@ainova-systems/intelligence 0.17.3 → 0.18.0

package/cli/commands/init.sh

@@ -295,7 +295,8 @@ manifest="$root/intelligence.yaml"
     echo "#   $content_dir/rules/context.md      an always-on rule; describe the project,"
     echo "#                                      its stack, and the constraints to respect"
     echo "#   $content_dir/agents/<name>.md      a persona (frontmatter: name, description,"
-    echo "#                                      tier: heavy|standard|light, access: full|readonly)"
+    echo "#                                      tier: frontier|heavy|standard|light,"
+    echo "#                                      access: full|readonly)"
     echo "#   $content_dir/skills/<name>/SKILL.md  a procedure invoked as /<name>"
     echo "# '.intelligence/' is CLI-managed (packages + engine content) — never edit it."
     echo "sources:"

package/engine/ENGINE_SHA

@@ -1 +1 @@
-c7851685b484be141067e86ff826a1f16ffe9db6
+1bf045d314f2c2f58a70d5a74130b5f5376b56e4

package/engine/VERSION

@@ -1 +1 @@
-0.17.3
+0.18.0

package/engine/adapters/codex.sh

@@ -103,7 +103,8 @@ sync_codex_agents() {
             name="${path##*/}"; name="${name%.md}"
             resolve_model_var "$tier"
             case "$tier" in
-                heavy)    effort="high" ;;
+                frontier) effort="xhigh" ;;
+                heavy|"") effort="high" ;;
                 standard) effort="medium" ;;
                 light)    effort="low" ;;
                 *)        effort="medium" ;;

package/engine/lib/common.sh

@@ -661,6 +661,7 @@ sync_open_skill_dirs() {
     # target gets it — not just this open-standard dir.
     if [ "$count" -gt 0 ]; then
         copy_skill_bundle_dirs "$output_dir" "${skill_dirs[@]}"
+        open_skill_invocation_policies "$output_dir" || return 1
     fi
 
     log+="  -> Skills: $count"$'\n'
@@ -670,6 +671,44 @@ sync_open_skill_dirs() {
     IS_OPEN_SKILLS_LOG="$log"
 }
 
+# open_skill_invocation_policies <open_skills_dir> — `disable-model-invocation:
+# true` keeps a skill out of automatic selection in Claude Code, Cursor and
+# Copilot, but Codex ignores that key and reads the same intent from
+# `agents/openai.yaml` beside SKILL.md. Source skills stay tool-neutral: the
+# policy file is derived here, in the open-standard tree Codex reads, so every
+# adapter sharing that tree writes the same bytes. A skill that ships its own
+# `agents/openai.yaml` keeps it — that is the author configuring Codex directly.
+open_skill_invocation_policies() {
+    local output_dir="$1" path flag rows
+    local -a skill_mds=() policy_dirs=() policies=()
+    for path in "$output_dir"/*/SKILL.md; do
+        [ -f "$path" ] && [ ! -L "$path" ] && skill_mds+=("$path")
+    done
+    [ "${#skill_mds[@]}" -gt 0 ] || return 0
+    # Captured, not streamed: a reader cut short must fail the render rather
+    # than quietly drop a policy and hand the skill back to the model.
+    rows="$(frontmatter_index "disable-model-invocation" "${skill_mds[@]}")" || {
+        echo "ERROR: could not read skill frontmatter under $output_dir" >&2
+        return 1
+    }
+    while IFS=$'\x1f' read -r path flag; do
+        [ "$flag" = "true" ] || continue
+        path="${path%/SKILL.md}/agents"
+        # A symlinked `agents` would carry the write outside the output tree.
+        [ -L "$path" ] && continue
+        [ -e "$path/openai.yaml" ] || [ -L "$path/openai.yaml" ] && continue
+        policy_dirs+=("$path")
+        policies+=("$path/openai.yaml")
+    done <<< "$rows"
+    [ "${#policies[@]}" -gt 0 ] || return 0
+    mkdir -p "${policy_dirs[@]}"
+    for path in "${policies[@]}"; do
+        printf '%s\n' '# Generated by intelligence-sync from disable-model-invocation in SKILL.md. Do not edit manually.' \
+            'policy:' '  allow_implicit_invocation: false' > "$path"
+    done
+    finalize_output_files "${policies[@]}"
+}
+
 # Lint YAML frontmatter for common pitfalls (unquoted colons, leading tabs).
 # Print warnings to stderr; do not fail. Strict consumers (Codex CLI) reject
 # these files with cryptic messages — catching them in sync gives better DX.
@@ -816,33 +855,47 @@ has_paths() {
 
 # --- Tier/Access Mappings ---
 
-# Hardcoded defaults: ide:tier -> model name.
+# Hardcoded defaults: ide:tier -> model name. Where a tool has fewer models
+# than there are tiers, tiers share one (decision 0013). cli/tests/unit-engine.sh
+# pins this table independently, so a bump updates its expected matrix too.
 # When you bump these, re-run sync in projects; any project whose config.yaml
 # `models:` section diverges from these will print a drift warning so users
 # know their override is now stale.
 # get_model_default_var sets IS_MODEL_DEFAULT; get_model_default prints it.
 get_model_default_var() {
     case "$1:$2" in
+        # Haiku 4.5 retires no sooner than 2026-10-15 and has no successor, so
+        # light shares standard's Sonnet on every Claude-backed target.
+        claude:frontier)  IS_MODEL_DEFAULT="fable" ;;
         claude:heavy)     IS_MODEL_DEFAULT="opus" ;;
         claude:standard)  IS_MODEL_DEFAULT="sonnet" ;;
-        claude:light)     IS_MODEL_DEFAULT="haiku" ;;
+        claude:light)     IS_MODEL_DEFAULT="sonnet" ;;
+        # Cursor documents only `inherit` or a concrete model ID, so every
+        # tier follows the session model unless the manifest pins one.
+        cursor:frontier)  IS_MODEL_DEFAULT="inherit" ;;
         cursor:heavy)     IS_MODEL_DEFAULT="inherit" ;;
         cursor:standard)  IS_MODEL_DEFAULT="inherit" ;;
-        cursor:light)     IS_MODEL_DEFAULT="fast" ;;
-        copilot:heavy)    IS_MODEL_DEFAULT="gpt-5.6-sol" ;;
-        copilot:standard) IS_MODEL_DEFAULT="gpt-5.6-terra" ;;
-        copilot:light)    IS_MODEL_DEFAULT="gpt-5.6-luna" ;;
-        codex:heavy)      IS_MODEL_DEFAULT="gpt-5.6-sol" ;;
-        codex:standard)   IS_MODEL_DEFAULT="gpt-5.6-terra" ;;
-        codex:light)      IS_MODEL_DEFAULT="gpt-5.6-luna" ;;
-        # Antigravity accepts only inherit|flash|pro, so standard and light
-        # share `flash` — there is no third tier to map onto.
+        cursor:light)     IS_MODEL_DEFAULT="inherit" ;;
+        # GPT-6 has no mid model, so frontier and heavy share Astra; Codex
+        # separates them by reasoning effort instead.
+        copilot:frontier) IS_MODEL_DEFAULT="gpt-6-astra" ;;
+        copilot:heavy)    IS_MODEL_DEFAULT="gpt-6-astra" ;;
+        copilot:standard) IS_MODEL_DEFAULT="gpt-6.1-sol" ;;
+        copilot:light)    IS_MODEL_DEFAULT="gpt-6-luna" ;;
+        codex:frontier)   IS_MODEL_DEFAULT="gpt-6-astra" ;;
+        codex:heavy)      IS_MODEL_DEFAULT="gpt-6-astra" ;;
+        codex:standard)   IS_MODEL_DEFAULT="gpt-6.1-sol" ;;
+        codex:light)      IS_MODEL_DEFAULT="gpt-6-luna" ;;
+        # Antigravity accepts only inherit|flash|pro, so frontier and heavy
+        # share `pro` and standard and light share `flash`.
+        antigravity:frontier)  IS_MODEL_DEFAULT="pro" ;;
         antigravity:heavy)     IS_MODEL_DEFAULT="pro" ;;
         antigravity:standard)  IS_MODEL_DEFAULT="flash" ;;
         antigravity:light)     IS_MODEL_DEFAULT="flash" ;;
-        opencode:heavy)    IS_MODEL_DEFAULT="anthropic/claude-opus-4-8" ;;
-        opencode:standard) IS_MODEL_DEFAULT="anthropic/claude-sonnet-5" ;;
-        opencode:light)    IS_MODEL_DEFAULT="anthropic/claude-haiku-4-5-20251001" ;;
+        opencode:frontier) IS_MODEL_DEFAULT="anthropic/claude-fable-5-1" ;;
+        opencode:heavy)    IS_MODEL_DEFAULT="anthropic/claude-opus-5-5" ;;
+        opencode:standard) IS_MODEL_DEFAULT="anthropic/claude-sonnet-5-5" ;;
+        opencode:light)    IS_MODEL_DEFAULT="anthropic/claude-sonnet-5-5" ;;
         *)                IS_MODEL_DEFAULT="" ;;
     esac
 }
@@ -925,25 +978,29 @@ get_model() {
     fi
 }
 
-# load_model_tiers <config_file> <ide> — resolve the three standard tiers
-# once per adapter run (IS_MODEL_HEAVY / IS_MODEL_STANDARD / IS_MODEL_LIGHT)
-# so per-file loops map tier -> model without forking. resolve_model_var
-# consumes them; a non-standard tier value still goes through get_model so a
-# `models:` override for it keeps working. One manifest pass reads all three.
+# load_model_tiers <config_file> <ide> — resolve the four standard tiers
+# once per adapter run (IS_MODEL_FRONTIER / IS_MODEL_HEAVY /
+# IS_MODEL_STANDARD / IS_MODEL_LIGHT) so per-file loops map tier -> model
+# without forking. resolve_model_var consumes them; a non-standard tier value
+# still goes through get_model so a `models:` override for it keeps working.
+# One manifest pass reads all four.
 load_model_tiers() {
-    local config_file="$1" ide="$2" overrides="" tier val heavy="" standard="" light=""
+    local config_file="$1" ide="$2" overrides="" tier val frontier="" heavy="" standard="" light=""
     IS_MODEL_CFG="$config_file"
     IS_MODEL_IDE="$ide"
     if [ -n "$config_file" ] && [ -f "$config_file" ]; then
-        overrides="$(_nested_yaml_values tagged "$config_file" "models" "$ide" heavy standard light)"
+        overrides="$(_nested_yaml_values tagged "$config_file" "models" "$ide" frontier heavy standard light)"
     fi
     while IFS=$'\037' read -r tier val; do
         case "$tier" in
+            frontier) frontier="$val" ;;
             heavy) heavy="$val" ;;
             standard) standard="$val" ;;
             light) light="$val" ;;
         esac
     done <<< "$overrides"
+    get_model_default_var "$ide" frontier
+    IS_MODEL_FRONTIER="${frontier:-$IS_MODEL_DEFAULT}"
     get_model_default_var "$ide" heavy
     IS_MODEL_HEAVY="${heavy:-$IS_MODEL_DEFAULT}"
     get_model_default_var "$ide" standard
@@ -957,6 +1014,7 @@ load_model_tiers() {
 # shellcheck disable=SC2034  # IS_MODEL is the return channel read by adapters
 resolve_model_var() {
     case "$1" in
+        frontier) IS_MODEL="$IS_MODEL_FRONTIER" ;;
         heavy|"") IS_MODEL="$IS_MODEL_HEAVY" ;;
         standard) IS_MODEL="$IS_MODEL_STANDARD" ;;
         light)    IS_MODEL="$IS_MODEL_LIGHT" ;;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ainova-systems/intelligence",
-  "version": "0.17.3",
+  "version": "0.18.0",
   "description": "Build, version and distribute AI agent intelligence across your organization — one CLI, versioned Intelligence Packages, and a sync engine for Claude Code, Cursor, Copilot, Codex, Pi and OpenCode.",
   "bin": {
     "intelligence": "bin/intelligence.js"

package/packages/sync/agents/intelligence-operator.md

@@ -5,8 +5,6 @@ tier: standard
 access: full
 skills:
   - intelligence-sync
-  - intelligence-upgrade
-  - intelligence-manage-adapters
 ---
 
 # Intelligence operator
@@ -28,6 +26,11 @@ the operation in prose.
 - **Every flow goes through its skill.** The steps and their guards live in `intelligence-sync`,
   `intelligence-upgrade` and `intelligence-manage-adapters`;
   improvising around them produces an unverified version of the same work.
+- **Upgrades and adapter changes are the owner's to start.** `intelligence-upgrade` moves CLI and
+  package versions, the lock and migrations; `intelligence-manage-adapters` adds or removes whole
+  tool outputs. Both are decisions about the layer, so they run only when the owner invokes them,
+  and a sync never previews an update or inspects adapters on its own. Name the command the owner
+  can run and stop there.
 - **Operating is not authoring.** A change to what an artifact says - a rule body, an agent persona,
   a skill's steps - belongs to `intelligence-architect` and the authoring meta-skills. This agent
   ships what exists and never decides what should exist.

package/packages/sync/references/adapters.md

@@ -152,12 +152,12 @@ Use the engine library instead of copying parsers or file-handling logic.
 | `frontmatter_index(keys, file...)` | Read several frontmatter scalars for many files in one pass (`\x1f`-separated rows; special key `paths#` counts `paths:` lines). |
 | `has_frontmatter(file)` / `has_paths(file)` | Inspect source shape. |
 | `strip_frontmatter(file)` | Emit the body without its first frontmatter block. |
-| `get_model(config, tool, tier)` | Resolve a `heavy`, `standard` or `light` model, including manifest overrides. |
+| `get_model(config, tool, tier)` | Resolve a `frontier`, `heavy`, `standard` or `light` model, including manifest overrides. |
 | `get_model_default(tool, tier)` | Read the built-in model default. |
-| `load_model_tiers(config, tool)` / `resolve_model_var(tier)` | Resolve the three standard tiers once, then map per file without subprocesses. |
+| `load_model_tiers(config, tool)` / `resolve_model_var(tier)` | Resolve the four standard tiers once, then map per file without subprocesses. |
 | `copy_skill_bundle(src, dest)` | Copy `SKILL.md` and all resources safely, normalize Markdown and quote free-text frontmatter. |
 | `copy_skill_bundle_dirs(dest_root, src...)` | Batch form: copy every skill directory into `dest_root/<name>` with one copy and one finalize pass. |
-| `sync_open_skill_dirs(root, config, dest)` | Own and populate a shared Agent Skills directory such as `.agents/skills/`. |
+| `sync_open_skill_dirs(root, config, dest)` | Own and populate a shared Agent Skills directory such as `.agents/skills/`, deriving Codex's `agents/openai.yaml` for a skill with `disable-model-invocation: true`. |
 | `finalize_output_file(file)` | Expand layout tokens and normalize line endings; required for every emitted text file. |
 | `finalize_output_files(file...)` / `finalize_copy_files(dest, src...)` | Batch forms: finalize in place, or copy-and-finalize into a directory, in one process. |
 | `emit_wrapped_bodies(spec)` | Emit many header + source-body + tail outputs in one process (see `engine/lib/common.sh` for the spec format). |

package/packages/sync/references/conventions.md

@@ -185,11 +185,14 @@ Do not instruct an agent to read rules or restate their content. Claude loads it
 
 ### Tier mappings
 
-| Tier | Claude | Cursor | Copilot / Codex | OpenCode | Typical use |
-|---|---|---|---|---|---|
-| `heavy` | `opus` | `inherit` | `gpt-5.6-sol` | `anthropic/claude-opus-4-8` | implementation, complex reasoning, migration |
-| `standard` | `sonnet` | `inherit` | `gpt-5.6-terra` | `anthropic/claude-sonnet-5` | review, validation, analysis |
-| `light` | `haiku` | `fast` | `gpt-5.6-luna` | `anthropic/claude-haiku-4-5-20251001` | lookups and simple formatting |
+| Tier | Claude | Cursor | Copilot / Codex | OpenCode | Antigravity | Typical use |
+|---|---|---|---|---|---|---|
+| `frontier` | `fable` | `inherit` | `gpt-6-astra` | `anthropic/claude-fable-5-1` | `pro` | long-horizon autonomous work, the hardest reasoning, where capability outweighs cost |
+| `heavy` | `opus` | `inherit` | `gpt-6-astra` | `anthropic/claude-opus-5-5` | `pro` | implementation, complex reasoning, migration |
+| `standard` | `sonnet` | `inherit` | `gpt-6.1-sol` | `anthropic/claude-sonnet-5-5` | `flash` | review, validation, analysis |
+| `light` | `sonnet` | `inherit` | `gpt-6-luna` | `anthropic/claude-sonnet-5-5` | `flash` | lookups and simple formatting |
+
+Codex also receives a reasoning effort per tier — `xhigh`, `high`, `medium`, `low` — which is what separates `frontier` from `heavy` in Codex. Copilot has no effort field, so its `frontier` and `heavy` agents are identical. Claude's Haiku 4.5 is retiring with no successor announced, so `light` shares `standard`'s Sonnet in Claude and OpenCode; Cursor and Antigravity have fewer native levels than there are tiers, so several tiers share one value there too.
 
 The vocabulary is tool-neutral. Adapters resolve it through `get_model()`. Override a default under `models.<tool>.<tier>` in `intelligence.yaml` only when the project needs a pin; sync reports drift when that override differs from the current default.
 
@@ -251,6 +254,8 @@ argument-hint: "<route-name>"
 
 Standard optional fields (`license`, `compatibility`, `metadata`, `allowed-tools`) and tool extensions pass through unchanged. A tool ignores fields it does not understand.
 
+`disable-model-invocation: true` makes a skill one only the owner starts, as a slash command: use it for a procedure that changes versions, the lock or generated outputs, where an agent selecting it unasked is the failure. Claude Code, Cursor and Copilot read the field itself; Codex does not, so sync writes `agents/openai.yaml` with `allow_implicit_invocation: false` beside the skill in `.agents/skills/`. Keep the source to the field — a skill that ships its own `agents/openai.yaml` keeps it unchanged.
+
 These limits reject a skill instead of degrading it:
 
 | Field | Limit | Failure mode |

package/packages/sync/rules/intelligence-authoring.md

@@ -109,6 +109,6 @@ The goal is subtraction, above. These are only the line past which something is
 
 ## Verifying a change to this layer
 
-The per-artifact authoring checks belong to `intelligence-update-context`. Session learning, repository onboarding, and accepted review findings use that same procedure. Invoke `intelligence-learn-from-session` to capture a lesson or workflow, `intelligence-learn-from-repository` for initial migration and recovery, and `intelligence-review-context` for audits and reductions. Operational work uses `intelligence-sync`, `intelligence-upgrade`, or `intelligence-manage-adapters`.
+The per-artifact authoring checks belong to `intelligence-update-context`. Session learning, repository onboarding, and accepted review findings use that same procedure. Invoke `intelligence-learn-from-session` to capture a lesson or workflow, `intelligence-learn-from-repository` for initial migration and recovery, and `intelligence-review-context` for audits and reductions. Operational work uses `intelligence-sync`. `intelligence-upgrade` and `intelligence-manage-adapters` change versions and generated outputs, so only the owner invokes them.
 
 A change to this layer is done when `<sync-cmd>` reports `IS_STATUS=ok` and the skill you invoked reports clean.

package/packages/sync/skills/intelligence-manage-adapters/SKILL.md

@@ -3,6 +3,7 @@ name: intelligence-manage-adapters
 description: "Enable, disable, or remove adapters and assess generated-output cleanup"
 argument-hint: "<enable|disable|remove> <adapter-name>"
 agent: intelligence-operator
+disable-model-invocation: true
 ---
 
 # Manage adapters

package/packages/sync/skills/intelligence-update-context/references/agents.md

@@ -4,9 +4,11 @@
    `<domain>-<role>` and determine its expertise from the source evidence.
 2. Select tier and access: implementation normally uses `heavy` and `full`;
    review or validation uses `standard` and `readonly`; simple lookup uses
-   `light` and `readonly`. Check the target's actual permission mapping when
-   external read tools are required. If native read-only restrictions exclude
-   those tools, use `full` only with a clear read-only boundary in the body.
+   `light` and `readonly`. Reserve `frontier` for long-horizon work whose
+   difficulty justifies the most capable and most expensive model. Check the
+   target's actual permission mapping when external read tools are required.
+   If native read-only restrictions exclude those tools, use `full` only with a
+   clear read-only boundary in the body.
 3. Keep the body thin: Expertise, Boundaries, and Build & Verify. Carry its own
    completion criteria and limitations. Reference constraints by name instead
    of copying rules, and put reusable procedures in skills.

package/packages/sync/skills/intelligence-upgrade/SKILL.md

@@ -3,6 +3,7 @@ name: intelligence-upgrade
 description: "Upgrade Intelligence and installed packages with migration checks"
 argument-hint: "[@scope/name]"
 agent: intelligence-operator
+disable-model-invocation: true
 ---
 
 # Upgrade Intelligence and packages