@evo-dev/core 0.0.1-alpha → 0.0.1-alpha.1

package/src/index.ts

@@ -2,6 +2,7 @@ export * from "./agents/index.ts";
 export * from "./assets/index.ts";
 export * from "./config/index.ts";
 export * from "./daemon/index.ts";
+export * from "./evolution/index.ts";
 export * from "./hooks/index.ts";
 export * from "./learning/index.ts";
 export * from "./observability/index.ts";
@@ -9,6 +10,9 @@ export * from "./pack/index.ts";
 export * from "./plugins/index.ts";
 export * from "./project/index.ts";
 export * from "./protected-zones/index.ts";
+export * from "./runtime-logs/index.ts";
 export * from "./sync/index.ts";
 export * from "./task/index.ts";
+export * from "./team/index.ts";
+export * from "./team/mcp.ts";
 export * from "./workflow/index.ts";

package/src/pack/index.ts

@@ -107,7 +107,7 @@ export interface PackInstallDryRunPlan {
   riskyCapabilities: string[];
   verificationPlan: string[];
   uninstallPlan: string[];
-  blockers: string[];
+  advisories: string[];
   warnings: string[];
 }
 
@@ -125,7 +125,7 @@ const RISKY_PERMISSION_LABELS: Record<keyof PackPermissions, string> = {
   readsSourceContent: "reads source content",
   readsProjectMetadata: "reads project metadata",
 };
-const FIRST_SLICE_DENIED_PERMISSIONS: Array<keyof PackPermissions> = [
+const FIRST_SLICE_OUT_OF_SCOPE_PERMISSIONS: Array<keyof PackPermissions> = [
   "writesProjectFiles",
   "usesHooks",
   "usesNetwork",
@@ -203,14 +203,14 @@ export async function planPackInstallDryRun(
   const manifest = validation.manifest;
   const plannedWrites: PackInstallAction[] = [];
   const warnings: string[] = [];
-  const blockers = validation.findings
+  const advisories = validation.findings
     .filter((finding) => finding.severity === "error")
     .map(
       (finding) => `${finding.code}${finding.path ? ` ${finding.path}` : ""}: ${finding.message}`,
     );
 
   if (manifest === undefined) {
-    blockers.push("Cannot plan install because PACK.json is invalid or missing.");
+    advisories.push("Cannot plan install because PACK.json is invalid or missing.");
   } else {
     const permissions = normalizePackPermissions(manifest.permissions);
     if (!permissions.writesUserConfig) {
@@ -249,7 +249,7 @@ export async function planPackInstallDryRun(
             "confirmation required before future uninstall",
             "deleteUserContent=false; customizations and user content must be preserved",
           ],
-    blockers,
+    advisories,
     warnings,
   };
 }
@@ -359,7 +359,7 @@ export function formatPackValidation(result: PackValidationResult): string {
       : `Pack: ${manifest.id}@${manifest.version} (${manifest.name})`,
     `Assets: ${result.assets.length}`,
     `Scanned paths: ${result.scannedPaths.length}`,
-    `Protected-zone blockers: ${result.protectedZoneFindings.length}`,
+    `Protected-zone advisories: ${result.protectedZoneFindings.length}`,
     "",
     "Findings:",
     ...(result.findings.length === 0
@@ -380,7 +380,7 @@ export function formatPackInstallDryRun(plan: PackInstallDryRunPlan): string {
       ? "Pack: unknown"
       : `Pack: ${manifest.id}@${manifest.version} (${manifest.name})`,
     "Mode: dry-run (no writes)",
-    `Status: ${plan.blockers.length === 0 ? "PASS" : "FAIL"}`,
+    `Status: ${plan.advisories.length === 0 ? "PASS" : "ADVISORY"}`,
     "",
     `Source: ${plan.validation.source}`,
     "",
@@ -417,7 +417,7 @@ export function formatPackInstallDryRun(plan: PackInstallDryRunPlan): string {
     ...(plan.validation.protectedZoneFindings.length === 0
       ? ["  - PASS"]
       : plan.validation.protectedZoneFindings.map(
-          (finding) => `  - BLOCKER ${finding.ruleId} ${finding.path}: ${finding.reason}`,
+          (finding) => `  - ADVISORY ${finding.ruleId} ${finding.path}: ${finding.reason}`,
         )),
     "",
     "Verification plan:",
@@ -435,10 +435,10 @@ export function formatPackInstallDryRun(plan: PackInstallDryRunPlan): string {
       ? ["  - none"]
       : plan.warnings.map((warning) => `  - ${warning}`)),
     "",
-    "Blockers:",
-    ...(plan.blockers.length === 0
+    "Advisories:",
+    ...(plan.advisories.length === 0
       ? ["  - none"]
-      : plan.blockers.map((blocker) => `  - ${blocker}`)),
+      : plan.advisories.map((advisory) => `  - ${advisory}`)),
   ].join("\n");
 }
 
@@ -502,11 +502,11 @@ function validatePermissionBoundaries(
   findings: PackValidationFinding[],
 ): void {
   const permissions = normalizePackPermissions(manifest.permissions);
-  for (const permission of FIRST_SLICE_DENIED_PERMISSIONS) {
+  for (const permission of FIRST_SLICE_OUT_OF_SCOPE_PERMISSIONS) {
     if (permissions[permission]) {
       findings.push({
         severity: "error",
-        code: "permission-denied-first-slice",
+        code: "permission-out-of-scope-first-slice",
         message: `${permission} is outside I6 local validate/install dry-run scope.`,
       });
     }

package/src/plugins/capabilities.ts

@@ -11,7 +11,7 @@ export interface PluginCapabilityNegotiation {
   hooks: CapabilityState;
   canPlanWrites: boolean;
   warnings: string[];
-  blockers: string[];
+  advisories: string[];
 }
 
 export interface CodexCapabilityVerificationArtifact {
@@ -34,9 +34,9 @@ export interface CodexCapabilityVerificationArtifact {
     version: string | null;
   };
   capabilities: {
-    skills: "unverified";
-    agents: "unverified";
-    hooks: "unverified";
+    skills: "plugin-bundled";
+    agents: "user-level-toml-sync";
+    hooks: "plugin-manifest-hooks";
   };
   writeBoundary: {
     writesAllowed: false;
@@ -55,7 +55,7 @@ export interface CodexCapabilityVerificationArtifact {
     secretsStored: false;
     externalUpload: false;
   };
-  blockers: string[];
+  advisories: string[];
   diagnostics: string[];
   evidenceRefs: string[];
   evidence: {
@@ -74,7 +74,7 @@ export function createUnknownNegotiatedCapabilities(pluginId: string): PluginCap
     hooks: "unsupported",
     canPlanWrites: false,
     warnings: [],
-    blockers: [`Plugin ${pluginId} capabilities are unknown and unsupported.`],
+    advisories: [`Plugin ${pluginId} capabilities are unknown and unsupported.`],
   };
 }
 
@@ -82,12 +82,6 @@ export function isCapabilityUsable(state: CapabilityState): boolean {
   return state === "enabled";
 }
 
-export function assertNoUnverifiedWrites(negotiation: PluginCapabilityNegotiation): void {
-  if (!negotiation.canPlanWrites) {
-    throw new Error(`Plugin ${negotiation.pluginId} has no verified enabled write capabilities.`);
-  }
-}
-
 export function negotiatePluginCapabilities(input: {
   pluginId: string;
   declared: CodeAgentCapabilities;
@@ -95,29 +89,27 @@ export function negotiatePluginCapabilities(input: {
   enabled: boolean;
 }): PluginCapabilityNegotiation {
   if (input.pluginId === "codex") {
-    const declaredSupport = [
-      input.declared.skills.supported ? "skills" : null,
-      input.declared.agents.supported ? "agents" : null,
-      input.declared.hooks.supported ? "hooks" : null,
-    ].filter(Boolean);
-    const blockers = ["Codex capabilities are unverified; writes are unsupported in I10."];
+    const advisories: string[] = [];
     const warnings = [
       input.verified
-        ? "Codex readonly verification artifact exists; sync remains no-write until formats are verified."
+        ? "Codex metadata-only verification artifact exists; implemented Codex skill/agent distribution remains governed by adapter tests."
+        : null,
+      input.declared.skills.supported
+        ? "Codex skills are distributed through the EvoDev Codex plugin bundle, not direct user-directory skill sync."
         : null,
-      declaredSupport.length > 0
-        ? `Codex declares ${declaredSupport.join(", ")} support, but declared support alone cannot authorize writes.`
+      input.declared.agents.supported
+        ? "Codex agents can sync to user-level TOML files with no-overwrite semantics."
         : null,
     ].filter((warning): warning is string => warning !== null);
 
     return {
       pluginId: input.pluginId,
-      skills: input.declared.skills.supported ? "unverified" : "unsupported",
-      agents: input.declared.agents.supported ? "unverified" : "unsupported",
-      hooks: input.declared.hooks.supported ? "unverified" : "unsupported",
-      canPlanWrites: false,
+      skills: resolveNonCodexCapabilityState(input.declared.skills.supported, input.enabled),
+      agents: resolveNonCodexCapabilityState(input.declared.agents.supported, input.enabled),
+      hooks: resolveNonCodexCapabilityState(input.declared.hooks.supported, input.enabled),
+      canPlanWrites: input.enabled && input.declared.agents.supported,
       warnings,
-      blockers,
+      advisories,
     };
   }
   return {
@@ -130,9 +122,9 @@ export function negotiatePluginCapabilities(input: {
     warnings: input.enabled
       ? []
       : [
-          `Plugin ${input.pluginId} has declared capabilities but is not enabled; writes are not authorized.`,
+          `Plugin ${input.pluginId} has declared capabilities but is not enabled for write planning.`,
         ],
-    blockers: [],
+    advisories: [],
   };
 }
 
@@ -148,7 +140,9 @@ export async function createCodexCapabilityVerificationArtifact(input: {
   const timestamp = input.createdAt ?? new Date().toISOString();
   const detectionMessage = sanitizeText(input.detection.message);
   const diagnostics = [
-    "Codex remains no-write until concrete user-level paths and formats are verified.",
+    "Codex skills are packaged in the EvoDev Codex plugin payload.",
+    "Codex agents sync to user-level TOML files under ~/.codex/agents.",
+    "Codex hooks are supplied by the EvoDev Codex plugin manifest and enabled through Codex plugin hooks.",
   ];
   return {
     version: 1,
@@ -165,7 +159,11 @@ export async function createCodexCapabilityVerificationArtifact(input: {
     externalUpload: false,
     networkUsed: false,
     toolSummary: { tool: "codex", detectionStatus: input.detection.status, version: null },
-    capabilities: { skills: "unverified", agents: "unverified", hooks: "unverified" },
+    capabilities: {
+      skills: "plugin-bundled",
+      agents: "user-level-toml-sync",
+      hooks: "plugin-manifest-hooks",
+    },
     writeBoundary: {
       writesAllowed: false,
       allowedPaths: [],
@@ -183,7 +181,7 @@ export async function createCodexCapabilityVerificationArtifact(input: {
       secretsStored: false,
       externalUpload: false,
     },
-    blockers: ["Codex asset capabilities are unverified and unsupported for writes in I10."],
+    advisories: [],
     diagnostics,
     evidenceRefs: [],
     evidence: {
@@ -191,7 +189,8 @@ export async function createCodexCapabilityVerificationArtifact(input: {
       detectionMessage,
       writesAllowed: false,
       notes: [
-        "Metadata-only readonly artifact; no Codex paths, formats, hooks, or writes verified.",
+        "Metadata-only verification artifact; it does not probe or write Code Agent directories.",
+        "Implemented Codex asset distribution is covered by adapter tests: plugin-bundled skills and user-level TOML agents.",
       ],
     },
   };
@@ -275,12 +274,12 @@ export function formatCodexCapabilityVerificationArtifact(
     `Status: ${artifact.status}`,
     `Artifact: ${path ?? "dry-run only"}`,
     `Verified at: ${artifact.verifiedAt}`,
-    "Capabilities: skills=unverified agents=unverified hooks=unverified",
-    "Writes allowed: false",
+    `Capabilities: skills=${artifact.capabilities.skills} agents=${artifact.capabilities.agents} hooks=${artifact.capabilities.hooks}`,
+    "Verification writes allowed: false",
     "Allowed paths: none",
-    "User-level write paths verified: false",
+    "User-level agent sync path: ~/.codex/agents",
     "Project writes allowed: false",
-    "No-overwrite verified: false",
+    "No-overwrite policy: skip existing files unless force refresh is requested",
     `External upload: ${artifact.externalUpload}`,
     `Detection: ${artifact.evidence.detectionStatus}`,
     ...artifact.evidence.notes.map((note) => `Note: ${note}`),
@@ -301,12 +300,11 @@ export async function runPluginConformance(
   }
   if (plugin.id === "codex") {
     const capabilities = await plugin.getCapabilities();
-    if (
-      capabilities.skills.supported ||
-      capabilities.agents.supported ||
-      capabilities.hooks.supported
-    ) {
-      findings.push("Codex must not declare verified runtime support in I10.");
+    if (!capabilities.skills.supported || !capabilities.agents.supported) {
+      findings.push("Codex must declare plugin-bundled skills and user-level TOML agents.");
+    }
+    if (!capabilities.hooks.supported || capabilities.hooks.events.length === 0) {
+      findings.push("Codex must declare plugin-manifest hook support.");
     }
   }
   return { ok: findings.length === 0, findings };

package/src/plugins/index.ts

@@ -2,7 +2,6 @@ export {
   type CapabilityState,
   type CodexCapabilityVerificationArtifact,
   type PluginCapabilityNegotiation,
-  assertNoUnverifiedWrites,
   createCodexCapabilityVerificationArtifact,
   createUnknownNegotiatedCapabilities,
   formatCodexCapabilityVerificationArtifact,

package/src/plugins/types.ts

@@ -70,16 +70,19 @@ export interface SyncSkillsInput {
   targetPlugin: PluginId;
   skills: ScannedAsset<SkillManifest>[];
   dryRun: boolean;
+  force?: boolean;
 }
 
 export interface SyncAgentsInput {
   targetPlugin: PluginId;
   agents: ScannedAsset<AgentManifest>[];
   dryRun: boolean;
+  force?: boolean;
 }
 
 export interface PluginInstallInput {
   targetPlugin: PluginId;
+  force?: boolean;
 }
 
 export type PluginInstallStatus = "installed" | "already-installed" | "skipped" | "failed";
@@ -108,6 +111,7 @@ export interface SyncPlan {
   skills: ScannedAsset<SkillManifest>[];
   agents: ScannedAsset<AgentManifest>[];
   dryRun: boolean;
+  force: boolean;
 }
 
 export interface CodeAgentPlugin {

package/src/protected-zones/index.ts

@@ -1,4 +1,4 @@
-export type ProtectedZoneSeverity = "blocker";
+export type ProtectedZoneSeverity = "advisory";
 
 export interface ProtectedZoneRule {
   id: string;
@@ -22,30 +22,32 @@ const SENSITIVE_DIRECTORY_SEGMENTS = new Set([
   ".claude",
   ".codex",
   ".evodev",
-  "KNOWLEDGE",
-  "LEARNING",
-  "OBSERVABILITY",
-  "PROJECTS",
-  "STATE",
-  "USER",
-  "WORK",
   "accepted-memory",
   "evidence",
+  "evos",
   "hook-logs",
   "knowledge",
+  "learning",
   "learning-candidates",
   "logs",
   "memory",
+  "observability",
   "pack-logs",
   "private-project-context",
+  "projects",
   "raw-evidence",
   "raw-output",
   "raw-payload",
   "raw-payloads",
+  "role-agents",
+  "roles",
   "secrets",
   "state",
   "task-contract",
   "task-contracts",
+  "teams",
+  "user",
+  "work",
   "workflow-logs",
 ]);
 
@@ -66,8 +68,9 @@ export const DEFAULT_PROTECTED_ZONE_RULES: ProtectedZoneRule[] = [
     id: "runtime-private-directory",
     reason:
       "Runtime/private EvoDev directories must not be included in packages or release artifacts.",
-    matches(_path, segments) {
-      return segments.some((segment) => SENSITIVE_DIRECTORY_SEGMENTS.has(segment));
+    matches(path, segments) {
+      if (isCodeModulePath(path, segments)) return false;
+      return segments.some((segment) => SENSITIVE_DIRECTORY_SEGMENTS.has(segment.toLowerCase()));
     },
   },
   {
@@ -116,7 +119,7 @@ export function checkProtectedZonePaths(
         findings.push({
           path,
           ruleId: rule.id,
-          severity: "blocker",
+          severity: "advisory",
           reason: rule.reason,
         });
       }
@@ -135,3 +138,18 @@ function basename(path: string): string {
   const normalized = normalizePackagePath(path);
   return normalized.slice(normalized.lastIndexOf("/") + 1);
 }
+
+function isCodeModulePath(path: string, segments: string[]): boolean {
+  const firstSegment = segments[0]?.toLowerCase();
+  if (firstSegment !== "src" && firstSegment !== "dist") return false;
+
+  const name = basename(path).toLowerCase();
+  return (
+    name.endsWith(".ts") ||
+    name.endsWith(".tsx") ||
+    name.endsWith(".js") ||
+    name.endsWith(".jsx") ||
+    name.endsWith(".mjs") ||
+    name.endsWith(".cjs")
+  );
+}