@ainova-systems/intelligence 0.11.0-rc.4 → 0.11.0-rc.6

package/cli/commands/status.sh

@@ -13,12 +13,13 @@ case "$IP_MODE" in
         else
             echo "Lockfile: none (no packages added yet)"
         fi
-        if [ -f "$IP_ROOT/.intelligence/engine/.version" ]; then
-            echo "Store:    .intelligence/engine at $(tr -d ' \t\r\n' < "$IP_ROOT/.intelligence/engine/.version")"
+        sync_locked="$(qmap_field "$IP_ROOT/intelligence.lock" "packages" "$SYNC_PKG_NAME" "resolved")"
+        if [ -n "$sync_locked" ]; then
+            echo "Content:  $SYNC_PKG_NAME at $sync_locked"
         else
-            echo "Store:    not staged — run 'intelligence install'"
+            echo "Content:  no $SYNC_PKG_NAME (bare setup)"
         fi
-        echo "Engine:   $(bundled_engine_version) (bundled)"
+        echo "Engine:   $(bundled_engine_version) (bundled with the CLI)"
         ;;
     legacy)
         echo "Project:  $IP_ROOT (vendored v1 setup)"

package/cli/commands/sync.sh

@@ -6,7 +6,25 @@ source "$CLI_DIR/lib/cli-common.sh"
 detect_project
 case "$IP_MODE" in
     v2)
-        ensure_engine_staged "$IP_ROOT"
+        # Fail closed, never skip silently: a store-backed source that is not
+        # on disk means the project is not installed (or predates the package
+        # model) — syncing would quietly drop whole rule sets.
+        missing="" stale=0
+        for section in rules agents skills; do
+            while IFS= read -r src; do
+                [ -n "$src" ] || continue
+                case "$src" in
+                    .intelligence/engine/*) stale=1 ;;
+                    .intelligence/*) [ -d "$IP_ROOT/$src" ] || missing="$missing $src" ;;
+                esac
+            done < <(read_yaml_list "$IP_ROOT/intelligence.yaml" "$section")
+        done
+        if [ "$stale" -eq 1 ]; then
+            die "this manifest predates the engine-content package (.intelligence/engine sources) — run 'intelligence upgrade'"
+        fi
+        if [ -n "$missing" ]; then
+            die "installed content missing on disk:$missing — run 'intelligence install'"
+        fi
         export_engine_env "$IP_ROOT"
         exec bash "$IS_ENGINE_DIR/scripts/sync.sh" "$@"
         ;;

package/cli/commands/update.sh

@@ -21,29 +21,48 @@ require_v2
 manifest="$IP_ROOT/intelligence.yaml"
 lock="$IP_ROOT/intelligence.lock"
 
-moved=0 checked=0
+moved=0 found=0
 while IFS= read -r name; do
     [ -n "$name" ] || continue
     [ -n "$only" ] && [ "$name" != "$only" ] && continue
+    # A named package that exists is "found" whatever happens next — a skip
+    # message followed by "not in the manifest" would contradict itself.
+    found=1
+    if [ "$name" = "$SYNC_PKG_NAME" ]; then
+        echo "  $name: engine content moves with the engine — 'intelligence upgrade' owns it"
+        continue
+    fi
     ref="$(qmap_field "$manifest" "packages" "$name" "ref")"
     [ -n "$ref" ] && { echo "  $name: pinned to ref '$ref' — skipped"; continue; }
     range="$(qmap_field "$manifest" "packages" "$name" "version")"
+    # An exact version is a pin, same as ref: — update never moves pins.
+    if [ -n "$range" ] && semver_is_stable "$range"; then
+        echo "  $name: pinned to $range — edit the manifest to move it"
+        continue
+    fi
     url="$(qmap_field "$manifest" "packages" "$name" "url")"
     path="$(qmap_field "$manifest" "packages" "$name" "path")"
     if [ -z "$url" ]; then
         resolve_package_source "$manifest" "$name"
         url="$RES_URL"; path="$RES_PATH"
     fi
-    checked=$((checked + 1))
     picked="$(list_remote_versions "$url" | semver_pick_highest "$range")"
     [ -n "$picked" ] || { echo "  $name: nothing satisfies '${range:-*}' at $url" >&2; continue; }
     read -r tag _ <<< "$(remote_tag_for_version "$url" "$picked")"
     current="$(qmap_field "$lock" "packages" "$name" "resolved")"
-    if [ "$tag" = "$current" ]; then
+    cur_url="$(qmap_field "$lock" "packages" "$name" "url")"
+    cur_path="$(qmap_field "$lock" "packages" "$name" "path")"
+    # Same tag is not enough: a registry may re-point a name's source while
+    # keeping the version — the move doctor warns about must be actionable
+    # here, so url/path changes refetch too.
+    if [ "$tag" = "$current" ] && [ "$url" = "$cur_url" ] && [ "$path" = "$cur_path" ]; then
         echo "  $name: ${current:-<none>} (up to date)"
         continue
     fi
     rel=".intelligence/packages/$name"
+    # The new version may have dropped a top-level section dir: unwire the old
+    # shape first, or a dangling store-backed source bricks the next sync.
+    unwire_package_sources "$manifest" "$rel"
     sha="$(fetch_package "$url" "$tag" "$path" "$IP_ROOT/$rel")"
     wire_package_sources "$manifest" "$name" "$rel" "$IP_ROOT"
     lock_upsert "$lock" "$name" "$range" "$url" "$path" "$tag" "$sha"
@@ -51,7 +70,7 @@ while IFS= read -r name; do
     moved=$((moved + 1))
 done < <(qmap_keys "$manifest" "packages")
 
-[ -n "$only" ] && [ "$checked" -eq 0 ] && die "package '$only' is not in the manifest"
+[ -n "$only" ] && [ "$found" -eq 0 ] && die "package '$only' is not in the manifest"
 echo "updated: $moved package(s)"
 
 if [ "$moved" -gt 0 ] && [ "$no_sync" -eq 0 ]; then

package/cli/commands/upgrade.sh

@@ -1,7 +1,7 @@
 #!/bin/bash
-# intelligence upgrade — bring the project to this CLI's engine: restage the
-# engine content, apply v2 schema migrations (none yet — the chain starts
-# empty by design), restamp sync_version, sync.
+# intelligence upgrade — bring the project to this CLI's engine: apply v2
+# schema migrations, align the engine-content package to the bundled version,
+# restamp sync_version, sync.
 set -euo pipefail
 source "$CLI_DIR/lib/cli-common.sh"
 
@@ -14,13 +14,54 @@ if [ -n "$stamp" ] && _ver_gt "$stamp" "$eng"; then
     die "manifest schema $stamp is newer than this CLI's engine $eng — update the CLI first: npm i -g @ainova-systems/intelligence@latest"
 fi
 
-# v2 schema migrations live HERE, not in the engine's chain (that one owns
-# vendored layouts). Same discipline: ascending, append-only, each migration
-# self-detects and no-ops when already applied.
-# V2_MIGRATIONS=( )  — first entry arrives with the first breaking v2 change.
+# --- v2 schema migrations -------------------------------------------------
+# The engine's own chain owns vendored layouts; this one owns the manifest.
+# Same discipline: ascending, append-only, each migration self-detects and
+# no-ops when already applied.
+
+# v2 migration 1: staged engine content -> the @ainova-systems/sync package.
+# Pre-package manifests listed `.intelligence/engine/{rules,agents,skills}`
+# as sources fed by a CLI-staged copy; that copy is now an ordinary package
+# entry seeded from the bundle. Post-condition: no `.intelligence/engine`
+# source entries, the package present in manifest+lock+store, stale dir gone.
+migrated=0
+for section in rules agents skills; do
+    while IFS= read -r src; do
+        case "$src" in
+            .intelligence/engine/*)
+                sources_remove_entry "$manifest" "$section" "$src"
+                migrated=1
+                ;;
+        esac
+    done < <(read_yaml_list "$manifest" "$section")
+done
+if [ "$migrated" -eq 1 ]; then
+    echo "  migrating: staged engine content -> $SYNC_PKG_NAME package"
+    rm -rf "$IP_ROOT/.intelligence/engine"
+    sync_pkg_entry "$manifest"
+    sync_pkg_install "$IP_ROOT"
+fi
+
+# --- steady state ---------------------------------------------------------
+# Align the engine-content package with the bundled engine. Only a manifest
+# that HAS the entry is touched — a --bare project opted out, and upgrade
+# respects that.
+have_pkg=0
+while IFS= read -r name; do
+    [ "$name" = "$SYNC_PKG_NAME" ] && have_pkg=1
+done < <(qmap_keys "$manifest" "packages")
+if [ "$have_pkg" -eq 1 ] && [ "$migrated" -eq 0 ]; then
+    pinned="$(qmap_field "$manifest" "packages" "$SYNC_PKG_NAME" "version")"
+    if [ "$pinned" != "$eng" ]; then
+        echo "  $SYNC_PKG_NAME: $pinned -> $eng"
+    fi
+    sync_pkg_entry "$manifest"
+    sync_pkg_install "$IP_ROOT"
+fi
+if [ "$have_pkg" -eq 0 ] && [ "$migrated" -eq 0 ]; then
+    echo "  NOTE: $SYNC_PKG_NAME is not in this manifest (bare setup) — engine meta-skills stay uninstalled; 'intelligence add $SYNC_PKG_NAME' opts back in." >&2
+fi
 
-stage_engine_content "$IP_ROOT/.intelligence/engine"
-echo "  engine content restaged ($eng)"
 stamp_version "$manifest" "$eng"
 echo "  sync_version -> $eng"
 

package/cli/engine-package.yaml

@@ -0,0 +1,14 @@
+# What THIS CLI distribution ships as its engine-content package, and which
+# registry its init seeds into new manifests. Data, not code: a fork or an
+# enterprise mirror edits this file (or its copy in the npm build) — nothing
+# in cli/ names a vendor.
+#
+# The engine-content package is the one package whose content documents the
+# engine scripts bundled with the CLI: init writes this entry into the
+# manifest (visible, removable), its pin always equals the engine VERSION,
+# `upgrade` moves it, and at the matching version it materializes from the
+# bundle without network.
+name: "@ainova-systems/sync"
+url: "https://github.com/ainova-systems/intelligence-sync.git"
+path: "intelligence/sync"
+default_registry: "https://github.com/ainova-systems/intelligence-registry.git"

package/cli/lib/cli-common.sh

@@ -24,10 +24,23 @@ source "$CLI_DIR/lib/semver.sh"
 source "$CLI_DIR/lib/registry.sh"
 source "$CLI_DIR/lib/lockfile.sh"
 
-# Meta-skills that the CLI replaces with first-class commands — staging skips
-# them so a v2 project never carries a skill telling the agent to run a flow
-# the CLI already owns.
-CLI_OBSOLETE_SKILLS="intelligence-update intelligence-sync"
+# The engine-content package: OPTIONAL but auto-selected at init. Package by
+# UX (manifest entry, lockfile row, list/search/remove), bundle by mechanics —
+# at the version the CLI ships, it materializes from the npm bundle without
+# network; only a cross-version install reaches git. The pin is held exactly
+# at the bundled engine version and moved only by `upgrade`.
+#
+# Its identity is DATA shipped with the distribution (cli/engine-package.yaml),
+# never a name compiled into cli code — a fork edits the file.
+_EPKG="$CLI_DIR/engine-package.yaml"
+SYNC_PKG_NAME="$(top_scalar "$_EPKG" "name")"
+SYNC_PKG_URL="$(top_scalar "$_EPKG" "url")"
+SYNC_PKG_PATH="$(top_scalar "$_EPKG" "path")"
+# Read by commands (init seeds it) — per-file shellcheck cannot see that.
+# shellcheck disable=SC2034
+DEFAULT_REGISTRY_URL="$(top_scalar "$_EPKG" "default_registry")"
+[ -n "$SYNC_PKG_NAME" ] || die "corrupt CLI installation: $_EPKG is missing or has no 'name'"
+SYNC_PKG_STORE=".intelligence/packages/$SYNC_PKG_NAME"
 
 # --- Project detection ---------------------------------------------------
 # Sets: IP_MODE (v2|legacy|none), IP_ROOT, IP_UMBRELLA, IP_MODULE_DIR.
@@ -90,51 +103,26 @@ bundled_engine_version() {
     tr -d ' \t\r\n' < "$IS_ENGINE_DIR/scripts/VERSION"
 }
 
-# --- Engine content staging ----------------------------------------------
-# The v2 project vendors no engine code; the engine's own rules / agents /
-# meta-skills / docs are staged into the package store so sources can reach
-# them as ordinary repo-relative dirs. Re-staged whenever the bundled engine
-# version differs from the `.version` stamp.
-# stage_engine_content <dest-dir> — unconditional copy of the engine's own
-# content into <dest-dir> plus the `.version` stamp.
-stage_engine_content() {
-    local store="$1"
-    rm -rf "$store"
-    mkdir -p "$store"
-    local d s name skip
-    # `scripts` travels too: engine-shipped skills reference `<module>/scripts/…`
-    # (adapters, docs) and `<module>` resolves here, so the paths they hand an
-    # agent must exist. Running that sync.sh directly is harmless — outside CLI
-    # mode it fails closed rather than generating against the wrong layout.
-    for d in rules agents docs scripts; do
-        [ -d "$IS_ENGINE_DIR/$d" ] && cp -R "$IS_ENGINE_DIR/$d" "$store/$d"
-    done
-    if [ -d "$IS_ENGINE_DIR/skills" ]; then
-        mkdir -p "$store/skills"
-        for s in "$IS_ENGINE_DIR"/skills/*/; do
-            [ -d "$s" ] || continue
-            name="$(basename "$s")"
-            skip=0
-            for d in $CLI_OBSOLETE_SKILLS; do
-                [ "$name" = "$d" ] && skip=1
-            done
-            [ "$skip" = "1" ] && continue
-            cp -R "$s" "$store/skills/$name"
-        done
-    fi
-    bundled_engine_version > "$store/.version"
+# --- The sync package's manifest/lock plumbing ---------------------------
+# sync_pkg_entry <manifest> — write/refresh the package's manifest entry:
+# name + exact pin + explicit url/path, so resolution never depends on any
+# registry (a project registry shadowing the name cannot brick the engine).
+sync_pkg_entry() {
+    local manifest="$1"
+    qmap_set "$manifest" "packages" "$SYNC_PKG_NAME" "version" "$(bundled_engine_version)"
+    qmap_set "$manifest" "packages" "$SYNC_PKG_NAME" "url" "$SYNC_PKG_URL"
+    qmap_set "$manifest" "packages" "$SYNC_PKG_NAME" "path" "$SYNC_PKG_PATH"
 }
 
-ensure_engine_staged() {
-    local root="$1"
-    local store="$root/.intelligence/engine"
-    local bundled_ver staged_ver
-    bundled_ver="$(bundled_engine_version)"
-    staged_ver=""
-    [ -f "$store/.version" ] && staged_ver="$(tr -d ' \t\r\n' < "$store/.version")"
-    [ "$staged_ver" = "$bundled_ver" ] && return 0
-    stage_engine_content "$store"
-    echo "  engine content staged: .intelligence/engine ($bundled_ver)"
+# sync_pkg_install <root> — materialize the package into the store and lock
+# it (offline at the bundled version — fetch_package's bundle-seed guard).
+sync_pkg_install() {
+    local root="$1" ver sha
+    ver="$(bundled_engine_version)"
+    sha="$(fetch_package "$SYNC_PKG_URL" "v$ver" "$SYNC_PKG_PATH" "$root/$SYNC_PKG_STORE")"
+    wire_package_sources "$root/intelligence.yaml" "$SYNC_PKG_NAME" "$SYNC_PKG_STORE" "$root"
+    lock_upsert "$root/intelligence.lock" "$SYNC_PKG_NAME" "$ver" "$SYNC_PKG_URL" "$SYNC_PKG_PATH" "v$ver" "$sha"
+    echo "  engine content installed: $SYNC_PKG_STORE (v$ver)"
 }
 
 # --- The engine env contract ---------------------------------------------
@@ -147,7 +135,8 @@ export_engine_env() {
     export CONFIG_FILE="$root/intelligence.yaml"
     export REPO_ROOT="$root"
     export IS_UMBRELLA_REL="$umbrella"
-    export IS_MODULE_REL=".intelligence/engine"
+    export IS_MODULE_REL="$SYNC_PKG_STORE"
     export IS_SYNC_CMD="intelligence sync"
+    export IS_MANIFEST_NAME="intelligence.yaml"
     export IS_PROTECTED_DIRS="$umbrella:.intelligence"
 }

package/cli/lib/manifest.sh

@@ -24,6 +24,16 @@ assert_valid_pkg_name() {
     case "$1" in
         *[!@/A-Za-z0-9._-]*|*/*/*) die "invalid package name '$1' — allowed: letters, digits, . _ -, one '/'" ;;
     esac
+    # Both segments become store path components fed to rm -rf: an empty one
+    # ('@scope/') resolves to the whole scope dir, and a dot segment walks the
+    # tree — either would turn one bad --name into deleting other packages.
+    local scope="${1%%/*}" short="${1#*/}"
+    case "${scope#@}" in
+        ""|.|..) die "invalid package name '$1' — empty or dot scope" ;;
+    esac
+    case "$short" in
+        ""|.|..) die "invalid package name '$1' — empty or dot name" ;;
+    esac
 }
 
 # qmap_keys <file> <block> — quoted keys, one per line.
@@ -194,6 +204,114 @@ qmap_delete_key() {
     '
 }
 
+# --- registries: a trust LIST, not a scope map -----------------------------
+# The block holds registry repo URLs in trust order. Two shapes are read so
+# early manifests keep working: the list form (`- "url"`) and the retired
+# flat-map form (`"@scope": "url"` — the scope label is ignored, the URL is
+# simply another registry).
+
+# registries_list <file> — registry URLs, one per line, manifest order.
+registries_list() {
+    [ -f "$1" ] || return 0
+    awk '
+        { sub(/\r$/, "") }
+        /^registries:[ \t]*$/ { inb = 1; next }
+        inb && /^[^ #]/ { inb = 0 }
+        inb {
+            line = $0
+            if (line ~ /^[ \t]*-[ \t]*/) {
+                sub(/^[ \t]*-[ \t]*/, "", line)
+            } else if (line ~ /^  "/) {
+                c = index(line, ":")
+                if (c == 0) next
+                line = substr(line, c + 1)
+            } else next
+            sub(/^[ \t]+/, "", line)
+            gsub(/["\x27]/, "", line)
+            sub(/[ \t]+#.*$/, "", line)
+            sub(/[ \t]+$/, "", line)
+            if (line != "") print line
+        }
+    ' "$1"
+}
+
+# registries_add <file> <url> — idempotent append in list form.
+registries_add() {
+    local file="$1" url="$2" existing
+    while IFS= read -r existing; do
+        [ "$existing" = "$url" ] && return 0
+    done < <(registries_list "$file")
+    _qmap_stage "$file" -v url="$url" '
+        function entry() { return "  - \"" url "\"" }
+        { sub(/\r$/, "") }
+        /^registries:[ \t]*$/ { blockseen = 1; inb = 1; print; next }
+        inb && /^[^ #]/ { if (!done) { print entry(); done = 1 }; inb = 0 }
+        { last = $0; print }
+        END {
+            if (inb && !done) { print entry(); done = 1 }
+            if (!blockseen) {
+                if (last != "") print ""
+                print "registries:"
+                print entry()
+            }
+        }
+    '
+}
+
+# registries_remove <file> <url> — drop the entry, either shape.
+registries_remove() {
+    local file="$1" url="$2"
+    [ -f "$file" ] || return 0
+    _qmap_stage "$file" -v url="$url" '
+        { sub(/\r$/, "") }
+        /^registries:[ \t]*$/ { inb = 1; print; next }
+        inb && /^[^ #]/ { inb = 0 }
+        inb {
+            line = $0
+            v = ""
+            if (line ~ /^[ \t]*-[ \t]*/) { v = line; sub(/^[ \t]*-[ \t]*/, "", v) }
+            else if (line ~ /^  "/) { c = index(line, ":"); if (c > 0) v = substr(line, c + 1) }
+            if (v != "") {
+                sub(/^[ \t]+/, "", v)
+                gsub(/["\x27]/, "", v)
+                sub(/[ \t]+#.*$/, "", v)
+                sub(/[ \t]+$/, "", v)
+                if (v == url) next
+            }
+        }
+        { print }
+    '
+}
+
+# sources_add_entry_first <file> <section> <entry> — idempotent insert at the
+# TOP of sources.<section> (creating sources:/section as needed). Package
+# entries go through this so project-owned entries stay later in the list —
+# adapters copy sources in order and the last write wins, which is exactly
+# the documented "your file overrides the package's" behavior.
+sources_add_entry_first() {
+    local file="$1" section="$2" entry="$3"
+    _mig_has_source "$file" "$entry" && return 0
+    _qmap_stage "$file" -v section="$section" -v entry="$entry" '
+        function line() { return "    - \"" entry "\"" }
+        { sub(/\r$/, "") }
+        /^sources:[ \t]*$/ { ins = 1; sourceseen = 1; print; next }
+        ins && /^[^ #]/ {
+            if (!secseen && !done) { print "  " section ":"; print line(); done = 1 }
+            ins = 0
+        }
+        ins && $0 ~ "^  " section ":[ \t]*$" { secseen = 1; print; print line(); done = 1; next }
+        { print }
+        END {
+            if (ins && !secseen && !done) { print "  " section ":"; print line(); done = 1 }
+            if (!sourceseen) {
+                print "sources:"
+                print "  " section ":"
+                print line()
+            }
+        }
+    '
+}
+
 # sources_remove_entry <file> <section> <entry> — remove `- "entry"` from
 # sources.<section>. Inverse of the engine-side _mig_add_source.
 sources_remove_entry() {

package/cli/lib/registry.sh

@@ -1,23 +1,23 @@
 #!/bin/bash
 # Name -> source resolution and package fetching.
 #
-# Resolution order (first hit wins):
-#   1. project `registries:` — a scope bound to a registry repo (a git repo
-#      holding index.yaml); private orgs override anything shipped
-#   2. the bundled default index (registry/index.yaml next to the CLI)
-#   3. convention: @org/name -> https://github.com/org/name.git, content at
-#      the repo root — the zero-infrastructure default
+# A name resolves ONLY through the manifest's `registries:` trust list (git
+# repos holding index.yaml, consulted in order; the first to declare the name
+# wins). There is deliberately no built-in catalog and no name->github
+# convention: the CLI core knows no vendor, and a name nobody explicitly
+# trusted must never silently turn into an install from a guessed URL.
+# Sources without a registry are always EXPLICIT: github:org/repo, git+<url>.
+# Vendor defaults exist only as lines `init` writes into the manifest —
+# visible, reviewable, deletable.
+#
+# The NAME is the trust anchor a developer reasons with; source integrity is
+# a separate mechanism: the lock pins url+sha, and doctor flags
+# resolution/lock url drift.
 #
 # An index is itself fetched with git (never curl): auth, proxies and private
 # hosting all come for free, and the CLI keeps the engine's bash+awk+git-only
 # dependency footprint.
 
-default_index_file() {
-    local f="$CLI_DIR/../registry/index.yaml"
-    [ -f "$f" ] && printf '%s' "$f"
-    return 0
-}
-
 # _fetch_index <registry-repo-url> — clones the registry repo (shallow) and
 # prints the path of its index.yaml; empty on failure. Cached per run+url.
 _fetch_index() {
@@ -43,38 +43,57 @@ _fetch_index() {
 # shellcheck disable=SC2034
 resolve_package_source() {
     local manifest="$1" name="$2"
-    local scope="${name%%/*}" short="${name#*/}"
     RES_URL=""; RES_PATH=""; RES_VIA=""
 
+    local reg_url index
     if [ -n "$manifest" ] && [ -f "$manifest" ]; then
-        local reg_url index
-        reg_url="$(qmap_value "$manifest" "registries" "$scope")"
-        if [ -n "$reg_url" ]; then
+        while IFS= read -r reg_url; do
+            [ -n "$reg_url" ] || continue
             index="$(_fetch_index "${reg_url#git+}")"
-            [ -n "$index" ] || die "registry for scope '$scope' is unreachable or has no index.yaml: $reg_url"
+            if [ -z "$index" ]; then
+                echo "  WARN: registry unreachable or missing index.yaml, skipped: $reg_url" >&2
+                continue
+            fi
             RES_URL="$(qmap_field "$index" "packages" "$name" "url")"
-            RES_PATH="$(qmap_field "$index" "packages" "$name" "path")"
-            [ -n "$RES_URL" ] || die "package '$name' not found in the '$scope' registry ($reg_url)"
-            RES_VIA="registry:$reg_url"
-            return 0
-        fi
+            if [ -n "$RES_URL" ]; then
+                RES_PATH="$(qmap_field "$index" "packages" "$name" "path")"
+                RES_VIA="registry:$reg_url"
+                return 0
+            fi
+        done < <(registries_list "$manifest")
     fi
+    # No trusted registry declares the name. Deliberately NOT an invented
+    # URL: the caller reports it, with suggestions.
+    return 0
+}
 
-    local bundled
-    bundled="$(default_index_file)"
-    if [ -n "$bundled" ]; then
-        RES_URL="$(qmap_field "$bundled" "packages" "$name" "url")"
-        if [ -n "$RES_URL" ]; then
-            RES_PATH="$(qmap_field "$bundled" "packages" "$name" "path")"
-            RES_VIA="index"
-            return 0
-        fi
+# suggest_similar <manifest-or-empty> <@scope/name> — "Did you mean" lines to
+# stderr, matched on the short name (singular/plural tolerant) across every
+# trusted registry.
+suggest_similar() {
+    local manifest="$1" name="$2"
+    local want cand cshort reg_url index seen=" "
+    want="${name#*/}"; want="${want%s}"
+    _suggest_from() {
+        local idx="$1"
+        [ -n "$idx" ] && [ -f "$idx" ] || return 0
+        while IFS= read -r cand; do
+            [ -n "$cand" ] || continue
+            case "$seen" in *" $cand "*) continue ;; esac
+            cshort="${cand#*/}"; cshort="${cshort%s}"
+            if [ "$cshort" = "$want" ] && [ "$cand" != "$name" ]; then
+                seen="$seen$cand "
+                echo "  Did you mean: intelligence add $cand" >&2
+            fi
+        done < <(qmap_keys "$idx" "packages")
+    }
+    if [ -n "$manifest" ] && [ -f "$manifest" ]; then
+        while IFS= read -r reg_url; do
+            [ -n "$reg_url" ] || continue
+            index="$(_fetch_index "${reg_url#git+}")"
+            _suggest_from "$index"
+        done < <(registries_list "$manifest")
     fi
-
-    RES_URL="https://github.com/${scope#@}/$short.git"
-    RES_PATH=""
-    RES_VIA="convention"
-    return 0
 }
 
 # fetch_package <url> <ref> <subpath> <dest-dir>
@@ -84,6 +103,22 @@ resolve_package_source() {
 # store holds the bytes the package published.
 fetch_package() {
     local url="$1" ref="$2" subpath="$3" dest="$4"
+    # Bundle seed: the engine-content package at the CLI's own version copies
+    # from the npm bundle — no network, which keeps init / fresh-clone install
+    # / migrate offline exactly like the staging they replace. Keyed on the
+    # full (url, path, ref) triple; any other version or source falls through
+    # to the normal clone.
+    if [ "$url" = "$SYNC_PKG_URL" ] && [ "$subpath" = "$SYNC_PKG_PATH" ] \
+        && [ "${ref#v}" = "$(bundled_engine_version)" ]; then
+        rm -rf "$dest"
+        mkdir -p "$dest"
+        cp -R "$IS_ENGINE_DIR/." "$dest/"
+        rm -rf "$dest/.git"
+        if [ -f "$IS_ENGINE_DIR/scripts/ENGINE_SHA" ]; then
+            tr -d ' \t\r\n' < "$IS_ENGINE_DIR/scripts/ENGINE_SHA"
+        fi
+        return 0
+    fi
     local tmp sha src
     local -a branch_arg=()
     [ -n "$ref" ] && branch_arg=(--branch "$ref")
@@ -119,14 +154,14 @@ fetch_package() {
 
 # wire_package_sources <manifest> <@scope/name> <store-rel-dir>
 # The provides convention: whichever of rules/agents/skills the installed
-# package has becomes a sources entry. Reuses the engine's idempotent,
-# comment-preserving _mig_add_source.
+# package has becomes a sources entry — inserted FIRST in its section, so
+# project-owned entries come later and win on same-named artifacts.
 wire_package_sources() {
     local manifest="$1" name="$2" rel="$3" root="$4"
     local section
     for section in rules agents skills; do
         if [ -d "$root/$rel/$section" ]; then
-            _mig_add_source "$manifest" "$section" "$rel/$section"
+            sources_add_entry_first "$manifest" "$section" "$rel/$section"
         fi
     done
 }

package/cli/lib/semver.sh

@@ -75,7 +75,10 @@ semver_match() {
 # onto their tag.
 list_remote_versions() {
     local url="$1"
-    GIT_TERMINAL_PROMPT=0 git ls-remote --tags "$url" 2>/dev/null \
+    # `|| true` inside the pipeline: an unreachable repo must read as "no
+    # versions", not kill a pipefail caller mid-command-substitution —
+    # reachability is the CALLER's question (add probes it explicitly).
+    { GIT_TERMINAL_PROMPT=0 git ls-remote --tags "$url" 2>/dev/null || true; } \
         | awk '{
             sub(/\r$/, "")
             ref = $2
@@ -92,7 +95,7 @@ list_remote_versions() {
 # prints "<tag> <sha>". Peeled sha (the commit a tag object points at) wins.
 remote_tag_for_version() {
     local url="$1" ver="${2#v}"
-    GIT_TERMINAL_PROMPT=0 git ls-remote --tags "$url" 2>/dev/null \
+    { GIT_TERMINAL_PROMPT=0 git ls-remote --tags "$url" 2>/dev/null || true; } \
         | awk -v want="$ver" '
             {
                 sub(/\r$/, "")

package/engine/agents/intelligence-operator.md

@@ -19,10 +19,10 @@ that ships it.
 
 ## Expertise
 
-The bash-to-skill status contract (`docs/CONVENTIONS.md`, Migration & Module Contract). Every flow
-here is deterministic and fail-closed: `sync.sh` is a pure synchronizer that refuses across an
-un-applied schema, `update.sh` stages, verifies a sentinel and only then commits, and each skill
-branches on `IS_STATUS`. The work is running the right flow, reading the code it returns, and doing
+The status contract (`<module>/docs/CONVENTIONS.md`, Migration & Module Contract). Every flow
+here is deterministic and fail-closed: the sync is a pure synchronizer that refuses across an
+un-applied schema, the update flow stages, verifies and only then commits, and every flow
+reports `IS_STATUS`. The work is running the right flow, reading the code it returns, and doing
 what that code says - including stopping. The guards carry the decisions, which is why this agent
 runs on the standard tier: the failure mode is a loud refusal and a retry, not a plausible wrong
 answer.