intentdna 1.6.5 → 1.7.4

package/.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
     {
       "name": "intentdna",
       "description": "Declarative policy layer for AI agent behavior with plugin-managed hook runtime for Claude Code.",
-      "version": "1.6.5",
+      "version": "1.7.4",
       "author": {
         "name": "Samuel"
       },
@@ -25,5 +25,5 @@
       ]
     }
   ],
-  "version": "1.6.5"
+  "version": "1.7.4"
 }

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "intentdna",
-  "version": "1.6.5",
+  "version": "1.7.4",
   "description": "Declarative policy layer for AI agent behavior",
   "author": {
     "name": "Samuel"

package/README.md

@@ -1,26 +1,32 @@
 # Intent DNA
 
-**Declarative control plane for AI agent behavior.**
+**Enterprise safety control plane for AI agent behavior.**
 
-Intent DNA turns intent, policy, and accumulated experience into enforceable agent constraints. Instead of relying on prompts alone, it compiles DNA into the native control surfaces of Claude Code and related harnesses. It governs how agents operate across existing tools and systems; it does not replace your business systems or act as a domain-specific automation runtime.
+Intent DNA lets an organization declare safety policy once, cascade it through Species → Enterprise → Project → Personal → Role → Context → Task, and compile it into deterministic gates for every agent, project, and harness. It governs how agents operate across existing tools and systems; it does not replace your business systems or act as a domain-specific automation runtime.
 
 ---
 
 ## What It Is
 
-Intent DNA is a compiler and runtime toolkit for managing agent behavior across four layers:
+Intent DNA is an enforcement-first control plane for organization-wide agent safety:
 
-- **Behavioral guidance** via generated prompt/context files
-- **Deterministic enforcement** via hooks and runtime checks
-- **Artifact handoff** via session-scoped manifests and resolver facts
-- **Feedback loops** via trace, audit, and epigenetic evolution
+- **Enterprise / Species policy bundles** define shared red lines across projects and teams
+- **Cascade governance** preserves provenance and prevents lower layers from relaxing organization thresholds
+- **Constraint IR** carries policy provenance into hook, SDK-check, and CI strict gates
+- **RuntimeDecisionEvent evidence** records who/what/why/from which policy for every allow/warn/block/escalate/validate decision
+- **MCP, reports, state, trace, audit, and evolution** query or package evidence; they are not the policy source of truth
 
 It governs the agents operating on your systems rather than re-implementing the systems themselves.
 
 The core model is:
 
 ```text
-DNA config → compiler pipeline → Constraint IR → harness-specific outputs
+Enterprise / Species Policy Bundle
+  → Species→Enterprise→Project→Personal→Role→Context→Task Cascade
+  → Constraint IR + Provenance Manifest
+  → Hook / SDK-check / CI strict gate
+  → RuntimeDecisionEvent
+  → MCP / report / dashboard / evolution evidence layer
 ```
 
 For the architectural model and long-term design, see [DESIGN.md](DESIGN.md).  
@@ -30,9 +36,10 @@ For the schema contract, see [spec/schema-spec.md](spec/schema-spec.md).
 ## Design Principles
 
 - Govern agents rather than re-implementing business systems.
-- Declare intent and boundaries first, then compile them into native control surfaces.
-- Combine guidance, enforcement, validation, and feedback into one governance loop.
-- Treat runtime state, validators, and signals as first-class governance assets.
+- Declare enterprise safety red lines first, then compile them into native control surfaces.
+- Treat Species and Enterprise thresholds as non-relaxable by Project, Personal, Role, Context, or Task layers.
+- Keep enforcement points authoritative: hooks, SDK checks, and CI gates make decisions from compiled IR and provenance.
+- Treat runtime state, validators, traces, reports, MCP queries, and signals as evidence assets, not policy truth.
 - Keep adapters and signal ingestion pluggable so the control plane outlives any single tool.
 
 ---
@@ -70,10 +77,10 @@ dna init --upgrade <template-name>
 
 ## How It Works
 
-Intent DNA compiles to your tool's native control surfaces:
+Intent DNA compiles organization policy to your tool's native control surfaces:
 
 ```text
-DNA → Constraint IR → CLAUDE.md / settings / agents / skills / runtime state
+DNA → Cascade provenance → Constraint IR → hooks / SDK checks / CI gates → evidence
 ```
 
 Typical outputs include:
@@ -82,12 +89,14 @@ Typical outputs include:
 |--------|---------|
 | `CLAUDE.md` | Behavioral guidance |
 | `.dna/compiled/ir.json` | Runtime-readable compiled constraints |
+| provenance manifest | Policy bundle, cascade layers, winners, and compiled IR hash |
+| RuntimeDecisionEvent | Enterprise evidence for allow/warn/block/escalate/validate decisions |
 | `.dna/state/sessions/*/handoffs/*.json` | Local artifact manifests for workflow handoff facts |
 | `.claude/agents/*.md` | Role definitions |
 | `.claude/skills/*/SKILL.md` | Workflow entrypoints |
 | `.claude/settings.json` or plugin runtime | Hook wiring |
 
-**Key idea:** prompts can drift, but runtime constraints, resolver-backed handoffs, and feedback loops make behavior governable.
+**Key idea:** prompts can drift, but non-relaxable enterprise thresholds, compiled gates, and provenance-backed runtime evidence make behavior governable.
 
 ---
 
@@ -95,11 +104,13 @@ Typical outputs include:
 
 Intent DNA currently focuses on:
 
+- Enterprise Safety Slice: shared policy bundles, cascade provenance, and non-relaxable organization thresholds
 - Claude Code / Claude-style harnesses
 - Role-based agent workflows
 - Template-driven project bootstrap and upgrades
 - Deterministic guardrails and stateful enforcement
 - Resolver-backed artifact handoff between workflow steps
+- Evidence-layer MCP/report/state/trace/audit surfaces
 - Dogfood-driven template iteration
 
 Adapter and ecosystem direction are tracked in [ROADMAP.md](ROADMAP.md), not duplicated here.
@@ -157,7 +168,7 @@ workflows:
         description: Review the implementation
 ```
 
-**Cascade:** DNA files inherit and override by priority. `threshold` codons (safety rules) can never be relaxed — even by higher priority DNA.
+**Cascade:** DNA files inherit and override by priority. `threshold` codons (safety rules) from Species or Enterprise are red lines: Project, Personal, Role, Context, and Task layers may add stricter rules but cannot relax them.
 
 **Genes:** Behavioral traits (attract/repel/threshold/weight/sense).
 

package/dist/cli/commands/compile.js

@@ -4,53 +4,8 @@
  * Compile DNA files to framework-specific configuration.
  */
 import { writeFile } from "node:fs/promises";
-import { resolve, dirname } from "node:path";
-import { fileURLToPath } from "node:url";
-import { compileFromFiles } from "../../compiler/index.js";
+import { compileFromFiles, expandDNAInputFiles } from "../../compiler/index.js";
 import { compileForClaude } from "../../runtime/claude-sdk.js";
-/**
- * Resolve the species default DNA path relative to this module's location.
- */
-function resolveSpeciesPath(ref) {
-    if (!ref.startsWith("species:"))
-        return null;
-    const name = ref.slice("species:".length);
-    const thisDir = dirname(fileURLToPath(import.meta.url));
-    // From dist/cli/commands/ -> dist/species/
-    return resolve(thisDir, "..", "..", "species", `${name}.dna.json`);
-}
-/**
- * Expand species references in file list and add species default if any DNA inherits it.
- */
-async function expandFiles(files) {
-    const { readFile } = await import("node:fs/promises");
-    const expanded = [];
-    const seen = new Set();
-    // First pass: collect all files and check for species references
-    for (const file of files) {
-        const abs = resolve(file);
-        if (seen.has(abs))
-            continue;
-        seen.add(abs);
-        expanded.push(abs);
-        // Check if this DNA inherits from species
-        try {
-            const raw = await readFile(abs, "utf-8");
-            const dna = JSON.parse(raw);
-            for (const ref of dna.cascade?.inherits ?? []) {
-                const speciesPath = resolveSpeciesPath(ref);
-                if (speciesPath && !seen.has(speciesPath)) {
-                    seen.add(speciesPath);
-                    expanded.unshift(speciesPath); // species goes first (lowest priority)
-                }
-            }
-        }
-        catch {
-            // Will fail later during compilation with proper error
-        }
-    }
-    return expanded;
-}
 export async function runCompile(opts) {
     if (opts.files.length === 0) {
         process.stderr.write("Error: no files specified\n");
@@ -62,7 +17,7 @@ export async function runCompile(opts) {
         return 2;
     }
     try {
-        const expandedFiles = await expandFiles(opts.files);
+        const expandedFiles = await expandDNAInputFiles(opts.files);
         const ir = await compileFromFiles(expandedFiles, opts.context);
         let output;
         if (opts.ir) {

package/dist/cli/commands/context.d.ts

@@ -0,0 +1,8 @@
+export interface ContextOptions {
+    subcommand: string;
+    query?: string;
+    id?: string;
+    files?: string[];
+    projectDir?: string;
+}
+export declare function runContext(opts: ContextOptions): Promise<number>;

package/dist/cli/commands/context.js

@@ -0,0 +1,63 @@
+import { resolve } from "node:path";
+import { findContextSource, formatContextSource, loadContextSourceIndex, readContextSourceDocument, searchContextSources, } from "../../runtime/context-sources.js";
+function usage() {
+    return "Usage: dna context <index|search|doc> [query|id] [files...]\n";
+}
+export async function runContext(opts) {
+    const projectDir = opts.projectDir ?? process.cwd();
+    const files = opts.files?.map((file) => resolve(projectDir, file));
+    const index = await loadContextSourceIndex(projectDir, files);
+    switch (opts.subcommand) {
+        case "index": {
+            if (index.sources.length === 0) {
+                process.stdout.write("No advisory context sources declared.\n");
+                return 0;
+            }
+            process.stdout.write(index.sources.map(formatContextSource).join("\n") + "\n");
+            if (index.planning_instructions.length > 0) {
+                process.stdout.write("\nPlanning instructions:\n");
+                for (const instruction of index.planning_instructions) {
+                    process.stdout.write(`- ${instruction}\n`);
+                }
+            }
+            return 0;
+        }
+        case "search": {
+            const query = opts.query ?? "";
+            const matches = searchContextSources(index, query);
+            if (matches.length === 0) {
+                process.stdout.write(`No advisory context sources matched '${query}'.\n`);
+                return 1;
+            }
+            process.stdout.write(matches.map(formatContextSource).join("\n") + "\n");
+            return 0;
+        }
+        case "doc": {
+            const id = opts.id ?? "";
+            if (!id) {
+                process.stderr.write("Error: context doc requires a source id.\n");
+                process.stderr.write(usage());
+                return 2;
+            }
+            const source = findContextSource(index, id);
+            if (!source) {
+                process.stderr.write(`Error: unknown advisory context source '${id}'.\n`);
+                return 1;
+            }
+            const doc = await readContextSourceDocument(projectDir, source);
+            process.stdout.write(`${formatContextSource(source)}\n`);
+            process.stdout.write("Planning-only advisory context; does not satisfy enforcement, handoff, or ArtifactManifest requirements.\n");
+            if (doc.content !== undefined) {
+                process.stdout.write("\n---\n");
+                process.stdout.write(doc.content.endsWith("\n") ? doc.content : `${doc.content}\n`);
+            }
+            else {
+                process.stdout.write("No local document body is available for this source type.\n");
+            }
+            return 0;
+        }
+        default:
+            process.stderr.write(usage());
+            return 2;
+    }
+}

package/dist/cli/commands/feedback.d.ts

@@ -1,13 +1,14 @@
 /**
  * dna feedback [--days <N>] [--json] [--evolve]
  *
- * Build a local kernel observability report from traces and verifier results.
- * With --evolve: include a preview-only marker diff derived from local signals.
+ * Build a local kernel observability report from RuntimeDecisionEvent evidence.
+ * Legacy traces and verifier results are included as diagnostic context only.
  */
 export interface FeedbackOptions {
     days: number;
     json: boolean;
     evolve: boolean;
     dnaId?: string;
+    packageReport?: boolean;
 }
 export declare function runFeedback(opts: FeedbackOptions): Promise<number>;

package/dist/cli/commands/feedback.js

@@ -1,20 +1,31 @@
 /**
  * dna feedback [--days <N>] [--json] [--evolve]
  *
- * Build a local kernel observability report from traces and verifier results.
- * With --evolve: include a preview-only marker diff derived from local signals.
+ * Build a local kernel observability report from RuntimeDecisionEvent evidence.
+ * Legacy traces and verifier results are included as diagnostic context only.
  */
 import { buildKernelReport, formatKernelReport } from "../../report/kernel-report.js";
+import { buildReportPackage } from "../../report/report-package.js";
 export async function runFeedback(opts) {
+    if (opts.packageReport) {
+        const reportPackage = await buildReportPackage({
+            projectDir: process.cwd(),
+            days: opts.days,
+            includeMarkerPreview: opts.evolve,
+            dnaId: opts.dnaId,
+        });
+        process.stdout.write(JSON.stringify(reportPackage, null, 2) + "\n");
+        return 0;
+    }
     const report = await buildKernelReport({
         projectDir: process.cwd(),
         days: opts.days,
         includeMarkerPreview: opts.evolve,
         dnaId: opts.dnaId,
     });
-    if (report.summary.traces === 0 && report.summary.verifier_results === 0) {
-        process.stderr.write(`No trace or verifier data found for the last ${opts.days} day(s).\n`);
-        process.stderr.write("Signals are generated by dna-hook during Claude Code sessions.\n");
+    if (report.summary.runtime_decisions === 0 && report.summary.legacy_diagnostics === 0) {
+        process.stderr.write(`No RuntimeDecisionEvent evidence or legacy diagnostics found for the last ${opts.days} day(s).\n`);
+        process.stderr.write("RuntimeDecisionEvent evidence is generated by dna-hook during Claude Code sessions.\n");
         return 0;
     }
     if (opts.json) {

package/dist/cli/commands/init.js

@@ -6,8 +6,8 @@
 import { writeFile, readFile, readdir, mkdir, copyFile, access } from "node:fs/promises";
 import { resolve, dirname, basename } from "node:path";
 import { fileURLToPath } from "node:url";
-import { createHash } from "node:crypto";
 import { parseYAML } from "../../schema/yaml-parser.js";
+import { listTemplateCatalog, calculateTemplateContentHash } from "../../templates/catalog.js";
 import { sanitizeTemplateName } from "../util/version.js";
 import { validateDNA } from "../../schema/validate.js";
 import { askString, askChoice, askNumber, askYesNo, closePrompt } from "../util/prompt.js";
@@ -23,53 +23,20 @@ async function dirExists(path) {
         return false;
     }
 }
-/**
- * Extract namespace and display name from a template YAML file.
- */
-async function readTemplateMetadata(filePath) {
-    try {
-        const content = await readFile(filePath, "utf-8");
-        const data = parseYAML(content);
-        return {
-            namespace: typeof data.namespace === "string" ? data.namespace : undefined,
-            displayName: typeof data.name === "string" ? data.name : undefined,
-        };
-    }
-    catch {
-        return {};
-    }
-}
 async function listTemplates() {
-    const results = [];
-    // Built-in templates
-    try {
-        const files = await readdir(TEMPLATES_DIR);
-        for (const f of files.filter((f) => f.endsWith(".dna.yaml"))) {
-            const name = f.replace(".dna.yaml", "");
-            const meta = await readTemplateMetadata(resolve(TEMPLATES_DIR, f));
-            results.push({ name, namespace: meta.namespace, displayName: meta.displayName, source: "builtin" });
-        }
-    }
-    catch { /* no built-in templates */ }
-    // Project-local templates
-    if (await dirExists(PROJECT_TEMPLATES_DIR)) {
-        try {
-            const files = await readdir(PROJECT_TEMPLATES_DIR);
-            for (const f of files.filter((f) => f.endsWith(".dna.yaml"))) {
-                const name = f.replace(".dna.yaml", "");
-                const meta = await readTemplateMetadata(resolve(PROJECT_TEMPLATES_DIR, f));
-                results.push({ name, namespace: meta.namespace, displayName: meta.displayName, source: "project" });
-            }
-        }
-        catch { /* no project templates */ }
-    }
-    return results;
+    const entries = await listTemplateCatalog();
+    return entries.map((entry) => ({
+        name: entry.name,
+        namespace: entry.namespace,
+        displayName: entry.displayName,
+        source: entry.source,
+    }));
 }
 /**
  * Calculate SHA256 hash of template content (truncated to 16 hex chars).
  */
 export function calculateTemplateHash(content) {
-    return createHash("sha256").update(content, "utf-8").digest("hex").slice(0, 16);
+    return calculateTemplateContentHash(content);
 }
 /**
  * Inject _source_template, _template_version, and _template_content_hash fields after the namespace/type line in YAML content.
@@ -122,27 +89,8 @@ function inferTemplateName(id) {
  * Priority: .dna/configs/*.yaml (multi-config) > legacy single-config
  */
 async function autoDetectConfigsForUpgrade() {
-    // Priority 1: .dna/configs/*.yaml (multi-config)
-    try {
-        const files = await readdir(MULTI_CONFIG_DIR);
-        const yamls = files
-            .filter(f => f.endsWith(".yaml") || f.endsWith(".yml"))
-            .sort()
-            .map(f => resolve(MULTI_CONFIG_DIR, f));
-        if (yamls.length > 0)
-            return yamls;
-    }
-    catch { /* dir doesn't exist */ }
-    // Fallback: legacy single-config paths
-    const candidates = [
-        ".dna/config.yaml", ".dna/config.yml", ".dna/config.json",
-        ".dna.yaml", ".dna.yml", ".dna.json",
-    ];
-    for (const name of candidates) {
-        if (await dirExists(name))
-            return [name];
-    }
-    return [];
+    const { detectDNAConfigs } = await import("../../compiler/index.js");
+    return detectDNAConfigs(process.cwd());
 }
 /**
  * Upgrade config from a newer template version while preserving user-filled variables.

package/dist/cli/commands/run.js

@@ -9,7 +9,7 @@ import { spawn } from "node:child_process";
 import { mkdir, writeFile } from "node:fs/promises";
 import { join } from "node:path";
 import { randomUUID } from "node:crypto";
-import { loadDNA, compileFromFiles } from "../../compiler/index.js";
+import { loadDNA, compileFromFiles, expandDNAInputFiles } from "../../compiler/index.js";
 import { cascadeDNA } from "../../compiler/cascade.js";
 import { compileWorkflow } from "../../compiler/workflow.js";
 import { compileAllRolesToAgentMD, writeAgentMDFiles, toKebabCase, } from "../../runtime/agent-md.js";
@@ -254,14 +254,15 @@ export async function runRun(opts) {
         return 2;
     }
     const maxBudget = opts.maxBudget ?? 5;
-    const permissionMode = opts.permissionMode ?? "bypassPermissions";
+    const permissionMode = opts.permissionMode ?? "default";
     const agentsDir = opts.agentsDir ?? ".claude/agents";
     try {
         // ── Step 1: Load & compile DNA ───────────────────────
         log("Loading DNA files...");
-        const dnas = await Promise.all(opts.dnaFiles.map(loadDNA));
+        const expandedDNAFiles = await expandDNAInputFiles(opts.dnaFiles);
+        const dnas = await Promise.all(expandedDNAFiles.map(loadDNA));
         const cascaded = cascadeDNA(dnas);
-        const ir = await compileFromFiles(opts.dnaFiles, {
+        const ir = await compileFromFiles(expandedDNAFiles, {
             context: opts.context,
         });
         // ── Step 2: Find & compile workflow ──────────────────

package/dist/cli/commands/show.js

@@ -3,51 +3,15 @@
  *
  * Show DNA gene expression state in human-readable format.
  */
-import { resolve, dirname } from "node:path";
-import { readFile } from "node:fs/promises";
-import { fileURLToPath } from "node:url";
-import { loadDNA, cascadeDNA, activateDNA } from "../../compiler/index.js";
+import { loadDNA, cascadeDNA, activateDNA, expandDNAInputFiles } from "../../compiler/index.js";
 import { formatGene, bold } from "../util/format.js";
-function resolveSpeciesPath(ref) {
-    if (!ref.startsWith("species:"))
-        return null;
-    const name = ref.slice("species:".length);
-    const thisDir = dirname(fileURLToPath(import.meta.url));
-    return resolve(thisDir, "..", "..", "species", `${name}.dna.json`);
-}
-async function expandFiles(files) {
-    const expanded = [];
-    const seen = new Set();
-    for (const file of files) {
-        const abs = resolve(file);
-        if (seen.has(abs))
-            continue;
-        seen.add(abs);
-        expanded.push(abs);
-        try {
-            const raw = await readFile(abs, "utf-8");
-            const dna = JSON.parse(raw);
-            for (const ref of dna.cascade?.inherits ?? []) {
-                const speciesPath = resolveSpeciesPath(ref);
-                if (speciesPath && !seen.has(speciesPath)) {
-                    seen.add(speciesPath);
-                    expanded.unshift(speciesPath);
-                }
-            }
-        }
-        catch {
-            // Will fail later with proper error
-        }
-    }
-    return expanded;
-}
 export async function runShow(opts) {
     if (opts.files.length === 0) {
         process.stderr.write("Error: no files specified\n");
         return 2;
     }
     try {
-        const expandedFiles = await expandFiles(opts.files);
+        const expandedFiles = await expandDNAInputFiles(opts.files);
         const dnas = await Promise.all(expandedFiles.map(loadDNA));
         const cascaded = cascadeDNA(dnas);
         const activated = activateDNA(cascaded, opts.context ?? null);

package/dist/cli/commands/sync.d.ts

@@ -10,6 +10,7 @@
  *
  * Targets: claude-md, soul-md, cursorrules, system-prompt
  */
+export type SyncMode = "auto" | "plugin" | "bin";
 export interface SyncOptions {
     files: string[];
     target: string;
@@ -26,7 +27,10 @@ export interface SyncOptions {
     settingsPath?: string;
     lockFile?: string;
     remove: boolean;
+    mode?: SyncMode;
     plugin?: boolean;
+    dryRun?: boolean;
+    postSummary?: boolean;
 }
 /**
  * Detect whether intentdna is running as a Claude Code plugin or standalone binary.
@@ -47,8 +51,8 @@ export declare function detectMode(): Promise<"plugin" | "bin">;
  */
 export declare function cleanStaleDNAFiles(dir: string, type: "agents" | "skills", activeNamespaces: string[]): Promise<string[]>;
 /**
- * Auto-detect DNA configs: multi-config (.dna/configs/*.yaml) or legacy single-config.
- * Returns array of absolute paths.
+ * Auto-detect DNA config file in current directory (legacy single-config).
+ * Priority: .dna/config.yaml > .dna/config.yml > .dna/config.json > .dna.yaml > .dna.yml > .dna.json
  */
 export declare function autoDetectConfigs(): Promise<string[]>;
 /**
@@ -74,12 +78,11 @@ export interface TemplateUpgradeInfo {
     templateName: string;
     currentVersion: string;
     availableVersion: string;
+    reason: "version-update" | "missing-hash" | "content-drift";
 }
 /**
- * Check template versions against current template content hashes.
- * Returns upgrade info for changed configs and prints human-readable suggestions.
- *
- * Uses content hash comparison instead of semver — detects any template content change.
+ * Check stamped template metadata against the current template catalog.
+ * Version mismatch is the primary upgrade signal; content hash drift is a fallback.
  */
 export declare function checkTemplateVersions(configPaths: string[]): Promise<TemplateUpgradeInfo[]>;
 export declare function runSync(opts: SyncOptions): Promise<number>;