@amsterdamdatalabs/adl-agent-control-linux-x64 0.1.46 → 0.1.48

package/packages/agent-settings/assets/GLOBAL-AGENTS.md

@@ -1,112 +0,0 @@
-# Global agent rules — Tarun
-
-Applies to every agent surface on every machine. Repo-specific rules live in that
-repo's own `AGENTS.md`.
-
-## Communication
-- Address me as **Tarun**.
-- Short, scannable **bullet points** — not long prose. Lead with the answer; keep reasoning tight.
-- **Every reply has three parts, in this order:**
-  - a **TL;DR** of a few lines; information stays brief, and detail is given only when asked;
-  - an explicit **Recommendation**: what you would do and why, in one line;
-  - **one ask**: the single question or decision you need next.
-- **Keep a numbered list of open points** and show it when it changes. I answer them one at a time, so never bundle several questions into one reply.
-- If a task is ambiguous, ask exactly one clarifying question.
-
-## Truthfulness (non-negotiable)
-- **No fake-green tests.** A test changes only when the intended behaviour changes, never to make unintended behaviour pass. Red is honest.
-- **No silent fallback or degrade** — if the real path fails, fail loud and stop.
-- **No silent drops** — no `|| true`, no swallowed errors, no skipped gates.
-- **No fakes** — no stubs, placeholders or TODOs passed off as done.
-- Unverified claims never enter durable artifacts.
-
-## Verification before claiming done
-- Evidence over assertions: run the command, show real output.
-- **Make the check falsifiable.** "Did you grep the source?" has an answer; "did you verify?" does not.
-- **Negative claims need source-level proof.** A tool listing or search result shows what was returned, not what exists. Grep the implementation, or write "I didn't find X via `<method>`".
-- **Ask the authoritative source, not the one in front of you.** A tool listing describes a session's registry; a worktree describes one branch. Neither describes the repository. Before reporting what a repo contains, ask `origin` — `git show origin/main:<path>` — and before reporting a shipped tool's behaviour, ask the installed binary, not its checkout.
-- **Name the ref, because "authoritative" is not one place.** Where a change is in flight, `origin/main` and `origin/integration` answer differently and BOTH are right about themselves. Two agents once disagreed for hours over a field name — `last_modified` on main, `last_update` on integration, same file, same line. Neither had misread. State which ref you asked, and when a rule depends on unlanded work, say so rather than reporting one ref as the truth.
-- **Deployed is not running.** `/usr/local/bin` holding the new binary does not mean the process serving you loaded it — a long-lived MCP server or daemon keeps the code it started with. A symbol scan of the FILE cannot see this; it passes while the old code still answers. When a fix is installed and the behaviour has not changed, restart the process before debugging the fix.
-- **Search the package, then narrow.** A grep scoped to `src/` cannot find what lives in `scripts/`, and returns the same confident silence either way. Run the wide search first, and pair every negative claim with a positive control in the same run — a term you KNOW is present. Zero hits for both means the scope was wrong, not that the thing is absent.
-- **Re-run before reporting.** Cite the run you are reporting, not one you remember.
-- Never claim "checked everything" without checking every case. State only measured facts.
-- A requirement you are about to not satisfy is a **stop**, not a design decision.
-
-## Scope discipline
-- Work in your own cwd. Touch only the repos and paths explicitly in scope.
-- Out-of-scope work becomes a **new work item** — never silent scope creep.
-- **At most 3 checkouts per repository, including the main folder.** `git worktree add` is denied for agents with the exact `adl worktree add` command to run instead, which refuses at the same cap and explains why; `EnterWorktree` and subagent `isolation: "worktree"` are allowed below the cap and denied at it. Reconcile old worktrees first (merge, then `git worktree remove <path>`) — `git worktree list`/`remove`/`prune`/`repair` stay allowed for that. Prefer working in the one checkout; parallel subagents share it, each with its own write scope. Only the orchestrator commits.
-
-## Plans and work items
-- **A plan is a Feature. A backlog item is a PBI or a Bug.** One file each, and the board is the only place their state lives.
-- Layout: `plans/features/az<feature id>-<slug>/spec.md`, with one item per row under that folder's `items/az<id>-<slug>.md`.
-- **The id is the identity** — allocate the work item on the board first, then name the file `az<id>-<slug>`. **No file exists before its id does**, and there is no placeholder: an item that is not yet allocated lives as a row in the plan's `## Items` table, not as a file waiting to be renamed. A rename is a second chance to disagree with the board.
-- **Nothing moves between directories.** A plan lives at one path for its whole life; a folder name that also claims to record progress is a second place to update and the one that goes stale.
-- **One link direction**: an item names its `feature:`. The Feature never lists its items except as the `## Items` table in its own `spec.md`.
-- `epic:` and `feature:` are **authored, never tool-created** — a typo must fail loudly instead of spawning a duplicate.
-- The spec text **is** the work item's fields. If the two differ, the board is lying.
-- A gap found along the way goes in `plans/GAPS-AND-FINDINGS.md`, becomes an item with `item_type: bug`, and parents under the **same Feature** that surfaced it.
-- Tracked types stop at Product Backlog Item: `Feature`, `Product Backlog Item`, `Bug`. A Bug is treated exactly as a PBI. `Epic` is a valid parent but is never created by tooling; `Task` is not used.
-- **The hierarchy is Epic > Feature > PBI/Bug, and the server enforces every level.** A PBI or Bug parents to a Feature; a Feature parents to an Epic. `workitem_create_or_update` refuses a wrong-typed parent by name — `Feature must be parented to a Epic; work item 368 is a Product Backlog Item` — on create and on update alike. `epic:` in a spec is a cross-check on the Feature's own parent, never a link target.
-- **An Epic is a valid parent but cannot be read back**, because `Epic` is not a tracked type. The refusal names the type it found, which is how you confirm one: `work item 376 is a Epic, which this server does not track`. That refusal is not proof of an Epic on its own — a `Task` and an id you cannot see produce the same words.
-- **A work item has exactly one parent**, so ordering is never expressed by parenting. Blocking edges are `Dependency-Reverse` links, authored from an item's `## Predecessors`. Supplying `parentId` on an update MOVES the item; the old link is removed, not kept alongside.
-- Which Epic a Feature belongs under is a **human decision**. The server checks the parent's TYPE, never that it is the right Epic.
-
-## Agent identity
-- Every Azure DevOps access (git, PRs, work items, builds, reads included) runs as an agent identity — never as you,
-  the human. Default is the machine's default agent, set silently by fleet reconcile; it is always overridable.
-- **Override:** prefix a command with `ADL_AGENT_ID_AGENT=<agent-tarun|agent-vivek|agent-reviewer>`. An MCP tool
-  call can't carry an inline prefix, so it uses the session env or the machine default agent; the fallback CLI
-  (`adl mcp cli <command>`) takes the inline prefix like any command.
-- Never read vault files. Never pass a token.
-- **Never set `ADL_HUMAN_AZDO`.** It is Tarun's own human-terminal marker for `bin/git-ado`'s and `adl id whoami`'s
-  fail-closed human pass-through (stdin TTY AND `ADL_HUMAN_AZDO=1`, exactly) — an agent carrying it would let a child
-  process forge that pass-through.
-
-## Commits and the PR lifecycle
-- **Use ordinary `git` for every Git operation.** The managed `/usr/local/bin/git` front controller delegates local and non-Azure DevOps work to the system Git executable, and routes HTTPS Azure DevOps network commands through `adl-agent-id exec --agent "$ADL_AGENT_ID_AGENT"` automatically. `git-ado` handles the credential boundary internally. Linux keeps its single administrator/root credential model; the controller does not introduce a second account or secret location.
-- **Start a sub-agent session on a surface (intra-surface sub-agents) with `adl run <surface> --headless "<prompt>"` ONLY when the operator explicitly asks for it** — an agent must never start one autonomously. Azure DevOps operations (PRs, work items, builds) go through the `adl` MCP server (`adl mcp serve`) with tools like `pr_list_or_get`, `pr_create_or_update`, `pr_review`, `build_list_or_get`, `build_run`, `workitem_list_or_get`, `workitem_create_or_update`. If the MCP server is not working, fall back to the CLI: `adl mcp cli <command>`. Never read vault files; never pass a token.
-- **Repository controls run via `adl repo controls`.** Git hooks in controlled repositories run pre-commit (local checks) and pre-push (Azure DevOps governance). Each repository is reconciled on its own with its `.agents/`, `.claude/`, `.codex/`, `.cursor/`, `.kimi-code/`, `.opencode/` projections.
-- **The release flow (`integration` auto-complete; the `branch → PR → integration → main` promotion; the integration PR merging itself once green) applies to repositories whose root contains an `adl-config.toml`.** Other repositories follow the release flow declared in their own `AGENTS.md`. The human approval gate, where it exists, is the promotion from `integration` to `main`; everything before that is auto-complete once CI is green.
-- Keep each commit **independently green** and on one cohesive topic. Never use `git stash`. When "one topic" and "independently green" conflict, green wins — and say so.
-- Subjects are `<type>(<scope>): <lowercase subject>`. Types: `feat|fix|docs|refactor|perf|chore`. Branch prefixes are exactly these types (`<type>/<kebab>`), not configurable per repository. No `!` marker. `release:` is reserved for the promotion PR the pipeline raises — never write one by hand. **In repositories whose root contains an `adl-config.toml`, the pipeline opens `integration → main` once CI is green on `integration` — no agent opens it; the subject follows the commit grammar above.**
-- A PR body needs non-empty `## Summary`, `## Why` and `## Changes`. The title follows the commit grammar above.
-
-## Tests
-- For features, bugfixes and non-trivial refactors: **tests first**, confirmed failing for the right reason; then minimal code to pass; then a separate review pass.
-- Every change ships a **new** test.
-- When a change deliberately alters behaviour, rework the existing tests that assert the old behaviour, in the same change. Name each reworked test and the decision that changed it.
-- **Never fake green.** Don't loosen, skip or delete an assertion, or set an expectation to whatever the code returns, to hide a failure you didn't intend.
-- Skip for pure config, docs and trivial one-liners.
-
-## Delegation & parallelism
-- Delegate hands-on execution to **executor** subagents; I orchestrate and verify.
-- Split independent work into **concurrent agents** launched together — never sequential when it can fan out.
-- Match the model tier to the task: strongest for architecture and deep analysis, fastest for quick lookups.
-- Author and reviewer are **distinct passes in separate contexts**. Never self-approve.
-
-## Fixing things
-- Fix at the **source** — the primitive, token or shared layer — so it propagates everywhere. Not a narrow downstream patch.
-- **Speed over caution.** Favour fast models and parallel execution.
-- Consult official docs **before** coding against an unfamiliar SDK, framework or API.
-
-## Context tooling
-- **Match the tool to the question. `rg` is not the answer to all of them.**
-  - Orient in unfamiliar code → **`crg`** (the code graph): `crg architecture`, `crg communities`.
-  - Symbols and semantic code queries → `crg search "<text>"`. `rg` finds the text; `crg` finds the edges.
-  - Callers, callees, blast radius → `crg query callers_of|callees_of|tests_for|importers_of <target>`, `crg impact`.
-  - Unreferenced code → `crg dead-code`.
-  - A code *shape* rather than a string → **`ast-grep`**.
-  - Prose in `docs/`, `plans/` → **`search <text>`** — hybrid semantic + keyword, so it surfaces the document whose filename never mentions the subject.
-  - Literal text or regex → **`rg`**. Never `grep`; never `find | grep`, which filters file NAMES and silently misses the file whose contents match.
-  - Files by name or tree → the host's native Glob / file-listing tools.
-
-## Agent surface commands
-Only on explicit operator request: `adl run` is for running a sub-agent headless, nothing else. It is not an identity
-route and not a fallback for anything.
-- **Headless:** `adl run claude --headless "<prompt>"`, `adl run codex --headless "<prompt>"`, `adl run opencode --headless "<prompt>"`, `adl run kimi --headless "<prompt>"`, `adl run cursor --headless "<prompt>"`
-- **Identity override:** add `--as <agent>` to any surface command above  
-- **Model:** add `--model <model>` to any headless command above, e.g. `adl run codex --model <model> --headless "<prompt>"` — adl passes each surface's own flag (claude/cursor `--model`, codex/opencode/kimi `-m`); a surface without a model flag refuses it (exit 2). `--model` cannot be combined with `adl run -- <cmd>` (usage error).
-- **Tasks ledger:** when you start and when you finish a task, append one line to `docs/notes.md` in the repository you work in (create the file if it is missing, with YAML frontmatter and a `## Lines` section) — format `YYYY-MM-DD HH:MM <surface> <note>`, the whole line ≤100 characters. Append-only, newest at the bottom, never rewrite earlier lines. One ledger per repository, for every agent.
-## Temporary files
-- All scratch and throwaway work goes in **`.scratchpad/`** at the repo root — never `/tmp` or `/private/tmp`. Create it if missing. Real deliverables go to their proper home.

package/packages/agent-settings/assets/lean-ctx/config.toml

@@ -1,42 +0,0 @@
-# >>> adl managed (do not edit within this block) >>>
-minimal_overhead = true
-structure_first = true
-journal_enabled = true
-auto_capture = true
-update_check_disabled = true
-# <<< adl managed <<<
-shell_allowlist_extra = [
-    "pi",
-    "install",
-    "script",
-    "expect",
-    "bash",
-    "claude",
-    "codex",
-    "just",
-    "crg",
-    "search",
-    "atlas",
-    "rustfmt",
-    "cursor-agent",
-    "kimi",
-    "opencode",
-    "pi-acp",
-    "adl",
-    "adl-repo-controls",
-    "orca",
-    "agent",
-    "az",
-    "trash",
-    "launchctl",
-    "ssh",
-    "base64",
-    "wasmtime",
-    "orca-ide",
-    "time",
-    "ast-grep",
-    "bun",
-    "npm",
-    "apply_patch",
-    "enact-docs-search"
-]

package/packages/agent-settings/assets/lean-ctx/gitignore

@@ -1,10 +0,0 @@
-# >>> adl managed (do not edit within this block) >>>
-/lean-ctx/data/
-/lean-ctx/cache/
-/lean-ctx/state/
-/lean-ctx/bin/
-/hooks/hooks.log
-/hooks/hooks-activity.log
-/lean-ctx/config/lean-ctx/workspace-trust.toml
-*.bak
-# <<< adl managed <<<

package/packages/agent-settings/assets/lean-ctx/layout.toml

@@ -1,7 +0,0 @@
-# >>> adl managed (do not edit within this block) >>>
-# lean-ctx layout pin (GL #623) — managed by lean-ctx, do not edit.
-# Marks this install as committed to the XDG four-dir layout so a stray
-# ~/.lean-ctx never re-collapses config/data/state/cache. Remove via
-# `lean-ctx doctor` only if you intentionally revert to a single-dir layout.
-mode = "xdg"
-# <<< adl managed <<<

package/packages/agent-settings/src/deploy/lean-ctx-deploy.ts

@@ -1,230 +0,0 @@
-/**
- * Writes the repo-local lean-ctx config files (config.toml, layout.toml)
- * and .agents/.gitignore from assets/lean-ctx/, per profile.leanCtx. A
- * fresh write (nothing at the target yet) is still a verbatim byte copy —
- * no per-surface rendering — reproducing the asset exactly (the asset
- * itself is a complete BEGIN/END-marked managed block; see
- * lean-ctx-merge.ts).
- *
- * Merge contract (Tarun, 2026-09-29, merge contract; mechanism corrected
- * by an independent review the same day — supersedes the original "L3,
- * Tarun 2026-09-28" whole-file-verbatim rule, and this comment's own
- * earlier per-key/array-entry description, both below): adl owns a single
- * marked managed block per file and it SELF-HEALS as a whole the moment
- * its content drifts from the asset. Everything OUTSIDE the markers is the
- * user's, preserved byte-for-byte, never parsed or rewritten — see
- * `lean-ctx-merge.ts`'s own header for exactly why (a full-file TOML parse
- * both rejected valid user TOML and silently discarded a user's entire
- * file on any parse failure; pure marker-text splicing cannot do either).
- * `doctorLeanCtx` (doctor.ts) shares the same `resolveLeanCtxWrite`
- * analysis, so "is this drift" is answered in exactly one place.
- *
- * A markerless file the lock already records as adl-written is a one-time
- * MIGRATION target (wrapped in markers if its known prior content is still
- * found verbatim; a CONFLICT, left untouched, otherwise) — never silently
- * discarded. Malformed markers, and a key declared both inside the managed
- * block and outside it, are conflicts too.
- *
- * Same ownership rule as mcp/agents (lock.ts): a pre-existing file at a
- * target path the lock does not record is a conflict, left untouched and
- * reported; a target dropped from profile.leanCtx.files is removed only if
- * the lock shows this deploy wrote it.
- *
- * Fails loud: a missing assets dir/target repo, a profile with no leanCtx
- * section, or a missing source asset file all throw. There is no
- * partial-success return value. A resolveLeanCtxWrite CONFLICT is reported
- * in the ordinary `conflicts` array (like any other), not a throw — the
- * caller (apps/cli's `adl install`) is the one that turns a non-empty
- * conflicts list into a loud, non-zero-exit failure.
- */
-import { existsSync, mkdirSync, readFileSync, statSync, unlinkSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { legacyFileTakeover, legacyTakeoverForGitignore, type LegacyLockDoc, readLegacyLock, stripLegacyOwnership } from "./legacy-lock.js";
-import { resolveConfigTomlWrite, resolveGitignoreWrite, resolveLeanCtxWrite } from "./lean-ctx-merge.js";
-import { leanCtxOwned, readLock, writeLock } from "./lock.js";
-import { type DeployProfile, loadProfile } from "./profile.js";
-
-export interface DeployLeanCtxOptions {
-  readonly assetsDir: string; // packages/agent-settings/assets/lean-ctx
-  readonly targetRepo: string;
-  readonly profile?: DeployProfile;
-  /** Computes the exact same written/unchanged/removed/conflicts result without writing anything (target files, lock, or legacy lock) — independent review, 2026-09-29, finding 6. */
-  readonly dryRun?: boolean;
-}
-
-export interface LeanCtxConflict {
-  readonly target: string;
-  readonly reason: string;
-}
-
-/** One adl-owned scalar restored to adl's own value this run (2026-09-30, Tarun's merge-contract correction: "adl-owned entries SELF-HEAL" — named explicitly, the same way a healed hook is named, never silent). */
-export interface RestoredLeanCtxScalar {
-  readonly target: string;
-  readonly key: string;
-  readonly value: unknown;
-  readonly previous: unknown;
-}
-
-export interface DeployLeanCtxResult {
-  readonly written: readonly string[];
-  readonly unchanged: readonly string[];
-  readonly removed: readonly string[];
-  readonly conflicts: readonly LeanCtxConflict[];
-  readonly lockPath: string;
-  readonly restored: readonly RestoredLeanCtxScalar[];
-}
-
-export function deployLeanCtx(options: DeployLeanCtxOptions): DeployLeanCtxResult {
-  const { assetsDir, targetRepo } = options;
-  const dryRun = options.dryRun === true;
-
-  if (!existsSync(assetsDir) || !statSync(assetsDir).isDirectory()) {
-    throw new Error(`agent-settings lean-ctx assets directory not found: ${assetsDir}`);
-  }
-  if (!existsSync(targetRepo) || !statSync(targetRepo).isDirectory()) {
-    throw new Error(`deploy target is not a directory: ${targetRepo}`);
-  }
-
-  const profile = options.profile ?? loadProfile();
-  if (profile.leanCtx === undefined) {
-    throw new Error("deploy profile has no leanCtx section");
-  }
-
-  const lock = readLock(targetRepo);
-  const legacyLockPath = profile.legacyLock !== undefined ? join(targetRepo, profile.legacyLock) : undefined;
-  const legacyDoc: LegacyLockDoc | undefined = legacyLockPath !== undefined ? readLegacyLock(legacyLockPath) : undefined;
-  const written: string[] = [];
-  const unchanged: string[] = [];
-  const removed: string[] = [];
-  const conflicts: LeanCtxConflict[] = [];
-  const restored: RestoredLeanCtxScalar[] = [];
-  const newLeanCtxEntries: Record<string, boolean> = {};
-  const kept: string[] = [];
-  const legacyFileRemovals: string[] = [];
-  const legacyGitignoreRemovals: string[] = [];
-  let anyLegacyTakeover = false;
-
-  for (const file of profile.leanCtx.files) {
-    const assetAbs = join(assetsDir, file.asset);
-    if (!existsSync(assetAbs)) {
-      throw new Error(`agent-settings lean-ctx asset not found: ${assetAbs}`);
-    }
-    const content = readFileSync(assetAbs, "utf8");
-    const targetAbs = join(targetRepo, file.target);
-    const exists = existsSync(targetAbs);
-    let managedByUs = leanCtxOwned(lock, file.target);
-    // Set only when THIS run's legacy hash check (below) is what makes
-    // managedByUs true — that check already verified the file's exact
-    // bytes against the OLD engine's own lock, so unlike leanCtxOwned
-    // (our own lock's unverified "we wrote this at some point" record),
-    // there is no risk of undetected foreign/user content mixed in, and
-    // the file can be overwritten wholesale — the same as a fresh write,
-    // never through resolveLeanCtxWrite's cautious migration path (which
-    // exists precisely for the case this check has already ruled out).
-    let legacyVerifiedClean = false;
-
-    if (exists && !managedByUs) {
-      const currentContent = readFileSync(targetAbs, "utf8");
-      // Whole-file record (config.toml/layout.toml) first; the legacy engine
-      // recorded .agents/.gitignore differently (created/lines/appended, no
-      // sha256), so fall back to that comparison for whichever target it is.
-      if (legacyFileTakeover(currentContent, legacyDoc, file.target)) {
-        managedByUs = true;
-        legacyVerifiedClean = true;
-        legacyFileRemovals.push(file.target);
-        anyLegacyTakeover = true;
-      } else if (legacyTakeoverForGitignore(currentContent, legacyDoc, file.target)) {
-        managedByUs = true;
-        legacyVerifiedClean = true;
-        legacyGitignoreRemovals.push(file.target);
-        anyLegacyTakeover = true;
-      }
-    }
-
-    // Independent review, 2026-09-30, finding 6: this guard used to apply
-    // uniformly, so a user-authored .agents/.gitignore with no markers at
-    // all (never written by us — managedByUs false) hit a hard conflict
-    // right here, before resolveGitignoreWrite ever got a chance to run
-    // its own append-not-conflict migration. .gitignore is deliberately
-    // exempted: append is always safe there (a stray, harmless duplicate
-    // ignore line at worst), unlike config.toml/layout.toml where
-    // guessing at a foreign file's structure is not.
-    if (exists && !managedByUs && file.asset !== "gitignore") {
-      conflicts.push({ target: file.target, reason: "a user-owned file already exists at this path; deploy left it untouched" });
-      continue;
-    }
-
-    if (!exists || legacyVerifiedClean) {
-      if (!dryRun) {
-        mkdirSync(dirname(targetAbs), { recursive: true });
-        writeFileSync(targetAbs, content);
-      }
-      written.push(file.target);
-      newLeanCtxEntries[file.target] = true;
-      kept.push(file.target);
-      continue;
-    }
-
-    const currentContent = readFileSync(targetAbs, "utf8");
-    if (currentContent === content) {
-      unchanged.push(file.target);
-      newLeanCtxEntries[file.target] = true;
-      kept.push(file.target);
-      continue;
-    }
-
-    const outcome =
-      file.asset === "config.toml"
-        ? resolveConfigTomlWrite(content, currentContent, managedByUs)
-        : file.asset === "gitignore"
-          ? resolveGitignoreWrite(content, currentContent, managedByUs)
-          : resolveLeanCtxWrite(content, currentContent, managedByUs);
-    if (outcome.action === "conflict") {
-      // Still tracked as ours going forward (a fixed-up file can migrate
-      // or self-heal on a later run) but never written to now.
-      conflicts.push({ target: file.target, reason: outcome.reason });
-      newLeanCtxEntries[file.target] = true;
-      kept.push(file.target);
-      continue;
-    }
-    if (outcome.action === "unchanged") {
-      unchanged.push(file.target);
-    } else {
-      if (!dryRun) writeFileSync(targetAbs, outcome.text);
-      written.push(file.target);
-      for (const scalar of outcome.restoredScalars ?? []) {
-        restored.push({ target: file.target, key: scalar.key, value: scalar.value, previous: scalar.previous });
-      }
-    }
-    newLeanCtxEntries[file.target] = true;
-    kept.push(file.target);
-  }
-
-  for (const target of Object.keys(lock.leanCtx)) {
-    if (kept.includes(target)) continue;
-    const targetAbs = join(targetRepo, target);
-    if (!dryRun && existsSync(targetAbs)) unlinkSync(targetAbs);
-    removed.push(target);
-  }
-
-  if (!dryRun) writeLock(targetRepo, { schema: 1, mcp: lock.mcp, agents: lock.agents, leanCtx: newLeanCtxEntries });
-
-  // Once anything was actually taken over, this package's own footprint in
-  // the legacy lock (these exact `files` entries and/or the `.agents/.gitignore`
-  // `gitignore` entry) is stale: ownership has fully moved to
-  // .agents/agent-settings.lock.json just written above. A legacy lock
-  // present but untouched by any takeover (no hash matched, or this repo
-  // never had one) is left exactly as found.
-  if (!dryRun && anyLegacyTakeover && legacyDoc !== undefined && legacyLockPath !== undefined) {
-    stripLegacyOwnership(legacyDoc, legacyLockPath, { files: legacyFileRemovals, gitignore: legacyGitignoreRemovals });
-  }
-
-  return {
-    written: written.sort(),
-    unchanged: unchanged.sort(),
-    removed: removed.sort(),
-    conflicts: conflicts.sort((a, b) => a.target.localeCompare(b.target)),
-    lockPath: join(targetRepo, ".agents/agent-settings.lock.json"),
-    restored,
-  };
-}