geneseed 4.8.0 → 4.9.1

package/CHANGELOG.md

@@ -8,6 +8,40 @@ label. For the capability ↔ spec map, see [SHIPPED.md](SHIPPED.md).
 
 ## [Unreleased]
 
+## [4.9.1] — 2026-10-18
+
+Patch: Deletion Is Deliberate and the root-scan check no longer fail open behind shell structure; the console stops re-running the doctor on every change.
+
+### Upgrade notes
+- Run `geneseed rebuild-all` once after updating so installed hooks and OpenCode plugins pick up the fix.
+
+### Fixed
+- **Deletion Is Deliberate and the root-scan check no longer fail open when shell structure hides the program word.** `true & git reset --hard`, `(git reset --hard)`, `if …; then git reset --hard; fi`, `{ rm x; }`, `echo $(rm x)`, `` echo `rm x` ``, `sudo -u root rm x`, `env -u FOO rm x`, `nice -n 5 rm x`, `timeout 5 rm x`, `true & find / …` and `(find / …)` passed where the plain form asks. The `reset --hard` forms had regressed in 4.7.0. Several changes close it, on Claude Code, OpenClaude and Bob (`git-gate`/`tool-gate`) and in the OpenCode guard:
+  - A lone `&` now separates commands. `2>&1`, `<&3`, `&>` and `|&` still do not.
+  - Leading `(`, `{`, `!`, `then`, `do` and `else` are stripped before the program word, and so are closing `)`/`}`.
+  - A command substitution is judged as a command of its own.
+  - Wrappers drop their value-taking flags. `timeout` is now a wrapper.
+  - A removal that names no path asks: `… | Remove-Item`, `ri -Force`.
+  - `find -delete` asks, and `unlink` counts as a removal.
+  - Behind all of these, a removal word written unquoted after a program the gate does not read asks ("could not verify"). That covers a wrapper it does not know (`setsid rm x`), a wrapper flag of unknown arity, `ForEach-Object { Remove-Item $_ }` and `case … rm …`. So does `ssh host rm x`. The exceptions are programs whose `rm` is their own subcommand (npm, pnpm, yarn, bun, cargo, brew, docker, podman) and programs that never run their arguments (echo, printf, the grep family, `which`, `type`, `man`, `Get-Command`, `Get-Help`).
+  - Proven-safe forms still pass: a clean tree, a tracked clean file, a quoted pattern, and a `$(cat <<'EOF' … EOF)` commit message.
+
+### Changed
+- **The console stops re-running the doctor when nothing it checks has changed.** A memory delete no longer drops the cached verdict (~3.6 s saved on the next overview); a finished job, an install toggle and a view switch still do. The Doctor page, the Greenhouse and Operator HUD lenses now read the cached run (groups and themes included) instead of running every check on each visit; the page's *Re-run checks* button asks for a fresh run (`GET /api/doctor?fresh=1`). The server warms the cache right after it starts listening, so an overview requested a few seconds later answers in ~0.15 s rather than ~3.8 s.
+
+## [4.9.0] — 2026-10-18
+
+Minor: on/off switches for the Sealed Secrets and done gates, and the console calls the laws Dictates.
+
+### Added
+- **On/off switches for the Sealed Secrets and Verify Before Asserting gates**, beside Law IV's. `geneseed build --no-secrets-gate` stands down the credential scan (`rule-gate` on Claude Code and OpenClaude, `tool-gate` on Bob, the OpenCode guard's key-file block and content scan); `--no-done-gate` stands down the done check in `learn` on Stop (and OpenCode's reminder), while learning still runs. Both armed by default; the Rule's text still binds. The install records `Secrets gate: off` / `Done gate: off` beside its pack list; rebuilds, upgrades, `status`, `diff`, `validate` and the console keep them. The console's Constitution page now has a toggle column on every Rule: a switch on Rules I, III and IV, *no gate* on the others.
+
+### Upgrade notes
+- The secrets and done gate switches: run `geneseed rebuild-all` before switching either off. While the machine's hook shim points at an older checkout, a disarmed install's `rule-gate`/`tool-gate` refuses the new flag and lets every write through (External Gate and Persist Insight too, and on Bob every check), and its `learn` refuses `--no-done-gate`, so that install stops learning as well. OpenCode reads both switches when it starts: restart it after flipping one.
+
+### Changed
+- **The console calls the laws Dictates**, the name AGENT.md gives them, instead of Invariants: the Laws tab and band, the dashboard KPI tile, the constitution map, Greenhouse and the Operator HUD. Routes and internal keys are unchanged (#321).
+
 ## [4.8.0] — 2026-10-18
 
 Minor: Deletion Is Deliberate asks only on real data loss, and can be switched off per install.

package/SHIPPED.md

@@ -20,7 +20,7 @@ historical references, not files distributed with the repo.
 > **On version numbers.** [`harness.config.json`](harness.config.json)'s `version` is a
 > human-readable label only. The canonical identity of an installed harness is the
 > **source fingerprint** stamped in `.geneseed-version` (see `geneseed version`), not the
-> string. Current label: **4.8.0**.
+> string. Current label: **4.9.1**.
 
 ## Capabilities
 

package/adapters/claude-code/README.md

@@ -20,7 +20,9 @@ absolute-path hooks instead — `geneseed setup` does that for you.) It:
   wired with `--no-consent`: commits and pushes pass without asking, while the
   Law IV refusals (asked only on real data loss: a force-push to `main`, a `reset --hard`
   over uncommitted work, an `rm` git cannot undo) stay in every build unless the install is
-  built `--no-deletion-gate`, which appends that flag and stands the real-loss check down. The hook inspects
+  built `--no-deletion-gate`, which appends that flag and stands the real-loss check down
+  (`--no-secrets-gate` does the same for `rule-gate`'s credential scan, `--no-done-gate` for
+  `learn`'s done check). The hook inspects
   command and, when it runs a `git commit` or `git push` (bare, flagged, `-C <path>`,
   or chained like `git add . && git commit … && git push`), returns
   `permissionDecision: "ask"` so Claude Code **prompts on every such call**. Crucially

package/adapters/opencode/plugins/geneseed-context.js

@@ -895,6 +895,21 @@ const DONE_LIST = ".geneseed/done-checks.txt"
 const DONE_EDIT_TOOLS = new Set(["edit", "write", "patch", "apply_patch", "multiedit"])
 const DONE_SHELL_TOOLS = new Set(["bash", "shell"])
 
+// Law III's gate switch (`--no-done-gate`, user decision 2026-10-18): the build writes
+// `Done gate: off` into the install's AGENT.md only when the gate is off. Read ONCE, at the first
+// use, from the harness dir (a switch flip takes an OpenCode restart); anything unreadable reads
+// as ARMED. Off silences the reminder and the V2 notice, nothing else.
+let doneGateOffOnce = null
+function doneGateOff() {
+  doneGateOffOnce ??= (async () => {
+    const dir = await harnessDir()
+    if (!dir) return false
+    const text = await fs.readFile(path.join(dir, "AGENT.md"), "utf8")
+    return /^Done gate:[ \t]*off[ \t]*\r?$/m.test(text)
+  })().catch(() => false)
+  return doneGateOffOnce
+}
+
 async function readDoneChecks(root) {
   try {
     const text = await fs.readFile(path.join(root, DONE_LIST), "utf8")
@@ -1140,6 +1155,7 @@ export const GeneseedContext = async (ctx) => {
       // INJECT_OFF and the visible delivery leave it on, and no early return below can skip it.
       // Its own function, so its early returns end the reminder, never the context injection.
       await (async () => {
+        if (await doneGateOff()) return
         const checks = await readDoneChecks(root)
         if (!checks.length) return
         const owed = doneOwed(output.messages, checks, root)
@@ -1211,7 +1227,7 @@ async function setupV2(ctx) {
   })
 
   // The done gate is not judged on OpenCode 2 (see `doneOwed`): said once, where its log goes.
-  if ((await readDoneChecks(root).catch(() => [])).length) {
+  if (!(await doneGateOff()) && (await readDoneChecks(root).catch(() => [])).length) {
     console.error(`[geneseed-context] done gate: ${DONE_LIST} found, but OpenCode 2 turns are not judged.`)
   }
 

package/adapters/opencode/plugins/geneseed-guard.js

@@ -124,26 +124,28 @@ const MODE = (process.env.GENESEED_GUARD || "on").toLowerCase()
 const OFF = ["off", "0", "false", "no"].includes(MODE)
 const WARN_ONLY = MODE === "warn"
 
-// Law IV's gate switch (`--no-deletion-gate`, user decision 2026-10-17). The build writes
-// `Deletion gate: off` into the install's AGENT.md only when the gate is off; this reads it ONCE
-// at load, from the same harness dir the context plugin resolves ($GENESEED_HARNESS, else
-// <plugin dir>/.. for a global install, else <plugin dir>/../.. for a project one), so flipping
-// the switch takes an OpenCode restart. Anything unreadable or unexpected reads as ARMED. It
-// stands down only the real-loss check below — catastrophic commands, root scans, secrets and
-// protected checks still block.
-function deletionGateOff() {
+// The gate switches (`--no-deletion-gate` 2026-10-17, `--no-secrets-gate` 2026-10-18, user
+// decisions). The build writes `Deletion gate: off` / `Secrets gate: off` into the install's
+// AGENT.md only when that gate is off; this reads the carrier ONCE at load, from the same
+// harness dir the context plugin resolves ($GENESEED_HARNESS, else <plugin dir>/.. for a global
+// install, else <plugin dir>/../.. for a project one), so flipping a switch takes an OpenCode
+// restart. Anything unreadable or unexpected reads as ARMED. Each stands down only its own check
+// below (the real-loss check; the Sealed Secrets path block and content scan) — catastrophic
+// commands, root scans and protected checks still block.
+function carrierText() {
   try {
     const dirs = [path.resolve(PLUGIN_DIR, ".."), path.resolve(PLUGIN_DIR, "..", "..")]
     if (process.env.GENESEED_HARNESS) dirs.unshift(process.env.GENESEED_HARNESS)
     for (const d of dirs) {
-      let text
-      try { text = readFileSync(path.join(d, "AGENT.md"), "utf8") } catch { continue }
-      return /^Deletion gate:[ \t]*off[ \t]*\r?$/m.test(text)
+      try { return readFileSync(path.join(d, "AGENT.md"), "utf8") } catch { continue }
     }
   } catch { /* fall through: armed */ }
-  return false
+  return ""
 }
-const DELETION_GATE_OFF = deletionGateOff()
+const CARRIER_TEXT = carrierText()
+const gateOff = (marker) => new RegExp(`^${marker}:[ \\t]*off[ \\t]*\\r?$`, "m").test(CARRIER_TEXT)
+const DELETION_GATE_OFF = gateOff("Deletion gate")
+const SECRETS_GATE_OFF = gateOff("Secrets gate")
 
 function log(msg) { console.error(`[geneseed-guard] ${msg}`) }
 
@@ -295,16 +297,31 @@ function stashExists(root) {
  * a superset of what the parse acts on.
  */
 const LOSS_CANDIDATE_RE =
-  /\bgit\b[^\n]*\b(?:reset|clean|branch|checkout|switch|restore|stash|reflog|gc|push)\b|(?:^|[\s;&|("'])(?:rm|rmdir|del|erase|remove-item|ri|rd)(?:\.exe)?(?=[\s;&|)"']|$)/im;
+  /\bgit\b[^\n]*\b(?:reset|clean|branch|checkout|switch|restore|stash|reflog|gc|push)\b|(?:^|[\s;&|("'`])(?:rm|rmdir|unlink|del|erase|remove-item|ri|rd)(?:\.exe)?(?=[\s;&|)"'`]|$)|(?:^|\s)-delete(?=\s|$)/im;
 
 class Unverified extends Error {}
 const unverified = (why) => { throw new Unverified(why); };
 
-const RM_PROGS = new Set(['rm', 'rmdir', 'del', 'erase', 'remove-item', 'ri', 'rd']);
+const RM_PROGS = new Set(['rm', 'rmdir', 'unlink', 'del', 'erase', 'remove-item', 'ri', 'rd']);
 // cmd.exe's own removal verbs take `/s` `/q` switches, which are not paths.
 const CMD_SWITCH_PROGS = new Set(['rmdir', 'del', 'erase', 'rd']);
 const CD_PROGS = new Set(['cd', 'pushd', 'chdir', 'set-location', 'sl']);
-const WRAPPERS = new Set(['sudo', 'doas', 'command', 'builtin', '\\builtin', 'time', 'nice', 'nohup', 'exec', 'env']);
+// A wrapper runs the command after its own flags: `<short flags taking a value>|<short flags taking
+// none>`. A flag in neither list (`env -S` runs a string, `env -C`/`sudo -D` change directory,
+// `command -v` only looks up) is not guessed at — the segment asks if it names a removal.
+const WRAPPERS = new Map([['sudo', 'ughpCUrtT|AbEHiknPSs'], ['doas', 'uC|ns'], ['command', '|p'],
+  ['builtin', '|'], ['\\builtin', '|'], ['time', 'fo|pav'], ['nice', 'n|'], ['nohup', '|'],
+  ['exec', 'a|cl'], ['env', 'u|i0v'], ['timeout', 'sk|v'], ['ionice', 'cn|t'], ['stdbuf', 'ioe|']]);
+const WRAPPER_LONG = new Set(['--preserve-status', '--foreground', '--verbose', '--login', '--preserve-env',
+  '--non-interactive', '--ignore-environment', '--null']);
+// Shell grammar that may stand before the program word (`(cd x && rm y)`, `if …; then rm y; fi`).
+const STRUCTURE = new Set(['(', '((', '{', '!', 'if', 'then', 'elif', 'else', 'do', 'while', 'until']);
+// The only programs this reader does not parse that may still name a removal word and pass: their
+// `rm`/`del` is their own subcommand (a package, a container), or they never run their arguments
+// (a substitution in one is judged on its own). Any other program over a removal word asks.
+const INERT = new Set(['npm', 'pnpm', 'yarn', 'bun', 'cargo', 'brew', 'docker', 'podman', 'echo', 'printf',
+  'grep', 'egrep', 'fgrep', 'rg', 'findstr', 'select-string', 'which', 'where', 'type', 'man', 'get-command',
+  'get-help']);
 // Programs that run ANOTHER command from their arguments or stdin: what they would remove is
 // not on this command line in a form the parse can read, so a removal word inside one asks.
 const INDIRECT = new Set(['bash', 'sh', 'zsh', 'dash', 'ksh', 'fish', 'pwsh', 'powershell', 'cmd',
@@ -669,6 +686,8 @@ function rmAct(prog, args, dir) {
     if (opts && CMD_SWITCH_PROGS.has(prog) && /^\/[a-zA-Z?]$/.test(a)) continue;
     targets.push(a);
   }
+  // `… | Remove-Item`, `ri -Force`: the paths come from the pipe, which this reader cannot see.
+  if (!targets.length) unverified(`\`${prog}\` names no path, so what it removes comes from elsewhere`);
   const groups = new Map();
   for (const t of targets) {
     const shown = t.replace(OPAQUE, '');
@@ -710,6 +729,69 @@ function rmAct(prog, args, dir) {
 /** The program word, stripped of its path and `.exe`, lowercased (PowerShell and cmd are case-blind). */
 const progOf = (w) => w.split(/[\\/]/).pop().toLowerCase().replace(/\.exe$/, '');
 
+/**
+ * A segment's RAW tokens with the shell grammar around its command dropped: leading `(`, `{`,
+ * `!`, `then`, `do`… (a `(` glued to the first word too) and a closing `)`/`}`. Without it
+ * `(git reset --hard)` has `(git` for its program and `--hard)` for its flag. `rootScan`
+ * shares it, so `(find / …)` is a scan.
+ */
+function stripStructure(raw) {
+  const t = raw.slice();
+  while (t.length) {
+    if (STRUCTURE.has(t[0])) t.shift();
+    else if (/^\(+./.test(t[0])) t[0] = t[0].replace(/^\(+/, '');
+    else break;
+  }
+  while (t.length && (t[t.length - 1] === '}' || /^\)+$/.test(t[t.length - 1]))) t.pop();
+  if (t.length) t[t.length - 1] = t[t.length - 1].replace(/\)+$/, '');
+  return t;
+}
+
+/**
+ * The bodies of the command substitutions in `text` (`$(…)`, backticks, `<(…)`, `>(…)`) —
+ * single quotes hide them, double quotes do not. An unclosed one runs to the end of the text:
+ * the splitter already cut an unquoted `$(a; b)` at its `;`.
+ */
+function substitutions(text) {
+  const out = [];
+  let sq = false; let dq = false;
+  for (let i = 0; i < text.length; i++) {
+    const c = text[i];
+    if (sq) { if (c === "'") sq = false; continue; }
+    if (c === "'" && !dq) { sq = true; continue; }
+    if (c === '"') { dq = !dq; continue; }
+    if (c === '`') {
+      const end = text.indexOf('`', i + 1);
+      out.push(text.slice(i + 1, end < 0 ? text.length : end));
+      i = end < 0 ? text.length : end;
+    } else if ('$<>'.includes(c) && text[i + 1] === '(') {
+      let depth = 1; let j = i + 2;
+      for (; j < text.length && depth; j++) depth += text[j] === '(' ? 1 : text[j] === ')' ? -1 : 0;
+      out.push(text.slice(i + 2, depth ? text.length : j - 1));
+      i = j - 1;
+    }
+  }
+  return out;
+}
+
+/** `w` past wrapper `name`'s own flags (and `timeout`'s duration), or null when a flag is unknown. */
+function pastWrapper(name, w) {
+  const [takes, plain] = WRAPPERS.get(name).split('|');
+  let i = 0;
+  for (; i < w.length && w[i].length > 1 && w[i].startsWith('-'); i++) {
+    const a = w[i];
+    if (a === '--') { i += 1; break; }
+    if (a.startsWith('--')) { if (a.includes('=') || WRAPPER_LONG.has(a)) continue; return null; }
+    if (name === 'nice' && /^-\d+$/.test(a)) continue;
+    for (let j = 1; j < a.length; j++) {
+      if (takes.includes(a[j])) { if (j === a.length - 1) i += 1; break; }   // the value: the rest, or the next word
+      if (!plain.includes(a[j])) return null;
+    }
+  }
+  if (name === 'timeout' && /^\d/.test(w[i] || '')) i += 1;
+  return w.slice(i);
+}
+
 /**
  * The verdict for a whole command, given its segments as RAW token arrays (quotes still on —
  * `js/hosts/hooks.mjs` cuts and tokenises with the same lexer `rootScan` uses, so a quoted
@@ -720,19 +802,33 @@ const progOf = (w) => w.split(/[\\/]/).pop().toLowerCase().replace(/\.exe$/, '')
  * each host's ceiling for a crashed gate (docs/adr/0007-gates-fail-closed-per-host-ceiling.md).
  * `always: false` skips the two acts that lose data in every state (`reflog expire`, `gc --prune`)
  * — the OpenCode guard passes it, because a static `permission.bash` glob already asks for those.
+ * `split` cuts a command substitution's body into segments the same way (both callers pass their
+ * splitter); without it, a substitution that names a removal asks.
+ * @param {string[][]} segments
+ * @param {string} cwd
+ * @param {{ always?: boolean, split?: (text: string) => string[][] }} [options]
  */
-function lossReason(segments, cwd, { always = true } = {}) {
-  let dir = cwd;
-  try {
-    for (const raw of segments) {
+function lossReason(segments, cwd, { always = true, split } = {}) {
+  /** The first loss among `segs`, run from `start`; a substitution body is judged as a command. */
+  const judge = (segs, start, depth = 0) => {
+    let dir = start;
+    for (const raw of segs.map(stripStructure)) {
+      const text = raw.join(' ');
+      const named = LOSS_CANDIDATE_RE.test(text);
+      for (const body of named ? substitutions(text) : []) {
+        if (!LOSS_CANDIDATE_RE.test(body)) continue;
+        // Bounded: `$($($(…` nested past any real command would rescan the text once per level.
+        if (!split || depth >= 4) unverified('a command substitution names a removal');
+        const v = judge(split(body), dir, depth + 1);
+        if (v) return v;
+      }
       let w = words(raw);
-      while (w.length && (/^\w+=/.test(w[0]) || WRAPPERS.has(progOf(w[0])))) {
+      while (w && w.length && (/^\w+=/.test(w[0]) || WRAPPERS.has(progOf(w[0])))) {
         const wrapper = progOf(w[0]);
-        w = w.slice(1);
-        // A wrapper's own flags (`sudo -u x`, `env -i`) are not the program.
-        if (wrapper !== 'command' && wrapper !== 'exec') while (w.length && w[0].startsWith('-')) w = w.slice(1);
+        w = /^\w+=/.test(w[0]) ? w.slice(1) : pastWrapper(wrapper, w.slice(1));
+        if (!w && named) unverified(`\`${wrapper}\` takes a flag the gate does not know`);
       }
-      if (!w.length) continue;
+      if (!w || !w.length) continue;
       const prog = progOf(w[0]);
       const args = w.slice(1);
       if (CD_PROGS.has(prog)) {
@@ -745,10 +841,18 @@ function lossReason(segments, cwd, { always = true } = {}) {
       else if (RM_PROGS.has(prog)) verdict = rmAct(prog, args, dir);
       else if (INDIRECT.has(prog) && LOSS_CANDIDATE_RE.test(args.join(' '))) {
         unverified(`\`${prog}\` runs a command the gate cannot read`);
+      } else if (named && !INERT.has(prog)
+        && LOSS_CANDIDATE_RE.test(raw.map((t) => t.replace(/"[^"]*"?|'[^']*'?/g, ' ')).join(' '))) {
+        // A program this reader does not know (a wrapper, a loop, shell syntax) over an unquoted
+        // removal word: it may run it, so it is not proven safe. A quoted word is data.
+        unverified(`\`${w[0].replace(OPAQUE, '')}\` is not a program the gate reads, and a removal follows it`);
       }
       if (verdict) return verdict;
     }
     return null;
+  };
+  try {
+    return judge(segments, cwd);
   } catch (e) {
     if (!(e instanceof Unverified)) throw e;
     return `the gate could not verify what this command would lose (${e.message})`;
@@ -774,9 +878,9 @@ const FS_ROOT_RE = /^(?:\/|\/[a-z]\/?|\/mnt\/[a-z]\/?|[a-z]:[\\/]?)\*?$/i
 const SCAN_WORD_RE = /\b(?:find|du|tree|rg|fd|where\.exe|grep|egrep|ls|dir|get-childitem|gci)\b/i
 const SCAN_TOKEN_RE = /(?:[^\s"']+|"[^"]*"?|'[^']*'?)+/g
 const SCAN_WRAPPERS = new Set(["sudo", "command", "\\builtin", "time", "nice"])
-// A comment (`#` starting a word), a quoted run (its `;`/`|` is data), a separator, or a heredoc
-// opener (never the `<<<` here-string).
-const SCAN_SPLIT_RE = /(?<![^\s;|&(])#[^\n]*|"[^"]*"?|'[^']*'?|\|\||&&|[|;\n]|(?<!<)<<(?!<)(-?)[ \t]*(["']?)([A-Za-z_]\w*)\2/g
+// A comment (`#` starting a word), a quoted run (its `;`/`|` is data), a separator (a lone `&`
+// too, never the one in `2>&1`/`<&3`/`&>`/`|&`), or a heredoc opener (never the `<<<` here-string).
+const SCAN_SPLIT_RE = /(?<![^\s;|&(])#[^\n]*|"[^"]*"?|'[^']*'?|\|\||&&|[|;\n]|(?<![&<>|])&(?![&>])|(?<!<)<<(?!<)(-?)[ \t]*(["']?)([A-Za-z_]\w*)\2/g
 // Cut at separators OUTSIDE quotes and drop every heredoc body (to its TAG line; `<<-` allows
 // tabs): a commit message that names a root scan is data, not a command to block.
 function scanSegments(command) {
@@ -810,7 +914,8 @@ function rootScan(command) {
   if (!SCAN_WORD_RE.test(command)) return null
   for (const seg of scanSegments(command)) {
     // Quotes kept until the root test, so a quoted "a:" is told from a bare C:.
-    let toks = (seg.match(SCAN_TOKEN_RE) || []).filter((t) => !/^\w+=/.test(t))
+    // `(find / …)`, `then find / …`: the grammar around the command is not its program.
+    let toks = stripStructure(seg.match(SCAN_TOKEN_RE) || []).filter((t) => !/^\w+=/.test(t))
     while (toks.length && SCAN_WRAPPERS.has(unquote(toks[0]))) toks = toks.slice(1)
     if (!toks.length) continue
     // The program word without its path (either slash) or an `.exe` suffix.
@@ -1168,7 +1273,7 @@ export const GeneseedGuard = async (ctx) => {
           // blocks the whole call (see `pickPath` for why this is not a single path).
           const paths = pickPath(args, cwd)
           for (const p of paths) {
-            if (SECRET_RE.some((re) => re.test(p))) { await deny(`write to secret/key file ${p} (Sealed Secrets)`, "law-1"); return }
+            if (!SECRETS_GATE_OFF && SECRET_RE.some((re) => re.test(p))) { await deny(`write to secret/key file ${p} (Sealed Secrets)`, "law-1"); return }
             if (SECRET_WARN_RE.some((re) => re.test(p))) log(`WARN: writing ${p} — keep secrets out of tracked files (Sealed Secrets)`)
             const sensor = protectedCheck(p)
             if (sensor) { await deny(`${p} is a protected check (${sensor === DONE_LIST ? "the done gate list itself" : `${sensor}, listed in ${SENSOR_LIST}`}) — a check the agent can edit is not a check (External Gate)`, "rigor-5"); return }
@@ -1185,7 +1290,7 @@ export const GeneseedGuard = async (ctx) => {
           // FILE, not pooled — a patch touching `.env` AND an ordinary file must still catch a
           // secret in the ordinary file; only the hunk whose OWN path is `.env`-shaped is
           // exempt, same as the path WARN tier above.
-          for (const { path: cp, content } of pickAddedContentByPath(args, cwd)) {
+          for (const { path: cp, content } of SECRETS_GATE_OFF ? [] : pickAddedContentByPath(args, cwd)) {
             if (SECRET_WARN_RE.some((re) => re.test(cp))) continue
             if (SECRET_CONTENT_RE.test(content)) {
               await deny(`${cp} would carry a credential-shaped string (Sealed Secrets) — secrets `
@@ -1216,7 +1321,8 @@ export const GeneseedGuard = async (ctx) => {
           if (c && !DELETION_GATE_OFF && LOSS_CANDIDATE_RE.test(c)) {
             // OpenCode's bash tool may run in `workdir`, resolved against the session directory.
             const wd = typeof args.workdir === "string" && args.workdir ? path.resolve(cwd, args.workdir) : cwd
-            const loss = lossReason(scanSegments(c).map((seg) => seg.match(SCAN_TOKEN_RE) || []), wd, { always: false })
+            const cut = (t) => scanSegments(t).map((seg) => seg.match(SCAN_TOKEN_RE) || [])
+            const loss = lossReason(cut(c), wd, { always: false, split: cut })
             if (loss) { await deny(`${loss} (Deletion Is Deliberate) — confirm with the user first`, "law-4"); return }
           }
         }

package/bin/geneseed-hook.mjs

@@ -75,16 +75,21 @@ const VERBS = {
     flags: HOSTED,
     switches: { '--no-consent': 'noConsent', '--no-deletion-gate': 'noDeletionGate' },
   },
-  'rule-gate': { load: gates, fn: 'cmdRuleGate', flags: HOSTED },
+  'rule-gate': {
+    load: gates, fn: 'cmdRuleGate', flags: HOSTED, switches: { '--no-secrets-gate': 'noSecretsGate' },
+  },
   'tool-gate': {
-    load: gates, fn: 'cmdToolGate', flags: HOSTED, switches: { '--no-deletion-gate': 'noDeletionGate' },
+    load: gates,
+    fn: 'cmdToolGate',
+    flags: HOSTED,
+    switches: { '--no-deletion-gate': 'noDeletionGate', '--no-secrets-gate': 'noSecretsGate' },
   },
   learn: {
     load: () => import('../js/hosts/hooks-learn.mjs'),
     fn: 'cmdLearn',
     // `--host` only keys the global stand-down's marker (js/hosts/hosts.mjs); learn has no dialect.
     flags: { '--memory': 'memory', '--host': 'host' },
-    switches: { '--consolidate': 'consolidate' },
+    switches: { '--consolidate': 'consolidate', '--no-done-gate': 'noDoneGate' },
     positional: 'file',
   },
 };
@@ -104,7 +109,7 @@ function die(code, msg) {
 function parse(spec, argv) {
   const args = {
     root: null, host: null, memory: null, consolidate: false, noConsent: false,
-    noDeletionGate: false, file: null,
+    noDeletionGate: false, noSecretsGate: false, noDoneGate: false, file: null,
   };
   for (let i = 0; i < argv.length; i += 1) {
     const tok = argv[i];

package/docs/concepts/enforcement-table.md

@@ -21,12 +21,12 @@ silently guarding the wrong rule after a renumber. See [ADR 0005](../adr/0005-st
 
 | id | Pack | Claude Code | OpenClaude | OpenCode | Bob |
 |---|---|---|---|---|---|
-| `sealed-secrets` | law | ask: rule-gate (credential-shaped content outside `.env*`) | same as Claude Code | block: guard plugin (key/credential file path, or vendor-prefixed secret content); warns only on `.env*` | block (exit 2) |
+| `sealed-secrets` | law | ask: rule-gate (credential-shaped content outside `.env*`). Switchable per install with `--no-secrets-gate` (see [Exclusions](exclusions.md)): this scan stands down on every host, the guard plugin's path block included | same as Claude Code | block: guard plugin (key/credential file path, or vendor-prefixed secret content); warns only on `.env*` | block (exit 2) |
 | `deletion-is-deliberate` | law | ask: git-gate, only on real data loss judged against the repository's state (the list in [Hooks](hooks.md): a protected branch deleted or force-pushed, an unpushed unmerged branch deleted, uncommitted work discarded, a stash dropped, the reflog pruned, files git cannot restore removed); asks when it cannot verify. Switchable per install with `--no-deletion-gate` (see [Exclusions](exclusions.md)): the real-loss check and the Law IV `permission.bash` keys stand down, everything else in this table stays | same as Claude Code | ask: permission prompt (`git reflog expire*`, `git gc --prune*`, a force push or delete of `main`/`master` by name) **+** block: guard plugin (catastrophic shell: `rm -rf /`, fork bomb, `format`, `dd` over a raw disk) **+** block: guard plugin (every other real-loss case, the same state-aware decisions as the hook) | block (exit 2) |
 | `persist-insight` | process | ask: rule-gate (a write to `user-rules.md` or the memory store) | same as Claude Code | ask once: guard plugin (refuses the *first* write to that path; a re-issued write goes through) | log only (warning, call goes through) |
 | `consent-before-push` | process | ask: git-gate (every `git commit`/`git push`). Togglable: build without the process pack, or drop this rule alone with `--exclude-rules` (see [Exclusions](exclusions.md)). Only this question drops; the `deletion-is-deliberate` gate stays. | same as Claude Code | ask: permission prompt (`git commit*`/`git push*`), wired only when the process pack is on; a `loop/*` push is statically allowed | log only |
 | `external-gate` | rigor | ask: rule-gate (a write under a project's `.geneseed/protected-checks.txt` list) | same as Claude Code | block: guard plugin (same list) | block (exit 2) |
-| `verify-before-asserting` | law | block at Stop, once per turn: the done gate in `learn` (a turn that edited files, while a check in the project's `.geneseed/done-checks.txt` has not passed since the last edit). Opt-in per project | same as Claude Code (**unverified live**: a frozen fork, and no check runs a model turn) | remind: context plugin, on the next request (OpenCode 1 only; OpenCode 2 is not judged, and logs so) | not judged: Stop carries no transcript (log line) |
+| `verify-before-asserting` | law | block at Stop, once per turn: the done gate in `learn` (a turn that edited files, while a check in the project's `.geneseed/done-checks.txt` has not passed since the last edit). Opt-in per project; switchable per install with `--no-done-gate` (see [Exclusions](exclusions.md)) | same as Claude Code (**unverified live**: a frozen fork, and no check runs a model turn) | remind: context plugin, on the next request (OpenCode 1 only; OpenCode 2 is not judged, and logs so) | not judged: Stop carries no transcript (log line) |
 | `commands-must-return` | ops | ask: git-gate (a recursive scan rooted at a filesystem root: `find /`, `du`, `grep -r`, `rg`, `Get-ChildItem -Recurse` at `/`, `/c`, `C:\`) | same as Claude Code | block: guard plugin (same root-scan pattern) | block (exit 2) |
 
 Bob has no "ask" tier (see [ADR 0007](../adr/0007-gates-fail-closed-per-host-ceiling.md)), so a

package/docs/concepts/exclusions.md

@@ -7,7 +7,7 @@ section: "Configuration"
 description: "Three ways to switch things off: one rule, one skill, or every hook in a folder."
 link: {"hash": "#/harness", "label": "Manage in Harness →"}
 ---
-Geneseed has three ways to switch something off, and they work at different scales (plus one on/off switch for Law IV's gate, below):
+Geneseed has three ways to switch something off, and they work at different scales (plus an on/off switch for the hook gates of Laws I, III and IV, below):
 
 | | Sovereign repo | Per-rule exclusion | Per-skill exclusion |
 | --- | --- | --- | --- |
@@ -88,3 +88,20 @@ Limits:
 - **A global install beside a project install.** On Claude Code and OpenClaude the global `git-gate` stands down for a project install, so the project's switch decides. Bob's `tool-gate` and the OpenCode guard do not stand down: an armed global install still refuses real loss inside a project whose own install is off.
 - **An existing `opencode.json` keeps its Law IV keys.** Switching off does not remove `permission.bash` entries already written — Geneseed cannot tell its own from yours — so the build warns that it keeps them and they keep asking. Delete them by hand.
 - **An older hook shim silences the whole gate.** The flag is new. While the machine's shared hook shim still points at an older checkout, that checkout refuses the flag and the gate verb lets every call through on a disarmed install — on Claude Code and OpenClaude the root-scan and consent checks too, on Bob also *Sealed Secrets* and *External Gate*. Update the checkout the shim points at (`geneseed rebuild-all`) before switching the gate off.
+
+### Law I secrets gate and Law III done gate — on or off
+
+The same switch, for two more gates. Both are armed by default, and the Rule's text in the carrier still binds the agent with either off.
+
+```bash
+geneseed build --emit claude-global --no-secrets-gate   # Sealed Secrets
+geneseed build --emit claude-global --no-done-gate      # Verify Before Asserting
+```
+
+The console's Constitution page has a switch on Rule I's and Rule III's rows too (*Enforced by* reads **Gate off** while one is off); the other Rules show *no gate*, because only their text enforces them. The install records `Secrets gate: off` / `Done gate: off` beside `Deletion gate:`, written only when off; rebuilds, upgrades and `geneseed status` carry them like Law IV's.
+
+What stops, per host:
+- **`--no-secrets-gate`**: the credential scan of `rule-gate` (Claude Code, OpenClaude) and of `tool-gate` (Bob, which then no longer exits 2 for it), and on OpenCode the guard plugin's *Sealed Secrets* block — both the key/credential file path block and the content scan. *External Gate*, *Persist Insight*, the deletion gate and the root-scan check stay.
+- **`--no-done-gate`**: the done check `learn` runs on Stop (Claude Code, OpenClaude; on Bob, the "turn not judged" log line), and on OpenCode the context plugin's reminder (OpenCode 1) and its one-line notice (OpenCode 2). Learning itself still runs, and `.geneseed/done-checks.txt` stays protected by *External Gate*.
+
+Limits: OpenCode reads both switches from the install's `AGENT.md` when it starts, so restart it after flipping one. A global install beside a project install: `rule-gate` and Bob's `tool-gate` do not stand down for a project install on any host, and neither does the OpenCode guard, so an armed global install still asks about (or blocks) a credential write inside a project whose own install has the secrets gate off. `learn` does stand down on Claude Code and OpenClaude, so there the project's done gate switch decides. And the older-shim limit above is sharper for the done gate: its flag rides on `learn`, so while the shim points at an older checkout an install with the done gate off **loses learning too**, not only the gate. Run `geneseed rebuild-all` before switching either gate off.

package/docs/concepts/hooks.md

@@ -42,13 +42,13 @@ Geneseed writes its hooks into the host's settings file. Every hook calls one pr
 - Any other command passes untouched.
 
 **rule-gate.** Runs before every file write.
-- Content that looks like a credential (a cloud access key, a GitHub or Anthropic token, a Slack token, a private-key block) going into any file other than `.env*` gets a prompt citing *Sealed Secrets*.
+- Content that looks like a credential (a cloud access key, a GitHub or Anthropic token, a Slack token, a private-key block) going into any file other than `.env*` gets a prompt citing *Sealed Secrets*. An install built `--no-secrets-gate` wires the hook with that flag and this check alone stands down ([Exclusions](exclusions.md)).
 - A write to `user-rules.md`, `MEMORY.md` or a file in the install's `memory/` gets a prompt citing *Persist Insight*: whether something is a standing rule or a fact to remember is your call, settled through the `rule` [skill](skills.md).
 - A write to a check the project protects gets a prompt citing *External Gate* (on Bob, it is blocked). A project opts in with `.geneseed/protected-checks.txt` at its git root: one repo-relative file or folder per line, `#` for comments — the checks and tests the agent is judged by. A check the agent can edit is not a check. The list protects itself. Only file-write tools are seen: a shell `sed -i` or redirect is not, so run the same checks in CI as the boundary that holds.
 - A write to `.geneseed/done-checks.txt`, the done gate's own list (below), gets the same *External Gate* prompt: emptying it would disarm the gate.
 - Ordinary edits pass untouched.
 
-**The done gate.** Runs when a turn ends, inside `learn` and before it calls any model. A project opts in with `.geneseed/done-checks.txt` at its git root: one command per line, `#` for comments — the checks that prove the work, for example `npm run lint` and `node --test`. If the turn edited a file under that root and a listed check has not passed since the last edit, the turn does not end: the agent is told which checks are owed, citing *Verify Before Asserting*. A check counts when it ran as a shell command, unpiped (`npm test | tail` exits with `tail`'s code, so it proves nothing), and its result was not an error. The gate never runs a check itself. It blocks at most once per turn; the second stop ends the turn and leaves a line in the gate ledger. Only file-write tools count as edits: a shell `sed -i` or redirect is not seen. Without the file, nothing changes. On OpenCode the gate is a reminder on the next request (OpenCode 1 only); on Bob, whose Stop carries no transcript, the turn is not judged and a log line says so.
+**The done gate.** Runs when a turn ends, inside `learn` and before it calls any model. A project opts in with `.geneseed/done-checks.txt` at its git root: one command per line, `#` for comments — the checks that prove the work, for example `npm run lint` and `node --test`. If the turn edited a file under that root and a listed check has not passed since the last edit, the turn does not end: the agent is told which checks are owed, citing *Verify Before Asserting*. A check counts when it ran as a shell command, unpiped (`npm test | tail` exits with `tail`'s code, so it proves nothing), and its result was not an error. The gate never runs a check itself. It blocks at most once per turn; the second stop ends the turn and leaves a line in the gate ledger. Only file-write tools count as edits: a shell `sed -i` or redirect is not seen. Without the file, nothing changes. On OpenCode the gate is a reminder on the next request (OpenCode 1 only); on Bob, whose Stop carries no transcript, the turn is not judged and a log line says so. An install built `--no-done-gate` wires `learn` with that flag: the check is skipped, learning still runs ([Exclusions](exclusions.md)).
 
 **learn.** Takes the tail of the transcript and asks a model to distil what is worth keeping into one-fact-per-file entries under `memory/`. It is shown the facts already stored, so it updates one with the merged text rather than writing a twin (the old version is kept in `memory/archive/`), and moves one the session proved obsolete into `memory/archive/`. It needs `GENESEED_LLM` set to a model command, for example:
 

package/docs/reference/plugin-context.md

@@ -17,7 +17,7 @@ One of the [OpenCode plugins](opencode-plugins.md). Its switches are also listed
 
 **When it runs.** On every request: the context rides invisibly in the request's message list, so it also survives compaction. If your OpenCode build lacks that (experimental) hook, the plugin notices and falls back to one visible message at session start, re-pushed when the session compacts.
 
-**The done gate's reminder.** In a project with `.geneseed/done-checks.txt` (see [Hooks](../concepts/hooks.md)), a request that follows a turn which edited files without every listed check passing since gets one more invisible message naming the checks owed. OpenCode has no turn-end event a plugin can block on, so this is a reminder, not a block. OpenCode 1 only: on OpenCode 2 the turn is not judged, and the plugin logs that once. `GENESEED_CONTEXT_INJECT=off` does not turn it off; removing the file does.
+**The done gate's reminder.** In a project with `.geneseed/done-checks.txt` (see [Hooks](../concepts/hooks.md)), a request that follows a turn which edited files without every listed check passing since gets one more invisible message naming the checks owed. OpenCode has no turn-end event a plugin can block on, so this is a reminder, not a block. OpenCode 1 only: on OpenCode 2 the turn is not judged, and the plugin logs that once. `GENESEED_CONTEXT_INJECT=off` does not turn it off; removing the file does, and so does an install built `--no-done-gate` (`Done gate: off` in its `AGENT.md`, read once when OpenCode starts), which also silences the OpenCode 2 log line.
 
 **What you see.** Normally nothing — the context is there, but not shown. With the visible fallback, a `PROJECT CONTEXT` block at the top of the session.
 

package/docs/reference/plugin-guard.md

@@ -10,7 +10,7 @@ One of the [OpenCode plugins](opencode-plugins.md). [Environment variables](envi
 
 **What it does.** Enforces the safety rules at the tool boundary — before a tool call runs, not after. High-confidence patterns only, so legitimate work is not caught.
 
-- **Blocks** writes to private-key and credential files (*Sealed Secrets*), catastrophic shell commands such as deleting the filesystem root and every command that would really lose data — a protected branch deleted or force-pushed, an unpushed unmerged branch deleted, a protected branch force-moved off commits nothing else holds, uncommitted work discarded, a stash dropped, files git cannot restore removed — judged against the repository's state, the same decisions the Claude/Bob hook makes (*Deletion Is Deliberate*; `reflog expire` and `gc --prune` are left to the `permission.bash` ask; an install built `--no-deletion-gate` carries `Deletion gate: off` in its `AGENT.md`, which the plugin reads once at load and then stops blocking real loss — catastrophic commands still block), a recursive scan rooted at a whole filesystem such as `find /` (*Commands Must Return* — search a specific directory instead), and any change — write, move, rename, delete — under a wiki folder declared `protected` in `geneseed-wiki.jsonc`, and writes to a check listed in the project's `.geneseed/protected-checks.txt` (*External Gate* — see [Hooks](../concepts/hooks.md)).
+- **Blocks** writes to private-key and credential files and writes whose content carries a credential (*Sealed Secrets*; an install built `--no-secrets-gate` carries `Secrets gate: off` in its `AGENT.md`, read once at load, and both stop blocking), catastrophic shell commands such as deleting the filesystem root and every command that would really lose data — a protected branch deleted or force-pushed, an unpushed unmerged branch deleted, a protected branch force-moved off commits nothing else holds, uncommitted work discarded, a stash dropped, files git cannot restore removed — judged against the repository's state, the same decisions the Claude/Bob hook makes (*Deletion Is Deliberate*; `reflog expire` and `gc --prune` are left to the `permission.bash` ask; an install built `--no-deletion-gate` carries `Deletion gate: off` in its `AGENT.md`, which the plugin reads once at load and then stops blocking real loss — catastrophic commands still block), a recursive scan rooted at a whole filesystem such as `find /` (*Commands Must Return* — search a specific directory instead), and any change — write, move, rename, delete — under a wiki folder declared `protected` in `geneseed-wiki.jsonc`, and writes to a check listed in the project's `.geneseed/protected-checks.txt` (*External Gate* — see [Hooks](../concepts/hooks.md)).
 - **Warns** (logged, allowed) on `.env` writes.
 - **Speed-bumps** the *first* write to `user-rules.md` or a memory file: it is refused once, naming *Persist Insight* — whether something is a standing rule or a fact to remember is your call, settled through the `rule` skill. The re-issued write goes through.
 

package/docs/reference/troubleshoot-doctor.md

@@ -43,7 +43,8 @@ These come only from `geneseed doctor --probe`. It runs each installed gate exac
 settings spell it, through the host's own shell, on `git reflog expire --expire=now --all` (which must be refused)
 and `git status` (which must go through). A gate wired with `--no-deletion-gate` lets the first one
 through by design, so it is probed on `find / -name geneseed-probe` instead — a root-wide scan it
-must still refuse. An OpenCode install's guard plugin has no command to
+must still refuse. `--no-secrets-gate` and `--no-done-gate` change nothing here: neither judges a
+shell command. An OpenCode install's guard plugin has no command to
 run: the probe imports it and calls its hook through both plugin APIs (V1 and V2), with `rm -rf /`
 as the call it must refuse. `GENESEED_GUARD=off` or `warn` in your terminal makes that a note,
 not a failure.

package/docs/web-ui.md

@@ -77,8 +77,8 @@ streams the output of background jobs and keeps their history across reloads.
   **Operator** (a searchable table of every deployed capability). Headlines reflect the
   active theme's voice.
 
-  The KPI band reads **Agents · Skills · Invariants · Local edits**. That third tile is
-  labelled *Invariants* and not *Constitution* on purpose: its value is the invariant count
+  The KPI band reads **Agents · Skills · Dictates · Local edits**. That third tile is
+  labelled *Dictates* (the name AGENT.md gives the laws) and not *Constitution* on purpose: its value is the law count
   alone, and calling it the constitution would under-report the ontology and the doctrine
   packs. The two Status *layouts* that have room for it add the missing half: Greenhouse
   puts an active-packs fraction under the tile (`3/4 packs · N rules`), and the Operator HUD
@@ -95,12 +95,13 @@ streams the output of background jobs and keeps their history across reloads.
   content the page last read — if an agent session edited the file meanwhile, the save
   409s and the page reloads instead of clobbering it.
 - **Constitution** (`#/laws`) — the whole governance surface on one page, in three bands:
-  the **Ethos** (four prose sections), the **Invariants** (the nine numbered Rules, with
+  the **Ethos** (four prose sections), the **Dictates** (the nine numbered Rules, with
   a class facet — only non-empty classes render, and two of the six have had no invariant
   since the split), and the **Doctrines** (one group per pack, each marked active or not for
-  this install). Rule IV carries one switch of its own, the install's deletion gate
-  (`--no-deletion-gate`; *Enforced by* reads *Gate off* while it is off) — flipping it asks,
-  then rebuilds the install once. Every row expands to its full body, lazily fetched. The rail entry is
+  this install). Rules I, III and IV each carry a switch for the install's hook gate — the
+  secrets gate, the done gate and the deletion gate (`--no-secrets-gate`, `--no-done-gate`,
+  `--no-deletion-gate`; *Enforced by* reads *Gate off* while one is off) — flipping one asks,
+  then rebuilds the install once; the other Rules read *no gate*. Every row expands to its full body, lazily fetched. The rail entry is
   labelled *Constitution* while the route, the id and the badge key stay `laws`; deep links
   are `#/item/law/ont:telos`, `#/item/law/IV` and `#/item/law/process.5` — three address
   shapes that cannot collide, because a slug carries a colon no numeral has and a doctrine
@@ -164,8 +165,9 @@ streams the output of background jobs and keeps their history across reloads.
   added / missing files with per-file expansion and coloured unified-diff lines. Select
   files to **export an `improvements.md`** back-port, or **restore** them to source.
 - **Doctor** (`#/doctor`) — runs the same health engine as the `doctor` command (every
-  theme, parity, links, authoring gates, drift), grouping any problems per check. Re-run
-  on demand.
+  theme, parity, links, authoring gates, drift), grouping any problems per check. It shows
+  the server's last run — warmed at start, redone after a job, an install toggle or a view
+  switch — and **Re-run checks** runs every check again on demand.
 
 ### 🎨 Setup
 

package/harness.config.json

@@ -2,5 +2,5 @@
   "_comment": "version is a human-readable release label only; the canonical identity of an installed harness is the source fingerprint stamped in .geneseed-version (see `harness version`), not this string.",
   "theme": "neutral",
   "product": "Geneseed",
-  "version": "4.8.0"
+  "version": "4.9.1"
 }

package/js/build/args.mjs

@@ -104,6 +104,8 @@ const FLAGS = {
   // Law IV's gate switch. No `harness.config.json` key feeds it, deliberately: a rebuild elides
   // the flag when armed, so a config default could disarm an armed install on its next upgrade.
   '--no-deletion-gate': 'noDeletionGate',
+  // Laws I and III, the same contract (`GATE_SWITCHES` in source.mjs).
+  '--no-secrets-gate': 'noSecretsGate', '--no-done-gate': 'noDoneGate',
   '-v': 'verbose', '--verbose': 'verbose',
 };
 
@@ -312,6 +314,7 @@ export function parseArgs(argv, defaults) {
     excludeSkills: defaults.excludeSkills ?? [],
     out: 'Harness', emit: 'files', footprint: 'lean', root: null,
     syncThemes: false, validateOnly: false, verbose: false, noDeletionGate: false,
+    noSecretsGate: false, noDoneGate: false,
   };
   const { tokens } = nodeParseArgs({
     args: argv, options: PARSE_OPTIONS, allowPositionals: true, strict: false, tokens: true,