@mc-and-his-agents/loom-installer 0.1.111 → 0.1.113

package/payload/skills/loom-handoff/.loom-runtime/shared/scripts/loom_init.py

@@ -38,6 +38,63 @@ ADOPTION_INTENTS = (
 )
 UNSPECIFIED_ADOPTION_INTENT = "unspecified"
 NON_WRITABLE_ADOPTION_PATHS = {"defer", "skill-install-only"}
+SCAFFOLD_PROFILES = (
+    "observe-only",
+    "skill-install-only",
+    "attach-only",
+    "light-governance",
+    "execution-control",
+    "strong-governance",
+)
+ATTACH_ONLY_FORBIDDEN_AUTHORED_CARRIERS = (
+    {
+        "path": ".loom/work-items/**",
+        "reason": "attach-only preserves host-owned work item truth",
+        "remediation": "migrate the item to a host truth locator, delete the competing Loom carrier, or rerun with --intent execution-control",
+    },
+    {
+        "path": ".loom/progress/**",
+        "reason": "attach-only preserves host-owned recovery/progress truth",
+        "remediation": "migrate recovery state to a host truth locator, delete the competing Loom carrier, or rerun with --intent execution-control",
+    },
+    {
+        "path": ".loom/status/current.md",
+        "reason": "attach-only preserves host-owned project status truth",
+        "remediation": "migrate status to a host truth locator, delete the competing Loom carrier, or rerun with --intent execution-control",
+    },
+    {
+        "path": ".loom/reviews/**",
+        "reason": "attach-only preserves host-owned PR review or guardian truth",
+        "remediation": "migrate review truth to a host truth locator, delete the competing Loom carrier, or rerun with --intent execution-control",
+    },
+    {
+        "path": ".loom/specs/**",
+        "reason": "attach-only does not author Loom spec truth unless the repo explicitly upgrades intent",
+        "remediation": "migrate spec truth to a host locator, delete the competing Loom carrier, or rerun with --intent execution-control",
+    },
+)
+ATTACH_ONLY_HOST_TRUTH_LOCATORS = {
+    "work_item": {
+        "host_surface": "github_issue",
+        "locator": "repo-owned issue tracker",
+        "mode": "host_truth_locator",
+    },
+    "project_status": {
+        "host_surface": "github_project",
+        "locator": "repo-owned project board or status system",
+        "mode": "host_truth_locator",
+    },
+    "review": {
+        "host_surface": "pull_request_review_or_guardian",
+        "locator": "repo-owned PR review, guardian, or review gate",
+        "mode": "host_truth_locator",
+    },
+    "closeout": {
+        "host_surface": "pull_request_metadata_and_issue_state",
+        "locator": "repo-owned PR metadata plus issue state",
+        "mode": "host_truth_locator",
+    },
+}
 
 RUNTIME_ARTIFACT_SOURCES = {
     ".loom/bin/loom_init.py": RUNTIME_SOURCE,
@@ -720,6 +777,183 @@ def is_heavy_execution_path(adoption_path: str) -> bool:
     return adoption_path == "full-bootstrap"
 
 
+def scaffold_profile_key(adoption_path: str, intake: dict[str, object]) -> str:
+    requested = str(intake.get("adoption_intent", UNSPECIFIED_ADOPTION_INTENT))
+    if requested in SCAFFOLD_PROFILES:
+        return requested
+    if adoption_path == "defer":
+        return "observe-only"
+    if adoption_path == "skill-install-only":
+        return "skill-install-only"
+    if uses_attach_only_path(adoption_path):
+        return "attach-only"
+    if adoption_path == "full-bootstrap":
+        return "execution-control"
+    return "light-governance"
+
+
+def profile_has_work_item_carriers(profile: str) -> bool:
+    return profile in {"execution-control", "strong-governance"}
+
+
+def profile_writes_artifacts(profile: str) -> bool:
+    return profile not in {"observe-only", "skill-install-only"}
+
+
+def forbidden_authored_carriers(profile: str) -> list[dict[str, str]]:
+    if profile != "attach-only":
+        return []
+    return [dict(carrier) for carrier in ATTACH_ONLY_FORBIDDEN_AUTHORED_CARRIERS]
+
+
+def required_carriers_for_profile(artifacts: list[dict[str, str]], profile: str) -> list[dict[str, str]]:
+    if profile in {"observe-only", "skill-install-only"}:
+        return []
+    return [
+        {
+            "path": artifact["path"],
+            "kind": artifact["kind"],
+            "owner": write_owner_for_path(artifact["path"]),
+        }
+        for artifact in artifacts
+        if isinstance(artifact.get("path"), str) and isinstance(artifact.get("kind"), str)
+    ]
+
+
+def normalize_relative_path(raw_path: object) -> str | None:
+    if not isinstance(raw_path, str) or not raw_path:
+        return None
+    normalized = raw_path.replace("\\", "/")
+    while normalized.startswith("./"):
+        normalized = normalized[2:]
+    if normalized.startswith("/") or normalized.startswith("../") or "/../" in normalized:
+        return None
+    return normalized
+
+
+def matches_forbidden_authored_carrier(relative_path: str, pattern: str) -> bool:
+    if pattern.endswith("/**"):
+        prefix = pattern[:-3]
+        return relative_path == prefix or relative_path.startswith(prefix + "/")
+    return relative_path == pattern
+
+
+def forbidden_authored_carrier_for_path(relative_path: str) -> dict[str, str] | None:
+    for carrier in ATTACH_ONLY_FORBIDDEN_AUTHORED_CARRIERS:
+        pattern = carrier["path"]
+        if matches_forbidden_authored_carrier(relative_path, pattern):
+            return carrier
+    return None
+
+
+def collect_forbidden_authored_carrier_declarations(result: dict[str, object]) -> list[dict[str, str]]:
+    declarations: list[dict[str, str]] = []
+
+    def add(raw_path: object, source: str) -> None:
+        relative = normalize_relative_path(raw_path)
+        if relative is None:
+            return
+        carrier = forbidden_authored_carrier_for_path(relative)
+        if carrier is not None:
+            declarations.append({"path": relative, "pattern": carrier["path"], "source": source})
+
+    for key in ("initial_artifacts", "planned_writes"):
+        entries = result.get(key)
+        if isinstance(entries, list):
+            for entry in entries:
+                if isinstance(entry, dict):
+                    add(entry.get("path"), key)
+    work_items = result.get("initial_work_items")
+    if isinstance(work_items, list):
+        for work_item in work_items:
+            if not isinstance(work_item, dict):
+                continue
+            artifacts = work_item.get("artifacts")
+            if isinstance(artifacts, list):
+                for artifact in artifacts:
+                    add(artifact, "initial_work_items.artifacts")
+    write = result.get("write")
+    if isinstance(write, dict):
+        touched = write.get("touched")
+        if isinstance(touched, list):
+            for path in touched:
+                add(path, "write.touched")
+    return declarations
+
+
+def collect_forbidden_authored_carrier_files(target_root: Path) -> list[dict[str, str]]:
+    found: list[dict[str, str]] = []
+    for carrier in ATTACH_ONLY_FORBIDDEN_AUTHORED_CARRIERS:
+        pattern = carrier["path"]
+        if pattern.endswith("/**"):
+            prefix = pattern[:-3]
+            base = target_root / prefix
+            if not base.exists():
+                continue
+            if base.is_file():
+                found.append({"path": prefix, "pattern": pattern, "source": "filesystem"})
+                continue
+            for path in sorted(candidate for candidate in base.rglob("*") if candidate.is_file()):
+                found.append(
+                    {
+                        "path": path.relative_to(target_root).as_posix(),
+                        "pattern": pattern,
+                        "source": "filesystem",
+                    }
+                )
+            continue
+        exact = target_root / pattern
+        if exact.exists():
+            found.append({"path": pattern, "pattern": pattern, "source": "filesystem"})
+    return found
+
+
+def collect_forbidden_manifest_declarations(target_root: Path) -> list[dict[str, str]]:
+    manifest_path = target_root / ".loom/bootstrap/manifest.json"
+    if not manifest_path.exists():
+        return []
+    try:
+        manifest = read_json(manifest_path)
+    except json.JSONDecodeError:
+        return []
+    artifacts = manifest.get("artifacts")
+    declarations: list[dict[str, str]] = []
+    if not isinstance(artifacts, list):
+        return declarations
+    for artifact in artifacts:
+        if not isinstance(artifact, dict):
+            continue
+        relative = normalize_relative_path(artifact.get("path"))
+        if relative is None:
+            continue
+        carrier = forbidden_authored_carrier_for_path(relative)
+        if carrier is not None:
+            declarations.append({"path": relative, "pattern": carrier["path"], "source": "manifest.artifacts"})
+    return declarations
+
+
+def attach_only_forbidden_carrier_errors(target_root: Path, result: dict[str, object]) -> list[str]:
+    findings = (
+        collect_forbidden_authored_carrier_declarations(result)
+        + collect_forbidden_manifest_declarations(target_root)
+        + collect_forbidden_authored_carrier_files(target_root)
+    )
+    errors: list[str] = []
+    seen: set[tuple[str, str, str]] = set()
+    for finding in findings:
+        key = (finding["source"], finding["path"], finding["pattern"])
+        if key in seen:
+            continue
+        seen.add(key)
+        errors.append(
+            "attach-only forbidden authored carrier detected in "
+            f"{finding['source']}: `{finding['path']}` matches `{finding['pattern']}`; "
+            "this would create a second truth chain. Migrate it to the host truth locator, delete it, "
+            "or explicitly rerun bootstrap with `--intent execution-control`."
+        )
+    return errors
+
+
 def adoption_intent_payload(adoption_path: str, intake: dict[str, object]) -> dict[str, object]:
     requested = str(intake.get("adoption_intent", UNSPECIFIED_ADOPTION_INTENT))
     source = str(intake.get("adoption_intent_source", "unspecified"))
@@ -795,7 +1029,28 @@ def rule_refs_for_capabilities(scenario: str, adoption_path: str) -> list[dict[s
     return common
 
 
-def deferred_capabilities(scenario: str, adoption_path: str) -> list[dict[str, str]]:
+def deferred_capabilities(scenario: str, adoption_path: str, profile: str) -> list[dict[str, str]]:
+    if profile == "light-governance":
+        return [
+            {
+                "name": "loom-owned-work-item-progress-status",
+                "reason": "light-governance keeps first-round adoption to a companion, review/spec, and PR-template loop",
+                "upgrade_trigger": "the repo explicitly opts into execution-control or needs Loom-owned recovery/status carriers",
+            },
+            {
+                "name": "host-gate-merge-closeout-control",
+                "reason": "light-governance does not claim host merge, release, or closeout control",
+                "upgrade_trigger": "required checks, merge-ready, or closeout must be consumed as Loom-owned gates",
+            },
+        ]
+    if profile == "execution-control":
+        return [
+            {
+                "name": "strong-governance-host-gates",
+                "reason": "execution-control writes Loom-owned execution carriers but does not require host merge and closeout gates as a profile precondition",
+                "upgrade_trigger": "host required checks, controlled merge, or closeout reconciliation become part of the adoption contract",
+            }
+        ]
     if scenario == "new":
         return [
             {
@@ -844,6 +1099,97 @@ def deferred_capabilities(scenario: str, adoption_path: str) -> list[dict[str, s
     ]
 
 
+def upgrade_triggers(deferred: list[dict[str, str]], profile: str) -> list[dict[str, str]]:
+    return [
+        {
+            "from_profile": profile,
+            "capability": item["name"],
+            "trigger": item["upgrade_trigger"],
+        }
+        for item in deferred
+        if item.get("upgrade_trigger")
+    ]
+
+
+def profile_common_artifacts() -> list[dict[str, str]]:
+    artifacts: list[dict[str, str]] = [
+        {"path": ".loom/README.md", "kind": "rule-entry", "source": "generated"},
+        {"path": ".loom/bootstrap/intake.snapshot.json", "kind": "intake", "source": "generated"},
+        {"path": ".loom/bootstrap/init-result.json", "kind": "init-result", "source": "generated"},
+        {"path": ".loom/bootstrap/manifest.json", "kind": "manifest", "source": "generated"},
+        {"path": ".loom/bootstrap/capability-map.md", "kind": "capability-map", "source": "generated"},
+        {"path": ".loom/companion/README.md", "kind": "repo-companion-entry", "source": "generated"},
+        {"path": ".loom/companion/manifest.json", "kind": "repo-companion-manifest", "source": "generated"},
+        {"path": ".loom/companion/repo-interface.json", "kind": "repo-companion-interface", "source": "generated"},
+        {"path": ".loom/companion/interop.json", "kind": "repo-interop-contract", "source": "generated"},
+        {"path": ".loom/companion/checkpoints.md", "kind": "repo-companion-doc", "source": "generated"},
+        {"path": ".loom/companion/review.md", "kind": "repo-companion-doc", "source": "generated"},
+        {"path": ".loom/companion/merge-ready.md", "kind": "repo-companion-doc", "source": "generated"},
+        {"path": ".loom/companion/closeout.md", "kind": "repo-companion-doc", "source": "generated"},
+        {"path": ".loom/companion/releases/changelog.md", "kind": "repo-release-surface", "source": "generated"},
+        {"path": ".loom/companion/releases/release-notes.md", "kind": "repo-release-surface", "source": "generated"},
+        {"path": ".loom/companion/releases/migration-notes.md", "kind": "repo-release-surface", "source": "generated"},
+        {"path": ".loom/companion/releases/rollback.md", "kind": "repo-release-surface", "source": "generated"},
+        {"path": ".loom/companion/releases/catalog.json", "kind": "repo-release-surface", "source": "generated"},
+        {"path": ".loom/companion/releases/current.json", "kind": "repo-release-surface", "source": "generated"},
+        {"path": ".loom/companion/releases/status.json", "kind": "repo-release-surface", "source": "generated"},
+        {"path": ".loom/shadow/admission-loom.json", "kind": "shadow-parity-surface", "source": "generated"},
+        {"path": ".loom/shadow/admission-repo.json", "kind": "shadow-parity-surface", "source": "generated"},
+        {"path": ".loom/shadow/review-loom.json", "kind": "shadow-parity-surface", "source": "generated"},
+        {"path": ".loom/shadow/review-repo.json", "kind": "shadow-parity-surface", "source": "generated"},
+        {"path": ".loom/shadow/merge-ready-loom.json", "kind": "shadow-parity-surface", "source": "generated"},
+        {"path": ".loom/shadow/merge-ready-repo.json", "kind": "shadow-parity-surface", "source": "generated"},
+        {"path": ".loom/shadow/closeout-loom.json", "kind": "shadow-parity-surface", "source": "generated"},
+        {"path": ".loom/shadow/closeout-repo.json", "kind": "shadow-parity-surface", "source": "generated"},
+        {"path": ".gitignore", "kind": "gitignore", "source": "generated"},
+        runtime_artifact(".loom/bin/loom_init.py", "loom-tool", RUNTIME_SOURCE),
+        runtime_artifact(".loom/bin/fact_chain_support.py", "loom-tool-support", FACT_CHAIN_RUNTIME_SOURCE),
+        runtime_artifact(".loom/bin/governance_surface.py", "loom-tool-support", GOVERNANCE_RUNTIME_SOURCE),
+        runtime_artifact(".loom/bin/loom_flow.py", "loom-tool", FLOW_RUNTIME_SOURCE),
+        runtime_artifact(".loom/bin/loom_status.py", "loom-tool", STATUS_RUNTIME_SOURCE),
+        runtime_artifact(".loom/bin/runtime_paths.py", "loom-tool-support", "skills/shared/scripts/runtime_paths.py"),
+        runtime_artifact(".loom/bin/runtime_state.py", "loom-tool-support", "skills/shared/scripts/runtime_state.py"),
+        runtime_artifact(".loom/bin/loom_check.py", "loom-tool", CHECK_RUNTIME_SOURCE),
+    ]
+    return artifacts
+
+
+def profile_light_artifacts(target_root: Path) -> list[dict[str, str]]:
+    artifacts: list[dict[str, str]] = []
+    if not (target_root / "AGENTS.md").exists():
+        artifacts.append({"path": "AGENTS.md", "kind": "root-entry", "source": "generated"})
+    artifacts.extend(
+        [
+            {"path": ".loom/reviews/INIT-0001.json", "kind": "review-entry", "source": "generated"},
+            {"path": ".loom/reviews/INIT-0001.spec.json", "kind": "review-entry", "source": "generated"},
+            {"path": ".loom/specs/INIT-0001/spec.md", "kind": "spec", "source": "skills/shared/assets/templates/scaffold/spec.md"},
+            {"path": ".loom/specs/INIT-0001/plan.md", "kind": "plan", "source": "skills/shared/assets/templates/scaffold/plan.md"},
+            {
+                "path": ".loom/specs/INIT-0001/implementation-contract.md",
+                "kind": "implementation-contract",
+                "source": "skills/shared/assets/templates/scaffold/implementation-contract.md",
+            },
+        ]
+    )
+    return artifacts
+
+
+def profile_execution_artifacts(target_root: Path) -> list[dict[str, str]]:
+    artifacts = profile_light_artifacts(target_root)
+    artifacts.extend(
+        [
+            {"path": ".loom/work-items/INIT-0001.md", "kind": "work-item", "source": "generated"},
+            {"path": ".loom/progress/INIT-0001.md", "kind": "progress", "source": "generated"},
+            {"path": ".loom/status/current.md", "kind": "status-surface", "source": "generated"},
+        ]
+    )
+    return artifacts
+
+
+def artifact_paths(artifacts: list[dict[str, str]]) -> list[str]:
+    return [artifact["path"] for artifact in artifacts]
+
+
 def attach_only_artifact_paths(target_root: Path, install_pr_template: bool) -> list[str]:
     artifacts = [
         ".loom/README.md",
@@ -869,7 +1215,13 @@ def attach_only_artifact_paths(target_root: Path, install_pr_template: bool) ->
     return artifacts
 
 
-def initial_work_items(scenario: str, target_root: Path, adoption_path: str, install_pr_template: bool) -> list[dict[str, object]]:
+def initial_work_items(
+    scenario: str,
+    target_root: Path,
+    adoption_path: str,
+    install_pr_template: bool,
+    profile: str,
+) -> list[dict[str, object]]:
     if adoption_path in NON_WRITABLE_ADOPTION_PATHS:
         return []
     if uses_attach_only_path(adoption_path):
@@ -889,26 +1241,7 @@ def initial_work_items(scenario: str, target_root: Path, adoption_path: str, ins
                 "owner_for_checkpoint_lite": "repository owner or current attach operator",
             }
         ]
-    artifacts = [
-        ".loom/bootstrap/init-result.json",
-        ".loom/work-items/INIT-0001.md",
-        ".loom/progress/INIT-0001.md",
-        ".loom/reviews/INIT-0001.json",
-        ".loom/reviews/INIT-0001.spec.json",
-        ".loom/status/current.md",
-        ".loom/bin/loom_init.py",
-        ".loom/bin/fact_chain_support.py",
-        ".loom/bin/governance_surface.py",
-        ".loom/bin/loom_flow.py",
-        ".loom/bin/loom_status.py",
-        ".loom/bin/runtime_paths.py",
-        ".loom/bin/loom_check.py",
-        ".loom/specs/INIT-0001/spec.md",
-        ".loom/specs/INIT-0001/plan.md",
-        ".loom/specs/INIT-0001/implementation-contract.md",
-    ]
-    if not (target_root / ".github/PULL_REQUEST_TEMPLATE.md").exists():
-        artifacts.append(".github/PULL_REQUEST_TEMPLATE.md")
+    artifacts = artifact_paths(initial_artifacts(target_root, install_pr_template, adoption_path, profile))
     return [
         {
             "id": WORK_ITEM_ID,
@@ -927,125 +1260,15 @@ def initial_work_items(scenario: str, target_root: Path, adoption_path: str, ins
     ]
 
 
-def initial_artifacts(target_root: Path, install_pr_template: bool, adoption_path: str) -> list[dict[str, str]]:
-    if adoption_path in NON_WRITABLE_ADOPTION_PATHS:
+def initial_artifacts(target_root: Path, install_pr_template: bool, adoption_path: str, profile: str) -> list[dict[str, str]]:
+    if not profile_writes_artifacts(profile):
         return []
 
-    artifacts = [
-        {
-            "path": ".loom/README.md",
-            "kind": "rule-entry",
-            "source": "generated",
-        },
-        {
-            "path": ".loom/bootstrap/intake.snapshot.json",
-            "kind": "intake",
-            "source": "generated",
-        },
-        {
-            "path": ".loom/bootstrap/init-result.json",
-            "kind": "init-result",
-            "source": "generated",
-        },
-        {
-            "path": ".loom/bootstrap/manifest.json",
-            "kind": "manifest",
-            "source": "generated",
-        },
-        {
-            "path": ".loom/bootstrap/capability-map.md",
-            "kind": "capability-map",
-            "source": "generated",
-        },
-        runtime_artifact(".loom/bin/loom_init.py", "loom-tool", RUNTIME_SOURCE),
-        runtime_artifact(".loom/bin/fact_chain_support.py", "loom-tool-support", FACT_CHAIN_RUNTIME_SOURCE),
-        runtime_artifact(".loom/bin/governance_surface.py", "loom-tool-support", GOVERNANCE_RUNTIME_SOURCE),
-        runtime_artifact(".loom/bin/loom_flow.py", "loom-tool", FLOW_RUNTIME_SOURCE),
-        runtime_artifact(".loom/bin/loom_status.py", "loom-tool", STATUS_RUNTIME_SOURCE),
-        runtime_artifact(".loom/bin/runtime_paths.py", "loom-tool-support", "skills/shared/scripts/runtime_paths.py"),
-        runtime_artifact(".loom/bin/runtime_state.py", "loom-tool-support", "skills/shared/scripts/runtime_state.py"),
-        runtime_artifact(".loom/bin/loom_check.py", "loom-tool", CHECK_RUNTIME_SOURCE),
-    ]
-    if uses_attach_only_path(adoption_path):
-        artifacts.extend(
-            [
-                {
-                    "path": ".loom/companion/README.md",
-                    "kind": "repo-companion-entry",
-                    "source": "generated",
-                },
-                {
-                    "path": ".loom/companion/checkpoints.md",
-                    "kind": "repo-companion-doc",
-                    "source": "generated",
-                },
-                {
-                    "path": ".loom/companion/review.md",
-                    "kind": "repo-companion-doc",
-                    "source": "generated",
-                },
-                {
-                    "path": ".loom/companion/merge-ready.md",
-                    "kind": "repo-companion-doc",
-                    "source": "generated",
-                },
-                {
-                    "path": ".loom/companion/closeout.md",
-                    "kind": "repo-companion-doc",
-                    "source": "generated",
-                },
-            ]
-        )
-    else:
-        artifacts.extend(
-            [
-                {
-                    "path": "AGENTS.md",
-                    "kind": "root-entry",
-                    "source": "generated",
-                },
-                {
-                    "path": ".loom/work-items/INIT-0001.md",
-                    "kind": "work-item",
-                    "source": "generated",
-                },
-                {
-                    "path": ".loom/progress/INIT-0001.md",
-                    "kind": "progress",
-                    "source": "generated",
-                },
-                {
-                    "path": ".loom/reviews/INIT-0001.json",
-                    "kind": "review-entry",
-                    "source": "generated",
-                },
-                {
-                    "path": ".loom/reviews/INIT-0001.spec.json",
-                    "kind": "review-entry",
-                    "source": "generated",
-                },
-                {
-                    "path": ".loom/status/current.md",
-                    "kind": "status-surface",
-                    "source": "generated",
-                },
-                {
-                    "path": ".loom/specs/INIT-0001/spec.md",
-                    "kind": "spec",
-                    "source": "skills/shared/assets/templates/scaffold/spec.md",
-                },
-                {
-                    "path": ".loom/specs/INIT-0001/plan.md",
-                    "kind": "plan",
-                    "source": "skills/shared/assets/templates/scaffold/plan.md",
-                },
-                {
-                    "path": ".loom/specs/INIT-0001/implementation-contract.md",
-                    "kind": "implementation-contract",
-                    "source": "skills/shared/assets/templates/scaffold/implementation-contract.md",
-                },
-            ]
-        )
+    artifacts = profile_common_artifacts()
+    if profile == "light-governance":
+        artifacts.extend(profile_light_artifacts(target_root))
+    elif profile in {"execution-control", "strong-governance"}:
+        artifacts.extend(profile_execution_artifacts(target_root))
     if install_pr_template or not (target_root / ".github/PULL_REQUEST_TEMPLATE.md").exists():
         artifacts.append(
             {
@@ -1144,18 +1367,25 @@ def planned_write_targets(result: dict[str, object], adoption_path: str) -> list
     return planned
 
 
-def intentionally_absent_targets(adoption_path: str) -> list[dict[str, str]]:
-    if uses_attach_only_path(adoption_path):
+def intentionally_absent_targets(adoption_path: str, profile: str) -> list[dict[str, str]]:
+    if profile == "attach-only":
         return [
             {"path": ".loom/work-items/**", "reason": "attach-only preserves host-owned work item truth"},
             {"path": ".loom/progress/**", "reason": "attach-only preserves host-owned recovery truth"},
             {"path": ".loom/status/current.md", "reason": "attach-only does not author Loom status truth"},
+            {"path": ".loom/reviews/**", "reason": "attach-only preserves host-owned review truth"},
             {"path": ".loom/specs/**", "reason": "attach-only does not author Loom execution specs"},
         ]
     if adoption_path == "defer":
         return [{"path": "*", "reason": "observe-only intent is read-only"}]
     if adoption_path == "skill-install-only":
         return [{"path": ".loom/work-items/**", "reason": "skill install does not adopt execution governance"}]
+    if profile == "light-governance":
+        return [
+            {"path": ".loom/work-items/**", "reason": "light-governance does not author Loom work item truth"},
+            {"path": ".loom/progress/**", "reason": "light-governance does not author Loom recovery truth"},
+            {"path": ".loom/status/current.md", "reason": "light-governance does not author Loom status truth"},
+        ]
     return []
 
 
@@ -1180,8 +1410,10 @@ def risk_summary(adoption_path: str, intake: dict[str, object], planned: list[di
 
 def build_result(target_root: Path, scenario: str, intake: dict[str, object], install_pr_template: bool) -> dict[str, object]:
     adoption_path = recommended_adoption_path(scenario, intake)
+    profile = scaffold_profile_key(adoption_path, intake)
     attach_only = uses_attach_only_path(adoption_path)
     read_only_adoption = adoption_path in NON_WRITABLE_ADOPTION_PATHS
+    has_work_item_carriers = profile_has_work_item_carriers(profile)
     main_problem = {
         "new": "the repository has no controlled Loom entry yet",
         "small-existing": "the repo has a baseline but still lacks a stable Loom adoption entry and explicit first artifacts",
@@ -1207,6 +1439,7 @@ def build_result(target_root: Path, scenario: str, intake: dict[str, object], in
         bootstrap_mode=True,
         scenario_override=scenario,
     )
+    initial_artifact_list = initial_artifacts(target_root, install_pr_template, adoption_path, profile)
     result = {
         "schema_version": "loom-init-output/v1",
         "generator": {
@@ -1235,7 +1468,20 @@ def build_result(target_root: Path, scenario: str, intake: dict[str, object], in
             "recovery_mode": recovery_mode(scenario),
             "capabilities": rule_refs_for_capabilities(scenario, adoption_path),
         },
-        "deferred_capabilities": deferred_capabilities(scenario, adoption_path),
+        "scaffold_profile": {
+            "name": profile,
+            "writes_artifacts": profile_writes_artifacts(profile),
+            "writes_work_item_carriers": has_work_item_carriers,
+            "description": {
+                "observe-only": "read-only repository observation; no Loom adoption carriers are written",
+                "skill-install-only": "skill/runtime installation intent without repository governance adoption carriers",
+                "attach-only": "companion/read-surface attachment that preserves repo-owned execution truth",
+                "light-governance": "companion, review/spec, and PR-template loop without Loom-owned work item/progress/status carriers",
+                "execution-control": "Loom-owned work item, progress, review, status, and spec carriers",
+                "strong-governance": "execution-control surface prepared for host gates, required checks, merge, and closeout consumption",
+            }[profile],
+        },
+        "deferred_capabilities": deferred_capabilities(scenario, adoption_path, profile),
         "fact_chain": (
             {
                 "mode": "intent-only dry-run",
@@ -1259,6 +1505,17 @@ def build_result(target_root: Path, scenario: str, intake: dict[str, object], in
                 },
             }
             if attach_only
+            else {
+                "mode": "profile-guided light-governance",
+                "read_entry": "not_applicable",
+                "entry_points": {
+                    "current_item_id": WORK_ITEM_ID,
+                    "work_item": "not_applicable",
+                    "recovery_entry": "not_applicable",
+                    "status_surface": "not_applicable",
+                },
+            }
+            if not has_work_item_carriers
             else {
                 "mode": "work-item + recovery-entry + derived status-surface",
                 "read_entry": "python3 .loom/bin/loom_init.py fact-chain --target .",
@@ -1270,8 +1527,8 @@ def build_result(target_root: Path, scenario: str, intake: dict[str, object], in
                 },
             }
         ),
-        "initial_artifacts": initial_artifacts(target_root, install_pr_template, adoption_path),
-        "initial_work_items": initial_work_items(scenario, target_root, adoption_path, install_pr_template),
+        "initial_artifacts": initial_artifact_list,
+        "initial_work_items": initial_work_items(scenario, target_root, adoption_path, install_pr_template, profile),
         "validation_and_closing": {
             "validation_entry": "python3 .loom/bin/loom_init.py verify --target .",
             "checkpoint_relationship": (
@@ -1281,6 +1538,12 @@ def build_result(target_root: Path, scenario: str, intake: dict[str, object], in
                     "merge checkpoint should only pass after downstream repo truth, companion extensions, and release judgment align",
                 ]
                 if attach_only
+                else [
+                    "admission checkpoint confirms the companion entry, review record, spec suite, and PR template are readable",
+                    "build checkpoint confirms generated light-governance surfaces are internally consistent",
+                    "merge checkpoint remains repo-owned until the intent upgrades to execution-control or strong-governance",
+                ]
+                if profile == "light-governance"
                 else [
                     "admission checkpoint confirms the bootstrap work item and first artifacts are readable",
                     "build checkpoint confirms generated carriers and templates are internally consistent",
@@ -1288,17 +1551,25 @@ def build_result(target_root: Path, scenario: str, intake: dict[str, object], in
                 ]
             ),
             "clean_state": (
-                "all generated attach-only Loom artifacts are readable, verified, and do not introduce Loom-owned recovery/status placeholders"
+                "all generated attach-only Loom artifacts are readable, verified, and do not introduce Loom-authored work/progress/status/review/spec truth carriers"
                 if attach_only
+                else "all generated light-governance artifacts are readable, verified, and do not introduce Loom-owned work/progress/status carriers"
+                if profile == "light-governance"
                 else "all generated Loom artifacts are readable, verified, and free of conflicting duplicates"
             ),
             "close_when": (
                 [
                     "the target repo has a readable root rule entry and attached repo companion entry",
                     "the attach-only bootstrap metadata and repo-local validation path are verifiable",
-                    "the bootstrap manifest does not declare Loom-owned recovery/status carriers for this path",
+                    "the bootstrap manifest, init-result, planned writes, and filesystem do not expose forbidden Loom-authored truth carriers",
                 ]
                 if attach_only
+                else [
+                    "the target repo has a readable Loom companion entry",
+                    "the review record, spec suite, and PR template exist",
+                    "the bootstrap manifest and init-result are verifiable",
+                ]
+                if profile == "light-governance"
                 else [
                     "the target repo has a readable root or companion Loom entry",
                     "the first work item, progress carrier, and spec/plan artifacts exist",
@@ -1312,6 +1583,7 @@ def build_result(target_root: Path, scenario: str, intake: dict[str, object], in
         "maturity_upgrade_path": init_maturity_upgrade_path(governance_surface),
     }
     planned = planned_write_targets(result, adoption_path)
+    deferred = result["deferred_capabilities"]
     result["detected_repository_mode"] = {
         "repository_type": intake.get("repository_type"),
         "scenario_key": scenario,
@@ -1319,7 +1591,14 @@ def build_result(target_root: Path, scenario: str, intake: dict[str, object], in
     }
     result["adoption_intent"] = adoption_intent_payload(adoption_path, intake)
     result["planned_writes"] = planned
-    result["intentionally_absent"] = intentionally_absent_targets(adoption_path)
+    result["required_carriers"] = required_carriers_for_profile(initial_artifact_list, profile)
+    result["intentionally_absent"] = intentionally_absent_targets(adoption_path, profile)
+    result["forbidden_authored_carriers"] = forbidden_authored_carriers(profile)
+    scaffold_profile = result.get("scaffold_profile")
+    if isinstance(scaffold_profile, dict):
+        scaffold_profile["required_carriers"] = result["required_carriers"]
+        scaffold_profile["forbidden_authored_carriers"] = result["forbidden_authored_carriers"]
+    result["upgrade_triggers"] = upgrade_triggers(deferred if isinstance(deferred, list) else [], profile)
     result["risk_summary"] = risk_summary(adoption_path, intake, planned)
     return result
 
@@ -1445,16 +1724,26 @@ def bootstrap_write_blockers(result: dict[str, object]) -> list[str]:
 
 def render_loom_readme(result: dict[str, object]) -> str:
     run = result["run"]
-    attach_only = uses_attach_only_path(str(result["recommended_adoption"]["path"]))
-    path_lines = (
-        "- Repo companion entry: `.loom/companion/README.md`\n"
-        "- Companion checkpoints: `.loom/companion/checkpoints.md`\n"
-        "- Companion review surface: `.loom/companion/review.md`\n"
-        if attach_only
-        else "- First work item: `.loom/work-items/INIT-0001.md`\n"
-        "- Progress carrier: `.loom/progress/INIT-0001.md`\n"
-        "- Status surface: `.loom/status/current.md`\n"
-    )
+    profile = result.get("scaffold_profile")
+    profile_name = str(profile.get("name")) if isinstance(profile, dict) else "execution-control"
+    if profile_name == "attach-only":
+        path_lines = (
+            "- Repo companion entry: `.loom/companion/README.md`\n"
+            "- Companion checkpoints: `.loom/companion/checkpoints.md`\n"
+            "- Companion review surface: `.loom/companion/review.md`\n"
+        )
+    elif profile_name == "light-governance":
+        path_lines = (
+            "- Repo companion entry: `.loom/companion/README.md`\n"
+            "- Review record: `.loom/reviews/INIT-0001.json`\n"
+            "- Spec suite: `.loom/specs/INIT-0001/`\n"
+        )
+    else:
+        path_lines = (
+            "- First work item: `.loom/work-items/INIT-0001.md`\n"
+            "- Progress carrier: `.loom/progress/INIT-0001.md`\n"
+            "- Status surface: `.loom/status/current.md`\n"
+        )
     return (
         "# Loom Bootstrap\n\n"
         f"This directory was generated by `{RUNTIME_SOURCE}`.\n\n"
@@ -1548,8 +1837,8 @@ def companion_manifest_payload() -> dict[str, object]:
     }
 
 
-def repo_interface_payload() -> dict[str, object]:
-    return {
+def repo_interface_payload(profile_name: str = "execution-control") -> dict[str, object]:
+    payload: dict[str, object] = {
         "schema_version": "loom-repo-interface/v2",
         "companion_entry": ".loom/companion/README.md",
         "repo_specific_requirements": {"review": [], "merge_ready": [], "closeout": []},
@@ -1570,6 +1859,9 @@ def repo_interface_payload() -> dict[str, object]:
             "status_locator": ".loom/companion/releases/status.json",
         },
     }
+    if profile_name == "attach-only":
+        payload["host_truth_locators"] = ATTACH_ONLY_HOST_TRUTH_LOCATORS
+    return payload
 
 
 def repo_interop_payload() -> dict[str, object]:
@@ -1842,7 +2134,14 @@ def scaffold_target(
 ) -> tuple[int, list[str]]:
     written = 0
     touched: list[str] = []
-    attach_only = uses_attach_only_path(str(result["recommended_adoption"]["path"]))
+    profile = result.get("scaffold_profile")
+    profile_name = str(profile.get("name")) if isinstance(profile, dict) else "execution-control"
+    writes_light_loop = profile_name in {"light-governance", "execution-control", "strong-governance"}
+    writes_work_item_carriers = profile_has_work_item_carriers(profile_name)
+    if profile_name == "attach-only":
+        forbidden_errors = attach_only_forbidden_carrier_errors(target_root, result)
+        if forbidden_errors:
+            raise RuntimeError("; ".join(forbidden_errors))
 
     writes: list[tuple[Path, str | dict[str, object], str]] = [
         (target_root / ".loom/README.md", render_loom_readme(result), "text"),
@@ -1852,7 +2151,7 @@ def scaffold_target(
         (target_root / ".loom/bootstrap/capability-map.md", render_capability_map(result), "text"),
         (target_root / ".loom/companion/README.md", render_companion_readme(result), "text"),
         (target_root / ".loom/companion/manifest.json", companion_manifest_payload(), "json"),
-        (target_root / ".loom/companion/repo-interface.json", repo_interface_payload(), "json"),
+        (target_root / ".loom/companion/repo-interface.json", repo_interface_payload(profile_name), "json"),
         (target_root / ".loom/companion/interop.json", repo_interop_payload(), "json"),
         (target_root / ".loom/companion/checkpoints.md", render_companion_checkpoints(), "text"),
         (target_root / ".loom/companion/review.md", render_companion_review(), "text"),
@@ -1912,15 +2211,18 @@ def scaffold_target(
             "json",
         ),
     ]
-    if attach_only:
-        pass
-    else:
+    if writes_light_loop:
         writes.extend(
             [
-                (target_root / ".loom/work-items/INIT-0001.md", render_work_item(result), "text"),
-                (target_root / ".loom/progress/INIT-0001.md", render_progress(result), "text"),
                 (target_root / ".loom/reviews/INIT-0001.json", render_review_entry(result), "text"),
                 (target_root / ".loom/reviews/INIT-0001.spec.json", render_spec_review_entry(result), "text"),
+            ]
+        )
+    if writes_work_item_carriers:
+        writes.extend(
+            [
+                (target_root / ".loom/work-items/INIT-0001.md", render_work_item(result), "text"),
+                (target_root / ".loom/progress/INIT-0001.md", render_progress(result), "text"),
                 (target_root / ".loom/status/current.md", render_status(result), "text"),
             ]
         )
@@ -1957,7 +2259,7 @@ def scaffold_target(
         if copy_file(source, destination, force=force):
             written += 1
             touched.append(str(destination.relative_to(target_root)))
-    if not attach_only:
+    if writes_light_loop:
         for source, destination in (
             (shared_asset(__file__, "templates/scaffold/spec.md"), target_root / ".loom/specs/INIT-0001/spec.md"),
             (shared_asset(__file__, "templates/scaffold/plan.md"), target_root / ".loom/specs/INIT-0001/plan.md"),
@@ -1977,7 +2279,7 @@ def scaffold_target(
             touched.append(str(pr_template_target.relative_to(target_root)))
 
     root_agents = target_root / "AGENTS.md"
-    if not attach_only and not root_agents.exists():
+    if writes_light_loop and not root_agents.exists():
         if write_text(root_agents, render_root_agents(), force=force):
             written += 1
             touched.append(str(root_agents.relative_to(target_root)))
@@ -2007,59 +2309,38 @@ def verify_target(target_root: Path, output_path: Path) -> list[str]:
         adoption = result.get("recommended_adoption")
         if isinstance(adoption, dict):
             attach_only = uses_attach_only_path(str(adoption.get("path", "")))
-        required_paths = [
-            ".loom/README.md",
-            ".loom/bootstrap/intake.snapshot.json",
-            str(output_path.relative_to(target_root)),
-            ".loom/bootstrap/manifest.json",
-            ".loom/bootstrap/capability-map.md",
-            ".loom/bin/loom_init.py",
-            ".loom/bin/fact_chain_support.py",
-            ".loom/bin/governance_surface.py",
-            ".loom/bin/loom_flow.py",
-            ".loom/bin/runtime_paths.py",
-            ".loom/bin/runtime_state.py",
-            ".loom/bin/loom_check.py",
-            ".loom/companion/README.md",
-            ".loom/companion/manifest.json",
-            ".loom/companion/repo-interface.json",
-            ".loom/companion/interop.json",
-            ".loom/companion/checkpoints.md",
-            ".loom/companion/review.md",
-            ".loom/companion/merge-ready.md",
-            ".loom/companion/closeout.md",
-            ".loom/shadow/admission-loom.json",
-            ".loom/shadow/admission-repo.json",
-            ".loom/shadow/review-loom.json",
-            ".loom/shadow/review-repo.json",
-            ".loom/shadow/merge-ready-loom.json",
-            ".loom/shadow/merge-ready-repo.json",
-            ".loom/shadow/closeout-loom.json",
-            ".loom/shadow/closeout-repo.json",
-        ]
-        if attach_only:
-            pass
+        scaffold_profile = result.get("scaffold_profile")
+        profile_name = str(scaffold_profile.get("name")) if isinstance(scaffold_profile, dict) else (
+            "attach-only" if attach_only else "execution-control"
+        )
+        initial_artifact_list = result.get("initial_artifacts")
+        planned_writes = result.get("planned_writes")
+        if isinstance(initial_artifact_list, list):
+            required_paths = [
+                str(item.get("path"))
+                for item in initial_artifact_list
+                if isinstance(item, dict) and isinstance(item.get("path"), str)
+            ]
+        elif isinstance(planned_writes, list):
+            required_paths = [
+                str(item.get("path"))
+                for item in planned_writes
+                if isinstance(item, dict) and isinstance(item.get("path"), str)
+            ]
         else:
-            required_paths.extend(
-                [
-                    "AGENTS.md",
-                    ".loom/work-items/INIT-0001.md",
-                    ".loom/progress/INIT-0001.md",
-                    ".loom/reviews/INIT-0001.json",
-                    ".loom/status/current.md",
-                    ".loom/specs/INIT-0001/spec.md",
-                    ".loom/specs/INIT-0001/plan.md",
-                    ".loom/specs/INIT-0001/implementation-contract.md",
-                ]
-            )
+            required_paths = []
         for key in (
             "project_judgment",
             "recommended_adoption",
+            "scaffold_profile",
             "adoption_intent",
             "detected_repository_mode",
             "risk_summary",
+            "required_carriers",
             "planned_writes",
+            "forbidden_authored_carriers",
             "deferred_capabilities",
+            "upgrade_triggers",
             "fact_chain",
             "initial_artifacts",
             "initial_work_items",
@@ -2127,12 +2408,39 @@ def verify_target(target_root: Path, output_path: Path) -> list[str]:
             for forbidden in (".loom/work-items/INIT-0001.md", ".loom/progress/INIT-0001.md", ".loom/status/current.md"):
                 if forbidden in declared_generated:
                     errors.append(f"deep-existing-repo bootstrap must not declare generated carrier `{forbidden}`")
+            forbidden_profile = result.get("forbidden_authored_carriers")
+            if not isinstance(forbidden_profile, list) or {
+                str(item.get("path")) for item in forbidden_profile if isinstance(item, dict)
+            } != {carrier["path"] for carrier in ATTACH_ONLY_FORBIDDEN_AUTHORED_CARRIERS}:
+                errors.append("attach-only init-result must declare the full `forbidden_authored_carriers` profile list")
+            errors.extend(attach_only_forbidden_carrier_errors(target_root, result))
+        if profile_name == "light-governance":
+            declared_generated = {
+                artifact.get("path")
+                for artifact in result.get("initial_artifacts", [])
+                if isinstance(artifact, dict) and isinstance(artifact.get("path"), str)
+            }
+            for forbidden in (".loom/work-items/INIT-0001.md", ".loom/progress/INIT-0001.md", ".loom/status/current.md"):
+                if forbidden in declared_generated:
+                    errors.append(f"light-governance bootstrap must not declare execution-control carrier `{forbidden}`")
 
     for relative in required_paths:
         if not (target_root / relative).exists():
             errors.append(f"missing required artifact: {relative}")
 
-    if not attach_only:
+    profile_writes_work_items = False
+    if output_path.exists():
+        try:
+            result_for_profile = read_json(output_path)
+            scaffold_profile = result_for_profile.get("scaffold_profile")
+            profile_name = str(scaffold_profile.get("name")) if isinstance(scaffold_profile, dict) else (
+                "attach-only" if attach_only else "execution-control"
+            )
+            profile_writes_work_items = profile_has_work_item_carriers(profile_name)
+        except json.JSONDecodeError:
+            profile_writes_work_items = not attach_only
+
+    if profile_writes_work_items:
         fact_chain_report, fact_chain_errors = inspect_fact_chain(
             target_root,
             str(output_path.relative_to(target_root)),
@@ -2192,7 +2500,7 @@ def verify_target(target_root: Path, output_path: Path) -> list[str]:
                 {"pass"},
             ),
         ]
-        if not attach_only:
+        if profile_writes_work_items:
             commands.extend(
                 [
                     (
@@ -2207,7 +2515,7 @@ def verify_target(target_root: Path, output_path: Path) -> list[str]:
                     ),
                 ]
             )
-        if current_item_id and not attach_only:
+        if current_item_id and profile_writes_work_items:
             commands.extend(
                 [
                     (