geneseed 4.9.4 → 4.10.0

package/js/inspect/checks-counts.mjs

@@ -7,7 +7,10 @@
  * is the reader that feeds it.
  */
 import path from 'node:path';
-import { DOCS, DOC_FOLDERS, PLUGIN_SRC, ROOT, SRC, ruleCanon } from '../build/source.mjs';
+import {
+  DOCS, DOC_FOLDERS, PLUGIN_SRC, RETIRED_KIT_IDS, ROOT, SRC, kitMembers, loadKits, makeCfg, ruleCanon, specLinks, upstreams,
+} from '../build/source.mjs';
+import { effectiveTheme, renderFile } from '../build/render.mjs';
 import { themeFiles } from '../hosts/installs.mjs';
 import { readText } from '../lib/fs.mjs';
 import { formatRepr } from '../lib/json.mjs';
@@ -25,7 +28,7 @@ import { existsSync, readdirSync } from 'node:fs';
  * so they drift silently — they already had. Pure over its inputs, so the corpus can feed it
  * crafted drift without touching the tree.
  */
-export function proseMirrorProblems(readme, web, counts, skillStems, shipped = '') {
+export function proseMirrorProblems(readme, web, counts, skillStems, shipped = '', upstreamKeys = undefined) {
   const problems = [];
   const { laws, agents, skills, plugins } = counts;
 
@@ -68,6 +71,32 @@ export function proseMirrorProblems(readme, web, counts, skillStems, shipped = '
     }
   }
 
+  // The README Credits section names EXACTLY the `src/upstreams.json` keys, both directions,
+  // as the skills row does. A missing section is a problem, or deleting it would turn the gate
+  // green. `upstreamKeys` is optional, like `plugins`, because the corpus predates it.
+  if (upstreamKeys !== undefined) {
+    const lines = readme.split('\n').map((ln) => ln.replace(/\r$/, ''));
+    const at = lines.findIndex((ln) => ln.trim() === '## 🙏 Credits');
+    if (at < 0) {
+      problems.push("[authoring] README has no '## 🙏 Credits' section — src/upstreams.json has "
+        + `${upstreamKeys.length} upstreams to credit`);
+    } else {
+      const end = lines.findIndex((ln, i) => i > at && ln.startsWith('## '));
+      const listed = new Set();
+      for (const ln of lines.slice(at + 1, end < 0 ? undefined : end).filter((l) => l.startsWith('- '))) {
+        const k = /^- `([^`]+)`/.exec(ln);
+        if (k) listed.add(k[1]);
+        else problems.push(`[authoring] README Credits bullet names no upstream key in backticks: '${ln}'`);
+      }
+      for (const key of [...upstreamKeys].filter((k) => !listed.has(k)).sort()) {
+        problems.push(`[authoring] README Credits omits upstream '${key}' (src/upstreams.json)`);
+      }
+      for (const key of [...listed].filter((k) => !upstreamKeys.includes(k)).sort()) {
+        problems.push(`[authoring] README Credits names '${key}', which src/upstreams.json does not define`);
+      }
+    }
+  }
+
   for (const m of web.matchAll(/(\d+) universal (?:laws|Rules)/g)) {
     if (Number(m[1]) !== laws) {
       problems.push(`[authoring] docs/ prose says '${m[1]} universal laws/Rules' but `
@@ -127,8 +156,13 @@ export function countTableProblems() {
     return [`[authoring] AGENT.md.tmpl unreadable: ${e.message}`];
   }
 
+  // A kit member's row lives in its kit's manifest, not the template (spec A6). A manifest that
+  // does not parse is `kitProblems`' to name; here it means no kit rows.
+  let kits;
+  try { kits = loadKits(); } catch { kits = new Map(); }
+  const kitRows = [...kits.values()].flatMap((m) => [...(m.catalogue?.skills ?? []), ...(m.catalogue?.agents ?? [])]);
   const linked = { agents: new Set(), skills: new Set() };
-  for (const m of ttext.matchAll(TMPL_SPEC_RE)) {
+  for (const m of [ttext, ...kitRows].join('\n').matchAll(TMPL_SPEC_RE)) {
     if (m[2] !== '_template') linked[m[1] === 'AGENTS' ? 'agents' : 'skills'].add(m[2]);
   }
   for (const folder of ['agents', 'skills']) {
@@ -173,11 +207,14 @@ export function countTableProblems() {
   // the SHIPPED.md triple count it. It is added HERE rather than in `srcStems`, whose other
   // readers above — the AGENT.md table links and SKILL_CLASS — are about flat specs only.
   const skillsDir = path.join(SRC, 'skills');
+  // Core only: a kit is off by default, so its members are in no badge, README list or SHIPPED triple.
+  const members = kitMembers(kits);
   const shippedSkills = new Set([...skillFiles, ...(isDir(skillsDir) ? readdirSync(skillsDir) : [])
-    .filter((d) => !d.startsWith('_') && isFile(path.join(skillsDir, d, 'SKILL.md')))]);
+    .filter((d) => !d.startsWith('_') && isFile(path.join(skillsDir, d, 'SKILL.md')))]
+    .filter((s) => !members.skills.has(s)));
 
   const counts = {
-    agents: srcStems('agents').size,
+    agents: [...srcStems('agents')].filter((a) => !members.agents.has(a)).length,
     skills: shippedSkills.size,
     laws: lawNums.length,
     // Every doctrine rule in every pack, opt-in ones included: the laws badge alone told a
@@ -242,6 +279,116 @@ export function countTableProblems() {
     problems.push('[authoring] SHIPPED.md carries no \'N laws, N agents, N skills\' line — '
       + 'deleting it is how that gate goes green while the count drifts');
   }
-  problems.push(...proseMirrorProblems(readme, web, counts, shippedSkills, shipped));
+  // A bad upstreams.json is creditProblems' to name; here it means no keys to hold the README to.
+  let upstreamKeys;
+  try { upstreamKeys = Object.keys(upstreams()); } catch { upstreamKeys = []; }
+  problems.push(...proseMirrorProblems(readme, web, counts, shippedSkills, shipped, upstreamKeys));
+  return problems;
+}
+
+/** The `.md` files directly in `d`, sorted; none for a missing folder. */
+const mdIn = (d) => { try { return readdirSync(d).filter((f) => f.endsWith('.md')).sort(); } catch { return []; } };
+
+/**
+ * The kit arm (spec A6, R3, R4, B7): each `src/kits/<kit>.json` against `src`. Refused: a
+ * manifest that does not parse or lacks `description`/`rules`/`skills`/`agents`; a reserved kit
+ * id (`RETIRED_KIT_IDS`); `rules` naming a missing file, or rendering (neutral theme) to more
+ * words than its `rulesWordBudget` (default 300); a member in two kits, or a core one (a row in
+ * AGENT.md.tmpl) — R3; a member with no spec (or a vendored folder skill) or no `registry.json` row; a catalogue row not of the shape `| [<m>]({{DIR_*}}/<m>.md) | <text> |`, or a member without exactly one; any `banned` string (manifest) in a member file or the rules, unless the line carries `<!-- banned: ok -->`; and a core file linking a
+ * kit member, which dangles with the kit off — R4. `registry.json` sits beside `src`, as at ROOT.
+ */
+export function kitProblems(src = SRC) {
+  let kits;
+  try { kits = loadKits(src); } catch (e) { return [`[authoring] ${e.message}`]; }
+  if (!kits.size) return [];
+  const problems = [];
+  const core = { agents: new Set(), skills: new Set() };
+  let tmpl = '';
+  try { tmpl = readText(path.join(src, 'AGENT.md.tmpl')); } catch { /* countTableProblems names it */ }
+  for (const m of tmpl.matchAll(TMPL_SPEC_RE)) core[m[1] === 'AGENTS' ? 'agents' : 'skills'].add(m[2]);
+  // null = no usable registry: `registryProblems` already names that (and every member it lacks a
+  // row for), so a member's missing row is only reported here when there IS an entities object.
+  let registry = null;
+  try { registry = JSON.parse(readText(path.join(path.dirname(src), 'registry.json'))).entities ?? null; } catch {
+    // registryProblems names an unreadable registry
+  }
+  const owner = new Map();
+  const cfg = { ...makeCfg(), src };
+  let theme = null;
+  for (const [kit, m] of kits) {
+    const at = `src/kits/${kit}.json`;
+    if (Object.hasOwn(RETIRED_KIT_IDS, kit)) {
+      problems.push(`[authoring] ${at}: kit id '${kit}' is reserved (${RETIRED_KIT_IDS[kit]})`);
+    }
+    const lacking = ['description', 'rules', 'skills', 'agents'].filter((k) => (
+      k === 'skills' || k === 'agents' ? !Array.isArray(m[k]) : typeof m[k] !== 'string'));
+    for (const k of lacking) problems.push(`[authoring] ${at} has no '${k}'`);
+    if (lacking.length) continue;
+    for (const kind of ['skills', 'agents']) {
+      for (const name of m[kind]) {
+        const key = `${kind}/${name}`;
+        if (owner.has(key)) problems.push(`[authoring] ${key} is in two kits: '${owner.get(key)}' and '${kit}'`);
+        else owner.set(key, kit);
+        if (core[kind].has(name)) problems.push(`[authoring] ${key} is core (AGENT.md.tmpl lists it), but kit '${kit}' claims it`);
+        if (!isFile(path.join(src, kind, `${name}.md`))) {
+          problems.push(kind === 'skills' && isFile(path.join(src, kind, name, 'SKILL.md'))
+            ? `[authoring] kit '${kit}' lists ${name}, a vendored folder skill; kit members must be flat specs`
+            : `[authoring] kit '${kit}' lists ${key}, but src/${key}.md does not exist`);
+        }
+        if (registry !== null && !Object.hasOwn(registry, key)) problems.push(`[authoring] ${key} (kit '${kit}') has no row in registry.json`);
+      }
+    }
+    // A6: a kit's catalogue rows are its own members' — a core row here would show twice with the
+    // kit on, or vanish with it off. Each row is `| [<m>]({{DIR_*}}/<m>.md) | <text> |`, one per member.
+    for (const kind of ['skills', 'agents']) {
+      const dir = kind === 'skills' ? 'SKILLS' : 'AGENTS';
+      const seen = new Map();
+      for (const row of m.catalogue?.[kind] ?? []) {
+        const hit = new RegExp(`^\\| \\[([a-z0-9-]+)\\]\\(\\{\\{DIR_${dir}\\}\\}/\\1\\.md\\) \\| \\S.* \\|$`).exec(row);
+        const named = hit?.[1] ?? row.match(/\{\{DIR_(?:AGENTS|SKILLS)\}\}\/([A-Za-z0-9_-]+)\.md/)?.[1];
+        if (named && !m[kind].includes(named)) {
+          problems.push(`[authoring] ${at} catalogue lists ${kind}/${named}, which is not a member of kit '${kit}'`);
+        } else if (!hit) {
+          problems.push(`[authoring] ${at} catalogue.${kind} row is not \`| [<member>]({{DIR_${dir}}}/<member>.md) | <text> |\`: ${row}`);
+        } else seen.set(named, (seen.get(named) ?? 0) + 1);
+      }
+      for (const name of m[kind]) {
+        const n = seen.get(name) ?? 0;
+        if (n !== 1) problems.push(`[authoring] ${at} catalogue.${kind} has ${n} rows for ${name}, want exactly one`);
+      }
+    }
+    // T4: strings no member file may contain; a line carrying the marker is exempt (a rule that names the construct to forbid it).
+    const files = [m.rules, ...m.skills.flatMap((n) => [`skills/${n}.md`, ...mdIn(path.join(src, 'skills', n)).map((f) => `skills/${n}/${f}`)]),
+      ...m.agents.map((n) => `agents/${n}.md`)];
+    for (const rel of files) {
+      if (!isFile(path.join(src, rel))) continue;
+      readText(path.join(src, rel)).split('\n').forEach((line, i) => {
+        if (line.includes('<!-- banned: ok -->')) return;
+        for (const b of m.banned ?? []) if (line.includes(b)) problems.push(`[authoring] src/${rel}:${i + 1} contains '${b}', banned by kit '${kit}'`);
+      });
+    }
+    const rules = path.join(src, m.rules);
+    if (!isFile(rules)) {
+      problems.push(`[authoring] ${at}: rules '${m.rules}' does not exist`);
+      continue;
+    }
+    theme ??= effectiveTheme(cfg, 'neutral');
+    const words = renderFile(cfg, rules, theme).split(/\s+/).filter(Boolean).length;
+    const budget = m.rulesWordBudget ?? 300;
+    if (words > budget) {
+      problems.push(`[authoring] src/${m.rules} renders to ${words} words, over kit '${kit}' rulesWordBudget of ${budget}`);
+    }
+  }
+  // R4. A core member (R3, named above) is left out: every core file linking it would repeat that.
+  const r4 = new Set();
+  for (const l of specLinks(src)) {
+    // Links run kit -> core only: a core file, or ANOTHER kit's file, linking a member dangles
+    // whenever that member's kit is off.
+    if (!l.owner || l.kit === l.owner || core[l.kind].has(l.name)) continue;
+    r4.add(l.kit
+      ? `[authoring] src/${l.rel} (kit '${l.kit}') links ${l.kind}/${l.name}, a member of kit '${l.owner}' — links run kit → core only`
+      : `[authoring] src/${l.rel} links ${l.kind}/${l.name}, a kit member — the link dangles when the kit is off`);
+  }
+  problems.push(...r4);
   return problems;
 }

package/js/inspect/checks-repo.mjs

@@ -9,7 +9,8 @@
  */
 import path from 'node:path';
 import {
-  ALIASES_RE, PLUGIN_SRC, RETIRED_SKILL_IDS, ROOT, SRC, THEMES, WORKFLOW_SRC, aliasesOf, knownSkillIds,
+  ALIASES_RE, CREDIT_RE, PLUGIN_SRC, RETIRED_SKILL_IDS, ROOT, SRC, THEMES, WORKFLOW_SRC, aliasesOf,
+  knownSkillIds, upstreams,
 } from '../build/source.mjs';
 import { HOSTS } from '../hosts/hosts.mjs';
 import { installTargets, installsReferencingShim } from '../hosts/installs.mjs';
@@ -22,7 +23,7 @@ import { splitLines } from '../lib/udiff.mjs';
 import { ENTITY_STATUSES } from './inventory.mjs';
 import { assessRepo } from './scorecard.mjs';
 import { badgeUrl, renderSvg } from './scorecard-svg.mjs';
-import { isDir, isFile, rglob, srcStems } from './scan.mjs';
+import { isDir, isFile, rglob, srcStems, within } from './scan.mjs';
 import { existsSync, readFileSync, readdirSync } from 'node:fs';
 
 /**
@@ -225,14 +226,17 @@ const MOVING_REFS = new Set(['main', 'master', 'develop', 'dev', 'head', 'latest
 
 /**
  * `_harness_build._vendor_pin_problems` — every vendored skill folder records where it came
- * from, under which license, and at WHICH immutable commit.
+ * from: `**Upstream key:** <key>`, naming its `src/upstreams.json` entry, which holds the repo,
+ * the pinned commit and the licence (`creditProblems` checks those facts).
  *
  * First-party folders that merely ride the vendored mechanism for their multi-file layout
- * declare that instead (`**Upstream:** this …`) and are exempt from the pin: there is no
- * upstream to drift against.
+ * declare that instead (`**Upstream:** this …`, plus a `**License:**`) and have no key: there is
+ * no upstream to drift against.
  */
 export function vendorPinProblems() {
   const problems = [];
+  let entries;
+  try { entries = upstreams(); } catch { entries = {}; }  // creditProblems names the bad JSON
   for (const name of VENDORED_SKILL_DIRS) {
     const folder = path.join(SRC, 'skills', name);
     if (!isDir(folder)) {
@@ -246,24 +250,95 @@ export function vendorPinProblems() {
         + 'pinned commit and license are unrecorded');
       continue;
     }
-    if (!/\*\*License:\*\*/.test(text)) {
-      problems.push(`[authoring] skills/${name}/VENDOR.md records no '**License:**'`);
-    }
     const upstream = /\*\*Upstream:\*\*\s*(\S+)/.exec(text);
-    if (!upstream) {
-      problems.push(`[authoring] skills/${name}/VENDOR.md declares no '**Upstream:**'`);
+    if (upstream && upstream[1].toLowerCase().startsWith('this')) {  // first-party
+      if (!/\*\*License:\*\*/.test(text)) {
+        problems.push(`[authoring] skills/${name}/VENDOR.md records no '**License:**'`);
+      }
+      continue;
+    }
+    const key = /\*\*Upstream key:\*\*\s*(\S+)/.exec(text);
+    if (!key) {
+      problems.push(`[authoring] skills/${name}/VENDOR.md declares no '**Upstream key:**' `
+        + "(nor '**Upstream:** this repository' for a first-party folder)");
+    } else if (!Object.hasOwn(entries, key[1])) {
+      problems.push(`[authoring] skills/${name}/VENDOR.md names upstream key '${key[1]}', `
+        + 'which src/upstreams.json does not define');
+    }
+  }
+  return problems;
+}
+
+/** The files a `{{CREDIT:` may sit in: those `renderAll` derives a licence copy for, plus agents. */
+const CREDITABLE_RE = /^(?:skills\/[^/_][^/]*(?:\/[^/_][^/]*)?|agents\/[^/_][^/]*)\.md$/;
+
+/**
+ * Every credit ships with what it promises. A `{{CREDIT:<key>:…}}` key resolves in
+ * `src/upstreams.json`; every entry there is credited by a token or a VENDOR.md
+ * `**Upstream key:**`; its `licenseFile` exists (the emit copies it, and throws mid-build if
+ * not); its commit is an immutable sha. A token in a `_` partial is refused: it is included
+ * into other files, whose raw source `renderAll` scans for the licence copy, so it would credit
+ * without shipping the licence. A `licenseFile: null` is only for a key credited from a vendored
+ * folder alone, which ships its upstream's own LICENSE: anywhere else the licence text must
+ * ship with the work, so a token outside those folders needs a licence file.
+ */
+export function creditProblems(src = SRC) {
+  let entries;
+  try { entries = upstreams(src); } catch {
+    return ['[authoring] src/upstreams.json is not valid JSON'];
+  }
+  const problems = [];
+  const used = new Set();
+  /** key -> the first non-vendored file whose token credits it. */
+  const needsLicence = new Map();
+  for (const file of rglob(src)) {
+    if (!file.endsWith('.md') || !isFile(file)) continue;
+    const rel = path.relative(src, file).split(path.sep).join('/');
+    const text = readText(file);
+    const vendorKey = path.basename(file) === 'VENDOR.md' && /\*\*Upstream key:\*\*\s*(\S+)/.exec(text);
+    if (vendorKey) used.add(vendorKey[1]);
+    if (!text.includes('{{CREDIT:')) continue;
+    if (!CREDITABLE_RE.test(rel)) {
+      problems.push(`[authoring] ${rel} carries a {{CREDIT:}} token, but only skills/<stem>.md, `
+        + 'skills/<stem>/*.md and agents/*.md may — the licence copy is derived for those alone');
+      continue;
+    }
+    for (const key of new Set([...text.matchAll(CREDIT_RE)].map((m) => m[1]))) {
+      used.add(key);
+      const sp = rel.split('/');
+      if (!(sp.length > 2 && VENDORED_SKILL_DIRS.has(sp[1])) && !needsLicence.has(key)) needsLicence.set(key, rel);
+      if (!Object.hasOwn(entries, key)) {
+        problems.push(`[authoring] ${rel} credits '${key}', which src/upstreams.json does not define`);
+      }
+    }
+  }
+  for (const [key, u] of Object.entries(entries)) {
+    const where = `src/upstreams.json entry '${key}'`;
+    if (!used.has(key)) problems.push(`[authoring] ${where} is credited by no {{CREDIT:}} token and no VENDOR.md`);
+    const pin = String(u.commit ?? '');
+    if (MOVING_REFS.has(pin.toLowerCase())) {
+      problems.push(`[authoring] ${where} pins '${pin}', a moving branch — record the commit sha instead`);
+    } else if (!HEX40_RE.test(pin.toLowerCase())) {
+      problems.push(`[authoring] ${where} pin '${pin}' is not a 40-character commit sha`);
+    }
+    for (const field of ['repo', 'author', 'license']) {
+      if (!u[field]) problems.push(`[authoring] ${where} has no '${field}'`);
+    }
+    if (u.frozen !== undefined && typeof u.frozen !== 'boolean') {
+      problems.push(`[authoring] ${where} has frozen ${JSON.stringify(u.frozen)}, which is not a boolean`);
+    }
+    if (!u.licenseFile) {
+      if (needsLicence.has(key)) {
+        problems.push(`[authoring] ${where} has licenseFile null, but ${needsLicence.get(key)} credits it `
+          + 'outside a vendored folder — its licence text must ship with the work');
+      }
       continue;
     }
-    if (upstream[1].toLowerCase().startsWith('this')) continue;  // first-party
-    const pin = /\*\*Commit:\*\*\s*(\S+)/.exec(text);
-    if (!pin) {
-      problems.push(`[authoring] skills/${name}/VENDOR.md has no '**Commit:**' pin`);
-    } else if (MOVING_REFS.has(pin[1].toLowerCase())) {
-      problems.push(`[authoring] skills/${name}/VENDOR.md pins '${pin[1]}', a `
-        + 'moving branch — record the commit sha instead');
-    } else if (!HEX40_RE.test(pin[1].toLowerCase())) {
-      problems.push(`[authoring] skills/${name}/VENDOR.md pin '${pin[1]}' is not `
-        + 'a 40-character commit sha');
+    // The emit copies it into every install, so it must be a file of this tree.
+    if (!within(path.resolve(src, u.licenseFile), path.resolve(src))) {
+      problems.push(`[authoring] ${where} names licenseFile '${u.licenseFile}', which resolves outside src/`);
+    } else if (!isFile(path.join(src, u.licenseFile))) {
+      problems.push(`[authoring] ${where} names licenseFile '${u.licenseFile}', which does not exist under src/`);
     }
   }
   return problems;

package/js/inspect/diff.mjs

@@ -49,7 +49,7 @@ import {
 } from '../hosts/hosts.mjs';
 import {
   EMIT_HOST_SCOPE, defaultTheme, doctrinesForBuild, excludedRulesOfDir,
-  excludedSkillsOfDir, gatesOfDir,
+  excludedSkillsOfDir, gatesOfDir, kitsOfDir,
   footprintOfDir, modeOfDir, postureOfDir,
   trustOfDir,
   readJsonMaybe, readMaybe, themeOfDir,
@@ -265,6 +265,8 @@ export function diffCollect({
     excludeRules: excludedRulesOfDir(dir),
     // The excluded skills, or every skill the install left out reads as deleted.
     excludeSkills: excludedSkillsOfDir(dir),
+    // The kits on, or every kit file reads as added and the Kits block as drift.
+    kits: kitsOfDir(dir),
     // The gate switches, or a disarmed install reads its `<gate>: off` line as drift.
     ...gatesOfDir(dir),
   };

package/js/inspect/inventory.mjs

@@ -96,6 +96,7 @@ export const SKILL_CLASS = {
   develop: 'build', refactor: 'build', debug: 'build', dependencies: 'build',
   'frontend-design': 'build', prototype: 'build', deck: 'build',
   'forge-mcp': 'build', bruno: 'build', worktree: 'build',
+  'spring-boot': 'build', 'spring-data-jpa': 'build', 'spring-testing': 'build',
   'geneseed-code-review': 'review', 'fresh-eyes': 'review', 'security-audit': 'review',
   'roast-me': 'review', 'review-response': 'review', ponytail: 'review',
   commit: 'ship', ship: 'ship', release: 'ship', handoff: 'ship',

package/js/inspect/status.mjs

@@ -58,12 +58,12 @@
 import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import path from 'node:path';
 
-import { GATE_SWITCHES, THEMES, ROOT, makeCfg } from '../build/source.mjs';
+import { GATE_SWITCHES, THEMES, ROOT, loadKits, makeCfg } from '../build/source.mjs';
 import { tuiInventory } from './inventory.mjs';
 import { readVersion, sourceFingerprint } from '../build/version.mjs';
 import {
   claudeConfigDir, bobConfigDir, openclaudeConfigDir, opencodeConfigDir, opencodeShadowedInstall,
-  isHostGlobalDir, resolvePath, resolveMemoryDir, sovereignBypass, CLAUDE_STYLE, GATE_LEDGER,
+  isHostGlobalDir, resolvePath, resolveMemoryDir, sovereignBypass, CLAUDE_STYLE, GATE_LEDGER, HOSTS,
 } from '../hosts/hosts.mjs';
 // P5f moved the install DETECTORS out of this file — `diff` renders its expected copy in the
 // deployed theme and footprint, and `rebuild-all` re-emits in the deployed everything, so
@@ -238,6 +238,40 @@ export function gateSummary(cfgDirs, platform = process.platform) {
 }
 
 /** `_harness_status._status_data`. */
+/**
+ * Spec R6: the member files of every kit NOT on in this install that are still on disk — the ones
+ * `pruneOwned` kept because their owner edited them — as `{ kit: [rel, ...] }`, or `null` when
+ * there are none. No new state: the kit manifests say which rels a member owns (`skills/<m>.md`,
+ * `skills/<m>/...`, `agents/<m>.md`), the install's layer dir says where to look.
+ */
+export function keptKitFiles(host, scope, root, active) {
+  const marker = HOSTS.find((h) => h.host === host)?.projectMarker;
+  const dir = scope === 'global' || !marker ? root : path.join(root, marker);
+  const walk = (rel) => {
+    const abs = path.join(dir, rel);
+    let entries;
+    try { entries = readdirSync(abs, { withFileTypes: true }); } catch { return []; }
+    return entries.flatMap((e) => (e.isDirectory() ? walk(`${rel}/${e.name}`)
+      : e.isFile() ? [`${rel}/${e.name}`] : []));
+  };
+  const kept = {};
+  let kits;
+  try { kits = loadKits(); } catch (e) {
+    process.stderr.write(`warning: kit rows skipped — ${e.message}\n`);
+    return null;
+  }
+  for (const [kit, m] of kits) {
+    if (active.includes(kit)) continue;
+    const rels = [
+      ...(m.skills ?? []).flatMap((n) => [`skills/${n}.md`].filter((r) => existsSync(path.join(dir, r)))
+        .concat(walk(`skills/${n}`))),
+      ...(m.agents ?? []).map((n) => `agents/${n}.md`).filter((r) => existsSync(path.join(dir, r))),
+    ].sort();
+    if (rels.length) kept[kit] = rels;
+  }
+  return Object.keys(kept).length ? kept : null;
+}
+
 export function statusData() {
   const inst = installedDefaults();
   const theme = inst.theme || defaultTheme();
@@ -304,10 +338,12 @@ export function statusData() {
     installs: installTargets().map(([host, scope, root]) => {
       try {
         const p = installProfile(host, scope, root);
+        // Only when something is kept, so `--json` without kits stays the bytes it was.
+        const kept = keptKitFiles(host, scope, root, p.kits);
         const rebuild = legacyProcessCarrierOfDir(root, host)
           ? "geneseed setup  # pre-comms carrier (names 'process 8') — run setup for this install, not a rebuild"
           : rebuildCommand(p.argv);
-        return { ...p, rebuild };
+        return { ...p, ...(kept ? { keptKitFiles: kept } : {}), rebuild };
       } catch (e) {
         return { host, scope, root, state: 'unreadable', error: String(e?.message ?? e) };
       }
@@ -422,10 +458,15 @@ export function statusLines(d, color = false) {
     const excl = p.excludeRules?.length ? `excluding ${p.excludeRules.join(',')}` : 'no rules excluded';
     rows.push([`${p.host}:${p.scope}`, [p.state, p.theme, p.footprint, `${p.posture}/${p.mode}/${p.trust}`,
       packs, excl, ...(p.excludeSkills?.length ? [`skills off: ${p.excludeSkills.join(',')}`] : []),
+      ...(p.kits?.length ? [`kits: ${p.kits.join(',')}`] : []),
       // Each elided when armed. The law's text still binds; only its tool-boundary gate is off.
       ...GATE_SWITCHES.filter((g) => p[g.key] === false)
         .map((g) => `${g.marker.toLowerCase()}: off (Law ${g.law} text still binds)`)]
       .join(` ${DOT} `) + where]);
+    // R6: a member its owner edited outlives its kit; name it, so turning the kit off is visible.
+    for (const [kit, rels] of Object.entries(p.keptKitFiles ?? {})) {
+      rows.push([`${p.host}:${p.scope}`, `kept from inactive kit ${kit}: ${rels.join(', ')}${where}`]);
+    }
   }
 
   const labelW = Math.max(...rows.map(([k]) => codePointLength(k)));

package/js/inspect/validate.mjs

@@ -34,8 +34,8 @@ export const VALIDATE_USAGE = [
   'usage: geneseed validate [-h] [--theme THEME] [--emit EMIT] [--out OUT] [--root ROOT]',
   '                         [--footprint {lean,full}] [--posture POSTURE] [--mode MODE]',
   '                         [--trust TRUST] [--doctrines DOCTRINES] [--exclude-rules RULES]',
-  '                         [--exclude-skills SKILLS] [--no-secrets-gate] [--no-done-gate]',
-  '                         [--no-deletion-gate] [-v]',
+  '                         [--exclude-skills SKILLS] [--kits KITS] [--no-secrets-gate]',
+  '                         [--no-done-gate] [--no-deletion-gate] [-v]',
   '',
   "Render and emit into a throwaway sandbox, run the doctor's checks, and write nothing real.",
   "Takes the generator's render flags (see geneseed-build --help) except --sync-themes and",
@@ -130,7 +130,7 @@ export function cmdValidate(args) {
     const opts = {
       theme: args.theme, footprint: args.footprint, posture: args.posture, mode: args.mode,
       trust: args.trust, doctrines: args.doctrines, excludeRules: args.excludeRules,
-      excludeSkills: args.excludeSkills,
+      excludeSkills: args.excludeSkills, kits: args.kits,
       ...Object.fromEntries(GATE_SWITCHES.map((g) => [g.key, args[g.arg] ? false : null])),
     };
     let scanDirs;

package/js/maintain/setup.mjs

@@ -46,7 +46,7 @@ import path from 'node:path';
 
 import { main as driverMain, resolveOut } from '../build/driver.mjs';
 import { playLine } from '../ui/anim.mjs';
-import { discoverNames, GATE_SWITCHES, PACK_ORDER } from '../build/source.mjs';
+import { discoverNames, GATE_SWITCHES, PACK_ORDER, loadKits } from '../build/source.mjs';
 import { exportImprovements } from '../inspect/diff.mjs';
 import { cmdDoctor } from '../inspect/doctor.mjs';
 import { setupBuildArgs } from '../build/generate.mjs';
@@ -227,6 +227,28 @@ function askDoctrines(deployed = null) {
     known === null || known.includes(name) ? 'yes' : 'no') === 'yes');
 }
 
+/**
+ * The Kits question (spec A5): one pick, a kit or `none`, defaulting to what the install has on
+ * (`deployed`, its `Active kits:` marker). Asked ONLY when this checkout ships a kit, so a kit-less
+ * wizard reads exactly the stdin it always did (and has no kit to carry: `kitsOfDir` drops an unshipped one).
+ * Returns the kit list, or null for none (`setupBuildArgs` omits `--kits`).
+ */
+export function askKits(deployed = null, kits = null) {
+  try { kits ??= loadKits(); } catch (e) {
+    process.stderr.write(`warning: kit question skipped — ${e.message}\n`);
+    return null;
+  }
+  const on = (deployed ?? []).filter((k) => kits.has(k));
+  if (!kits.size) return null;
+  const opts = [...kits].map(([k, m]) => [k, m.description ?? '']);
+  // shortcut: one pick per run, so several deployed kits are offered as one "keep" option; ask
+  // per kit once a second kit ships.
+  if (on.length > 1) opts.push([on.join(','), 'keep the installed kits']);
+  opts.push(['none', 'no kit']);
+  const pick = askChoice('Kits', opts, on.length ? on.join(',') : 'none');
+  return pick === 'none' ? null : pick.split(',');
+}
+
 /**
  * `_harness_setup._collect_setup_lines` — the six questions, the plan, the confirm.
  *
@@ -260,13 +282,15 @@ function targetGates(emit, out) {
   }
 }
 
-export function collectSetupLines() {
+export function collectSetupLines(kitMap = null) {
   printOut('Geneseed setup — answer a few questions; nothing is written until you confirm.\n');
   const inst = installedDefaults();
   const theme = askChoice('Theme', themeOptions(), inst.theme || defaultTheme());
   const posture = askChoice('Posture', postureOptions(), inst.posture || defaultPosture());
   const mode = askChoice('Mode', modeOptions(), inst.mode || defaultMode());
   const doctrines = askDoctrines(inst.doctrines);
+  // Kits on stay on (spec A3); `kitsOfDir` already dropped a retired one.
+  const kits = askKits(inst.kits, kitMap);
   const emit = askChoice('Install mode', EMIT_OPTIONS, inst.emit || 'opencode-global');
   const footprint = askChoice('Footprint', FOOTPRINT_OPTIONS,
     inst.footprint || 'lean');
@@ -304,13 +328,13 @@ export function collectSetupLines() {
   const gated = Object.values(gates).some((on) => on === false);
   printOut(`\nAbout to run:  geneseed build ${
     setupBuildArgs(theme, emit, out, root, footprint, posture, mode, doctrines, allPacks,
-      excludeRules, undefined, excludeSkills, gates).join(' ')}\n`);
+      excludeRules, undefined, excludeSkills, gates, kits).join(' ')}\n`);
   if (!confirm('Proceed?', true)) return null;
   // The key only when there is something to carry, so a selection that excludes no skill and
   // switches off no gate is the same object it was before either existed.
   return {
     theme, posture, mode, doctrines, excludeRules, ...(excludeSkills ? { excludeSkills } : {}),
-    ...(gated ? { gates } : {}),
+    ...(gated ? { gates } : {}), ...(kits ? { kits } : {}),
     emit, out, root, footprint,
   };
 }
@@ -494,7 +518,7 @@ export function setupLines() {
   }
   const {
     theme, emit, out, root, footprint = 'lean', posture = 'peer', mode = 'direct',
-    doctrines = null, excludeRules = null, excludeSkills = null, gates = {},
+    doctrines = null, excludeRules = null, excludeSkills = null, gates = {}, kits = null,
   } = sel;
   if (emit === 'opencode-global') {
     // The build below overwrites the deployed global harness, and the self-improvement loops
@@ -513,7 +537,7 @@ export function setupLines() {
   // runs must carry the pack selection the plan line just previewed, or the wizard would print
   // one command and run another.
   const argv = setupBuildArgs(theme, emit, out, root, footprint, posture, mode, doctrines,
-    doctrineOptions().map(([n]) => n), excludeRules, undefined, excludeSkills, gates);
+    doctrineOptions().map(([n]) => n), excludeRules, undefined, excludeSkills, gates, kits);
   printOut(`Running:  geneseed build ${argv.join(' ')}\n`);
   const rc = driverMain(argv);
   if (rc !== 0) {

package/js/maintain/update.mjs

@@ -632,7 +632,7 @@ export async function installAxes(dir, { installProfile, setupBuildArgs }, notif
   if (legacyProcessCarrierOfDir(String(dir), 'opencode')) return null;
   const p = installProfile('opencode', 'global', String(dir), notify);
   return setupBuildArgs('', 'files', null, null, p.footprint, p.posture, p.mode, p.doctrines,
-    undefined, p.excludeRules, p.trust, p.excludeSkills, p).slice(4);
+    undefined, p.excludeRules, p.trust, p.excludeSkills, p, p.kits).slice(4);
 }
 
 /**