geneseed 4.9.3 → 4.10.0

package/js/hosts/installs.mjs

@@ -36,7 +36,7 @@ import { existsSync, readdirSync } from 'node:fs';
 import path from 'node:path';
 
 import {
-  CONFIG, GATE_SWITCHES, PACK_ORDER, THEMES, discoverNames, resolveSkillNames,
+  CONFIG, GATE_SWITCHES, PACK_ORDER, RETIRED_KIT_IDS, THEMES, discoverNames, loadKits, resolveSkillNames,
 } from '../build/source.mjs';
 import {
   CLAUDE_STYLE, DISABLED_STASH, GLOBAL_MANIFEST, HOSTS, isHostGlobalDir, liveRecordedHooks,
@@ -585,6 +585,33 @@ export function excludedSkillsOfDir(d, host = null, notify = null) {
   }, [], host);
 }
 
+/** `Active kits: spring-boot` — written only when a kit is on; the skills line's shape. */
+const KITS_RE = /^Active kits:[ \t]*(.+?)[ \t]*$/m;
+
+/**
+ * The kits a DEPLOYED install has on, read back so `rebuild-all`, `upgrade`, `migrate`, `diff`, the wizard
+ * and the console re-render them (spec A3). A missing line is `[]`: no kits, the old install's
+ * state. Unlike `excludedSkillsOfDir`, a name this checkout does not ship drops ALONE, with a
+ * notice (spec R2): a retired kit must never reach `--kits`, which refuses it and would fail the
+ * whole `rebuild-all`, and the kits beside it are still the owner's choice. Silent without `notify`.
+ */
+export function kitsOfDir(d, host = null, notify = null) {
+  return firstCarrier(d, (carrierPath) => {
+    const text = readMaybe(carrierPath);
+    if (text === null) return undefined;
+    const m = KITS_RE.exec(text);
+    if (!m) return undefined;
+    const known = loadKits();
+    const names = [...new Set(m[1].split(',').map((s) => s.trim()).filter(Boolean))].sort();
+    for (const k of names.filter((n) => !known.has(n))) {
+      notify?.(Object.hasOwn(RETIRED_KIT_IDS, k)
+        ? `kit '${k}' was retired (${RETIRED_KIT_IDS[k]}) — dropped`
+        : `kit '${k}' is not shipped by this Geneseed — dropped`);
+    }
+    return names.filter((n) => known.has(n));
+  }, [], host);
+}
+
 /**
  * Whether a DEPLOYED install keeps one law's hook gate armed — `true` (armed) or `false` (its
  * `<marker>: off` line, written by a build with that gate's `--no-*-gate` flag; `GATE_SWITCHES`).
@@ -861,7 +888,7 @@ export function installsReferencingShim(shimPath = hookShimPath(), targets = ins
 export function installedDefaults() {
   const found = {
     theme: null, posture: null, mode: null, emit: null, footprint: null, doctrines: null,
-    excludeRules: null, excludeSkills: null,
+    excludeRules: null, excludeSkills: null, kits: null,
   };
   const candidates = [];
   for (const { host, configDir } of HOSTS) {
@@ -904,6 +931,12 @@ export function installedDefaults() {
     // indistinguishable here, which is exactly what the marker itself already says.
     if (!found.excludeRules?.length) found.excludeRules = excludedRulesOfDir(base);
     if (!found.excludeSkills?.length) found.excludeSkills = excludedSkillsOfDir(base);
+    // Kits walk the same two-state way: no line and `none` both read `[]`.
+    // A broken manifest must not crash the wizard here: the build that follows still fails loudly
+    // in `loadKits`. Not guarded inside `kitsOfDir`, which rebuild-all must keep failing on.
+    if (!found.kits?.length) {
+      try { found.kits = kitsOfDir(base); } catch { found.kits = []; }
+    }
   }
   return found;
 }

package/js/hosts/loss.mjs

@@ -10,7 +10,9 @@
  *   - a protected branch (`main`, `master`, a remote's default) deleted or force-pushed, local
  *     or remote;
  *   - `branch -D x` while x carries a commit no remote ref and no HEAD reaches;
- *   - uncommitted work discarded (`reset --hard`, `checkout -f`/`-- <paths>`, `switch -f`/
+ *   - `reset --hard <target>` abandoning commits HEAD reaches and neither <target> nor a remote
+ *     does — the uncommitted work it discards passes (user decision, 2026-10-18);
+ *   - uncommitted work discarded (`checkout -f`/`-- <paths>`, `switch -f`/
  *     `--discard-changes`, `restore` beyond `--staged` alone, `clean -f`) — and only when the
  *     tree actually holds such work (for `clean`, what `git clean -n` says it would remove);
  *   - only where a protected branch is concerned (user ruling, 2026-10-17): `checkout <paths>`
@@ -332,6 +334,25 @@ function branchAct(rest, dir) {
   return null;
 }
 
+/**
+ * `git reset --hard [<target>]` — asks only when it would abandon COMMITS: one HEAD reaches that
+ * neither `<target>` nor any remote ref does. The uncommitted work it discards passes: what is in
+ * progress may break, what exists must be protected (user decision, 2026-10-18). No target is
+ * HEAD itself, which abandons nothing.
+ */
+function resetHardAct(rest, dir) {
+  const dd = rest.indexOf('--');
+  const target = (dd < 0 ? rest : rest.slice(0, dd)).find((a) => !a.startsWith('-'));
+  if (target === undefined) return null;
+  if (target.includes(OPAQUE)) unverified(`the target \`${target.replace(OPAQUE, '')}\` expands in the shell`);
+  repoRoot(dir);
+  const t = git(dir, ['rev-parse', '-q', '--verify', `${target}^{commit}`]);
+  if (t.status !== 0) unverified(`cannot resolve ${target} to a commit`);
+  const r = git(dir, ['rev-list', '-n1', 'HEAD', '--not', t.stdout.trim(), '--remotes']);
+  if (r.status !== 0) unverified(`cannot compare HEAD with ${target}: ${firstLine(r.stderr)}`);
+  return r.stdout.trim() ? `\`git reset --hard ${target}\` would abandon commits no remote and not ${target} holds` : null;
+}
+
 /** `git clean` — forced, it asks when `git clean -n` with the same selection lists anything. */
 function cleanAct(rest, dir) {
   const forced = rest.some((a) => a === '--force' || hasShort(a, 'f'));
@@ -373,7 +394,7 @@ function gitAct(args, dir, always) {
   const act = () => {
     switch (verb) {
       case 'reset':
-        return rest.includes('--hard') ? dirty(d, [], '`git reset --hard`') : null;
+        return rest.includes('--hard') ? resetHardAct(rest, d) : null;
       case 'checkout': {
         const forced = rest.some((a) => a === '--force' || hasShort(a, 'f')) && dirty(d, [], '`git checkout --force`');
         if (forced) return forced;

package/js/hosts/native.mjs

@@ -579,7 +579,7 @@ export function writeNativeLayer(items, agentsDir, skillsDir, overrides = null,
   let nAgents = 0;
   let nSkills = 0;
   const written = [];
-  const sideFiles = [];            // [stem, dest, text], written after the loop
+  const sideFiles = [];            // [stem, dest, text, source], written after the loop
   const claimedSkills = new Set(); // stems whose own SKILL.md claim held
   const userOnlySkills = [];       // claimed stems carrying the user-only marker
 
@@ -589,7 +589,13 @@ export function writeNativeLayer(items, agentsDir, skillsDir, overrides = null,
     written.push(dest);
   };
 
-  for (const { text, src: source } of items) {
+  for (const { text, src: source, rel, licenceOf } of items) {
+    // A credited skill's upstream licence: copied verbatim beside its SKILL.md, held like a side
+    // file until that claim holds. Routed by `licenceOf`, since `source` is the upstream's file.
+    if (licenceOf) {
+      sideFiles.push([licenceOf, path.join(skillsDir, licenceOf, path.posix.basename(rel)), null, source]);
+      continue;
+    }
     const sparts = relPosix(src, source).split('/');
 
     // Vendored third-party skill folders ride along verbatim, preserving their own
@@ -706,8 +712,12 @@ export function writeNativeLayer(items, agentsDir, skillsDir, overrides = null,
     if (kind === 'agent') nAgents += 1;
     else nSkills += 1;
   }
-  for (const [stem, dest, text] of sideFiles) {
-    if (claimedSkills.has(stem) && claim(dest)) write(dest, stripSkillBodyLinks(text));
+  for (const [stem, dest, text, source] of sideFiles) {
+    if (!claimedSkills.has(stem) || !claim(dest)) continue;
+    if (text !== null) { write(dest, stripSkillBodyLinks(text)); continue; }
+    mkdirSync(path.dirname(dest), { recursive: true });
+    copyFile(source, dest);
+    written.push(dest);
   }
   return { nAgents, nSkills, written, userOnlySkills };
 }

package/js/inspect/checks-authoring.mjs

@@ -21,11 +21,11 @@ import { blankCodeSpans } from '../lib/text.mjs';
 import { which } from '../lib/paths.mjs';
 import { NO_WINDOW } from '../lib/proc.mjs';
 import {
-  aliasProblems, folderSkillProblems, registryProblems, secretProblems, sideFileProblems,
+  aliasProblems, creditProblems, folderSkillProblems, registryProblems, secretProblems, sideFileProblems,
   vendorPinProblems,
 } from './checks-repo.mjs';
 import { constitutionProblems, leanBlockProblems } from './checks-constitution.mjs';
-import { countTableProblems } from './checks-counts.mjs';
+import { countTableProblems, kitProblems } from './checks-counts.mjs';
 import { catalogProblems } from '../loop/catalog.mjs';
 import { globSorted, isDir, isFile, rglob } from './scan.mjs';
 import { spawnSync } from 'node:child_process';
@@ -55,6 +55,7 @@ const ALLOWED_COMMENT_RES = [
   // js/web/docs.mjs HARNESS_OPEN_RE: `harness:` then one or more of its four ids, comma-separated.
   new RegExp(`^harness:\\s*(?:${HARNESS_IDS})(?:\\s*,\\s*(?:${HARNESS_IDS}))*$`),
   /^bash:\s*allow$/,                         // js/hosts/native.mjs BASH_MARKER
+  /^banned: ok$/,                            // checks-counts.mjs kitProblems: a kit line that names a banned string
 ];
 
 /**
@@ -114,7 +115,7 @@ export function authorNoteProblems(src = SRC) {
 export {
   HOOK_PINNED, constitutionProblems, doctrineMetaProblems, lawMetaProblems, leanBlockProblems,
 } from './checks-constitution.mjs';
-export { countTableProblems, proseMirrorProblems } from './checks-counts.mjs';
+export { countTableProblems, kitProblems, proseMirrorProblems } from './checks-counts.mjs';
 
 /**
  * The shipped loop catalogue parses and every shipped template passes the engine's own graph
@@ -192,10 +193,12 @@ export function authoringProblems() {
   problems.push(...vendorPinProblems());
   problems.push(...folderSkillProblems());
   problems.push(...aliasProblems());
+  problems.push(...creditProblems());
   problems.push(...sideFileProblems());
   problems.push(...constitutionProblems());
   problems.push(...leanBlockProblems());
   problems.push(...countTableProblems());
+  problems.push(...kitProblems());
   problems.push(...authorNoteProblems());
   return problems;
 }

package/js/inspect/checks-build.mjs

@@ -9,7 +9,7 @@
 import path from 'node:path';
 import { stripCapabilityLinks } from '../build/emit-common.mjs';
 import { STRUCTURE, renderAll } from '../build/render.mjs';
-import { CONFIG, makeCfg } from '../build/source.mjs';
+import { CONFIG, CREDIT_RE, makeCfg } from '../build/source.mjs';
 import { hostCatalogsNatively, resolvePath } from '../hosts/hosts.mjs';
 import { EMIT_HOST_SCOPE, footprintOfDir, themeFiles } from '../hosts/installs.mjs';
 import { isVendoredPath } from '../hosts/native.mjs';
@@ -80,6 +80,12 @@ export function checkBuild(themeName, out, isVendored = isVendoredPath) {
     for (const tok of sortedUnique(text.match(TOKEN_RE) ?? [])) {
       problems.push(`[${themeName}] unresolved token ${tok} in ${rel}`);
     }
+    // `TOKEN_RE` cannot see a credit (colon, lowercase key): one left standing names no upstream.
+    if (text.includes('{{CREDIT:')) {
+      for (const tok of sortedUnique(text.match(CREDIT_RE) ?? ['{{CREDIT:'])) {
+        problems.push(`[${themeName}] unresolved token ${tok} in ${rel}`);
+      }
+    }
     for (const p of linkProblems(md, text, outAbs, rel)) problems.push(`[${themeName}] ${p}`);
     for (const p of descriptionProblems(text, rel)) problems.push(`[${themeName}] ${p}`);
   }

package/js/inspect/checks-counts.mjs

@@ -7,7 +7,10 @@
  * is the reader that feeds it.
  */
 import path from 'node:path';
-import { DOCS, DOC_FOLDERS, PLUGIN_SRC, ROOT, SRC, ruleCanon } from '../build/source.mjs';
+import {
+  DOCS, DOC_FOLDERS, PLUGIN_SRC, RETIRED_KIT_IDS, ROOT, SRC, kitMembers, loadKits, makeCfg, ruleCanon, specLinks, upstreams,
+} from '../build/source.mjs';
+import { effectiveTheme, renderFile } from '../build/render.mjs';
 import { themeFiles } from '../hosts/installs.mjs';
 import { readText } from '../lib/fs.mjs';
 import { formatRepr } from '../lib/json.mjs';
@@ -25,7 +28,7 @@ import { existsSync, readdirSync } from 'node:fs';
  * so they drift silently — they already had. Pure over its inputs, so the corpus can feed it
  * crafted drift without touching the tree.
  */
-export function proseMirrorProblems(readme, web, counts, skillStems, shipped = '') {
+export function proseMirrorProblems(readme, web, counts, skillStems, shipped = '', upstreamKeys = undefined) {
   const problems = [];
   const { laws, agents, skills, plugins } = counts;
 
@@ -68,6 +71,32 @@ export function proseMirrorProblems(readme, web, counts, skillStems, shipped = '
     }
   }
 
+  // The README Credits section names EXACTLY the `src/upstreams.json` keys, both directions,
+  // as the skills row does. A missing section is a problem, or deleting it would turn the gate
+  // green. `upstreamKeys` is optional, like `plugins`, because the corpus predates it.
+  if (upstreamKeys !== undefined) {
+    const lines = readme.split('\n').map((ln) => ln.replace(/\r$/, ''));
+    const at = lines.findIndex((ln) => ln.trim() === '## 🙏 Credits');
+    if (at < 0) {
+      problems.push("[authoring] README has no '## 🙏 Credits' section — src/upstreams.json has "
+        + `${upstreamKeys.length} upstreams to credit`);
+    } else {
+      const end = lines.findIndex((ln, i) => i > at && ln.startsWith('## '));
+      const listed = new Set();
+      for (const ln of lines.slice(at + 1, end < 0 ? undefined : end).filter((l) => l.startsWith('- '))) {
+        const k = /^- `([^`]+)`/.exec(ln);
+        if (k) listed.add(k[1]);
+        else problems.push(`[authoring] README Credits bullet names no upstream key in backticks: '${ln}'`);
+      }
+      for (const key of [...upstreamKeys].filter((k) => !listed.has(k)).sort()) {
+        problems.push(`[authoring] README Credits omits upstream '${key}' (src/upstreams.json)`);
+      }
+      for (const key of [...listed].filter((k) => !upstreamKeys.includes(k)).sort()) {
+        problems.push(`[authoring] README Credits names '${key}', which src/upstreams.json does not define`);
+      }
+    }
+  }
+
   for (const m of web.matchAll(/(\d+) universal (?:laws|Rules)/g)) {
     if (Number(m[1]) !== laws) {
       problems.push(`[authoring] docs/ prose says '${m[1]} universal laws/Rules' but `
@@ -127,8 +156,13 @@ export function countTableProblems() {
     return [`[authoring] AGENT.md.tmpl unreadable: ${e.message}`];
   }
 
+  // A kit member's row lives in its kit's manifest, not the template (spec A6). A manifest that
+  // does not parse is `kitProblems`' to name; here it means no kit rows.
+  let kits;
+  try { kits = loadKits(); } catch { kits = new Map(); }
+  const kitRows = [...kits.values()].flatMap((m) => [...(m.catalogue?.skills ?? []), ...(m.catalogue?.agents ?? [])]);
   const linked = { agents: new Set(), skills: new Set() };
-  for (const m of ttext.matchAll(TMPL_SPEC_RE)) {
+  for (const m of [ttext, ...kitRows].join('\n').matchAll(TMPL_SPEC_RE)) {
     if (m[2] !== '_template') linked[m[1] === 'AGENTS' ? 'agents' : 'skills'].add(m[2]);
   }
   for (const folder of ['agents', 'skills']) {
@@ -173,11 +207,14 @@ export function countTableProblems() {
   // the SHIPPED.md triple count it. It is added HERE rather than in `srcStems`, whose other
   // readers above — the AGENT.md table links and SKILL_CLASS — are about flat specs only.
   const skillsDir = path.join(SRC, 'skills');
+  // Core only: a kit is off by default, so its members are in no badge, README list or SHIPPED triple.
+  const members = kitMembers(kits);
   const shippedSkills = new Set([...skillFiles, ...(isDir(skillsDir) ? readdirSync(skillsDir) : [])
-    .filter((d) => !d.startsWith('_') && isFile(path.join(skillsDir, d, 'SKILL.md')))]);
+    .filter((d) => !d.startsWith('_') && isFile(path.join(skillsDir, d, 'SKILL.md')))]
+    .filter((s) => !members.skills.has(s)));
 
   const counts = {
-    agents: srcStems('agents').size,
+    agents: [...srcStems('agents')].filter((a) => !members.agents.has(a)).length,
     skills: shippedSkills.size,
     laws: lawNums.length,
     // Every doctrine rule in every pack, opt-in ones included: the laws badge alone told a
@@ -242,6 +279,116 @@ export function countTableProblems() {
     problems.push('[authoring] SHIPPED.md carries no \'N laws, N agents, N skills\' line — '
       + 'deleting it is how that gate goes green while the count drifts');
   }
-  problems.push(...proseMirrorProblems(readme, web, counts, shippedSkills, shipped));
+  // A bad upstreams.json is creditProblems' to name; here it means no keys to hold the README to.
+  let upstreamKeys;
+  try { upstreamKeys = Object.keys(upstreams()); } catch { upstreamKeys = []; }
+  problems.push(...proseMirrorProblems(readme, web, counts, shippedSkills, shipped, upstreamKeys));
+  return problems;
+}
+
+/** The `.md` files directly in `d`, sorted; none for a missing folder. */
+const mdIn = (d) => { try { return readdirSync(d).filter((f) => f.endsWith('.md')).sort(); } catch { return []; } };
+
+/**
+ * The kit arm (spec A6, R3, R4, B7): each `src/kits/<kit>.json` against `src`. Refused: a
+ * manifest that does not parse or lacks `description`/`rules`/`skills`/`agents`; a reserved kit
+ * id (`RETIRED_KIT_IDS`); `rules` naming a missing file, or rendering (neutral theme) to more
+ * words than its `rulesWordBudget` (default 300); a member in two kits, or a core one (a row in
+ * AGENT.md.tmpl) — R3; a member with no spec (or a vendored folder skill) or no `registry.json` row; a catalogue row not of the shape `| [<m>]({{DIR_*}}/<m>.md) | <text> |`, or a member without exactly one; any `banned` string (manifest) in a member file or the rules, unless the line carries `<!-- banned: ok -->`; and a core file linking a
+ * kit member, which dangles with the kit off — R4. `registry.json` sits beside `src`, as at ROOT.
+ */
+export function kitProblems(src = SRC) {
+  let kits;
+  try { kits = loadKits(src); } catch (e) { return [`[authoring] ${e.message}`]; }
+  if (!kits.size) return [];
+  const problems = [];
+  const core = { agents: new Set(), skills: new Set() };
+  let tmpl = '';
+  try { tmpl = readText(path.join(src, 'AGENT.md.tmpl')); } catch { /* countTableProblems names it */ }
+  for (const m of tmpl.matchAll(TMPL_SPEC_RE)) core[m[1] === 'AGENTS' ? 'agents' : 'skills'].add(m[2]);
+  // null = no usable registry: `registryProblems` already names that (and every member it lacks a
+  // row for), so a member's missing row is only reported here when there IS an entities object.
+  let registry = null;
+  try { registry = JSON.parse(readText(path.join(path.dirname(src), 'registry.json'))).entities ?? null; } catch {
+    // registryProblems names an unreadable registry
+  }
+  const owner = new Map();
+  const cfg = { ...makeCfg(), src };
+  let theme = null;
+  for (const [kit, m] of kits) {
+    const at = `src/kits/${kit}.json`;
+    if (Object.hasOwn(RETIRED_KIT_IDS, kit)) {
+      problems.push(`[authoring] ${at}: kit id '${kit}' is reserved (${RETIRED_KIT_IDS[kit]})`);
+    }
+    const lacking = ['description', 'rules', 'skills', 'agents'].filter((k) => (
+      k === 'skills' || k === 'agents' ? !Array.isArray(m[k]) : typeof m[k] !== 'string'));
+    for (const k of lacking) problems.push(`[authoring] ${at} has no '${k}'`);
+    if (lacking.length) continue;
+    for (const kind of ['skills', 'agents']) {
+      for (const name of m[kind]) {
+        const key = `${kind}/${name}`;
+        if (owner.has(key)) problems.push(`[authoring] ${key} is in two kits: '${owner.get(key)}' and '${kit}'`);
+        else owner.set(key, kit);
+        if (core[kind].has(name)) problems.push(`[authoring] ${key} is core (AGENT.md.tmpl lists it), but kit '${kit}' claims it`);
+        if (!isFile(path.join(src, kind, `${name}.md`))) {
+          problems.push(kind === 'skills' && isFile(path.join(src, kind, name, 'SKILL.md'))
+            ? `[authoring] kit '${kit}' lists ${name}, a vendored folder skill; kit members must be flat specs`
+            : `[authoring] kit '${kit}' lists ${key}, but src/${key}.md does not exist`);
+        }
+        if (registry !== null && !Object.hasOwn(registry, key)) problems.push(`[authoring] ${key} (kit '${kit}') has no row in registry.json`);
+      }
+    }
+    // A6: a kit's catalogue rows are its own members' — a core row here would show twice with the
+    // kit on, or vanish with it off. Each row is `| [<m>]({{DIR_*}}/<m>.md) | <text> |`, one per member.
+    for (const kind of ['skills', 'agents']) {
+      const dir = kind === 'skills' ? 'SKILLS' : 'AGENTS';
+      const seen = new Map();
+      for (const row of m.catalogue?.[kind] ?? []) {
+        const hit = new RegExp(`^\\| \\[([a-z0-9-]+)\\]\\(\\{\\{DIR_${dir}\\}\\}/\\1\\.md\\) \\| \\S.* \\|$`).exec(row);
+        const named = hit?.[1] ?? row.match(/\{\{DIR_(?:AGENTS|SKILLS)\}\}\/([A-Za-z0-9_-]+)\.md/)?.[1];
+        if (named && !m[kind].includes(named)) {
+          problems.push(`[authoring] ${at} catalogue lists ${kind}/${named}, which is not a member of kit '${kit}'`);
+        } else if (!hit) {
+          problems.push(`[authoring] ${at} catalogue.${kind} row is not \`| [<member>]({{DIR_${dir}}}/<member>.md) | <text> |\`: ${row}`);
+        } else seen.set(named, (seen.get(named) ?? 0) + 1);
+      }
+      for (const name of m[kind]) {
+        const n = seen.get(name) ?? 0;
+        if (n !== 1) problems.push(`[authoring] ${at} catalogue.${kind} has ${n} rows for ${name}, want exactly one`);
+      }
+    }
+    // T4: strings no member file may contain; a line carrying the marker is exempt (a rule that names the construct to forbid it).
+    const files = [m.rules, ...m.skills.flatMap((n) => [`skills/${n}.md`, ...mdIn(path.join(src, 'skills', n)).map((f) => `skills/${n}/${f}`)]),
+      ...m.agents.map((n) => `agents/${n}.md`)];
+    for (const rel of files) {
+      if (!isFile(path.join(src, rel))) continue;
+      readText(path.join(src, rel)).split('\n').forEach((line, i) => {
+        if (line.includes('<!-- banned: ok -->')) return;
+        for (const b of m.banned ?? []) if (line.includes(b)) problems.push(`[authoring] src/${rel}:${i + 1} contains '${b}', banned by kit '${kit}'`);
+      });
+    }
+    const rules = path.join(src, m.rules);
+    if (!isFile(rules)) {
+      problems.push(`[authoring] ${at}: rules '${m.rules}' does not exist`);
+      continue;
+    }
+    theme ??= effectiveTheme(cfg, 'neutral');
+    const words = renderFile(cfg, rules, theme).split(/\s+/).filter(Boolean).length;
+    const budget = m.rulesWordBudget ?? 300;
+    if (words > budget) {
+      problems.push(`[authoring] src/${m.rules} renders to ${words} words, over kit '${kit}' rulesWordBudget of ${budget}`);
+    }
+  }
+  // R4. A core member (R3, named above) is left out: every core file linking it would repeat that.
+  const r4 = new Set();
+  for (const l of specLinks(src)) {
+    // Links run kit -> core only: a core file, or ANOTHER kit's file, linking a member dangles
+    // whenever that member's kit is off.
+    if (!l.owner || l.kit === l.owner || core[l.kind].has(l.name)) continue;
+    r4.add(l.kit
+      ? `[authoring] src/${l.rel} (kit '${l.kit}') links ${l.kind}/${l.name}, a member of kit '${l.owner}' — links run kit → core only`
+      : `[authoring] src/${l.rel} links ${l.kind}/${l.name}, a kit member — the link dangles when the kit is off`);
+  }
+  problems.push(...r4);
   return problems;
 }

package/js/inspect/checks-repo.mjs

@@ -9,7 +9,8 @@
  */
 import path from 'node:path';
 import {
-  ALIASES_RE, PLUGIN_SRC, RETIRED_SKILL_IDS, ROOT, SRC, THEMES, WORKFLOW_SRC, aliasesOf, knownSkillIds,
+  ALIASES_RE, CREDIT_RE, PLUGIN_SRC, RETIRED_SKILL_IDS, ROOT, SRC, THEMES, WORKFLOW_SRC, aliasesOf,
+  knownSkillIds, upstreams,
 } from '../build/source.mjs';
 import { HOSTS } from '../hosts/hosts.mjs';
 import { installTargets, installsReferencingShim } from '../hosts/installs.mjs';
@@ -22,7 +23,7 @@ import { splitLines } from '../lib/udiff.mjs';
 import { ENTITY_STATUSES } from './inventory.mjs';
 import { assessRepo } from './scorecard.mjs';
 import { badgeUrl, renderSvg } from './scorecard-svg.mjs';
-import { isDir, isFile, rglob, srcStems } from './scan.mjs';
+import { isDir, isFile, rglob, srcStems, within } from './scan.mjs';
 import { existsSync, readFileSync, readdirSync } from 'node:fs';
 
 /**
@@ -225,14 +226,17 @@ const MOVING_REFS = new Set(['main', 'master', 'develop', 'dev', 'head', 'latest
 
 /**
  * `_harness_build._vendor_pin_problems` — every vendored skill folder records where it came
- * from, under which license, and at WHICH immutable commit.
+ * from: `**Upstream key:** <key>`, naming its `src/upstreams.json` entry, which holds the repo,
+ * the pinned commit and the licence (`creditProblems` checks those facts).
  *
  * First-party folders that merely ride the vendored mechanism for their multi-file layout
- * declare that instead (`**Upstream:** this …`) and are exempt from the pin: there is no
- * upstream to drift against.
+ * declare that instead (`**Upstream:** this …`, plus a `**License:**`) and have no key: there is
+ * no upstream to drift against.
  */
 export function vendorPinProblems() {
   const problems = [];
+  let entries;
+  try { entries = upstreams(); } catch { entries = {}; }  // creditProblems names the bad JSON
   for (const name of VENDORED_SKILL_DIRS) {
     const folder = path.join(SRC, 'skills', name);
     if (!isDir(folder)) {
@@ -246,24 +250,95 @@ export function vendorPinProblems() {
         + 'pinned commit and license are unrecorded');
       continue;
     }
-    if (!/\*\*License:\*\*/.test(text)) {
-      problems.push(`[authoring] skills/${name}/VENDOR.md records no '**License:**'`);
-    }
     const upstream = /\*\*Upstream:\*\*\s*(\S+)/.exec(text);
-    if (!upstream) {
-      problems.push(`[authoring] skills/${name}/VENDOR.md declares no '**Upstream:**'`);
+    if (upstream && upstream[1].toLowerCase().startsWith('this')) {  // first-party
+      if (!/\*\*License:\*\*/.test(text)) {
+        problems.push(`[authoring] skills/${name}/VENDOR.md records no '**License:**'`);
+      }
+      continue;
+    }
+    const key = /\*\*Upstream key:\*\*\s*(\S+)/.exec(text);
+    if (!key) {
+      problems.push(`[authoring] skills/${name}/VENDOR.md declares no '**Upstream key:**' `
+        + "(nor '**Upstream:** this repository' for a first-party folder)");
+    } else if (!Object.hasOwn(entries, key[1])) {
+      problems.push(`[authoring] skills/${name}/VENDOR.md names upstream key '${key[1]}', `
+        + 'which src/upstreams.json does not define');
+    }
+  }
+  return problems;
+}
+
+/** The files a `{{CREDIT:` may sit in: those `renderAll` derives a licence copy for, plus agents. */
+const CREDITABLE_RE = /^(?:skills\/[^/_][^/]*(?:\/[^/_][^/]*)?|agents\/[^/_][^/]*)\.md$/;
+
+/**
+ * Every credit ships with what it promises. A `{{CREDIT:<key>:…}}` key resolves in
+ * `src/upstreams.json`; every entry there is credited by a token or a VENDOR.md
+ * `**Upstream key:**`; its `licenseFile` exists (the emit copies it, and throws mid-build if
+ * not); its commit is an immutable sha. A token in a `_` partial is refused: it is included
+ * into other files, whose raw source `renderAll` scans for the licence copy, so it would credit
+ * without shipping the licence. A `licenseFile: null` is only for a key credited from a vendored
+ * folder alone, which ships its upstream's own LICENSE: anywhere else the licence text must
+ * ship with the work, so a token outside those folders needs a licence file.
+ */
+export function creditProblems(src = SRC) {
+  let entries;
+  try { entries = upstreams(src); } catch {
+    return ['[authoring] src/upstreams.json is not valid JSON'];
+  }
+  const problems = [];
+  const used = new Set();
+  /** key -> the first non-vendored file whose token credits it. */
+  const needsLicence = new Map();
+  for (const file of rglob(src)) {
+    if (!file.endsWith('.md') || !isFile(file)) continue;
+    const rel = path.relative(src, file).split(path.sep).join('/');
+    const text = readText(file);
+    const vendorKey = path.basename(file) === 'VENDOR.md' && /\*\*Upstream key:\*\*\s*(\S+)/.exec(text);
+    if (vendorKey) used.add(vendorKey[1]);
+    if (!text.includes('{{CREDIT:')) continue;
+    if (!CREDITABLE_RE.test(rel)) {
+      problems.push(`[authoring] ${rel} carries a {{CREDIT:}} token, but only skills/<stem>.md, `
+        + 'skills/<stem>/*.md and agents/*.md may — the licence copy is derived for those alone');
+      continue;
+    }
+    for (const key of new Set([...text.matchAll(CREDIT_RE)].map((m) => m[1]))) {
+      used.add(key);
+      const sp = rel.split('/');
+      if (!(sp.length > 2 && VENDORED_SKILL_DIRS.has(sp[1])) && !needsLicence.has(key)) needsLicence.set(key, rel);
+      if (!Object.hasOwn(entries, key)) {
+        problems.push(`[authoring] ${rel} credits '${key}', which src/upstreams.json does not define`);
+      }
+    }
+  }
+  for (const [key, u] of Object.entries(entries)) {
+    const where = `src/upstreams.json entry '${key}'`;
+    if (!used.has(key)) problems.push(`[authoring] ${where} is credited by no {{CREDIT:}} token and no VENDOR.md`);
+    const pin = String(u.commit ?? '');
+    if (MOVING_REFS.has(pin.toLowerCase())) {
+      problems.push(`[authoring] ${where} pins '${pin}', a moving branch — record the commit sha instead`);
+    } else if (!HEX40_RE.test(pin.toLowerCase())) {
+      problems.push(`[authoring] ${where} pin '${pin}' is not a 40-character commit sha`);
+    }
+    for (const field of ['repo', 'author', 'license']) {
+      if (!u[field]) problems.push(`[authoring] ${where} has no '${field}'`);
+    }
+    if (u.frozen !== undefined && typeof u.frozen !== 'boolean') {
+      problems.push(`[authoring] ${where} has frozen ${JSON.stringify(u.frozen)}, which is not a boolean`);
+    }
+    if (!u.licenseFile) {
+      if (needsLicence.has(key)) {
+        problems.push(`[authoring] ${where} has licenseFile null, but ${needsLicence.get(key)} credits it `
+          + 'outside a vendored folder — its licence text must ship with the work');
+      }
       continue;
     }
-    if (upstream[1].toLowerCase().startsWith('this')) continue;  // first-party
-    const pin = /\*\*Commit:\*\*\s*(\S+)/.exec(text);
-    if (!pin) {
-      problems.push(`[authoring] skills/${name}/VENDOR.md has no '**Commit:**' pin`);
-    } else if (MOVING_REFS.has(pin[1].toLowerCase())) {
-      problems.push(`[authoring] skills/${name}/VENDOR.md pins '${pin[1]}', a `
-        + 'moving branch — record the commit sha instead');
-    } else if (!HEX40_RE.test(pin[1].toLowerCase())) {
-      problems.push(`[authoring] skills/${name}/VENDOR.md pin '${pin[1]}' is not `
-        + 'a 40-character commit sha');
+    // The emit copies it into every install, so it must be a file of this tree.
+    if (!within(path.resolve(src, u.licenseFile), path.resolve(src))) {
+      problems.push(`[authoring] ${where} names licenseFile '${u.licenseFile}', which resolves outside src/`);
+    } else if (!isFile(path.join(src, u.licenseFile))) {
+      problems.push(`[authoring] ${where} names licenseFile '${u.licenseFile}', which does not exist under src/`);
     }
   }
   return problems;

package/js/inspect/cost.mjs

@@ -35,7 +35,7 @@ import { isFile, readText } from '../lib/fs.mjs';
  * console draws it on the cost chart, so it lives here, once, where both read it. Raise it by
  * exactly the measured overrun and say why in that test's docblock, which keeps its history.
  */
-export const CARRIER_CEILING = { full: 62_219, lean: 39_088 };
+export const CARRIER_CEILING = { full: 62_219, lean: 39_111 };
 
 /**
  * A frontmatter value as the host shows it. The emit writes descriptions JSON-escaped

package/js/inspect/diff.mjs

@@ -49,7 +49,7 @@ import {
 } from '../hosts/hosts.mjs';
 import {
   EMIT_HOST_SCOPE, defaultTheme, doctrinesForBuild, excludedRulesOfDir,
-  excludedSkillsOfDir, gatesOfDir,
+  excludedSkillsOfDir, gatesOfDir, kitsOfDir,
   footprintOfDir, modeOfDir, postureOfDir,
   trustOfDir,
   readJsonMaybe, readMaybe, themeOfDir,
@@ -265,6 +265,8 @@ export function diffCollect({
     excludeRules: excludedRulesOfDir(dir),
     // The excluded skills, or every skill the install left out reads as deleted.
     excludeSkills: excludedSkillsOfDir(dir),
+    // The kits on, or every kit file reads as added and the Kits block as drift.
+    kits: kitsOfDir(dir),
     // The gate switches, or a disarmed install reads its `<gate>: off` line as drift.
     ...gatesOfDir(dir),
   };

package/js/inspect/inventory.mjs

@@ -96,6 +96,7 @@ export const SKILL_CLASS = {
   develop: 'build', refactor: 'build', debug: 'build', dependencies: 'build',
   'frontend-design': 'build', prototype: 'build', deck: 'build',
   'forge-mcp': 'build', bruno: 'build', worktree: 'build',
+  'spring-boot': 'build', 'spring-data-jpa': 'build', 'spring-testing': 'build',
   'geneseed-code-review': 'review', 'fresh-eyes': 'review', 'security-audit': 'review',
   'roast-me': 'review', 'review-response': 'review', ponytail: 'review',
   commit: 'ship', ship: 'ship', release: 'ship', handoff: 'ship',