@ainova-systems/intelligence 0.11.0-rc.4 → 0.11.0-rc.6

package/cli/commands/add.sh

@@ -78,9 +78,27 @@ assert_valid_pkg_name "$name"
 if [ "$mode" = "registry" ]; then
     resolve_package_source "$manifest" "$name"
     url="$RES_URL"; path="$RES_PATH"
+    if [ -z "$url" ]; then
+        echo "ERROR: no trusted registry declares '$name'." >&2
+        echo "  A name installs only through a registry this project added explicitly" >&2
+        echo "  ('intelligence registry list' shows them). Either add its registry:" >&2
+        echo "    intelligence registry add <registry-repo-url>" >&2
+        echo "  or install from an explicit source you name yourself:" >&2
+        echo "    intelligence add github:org/repo   |   intelligence add git+<url>[@ref][#path]" >&2
+        suggest_similar "$manifest" "$name"
+        exit 1
+    fi
     echo "  resolving $name via $RES_VIA -> $url${path:+ ($path)}"
 fi
 
+# The source must exist before anything else is attempted — never die
+# mid-pipeline with no message.
+if ! GIT_TERMINAL_PROMPT=0 git ls-remote "$url" >/dev/null 2>&1; then
+    echo "ERROR: no reachable repository at $url" >&2
+    echo "  Declared by ${RES_VIA:-the spec} — check the URL and your git access." >&2
+    exit 1
+fi
+
 # Pick the version: an explicit ref pins; otherwise the highest stable tag
 # matching the range (npm's behaviour, `^highest` becoming the requested range
 # when none was given).
@@ -107,7 +125,11 @@ sha="$(fetch_package "$url" "${ref:-$resolved_tag}" "$path" "$IP_ROOT/$rel")"
 wire_package_sources "$manifest" "$name" "$rel" "$IP_ROOT"
 
 # Manifest entry: a registry package records its range; a direct one records
-# its source so resolution never has to guess it again.
+# its source so resolution never has to guess it again. The entry is replaced
+# WHOLE — re-adding under a different spec must not leave the old spec's
+# fields behind (a stale ref: would freeze update, a stale url: would pin the
+# old source).
+qmap_delete_key "$manifest" "packages" "$name"
 if [ "$mode" = "registry" ]; then
     qmap_set "$manifest" "packages" "$name" "version" "$requested"
 else

package/cli/commands/doctor.sh

@@ -43,14 +43,23 @@ else
     ok "sync_version $stamp matches the engine"
 fi
 
-if [ -f "$IP_ROOT/.intelligence/engine/.version" ]; then
-    staged="$(tr -d ' \t\r\n' < "$IP_ROOT/.intelligence/engine/.version")"
-    [ "$staged" = "$eng" ] && ok "engine content staged ($staged)" || warn "staged engine content is $staged, bundled is $eng — run 'intelligence install'"
-else
-    warn "engine content not staged — run 'intelligence install'"
+# The engine-content package must sit at the bundled engine version — the
+# content documents exactly the scripts the CLI executes.
+sync_locked="$(qmap_field "$lock" "packages" "$SYNC_PKG_NAME" "resolved")"
+if [ -n "$sync_locked" ]; then
+    if [ "${sync_locked#v}" = "$eng" ]; then
+        ok "$SYNC_PKG_NAME at $sync_locked (matches the engine)"
+    else
+        warn "$SYNC_PKG_NAME locked at $sync_locked but the engine is $eng — run 'intelligence upgrade'"
+    fi
+fi
+if [ -d "$IP_ROOT/.intelligence/engine" ]; then
+    warn "stale .intelligence/engine directory (pre-package layout) — run 'intelligence upgrade'"
 fi
 
-# Manifest packages: names valid, locked, installed.
+# Manifest packages: names valid, locked, installed — and the lock's source
+# still the one resolution would pick today (a registry silently re-pointing
+# an installed name is the dependency-confusion tail this check cuts off).
 while IFS= read -r name; do
     [ -n "$name" ] || continue
     assert_valid_pkg_name "$name"
@@ -60,6 +69,13 @@ while IFS= read -r name; do
         warn "$name is locked but not installed — run 'intelligence install'"
     else
         ok "$name @ $(qmap_field "$lock" "packages" "$name" "resolved")"
+        if [ -z "$(qmap_field "$manifest" "packages" "$name" "url")" ]; then
+            locked_url="$(qmap_field "$lock" "packages" "$name" "url")"
+            resolve_package_source "$manifest" "$name" 2>/dev/null || true
+            if [ -n "${RES_URL:-}" ] && [ -n "$locked_url" ] && [ "$RES_URL" != "$locked_url" ]; then
+                warn "$name now resolves to $RES_URL but the lock pins $locked_url — a registry re-pointed the name; verify before 'intelligence update'"
+            fi
+        fi
     fi
 done < <(qmap_keys "$manifest" "packages")
 
@@ -85,8 +101,13 @@ for section in rules agents skills; do
         esac
         if [ ! -d "$IP_ROOT/$src" ]; then
             case "$src" in
+                # Store content is restorable state: absent means un-installed.
                 .intelligence/*) warn "sources.$section '$src' missing — run 'intelligence install'" ;;
-                *) warn "sources.$section '$src' does not exist" ;;
+                # A project-owned dir that does not exist yet is a legitimate
+                # state — a project consuming only packages authors nothing of
+                # its own — and the engine simply skips it. Declared up front so
+                # authoring later needs no config edit.
+                *) ok "sources.$section '$src' — not created yet (optional)" ;;
             esac
         fi
     done < <(read_yaml_list "$manifest" "$section")

package/cli/commands/init.sh

@@ -8,15 +8,21 @@
 set -euo pipefail
 source "$CLI_DIR/lib/cli-common.sh"
 
-targets_arg="" no_sync=0
+targets_arg="" no_sync=0 content_dir="intelligence" bare=0
 while [ $# -gt 0 ]; do
     case "$1" in
         --targets) shift; targets_arg="${1:-}" ;;
+        --dir) shift; content_dir="${1:-}" ;;
         --no-sync) no_sync=1 ;;
+        --bare) bare=1 ;;
         *) die "unknown option '$1'" ;;
     esac
     shift || true
 done
+[ -n "$content_dir" ] || die "--dir needs a directory name"
+case "$content_dir" in
+    /*|*..*|.intelligence|.intelligence/*) die "--dir must be a plain directory inside the repo, and not the package store" ;;
+esac
 
 detect_project
 case "$IP_MODE" in
@@ -27,37 +33,55 @@ esac
 root="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
 root="$(cd "$root" && pwd)"
 
-targets="agents claude"
+# Never invent a tool the project shows no trace of: every per-tool target is
+# DETECTED from repo markers or named explicitly via --targets. Only `agents`
+# (AGENTS.md, the tool-neutral standard every AGENTS-reading tool shares, and
+# the invariant-required carrier once any of them is on) is unconditional.
+targets="agents"
 if [ -n "$targets_arg" ]; then
     targets="agents $(printf '%s' "$targets_arg" | tr ',' ' ')"
 else
+    if [ -d "$root/.claude" ] || [ -f "$root/CLAUDE.md" ]; then targets="$targets claude"; fi
     [ -d "$root/.cursor" ] && targets="$targets cursor"
     [ -d "$root/.codex" ] && targets="$targets codex"
     [ -d "$root/.pi" ] && targets="$targets pi"
     [ -d "$root/.opencode" ] && targets="$targets opencode"
     [ -d "$root/.github" ] && [ -d "$root/.github/instructions" ] && targets="$targets copilot"
+    if [ "$targets" = "agents" ]; then
+        echo "  NOTE: no tool markers found (.claude/, CLAUDE.md, .cursor/, …) — only AGENTS.md is enabled." >&2
+        echo "        Name your tools explicitly: intelligence init --targets claude,cursor  (or edit targets: later)" >&2
+    fi
 fi
 
 manifest="$root/intelligence.yaml"
 {
     echo "# Intelligence manifest — what this project's AI tooling knows and where it goes."
-    echo "# Managed by the intelligence CLI (https://github.com/ainova-systems/intelligence-sync)."
+    echo "# Managed by the intelligence CLI. Reference: https://github.com/ainova-systems/intelligence-sync"
     echo "project:"
     echo "  name: \"$(basename "$root")\""
+    [ "$content_dir" = "intelligence" ] || echo "  intelligence_dir: \"$content_dir\""
     echo ""
+    echo "# Schema version of this manifest. The CLI keeps it in step with its engine."
     echo "sync_version: \"$(bundled_engine_version)\""
     echo ""
+    echo "# Where content comes from. Nothing here has to exist: a directory that is"
+    echo "# absent is skipped, so a project consuming only packages authors nothing of"
+    echo "# its own. To write your own, create the directory and sync — no config edit:"
+    echo "#   $content_dir/rules/context.md      an always-on rule; describe the project,"
+    echo "#                                      its stack, and the constraints to respect"
+    echo "#   $content_dir/agents/<name>.md      a persona (frontmatter: name, description,"
+    echo "#                                      tier: heavy|standard|light, access: full|readonly)"
+    echo "#   $content_dir/skills/<name>/SKILL.md  a procedure invoked as /<name>"
+    echo "# '.intelligence/' is CLI-managed (packages + engine content) — never edit it."
     echo "sources:"
     echo "  rules:"
-    echo "    - \"intelligence/rules\""
-    echo "    - \".intelligence/engine/rules\""
+    echo "    - \"$content_dir/rules\""
     echo "  agents:"
-    echo "    - \"intelligence/agents\""
-    echo "    - \".intelligence/engine/agents\""
+    echo "    - \"$content_dir/agents\""
     echo "  skills:"
-    echo "    - \"intelligence/skills\""
-    echo "    - \".intelligence/engine/skills\""
+    echo "    - \"$content_dir/skills\""
     echo ""
+    echo "# Generated output, one entry per tool. Add or drop tools freely."
     echo "targets:"
     for t in $targets; do
         case "$t" in
@@ -65,18 +89,30 @@ manifest="$root/intelligence.yaml"
             *) echo "  $t: { enabled: true, output: \".$t\" }" ;;
         esac
     done
+    echo ""
+    echo "# Packages are managed with 'intelligence add' / 'search' / 'list':"
+    echo "#   intelligence add @ainova-systems/core       from the registry"
+    echo "#   intelligence add github:org/repo            any repo with rules|agents|skills"
+    echo "# packages:"
+    echo "#   \"@ainova-systems/core\":"
+    echo "#     version: \"^0.3.0\""
+    echo ""
+    echo "# Registries are this project's TRUST LIST — the ONLY way a package name"
+    echo "# resolves (there is no built-in catalog and no name->github guessing;"
+    echo "# registry-less installs are always explicit: github:org/repo, git+<url>)."
+    echo "# Git repos holding an index.yaml, consulted in order; first to declare a"
+    echo "# name wins; sources are then pinned by url+sha in intelligence.lock."
+    echo "# Managed with 'intelligence registry add|remove'. Delete a line to"
+    echo "# distrust that catalog — including the default seeded below."
+    if [ "$bare" -eq 1 ] || [ -z "$DEFAULT_REGISTRY_URL" ]; then
+        echo "# registries:"
+        echo "#   - \"https://github.com/acme/intelligence-registry.git\""
+    else
+        echo "registries:"
+        echo "  - \"$DEFAULT_REGISTRY_URL\""
+    fi
 } > "$manifest"
 
-mkdir -p "$root/intelligence/rules" "$root/intelligence/agents" "$root/intelligence/skills"
-if [ ! -f "$root/intelligence/rules/context.md" ]; then
-    cat > "$root/intelligence/rules/context.md" <<EOF
-# Project Context
-
-<!-- Always-on context every AI tool receives. Describe what this project is,
-     its stack, and the constraints an agent must respect. -->
-EOF
-fi
-
 # The package store is restorable state, never committed — the npm model.
 if [ ! -f "$root/.gitignore" ] || ! grep -q '^\.intelligence/' "$root/.gitignore"; then
     {
@@ -86,9 +122,19 @@ if [ ! -f "$root/.gitignore" ] || ! grep -q '^\.intelligence/' "$root/.gitignore
     } >> "$root/.gitignore"
 fi
 
-ensure_engine_staged "$root"
+# The engine's own content (meta-skills, authoring rule, engine agents) is an
+# ordinary package: auto-selected, opted out with --bare, removable later with
+# 'intelligence remove @ainova-systems/sync --force'.
+if [ "$bare" -eq 0 ]; then
+    sync_pkg_entry "$manifest"
+    sync_pkg_install "$root"
+fi
+
 echo "initialized: intelligence.yaml (targets:$(printf ' %s' $targets))"
-echo "next: add intelligence packages — e.g. 'intelligence add @ainova-systems/core'"
+[ "$bare" -eq 1 ] && echo "  bare setup: no packages — engine meta-skills not installed"
+echo "  add packages:  intelligence add @ainova-systems/core   (browse: intelligence search)"
+echo "  write your own: create $content_dir/rules/context.md, then intelligence sync"
+echo "  docs: https://github.com/ainova-systems/intelligence-sync#readme"
 
 if [ "$no_sync" -eq 0 ]; then
     cd "$root"

package/cli/commands/install.sh

@@ -22,10 +22,44 @@ require_v2
 manifest="$IP_ROOT/intelligence.yaml"
 lock="$IP_ROOT/intelligence.lock"
 
-ensure_engine_staged "$IP_ROOT"
+# --frozen is the reproducibility contract: the lock must agree with the
+# manifest on the package SET and on every requested-source field before a
+# single byte is restored. Anything less lets a manifest edit ride on a stale
+# lock — the exact drift the flag exists to refuse.
+if [ "$frozen" -eq 1 ]; then
+    while IFS= read -r name; do
+        [ -n "$name" ] || continue
+        [ -n "$(qmap_field "$lock" "packages" "$name" "url")" ] \
+            || die "--frozen: $name is in the manifest but not in intelligence.lock"
+        m_ver="$(qmap_field "$manifest" "packages" "$name" "version")"
+        m_ref="$(qmap_field "$manifest" "packages" "$name" "ref")"
+        m_url="$(qmap_field "$manifest" "packages" "$name" "url")"
+        m_path="$(qmap_field "$manifest" "packages" "$name" "path")"
+        l_req="$(qmap_field "$lock" "packages" "$name" "requested")"
+        l_res="$(qmap_field "$lock" "packages" "$name" "resolved")"
+        l_url="$(qmap_field "$lock" "packages" "$name" "url")"
+        l_path="$(qmap_field "$lock" "packages" "$name" "path")"
+        [ -z "$m_ver" ] || [ "$m_ver" = "$l_req" ] \
+            || die "--frozen: $name requests '$m_ver' but the lock recorded '$l_req' — run 'intelligence install' without --frozen"
+        [ -z "$m_ref" ] || [ "$m_ref" = "$l_res" ] \
+            || die "--frozen: $name pins ref '$m_ref' but the lock resolved '$l_res'"
+        [ -z "$m_url" ] || [ "$m_url" = "$l_url" ] \
+            || die "--frozen: $name declares url '$m_url' but the lock recorded '$l_url'"
+        [ -z "$m_path" ] || [ "$m_path" = "$l_path" ] \
+            || die "--frozen: $name declares path '$m_path' but the lock recorded '$l_path'"
+    done < <(qmap_keys "$manifest" "packages")
+    while IFS= read -r name; do
+        [ -n "$name" ] || continue
+        found=0
+        while IFS= read -r m; do
+            [ "$m" = "$name" ] && found=1
+        done < <(qmap_keys "$manifest" "packages")
+        [ "$found" -eq 1 ] || die "--frozen: $name is locked but absent from the manifest"
+    done < <(qmap_keys "$lock" "packages")
+fi
 
 # Manifest packages missing from the lock: resolve them now (npm install
-# semantics). Under --frozen that is an error instead.
+# semantics). Under --frozen the drift gate above has already refused.
 missing=""
 while IFS= read -r name; do
     [ -n "$name" ] || continue
@@ -34,8 +68,13 @@ while IFS= read -r name; do
     fi
 done < <(qmap_keys "$manifest" "packages")
 if [ -n "$missing" ]; then
-    [ "$frozen" -eq 1 ] && die "lockfile is missing packages:$missing — run 'intelligence install' without --frozen"
     for name in $missing; do
+        # The engine-content package needs no remote resolution: its pin IS
+        # the bundled engine version and it seeds from the bundle, offline.
+        if [ "$name" = "$SYNC_PKG_NAME" ]; then
+            sync_pkg_install "$IP_ROOT"
+            continue
+        fi
         url="$(qmap_field "$manifest" "packages" "$name" "url")"
         path="$(qmap_field "$manifest" "packages" "$name" "path")"
         ref="$(qmap_field "$manifest" "packages" "$name" "ref")"
@@ -66,14 +105,25 @@ if [ -f "$lock" ]; then
         if [ -d "$IP_ROOT/$rel" ] && [ "$force" -eq 0 ]; then
             continue
         fi
-        got="$(fetch_package "$url" "$resolved" "$path" "$IP_ROOT/$rel")"
-        if [ -n "$sha" ] && [ "$got" != "$sha" ]; then
+        # Fetch into staging and commit to the store only after the integrity
+        # verdict: content that violates the lock must never be left where a
+        # re-run (whose dir-exists check skips verification) would sync it.
+        staging="$IP_ROOT/.intelligence/.staging-$$"
+        rm -rf "$staging"
+        got="$(fetch_package "$url" "$resolved" "$path" "$staging")"
+        # An empty sha (bundle-seeded content on a dev build) means unknown,
+        # not moved — only two known-and-different shas are a finding.
+        if [ -n "$sha" ] && [ -n "$got" ] && [ "$got" != "$sha" ]; then
             if [ "$frozen" -eq 1 ]; then
+                rm -rf "$staging"
                 die "$name: fetched $got but the lock pins $sha — the ref moved; refusing under --frozen"
             fi
             echo "  WARN: $name resolved to $got, lock had $sha — updating the lock" >&2
             lock_upsert "$lock" "$name" "$requested" "$url" "$path" "$resolved" "$got"
         fi
+        rm -rf "${IP_ROOT:?}/$rel"
+        mkdir -p "$(dirname "$IP_ROOT/$rel")"
+        mv "$staging" "$IP_ROOT/$rel"
         wire_package_sources "$manifest" "$name" "$rel" "$IP_ROOT"
         echo "= $name@${resolved:-HEAD}"
     done < <(lock_to_tsv "$lock")

package/cli/commands/migrate.sh

@@ -44,13 +44,6 @@ stamp="$(read_engine_stamp "$config")"
 eng="$(bundled_engine_version)"
 [ -n "$stamp" ] && _ver_gt "$stamp" "$eng" && die "project schema $stamp is newer than this CLI's engine $eng — update the CLI first"
 
-# A schema gap is closed by the engine's own proven chain before conversion.
-if [ "$dry_run" -eq 0 ] && { [ -z "$stamp" ] || _ver_gt "$eng" "$stamp"; }; then
-    echo "== applying the engine migration chain ($stamp -> $eng) =="
-    run_migrations "$umbrella" "$(basename "$module_dir")" "" || die "engine migration chain failed (IS_STATUS above) — nothing converted"
-    stamp_version "$config" "$eng"
-fi
-
 # ---- Stage ----------------------------------------------------------------
 stage="$root/.intelligence-migrate-stage.$$"
 [ "$dry_run" -eq 1 ] && stage="$(mktemp -d -t intelligence-migrate-XXXXXX 2>/dev/null || mktemp -d)"
@@ -58,8 +51,28 @@ cleanup_stage() { rm -rf "$stage"; }
 trap cleanup_stage EXIT INT TERM
 mkdir -p "$stage/.intelligence/packages"
 
+# A schema gap is closed by the engine's own proven chain before conversion.
+# Dry-run must preview the SAME pipeline, so it runs the chain too — against
+# a staged copy of the umbrella, leaving the project untouched.
+if [ -z "$stamp" ] || _ver_gt "$eng" "$stamp"; then
+    if [ "$dry_run" -eq 1 ]; then
+        echo "== applying the engine migration chain ($stamp -> $eng) to a staged copy =="
+        cp -R "$umbrella" "$stage/umbrella"
+        run_migrations "$stage/umbrella" "$(basename "$module_dir")" "" > "$stage/chain.log" 2>&1 \
+            || { tail -5 "$stage/chain.log" >&2; die "engine migration chain failed in the staged copy — a real migrate would fail the same way"; }
+        stamp_version "$stage/umbrella/config.yaml" "$eng"
+        config="$stage/umbrella/config.yaml"
+    else
+        echo "== applying the engine migration chain ($stamp -> $eng) =="
+        run_migrations "$umbrella" "$(basename "$module_dir")" "" || die "engine migration chain failed (IS_STATUS above) — nothing converted"
+        stamp_version "$config" "$eng"
+    fi
+fi
+
 echo "== staging =="
-stage_engine_content "$stage/.intelligence/engine"
+# Engine content arrives as the @ainova-systems/sync package, seeded from the
+# bundle (fetch_package's guard — no network).
+sync_pkg_sha="$(fetch_package "$SYNC_PKG_URL" "v$eng" "$SYNC_PKG_PATH" "$stage/$SYNC_PKG_STORE")"
 
 # Legacy pack name -> v2 package name (@org/repo derived from the url), plus
 # per-pack source facts. Recorded as rows for the config rewrite and the lock.
@@ -117,7 +130,7 @@ rewrite_source_value() {
     local v="$1" pack name rest
     case "$v" in
         "$module_rel"/rules|"$module_rel"/agents|"$module_rel"/skills)
-            printf '.intelligence/engine/%s' "${v##*/}"
+            printf '%s/%s' "$SYNC_PKG_STORE" "${v##*/}"
             return 0 ;;
         @*)
             rest="${v#@}"
@@ -168,6 +181,13 @@ while IFS="$LOCK_SEP" read -r pack name url ref mirror; do
     [ -n "$ref" ] && qmap_set "$manifest_stage" "packages" "$name" "ref" "$ref"
 done < "$pack_rows"
 
+# The engine's own content rides along as a package, pinned to the engine.
+qmap_set "$manifest_stage" "packages" "$SYNC_PKG_NAME" "version" "$eng"
+qmap_set "$manifest_stage" "packages" "$SYNC_PKG_NAME" "url" "$SYNC_PKG_URL"
+qmap_set "$manifest_stage" "packages" "$SYNC_PKG_NAME" "path" "$SYNC_PKG_PATH"
+printf '%s\037%s\037%s\037%s\037%s\037%s\n' \
+    "$SYNC_PKG_NAME" "$eng" "$SYNC_PKG_URL" "$SYNC_PKG_PATH" "v$eng" "$sync_pkg_sha" >> "$lock_rows"
+
 # ---- Verify ---------------------------------------------------------------
 echo "== verifying staged state =="
 fail=0
@@ -203,6 +223,13 @@ fi
 
 # ---- Commit ---------------------------------------------------------------
 echo "== committing =="
+# .gitignore is part of the transaction: rollback must leave it exactly as
+# found, absent included.
+gitignore_existed=0
+if [ -f "$root/.gitignore" ]; then
+    gitignore_existed=1
+    cp "$root/.gitignore" "$stage/gitignore.orig"
+fi
 if [ ! -f "$root/.gitignore" ] || ! grep -q '^\.intelligence/' "$root/.gitignore"; then
     {
         [ -f "$root/.gitignore" ] && [ -n "$(tail -c 1 "$root/.gitignore" 2>/dev/null)" ] && echo ""
@@ -212,6 +239,11 @@ if [ ! -f "$root/.gitignore" ] || ! grep -q '^\.intelligence/' "$root/.gitignore
 fi
 rollback() {
     rm -rf "$root/.intelligence" "$root/intelligence.yaml" "$root/intelligence.lock"
+    if [ "$gitignore_existed" -eq 1 ]; then
+        cp "$stage/gitignore.orig" "$root/.gitignore"
+    else
+        rm -f "$root/.gitignore"
+    fi
     echo "rolled back — the vendored setup is untouched" >&2
 }
 mv "$stage/.intelligence" "$root/.intelligence"

package/cli/commands/registry.sh

@@ -1,8 +1,10 @@
 #!/bin/bash
-# intelligence registry <list | add @scope <registry-repo-url> | remove @scope>
+# intelligence registry <list | add <registry-repo-url> [--force] | remove <url>>
 #
-# A registry binding is rare, per-scope configuration (npm's @scope:registry
-# analog): the URL of a git repo whose index.yaml maps names to sources.
+# The registries block is a TRUST LIST: git repos holding an index.yaml, in
+# trust order. Adding one is a committed, reviewable act — after it, every
+# name that registry declares installs like a bundled one. No scope labels:
+# names carry their own scope, and the first registry to declare a name wins.
 set -euo pipefail
 source "$CLI_DIR/lib/cli-common.sh"
 
@@ -11,54 +13,71 @@ case "$sub" in
     list)
         detect_project
         if [ "$IP_MODE" = "v2" ] && [ -f "$IP_ROOT/intelligence.yaml" ]; then
-            echo "Project bindings (intelligence.yaml):"
+            echo "Project registries (intelligence.yaml, trust order):"
             found=0
-            while IFS= read -r scope; do
-                [ -n "$scope" ] || continue
+            while IFS= read -r url; do
+                [ -n "$url" ] || continue
                 found=1
-                echo "  $scope -> $(qmap_value "$IP_ROOT/intelligence.yaml" "registries" "$scope")"
-            done < <(qmap_keys "$IP_ROOT/intelligence.yaml" "registries")
+                index="$(_fetch_index "${url#git+}")"
+                if [ -n "$index" ]; then
+                    n="$(qmap_keys "$index" "packages" | grep -c . || true)"
+                    echo "  $url — $n package(s)"
+                else
+                    echo "  $url — UNREACHABLE or no index.yaml"
+                fi
+            done < <(registries_list "$IP_ROOT/intelligence.yaml")
             [ "$found" -eq 0 ] && echo "  (none)"
         fi
-        bundled="$(default_index_file)"
-        if [ -n "$bundled" ]; then
-            echo "Bundled index:"
-            while IFS= read -r name; do
-                [ -n "$name" ] || continue
-                echo "  $name -> $(qmap_field "$bundled" "packages" "$name" "url")"
-            done < <(qmap_keys "$bundled" "packages")
-        fi
-        echo "Fallback: @org/name -> https://github.com/org/name.git"
+        echo "Names resolve ONLY through the list above. Registry-less installs are explicit: github:org/repo, git+<url>."
         ;;
     add)
-        scope="${2:-}"; url="${3:-}"
-        { [ -n "$scope" ] && [ -n "$url" ]; } || die "usage: intelligence registry add @scope <registry-repo-url>"
-        case "$scope" in @*/*) die "bind a scope (@acme), not a package name" ;; @*) ;; *) die "scope must start with @" ;; esac
+        url="${2:-}"
+        force=0
+        [ "${3:-}" = "--force" ] && force=1
+        [ -n "$url" ] || die "usage: intelligence registry add <registry-repo-url> [--force]"
+        case "$url" in
+            @*) die "registries are added by URL — names carry their own scope. To install a package: intelligence add $url/<name>" ;;
+        esac
         require_v2
-        # Validate at bind time, not at the first `add`: a registry is a git
-        # repo holding index.yaml, and a URL pointing at anything else (a pack
-        # repo, a typo) is a mistake worth hearing about now. The binding is
-        # still written — the registry may simply not be reachable yet.
+        # Fail closed: a URL that cannot produce an index is not a registry,
+        # and recording it would turn a typo here into a confusing failure at
+        # the first add. --force covers the one honest case: the registry is
+        # not published (or reachable) yet.
         index="$(_fetch_index "${url#git+}")"
         if [ -n "$index" ]; then
             n="$(qmap_keys "$index" "packages" | grep -c . || true)"
-            echo "  index.yaml reachable — $n package(s) offered"
+            echo "  index.yaml reachable — $n package(s):"
+            qmap_keys "$index" "packages" | sed 's/^/    /'
+        elif [ "$force" -eq 1 ]; then
+            echo "  WARN: no index.yaml at $url — recording anyway (--force)." >&2
         else
-            echo "  WARN: no index.yaml found at $url — 'intelligence add $scope/<name>' will fail until it has one." >&2
-            echo "        A registry is a git repo with index.yaml at its root (see the README of" >&2
-            echo "        https://github.com/ainova-systems/intelligence-registry for the format)." >&2
+            echo "ERROR: no index.yaml found at $url — not adding it." >&2
+            echo "  A registry is a git repo with index.yaml at its root, mapping names to sources:" >&2
+            echo "    packages:" >&2
+            echo "      \"@acme/backend\":" >&2
+            echo "        url: \"https://github.com/acme/intelligence.git\"" >&2
+            echo "        path: \"packs/backend\"      # omit when the repo IS the package" >&2
+            echo "  Format and an example: https://github.com/ainova-systems/intelligence-registry" >&2
+            echo "  A single repository needs no registry at all: intelligence add github:org/repo" >&2
+            echo "  Recording it ahead of a registry that does not exist yet: --force" >&2
+            exit 1
         fi
-        qmap_set_value "$IP_ROOT/intelligence.yaml" "registries" "$scope" "$url"
-        echo "$scope -> $url"
+        registries_add "$IP_ROOT/intelligence.yaml" "$url"
+        echo "added: $url"
         ;;
     remove)
-        scope="${2:-}"
-        [ -n "$scope" ] || die "usage: intelligence registry remove @scope"
+        url="${2:-}"
+        [ -n "$url" ] || die "usage: intelligence registry remove <url>"
         require_v2
-        qmap_delete_key "$IP_ROOT/intelligence.yaml" "registries" "$scope"
-        echo "unbound $scope"
+        registries_remove "$IP_ROOT/intelligence.yaml" "$url"
+        # The retired flat-map form also stored scope keys — drop one if the
+        # argument names it, so old manifests clean up with the old command.
+        case "$url" in
+            @*) qmap_delete_key "$IP_ROOT/intelligence.yaml" "registries" "$url" ;;
+        esac
+        echo "removed: $url"
         ;;
     *)
-        die "usage: intelligence registry <list | add @scope <url> | remove @scope>"
+        die "usage: intelligence registry <list | add <url> [--force] | remove <url>>"
         ;;
 esac

package/cli/commands/remove.sh

@@ -6,15 +6,27 @@ source "$CLI_DIR/lib/cli-common.sh"
 name="${1:-}"
 [ -n "$name" ] || die "usage: intelligence remove <@scope/name>"
 shift || true
-no_sync=0
+no_sync=0 force=0
 for a in "$@"; do
     case "$a" in
         --no-sync) no_sync=1 ;;
+        --force) force=1 ;;
         *) die "unknown option '$a'" ;;
     esac
 done
 
 require_v2
+
+# Removing the engine-content package guts the outputs (meta-skills, the
+# authoring rule, both engine agents disappear) while everything still
+# reports ok — legal, but never by accident.
+if [ "$name" = "$SYNC_PKG_NAME" ] && [ "$force" -eq 0 ]; then
+    echo "ERROR: $SYNC_PKG_NAME is the engine's own content — removing it drops every" >&2
+    echo "  intelligence-* meta-skill, the authoring rule and the engine agents from" >&2
+    echo "  the outputs. The sync engine itself keeps working (it ships with the CLI)." >&2
+    echo "  If that is what you want: intelligence remove $SYNC_PKG_NAME --force" >&2
+    exit 1
+fi
 assert_valid_pkg_name "$name"
 manifest="$IP_ROOT/intelligence.yaml"
 lock="$IP_ROOT/intelligence.lock"

package/cli/commands/search.sh

@@ -4,7 +4,7 @@
 # "what does this project depend on", `search` answers "what could it".
 #
 # Sources, in resolution order (a name found earlier wins, exactly as `add`
-# resolves it): every scope bound in the manifest, then the bundled index.
+# resolves it): the manifest's trusted registries, in order.
 set -euo pipefail
 source "$CLI_DIR/lib/cli-common.sh"
 
@@ -33,6 +33,9 @@ pkg_state() {
 
 seen=" "
 rows=0
+# emit_index <index-file> <origin-label>
+# Registries are consulted in trust order; the first to declare a name wins,
+# so a name already seen is not repeated (that IS the resolution order).
 emit_index() {
     local index="$1" origin="$2" name desc state
     [ -n "$index" ] && [ -f "$index" ] || return 0
@@ -56,29 +59,25 @@ emit_index() {
 }
 
 if [ -n "$manifest" ]; then
-    while IFS= read -r scope; do
-        [ -n "$scope" ] || continue
-        url="$(qmap_value "$manifest" "registries" "$scope")"
+    while IFS= read -r url; do
         [ -n "$url" ] || continue
         index="$(_fetch_index "${url#git+}")"
         if [ -z "$index" ]; then
-            echo "  WARN: registry for $scope is unreachable or has no index.yaml: $url" >&2
+            echo "  WARN: registry unreachable or missing index.yaml: $url" >&2
             continue
         fi
-        emit_index "$index" "$scope -> $url"
-    done < <(qmap_keys "$manifest" "registries")
+        emit_index "$index" "$url"
+    done < <(registries_list "$manifest")
 fi
-emit_index "$(default_index_file)" "bundled"
-
 if [ "$rows" -eq 0 ]; then
     if [ -n "$term" ]; then
-        echo "Nothing matching '$term' in the configured registries."
+        echo "Nothing matching '$term' in this project's trusted registries."
     else
-        echo "No registries hold any packages."
+        echo "No trusted registries (or they offer nothing) — intelligence registry add <repo-url>."
     fi
-    echo "Any git repo with rules/, agents/ or skills/ is a package: intelligence add @org/repo"
+    echo "Explicit installs need no registry: intelligence add github:org/repo"
     exit 0
 fi
 
 echo ""
-echo "add one: intelligence add <name>   |   private registry: intelligence registry add @scope <repo-url>"
+echo "add one: intelligence add <name>   |   private registry: intelligence registry add <repo-url>"