@ainova-systems/intelligence 0.11.0-rc.1 → 0.11.0-rc.10

package/cli/commands/status.sh

@@ -1,32 +1,41 @@
 #!/bin/bash
-# intelligence status — project state at a glance.
+# intelligence status [--check] — project state or deep consistency checks.
 set -euo pipefail
 source "$CLI_DIR/lib/cli-common.sh"
 
+case "${1:-}" in
+    "") ;;
+    --check) [ $# -eq 1 ] || die "usage: intelligence status [--check]"; exec bash "$CLI_DIR/internal/check.sh" ;;
+    *) die "usage: intelligence status [--check]" ;;
+esac
+
 detect_project
 case "$IP_MODE" in
-    v2)
-        echo "Project:  $IP_ROOT (CLI setup)"
-        echo "Manifest: intelligence.yaml (sync_version $(read_engine_stamp "$IP_ROOT/intelligence.yaml"))"
+    cli)
+        echo "Project:  $IP_ROOT (Intelligence project)"
+        echo "Manifest: intelligence.yaml (schema_version $(read_schema_version "$IP_ROOT/intelligence.yaml"))"
         if [ -f "$IP_ROOT/intelligence.lock" ]; then
             echo "Lockfile: intelligence.lock"
+        elif [ -n "$(qmap_keys "$IP_ROOT/intelligence.yaml" "packages")" ]; then
+            echo "Lockfile: MISSING (manifest declares packages)"
         else
             echo "Lockfile: none (no packages added yet)"
         fi
-        if [ -f "$IP_ROOT/.intelligence/engine/.version" ]; then
-            echo "Store:    .intelligence/engine at $(tr -d ' \t\r\n' < "$IP_ROOT/.intelligence/engine/.version")"
+        sync_locked="$(qmap_field "$IP_ROOT/intelligence.lock" "packages" "$SYNC_PKG_NAME" "resolved")"
+        if [ -n "$sync_locked" ]; then
+            echo "Content:  $SYNC_PKG_NAME at $sync_locked"
         else
-            echo "Store:    not staged — run 'intelligence install'"
+            echo "Content:  no $SYNC_PKG_NAME (bare setup)"
         fi
-        echo "Engine:   $(bundled_engine_version) (bundled)"
+        echo "Engine:   $(bundled_engine_version) (bundled with the CLI)"
         ;;
     legacy)
-        echo "Project:  $IP_ROOT (vendored v1 setup)"
+        echo "Project:  $IP_ROOT (legacy Intelligence Sync)"
         echo "Umbrella: $IP_UMBRELLA"
         echo "Engine:   $(tr -d ' \t\r\n' < "$IP_MODULE_DIR/scripts/VERSION") (vendored at $IP_MODULE_DIR)"
-        echo "Stamp:    $(read_engine_stamp "$IP_UMBRELLA/config.yaml")"
+        echo "Stamp:    $(top_scalar "$IP_UMBRELLA/config.yaml" "sync_version")"
         echo ""
-        echo "Convert to the CLI setup: intelligence migrate"
+        echo "Convert to Intelligence: intelligence init"
         ;;
     *)
         echo "No intelligence project here. Start one: intelligence init"

package/cli/commands/sync.sh

@@ -5,15 +5,20 @@ source "$CLI_DIR/lib/cli-common.sh"
 
 detect_project
 case "$IP_MODE" in
-    v2)
-        ensure_engine_staged "$IP_ROOT"
+    cli)
+        # `sync` is the normal fresh-clone command. A newer globally installed
+        # CLI aligns the current Intelligence project first (except in CI, where a
+        # tracked migration must be reviewed and committed locally), and a
+        # missing ignored store is restored strictly from the committed lock.
+        ensure_project_current "$IP_ROOT"
+        restore_project_store_if_missing "$IP_ROOT"
         export_engine_env "$IP_ROOT"
-        exec bash "$IS_ENGINE_DIR/scripts/sync.sh" "$@"
+        exec bash "$IS_ENGINE_DIR/sync.sh" "$@"
         ;;
     legacy)
         # A vendored project syncs with ITS engine — its pin is the contract,
         # and a newer bundled engine must not generate against an older schema.
-        echo "NOTE: vendored (v1) setup — delegating to its own engine. 'intelligence migrate' converts it to the CLI setup." >&2
+        echo "NOTE: legacy Intelligence Sync project — delegating to $IP_MODULE_DIR/scripts/sync.sh. 'intelligence init' converts it into an Intelligence project." >&2
         exec bash "$IP_MODULE_DIR/scripts/sync.sh" "$@"
         ;;
     *)

package/cli/commands/update.sh

@@ -1,59 +1,93 @@
 #!/bin/bash
-# intelligence update [name] [--no-sync]
+# intelligence update [@scope/name] [--preview|--apply]
 #
-# Re-resolve version ranges against the remotes and rewrite the lock. Pinned
-# packages (`ref:`) never move here — repin by editing the manifest or
-# re-adding. `update <name>` limits the pass to one package.
+# One update surface: show the installed-CLI/project/package plan, then either
+# stop, ask interactively, or apply without a prompt. Updating the global npm
+# installation remains an explicit package-manager operation.
 set -euo pipefail
 source "$CLI_DIR/lib/cli-common.sh"
 
-only="" no_sync=0
+only="" mode="ask" preview_seen=0 apply_seen=0
 while [ $# -gt 0 ]; do
     case "$1" in
-        --no-sync) no_sync=1 ;;
-        @*) only="$1" ;;
-        *) die "unknown argument '$1'" ;;
+        --preview) preview_seen=1; mode="preview" ;;
+        --apply) apply_seen=1; mode="apply" ;;
+        @*) [ -z "$only" ] || die "only one package may be selected"; only="$1" ;;
+        *) die "usage: intelligence update [@scope/name] [--preview|--apply]" ;;
     esac
-    shift || true
+    shift
 done
+[ "$preview_seen" -eq 0 ] || [ "$apply_seen" -eq 0 ] || die "choose either --preview or --apply"
 
-require_v2
+require_cli_project
 manifest="$IP_ROOT/intelligence.yaml"
-lock="$IP_ROOT/intelligence.lock"
-
-moved=0 checked=0
-while IFS= read -r name; do
-    [ -n "$name" ] || continue
-    [ -n "$only" ] && [ "$name" != "$only" ] && continue
-    ref="$(qmap_field "$manifest" "packages" "$name" "ref")"
-    [ -n "$ref" ] && { echo "  $name: pinned to ref '$ref' — skipped"; continue; }
-    range="$(qmap_field "$manifest" "packages" "$name" "version")"
-    url="$(qmap_field "$manifest" "packages" "$name" "url")"
-    path="$(qmap_field "$manifest" "packages" "$name" "path")"
-    if [ -z "$url" ]; then
-        resolve_package_source "$manifest" "$name"
-        url="$RES_URL"; path="$RES_PATH"
-    fi
-    checked=$((checked + 1))
-    picked="$(list_remote_versions "$url" | semver_pick_highest "$range")"
-    [ -n "$picked" ] || { echo "  $name: nothing satisfies '${range:-*}' at $url" >&2; continue; }
-    read -r tag _ <<< "$(remote_tag_for_version "$url" "$picked")"
-    current="$(qmap_field "$lock" "packages" "$name" "resolved")"
-    if [ "$tag" = "$current" ]; then
-        echo "  $name: ${current:-<none>} (up to date)"
-        continue
+check_version_compat "$manifest"
+eng="$(bundled_engine_version)"
+stamp="$(read_schema_version "$manifest")"
+project_change=0
+
+echo "Update plan"
+echo ""
+echo "CLI:"
+if [ -n "${INTELLIGENCE_NPM_VERSION:-}" ] && [ "${IS_SKIP_NPM_CHECK:-0}" != "1" ] && command -v npm >/dev/null 2>&1; then
+    channel="latest"
+    case "$INTELLIGENCE_NPM_VERSION" in *-*) channel="next" ;; esac
+    available="$(npm view "@ainova-systems/intelligence" "dist-tags.$channel" 2>/dev/null || true)"
+    if [ -z "$available" ]; then
+        echo "  installed: $INTELLIGENCE_NPM_VERSION; registry check unavailable"
+    elif [ "$available" = "$INTELLIGENCE_NPM_VERSION" ]; then
+        echo "  $INTELLIGENCE_NPM_VERSION (up to date on npm $channel)"
+    else
+        echo "  $INTELLIGENCE_NPM_VERSION -> $available (npm $channel)"
+        echo "  run: npm install -g @ainova-systems/intelligence@$channel"
+        echo "  then rerun: intelligence update --apply"
     fi
-    rel=".intelligence/packages/$name"
-    sha="$(fetch_package "$url" "$tag" "$path" "$IP_ROOT/$rel")"
-    wire_package_sources "$manifest" "$name" "$rel" "$IP_ROOT"
-    lock_upsert "$lock" "$name" "$range" "$url" "$path" "$tag" "$sha"
-    echo "  $name: ${current:-<none>} -> $tag"
-    moved=$((moved + 1))
-done < <(qmap_keys "$manifest" "packages")
-
-[ -n "$only" ] && [ "$checked" -eq 0 ] && die "package '$only' is not in the manifest"
-echo "updated: $moved package(s)"
-
-if [ "$moved" -gt 0 ] && [ "$no_sync" -eq 0 ]; then
-    exec bash "$CLI_DIR/commands/sync.sh"
+else
+    echo "  source checkout/registry check skipped; engine $eng"
+fi
+
+echo ""
+echo "Project:"
+if project_needs_upgrade "$IP_ROOT"; then
+    echo "  lifecycle alignment required (stamp ${stamp:-unstamped}, engine $eng)"
+    project_change=1
+else
+    echo "  schema/content $eng (up to date)"
 fi
+
+if project_has_packages "$IP_ROOT" && [ ! -f "$IP_ROOT/intelligence.lock" ]; then
+    die "manifest declares packages but intelligence.lock is absent — restore the committed lock before planning or applying updates"
+fi
+
+pkg_args=(--preview)
+[ -z "$only" ] || pkg_args+=("$only")
+pkg_plan="$(bash "$CLI_DIR/internal/package-update.sh" "${pkg_args[@]}")"
+echo ""
+echo "Packages:"
+printf '%s\n' "$pkg_plan"
+package_changes="$(printf '%s\n' "$pkg_plan" | awk '/^updates available:/ {print $3; exit}')"
+package_changes="${package_changes:-0}"
+
+if [ "$mode" = "preview" ]; then
+    exit 0
+fi
+if [ "$project_change" -eq 0 ] && [ "$package_changes" -eq 0 ]; then
+    echo ""
+    echo "Nothing to apply with the currently installed CLI."
+    exit 0
+fi
+if [ "$mode" = "ask" ]; then
+    [ -t 0 ] || die "update requires confirmation — rerun with --preview or --apply"
+    printf '\nApply this plan? [Y/n] '
+    read -r answer
+    case "$answer" in
+        ""|y|Y|yes|YES) ;;
+        *) echo "update cancelled"; exit 0 ;;
+    esac
+fi
+
+ensure_project_current "$IP_ROOT"
+apply_args=(--no-sync)
+[ -z "$only" ] || apply_args+=("$only")
+bash "$CLI_DIR/internal/package-update.sh" "${apply_args[@]}"
+exec bash "$CLI_DIR/commands/sync.sh"

package/cli/engine-package.yaml

@@ -0,0 +1,14 @@
+# What THIS CLI distribution ships as its engine-content package, and which
+# registry its init seeds into new manifests. Data, not code: a fork or an
+# enterprise mirror edits this file (or its copy in the npm build) — nothing
+# in cli/ names a vendor.
+#
+# The engine-content package is the one package whose content documents the
+# engine scripts bundled with the CLI: init writes this entry into the
+# manifest (visible, removable), its pin always equals the engine VERSION,
+# lifecycle preflight aligns it with the installed CLI, and at the matching
+# version it materializes from the bundle without network.
+name: "@ainova-systems/sync"
+url: "https://github.com/ainova-systems/intelligence.git"
+path: "packages/sync"
+default_registry: "https://github.com/ainova-systems/intelligence-registry.git"

package/cli/intelligence

@@ -3,25 +3,20 @@
 #
 # Dispatcher only: each command lives in commands/<name>.sh so commands can be
 # ported to Node one at a time without touching the others. The engine is the
-# vendored bash engine bundled next to the CLI (npm package) or, when running
-# from the intelligence-sync repo itself, the repo's own module.
+# bash engine shipped next to the CLI.
 
 set -euo pipefail
 
 CLI_DIR="$(cd "$(dirname "$0")" && pwd)"
 export CLI_DIR
 
-# Engine discovery, by role (scripts/sync.sh + scripts/VERSION), never by
-# guessing names beyond the two shipped layouts:
-#   1. npm package:  <pkg>/cli/intelligence + <pkg>/engine/scripts/
-#   2. this repo:    <repo>/cli/intelligence + <repo>/intelligence/sync/scripts/
+# Engine discovery, by role (sync.sh + VERSION). The repo and the npm package
+# ship one layout — <root>/{cli,engine,packages/sync} — so there is a single
+# candidate rather than a per-distribution list.
 IS_ENGINE_DIR=""
-for _cand in "$CLI_DIR/../engine" "$CLI_DIR/../intelligence/sync"; do
-    if [ -f "$_cand/scripts/sync.sh" ] && [ -f "$_cand/scripts/VERSION" ]; then
-        IS_ENGINE_DIR="$(cd "$_cand" && pwd)"
-        break
-    fi
-done
+if [ -f "$CLI_DIR/../engine/sync.sh" ] && [ -f "$CLI_DIR/../engine/VERSION" ]; then
+    IS_ENGINE_DIR="$(cd "$CLI_DIR/../engine" && pwd)"
+fi
 if [ -z "$IS_ENGINE_DIR" ]; then
     echo "ERROR: bundled sync engine not found next to the CLI ($CLI_DIR)." >&2
     echo "       Reinstall: npm i -g @ainova-systems/intelligence" >&2
@@ -29,40 +24,56 @@ if [ -z "$IS_ENGINE_DIR" ]; then
 fi
 export IS_ENGINE_DIR
 
+# The engine's own content, shipped beside the engine as the seed for the
+# @ainova-systems/sync package at exactly this CLI's version. Separate from the
+# engine dir: the store must receive rules/agents/skills, never engine scripts.
+IS_BUNDLED_PKG_DIR=""
+if [ -d "$CLI_DIR/../packages/sync" ]; then
+    IS_BUNDLED_PKG_DIR="$(cd "$CLI_DIR/../packages/sync" && pwd)"
+fi
+export IS_BUNDLED_PKG_DIR
+
 cmd="${1:-}"
 case "$cmd" in
     ""|help|-h|--help)
-        engine_ver="$(tr -d ' \t\r\n' < "$IS_ENGINE_DIR/scripts/VERSION")"
+        engine_ver="$(tr -d ' \t\r\n' < "$IS_ENGINE_DIR/VERSION")"
         cat <<EOF
 intelligence — build, version and distribute AI agent intelligence
 (engine $engine_ver${INTELLIGENCE_NPM_VERSION:+, package $INTELLIGENCE_NPM_VERSION})
 
 Usage: intelligence <command> [args]
 
-  init                    Set up this project (manifest, content skeleton, targets)
-  add <spec>              Add a package: @scope/name[@range] | github:org/repo[#path] | git+<url>[@ref][#path]
-  remove <name>           Remove a package
-  install [--frozen]      Restore .intelligence/ exactly from intelligence.lock
-  update [name]           Re-resolve version ranges and rewrite the lockfile
-  upgrade                 Upgrade the project to this CLI's engine (restage + restamp)
-  list                    Installed packages with requested/locked versions
-  sync [target]           Render intelligence to every enabled tool (.claude, AGENTS.md, ...)
-  registry <list|add|remove>  Bind a scope to a registry index
-  migrate [--dry-run]     Convert a vendored (v1) setup to the CLI setup
-  doctor                  Check manifest, lockfile, store and engine consistency
-  status                  Project state at a glance
+  init [--preview|--apply]  Initialize, convert, restore or align this project
+    --targets a,b --dir name --bare --no-sync   New-project options
+    --force               Accept a dirty worktree during legacy project conversion
+  sync [adapter]          Restore locked content if needed, then render enabled adapters
+  update [@scope/name]    Show an update plan; ask before applying it
+    --preview             Show the plan without asking or writing
+    --apply               Apply the plan without asking
+  package <command>       add | remove | list | search
+  adapter <command>       list | create | enable | disable | remove
+  status [--check]        Project state; --check runs deep consistency checks
+  registry <list|add|remove>  Manage the trusted registry list (add <repo-url>)
   version                 Print CLI and engine versions
 EOF
         exit 0
         ;;
     version|-v|--version)
-        engine_ver="$(tr -d ' \t\r\n' < "$IS_ENGINE_DIR/scripts/VERSION")"
+        engine_ver="$(tr -d ' \t\r\n' < "$IS_ENGINE_DIR/VERSION")"
         echo "${INTELLIGENCE_NPM_VERSION:-$engine_ver} (engine $engine_ver)"
         exit 0
         ;;
 esac
 shift
 
+# The command word builds a path — allow exactly lowercase words, so
+# `intelligence ../x` can never exec a neighbouring script.
+case "$cmd" in
+    *[!a-z-]*|-*)
+        echo "ERROR: unknown command '$cmd'. Run 'intelligence help'." >&2
+        exit 1
+        ;;
+esac
 cmd_file="$CLI_DIR/commands/$cmd.sh"
 if [ ! -f "$cmd_file" ]; then
     echo "ERROR: unknown command '$cmd'. Run 'intelligence help'." >&2

package/cli/internal/align-project.sh

@@ -0,0 +1,134 @@
+#!/bin/bash
+# Internal: bring an Intelligence project to this CLI's engine: apply schema
+# migrations, align the engine-content package to the bundled version,
+# restamp schema_version, sync.
+set -euo pipefail
+source "$CLI_DIR/lib/cli-common.sh"
+
+no_sync=0
+while [ $# -gt 0 ]; do
+    case "$1" in
+        --no-sync) no_sync=1 ;;
+        *) die "internal upgrade: unknown option '$1'" ;;
+    esac
+    shift
+done
+
+require_cli_project
+manifest="$IP_ROOT/intelligence.yaml"
+
+stamp="$(read_schema_version "$manifest")"
+legacy_stamp="$(top_scalar "$manifest" "sync_version")"
+schema_key_count="$(awk '/^schema_version:[[:space:]]*/ { n++ } END { print n + 0 }' "$manifest")"
+legacy_key_count="$(awk '/^sync_version:[[:space:]]*/ { n++ } END { print n + 0 }' "$manifest")"
+eng="$(bundled_engine_version)"
+[ "$schema_key_count" -le 1 ] || die "manifest has duplicate schema_version keys"
+[ "$legacy_key_count" -le 1 ] || die "manifest has duplicate sync_version keys"
+if [ -n "$stamp" ] && _ver_gt "$stamp" "$eng"; then
+    die "manifest schema $stamp is newer than this CLI's engine $eng — update the global CLI first"
+fi
+if [ -n "$legacy_stamp" ] && _ver_gt "$legacy_stamp" "$eng"; then
+    die "manifest schema $legacy_stamp is newer than this CLI's engine $eng — update the global CLI first"
+fi
+
+# --- project schema migrations --------------------------------------------
+# The engine's own chain owns vendored layouts; this one owns the manifest.
+# Same discipline: ascending, append-only, each migration self-detects and
+# no-ops when already applied.
+
+# migration 0: the original RC manifest called the permanent schema key
+# `sync_version`. Rename it without changing its value; the final stamp below
+# then aligns it with this engine. The legacy Intelligence Sync reader remains
+# separate.
+if [ -n "$legacy_stamp" ]; then
+    if [ -n "$stamp" ]; then
+        [ "$stamp" = "$legacy_stamp" ] || die "manifest has conflicting schema_version '$stamp' and sync_version '$legacy_stamp'"
+        _qmap_stage "$manifest" '$0 !~ /^sync_version:[[:space:]]*/'
+    else
+        _qmap_stage "$manifest" '{ sub(/^sync_version:/, "schema_version:"); print }'
+    fi
+    echo "  migrating: sync_version -> schema_version"
+fi
+
+# migration 1: package entries contain requested intent only. Early RCs
+# also copied resolved url/path into the manifest. Preserve the existing lock
+# as the trusted source and remove that duplicate representation. A direct
+# unversioned package becomes an explicit HEAD pin so its manifest entry stays
+# meaningful after the source fields are removed.
+source_fields_migrated=0
+while IFS= read -r name; do
+    [ -n "$name" ] || continue
+    m_url="$(qmap_field "$manifest" "packages" "$name" "url")"
+    m_path="$(qmap_field "$manifest" "packages" "$name" "path")"
+    [ -n "$m_url" ] || [ -n "$m_path" ] || continue
+    m_ver="$(qmap_field "$manifest" "packages" "$name" "version")"
+    m_ref="$(qmap_field "$manifest" "packages" "$name" "ref")"
+    if [ -z "$m_ver" ] && [ -z "$m_ref" ]; then
+        locked_ref="$(qmap_field "$IP_ROOT/intelligence.lock" "packages" "$name" "resolved")"
+        qmap_set "$manifest" "packages" "$name" "ref" "${locked_ref:-HEAD}"
+    fi
+    qmap_delete_field "$manifest" "packages" "$name" "url"
+    qmap_delete_field "$manifest" "packages" "$name" "path"
+    source_fields_migrated=1
+done < <(qmap_keys "$manifest" "packages")
+if [ "$source_fields_migrated" -eq 1 ]; then
+    echo "  migrating: package url/path -> intelligence.lock"
+fi
+
+# migration 2: staged engine content -> the @ainova-systems/sync package.
+# Pre-package manifests listed `.intelligence/engine/{rules,agents,skills}`
+# as sources fed by a CLI-staged copy; that copy is now an ordinary package
+# entry seeded from the bundle. Post-condition: no `.intelligence/engine`
+# source entries, the package present in manifest+lock+store, stale dir gone.
+migrated=0
+for section in rules agents skills; do
+    while IFS= read -r src; do
+        case "$src" in
+            .intelligence/engine/*)
+                sources_remove_entry "$manifest" "$section" "$src"
+                migrated=1
+                ;;
+        esac
+    done < <(read_yaml_list "$manifest" "$section")
+done
+if [ "$migrated" -eq 1 ]; then
+    echo "  migrating: staged engine content -> $SYNC_PKG_NAME package"
+    rm -rf "$IP_ROOT/.intelligence/engine"
+    sync_pkg_entry "$manifest"
+    sync_pkg_install "$IP_ROOT"
+fi
+
+# --- steady state ---------------------------------------------------------
+# Align the engine-content package with the bundled engine. Only a manifest
+# that HAS the entry is touched — a --bare project opted out, and upgrade
+# respects that.
+have_pkg=0
+while IFS= read -r name; do
+    [ "$name" = "$SYNC_PKG_NAME" ] && have_pkg=1
+done < <(qmap_keys "$manifest" "packages")
+if [ "$have_pkg" -eq 1 ] && [ "$migrated" -eq 0 ]; then
+    pinned="$(qmap_field "$manifest" "packages" "$SYNC_PKG_NAME" "version")"
+    if [ "$pinned" != "$eng" ]; then
+        echo "  $SYNC_PKG_NAME: $pinned -> $eng"
+    fi
+    sync_pkg_entry "$manifest"
+    sync_pkg_install "$IP_ROOT"
+fi
+if [ "$have_pkg" -eq 0 ] && [ "$migrated" -eq 0 ]; then
+    echo "  NOTE: $SYNC_PKG_NAME is not in this manifest (bare setup) — engine meta-skills stay uninstalled; 'intelligence package add $SYNC_PKG_NAME' opts back in." >&2
+fi
+
+# A previous RC could leave this managed directory even after its source
+# entries were already removed. Its presence is itself an upgrade predicate,
+# so always close that post-condition.
+if [ -d "$IP_ROOT/.intelligence/engine" ]; then
+    rm -rf "$IP_ROOT/.intelligence/engine"
+    echo "  removed stale .intelligence/engine"
+fi
+
+stamp_schema_version "$manifest" "$eng"
+echo "  schema_version -> $eng"
+
+if [ "$no_sync" -eq 0 ]; then
+    exec bash "$CLI_DIR/commands/sync.sh"
+fi

package/cli/internal/check.sh

@@ -0,0 +1,128 @@
+#!/bin/bash
+# Internal deep consistency check. No writes; exits 1 on problems.
+set -euo pipefail
+source "$CLI_DIR/lib/cli-common.sh"
+
+problems=0
+warn() { echo "  ✗ $*"; problems=$((problems + 1)); }
+ok()   { echo "  ✓ $*"; }
+
+echo "environment:"
+command -v git >/dev/null 2>&1 && ok "git $(git --version | awk '{print $3}')" || warn "git not found"
+command -v awk >/dev/null 2>&1 && ok "awk present" || warn "awk not found"
+ok "bash $BASH_VERSION"
+ok "engine $(bundled_engine_version) at $IS_ENGINE_DIR"
+
+detect_project
+case "$IP_MODE" in
+    none)
+        echo "project: none here — 'intelligence init' starts one"
+        exit 0
+        ;;
+    legacy)
+        echo "project: legacy Intelligence Sync at $IP_ROOT"
+        ok "vendored engine $(tr -d ' \t\r\n' < "$IP_MODULE_DIR/scripts/VERSION")"
+        echo "  → 'intelligence init' converts it into an Intelligence project"
+        exit 0
+        ;;
+esac
+
+echo "project: $IP_ROOT"
+manifest="$IP_ROOT/intelligence.yaml"
+lock="$IP_ROOT/intelligence.lock"
+
+stamp="$(read_schema_version "$manifest")"
+eng="$(bundled_engine_version)"
+if [ -z "$stamp" ]; then
+    warn "manifest has no schema_version — run 'intelligence init'"
+elif _ver_gt "$stamp" "$eng"; then
+    warn "manifest schema $stamp is newer than this CLI's engine $eng — update the CLI: npm i -g @ainova-systems/intelligence@latest"
+elif _ver_gt "$eng" "$stamp"; then
+    warn "manifest schema $stamp behind engine $eng — run 'intelligence init'"
+else
+    ok "schema_version $stamp matches the engine"
+fi
+
+# The engine-content package must sit at the bundled engine version — the
+# content documents exactly the scripts the CLI executes.
+sync_locked="$(qmap_field "$lock" "packages" "$SYNC_PKG_NAME" "resolved")"
+if [ -n "$sync_locked" ]; then
+    if [ "${sync_locked#v}" = "$eng" ]; then
+        ok "$SYNC_PKG_NAME at $sync_locked (matches the engine)"
+    else
+        warn "$SYNC_PKG_NAME locked at $sync_locked but the engine is $eng — run 'intelligence init'"
+    fi
+fi
+if [ -d "$IP_ROOT/.intelligence/engine" ]; then
+    warn "stale .intelligence/engine directory (pre-package layout) — run 'intelligence init'"
+fi
+
+# Manifest packages: names valid, requested intent only, locked and installed.
+# The lock is authoritative for resolved source URL/path until an explicit
+# package re-add changes that trust decision.
+while IFS= read -r name; do
+    [ -n "$name" ] || continue
+    assert_valid_pkg_name "$name"
+    if [ -z "$(qmap_field "$lock" "packages" "$name" "url")" ]; then
+        warn "$name is in the manifest but not in intelligence.lock — run 'intelligence init'"
+    else
+        m_ver="$(qmap_field "$manifest" "packages" "$name" "version")"
+        m_ref="$(qmap_field "$manifest" "packages" "$name" "ref")"
+        l_req="$(qmap_field "$lock" "packages" "$name" "requested")"
+        l_res="$(qmap_field "$lock" "packages" "$name" "resolved")"
+        [ -z "$m_ver" ] || [ "$m_ver" = "$l_req" ] \
+            || warn "$name requests '$m_ver' but the lock recorded '$l_req' — run 'intelligence update --preview'"
+        [ -z "$m_ref" ] || [ "$m_ref" = "$l_res" ] \
+            || warn "$name pins ref '$m_ref' but the lock resolved '$l_res'"
+        if [ -n "$(qmap_field "$manifest" "packages" "$name" "url")" ] \
+            || [ -n "$(qmap_field "$manifest" "packages" "$name" "path")" ]; then
+            warn "$name stores source details in the manifest — run 'intelligence init --apply' to move them to the lock-only model"
+        fi
+        if [ ! -d "$IP_ROOT/.intelligence/packages/$name" ]; then
+            warn "$name is locked but not installed — run 'intelligence sync'"
+            continue
+        fi
+        ok "$name @ $(qmap_field "$lock" "packages" "$name" "resolved")"
+    fi
+done < <(qmap_keys "$manifest" "packages")
+
+# Lock orphans.
+if [ -f "$lock" ]; then
+    while IFS= read -r name; do
+        [ -n "$name" ] || continue
+        found=0
+        while IFS= read -r m; do
+            [ "$m" = "$name" ] && found=1
+        done < <(qmap_keys "$manifest" "packages")
+        [ "$found" -eq 1 ] || warn "$name is locked but absent from the manifest — 'intelligence package remove $name' cleans it up"
+    done < <(qmap_keys "$lock" "packages")
+fi
+
+# Sources must exist (a missing dir is silently skipped by the engine, which
+# is exactly why doctor names it).
+for section in rules agents skills; do
+    while IFS= read -r src; do
+        [ -n "$src" ] || continue
+        case "$src" in
+            git+*|@*) continue ;;
+        esac
+        if [ ! -d "$IP_ROOT/$src" ]; then
+            case "$src" in
+                # Store content is restorable state: absent means un-installed.
+                .intelligence/*) warn "sources.$section '$src' missing — run 'intelligence sync'" ;;
+                # A project-owned dir that does not exist yet is a legitimate
+                # state — a project consuming only packages authors nothing of
+                # its own — and the engine simply skips it. Declared up front so
+                # authoring later needs no config edit.
+                *) ok "sources.$section '$src' — not created yet (optional)" ;;
+            esac
+        fi
+    done < <(read_yaml_list "$manifest" "$section")
+done
+
+if [ "$problems" -eq 0 ]; then
+    echo "all good."
+else
+    echo "$problems problem(s)."
+    exit 1
+fi