   return {
     owned,
@@ -216,7 +216,7 @@ export function emitClaudeRender(cfg, job) {
  * always a string, so `''` is the only falsy value either language sees.
  */
 function claudeWire(job, claudeMdText, hasAgentText, doctrines = null, excludeRules = [],
-  deletionGate = true) {
+  deletionGate = true, gates = {}) {
   phaseLog('WIRE');
   const { cfgDir, claudeMd, scope, host, oldManaged, preambleExclude, hookOpts } = job;
   const old = oldManaged && typeof oldManaged === 'object' && !Array.isArray(oldManaged)
@@ -280,7 +280,7 @@ function claudeWire(job, claudeMdText, hasAgentText, doctrines = null, excludeRu
   // DECIDES the install's packs, so the marker on disk is still the previous build's.
   const [, managedHooks] = mergeClaudeSettings(
     settingsPath, oldSf === settingsName ? get(old, 'settings_hooks') : null, hookOpts,
-    doctrines, excludeRules, host, cfgDir, deletionGate,
+    doctrines, excludeRules, host, cfgDir, deletionGate, gates,
   );
   managed.settings_hooks = managedHooks;
 

package/js/build/generate.mjs

@@ -35,12 +35,12 @@ import { existsSync, mkdirSync, statSync } from 'node:fs';
 import path from 'node:path';
 
 import { main as driverMain } from './driver.mjs';
-import { makeCfg, PACK_ORDER } from './source.mjs';
+import { GATE_SWITCHES, makeCfg, PACK_ORDER } from './source.mjs';
 import { DEFAULT_PRESET } from '../loop/score.mjs';
 import { opencodeConfigDir, resolvePath } from '../hosts/hosts.mjs';
 import {
   EMIT_HOST_SCOPE, defaultMode, defaultPosture, defaultTheme, doctrinesForBuild,
-  deletionGateOfDir, excludedRulesOfDir, excludedSkillsOfDir, footprintOfDir, installState, installTargets,
+  excludedRulesOfDir, excludedSkillsOfDir, footprintOfDir, gatesOfDir, installState, installTargets,
   legacyProcessCarrierOfDir, modeOfDir, postureOfDir, readMaybe, themeOfDir, trustOfDir,
 } from '../hosts/installs.mjs';
 import { colorThemeFiles, colorThemeJson, PALETTE_ROLES } from '../hosts/opencode.mjs';
@@ -102,8 +102,9 @@ const BUILD_FORWARD = [
 export function cmdBuild(args) {
   const argv = [];
   for (const [key, flag] of BUILD_FORWARD) if (args[key] != null) argv.push(flag, args[key]);
-  // The one bare switch `build` forwards: it takes no value, so it is not a BUILD_FORWARD row.
-  if (args.noDeletionGate) argv.push('--no-deletion-gate');
+  // The bare switches `build` forwards (the gate switches): they take no value, so they are
+  // not BUILD_FORWARD rows.
+  for (const g of GATE_SWITCHES) if (args[g.arg]) argv.push(g.flag);
   return driverMain(argv);
 }
 
@@ -140,7 +141,8 @@ export function cmdBuild(args) {
  */
 export function setupBuildArgs(theme, emit, out = null, root = null, footprint = 'lean',
   posture = 'peer', mode = 'direct', doctrines = null, allPacks = PACK_ORDER,
-  excludeRules = null, trust = DEFAULT_PRESET, excludeSkills = null, deletionGate = true) {
+  excludeRules = null, trust = DEFAULT_PRESET, excludeSkills = null, deletionGate = true,
+  { secretsGate = true, doneGate = true } = {}) {
   const argv = ['--theme', theme, '--emit', emit];
   if (!emit.endsWith('-global')) {
     if (out) argv.push('--out', out);
@@ -168,9 +170,11 @@ export function setupBuildArgs(theme, emit, out = null, root = null, footprint =
   // feeds it), so the flag's absence and `none` are the same answer, and every argv that
   // excludes nothing stays the bytes it was before the flag existed.
   if (excludeSkills?.length) argv.push('--exclude-skills', excludeSkills.join(','));
-  // Law IV's gate elides when armed: the driver's default IS armed (no config key feeds it), so
-  // only an explicit `false` speaks, and every armed argv stays the bytes it was.
-  if (deletionGate === false) argv.push('--no-deletion-gate');
+  // The gate switches elide when armed: the driver's default IS armed (no config key feeds
+  // them), so only an explicit `false` speaks, and every armed argv stays the bytes it was.
+  // Law order, so a Law IV-only install still ends on `--no-deletion-gate` as it did.
+  const gates = { secretsGate, doneGate, deletionGate };
+  for (const g of GATE_SWITCHES) if (gates[g.key] === false) argv.push(g.flag);
   return argv;
 }
 
@@ -229,12 +233,12 @@ export function installProfile(host, scope, root, notify = null) {
   const excludeRules = excludedRulesOfDir(root, host);
   // Skills left out stay left out: an upgrade that forgot them would put them all back.
   const excludeSkills = excludedSkillsOfDir(root, host, notify);
-  // Law IV's gate switch: a rebuild that forgot it would silently re-arm (or, read wrong, disarm)
+  // The gate switches: a rebuild that forgot one would silently re-arm (or, read wrong, disarm)
   // the install. A missing marker reads as armed.
-  const deletionGate = deletionGateOfDir(root, host);
+  const gates = gatesOfDir(root, host);
   const out = scope === 'global' ? null : root;
   const argv = setupBuildArgs(theme, emit, out, out, footprint, posture, mode, doctrines,
-    PACK_ORDER, excludeRules, trust, excludeSkills, deletionGate);
+    PACK_ORDER, excludeRules, trust, excludeSkills, gates.deletionGate, gates);
   // A GLOBAL ROW NAMES ITS OWN DIR. `root` came from the host's config-dir resolver, which
   // honours env overrides (`OPENCODE_CONFIG_DIR`, `CLAUDE_CONFIG_DIR`…); without the flag the
   // same argv run from a shell lacking that variable re-emits into the DEFAULT dir — a second
@@ -243,7 +247,7 @@ export function installProfile(host, scope, root, notify = null) {
   return {
     host, scope, root, state: installState(root, host, scope),
     emit, theme, footprint, posture, mode, trust, doctrines, excludeRules, excludeSkills,
-    deletionGate, argv,
+    ...gates, argv,
   };
 }
 

package/js/build/render.mjs

@@ -34,7 +34,7 @@ import { readText } from '../lib/fs.mjs';
 import { parseJson } from '../lib/json.mjs';
 import { normcase, comparePaths } from '../lib/paths.mjs';
 // `js/build/source.mjs` imports nothing but node builtins, so this direction cannot cycle.
-import { PACK_ORDER, readPackText, resolveRuleIds, ruleCanon } from './source.mjs';
+import { GATE_SWITCHES, PACK_ORDER, readPackText, resolveRuleIds, ruleCanon } from './source.mjs';
 import { DEFAULT_PRESET } from '../loop/score.mjs';
 
 /** Document STRUCTURE is theme-INDEPENDENT — mirrors `_build_render.STRUCTURE`. */
@@ -444,10 +444,12 @@ export function effectiveTheme(cfg, themeName, { footprint = 'full', lawsPrefix
   const skipped = [...(cfg.excludeSkills ?? [])].sort();
   // It fills a template line of its own, so its value carries the blank line around it.
   theme.EXCLUDED_SKILLS_LINE = skipped.length ? `\nExcluded skills: ${skipped.join(', ')}\n` : '';
-  // Law IV's gate switch, under the same contract: written only when OFF, so a default build
-  // stays byte-identical and a missing line reads back as armed (`deletionGateOfDir`). The
-  // OpenCode guard plugin reads this line at load, so its wording is a parsed contract.
-  theme.DELETION_GATE_LINE = cfg.deletionGate === false ? '\nDeletion gate: off' : '';
+  // The gate switches (`GATE_SWITCHES`: Laws I, III, IV), under the same contract: a line is
+  // written only when its gate is OFF, so a default build stays byte-identical and a missing
+  // line reads back as armed (`gatesOfDir`). The OpenCode plugins read these lines at load, so
+  // their wording is a parsed contract.
+  theme.GATE_LINES = GATE_SWITCHES.filter((g) => cfg[g.key] === false)
+    .map((g) => `\n${g.marker}: off`).join('');
   return theme;
 }
 

package/js/build/source.mjs

@@ -399,7 +399,8 @@ export function resolveSkillNames(names, {
  */
 export function makeCfg({
   posture = 'peer', mode = 'direct', trust = DEFAULT_PRESET, doctrines = PACK_ORDER,
-  excludeRules = [], excludeSkills = [], noDeletionGate = false,
+  excludeRules = [], excludeSkills = [], noDeletionGate = false, noSecretsGate = false,
+  noDoneGate = false,
 } = {}) {
   return {
     root: ROOT,
@@ -430,5 +431,22 @@ export function makeCfg({
     // Law IV's deletion gate (`--no-deletion-gate`). Armed unless switched off in so many words:
     // only a literal `true` disarms, so every caller that never heard of the switch keeps it.
     deletionGate: noDeletionGate !== true,
+    // Law I's secret scan (`--no-secrets-gate`) and Law III's done gate (`--no-done-gate`), the
+    // same contract (user decision 2026-10-18; see GATE_SWITCHES).
+    secretsGate: noSecretsGate !== true,
+    doneGate: noDoneGate !== true,
   };
 }
+
+/**
+ * The laws whose hook gate an install can switch off, in law order: the cfg/profile key, the
+ * build flag, the carrier marker (`<marker>: off`, written only when off) and the law. ONE
+ * table, so the flag, the marker, the rebuild argv, the read-back and `status` cannot drift
+ * apart. Every gate is ARMED by default and the law's text binds either way. The deletion row
+ * is #319's, unchanged: existing installs carry its flag and marker.
+ */
+export const GATE_SWITCHES = [
+  { key: 'secretsGate', flag: '--no-secrets-gate', arg: 'noSecretsGate', marker: 'Secrets gate', law: 'I' },
+  { key: 'doneGate', flag: '--no-done-gate', arg: 'noDoneGate', marker: 'Done gate', law: 'III' },
+  { key: 'deletionGate', flag: '--no-deletion-gate', arg: 'noDeletionGate', marker: 'Deletion gate', law: 'IV' },
+];