geneseed 4.9.4 → 4.14.0

package/docs/web-ui.md

@@ -114,6 +114,11 @@ streams the output of background jobs and keeps their history across reloads.
   **Promote to rule** control turns a recurring lesson into a trial rule in
   `user-rules.md` — provenance recorded, the source fact deleted so it isn't loaded
   twice — landing you on the Rules page.
+- **Kits** (`#/kits`, `#/kits/<kit>`) — the list of shipped kits and, per kit, a detail page
+  with its rules, word budget, banned APIs, upstream credits and one switch per install.
+  `GET /api/kits` carries `rules`, `rulesWordBudget`, `banned` and `credits` per kit; the
+  catalog and item endpoints for skills and agents carry `kit` (the owning kit or `null`),
+  which the Library shows as a `kit:` badge.
 - **Loops** (`#/loops`) — the loop catalogue `geneseed loop` runs from, read-only, laid out
   like the Library: a rail of sections (**Templates**, **Bricks**, **Active**, each with its
   count; `#/loops/<section>/<item>` opens an entry), with the selected section's groups
@@ -194,6 +199,10 @@ streams the output of background jobs and keeps their history across reloads.
     card (shown once a global install exists) manages sovereign repos — folders where every
     global harness goes dormant (hooks stay silent, the global preamble never loads);
     add or remove one here, the web mirror of `harness exclude add|remove|list`.
+- **Kits** (`#/installs/kits`) — every install (disabled ones read-only) as a panel with one switch per kit.
+  Toggling only stages the set; **Apply** asks first, then rebuilds that install with
+  exactly that set as a console job. Files you edited in a kit that is now off are kept,
+  and the row lists them.
 - **Settings** (`#/settings`) — a **Console direction** picker (the visual flavour of the
   console: Cultivar, Operator, Matrix or Atlas) with a **Dashboard layout** control (Auto follows each theme's designed Status
   lens; Cultivar / Greenhouse / Operator / Journal force one regardless of skin), the

package/harness.config.json

@@ -2,5 +2,5 @@
   "_comment": "version is a human-readable release label only; the canonical identity of an installed harness is the source fingerprint stamped in .geneseed-version (see `harness version`), not this string.",
   "theme": "neutral",
   "product": "Geneseed",
-  "version": "4.9.4"
+  "version": "4.14.0"
 }

package/js/build/args.mjs

@@ -11,7 +11,8 @@ import { parseArgs as nodeParseArgs } from 'node:util';
 import { withPlatformNewlines } from '../lib/fs.mjs';
 import path from 'node:path';
 import {
-  CONFIG, discoverNames, GATE_SWITCHES, PACK_ORDER, knownRuleIds, knownSkillIds, linkedSkillIds, resolveSkillNames,
+  CONFIG, discoverNames, GATE_SWITCHES, PACK_ORDER, SRC, knownRuleIds, knownSkillIds, linkedSkillIds, loadKits,
+  resolveSkillNames, skillAliases,
 } from './source.mjs';
 // The loop engine's trust presets — the `--trust` choices. `score.mjs` imports nothing, which is
 // what lets it sit inside this module's `child_process` ban.
@@ -32,7 +33,7 @@ const EMITS = ['files', 'opencode', 'opencode-global', 'claude', 'claude-global'
 export function configDefaults() {
   const d = {
     theme: 'neutral', posture: 'peer', mode: 'direct', trust: DEFAULT_PRESET,
-    doctrines: [...PACK_ORDER], excludeRules: [], excludeSkills: [],
+    doctrines: [...PACK_ORDER], excludeRules: [], excludeSkills: [], kits: [],
   };
   if (!existsSync(CONFIG)) return d;
   try {
@@ -96,6 +97,7 @@ export function configDefaults() {
 const VALUED = {
   '--theme': 'theme', '--posture': 'posture', '--mode': 'mode', '--trust': 'trust',
   '--doctrines': 'doctrines', '--exclude-rules': 'excludeRules', '--exclude-skills': 'excludeSkills',
+  '--kits': 'kits',
   '--out': 'out', '--target': 'out', '--emit': 'emit',
   '--footprint': 'footprint', '--root': 'root', '--config-dir': 'cfgDir',
 };
@@ -196,13 +198,13 @@ function parseExcludeRules(value) {
  * through `resolveSkillNames` and leave one stderr line each; the linked refusal stays for a
  * name typed as itself.
  */
-function parseExcludeSkills(value) {
+export function parseExcludeSkills(value, src = SRC) {
   const s = value.trim();
   if (s === 'none' || s === '') return [];
-  const known = knownSkillIds();
-  const linked = linkedSkillIds();
+  const known = knownSkillIds(src);
+  const linked = linkedSkillIds(src);
   const names = s.split(',').map((x) => x.trim()).filter(Boolean);
-  const { ids, notices, unknown } = resolveSkillNames(names, { known, linked });
+  const { ids, notices, unknown } = resolveSkillNames(names, { known, linked, aliases: skillAliases(src) });
   if (unknown.length) {
     die(2, `argument --exclude-skills: unknown skill '${unknown[0]}' (choose from `
       + `${known.filter((k) => !linked.includes(k)).join(', ')}, or 'none')`);
@@ -216,6 +218,23 @@ function parseExcludeSkills(value) {
   return ids;
 }
 
+/**
+ * `--kits a,b` / `--kits none` -> the cfg's kit list, sorted and deduped for the same marker
+ * stability as `--exclude-skills`. `none` and '' mean no kits; an unknown kit is refused, naming
+ * the known ones (spec R1). No `harness.config.json` key feeds it, for `excludeSkills`' reason.
+ */
+export function parseKits(value, known = [...loadKits().keys()]) {
+  const s = value.trim();
+  if (s === 'none' || s === '') return [];
+  const names = [...new Set(s.split(',').map((x) => x.trim()).filter(Boolean))].sort();
+  const unknown = names.find((n) => !known.includes(n));
+  if (unknown) {
+    const choices = known.length ? `${known.join(', ')}, or 'none'` : "'none'";
+    die(2, `argument --kits: unknown kit '${unknown}' (choose from ${choices})`);
+  }
+  return names;
+}
+
 /**
  * `--doctrines craft,rigor` / `--doctrines none` -> the cfg's pack array.
  *
@@ -313,6 +332,7 @@ export function parseArgs(argv, defaults) {
     doctrines: defaults.doctrines,
     excludeRules: defaults.excludeRules,
     excludeSkills: defaults.excludeSkills ?? [],
+    kits: defaults.kits ?? [],
     out: 'Harness', emit: 'files', footprint: 'lean', root: null,
     syncThemes: false, validateOnly: false, verbose: false,
     ...Object.fromEntries(GATE_SWITCHES.map((g) => [g.arg, false])),
@@ -356,6 +376,7 @@ export function parseArgs(argv, defaults) {
   if (typeof args.doctrines === 'string') args.doctrines = parseDoctrines(args.doctrines);
   if (typeof args.excludeRules === 'string') args.excludeRules = parseExcludeRules(args.excludeRules);
   if (typeof args.excludeSkills === 'string') args.excludeSkills = parseExcludeSkills(args.excludeSkills);
+  if (typeof args.kits === 'string') args.kits = parseKits(args.kits);
   return args;
 }
 

package/js/build/driver.mjs

@@ -65,6 +65,7 @@ import {
 // registry to find every install it must re-emit, and a CLI verb may not reach into a driver
 // for a reader. See js/inspect/registry.mjs.
 import { registryRecord, registryRoots } from '../inspect/registry.mjs';
+import { kitsOfDir } from '../hosts/installs.mjs';
 
 // P2. `--sync-themes` crossed into its own module rather than into this file: it is 90 lines
 // of textual surgery over committed files with a corpus of its own, and it is the half of the
@@ -651,12 +652,12 @@ const PROJECT_EMITS = {
  * carry straight past the parameter default.
  */
 function axesCfg({
-  posture, mode, trust, doctrines, excludeRules, excludeSkills, ...gates
+  posture, mode, trust, doctrines, excludeRules, excludeSkills, kits, ...gates
 }) {
   return makeCfg({
     ...(posture ? { posture } : {}), ...(mode ? { mode } : {}), ...(trust ? { trust } : {}),
     ...(doctrines ? { doctrines } : {}), ...(excludeRules ? { excludeRules } : {}),
-    ...(excludeSkills ? { excludeSkills } : {}),
+    ...(excludeSkills ? { excludeSkills } : {}), ...(kits ? { kits } : {}),
     // The gate switches (`GATE_SWITCHES` keys): only an explicit `false` disarms; `null` (no
     // opinion) keeps the gate.
     ...Object.fromEntries(GATE_SWITCHES.filter((g) => gates[g.key] === false).map((g) => [g.arg, true])),
@@ -665,7 +666,7 @@ function axesCfg({
 
 export function emitProjectInto(host, {
   theme, out, root, footprint = 'full', posture = null, mode = null, trust = null,
-  doctrines = null, excludeRules = null, excludeSkills = null, ...gates
+  doctrines = null, excludeRules = null, excludeSkills = null, kits = null, ...gates
 }) {
   const emit = PROJECT_EMITS[host];
   // The axes ride the same rail into every `*Into`, and for the same reason: a drift reader
@@ -674,7 +675,7 @@ export function emitProjectInto(host, {
   // checked an all-packs render nobody asked for.
   return withPlatformNewlines(() => emit(
     axesCfg({
-      posture, mode, trust, doctrines, excludeRules, excludeSkills, ...gates }),
+      posture, mode, trust, doctrines, excludeRules, excludeSkills, kits, ...gates }),
     { theme, footprint, root }, out,
   ));
 }
@@ -689,16 +690,16 @@ export function emitProjectInto(host, {
  */
 export function buildInto({
   theme, out, footprint = 'lean', posture = null, mode = null, trust = null, doctrines = null,
-  excludeRules = null, excludeSkills = null, ...gates
+  excludeRules = null, excludeSkills = null, kits = null, ...gates
 }) {
   return withPlatformNewlines(() => build(axesCfg({
-    posture, mode, trust, doctrines, excludeRules, excludeSkills, ...gates }),
+    posture, mode, trust, doctrines, excludeRules, excludeSkills, kits, ...gates }),
     theme, out, { footprint, nativeCatalog: false }));
 }
 
 export function emitGlobalInto(host, {
   theme, out, cfgDir, footprint, posture = null, mode = null, doctrines = null, trust = null,
-  excludeRules = null, excludeSkills = null, ...gates
+  excludeRules = null, excludeSkills = null, kits = null, ...gates
 }) {
   // `build.HOSTS.get(host, build.HOSTS["opencode"])` — an unknown host falls back rather than
   // raising, because the host comes from a marker file a user can edit.
@@ -715,7 +716,7 @@ export function emitGlobalInto(host, {
   // the same scar the footprint left in `diffCollect`, one axis over each time.
   return withPlatformNewlines(() => emit(
     axesCfg({
-      posture, mode, trust, doctrines, excludeRules, excludeSkills, ...gates }),
+      posture, mode, trust, doctrines, excludeRules, excludeSkills, kits, ...gates }),
     { theme, footprint, root: null, cfgDir }, out,
   ));
 }
@@ -749,6 +750,25 @@ export function main(argv) {
   });
 }
 
+/**
+ * Spec B3: a build does what its flags say, so one without `--kits` turns off a kit the target
+ * install has on. Said BEFORE the emit rewrites the marker. The target is the emit's own: the
+ * config dir for a `-global` emit, `out` otherwise. `kitsOfDir` has already dropped a kit this
+ * checkout no longer ships, so the advice never names one `--kits` would refuse. Best-effort.
+ */
+function warnDroppedKits(args, out) {
+  try {
+    const global = args.emit.endsWith('-global');
+    const host = global ? args.emit.slice(0, -'-global'.length) : (args.emit === 'files' ? null : args.emit);
+    const target = global ? (args.cfgDir ?? HOSTS.find((h) => h.host === host).configDir()) : out;
+    for (const k of kitsOfDir(target, host).filter((x) => !args.kits.includes(x))) {
+      process.stderr.write(`[geneseed] WARN: this install has kit ${k}; this build turns it off — `
+        + `pass --kits ${k} to keep it
+`);
+    }
+  } catch { /* a warning never fails a build */ }
+}
+
 function run(argv) {
   const args = parseArgs(argv, configDefaults());
 
@@ -783,6 +803,7 @@ function run(argv) {
     args.cfgDir = resolveOut(args.cfgDir);
   }
   const cfg = makeCfg(args);
+  warnDroppedKits(args, out);
 
   // The marker directory is the emit's TARGET, which for a global emit is the config dir it
   // just rendered into and not `--out` at all — so the emit returns it rather than the

package/js/build/emit-claude.mjs

@@ -19,7 +19,7 @@ import { assertSourceComplete, phaseLog, ensureMemoryStore } from './bundle.mjs'
 import {
   claimAndWrite, globalMemory, globalNotebook, shipLeanLaws, stripCapabilityLinks,
 } from './emit-common.mjs';
-import { renderAll, renderFile } from './render.mjs';
+import { kitsBody, renderAll, renderFile } from './render.mjs';
 import {
   BOB_RULES_STUB, ensureContextStub, ensureExcludesStub, ensureNotebookIndex,
   ensureProfileStub,
@@ -82,6 +82,8 @@ export function emitClaudeRender(cfg, job) {
       ptheme[tok] = prefix + (ptheme[tok] ?? tok.split('_').slice(1).join('_').toLowerCase());
     }
     ptheme.AT_HARNESS = prefix;
+    // The Kits block was substituted with the unprefixed DIR_* tokens; rebuild it, or its links dangle.
+    ptheme.KITS_BODY = kitsBody(cfg, ptheme, '');
     // Same catalogue decision as the renderAll above — a re-render that forgot it would
     // quietly put the stripped tables back.
     return renderFile(cfg, tmplItem.src, ptheme, footprint, '', new Set(), nativeCatalog);

package/js/build/generate.mjs

@@ -40,7 +40,7 @@ import { DEFAULT_PRESET } from '../loop/score.mjs';
 import { opencodeConfigDir, resolvePath } from '../hosts/hosts.mjs';
 import {
   EMIT_HOST_SCOPE, defaultMode, defaultPosture, defaultTheme, doctrinesForBuild,
-  excludedRulesOfDir, excludedSkillsOfDir, footprintOfDir, gatesOfDir, installState, installTargets,
+  excludedRulesOfDir, excludedSkillsOfDir, footprintOfDir, kitsOfDir, gatesOfDir, installState, installTargets,
   legacyProcessCarrierOfDir, modeOfDir, postureOfDir, readMaybe, themeOfDir, trustOfDir,
 } from '../hosts/installs.mjs';
 import { colorThemeFiles, colorThemeJson, PALETTE_ROLES } from '../hosts/opencode.mjs';
@@ -95,7 +95,7 @@ function sysExit(msg) {
 const BUILD_FORWARD = [
   ['theme', '--theme'], ['emit', '--emit'], ['footprint', '--footprint'],
   ['posture', '--posture'], ['mode', '--mode'], ['trust', '--trust'], ['doctrines', '--doctrines'],
-  ['excludeRules', '--exclude-rules'], ['excludeSkills', '--exclude-skills'], ['out', '--out'], ['root', '--root'],
+  ['excludeRules', '--exclude-rules'], ['excludeSkills', '--exclude-skills'], ['kits', '--kits'], ['out', '--out'], ['root', '--root'],
   ['configDir', '--config-dir'],
 ];
 
@@ -141,7 +141,7 @@ export function cmdBuild(args) {
  */
 export function setupBuildArgs(theme, emit, out = null, root = null, footprint = 'lean',
   posture = 'peer', mode = 'direct', doctrines = null, allPacks = PACK_ORDER,
-  excludeRules = null, trust = DEFAULT_PRESET, excludeSkills = null, gates = {}) {
+  excludeRules = null, trust = DEFAULT_PRESET, excludeSkills = null, gates = {}, kits = null) {
   const argv = ['--theme', theme, '--emit', emit];
   if (!emit.endsWith('-global')) {
     if (out) argv.push('--out', out);
@@ -174,6 +174,9 @@ export function setupBuildArgs(theme, emit, out = null, root = null, footprint =
   // `gates` is one object keyed as `GATE_SWITCHES` keys it (`gatesOfDir`, a profile, a body).
   // Law order, so a Law IV-only install still ends on `--no-deletion-gate` as it did.
   for (const g of GATE_SWITCHES) if (gates?.[g.key] === false) argv.push(g.flag);
+  // Kits elide when none is on, as skills do: no config key feeds them, so absence and `none`
+  // are the same answer. Last, so an argv naming no kit is the bytes it always was.
+  if (kits?.length) argv.push('--kits', [...kits].sort().join(','));
   return argv;
 }
 
@@ -235,9 +238,11 @@ export function installProfile(host, scope, root, notify = null) {
   // The gate switches: a rebuild that forgot one would silently re-arm (or, read wrong, disarm)
   // the install. A missing marker reads as armed.
   const gates = gatesOfDir(root, host);
+  // Kits on stay on (spec A3); one this checkout no longer ships drops with a notice (R2).
+  const kits = kitsOfDir(root, host, notify);
   const out = scope === 'global' ? null : root;
   const argv = setupBuildArgs(theme, emit, out, out, footprint, posture, mode, doctrines,
-    PACK_ORDER, excludeRules, trust, excludeSkills, gates);
+    PACK_ORDER, excludeRules, trust, excludeSkills, gates, kits);
   // A GLOBAL ROW NAMES ITS OWN DIR. `root` came from the host's config-dir resolver, which
   // honours env overrides (`OPENCODE_CONFIG_DIR`, `CLAUDE_CONFIG_DIR`…); without the flag the
   // same argv run from a shell lacking that variable re-emits into the DEFAULT dir — a second
@@ -246,7 +251,7 @@ export function installProfile(host, scope, root, notify = null) {
   return {
     host, scope, root, state: installState(root, host, scope),
     emit, theme, footprint, posture, mode, trust, doctrines, excludeRules, excludeSkills,
-    ...gates, argv,
+    kits, ...gates, argv,
   };
 }
 

package/js/build/render.mjs

@@ -34,7 +34,10 @@ import { readText } from '../lib/fs.mjs';
 import { parseJson } from '../lib/json.mjs';
 import { normcase, comparePaths } from '../lib/paths.mjs';
 // `js/build/source.mjs` imports nothing but node builtins, so this direction cannot cycle.
-import { GATE_SWITCHES, PACK_ORDER, readPackText, resolveRuleIds, ruleCanon } from './source.mjs';
+import {
+  CREDIT_RE, GATE_SWITCHES, PACK_ORDER, kitMembers, loadKits, readPackText, resolveCredits, resolveRuleIds, ruleCanon, upstreamOf,
+} from './source.mjs';
+import { VENDORED_SKILL_DIRS } from '../hosts/native.mjs';
 import { DEFAULT_PRESET } from '../loop/score.mjs';
 
 /** Document STRUCTURE is theme-INDEPENDENT — mirrors `_build_render.STRUCTURE`. */
@@ -66,6 +69,9 @@ export const SRC_DIR_TOKENS = {
 };
 
 const TEXT_SUFFIXES = new Set(['.md', '.tmpl', '.json', '.txt', '.yml', '.yaml']);
+/** Top-level `src/` entries the build reads but never ships: upstream-credit provenance, and the
+ * kit manifests (a kit's members ship flat from `skills/` and `agents/`). */
+const NOT_BUNDLED = new Set(['upstreams.json', 'licenses', 'kits']);
 
 // Digits are legal after the first character: `DOC_<PACK>_<n>` (the doctrine rule titles) are
 // the first token names in the project to carry one, and without `0-9` here `{{DOC_CRAFT_1}}`
@@ -160,11 +166,59 @@ export function substitute(text, theme) {
 }
 
 /** `_build_render._resolve_catalogs`. */
-function resolveCatalogs(text, nativeCatalog, excludeSkills = []) {
+function resolveCatalogs(text, nativeCatalog, excludeSkills = [], cfg = null) {
   // `true`/`false` still mean "both kinds", for the plain-bundle callers that pass a boolean.
   const nat = nativeCatalog === true ? { skills: true, agents: true } : (nativeCatalog || {});
-  return text.replace(CATALOG_BLOCK_RE, (_m, kind, table, pointer) => (nat[kind] ? pointer
-    : kind === 'skills' ? dropExcludedSkillRows(table, excludeSkills) : table));
+  return text.replace(CATALOG_BLOCK_RE, (_m, kind, table, pointer) => {
+    if (nat[kind]) return pointer;
+    // Active kits' rows close the table, before `--exclude-skills` drops rows (R5: exclusion wins).
+    const full = withTableRows(table, activeKits(cfg).flatMap(([, m]) => m.catalogue?.[kind] ?? []));
+    return kind === 'skills' ? dropExcludedSkillRows(full, excludeSkills) : full;
+  });
+}
+
+/**
+ * `rows` inserted after the last row of the block's first table — inside it, not after the
+ * folder-skills list that follows §4's table (a table row there renders as broken markup). A
+ * block with no table gets them at its end; no rows returns the block as it was.
+ */
+function withTableRows(block, rows) {
+  if (!rows.length) return block;
+  const lines = block.split('\n');
+  let i = lines.findIndex((l) => l.startsWith('|'));
+  if (i < 0) i = lines.length - 1;
+  else while (i < lines.length && lines[i].startsWith('|')) i++;
+  lines.splice(i, 0, ...rows);
+  return lines.join('\n');
+}
+
+/** `loadKits(cfg.src)`, read once per cfg: a render asks for it per CATALOG block. */
+const KITS = new WeakMap();
+function kitsOf(cfg) {
+  let kits = KITS.get(cfg);
+  if (!kits) KITS.set(cfg, (kits = loadKits(cfg.src)));
+  return kits;
+}
+
+/** `[kit, manifest]` for each kit `cfg.kits` names, in its (sorted) order. */
+function activeKits(cfg) {
+  if (!cfg?.kits?.length) return [];
+  const kits = kitsOf(cfg);
+  return cfg.kits.map((k) => {
+    if (!kits.has(k)) throw new Error(`unknown kit '${k}' (no src/kits/${k}.json)`);
+    const m = kits.get(k);
+    if (typeof m.rules !== 'string') throw new Error(`src/kits/${k}.json has no 'rules' path`);
+    return [k, m];
+  });
+}
+
+/**
+ * The Kits block: each active kit's rules.md, rendered against `theme`. Exported because a
+ * carrier re-rendered with prefixed DIR_* tokens (`prefixedAgentText`) must rebuild it too.
+ */
+export function kitsBody(cfg, theme, lawsPrefix = '') {
+  return activeKits(cfg).map(([, m]) => `\n${renderFile(cfg, path.join(cfg.src, m.rules), theme,
+    'full', lawsPrefix).trim()}\n`).join('');
 }
 
 /**
@@ -240,8 +294,8 @@ function readSource(cfg, p) {
   let seen = SRC_TEXT.get(cfg);
   if (!seen) SRC_TEXT.set(cfg, (seen = new Map()));
   let text = seen.get(p);
-  // Rule ids resolve here, once per file, so every stage after sees the addressed form.
-  if (text === undefined) seen.set(p, (text = resolveRuleIds(readText(p), cfg.src)));
+  // Rule ids and credits resolve here, once per file, so every stage after sees the addressed form.
+  if (text === undefined) seen.set(p, (text = resolveCredits(resolveRuleIds(readText(p), cfg.src), cfg.src)));
   return text;
 }
 
@@ -276,7 +330,7 @@ export function renderFile(cfg, filePath, theme, footprint = 'full', lawsPrefix
     return inner;
   });
 
-  text = resolveCatalogs(text, nativeCatalog, cfg.excludeSkills ?? []);
+  text = resolveCatalogs(text, nativeCatalog, cfg.excludeSkills ?? [], cfg);
   text = resolveLean(text, footprint);
   return substitute(text, theme);
 }
@@ -444,6 +498,12 @@ export function effectiveTheme(cfg, themeName, { footprint = 'full', lawsPrefix
   const skipped = [...(cfg.excludeSkills ?? [])].sort();
   // It fills a template line of its own, so its value carries the blank line around it.
   theme.EXCLUDED_SKILLS_LINE = skipped.length ? `\nExcluded skills: ${skipped.join(', ')}\n` : '';
+  // Kits, under the same contract: both empty with no kit, so a default build stays
+  // byte-identical. The marker has the skills line's shape so one parser reads both; the block is
+  // each active kit's rules.md, plain text (no rule ids, no LEAN halves), the same at either footprint.
+  const kits = activeKits(cfg);
+  theme.KITS_LINE = kits.length ? `\nActive kits: ${kits.map(([k]) => k).join(', ')}\n` : '';
+  theme.KITS_BODY = kitsBody(cfg, theme, lawsPrefix);
   // The gate switches (`GATE_SWITCHES`: Laws I, III, IV), under the same contract: a line is
   // written only when its gate is OFF, so a default build stays byte-identical and a missing
   // line reads back as armed (`gatesOfDir`). The OpenCode plugins read these lines at load, so
@@ -488,7 +548,8 @@ export function destRel(rel) {
  *
  * Returns `{ theme, items }` where each item is `{ rel, text, src }` — `rel` is the
  * themed POSIX output path, `text` is the rendered text or `null` for a binary that the
- * caller copies from `src`. Python returns a tuple of tuples; the object form is the
+ * caller copies from `src`. A credited skill's licence copy also carries `licenceOf` (the
+ * skill's stem), since its `src` is not under that skill. Python returns a tuple of tuples; the object form is the
  * same data with the field names the Python docstring already uses.
  * @param {any} cfg
  * @param {string} themeName
@@ -500,11 +561,16 @@ export function renderAll(cfg, themeName, {
   const theme = effectiveTheme(cfg, themeName, { footprint, lawsPrefix });
   const items = [];
   const skipped = new Set(cfg.excludeSkills ?? []);
+  // Members of every kit `--kits` did not name: kit logic, not `excludeSkills`, so no marker.
+  const off = kitMembers(new Map([...kitsOf(cfg)].filter(([k]) => !(cfg.kits ?? []).includes(k))));
+  const licences = new Map();   // `<stem>/LICENSE-<key>.txt` -> the upstream's licence file
   for (const file of sortedSourceFiles(cfg.src)) {
     const rel = path.relative(cfg.src, file);
     // `--exclude-skills`: the one filter every host's emit and the plain bundle read through.
     const sp = rel.split(path.sep);
     if (sp[0] === 'skills' && sp.length >= 2 && skipped.has(sp[1].replace(/\.md$/, ''))) continue;
+    if (NOT_BUNDLED.has(sp[0])) continue;
+    if (sp.length >= 2 && Object.hasOwn(off, sp[0]) && off[sp[0]].has(sp[1].replace(/\.md$/, ''))) continue;
     const outRel = destRel(themedRel(rel, theme)).split(path.sep).join('/');  // as_posix()
     // The on-disk `laws/`, `ontology/` and `doctrines/` are the "complete text" the two lean
     // pointers promise — §1's and the Doctrines section's. They render at full whatever the
@@ -513,9 +579,26 @@ export function renderAll(cfg, themeName, {
     // accident, which is a different thing from shipping whole by contract.
     // Keyed on the SOURCE rel, not the themed one, so a DIR_* rename cannot un-exempt them.
     const fp = /^(?:laws|ontology|doctrines)[\\/]/.test(rel) ? 'full' : footprint;
-    items.push(TEXT_SUFFIXES.has(suffixOf(path.basename(file)))
-      ? { rel: outRel, text: renderFile(cfg, file, theme, fp, lawsPrefix, new Set(), nativeCatalog), src: file }
-      : { rel: outRel, text: null, src: file });
+    const text = TEXT_SUFFIXES.has(suffixOf(path.basename(file)))
+      ? renderFile(cfg, file, theme, fp, lawsPrefix, new Set(), nativeCatalog) : null;
+    items.push({ rel: outRel, text, src: file });
+    // A credited skill ships its upstream's licence beside it, one copy per (skill, key). The
+    // token is gone from `text`, so the raw source is scanned; an unknown key or a null
+    // licenseFile yields no copy. A vendored folder's VENDOR.md carries a credit too, but the
+    // folder already ships its upstream's LICENSE verbatim, so it gets no second copy.
+    const stem = sp[0] === 'skills' && sp.length >= 2 ? sp[1].replace(/\.md$/, '') : null;
+    if (stem && !VENDORED_SKILL_DIRS.has(stem) && text !== null) {
+      for (const [, key] of readText(file).matchAll(CREDIT_RE)) {
+        const lic = upstreamOf(key, cfg.src)?.licenseFile;
+        if (lic) licences.set(`${stem}/LICENSE-${key}.txt`, path.join(cfg.src, lic));
+      }
+    }
+  }
+  // Copied, not rendered (`text: null`): the licence ships byte for byte. `licenceOf` names the
+  // skill, because the copy's `src` is the upstream's file, not a path under that skill.
+  for (const [name, lic] of [...licences].sort(([a], [b]) => comparePaths(a, b))) {
+    items.push({ rel: destRel(themedRel(path.join('skills', name), theme)).split(path.sep).join('/'),
+      text: null, src: lic, licenceOf: name.split('/')[0] });
   }
   return { theme, items };
 }

package/js/build/source.mjs

@@ -90,6 +90,14 @@ export const RETIRED_RULE_IDS = {
   'absence-is-a-claim': { was: 'Law XI', liveAs: null, note: 'folded into verify-before-asserting' },
 };
 
+/**
+ * Kit ids that must never name a kit (`src/kits/<id>.json`), the reason beside each — the
+ * contract `RETIRED_RULE_IDS` keeps for rules. `none` was never a kit: `--kits none` means no kits.
+ */
+export const RETIRED_KIT_IDS = {
+  none: 'reserved: --kits none switches every kit off',
+};
+
 /** @type {Array<[number, string]>} */
 const ROMAN = [[1000, 'M'], [900, 'CM'], [500, 'D'], [400, 'CD'], [100, 'C'], [90, 'XC'],
   [50, 'L'], [40, 'XL'], [10, 'X'], [9, 'IX'], [5, 'V'], [4, 'IV'], [1, 'I']];
@@ -192,6 +200,82 @@ export function resolveRuleIds(text, src = SRC) {
     .replace(CITE_RE, (whole, kind, id) => { const r = known(kind, id); return r ? `*${r.name}*` : whole; });
 }
 
+/** `{{CREDIT:<key>:<path>}}` — `key` names a `src/upstreams.json` entry, `path` a file upstream. */
+export const CREDIT_RE = /\{\{CREDIT:([a-z0-9]+(?:-[a-z0-9]+)*):([A-Za-z0-9._/-]+)\}\}/g;
+
+const _upstreams = new Map();
+/**
+ * `src/upstreams.json`, parsed — memoised on its raw text the way `ruleCanon` is, so the web
+ * daemon sees an edit. A tree without the file credits nothing.
+ */
+export function upstreams(src = SRC) {
+  const file = path.join(src, 'upstreams.json');
+  let text;
+  // Not readRawText: its mtime key misses a rewrite inside one mtime tick (seen on Windows CI).
+  try { text = readFileSync(file, 'utf8'); } catch { return {}; }
+  const hit = _upstreams.get(file);
+  if (hit && hit.text === text) return hit.entries;
+  const entries = JSON.parse(text);
+  _upstreams.set(file, { text, entries });
+  return entries;
+}
+
+/** The entry a credit key names, or null — `hasOwn`, so `constructor` is not a key. */
+export function upstreamOf(key, src = SRC) {
+  const u = upstreams(src);
+  return Object.hasOwn(u, key) ? u[key] : null;
+}
+
+/**
+ * Resolve every credit in `text` into its attribution line. An unknown key is left exactly as
+ * written, as `resolveRuleIds` leaves an unknown id, so the doctor can name it.
+ */
+export function resolveCredits(text, src = SRC) {
+  if (!text.includes('{{CREDIT:')) return text;
+  return text.replace(CREDIT_RE, (whole, key, file) => {
+    const u = upstreamOf(key, src);
+    return u ? `*Adapted from [${u.repo}](https://github.com/${u.repo}) (\`${file}\`) `
+      + `by ${u.author} — ${u.license}, modified.*` : whole;
+  });
+}
+
+/**
+ * `src/kits/<kit>.json`, parsed, as `Map<kit, manifest>` in sorted kit order. A manifest is
+ * `{ description, skills, agents, rules, rulesWordBudget, catalogue, banned? }`, the sole writer of its
+ * kit's membership; the `<kit>/` folder beside it holds the kit's `rules.md` and is not read
+ * here. A tree without `src/kits/` has no kits.
+ */
+export function loadKits(src = SRC) {
+  const dir = path.join(src, 'kits');
+  let names;
+  try { names = readdirSync(dir).filter((n) => n.endsWith('.json')).sort(); } catch (e) {
+    if (e.code === 'ENOENT') return new Map(); // only an absent src/kits means "no kits"
+    throw new Error(`src/kits: ${e.message}`, { cause: e });
+  }
+  return new Map(names.map((n) => {
+    let m;
+    try { m = JSON.parse(readFileSync(path.join(dir, n), 'utf8')); } catch (e) {
+      throw new Error(`src/kits/${n}: ${e.message}`, { cause: e });
+    }
+    if (m === null || typeof m !== 'object' || Array.isArray(m)) throw new Error(`src/kits/${n}: a manifest must be a JSON object`);
+    if (m.banned !== undefined && !(Array.isArray(m.banned) && m.banned.every((b) => typeof b === 'string' && b))) {
+      throw new Error(`src/kits/${n}: 'banned' must be an array of non-empty strings`);
+    }
+    return [n.slice(0, -'.json'.length), m];
+  }));
+}
+
+/** Every skill and agent the kits handed in claim (a `loadKits` Map, or a subset of one). */
+export function kitMembers(kits) {
+  const skills = new Set();
+  const agents = new Set();
+  for (const m of kits.values()) {
+    for (const s of m.skills ?? []) skills.add(s);
+    for (const a of m.agents ?? []) agents.add(a);
+  }
+  return { skills, agents };
+}
+
 /**
  * `_build_core.ROOT` — the checkout, from this file's own location (`js/..`).
  *
@@ -295,20 +379,47 @@ export function knownSkillIds(src = SRC) {
  * not listed, so a new link protects its target the day it is written.
  */
 export function linkedSkillIds(src = SRC) {
-  const linked = new Set();
+  // A kit's links to its own members do not protect them (spec R5: excluding a kit skill is
+  // allowed); a kit file's link to a CORE skill still does, or excluding it would leave the link dead.
+  return [...new Set(specLinks(src).filter((l) => l.kind === 'skills' && !(l.kit && l.kit === l.owner))
+    .map((l) => l.name))].sort();
+}
+
+/**
+ * Every `{{DIR_SKILLS}}/<name>` / `{{DIR_AGENTS}}/<name>` link in `src`'s .md/.tmpl files, outside
+ * the §4 skills catalogue table: `{ rel, kind, name, kit, owner }`. `kit` is the kit that owns the
+ * file (`kits/<kit>.json`, `kits/<kit>/**`, a member's spec or side file), `owner` the kit the
+ * target is a member of; each null for core. `linkedSkillIds` and the doctor's R4 arm
+ * (`kitProblems`) read the same walk.
+ */
+export function specLinks(src = SRC) {
+  // Member -> its kit, per kind; the first kit wins a member two kits claim (R3 names that).
+  const owners = { skills: new Map(), agents: new Map() };
+  for (const [kit, m] of loadKits(src)) {
+    for (const kind of ['skills', 'agents']) for (const n of m[kind] ?? []) if (!owners[kind].has(n)) owners[kind].set(n, kit);
+  }
+  // Under kits/, only `<kit>.json` and `<kit>/**` belong to a kit; any other file there (a README) is nobody's.
+  const ofKit = (sp) => (sp[0] === 'kits'
+    ? (sp.length > 2 ? sp[1] : /\.json$/.test(sp[1]) ? sp[1].slice(0, -'.json'.length) : null)
+    : (sp.length >= 2 && Object.hasOwn(owners, sp[0]) && owners[sp[0]].get(sp[1].replace(/\.md$/, ''))) || null);
+  const links = [];
   const walk = (d) => {
     for (const e of readdirSync(d, { withFileTypes: true })) {
       const f = path.join(d, e.name);
       if (e.isDirectory()) walk(f);
       else if (/\.(md|tmpl)$/.test(e.name)) {
+        const sp = path.relative(src, f).split(path.sep);
         const text = readFileSync(f, 'utf8')
           .replace(/<!-- CATALOG:begin skills -->[\s\S]*?<!-- CATALOG:end -->/, '');
-        for (const m of text.matchAll(/\{\{DIR_SKILLS\}\}\/([a-z0-9-]+)/g)) linked.add(m[1]);
+        for (const m of text.matchAll(/\{\{DIR_(SKILLS|AGENTS)\}\}\/([a-z0-9-]+)/g)) {
+          const kind = m[1].toLowerCase();
+          links.push({ rel: sp.join('/'), kind, name: m[2], kit: ofKit(sp), owner: owners[kind].get(m[2]) ?? null });
+        }
       }
     }
   };
   walk(src);
-  return [...linked].sort();
+  return links;
 }
 
 /**
@@ -412,7 +523,7 @@ export const GATE_SWITCHES = [
  */
 export function makeCfg({
   posture = 'peer', mode = 'direct', trust = DEFAULT_PRESET, doctrines = PACK_ORDER,
-  excludeRules = [], excludeSkills = [], ...switches
+  excludeRules = [], excludeSkills = [], kits = [], ...switches
 } = {}) {
   return {
     root: ROOT,
@@ -440,6 +551,8 @@ export function makeCfg({
     excludeRules: Array.isArray(excludeRules) ? [...excludeRules] : [],
     // Skill names left out of this install — same "unspecified takes nothing away" default.
     excludeSkills: Array.isArray(excludeSkills) ? [...excludeSkills] : [],
+    // Kits switched on for this install — off unless named, so a default build is unchanged.
+    kits: Array.isArray(kits) ? [...kits] : [],
     // The gate switches (`GATE_SWITCHES`: `secretsGate`, `doneGate`, `deletionGate`), each armed
     // unless its `no*` arg says so in so many words: only a literal `true` disarms, so every
     // caller that never heard of a switch keeps the gate.

package/js/cli-table.json

@@ -193,6 +193,21 @@
           "type": null,
           "hidden": false
         },
+        {
+          "names": [
+            "--kits"
+          ],
+          "dest": "kits",
+          "metavar": null,
+          "help": "switch on opt-in kits, comma-separated; 'none' turns every kit off (default: no kits)",
+          "choices": null,
+          "default": null,
+          "required": false,
+          "nargs": null,
+          "is_flag": false,
+          "type": null,
+          "hidden": false
+        },
         {
           "names": [
             "--out"