@ainova-systems/intelligence 0.17.0 → 0.17.2

package/cli/commands/adapter.sh

@@ -118,6 +118,8 @@ adapter_remove() {
         read -r answer
         case "$answer" in y|Y|yes|YES) ;; *) echo "removal cancelled"; exit 0 ;; esac
     fi
+    # A render sources project adapters: never remove one under it.
+    project_lock_hold "$IP_ROOT"
     rm -f "$file"
     echo "removed: $content_dir/adapters/$name.sh"
     echo "  generated output was kept"
@@ -136,6 +138,8 @@ case "$action" in
         [ -n "$name" ] && [ $# -eq 2 ] || die "usage: intelligence adapter <enable|disable> <name>"
         assert_valid_target_name "$name"
         require_cli_project
+        # Held through the final render: target-state and sync join it.
+        project_lock_hold "$IP_ROOT"
         ensure_project_current "$IP_ROOT"
         if [ "$action" = "enable" ]; then
             state_stage="$(mktemp -d -t intelligence-adapter-state-XXXXXX)"

package/cli/commands/sync.sh

@@ -1,9 +1,15 @@
 #!/bin/bash
 # intelligence sync [target] [--compact] [--force] - render intelligence to enabled tools.
 set -euo pipefail
-source "$CLI_DIR/lib/cli-common.sh"
 
+# Print before library loading and lifecycle checks so a content verification
+# never looks idle. Compact output remains a buffered machine-readable report.
 compact=0
+for argument in "$@"; do
+    [ "$argument" != --compact ] || compact=1
+done
+[ "$compact" -ne 0 ] || echo 'Checking project...'
+source "$CLI_DIR/lib/cli-common.sh"
 force=0
 target=""
 while [ $# -gt 0 ]; do
@@ -23,6 +29,9 @@ run_sync() {
     detect_project || return $?
     case "$IP_MODE" in
         cli)
+            # One writer per project at a time: the store restore and the
+            # render below both rewrite shared state (sync-lock.sh).
+            project_lock_hold "$IP_ROOT"
             # `sync` is the normal fresh-clone command. A newer globally installed
             # CLI aligns the current Intelligence project first (except in CI, where a
             # tracked migration must be reviewed and committed locally), and a

package/cli/commands/update.sh

@@ -105,6 +105,9 @@ if [ "$mode" = "ask" ]; then
     esac
 fi
 
+# Held from alignment through the final render: the package pass and the sync
+# it execs join this lock instead of taking their own.
+project_lock_hold "$IP_ROOT"
 ensure_project_current "$IP_ROOT"
 apply_args=(--no-sync)
 [ -z "$only" ] || apply_args+=("$only")

package/cli/intelligence

@@ -7,15 +7,21 @@
 
 set -euo pipefail
 
-CLI_DIR="$(cd "$(dirname "$0")" && pwd)"
+case "$0" in
+    */*) CLI_DIR="${0%/*}"; [ -n "$CLI_DIR" ] || CLI_DIR="/" ;;
+    *) CLI_DIR="." ;;
+esac
+CLI_DIR="$(cd "$CLI_DIR" && pwd)"
 export CLI_DIR
 
 # Engine discovery, by role (sync.sh + VERSION). The repo and the npm package
 # ship one layout — <root>/{cli,engine,packages/sync} — so there is a single
-# candidate rather than a per-distribution list.
+# candidate rather than a per-distribution list. CLI_DIR is already the logical
+# `pwd` spelling, so its textual parent is what `cd "$CLI_DIR/.."` would print.
+CLI_ROOT="${CLI_DIR%/*}"
 IS_ENGINE_DIR=""
 if [ -f "$CLI_DIR/../engine/sync.sh" ] && [ -f "$CLI_DIR/../engine/VERSION" ]; then
-    IS_ENGINE_DIR="$(cd "$CLI_DIR/../engine" && pwd)"
+    IS_ENGINE_DIR="$CLI_ROOT/engine"
 fi
 if [ -z "$IS_ENGINE_DIR" ]; then
     echo "ERROR: bundled sync engine not found next to the CLI ($CLI_DIR)." >&2
@@ -29,7 +35,7 @@ export IS_ENGINE_DIR
 # engine dir: the store must receive rules/agents/skills, never engine scripts.
 IS_BUNDLED_PKG_DIR=""
 if [ -d "$CLI_DIR/../packages/sync" ]; then
-    IS_BUNDLED_PKG_DIR="$(cd "$CLI_DIR/../packages/sync" && pwd)"
+    IS_BUNDLED_PKG_DIR="$CLI_ROOT/packages/sync"
 fi
 export IS_BUNDLED_PKG_DIR
 

package/cli/internal/align-project.sh

@@ -15,6 +15,7 @@ while [ $# -gt 0 ]; do
 done
 
 require_cli_project
+project_lock_hold "$IP_ROOT"
 manifest="$IP_ROOT/intelligence.yaml"
 
 stamp="$(read_schema_version "$manifest")"

package/cli/internal/convert-legacy.sh

@@ -227,7 +227,38 @@ rewrite_source_value() {
     esac
     printf '%s' "$v"
 }
-in_packs=0 in_sources=0
+# The project's own content stays where the legacy layout kept it. When that
+# directory is not `intelligence/`, the manifest names it: the content directory
+# is where project adapters live, what no output may overwrite, and the source of
+# truth AGENTS.md points readers at. Left at the default, all three name a
+# directory that only a case-insensitive filesystem confuses with the real one.
+legacy_content_dir=""
+case "$umbrella_rel" in
+    "$umbrella"|intelligence|*/*|.intelligence*|*[\"\'\\]*|*[[:cntrl:]]*) ;;
+    *)
+        # Only content that stays counts: the vendored module and pack mirrors
+        # move into the store and leave, so a config-only umbrella is not one.
+        if [ -z "$(get_yaml_field "$config" "project" "intelligence_dir")" ]; then
+            for section in rules agents skills; do
+                while IFS= read -r src; do
+                    case "$src" in ""|git+*|@*) continue ;; esac
+                    src_canon="$(normalize_path "$root/$src")"
+                    case "$src_canon" in "$root"/*) src_rel="${src_canon#"$root"/}" ;; *) continue ;; esac
+                    case "$src_rel" in "$module_rel"|"$module_rel"/*) continue ;; esac
+                    leaving=0
+                    while IFS="$LOCK_SEP" read -r _ _ _ _ mirror; do
+                        [ -n "$mirror" ] || continue
+                        mirror="$(normalize_path "$root/$mirror")"
+                        case "$src_canon" in "$mirror"|"$mirror"/*) leaving=1 ;; esac
+                    done < "$pack_rows"
+                    [ "$leaving" -eq 0 ] || continue
+                    case "$src_rel" in "$umbrella_rel"|"$umbrella_rel"/*) legacy_content_dir="$umbrella_rel" ;; esac
+                done < <(read_yaml_list "$config" "$section")
+            done
+        fi
+        ;;
+esac
+in_packs=0 in_sources=0 project_key=0 content_dir_written=0
 while IFS= read -r line || [ -n "$line" ]; do
     line="${line%$'\r'}"
     case "$line" in
@@ -236,6 +267,18 @@ while IFS= read -r line || [ -n "$line" ]; do
         sources:*) in_sources=1; in_packs=0; echo "$line"; continue ;;
         [!\ \#]*) in_packs=0; in_sources=0 ;;
     esac
+    case "$line" in project:*) project_key=1 ;; esac
+    if [ -n "$legacy_content_dir" ] && [ "$content_dir_written" -eq 0 ]; then
+        # Only the block form takes a child line; `project: {...}` does not.
+        key_part="${line%%#*}"
+        key_part="${key_part%"${key_part##*[![:space:]]}"}"
+        if [ "$key_part" = "project:" ]; then
+            echo "$line"
+            echo "  intelligence_dir: \"$legacy_content_dir\""
+            content_dir_written=1
+            continue
+        fi
+    fi
     [ "$in_packs" -eq 1 ] && continue
     if [ "$in_sources" -eq 1 ]; then
         case "$line" in
@@ -261,6 +304,9 @@ while IFS= read -r line || [ -n "$line" ]; do
     fi
     echo "$line"
 done < "$config" > "$manifest_stage"
+if [ -n "$legacy_content_dir" ] && [ "$content_dir_written" -eq 0 ] && [ "$project_key" -eq 0 ]; then
+    printf 'project:\n  intelligence_dir: "%s"\n' "$legacy_content_dir" >> "$manifest_stage"
+fi
 stamp_schema_version "$manifest_stage" "$eng"
 
 # packages: requested pins only; resolved source details live in the lock.

package/cli/internal/package-add.sh

@@ -24,6 +24,7 @@ while [ $# -gt 0 ]; do
 done
 
 require_cli_project
+project_lock_hold "$IP_ROOT"
 manifest="$IP_ROOT/intelligence.yaml"
 lock="$IP_ROOT/intelligence.lock"
 

package/cli/internal/package-remove.sh

@@ -16,6 +16,7 @@ for a in "$@"; do
 done
 
 require_cli_project
+project_lock_hold "$IP_ROOT"
 
 # Removing the engine-content package guts the outputs (meta-skills, the
 # authoring rule, both engine agents disappear) while everything still

package/cli/internal/package-update.sh

@@ -25,6 +25,7 @@ done
     || die "--latest needs the package to move: intelligence update @scope/name --latest"
 
 require_cli_project
+[ "$preview" -eq 1 ] || project_lock_hold "$IP_ROOT"
 manifest="$IP_ROOT/intelligence.yaml"
 lock="$IP_ROOT/intelligence.lock"
 

package/cli/internal/restore.sh

@@ -19,6 +19,7 @@ while [ $# -gt 0 ]; do
 done
 
 require_cli_project
+project_lock_hold "$IP_ROOT"
 manifest="$IP_ROOT/intelligence.yaml"
 lock="$IP_ROOT/intelligence.lock"
 validate_project_lock "$IP_ROOT" --restore

package/cli/internal/target-state.sh

@@ -15,6 +15,7 @@ case "$action" in enable|disable) ;; *) die "internal target state: expected <en
 assert_valid_target_name "$name"
 
 require_cli_project
+project_lock_hold "$IP_ROOT"
 manifest="$IP_ROOT/intelligence.yaml"
 content_dir="$(manifest_intelligence_dir "$manifest")"
 

package/cli/lib/cli-common.sh

@@ -87,6 +87,7 @@ source "$CLI_DIR/lib/adapter-lifecycle.sh"
 source "$CLI_DIR/lib/gitignore.sh"
 source "$CLI_DIR/lib/onboarding.sh"
 source "$CLI_DIR/lib/sync-cache.sh"
+source "$CLI_DIR/lib/sync-lock.sh"
 
 # The engine-content package: OPTIONAL but auto-selected at init. Package by
 # UX (manifest entry, lockfile row, list/search/remove), bundle by mechanics —
@@ -97,12 +98,21 @@ source "$CLI_DIR/lib/sync-cache.sh"
 # Its identity is DATA shipped with the distribution (cli/engine-package.yaml),
 # never a name compiled into cli code — a fork edits the file.
 _EPKG="$CLI_DIR/engine-package.yaml"
-SYNC_PKG_NAME="$(top_scalar "$_EPKG" "name")"
-SYNC_PKG_URL="$(top_scalar "$_EPKG" "url")"
-SYNC_PKG_PATH="$(top_scalar "$_EPKG" "path")"
+SYNC_PKG_NAME="" SYNC_PKG_URL="" SYNC_PKG_PATH=""
 # Read by commands (init seeds it) — per-file shellcheck cannot see that.
 # shellcheck disable=SC2034
-DEFAULT_REGISTRY_URL="$(top_scalar "$_EPKG" "default_registry")"
+DEFAULT_REGISTRY_URL=""
+# Every command loads this file first: read the four fields in one pass.
+# shellcheck disable=SC2034  # DEFAULT_REGISTRY_URL is read by commands, as above
+while IFS="$LOCK_SEP" read -r _epkg_key _epkg_value; do
+    case "$_epkg_key" in
+        name) SYNC_PKG_NAME="$_epkg_value" ;;
+        url) SYNC_PKG_URL="$_epkg_value" ;;
+        path) SYNC_PKG_PATH="$_epkg_value" ;;
+        default_registry) DEFAULT_REGISTRY_URL="$_epkg_value" ;;
+    esac
+done <<< "$(_qmap_read tops "$_EPKG" '' 'name url path default_registry')"
+unset _epkg_key _epkg_value
 [ -n "$SYNC_PKG_NAME" ] || die "corrupt CLI installation: $_EPKG is missing or has no 'name'"
 SYNC_PKG_STORE=".intelligence/packages/$SYNC_PKG_NAME"
 
@@ -116,15 +126,18 @@ SYNC_PKG_STORE=".intelligence/packages/$SYNC_PKG_NAME"
 # by role — scripts/sync.sh + scripts/VERSION — never by name.
 detect_project() {
     IP_MODE="none"; IP_ROOT=""; IP_UMBRELLA=""; IP_MODULE_DIR=""
-    local dir="$PWD"
+    # PWD is already the logical `pwd` spelling, and so is each textual parent.
+    local dir="$PWD" parent
     while :; do
         if [ -f "$dir/intelligence.yaml" ]; then
             IP_MODE="cli"
-            IP_ROOT="$(cd "$dir" && pwd)"
+            IP_ROOT="$dir"
             return 0
         fi
-        [ "$dir" = "$(dirname "$dir")" ] && break
-        dir="$(dirname "$dir")"
+        parent="${dir%/*}"
+        [ -n "$parent" ] || parent="/"
+        [ "$dir" = "$parent" ] && break
+        dir="$parent"
     done
     local root
     root="$(git rev-parse --show-toplevel 2>/dev/null || true)"
@@ -257,10 +270,23 @@ default_target_output() {
     esac
 }
 
+# bundled_engine_version_var sets IS_BUNDLED_ENGINE_VERSION, reading VERSION
+# once per process; lifecycle preflight compares against it several times.
+bundled_engine_version_var() {
+    [ -z "${IS_BUNDLED_ENGINE_VERSION_READ:-}" ] || return 0
+    local version=""
+    [ -r "$IS_ENGINE_DIR/VERSION" ] || {
+        echo "ERROR: cannot read $IS_ENGINE_DIR/VERSION" >&2
+        return 1
+    }
+    IFS= read -r -d '' version < "$IS_ENGINE_DIR/VERSION" || true
+    IS_BUNDLED_ENGINE_VERSION="${version//[$' \t\r\n']/}"
+    IS_BUNDLED_ENGINE_VERSION_READ=1
+}
+
 bundled_engine_version() {
-    local version
-    version="$(< "$IS_ENGINE_DIR/VERSION")"
-    printf '%s' "${version//[$' \t\r\n']/}"
+    bundled_engine_version_var
+    printf '%s' "$IS_BUNDLED_ENGINE_VERSION"
 }
 
 # --- The sync package's manifest/lock plumbing ---------------------------
@@ -345,15 +371,19 @@ assert_safe_content_dir() {
 # the admitted minor/patch gap; the predicate itself does not re-judge the gap.
 project_stamped_ahead() {
     local stamp
-    stamp="$(read_schema_version "$1/intelligence.yaml")"
-    [ -n "$stamp" ] && _ver_gt "$stamp" "$(bundled_engine_version)"
+    read_schema_version_var "$1/intelligence.yaml"
+    stamp="$IS_SCHEMA_VERSION"
+    bundled_engine_version_var
+    [ -n "$stamp" ] && _ver_gt "$stamp" "$IS_BUNDLED_ENGINE_VERSION"
 }
 
 project_needs_upgrade() {
-    local root="$1" manifest="$1/intelligence.yaml" stamp eng pinned locked name
+    local root="$1" manifest="$1/intelligence.yaml" stamp eng pinned locked name url path rows
     [ -f "$manifest" ] || return 1
-    stamp="$(read_schema_version "$manifest")"
-    eng="$(bundled_engine_version)"
+    read_schema_version_var "$manifest"
+    stamp="$IS_SCHEMA_VERSION"
+    bundled_engine_version_var
+    eng="$IS_BUNDLED_ENGINE_VERSION"
     [ -z "$stamp" ] && return 0
     # A project stamped ahead belongs to a newer CLI. Aligning it here would
     # restamp the schema and re-pin the engine content DOWNWARD, and the next
@@ -363,14 +393,15 @@ project_needs_upgrade() {
     _ver_gt "$eng" "$stamp" && return 0
     [ -d "$root/.intelligence/engine" ] && return 0
 
-    while IFS= read -r name; do
+    # One manifest pass for every package's fields, not a reader per field.
+    rows="$(_qmap_read fieldrows "$manifest" packages '' 'url path version')"
+    while IFS="$LOCK_SEP" read -r name url path pinned; do
         [ -n "$name" ] || continue
         # Early RC manifests mixed requested intent with resolved source
         # details. Source URL/path now live only in the required lockfile.
-        [ -n "$(qmap_field "$manifest" "packages" "$name" "url")" ] && return 0
-        [ -n "$(qmap_field "$manifest" "packages" "$name" "path")" ] && return 0
+        [ -n "$url" ] && return 0
+        [ -n "$path" ] && return 0
         if [ "$name" = "$SYNC_PKG_NAME" ]; then
-            pinned="$(qmap_field "$manifest" "packages" "$name" "version")"
             locked="$(qmap_field "$root/intelligence.lock" "packages" "$name" "resolved")"
             [ "$pinned" = "$eng" ] || return 0
             if [ -f "$root/intelligence.lock" ]; then
@@ -378,7 +409,7 @@ project_needs_upgrade() {
                 [ "${locked#v}" = "$eng" ] || return 0
             fi
         fi
-    done < <(qmap_keys "$manifest" "packages")
+    done <<< "$rows"
     return 1
 }
 
@@ -402,8 +433,10 @@ ensure_project_current() {
         die "manifest declares packages but intelligence.lock is absent — restore the committed lock before running project lifecycle commands"
     fi
     project_needs_upgrade "$root" || return 0
-    stamp="$(read_schema_version "$manifest")"
-    eng="$(bundled_engine_version)"
+    read_schema_version_var "$manifest"
+    stamp="$IS_SCHEMA_VERSION"
+    bundled_engine_version_var
+    eng="$IS_BUNDLED_ENGINE_VERSION"
     if is_ci_environment && [ "$explicit" != "--explicit" ]; then
         die "project lifecycle requires alignment (stamp ${stamp:-unstamped}, engine $eng) — run 'intelligence init --apply' locally, review and commit the diff"
     fi

package/cli/lib/lockfile.sh

@@ -24,7 +24,8 @@ lock_validate() (
     # The same tokenizer supplies ordinary lock rows and strict metadata. Buffer
     # before consumption: a failed parser must never yield a partial package set.
     rows="$(_qmap_read lock "$lock" packages '' '' "$LOCKFILE_VERSION")" || return $?
-    current="$(bundled_engine_version)"
+    bundled_engine_version_var
+    current="$IS_BUNDLED_ENGINE_VERSION"
     while IFS="$LOCK_SEP" read -r kind name requested url path resolved sha line; do
         case "$kind" in
             V)

package/cli/lib/qmap.awk

@@ -177,7 +177,17 @@ END {
         exit 1
     }
     if (mode == "lock") print "V" sep top_value["lockfile_version"] sep top_value["engine_version"]
-    if (mode == "rows" || mode == "lock" || mode == "keys") {
+    if (mode == "fieldrows") {
+        # One row per package key, as `keys` lists them: the name, then each
+        # field QMAP_FIELD names (space separated), as qmap_field decodes it.
+        count = split(wanted_field, fields, " ")
+        for (i = 1; i <= row_count; i++) {
+            name = row_name[i]
+            row = name
+            for (f = 1; f <= count; f++) row = row sep field_value[name SUBSEP fields[f]]
+            print row
+        }
+    } else if (mode == "rows" || mode == "lock" || mode == "keys") {
         for (i = 1; i <= row_count; i++) {
             name = row_name[i]
             if (mode == "keys") print name
@@ -187,5 +197,10 @@ END {
                 else print row
             }
         }
+    } else if (mode == "tops") {
+        # Several top-level scalars in one pass: QMAP_KEY lists them, space
+        # separated; each present one prints as key<US>value.
+        count = split(wanted_key, tops, " ")
+        for (i = 1; i <= count; i++) if (tops[i] in top_value) print tops[i] sep top_value[tops[i]]
     } else if (found) print result
 }

package/cli/lib/sync-cache.sh

@@ -16,6 +16,8 @@ sync_cache_safe_path() {
 # One checked enumeration and one batch hash, including names, directory/file
 # types and executable bits. Timestamps cannot prove content is unchanged.
 # Unsupported paths/types are a cache miss, never an incomplete fingerprint.
+# Keep list descriptors open across the walk; reopening each line is expensive
+# on Windows and provides no additional content verification.
 sync_cache_fingerprint() (
     local work="$1" path kind executable seen=$'\n'
     local -a existing
@@ -48,14 +50,14 @@ sync_cache_fingerprint() (
         if [ -f "$path" ]; then
             kind='file'
             [ ! -x "$path" ] || executable=1
-            printf '%s\n' "$path" >> "$work/files" || return 1
+            printf '%s\n' "$path" >&4 || return 1
         elif [ -d "$path" ]; then
             kind=directory
         else
             return 1
         fi
-        printf '%s\t%s\t%s\n' "$kind" "$executable" "$path" >> "$work/entries" || return 1
-    done < "$work/list"
+        printf '%s\t%s\t%s\n' "$kind" "$executable" "$path" >&3 || return 1
+    done < "$work/list" 3>> "$work/entries" 4> "$work/files" || return 1
     # find order need not be stable. Sort both streams; preserve path-to-hash
     # association by feeding the sorted file list into a single git process.
     LC_ALL=C sort -u "$work/entries" > "$work/sorted" || return 1
@@ -109,14 +111,17 @@ sync_cache_dependencies() {
 }
 
 sync_cache_input_hash() {
-    local fingerprint
+    local fingerprint payload
     fingerprint="$(sync_cache_fingerprint "$1" "${SC_INPUTS[@]}")" || return 1
+    [ -n "${SC_UMASK:-}" ] || SC_UMASK="$(umask)"
     # Explicit environment values that affect rendering, discovery or parsing.
     # No secrets or inherited environment dump are persisted.
-    printf '%s\n' "$fingerprint" "$2" "$REPO_ROOT" "$CONFIG_FILE" \
+    printf -v payload '%s\n' "$fingerprint" "$2" "$REPO_ROOT" "$CONFIG_FILE" \
         "$IS_CONTENT_REL" "$IS_MODULE_REL" "$IS_SYNC_CMD" "$IS_MANIFEST_NAME" \
         "$IS_PROTECTED_DIRS" "$BASH_VERSION" "${OSTYPE:-}" "${LANG:-}" \
-        "${LC_ALL:-}" "${LC_CTYPE:-}" "${LC_COLLATE:-}" "${PATH:-}" "$(umask)" | git hash-object --stdin
+        "${LC_ALL:-}" "${LC_CTYPE:-}" "${LC_COLLATE:-}" "${PATH:-}" "$SC_UMASK"
+    # A here-string appends the final newline the payload already ends with.
+    git hash-object --stdin <<< "${payload%$'\n'}"
 }
 
 sync_cache_directory() {
@@ -161,15 +166,21 @@ sync_with_cache() (
     local target="$1" force="$2" work before after outputs report_hash rc=0 cacheable=0
     work="$(mktemp -d -t intelligence-cache-XXXXXX)" || return 1
     trap 'rm -rf "$work"' EXIT
+    echo "Checking source files..."
+    # Read once here so both input hashes, one in a background job, reuse it.
+    SC_UMASK="$(umask)"
     if sync_cache_dependencies && sync_cache_directory; then
         before="$(sync_cache_input_hash "$work" "$target")" || before=""
         [ -z "$before" ] || cacheable=1
     fi
     if [ "$cacheable" = 1 ] && [ "$force" = 0 ]; then
+        echo "Checking generated files..."
         outputs="$(sync_cache_fingerprint "$work" "${SC_OUTPUTS[@]}")" || outputs=""
         if [ -n "$outputs" ] && sync_cache_read "$SC_DIRECTORY/state" "$before" "$outputs" "$work"; then
-            echo '  Unchanged: verified sources and generated output; skipped rendering (use --force to refresh discovery).'
+            echo 'Unchanged: generated files are up to date.'
+            printf '\n'
             cat "$work/report"
+            printf '\n=== Unchanged: no files needed updating ===\n'
             return 0
         fi
     fi
@@ -177,26 +188,45 @@ sync_with_cache() (
     if [ "$cacheable" = 1 ]; then
         rm -f "$SC_DIRECTORY/state" || cacheable=0
     fi
-    # Buffer once so success diagnostics can be replayed without asking the
-    # engine to know about persistent CLI state. Preserve the engine exit code.
-    bash "$IS_ENGINE_DIR/sync.sh" "$target" > "$work/log" 2>&1 || rc=$?
-    cat "$work/log"
-    [ "$rc" = 0 ] || return "$rc"
-    [ "$cacheable" = 1 ] || return 0
-    after="$(sync_cache_input_hash "$work" "$target")" || return 0
-    [ "$before" = "$after" ] || return 0
-    outputs="$(sync_cache_fingerprint "$work" "${SC_OUTPUTS[@]}")" || return 0
-    sync_cache_report "$work/log" > "$work/report" || return 0
-    report_hash="$(git hash-object --stdin < "$work/report")" || return 0
-    # Recheck containment before publishing. mktemp+rename avoids following a
-    # pre-existing state-file link, and readers see only complete records.
-    sync_cache_directory create || return 0
-    local staged
-    staged="$(mktemp "$SC_DIRECTORY/state-XXXXXX")" || return 0
-    if { printf 'intelligence-sync-cache-v1 %s %s %s\n' "$after" "$outputs" "$report_hash"; cat "$work/report"; } > "$staged"; then
-        mv -f "$staged" "$SC_DIRECTORY/state" || rm -f "$staged"
+    # Stream progress while retaining diagnostics for the next cache hit. Check
+    # both processes: a failed capture must never publish a success record.
+    local -a pipeline_status
+    if bash "$IS_ENGINE_DIR/sync.sh" "$target" 2>&1 | tee "$work/log"; then
+        pipeline_status=("${PIPESTATUS[@]}")
     else
-        rm -f "$staged"
+        pipeline_status=("${PIPESTATUS[@]}")
+    fi
+    rc="${pipeline_status[0]}"
+    [ "$rc" = 0 ] || return "$rc"
+    [ "${pipeline_status[1]}" = 0 ] || return "${pipeline_status[1]}"
+    if [ "$cacheable" = 1 ]; then
+        (
+            echo "Checking sync results..."
+            # The input recheck and the output fingerprint only read files, so
+            # they run side by side, each in its own scratch directory.
+            local after_pid after_rc=0
+            mkdir "$work/after" "$work/outputs" || return 0
+            sync_cache_input_hash "$work/after" "$target" > "$work/after/hash" &
+            after_pid=$!
+            outputs="$(sync_cache_fingerprint "$work/outputs" "${SC_OUTPUTS[@]}")" || outputs=""
+            sync_cache_report "$work/log" > "$work/report" || outputs=""
+            report_hash="$(git hash-object --stdin < "$work/report")" || outputs=""
+            wait "$after_pid" || after_rc=$?
+            [ "$after_rc" = 0 ] && [ -n "$outputs" ] || return 0
+            IFS= read -r after < "$work/after/hash" || return 0
+            [ "$before" = "$after" ] || return 0
+            # Recheck containment before publishing. mktemp+rename avoids following a
+            # pre-existing state-file link, and readers see only complete records.
+            sync_cache_directory create || return 0
+            local staged
+            staged="$(mktemp "$SC_DIRECTORY/state-XXXXXX")" || return 0
+            if { printf 'intelligence-sync-cache-v1 %s %s %s\n' "$after" "$outputs" "$report_hash"; cat "$work/report"; } > "$staged"; then
+                mv -f "$staged" "$SC_DIRECTORY/state" || rm -f "$staged"
+            else
+                rm -f "$staged"
+            fi
+        )
     fi
+    echo "=== Sync complete ==="
     return 0
 )