geneseed 4.9.4 → 4.10.0

package/js/build/emit-claude.mjs

@@ -19,7 +19,7 @@ import { assertSourceComplete, phaseLog, ensureMemoryStore } from './bundle.mjs'
 import {
   claimAndWrite, globalMemory, globalNotebook, shipLeanLaws, stripCapabilityLinks,
 } from './emit-common.mjs';
-import { renderAll, renderFile } from './render.mjs';
+import { kitsBody, renderAll, renderFile } from './render.mjs';
 import {
   BOB_RULES_STUB, ensureContextStub, ensureExcludesStub, ensureNotebookIndex,
   ensureProfileStub,
@@ -82,6 +82,8 @@ export function emitClaudeRender(cfg, job) {
       ptheme[tok] = prefix + (ptheme[tok] ?? tok.split('_').slice(1).join('_').toLowerCase());
     }
     ptheme.AT_HARNESS = prefix;
+    // The Kits block was substituted with the unprefixed DIR_* tokens; rebuild it, or its links dangle.
+    ptheme.KITS_BODY = kitsBody(cfg, ptheme, '');
     // Same catalogue decision as the renderAll above — a re-render that forgot it would
     // quietly put the stripped tables back.
     return renderFile(cfg, tmplItem.src, ptheme, footprint, '', new Set(), nativeCatalog);

package/js/build/generate.mjs

@@ -40,7 +40,7 @@ import { DEFAULT_PRESET } from '../loop/score.mjs';
 import { opencodeConfigDir, resolvePath } from '../hosts/hosts.mjs';
 import {
   EMIT_HOST_SCOPE, defaultMode, defaultPosture, defaultTheme, doctrinesForBuild,
-  excludedRulesOfDir, excludedSkillsOfDir, footprintOfDir, gatesOfDir, installState, installTargets,
+  excludedRulesOfDir, excludedSkillsOfDir, footprintOfDir, kitsOfDir, gatesOfDir, installState, installTargets,
   legacyProcessCarrierOfDir, modeOfDir, postureOfDir, readMaybe, themeOfDir, trustOfDir,
 } from '../hosts/installs.mjs';
 import { colorThemeFiles, colorThemeJson, PALETTE_ROLES } from '../hosts/opencode.mjs';
@@ -95,7 +95,7 @@ function sysExit(msg) {
 const BUILD_FORWARD = [
   ['theme', '--theme'], ['emit', '--emit'], ['footprint', '--footprint'],
   ['posture', '--posture'], ['mode', '--mode'], ['trust', '--trust'], ['doctrines', '--doctrines'],
-  ['excludeRules', '--exclude-rules'], ['excludeSkills', '--exclude-skills'], ['out', '--out'], ['root', '--root'],
+  ['excludeRules', '--exclude-rules'], ['excludeSkills', '--exclude-skills'], ['kits', '--kits'], ['out', '--out'], ['root', '--root'],
   ['configDir', '--config-dir'],
 ];
 
@@ -141,7 +141,7 @@ export function cmdBuild(args) {
  */
 export function setupBuildArgs(theme, emit, out = null, root = null, footprint = 'lean',
   posture = 'peer', mode = 'direct', doctrines = null, allPacks = PACK_ORDER,
-  excludeRules = null, trust = DEFAULT_PRESET, excludeSkills = null, gates = {}) {
+  excludeRules = null, trust = DEFAULT_PRESET, excludeSkills = null, gates = {}, kits = null) {
   const argv = ['--theme', theme, '--emit', emit];
   if (!emit.endsWith('-global')) {
     if (out) argv.push('--out', out);
@@ -174,6 +174,9 @@ export function setupBuildArgs(theme, emit, out = null, root = null, footprint =
   // `gates` is one object keyed as `GATE_SWITCHES` keys it (`gatesOfDir`, a profile, a body).
   // Law order, so a Law IV-only install still ends on `--no-deletion-gate` as it did.
   for (const g of GATE_SWITCHES) if (gates?.[g.key] === false) argv.push(g.flag);
+  // Kits elide when none is on, as skills do: no config key feeds them, so absence and `none`
+  // are the same answer. Last, so an argv naming no kit is the bytes it always was.
+  if (kits?.length) argv.push('--kits', [...kits].sort().join(','));
   return argv;
 }
 
@@ -235,9 +238,11 @@ export function installProfile(host, scope, root, notify = null) {
   // The gate switches: a rebuild that forgot one would silently re-arm (or, read wrong, disarm)
   // the install. A missing marker reads as armed.
   const gates = gatesOfDir(root, host);
+  // Kits on stay on (spec A3); one this checkout no longer ships drops with a notice (R2).
+  const kits = kitsOfDir(root, host, notify);
   const out = scope === 'global' ? null : root;
   const argv = setupBuildArgs(theme, emit, out, out, footprint, posture, mode, doctrines,
-    PACK_ORDER, excludeRules, trust, excludeSkills, gates);
+    PACK_ORDER, excludeRules, trust, excludeSkills, gates, kits);
   // A GLOBAL ROW NAMES ITS OWN DIR. `root` came from the host's config-dir resolver, which
   // honours env overrides (`OPENCODE_CONFIG_DIR`, `CLAUDE_CONFIG_DIR`…); without the flag the
   // same argv run from a shell lacking that variable re-emits into the DEFAULT dir — a second
@@ -246,7 +251,7 @@ export function installProfile(host, scope, root, notify = null) {
   return {
     host, scope, root, state: installState(root, host, scope),
     emit, theme, footprint, posture, mode, trust, doctrines, excludeRules, excludeSkills,
-    ...gates, argv,
+    kits, ...gates, argv,
   };
 }
 

package/js/build/render.mjs

@@ -34,7 +34,10 @@ import { readText } from '../lib/fs.mjs';
 import { parseJson } from '../lib/json.mjs';
 import { normcase, comparePaths } from '../lib/paths.mjs';
 // `js/build/source.mjs` imports nothing but node builtins, so this direction cannot cycle.
-import { GATE_SWITCHES, PACK_ORDER, readPackText, resolveRuleIds, ruleCanon } from './source.mjs';
+import {
+  CREDIT_RE, GATE_SWITCHES, PACK_ORDER, kitMembers, loadKits, readPackText, resolveCredits, resolveRuleIds, ruleCanon, upstreamOf,
+} from './source.mjs';
+import { VENDORED_SKILL_DIRS } from '../hosts/native.mjs';
 import { DEFAULT_PRESET } from '../loop/score.mjs';
 
 /** Document STRUCTURE is theme-INDEPENDENT — mirrors `_build_render.STRUCTURE`. */
@@ -66,6 +69,9 @@ export const SRC_DIR_TOKENS = {
 };
 
 const TEXT_SUFFIXES = new Set(['.md', '.tmpl', '.json', '.txt', '.yml', '.yaml']);
+/** Top-level `src/` entries the build reads but never ships: upstream-credit provenance, and the
+ * kit manifests (a kit's members ship flat from `skills/` and `agents/`). */
+const NOT_BUNDLED = new Set(['upstreams.json', 'licenses', 'kits']);
 
 // Digits are legal after the first character: `DOC_<PACK>_<n>` (the doctrine rule titles) are
 // the first token names in the project to carry one, and without `0-9` here `{{DOC_CRAFT_1}}`
@@ -160,11 +166,59 @@ export function substitute(text, theme) {
 }
 
 /** `_build_render._resolve_catalogs`. */
-function resolveCatalogs(text, nativeCatalog, excludeSkills = []) {
+function resolveCatalogs(text, nativeCatalog, excludeSkills = [], cfg = null) {
   // `true`/`false` still mean "both kinds", for the plain-bundle callers that pass a boolean.
   const nat = nativeCatalog === true ? { skills: true, agents: true } : (nativeCatalog || {});
-  return text.replace(CATALOG_BLOCK_RE, (_m, kind, table, pointer) => (nat[kind] ? pointer
-    : kind === 'skills' ? dropExcludedSkillRows(table, excludeSkills) : table));
+  return text.replace(CATALOG_BLOCK_RE, (_m, kind, table, pointer) => {
+    if (nat[kind]) return pointer;
+    // Active kits' rows close the table, before `--exclude-skills` drops rows (R5: exclusion wins).
+    const full = withTableRows(table, activeKits(cfg).flatMap(([, m]) => m.catalogue?.[kind] ?? []));
+    return kind === 'skills' ? dropExcludedSkillRows(full, excludeSkills) : full;
+  });
+}
+
+/**
+ * `rows` inserted after the last row of the block's first table — inside it, not after the
+ * folder-skills list that follows §4's table (a table row there renders as broken markup). A
+ * block with no table gets them at its end; no rows returns the block as it was.
+ */
+function withTableRows(block, rows) {
+  if (!rows.length) return block;
+  const lines = block.split('\n');
+  let i = lines.findIndex((l) => l.startsWith('|'));
+  if (i < 0) i = lines.length - 1;
+  else while (i < lines.length && lines[i].startsWith('|')) i++;
+  lines.splice(i, 0, ...rows);
+  return lines.join('\n');
+}
+
+/** `loadKits(cfg.src)`, read once per cfg: a render asks for it per CATALOG block. */
+const KITS = new WeakMap();
+function kitsOf(cfg) {
+  let kits = KITS.get(cfg);
+  if (!kits) KITS.set(cfg, (kits = loadKits(cfg.src)));
+  return kits;
+}
+
+/** `[kit, manifest]` for each kit `cfg.kits` names, in its (sorted) order. */
+function activeKits(cfg) {
+  if (!cfg?.kits?.length) return [];
+  const kits = kitsOf(cfg);
+  return cfg.kits.map((k) => {
+    if (!kits.has(k)) throw new Error(`unknown kit '${k}' (no src/kits/${k}.json)`);
+    const m = kits.get(k);
+    if (typeof m.rules !== 'string') throw new Error(`src/kits/${k}.json has no 'rules' path`);
+    return [k, m];
+  });
+}
+
+/**
+ * The Kits block: each active kit's rules.md, rendered against `theme`. Exported because a
+ * carrier re-rendered with prefixed DIR_* tokens (`prefixedAgentText`) must rebuild it too.
+ */
+export function kitsBody(cfg, theme, lawsPrefix = '') {
+  return activeKits(cfg).map(([, m]) => `\n${renderFile(cfg, path.join(cfg.src, m.rules), theme,
+    'full', lawsPrefix).trim()}\n`).join('');
 }
 
 /**
@@ -240,8 +294,8 @@ function readSource(cfg, p) {
   let seen = SRC_TEXT.get(cfg);
   if (!seen) SRC_TEXT.set(cfg, (seen = new Map()));
   let text = seen.get(p);
-  // Rule ids resolve here, once per file, so every stage after sees the addressed form.
-  if (text === undefined) seen.set(p, (text = resolveRuleIds(readText(p), cfg.src)));
+  // Rule ids and credits resolve here, once per file, so every stage after sees the addressed form.
+  if (text === undefined) seen.set(p, (text = resolveCredits(resolveRuleIds(readText(p), cfg.src), cfg.src)));
   return text;
 }
 
@@ -276,7 +330,7 @@ export function renderFile(cfg, filePath, theme, footprint = 'full', lawsPrefix
     return inner;
   });
 
-  text = resolveCatalogs(text, nativeCatalog, cfg.excludeSkills ?? []);
+  text = resolveCatalogs(text, nativeCatalog, cfg.excludeSkills ?? [], cfg);
   text = resolveLean(text, footprint);
   return substitute(text, theme);
 }
@@ -444,6 +498,12 @@ export function effectiveTheme(cfg, themeName, { footprint = 'full', lawsPrefix
   const skipped = [...(cfg.excludeSkills ?? [])].sort();
   // It fills a template line of its own, so its value carries the blank line around it.
   theme.EXCLUDED_SKILLS_LINE = skipped.length ? `\nExcluded skills: ${skipped.join(', ')}\n` : '';
+  // Kits, under the same contract: both empty with no kit, so a default build stays
+  // byte-identical. The marker has the skills line's shape so one parser reads both; the block is
+  // each active kit's rules.md, plain text (no rule ids, no LEAN halves), the same at either footprint.
+  const kits = activeKits(cfg);
+  theme.KITS_LINE = kits.length ? `\nActive kits: ${kits.map(([k]) => k).join(', ')}\n` : '';
+  theme.KITS_BODY = kitsBody(cfg, theme, lawsPrefix);
   // The gate switches (`GATE_SWITCHES`: Laws I, III, IV), under the same contract: a line is
   // written only when its gate is OFF, so a default build stays byte-identical and a missing
   // line reads back as armed (`gatesOfDir`). The OpenCode plugins read these lines at load, so
@@ -488,7 +548,8 @@ export function destRel(rel) {
  *
  * Returns `{ theme, items }` where each item is `{ rel, text, src }` — `rel` is the
  * themed POSIX output path, `text` is the rendered text or `null` for a binary that the
- * caller copies from `src`. Python returns a tuple of tuples; the object form is the
+ * caller copies from `src`. A credited skill's licence copy also carries `licenceOf` (the
+ * skill's stem), since its `src` is not under that skill. Python returns a tuple of tuples; the object form is the
  * same data with the field names the Python docstring already uses.
  * @param {any} cfg
  * @param {string} themeName
@@ -500,11 +561,16 @@ export function renderAll(cfg, themeName, {
   const theme = effectiveTheme(cfg, themeName, { footprint, lawsPrefix });
   const items = [];
   const skipped = new Set(cfg.excludeSkills ?? []);
+  // Members of every kit `--kits` did not name: kit logic, not `excludeSkills`, so no marker.
+  const off = kitMembers(new Map([...kitsOf(cfg)].filter(([k]) => !(cfg.kits ?? []).includes(k))));
+  const licences = new Map();   // `<stem>/LICENSE-<key>.txt` -> the upstream's licence file
   for (const file of sortedSourceFiles(cfg.src)) {
     const rel = path.relative(cfg.src, file);
     // `--exclude-skills`: the one filter every host's emit and the plain bundle read through.
     const sp = rel.split(path.sep);
     if (sp[0] === 'skills' && sp.length >= 2 && skipped.has(sp[1].replace(/\.md$/, ''))) continue;
+    if (NOT_BUNDLED.has(sp[0])) continue;
+    if (sp.length >= 2 && Object.hasOwn(off, sp[0]) && off[sp[0]].has(sp[1].replace(/\.md$/, ''))) continue;
     const outRel = destRel(themedRel(rel, theme)).split(path.sep).join('/');  // as_posix()
     // The on-disk `laws/`, `ontology/` and `doctrines/` are the "complete text" the two lean
     // pointers promise — §1's and the Doctrines section's. They render at full whatever the
@@ -513,9 +579,26 @@ export function renderAll(cfg, themeName, {
     // accident, which is a different thing from shipping whole by contract.
     // Keyed on the SOURCE rel, not the themed one, so a DIR_* rename cannot un-exempt them.
     const fp = /^(?:laws|ontology|doctrines)[\\/]/.test(rel) ? 'full' : footprint;
-    items.push(TEXT_SUFFIXES.has(suffixOf(path.basename(file)))
-      ? { rel: outRel, text: renderFile(cfg, file, theme, fp, lawsPrefix, new Set(), nativeCatalog), src: file }
-      : { rel: outRel, text: null, src: file });
+    const text = TEXT_SUFFIXES.has(suffixOf(path.basename(file)))
+      ? renderFile(cfg, file, theme, fp, lawsPrefix, new Set(), nativeCatalog) : null;
+    items.push({ rel: outRel, text, src: file });
+    // A credited skill ships its upstream's licence beside it, one copy per (skill, key). The
+    // token is gone from `text`, so the raw source is scanned; an unknown key or a null
+    // licenseFile yields no copy. A vendored folder's VENDOR.md carries a credit too, but the
+    // folder already ships its upstream's LICENSE verbatim, so it gets no second copy.
+    const stem = sp[0] === 'skills' && sp.length >= 2 ? sp[1].replace(/\.md$/, '') : null;
+    if (stem && !VENDORED_SKILL_DIRS.has(stem) && text !== null) {
+      for (const [, key] of readText(file).matchAll(CREDIT_RE)) {
+        const lic = upstreamOf(key, cfg.src)?.licenseFile;
+        if (lic) licences.set(`${stem}/LICENSE-${key}.txt`, path.join(cfg.src, lic));
+      }
+    }
+  }
+  // Copied, not rendered (`text: null`): the licence ships byte for byte. `licenceOf` names the
+  // skill, because the copy's `src` is the upstream's file, not a path under that skill.
+  for (const [name, lic] of [...licences].sort(([a], [b]) => comparePaths(a, b))) {
+    items.push({ rel: destRel(themedRel(path.join('skills', name), theme)).split(path.sep).join('/'),
+      text: null, src: lic, licenceOf: name.split('/')[0] });
   }
   return { theme, items };
 }

package/js/build/source.mjs

@@ -90,6 +90,14 @@ export const RETIRED_RULE_IDS = {
   'absence-is-a-claim': { was: 'Law XI', liveAs: null, note: 'folded into verify-before-asserting' },
 };
 
+/**
+ * Kit ids that must never name a kit (`src/kits/<id>.json`), the reason beside each — the
+ * contract `RETIRED_RULE_IDS` keeps for rules. `none` was never a kit: `--kits none` means no kits.
+ */
+export const RETIRED_KIT_IDS = {
+  none: 'reserved: --kits none switches every kit off',
+};
+
 /** @type {Array<[number, string]>} */
 const ROMAN = [[1000, 'M'], [900, 'CM'], [500, 'D'], [400, 'CD'], [100, 'C'], [90, 'XC'],
   [50, 'L'], [40, 'XL'], [10, 'X'], [9, 'IX'], [5, 'V'], [4, 'IV'], [1, 'I']];
@@ -192,6 +200,82 @@ export function resolveRuleIds(text, src = SRC) {
     .replace(CITE_RE, (whole, kind, id) => { const r = known(kind, id); return r ? `*${r.name}*` : whole; });
 }
 
+/** `{{CREDIT:<key>:<path>}}` — `key` names a `src/upstreams.json` entry, `path` a file upstream. */
+export const CREDIT_RE = /\{\{CREDIT:([a-z0-9]+(?:-[a-z0-9]+)*):([A-Za-z0-9._/-]+)\}\}/g;
+
+const _upstreams = new Map();
+/**
+ * `src/upstreams.json`, parsed — memoised on its raw text the way `ruleCanon` is, so the web
+ * daemon sees an edit. A tree without the file credits nothing.
+ */
+export function upstreams(src = SRC) {
+  const file = path.join(src, 'upstreams.json');
+  let text;
+  // Not readRawText: its mtime key misses a rewrite inside one mtime tick (seen on Windows CI).
+  try { text = readFileSync(file, 'utf8'); } catch { return {}; }
+  const hit = _upstreams.get(file);
+  if (hit && hit.text === text) return hit.entries;
+  const entries = JSON.parse(text);
+  _upstreams.set(file, { text, entries });
+  return entries;
+}
+
+/** The entry a credit key names, or null — `hasOwn`, so `constructor` is not a key. */
+export function upstreamOf(key, src = SRC) {
+  const u = upstreams(src);
+  return Object.hasOwn(u, key) ? u[key] : null;
+}
+
+/**
+ * Resolve every credit in `text` into its attribution line. An unknown key is left exactly as
+ * written, as `resolveRuleIds` leaves an unknown id, so the doctor can name it.
+ */
+export function resolveCredits(text, src = SRC) {
+  if (!text.includes('{{CREDIT:')) return text;
+  return text.replace(CREDIT_RE, (whole, key, file) => {
+    const u = upstreamOf(key, src);
+    return u ? `*Adapted from [${u.repo}](https://github.com/${u.repo}) (\`${file}\`) `
+      + `by ${u.author} — ${u.license}, modified.*` : whole;
+  });
+}
+
+/**
+ * `src/kits/<kit>.json`, parsed, as `Map<kit, manifest>` in sorted kit order. A manifest is
+ * `{ description, skills, agents, rules, rulesWordBudget, catalogue, banned? }`, the sole writer of its
+ * kit's membership; the `<kit>/` folder beside it holds the kit's `rules.md` and is not read
+ * here. A tree without `src/kits/` has no kits.
+ */
+export function loadKits(src = SRC) {
+  const dir = path.join(src, 'kits');
+  let names;
+  try { names = readdirSync(dir).filter((n) => n.endsWith('.json')).sort(); } catch (e) {
+    if (e.code === 'ENOENT') return new Map(); // only an absent src/kits means "no kits"
+    throw new Error(`src/kits: ${e.message}`, { cause: e });
+  }
+  return new Map(names.map((n) => {
+    let m;
+    try { m = JSON.parse(readFileSync(path.join(dir, n), 'utf8')); } catch (e) {
+      throw new Error(`src/kits/${n}: ${e.message}`, { cause: e });
+    }
+    if (m === null || typeof m !== 'object' || Array.isArray(m)) throw new Error(`src/kits/${n}: a manifest must be a JSON object`);
+    if (m.banned !== undefined && !(Array.isArray(m.banned) && m.banned.every((b) => typeof b === 'string' && b))) {
+      throw new Error(`src/kits/${n}: 'banned' must be an array of non-empty strings`);
+    }
+    return [n.slice(0, -'.json'.length), m];
+  }));
+}
+
+/** Every skill and agent the kits handed in claim (a `loadKits` Map, or a subset of one). */
+export function kitMembers(kits) {
+  const skills = new Set();
+  const agents = new Set();
+  for (const m of kits.values()) {
+    for (const s of m.skills ?? []) skills.add(s);
+    for (const a of m.agents ?? []) agents.add(a);
+  }
+  return { skills, agents };
+}
+
 /**
  * `_build_core.ROOT` — the checkout, from this file's own location (`js/..`).
  *
@@ -295,20 +379,47 @@ export function knownSkillIds(src = SRC) {
  * not listed, so a new link protects its target the day it is written.
  */
 export function linkedSkillIds(src = SRC) {
-  const linked = new Set();
+  // A kit's links to its own members do not protect them (spec R5: excluding a kit skill is
+  // allowed); a kit file's link to a CORE skill still does, or excluding it would leave the link dead.
+  return [...new Set(specLinks(src).filter((l) => l.kind === 'skills' && !(l.kit && l.kit === l.owner))
+    .map((l) => l.name))].sort();
+}
+
+/**
+ * Every `{{DIR_SKILLS}}/<name>` / `{{DIR_AGENTS}}/<name>` link in `src`'s .md/.tmpl files, outside
+ * the §4 skills catalogue table: `{ rel, kind, name, kit, owner }`. `kit` is the kit that owns the
+ * file (`kits/<kit>.json`, `kits/<kit>/**`, a member's spec or side file), `owner` the kit the
+ * target is a member of; each null for core. `linkedSkillIds` and the doctor's R4 arm
+ * (`kitProblems`) read the same walk.
+ */
+export function specLinks(src = SRC) {
+  // Member -> its kit, per kind; the first kit wins a member two kits claim (R3 names that).
+  const owners = { skills: new Map(), agents: new Map() };
+  for (const [kit, m] of loadKits(src)) {
+    for (const kind of ['skills', 'agents']) for (const n of m[kind] ?? []) if (!owners[kind].has(n)) owners[kind].set(n, kit);
+  }
+  // Under kits/, only `<kit>.json` and `<kit>/**` belong to a kit; any other file there (a README) is nobody's.
+  const ofKit = (sp) => (sp[0] === 'kits'
+    ? (sp.length > 2 ? sp[1] : /\.json$/.test(sp[1]) ? sp[1].slice(0, -'.json'.length) : null)
+    : (sp.length >= 2 && Object.hasOwn(owners, sp[0]) && owners[sp[0]].get(sp[1].replace(/\.md$/, ''))) || null);
+  const links = [];
   const walk = (d) => {
     for (const e of readdirSync(d, { withFileTypes: true })) {
       const f = path.join(d, e.name);
       if (e.isDirectory()) walk(f);
       else if (/\.(md|tmpl)$/.test(e.name)) {
+        const sp = path.relative(src, f).split(path.sep);
         const text = readFileSync(f, 'utf8')
           .replace(/<!-- CATALOG:begin skills -->[\s\S]*?<!-- CATALOG:end -->/, '');
-        for (const m of text.matchAll(/\{\{DIR_SKILLS\}\}\/([a-z0-9-]+)/g)) linked.add(m[1]);
+        for (const m of text.matchAll(/\{\{DIR_(SKILLS|AGENTS)\}\}\/([a-z0-9-]+)/g)) {
+          const kind = m[1].toLowerCase();
+          links.push({ rel: sp.join('/'), kind, name: m[2], kit: ofKit(sp), owner: owners[kind].get(m[2]) ?? null });
+        }
       }
     }
   };
   walk(src);
-  return [...linked].sort();
+  return links;
 }
 
 /**
@@ -412,7 +523,7 @@ export const GATE_SWITCHES = [
  */
 export function makeCfg({
   posture = 'peer', mode = 'direct', trust = DEFAULT_PRESET, doctrines = PACK_ORDER,
-  excludeRules = [], excludeSkills = [], ...switches
+  excludeRules = [], excludeSkills = [], kits = [], ...switches
 } = {}) {
   return {
     root: ROOT,
@@ -440,6 +551,8 @@ export function makeCfg({
     excludeRules: Array.isArray(excludeRules) ? [...excludeRules] : [],
     // Skill names left out of this install — same "unspecified takes nothing away" default.
     excludeSkills: Array.isArray(excludeSkills) ? [...excludeSkills] : [],
+    // Kits switched on for this install — off unless named, so a default build is unchanged.
+    kits: Array.isArray(kits) ? [...kits] : [],
     // The gate switches (`GATE_SWITCHES`: `secretsGate`, `doneGate`, `deletionGate`), each armed
     // unless its `no*` arg says so in so many words: only a literal `true` disarms, so every
     // caller that never heard of a switch keeps the gate.

package/js/cli-table.json

@@ -193,6 +193,21 @@
           "type": null,
           "hidden": false
         },
+        {
+          "names": [
+            "--kits"
+          ],
+          "dest": "kits",
+          "metavar": null,
+          "help": "switch on opt-in kits, comma-separated; 'none' turns every kit off (default: no kits)",
+          "choices": null,
+          "default": null,
+          "required": false,
+          "nargs": null,
+          "is_flag": false,
+          "type": null,
+          "hidden": false
+        },
         {
           "names": [
             "--out"

package/js/hosts/installs.mjs

@@ -36,7 +36,7 @@ import { existsSync, readdirSync } from 'node:fs';
 import path from 'node:path';
 
 import {
-  CONFIG, GATE_SWITCHES, PACK_ORDER, THEMES, discoverNames, resolveSkillNames,
+  CONFIG, GATE_SWITCHES, PACK_ORDER, RETIRED_KIT_IDS, THEMES, discoverNames, loadKits, resolveSkillNames,
 } from '../build/source.mjs';
 import {
   CLAUDE_STYLE, DISABLED_STASH, GLOBAL_MANIFEST, HOSTS, isHostGlobalDir, liveRecordedHooks,
@@ -585,6 +585,33 @@ export function excludedSkillsOfDir(d, host = null, notify = null) {
   }, [], host);
 }
 
+/** `Active kits: spring-boot` — written only when a kit is on; the skills line's shape. */
+const KITS_RE = /^Active kits:[ \t]*(.+?)[ \t]*$/m;
+
+/**
+ * The kits a DEPLOYED install has on, read back so `rebuild-all`, `upgrade`, `migrate`, `diff`, the wizard
+ * and the console re-render them (spec A3). A missing line is `[]`: no kits, the old install's
+ * state. Unlike `excludedSkillsOfDir`, a name this checkout does not ship drops ALONE, with a
+ * notice (spec R2): a retired kit must never reach `--kits`, which refuses it and would fail the
+ * whole `rebuild-all`, and the kits beside it are still the owner's choice. Silent without `notify`.
+ */
+export function kitsOfDir(d, host = null, notify = null) {
+  return firstCarrier(d, (carrierPath) => {
+    const text = readMaybe(carrierPath);
+    if (text === null) return undefined;
+    const m = KITS_RE.exec(text);
+    if (!m) return undefined;
+    const known = loadKits();
+    const names = [...new Set(m[1].split(',').map((s) => s.trim()).filter(Boolean))].sort();
+    for (const k of names.filter((n) => !known.has(n))) {
+      notify?.(Object.hasOwn(RETIRED_KIT_IDS, k)
+        ? `kit '${k}' was retired (${RETIRED_KIT_IDS[k]}) — dropped`
+        : `kit '${k}' is not shipped by this Geneseed — dropped`);
+    }
+    return names.filter((n) => known.has(n));
+  }, [], host);
+}
+
 /**
  * Whether a DEPLOYED install keeps one law's hook gate armed — `true` (armed) or `false` (its
  * `<marker>: off` line, written by a build with that gate's `--no-*-gate` flag; `GATE_SWITCHES`).
@@ -861,7 +888,7 @@ export function installsReferencingShim(shimPath = hookShimPath(), targets = ins
 export function installedDefaults() {
   const found = {
     theme: null, posture: null, mode: null, emit: null, footprint: null, doctrines: null,
-    excludeRules: null, excludeSkills: null,
+    excludeRules: null, excludeSkills: null, kits: null,
   };
   const candidates = [];
   for (const { host, configDir } of HOSTS) {
@@ -904,6 +931,12 @@ export function installedDefaults() {
     // indistinguishable here, which is exactly what the marker itself already says.
     if (!found.excludeRules?.length) found.excludeRules = excludedRulesOfDir(base);
     if (!found.excludeSkills?.length) found.excludeSkills = excludedSkillsOfDir(base);
+    // Kits walk the same two-state way: no line and `none` both read `[]`.
+    // A broken manifest must not crash the wizard here: the build that follows still fails loudly
+    // in `loadKits`. Not guarded inside `kitsOfDir`, which rebuild-all must keep failing on.
+    if (!found.kits?.length) {
+      try { found.kits = kitsOfDir(base); } catch { found.kits = []; }
+    }
   }
   return found;
 }

package/js/hosts/native.mjs

@@ -579,7 +579,7 @@ export function writeNativeLayer(items, agentsDir, skillsDir, overrides = null,
   let nAgents = 0;
   let nSkills = 0;
   const written = [];
-  const sideFiles = [];            // [stem, dest, text], written after the loop
+  const sideFiles = [];            // [stem, dest, text, source], written after the loop
   const claimedSkills = new Set(); // stems whose own SKILL.md claim held
   const userOnlySkills = [];       // claimed stems carrying the user-only marker
 
@@ -589,7 +589,13 @@ export function writeNativeLayer(items, agentsDir, skillsDir, overrides = null,
     written.push(dest);
   };
 
-  for (const { text, src: source } of items) {
+  for (const { text, src: source, rel, licenceOf } of items) {
+    // A credited skill's upstream licence: copied verbatim beside its SKILL.md, held like a side
+    // file until that claim holds. Routed by `licenceOf`, since `source` is the upstream's file.
+    if (licenceOf) {
+      sideFiles.push([licenceOf, path.join(skillsDir, licenceOf, path.posix.basename(rel)), null, source]);
+      continue;
+    }
     const sparts = relPosix(src, source).split('/');
 
     // Vendored third-party skill folders ride along verbatim, preserving their own
@@ -706,8 +712,12 @@ export function writeNativeLayer(items, agentsDir, skillsDir, overrides = null,
     if (kind === 'agent') nAgents += 1;
     else nSkills += 1;
   }
-  for (const [stem, dest, text] of sideFiles) {
-    if (claimedSkills.has(stem) && claim(dest)) write(dest, stripSkillBodyLinks(text));
+  for (const [stem, dest, text, source] of sideFiles) {
+    if (!claimedSkills.has(stem) || !claim(dest)) continue;
+    if (text !== null) { write(dest, stripSkillBodyLinks(text)); continue; }
+    mkdirSync(path.dirname(dest), { recursive: true });
+    copyFile(source, dest);
+    written.push(dest);
   }
   return { nAgents, nSkills, written, userOnlySkills };
 }

package/js/inspect/checks-authoring.mjs

@@ -21,11 +21,11 @@ import { blankCodeSpans } from '../lib/text.mjs';
 import { which } from '../lib/paths.mjs';
 import { NO_WINDOW } from '../lib/proc.mjs';
 import {
-  aliasProblems, folderSkillProblems, registryProblems, secretProblems, sideFileProblems,
+  aliasProblems, creditProblems, folderSkillProblems, registryProblems, secretProblems, sideFileProblems,
   vendorPinProblems,
 } from './checks-repo.mjs';
 import { constitutionProblems, leanBlockProblems } from './checks-constitution.mjs';
-import { countTableProblems } from './checks-counts.mjs';
+import { countTableProblems, kitProblems } from './checks-counts.mjs';
 import { catalogProblems } from '../loop/catalog.mjs';
 import { globSorted, isDir, isFile, rglob } from './scan.mjs';
 import { spawnSync } from 'node:child_process';
@@ -55,6 +55,7 @@ const ALLOWED_COMMENT_RES = [
   // js/web/docs.mjs HARNESS_OPEN_RE: `harness:` then one or more of its four ids, comma-separated.
   new RegExp(`^harness:\\s*(?:${HARNESS_IDS})(?:\\s*,\\s*(?:${HARNESS_IDS}))*$`),
   /^bash:\s*allow$/,                         // js/hosts/native.mjs BASH_MARKER
+  /^banned: ok$/,                            // checks-counts.mjs kitProblems: a kit line that names a banned string
 ];
 
 /**
@@ -114,7 +115,7 @@ export function authorNoteProblems(src = SRC) {
 export {
   HOOK_PINNED, constitutionProblems, doctrineMetaProblems, lawMetaProblems, leanBlockProblems,
 } from './checks-constitution.mjs';
-export { countTableProblems, proseMirrorProblems } from './checks-counts.mjs';
+export { countTableProblems, kitProblems, proseMirrorProblems } from './checks-counts.mjs';
 
 /**
  * The shipped loop catalogue parses and every shipped template passes the engine's own graph
@@ -192,10 +193,12 @@ export function authoringProblems() {
   problems.push(...vendorPinProblems());
   problems.push(...folderSkillProblems());
   problems.push(...aliasProblems());
+  problems.push(...creditProblems());
   problems.push(...sideFileProblems());
   problems.push(...constitutionProblems());
   problems.push(...leanBlockProblems());
   problems.push(...countTableProblems());
+  problems.push(...kitProblems());
   problems.push(...authorNoteProblems());
   return problems;
 }

package/js/inspect/checks-build.mjs

@@ -9,7 +9,7 @@
 import path from 'node:path';
 import { stripCapabilityLinks } from '../build/emit-common.mjs';
 import { STRUCTURE, renderAll } from '../build/render.mjs';
-import { CONFIG, makeCfg } from '../build/source.mjs';
+import { CONFIG, CREDIT_RE, makeCfg } from '../build/source.mjs';
 import { hostCatalogsNatively, resolvePath } from '../hosts/hosts.mjs';
 import { EMIT_HOST_SCOPE, footprintOfDir, themeFiles } from '../hosts/installs.mjs';
 import { isVendoredPath } from '../hosts/native.mjs';
@@ -80,6 +80,12 @@ export function checkBuild(themeName, out, isVendored = isVendoredPath) {
     for (const tok of sortedUnique(text.match(TOKEN_RE) ?? [])) {
       problems.push(`[${themeName}] unresolved token ${tok} in ${rel}`);
     }
+    // `TOKEN_RE` cannot see a credit (colon, lowercase key): one left standing names no upstream.
+    if (text.includes('{{CREDIT:')) {
+      for (const tok of sortedUnique(text.match(CREDIT_RE) ?? ['{{CREDIT:'])) {
+        problems.push(`[${themeName}] unresolved token ${tok} in ${rel}`);
+      }
+    }
     for (const p of linkProblems(md, text, outAbs, rel)) problems.push(`[${themeName}] ${p}`);
     for (const p of descriptionProblems(text, rel)) problems.push(`[${themeName}] ${p}`);
   }