@ainova-systems/intelligence 0.11.0-rc.6 → 0.11.0-rc.8

package/README.md

@@ -3,11 +3,11 @@
 **npm for AI agent intelligence.** One CLI that builds, versions and distributes the rules, agents and skills your AI coding tools run on — rendered natively for Claude Code, Cursor, GitHub Copilot, OpenAI Codex, Pi, OpenCode and `AGENTS.md`.
 
 ```bash
-npm install -g @ainova-systems/intelligence
+npm install -g @ainova-systems/intelligence@next
 
 cd your-project
 intelligence init
-intelligence add @ainova-systems/core
+intelligence package add @ainova-systems/core
 intelligence sync
 ```
 
@@ -22,25 +22,24 @@ intelligence/          # your own rules / agents / skills
 AGENTS.md
 ```
 
-Teammates need one command after cloning:
+Teammates need one command after cloning; it restores the locked package store before rendering:
 
 ```bash
-intelligence install
+intelligence sync
 ```
 
 ## Commands
 
 | Command | What it does |
 |---|---|
-| `intelligence init` | Detect your tools, write the manifest, first sync |
-| `intelligence add <pkg>` | `@scope/name[@range]`, `github:org/repo[#path]`, or `git+<url>[@ref][#path]` |
-| `intelligence install [--frozen]` | Restore `.intelligence/` exactly from the lockfile |
-| `intelligence update [pkg]` | Re-resolve version ranges, rewrite the lock |
-| `intelligence sync [target]` | Render intelligence to every enabled tool |
-| `intelligence list` / `doctor` / `status` | Inspect and verify |
-| `intelligence registry add @scope <url>` | Bind a scope to a private registry index |
-| `intelligence migrate` | Convert a vendored intelligence-sync setup to the CLI |
-
-Any git repo with `rules/`, `agents/` or `skills/` at its root is already an Intelligence Package: `intelligence add @your-org/your-repo` resolves it straight from GitHub — versions come from its `x.y.z` git tags. A monorepo of packages needs one line in a registry index.
-
-Requires `git` (and on Windows the bash it ships with — Git for Windows). Engine and docs: [ainova-systems/intelligence-sync](https://github.com/ainova-systems/intelligence-sync).
+| `intelligence init [--preview\|--apply]` | Create, convert, restore or align a project |
+| `intelligence sync [adapter]` | Restore locked content if needed, then render all or one enabled adapter |
+| `intelligence update [@scope/name] [--preview\|--apply]` | Plan or apply project and ranged-package updates |
+| `intelligence package add\|remove\|list\|search` | Manage versioned Intelligence Packages |
+| `intelligence adapter list\|create\|enable\|disable\|remove` | Manage render adapters |
+| `intelligence status [--check]` | Inspect project state and consistency |
+| `intelligence registry list\|add\|remove` | Manage trusted registry repositories |
+
+Any git repo with `rules/`, `agents/` or `skills/` at its root is already an Intelligence Package: install it from an explicit source — `intelligence package add github:your-org/your-repo` — with versions from its `x.y.z` git tags. Names (`@scope/name`) resolve only through registries this project explicitly trusts; a monorepo of packages needs one line in such an index.
+
+Requires `git` (and on Windows the bash it ships with — Git for Windows). Engine and docs: [ainova-systems/intelligence](https://github.com/ainova-systems/intelligence).

package/cli/commands/adapter.sh

@@ -0,0 +1,153 @@
+#!/bin/bash
+# intelligence adapter <list|create|enable|disable|remove> [name]
+set -euo pipefail
+source "$CLI_DIR/lib/cli-common.sh"
+
+action="${1:-}"
+name="${2:-}"
+
+adapter_list() {
+    detect_project
+    local manifest="" content_dir="" seen=" " file item enabled output configured
+    if [ "$IP_MODE" = "v2" ]; then
+        manifest="$IP_ROOT/intelligence.yaml"
+        content_dir="$(manifest_intelligence_dir "$manifest")"
+    fi
+
+    printf '%-16s %-10s %-10s %s\n' "NAME" "SOURCE" "STATE" "OUTPUT"
+    # Project adapters come first because they override built-ins by name.
+    if [ -n "$content_dir" ] && [ -d "$IP_ROOT/$content_dir/adapters" ]; then
+        for file in "$IP_ROOT/$content_dir/adapters"/*.sh; do
+            [ -f "$file" ] || continue
+            item="$(basename "$file" .sh)"
+            seen="$seen$item "
+            enabled="disabled"; output="$(default_target_output "$item")"
+            [ "$(is_target_enabled "$manifest" "$item")" = "1" ] && enabled="enabled"
+            configured="$(get_target_output "$manifest" "$item")"
+            [ -z "$configured" ] || output="$configured"
+            printf '%-16s %-10s %-10s %s\n' "$item" "project" "$enabled" "$output"
+        done
+    fi
+    for file in "$IS_ENGINE_DIR/adapters"/*.sh; do
+        [ -f "$file" ] || continue
+        item="$(basename "$file" .sh)"
+        [ "$item" = "_template" ] && continue
+        case "$seen" in *" $item "*) continue ;; esac
+        enabled="disabled"; output="$(default_target_output "$item")"
+        if [ -n "$manifest" ]; then
+            [ "$(is_target_enabled "$manifest" "$item")" = "1" ] && enabled="enabled"
+            configured="$(get_target_output "$manifest" "$item")"
+            [ -z "$configured" ] || output="$configured"
+        fi
+        printf '%-16s %-10s %-10s %s\n' "$item" "built-in" "$enabled" "$output"
+    done
+}
+
+adapter_create() {
+    [ -n "$name" ] && [ $# -eq 0 ] || die "usage: intelligence adapter create <name>"
+    assert_valid_target_name "$name"
+    require_v2
+    ensure_project_current "$IP_ROOT"
+    local manifest="$IP_ROOT/intelligence.yaml" content_dir repo_phys probe old_ifs part probe_phys
+    local template adapter_dir adapter_phys dest tmp
+    local -a parts
+    content_dir="$(manifest_intelligence_dir "$manifest")"
+    case "$content_dir" in
+        ""|/*|.|..|../*|*/../*|*/..|.intelligence|.intelligence/*)
+            die "unsafe project.intelligence_dir '$content_dir'"
+            ;;
+    esac
+    repo_phys="$(cd "$IP_ROOT" && pwd -P)"
+    probe="$IP_ROOT"
+    old_ifs="$IFS"; IFS='/'; read -r -a parts <<< "$content_dir"; IFS="$old_ifs"
+    for part in "${parts[@]}"; do
+        [ -n "$part" ] || continue
+        probe="$probe/$part"
+        if [ -e "$probe" ] || [ -L "$probe" ]; then
+            probe_phys="$(cd "$probe" 2>/dev/null && pwd -P)" || die "cannot resolve project content path '$content_dir'"
+            case "$probe_phys" in "$repo_phys"|"$repo_phys"/*) ;; *) die "project.intelligence_dir resolves outside the repository: '$content_dir'" ;; esac
+        fi
+    done
+    template="$IS_ENGINE_DIR/adapters/_template.sh"
+    [ -f "$template" ] || die "corrupt CLI installation: bundled adapter template is missing"
+    adapter_dir="$IP_ROOT/$content_dir/adapters"
+    dest="$adapter_dir/$name.sh"
+    [ ! -e "$dest" ] || die "project adapter already exists: $content_dir/adapters/$name.sh"
+    mkdir -p "$adapter_dir"
+    adapter_phys="$(cd "$adapter_dir" && pwd -P)"
+    case "$adapter_phys" in "$repo_phys"|"$repo_phys"/*) ;; *) die "project adapter directory resolves outside the repository" ;; esac
+    tmp="$(mktemp "$adapter_dir/.${name}.XXXXXX")"
+    trap '[ -z "${tmp:-}" ] || rm -f "$tmp"' EXIT
+    awk -v name="$name" '{ gsub(/<agent-name>/, name); gsub(/<Agent Name>/, name); gsub(/<name>/, name); print }' "$template" > "$tmp"
+    [ -s "$tmp" ] || die "adapter template produced an empty file"
+    mv "$tmp" "$dest"
+    tmp=""
+    echo "created: $content_dir/adapters/$name.sh"
+    echo "  implement sync_to_${name}(), then run: intelligence adapter enable $name"
+}
+
+adapter_remove() {
+    local apply=0 manifest content_dir file answer repo_phys adapter_dir adapter_phys
+    while [ $# -gt 0 ]; do
+        case "$1" in --apply) apply=1 ;; *) die "unknown option '$1'" ;; esac
+        shift
+    done
+    [ -n "$name" ] || die "usage: intelligence adapter remove <name> [--apply]"
+    assert_valid_target_name "$name"
+    require_v2
+    ensure_project_current "$IP_ROOT"
+    manifest="$IP_ROOT/intelligence.yaml"
+    content_dir="$(manifest_intelligence_dir "$manifest")"
+    case "$content_dir" in
+        ""|/*|.|..|../*|*/../*|*/..|.intelligence|.intelligence/*)
+            die "unsafe project.intelligence_dir '$content_dir'"
+            ;;
+    esac
+    repo_phys="$(cd "$IP_ROOT" && pwd -P)"
+    adapter_dir="$IP_ROOT/$content_dir/adapters"
+    [ -d "$adapter_dir" ] || die "project adapter '$name' does not exist"
+    adapter_phys="$(cd "$adapter_dir" 2>/dev/null && pwd -P)" || die "cannot resolve project adapter directory"
+    case "$adapter_phys" in "$repo_phys"|"$repo_phys"/*) ;; *) die "project adapter directory resolves outside the repository" ;; esac
+    file="$adapter_dir/$name.sh"
+    [ -f "$file" ] || die "project adapter '$name' does not exist"
+    [ "$(is_target_enabled "$manifest" "$name")" != "1" ] || die "adapter '$name' is enabled — disable it first"
+    echo "remove project adapter source: $content_dir/adapters/$name.sh"
+    if [ "$apply" -ne 1 ]; then
+        [ -t 0 ] || die "removal requires confirmation — rerun with --apply"
+        printf 'Remove it? [y/N] '
+        read -r answer
+        case "$answer" in y|Y|yes|YES) ;; *) echo "removal cancelled"; exit 0 ;; esac
+    fi
+    rm -f "$file"
+    echo "removed: $content_dir/adapters/$name.sh"
+    echo "  generated output was kept"
+}
+
+case "$action" in
+    list)
+        [ $# -eq 1 ] || die "usage: intelligence adapter list"
+        adapter_list
+        ;;
+    create)
+        shift 2 || true
+        adapter_create "$@"
+        ;;
+    enable|disable)
+        [ -n "$name" ] && [ $# -eq 2 ] || die "usage: intelligence adapter <enable|disable> <name>"
+        assert_valid_target_name "$name"
+        require_v2
+        ensure_project_current "$IP_ROOT"
+        bash "$CLI_DIR/internal/target-state.sh" "$action" "$name"
+        if [ "$action" = "enable" ]; then
+            exec bash "$CLI_DIR/commands/sync.sh"
+        fi
+        ;;
+    remove)
+        [ -n "$name" ] || die "usage: intelligence adapter remove <name> [--apply]"
+        shift 2 || true
+        adapter_remove "$@"
+        ;;
+    *)
+        die "usage: intelligence adapter <list|create|enable|disable|remove> [name]"
+        ;;
+esac

package/cli/commands/init.sh

@@ -1,24 +1,32 @@
 #!/bin/bash
-# intelligence init [--targets a,b,c] [--no-sync]
+# intelligence init [--targets a,b,c] [--dir name] [--bare] [--no-sync]
+#                   [--preview | --apply] [--force]
 #
 # Set up a project: root manifest, content skeleton, .gitignore, staged
 # engine content, first sync. Targets are detected from IDE markers unless
-# named explicitly; `agents` and `claude` are always on (AGENTS.md is the
-# canonical carrier of always-on rules, Claude Code does not read it).
+# named explicitly. Only `agents` is unconditional: AGENTS.md is the
+# tool-neutral carrier of always-on rules; tool targets come from markers or
+# --targets.
 set -euo pipefail
 source "$CLI_DIR/lib/cli-common.sh"
 
 targets_arg="" no_sync=0 content_dir="intelligence" bare=0
+targets_set=0 dir_set=0 bare_set=0 preview=0 apply=0 force=0
 while [ $# -gt 0 ]; do
     case "$1" in
-        --targets) shift; targets_arg="${1:-}" ;;
-        --dir) shift; content_dir="${1:-}" ;;
+        --targets) shift; targets_arg="${1:-}"; targets_set=1 ;;
+        --dir) shift; content_dir="${1:-}"; dir_set=1 ;;
         --no-sync) no_sync=1 ;;
-        --bare) bare=1 ;;
+        --bare) bare=1; bare_set=1 ;;
+        --preview) preview=1 ;;
+        --apply) apply=1 ;;
+        --force) force=1 ;;
         *) die "unknown option '$1'" ;;
     esac
     shift || true
 done
+[ "$preview" -eq 0 ] || [ "$apply" -eq 0 ] || die "choose either --preview or --apply"
+[ "$targets_set" -eq 0 ] || [ -n "$targets_arg" ] || die "--targets needs a comma-separated adapter list"
 [ -n "$content_dir" ] || die "--dir needs a directory name"
 case "$content_dir" in
     /*|*..*|.intelligence|.intelligence/*) die "--dir must be a plain directory inside the repo, and not the package store" ;;
@@ -26,12 +34,72 @@ esac
 
 detect_project
 case "$IP_MODE" in
-    v2) die "already set up — manifest at $IP_ROOT/intelligence.yaml (use 'intelligence status')" ;;
-    legacy) die "this is a vendored (v1) setup at $IP_UMBRELLA — run 'intelligence migrate' instead" ;;
+    v2)
+        [ "$targets_set" -eq 0 ] || die "--targets applies only when creating a new project"
+        [ "$dir_set" -eq 0 ] || die "--dir applies only when creating a new project"
+        [ "$bare_set" -eq 0 ] || die "--bare applies only when creating a new project"
+        [ "$force" -eq 0 ] || die "--force applies only when converting an archived v1 project"
+        if [ "$preview" -eq 1 ]; then
+            check_version_compat "$IP_ROOT/intelligence.yaml"
+            echo "project: v2 at $IP_ROOT"
+            if project_needs_upgrade "$IP_ROOT"; then
+                echo "  would align project lifecycle with engine $(bundled_engine_version)"
+            else
+                echo "  schema/content already match engine $(bundled_engine_version)"
+            fi
+            if project_has_packages "$IP_ROOT" && [ ! -f "$IP_ROOT/intelligence.lock" ]; then
+                die "manifest declares packages but intelligence.lock is absent — restore the committed lock before applying"
+            fi
+            if project_store_missing "$IP_ROOT"; then
+                echo "  would restore .intelligence/ from intelligence.lock"
+            else
+                echo "  package store already present"
+            fi
+            if [ "$no_sync" -eq 1 ]; then
+                echo "  would stop before intelligence sync"
+            else
+                echo "  would run intelligence sync"
+            fi
+            exit 0
+        fi
+        if [ "$apply" -eq 1 ]; then
+            ensure_project_current "$IP_ROOT" --explicit
+        else
+            ensure_project_current "$IP_ROOT"
+        fi
+        restore_project_store_if_missing "$IP_ROOT"
+        [ "$no_sync" -eq 1 ] && exit 0
+        cd "$IP_ROOT"
+        exec bash "$CLI_DIR/commands/sync.sh"
+        ;;
+    legacy)
+        [ "$targets_set" -eq 0 ] || die "--targets applies only when creating a new project"
+        [ "$dir_set" -eq 0 ] || die "--dir applies only when creating a new project"
+        [ "$bare_set" -eq 0 ] || die "--bare applies only when creating a new project"
+        [ "$no_sync" -eq 0 ] || die "--no-sync cannot skip transactional conversion verification"
+        migrate_args=()
+        [ "$force" -eq 1 ] && migrate_args+=(--force)
+        if [ "$preview" -eq 1 ]; then
+            exec bash "$CLI_DIR/internal/migrate-v1.sh" --dry-run ${migrate_args[@]+"${migrate_args[@]}"}
+        fi
+        if [ "$apply" -eq 1 ]; then
+            exec bash "$CLI_DIR/internal/migrate-v1.sh" ${migrate_args[@]+"${migrate_args[@]}"}
+        fi
+        bash "$CLI_DIR/internal/migrate-v1.sh" --dry-run ${migrate_args[@]+"${migrate_args[@]}"}
+        [ -t 0 ] || die "v1 migration requires confirmation — rerun 'intelligence init --apply'"
+        printf 'Apply this migration? [Y/n] '
+        read -r answer
+        case "$answer" in
+            ""|y|Y|yes|YES) exec bash "$CLI_DIR/internal/migrate-v1.sh" ${migrate_args[@]+"${migrate_args[@]}"} ;;
+            *) echo "migration cancelled"; exit 0 ;;
+        esac
+        ;;
 esac
 
+[ "$force" -eq 0 ] || die "--force applies only when converting an archived v1 project"
 root="$(git rev-parse --show-toplevel 2>/dev/null || pwd)"
 root="$(cd "$root" && pwd)"
+assert_safe_content_dir "$root" "$content_dir"
 
 # Never invent a tool the project shows no trace of: every per-tool target is
 # DETECTED from repo markers or named explicitly via --targets. Only `agents`
@@ -39,7 +107,14 @@ root="$(cd "$root" && pwd)"
 # the invariant-required carrier once any of them is on) is unconditional.
 targets="agents"
 if [ -n "$targets_arg" ]; then
-    targets="agents $(printf '%s' "$targets_arg" | tr ',' ' ')"
+    for target in $(printf '%s' "$targets_arg" | tr ',' ' '); do
+        assert_valid_target_name "$target"
+        if [ ! -f "$IS_ENGINE_DIR/adapters/$target.sh" ] \
+            && [ ! -f "$root/$content_dir/adapters/$target.sh" ]; then
+            die "adapter '$target' not found — create it after init with: intelligence adapter create $target"
+        fi
+        case " $targets " in *" $target "*) ;; *) targets="$targets $target" ;; esac
+    done
 else
     if [ -d "$root/.claude" ] || [ -f "$root/CLAUDE.md" ]; then targets="$targets claude"; fi
     [ -d "$root/.cursor" ] && targets="$targets cursor"
@@ -53,16 +128,32 @@ else
     fi
 fi
 
+if [ "$preview" -eq 1 ]; then
+    echo "project: no Intelligence setup found"
+    echo "  would create intelligence.yaml and intelligence.lock"
+    if [ "$bare" -eq 1 ]; then
+        echo "  would omit the bundled sync-content package (--bare)"
+    else
+        echo "  would install the bundled sync-content package"
+    fi
+    if [ "$no_sync" -eq 1 ]; then
+        echo "  would enable adapters:$targets and stop before sync"
+    else
+        echo "  would enable adapters:$targets, then sync"
+    fi
+    exit 0
+fi
+
 manifest="$root/intelligence.yaml"
 {
     echo "# Intelligence manifest — what this project's AI tooling knows and where it goes."
-    echo "# Managed by the intelligence CLI. Reference: https://github.com/ainova-systems/intelligence-sync"
+    echo "# Managed by the intelligence CLI. Reference: https://github.com/ainova-systems/intelligence"
     echo "project:"
     echo "  name: \"$(basename "$root")\""
     [ "$content_dir" = "intelligence" ] || echo "  intelligence_dir: \"$content_dir\""
     echo ""
     echo "# Schema version of this manifest. The CLI keeps it in step with its engine."
-    echo "sync_version: \"$(bundled_engine_version)\""
+    echo "schema_version: \"$(bundled_engine_version)\""
     echo ""
     echo "# Where content comes from. Nothing here has to exist: a directory that is"
     echo "# absent is skipped, so a project consuming only packages authors nothing of"
@@ -84,15 +175,12 @@ manifest="$root/intelligence.yaml"
     echo "# Generated output, one entry per tool. Add or drop tools freely."
     echo "targets:"
     for t in $targets; do
-        case "$t" in
-            agents) echo "  agents: { enabled: true, output: \"AGENTS.md\" }" ;;
-            *) echo "  $t: { enabled: true, output: \".$t\" }" ;;
-        esac
+        echo "  $t: { enabled: true, output: \"$(default_target_output "$t")\" }"
     done
     echo ""
-    echo "# Packages are managed with 'intelligence add' / 'search' / 'list':"
-    echo "#   intelligence add @ainova-systems/core       from the registry"
-    echo "#   intelligence add github:org/repo            any repo with rules|agents|skills"
+    echo "# Packages are managed with 'intelligence package add|search|list':"
+    echo "#   intelligence package add @ainova-systems/core       from the registry"
+    echo "#   intelligence package add github:org/repo            any repo with rules|agents|skills"
     echo "# packages:"
     echo "#   \"@ainova-systems/core\":"
     echo "#     version: \"^0.3.0\""
@@ -117,14 +205,14 @@ manifest="$root/intelligence.yaml"
 if [ ! -f "$root/.gitignore" ] || ! grep -q '^\.intelligence/' "$root/.gitignore"; then
     {
         [ -f "$root/.gitignore" ] && [ -n "$(tail -c 1 "$root/.gitignore" 2>/dev/null)" ] && echo ""
-        echo "# intelligence CLI package store (restored by 'intelligence install')"
+        echo "# intelligence CLI package store (restored automatically by 'intelligence sync')"
         echo ".intelligence/"
     } >> "$root/.gitignore"
 fi
 
 # The engine's own content (meta-skills, authoring rule, engine agents) is an
 # ordinary package: auto-selected, opted out with --bare, removable later with
-# 'intelligence remove @ainova-systems/sync --force'.
+# 'intelligence package remove @ainova-systems/sync --force'.
 if [ "$bare" -eq 0 ]; then
     sync_pkg_entry "$manifest"
     sync_pkg_install "$root"
@@ -132,9 +220,12 @@ fi
 
 echo "initialized: intelligence.yaml (targets:$(printf ' %s' $targets))"
 [ "$bare" -eq 1 ] && echo "  bare setup: no packages — engine meta-skills not installed"
-echo "  add packages:  intelligence add @ainova-systems/core   (browse: intelligence search)"
+echo "  add packages:  intelligence package add @ainova-systems/core   (browse: intelligence package search)"
 echo "  write your own: create $content_dir/rules/context.md, then intelligence sync"
-echo "  docs: https://github.com/ainova-systems/intelligence-sync#readme"
+if [ "$bare" -eq 0 ]; then
+    echo "  tailor this repository: ask your agent to run /intelligence-learn-from-repository after sync"
+fi
+echo "  docs: https://github.com/ainova-systems/intelligence#readme"
 
 if [ "$no_sync" -eq 0 ]; then
     cd "$root"

package/cli/commands/package.sh

@@ -0,0 +1,30 @@
+#!/bin/bash
+# intelligence package <add|remove|list|search> ...
+set -euo pipefail
+source "$CLI_DIR/lib/cli-common.sh"
+
+action="${1:-}"
+[ -n "$action" ] || die "usage: intelligence package <add|remove|list|search> [args]"
+shift
+
+case "$action" in
+    add)
+        require_v2
+        ensure_project_current "$IP_ROOT"
+        exec bash "$CLI_DIR/internal/package-add.sh" "$@"
+        ;;
+    remove)
+        require_v2
+        ensure_project_current "$IP_ROOT"
+        exec bash "$CLI_DIR/internal/package-remove.sh" "$@"
+        ;;
+    list)
+        exec bash "$CLI_DIR/internal/package-list.sh" "$@"
+        ;;
+    search)
+        exec bash "$CLI_DIR/internal/package-search.sh" "$@"
+        ;;
+    *)
+        die "usage: intelligence package <add|remove|list|search> [args]"
+        ;;
+esac

package/cli/commands/registry.sh

@@ -36,9 +36,11 @@ case "$sub" in
         [ "${3:-}" = "--force" ] && force=1
         [ -n "$url" ] || die "usage: intelligence registry add <registry-repo-url> [--force]"
         case "$url" in
-            @*) die "registries are added by URL — names carry their own scope. To install a package: intelligence add $url/<name>" ;;
+            @*) die "registries are added by URL — names carry their own scope. To install a package: intelligence package add $url/<name>" ;;
         esac
+        assert_safe_source_url "${url#git+}"
         require_v2
+        ensure_project_current "$IP_ROOT"
         # Fail closed: a URL that cannot produce an index is not a registry,
         # and recording it would turn a typo here into a confusing failure at
         # the first add. --force covers the one honest case: the registry is
@@ -58,7 +60,7 @@ case "$sub" in
             echo "        url: \"https://github.com/acme/intelligence.git\"" >&2
             echo "        path: \"packs/backend\"      # omit when the repo IS the package" >&2
             echo "  Format and an example: https://github.com/ainova-systems/intelligence-registry" >&2
-            echo "  A single repository needs no registry at all: intelligence add github:org/repo" >&2
+            echo "  A single repository needs no registry at all: intelligence package add github:org/repo" >&2
             echo "  Recording it ahead of a registry that does not exist yet: --force" >&2
             exit 1
         fi
@@ -69,6 +71,7 @@ case "$sub" in
         url="${2:-}"
         [ -n "$url" ] || die "usage: intelligence registry remove <url>"
         require_v2
+        ensure_project_current "$IP_ROOT"
         registries_remove "$IP_ROOT/intelligence.yaml" "$url"
         # The retired flat-map form also stored scope keys — drop one if the
         # argument names it, so old manifests clean up with the old command.

package/cli/commands/status.sh

@@ -1,15 +1,23 @@
 #!/bin/bash
-# intelligence status — project state at a glance.
+# intelligence status [--check] — project state or deep consistency checks.
 set -euo pipefail
 source "$CLI_DIR/lib/cli-common.sh"
 
+case "${1:-}" in
+    "") ;;
+    --check) [ $# -eq 1 ] || die "usage: intelligence status [--check]"; exec bash "$CLI_DIR/internal/check.sh" ;;
+    *) die "usage: intelligence status [--check]" ;;
+esac
+
 detect_project
 case "$IP_MODE" in
     v2)
         echo "Project:  $IP_ROOT (CLI setup)"
-        echo "Manifest: intelligence.yaml (sync_version $(read_engine_stamp "$IP_ROOT/intelligence.yaml"))"
+        echo "Manifest: intelligence.yaml (schema_version $(read_schema_version "$IP_ROOT/intelligence.yaml"))"
         if [ -f "$IP_ROOT/intelligence.lock" ]; then
             echo "Lockfile: intelligence.lock"
+        elif [ -n "$(qmap_keys "$IP_ROOT/intelligence.yaml" "packages")" ]; then
+            echo "Lockfile: MISSING (manifest declares packages)"
         else
             echo "Lockfile: none (no packages added yet)"
         fi
@@ -25,9 +33,9 @@ case "$IP_MODE" in
         echo "Project:  $IP_ROOT (vendored v1 setup)"
         echo "Umbrella: $IP_UMBRELLA"
         echo "Engine:   $(tr -d ' \t\r\n' < "$IP_MODULE_DIR/scripts/VERSION") (vendored at $IP_MODULE_DIR)"
-        echo "Stamp:    $(read_engine_stamp "$IP_UMBRELLA/config.yaml")"
+        echo "Stamp:    $(top_scalar "$IP_UMBRELLA/config.yaml" "sync_version")"
         echo ""
-        echo "Convert to the CLI setup: intelligence migrate"
+        echo "Convert to the CLI setup: intelligence init"
         ;;
     *)
         echo "No intelligence project here. Start one: intelligence init"

package/cli/commands/sync.sh

@@ -6,32 +6,19 @@ source "$CLI_DIR/lib/cli-common.sh"
 detect_project
 case "$IP_MODE" in
     v2)
-        # Fail closed, never skip silently: a store-backed source that is not
-        # on disk means the project is not installed (or predates the package
-        # model) — syncing would quietly drop whole rule sets.
-        missing="" stale=0
-        for section in rules agents skills; do
-            while IFS= read -r src; do
-                [ -n "$src" ] || continue
-                case "$src" in
-                    .intelligence/engine/*) stale=1 ;;
-                    .intelligence/*) [ -d "$IP_ROOT/$src" ] || missing="$missing $src" ;;
-                esac
-            done < <(read_yaml_list "$IP_ROOT/intelligence.yaml" "$section")
-        done
-        if [ "$stale" -eq 1 ]; then
-            die "this manifest predates the engine-content package (.intelligence/engine sources) — run 'intelligence upgrade'"
-        fi
-        if [ -n "$missing" ]; then
-            die "installed content missing on disk:$missing — run 'intelligence install'"
-        fi
+        # `sync` is the normal fresh-clone command. A newer globally installed
+        # CLI upgrades the current v2 project first (except in CI, where a
+        # tracked migration must be reviewed and committed locally), and a
+        # missing ignored store is restored strictly from the committed lock.
+        ensure_project_current "$IP_ROOT"
+        restore_project_store_if_missing "$IP_ROOT"
         export_engine_env "$IP_ROOT"
-        exec bash "$IS_ENGINE_DIR/scripts/sync.sh" "$@"
+        exec bash "$IS_ENGINE_DIR/sync.sh" "$@"
         ;;
     legacy)
         # A vendored project syncs with ITS engine — its pin is the contract,
         # and a newer bundled engine must not generate against an older schema.
-        echo "NOTE: vendored (v1) setup — delegating to its own engine. 'intelligence migrate' converts it to the CLI setup." >&2
+        echo "NOTE: vendored (v1) setup — delegating to $IP_MODULE_DIR/scripts/sync.sh. 'intelligence init' converts it to the CLI setup." >&2
         exec bash "$IP_MODULE_DIR/scripts/sync.sh" "$@"
         ;;
     *)