@getripple/cli 1.0.8 → 1.0.10

package/dist/index.js

@@ -26,6 +26,7 @@ var __importStar = (this && this.__importStar) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
 const core_1 = require("@getripple/core");
 const CONTROL_MODES = ["brainstorm", "function", "file", "task", "pr"];
 function usage() {
@@ -45,18 +46,25 @@ function usage() {
         "  ripple callers <file>::<symbol>",
         "  ripple history [--last N]",
         "  ripple plan --file <file> --task <task> [--mode file|function|brainstorm|task|pr] [--symbol name] [--budget N] [--save]",
+        "  ripple intent status [--intent latest|path]",
+        "  ripple intent close --reason text [--intent latest|path]",
         "  ripple check --staged [--intent latest|path] [--strict]",
+        "  ripple check --worktree [--intent latest|path] [--strict]",
         "  ripple check --changed --base <ref> [--intent latest|path] [--strict]",
-        "  ripple audit [--intent latest|path] [--changed --base <ref>] [--strict]",
-        "  ripple gate [--intent latest|path] [--changed --base <ref>] [--strict]",
+        "  ripple audit [--intent latest|path] [--worktree|--changed --base <ref>] [--strict]",
+        "  ripple gate [--intent latest|path] [--worktree|--changed --base <ref>] [--strict]",
         "  ripple approval [--intent latest|path] [--gate before-risky-edit|before-merge]",
-        "  ripple approve [--intent latest|path] [--gate before-risky-edit|before-merge] [--reason text]",
+        "  ripple approve [--intent latest|path] [--gate before-risky-edit|before-merge] --reason text",
+        "  ripple verify --run <test command> [--intent latest|path] [--note text]",
+        "  ripple verify --command <test command> --status passed|failed|skipped|unknown [--intent latest|path] [--note text]",
         "  ripple repair [--intent latest|path] [--strict]",
         "  ripple ci [--base <ref>] [--intent latest|path] [--github-annotations]",
         "  ripple init-ci [--print] [--force]",
         "  ripple policy init [--print] [--force]",
         "  ripple policy explain --file <file>",
         "  ripple agent",
+        "  ripple agent setup [--print] [--force]",
+        "  ripple hook install [--print] [--force]",
         "",
         "Options:",
         "  --json, -j    Print machine-readable JSON",
@@ -67,14 +75,15 @@ function usage() {
         "  --mode MODE   Agent control boundary for saved plans (default: file)",
         "  --symbol NAME Allowed symbol for --mode function",
         "  --gate GATE   Human approval gate for approve (before-risky-edit or before-merge)",
-        "  --reason TEXT Human approval reason",
+        "  --reason TEXT Required human approval reason",
         "  --approved-by NAME  Human approver name for approval records",
         "  --budget N    Token budget for plan (default: 4000)",
         "  --staged      Check currently staged JS/TS files",
         "  --changed     Check JS/TS files changed against --base",
+        "  --worktree    Check unstaged working-tree JS/TS changes",
         "  --base REF    Base git ref for --changed checks (default: HEAD)",
         "  --save        Save a change intent from ripple plan",
-        "  --intent REF  Validate changes against saved intent (latest, id, or path; ci default: latest)",
+        "  --intent REF  Validate changes against saved intent (latest, id, or path; local checks only)",
         "  --strict      Exit non-zero when check/repair detects missing intent, drift, or contract danger",
         "  --github-annotations  Emit GitHub Actions annotations for CI findings",
         "  --print       Print generated setup content instead of writing files",
@@ -86,10 +95,14 @@ function usage() {
         "  ripple workflow",
         "  ripple doctor --agent",
         "  ripple agent",
+        "  ripple agent setup",
         "  ripple agent --json",
         "  ripple plan --file src/auth.ts --task \"change token refresh behavior\" --mode file --agent --save",
         "  ripple plan --file src/auth.ts --symbol refreshToken --task \"fix retry behavior\" --mode function --agent --save",
+        "  ripple intent status",
+        "  ripple intent close --reason \"task finished\"",
         "  ripple check --staged --agent --intent latest",
+        "  ripple check --worktree --agent --intent latest",
         "  ripple audit --agent --intent latest",
         "  ripple gate --agent --intent latest",
         "  ripple approval --intent latest --agent",
@@ -97,7 +110,7 @@ function usage() {
         "  ripple repair --agent --intent latest",
         "  ripple check --staged --intent latest --strict",
         "  ripple check --changed --base origin/main --strict",
-        "  ripple ci --base origin/main --intent latest --github-annotations",
+        "  ripple ci --base origin/main --github-annotations",
         "  ripple init",
         "  ripple init-ci",
         "  ripple policy init",
@@ -139,6 +152,9 @@ function agentWorkflowGuide() {
         `  ${workflow.commands.auditCurrentChange}`,
         `  ${workflow.commands.gateCurrentChange}`,
         "",
+        "Record verification evidence:",
+        `  ${workflow.commands.recordVerification}`,
+        "",
         "If staged changes drift:",
         `  ${workflow.commands.repairIntentDrift}`,
         "",
@@ -158,6 +174,135 @@ function agentWorkflowGuide() {
         ...workflow.example.map((command) => `  ${command}`),
     ].join("\n");
 }
+function mcpServerConfig(workspaceRoot) {
+    return {
+        mcpServers: {
+            ripple: {
+                command: "npx",
+                args: ["-y", "@getripple/mcp", "--workspace", workspaceRoot],
+            },
+        },
+    };
+}
+function mcpServerConfigJson(workspaceRoot) {
+    return JSON.stringify(mcpServerConfig(workspaceRoot), null, 2);
+}
+const RIPPLE_AGENT_SETUP_FILE_NAMES = ["AGENTS.md", "CLAUDE.md", ".cursorrules"];
+const RIPPLE_DEFAULT_AGENT_SETUP_FILE = ".cursorrules";
+function agentInstructionMarkdown(_workspaceRoot, _fileName) {
+    const workflow = (0, core_1.getAgentWorkflowSummary)();
+    return [
+        "# RIPPLE AGENT PROTOCOL",
+        "You are connected to Ripple MCP for this repo.",
+        `1. BEFORE editing: MUST call \`${workflow.mcpTools.planBeforeEditing}\` with saveIntent=true.`,
+        `2. AFTER editing: MUST call \`${workflow.mcpTools.gateCurrentChange}\` or \`${workflow.mcpTools.checkChangedAgainstBase}\`.`,
+        "3. If mustStop=true or needsHuman=true: STOP and ask the human.",
+        "4. DO NOT edit `.ripple/` policy/cache/intent files unless explicitly requested.",
+        "5. DO NOT claim Ripple passed unless you called a Ripple MCP tool.",
+    ].join("\n");
+}
+const RIPPLE_AGENT_SECTION_START = "<!-- RIPPLE:START -->";
+const RIPPLE_AGENT_SECTION_END = "<!-- RIPPLE:END -->";
+function rippleAgentManagedSection(content) {
+    return [
+        RIPPLE_AGENT_SECTION_START,
+        content.trimEnd(),
+        RIPPLE_AGENT_SECTION_END,
+        "",
+    ].join("\n");
+}
+function resolveAgentSetupFileNames(workspaceRoot) {
+    const existing = RIPPLE_AGENT_SETUP_FILE_NAMES.filter((fileName) => fs.existsSync(path.join(workspaceRoot, fileName)));
+    return existing.length > 0 ? existing : [RIPPLE_DEFAULT_AGENT_SETUP_FILE];
+}
+function agentSetupFiles(workspaceRoot) {
+    return resolveAgentSetupFileNames(workspaceRoot).map((fileName) => ({
+        path: fileName,
+        absolutePath: path.join(workspaceRoot, fileName),
+        content: rippleAgentManagedSection(agentInstructionMarkdown(workspaceRoot, fileName)),
+    }));
+}
+function buildAgentSetupSummary(workspaceRoot, files) {
+    const mcpArgs = ["-y", "@getripple/mcp", "--workspace", workspaceRoot];
+    return {
+        protocol: "ripple-agent-setup",
+        version: 1,
+        workspace: workspaceRoot,
+        files,
+        mcp: {
+            serverName: "ripple",
+            command: "npx",
+            args: mcpArgs,
+            workspace: workspaceRoot,
+            config: mcpServerConfig(workspaceRoot),
+        },
+        setupRequired: [
+            "Open your agent or IDE MCP settings.",
+            "Add a new MCP server named ripple.",
+            `Use command: npx ${mcpArgs.join(" ")}`,
+            "Restart or reload the agent so Ripple MCP tools become available.",
+        ],
+        nextSteps: [
+            "Ask the agent to call ripple_get_agent_workflow to confirm MCP connectivity.",
+            "Before edits, the agent should call ripple_plan_context with saveIntent enabled.",
+            "After edits, the agent should call ripple_gate or ripple_check_changed before handoff.",
+        ],
+    };
+}
+function printAgentSetupSummary(summary) {
+    console.log("Ripple agent setup");
+    console.log(`Workspace: ${summary.workspace}`);
+    console.log("");
+    console.log("Generated files:");
+    summary.files.forEach((file) => {
+        console.log(`  - ${file.path}: ${file.status}`);
+    });
+    console.log("");
+    console.log("ACTION REQUIRED: connect Ripple MCP to your agent/IDE.");
+    console.log("");
+    console.log("MCP server:");
+    console.log("  name: ripple");
+    console.log("  command: npx");
+    console.log(`  args: ${summary.mcp.args.join(" ")}`);
+    console.log("");
+    console.log("Paste this MCP config if your client accepts JSON:");
+    console.log(mcpServerConfigJson(summary.workspace));
+    console.log("");
+    console.log("Cursor / Claude / agent steps:");
+    summary.setupRequired.forEach((step, index) => console.log(`  ${index + 1}. ${step}`));
+    console.log("");
+    console.log("Next:");
+    summary.nextSteps.forEach((step) => console.log(`  - ${step}`));
+}
+function agentSetupCommand(options) {
+    const workspaceRoot = resolveWorkspaceRoot(".");
+    const files = agentSetupFiles(workspaceRoot);
+    if (options.print) {
+        const summary = buildAgentSetupSummary(workspaceRoot, files.map((file) => ({
+            path: file.path,
+            status: "printed",
+            written: false,
+            overwritten: false,
+            content: file.content,
+        })));
+        if (options.json) {
+            printJson(summary);
+            return;
+        }
+        process.stdout.write(files
+            .flatMap((file) => [`# ${file.path}`, file.content.trimEnd(), ""])
+            .join("\n"));
+        return;
+    }
+    const writtenFiles = files.map((file) => writeAgentSetupFile(file, options.force));
+    const summary = buildAgentSetupSummary(workspaceRoot, writtenFiles);
+    if (options.json) {
+        printJson(summary);
+    }
+    else {
+        printAgentSetupSummary(summary);
+    }
+}
 function parseCliArgs(argv) {
     let command;
     const args = [];
@@ -168,6 +313,7 @@ function parseCliArgs(argv) {
         budget: 4000,
         staged: false,
         changed: false,
+        worktree: false,
         save: false,
         strict: false,
         githubAnnotations: false,
@@ -192,6 +338,10 @@ function parseCliArgs(argv) {
             options.changed = true;
             continue;
         }
+        if (token === "--worktree") {
+            options.worktree = true;
+            continue;
+        }
         if (token === "--save") {
             options.save = true;
             continue;
@@ -290,6 +440,58 @@ function parseCliArgs(argv) {
             options.gate = parseApprovalGate(token.slice("--gate=".length));
             continue;
         }
+        if (token === "--run") {
+            const value = argv[i + 1];
+            if (!value || value.startsWith("-")) {
+                throw new Error("Missing value for --run");
+            }
+            options.verificationRunCommand = value;
+            i++;
+            continue;
+        }
+        if (token.startsWith("--run=")) {
+            options.verificationRunCommand = token.slice("--run=".length);
+            continue;
+        }
+        if (token === "--command") {
+            const value = argv[i + 1];
+            if (!value || value.startsWith("-")) {
+                throw new Error("Missing value for --command");
+            }
+            options.verificationCommand = value;
+            i++;
+            continue;
+        }
+        if (token.startsWith("--command=")) {
+            options.verificationCommand = token.slice("--command=".length);
+            continue;
+        }
+        if (token === "--status") {
+            const value = argv[i + 1];
+            if (!value || value.startsWith("-")) {
+                throw new Error("Missing value for --status");
+            }
+            options.verificationStatus = parseVerificationStatus(value);
+            i++;
+            continue;
+        }
+        if (token.startsWith("--status=")) {
+            options.verificationStatus = parseVerificationStatus(token.slice("--status=".length));
+            continue;
+        }
+        if (token === "--note") {
+            const value = argv[i + 1];
+            if (!value || value.startsWith("-")) {
+                throw new Error("Missing value for --note");
+            }
+            options.note = value;
+            i++;
+            continue;
+        }
+        if (token.startsWith("--note=")) {
+            options.note = token.slice("--note=".length);
+            continue;
+        }
         if (token === "--reason") {
             const value = argv[i + 1];
             if (!value || value.startsWith("-")) {
@@ -342,6 +544,19 @@ function parseCliArgs(argv) {
             options.base = token.slice("--base=".length);
             continue;
         }
+        if (token === "--sha") {
+            const value = argv[i + 1];
+            if (!value || value.startsWith("-")) {
+                throw new Error("Missing value for --sha");
+            }
+            options.sha = value;
+            i++;
+            continue;
+        }
+        if (token.startsWith("--sha=")) {
+            options.sha = token.slice("--sha=".length);
+            continue;
+        }
         if (token === "--budget") {
             const value = argv[i + 1];
             if (!value || value.startsWith("-")) {
@@ -376,6 +591,12 @@ function parseControlMode(value) {
     }
     throw new Error(`--mode must be one of: ${CONTROL_MODES.join(", ")}`);
 }
+function parseVerificationStatus(value) {
+    if (value === "passed" || value === "failed" || value === "skipped" || value === "unknown") {
+        return value;
+    }
+    throw new Error("--status must be one of: passed, failed, skipped, unknown");
+}
 function parseApprovalGate(value) {
     if (value === "before-risky-edit" || value === "before-merge") {
         return value;
@@ -392,21 +613,48 @@ function version() {
         return "0.0.0";
     }
 }
+function rippleCliPackageSpec() {
+    const currentVersion = version();
+    return currentVersion === "0.0.0"
+        ? "@getripple/cli"
+        : `@getripple/cli@${currentVersion}`;
+}
+function shellSingleQuote(value) {
+    return `'${value.replace(/'/g, `'\\''`).replace(/\\/g, "/")}'`;
+}
+function rippleDirectRunnerHookLines() {
+    return [
+        `  ripple_direct_node=${shellSingleQuote(process.execPath)}`,
+        `  ripple_direct_cli=${shellSingleQuote(__filename)}`,
+        `  if [ -x "./node_modules/.bin/ripple" ]; then`,
+        `    "./node_modules/.bin/ripple" "$@"`,
+        `  elif [ -f "$ripple_direct_cli" ] && [ -f "$ripple_direct_node" ]; then`,
+        `    "$ripple_direct_node" "$ripple_direct_cli" "$@"`,
+        `  elif command -v ripple >/dev/null 2>&1; then`,
+        `    ripple "$@"`,
+        `  else`,
+        `    npx -y ${rippleCliPackageSpec()} "$@"`,
+        `  fi`,
+    ];
+}
 const GITHUB_ACTIONS_WORKFLOW_PATH = core_1.RIPPLE_CI_WORKFLOW_PATH;
 function githubActionsWorkflow() {
     return [
-        "name: Ripple",
+        "name: Ripple Enterprise Gate",
         "",
         "on:",
         "  pull_request:",
+        "  push:",
+        "    branches: [main, master]",
         "",
         "permissions:",
         "  contents: read",
         "  pull-requests: read",
+        "  checks: write",
         "",
         "jobs:",
         "  ripple:",
-        "    name: Ripple architecture gate",
+        "    name: Ripple authorization gate",
         "    runs-on: ubuntu-latest",
         "    steps:",
         "      - name: Checkout",
@@ -417,8 +665,11 @@ function githubActionsWorkflow() {
         "        uses: actions/setup-node@v4",
         "        with:",
         "          node-version: 20",
-        "      - name: Ripple CI",
-        "        run: npx -y @getripple/cli@latest ci --base origin/${{ github.base_ref }} --intent latest --github-annotations",
+        "      - name: Ripple CI gate",
+        `        run: npx -y ${rippleCliPackageSpec()} ci --base origin/\${{ github.base_ref }} --github-annotations --sha \${{ github.sha }}`,
+        "        env:",
+        "          RIPPLE_API_KEY: ${{ secrets.RIPPLE_API_KEY }}",
+        "          RIPPLE_CLOUD_URL: ${{ secrets.RIPPLE_CLOUD_URL }}",
         "",
     ].join("\n");
 }
@@ -434,7 +685,7 @@ function defaultInitNextSteps(readiness) {
         ...(readiness?.nextSteps ?? []),
         "Run ripple plan --file <file> --task \"<task>\" --mode file --agent --save.",
         "Run ripple doctor --agent --strict after saving the first intent.",
-        "Commit .ripple/policy.json, .ripple/intents/latest.json, approvals when needed, and .github/workflows/ripple.yml.",
+        "Commit .ripple/policy.json, approvals when needed, and .github/workflows/ripple.yml. Keep local intents out of PRs.",
     ]);
 }
 function uniqueLines(lines) {
@@ -488,7 +739,7 @@ function intentLoadFailureMessage(intentRef, error) {
     const detail = error instanceof Error ? error.message : String(error);
     return [
         `Could not load Ripple change intent '${intentRef}'.`,
-        "Run ripple plan --save and include .ripple/intents/latest.json in the PR, or pass a valid --intent path.",
+        "Run ripple plan --save for local intent-based checks, or pass a valid --intent path. Do not commit local latest intents into PRs.",
         detail,
     ].join(" ");
 }
@@ -534,6 +785,149 @@ function writeGithubAuditStepSummary(audit) {
         console.error(`Ripple CLI warning: Could not write GitHub step summary: ${message}`);
     }
 }
+function writeGithubPolicyAuditStepSummary(summary, policySync) {
+    const summaryPath = process.env.GITHUB_STEP_SUMMARY?.trim();
+    if (!summaryPath) {
+        return;
+    }
+    try {
+        fs.appendFileSync(summaryPath, buildGithubPolicyAuditStepSummary(summary, policySync), "utf8");
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        console.error(`Ripple CLI warning: Could not write GitHub step summary: ${message}`);
+    }
+}
+function pushMarkdownList(lines, title, items, limit) {
+    lines.push(`#### ${title}`);
+    if (items.length === 0) {
+        lines.push("- none");
+        return;
+    }
+    items.slice(0, limit).forEach((item) => lines.push(`- ${item}`));
+    if (items.length > limit) {
+        lines.push(`- ...and ${items.length - limit} more`);
+    }
+}
+function appendGithubReviewPacket(lines, packet) {
+    if (!packet) {
+        return;
+    }
+    lines.push("### Review packet", "");
+    lines.push(`- Protocol: ${packet.protocol} v${packet.version}`);
+    lines.push(`- Task: ${packet.originalTask}`);
+    lines.push(`- Mode: ${packet.mode}`);
+    lines.push(`- Declared scope: ${packet.declaredScope.controlMode} ${packet.declaredScope.targetFile}`);
+    lines.push(`- Human gate: ${packet.declaredScope.humanGate}`);
+    lines.push(`- Boundary risk: ${packet.declaredScope.boundaryRisk}`);
+    lines.push(`- Tests run: ${packet.verification.testsRun}`);
+    if (packet.verification.evidence.length > 0) {
+        lines.push(`- Verification status: ${verificationEvidenceStatusLabel(packet.verification.evidence)}`);
+    }
+    lines.push(`- Decision: ${packet.decision.verdict}`);
+    lines.push(`- Can continue: ${packet.decision.canContinue}`);
+    lines.push(`- Must stop: ${packet.decision.mustStop}`);
+    lines.push(`- Needs human: ${packet.decision.needsHuman}`);
+    lines.push(`- Next required action: ${packet.decision.nextRequiredAction}`);
+    lines.push("");
+    pushMarkdownList(lines, "Allowed files", packet.declaredScope.allowedFiles, 12);
+    lines.push("");
+    pushMarkdownList(lines, "Allowed symbols", packet.declaredScope.allowedSymbols, 12);
+    lines.push("");
+    pushMarkdownList(lines, "Actual changed files", packet.actualChanges.changedFiles, 20);
+    lines.push("");
+    pushMarkdownList(lines, "Changed symbols", packet.actualChanges.changedSymbols, 16);
+    lines.push("");
+    pushMarkdownList(lines, "Outside boundary files", packet.scopeFindings.outsideBoundaryFiles, 20);
+    lines.push("");
+    pushMarkdownList(lines, "Outside boundary symbols", packet.scopeFindings.outsideBoundarySymbols, 16);
+    lines.push("");
+    pushMarkdownList(lines, "Contract changes to review", uniqueItems([
+        ...packet.scopeFindings.protectedContractChanges,
+        ...packet.scopeFindings.unplannedContractChanges,
+    ]), 16);
+    lines.push("");
+    pushMarkdownList(lines, "Verification expected", packet.verification.expectedCommands, 20);
+    lines.push("");
+    pushMarkdownList(lines, "Verification evidence", packet.verification.evidence.map(formatVerificationEvidence), 20);
+    lines.push("");
+    lines.push("#### Verification note");
+    lines.push(`- ${packet.verification.note}`);
+    lines.push("");
+    pushMarkdownList(lines, "Reviewer notes", packet.reviewerNotes, 12);
+    lines.push("");
+}
+function buildGithubPolicyAuditStepSummary(summary, policySync) {
+    const pushList = (lines, title, items, limit) => {
+        lines.push(`#### ${title}`);
+        if (items.length === 0) {
+            lines.push("- none");
+            return;
+        }
+        items.slice(0, limit).forEach((item) => lines.push(`- ${item}`));
+        if (items.length > limit) {
+            lines.push(`- ...and ${items.length - limit} more`);
+        }
+    };
+    const lines = [
+        "## Ripple architecture gate",
+        "",
+        "Status: audit",
+        "Mode: policy-only",
+        "Blocking: false",
+        "Intent: none (local intents are not required in CI audit mode)",
+        `Checked files: ${summary.checkedFiles}`,
+        `Highest risk: ${summary.highestRisk}`,
+        `Requires attention: ${summary.requiresAttention}`,
+        "",
+    ];
+    if (summary.baseRef) {
+        lines.splice(5, 0, `Base ref: ${summary.baseRef}`);
+    }
+    if (summary.files.length > 0) {
+        lines.push("### Changed files", "");
+        summary.files.slice(0, 20).forEach((file) => {
+            lines.push(`- ${file.file} (${file.modificationRisk}, importers: ${file.importerCount})`);
+        });
+        if (summary.files.length > 20) {
+            lines.push(`- ...and ${summary.files.length - 20} more`);
+        }
+        lines.push("");
+    }
+    if (policySync) {
+        lines.push("### Policy sync", "");
+        lines.push(`Status: ${policySync.status}`);
+        if (policySync.missingRules.length > 0) {
+            policySync.missingRules.slice(0, 12).forEach((rule) => {
+                lines.push(`- ${rule.paths.join(", ")} (risk: ${rule.risk ?? "medium"})`);
+            });
+            if (policySync.missingRules.length > 12) {
+                lines.push(`- ...and ${policySync.missingRules.length - 12} more`);
+            }
+        }
+        else {
+            lines.push("- up to date");
+        }
+        lines.push("");
+    }
+    lines.push("### Agent actions", "");
+    pushList(lines, "Trusted findings", summary.agentActions.trustedFindings, 12);
+    lines.push("");
+    pushList(lines, "Verify before merge", summary.agentActions.verifyBeforeCommit, 12);
+    lines.push("");
+    pushList(lines, "Manual review recommended", summary.agentActions.manualReviewRequired, 12);
+    lines.push("");
+    const verificationTargets = uniqueItems(summary.files.flatMap((file) => file.verificationTargets));
+    if (verificationTargets.length > 0) {
+        lines.push("### Verify", "");
+        verificationTargets.slice(0, 20).forEach((target) => lines.push(`- ${target}`));
+        if (verificationTargets.length > 20) {
+            lines.push(`- ...and ${verificationTargets.length - 20} more`);
+        }
+        lines.push("");
+    }
+    return `${lines.join("\n")}\n`;
+}
 function buildGithubStepSummary(input) {
     const { summary, intentLoadError } = input;
     const validation = summary.intentValidation;
@@ -588,6 +982,7 @@ function buildGithubStepSummary(input) {
     else {
         lines.push("### Intent", "", "- No saved change intent was provided.", `- Next required phase: ${nextRequiredPhase}`, `- Next required action: ${nextRequiredAction}`, "");
     }
+    appendGithubReviewPacket(lines, summary.reviewPacket);
     const blockingReasons = validation?.blockingReasons ?? [];
     if (blockingReasons.length > 0) {
         lines.push("### Blocking reasons", "");
@@ -681,6 +1076,7 @@ function buildGithubAuditStepSummary(audit) {
     }
     pushList(lines, "Approval why", audit.approvalStatus.why, 8);
     lines.push("");
+    appendGithubReviewPacket(lines, audit.reviewPacket);
     if (audit.blockingReasons.length > 0) {
         lines.push("### Blocking reasons", "");
         audit.blockingReasons.forEach((reason) => lines.push(`- ${reason}`));
@@ -763,13 +1159,13 @@ function printGithubCheckAnnotations(summary) {
         return;
     }
     if (validation.policyDrift.status === "changed") {
-        printGithubErrorAnnotation({
+        printGithubWarningAnnotation({
             file: validation.targetFile,
             title: "Ripple policy drift",
             message: validation.policyDrift.summary,
         });
         validation.policyDrift.changedFields.slice(0, 8).forEach((field) => {
-            printGithubErrorAnnotation({
+            printGithubWarningAnnotation({
                 file: validation.targetFile,
                 title: "Ripple policy drift",
                 message: field,
@@ -777,13 +1173,13 @@ function printGithubCheckAnnotations(summary) {
         });
     }
     if (validation.readinessDrift.status === "weakened") {
-        printGithubErrorAnnotation({
+        printGithubWarningAnnotation({
             file: validation.targetFile,
             title: "Ripple readiness drift",
             message: validation.readinessDrift.summary,
         });
         validation.readinessDrift.weakenedFields.slice(0, 8).forEach((field) => {
-            printGithubErrorAnnotation({
+            printGithubWarningAnnotation({
                 file: validation.targetFile,
                 title: "Ripple readiness drift",
                 message: `Weakened readiness field: ${field}`,
@@ -791,7 +1187,7 @@ function printGithubCheckAnnotations(summary) {
         });
     }
     validation.unplannedFiles.forEach((file) => {
-        printGithubErrorAnnotation({
+        printGithubWarningAnnotation({
             file,
             title: "Ripple intent drift",
             message: `Unplanned file changed: ${file}`,
@@ -799,7 +1195,7 @@ function printGithubCheckAnnotations(summary) {
     });
     validation.unplannedSymbols.forEach((symbol) => {
         const file = symbolFile(symbol);
-        printGithubErrorAnnotation({
+        printGithubWarningAnnotation({
             file,
             title: "Ripple symbol drift",
             message: `Unplanned symbol changed: ${symbol}`,
@@ -853,24 +1249,58 @@ function printGithubCheckAnnotations(summary) {
         });
     });
     summary.agentActions.manualReviewRequired.slice(0, 12).forEach((action) => {
-        printGithubErrorAnnotation({
+        printGithubWarningAnnotation({
             file: actionFile(action),
             title: "Ripple manual review required",
             message: action,
         });
     });
 }
+function printGithubPolicyAuditAnnotations(summary, policySync) {
+    if (summary.requiresAttention) {
+        printGithubWarningAnnotation({
+            title: "Ripple policy audit",
+            message: `Policy audit detected ${summary.highestRisk} risk changes. Ripple is in audit mode, so this does not block merge. Ensure human review before merging.`,
+        });
+    }
+    else {
+        printGithubNoticeAnnotation({
+            title: "Ripple policy audit",
+            message: "Policy audit completed without high-risk findings.",
+        });
+    }
+    if (policySync && policySync.missingRules.length > 0) {
+        printGithubWarningAnnotation({
+            title: "Ripple policy rot",
+            message: `Policy may be missing ${policySync.missingRules.length} risky repo surface(s). Run ripple policy sync and review .ripple/policy.json.`,
+        });
+    }
+    summary.agentActions.verifyBeforeCommit.slice(0, 12).forEach((action) => {
+        printGithubWarningAnnotation({
+            file: actionFile(action),
+            title: "Ripple verify before merge",
+            message: action,
+        });
+    });
+    summary.agentActions.manualReviewRequired.slice(0, 12).forEach((action) => {
+        printGithubWarningAnnotation({
+            file: actionFile(action),
+            title: "Ripple manual review recommended",
+            message: action,
+        });
+    });
+}
 function printGithubAuditAnnotations(audit) {
     const gate = (0, core_1.buildRippleGateSummary)(audit);
     if (audit.status !== "pass") {
-        printGithubErrorAnnotation({
+        printGithubWarningAnnotation({
             file: audit.intent.targetFile,
             title: "Ripple gate closed",
             message: `${gate.status}/${gate.decision}: next=${gate.nextRequiredPhase}. ${gate.nextRequiredAction}`,
         });
     }
     if (audit.approvalStatus.required && !audit.approvalStatus.approved) {
-        printGithubErrorAnnotation({
+        printGithubWarningAnnotation({
             file: audit.intent.targetFile,
             title: "Ripple approval required",
             message: audit.approvalStatus.summary,
@@ -930,6 +1360,28 @@ function relativeToWorkspace(workspaceRoot, filePath) {
 function normalizeProjectPath(filePath) {
     return filePath.replace(/\\/g, "/").replace(/^\.\/+/, "");
 }
+function resolveCliIntentPath(workspaceRoot, intentRef) {
+    const normalized = intentRef.trim();
+    if (normalized.length === 0 || normalized === "latest") {
+        return (0, core_1.defaultChangeIntentPath)(workspaceRoot);
+    }
+    if (path.isAbsolute(normalized)) {
+        return normalized;
+    }
+    if (normalized.endsWith(".json") || normalized.includes("/") || normalized.includes("\\")) {
+        return path.resolve(workspaceRoot, normalized);
+    }
+    return path.join(workspaceRoot, ".ripple", "intents", `${normalized}.json`);
+}
+function isActiveChangeIntentFile(filePath) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(filePath, "utf8"));
+        return parsed.protocol === "ripple-change-intent";
+    }
+    catch {
+        return false;
+    }
+}
 function formatEventLine(event) {
     const target = event.target ? ` -> ${event.target}` : "";
     const details = [
@@ -1021,6 +1473,15 @@ function printDoctorSummary(summary) {
         summary.enforcement.gaps.forEach((gap) => console.log(`    - ${gap}`));
     }
     console.log("");
+    console.log("Policy sync:");
+    console.log(`  status: ${summary.policySync.status}`);
+    if (summary.policySync.missingRules.length > 0) {
+        console.log("  missing coverage:");
+        summary.policySync.missingRules.slice(0, 12).forEach((rule) => {
+            console.log(`    - ${rule.paths.join(", ")} risk=${rule.risk ?? "medium"}`);
+        });
+    }
+    console.log("");
     console.log("Next steps:");
     summary.nextSteps.forEach((step) => console.log(`  - ${step}`));
 }
@@ -1032,6 +1493,21 @@ function printInitSummary(summary) {
     summary.files.forEach((file) => {
         console.log(`  - ${file.path}: ${file.status}`);
     });
+    if (summary.agentSetup) {
+        console.log("");
+        console.log("Agent setup files:");
+        summary.agentSetup.files.forEach((file) => {
+            console.log(`  - ${file.path}: ${file.status}`);
+        });
+    }
+    if (summary.hooks) {
+        console.log("");
+        console.log("Git hooks:");
+        console.log(`  - ${summary.hooks.path}: ${summary.hooks.preCommitAction ?? summary.hooks.status}`);
+        if (summary.hooks.postCommitPath) {
+            console.log(`  - ${summary.hooks.postCommitPath}: ${summary.hooks.postCommitAction ?? summary.hooks.status}`);
+        }
+    }
     if (summary.readiness) {
         console.log("");
         console.log("Readiness after init:");
@@ -1067,6 +1543,13 @@ function printAgentDoctorSummary(summary) {
     console.log(`git_ignore: ${summary.checks.gitIgnore.ok ? "ok" : "missing"} - ${summary.checks.gitIgnore.detail}`);
     console.log(`ci_workflow: ${summary.checks.ciWorkflow.ok ? "ok" : "missing"} - ${summary.checks.ciWorkflow.detail}`);
     console.log(`latest_intent: ${summary.checks.latestIntent.ok ? "ok" : "missing"} - ${summary.checks.latestIntent.detail}`);
+    console.log(`policy_sync: ${summary.policySync.status}`);
+    if (summary.policySync.missingRules.length > 0) {
+        console.log("policy_sync_missing_rules:");
+        summary.policySync.missingRules.slice(0, 12).forEach((rule) => {
+            console.log(`- ${rule.paths.join(", ")} risk=${rule.risk ?? "medium"}`);
+        });
+    }
     console.log("");
     printAgentList("why", summary.why);
     console.log("");
@@ -1492,6 +1975,10 @@ function printAgentStagedCheckSummary(summary) {
     console.log(`checked_js_ts_files: ${summary.stagedFiles}`);
     console.log(`checked_files: ${summary.checkedFiles}`);
     printAgentIntentValidation(summary.intentValidation);
+    if (summary.reviewPacket) {
+        console.log("");
+        printAgentReviewPacket(summary.reviewPacket);
+    }
     console.log("");
     printAgentList("trusted_findings", summary.agentActions.trustedFindings);
     console.log("");
@@ -1760,6 +2247,8 @@ function printAgentAuditSummary(summary) {
     console.log(`repair_status: ${summary.repairPlan.status}`);
     console.log(`recommended_action: ${summary.recommendedAction}`);
     console.log("");
+    printAgentReviewPacket(summary.reviewPacket);
+    console.log("");
     printAgentHandoffBlock("handoff", summary.handoff);
     if (summary.approvalStatus.approval) {
         console.log(`approved_by: ${summary.approvalStatus.approval.approvedBy}`);
@@ -1817,6 +2306,8 @@ function printAgentGateSummary(summary) {
     console.log(`risk_score: ${summary.risk.score}`);
     console.log(`risk_summary: ${summary.risk.summary}`);
     console.log("");
+    printAgentReviewPacket(summary.reviewPacket);
+    console.log("");
     printAgentList("risk_reasons", compactGateRiskReasons(summary));
     console.log("");
     printAgentList("risk_evidence", compactGateRiskEvidence(summary));
@@ -1845,15 +2336,43 @@ function printAgentGateSummary(summary) {
     console.log("");
     printAgentList("commands_verify", summary.commands.verify);
 }
-function printGateSummary(summary) {
-    const statusLabel = summary.canContinue ? "CONTINUE" : "STOP";
-    console.log(`Ripple gate: ${statusLabel}`);
-    console.log(gateHeadline(summary));
-    console.log("");
-    console.log(`Decision: ${summary.decision}`);
-    console.log(`Can continue: ${formatYesNo(summary.canContinue)}`);
-    console.log(`Must stop: ${formatYesNo(summary.mustStop)}`);
-    printGateRiskSummary(summary);
+function printAgentGateIntentBlock(summary) {
+    console.log("RIPPLE_GATE_INTENT_BLOCK");
+    console.log(`protocol: ${summary.protocol}`);
+    console.log(`status: ${summary.status}`);
+    console.log(`decision: ${summary.decision}`);
+    console.log(`can_continue: ${summary.canContinue}`);
+    console.log(`must_stop: ${summary.mustStop}`);
+    console.log(`needs_human: ${summary.needsHuman}`);
+    console.log(`next_required_phase: ${summary.nextRequiredPhase}`);
+    console.log(`next_required_action: ${summary.nextRequiredAction}`);
+    console.log(`summary: ${summary.summary}`);
+    console.log(`mode: ${summary.mode}`);
+    if (summary.baseRef) {
+        console.log(`base_ref: ${summary.baseRef}`);
+    }
+    console.log(`intent_ref: ${summary.intentRef}`);
+    console.log(`intent_state: ${summary.intentState}`);
+    console.log(`intent_error: ${summary.intentLoadError}`);
+    console.log("");
+    printAgentList("why", summary.why);
+    console.log("");
+    printAgentList("fix_now", summary.fixNow);
+    console.log("");
+    printAgentList("ask_human", summary.askHuman);
+    console.log("");
+    printAgentList("commands_plan", summary.commands.plan);
+}
+function printGateSummary(summary) {
+    const statusLabel = summary.canContinue ? "CONTINUE" : "STOP";
+    console.log(`Ripple gate: ${statusLabel}`);
+    console.log(gateHeadline(summary));
+    console.log("");
+    console.log(`Decision: ${summary.decision}`);
+    console.log(`Can continue: ${formatYesNo(summary.canContinue)}`);
+    console.log(`Must stop: ${formatYesNo(summary.mustStop)}`);
+    console.log("");
+    printReviewPacketSummary(summary.reviewPacket);
     console.log("");
     console.log("Intent:");
     console.log(`  Task: ${summary.intent.task}`);
@@ -1865,6 +2384,7 @@ function printGateSummary(summary) {
     printHumanList("Allowed:", gateAllowedItems(summary));
     const outsideBoundary = gateChangedOutsideItems(summary);
     printHumanList(outsideBoundary.length > 0 ? "Changed outside boundary:" : "Changed files:", outsideBoundary.length > 0 ? outsideBoundary : summary.changedFiles);
+    console.log("");
     printHumanList("Why:", compactGateReasons(summary));
     printHumanList("Fix now:", compactGateFixes(summary));
     if (summary.canContinue) {
@@ -1873,6 +2393,28 @@ function printGateSummary(summary) {
     else {
         printHumanList("Commands:", compactGateCommands(summary));
     }
+    printGateRiskSummary(summary);
+}
+function printGateIntentBlock(summary) {
+    console.log("Ripple gate: STOP");
+    console.log("Agent must stop before continuing.");
+    console.log("");
+    console.log(`Decision: ${summary.decision}`);
+    console.log(`Can continue: ${formatYesNo(summary.canContinue)}`);
+    console.log(`Must stop: ${formatYesNo(summary.mustStop)}`);
+    console.log(`Needs human: ${formatYesNo(summary.needsHuman)}`);
+    console.log(`Next required phase: ${summary.nextRequiredPhase}`);
+    console.log(`Next required action: ${summary.nextRequiredAction}`);
+    console.log("");
+    console.log("Intent:");
+    console.log(`  Ref: ${summary.intentRef}`);
+    console.log(`  State: ${summary.intentState}`);
+    console.log(`  Error: ${summary.intentLoadError}`);
+    console.log("");
+    printHumanList("Why:", summary.why);
+    printHumanList("Fix now:", summary.fixNow);
+    printHumanList("Ask human:", summary.askHuman);
+    printHumanList("Commands:", summary.commands.plan);
 }
 function printGateRiskSummary(summary) {
     console.log("");
@@ -1967,6 +2509,8 @@ function printAuditSummary(summary) {
     console.log(`  next required action: ${gate.nextRequiredAction}`);
     console.log(`  summary: ${gate.summary}`);
     console.log("");
+    printReviewPacketSummary(summary.reviewPacket);
+    console.log("");
     console.log("Approval:");
     console.log(`  status: ${summary.approvalStatus.status}`);
     console.log(`  decision: ${summary.approvalStatus.decision}`);
@@ -2125,9 +2669,83 @@ function printHumanList(title, items) {
     }
     items.forEach((item) => console.log(`  - ${item}`));
 }
+function formatVerificationEvidence(evidence) {
+    const note = evidence.note ? ` note=${evidence.note}` : "";
+    const exitCode = typeof evidence.exitCode === "number" ? ` exitCode=${evidence.exitCode}` : "";
+    const duration = typeof evidence.durationMs === "number" ? ` durationMs=${evidence.durationMs}` : "";
+    const files = evidence.changedFiles
+        ? ` files=${evidence.changedFiles.length > 0 ? evidence.changedFiles.join(",") : "none"}`
+        : "";
+    const mode = evidence.changeMode ? ` mode=${evidence.changeMode}` : "";
+    const fingerprint = evidence.changeFingerprint
+        ? ` fingerprint=${evidence.changeFingerprint.slice(0, 12)}`
+        : "";
+    return `${evidence.status}: ${evidence.command} (${evidence.source}${exitCode}${duration}${files}${mode}${fingerprint} ${evidence.recordedAt})${note}`;
+}
+function verificationEvidenceStatusLabel(evidence) {
+    if (evidence.length === 0) {
+        return "none";
+    }
+    if (evidence.some((item) => item.status === "failed")) {
+        return "failed";
+    }
+    if (evidence.some((item) => item.status === "unknown")) {
+        return "unknown";
+    }
+    if (evidence.some((item) => item.status === "skipped")) {
+        return "skipped";
+    }
+    return "passed";
+}
+function printReviewPacketSummary(packet) {
+    console.log("Review packet:");
+    console.log(`  protocol: ${packet.protocol}`);
+    console.log(`  task: ${packet.originalTask}`);
+    console.log(`  declared scope: ${packet.declaredScope.controlMode} ${packet.declaredScope.targetFile}`);
+    console.log(`  human gate: ${packet.declaredScope.humanGate}`);
+    console.log(`  boundary risk: ${packet.declaredScope.boundaryRisk}`);
+    printHumanList("  changed files", packet.actualChanges.changedFiles);
+    printHumanList("  outside boundary files", packet.scopeFindings.outsideBoundaryFiles);
+    printHumanList("  outside boundary symbols", packet.scopeFindings.outsideBoundarySymbols);
+    printHumanList("  verification expected", packet.verification.expectedCommands);
+    console.log(`  tests run: ${packet.verification.testsRun}`);
+    if (packet.verification.evidence.length > 0) {
+        console.log(`  verification status: ${verificationEvidenceStatusLabel(packet.verification.evidence)}`);
+    }
+    printHumanList("  verification evidence", packet.verification.evidence.map(formatVerificationEvidence));
+    console.log(`  can continue: ${formatYesNo(packet.decision.canContinue)}`);
+    console.log(`  must stop: ${formatYesNo(packet.decision.mustStop)}`);
+    console.log(`  needs human: ${formatYesNo(packet.decision.needsHuman)}`);
+    printHumanList("  reviewer notes", packet.reviewerNotes);
+}
+function printAgentReviewPacket(packet) {
+    console.log(`review_packet_protocol: ${packet.protocol}`);
+    console.log(`review_packet_version: ${packet.version}`);
+    console.log(`review_packet_task: ${packet.originalTask}`);
+    console.log(`review_packet_scope: ${packet.declaredScope.controlMode} ${packet.declaredScope.targetFile}`);
+    console.log(`review_packet_human_gate: ${packet.declaredScope.humanGate}`);
+    console.log(`review_packet_boundary_risk: ${packet.declaredScope.boundaryRisk}`);
+    console.log(`review_packet_tests_run: ${packet.verification.testsRun}`);
+    console.log(`review_packet_verification_status: ${verificationEvidenceStatusLabel(packet.verification.evidence)}`);
+    console.log(`review_packet_can_continue: ${packet.decision.canContinue}`);
+    console.log(`review_packet_must_stop: ${packet.decision.mustStop}`);
+    console.log(`review_packet_needs_human: ${packet.decision.needsHuman}`);
+    console.log("");
+    printAgentList("review_packet_changed_files", packet.actualChanges.changedFiles);
+    console.log("");
+    printAgentList("review_packet_outside_boundary_files", packet.scopeFindings.outsideBoundaryFiles);
+    console.log("");
+    printAgentList("review_packet_outside_boundary_symbols", packet.scopeFindings.outsideBoundarySymbols);
+    console.log("");
+    printAgentList("review_packet_verification_expected", packet.verification.expectedCommands);
+    console.log("");
+    printAgentList("review_packet_verification_reported", packet.verification.evidence.map(formatVerificationEvidence));
+    console.log("");
+    printAgentList("review_packet_reviewer_notes", packet.reviewerNotes);
+}
 function printStagedCheckSummary(summary) {
     const adapter = summary.adapterSupport.primaryAdapter;
-    console.log(summary.mode === "changed" ? "Ripple changed-files check" : "Ripple staged check");
+    console.log(summary.mode === "changed" ? "Ripple changed-files check" : summary.mode === "worktree" ? "Ripple worktree check" : "Ripple staged check");
     console.log(`Workspace: ${summary.workspace}`);
     console.log(`Mode: ${summary.mode}`);
     if (summary.baseRef) {
@@ -2151,6 +2769,10 @@ function printStagedCheckSummary(summary) {
         printReadinessDriftSummary("Readiness drift:", summary.intentValidation.readinessDrift);
         console.log(`Planned scope: ${summary.intentValidation.plannedScope}`);
     }
+    if (summary.reviewPacket) {
+        console.log("");
+        printReviewPacketSummary(summary.reviewPacket);
+    }
     if (summary.skippedFiles.length > 0) {
         console.log(`Skipped non-source files: ${summary.skippedFiles.length}`);
     }
@@ -2163,7 +2785,9 @@ function printStagedCheckSummary(summary) {
         console.log("");
         console.log(summary.mode === "changed"
             ? "No changed JS/TS files found."
-            : "No staged JS/TS files found.");
+            : summary.mode === "worktree"
+                ? "No worktree JS/TS changes found."
+                : "No staged JS/TS files found.");
         return;
     }
     console.log("");
@@ -2374,7 +2998,7 @@ async function planCommand(options) {
             const output = savedIntent
                 ? {
                     ...summary,
-                    policyExplanation,
+                    policyExplanation: savedIntent.intent.policyExplanation,
                     changeIntent: savedIntent.intent,
                     changeIntentPath: savedIntent.path,
                 }
@@ -2419,6 +3043,140 @@ function currentPolicyExplanationForIntent(workspaceRoot, intent) {
 function currentReadinessSnapshotForEngine(workspaceRoot, engine) {
     return (0, core_1.buildChangeIntentReadinessSnapshot)((0, core_1.buildRippleReadinessSummary)(workspaceRoot, engine));
 }
+function intentSnapshot(intent) {
+    return {
+        id: intent.id,
+        createdAt: intent.createdAt,
+        task: intent.task,
+        targetFile: intent.targetFile,
+        controlMode: intent.controlMode,
+        humanGate: intent.humanGate,
+        boundaryRisk: intent.boundaryRisk,
+    };
+}
+function intentCommand(action, options) {
+    if (!action || action === "status") {
+        intentStatusCommand(options);
+        return;
+    }
+    if (action === "close") {
+        closeIntentCommand(options);
+        return;
+    }
+    throw new Error("Usage: ripple intent status [--intent latest|path] or ripple intent close --reason <text> [--intent latest|path]");
+}
+function intentStatusCommand(options) {
+    const workspaceRoot = resolveWorkspaceRoot(".");
+    const intentRef = options.intent ?? "latest";
+    const intentPath = resolveCliIntentPath(workspaceRoot, intentRef);
+    const exists = fs.existsSync(intentPath);
+    const active = exists && isActiveChangeIntentFile(intentPath);
+    const output = {
+        protocol: "ripple-intent-status",
+        version: 1,
+        workspace: workspaceRoot,
+        intentRef,
+        intentPath: relativeToWorkspace(workspaceRoot, intentPath),
+        exists,
+        active,
+        nextSteps: active
+            ? [
+                "Run ripple gate --intent latest before continuing.",
+                "Run ripple intent close --reason \"<why this boundary is done>\" when the task boundary is complete or intentionally replaced.",
+            ]
+            : [
+                "Run ripple plan --file <file> --task \"<task>\" --agent --save before an agent edits.",
+            ],
+    };
+    if (active) {
+        output.intent = intentSnapshot((0, core_1.loadChangeIntent)(workspaceRoot, intentRef));
+    }
+    if (options.json) {
+        printJson(output);
+        return;
+    }
+    printIntentStatus(output);
+}
+function closeIntentCommand(options) {
+    const workspaceRoot = resolveWorkspaceRoot(".");
+    const intentRef = options.intent ?? "latest";
+    const intentPath = resolveCliIntentPath(workspaceRoot, intentRef);
+    if (!fs.existsSync(intentPath) || !isActiveChangeIntentFile(intentPath)) {
+        throw new Error(`No active Ripple intent exists at ${relativeToWorkspace(workspaceRoot, intentPath)}.`);
+    }
+    const reason = options.reason?.trim();
+    if (!reason) {
+        throw new Error("Closing an active Ripple intent requires --reason.");
+    }
+    const intent = (0, core_1.loadChangeIntent)(workspaceRoot, intentRef);
+    const closedAt = new Date().toISOString();
+    const closedBy = options.approvedBy?.trim() || "human";
+    const archivePath = archivedIntentPath(workspaceRoot, intent, closedAt);
+    const archive = {
+        protocol: "ripple-closed-intent",
+        version: 1,
+        closedAt,
+        closedBy,
+        reason,
+        originalIntentPath: relativeToWorkspace(workspaceRoot, intentPath),
+        intent,
+    };
+    fs.mkdirSync(path.dirname(archivePath), { recursive: true });
+    fs.writeFileSync(archivePath, `${JSON.stringify(archive, null, 2)}\n`, "utf8");
+    fs.writeFileSync(intentPath, `${JSON.stringify(archive, null, 2)}\n`, "utf8");
+    const output = {
+        protocol: "ripple-intent-close",
+        version: 1,
+        workspace: workspaceRoot,
+        intentRef,
+        intentPath: relativeToWorkspace(workspaceRoot, intentPath),
+        archivePath: relativeToWorkspace(workspaceRoot, archivePath),
+        closedAt,
+        closedBy,
+        reason,
+        intent: intentSnapshot(intent),
+        nextSteps: [
+            "Run ripple intent status to confirm no active saved boundary remains.",
+            "Run ripple plan --file <file> --task \"<task>\" --agent --save to start the next agent boundary.",
+        ],
+    };
+    if (options.json) {
+        printJson(output);
+        return;
+    }
+    printIntentClose(output);
+}
+function archivedIntentPath(workspaceRoot, intent, closedAt) {
+    const timestamp = closedAt.replace(/[:.]/g, "-");
+    const safeId = intent.id.replace(/[^a-zA-Z0-9._-]/g, "-");
+    return path.join(workspaceRoot, ".ripple", "intents", "archive", `${timestamp}-${safeId}.json`);
+}
+function printIntentStatus(summary) {
+    console.log("Ripple intent status");
+    console.log(`Intent: ${summary.intentRef}`);
+    console.log(`Path: ${summary.intentPath}`);
+    console.log(`Active: ${formatYesNo(summary.active)}`);
+    if (summary.intent) {
+        console.log(`Id: ${summary.intent.id}`);
+        console.log(`Task: ${summary.intent.task}`);
+        console.log(`Target: ${summary.intent.targetFile}`);
+        console.log(`Control mode: ${summary.intent.controlMode}`);
+        console.log(`Human gate: ${summary.intent.humanGate}`);
+        console.log(`Boundary risk: ${summary.intent.boundaryRisk}`);
+    }
+    printHumanList("Next:", summary.nextSteps);
+}
+function printIntentClose(summary) {
+    console.log("Ripple intent closed");
+    console.log(`Intent: ${summary.intent.id}`);
+    console.log(`Task: ${summary.intent.task}`);
+    console.log(`Target: ${summary.intent.targetFile}`);
+    console.log(`Closed by: ${summary.closedBy}`);
+    console.log(`Reason: ${summary.reason}`);
+    console.log(`Archived: ${summary.archivePath}`);
+    console.log(`Closed marker: ${summary.intentPath}`);
+    printHumanList("Next:", summary.nextSteps);
+}
 function approvalStatusOutput(intent, status) {
     return {
         ...status,
@@ -2478,32 +3236,60 @@ async function buildCheckSummaryForFiles(input) {
         engine.dispose();
     }
 }
-async function checkCommand(options) {
-    if (!options.staged && !options.changed) {
-        throw new Error("Missing check mode. Usage: ripple check --staged or ripple check --changed --base <ref>");
+function selectedChangeMode(options) {
+    if (options.changed) {
+        return "changed";
+    }
+    if (options.worktree) {
+        return "worktree";
+    }
+    return "staged";
+}
+function selectedChangeModeCount(options) {
+    return [options.staged, options.changed, options.worktree].filter(Boolean).length;
+}
+function listFilesForChangeMode(workspaceRoot, mode, baseRef) {
+    if (mode === "changed") {
+        return (0, core_1.listGitChangedFiles)(workspaceRoot, baseRef);
     }
-    if (options.staged && options.changed) {
-        throw new Error("Choose one check mode: --staged or --changed");
+    if (mode === "worktree") {
+        return (0, core_1.listGitWorktreeFiles)(workspaceRoot);
+    }
+    return (0, core_1.listGitStagedFiles)(workspaceRoot);
+}
+async function checkCommand(options) {
+    if (selectedChangeModeCount(options) !== 1) {
+        throw new Error("Choose one check mode: --staged, --worktree, or --changed --base <ref>");
     }
     const workspaceRoot = resolveWorkspaceRoot(".");
     const baseRef = options.base ?? "HEAD";
-    const checkFiles = options.changed
-        ? (0, core_1.listGitChangedFiles)(workspaceRoot, baseRef)
-        : (0, core_1.listGitStagedFiles)(workspaceRoot);
+    const mode = selectedChangeMode(options);
+    let loadedIntent;
+    if (options.intent) {
+        try {
+            loadedIntent = (0, core_1.loadChangeIntent)(workspaceRoot, options.intent);
+        }
+        catch (err) {
+            if (!options.strict && !options.githubAnnotations) {
+                throw err;
+            }
+        }
+    }
+    const checkFiles = listFilesForChangeMode(workspaceRoot, mode, baseRef);
     const engine = createFastCheckEngine(workspaceRoot);
     try {
         await runWithQuietEngine(() => engine.fastCheckScan(fastCheckCandidateFiles(checkFiles)));
         const stagedSummary = (0, core_1.buildStagedCheckSummary)(engine, {
             workspaceRoot,
             stagedFiles: checkFiles,
-            mode: options.changed ? "changed" : "staged",
-            baseRef: options.changed ? baseRef : undefined,
+            mode,
+            baseRef: mode === "changed" ? baseRef : undefined,
             tokenBudget: options.budget,
         });
         let summary = stagedSummary;
         if (options.intent) {
             try {
-                const intent = (0, core_1.loadChangeIntent)(workspaceRoot, options.intent);
+                const intent = loadedIntent ?? (0, core_1.loadChangeIntent)(workspaceRoot, options.intent);
                 summary = (0, core_1.validateStagedCheckAgainstIntent)(stagedSummary, intent, {
                     currentPolicyExplanation: currentPolicyExplanationForIntent(workspaceRoot, intent),
                     currentReadinessSnapshot: currentReadinessSnapshotForEngine(workspaceRoot, engine),
@@ -2571,18 +3357,16 @@ async function checkCommand(options) {
     }
 }
 async function buildAuditFromCliOptions(options) {
-    if (options.staged && options.changed) {
-        throw new Error("Choose one gate/audit mode: --staged or --changed");
+    if (selectedChangeModeCount(options) > 1) {
+        throw new Error("Choose one gate/audit mode: --staged, --worktree, or --changed --base <ref>");
     }
     const workspaceRoot = resolveWorkspaceRoot(".");
     const intentRef = options.intent ?? "latest";
-    const mode = options.changed ? "changed" : "staged";
+    const mode = selectedChangeMode(options);
     const baseRef = options.base ?? "HEAD";
-    const files = mode === "changed"
-        ? (0, core_1.listGitChangedFiles)(workspaceRoot, baseRef)
-        : (0, core_1.listGitStagedFiles)(workspaceRoot);
     const intent = (0, core_1.loadChangeIntent)(workspaceRoot, intentRef);
     const currentPolicyExplanation = currentPolicyExplanationForIntent(workspaceRoot, intent);
+    const files = listFilesForChangeMode(workspaceRoot, mode, baseRef);
     return buildAuditForFiles({
         workspaceRoot,
         files,
@@ -2610,6 +3394,36 @@ async function auditCommand(options) {
     applyStrictExit(options.strict && strictAuditShouldFail(audit));
 }
 async function gateCommand(options) {
+    if (selectedChangeModeCount(options) > 1) {
+        throw new Error("Choose one gate/audit mode: --staged, --worktree, or --changed --base <ref>");
+    }
+    const workspaceRoot = resolveWorkspaceRoot(".");
+    const intentRef = options.intent ?? "latest";
+    const mode = selectedChangeMode(options);
+    const baseRef = options.base ?? "HEAD";
+    try {
+        (0, core_1.loadChangeIntent)(workspaceRoot, intentRef);
+    }
+    catch (err) {
+        const block = (0, core_1.buildRippleGateIntentBlockSummary)({
+            workspaceRoot,
+            mode,
+            baseRef: mode === "changed" ? baseRef : undefined,
+            intentRef,
+            error: err,
+        });
+        if (options.json) {
+            printJson(block);
+        }
+        else if (options.agent) {
+            printAgentGateIntentBlock(block);
+        }
+        else {
+            printGateIntentBlock(block);
+        }
+        applyStrictExit(true);
+        return;
+    }
     const audit = await buildAuditFromCliOptions(options);
     const gate = (0, core_1.buildRippleGateSummary)(audit);
     if (options.json) {
@@ -2621,11 +3435,67 @@ async function gateCommand(options) {
     else {
         printGateSummary(gate);
     }
+    // ─── Ripple Cloud Sync ───────────────────────────────────────────────────
+    // Records the gate decision to ripple-cloud for the compliance audit trail.
+    // Runs on EVERY gate call — including the pre-commit hook blocking scenario.
+    // Never blocks. Never throws. The commit result is unaffected by cloud sync.
+    if (process.env.RIPPLE_API_KEY) {
+        const cloudDecision = gate.canContinue ? "continue" :
+            gate.needsHuman ? "human-review" : "blocked";
+        const commitSha = (0, core_1.getCurrentCommitSha)(child_process_1.execSync);
+        const branch = (0, core_1.getCurrentBranch)(child_process_1.execSync);
+        const actor = (0, core_1.getCurrentActor)(child_process_1.execSync);
+        const cloudResult = await (0, core_1.syncAuditToCloud)({
+            intentId: audit.intent.id,
+            decision: cloudDecision,
+            commitSha,
+            branch,
+            actor,
+            source: "cli",
+            payload: {
+                // Identity
+                intentId: audit.intent.id,
+                commitSha,
+                branch,
+                actor,
+                source: "pre-commit-gate",
+                // Intent declared scope — what the developer said they would change
+                task: audit.intent.task,
+                targetFile: audit.intent.targetFile,
+                controlMode: audit.intent.controlMode,
+                boundaryRisk: audit.intent.boundaryRisk,
+                humanGate: audit.intent.humanGate,
+                // Gate verdict — what Ripple actually decided
+                decision: cloudDecision,
+                status: gate.status,
+                canContinue: gate.canContinue,
+                mustStop: gate.mustStop,
+                needsHuman: gate.needsHuman,
+                // Evidence — what actually changed
+                blockingReasons: audit.blockingReasons ?? [],
+                changedFiles: audit.changedFiles ?? [],
+                changedOutsideBoundaryFiles: audit.stagedCheck?.intentValidation?.boundaryVerdict?.changedOutsideBoundaryFiles ?? [],
+            },
+        });
+        if (!options.json && !options.agent) {
+            if (cloudResult.sent) {
+                const icon = cloudDecision === "continue" ? "✓" : "⛔";
+                console.log(`\n[Ripple Cloud] ${icon} Gate decision recorded: ${cloudDecision} (${commitSha.slice(0, 7)})`);
+            }
+            else if (cloudResult.error) {
+                console.warn(`\n[Ripple Cloud] ⚠ Sync failed (non-blocking): ${cloudResult.error}`);
+            }
+        }
+    }
+    // ────────────────────────────────────────────────────────────────────────
     applyStrictExit(options.strict && !gate.canContinue);
 }
 function approveCommand(options) {
     const workspaceRoot = resolveWorkspaceRoot(".");
     const intentRef = options.intent ?? "latest";
+    if (!options.reason || options.reason.trim().length === 0) {
+        throw new Error("Approval requires --reason explaining why this boundary is approved.");
+    }
     const intent = (0, core_1.loadChangeIntent)(workspaceRoot, intentRef);
     const approval = (0, core_1.recordRippleApproval)(workspaceRoot, intent, {
         gate: options.gate,
@@ -2642,6 +3512,171 @@ function approveCommand(options) {
     }
     printApprovalRecord(approval);
 }
+function executeVerificationCommand(workspaceRoot, command, note) {
+    const startedAt = Date.now();
+    const result = (0, child_process_1.spawnSync)(command, {
+        cwd: workspaceRoot,
+        shell: true,
+        encoding: "utf8",
+        maxBuffer: 1024 * 1024,
+        windowsHide: true,
+    });
+    const durationMs = Math.max(0, Date.now() - startedAt);
+    const exitCode = typeof result.status === "number" ? result.status : 1;
+    const stderr = [
+        typeof result.stderr === "string" ? result.stderr : "",
+        result.error ? result.error.message : "",
+    ].filter(Boolean).join("\n");
+    return {
+        command,
+        status: exitCode === 0 ? "passed" : "failed",
+        exitCode,
+        durationMs,
+        stdoutTail: outputTail(typeof result.stdout === "string" ? result.stdout : ""),
+        stderrTail: outputTail(stderr),
+        note,
+    };
+}
+function outputTail(value, maxLength = 4000) {
+    const normalized = value.replace(/\r\n/g, "\n").trim();
+    if (normalized.length === 0) {
+        return undefined;
+    }
+    return normalized.length > maxLength ? normalized.slice(-maxLength) : normalized;
+}
+function currentChangeSnapshotForVerification(workspaceRoot, intent) {
+    const scope = verificationSnapshotScope(intent);
+    const snapshot = (changedFiles, diff, changeMode) => ({
+        changedFiles: changedFiles
+            .map(normalizeProjectPath)
+            .filter(core_1.isRippleSourceFile)
+            .filter((file) => scope.size === 0 || scope.has(file)),
+        changeMode,
+        changeFingerprint: (0, core_1.fingerprintRippleChangeDiff)(diff),
+    });
+    try {
+        const diff = (0, core_1.listGitChangedDiff)(workspaceRoot, "HEAD");
+        const changedFiles = (0, core_1.listGitChangedFiles)(workspaceRoot, "HEAD");
+        const changedSnapshot = snapshot(changedFiles, diff, "changed");
+        if (changedSnapshot.changedFiles.length > 0) {
+            return changedSnapshot;
+        }
+    }
+    catch {
+        // Repositories without a HEAD commit fall back to staged/worktree snapshots.
+    }
+    try {
+        const diff = (0, core_1.listGitStagedDiff)(workspaceRoot);
+        const stagedSnapshot = snapshot((0, core_1.listGitStagedFiles)(workspaceRoot), diff, "staged");
+        if (stagedSnapshot.changedFiles.length > 0) {
+            return stagedSnapshot;
+        }
+    }
+    catch {
+        // Fall through to worktree or empty coverage.
+    }
+    try {
+        return snapshot((0, core_1.listGitWorktreeFiles)(workspaceRoot), (0, core_1.listGitWorktreeDiff)(workspaceRoot), "worktree");
+    }
+    catch {
+        return { changedFiles: [], changeMode: "staged" };
+    }
+}
+function verificationSnapshotScope(intent) {
+    return new Set([
+        ...intent.editableFiles,
+        ...intent.expectedFiles,
+        intent.targetFile,
+    ].map(normalizeProjectPath));
+}
+function verifyCommand(options) {
+    const workspaceRoot = process.cwd();
+    const intentRef = options.intent ?? "latest";
+    const reportedCommand = options.verificationCommand?.trim();
+    const runCommand = options.verificationRunCommand?.trim();
+    if (reportedCommand && runCommand) {
+        throw new Error("Use either --run for Ripple-executed evidence or --command/--status for reported evidence, not both.");
+    }
+    if (!reportedCommand && !runCommand) {
+        throw new Error("Usage: ripple verify --run <test command> [--intent latest|path] or ripple verify --command <test command> --status passed|failed|skipped|unknown [--intent latest|path]");
+    }
+    if (runCommand && options.verificationStatus) {
+        throw new Error("--status is only valid with --command. Use --run to let Ripple compute passed/failed from the exit code.");
+    }
+    const intent = (0, core_1.loadChangeIntent)(workspaceRoot, intentRef);
+    const executed = runCommand
+        ? executeVerificationCommand(workspaceRoot, runCommand, options.note)
+        : undefined;
+    const changeSnapshot = currentChangeSnapshotForVerification(workspaceRoot, intent);
+    const updatedIntent = (0, core_1.appendRippleVerificationEvidence)(intent, {
+        command: executed?.command ?? reportedCommand ?? "",
+        status: executed?.status ?? options.verificationStatus ?? "unknown",
+        source: executed ? "executed" : "reported",
+        changedFiles: changeSnapshot.changedFiles,
+        changeMode: changeSnapshot.changeMode,
+        changeFingerprint: changeSnapshot.changeFingerprint,
+        exitCode: executed?.exitCode,
+        durationMs: executed?.durationMs,
+        stdoutTail: executed?.stdoutTail,
+        stderrTail: executed?.stderrTail,
+        note: executed?.note ?? options.note,
+    });
+    const intentPath = (0, core_1.saveChangeIntent)(workspaceRoot, updatedIntent, intentRef);
+    const evidence = updatedIntent.verificationEvidence[updatedIntent.verificationEvidence.length - 1];
+    const evidenceSourceLabel = evidence.source === "executed"
+        ? "Ripple executed this command and recorded its exit code."
+        : "Ripple recorded reported evidence only; it did not independently run this command.";
+    const output = {
+        protocol: "ripple-verification-evidence",
+        version: 1,
+        workspace: workspaceRoot,
+        intentPath,
+        intentId: updatedIntent.id,
+        evidence,
+        totalEvidence: updatedIntent.verificationEvidence.length,
+        nextSteps: [
+            "Run ripple gate --intent latest --json to include this evidence in the review packet.",
+            evidence.status === "failed"
+                ? "Fix the failing verification, rerun ripple verify --run, then run ripple gate again."
+                : "Run ripple gate again before handoff so the continue/stop decision includes this evidence.",
+            evidenceSourceLabel,
+        ],
+    };
+    if (options.json) {
+        printJson(output);
+        return;
+    }
+    console.log("Ripple verification evidence");
+    console.log(`Intent: ${output.intentId}`);
+    console.log(`Intent path: ${path.relative(workspaceRoot, output.intentPath) || output.intentPath}`);
+    console.log(`Status: ${output.evidence.status}`);
+    console.log(`Command: ${output.evidence.command}`);
+    console.log(`Source: ${output.evidence.source}`);
+    if (typeof output.evidence.exitCode === "number") {
+        console.log(`Exit code: ${output.evidence.exitCode}`);
+    }
+    if (typeof output.evidence.durationMs === "number") {
+        console.log(`Duration ms: ${output.evidence.durationMs}`);
+    }
+    if (output.evidence.changedFiles) {
+        printHumanList("Changed files covered:", output.evidence.changedFiles);
+    }
+    if (output.evidence.changeMode) {
+        console.log(`Change mode: ${output.evidence.changeMode}`);
+    }
+    if (output.evidence.changeFingerprint) {
+        console.log(`Change fingerprint: ${output.evidence.changeFingerprint.slice(0, 12)}`);
+    }
+    console.log(`Recorded at: ${output.evidence.recordedAt}`);
+    if (output.evidence.note) {
+        console.log(`Note: ${output.evidence.note}`);
+    }
+    if (output.evidence.stderrTail) {
+        console.log("Stderr tail:");
+        console.log(output.evidence.stderrTail);
+    }
+    console.log(`Note: ${evidenceSourceLabel}`);
+}
 function approvalCommand(options) {
     const workspaceRoot = resolveWorkspaceRoot(".");
     const intentRef = options.intent ?? "latest";
@@ -2660,9 +3695,94 @@ function approvalCommand(options) {
 async function ciCommand(options) {
     const workspaceRoot = resolveWorkspaceRoot(".");
     const baseRef = options.base ?? defaultCiBaseRef();
+    const hasExplicitIntent = Boolean(options.intent);
     const intentRef = options.intent ?? "latest";
     const files = (0, core_1.listGitChangedFiles)(workspaceRoot, baseRef);
     const emitGithubAnnotations = shouldEmitGithubAnnotations(options);
+    if (!hasExplicitIntent) {
+        const summary = await buildCheckSummaryForFiles({
+            workspaceRoot,
+            files,
+            mode: "changed",
+            baseRef,
+            tokenBudget: options.budget,
+        });
+        const policySync = buildPolicySyncSummary(workspaceRoot);
+        if (options.json) {
+            printJson({
+                ...summary,
+                protocol: "ripple-ci-policy-audit",
+                version: 1,
+                auditMode: true,
+                blocking: false,
+                intentRequired: false,
+                policySync,
+            });
+        }
+        else if (options.agent) {
+            printAgentStagedCheckSummary(summary);
+            console.log("");
+            console.log("ci_mode: policy-audit");
+            console.log("blocking: false");
+            console.log("intent_required: false");
+            console.log(`policy_sync: ${policySync.status}`);
+            if (policySync.missingRules.length > 0) {
+                console.log("policy_sync_missing_rules:");
+                policySync.missingRules.slice(0, 12).forEach((rule) => {
+                    console.log(`- ${rule.paths.join(", ")} risk=${rule.risk ?? "medium"}`);
+                });
+            }
+            console.log("next_required_action: Review policy-risk findings and policy-sync warnings before merge. Use --intent latest --strict only when you want an intent-bound hard gate.");
+        }
+        else {
+            console.log("Ripple CI policy audit");
+            console.log("Status: audit");
+            console.log("Blocking: false");
+            console.log("Intent: none (local intents are not required in CI audit mode)");
+            console.log(`Policy sync: ${policySync.status}`);
+            if (policySync.missingRules.length > 0) {
+                console.log("");
+                console.log("Policy may be missing risky repo surfaces:");
+                policySync.missingRules.slice(0, 12).forEach((rule) => {
+                    console.log(`- ${rule.paths.join(", ")} risk=${rule.risk ?? "medium"}`);
+                });
+            }
+            console.log("");
+            printStagedCheckSummary(summary);
+            console.log("");
+            console.log("Next action: Review policy-risk findings and policy-sync warnings before merge. Use --intent latest --strict only when you want an intent-bound hard gate.");
+        }
+        if (emitGithubAnnotations && !options.json) {
+            printGithubPolicyAuditAnnotations(summary, policySync);
+        }
+        writeGithubPolicyAuditStepSummary(summary, policySync);
+        // FOUNDER FIX: Add Cloud Sync to the Policy Audit Path
+        if (process.env.RIPPLE_API_KEY) {
+            const commitSha = options.sha ?? (0, core_1.getCurrentCommitSha)(child_process_1.execSync);
+            const branch = (0, core_1.getCurrentBranch)(child_process_1.execSync);
+            const actor = (0, core_1.getCurrentActor)(child_process_1.execSync);
+            const syntheticIntentId = `ci-policy-${commitSha.slice(0, 16)}`;
+            const cloudResult = await (0, core_1.syncAuditToCloud)({
+                protocol: 'ripple-audit', // FOUNDER FIX: Satisfy the strict Zod Cloud Schema
+                intentId: syntheticIntentId,
+                decision: 'continue',
+                commitSha,
+                branch,
+                actor,
+                source: 'ci',
+                payload: { mode: 'policy-audit', commitSha, branch, actor },
+            });
+            if (!options.json && !options.agent) {
+                if (cloudResult.sent) {
+                    console.log(`\n[Ripple Cloud] ✓ Policy audit synced (${commitSha.slice(0, 7)})`);
+                }
+                else if (cloudResult.error) {
+                    console.warn(`\n[Ripple Cloud] ⚠ Sync failed: ${cloudResult.error}`);
+                }
+            }
+        }
+        return;
+    }
     let intent;
     try {
         intent = (0, core_1.loadChangeIntent)(workspaceRoot, intentRef);
@@ -2709,7 +3829,7 @@ async function ciCommand(options) {
             printGithubIntentLoadError(message);
         }
         writeGithubStepSummary({ summary, intentLoadError: message });
-        process.exitCode = 1;
+        applyStrictExit(options.strict);
         return;
     }
     const audit = await buildAuditForFiles({
@@ -2737,7 +3857,45 @@ async function ciCommand(options) {
         printGithubAuditAnnotations(audit);
     }
     writeGithubAuditStepSummary(audit);
-    applyStrictExit(strictAuditShouldFail(audit));
+    // ─── Ripple Cloud Sync ──────────────────────────────────────────────────
+    // Sends the audit result to ripple-cloud so the GitHub App can verify it.
+    // Only runs when RIPPLE_API_KEY is set. Never blocks or throws.
+    if (process.env.RIPPLE_API_KEY) {
+        const gate = (0, core_1.buildRippleGateSummary)(audit);
+        const cloudDecision = gate.canContinue ? "continue" :
+            gate.needsHuman ? "human-review" : "blocked";
+        const commitSha = options.sha ?? (0, core_1.getCurrentCommitSha)(child_process_1.execSync);
+        const branch = (0, core_1.getCurrentBranch)(child_process_1.execSync);
+        const actor = (0, core_1.getCurrentActor)(child_process_1.execSync);
+        const cloudResult = await (0, core_1.syncAuditToCloud)({
+            intentId: intent.id,
+            decision: cloudDecision,
+            commitSha,
+            branch,
+            actor,
+            source: "ci",
+            payload: {
+                intentId: intent.id,
+                commitSha,
+                branch,
+                actor,
+                decision: cloudDecision,
+                gate,
+                violations: audit.violations?.length ?? 0,
+                riskLevel: audit.riskLevel ?? "unknown",
+            },
+        });
+        if (!options.json && !options.agent) {
+            if (cloudResult.sent) {
+                console.log(`[Ripple Cloud] ✓ Audit synced (${commitSha.slice(0, 7)})`);
+            }
+            else if (cloudResult.error) {
+                console.warn(`[Ripple Cloud] ⚠ Sync failed (non-blocking): ${cloudResult.error}`);
+            }
+        }
+    }
+    // ────────────────────────────────────────────────────────────────────────
+    applyStrictExit(options.strict && strictAuditShouldFail(audit));
 }
 async function doctorCommand(options) {
     const workspaceRoot = resolveWorkspaceRoot(".");
@@ -2745,14 +3903,19 @@ async function doctorCommand(options) {
     try {
         await runWithQuietEngine(() => engine.initialScan());
         const summary = (0, core_1.buildRippleReadinessSummary)(workspaceRoot, engine);
+        const policySync = buildPolicySyncSummary(workspaceRoot);
+        const output = {
+            ...summary,
+            policySync,
+        };
         if (options.json) {
-            printJson(summary);
+            printJson(output);
         }
         else if (options.agent) {
-            printAgentDoctorSummary(summary);
+            printAgentDoctorSummary(output);
         }
         else {
-            printDoctorSummary(summary);
+            printDoctorSummary(output);
         }
         applyStrictExit(options.strict && summary.status !== "ready");
     }
@@ -2762,7 +3925,7 @@ async function doctorCommand(options) {
 }
 async function initCommand(options) {
     const workspaceRoot = resolveWorkspaceRoot(".");
-    const policy = (0, core_1.defaultRipplePolicy)();
+    const { policy } = (0, core_1.buildSmartRipplePolicy)(workspaceRoot);
     const policyContents = (0, core_1.formatRipplePolicy)(policy);
     const workflow = githubActionsWorkflow();
     const gitignoreBlock = rippleGitIgnoreBlock();
@@ -2785,6 +3948,32 @@ async function initCommand(options) {
         },
     ];
     if (options.print) {
+        const agentFiles = agentSetupFiles(workspaceRoot);
+        const agentSetup = buildAgentSetupSummary(workspaceRoot, agentFiles.map((file) => ({
+            path: file.path,
+            status: "printed",
+            written: false,
+            overwritten: false,
+            content: file.content,
+        })));
+        const preCommitContent = ripplePreCommitHookScript();
+        const postCommitContent = ripplePostCommitHookScript();
+        const hookPath = preferredHookPath(workspaceRoot, "pre-commit");
+        const postCommitHookPath = preferredHookPath(workspaceRoot, "post-commit");
+        const hooks = {
+            protocol: "ripple-hook-install",
+            version: 1,
+            workspace: workspaceRoot,
+            path: normalizeHookPathForOutput(workspaceRoot, hookPath),
+            postCommitPath: normalizeHookPathForOutput(workspaceRoot, postCommitHookPath),
+            status: "printed",
+            written: false,
+            overwritten: false,
+            content: [preCommitContent, postCommitContent].join("\n--- ripple-post-commit ---\n"),
+            preCommitContent,
+            postCommitContent,
+            nextSteps: ["Review the hook scripts, then run ripple init to write the full local setup."],
+        };
         const summary = {
             protocol: "ripple-init",
             version: 1,
@@ -2796,20 +3985,30 @@ async function initCommand(options) {
                 overwritten: false,
                 content: file.content,
             })),
+            agentSetup,
+            hooks,
             nextSteps: defaultInitNextSteps(),
         };
         if (options.json) {
             printJson(summary);
             return;
         }
-        process.stdout.write(files
-            .flatMap((file) => [`# ${file.path}`, file.content.trimEnd(), ""])
-            .join("\n"));
+        process.stdout.write([
+            ...files.flatMap((file) => [`# ${file.path}`, file.content.trimEnd(), ""]),
+            ...agentFiles.flatMap((file) => [`# ${file.path}`, file.content.trimEnd(), ""]),
+            "# .git hooks",
+            preCommitContent.trimEnd(),
+            "--- ripple-post-commit ---",
+            postCommitContent.trimEnd(),
+            "",
+        ].join("\n"));
         return;
     }
     const writtenFiles = files.map((file) => file.merge
         ? writeRippleGitIgnoreFile(file.absolutePath)
         : writeInitFile(file, options.force));
+    const agentSetup = buildAgentSetupSummary(workspaceRoot, agentSetupFiles(workspaceRoot).map((file) => writeAgentSetupFile(file, options.force)));
+    const hooks = installRippleHooks(workspaceRoot);
     const engine = createCliEngine(workspaceRoot);
     try {
         await runWithQuietEngine(() => engine.initialScan());
@@ -2819,6 +4018,8 @@ async function initCommand(options) {
             version: 1,
             workspace: workspaceRoot,
             files: writtenFiles,
+            agentSetup,
+            hooks,
             readiness,
             nextSteps: defaultInitNextSteps(readiness),
         };
@@ -2833,6 +4034,65 @@ async function initCommand(options) {
         engine.dispose();
     }
 }
+function writeAgentSetupFile(file, force) {
+    const existed = fs.existsSync(file.absolutePath);
+    const nextSection = normalizeLf(file.content);
+    if (!existed || force) {
+        fs.mkdirSync(path.dirname(file.absolutePath), { recursive: true });
+        fs.writeFileSync(file.absolutePath, ensureTrailingLf(nextSection), "utf8");
+        return {
+            path: file.path,
+            status: existed ? "overwritten" : "written",
+            written: true,
+            overwritten: existed,
+        };
+    }
+    const existing = fs.readFileSync(file.absolutePath, "utf8");
+    const updated = mergeRippleManagedSection(existing, nextSection);
+    if (updated.content === existing) {
+        return {
+            path: file.path,
+            status: "exists",
+            written: false,
+            overwritten: false,
+        };
+    }
+    fs.writeFileSync(file.absolutePath, updated.content, "utf8");
+    return {
+        path: file.path,
+        status: updated.action,
+        written: true,
+        overwritten: false,
+    };
+}
+function mergeRippleManagedSection(existing, nextSection) {
+    const normalizedExisting = normalizeLf(existing);
+    const start = normalizedExisting.indexOf(RIPPLE_AGENT_SECTION_START);
+    const end = normalizedExisting.indexOf(RIPPLE_AGENT_SECTION_END);
+    if (start !== -1 && end !== -1 && end > start) {
+        const afterEnd = end + RIPPLE_AGENT_SECTION_END.length;
+        const withoutOldSection = `${normalizedExisting.slice(0, start)}${normalizedExisting.slice(afterEnd)}`;
+        return {
+            content: appendRippleSectionAtBottom(withoutOldSection, nextSection),
+            action: "updated",
+        };
+    }
+    return {
+        content: appendRippleSectionAtBottom(normalizedExisting, nextSection),
+        action: "appended",
+    };
+}
+function appendRippleSectionAtBottom(existing, nextSection) {
+    const base = normalizeLf(existing).replace(/\n*$/, "");
+    const separator = base.length === 0 ? "" : "\n\n";
+    return `${base}${separator}${ensureTrailingLf(normalizeLf(nextSection))}`;
+}
+function normalizeLf(value) {
+    return value.replace(/\r\n/g, "\n").replace(/\r/g, "\n");
+}
+function ensureTrailingLf(value) {
+    return value.endsWith("\n") ? value : `${value}\n`;
+}
 function writeInitFile(file, force) {
     const existed = fs.existsSync(file.absolutePath);
     if (existed && !force) {
@@ -2890,6 +4150,315 @@ function gitIgnoreContainsRippleCache(contents) {
         line === ".ripple/.cache" ||
         line === ".ripple/.cache/**");
 }
+const RIPPLE_PRE_COMMIT_HOOK_START = "# >>> ripple pre-commit hook";
+const RIPPLE_PRE_COMMIT_HOOK_END = "# <<< ripple pre-commit hook";
+const RIPPLE_POST_COMMIT_HOOK_START = "# >>> ripple post-commit hook";
+const RIPPLE_POST_COMMIT_HOOK_END = "# <<< ripple post-commit hook";
+function ripplePreCommitHookBlock() {
+    return [
+        RIPPLE_PRE_COMMIT_HOOK_START,
+        `# Policy is permanent. Intent is local. Git staged diff is truth.
+ripple_previous_status=$?
+if [ "$ripple_previous_status" -ne 0 ]; then
+  exit "$ripple_previous_status"
+fi
+
+set +e
+
+ripple_run() {
+${rippleDirectRunnerHookLines().join("\n")}
+}
+
+if [ -f ".ripple/intents/latest.json" ]; then
+  echo "[Ripple] Active local intent found. Checking staged changes against approved boundary..."
+  ripple_run gate --staged --intent latest --agent --strict
+  status=$?
+  if [ "$status" -ne 0 ]; then
+    cat <<'EOF'
+[RIPPLE STOP] Commit blocked by Ripple active-intent boundary.
+
+If you are an AI agent:
+- DO NOT retry the commit.
+- Repair the unauthorized change or ask the human to approve a wider scope.
+
+If you are a human developer:
+- Review the Ripple output above.
+- To bypass this local hook intentionally, run: git commit --no-verify
+EOF
+    exit $status
+  fi
+else
+  echo "[Ripple] No active local intent found. Running staged policy/contract awareness check..."
+  ripple_run check --staged --agent
+  status=$?
+  if [ "$status" -ne 0 ]; then
+    cat <<'EOF'
+[RIPPLE WARNING] Ripple could not complete the no-intent staged check.
+
+If you are an AI agent:
+- Stop and ask the human before continuing.
+
+If you are a human developer:
+- Review the error above.
+- To bypass this local hook intentionally, run: git commit --no-verify
+EOF
+    exit $status
+  fi
+fi`,
+        RIPPLE_PRE_COMMIT_HOOK_END,
+        "",
+    ].join("\n");
+}
+function ripplePreCommitHookScript() {
+    return [
+        "#!/bin/sh",
+        "# Ripple pre-commit hook - generated by `ripple hook install`.",
+        ripplePreCommitHookBlock(),
+        "exit 0",
+        "",
+    ].join("\n");
+}
+function ripplePostCommitHookBlock() {
+    return [
+        RIPPLE_POST_COMMIT_HOOK_START,
+        `# Local intents are consumed after a successful commit.
+# If RIPPLE_API_KEY is set, the commit is synced to ripple-cloud for GitHub App verification.
+set +e
+
+COMMIT_SHA=$(git rev-parse HEAD 2>/dev/null || echo "unknown")
+BRANCH=$(git branch --show-current 2>/dev/null || echo "unknown")
+ACTOR=$(git config user.name 2>/dev/null || git config user.email 2>/dev/null || echo "unknown")
+CLOUD_URL=\${RIPPLE_CLOUD_URL:-https://your-ripple-cloud.vercel.app}
+
+INTENT_FILE=""
+for intent_file in .ripple/.cache/latest-intent.json .ripple/intents/latest.json; do
+  if [ -f "$intent_file" ]; then
+    INTENT_FILE="$intent_file"
+    break
+  fi
+done
+
+# Cloud sync — only if API key is set and we have an intent to sync
+if [ -n "$RIPPLE_API_KEY" ] && [ -n "$INTENT_FILE" ]; then
+  INTENT_ID=$(node -e "try{const d=require('fs').readFileSync(process.argv[1],'utf8');console.log(JSON.parse(d).id||'')}catch(e){console.log('')}" "$INTENT_FILE" 2>/dev/null || echo "")
+  if [ -n "$INTENT_ID" ]; then
+    node -e "
+const https = require('https');
+const http = require('http');
+const url = new URL(process.env.CLOUD_URL + '/api/audit');
+const isHttps = url.protocol === 'https:';
+const body = JSON.stringify({
+  intentId: process.env.INTENT_ID,
+  decision: 'continue',
+  commitSha: process.env.COMMIT_SHA,
+  branch: process.env.BRANCH,
+  actor: process.env.ACTOR,
+  source: 'cli',
+  payload: { commitSha: process.env.COMMIT_SHA, source: 'post-commit-hook', branch: process.env.BRANCH }
+});
+const lib = isHttps ? https : http;
+const req = lib.request({
+  hostname: url.hostname,
+  port: url.port || (isHttps ? 443 : 80),
+  path: url.pathname,
+  method: 'POST',
+  headers: {
+    'Content-Type': 'application/json',
+    'Authorization': 'Bearer ' + process.env.RIPPLE_API_KEY,
+    'Content-Length': Buffer.byteLength(body)
+  }
+}, res => {
+  if (res.statusCode < 300) process.stdout.write('[Ripple Cloud] Commit synced (' + process.env.COMMIT_SHA.slice(0,7) + ')\\n');
+});
+req.setTimeout(3000, () => req.destroy());
+req.on('error', () => {});
+req.write(body);
+req.end();
+" 2>/dev/null || true
+  fi
+fi
+
+# Clear the local intent after sync
+cleared=0
+for intent_file in .ripple/.cache/latest-intent.json .ripple/intents/latest.json; do
+  if [ -f "$intent_file" ]; then
+    rm "$intent_file"
+    cleared=1
+  fi
+done
+
+if [ "$cleared" -eq 1 ]; then
+  echo "[Ripple] Consumed and cleared local intent."
+fi`,
+        RIPPLE_POST_COMMIT_HOOK_END,
+        "",
+    ].join("\n");
+}
+function ripplePostCommitHookScript() {
+    return [
+        "#!/bin/sh",
+        "# Ripple post-commit hook - generated by `ripple hook install`.",
+        ripplePostCommitHookBlock(),
+        "exit 0",
+        "",
+    ].join("\n");
+}
+function normalizeHookPathForOutput(workspaceRoot, hookPath) {
+    return path.relative(workspaceRoot, hookPath).split(path.sep).join("/");
+}
+function preferredHookPath(workspaceRoot, hookName) {
+    const huskyDir = path.join(workspaceRoot, ".husky");
+    if (fs.existsSync(huskyDir) && fs.statSync(huskyDir).isDirectory()) {
+        return path.join(huskyDir, hookName);
+    }
+    return path.join(workspaceRoot, ".git", "hooks", hookName);
+}
+function installRippleHookBlock(input) {
+    const { hookPath, fullScript, block, marker } = input;
+    if (!fs.existsSync(hookPath)) {
+        fs.mkdirSync(path.dirname(hookPath), { recursive: true });
+        fs.writeFileSync(hookPath, fullScript, { encoding: "utf8", mode: 0o755 });
+        try {
+            fs.chmodSync(hookPath, 0o755);
+        }
+        catch {
+            // chmod is best-effort on Windows.
+        }
+        return "created";
+    }
+    const existing = fs.readFileSync(hookPath, "utf8");
+    if (existing.includes(marker)) {
+        return "already-present";
+    }
+    const separator = existing.length === 0 || existing.endsWith("\n") ? "" : "\n";
+    fs.writeFileSync(hookPath, `${existing}${separator}\n${block}\n`, "utf8");
+    try {
+        fs.chmodSync(hookPath, 0o755);
+    }
+    catch {
+        // chmod is best-effort on Windows.
+    }
+    return "appended";
+}
+function installRippleHooks(workspaceRoot) {
+    if (!fs.existsSync(path.join(workspaceRoot, ".git"))) {
+        throw new Error("Cannot install Ripple hook because .git was not found. Run this inside a Git worktree.");
+    }
+    const hookPath = preferredHookPath(workspaceRoot, "pre-commit");
+    const postCommitHookPath = preferredHookPath(workspaceRoot, "post-commit");
+    const content = ripplePreCommitHookScript();
+    const postCommitContent = ripplePostCommitHookScript();
+    const preCommitAction = installRippleHookBlock({
+        hookPath,
+        fullScript: content,
+        block: ripplePreCommitHookBlock(),
+        marker: RIPPLE_PRE_COMMIT_HOOK_START,
+    });
+    const postCommitAction = installRippleHookBlock({
+        hookPath: postCommitHookPath,
+        fullScript: postCommitContent,
+        block: ripplePostCommitHookBlock(),
+        marker: RIPPLE_POST_COMMIT_HOOK_START,
+    });
+    const wroteSomething = preCommitAction !== "already-present" || postCommitAction !== "already-present";
+    return {
+        protocol: "ripple-hook-install",
+        version: 1,
+        workspace: workspaceRoot,
+        path: normalizeHookPathForOutput(workspaceRoot, hookPath),
+        postCommitPath: normalizeHookPathForOutput(workspaceRoot, postCommitHookPath),
+        status: wroteSomething ? "written" : "exists",
+        written: wroteSomething,
+        overwritten: false,
+        preCommitAction,
+        postCommitAction,
+        nextSteps: [
+            "Run ripple plan --file <file> --task \"<task>\" --mode file --agent --save before AI edits.",
+            "Commit normally; Ripple will block active-intent drift and clear consumed local intents after successful commits.",
+        ],
+    };
+}
+function hookInstallCommand(subcommand, options) {
+    if (subcommand !== "install") {
+        throw new Error("Usage: ripple hook install [--print] [--force]");
+    }
+    const workspaceRoot = resolveWorkspaceRoot(".");
+    const hookPath = preferredHookPath(workspaceRoot, "pre-commit");
+    const postCommitHookPath = preferredHookPath(workspaceRoot, "post-commit");
+    const relativeHookPath = normalizeHookPathForOutput(workspaceRoot, hookPath);
+    const relativePostCommitHookPath = normalizeHookPathForOutput(workspaceRoot, postCommitHookPath);
+    const content = ripplePreCommitHookScript();
+    const postCommitContent = ripplePostCommitHookScript();
+    if (options.print) {
+        const summary = {
+            protocol: "ripple-hook-install",
+            version: 1,
+            workspace: workspaceRoot,
+            path: relativeHookPath,
+            postCommitPath: relativePostCommitHookPath,
+            status: "printed",
+            written: false,
+            overwritten: false,
+            content: [content, postCommitContent].join("\n--- ripple-post-commit ---\n"),
+            preCommitContent: content,
+            postCommitContent,
+            nextSteps: ["Review the hook scripts, then run ripple hook install to write them."],
+        };
+        if (options.json) {
+            printJson(summary);
+        }
+        else {
+            process.stdout.write(content);
+            process.stdout.write("\n--- ripple-post-commit ---\n");
+            process.stdout.write(postCommitContent);
+        }
+        return;
+    }
+    if (!fs.existsSync(path.join(workspaceRoot, ".git"))) {
+        throw new Error("Cannot install Ripple hook because .git was not found. Run this inside a Git worktree.");
+    }
+    const preCommitAction = installRippleHookBlock({
+        hookPath,
+        fullScript: content,
+        block: ripplePreCommitHookBlock(),
+        marker: RIPPLE_PRE_COMMIT_HOOK_START,
+    });
+    const postCommitAction = installRippleHookBlock({
+        hookPath: postCommitHookPath,
+        fullScript: postCommitContent,
+        block: ripplePostCommitHookBlock(),
+        marker: RIPPLE_POST_COMMIT_HOOK_START,
+    });
+    const wroteSomething = preCommitAction !== "already-present" || postCommitAction !== "already-present";
+    const summary = {
+        protocol: "ripple-hook-install",
+        version: 1,
+        workspace: workspaceRoot,
+        path: relativeHookPath,
+        postCommitPath: relativePostCommitHookPath,
+        status: wroteSomething ? "written" : "exists",
+        written: wroteSomething,
+        overwritten: false,
+        preCommitAction,
+        postCommitAction,
+        nextSteps: [
+            "Commit normally. Ripple will check staged changes before each commit.",
+            "After a successful commit, Ripple clears consumed local intents to prevent ghost-intent blocks.",
+            "Humans can intentionally bypass local hooks with git commit --no-verify.",
+        ],
+    };
+    if (options.json) {
+        printJson(summary);
+    }
+    else {
+        console.log(wroteSomething ? "Ripple Git hooks integrated" : "Ripple Git hooks already integrated");
+        console.log(`Pre-commit: ${relativeHookPath} (${preCommitAction})`);
+        console.log(`Post-commit: ${relativePostCommitHookPath} (${postCommitAction})`);
+        console.log("Active intent: blocks staged drift against latest local plan.");
+        console.log("No intent: warns with staged policy/contract awareness and lets humans stay in control.");
+        console.log("Post-commit: clears consumed local intents to prevent ghost-intent blocks.");
+    }
+}
 function initCiCommand(options) {
     const workflow = githubActionsWorkflow();
     const workspaceRoot = resolveWorkspaceRoot(".");
@@ -2924,7 +4493,7 @@ function initCiCommand(options) {
     }
     console.log(existed ? "Ripple CI workflow overwritten" : "Ripple CI workflow written");
     console.log(`Path: ${relativeTargetPath}`);
-    console.log("Command: npx -y @getripple/cli@latest ci --base origin/${{ github.base_ref }} --intent latest --github-annotations");
+    console.log(`Command: npx -y ${rippleCliPackageSpec()} ci --base origin/\${{ github.base_ref }} --github-annotations`);
 }
 function policyCommand(args, options) {
     const subcommand = args[0];
@@ -2932,15 +4501,19 @@ function policyCommand(args, options) {
         policyInitCommand(options);
         return;
     }
+    if (subcommand === "sync") {
+        policySyncCommand(options);
+        return;
+    }
     if (subcommand === "explain") {
         policyExplainCommand(options);
         return;
     }
-    throw new Error("Usage: ripple policy init [--print] [--force] or ripple policy explain --file <file>");
+    throw new Error("Usage: ripple policy init [--print] [--force], ripple policy sync [--json], or ripple policy explain --file <file>");
 }
 function policyInitCommand(options) {
-    const policy = (0, core_1.defaultRipplePolicy)();
     const workspaceRoot = resolveWorkspaceRoot(".");
+    const { policy, detections } = (0, core_1.buildSmartRipplePolicy)(workspaceRoot);
     const targetPath = (0, core_1.ripplePolicyPath)(workspaceRoot);
     const relativeTargetPath = core_1.RIPPLE_POLICY_PATH.split(path.sep).join("/");
     const contents = (0, core_1.formatRipplePolicy)(policy);
@@ -2949,6 +4522,7 @@ function policyInitCommand(options) {
             printJson({
                 path: relativeTargetPath,
                 policy,
+                detections,
                 written: false,
             });
         }
@@ -2969,6 +4543,7 @@ function policyInitCommand(options) {
             written: true,
             overwritten: existed,
             policy,
+            detections,
         });
         return;
     }
@@ -2976,6 +4551,189 @@ function policyInitCommand(options) {
     console.log(`Path: ${relativeTargetPath}`);
     console.log(`Default mode: ${policy.defaultMode ?? "file"}`);
     console.log(`Risk rules: ${policy.riskRules?.length ?? 0}`);
+    if (detections.length > 0) {
+        console.log("Smart detections:");
+        detections.forEach((detection) => {
+            console.log(`- ${detection.kind}: ${detection.evidence.join(", ")}`);
+        });
+    }
+}
+function policySyncCommand(options) {
+    const workspaceRoot = resolveWorkspaceRoot(".");
+    const summary = buildPolicySyncSummary(workspaceRoot);
+    if (options.json) {
+        printJson(summary);
+        return;
+    }
+    printPolicySyncSummary(summary);
+}
+function buildPolicySyncSummary(workspaceRoot) {
+    const loadedPolicy = (0, core_1.loadRipplePolicy)(workspaceRoot);
+    const { policy: smartPolicy, detections } = (0, core_1.buildSmartRipplePolicy)(workspaceRoot);
+    const existingRules = loadedPolicy.policy.riskRules ?? [];
+    const missingRules = [];
+    const missingRuleKeys = new Set();
+    const detectionSummaries = detections.map((detection) => {
+        let missingForDetection = 0;
+        detection.rules.forEach((rule) => {
+            if (policyRuleIsCovered(rule, existingRules)) {
+                return;
+            }
+            const key = policyRuleKey(rule);
+            if (missingRuleKeys.has(key)) {
+                return;
+            }
+            missingRuleKeys.add(key);
+            missingForDetection += 1;
+            missingRules.push({
+                ...clonePolicyRule(rule),
+                reason: `${detection.kind}: ${detection.evidence.join(", ")}`,
+            });
+        });
+        return {
+            kind: detection.kind,
+            evidence: detection.evidence,
+            missingRules: missingForDetection,
+        };
+    });
+    if (!loadedPolicy.exists) {
+        (smartPolicy.riskRules ?? []).forEach((rule) => {
+            const key = policyRuleKey(rule);
+            if (missingRuleKeys.has(key)) {
+                return;
+            }
+            missingRuleKeys.add(key);
+            missingRules.push({
+                ...clonePolicyRule(rule),
+                reason: "policy file missing",
+            });
+        });
+    }
+    const status = missingRules.length > 0 ? "update-available" : "up-to-date";
+    return {
+        protocol: "ripple-policy-sync",
+        version: 1,
+        workspace: workspaceRoot,
+        policyPath: core_1.RIPPLE_POLICY_PATH.split(path.sep).join("/"),
+        policyExists: loadedPolicy.exists,
+        status,
+        missingRules,
+        detections: detectionSummaries,
+        nextSteps: policySyncNextSteps(status, loadedPolicy.exists),
+    };
+}
+function clonePolicyRule(rule) {
+    return {
+        paths: [...rule.paths],
+        ...(rule.risk ? { risk: rule.risk } : {}),
+        ...(rule.requireHumanBeforeEdit === true ? { requireHumanBeforeEdit: true } : {}),
+        ...(rule.requireHumanBeforeMerge === true ? { requireHumanBeforeMerge: true } : {}),
+        ...(rule.allowPrMode === true ? { allowPrMode: true } : {}),
+    };
+}
+function policyRuleIsCovered(suggested, existingRules) {
+    return existingRules.some((existing) => {
+        if (!suggested.paths.every((suggestedPath) => existing.paths.some((existingPath) => policyPathPatternCovers(existingPath, suggestedPath)))) {
+            return false;
+        }
+        if (suggested.risk && comparePolicyRisk(existing.risk, suggested.risk) < 0) {
+            return false;
+        }
+        if (suggested.requireHumanBeforeEdit === true && existing.requireHumanBeforeEdit !== true) {
+            return false;
+        }
+        if (suggested.requireHumanBeforeMerge === true && existing.requireHumanBeforeMerge !== true) {
+            return false;
+        }
+        return true;
+    });
+}
+function policyPathPatternCovers(existingPattern, suggestedPattern) {
+    const existing = normalizePolicyPattern(existingPattern);
+    const suggested = normalizePolicyPattern(suggestedPattern);
+    if (existing === suggested) {
+        return true;
+    }
+    if (existing === "**" || existing === "**/*") {
+        return true;
+    }
+    if (existing.endsWith("/**")) {
+        const base = existing.slice(0, -3);
+        return suggested === base || suggested.startsWith(`${base}/`);
+    }
+    if (!suggested.includes("*") && policyGlobToRegExp(existing).test(suggested)) {
+        return true;
+    }
+    return false;
+}
+function normalizePolicyPattern(pattern) {
+    return pattern.replace(/\\\\/g, "/").replace(/^\.\//, "");
+}
+function policyGlobToRegExp(pattern) {
+    const normalized = normalizePolicyPattern(pattern);
+    let source = "";
+    for (let index = 0; index < normalized.length; index += 1) {
+        const char = normalized[index];
+        const next = normalized[index + 1];
+        if (char === "*" && next === "*") {
+            source += ".*";
+            index += 1;
+            continue;
+        }
+        if (char === "*") {
+            source += "[^/]*";
+            continue;
+        }
+        source += char.replace(/[|\\{}()[\]^$+?.]/g, "\\$&");
+    }
+    return new RegExp(`^${source}$`);
+}
+function comparePolicyRisk(existing, suggested) {
+    const levels = ["low", "medium", "high", "critical"];
+    return levels.indexOf(existing ?? "low") - levels.indexOf(suggested ?? "low");
+}
+function policyRuleKey(rule) {
+    return JSON.stringify({
+        paths: rule.paths.map(normalizePolicyPattern).sort(),
+        risk: rule.risk ?? "",
+        requireHumanBeforeEdit: rule.requireHumanBeforeEdit === true,
+        requireHumanBeforeMerge: rule.requireHumanBeforeMerge === true,
+        allowPrMode: rule.allowPrMode === true,
+    });
+}
+function policySyncNextSteps(status, policyExists) {
+    if (!policyExists) {
+        return [
+            "Run ripple policy init to create .ripple/policy.json from the current repository shape.",
+            "Review the suggested risk rules before committing the policy.",
+        ];
+    }
+    if (status === "up-to-date") {
+        return ["No policy update is required right now."];
+    }
+    return [
+        "Review the suggested missing rules with a human maintainer.",
+        "Update .ripple/policy.json only after approving the new trust boundaries.",
+    ];
+}
+function printPolicySyncSummary(summary) {
+    console.log("Ripple policy sync");
+    console.log(`Policy: ${summary.policyPath}${summary.policyExists ? "" : " (missing)"}`);
+    console.log(`Status: ${summary.status}`);
+    if (summary.missingRules.length > 0) {
+        console.log("");
+        console.log("Detected risky paths not covered by policy:");
+        summary.missingRules.forEach((rule) => {
+            console.log(`- ${rule.paths.join(", ")} risk=${rule.risk ?? "medium"}${rule.requireHumanBeforeEdit ? " human-before-edit" : ""}${rule.requireHumanBeforeMerge ? " human-before-merge" : ""}`);
+            console.log(`  reason: ${rule.reason}`);
+        });
+    }
+    else {
+        console.log("Policy is up to date with current smart detections.");
+    }
+    console.log("");
+    console.log("Next:");
+    summary.nextSteps.forEach((step) => console.log(`- ${step}`));
 }
 function policyExplainCommand(options) {
     if (!options.file) {
@@ -3035,8 +4793,8 @@ function printAgentPolicyExplanation(explanation) {
 }
 async function repairCommand(options) {
     const workspaceRoot = resolveWorkspaceRoot(".");
-    const stagedFiles = (0, core_1.listGitStagedFiles)(workspaceRoot);
     const intent = (0, core_1.loadChangeIntent)(workspaceRoot, options.intent ?? "latest");
+    const stagedFiles = (0, core_1.listGitStagedFiles)(workspaceRoot);
     const engine = createFastCheckEngine(workspaceRoot);
     try {
         await runWithQuietEngine(() => engine.fastCheckScan(fastCheckCandidateFiles(stagedFiles, intent)));
@@ -3299,6 +5057,13 @@ async function main() {
         return;
     }
     if (command === "agent") {
+        if (arg === "setup") {
+            agentSetupCommand(options);
+            return;
+        }
+        if (arg && arg !== "setup") {
+            throw new Error("Usage: ripple agent or ripple agent setup [--print] [--force]");
+        }
         if (options.json) {
             printJson((0, core_1.getAgentWorkflowSummary)());
         }
@@ -3307,6 +5072,10 @@ async function main() {
         }
         return;
     }
+    if (command === "hook") {
+        hookInstallCommand(arg, options);
+        return;
+    }
     if (command === "init") {
         await initCommand(options);
         return;
@@ -3355,6 +5124,10 @@ async function main() {
         await planCommand(options);
         return;
     }
+    if (command === "intent") {
+        intentCommand(arg, options);
+        return;
+    }
     if (command === "check") {
         await checkCommand(options);
         return;
@@ -3367,6 +5140,10 @@ async function main() {
         await gateCommand(options);
         return;
     }
+    if (command === "verify") {
+        verifyCommand(options);
+        return;
+    }
     if (command === "approval") {
         approvalCommand(options);
         return;