@amsterdamdatalabs/adl-agent-control-linux-x64 0.1.12 → 0.1.28

package/packages/agent-settings/README.md

@@ -0,0 +1,287 @@
+# Global surface sweep
+
+This operator tool finds third-party machine-global Claude, Codex, and Cursor
+extensions that should normally be repository-local. Manual use keeps review
+and approval separate; fleet enforcement is an explicit manifest policy run by
+the existing global-tool reconciler.
+
+## Safety contract
+
+The workflow has five modes:
+
+- `audit` prints every candidate and changes nothing.
+- `plan` emits a reviewable JSON approval document. It contains exact JSON
+  selectors, TOML table headers, filesystem paths, and pre-change SHA-256
+  fingerprints, but not the removed configuration values.
+- `copy-review` makes a private, surface-organized copy of every path candidate,
+  full original and proposed configuration files, and exact removed JSON/TOML
+  fragments. It does not change the source surfaces.
+- `apply` requires that approval document. It recomputes the candidates,
+  verifies every removal description and fingerprint before making any change,
+  and fails before the first mutation if an approved target drifted.
+- `enforce` is the manifest-authorized scheduled mode. It applies all current
+  unprotected candidates without a one-time approval file.
+
+Before discovery produces candidates, it consults
+[`protected.json`](./protected.json). Protection there is limited to verified
+entries supplied or managed by the agent application itself. It is never
+granted to a directory prefix or namespace. Protection matches only the listed
+filesystem path, JSON selector, or TOML table header; its content may change
+during normal vendor updates. A newly appearing sibling or child is not
+protected unless its own exact identity is listed.
+
+The checked-in list protects the currently verified Codex application caches,
+OpenAI-bundled plugin/runtime artifacts, Codex system skill catalog,
+Cursor-bundled `skills-cursor` entries, Codex's own Node REPL configuration,
+and Anthropic's automatically available official marketplace metadata. The
+marketplace itself is native; a plugin selected from it is not. This distinction
+matches [Anthropic's marketplace documentation](https://code.claude.com/docs/en/discover-plugins),
+which describes the official marketplace as automatic and each plugin as an
+explicit user/project/local installation.
+
+The list does not protect third-party/global additions such as Paseo, Enact
+Context, Code Review Graph, OfficeCLI, custom skills, custom commands,
+installed Claude plugins, or OpenAI curated-remote plugins. Those remain sweep
+candidates even when they are useful; their intended home is the owning
+repository.
+
+**Orca hooks are the one exception, and they are protected by content, not by
+`protected.json`.** Tarun, 2026-09-27 ("Orca allowed for
+adl"): "keep the orca hooks, let orca manage it, orca is allowed for adl" —
+the managed layer now calls Orca itself (see
+[`managed/README.md`](./managed/README.md#orca-orca-allowed-for-adl)),
+and Orca's own user-level hooks on every surface (Claude `hooks` +
+`statusLine`, Codex `hooks.json`, Cursor `hooks.json`, Kimi `[[hooks]]`) are
+never removal candidates either. Unlike every other protected entry above,
+this is not a static `protected.json` identity: `global-surface-sweep.ts`
+recognizes an Orca hook at plan time by an EXACT reference to the path
+segment `.orca/agent-hooks/` in its content (never a loose match on the word
+"orca" alone — `/opt/orca/kimi-hook.sh`, which merely mentions "orca", is
+still a genuine candidate). This also required `.claude/settings.json`'s
+`hooks` key (and its Codex/Cursor equivalents) to move from one sweep
+candidate per event to one candidate per hook GROUP, so a real machine's
+single event can mix a still-sweepable adl/lean-ctx hook with an Orca hook
+that must not be swept. See `tests/orca-hooks-protected.test.ts`.
+
+Operations omitted from the reviewed plan remain untouched. Approval is atomic
+per target file or filesystem path: for example, all listed removals from
+`.claude/settings.json` form one operation. Delete the entire operation from
+the plan if any listed removal should remain.
+
+Apply mode also checks each fingerprint again immediately before mutation.
+Modified files are copied and removed paths are moved to a unique backup under
+`STATE_DIR/global-surface-sweep/backups/`. An `applied-plan.json` beside each
+backup records exactly what changed. A failed multi-operation apply rolls back
+the already completed prefix. File rewrites preserve the original mode, owner,
+and group even when scheduled reconciliation runs as root.
+
+Those backups apply only to foreign entries in mixed host/application files and
+directories; `STATE_DIR` is runtime recovery state, not an Adl-owned surface
+root. Fully owned Adl artifacts use their own direct reconciliation paths and
+are never routed through this remover.
+
+The built-in scope intentionally excludes host-owned user data such as
+`.codex/memories`, `.codex/automations`, `.codex/sessions`,
+`.claude/projects`, and global instruction files. A forged plan cannot expand
+the built-in target allowlist.
+
+## Scanned surfaces and entry kinds
+
+Ownership rule: machine-global agent configuration belongs to enact-vps;
+everything else belongs in the owning repository. The sweep therefore treats
+anything not declared by enact-vps (`protected.json`, the Kimi managed block,
+GLOBAL-AGENTS deployment targets) as foreign:
+
+- JSON entries: Claude `settings.json` `hooks`, `mcpServers`, `enabledPlugins`,
+  `extraKnownMarketplaces`, `permissions.allow|deny|ask` items; `.claude.json`
+  MCP; Codex/Cursor hooks and MCP; OpenCode `mcp`, `permission`, `plugin`;
+  Kimi `mcp.json`.
+- TOML tables: Codex `mcp_servers.*` and `hooks.*`; Kimi `[[hooks]]` outside
+  `# BEGIN/END ADL KIMI HOOKS` (that region is never inspected or changed).
+- Root-key baselines (`root_keys` in `protected.json`): when a settings file has a
+  declared baseline, every undeclared top-level JSON key, TOML root key, or TOML
+  table whose first segment is undeclared is removed. Files without a baseline
+  never lose root keys.
+- Text blocks: tool-injected marker regions (`# >>> name >>>`…`# <<< name <<<`,
+  `# name — begin`…`# name — end`, `<!-- name -->`…`<!-- /name -->`) in shell rc
+  files (`.zshenv`, `.zprofile`, `.zshrc`, `.zlogin`, `.bashenv`, `.bashrc`,
+  `.bash_profile`, `.profile`) and global instruction files (`CLAUDE.md`,
+  Codex/Cursor/Kimi/OpenCode `AGENTS.md`). Text
+  outside markers is never touched; exact `text_blocks` identities are retained.
+- Paths: skills/plugins/commands/rules directories for every host above and
+  `~/Library/LaunchAgents` entries.
+
+VS Code is deliberately outside this broad removal scope. The focused
+`packages/fleet/src/vscode-settings.ts` deployer owns only
+`git.detectWorktrees` and `scm.alwaysShowRepositories` in existing stable VS
+Code profiles, plus those two IDs in the default profile's apply-to-all list;
+that narrow ownership does not authorize sweeping other VS Code configuration.
+
+`~/Library/LaunchAgents` scope is agent tooling only. An entry is scanned
+only when its file name or raw plist content (the label, program and
+arguments, and environment) contains one of these case-insensitive tokens:
+`lean-ctx`, `leanctx`, `adl`, `jcode`, `claude`, `codex`, `cursor`, `kimi`,
+`opencode`, `copilot`, or `orca` (`AGENT_TOOL_TOKENS` in the source). XML and
+binary plists both store those strings verbatim. Other application
+LaunchAgents, such as `com.google.GoogleUpdater.wake` or Keystone, are not
+agent surfaces, so they are neither candidates nor reported. The fleet
+manifest declares no LaunchAgent any more (git-maintain was retired on
+2026-09-30), so no plist is protected by manifest identity; `protected.json` is
+the only protection list.
+
+In-scope `~/Library/LaunchAgents` entries require explicit approval: `enforce` never
+removes them and instead prints `pending approval:` lines plus a stderr
+warning on every run until a reviewed plan is applied. Because removing a
+plist does not by itself unload an already-loaded job, `apply` (macOS only)
+runs `launchctl bootout gui/<uid>/<label>` for a LaunchAgents removal
+immediately before moving its plist to backup, and refuses the removal
+(fails loud, rolls back) if the job is verifiably still loaded afterward —
+`launchctl bootout` failing because the job simply was not loaded is the
+expected, harmless common case and is not itself an error.
+
+## Review exactly what would be removed
+
+Start with the human-readable audit:
+
+```bash
+bin/global-surface-sweep --home "$HOME" --mode audit
+```
+
+Create a review bundle in a new or empty private directory:
+
+```bash
+bin/global-surface-sweep \
+  --home "$HOME" \
+  --mode copy-review \
+  --destination /absolute/path/to/review-copy
+```
+
+The destination is mode `0700`. It is divided into `agents/`, `claude/`,
+`codex/`, and `cursor/`. Each surface can contain exact path copies, original
+configuration files, proposed-after files, and removed fragments. The bundle's
+`manifest.json` records every candidate, fingerprint, and copy mapping without
+placing removed values in the manifest. Removed-fragment files can contain
+credentials and are mode `0600`; do not commit or share the bundle.
+
+The audit first prints every exact protected identity retained by
+`protected.json`, including its reason. Each candidate is then followed by
+exact lines such as:
+
+```text
+protected: PATH .codex/skills/.system (sha256:...) — Codex system skills supplied by the application
+remove: JSON .claude/settings.json#/hooks/PostToolUse (sha256:...)
+remove: TOML .codex/config.toml [mcp_servers.example] (sha256:...)
+remove: PATH .codex/skills/example (sha256:...)
+```
+
+Generate the approval document in a root-restricted working directory:
+
+```bash
+umask 077
+bin/global-surface-sweep \
+  --home "$HOME" --mode plan >./global-surface-sweep-plan.json
+```
+
+Review every object in `operations`. Remove whole operation objects that are
+not approved. Do not edit their paths, hashes, or `removals` arrays; apply mode
+compares those fields with a fresh plan and rejects mismatches.
+
+Apply only after review:
+
+```bash
+sudo bin/global-surface-sweep \
+  --home "$HOME" \
+  --mode apply \
+  --approval ./global-surface-sweep-plan.json \
+  --state-dir /var/lib/adl
+```
+
+Because plans contain machine-specific home paths and fingerprints, generate a
+separate plan on each machine. Plans are one-time approval artifacts, not files
+to commit to this repository.
+
+## Scheduled fleet enforcement
+
+`bin/reconcile --mode apply` invokes `enforce` after package and
+health checks and before recording the manifest as successfully applied. The
+administrator home is declared per device in `packages/fleet/manifest.json`.
+Audit and plan runs invoke the read-only surface audit instead.
+
+`global_surface_sweep.remove_unprotected` in the manifest gates whether an
+apply run actually removes anything: `true` (the current fleet default)
+enforces — removes every unprotected candidate; `false` keeps `reconcile
+--mode apply` on `audit` for the surface sweep step even though the rest of
+the run still applies normally, so the sweep only plans/reports without
+deleting until the flag is flipped back. Protection itself is based on the
+exact known identity, not its content fingerprint, so normal vendor updates
+at a listed path or selector remain protected across fleet versions.
+
+## Maintaining the protected list
+
+Add an entry only after verifying that the agent vendor ships or owns that
+specific artifact. Record its exact filesystem path, JSON selector, or TOML
+table header and the provenance reason. Do not add parent directories, path
+prefixes, wildcard selectors, or TOML namespace prefixes. A protected path
+continues to match if its content or file type changes, so keep the identity
+list narrow and explicit.
+
+`root_keys` baselines are derived from each host's own documented top-level
+settings schema (currently `.claude/settings.json` from
+<https://code.claude.com/docs/en/settings-reference> and `.codex/config.toml`
+from <https://developers.openai.com/codex/config-reference>), not merely from
+whatever keys this machine's own settings files currently happen to use —
+that guards against a legitimate key one fleet device has set (and another
+has not yet) being misclassified as foreign. Re-sync a baseline against its
+source page whenever the vendor ships new top-level settings keys. A key
+whose *content* is inherently third-party wiring (e.g. Claude's
+`extraKnownMarketplaces`) is deliberately left out of the baseline on
+purpose even though it is a real, documented key, so the whole container
+stays a sweep candidate whenever non-empty — see the `reason` field on that
+baseline entry for the specific rationale.
+
+## Global agent instructions (`GLOBAL-AGENTS.md`)
+
+[`GLOBAL-AGENTS.md`](./assets/GLOBAL-AGENTS.md) is the single source of truth for
+every host's global instruction file: `~/.claude/CLAUDE.md`,
+`~/.codex/AGENTS.md`, `~/.cursor/AGENTS.md`, `~/.kimi-code/AGENTS.md`, and
+`~/.config/opencode/AGENTS.md`. Any change to those files must be made in
+`GLOBAL-AGENTS.md`; a direct edit to a target is drift and is overwritten on
+the next deploy.
+
+```bash
+bin/global-agents --home "$HOME" --mode status     # read-only
+bin/global-agents --home "$HOME" --mode deploy     # forced
+bin/global-agents --home "$HOME" --mode uninstall
+```
+
+Deploy is always forced; there is no `--force` flag and no leave-in-place
+mode. A missing target is created, a target already equal to the source is
+left untouched, and a drifted target (hand-edited, or stale from an older
+source) is replaced from source. These exact files are Adl-owned artifacts:
+there is no displaced-original backup or leave-in-place path. A second deploy
+with no source change writes nothing. Uninstall removes the same owned files
+regardless of their current bytes.
+
+`bin/reconcile --mode apply` runs the forced deploy
+privilege-dropped as the device's `brew_user` against `brew_user_home` when
+`config.global_agents.enabled` is true; plan and audit runs call `status`
+only.
+
+## Tests
+
+```bash
+(cd packages/agent-settings && bun test tests/global-surface-sweep.test.ts)
+```
+
+The tests use temporary home and state directories only. They verify exact
+removal reporting, exact (non-blanket) identity protection, sibling discovery,
+no-op discovery, unapproved-entry retention, deletion fingerprint drift
+rejection, path allowlisting, recoverable backups, and idempotence.
+`third-party-wiring.test.ts` reproduces the lean-ctx / enact-context global
+footprint (shell hooks, Claude permissions, instruction blocks, OpenCode,
+Kimi, LaunchAgents) and checks plan, enforce, approved
+apply, idempotence, and drift detection.
+`global-agents.test.ts` and `global-agents-forced-deploy.test.ts` cover the
+global instruction deploy with temporary homes: drifted targets replaced from
+source without a displaced copy, matching targets untouched, missing targets
+created, and idempotence.

package/packages/agent-settings/assets/GLOBAL-AGENTS.md

@@ -50,9 +50,9 @@ repo's own `AGENTS.md`.
 ## Agent identity
 - Every Azure DevOps access (git, PRs, work items, builds, reads included) runs as an agent identity — never as you,
   the human. Default is the machine's default agent, set silently by fleet reconcile; it is always overridable.
-- **Override:** prefix a command with `ADL_AGENT_ID_AGENT=<agent-tarun|agent-vivek|agent-reviewer>`, or start the
-  session with `adl run <surface> --as <agent>`. An MCP tool call can't carry an inline prefix, so `adl run --as` is
-  its override.
+- **Override:** prefix a command with `ADL_AGENT_ID_AGENT=<agent-tarun|agent-vivek|agent-reviewer>`. An MCP tool
+  call can't carry an inline prefix, so it uses the session env or the machine default agent; the fallback CLI
+  (`adl mcp cli <command>`) takes the inline prefix like any command.
 - Never read vault files. Never pass a token.
 - **Never set `ADL_HUMAN_AZDO`.** It is Tarun's own human-terminal marker for `bin/git-ado`'s and `adl id whoami`'s
   fail-closed human pass-through (stdin TTY AND `ADL_HUMAN_AZDO=1`, exactly) — an agent carrying it would let a child
@@ -60,8 +60,8 @@ repo's own `AGENTS.md`.
 
 ## Commits and the PR lifecycle
 - **Use ordinary `git` for every Git operation.** The managed `/usr/local/bin/git` front controller delegates local and non-Azure DevOps work to the system Git executable, and routes HTTPS Azure DevOps network commands through `adl-agent-id exec --agent "$ADL_AGENT_ID_AGENT"` automatically. `git-ado` handles the credential boundary internally. Linux keeps its single administrator/root credential model; the controller does not introduce a second account or secret location.
-- **Start a sub-agent session on a surface (intra-surface sub-agents) with `adl run <surface> --headless "<prompt>"` ONLY when the operator explicitly asks for it** — an agent must never start one autonomously. Azure DevOps operations (PRs, work items, builds) go through the `adl` MCP server (`adl mcp serve`) with tools like `pr_list_or_get`, `pr_create_or_update`, `pr_review`, `build_list_or_get`, `build_run`, `workitem_list_or_get`, `workitem_create_or_update`, or via `adl mcp cli`. Never read vault files; never pass a token.
-- **Repository controls run via `adl repo controls`.** Git hooks in controlled repositories run pre-commit (local checks) and pre-push (Azure DevOps governance). Each repository is reconciled on its own with its `.agents/`, `.claude/`, `.codex/`, `.cursor/`, `.kimi-code/`, `.opencode/` projections and its own `.agents/lean-ctx/config/lean-ctx/config.toml` — lean-ctx config is per repository, never global.
+- **Start a sub-agent session on a surface (intra-surface sub-agents) with `adl run <surface> --headless "<prompt>"` ONLY when the operator explicitly asks for it** — an agent must never start one autonomously. Azure DevOps operations (PRs, work items, builds) go through the `adl` MCP server (`adl mcp serve`) with tools like `pr_list_or_get`, `pr_create_or_update`, `pr_review`, `build_list_or_get`, `build_run`, `workitem_list_or_get`, `workitem_create_or_update`. If the MCP server is not working, fall back to the CLI: `adl mcp cli <command>`. Never read vault files; never pass a token.
+- **Repository controls run via `adl repo controls`.** Git hooks in controlled repositories run pre-commit (local checks) and pre-push (Azure DevOps governance). Each repository is reconciled on its own with its `.agents/`, `.claude/`, `.codex/`, `.cursor/`, `.kimi-code/`, `.opencode/` projections.
 - **The release flow (`integration` auto-complete; the `branch → PR → integration → main` promotion; the integration PR merging itself once green) applies to repositories whose root contains an `adl-config.toml`.** Other repositories follow the release flow declared in their own `AGENTS.md`. The human approval gate, where it exists, is the promotion from `integration` to `main`; everything before that is auto-complete once CI is green.
 - Keep each commit **independently green** and on one cohesive topic. Never use `git stash`. When "one topic" and "independently green" conflict, green wins — and say so.
 - Subjects are `<type>(<scope>): <lowercase subject>`. Types: `feat|fix|docs|refactor|perf|chore`. No `!` marker. `release:` is reserved for the promotion PR the pipeline raises — never write one by hand. **In repositories whose root contains an `adl-config.toml`, the pipeline opens `integration → main` once CI is green on `integration` — no agent opens it; the subject follows the commit grammar above.**
@@ -86,24 +86,22 @@ repo's own `AGENTS.md`.
 - Consult official docs **before** coding against an unfamiliar SDK, framework or API.
 
 ## Context tooling
-- Prefer `ctx_*` over native: `ctx_read` for reads, `ctx_search` for grep, `ctx_tree`/`ctx_glob` for listing, `ctx_shell` for commands, `ctx_read(mode="anchored")` → `ctx_patch` for edits.
-- Pick the read mode: `full` when editing, `map`/`signatures` to orient, `lines:N-M` for a range. Never `full` for a file you will not edit.
-- **Match the tool to the question. `ctx_search` is not the answer to all of them.**
-  - Orient in unfamiliar code → `ctx_compose`; `ctx_call` reaches `ctx_overview`.
-  - Literal text or regex → **`rg`**. Never `grep`; never `find | grep`, which filters file NAMES and silently misses the file whose contents match.
+- **Match the tool to the question. `rg` is not the answer to all of them.**
+  - Orient in unfamiliar code → **`crg`** (the code graph): `crg architecture`, `crg communities`.
+  - Symbols and semantic code queries → `crg search "<text>"`. `rg` finds the text; `crg` finds the edges.
+  - Callers, callees, blast radius → `crg query callers_of|callees_of|tests_for|importers_of <target>`, `crg impact`.
+  - Unreferenced code → `crg dead-code`.
   - A code *shape* rather than a string → **`ast-grep`**.
-  - Files by name or tree → `ctx_glob` / `ctx_tree`.
-  - Callers, callees, blast radius → `ctx_callgraph`, or **`crg`** (the code graph): `crg impact`, `crg query callers_of|callees_of|tests_for|importers_of <target>`, `crg dead-code`, `crg architecture`. `rg` finds the text; `crg` finds the edges.
   - Prose in `docs/`, `plans/` → **`search <text>`** — hybrid semantic + keyword, so it surfaces the document whose filename never mentions the subject.
-  - What we already established → `ctx_knowledge` / `ctx_session` (via `ctx_call` when unadvertised). Record decisions there as you go, not only at the end.
+  - Literal text or regex → **`rg`**. Never `grep`; never `find | grep`, which filters file NAMES and silently misses the file whose contents match.
+  - Files by name or tree → the host's native Glob / file-listing tools.
 
 ## Agent surface commands
-Only on explicit operator request:
+Only on explicit operator request: `adl run` is for running a sub-agent headless, nothing else. It is not an identity
+route and not a fallback for anything.
 - **Headless:** `adl run claude --headless "<prompt>"`, `adl run codex --headless "<prompt>"`, `adl run opencode --headless "<prompt>"`, `adl run kimi --headless "<prompt>"`, `adl run cursor --headless "<prompt>"`
 - **Identity override:** add `--as <agent>` to any surface command above  
 - **Model:** add `--model <model>` to any headless command above, e.g. `adl run codex --model <model> --headless "<prompt>"` — adl passes each surface's own flag (claude/cursor `--model`, codex/opencode/kimi `-m`); a surface without a model flag refuses it (exit 2). `--model` cannot be combined with `adl run -- <cmd>` (usage error).
 - **Tasks ledger:** when you start and when you finish a task, append one line to `docs/notes.md` in the repository you work in (create the file if it is missing, with YAML frontmatter and a `## Lines` section) — format `YYYY-MM-DD HH:MM <surface> <note>`, the whole line ≤100 characters. Append-only, newest at the bottom, never rewrite earlier lines. One ledger per repository, for every agent.
-- **General form:** `adl run -- <cmd>` for arbitrary commands
-
 ## Temporary files
 - All scratch and throwaway work goes in **`.scratchpad/`** at the repo root — never `/tmp` or `/private/tmp`. Create it if missing. Real deliverables go to their proper home.

package/packages/agent-settings/assets/agents/architect.toml

@@ -17,6 +17,8 @@ Role:
 Rules:
 - Never edit files.
 - Never speculate when you can read the source.
+- Ground assessments in `crg architecture` and `crg communities` evidence rather than directory guesses.
+- Follow the `explore-codebase` skill for graph-powered navigation.
 - Cite exact file paths and line references for material claims.
 - Call out tradeoffs, not just the favored direction.
 - Never act as StageVerifier or LoopGrader, claim external independence, or call loop judgment and closure tools.

package/packages/agent-settings/assets/agents/code-reviewer.toml

@@ -16,6 +16,8 @@ Role:
 Rules:
 - Never edit files.
 - Review only from the actual diff and surrounding code.
+- Run `crg detect-changes --brief` for the risk picture, then `crg impact` and `crg query tests_for <fn>` on high-risk functions.
+- Follow the `review-changes` skill for change detection and impact analysis.
 - Every finding must cite a file reference and explain impact.
 - If no actionable issues remain, report that no local findings were found; do not emit a binding approval token.
 - Never act as StageVerifier or LoopGrader, claim external independence, or call loop judgment and closure tools.

package/packages/agent-settings/assets/agents/executor.toml

@@ -15,6 +15,8 @@ Role:
 Rules:
 - Stay inside the stated scope.
 - Match existing code patterns.
+- Before changing a symbol, check `crg query callers_of <symbol>` and `crg query tests_for <symbol>`.
+- Follow the `tdd` skill for verification.
 - Do not add abstractions unless the code clearly needs them.
 - Do not stop at code changes; include the verification result.
 - Before dispatching or relaying work, require Factory's exact { planPath, sha256, approvedBy, approvedAt } approval record and rehash planPath; missing approval or byte drift is blocking.

package/packages/agent-settings/assets/agents/explore.toml

@@ -16,6 +16,8 @@ Rules:
 - Never edit files.
 - Use absolute paths in results.
 - Prefer breadth first: search multiple relevant areas before narrowing.
+- Lead orientation with `crg architecture`, `crg communities`, `crg query`, and `crg search` before falling back to raw text search.
+- Follow the `explore-codebase` skill for graph-powered navigation.
 - Explain how the files connect instead of returning a raw list.
 
 Output contract:

package/packages/agent-settings/assets/agents/planner.toml

@@ -15,6 +15,8 @@ Role:
 Rules:
 - Never write production code.
 - Prefer 3 to 6 concrete steps.
+- Scope plans with `crg impact` and `crg query` so step lists name real symbols.
+- Follow the `explore-codebase` skill for graph-powered navigation.
 - Include dependencies, risks, and verification expectations.
 - After authorized review, emit the Factory-owned approval record exactly as { planPath, sha256, approvedBy, approvedAt }; sha256 is the exact plan-byte digest and changes invalidate approval.
 - For board effects, preserve remote System.State verbatim, model execution, review, and PR as separate axes, and mark unknown remote states blocking.

package/packages/agent-settings/assets/mcp.json

@@ -11,10 +11,6 @@
         "--tools",
         "get_minimal_context_tool,query_graph_tool,detect_changes_tool,semantic_search_nodes_tool,list_graph_stats_tool"
       ]
-    },
-    "lean-ctx": {
-      "command": "adl",
-      "args": ["hook", "lean-ctx", "mcp"]
     }
   }
 }

package/packages/agent-settings/deploy-profile.json

@@ -0,0 +1,139 @@
+{
+  "$schema": "./deploy-profile.schema.json",
+  "mcp": {
+    "source": "assets/mcp.json",
+    "marker": "adl",
+    "surfaces": [
+      {
+        "name": "claude",
+        "format": "json",
+        "file": ".mcp.json",
+        "containerKey": "mcpServers",
+        "jsonStyle": "width-aware",
+        "entry": [
+          { "key": "command", "from": "command" },
+          { "key": "args", "from": "args" }
+        ]
+      },
+      {
+        "name": "codex",
+        "format": "toml-block",
+        "file": ".codex/config.toml",
+        "tableKey": "mcp_servers",
+        "entry": [
+          { "key": "command", "from": "command" },
+          { "key": "args", "from": "args" }
+        ],
+        "topLevel": [
+          {
+            "table": "features",
+            "fields": [{ "key": "hooks", "const": true }]
+          }
+        ]
+      },
+      {
+        "name": "cursor",
+        "format": "json",
+        "file": ".cursor/mcp.json",
+        "containerKey": "mcpServers",
+        "jsonStyle": "expanded",
+        "entry": [
+          { "key": "type", "const": "stdio" },
+          { "key": "command", "from": "command" },
+          { "key": "args", "from": "args" }
+        ]
+      },
+      {
+        "name": "kimi",
+        "format": "json",
+        "file": ".kimi-code/mcp.json",
+        "containerKey": "mcpServers",
+        "jsonStyle": "expanded",
+        "entry": [
+          { "key": "command", "from": "command" },
+          { "key": "args", "from": "args" }
+        ]
+      },
+      {
+        "name": "opencode",
+        "format": "json",
+        "file": "opencode.json",
+        "containerKey": "mcp",
+        "jsonStyle": "width-aware",
+        "entry": [
+          { "key": "type", "const": "local" },
+          { "key": "command", "from": "commandArgs" },
+          { "key": "enabled", "const": true }
+        ]
+      }
+    ]
+  },
+  "agents": {
+    "source": "assets/agents",
+    "surfaces": [
+      {
+        "name": "claude",
+        "format": "md",
+        "folder": ".claude/agents",
+        "frontMatter": [
+          { "key": "name", "from": "name" },
+          { "key": "description", "from": "description" },
+          { "key": "tools", "from": "tools", "presentIf": "tools" },
+          { "key": "model", "from": "claude_model" }
+        ]
+      },
+      {
+        "name": "codex",
+        "format": "toml",
+        "folder": ".codex/agents",
+        "fields": [
+          { "key": "name", "from": "name" },
+          { "key": "description", "from": "description" },
+          { "key": "model", "from": "model" },
+          { "key": "model_reasoning_effort", "from": "model_reasoning_effort" },
+          { "key": "sandbox_mode", "from": "sandbox_mode" }
+        ],
+        "bodyField": "developer_instructions"
+      },
+      {
+        "name": "cursor",
+        "format": "md",
+        "folder": ".cursor/agents",
+        "frontMatter": [
+          { "key": "name", "from": "name" },
+          { "key": "description", "from": "description" },
+          { "key": "tools", "from": "tools", "presentIf": "tools" },
+          { "key": "model", "from": "cursor_model" },
+          { "key": "readonly", "const": false }
+        ]
+      },
+      {
+        "name": "kimi",
+        "format": "md",
+        "folder": ".kimi-code/agents",
+        "frontMatter": [
+          { "key": "name", "from": "name" },
+          { "key": "description", "from": "description" },
+          { "key": "whenToUse", "from": "description" },
+          { "key": "override", "const": false },
+          { "key": "tools", "from": "tools", "presentIf": "tools", "style": "csv-list" }
+        ]
+      },
+      {
+        "name": "opencode",
+        "format": "md",
+        "folder": ".opencode/agents",
+        "frontMatter": [
+          { "key": "description", "from": "description" },
+          { "key": "mode", "const": "subagent" },
+          {
+            "key": "permission",
+            "presentIf": "tools",
+            "fields": [{ "key": "edit", "const": "deny" }]
+          }
+        ]
+      }
+    ]
+  },
+  "legacyLock": ".agents/adl-repo.lock.json"
+}