@ainova-systems/intelligence 0.11.0-rc.8 → 0.11.0-rc.9

package/README.md

@@ -42,4 +42,8 @@ intelligence sync
 
 Any git repo with `rules/`, `agents/` or `skills/` at its root is already an Intelligence Package: install it from an explicit source — `intelligence package add github:your-org/your-repo` — with versions from its `x.y.z` git tags. Names (`@scope/name`) resolve only through registries this project explicitly trusts; a monorepo of packages needs one line in such an index.
 
+Every package has the same compact manifest entry: requested `version` or
+`ref` only. Repository URL/path, resolved tag/ref and commit SHA are recorded
+in the committed `intelligence.lock`.
+
 Requires `git` (and on Windows the bash it ships with — Git for Windows). Engine and docs: [ainova-systems/intelligence](https://github.com/ainova-systems/intelligence).

package/cli/internal/check.sh

@@ -57,9 +57,9 @@ if [ -d "$IP_ROOT/.intelligence/engine" ]; then
     warn "stale .intelligence/engine directory (pre-package layout) — run 'intelligence init'"
 fi
 
-# Manifest packages: names valid, locked, installed — and the lock's source
-# still the one resolution would pick today (a registry silently re-pointing
-# an installed name is the dependency-confusion tail this check cuts off).
+# Manifest packages: names valid, requested intent only, locked and installed.
+# The lock is authoritative for resolved source URL/path until an explicit
+# package re-add changes that trust decision.
 while IFS= read -r name; do
     [ -n "$name" ] || continue
     assert_valid_pkg_name "$name"
@@ -68,32 +68,21 @@ while IFS= read -r name; do
     else
         m_ver="$(qmap_field "$manifest" "packages" "$name" "version")"
         m_ref="$(qmap_field "$manifest" "packages" "$name" "ref")"
-        m_url="$(qmap_field "$manifest" "packages" "$name" "url")"
-        m_path="$(qmap_field "$manifest" "packages" "$name" "path")"
         l_req="$(qmap_field "$lock" "packages" "$name" "requested")"
         l_res="$(qmap_field "$lock" "packages" "$name" "resolved")"
-        l_url="$(qmap_field "$lock" "packages" "$name" "url")"
-        l_path="$(qmap_field "$lock" "packages" "$name" "path")"
         [ -z "$m_ver" ] || [ "$m_ver" = "$l_req" ] \
             || warn "$name requests '$m_ver' but the lock recorded '$l_req' — run 'intelligence update --preview'"
         [ -z "$m_ref" ] || [ "$m_ref" = "$l_res" ] \
             || warn "$name pins ref '$m_ref' but the lock resolved '$l_res'"
-        [ -z "$m_url" ] || [ "$m_url" = "$l_url" ] \
-            || warn "$name declares url '$m_url' but the lock recorded '$l_url'"
-        [ -z "$m_path" ] || [ "$m_path" = "$l_path" ] \
-            || warn "$name declares path '$m_path' but the lock recorded '$l_path'"
+        if [ -n "$(qmap_field "$manifest" "packages" "$name" "url")" ] \
+            || [ -n "$(qmap_field "$manifest" "packages" "$name" "path")" ]; then
+            warn "$name stores source details in the manifest — run 'intelligence init --apply' to move them to the lock-only model"
+        fi
         if [ ! -d "$IP_ROOT/.intelligence/packages/$name" ]; then
             warn "$name is locked but not installed — run 'intelligence sync'"
             continue
         fi
         ok "$name @ $(qmap_field "$lock" "packages" "$name" "resolved")"
-        if [ -z "$(qmap_field "$manifest" "packages" "$name" "url")" ]; then
-            locked_url="$(qmap_field "$lock" "packages" "$name" "url")"
-            resolve_package_source "$manifest" "$name" 2>/dev/null || true
-            if [ -n "${RES_URL:-}" ] && [ -n "$locked_url" ] && [ "$RES_URL" != "$locked_url" ]; then
-                warn "$name now resolves to $RES_URL but the lock pins $locked_url — a registry re-pointed the name; verify with 'intelligence update --preview'"
-            fi
-        fi
     fi
 done < <(qmap_keys "$manifest" "packages")
 

package/cli/internal/migrate-v1.sh

@@ -194,6 +194,7 @@ while IFS="$LOCK_SEP" read -r pack name url ref mirror; do
     if [ -z "$sha" ] || [ "$sha" = "unknown" ]; then
         sha="$(GIT_TERMINAL_PROMPT=0 git ls-remote -- "$url" "$ref" 2>/dev/null | awk '{print $1; exit}')"
     fi
+    [ -n "$ref" ] || ref="HEAD"
     printf '%s\037%s\037%s\037%s\037%s\037%s\n' \
         "$name" "" "$url" "" "$ref" "$sha" >> "$lock_rows"
 done < "$pack_rows"
@@ -261,17 +262,14 @@ while IFS= read -r line || [ -n "$line" ]; do
 done < "$config" > "$manifest_stage"
 stamp_schema_version "$manifest_stage" "$eng"
 
-# packages: entries (pin preserved — no invented ranges).
+# packages: requested pins only; resolved source details live in the lock.
 while IFS="$LOCK_SEP" read -r pack name url ref mirror; do
     [ -n "$pack" ] || continue
-    qmap_set "$manifest_stage" "packages" "$name" "url" "$url"
-    [ -n "$ref" ] && qmap_set "$manifest_stage" "packages" "$name" "ref" "$ref"
+    qmap_set "$manifest_stage" "packages" "$name" "ref" "${ref:-HEAD}"
 done < "$pack_rows"
 
 # The engine's own content rides along as a package, pinned to the engine.
 qmap_set "$manifest_stage" "packages" "$SYNC_PKG_NAME" "version" "$eng"
-qmap_set "$manifest_stage" "packages" "$SYNC_PKG_NAME" "url" "$SYNC_PKG_URL"
-qmap_set "$manifest_stage" "packages" "$SYNC_PKG_NAME" "path" "$SYNC_PKG_PATH"
 printf '%s\037%s\037%s\037%s\037%s\037%s\n' \
     "$SYNC_PKG_NAME" "$eng" "$SYNC_PKG_URL" "$SYNC_PKG_PATH" "v$eng" "$sync_pkg_sha" >> "$lock_rows"
 

package/cli/internal/package-add.sh

@@ -117,6 +117,7 @@ if [ -z "$ref" ]; then
             die "'$name' has no stable version tags at $url — a registry package must be versioned; use github:/git+ with @<ref> to pin a branch or commit"
         fi
         echo "  NOTE: no version tags at $url — pinning the default branch head" >&2
+        ref="HEAD"
     fi
 fi
 
@@ -125,22 +126,16 @@ sha="$(fetch_package "$url" "${ref:-$resolved_tag}" "$path" "$IP_ROOT/$rel")"
 
 wire_package_sources "$manifest" "$name" "$rel" "$IP_ROOT"
 
-# Manifest entry: a registry package records its range; a direct one records
-# its source so resolution never has to guess it again. The entry is replaced
-# WHOLE — re-adding under a different spec must not leave the old spec's
-# fields behind (a stale ref: would freeze update, a stale url: would pin the
-# old source).
+# The manifest records requested intent only. The resolved source URL/path,
+# tag/ref and SHA live in the required lock. Re-adding a package is the
+# explicit operation for changing its trusted source.
 qmap_delete_key "$manifest" "packages" "$name"
-if [ "$mode" = "registry" ]; then
+if [ -n "$ref" ]; then
+    qmap_set "$manifest" "packages" "$name" "ref" "$ref"
+elif [ -n "$requested" ]; then
     qmap_set "$manifest" "packages" "$name" "version" "$requested"
 else
-    qmap_set "$manifest" "packages" "$name" "url" "$url"
-    [ -n "$path" ] && qmap_set "$manifest" "packages" "$name" "path" "$path"
-    if [ -n "$ref" ]; then
-        qmap_set "$manifest" "packages" "$name" "ref" "$ref"
-    elif [ -n "$requested" ]; then
-        qmap_set "$manifest" "packages" "$name" "version" "$requested"
-    fi
+    die "internal: package '$name' has neither a requested version nor ref"
 fi
 
 lock_upsert "$lock" "$name" "$requested" "$url" "$path" "${ref:-$resolved_tag}" "$sha"

package/cli/internal/package-update.sh

@@ -1,9 +1,9 @@
 #!/bin/bash
 # Internal package range update operation.
 #
-# Re-resolve version ranges against the remotes and rewrite the lock. Pinned
-# packages (`ref:`) never move here — repin by editing the manifest or
-# re-adding. `update <name>` limits the pass to one package.
+# Resolve requested versions/refs against each package's locked source and
+# rewrite the lock. `update <name>` limits the pass to one package; re-adding
+# is the explicit operation for changing a source URL/path.
 set -euo pipefail
 source "$CLI_DIR/lib/cli-common.sh"
 
@@ -35,30 +35,36 @@ while IFS= read -r name; do
         echo "  $name: engine content follows the installed CLI — skipped"
         continue
     fi
+    current="$(qmap_field "$lock" "packages" "$name" "resolved")"
+    locked_requested="$(qmap_field "$lock" "packages" "$name" "requested")"
+    url="$(qmap_field "$lock" "packages" "$name" "url")"
+    path="$(qmap_field "$lock" "packages" "$name" "path")"
+    [ -n "$url" ] || die "$name has no source in intelligence.lock — restore the committed lock or re-add the package"
     ref="$(qmap_field "$manifest" "packages" "$name" "ref")"
-    [ -n "$ref" ] && { echo "  $name: pinned to ref '$ref' — skipped"; continue; }
     range="$(qmap_field "$manifest" "packages" "$name" "version")"
-    # An exact version is a pin, same as ref: — update never moves pins.
-    if [ -n "$range" ] && semver_is_stable "$range"; then
-        echo "  $name: pinned to $range — edit the manifest to move it"
-        continue
+    [ -n "$ref" ] || [ -n "$range" ] || die "$name has neither version nor ref in the manifest"
+
+    if [ -n "$ref" ]; then
+        tag="$ref"
+        requested=""
+    else
+        picked="$(list_remote_versions "$url" | semver_pick_highest "$range")"
+        [ -n "$picked" ] || { echo "  $name: nothing satisfies '$range' at $url" >&2; continue; }
+        read -r tag _ <<< "$(remote_tag_for_version "$url" "$picked")"
+        requested="$range"
     fi
-    url="$(qmap_field "$manifest" "packages" "$name" "url")"
-    path="$(qmap_field "$manifest" "packages" "$name" "path")"
-    if [ -z "$url" ]; then
-        resolve_package_source "$manifest" "$name"
-        url="$RES_URL"; path="$RES_PATH"
+    if [ "$tag" = "$current" ] && [ "$requested" != "$locked_requested" ]; then
+        if [ "$preview" -eq 1 ]; then
+            echo "  $name: request ${locked_requested:-<none>} -> ${requested:-<ref>} (keeps $current)"
+        else
+            locked_sha="$(qmap_field "$lock" "packages" "$name" "sha")"
+            lock_upsert "$lock" "$name" "$requested" "$url" "$path" "$current" "$locked_sha"
+            echo "  $name: request ${locked_requested:-<none>} -> ${requested:-<ref>} (kept $current)"
+        fi
+        moved=$((moved + 1))
+        continue
     fi
-    picked="$(list_remote_versions "$url" | semver_pick_highest "$range")"
-    [ -n "$picked" ] || { echo "  $name: nothing satisfies '${range:-*}' at $url" >&2; continue; }
-    read -r tag _ <<< "$(remote_tag_for_version "$url" "$picked")"
-    current="$(qmap_field "$lock" "packages" "$name" "resolved")"
-    cur_url="$(qmap_field "$lock" "packages" "$name" "url")"
-    cur_path="$(qmap_field "$lock" "packages" "$name" "path")"
-    # Same tag is not enough: a registry may re-point a name's source while
-    # keeping the version — the move doctor warns about must be actionable
-    # here, so url/path changes refetch too.
-    if [ "$tag" = "$current" ] && [ "$url" = "$cur_url" ] && [ "$path" = "$cur_path" ]; then
+    if [ "$tag" = "$current" ]; then
         echo "  $name: ${current:-<none>} (up to date)"
         continue
     fi
@@ -80,7 +86,7 @@ while IFS= read -r name; do
     mkdir -p "$(dirname "$IP_ROOT/$rel")"
     mv "$staging" "$IP_ROOT/$rel"
     wire_package_sources "$manifest" "$name" "$rel" "$IP_ROOT"
-    lock_upsert "$lock" "$name" "$range" "$url" "$path" "$tag" "$sha"
+    lock_upsert "$lock" "$name" "$requested" "$url" "$path" "$tag" "$sha"
     echo "  $name: ${current:-<none>} -> $tag"
     moved=$((moved + 1))
 done < <(qmap_keys "$manifest" "packages")

package/cli/internal/restore.sh

@@ -23,7 +23,7 @@ manifest="$IP_ROOT/intelligence.yaml"
 lock="$IP_ROOT/intelligence.lock"
 
 # --frozen is the reproducibility contract: the lock must agree with the
-# manifest on the package SET and on every requested-source field before a
+# manifest on the package SET and on every requested-intent field before a
 # single byte is restored. Anything less lets a manifest edit ride on a stale
 # lock — the exact drift the flag exists to refuse.
 if [ "$frozen" -eq 1 ]; then
@@ -33,20 +33,12 @@ if [ "$frozen" -eq 1 ]; then
             || die "locked restore: $name is in the manifest but not in intelligence.lock"
         m_ver="$(qmap_field "$manifest" "packages" "$name" "version")"
         m_ref="$(qmap_field "$manifest" "packages" "$name" "ref")"
-        m_url="$(qmap_field "$manifest" "packages" "$name" "url")"
-        m_path="$(qmap_field "$manifest" "packages" "$name" "path")"
         l_req="$(qmap_field "$lock" "packages" "$name" "requested")"
         l_res="$(qmap_field "$lock" "packages" "$name" "resolved")"
-        l_url="$(qmap_field "$lock" "packages" "$name" "url")"
-        l_path="$(qmap_field "$lock" "packages" "$name" "path")"
         [ -z "$m_ver" ] || [ "$m_ver" = "$l_req" ] \
             || die "locked restore: $name requests '$m_ver' but the lock recorded '$l_req' — reconcile the manifest and lock"
         [ -z "$m_ref" ] || [ "$m_ref" = "$l_res" ] \
             || die "--frozen: $name pins ref '$m_ref' but the lock resolved '$l_res'"
-        [ -z "$m_url" ] || [ "$m_url" = "$l_url" ] \
-            || die "--frozen: $name declares url '$m_url' but the lock recorded '$l_url'"
-        [ -z "$m_path" ] || [ "$m_path" = "$l_path" ] \
-            || die "--frozen: $name declares path '$m_path' but the lock recorded '$l_path'"
     done < <(qmap_keys "$manifest" "packages")
     while IFS= read -r name; do
         [ -n "$name" ] || continue
@@ -76,14 +68,11 @@ if [ -n "$missing" ]; then
             sync_pkg_install "$IP_ROOT"
             continue
         fi
-        url="$(qmap_field "$manifest" "packages" "$name" "url")"
-        path="$(qmap_field "$manifest" "packages" "$name" "path")"
         ref="$(qmap_field "$manifest" "packages" "$name" "ref")"
         range="$(qmap_field "$manifest" "packages" "$name" "version")"
-        if [ -z "$url" ]; then
-            resolve_package_source "$manifest" "$name"
-            url="$RES_URL"; path="$RES_PATH"
-        fi
+        resolve_package_source "$manifest" "$name"
+        url="$RES_URL"; path="$RES_PATH"
+        [ -n "$url" ] || die "no trusted registry declares '$name' and it is absent from intelligence.lock"
         resolved_tag=""
         if [ -z "$ref" ]; then
             picked="$(list_remote_versions "$url" | semver_pick_highest "$range")"

package/cli/internal/upgrade-v2.sh

@@ -49,7 +49,32 @@ if [ -n "$legacy_stamp" ]; then
     echo "  migrating: sync_version -> schema_version"
 fi
 
-# v2 migration 1: staged engine content -> the @ainova-systems/sync package.
+# v2 migration 1: package entries contain requested intent only. Early RCs
+# also copied resolved url/path into the manifest. Preserve the existing lock
+# as the trusted source and remove that duplicate representation. A direct
+# unversioned package becomes an explicit HEAD pin so its manifest entry stays
+# meaningful after the source fields are removed.
+source_fields_migrated=0
+while IFS= read -r name; do
+    [ -n "$name" ] || continue
+    m_url="$(qmap_field "$manifest" "packages" "$name" "url")"
+    m_path="$(qmap_field "$manifest" "packages" "$name" "path")"
+    [ -n "$m_url" ] || [ -n "$m_path" ] || continue
+    m_ver="$(qmap_field "$manifest" "packages" "$name" "version")"
+    m_ref="$(qmap_field "$manifest" "packages" "$name" "ref")"
+    if [ -z "$m_ver" ] && [ -z "$m_ref" ]; then
+        locked_ref="$(qmap_field "$IP_ROOT/intelligence.lock" "packages" "$name" "resolved")"
+        qmap_set "$manifest" "packages" "$name" "ref" "${locked_ref:-HEAD}"
+    fi
+    qmap_delete_field "$manifest" "packages" "$name" "url"
+    qmap_delete_field "$manifest" "packages" "$name" "path"
+    source_fields_migrated=1
+done < <(qmap_keys "$manifest" "packages")
+if [ "$source_fields_migrated" -eq 1 ]; then
+    echo "  migrating: package url/path -> intelligence.lock"
+fi
+
+# v2 migration 2: staged engine content -> the @ainova-systems/sync package.
 # Pre-package manifests listed `.intelligence/engine/{rules,agents,skills}`
 # as sources fed by a CLI-staged copy; that copy is now an ordinary package
 # entry seeded from the bundle. Post-condition: no `.intelligence/engine`

package/cli/lib/cli-common.sh

@@ -139,14 +139,12 @@ bundled_engine_version() {
 }
 
 # --- The sync package's manifest/lock plumbing ---------------------------
-# sync_pkg_entry <manifest> — write/refresh the package's manifest entry:
-# name + exact pin + explicit url/path, so resolution never depends on any
-# registry (a project registry shadowing the name cannot brick the engine).
+# sync_pkg_entry <manifest> — write/refresh only the requested exact pin.
+# The built-in source lives in engine-package.yaml and resolved source state
+# belongs exclusively to intelligence.lock.
 sync_pkg_entry() {
     local manifest="$1"
     qmap_set "$manifest" "packages" "$SYNC_PKG_NAME" "version" "$(bundled_engine_version)"
-    qmap_set "$manifest" "packages" "$SYNC_PKG_NAME" "url" "$SYNC_PKG_URL"
-    qmap_set "$manifest" "packages" "$SYNC_PKG_NAME" "path" "$SYNC_PKG_PATH"
 }
 
 # sync_pkg_install <root> — materialize the package into the store and lock
@@ -227,13 +225,19 @@ project_needs_upgrade() {
     [ -d "$root/.intelligence/engine" ] && return 0
 
     while IFS= read -r name; do
-        [ "$name" = "$SYNC_PKG_NAME" ] || continue
-        pinned="$(qmap_field "$manifest" "packages" "$name" "version")"
-        locked="$(qmap_field "$root/intelligence.lock" "packages" "$name" "resolved")"
-        [ "$pinned" = "$eng" ] || return 0
-        if [ -f "$root/intelligence.lock" ]; then
-            [ -n "$locked" ] || return 0
-            [ "${locked#v}" = "$eng" ] || return 0
+        [ -n "$name" ] || continue
+        # Early RC manifests mixed requested intent with resolved source
+        # details. Source URL/path now live only in the required lockfile.
+        [ -n "$(qmap_field "$manifest" "packages" "$name" "url")" ] && return 0
+        [ -n "$(qmap_field "$manifest" "packages" "$name" "path")" ] && return 0
+        if [ "$name" = "$SYNC_PKG_NAME" ]; then
+            pinned="$(qmap_field "$manifest" "packages" "$name" "version")"
+            locked="$(qmap_field "$root/intelligence.lock" "packages" "$name" "resolved")"
+            [ "$pinned" = "$eng" ] || return 0
+            if [ -f "$root/intelligence.lock" ]; then
+                [ -n "$locked" ] || return 0
+                [ "${locked#v}" = "$eng" ] || return 0
+            fi
         fi
     done < <(qmap_keys "$manifest" "packages")
     return 1

package/cli/lib/manifest.sh

@@ -301,6 +301,29 @@ qmap_delete_key() {
     '
 }
 
+# qmap_delete_field <file> <block> <key> <field> — drop one field from a
+# quoted-key entry without disturbing its other fields or surrounding YAML.
+qmap_delete_field() {
+    local file="$1" block="$2" key="$3" field="$4"
+    [ -f "$file" ] || return 0
+    _qmap_stage "$file" -v block="$block" -v key="$key" -v field="$field" '
+        { sub(/\r$/, "") }
+        $0 ~ "^" block ":[ \t]*$" { inb = 1; print; next }
+        inb && /^[^ #]/ { inb = 0; ink = 0 }
+        inb && /^  "/ {
+            s = substr($0, 4); q = index(s, "\"")
+            ink = (q > 0 && substr(s, 1, q - 1) == key)
+            print; next
+        }
+        inb && ink && /^    [A-Za-z_]/ {
+            line = $0; sub(/^    /, "", line)
+            c = index(line, ":")
+            if (c > 0 && substr(line, 1, c - 1) == field) next
+        }
+        { print }
+    '
+}
+
 # --- registries: a trust LIST, not a scope map -----------------------------
 # The block holds registry repo URLs in trust order. Two shapes are read so
 # early manifests keep working: the list form (`- "url"`) and the retired

package/engine/ENGINE_SHA

@@ -1 +1 @@
-f2bfc5e3722bf6fb2f7309db2d248368d5b0cc5e
+af238e67e8a9469edf6d2058e169de52cbeb93af

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ainova-systems/intelligence",
-  "version": "0.11.0-rc.8",
+  "version": "0.11.0-rc.9",
   "description": "Build, version and distribute AI agent intelligence across your organization — one CLI, versioned Intelligence Packages, and a sync engine for Claude Code, Cursor, Copilot, Codex, Pi and OpenCode.",
   "bin": {
     "intelligence": "bin/intelligence.js"

package/packages/sync/references/conventions.md

@@ -92,11 +92,11 @@ intelligence package add github:acme/backend-intelligence
 intelligence package add 'git+https://git.example.com/acme/backend.git@main#package'
 ```
 
-Registries are an ordered trust list and the only resolver for a package name. There is no built-in catalog and no `@org/name` → GitHub guessing. An explicit `github:` or `git+` spec bypasses registry lookup while remaining recorded and pinned in the manifest and lock.
+Registries are an ordered trust list and the only resolver for a package name. There is no built-in catalog and no `@org/name` → GitHub guessing. An explicit `github:` or `git+` spec bypasses registry lookup. In every case the manifest stores only requested `version` or `ref`; resolved URL/path and SHA live in the lock.
 
 Stable Git tags provide package versions. Semver ranges select the highest matching stable tag; a `ref:` pin names a branch or commit and does not move during `intelligence update`. One package name has one version per project.
 
-Commit `intelligence.lock`. It records requested versions, source URLs and paths, resolved refs and commit SHAs. After cloning, `intelligence sync` restores a missing store strictly from that lock before rendering; manifest/lock or SHA drift is refused.
+Commit `intelligence.lock`. It records requested versions, source URLs and paths, resolved refs and commit SHAs. After cloning, `intelligence sync` restores a missing store strictly from that lock before rendering; manifest/lock or SHA drift is refused. Re-run `package add` when deliberately changing a source.
 
 `@ainova-systems/sync` is ordinary package content exact-pinned to the bundled engine version. `intelligence init` installs it unless `--bare` is used. Lifecycle preflight keeps that pin and `schema_version` aligned with the installed CLI; package-range updates never move it independently.