@amsterdamdatalabs/adl-agent-control-linux-x64 0.1.10 → 0.1.26

package/packages/agent-settings/deploy-profile.schema.json

@@ -0,0 +1,147 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "agent-settings deploy profile",
+  "description": "Single source of truth for how assets/mcp.json's servers and assets/agents/*.toml's agents are written into each surface's file — target path, container/table key, per-entry field mapping (which target key comes from which source field, or a constant), array/JSON formatting style, and (for the Markdown surfaces) YAML front-matter field order including nested and comma-list styles. The renderer (src/deploy/*.ts) is generic over this document; it hard-codes nothing surface-specific. What IS necessarily code (documented at each site): the codex-toml-block marker-replace algorithm and its blank-line spacing, the width-aware vs always-expanded JSON array formatters themselves (a surface only picks a `jsonStyle` NAME), the meaning of the fixed `from` vocabulary (command/args/commandArgs; name/description/model/claude_model/cursor_model/tools), and the csv-list split transform — see mcp-render.ts / agent-render.ts headers.",
+  "type": "object",
+  "required": ["mcp", "agents"],
+  "additionalProperties": false,
+  "properties": {
+    "$schema": { "type": "string" },
+    "mcp": {
+      "type": "object",
+      "required": ["source", "surfaces"],
+      "additionalProperties": false,
+      "properties": {
+        "source": { "type": "string", "minLength": 1 },
+        "marker": { "type": "string", "minLength": 1 },
+        "surfaces": {
+          "type": "array",
+          "minItems": 1,
+          "items": { "$ref": "#/definitions/mcpSurface" }
+        }
+      }
+    },
+    "agents": {
+      "type": "object",
+      "required": ["source", "surfaces"],
+      "additionalProperties": false,
+      "properties": {
+        "source": { "type": "string", "minLength": 1 },
+        "surfaces": {
+          "type": "array",
+          "minItems": 1,
+          "items": { "$ref": "#/definitions/agentSurface" }
+        }
+      }
+    },
+    "legacyLock": {
+      "type": "string",
+      "pattern": "^\\.[A-Za-z0-9_./-]+$",
+      "description": "Repo-relative path to the pre-agent-settings engine's own install lock (e.g. .agents/adl-repo.lock.json), if this repo may still carry one. When present, deploy takes over an agent file or lean-ctx file whose whole-file content hash matches that lock's files[<path>].sha256, an MCP server entry whose content hash matches merged[<mcp file>].entries[] at path [<containerKey>, <name>], the codex managed TOML block whose content hash matches toml[<codex file>].sha256, and .agents/.gitignore when its content equals that lock's gitignore[<path>].appended (or lines joined) text with created:true — instead of treating any of those as foreign. Optional: a profile with no legacy engine to migrate from omits it."
+    }
+  },
+  "definitions": {
+    "mcpEntryField": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["key"],
+      "properties": {
+        "key": { "type": "string", "minLength": 1 },
+        "from": { "type": "string", "enum": ["command", "args", "commandArgs"] },
+        "const": { "type": ["string", "boolean", "number"] }
+      }
+    },
+    "mcpTopLevelField": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["key", "const"],
+      "properties": {
+        "key": { "type": "string", "minLength": 1 },
+        "const": { "type": ["string", "boolean", "number"] }
+      }
+    },
+    "mcpTopLevelTable": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["table", "fields"],
+      "properties": {
+        "table": { "type": "string", "minLength": 1 },
+        "fields": {
+          "type": "array",
+          "minItems": 1,
+          "items": { "$ref": "#/definitions/mcpTopLevelField" }
+        }
+      }
+    },
+    "mcpSurface": {
+      "type": "object",
+      "required": ["name", "format", "file", "entry"],
+      "additionalProperties": false,
+      "properties": {
+        "name": { "type": "string", "minLength": 1 },
+        "format": { "type": "string", "enum": ["json", "toml-block"] },
+        "file": { "type": "string", "minLength": 1 },
+        "containerKey": { "type": "string", "minLength": 1 },
+        "jsonStyle": { "type": "string", "enum": ["width-aware", "expanded"] },
+        "tableKey": { "type": "string", "minLength": 1 },
+        "entry": {
+          "type": "array",
+          "minItems": 1,
+          "items": { "$ref": "#/definitions/mcpEntryField" }
+        },
+        "topLevel": {
+          "type": "array",
+          "minItems": 1,
+          "items": { "$ref": "#/definitions/mcpTopLevelTable" }
+        }
+      }
+    },
+    "agentFrontMatterField": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["key"],
+      "properties": {
+        "key": { "type": "string", "minLength": 1 },
+        "from": { "type": "string", "enum": ["name", "description", "model", "claude_model", "cursor_model", "tools"] },
+        "const": { "type": ["string", "boolean", "number"] },
+        "presentIf": { "type": "string", "enum": ["tools"] },
+        "style": { "type": "string", "enum": ["plain", "csv-list"] },
+        "fields": {
+          "type": "array",
+          "minItems": 1,
+          "items": { "$ref": "#/definitions/agentFrontMatterField" }
+        }
+      }
+    },
+    "agentTomlField": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["key", "from"],
+      "properties": {
+        "key": { "type": "string", "minLength": 1 },
+        "from": { "type": "string", "enum": ["name", "description", "model", "model_reasoning_effort", "sandbox_mode"] }
+      }
+    },
+    "agentSurface": {
+      "type": "object",
+      "required": ["name", "format", "folder"],
+      "additionalProperties": false,
+      "properties": {
+        "name": { "type": "string", "minLength": 1 },
+        "format": { "type": "string", "enum": ["md", "toml"] },
+        "folder": { "type": "string", "pattern": "^\\.[A-Za-z0-9_.-]+/agents$" },
+        "frontMatter": {
+          "type": "array",
+          "minItems": 1,
+          "items": { "$ref": "#/definitions/agentFrontMatterField" }
+        },
+        "fields": {
+          "type": "array",
+          "minItems": 1,
+          "items": { "$ref": "#/definitions/agentTomlField" }
+        },
+        "bodyField": { "type": "string", "enum": ["developer_instructions"] }
+      }
+    }
+  }
+}

package/packages/agent-settings/managed/README.md

@@ -1,10 +1,10 @@
-# Managed baseline files (adl items 10/17 — superseded by STATUS.md 12p decision 13)
+# Managed baseline files (local repo first: no `adl hook` entries)
 
-**STATUS.md 12p decision 13 (Tarun, 2026-09-29): "adl is LOCAL REPO FIRST".**
+**Local repo first (Tarun, 2026-09-29): "adl is LOCAL REPO FIRST".**
 "the repos where adl-config.toml does not exist has no business of running
 hooks"; setting up Claude or Codex hooks globally "is incorrect". This
 directory's two files no longer carry any `adl hook …` command — the
-`adl.session-required-for-writes` deny (`packages/agent-hooks/src/rules/impl/adl-session-required.ts`)
+`adl.run-required-for-writes` deny (`packages/agent-hooks/src/rules/impl/adl-run-required.ts`)
 and every other rule now run ONLY from a repository's own per-repo carrier
 (`.claude/settings.json`, `.codex/hooks.json`, `.cursor/hooks.json`,
 `.opencode/plugins/adl-repo.ts`), written by `adl hooks deploy`
@@ -15,12 +15,12 @@ they no longer stop that per-repo carrier from running (see the "Locks"
 citation further down). What each template still deploys machine-wide,
 deliberately: the Claude worktree guard (`permissions.deny`, "Worktree guard
 L2" below) and Orca's own reporting hooks (Tarun decides Orca's wiring
-separately, STATUS.md item 12d).
+separately; see "Orca" below).
 
-**STATUS.md 12p item 13 (Tarun, 2026-09-29): the `lean-ctx hook observe`
+**Tarun, 2026-09-29: the `lean-ctx hook observe`
 session-lifecycle entries are REMOVED, everywhere adl manages them.**
 "That's only for observation layer. We don't want to send any data to
-remote." Decision 13 had kept these five hooks wired here on the grounds
+remote." The local-repo-first rule had kept these five hooks wired here on the grounds
 that `observe` had no per-repo carrier of its own; that tradeoff is now
 retracted outright rather than replaced with one — see "lean-ctx `observe`
 hooks (removed)" below for the full detail and every place this touched.
@@ -78,8 +78,8 @@ nobody reads and become the templates the installer renders from:
   when the session env is absent, before ever reaching a no-identity
   refusal — so surface parity for the *default* identity does not depend
   on whether Codex honours `shell_environment_policy` at all. **Whether
-  Codex applies it remains UNCONFIRMED pending a live probe** (STATUS.md
-  item 16); this file records that gap rather than assuming either answer.
+  Codex applies it remains UNCONFIRMED pending a live probe of plain
+  `codex`'s shell, hooks and MCP servers**; this file records that gap rather than assuming either answer.
   What this `managed_config.toml` layer would still add, if honoured, is
   only the env var being visible to a plain shell command Codex runs
   directly — not the identity the hook or the MCP server resolve, since
@@ -89,14 +89,14 @@ nobody reads and become the templates the installer renders from:
 
 `allowManagedHooksOnly` (Claude) / `allow_managed_hooks_only` (Codex, in
 `codex-requirements.toml` only — the same key in `config.toml` does nothing)
-is now `false` in both templates (STATUS.md 12p decision 13, 2026-09-29):
+is `false` in both templates (local-repo-first rule, Tarun, 2026-09-29):
 set to `true`, it made each hook file fail-closed — a repository's own
 `.claude/settings.json` or user-level Codex config could not add a hook that
 overrides or removes a `PreToolUse` entry here. With no `adl hook` entry
 left in either template, the lock's only remaining effect would have been to
 stop the per-repo carrier (`adl hooks deploy` writes `.claude/settings.json`
-/ `.codex/hooks.json`) from running at all — exactly what decision 13 says
-must not happen. Both the lock's semantics and its install paths are
+/ `.codex/hooks.json`) from running at all — exactly what the local-repo-first
+rule forbids. Both the lock's semantics and its install paths are
 CONFIRMED from official docs (fetched 2026-09-27, re-confirmed 2026-09-29):
 
 - Claude, <https://code.claude.com/docs/en/settings-reference>: `env` —
@@ -138,23 +138,23 @@ the render is left untouched; anything else (missing, stale, hand-edited) is
 atomically replaced.
 
 `packages/agent-settings/tests/managed-artifacts.test.ts` parses the two
-templates in this directory and asserts the DECISION 13 shape: the lockdown
+templates in this directory and asserts the local-repo-first shape: the lockdown
 key is `false` in both, and neither template contains the string `adl hook`
 anywhere — `PreToolUse`/`PostToolUse` each carry only the Orca conditional
 hook now (see "Orca" below). `adl hook pre-tool-use --host=kimi` (and the
 rest of Kimi's eight commands) still run from `packages/agent-settings/src/kimi-hooks.ts`'s
-own global `~/.kimi-code/config.toml` carrier, UNCHANGED by this decision —
+own global `~/.kimi-code/config.toml` carrier, UNCHANGED by the local-repo-first rule —
 Kimi genuinely has no per-repo hook configuration (confirmed from Kimi's own
 docs, see `docs/architecture/cli-design.md` §2), so its carrier stays global
 by necessity, not by the same "managed baseline" design this directory's two
 files used to implement. `adl hook` is the old standalone `enact-hook`
-binary, folded into the one `adl` binary (item 15/P4,
-docs/specs/two-branch-standard-2026-09-27.md): there is no `enact-hook`
+binary, folded into the one `adl` binary (the P4 hard cut,
+docs/architecture/cli-design.md §7): there is no `enact-hook`
 executable on the fleet any more, hard cut, no compat shim.
 
 The `adl hook pre-tool-use --host=<claude|codex>` guard and the catch-all
 `adl hook lean-ctx <pre|post>-tool-use --host=<claude|codex>` hooks that used
-to live in this directory's two templates are REMOVED (decision 13): they
+to live in this directory's two templates are REMOVED (local repo first): they
 now run only from a repository's own per-repo carrier
 (`packages/agent-hooks/deploy-profile.json`, written by `adl hooks deploy`),
 which already wires the same commands — `rg -c 'adl hook' .claude/settings.json
@@ -174,7 +174,7 @@ or `/etc` paths.
 
 This is the ONE machine-level, non-overridable lever any of the researched
 surfaces has for worktree creation specifically
-(`docs/operations/research-2026-09-27-worktree-controls-per-surface.md`, "Bottom line
+(`docs/research/research-2026-09-27-worktree-controls-per-surface.md`, "Bottom line
 for the fleet"). Managed settings rank above every user/project/local source,
 so a repository's own `.claude/settings.json` cannot loosen this. Syntax
 CONFIRMED from code.claude.com/docs/en/permissions (fetched 2026-09-27):
@@ -213,14 +213,14 @@ blocker for L2 today.
 
 ## lean-ctx `observe` hooks (removed)
 
-**STATUS.md 12p item 13 (Tarun, 2026-09-29): REMOVED, everywhere adl
+**Tarun, 2026-09-29: REMOVED, everywhere adl
 manages them.** "That's only for observation layer. We don't want to send
 any data to remote." Both templates used to wire five session-lifecycle
 events — `SessionStart`, `SessionEnd`, `Stop`, `PreCompact`,
 `UserPromptSubmit` — each matcher `".*"`, each calling
 `/usr/local/bin/lean-ctx hook observe` **directly**, with no `adl hook`/
 `--host=` wrapper, added 2026-09-27 for parity with Tarun's then-live
-`~/.claude/settings.json`. Decision 13 (above) had kept these wired
+`~/.claude/settings.json`. The local-repo-first rule (above) had kept these wired
 regardless of `allowManagedHooksOnly`/`allow_managed_hooks_only` on the
 grounds that `observe` had no per-repo carrier of its own on any surface —
 that tradeoff is now retracted outright, not replaced with a carrier: no
@@ -228,14 +228,14 @@ surface wires `observe` from this repo any more.
 
 `SessionStart`/`Stop`/`UserPromptSubmit` keep their Orca conditional hook,
 now the only entry on each (same one-group shape `PreToolUse`/`PostToolUse`
-already had after decision 13). `PreCompact` (both hosts) and Codex's
+already had after the local-repo-first rule). `PreCompact` (both hosts) and Codex's
 `SessionEnd` — neither in Tarun's Orca event lists — carried `observe`
 alone and now have no key/`[[hooks.*]]` entry at all, rather than being left
 as an empty array. `packages/agent-settings/tests/managed-artifacts.test.ts`
 covers the new shape, including a standing assertion that no managed
 artifact's hook commands contain the string `hook observe` anywhere.
 
-`workflows/scripts/fleet/fleet-cutover.sh`'s `strip_user_lean_ctx_hooks`
+`packages/fleet/scripts/fleet-cutover.sh`'s `strip_user_lean_ctx_hooks`
 (successor of the retired `m3-cutover.sh`) still strips any leftover
 per-user `lean-ctx hook observe` entry from `~/.claude/settings.json` —
 previously framed as "redundant once the managed baseline installs", now
@@ -243,14 +243,13 @@ simply "the hook Tarun retracted, wherever it is still found" (backing the
 file up to that run's own backup folder first); its behaviour and tests are
 unchanged by this removal, only its rationale.
 
-## Orca (STATUS.md item 12d, "Orca allowed for adl")
+## Orca ("Orca allowed for adl")
 
 Tarun, 2026-09-27: "keep the orca hooks, let orca manage it, orca is allowed
 for adl" — of the options considered, the one built is **the MANAGED layer
-calls Orca**. This is unaffected by STATUS.md 12p decision 13 (2026-09-29,
+calls Orca**. This is unaffected by the local-repo-first rule (2026-09-29,
 `allowManagedHooksOnly` / `allow_managed_hooks_only` now `false`): Orca's own
-wiring here is a separate decision Tarun makes independently (STATUS.md item
-12d), and the question below was only whether Orca's own report-only hooks
+wiring here is a separate decision Tarun makes independently, and the question below was only whether Orca's own report-only hooks
 keep running, never about the lock's value.
 
 Orca (`/Applications/Orca.app`) installs its own user-level hooks that call
@@ -262,14 +261,14 @@ report-only: they read the event JSON on stdin, POST it to Orca on
 prints `{}` up front. Neither script does anything unless
 `ORCA_PANE_KEY`/`ORCA_AGENT_HOOK_PORT`/`ORCA_AGENT_HOOK_TOKEN` are already set
 in the environment (Orca sets these itself when it launches a pane). Before
-decision 13, once `allowManagedHooksOnly`/`allow_managed_hooks_only` locked a
+the local-repo-first rule, once `allowManagedHooksOnly`/`allow_managed_hooks_only` locked a
 host to this directory's templates, Orca's own user-level `hooks` entries in
 `~/.claude/settings.json` / `~/.codex/hooks.json` stopped running fleet-wide —
 exactly the same per-user gap the lean-ctx catch-alls and `observe` hooks
 above already had to close, so the managed layer called Orca itself instead.
 The lock is now `false`, but Orca's own user-level `hooks` entries are a
 SEPARATE per-user config source from a repository's `adl hooks deploy`
-carrier either way — nothing about decision 13 reintroduces a route for
+carrier either way — nothing about the local-repo-first rule reintroduces a route for
 Orca's own wiring to run on its own, so this managed layer keeps calling
 Orca directly, unchanged.
 
@@ -292,9 +291,9 @@ sh -c 'h="$HOME/.orca/agent-hooks/claude-hook.sh"; if [ -f "$h" ] && [ -r "$h" ]
 
 Historically, for an event that already carried an adl/lean-ctx or `observe`
 hook, the Orca entry was **added after** the existing ones, in the same
-array — never replacing or reordering them. Decision 13 removed the adl
-guard and lean-ctx catch-alls from `PreToolUse`/`PostToolUse`, and STATUS.md
-12p item 13 (2026-09-29) then removed `observe` from
+array — never replacing or reordering them. The local-repo-first rule removed the adl
+guard and lean-ctx catch-alls from `PreToolUse`/`PostToolUse`, and Tarun
+(2026-09-29) then removed `observe` from
 `SessionStart`/`SessionEnd`/`Stop`/`UserPromptSubmit` too — so every event on
 Tarun's Orca lists now carries the Orca entry as its ONLY hook, one group,
 matcher `".*"`. `PreCompact` (Claude) and `PreCompact`/`SessionEnd` (Codex)

package/packages/agent-settings/managed/codex-requirements.toml

@@ -1,4 +1,4 @@
-# adl items 10/17 — the managed baseline hook (docs/architecture/cli-design.md §2/§3).
+# The managed baseline hook (docs/architecture/cli-design.md §2/§3).
 #
 # This is the committed TEMPLATE. `bin/reconcile`
 # (packages/fleet/src/managed-settings.ts, bin/managed-settings) installs it
@@ -8,7 +8,7 @@
 # per-device-rendered managed_config.toml that carries
 # shell_environment_policy.set.
 #
-# STATUS.md 12p decision 13 (Tarun, 2026-09-29): "adl is LOCAL REPO FIRST …
+# Local repo first (Tarun, 2026-09-29): "adl is LOCAL REPO FIRST …
 # the repos where adl-config.toml does not exist has no business of running
 # hooks"; setting up Codex hooks globally "is incorrect". `adl hook …` is
 # therefore NOT wired from this machine-global layer any more — Codex's own
@@ -29,7 +29,7 @@
 # `allow_managed_hooks_only` is Codex's fail-closed equivalent of Claude
 # Code's `allowManagedHooksOnly`: set to `true` it made a repository or user
 # Codex config unable to add a hook that overrides or removes ones wired
-# here. Decision 13 sets it to `false`: with no `adl hook` entries left in
+# here. It is `false` here: with no `adl hook` entries left in
 # this file to protect, the lock's only remaining effect was to make a
 # repository's own `.codex/hooks.json` — the carrier `adl hooks deploy`
 # writes — silently not run. Per
@@ -40,7 +40,7 @@
 # layer does not lock hooks, so the per-repo carrier is the one that runs.
 allow_managed_hooks_only = false
 
-# Orca wiring (STATUS.md item 12d, Tarun 2026-09-27: "keep the orca hooks,
+# Orca wiring (Tarun 2026-09-27: "keep the orca hooks,
 # let orca manage it, orca is allowed for adl" -- the MANAGED layer calls
 # Orca). Orca (/Applications/Orca.app) installs its own user-level hooks
 # calling `~/.orca/agent-hooks/codex-hook.sh`, a report-only script (reads
@@ -49,8 +49,8 @@ allow_managed_hooks_only = false
 # ORCA_AGENT_HOOK_TOKEN are set) -- read verbatim as part of this change.
 # This entry is Orca's own global reporting hook, unrelated to
 # `allow_managed_hooks_only`/the adl per-repo carrier above — kept exactly as
-# it was; Tarun decides Orca's own wiring separately (STATUS.md 12p decision
-# 13 report, "remain global"). `$HOME`, never a hard-coded `/Users` path.
+# it was; Tarun decides Orca's own wiring separately, so it stays global.
+# `$HOME`, never a hard-coded `/Users` path.
 # Does nothing (exit 0, no output) when the script is absent or not
 # executable.
 [[hooks.PreToolUse]]
@@ -60,7 +60,7 @@ hooks = [{ type = "command", command = "sh -c 'h=\"$HOME/.orca/agent-hooks/codex
 hooks = [{ type = "command", command = "sh -c 'h=\"$HOME/.orca/agent-hooks/codex-hook.sh\"; if [ -f \"$h\" ] && [ -r \"$h\" ] && [ -x \"$h\" ]; then exec \"$h\"; else cat >/dev/null 2>&1 || :; fi'" }]
 
 
-# lean-ctx `observe` hooks: REMOVED (STATUS.md 12p item 13, Tarun,
+# lean-ctx `observe` hooks: REMOVED (Tarun,
 # 2026-09-29 — "That's only for observation layer. We don't want to send any
 # data to remote."). These five session-lifecycle hooks (SessionStart,
 # SessionEnd, Stop, PreCompact, UserPromptSubmit), added 2026-09-27 for
@@ -84,13 +84,13 @@ hooks = [{ type = "command", command = "sh -c 'h=\"$HOME/.orca/agent-hooks/codex
 matcher = ".*"
 hooks = [{ type = "command", command = "sh -c 'h=\"$HOME/.orca/agent-hooks/codex-hook.sh\"; if [ -f \"$h\" ] && [ -r \"$h\" ] && [ -x \"$h\" ]; then exec \"$h\"; else cat >/dev/null 2>&1 || :; fi'" }]
 
-# Orca events with no prior adl/lean-ctx hook: STATUS.md item 12d names these
+# Orca events with no prior adl/lean-ctx hook: Tarun's Orca list names these
 # among Codex's 8 (SessionStart, UserPromptSubmit, PreToolUse,
 # PermissionRequest, PostToolUse, SubagentStart, SubagentStop, Stop) — the
 # Orca entry is simply the sole hook for the event, same conditional
 # $HOME-gated command as above. `PreCompact` and `SessionEnd` are NOT in
 # Tarun's 8-event list and no longer carry a `lean-ctx observe` hook either
-# (STATUS.md 12p item 13, 2026-09-29 — removed), so neither has any
+# (removed 2026-09-29), so neither has any
 # `[[hooks.*]]` entry left at all.
 [[hooks.PermissionRequest]]
 matcher = ".*"

package/packages/agent-settings/package.json

@@ -0,0 +1,20 @@
+{
+  "name": "@adl/agent-settings",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "description": "Machine-global agent surface tooling (sweep, global-agents, kimi-hooks, surface-policy) run by the fleet bin wrappers under bun; also holds GLOBAL-AGENTS.md, surface policy, and the protected list. Subagent definitions (Claude/Codex/Cursor/Kimi/OpenCode) are canonical in packages/agent-skills/extensions/adl-factory/agents/*.toml and projected per repo by that package's installer; this package does not generate or hold its own copy.",
+  "scripts": {
+    "typecheck": "tsc --noEmit",
+    "test": "bun test --coverage",
+    "check": "bun run typecheck && bun run test --coverage"
+  },
+  "dependencies": {
+    "@iarna/toml": "^2.2.5",
+    "ajv": "^8.17.1"
+  },
+  "devDependencies": {
+    "typescript": "5.9.3",
+    "@types/bun": "latest"
+  }
+}

package/packages/agent-settings/src/deploy/agent-render.ts

@@ -60,7 +60,7 @@ function renderFrontMatterField(field: AgentFrontMatterField, def: AgentDef, ind
 }
 
 /** `---\n<front matter>\n---\n\n<body>` — the YAML front-matter wrapper is structural (inherent to Markdown front matter), not a per-surface value, so it stays here; every LINE inside it comes from `surface.frontMatter`. */
-export function renderAgentMd(surface: AgentSurface, def: AgentDef): string {
+function renderAgentMd(surface: AgentSurface, def: AgentDef): string {
   const lines = (surface.frontMatter ?? []).flatMap((field) => renderFrontMatterField(field, def, ""));
   return `---\n${lines.join("\n")}\n---\n\n${def.developerInstructions}`;
 }
@@ -76,7 +76,7 @@ function resolveTomlField(field: AgentTomlField, def: AgentDef): string {
 }
 
 /** Flat `key = "value"` lines plus one `bodyField = """..."""` block. The `key = value` / triple-quoted-string TEXT FORMAT is structural (inherent to TOML), not a per-surface value; which keys exist and their order come from `surface.fields`. */
-export function renderAgentToml(surface: AgentSurface, def: AgentDef): string {
+function renderAgentToml(surface: AgentSurface, def: AgentDef): string {
   const fields = surface.fields ?? [];
   const lines = fields.map((field) => `${field.key} = ${tomlBasicString(resolveTomlField(field, def))}`);
   const bodyKey = surface.bodyField ?? "developer_instructions";

package/packages/agent-settings/src/deploy/agent-toml.ts

@@ -36,7 +36,7 @@ function optionalString(doc: Record<string, unknown>, key: string): string | und
 }
 
 /** Parses one source agent TOML file's text. Throws (fails loud) if a required key is missing, developer_instructions isn't a string, or the text is not valid TOML. */
-export function parseAgentToml(text: string, sourcePath: string): AgentDef {
+function parseAgentToml(text: string, sourcePath: string): AgentDef {
   let doc: unknown;
   try {
     doc = TOML.parse(text);

package/packages/agent-settings/src/deploy/agents-deploy.ts

@@ -27,7 +27,7 @@ export interface DeployAgentsOptions {
   readonly dryRun?: boolean;
 }
 
-export interface AgentConflict {
+interface AgentConflict {
   readonly folder: string;
   readonly agent: string;
   readonly reason: string;
@@ -38,6 +38,8 @@ export interface DeployAgentsResult {
   readonly unchanged: readonly string[];
   readonly removed: readonly string[];
   readonly conflicts: readonly AgentConflict[];
+  /** Unlocked same-name agent files whose content was exactly what deploy renders: taken over and locked, never a conflict. */
+  readonly adopted: readonly string[];
   readonly lockPath: string;
 }
 
@@ -64,6 +66,7 @@ export function deployAgents(options: DeployAgentsOptions): DeployAgentsResult {
   const unchanged: string[] = [];
   const removed: string[] = [];
   const conflicts: AgentConflict[] = [];
+  const adopted: string[] = [];
   const legacyFileRemovals: string[] = [];
   let anyLegacyTakeover = false;
 
@@ -83,12 +86,22 @@ export function deployAgents(options: DeployAgentsOptions): DeployAgentsResult {
         anyLegacyTakeover = true;
       }
 
+      const content = renderAgent(surface, def);
+
+      // Tarun, 2026-10-01: an unrecorded file byte-identical to what deploy
+      // renders holds no user content: adopt it (it is locked below via
+      // `kept`), the same rule as lean-ctx's adoptUnmarkedManagedText. A
+      // file that differs at all stays a conflict.
+      if (exists && !managedByUs && readFileSync(absPath, "utf8") === content) {
+        managedByUs = true;
+        adopted.push(relPath);
+      }
+
       if (exists && !managedByUs) {
         conflicts.push({ folder: surface.folder, agent: def.name, reason: "a user-owned agent file already exists with this name; deploy left it untouched" });
         continue;
       }
 
-      const content = renderAgent(surface, def);
       if (exists && readFileSync(absPath, "utf8") === content) {
         unchanged.push(relPath);
       } else {
@@ -113,7 +126,7 @@ export function deployAgents(options: DeployAgentsOptions): DeployAgentsResult {
     newAgentEntries[surface.folder] = kept.sort();
   }
 
-  if (!dryRun) writeLock(targetRepo, { schema: 1, mcp: lock.mcp, agents: newAgentEntries, leanCtx: lock.leanCtx });
+  if (!dryRun) writeLock(targetRepo, { schema: 1, mcp: lock.mcp, agents: newAgentEntries });
 
   // Once anything was actually taken over, this package's own footprint in
   // the legacy lock's `files` section for these exact agent paths is stale:
@@ -129,6 +142,7 @@ export function deployAgents(options: DeployAgentsOptions): DeployAgentsResult {
     unchanged: unchanged.sort(),
     removed: removed.sort(),
     conflicts: conflicts.sort((a, b) => `${a.folder}/${a.agent}`.localeCompare(`${b.folder}/${b.agent}`)),
+    adopted: adopted.sort(),
     lockPath: join(targetRepo, ".agents/agent-settings.lock.json"),
   };
 }

package/packages/agent-settings/src/deploy/doctor.ts

@@ -12,14 +12,13 @@ import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { extensionFor, renderAgent } from "./agent-render.js";
 import { loadAgentSources, type AgentDef } from "./agent-toml.js";
-import { resolveConfigTomlWrite, resolveGitignoreWrite, resolveLeanCtxWrite } from "./lean-ctx-merge.js";
-import { agentOwned, leanCtxOwned, mcpServerOwned, readLock, type SettingsLock } from "./lock.js";
+import { readLock, type SettingsLock } from "./lock.js";
 import { readDeployedMcpServerNames, readDeployedMcpServerValue } from "./mcp-inspect.js";
 import { renderMcpJsonEntry } from "./mcp-render.js";
 import { loadMcpSource, type McpServerSpec } from "./mcp-source.js";
 import { type DeployProfile, loadProfile } from "./profile.js";
 
-export interface DoctorIssue {
+interface DoctorIssue {
   readonly severity: "error" | "info";
   readonly path: string;
   readonly reason: string;
@@ -150,88 +149,9 @@ export function doctorAgents(options: DoctorAgentsOptions): DoctorResult {
   return toResult(issues);
 }
 
-export interface DoctorLeanCtxOptions {
-  readonly assetsDir: string;
-  readonly targetRepo: string;
-  readonly profile?: DeployProfile;
-  readonly lock?: SettingsLock;
-}
-
-export function doctorLeanCtx(options: DoctorLeanCtxOptions): DoctorResult {
-  const profile = options.profile ?? loadProfile();
-  if (profile.leanCtx === undefined) {
-    throw new Error("deploy profile has no leanCtx section");
-  }
-  const lock = options.lock ?? readLock(options.targetRepo);
-  const issues: DoctorIssue[] = [];
-  const lockOwnedTargets = new Set(Object.keys(lock.leanCtx).filter((target) => lock.leanCtx[target] === true));
-
-  for (const file of profile.leanCtx.files) {
-    const assetAbs = join(options.assetsDir, file.asset);
-    const targetAbs = join(options.targetRepo, file.target);
-    const exists = existsSync(targetAbs);
-    const ownedByUs = leanCtxOwned(lock, file.target);
-
-    if (!exists) {
-      issues.push({ severity: "error", path: file.target, reason: ownedByUs ? "deploy-written lean-ctx file is missing from the target repo" : "expected lean-ctx file has not been deployed" });
-      continue;
-    }
-    // Independent review, 2026-09-30, finding 6: .gitignore is exempted
-    // from this early conflict the same way deploy itself now is — a
-    // markerless, never-adl-written .agents/.gitignore is not a hard
-    // conflict; resolveGitignoreWrite's own append-not-conflict migration
-    // decides it below instead (mirrors lean-ctx-deploy.ts's own guard).
-    if (!ownedByUs && file.asset !== "gitignore") {
-      issues.push({ severity: "error", path: file.target, reason: "a user-owned file conflicts with a lean-ctx asset path; not managed by deploy" });
-      continue;
-    }
-    const expected = readFileSync(assetAbs, "utf8");
-    const current = readFileSync(targetAbs, "utf8");
-    // Same merge-contract analysis deploy itself uses (lean-ctx-merge.ts):
-    // a user addition outside the managed block alone is not drift; a
-    // changed/removed/malformed managed block, or a duplicate key, is.
-    if (current !== expected) {
-      const outcome =
-        file.asset === "config.toml"
-          ? resolveConfigTomlWrite(expected, current, ownedByUs)
-          : file.asset === "gitignore"
-            ? resolveGitignoreWrite(expected, current, ownedByUs)
-            : resolveLeanCtxWrite(expected, current, ownedByUs);
-      if (outcome.action === "write") {
-        // Tarun, 2026-09-30 (merge-contract correction, same day):
-        // "adl-owned entries SELF-HEAL" — when the drift is specifically
-        // an adl-owned scalar restored to adl's own value, name it
-        // explicitly here too, the same way a healed hook is named
-        // ("restored … local changes replaced"), instead of the generic
-        // "modified since deploy" wording.
-        if (outcome.restoredScalars !== undefined && outcome.restoredScalars.length > 0) {
-          for (const scalar of outcome.restoredScalars) {
-            issues.push({
-              severity: "error",
-              path: file.target,
-              reason: `restored adl value: ${scalar.key} = ${JSON.stringify(scalar.value)} (was ${JSON.stringify(scalar.previous)}); run deploy to apply`,
-            });
-          }
-        } else {
-          issues.push({ severity: "error", path: file.target, reason: "deploy-written lean-ctx file was modified since deploy" });
-        }
-      } else if (outcome.action === "conflict") {
-        issues.push({ severity: "error", path: file.target, reason: outcome.reason });
-      }
-    }
-  }
-
-  for (const target of lockOwnedTargets) {
-    if (profile.leanCtx.files.some((f) => f.target === target)) continue;
-    issues.push({ severity: "error", path: target, reason: "deploy-written lean-ctx file is no longer in the deploy profile; run deploy to remove it" });
-  }
-
-  return toResult(issues);
-}
-
 export function mergeDoctorResults(results: readonly DoctorResult[]): DoctorResult {
   const issues = results.flatMap((r) => r.issues);
   return toResult(issues);
 }
 
-export { mcpServerOwned, agentOwned, leanCtxOwned };
+;