@ainova-systems/intelligence 0.11.0-rc.9 → 0.11.0

package/cli/internal/check.sh

@@ -20,9 +20,9 @@ case "$IP_MODE" in
         exit 0
         ;;
     legacy)
-        echo "project: vendored (v1) at $IP_ROOT"
+        echo "project: legacy Intelligence Sync at $IP_ROOT"
         ok "vendored engine $(tr -d ' \t\r\n' < "$IP_MODULE_DIR/scripts/VERSION")"
-        echo "  → 'intelligence init' converts it to the CLI setup"
+        echo "  → 'intelligence init' converts it into an Intelligence project"
         exit 0
         ;;
 esac
@@ -86,6 +86,46 @@ while IFS= read -r name; do
     fi
 done < <(qmap_keys "$manifest" "packages")
 
+# Adapter contracts are the shared source of truth for dependencies, rollback,
+# onboarding backup and Git policy. Validate every declared target, including
+# disabled ones, so a later enable cannot reveal a stale custom adapter.
+content_dir="$(manifest_intelligence_dir "$manifest")"
+while IFS= read -r target; do
+    [ -n "$target" ] || continue
+    output="$(get_target_output "$manifest" "$target")"
+    [ -n "$output" ] || output="$(default_target_output "$target")"
+    adapter_file="$(adapter_file_for "$IP_ROOT" "$content_dir" "$target" 2>/dev/null || true)"
+    if [ -z "$adapter_file" ]; then
+        warn "adapter '$target' is declared but its implementation is missing"
+        continue
+    fi
+    records="$(adapter_contract_records "$target" "$adapter_file" "$output" 2>/dev/null || true)"
+    if ! printf '%s\n' "$records" | grep -Fqx $'version\t1'; then
+        warn "adapter '$target' has an invalid ownership contract"
+        continue
+    fi
+    while IFS=$'\t' read -r kind value; do
+        if [ "$kind" = "requires" ] \
+            && [ "$(is_target_enabled "$manifest" "$target")" = "1" ] \
+            && [ "$(is_target_enabled "$manifest" "$value")" != "1" ]; then
+            warn "enabled adapter '$target' requires enabled adapter '$value'"
+        fi
+        if [ "$(is_target_enabled "$manifest" "$target")" = "1" ]; then
+            case "$kind" in
+                ignore)
+                    grep -Fqx -- "$value" "$IP_ROOT/.gitignore" 2>/dev/null \
+                        || warn "adapter '$target' Git policy is missing '$value'"
+                    ;;
+                include)
+                    grep -Fqx -- "!$value" "$IP_ROOT/.gitignore" 2>/dev/null \
+                        || warn "adapter '$target' Git policy is missing '!$value'"
+                    ;;
+            esac
+        fi
+    done <<< "$records"
+    ok "adapter $target contract v1"
+done < <(target_names "$manifest")
+
 # Lock orphans.
 if [ -f "$lock" ]; then
     while IFS= read -r name; do

package/cli/internal/{migrate-v1.sh → convert-legacy.sh}

@@ -1,6 +1,6 @@
 #!/bin/bash
-# Internal v1-to-v2 migration operation.
-# to the CLI setup: root intelligence.yaml, .intelligence/ store,
+# Internal conversion from legacy Intelligence Sync to Intelligence CLI.
+# to an Intelligence project: root intelligence.yaml, .intelligence/ store,
 # intelligence.lock, no vendored engine.
 #
 # Transactional: STAGE everything next to the
@@ -24,8 +24,8 @@ done
 detect_project
 case "$IP_MODE" in
     legacy) ;;
-    v2) die "already on the v2 setup ($IP_ROOT/intelligence.yaml)" ;;
-    *) die "no vendored setup found here — 'intelligence init' starts a fresh project" ;;
+    cli) die "already an Intelligence project ($IP_ROOT/intelligence.yaml)" ;;
+    *) die "no legacy Intelligence Sync project found here — 'intelligence init' starts a fresh project" ;;
 esac
 root="$IP_ROOT"
 umbrella="$IP_UMBRELLA"
@@ -36,22 +36,22 @@ umbrella_rel="${umbrella#"$root"/}"
 
 for existing in intelligence.yaml intelligence.lock .intelligence; do
     if [ -e "$root/$existing" ] || [ -L "$root/$existing" ]; then
-        die "$existing already exists at the root — conflicting v2 state; move it aside or restore the project before migrating"
+        die "$existing already exists at the root — conflicting Intelligence CLI state; move it aside or restore the project before converting"
     fi
 done
 if [ "$dry_run" -eq 0 ] && [ "$force" -eq 0 ]; then
     if [ -n "$(git -C "$root" status --porcelain 2>/dev/null)" ]; then
-        die "working tree is not clean — commit or stash first (or --force); migrate wants a one-commit diff you can review and revert"
+        die "working tree is not clean — commit or stash first (or --force); conversion produces a one-commit diff you can review and revert"
     fi
 fi
 
-# `sync_version` belongs to the archived v1 format. The v2 contract uses
+# `sync_version` belongs to the legacy Intelligence Sync format. Intelligence uses
 # `schema_version`, so conversion reads the legacy scalar explicitly.
 stamp="$(top_scalar "$config" "sync_version")"
 eng="$(bundled_engine_version)"
 [ -n "$stamp" ] && _ver_gt "$stamp" "$eng" && die "project schema $stamp is newer than this CLI's engine $eng — update the CLI first"
 
-# The v1 `packs:` block is the one v1 shape migrate still has to read, and the
+# The legacy `packs:` block is the one Intelligence Sync shape conversion still reads, and the
 # engine no longer knows it — the reader lives here, with its only consumer.
 get_pack_field() {
     get_nested_yaml_value "$1" "packs" "$2" "$3"
@@ -73,10 +73,10 @@ validate_mirror_path() {
     case "$canon" in "$root"/*) ;; *) die "pack '$pack' mirror escapes the repository: '$mirror'" ;; esac
     rel="${canon#"$root"/}"
 
-    # A v1 mirror may live below the content directory (the normal location is
+    # A legacy mirror may live below the content directory (the normal location is
     # intelligence/external/<pack>), but it must never own the directory itself,
     # the vendored module, CLI state, authored sources, or generated outputs.
-    case "$umbrella_rel" in "$rel"|"$rel"/*) die "pack '$pack' mirror '$mirror' contains the v1 content directory" ;; esac
+    case "$umbrella_rel" in "$rel"|"$rel"/*) die "pack '$pack' mirror '$mirror' contains the legacy content directory" ;; esac
     for protected in .git .intelligence "$module_rel"; do
         paths_overlap "$rel" "$protected" && die "pack '$pack' mirror '$mirror' overlaps protected path '$protected'"
     done
@@ -115,14 +115,14 @@ cleanup_stage() { rm -rf "$stage"; }
 trap cleanup_stage EXIT INT TERM
 mkdir -p "$stage/.intelligence/packages"
 
-# v2 carries no v1 migration chain: v1 is archived, and the archived engine is
-# what knows how to walk an old project forward. So migrate accepts only a
-# project already at the final v1 schema and names the exact remedy otherwise —
+# Intelligence carries no legacy migration chain: the archived Intelligence Sync
+# engine knows how to walk an old project forward. Conversion accepts only a
+# project already at the final legacy schema and names the exact remedy otherwise —
 # a remedy that keeps working indefinitely, because the archive stays at the
 # URL the project's own update.sh already clones.
-V1_FINAL_SCHEMA="0.10.0"
-if [ -z "$stamp" ] || _ver_gt "$V1_FINAL_SCHEMA" "$stamp"; then
-    echo "ERROR: project schema is ${stamp:-absent (pre-0.3.1)}, older than the final v1 schema $V1_FINAL_SCHEMA." >&2
+LEGACY_FINAL_SCHEMA="0.10.0"
+if [ -z "$stamp" ] || _ver_gt "$LEGACY_FINAL_SCHEMA" "$stamp"; then
+    echo "ERROR: project schema is ${stamp:-absent (pre-0.3.1)}, older than the final legacy Intelligence Sync schema $LEGACY_FINAL_SCHEMA." >&2
     echo "       Bring it forward with its own engine first — that still works:" >&2
     echo "         bash $module_rel/scripts/update.sh --yes" >&2
     echo "       then re-run: intelligence init" >&2
@@ -134,7 +134,7 @@ echo "== staging =="
 # bundle (fetch_package's guard — no network).
 sync_pkg_sha="$(fetch_package "$SYNC_PKG_URL" "v$eng" "$SYNC_PKG_PATH" "$stage/$SYNC_PKG_STORE")"
 
-# Legacy pack name -> v2 package name (@org/repo derived from the url), plus
+# Legacy pack name -> Intelligence package name (@org/repo derived from the url), plus
 # per-pack source facts. Recorded as rows for the config rewrite and the lock.
 pack_rows="$stage/packs.rows"
 : > "$pack_rows"
@@ -325,6 +325,10 @@ if [ -f "$root/.gitignore" ]; then
     gitignore_existed=1
     cp "$root/.gitignore" "$stage/gitignore.orig"
 fi
+while IFS= read -r policy_file; do
+    [ -f "$root/$policy_file" ] || continue
+    cp "$root/$policy_file" "$stage/$policy_file.orig"
+done < <(publisher_ignore_file_names)
 commit_active=1
 rollback() {
     [ "$commit_active" -eq 1 ] || return 0
@@ -336,6 +340,10 @@ rollback() {
     else
         rm -f "$root/.gitignore"
     fi
+    while IFS= read -r policy_file; do
+        [ -f "$stage/$policy_file.orig" ] || continue
+        cp "$stage/$policy_file.orig" "$root/$policy_file"
+    done < <(publisher_ignore_file_names)
     rm -rf "$stage"
     echo "rolled back — the vendored setup is untouched" >&2
 }
@@ -348,24 +356,19 @@ rollback_on_exit() {
 # plain set -e/EXIT failure rather than only an explicit sync refusal.
 trap rollback_on_exit EXIT
 trap 'rollback; exit 130' INT TERM
-if [ ! -f "$root/.gitignore" ] || ! grep -q '^\.intelligence/' "$root/.gitignore"; then
-    {
-        [ -f "$root/.gitignore" ] && [ -n "$(tail -c 1 "$root/.gitignore" 2>/dev/null)" ] && echo ""
-        echo "# intelligence CLI package store (restored automatically by 'intelligence sync')"
-        echo ".intelligence/"
-    } >> "$root/.gitignore"
-fi
 mv "$stage/.intelligence" "$root/.intelligence"
 cp "$manifest_stage" "$root/intelligence.yaml"
 lock_write_from_tsv "$root/intelligence.lock" "$lock_rows"
+ensure_manifest_gitignore "$root" "$root/intelligence.yaml"
+ensure_manifest_publisher_ignores "$root" "$root/intelligence.yaml"
 
 sync_out="$(cd "$root" && IS_SUPPRESS_CLI_NOTE=1 bash "$CLI_DIR/commands/sync.sh" 2>&1)" || {
     echo "$sync_out"
-    die "sync of the migrated state failed"
+    die "sync of the converted state failed"
 }
 echo "$sync_out" | grep -q '^IS_STATUS=ok' || {
     echo "$sync_out"
-    die "sync of the migrated state did not report ok"
+    die "sync of the converted state did not report ok"
 }
 # Point of no return: the new state is verified. From here an interrupt must
 # NOT roll back (the old setup is being removed) — only clean the stage.
@@ -384,7 +387,7 @@ while IFS="$LOCK_SEP" read -r pack name url ref mirror; do
     esac
     if [ -d "$root/$mirror" ]; then
         rm -rf "${root:?}/$mirror"
-        # An emptied v1 mirror parent (for example intelligence/external/) goes with it.
+        # An emptied legacy mirror parent (for example intelligence/external/) goes with it.
         rmdir "$(dirname "$root/$mirror")" 2>/dev/null || true
     fi
 done < "$pack_rows"
@@ -395,6 +398,7 @@ rm -f "$config"
 rmdir "$umbrella" 2>/dev/null || true
 
 echo ""
-echo "migrated. Review the diff, then commit. The old config.yaml is kept at .intelligence/backup/config.yaml."
+echo "converted. Review the diff, then commit. The old config.yaml is kept at .intelligence/backup/config.yaml."
 echo "From now on: intelligence sync | package | update | status."
-echo "Next: ask your agent to run /intelligence-learn-from-repository to review the migrated project context."
+report_tracked_managed_ignores "$root" "$root/intelligence.yaml"
+echo "Next: ask your agent to run /intelligence-learn-from-repository to verify setup and review the converted project context."

package/cli/internal/package-add.sh

@@ -23,7 +23,7 @@ while [ $# -gt 0 ]; do
     shift || true
 done
 
-require_v2
+require_cli_project
 manifest="$IP_ROOT/intelligence.yaml"
 lock="$IP_ROOT/intelligence.lock"
 

package/cli/internal/package-list.sh

@@ -3,7 +3,7 @@
 set -euo pipefail
 source "$CLI_DIR/lib/cli-common.sh"
 
-require_v2
+require_cli_project
 manifest="$IP_ROOT/intelligence.yaml"
 lock="$IP_ROOT/intelligence.lock"
 

package/cli/internal/package-remove.sh

@@ -15,7 +15,7 @@ for a in "$@"; do
     esac
 done
 
-require_v2
+require_cli_project
 
 # Removing the engine-content package guts the outputs (meta-skills, the
 # authoring rule, both engine agents disappear) while everything still

package/cli/internal/package-search.sh

@@ -12,7 +12,7 @@ term="${1:-}"
 
 detect_project
 manifest=""
-[ "$IP_MODE" = "v2" ] && manifest="$IP_ROOT/intelligence.yaml"
+[ "$IP_MODE" = "cli" ] && manifest="$IP_ROOT/intelligence.yaml"
 
 # State of one package name in this project: installed / declared / available.
 pkg_state() {

package/cli/internal/package-update.sh

@@ -18,7 +18,7 @@ while [ $# -gt 0 ]; do
     shift || true
 done
 
-require_v2
+require_cli_project
 manifest="$IP_ROOT/intelligence.yaml"
 lock="$IP_ROOT/intelligence.lock"
 

package/cli/internal/restore.sh

@@ -18,7 +18,7 @@ while [ $# -gt 0 ]; do
     shift || true
 done
 
-require_v2
+require_cli_project
 manifest="$IP_ROOT/intelligence.yaml"
 lock="$IP_ROOT/intelligence.lock"
 

package/cli/internal/target-state.sh

@@ -14,7 +14,7 @@ case "$action" in enable|disable) ;; *) die "internal target state: expected <en
 [ -n "$name" ] || die "internal target state: missing adapter name"
 assert_valid_target_name "$name"
 
-require_v2
+require_cli_project
 manifest="$IP_ROOT/intelligence.yaml"
 content_dir="$(manifest_intelligence_dir "$manifest")"
 
@@ -25,31 +25,39 @@ if [ "$action" = "enable" ]; then
         die "adapter '$name' not found — create it first: intelligence adapter create $name"
     fi
 
-    # These adapters intentionally omit always-on rules because their tools
-    # read AGENTS.md. Do not create a manifest that full sync must refuse.
-    case "$name" in
-        cursor|copilot|codex|pi|opencode)
-            if [ "$(is_target_enabled "$manifest" "agents")" != "1" ]; then
-                die "target '$name' requires target 'agents' — enable it first"
-            fi
-            ;;
-    esac
-
     output="$(get_target_output "$manifest" "$name")"
     [ -n "$output" ] || output="$(default_target_output "$name")"
+    validate_adapter_contract_for "$IP_ROOT" "$content_dir" "$name" "$output" \
+        || die "adapter '$name' has an invalid ownership contract"
+    while IFS= read -r required; do
+        [ -n "$required" ] || continue
+        if [ "$(is_target_enabled "$manifest" "$required")" != "1" ]; then
+            die "target '$name' requires target '$required' — enable it first"
+        fi
+    done < <(adapter_records_for "$IP_ROOT" "$content_dir" "$name" "$output" \
+        | awk -F '\t' '$1 == "requires" { print $2 }')
     target_set_enabled "$manifest" "$name" true "$output"
+    ensure_target_gitignore "$IP_ROOT" "$manifest" "$name"
+    ensure_manifest_publisher_ignores "$IP_ROOT" "$manifest"
     echo "enabled: $name (output: $output)"
     exit 0
 fi
 
 target_exists "$manifest" "$name" || die "target '$name' is not in the manifest"
-if [ "$name" = "agents" ]; then
-    for dependent in cursor copilot codex pi opencode; do
-        if [ "$(is_target_enabled "$manifest" "$dependent")" = "1" ]; then
-            die "target 'agents' is required by enabled target '$dependent' — disable '$dependent' first"
-        fi
-    done
-fi
+while IFS= read -r dependent; do
+    [ -n "$dependent" ] || continue
+    [ "$dependent" = "$name" ] && continue
+    [ "$(is_target_enabled "$manifest" "$dependent")" = "1" ] || continue
+    dependent_output="$(get_target_output "$manifest" "$dependent")"
+    [ -n "$dependent_output" ] || dependent_output="$(default_target_output "$dependent")"
+    dependent_records="$(adapter_records_for "$IP_ROOT" "$content_dir" "$dependent" "$dependent_output")" \
+        || die "adapter '$dependent' has an invalid ownership contract"
+    if awk -F '\t' -v required="$name" \
+        '$1 == "requires" && $2 == required { found=1 } END { exit(found ? 0 : 1) }' \
+        <<< "$dependent_records"; then
+        die "target '$name' is required by enabled target '$dependent' — disable '$dependent' first"
+    fi
+done < <(target_names "$manifest")
 output="$(get_target_output "$manifest" "$name")"
 [ -n "$output" ] || output="$(default_target_output "$name")"
 target_set_enabled "$manifest" "$name" false "$output"

package/cli/lib/adapter-lifecycle.sh

@@ -0,0 +1,33 @@
+#!/bin/bash
+# CLI consumers of the engine's declarative adapter contract.
+
+adapter_file_for() {
+    local root="$1" content_dir="$2" name="$3"
+    if [ -f "$root/$content_dir/adapters/$name.sh" ]; then
+        printf '%s\n' "$root/$content_dir/adapters/$name.sh"
+    elif [ -f "$IS_ENGINE_DIR/adapters/$name.sh" ]; then
+        printf '%s\n' "$IS_ENGINE_DIR/adapters/$name.sh"
+    else
+        return 1
+    fi
+}
+
+adapter_records_for() {
+    local root="$1" content_dir="$2" name="$3" output="$4" file
+    file="$(adapter_file_for "$root" "$content_dir" "$name")" || {
+        echo "ERROR: adapter '$name' not found" >&2
+        return 1
+    }
+    adapter_contract_records "$name" "$file" "$output"
+}
+
+validate_adapter_contract_for() {
+    local root="$1" content_dir="$2" name="$3" output="$4"
+    adapter_records_for "$root" "$content_dir" "$name" "$output" >/dev/null
+}
+
+adapter_contract_paths() {
+    local root="$1" content_dir="$2" name="$3" output="$4"
+    adapter_records_for "$root" "$content_dir" "$name" "$output" \
+        | awk -F '\t' '$1 == "owned" || $1 == "managed" || $1 == "legacy" || $1 == "preserve" { print $2 }'
+}

package/cli/lib/cli-common.sh

@@ -11,6 +11,7 @@
 # IS_ENGINE_DIR come exported from the dispatcher.
 source "$IS_ENGINE_DIR/lib/common.sh"
 source "$IS_ENGINE_DIR/lib/contract.sh"
+source "$IS_ENGINE_DIR/lib/adapter-contract.sh"
 
 die() {
     echo "ERROR: $*" >&2
@@ -50,6 +51,9 @@ source "$CLI_DIR/lib/manifest.sh"
 source "$CLI_DIR/lib/semver.sh"
 source "$CLI_DIR/lib/registry.sh"
 source "$CLI_DIR/lib/lockfile.sh"
+source "$CLI_DIR/lib/adapter-lifecycle.sh"
+source "$CLI_DIR/lib/gitignore.sh"
+source "$CLI_DIR/lib/onboarding.sh"
 
 # The engine-content package: OPTIONAL but auto-selected at init. Package by
 # UX (manifest entry, lockfile row, list/search/remove), bundle by mechanics —
@@ -70,11 +74,11 @@ DEFAULT_REGISTRY_URL="$(top_scalar "$_EPKG" "default_registry")"
 SYNC_PKG_STORE=".intelligence/packages/$SYNC_PKG_NAME"
 
 # --- Project detection ---------------------------------------------------
-# Sets: IP_MODE (v2|legacy|none), IP_ROOT, IP_UMBRELLA, IP_MODULE_DIR.
+# Sets: IP_MODE (cli|legacy|none), IP_ROOT, IP_UMBRELLA, IP_MODULE_DIR.
 # These ARE this lib's public API — every command reads them after calling
 # detect_project, which per-file shellcheck cannot see.
 # shellcheck disable=SC2034
-# v2 wins: the nearest ancestor holding intelligence.yaml. Legacy is a git
+# The CLI product wins: the nearest ancestor holding intelligence.yaml. Legacy is a git
 # repo holding an umbrella (a dir with config.yaml) whose module is identified
 # by role — scripts/sync.sh + scripts/VERSION — never by name.
 detect_project() {
@@ -82,7 +86,7 @@ detect_project() {
     local dir="$PWD"
     while :; do
         if [ -f "$dir/intelligence.yaml" ]; then
-            IP_MODE="v2"
+            IP_MODE="cli"
             IP_ROOT="$(cd "$dir" && pwd)"
             return 0
         fi
@@ -109,11 +113,11 @@ detect_project() {
     return 0
 }
 
-require_v2() {
+require_cli_project() {
     detect_project
     case "$IP_MODE" in
-        v2) ;;
-        legacy) die "this is a vendored (v1) setup — run 'intelligence init' to migrate it, or keep using its own flow" ;;
+        cli) ;;
+        legacy) die "this is a legacy Intelligence Sync project — run 'intelligence init' to convert it, or keep using its own flow" ;;
         *) die "no intelligence project found here — run 'intelligence init'" ;;
     esac
 }
@@ -176,7 +180,7 @@ export_engine_env() {
 
 # --- Project lifecycle preflight -----------------------------------------
 # Public commands are intentionally few. They share this state gate so a CLI
-# installed at a newer engine version brings the current v2 project forward
+# installed at a newer engine version brings the current Intelligence project forward
 # before a mutating operation. The npm install itself cannot do that: it runs
 # outside any project and does not know which repositories the user owns.
 
@@ -268,7 +272,7 @@ ensure_project_current() {
         die "project lifecycle requires alignment (stamp ${stamp:-unstamped}, engine $eng) — run 'intelligence init --apply' locally, review and commit the diff"
     fi
     echo "  project alignment: stamp ${stamp:-unstamped}, engine $eng"
-    bash "$CLI_DIR/internal/upgrade-v2.sh" --no-sync
+    bash "$CLI_DIR/internal/align-project.sh" --no-sync
 }
 
 project_store_missing() {

package/cli/lib/gitignore.sh

@@ -0,0 +1,174 @@
+#!/bin/bash
+# Generated-output policy derived from each adapter's ownership contract.
+
+gitignore_add_line() {
+    local root="$1" line="$2" file="$1/.gitignore"
+    if [ -f "$file" ] && grep -Fqx -- "$line" "$file"; then
+        return 0
+    fi
+    printf '%s\n' "$line" >> "$file"
+}
+
+ensure_gitignore_header() {
+    local root="$1" file="$1/.gitignore"
+    if [ ! -f "$file" ] || ! grep -Fqx '# Intelligence generated state and tool output' "$file"; then
+        if [ -f "$file" ] && [ -s "$file" ] && [ -n "$(tail -c 1 "$file" 2>/dev/null)" ]; then
+            printf '\n' >> "$file"
+        fi
+        printf '%s\n' '# Intelligence generated state and tool output' >> "$file"
+    fi
+}
+
+ensure_base_gitignore() {
+    local root="$1"
+    ensure_gitignore_header "$root"
+    gitignore_add_line "$root" '.intelligence/'
+}
+
+ensure_target_gitignore() {
+    local root="$1" manifest="$2" target="$3" content_dir output kind value records
+    ensure_gitignore_header "$root"
+    content_dir="$(manifest_intelligence_dir "$manifest")"
+    output="$(get_target_output "$manifest" "$target")"
+    [ -n "$output" ] || output="$(default_target_output "$target")"
+    records="$(adapter_records_for "$root" "$content_dir" "$target" "$output")" \
+        || die "adapter '$target' has an invalid ownership contract"
+    while IFS=$'\t' read -r kind value; do
+        case "$kind" in
+            ignore)  gitignore_add_line "$root" "$value" ;;
+            include) gitignore_add_line "$root" "!$value" ;;
+        esac
+    done <<< "$records"
+}
+
+ensure_manifest_gitignore() {
+    local root="$1" manifest="$2" target
+    ensure_base_gitignore "$root"
+    while IFS= read -r target; do
+        [ -n "$target" ] || continue
+        if [ "$(is_target_enabled "$manifest" "$target")" = "1" ]; then
+            ensure_target_gitignore "$root" "$manifest" "$target"
+        fi
+    done < <(target_names "$manifest")
+}
+
+# Publishing/build tools do not share Git's ignore policy. In particular,
+# .vscodeignore and .npmignore become the packager's own filter, while Docker
+# always builds from its independent context filter. Only amend files the
+# project already has: their presence is the explicit signal that this root is
+# packaged or sent as a build context.
+publisher_ignore_file_names() {
+    printf '%s\n' .vscodeignore .npmignore .dockerignore
+}
+
+publisher_ignore_add_line() {
+    local file="$1" line="$2"
+    if grep -Fqx -- "$line" "$file" 2>/dev/null; then
+        return 0
+    fi
+    printf '%s\n' "$line" >> "$file"
+    PUBLISH_IGNORE_FILE_CHANGED=1
+}
+
+publisher_ignore_add_path() {
+    local file="$1" path="${2#./}"
+    path="${path%/}"
+    [ -n "$path" ] || return 0
+    publisher_ignore_add_line "$file" "$path"
+    publisher_ignore_add_line "$file" "$path/**"
+}
+
+ensure_manifest_publisher_ignores() {
+    local root="$1" manifest="$2" rel file content_dir target output records kind value
+    content_dir="$(manifest_intelligence_dir "$manifest")"
+    while IFS= read -r rel; do
+        [ -n "$rel" ] || continue
+        file="$root/$rel"
+        [ -f "$file" ] || continue
+        PUBLISH_IGNORE_FILE_CHANGED=0
+        if ! grep -Fqx '# Intelligence development context and generated output' "$file" 2>/dev/null; then
+            if [ -s "$file" ] && [ -n "$(tail -c 1 "$file" 2>/dev/null)" ]; then
+                printf '\n' >> "$file"
+            fi
+            printf '%s\n' '# Intelligence development context and generated output' >> "$file"
+            PUBLISH_IGNORE_FILE_CHANGED=1
+        fi
+        publisher_ignore_add_path "$file" '.intelligence'
+        publisher_ignore_add_line "$file" 'intelligence.yaml'
+        publisher_ignore_add_line "$file" 'intelligence.lock'
+        publisher_ignore_add_path "$file" "$content_dir"
+        while IFS= read -r target; do
+            [ -n "$target" ] || continue
+            [ "$(is_target_enabled "$manifest" "$target")" = "1" ] || continue
+            output="$(get_target_output "$manifest" "$target")"
+            [ -n "$output" ] || output="$(default_target_output "$target")"
+            publisher_ignore_add_path "$file" "$output"
+            records="$(adapter_records_for "$root" "$content_dir" "$target" "$output")" \
+                || die "adapter '$target' has an invalid ownership contract"
+            while IFS=$'\t' read -r kind value; do
+                case "$kind" in
+                    owned|managed|legacy) publisher_ignore_add_path "$file" "$value" ;;
+                esac
+            done <<< "$records"
+        done < <(target_names "$manifest")
+        if [ "$PUBLISH_IGNORE_FILE_CHANGED" -eq 1 ]; then
+            echo "packaging exclusions updated: $rel"
+        fi
+    done < <(publisher_ignore_file_names)
+}
+
+managed_gitignore_patterns() {
+    local root="$1" manifest="$2" content_dir target output records kind value
+    content_dir="$(manifest_intelligence_dir "$manifest")"
+    printf '%s\n' '.intelligence/' "$content_dir/_backup/"
+    while IFS= read -r target; do
+        [ -n "$target" ] || continue
+        [ "$(is_target_enabled "$manifest" "$target")" = "1" ] || continue
+        output="$(get_target_output "$manifest" "$target")"
+        [ -n "$output" ] || output="$(default_target_output "$target")"
+        records="$(adapter_records_for "$root" "$content_dir" "$target" "$output")" \
+            || return 1
+        while IFS=$'\t' read -r kind value; do
+            case "$kind" in
+                ignore) printf '%s\n' "$value" ;;
+                include) printf '!%s\n' "$value" ;;
+            esac
+        done <<< "$records"
+    done < <(target_names "$manifest")
+}
+
+# Git does not apply ignore rules retroactively to files already in its index.
+# Name each affected path and print a command which only untracks it; the local
+# file remains available as migration input.
+report_tracked_managed_ignores() {
+    local root="$1" manifest="$2" patterns tracked path quoted posix_quoted powershell_quoted
+    git -C "$root" rev-parse --is-inside-work-tree >/dev/null 2>&1 || return 0
+    patterns="$(mktemp -t intelligence-gitignore-XXXXXX)"
+    tracked="$(mktemp -t intelligence-tracked-XXXXXX)"
+    managed_gitignore_patterns "$root" "$manifest" > "$patterns" || {
+        rm -f "$patterns" "$tracked"
+        return 0
+    }
+    git -C "$root" ls-files -z -ci --exclude-from="$patterns" > "$tracked" 2>/dev/null || true
+    rm -f "$patterns"
+    [ -s "$tracked" ] || {
+        rm -f "$tracked"
+        return 0
+    }
+    echo "  Tracked files still bypass these .gitignore rules. Untrack them without deleting local copies:"
+    while IFS= read -r -d '' path; do
+        [ -n "$path" ] || continue
+        if [[ "$path" == *"'"* ]]; then
+            # macOS still ships Bash 3.2; use portable sed rather than newer
+            # parameter-replacement behavior for the embedded quote.
+            posix_quoted="$(printf '%s' "$path" | sed "s/'/'\\\\''/g")"
+            powershell_quoted="$(printf '%s' "$path" | sed "s/'/''/g")"
+            printf "    POSIX:      git rm --cached -- '%s'\n" "$posix_quoted"
+            printf "    PowerShell: git rm --cached -- '%s'\n" "$powershell_quoted"
+        else
+            quoted="'$path'"
+            printf '    git rm --cached -- %s\n' "$quoted"
+        fi
+    done < "$tracked"
+    rm -f "$tracked"
+}