@ainova-systems/intelligence 0.11.0-rc.8 → 0.11.0

package/cli/internal/check.sh

@@ -20,9 +20,9 @@ case "$IP_MODE" in
         exit 0
         ;;
     legacy)
-        echo "project: vendored (v1) at $IP_ROOT"
+        echo "project: legacy Intelligence Sync at $IP_ROOT"
         ok "vendored engine $(tr -d ' \t\r\n' < "$IP_MODULE_DIR/scripts/VERSION")"
-        echo "  → 'intelligence init' converts it to the CLI setup"
+        echo "  → 'intelligence init' converts it into an Intelligence project"
         exit 0
         ;;
 esac
@@ -57,9 +57,9 @@ if [ -d "$IP_ROOT/.intelligence/engine" ]; then
     warn "stale .intelligence/engine directory (pre-package layout) — run 'intelligence init'"
 fi
 
-# Manifest packages: names valid, locked, installed — and the lock's source
-# still the one resolution would pick today (a registry silently re-pointing
-# an installed name is the dependency-confusion tail this check cuts off).
+# Manifest packages: names valid, requested intent only, locked and installed.
+# The lock is authoritative for resolved source URL/path until an explicit
+# package re-add changes that trust decision.
 while IFS= read -r name; do
     [ -n "$name" ] || continue
     assert_valid_pkg_name "$name"
@@ -68,35 +68,64 @@ while IFS= read -r name; do
     else
         m_ver="$(qmap_field "$manifest" "packages" "$name" "version")"
         m_ref="$(qmap_field "$manifest" "packages" "$name" "ref")"
-        m_url="$(qmap_field "$manifest" "packages" "$name" "url")"
-        m_path="$(qmap_field "$manifest" "packages" "$name" "path")"
         l_req="$(qmap_field "$lock" "packages" "$name" "requested")"
         l_res="$(qmap_field "$lock" "packages" "$name" "resolved")"
-        l_url="$(qmap_field "$lock" "packages" "$name" "url")"
-        l_path="$(qmap_field "$lock" "packages" "$name" "path")"
         [ -z "$m_ver" ] || [ "$m_ver" = "$l_req" ] \
             || warn "$name requests '$m_ver' but the lock recorded '$l_req' — run 'intelligence update --preview'"
         [ -z "$m_ref" ] || [ "$m_ref" = "$l_res" ] \
             || warn "$name pins ref '$m_ref' but the lock resolved '$l_res'"
-        [ -z "$m_url" ] || [ "$m_url" = "$l_url" ] \
-            || warn "$name declares url '$m_url' but the lock recorded '$l_url'"
-        [ -z "$m_path" ] || [ "$m_path" = "$l_path" ] \
-            || warn "$name declares path '$m_path' but the lock recorded '$l_path'"
+        if [ -n "$(qmap_field "$manifest" "packages" "$name" "url")" ] \
+            || [ -n "$(qmap_field "$manifest" "packages" "$name" "path")" ]; then
+            warn "$name stores source details in the manifest — run 'intelligence init --apply' to move them to the lock-only model"
+        fi
         if [ ! -d "$IP_ROOT/.intelligence/packages/$name" ]; then
             warn "$name is locked but not installed — run 'intelligence sync'"
             continue
         fi
         ok "$name @ $(qmap_field "$lock" "packages" "$name" "resolved")"
-        if [ -z "$(qmap_field "$manifest" "packages" "$name" "url")" ]; then
-            locked_url="$(qmap_field "$lock" "packages" "$name" "url")"
-            resolve_package_source "$manifest" "$name" 2>/dev/null || true
-            if [ -n "${RES_URL:-}" ] && [ -n "$locked_url" ] && [ "$RES_URL" != "$locked_url" ]; then
-                warn "$name now resolves to $RES_URL but the lock pins $locked_url — a registry re-pointed the name; verify with 'intelligence update --preview'"
-            fi
-        fi
     fi
 done < <(qmap_keys "$manifest" "packages")
 
+# Adapter contracts are the shared source of truth for dependencies, rollback,
+# onboarding backup and Git policy. Validate every declared target, including
+# disabled ones, so a later enable cannot reveal a stale custom adapter.
+content_dir="$(manifest_intelligence_dir "$manifest")"
+while IFS= read -r target; do
+    [ -n "$target" ] || continue
+    output="$(get_target_output "$manifest" "$target")"
+    [ -n "$output" ] || output="$(default_target_output "$target")"
+    adapter_file="$(adapter_file_for "$IP_ROOT" "$content_dir" "$target" 2>/dev/null || true)"
+    if [ -z "$adapter_file" ]; then
+        warn "adapter '$target' is declared but its implementation is missing"
+        continue
+    fi
+    records="$(adapter_contract_records "$target" "$adapter_file" "$output" 2>/dev/null || true)"
+    if ! printf '%s\n' "$records" | grep -Fqx $'version\t1'; then
+        warn "adapter '$target' has an invalid ownership contract"
+        continue
+    fi
+    while IFS=$'\t' read -r kind value; do
+        if [ "$kind" = "requires" ] \
+            && [ "$(is_target_enabled "$manifest" "$target")" = "1" ] \
+            && [ "$(is_target_enabled "$manifest" "$value")" != "1" ]; then
+            warn "enabled adapter '$target' requires enabled adapter '$value'"
+        fi
+        if [ "$(is_target_enabled "$manifest" "$target")" = "1" ]; then
+            case "$kind" in
+                ignore)
+                    grep -Fqx -- "$value" "$IP_ROOT/.gitignore" 2>/dev/null \
+                        || warn "adapter '$target' Git policy is missing '$value'"
+                    ;;
+                include)
+                    grep -Fqx -- "!$value" "$IP_ROOT/.gitignore" 2>/dev/null \
+                        || warn "adapter '$target' Git policy is missing '!$value'"
+                    ;;
+            esac
+        fi
+    done <<< "$records"
+    ok "adapter $target contract v1"
+done < <(target_names "$manifest")
+
 # Lock orphans.
 if [ -f "$lock" ]; then
     while IFS= read -r name; do

package/cli/internal/{migrate-v1.sh → convert-legacy.sh}

@@ -1,6 +1,6 @@
 #!/bin/bash
-# Internal v1-to-v2 migration operation.
-# to the CLI setup: root intelligence.yaml, .intelligence/ store,
+# Internal conversion from legacy Intelligence Sync to Intelligence CLI.
+# to an Intelligence project: root intelligence.yaml, .intelligence/ store,
 # intelligence.lock, no vendored engine.
 #
 # Transactional: STAGE everything next to the
@@ -24,8 +24,8 @@ done
 detect_project
 case "$IP_MODE" in
     legacy) ;;
-    v2) die "already on the v2 setup ($IP_ROOT/intelligence.yaml)" ;;
-    *) die "no vendored setup found here — 'intelligence init' starts a fresh project" ;;
+    cli) die "already an Intelligence project ($IP_ROOT/intelligence.yaml)" ;;
+    *) die "no legacy Intelligence Sync project found here — 'intelligence init' starts a fresh project" ;;
 esac
 root="$IP_ROOT"
 umbrella="$IP_UMBRELLA"
@@ -36,22 +36,22 @@ umbrella_rel="${umbrella#"$root"/}"
 
 for existing in intelligence.yaml intelligence.lock .intelligence; do
     if [ -e "$root/$existing" ] || [ -L "$root/$existing" ]; then
-        die "$existing already exists at the root — conflicting v2 state; move it aside or restore the project before migrating"
+        die "$existing already exists at the root — conflicting Intelligence CLI state; move it aside or restore the project before converting"
     fi
 done
 if [ "$dry_run" -eq 0 ] && [ "$force" -eq 0 ]; then
     if [ -n "$(git -C "$root" status --porcelain 2>/dev/null)" ]; then
-        die "working tree is not clean — commit or stash first (or --force); migrate wants a one-commit diff you can review and revert"
+        die "working tree is not clean — commit or stash first (or --force); conversion produces a one-commit diff you can review and revert"
     fi
 fi
 
-# `sync_version` belongs to the archived v1 format. The v2 contract uses
+# `sync_version` belongs to the legacy Intelligence Sync format. Intelligence uses
 # `schema_version`, so conversion reads the legacy scalar explicitly.
 stamp="$(top_scalar "$config" "sync_version")"
 eng="$(bundled_engine_version)"
 [ -n "$stamp" ] && _ver_gt "$stamp" "$eng" && die "project schema $stamp is newer than this CLI's engine $eng — update the CLI first"
 
-# The v1 `packs:` block is the one v1 shape migrate still has to read, and the
+# The legacy `packs:` block is the one Intelligence Sync shape conversion still reads, and the
 # engine no longer knows it — the reader lives here, with its only consumer.
 get_pack_field() {
     get_nested_yaml_value "$1" "packs" "$2" "$3"
@@ -73,10 +73,10 @@ validate_mirror_path() {
     case "$canon" in "$root"/*) ;; *) die "pack '$pack' mirror escapes the repository: '$mirror'" ;; esac
     rel="${canon#"$root"/}"
 
-    # A v1 mirror may live below the content directory (the normal location is
+    # A legacy mirror may live below the content directory (the normal location is
     # intelligence/external/<pack>), but it must never own the directory itself,
     # the vendored module, CLI state, authored sources, or generated outputs.
-    case "$umbrella_rel" in "$rel"|"$rel"/*) die "pack '$pack' mirror '$mirror' contains the v1 content directory" ;; esac
+    case "$umbrella_rel" in "$rel"|"$rel"/*) die "pack '$pack' mirror '$mirror' contains the legacy content directory" ;; esac
     for protected in .git .intelligence "$module_rel"; do
         paths_overlap "$rel" "$protected" && die "pack '$pack' mirror '$mirror' overlaps protected path '$protected'"
     done
@@ -115,14 +115,14 @@ cleanup_stage() { rm -rf "$stage"; }
 trap cleanup_stage EXIT INT TERM
 mkdir -p "$stage/.intelligence/packages"
 
-# v2 carries no v1 migration chain: v1 is archived, and the archived engine is
-# what knows how to walk an old project forward. So migrate accepts only a
-# project already at the final v1 schema and names the exact remedy otherwise —
+# Intelligence carries no legacy migration chain: the archived Intelligence Sync
+# engine knows how to walk an old project forward. Conversion accepts only a
+# project already at the final legacy schema and names the exact remedy otherwise —
 # a remedy that keeps working indefinitely, because the archive stays at the
 # URL the project's own update.sh already clones.
-V1_FINAL_SCHEMA="0.10.0"
-if [ -z "$stamp" ] || _ver_gt "$V1_FINAL_SCHEMA" "$stamp"; then
-    echo "ERROR: project schema is ${stamp:-absent (pre-0.3.1)}, older than the final v1 schema $V1_FINAL_SCHEMA." >&2
+LEGACY_FINAL_SCHEMA="0.10.0"
+if [ -z "$stamp" ] || _ver_gt "$LEGACY_FINAL_SCHEMA" "$stamp"; then
+    echo "ERROR: project schema is ${stamp:-absent (pre-0.3.1)}, older than the final legacy Intelligence Sync schema $LEGACY_FINAL_SCHEMA." >&2
     echo "       Bring it forward with its own engine first — that still works:" >&2
     echo "         bash $module_rel/scripts/update.sh --yes" >&2
     echo "       then re-run: intelligence init" >&2
@@ -134,7 +134,7 @@ echo "== staging =="
 # bundle (fetch_package's guard — no network).
 sync_pkg_sha="$(fetch_package "$SYNC_PKG_URL" "v$eng" "$SYNC_PKG_PATH" "$stage/$SYNC_PKG_STORE")"
 
-# Legacy pack name -> v2 package name (@org/repo derived from the url), plus
+# Legacy pack name -> Intelligence package name (@org/repo derived from the url), plus
 # per-pack source facts. Recorded as rows for the config rewrite and the lock.
 pack_rows="$stage/packs.rows"
 : > "$pack_rows"
@@ -194,6 +194,7 @@ while IFS="$LOCK_SEP" read -r pack name url ref mirror; do
     if [ -z "$sha" ] || [ "$sha" = "unknown" ]; then
         sha="$(GIT_TERMINAL_PROMPT=0 git ls-remote -- "$url" "$ref" 2>/dev/null | awk '{print $1; exit}')"
     fi
+    [ -n "$ref" ] || ref="HEAD"
     printf '%s\037%s\037%s\037%s\037%s\037%s\n' \
         "$name" "" "$url" "" "$ref" "$sha" >> "$lock_rows"
 done < "$pack_rows"
@@ -261,17 +262,14 @@ while IFS= read -r line || [ -n "$line" ]; do
 done < "$config" > "$manifest_stage"
 stamp_schema_version "$manifest_stage" "$eng"
 
-# packages: entries (pin preserved — no invented ranges).
+# packages: requested pins only; resolved source details live in the lock.
 while IFS="$LOCK_SEP" read -r pack name url ref mirror; do
     [ -n "$pack" ] || continue
-    qmap_set "$manifest_stage" "packages" "$name" "url" "$url"
-    [ -n "$ref" ] && qmap_set "$manifest_stage" "packages" "$name" "ref" "$ref"
+    qmap_set "$manifest_stage" "packages" "$name" "ref" "${ref:-HEAD}"
 done < "$pack_rows"
 
 # The engine's own content rides along as a package, pinned to the engine.
 qmap_set "$manifest_stage" "packages" "$SYNC_PKG_NAME" "version" "$eng"
-qmap_set "$manifest_stage" "packages" "$SYNC_PKG_NAME" "url" "$SYNC_PKG_URL"
-qmap_set "$manifest_stage" "packages" "$SYNC_PKG_NAME" "path" "$SYNC_PKG_PATH"
 printf '%s\037%s\037%s\037%s\037%s\037%s\n' \
     "$SYNC_PKG_NAME" "$eng" "$SYNC_PKG_URL" "$SYNC_PKG_PATH" "v$eng" "$sync_pkg_sha" >> "$lock_rows"
 
@@ -327,6 +325,10 @@ if [ -f "$root/.gitignore" ]; then
     gitignore_existed=1
     cp "$root/.gitignore" "$stage/gitignore.orig"
 fi
+while IFS= read -r policy_file; do
+    [ -f "$root/$policy_file" ] || continue
+    cp "$root/$policy_file" "$stage/$policy_file.orig"
+done < <(publisher_ignore_file_names)
 commit_active=1
 rollback() {
     [ "$commit_active" -eq 1 ] || return 0
@@ -338,6 +340,10 @@ rollback() {
     else
         rm -f "$root/.gitignore"
     fi
+    while IFS= read -r policy_file; do
+        [ -f "$stage/$policy_file.orig" ] || continue
+        cp "$stage/$policy_file.orig" "$root/$policy_file"
+    done < <(publisher_ignore_file_names)
     rm -rf "$stage"
     echo "rolled back — the vendored setup is untouched" >&2
 }
@@ -350,24 +356,19 @@ rollback_on_exit() {
 # plain set -e/EXIT failure rather than only an explicit sync refusal.
 trap rollback_on_exit EXIT
 trap 'rollback; exit 130' INT TERM
-if [ ! -f "$root/.gitignore" ] || ! grep -q '^\.intelligence/' "$root/.gitignore"; then
-    {
-        [ -f "$root/.gitignore" ] && [ -n "$(tail -c 1 "$root/.gitignore" 2>/dev/null)" ] && echo ""
-        echo "# intelligence CLI package store (restored automatically by 'intelligence sync')"
-        echo ".intelligence/"
-    } >> "$root/.gitignore"
-fi
 mv "$stage/.intelligence" "$root/.intelligence"
 cp "$manifest_stage" "$root/intelligence.yaml"
 lock_write_from_tsv "$root/intelligence.lock" "$lock_rows"
+ensure_manifest_gitignore "$root" "$root/intelligence.yaml"
+ensure_manifest_publisher_ignores "$root" "$root/intelligence.yaml"
 
 sync_out="$(cd "$root" && IS_SUPPRESS_CLI_NOTE=1 bash "$CLI_DIR/commands/sync.sh" 2>&1)" || {
     echo "$sync_out"
-    die "sync of the migrated state failed"
+    die "sync of the converted state failed"
 }
 echo "$sync_out" | grep -q '^IS_STATUS=ok' || {
     echo "$sync_out"
-    die "sync of the migrated state did not report ok"
+    die "sync of the converted state did not report ok"
 }
 # Point of no return: the new state is verified. From here an interrupt must
 # NOT roll back (the old setup is being removed) — only clean the stage.
@@ -386,7 +387,7 @@ while IFS="$LOCK_SEP" read -r pack name url ref mirror; do
     esac
     if [ -d "$root/$mirror" ]; then
         rm -rf "${root:?}/$mirror"
-        # An emptied v1 mirror parent (for example intelligence/external/) goes with it.
+        # An emptied legacy mirror parent (for example intelligence/external/) goes with it.
         rmdir "$(dirname "$root/$mirror")" 2>/dev/null || true
     fi
 done < "$pack_rows"
@@ -397,6 +398,7 @@ rm -f "$config"
 rmdir "$umbrella" 2>/dev/null || true
 
 echo ""
-echo "migrated. Review the diff, then commit. The old config.yaml is kept at .intelligence/backup/config.yaml."
+echo "converted. Review the diff, then commit. The old config.yaml is kept at .intelligence/backup/config.yaml."
 echo "From now on: intelligence sync | package | update | status."
-echo "Next: ask your agent to run /intelligence-learn-from-repository to review the migrated project context."
+report_tracked_managed_ignores "$root" "$root/intelligence.yaml"
+echo "Next: ask your agent to run /intelligence-learn-from-repository to verify setup and review the converted project context."

package/cli/internal/package-add.sh

@@ -23,7 +23,7 @@ while [ $# -gt 0 ]; do
     shift || true
 done
 
-require_v2
+require_cli_project
 manifest="$IP_ROOT/intelligence.yaml"
 lock="$IP_ROOT/intelligence.lock"
 
@@ -117,6 +117,7 @@ if [ -z "$ref" ]; then
             die "'$name' has no stable version tags at $url — a registry package must be versioned; use github:/git+ with @<ref> to pin a branch or commit"
         fi
         echo "  NOTE: no version tags at $url — pinning the default branch head" >&2
+        ref="HEAD"
     fi
 fi
 
@@ -125,22 +126,16 @@ sha="$(fetch_package "$url" "${ref:-$resolved_tag}" "$path" "$IP_ROOT/$rel")"
 
 wire_package_sources "$manifest" "$name" "$rel" "$IP_ROOT"
 
-# Manifest entry: a registry package records its range; a direct one records
-# its source so resolution never has to guess it again. The entry is replaced
-# WHOLE — re-adding under a different spec must not leave the old spec's
-# fields behind (a stale ref: would freeze update, a stale url: would pin the
-# old source).
+# The manifest records requested intent only. The resolved source URL/path,
+# tag/ref and SHA live in the required lock. Re-adding a package is the
+# explicit operation for changing its trusted source.
 qmap_delete_key "$manifest" "packages" "$name"
-if [ "$mode" = "registry" ]; then
+if [ -n "$ref" ]; then
+    qmap_set "$manifest" "packages" "$name" "ref" "$ref"
+elif [ -n "$requested" ]; then
     qmap_set "$manifest" "packages" "$name" "version" "$requested"
 else
-    qmap_set "$manifest" "packages" "$name" "url" "$url"
-    [ -n "$path" ] && qmap_set "$manifest" "packages" "$name" "path" "$path"
-    if [ -n "$ref" ]; then
-        qmap_set "$manifest" "packages" "$name" "ref" "$ref"
-    elif [ -n "$requested" ]; then
-        qmap_set "$manifest" "packages" "$name" "version" "$requested"
-    fi
+    die "internal: package '$name' has neither a requested version nor ref"
 fi
 
 lock_upsert "$lock" "$name" "$requested" "$url" "$path" "${ref:-$resolved_tag}" "$sha"

package/cli/internal/package-list.sh

@@ -3,7 +3,7 @@
 set -euo pipefail
 source "$CLI_DIR/lib/cli-common.sh"
 
-require_v2
+require_cli_project
 manifest="$IP_ROOT/intelligence.yaml"
 lock="$IP_ROOT/intelligence.lock"
 

package/cli/internal/package-remove.sh

@@ -15,7 +15,7 @@ for a in "$@"; do
     esac
 done
 
-require_v2
+require_cli_project
 
 # Removing the engine-content package guts the outputs (meta-skills, the
 # authoring rule, both engine agents disappear) while everything still

package/cli/internal/package-search.sh

@@ -12,7 +12,7 @@ term="${1:-}"
 
 detect_project
 manifest=""
-[ "$IP_MODE" = "v2" ] && manifest="$IP_ROOT/intelligence.yaml"
+[ "$IP_MODE" = "cli" ] && manifest="$IP_ROOT/intelligence.yaml"
 
 # State of one package name in this project: installed / declared / available.
 pkg_state() {

package/cli/internal/package-update.sh

@@ -1,9 +1,9 @@
 #!/bin/bash
 # Internal package range update operation.
 #
-# Re-resolve version ranges against the remotes and rewrite the lock. Pinned
-# packages (`ref:`) never move here — repin by editing the manifest or
-# re-adding. `update <name>` limits the pass to one package.
+# Resolve requested versions/refs against each package's locked source and
+# rewrite the lock. `update <name>` limits the pass to one package; re-adding
+# is the explicit operation for changing a source URL/path.
 set -euo pipefail
 source "$CLI_DIR/lib/cli-common.sh"
 
@@ -18,7 +18,7 @@ while [ $# -gt 0 ]; do
     shift || true
 done
 
-require_v2
+require_cli_project
 manifest="$IP_ROOT/intelligence.yaml"
 lock="$IP_ROOT/intelligence.lock"
 
@@ -35,30 +35,36 @@ while IFS= read -r name; do
         echo "  $name: engine content follows the installed CLI — skipped"
         continue
     fi
+    current="$(qmap_field "$lock" "packages" "$name" "resolved")"
+    locked_requested="$(qmap_field "$lock" "packages" "$name" "requested")"
+    url="$(qmap_field "$lock" "packages" "$name" "url")"
+    path="$(qmap_field "$lock" "packages" "$name" "path")"
+    [ -n "$url" ] || die "$name has no source in intelligence.lock — restore the committed lock or re-add the package"
     ref="$(qmap_field "$manifest" "packages" "$name" "ref")"
-    [ -n "$ref" ] && { echo "  $name: pinned to ref '$ref' — skipped"; continue; }
     range="$(qmap_field "$manifest" "packages" "$name" "version")"
-    # An exact version is a pin, same as ref: — update never moves pins.
-    if [ -n "$range" ] && semver_is_stable "$range"; then
-        echo "  $name: pinned to $range — edit the manifest to move it"
-        continue
+    [ -n "$ref" ] || [ -n "$range" ] || die "$name has neither version nor ref in the manifest"
+
+    if [ -n "$ref" ]; then
+        tag="$ref"
+        requested=""
+    else
+        picked="$(list_remote_versions "$url" | semver_pick_highest "$range")"
+        [ -n "$picked" ] || { echo "  $name: nothing satisfies '$range' at $url" >&2; continue; }
+        read -r tag _ <<< "$(remote_tag_for_version "$url" "$picked")"
+        requested="$range"
     fi
-    url="$(qmap_field "$manifest" "packages" "$name" "url")"
-    path="$(qmap_field "$manifest" "packages" "$name" "path")"
-    if [ -z "$url" ]; then
-        resolve_package_source "$manifest" "$name"
-        url="$RES_URL"; path="$RES_PATH"
+    if [ "$tag" = "$current" ] && [ "$requested" != "$locked_requested" ]; then
+        if [ "$preview" -eq 1 ]; then
+            echo "  $name: request ${locked_requested:-<none>} -> ${requested:-<ref>} (keeps $current)"
+        else
+            locked_sha="$(qmap_field "$lock" "packages" "$name" "sha")"
+            lock_upsert "$lock" "$name" "$requested" "$url" "$path" "$current" "$locked_sha"
+            echo "  $name: request ${locked_requested:-<none>} -> ${requested:-<ref>} (kept $current)"
+        fi
+        moved=$((moved + 1))
+        continue
     fi
-    picked="$(list_remote_versions "$url" | semver_pick_highest "$range")"
-    [ -n "$picked" ] || { echo "  $name: nothing satisfies '${range:-*}' at $url" >&2; continue; }
-    read -r tag _ <<< "$(remote_tag_for_version "$url" "$picked")"
-    current="$(qmap_field "$lock" "packages" "$name" "resolved")"
-    cur_url="$(qmap_field "$lock" "packages" "$name" "url")"
-    cur_path="$(qmap_field "$lock" "packages" "$name" "path")"
-    # Same tag is not enough: a registry may re-point a name's source while
-    # keeping the version — the move doctor warns about must be actionable
-    # here, so url/path changes refetch too.
-    if [ "$tag" = "$current" ] && [ "$url" = "$cur_url" ] && [ "$path" = "$cur_path" ]; then
+    if [ "$tag" = "$current" ]; then
         echo "  $name: ${current:-<none>} (up to date)"
         continue
     fi
@@ -80,7 +86,7 @@ while IFS= read -r name; do
     mkdir -p "$(dirname "$IP_ROOT/$rel")"
     mv "$staging" "$IP_ROOT/$rel"
     wire_package_sources "$manifest" "$name" "$rel" "$IP_ROOT"
-    lock_upsert "$lock" "$name" "$range" "$url" "$path" "$tag" "$sha"
+    lock_upsert "$lock" "$name" "$requested" "$url" "$path" "$tag" "$sha"
     echo "  $name: ${current:-<none>} -> $tag"
     moved=$((moved + 1))
 done < <(qmap_keys "$manifest" "packages")

package/cli/internal/restore.sh

@@ -18,12 +18,12 @@ while [ $# -gt 0 ]; do
     shift || true
 done
 
-require_v2
+require_cli_project
 manifest="$IP_ROOT/intelligence.yaml"
 lock="$IP_ROOT/intelligence.lock"
 
 # --frozen is the reproducibility contract: the lock must agree with the
-# manifest on the package SET and on every requested-source field before a
+# manifest on the package SET and on every requested-intent field before a
 # single byte is restored. Anything less lets a manifest edit ride on a stale
 # lock — the exact drift the flag exists to refuse.
 if [ "$frozen" -eq 1 ]; then
@@ -33,20 +33,12 @@ if [ "$frozen" -eq 1 ]; then
             || die "locked restore: $name is in the manifest but not in intelligence.lock"
         m_ver="$(qmap_field "$manifest" "packages" "$name" "version")"
         m_ref="$(qmap_field "$manifest" "packages" "$name" "ref")"
-        m_url="$(qmap_field "$manifest" "packages" "$name" "url")"
-        m_path="$(qmap_field "$manifest" "packages" "$name" "path")"
         l_req="$(qmap_field "$lock" "packages" "$name" "requested")"
         l_res="$(qmap_field "$lock" "packages" "$name" "resolved")"
-        l_url="$(qmap_field "$lock" "packages" "$name" "url")"
-        l_path="$(qmap_field "$lock" "packages" "$name" "path")"
         [ -z "$m_ver" ] || [ "$m_ver" = "$l_req" ] \
             || die "locked restore: $name requests '$m_ver' but the lock recorded '$l_req' — reconcile the manifest and lock"
         [ -z "$m_ref" ] || [ "$m_ref" = "$l_res" ] \
             || die "--frozen: $name pins ref '$m_ref' but the lock resolved '$l_res'"
-        [ -z "$m_url" ] || [ "$m_url" = "$l_url" ] \
-            || die "--frozen: $name declares url '$m_url' but the lock recorded '$l_url'"
-        [ -z "$m_path" ] || [ "$m_path" = "$l_path" ] \
-            || die "--frozen: $name declares path '$m_path' but the lock recorded '$l_path'"
     done < <(qmap_keys "$manifest" "packages")
     while IFS= read -r name; do
         [ -n "$name" ] || continue
@@ -76,14 +68,11 @@ if [ -n "$missing" ]; then
             sync_pkg_install "$IP_ROOT"
             continue
         fi
-        url="$(qmap_field "$manifest" "packages" "$name" "url")"
-        path="$(qmap_field "$manifest" "packages" "$name" "path")"
         ref="$(qmap_field "$manifest" "packages" "$name" "ref")"
         range="$(qmap_field "$manifest" "packages" "$name" "version")"
-        if [ -z "$url" ]; then
-            resolve_package_source "$manifest" "$name"
-            url="$RES_URL"; path="$RES_PATH"
-        fi
+        resolve_package_source "$manifest" "$name"
+        url="$RES_URL"; path="$RES_PATH"
+        [ -n "$url" ] || die "no trusted registry declares '$name' and it is absent from intelligence.lock"
         resolved_tag=""
         if [ -z "$ref" ]; then
             picked="$(list_remote_versions "$url" | semver_pick_highest "$range")"

package/cli/internal/target-state.sh

@@ -14,7 +14,7 @@ case "$action" in enable|disable) ;; *) die "internal target state: expected <en
 [ -n "$name" ] || die "internal target state: missing adapter name"
 assert_valid_target_name "$name"
 
-require_v2
+require_cli_project
 manifest="$IP_ROOT/intelligence.yaml"
 content_dir="$(manifest_intelligence_dir "$manifest")"
 
@@ -25,31 +25,39 @@ if [ "$action" = "enable" ]; then
         die "adapter '$name' not found — create it first: intelligence adapter create $name"
     fi
 
-    # These adapters intentionally omit always-on rules because their tools
-    # read AGENTS.md. Do not create a manifest that full sync must refuse.
-    case "$name" in
-        cursor|copilot|codex|pi|opencode)
-            if [ "$(is_target_enabled "$manifest" "agents")" != "1" ]; then
-                die "target '$name' requires target 'agents' — enable it first"
-            fi
-            ;;
-    esac
-
     output="$(get_target_output "$manifest" "$name")"
     [ -n "$output" ] || output="$(default_target_output "$name")"
+    validate_adapter_contract_for "$IP_ROOT" "$content_dir" "$name" "$output" \
+        || die "adapter '$name' has an invalid ownership contract"
+    while IFS= read -r required; do
+        [ -n "$required" ] || continue
+        if [ "$(is_target_enabled "$manifest" "$required")" != "1" ]; then
+            die "target '$name' requires target '$required' — enable it first"
+        fi
+    done < <(adapter_records_for "$IP_ROOT" "$content_dir" "$name" "$output" \
+        | awk -F '\t' '$1 == "requires" { print $2 }')
     target_set_enabled "$manifest" "$name" true "$output"
+    ensure_target_gitignore "$IP_ROOT" "$manifest" "$name"
+    ensure_manifest_publisher_ignores "$IP_ROOT" "$manifest"
     echo "enabled: $name (output: $output)"
     exit 0
 fi
 
 target_exists "$manifest" "$name" || die "target '$name' is not in the manifest"
-if [ "$name" = "agents" ]; then
-    for dependent in cursor copilot codex pi opencode; do
-        if [ "$(is_target_enabled "$manifest" "$dependent")" = "1" ]; then
-            die "target 'agents' is required by enabled target '$dependent' — disable '$dependent' first"
-        fi
-    done
-fi
+while IFS= read -r dependent; do
+    [ -n "$dependent" ] || continue
+    [ "$dependent" = "$name" ] && continue
+    [ "$(is_target_enabled "$manifest" "$dependent")" = "1" ] || continue
+    dependent_output="$(get_target_output "$manifest" "$dependent")"
+    [ -n "$dependent_output" ] || dependent_output="$(default_target_output "$dependent")"
+    dependent_records="$(adapter_records_for "$IP_ROOT" "$content_dir" "$dependent" "$dependent_output")" \
+        || die "adapter '$dependent' has an invalid ownership contract"
+    if awk -F '\t' -v required="$name" \
+        '$1 == "requires" && $2 == required { found=1 } END { exit(found ? 0 : 1) }' \
+        <<< "$dependent_records"; then
+        die "target '$name' is required by enabled target '$dependent' — disable '$dependent' first"
+    fi
+done < <(target_names "$manifest")
 output="$(get_target_output "$manifest" "$name")"
 [ -n "$output" ] || output="$(default_target_output "$name")"
 target_set_enabled "$manifest" "$name" false "$output"

package/cli/lib/adapter-lifecycle.sh

@@ -0,0 +1,33 @@
+#!/bin/bash
+# CLI consumers of the engine's declarative adapter contract.
+
+adapter_file_for() {
+    local root="$1" content_dir="$2" name="$3"
+    if [ -f "$root/$content_dir/adapters/$name.sh" ]; then
+        printf '%s\n' "$root/$content_dir/adapters/$name.sh"
+    elif [ -f "$IS_ENGINE_DIR/adapters/$name.sh" ]; then
+        printf '%s\n' "$IS_ENGINE_DIR/adapters/$name.sh"
+    else
+        return 1
+    fi
+}
+
+adapter_records_for() {
+    local root="$1" content_dir="$2" name="$3" output="$4" file
+    file="$(adapter_file_for "$root" "$content_dir" "$name")" || {
+        echo "ERROR: adapter '$name' not found" >&2
+        return 1
+    }
+    adapter_contract_records "$name" "$file" "$output"
+}
+
+validate_adapter_contract_for() {
+    local root="$1" content_dir="$2" name="$3" output="$4"
+    adapter_records_for "$root" "$content_dir" "$name" "$output" >/dev/null
+}
+
+adapter_contract_paths() {
+    local root="$1" content_dir="$2" name="$3" output="$4"
+    adapter_records_for "$root" "$content_dir" "$name" "$output" \
+        | awk -F '\t' '$1 == "owned" || $1 == "managed" || $1 == "legacy" || $1 == "preserve" { print $2 }'
+}