@devtrack-solution/codesdd 1.2.4-rc3 → 1.2.4

package/README.md

@@ -31,6 +31,7 @@ Os documentos canonicos desta fronteira ficam em `docs/`:
 
 - [docs/CREDITS.md](docs/CREDITS.md): reconhecimento conceitual e fronteira clean-room (fora do fluxo operacional).
 - [docs/THIRD_PARTY_NOTICES.md](docs/THIRD_PARTY_NOTICES.md): notices tecnicos/licencas para dependencias runtime.
+- [docs/service-catalog-maturity-epic-0097.md](docs/service-catalog-maturity-epic-0097.md): scorecard e guardrails da maturidade 5 do catalogo de servicos.
 - [positioning.md](positioning.md): narrativa de posicionamento enterprise do CodeSDD.
 
 ## O que o CodeSDD faz
@@ -73,6 +74,7 @@ Para a iniciativa EPIC-0065, o projeto formaliza a seguinte fronteira canonica:
 - CodeSDD e o control plane soberano: estado canonico (`.sdd/state/*.yaml`), lifecycle, EPIC/FEAT, ADR, politicas, qualidade, evidencia e finalize.
 - DeepAgents e execution plane governado: planejamento tatico, delegacao de subagentes, execucao em sandbox, memoria tatica controlada e coleta de evidencia estruturada.
 - Plugins operam como plano de construcao deterministico via broker e envelopes; Reversa opera como pipeline especializado de engenharia reversa.
+- Reversa URL opera como superficie governada de frontend renderizado: `codesdd sdd reversa url <url>` exige aceite legal, escopo de autorizacao, intake guiado, stack alvo, limites de volumetria, politica de assets, boundary frontend-only e, quando solicitado, inventario redigido de contratos backend observados. Ele nao copia backend, bancos, credenciais, regras servidoras ou infraestrutura.
 - Planos de plugin standalone validam `package_governance`, runtime de linguagem e fronteira de storage antes de qualquer adaptador tratar a operacao como executavel.
 - O core agora possui uma casca Foundation-like incremental em `src/domains`, `src/applications`, `src/infrastructures`, `src/presentations` e `src/shared`; detalhes em `docs/codesdd-foundation-layer-migration.md`.
 - Gates de qualidade para SDK/agentes/plugins agregam governanca de pacote, runtime de linguagem, artifact map, planos DeepAgents/Codex/OpenCode, compliance de plugin e cobertura por escopo em `src/core/sdd/sdk-agent-plugin-quality-gates.ts`.
@@ -197,6 +199,47 @@ export CODESDD_REDIS_URL="redis://localhost:6379"
 
 Redis nunca deve armazenar estado canonico do projeto, chaves de API, tokens, senhas, respostas cruas de providers ou dados pessoais. Use `docs/redis-operations.md` para o runbook completo.
 
+### Provisionamento Enterprise de itens numerados
+
+Em modo Enterprise multiagente, DEB, INS, EPIC, FEAT e demais artefatos numerados devem usar uma autoridade online de provisionamento antes de qualquer escrita canonica. O modo local/single-agent continua usando o estado versionado em `.sdd` sem contato remoto obrigatorio.
+
+Configure a identidade do projeto e a autoridade em `~/.codesdd/config.toml`:
+
+```toml
+[enterprise.provisioning]
+mode = "enterprise"
+project_id = "proj_devtrack_tools"
+tenant_id = "tenant-main"
+authority_url_env = "CODESDD_ALLOCATOR_URL"
+required_for_numbered_artifacts = true
+```
+
+Mantenha a URL real no shell, password manager ou secret store:
+
+```bash
+export CODESDD_ALLOCATOR_URL="https://allocator.example.test"
+```
+
+`codesdd config doctor --json` expoe `enterprise_provisioning` com `disabled`, `ready` ou `blocked`. Quando Enterprise esta solicitado e falta `project_id` ou autoridade, o doctor bloqueia; quando a autoridade estiver indisponivel em execucao, agentes Enterprise devem criar apenas drafts nao canonicos ate uma reserva online posterior.
+
+O contrato inicial do allocator vive em `src/core/sdd/artifact-id-allocator.ts`. Ele define requests/responses versionados para reservar IDs canonicos (`INS`, `DEB`, `EPIC`, `FEAT`, `FGAP`, `TD`), gera idempotency keys deterministicas, retorna `reserved` na primeira reserva e `replayed` quando a mesma chave/payload e repetida. Reuso da mesma idempotency key com outro payload e conflito bloqueante.
+
+O mesmo contrato tambem define leases de allocator com TTL, fencing token monotônico e audit trail. Uma lease ativa bloqueia outra lease concorrente para o mesmo projeto/tipo de artefato; replay da mesma idempotency key retorna a lease original; fencing token expirado ou divergente falha antes de ser usado por gates de escrita nos FEATs seguintes.
+
+CAS de escrita canonica tambem e modelado no contrato: `commitCanonicalArtifactWrite` exige lease existente, fencing token valido e `expected_revision` igual a revisao atual do artefato. Repetir a mesma idempotency key/payload retorna `replayed`; token vencido, token divergente ou revisao stale gera rejeicao auditavel.
+
+O gate Enterprise de comandos mutantes vive em `src/core/sdd/enterprise-mutating-command-gate.ts`. Ele permite comandos read-only, bloqueia mutacoes numeradas Enterprise sem lease/fencing valido e marca tentativas de bypass como `bypass-detected` antes de avaliar o lease.
+
+Modo draft nao canonico tambem vive no contrato do allocator. `createNoncanonicalDraft` cria um identificador `draft_<tipo>_<hash>` que nunca entra na sequencia canonica; `convertDraftToCanonicalArtifact` exige uma reserva real do allocator, vincula o draft ao ID canonico e retorna `replayed` se a conversao ja tiver sido aplicada.
+
+Gates de provenance vivem em `src/core/sdd/enterprise-provenance-gates.ts`. Eles verificam se reservas, leases, writes canonicos e conversoes de draft possuem audit/provenance suficiente para `diagnose`, `check`, `finalize` e CI bloquearem estados sem trilha.
+
+Recovery do allocator vive em `src/core/sdd/allocator-recovery.ts`. Ele reconstrói counters a partir do histórico de reservas e reporta branch lag quando uma revisão local está atrás da revisão canônica observada.
+
+Segurança do allocator vive em `src/core/sdd/allocator-security.ts`, com decisões determinísticas para quota por tenant/tipo de artefato e replay fora da janela permitida.
+
+A carta arquitetural de EPIC-0084 vive em `.sdd/core/adrs/ADR-FEAT-0363.md` e mapeia cada FEAT do fechamento para seu contrato, evidencia primaria e risco residual. Use essa matriz como trilha de auditoria antes de adicionar transporte remoto, persistencia ou wiring de comandos mutantes.
+
 ## Contrato de nomenclatura
 
 O contrato canonico de identidade do produto vive em `.sdd/state/naming-contract.yaml`
@@ -289,6 +332,9 @@ Se o terminal nao encontrar `codesdd`, a instalacao provavelmente foi concluida,
 - Em shell Zsh, `codesdd config init` garante um bloco idempotente no `~/.zshrc` para `source ~/.codesdd/env.zsh`.
 - A fronteira funcional e validavel: estado versionado do projeto fica em `.sdd`; config/runtime/cache comum fica em `~/.codesdd`; `.codesdd` dentro do repositorio e invalido para novo estado.
 - `codesdd config doctor --json` expoe `storage_boundary` com `project_state_dir`, `global_runtime_dir`, `global_cache_dir`, tiers de cache e regras de separacao.
+- `codesdd config doctor --json` tambem expoe `generated_instructions`, que aponta skills/prompts gerados sem o anuncio `CodeSDD Canonical Workflow`; quando `status=stale`, rode `codesdd update` ou reinstale as ferramentas afetadas.
+- `codesdd config doctor --json` tambem expoe `enterprise_provisioning`, que valida identidade de projeto e autoridade online obrigatoria para artefatos numerados em modo Enterprise multiagente.
+- O contrato de reserva de IDs canonicos fica em `src/core/sdd/artifact-id-allocator.ts`; ele e propositalmente puro/testavel e ainda nao substitui os gates de lease/CAS/mutating commands dos FEATs dependentes.
 - `codesdd sdd plugin plan --project-root <path>` reutiliza essa fronteira para bloquear writes de plugin em `.codesdd` local e expor `workcell_runner.standalone.storage_boundary`.
 - O perfil gerado por `codesdd config init` e fail-closed: DeepAgents fica
   desabilitado, runtime `disabled`, provider smoke `0` e rede `disabled` ate
@@ -390,16 +436,37 @@ docs de release/seguranca.
 Entre no repositorio onde voce quer usar o sistema e rode:
 
 ```bash
-codesdd install --tools none
+codesdd sdd init-context
+```
+
+O `init-context` e o primeiro comando de capacidade CodeSDD dentro do projeto: ele inspeciona a base, cria/atualiza `.sdd/`, preenche contexto inicial de arquitetura, stack, servicos e mapa do repositorio, e deixa o projeto pronto para operar com estado canonico. Em um projeto recem-inicializado, valide e leia o onboarding antes do primeiro trabalho:
+
+```bash
+codesdd sdd check --render
+codesdd sdd onboard system
 ```
 
-Para ja nascer com nomenclatura mais intuitiva em portugues nas pastas do SDD:
+O `sdd check --render` separa ruido historico de pendencia real. Para frontend,
+use `Gaps de frontend abertos` como indicador operacional de trabalho pendente;
+`Gaps de frontend resolvidos/historicos` e `Gaps de frontend total historico`
+preservam auditoria de FGAPs ja fechados. Para lock domains, apenas
+`Lock domains compartilhados ativos` indica risco de paralelizacao atual;
+locks compartilhados historicos/mistos sao contexto de auditoria e nao devem
+ser tratados como blocker por si so.
+
+Depois disso, o primeiro trabalho normalmente comeca assim:
 
 ```bash
-codesdd install --tools none --lang pt-BR --layout pt-BR
+codesdd sdd insight "descreva a mudanca ou iniciativa"
 ```
 
-Se quiser integrar ferramentas suportadas no bootstrap:
+Se quiser fixar idioma/layout em portugues:
+
+```bash
+codesdd sdd init-context --lang pt-BR --layout pt-BR
+```
+
+Se quiser gerar assets de assistente explicitamente para agentes como Codex, Claude, Cursor ou OpenCode, use `install --tools` depois que o projeto tiver contexto CodeSDD:
 
 ```bash
 codesdd install --tools all
@@ -411,21 +478,19 @@ Ou somente algumas:
 codesdd install --tools codex,cursor,claude
 ```
 
-Esse comando instala de uma vez:
+Para OpenCode, use `--tools opencode` para instalar skills/prompts gerados. O provider MCP do bridge SDD usa outro id: `--provider open-code`.
+
+O `init-context` prepara a base CodeSDD do projeto:
 
-- a base do runtime
 - `.sdd/config.yaml`
 - `.sdd/`
-- skills curadas
-- prompts recomendados por workflow
-- templates
 - estados YAML canonicos
 - documentos iniciais do projeto
 
-Se voce nao quiser habilitar frontend no bootstrap:
+Se voce nao quiser habilitar frontend na inicializacao de contexto:
 
 ```bash
-codesdd install --tools none --no-frontend
+codesdd sdd init-context --no-frontend
 ```
 
 Atalhos em portugues no CLI:
@@ -438,15 +503,21 @@ Atalhos em portugues no CLI:
 
 ## Como absorver um projeto que ja existe
 
-Se o projeto ja esta em andamento, o primeiro passo depois do `install` e inicializar o contexto:
+Se o projeto ja esta em andamento, rode o mesmo comando na raiz:
 
 ```bash
-codesdd sdd init-context --frontend --lang en-US --layout en-US
+codesdd sdd init-context
 codesdd sdd check --render
 codesdd sdd onboard system
 ```
 
-O `init-context` serve para:
+O `init-context` detecta marcadores de codigo existente e executa a absorcao inicial de contexto. Para reabsorver de forma controlada depois que o projeto ja estiver governado, rode o mesmo comando com as opcoes necessarias:
+
+```bash
+codesdd sdd init-context --frontend --lang en-US --layout en-US
+```
+
+Esse comando serve para:
 
 - inspecionar a base existente
 - preencher contexto inicial de arquitetura, stack, servicos e mapa do repositorio
@@ -734,8 +805,10 @@ do ciclo de vida.
 
 Perfis aceitos por `--provider`: `codex`, `claude-code`, `kimmy-code`,
 `kilo-code`, `open-code` e `generic`. Para OpenCode/Open Code, o bridge MCP usa
-o identificador `open-code`; `opencode` aparece em contratos antigos de
-agent-binding e nao e aceito por `sdd mcp-manifest` neste runtime.
+o identificador `open-code`. Use `opencode` apenas como id tecnico de assets
+gerados por `codesdd install --tools opencode` e em contratos de runtime
+OpenCode que executam o binario `opencode`; esse id nao e aceito por
+`sdd mcp-manifest` neste runtime.
 
 Matriz de provedores: consulte
 [docs/mcp-provider-compatibility.md](docs/mcp-provider-compatibility.md),
@@ -960,15 +1033,19 @@ Entre elas:
 - `frontend-extractor-sdd`
 - `planning-normalizer-sdd`
 - `api-clean-flask-langgraph` (bundle `python-agentic-backend`)
-- `devtrack-api` (bundle `architecture-backend`, canonical DevTrack/NestJS/TypeORM API architecture)
+- `devtrack-api` (bundle `architecture-backend`, compatibility binding for Foundation-derived CodeSDD API profiles)
 - `devtrack-angular` (bundle `frontend-product`, canonical DevTrack Angular Admin architecture)
 - `devtrack-flutter` (bundle `frontend-product`, canonical DevTrack Flutter/Dart architecture)
 
-Skill routing is operational, not decorative. When `codesdd sdd context <FEAT-ID>` returns `recommended_skills`, or when a user explicitly directs a skill, the agent must read and follow that skill before implementation and record one `skill_evidence` entry per required skill in `.sdd/active/<FEAT-ID>/5-quality.yaml` before finalize. For API/backend work without an explicit alternative skill/profile, `devtrack-api` is the default architecture and naming source. Angular Admin/backoffice work that names admin pages, dashboards, CRUD, data grids, admin Formly, admin NGXS/state, official Angular framework patterns, permissions, reports, workflow, admin realtime, or admin chat uses `devtrack-angular`. Flutter/Dart work that names Flutter apps, widgets, routing, localization, responsive layout, JSON, HTTP, previews, widget tests, integration tests, go_router, ARB, or l10n uses `devtrack-flutter`. Explicit Python/Flask API work remains routed to `api-clean-flask-langgraph`.
+Skill routing is operational, not decorative. When `codesdd sdd context <FEAT-ID>` returns `recommended_skills`, or when a user explicitly directs a skill, the agent must read and follow that skill before implementation and record one `skill_evidence` entry per required skill in `.sdd/active/<FEAT-ID>/5-quality.yaml` before finalize. For API/backend work without an explicit alternative skill/profile, select one CodeSDD API profile: `minimal-rest`, `rest-auth-rbac`, `rest-crud-typeorm`, `evented-api`, `ai-agent-api`, or `full-foundation-compatible`; `devtrack-api` remains the compatibility skill/alias. Angular Admin/backoffice work that names admin pages, dashboards, CRUD, data grids, admin Formly, admin NGXS/state, official Angular framework patterns, permissions, reports, workflow, admin realtime, or admin chat uses `devtrack-angular`. Flutter/Dart work that names Flutter apps, widgets, routing, localization, responsive layout, JSON, HTTP, previews, widget tests, integration tests, go_router, ARB, or l10n uses `devtrack-flutter`. Explicit Python/Flask API work remains routed to `api-clean-flask-langgraph`.
 
 The `devtrack-api` skill has a Foundation-layout conformance test. When the Foundation checkout is not at `/Volumes/WORKSPACE/DEVTRACK_TOOLS/devtrack-foundation-api`, set `CODESDD_FOUNDATION_API_ROOT=/path/to/devtrack-foundation-api` before running `pnpm test -- test/specs/devtrack-api-foundation-layout.test.ts`.
 
-The executable `devtrack-api` contract pack lives in `.sdd/skills/curated/devtrack-api/references/contract-pack.yaml`. It defines the `prototype`, `foundation-compatible`, and `enterprise-strict` profiles, P0/P1/P2 severity semantics, early package-preview expectations, import/alias and TypeORM drift rules, and the `codesdd-validate` plus field-evidence drift maps consumed by later governance gates.
+That conformance test now checks the live Foundation BO and TypeORM topology: aggregate `.bo.ts` files must use `extends GenericBusinessObject<T>` followed by `implements <Name>Interface, IValidator`, and persistence wiring must use `src/infrastructure/adapters/orm/typeorm.module.ts` plus context modules such as `<context>-orm.module.ts`.
+
+The executable `devtrack-api` contract pack lives in `.sdd/skills/curated/devtrack-api/references/contract-pack.yaml`. It defines the `prototype`, `foundation-compatible`, and `enterprise-strict` profiles, P0/P1/P2 severity semantics, early package-preview expectations, import/alias and TypeORM drift rules, mandatory `cleanup`/`cleanup:install` plus port-safe `start`/`start:dev` bootstrap scripts for linked/generated API projects, and the `codesdd-validate` plus field-evidence drift maps consumed by later governance gates.
+
+The EPIC-0080 dual-boundary charter lives in `.sdd/core/adrs/ADR-FEAT-0373.md`. It freezes the rule that CodeSDD keeps plural internal layer roots for this CLI repository while every `devtrack-api` preview, artifact map, validator, and generated output must target singular Foundation-compatible roots. For this EPIC, `human_validation_gate.status` is limited to `approved`, `corrected`, `pending`, or `rejected`; any material source, profile, exception, or validator change invalidates prior approval back to `pending` until a human re-approves it.
 
 The executable `devtrack-angular` contract pack lives in `.sdd/skills/curated/devtrack-angular/references/contract-pack.yaml`. It defines portable agent adapters, `prototype`, `production-admin`, and `enterprise-admin` profiles, pages-first Angular Admin architecture rules, Formly/NGXS/realtime/admin gates, official Angular skills mapping, and evidence expectations for Angular Admin delivery.
 
@@ -978,6 +1055,8 @@ Consumer copies of `devtrack-api` are one-way CodeSDD materializations, not dura
 
 Field validation for `devtrack-api` is governed by `.sdd/skills/curated/devtrack-api/references/field-validation-protocol.md`. A consumer project must keep its own evidence showing at least two detailed implementation debates and closure of divergence classes D-01 through D-08; CodeSDD keeps the protocol and external reference, not private consumer ledgers.
 
+Legacy generated `devtrack-api` previews, scaffold dry-runs, caches, artifact maps, validator results, and evidence bundles are governed by `.sdd/skills/curated/devtrack-api/references/generated-artifact-invalidation.md`. Pre-EPIC-0080 generated artifacts are noncanonical by default and must be classified as `revalidated`, `invalidated`, `grandfathered`, or `not_applicable` before supporting any Foundation-compatible claim.
+
 Prompts recomendados tambem sao instalados em:
 
 ```text
@@ -1007,13 +1086,11 @@ Um agente novo deve seguir esta ordem:
 
 ## Comandos principais
 
-Bootstrap:
+Inicializacao e reparo de projeto:
 
-- `codesdd install --tools none`
-- `codesdd install --tools all`
-- `codesdd reload --tools none`
 - `codesdd sdd init-context`
 - `codesdd sdd init-context --frontend --lang en-US --layout en-US`
+- `codesdd reload --tools none`
 - `codesdd sdd check --render`
 - `codesdd sdd check --render --strict`
 - `codesdd sdd diagnose`
@@ -1035,6 +1112,12 @@ Bootstrap:
 - `codesdd sdd lint feature FEAT-0001 --strict --json`
 - `codesdd sdd ingest-deposito`
 
+Assets de agentes:
+
+- `codesdd install --tools none` (nao gera assets de agentes)
+- `codesdd install --tools all`
+- `codesdd install --tools opencode` (assets OpenCode; MCP continua `--provider open-code`)
+
 Onboarding e operacao:
 
 - `codesdd sdd onboard system`
@@ -1049,6 +1132,11 @@ Onboarding e operacao:
 - `codesdd sdd audit`
 - `codesdd sdd finalize --ref FEAT-0001`
 
+Absorcao de contexto:
+
+- `codesdd sdd init-context`
+- `codesdd sdd init-context --frontend --lang en-US --layout en-US`
+
 Descoberta:
 
 - `codesdd sdd insight "..."`
@@ -1092,7 +1180,16 @@ pnpm run dev:cli
 
 O repositório instala automaticamente um hook de `pre-commit` local via `.githooks/` durante `pnpm install`. Esse hook chama `node scripts/pre-commit-sdd-fast.mjs`, inspeciona arquivos staged e roda `codesdd sdd check --strict` somente quando houver arquivos `.sdd/` no commit. Para a validacao completa antes de PR/release, rode `pnpm run sdd:validate`.
 
-A matriz autoritativa de cobertura da CLI fica em `src/core/cli/command-matrix.ts`. Sempre que um novo leaf command for registrado, atualize a matriz junto para explicitar se a cobertura esperada e `contract`, `spawned-e2e` ou `exception`.
+A matriz autoritativa de cobertura e taxonomia publica da CLI fica em `src/core/cli/command-matrix.ts`. Sempre que um novo leaf command for registrado, atualize a matriz junto para explicitar se a cobertura esperada e `contract`, `spawned-e2e` ou `exception`, e classifique o comando como lifecycle canonico, bootstrap/repair, compatibilidade, migracao, diagnostico/governanca ou interno.
+
+Harness pratico de comandos:
+
+```bash
+pnpm exec vitest run test/helpers/practical-api-fixture.test.ts
+pnpm exec vitest run --testTimeout 120000 test/e2e/practical-api-command-system.test.ts
+```
+
+Esse harness cria uma API ficticia `proposal-builder-api` em diretorio temporario, isola `HOME`, `USERPROFILE`, `XDG_*`, `CODEX_HOME` e flags de runtime, e valida um ciclo real do CodeSDD com exatamente um `INS`, um `DEB`, um `EPIC` e um `FEAT`. A cobertura da matriz publica deve terminar sem comandos faltantes: cada caminho fica marcado como `executed`, `dry_run`, `alias_covered` ou `skipped_external` com motivo explicito.
 
 ## Estado atual da distribuicao
 
@@ -1158,7 +1255,7 @@ Initial operational directives:
 - CodeSDD is the official planner for any build request; other planners or agent-native plans are secondary execution aids only.
 - In initialized CodeSDD repositories, any user request that implies implementation, file edits, validation, execution, or finalize must be treated as requiring CodeSDD planning unless the user explicitly marks it as read-only or outside CodeSDD.
 - For change requests, agents must bind the work to an active or ready FEAT through `codesdd sdd next` and `codesdd sdd context <FEAT-ID>` before implementation; agent-native plans may only decompose execution after that CodeSDD context exists.
-- For API/backend work, use `devtrack-api` by default unless the user or SDD context explicitly selects another skill/profile; Python/Flask API work stays routed to `api-clean-flask-langgraph`.
+- For API/backend work, select a CodeSDD API profile (`minimal-rest`, `rest-auth-rbac`, `rest-crud-typeorm`, `evented-api`, `ai-agent-api`, or `full-foundation-compatible`); `devtrack-api` remains the compatibility skill/alias and Python/Flask API work stays routed to `api-clean-flask-langgraph`.
 - During init, onboard, insight, and debate flows, CodeSDD-managed agent instruction blocks must be inspected and reconfigured when they drift from this contract.
 - Commit requests must follow Conventional Commits, selective staging, and grouping by modified directory plus change protocol (`src`, `.sdd`, docs, config, infra, dependencies, or generated files).
 

package/dist/cli/program.js

@@ -1,10 +1,11 @@
 import { Command } from 'commander';
 import { createRequire } from 'module';
 import ora from 'ora';
+import chalk from 'chalk';
 import path from 'path';
 import { promises as fs } from 'fs';
-import { AI_TOOLS } from '../core/config.js';
-import { CLI_NAME } from '../core/branding.js';
+import { AI_TOOLS, getToolInstallGuidance } from '../core/config.js';
+import { CLI_NAME, CLI_PRODUCT_NAME } from '../core/branding.js';
 import { UpdateCommand } from '../core/update.js';
 import { ListCommand } from '../core/list.js';
 import { ArchiveCommand } from '../core/archive.js';
@@ -108,6 +109,114 @@ export function createCliProgram(options = {}) {
             return value;
         throw new Error(`Invalid value for --layout: "${value}". Use en-US, legacy, or pt-BR.`);
     }
+    async function detectExistingCodebase(projectRoot) {
+        const markers = [
+            'package.json',
+            'pnpm-workspace.yaml',
+            'tsconfig.json',
+            'pyproject.toml',
+            'requirements.txt',
+            'go.mod',
+            'Cargo.toml',
+            'pom.xml',
+            'build.gradle',
+            'pubspec.yaml',
+            'src',
+            'test',
+            'tests',
+            'docs',
+            'README.md',
+            '.github',
+        ];
+        const entries = await fs.readdir(projectRoot).catch(() => []);
+        const visibleEntries = entries.filter((entry) => !['.sdd', '.git', '.codex', '.claude', '.cursor', '.opencode'].includes(entry));
+        return markers.some((marker) => visibleEntries.includes(marker));
+    }
+    async function resolveInstallPrimaryNextAction(projectRoot) {
+        try {
+            const { loadProjectSddConfig, loadStateSnapshot, resolveSddPaths } = await import('../core/sdd/state.js');
+            const config = await loadProjectSddConfig(projectRoot);
+            const paths = resolveSddPaths(projectRoot, config);
+            const snapshot = await loadStateSnapshot(paths, config);
+            const activeFeature = snapshot.backlog.items.find((item) => item.status === 'IN_PROGRESS');
+            if (activeFeature) {
+                return `${CLI_NAME} sdd context ${activeFeature.id}`;
+            }
+            const readyFeature = snapshot.backlog.items.find((item) => item.status === 'READY');
+            if (readyFeature) {
+                return `${CLI_NAME} sdd start ${readyFeature.id}`;
+            }
+            const openDebate = snapshot.discoveryIndex.records.find((record) => record.type === 'DEB' && record.status === 'OPEN');
+            if (openDebate) {
+                return `${CLI_NAME} sdd decide ${openDebate.id} --outcome epic`;
+            }
+            const hasInsight = snapshot.discoveryIndex.records.some((record) => record.type === 'INS');
+            if (!hasInsight) {
+                return `${CLI_NAME} sdd insight "describe the change or initiative"`;
+            }
+            return `${CLI_NAME} sdd next`;
+        }
+        catch {
+            return `${CLI_NAME} sdd onboard system`;
+        }
+    }
+    function formatInstallDefaults(options) {
+        return {
+            tools: options?.tools ? `explicit:${options.tools}` : 'auto',
+            language: options?.lang ? `explicit:${options.lang}` : 'auto',
+            layout: options?.layout ? `explicit:${options.layout}` : 'auto',
+            frontend: options?.frontend === false ? 'disabled' : 'auto',
+            check: 'rendered',
+            onboard: 'synced',
+            announce: 'synced',
+            legacy: 'warn-only',
+        };
+    }
+    function resolveInstallToolIds(tools) {
+        if (!tools)
+            return [];
+        const raw = tools.trim().toLowerCase();
+        if (!raw || raw === 'none')
+            return [];
+        if (raw === 'all')
+            return availableToolIds;
+        return raw
+            .split(',')
+            .map((token) => token.trim())
+            .filter((token) => token.length > 0);
+    }
+    function displayFullInstallResult(result) {
+        console.log();
+        console.log(chalk.bold(`${CLI_PRODUCT_NAME} Setup Complete`));
+        console.log();
+        console.log(chalk.bold('Default-first engagement:'));
+        console.log(`  Mode: ${result.mode}`);
+        console.log(`  Tools: ${result.defaults.tools}`);
+        for (const note of result.toolNotes) {
+            console.log(`  ${note}`);
+        }
+        console.log(`  Language: ${result.defaults.language}`);
+        console.log(`  Layout: ${result.defaults.layout}`);
+        console.log(`  Frontend: ${result.frontendEnabled ? 'enabled' : 'disabled'} (${result.defaults.frontend})`);
+        console.log(`  Views generated: ${result.rendered ? 'yes' : 'no'}`);
+        console.log(`  Curated skills loaded: ${result.skillsSeeded}`);
+        console.log(`  Local skills generated: ${result.localSkillsMaterialized}`);
+        console.log(`  Tools synced: ${result.syncedTools.length > 0 ? result.syncedTools.join(', ') : 'none detected'}`);
+        if (result.mode === 'existing-codebase') {
+            const updatedKeys = Object.entries(result.contextUpdated)
+                .filter(([, updated]) => updated)
+                .map(([key]) => key);
+            console.log(`  Existing context absorbed: ${updatedKeys.length > 0 ? updatedKeys.join(', ') : 'no structural updates needed'}`);
+        }
+        console.log(`  Compatibility: ${result.defaults.legacy}`);
+        console.log();
+        console.log(chalk.bold('Primary next action:'));
+        console.log(`  ${result.primaryNextAction}`);
+        console.log();
+        console.log(chalk.dim(`Advanced checks: ${CLI_NAME} sdd onboard system | ${CLI_NAME} sdd check --render`));
+        console.log(chalk.dim('Compatibility slash commands may exist for older workflows; prefer CodeSDD SDD commands in .sdd-native projects.'));
+        console.log();
+    }
     async function runInitCommand(targetPath, options) {
         // Validate that the path is a valid directory
         const resolvedPath = path.resolve(targetPath);
@@ -142,15 +251,53 @@ export function createCliProgram(options = {}) {
         await initCommand.execute(targetPath);
     }
     async function runFullInstallCommand(targetPath, options) {
-        await runInitCommand(targetPath, options);
-        const { SddInitCommand } = await import('../core/sdd/init.js');
+        const resolvedPath = path.resolve(targetPath);
+        const existingCodebase = await detectExistingCodebase(resolvedPath);
+        await runInitCommand(targetPath, {
+            ...options,
+            allowNoToolsFallback: true,
+            interactive: false,
+            silent: true,
+        });
+        const { SddInitCommand, SddInitContextCommand } = await import('../core/sdd/init.js');
+        const language = normalizeSddLang(options?.lang);
+        const layout = normalizeSddLayout(options?.layout);
+        const frontendEnabled = options?.frontend ?? true;
         const sddInitCommand = new SddInitCommand();
-        await sddInitCommand.execute(targetPath, {
-            frontendEnabled: options?.frontend ?? true,
-            language: normalizeSddLang(options?.lang),
-            layout: normalizeSddLayout(options?.layout),
-            render: true,
+        const initResult = await sddInitCommand.execute(targetPath, {
+            frontendEnabled,
+            language,
+            layout,
+            render: !existingCodebase,
         });
+        let contextUpdated = {};
+        let rendered = initResult.rendered;
+        if (existingCodebase) {
+            const contextCommand = new SddInitContextCommand();
+            const contextResult = await contextCommand.execute(targetPath, {
+                mode: 'merge',
+                deep: true,
+                render: true,
+                frontendEnabled,
+                language,
+                layout,
+            });
+            contextUpdated = contextResult.sddBootstrap.updated;
+            rendered = contextResult.rendered;
+        }
+        return {
+            memoryDir: initResult.memoryDir,
+            frontendEnabled: initResult.frontendEnabled,
+            rendered,
+            skillsSeeded: initResult.skillsSeeded,
+            localSkillsMaterialized: initResult.localSkillsMaterialized,
+            syncedTools: initResult.syncedTools,
+            mode: existingCodebase ? 'existing-codebase' : 'new-project',
+            contextUpdated,
+            defaults: formatInstallDefaults(options),
+            toolNotes: getToolInstallGuidance(resolveInstallToolIds(options?.tools)),
+            primaryNextAction: await resolveInstallPrimaryNextAction(resolvedPath),
+        };
     }
     async function runReloadCommand(targetPath, options) {
         await runInitCommand(targetPath, {
@@ -254,7 +401,8 @@ export function createCliProgram(options = {}) {
         .option('--no-frontend', 'Disable frontend module in the SDD bootstrap')
         .action(async (targetPath = '.', options) => {
         try {
-            await runFullInstallCommand(targetPath, options);
+            const result = await runFullInstallCommand(targetPath, options);
+            displayFullInstallResult(result);
         }
         catch (error) {
             console.log();
@@ -640,6 +788,27 @@ export function createCliProgram(options = {}) {
 }
 export async function runCli(argv = process.argv) {
     const program = createCliProgram();
-    await program.parseAsync(argv);
+    try {
+        await program.parseAsync(argv);
+    }
+    catch (error) {
+        const rawMessage = error instanceof Error ? error.message : `${error}`;
+        const formattedMessage = /^error:/i.test(rawMessage) ? rawMessage : `Error: ${rawMessage}`;
+        const errorExitCode = typeof error === 'object' &&
+            error !== null &&
+            'exitCode' in error &&
+            typeof error.exitCode === 'number'
+            ? error.exitCode
+            : undefined;
+        console.error(formattedMessage);
+        if (typeof process.exitCode === 'number' && process.exitCode !== 0) {
+            return;
+        }
+        if (typeof errorExitCode === 'number' && Number.isInteger(errorExitCode) && errorExitCode > 0) {
+            process.exitCode = errorExitCode;
+            return;
+        }
+        process.exitCode = 1;
+    }
 }
 //# sourceMappingURL=program.js.map

package/dist/commands/config.js

@@ -7,9 +7,11 @@ import { getNestedValue, setNestedValue, deleteNestedValue, coerceValue, formatV
 import { CORE_WORKFLOWS, ALL_WORKFLOWS, getProfileWorkflows } from '../core/profiles.js';
 import { hasProjectConfigDrift } from '../core/profile-sync-drift.js';
 import { CLI_NAME } from '../core/branding.js';
+import { buildGeneratedInstructionDriftReport } from '../core/shared/tool-detection.js';
 import { resolveLegacySpecLiveRoot } from '../core/sdd/services/legacy-capability.service.js';
 import { buildRedisOperationalReport, deleteKeysByPrefix, RedisClientFactory, resolveRedisBoundaryConfig, runRedisBenchmark, } from '../core/sdd/coordination/index.js';
 import { buildCodesddStorageBoundaryReport } from '../core/sdd/runtime-boundary-contract.js';
+import { buildEnterpriseProvisioningPolicyReport } from '../core/sdd/enterprise-provisioning-policy.js';
 import { buildDeepAgentsOperationalPreflight, createDeepAgentsPolicySnapshot, } from '../core/sdd/deepagents/policy.js';
 import { detectShell } from '../utils/shell-detection.js';
 import { ZshInstaller } from '../core/completions/installers/zsh-installer.js';
@@ -267,8 +269,11 @@ export function registerConfigCommand(program) {
             env: process.env,
             globalConfig: getGlobalConfig(),
         });
+        const globalConfig = getGlobalConfig();
         const cacheTiers = getGlobalCacheTierDirs();
         const storageBoundary = buildCodesddStorageBoundaryReport(process.cwd());
+        const generatedInstructions = buildGeneratedInstructionDriftReport(process.cwd());
+        const enterpriseProvisioning = buildEnterpriseProvisioningPolicyReport(globalConfig, process.env);
         const report = {
             schema_version: 1,
             global_config_path: getGlobalConfigPath(),
@@ -277,6 +282,7 @@ export function registerConfigCommand(program) {
                 tiers: Object.keys(cacheTiers),
             },
             storage_boundary: storageBoundary,
+            generated_instructions: generatedInstructions,
             redis: {
                 requested: redisReport.requested,
                 namespace: redisReport.namespace,
@@ -288,6 +294,7 @@ export function registerConfigCommand(program) {
                 validation_errors: redisReport.validation_errors,
                 warnings: redisReport.warnings,
             },
+            enterprise_provisioning: enterpriseProvisioning,
             deepagents: preflight,
         };
         if (options.json) {
@@ -299,6 +306,13 @@ export function registerConfigCommand(program) {
             console.log(`Cache tiers: ${report.cache.tiers.join(', ')}`);
             console.log(`Project state: ${report.storage_boundary.project_state_dir}`);
             console.log(`Global runtime: ${report.storage_boundary.global_runtime_dir}`);
+            console.log(`Generated instructions: ${generatedInstructions.status} (checked=${generatedInstructions.checked_count}, stale=${generatedInstructions.stale_count})`);
+            for (const warning of generatedInstructions.warnings) {
+                console.log(`- ${warning}`);
+            }
+            for (const staleFile of generatedInstructions.stale_files.slice(0, 10)) {
+                console.log(`- stale ${staleFile.kind}: ${staleFile.path}`);
+            }
             console.log(`Redis: ${report.redis.status} (namespace=${report.redis.namespace}, fallback=${report.redis.fallback})`);
             if (report.redis.redacted_url) {
                 console.log(`Redis URL: ${report.redis.redacted_url}`);
@@ -313,12 +327,24 @@ export function registerConfigCommand(program) {
             for (const error of report.redis.validation_errors) {
                 console.log(`- ${error}`);
             }
+            const enterpriseRequestedMode = enterpriseProvisioning.requested_mode ?? enterpriseProvisioning.mode;
+            const enterpriseEffectiveMode = enterpriseProvisioning.effective_mode ?? (enterpriseProvisioning.requested ? 'enterprise' : 'local');
+            const localModeExceptionAccepted = enterpriseProvisioning.local_mode_exception_accepted ?? !enterpriseProvisioning.requested;
+            console.log(`Enterprise provisioning: ${enterpriseProvisioning.status}`);
+            console.log(`Enterprise requested mode: ${enterpriseRequestedMode}`);
+            console.log(`Enterprise effective mode: ${enterpriseEffectiveMode}`);
+            console.log(`Enterprise local-mode exception accepted: ${localModeExceptionAccepted ? 'yes' : 'no'}`);
+            console.log(`Enterprise provisioning reason: ${enterpriseProvisioning.reason}`);
+            console.log(`Enterprise provisioning next action: ${enterpriseProvisioning.next_action}`);
+            for (const error of enterpriseProvisioning.validation_errors) {
+                console.log(`- ${error}`);
+            }
             console.log(`DeepAgents preflight: ${preflight.status}`);
             for (const reason of preflight.reasons) {
                 console.log(`- ${reason}`);
             }
         }
-        if (preflight.status === 'blocked' || redisReport.status === 'blocked') {
+        if (preflight.status === 'blocked' || redisReport.status === 'blocked' || enterpriseProvisioning.status === 'blocked') {
             process.exitCode = 1;
         }
     });