intentdna 1.7.4 → 1.8.0

package/dist/cli/commands/org.js

@@ -0,0 +1,2393 @@
+/**
+ * dna org — local organization/project asset management.
+ */
+import { bindOrganizationAsset, createOrganizationProfile, isOrganizationAssetStatus, readOrganizationProfile, reviewOrganization, } from "../../organization/index.js";
+import { activeEvidenceFollowupReviewRoute, activeEvidenceFollowupRoute, buildWorkflowAssetEvidenceIndex, findWorkflowAsset, listWorkflowAssets } from "../../assets/index.js";
+import { WORKFLOW_ASSET_IDS } from "../../templates/metadata.js";
+import { createConfigFromTemplate } from "./init.js";
+function commandQuote(value) {
+    return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
+}
+function commandValue(value) {
+    return /^[A-Za-z0-9_./:-]+$/.test(value) ? value : commandQuote(value);
+}
+function syncTargetFromDescription(description) {
+    const lower = description?.toLowerCase() ?? "";
+    if (lower.includes("codex"))
+        return "codex";
+    if (lower.includes("claude"))
+        return "claude";
+    return undefined;
+}
+function preferredProjectName(opts) {
+    return opts.project?.trim() || opts.description?.trim() || "My Project";
+}
+async function preferredAssetName(opts) {
+    if (opts.asset?.trim())
+        return opts.asset.trim();
+    const assets = await listWorkflowAssets({ projectDir: opts.projectDir });
+    const description = opts.description?.toLowerCase() ?? "";
+    const describedAsset = assets.find((asset) => description.includes(asset.name.toLowerCase()));
+    return describedAsset?.name
+        ?? assets.find((asset) => asset.status.managementStatus === "dogfood_ready")?.name
+        ?? assets.find((asset) => asset.name === WORKFLOW_ASSET_IDS.default)?.name
+        ?? assets[0]?.name
+        ?? WORKFLOW_ASSET_IDS.default;
+}
+function profileSyncTargets(profile) {
+    if (!profile)
+        return [];
+    return [...new Set(profile.projects.flatMap((project) => project.syncTargets))];
+}
+function projectHasAsset(profile, projectName, asset) {
+    if (!profile)
+        return false;
+    const project = profile.projects.find((entry) => entry.name === projectName || entry.id === projectName) ?? profile.projects[0];
+    return project?.assets.some((binding) => binding.asset === asset) === true;
+}
+function projectHasSyncTarget(profile, projectName, target) {
+    if (!profile)
+        return false;
+    const project = profile.projects.find((entry) => entry.name === projectName || entry.id === projectName) ?? profile.projects[0];
+    return project?.syncTargets.includes(target) === true;
+}
+function orgInitCommand(params) {
+    return `dna org init --name ${commandValue(params.name)} --project ${commandValue(params.project)} --asset ${params.asset} --sync-target ${params.syncTarget}`;
+}
+function orgBindCommand(params) {
+    const project = params.project ? ` --project ${commandValue(params.project)}` : "";
+    return `dna org bind --asset ${params.asset}${project} --status ${params.status} --sync-target ${params.syncTarget}`;
+}
+function rolloutCommandForTarget(target) {
+    const normalized = target.toLowerCase();
+    if (normalized === "codex" || normalized === "codex_cli")
+        return "dna sync --codex";
+    return "dna sync";
+}
+function buildOrgReleaseGate() {
+    return {
+        status: "conditional",
+        command: "dna release deploy-plan <changed-files>",
+        requiredWhen: [
+            "apps/online public, embed, management, or static handoff surface changed.",
+            "apps/dashboard changed and needs external deployed review.",
+            "public static assets, public articles, launch pages, or preview pages changed.",
+        ],
+        notRequiredFor: [
+            "dna CLI/core/runtime changes.",
+            "docs, references, wiki, and internal Obsidian project memory changes.",
+            "Organization rollout or runtime sync when no web/public deployed surface changed.",
+        ],
+        deployAndVerifyWhen: "Only after dna release deploy-plan returns deployment_required, or deployment_conditional is explicitly confirmed for external review.",
+        verification: [
+            "Run the local build/test commands printed by dna release deploy-plan.",
+            "Deploy with the printed Vercel CLI command and capture the deployment URL.",
+            "Wait for readiness with the printed Vercel inspect --wait command.",
+            "Verify the changed deployed routes with the printed Vercel curl commands before claiming release completion.",
+        ],
+        boundary: "Release gate is read-only here; org review and rollout do not deploy, sync runtime artifacts, mutate dashboard state, or replace dna release deploy-plan.",
+    };
+}
+function buildOrgOperatingRoute(params) {
+    const asset = params.asset || WORKFLOW_ASSET_IDS.default;
+    const syncTarget = params.syncTarget || "codex";
+    const followup = activeEvidenceFollowupRoute(asset);
+    const followupCommands = new Set([
+        followup.command,
+        `dna assets inspect ${followup.assetName} --evidence`,
+        `dna assets governance ${followup.assetName}`,
+        `dna assets diff ${asset} ${followup.assetName}`,
+        `dna assets adoption ${followup.assetName}`,
+        `dna org bind --asset ${followup.assetName} --status active --sync-target ${syncTarget}`,
+    ]);
+    const usingFollowup = followupCommands.has(params.currentCommand) || params.nextAsset === followup.assetName;
+    const reviewingFollowup = usingFollowup && params.currentCommand !== followup.command;
+    const nextVersion = params.nextAsset ?? (usingFollowup ? followup.assetName : `${asset}-v2`);
+    const editCommand = usingFollowup && !reviewingFollowup
+        ? followup.command
+        : `dna workflow edit-plan "Describe the reviewed workflow change" --from-template ${asset} --save-template ${nextVersion}`;
+    const syncCommand = rolloutCommandForTarget(syncTarget);
+    const organizeCommand = params.currentStage === "organize" && params.currentCommand.startsWith("dna org bind ")
+        ? params.currentCommand
+        : `dna org bind --asset ${nextVersion} --status active --sync-target ${syncTarget}`;
+    return {
+        spine: ["describe", "asset", "edit", "review", "organize", "configure", "rollout", "sync", "deploy", "improve"],
+        currentStage: params.currentStage,
+        currentCommand: params.currentCommand,
+        principle: "Users describe a working method; dna turns it into a governed workflow asset, routes it through manager review, binds it to an organization, then syncs runtime surfaces only after gates pass.",
+        phases: [
+            {
+                id: "describe",
+                label: "Describe work",
+                command: `dna workflow intake "Describe the working method you want to govern"`,
+                purpose: "Start from natural language rather than a canvas or harness-specific setup.",
+                writes: false,
+                owner: "user",
+            },
+            {
+                id: "asset",
+                label: "Choose or inspect asset",
+                command: `dna assets lineage ${asset}`,
+                purpose: "Understand the asset's origin, cascade, evidence, and evolution route before adoption.",
+                writes: false,
+                owner: "dna_core",
+            },
+            {
+                id: "edit",
+                label: usingFollowup
+                    ? reviewingFollowup ? "Unfinished-work draft ready for review" : "Save unfinished-work draft"
+                    : "Draft workflow change",
+                command: editCommand,
+                purpose: usingFollowup
+                    ? reviewingFollowup
+                        ? "The unfinished-work draft exists; keep generation closed and continue through diff/adoption review without replacing the source asset."
+                        : "Save open dogfood evidence as a reviewable unfinished-work draft before organization binding or sync; the source asset stays intact."
+                    : "Create a reviewable workflow asset version without mutating organization state.",
+                writes: usingFollowup ? !reviewingFollowup : true,
+                owner: "dna_core",
+            },
+            {
+                id: "review",
+                label: "Review asset version",
+                command: `dna assets diff ${asset} ${nextVersion}`,
+                purpose: "Let a manager review workflow and governance changes before adoption.",
+                writes: false,
+                owner: "manager",
+            },
+            {
+                id: "organize",
+                label: "Bind to organization",
+                command: organizeCommand,
+                purpose: "Record the accepted asset version in the organization route before rollout.",
+                writes: true,
+                owner: "manager",
+            },
+            {
+                id: "configure",
+                label: "Configure declared assets",
+                command: "dna org configure-plan",
+                purpose: "List or apply explicit dna init commands for organization-declared assets missing project config.",
+                writes: false,
+                owner: "dna_core",
+            },
+            {
+                id: "rollout",
+                label: "Review rollout",
+                command: "dna org rollout",
+                purpose: "Check target-level ready, partial, and blocked distribution plans before runtime sync.",
+                writes: false,
+                owner: "manager",
+            },
+            {
+                id: "sync",
+                label: "Sync runtime",
+                command: syncCommand,
+                purpose: "Generate Codex or Claude runtime artifacts only after organization gates pass.",
+                writes: true,
+                owner: "runtime",
+            },
+            {
+                id: "deploy",
+                label: "Deploy public surface",
+                command: "dna release deploy-plan",
+                purpose: "Use Vercel CLI deployment and deployed URL verification only for web/public surface changes.",
+                writes: false,
+                owner: "release",
+            },
+            {
+                id: "improve",
+                label: "Improve from evidence",
+                command: usingFollowup ? params.currentCommand : `dna assets suggestions ${asset}`,
+                purpose: usingFollowup
+                    ? "Feed dogfood evidence into a concrete reviewed unfinished-work draft before promotion."
+                    : "Feed dogfood evidence back into reviewed workflow asset improvements instead of mutating policy automatically.",
+                writes: false,
+                owner: "dna_core",
+            },
+        ],
+        boundaries: [
+            "dna CLI/core/runtime owns workflow assets, organization bindings, rollout gates, and sync decisions.",
+            "Dashboard is a read-only projection of this route, not a workflow builder or policy source of truth.",
+            "Obsidian/wiki is internal project memory for decisions and references, not product runtime state.",
+            "Claude Code and Codex are harness targets; governance logic should not be reimplemented inside those tools.",
+            "Vercel deployment is conditional and separate from organization rollout and runtime sync.",
+        ],
+    };
+}
+function buildDistributionPlan(targets, assets) {
+    return targets.map((target) => {
+        const targetAssets = assets.filter((asset) => asset.syncTargets.includes(target));
+        const readyAssets = targetAssets
+            .filter((asset) => asset.syncReady)
+            .map((asset) => ({ project: asset.project, asset: asset.asset }));
+        const blockedAssets = targetAssets
+            .filter((asset) => !asset.syncReady)
+            .map((asset) => ({
+            project: asset.project,
+            asset: asset.asset,
+            reason: asset.reason,
+            nextCommand: asset.nextCommand,
+        }));
+        const status = readyAssets.length > 0 && blockedAssets.length === 0
+            ? "ready"
+            : readyAssets.length > 0
+                ? "partial"
+                : "blocked";
+        return {
+            target,
+            status,
+            command: rolloutCommandForTarget(target),
+            readyAssets,
+            blockedAssets,
+        };
+    });
+}
+function orgRouteAssetRank(gate) {
+    if (gate.evidenceGate === "open")
+        return 0;
+    if (gate.bindingStatus === "active")
+        return 1;
+    if (gate.asset === WORKFLOW_ASSET_IDS.default)
+        return 2;
+    return 3;
+}
+function managerRisk(params) {
+    if (params.hasOpenEvidence)
+        return "open_evidence";
+    if (params.hasMissingConfiguration)
+        return "missing_configuration";
+    if (params.hasInactiveBinding)
+        return "inactive_binding";
+    if (params.decision === "ready_to_rollout")
+        return "ready_for_sync";
+    return "unknown";
+}
+function managerAllowedNow(params) {
+    if (params.decision === "ready_to_rollout") {
+        return [
+            "Review rollout readiness with dna org rollout.",
+            "Run the target sync command only after rollout stays ready.",
+            "Use dna release deploy-plan only if a web/public deployed surface changed.",
+        ];
+    }
+    if (params.decision === "review_evidence_before_rollout") {
+        const createCommand = activeEvidenceFollowupRoute(params.primaryAsset).command;
+        return [
+            params.primaryCommand === createCommand
+                ? `Save the unfinished-work draft: ${params.primaryCommand}.`
+                : `Review the saved unfinished-work draft: ${params.primaryCommand}.`,
+            "Review the draft diff before explicit adoption; the source asset is not replaced automatically.",
+            "Keep rollout and sync blocked until evidence is closed or explicitly triaged.",
+        ];
+    }
+    if (params.decision === "activate_bindings_before_rollout") {
+        return [
+            `Activate the configured organization binding: ${params.primaryCommand}.`,
+            "Return to dna org review after activation.",
+            "Run dna org rollout before any runtime sync command.",
+        ];
+    }
+    return [
+        "Review missing project configuration with dna org configure-plan.",
+        "Apply configuration only after the plan is acceptable.",
+        "Return to dna org review before rollout or sync.",
+    ];
+}
+function managerBlockedNow(params) {
+    const blocked = [];
+    if (params.hasOpenEvidence)
+        blocked.push("Runtime sync is blocked while dogfood evidence remains open.");
+    if (params.hasMissingConfiguration)
+        blocked.push("Runtime sync is blocked while organization-declared assets are not configured in the project.");
+    if (params.hasInactiveBinding)
+        blocked.push("Runtime sync is blocked while configured assets are not active in the organization binding.");
+    if (params.blockedAssets > 0)
+        blocked.push("Organization rollout is blocked for at least one declared asset.");
+    if (params.decision !== "ready_to_rollout")
+        blocked.push("Vercel deployment is not a substitute for org rollout or runtime sync.");
+    return blocked.length > 0 ? [...new Set(blocked)] : ["No manager-level blockers detected; still verify rollout before sync."];
+}
+function managerDecisionReason(params) {
+    if (params.decision === "review_evidence_before_rollout") {
+        if (params.dogfoodRemaining === 0) {
+            return "Dogfood modules show remaining=0, but an unfinished-work follow-up draft still needs diff/adoption review before rollout.";
+        }
+        return `Dogfood evidence has remaining=${params.dogfoodRemaining}; review or save an unfinished-work draft before rollout.`;
+    }
+    if (params.decision === "configure_assets_before_rollout") {
+        return `${params.blockedAssets} declared asset(s) are blocked and at least one needs project configuration before rollout.`;
+    }
+    if (params.decision === "activate_bindings_before_rollout") {
+        return `${params.blockedAssets} declared asset(s) are configured but still need manager activation before rollout.`;
+    }
+    return `${params.readyAssets}/${params.declaredAssets} declared asset(s) are ready; rollout review can decide whether to sync.`;
+}
+function buildUnfinishedWorkReview(params) {
+    const primaryFollowupMatch = /^(.*)-active-followup$/.exec(params.primaryAsset);
+    if (params.decision !== "review_evidence_before_rollout" && !primaryFollowupMatch)
+        return undefined;
+    const openGate = params.assets.find((asset) => asset.evidenceGate === "open")
+        ?? params.assets.find((asset) => asset.asset === params.primaryAsset);
+    const openFollowupMatch = openGate ? /^(.*)-active-followup$/.exec(openGate.asset) : undefined;
+    const sourceAsset = openFollowupMatch?.[1] ?? primaryFollowupMatch?.[1] ?? openGate?.asset ?? params.primaryAsset;
+    const route = activeEvidenceFollowupRoute(sourceAsset);
+    const normalizedCurrentCommand = params.primaryAsset === route.assetName && params.primaryCommand !== route.command && params.primaryCommand !== `${route.command} --force`
+        ? `dna assets diff ${sourceAsset} ${route.assetName}`
+        : params.primaryCommand;
+    const draftStatus = params.primaryCommand === route.command
+        ? "save_required"
+        : params.primaryCommand === `${route.command} --force`
+            ? "repair_required"
+            : params.primaryCommand === `dna assets inspect ${route.assetName} --evidence`
+                ? "inspect_required"
+                : "diff_review_required";
+    const diffCommand = `dna assets diff ${sourceAsset} ${route.assetName}`;
+    return {
+        mode: "unfinished_work_review",
+        status: draftStatus,
+        sourceAsset,
+        draftAsset: route.assetName,
+        plainLanguage: {
+            label: "saved unfinished-work draft",
+            purpose: "Make unfinished dogfood evidence explicit for manager review before stability, rollout, sync, publication readiness, or evolution claims.",
+            workflowImprovement: "Adds a concrete evidence checkpoint to the existing workflow route so active unfinished work is inspected, diffed, and accepted before anyone treats the source asset as stable.",
+            preserves: [
+                `${sourceAsset} remains the original workflow asset.`,
+                `${WORKFLOW_ASSET_IDS.rewriteFixReviewLoop} remains the reusable fix loop asset.`,
+                `${route.assetName} is only a review draft until a manager accepts it through diff, adoption, bind, and rollout gates.`,
+            ],
+            requiredBeforeUse: [
+                diffCommand,
+                "record explicit manager rationale for the diff when needed",
+                `dna assets adoption ${route.assetName}`,
+                `dna org bind --asset ${route.assetName} --status active --sync-target codex`,
+                "dna org rollout",
+            ],
+        },
+        currentCommand: normalizedCurrentCommand,
+        writes: normalizedCurrentCommand === route.command || normalizedCurrentCommand === `${route.command} --force`,
+        purpose: "Capture open dogfood evidence as an explicit manager-review handoff before rollout, publication readiness, runtime sync, or evolution.",
+        localAuthority: "manager_review_handoff_only",
+        notReplacement: true,
+        sourceAssetPreserved: true,
+        reviewCommands: [
+            route.command,
+            `dna assets inspect ${route.assetName} --evidence`,
+            diffCommand,
+            `record explicit manager rationale for ${diffCommand}`,
+            `dna assets adoption ${route.assetName}`,
+            `dna org bind --asset ${route.assetName} --status active --sync-target codex`,
+            "dna org rollout",
+        ],
+        boundaries: [
+            `${route.assetName} is a saved unfinished-work draft for ${sourceAsset}; it does not replace, delete, or auto-adopt ${sourceAsset}.`,
+            `${sourceAsset} remains the original workflow asset until a manager accepts a diff, adopts the draft, updates organization binding, and reruns rollout.`,
+            "The reusable fix loop remains a separate workflow asset; unfinished-work review does not remove or collapse existing fix-loop behavior.",
+            "This review package is local manager-review evidence only; it does not publish org_private assets or grant runtime authority.",
+        ],
+        notAllowedToImply: [
+            "source template deletion",
+            "source template replacement",
+            "automatic adoption",
+            "runtime sync approval",
+            "org_private SaaS publication",
+            "workflow execution",
+        ],
+    };
+}
+function assetFamilyName(asset) {
+    return asset.replace(/-active-followup$/, "");
+}
+function isSameAssetFamily(a, b) {
+    return assetFamilyName(a) === assetFamilyName(b);
+}
+function buildAssetPortfolio(assetGates) {
+    const active = assetGates
+        .filter((gate) => gate.bindingStatus === "active")
+        .map((gate) => ({
+        project: gate.project,
+        asset: gate.asset,
+        version: gate.assetVersion,
+        targets: gate.syncTargets,
+        rollout: gate.syncReady ? "ready" : "blocked",
+        evidence: gate.evidenceGate,
+        evidencePosture: gate.evidencePosture,
+        reviewRefs: gate.reviewRefs,
+        reviewEvidence: gate.reviewEvidence,
+        reviewCommand: gate.reviewCommand,
+    }));
+    const activeByProject = new Map();
+    for (const gate of assetGates) {
+        if (gate.bindingStatus !== "active")
+            continue;
+        const current = activeByProject.get(gate.project) ?? [];
+        current.push(gate.asset);
+        activeByProject.set(gate.project, current.sort((a, b) => a.localeCompare(b)));
+    }
+    const stale = assetGates
+        .filter((gate) => gate.bindingStatus !== "active" && activeByProject.get(gate.project)?.some((activeAsset) => isSameAssetFamily(gate.asset, activeAsset)))
+        .map((gate) => {
+        const activeAsset = activeByProject.get(gate.project)?.find((item) => isSameAssetFamily(gate.asset, item)) ?? gate.asset;
+        return {
+            project: gate.project,
+            asset: gate.asset,
+            version: gate.assetVersion,
+            reason: `Active asset ${activeAsset} is already bound for ${gate.project}; compare this ${gate.bindingStatus} version before promotion, pause, or removal.`,
+            nextCommand: `dna assets diff ${gate.asset} ${activeAsset}`,
+            reviewCommand: gate.reviewCommand,
+            reviewEvidence: gate.reviewEvidence,
+        };
+    });
+    const blocked = assetGates
+        .filter((gate) => !gate.syncReady)
+        .map((gate) => ({
+        project: gate.project,
+        asset: gate.asset,
+        version: gate.assetVersion,
+        reason: gate.reason,
+        nextCommand: gate.nextCommand,
+        evidence: gate.evidenceGate,
+        evidencePosture: gate.evidencePosture,
+        reviewCommand: gate.reviewCommand,
+        reviewEvidence: gate.reviewEvidence,
+    }));
+    const evidenceGaps = assetGates
+        .filter((gate) => gate.evidenceGate !== "clear")
+        .map((gate) => ({
+        project: gate.project,
+        asset: gate.asset,
+        version: gate.assetVersion,
+        evidenceGate: gate.evidenceGate,
+        evidencePosture: gate.evidencePosture,
+        reviewRefs: gate.reviewRefs,
+        reason: gate.evidenceGate === "open"
+            ? "Open evidence must be reviewed or saved as unfinished work before broad rollout."
+            : "No linked evidence was found; adoption can continue only as an explicitly reviewed manager decision.",
+        nextCommand: gate.evidenceGate === "open" ? gate.nextCommand : gate.reviewCommand,
+    }));
+    const upgradeRisks = [
+        ...stale.map((item) => ({
+            project: item.project,
+            asset: item.asset,
+            version: item.version,
+            reason: item.reason,
+            nextCommand: item.nextCommand,
+            reviewCommand: item.reviewCommand,
+            reviewEvidence: item.reviewEvidence,
+        })),
+        ...assetGates
+            .filter((gate) => gate.bindingStatus !== "active" && !stale.some((item) => item.project === gate.project && item.asset === gate.asset))
+            .map((gate) => ({
+            project: gate.project,
+            asset: gate.asset,
+            version: gate.assetVersion,
+            reason: gate.evidenceGate === "open"
+                ? `Asset binding is ${gate.bindingStatus}, but open evidence must be reviewed before manager activation or runtime distribution.`
+                : `Asset binding is ${gate.bindingStatus}; manager review must activate it before runtime distribution.`,
+            nextCommand: gate.evidenceGate === "open"
+                ? gate.nextCommand
+                : `dna org bind --asset ${gate.asset} --status active --sync-target ${gate.syncTargets[0] ?? "codex"}`,
+            reviewCommand: gate.reviewCommand,
+            reviewEvidence: gate.reviewEvidence,
+        })),
+        ...assetGates
+            .filter((gate) => gate.evidenceGate === "open")
+            .map((gate) => ({
+            project: gate.project,
+            asset: gate.asset,
+            version: gate.assetVersion,
+            reason: "Open dogfood evidence can change the recommended asset version before rollout.",
+            nextCommand: gate.nextCommand,
+            reviewCommand: gate.reviewCommand,
+            reviewEvidence: gate.reviewEvidence,
+        })),
+    ];
+    const uniqueUpgradeRisks = [...new Map(upgradeRisks.map((risk) => [`${risk.project}:${risk.asset}:${risk.reason}`, risk])).values()];
+    const rolloutMaturity = assetGates.length === 0
+        ? "empty"
+        : active.some((item) => item.rollout === "ready") && blocked.length === 0
+            ? "active_ready"
+            : active.length > 0
+                ? "active_blocked"
+                : evidenceGaps.some((gap) => gap.evidenceGate === "open")
+                    ? "review_required"
+                    : assetGates.some((gate) => gate.reason.includes("binding is not active"))
+                        ? "activation_needed"
+                        : "configuration_needed";
+    return {
+        active,
+        stale,
+        blocked,
+        evidenceGaps,
+        upgradeRisks: uniqueUpgradeRisks,
+        rolloutMaturity,
+    };
+}
+function buildManagerChoices(params) {
+    const syncCommand = params.readyTargets[0]?.command ?? rolloutCommandForTarget(params.primaryTarget ?? "codex");
+    const evidenceCommand = params.hasOpenEvidence ? params.primaryCommand : `dna assets suggestions ${params.primaryAsset}`;
+    const evidenceWrites = params.hasOpenEvidence
+        ? params.primaryCommand === activeEvidenceFollowupRoute(params.primaryAsset).command
+        : false;
+    const evidenceStatus = params.hasOpenEvidence ? "recommended" : "available";
+    const configureStatus = params.hasOpenEvidence
+        ? "blocked"
+        : params.hasMissingConfiguration
+            ? "recommended"
+            : "available";
+    const rolloutStatus = params.decision === "ready_to_rollout" ? "recommended" : "blocked";
+    const syncStatus = params.decision === "ready_to_rollout" ? "available" : "blocked";
+    const blockReason = params.hasOpenEvidence
+        ? "Open dogfood evidence should be reviewed through a follow-up continuation before configuration, rollout, or runtime sync."
+        : params.hasMissingConfiguration
+            ? "Declared workflow assets need project configuration before rollout or runtime sync."
+            : params.hasInactiveBinding
+                ? "Configured workflow assets need manager activation before rollout or runtime sync."
+                : "Declared workflow assets are not ready for rollout or runtime sync yet.";
+    return [
+        {
+            id: "handle_evidence",
+            label: "Handle evidence",
+            command: evidenceCommand,
+            purpose: "Turn dogfood evidence into a reviewed workflow-asset improvement path.",
+            writes: evidenceWrites,
+            status: evidenceStatus,
+            reason: params.hasOpenEvidence
+                ? "Dogfood evidence is still open, so this is the safest first manager action."
+                : "No open dogfood evidence blocks rollout; evidence suggestions remain available for improvement work.",
+            next: params.hasOpenEvidence
+                ? `Review the follow-up continuation with dna assets diff ${params.primaryAsset} ${activeEvidenceFollowupRoute(params.primaryAsset).assetName}, then return to dna org review.`
+                : "Review suggestions, draft a follow-up only if useful, then return to dna org review.",
+        },
+        {
+            id: "configure_assets",
+            label: "Configure assets",
+            command: "dna org configure-plan",
+            purpose: "Inspect or apply missing project configuration for organization-declared workflow assets.",
+            writes: false,
+            status: configureStatus,
+            reason: params.hasOpenEvidence
+                ? "Configuration waits behind the open evidence gate."
+                : params.hasMissingConfiguration
+                    ? "At least one declared workflow asset is not configured in the project yet."
+                    : "No missing project configuration is blocking rollout.",
+            next: params.hasOpenEvidence
+                ? params.primaryCommand
+                : params.hasMissingConfiguration
+                    ? "If the plan is acceptable, run dna org configure-plan --apply, then dna org review."
+                    : params.hasInactiveBinding
+                        ? params.primaryCommand
+                        : "Run dna org rollout to review distribution readiness.",
+        },
+        {
+            id: "review_rollout",
+            label: "Review rollout",
+            command: "dna org rollout",
+            purpose: "Check per-target ready, partial, and blocked distribution before runtime sync.",
+            writes: false,
+            status: rolloutStatus,
+            reason: params.decision === "ready_to_rollout"
+                ? "Declared assets are ready enough for manager rollout review."
+                : blockReason,
+            next: params.decision === "ready_to_rollout" ? syncCommand : params.primaryCommand,
+        },
+        {
+            id: "sync_runtime",
+            label: "Sync runtime",
+            command: syncCommand,
+            purpose: "Generate Claude/Codex runtime artifacts after manager gates pass.",
+            writes: true,
+            status: syncStatus,
+            reason: params.decision === "ready_to_rollout"
+                ? "Runtime sync is available after rollout review confirms the target is ready."
+                : blockReason,
+            next: params.decision === "ready_to_rollout"
+                ? "Run dna release deploy-plan <changed-files> only if web/public surfaces changed."
+                : params.primaryCommand,
+        },
+        {
+            id: "release_public_surface",
+            label: "Release public surface",
+            command: "dna release deploy-plan <changed-files>",
+            purpose: "Decide whether Vercel CLI deployment and deployed URL verification are required.",
+            writes: false,
+            status: "conditional",
+            reason: "Release work is separate from organization rollout and runtime sync, and only opens for web/public deployed surface changes.",
+            next: "If required, run the printed Vercel deploy, inspect, and route verification commands.",
+        },
+    ];
+}
+function managerPathStatus(choice) {
+    if (choice.status === "recommended")
+        return "current";
+    return choice.status;
+}
+function buildManagerPath(params) {
+    const choiceById = new Map(params.choices.map((choice) => [choice.id, choice]));
+    const choiceStep = (id, routeStages, owner) => {
+        const choice = choiceById.get(id);
+        if (!choice) {
+            return {
+                id,
+                label: id,
+                command: params.primaryCommand,
+                purpose: "Manager path step unavailable; inspect dna org review.",
+                owner,
+                writes: false,
+                status: "blocked",
+                routeStages,
+                next: "dna org review",
+            };
+        }
+        return {
+            id,
+            label: choice.label,
+            command: choice.command,
+            purpose: choice.purpose,
+            owner,
+            writes: choice.writes,
+            status: managerPathStatus(choice),
+            routeStages,
+            next: choice.next,
+        };
+    };
+    return [
+        {
+            id: "review_system",
+            label: "Review organization state",
+            command: "dna org review",
+            purpose: "Read the organization profile, declared workflow assets, evidence gates, target readiness, and release boundary before action.",
+            owner: "manager",
+            writes: false,
+            status: "done",
+            routeStages: ["organize"],
+            next: params.primaryCommand,
+        },
+        choiceStep("handle_evidence", ["improve"], "dna_core"),
+        choiceStep("configure_assets", ["configure"], "dna_core"),
+        choiceStep("review_rollout", ["rollout"], "manager"),
+        choiceStep("sync_runtime", ["sync"], "runtime"),
+        choiceStep("release_public_surface", ["deploy"], "release"),
+    ];
+}
+function buildOrgEntryPacket(params) {
+    const decision = params.path === "create_profile"
+        ? "create_profile_first"
+        : params.path === "bind_asset"
+            ? "bind_asset_first"
+            : "review_existing_profile";
+    const primaryAction = params.path === "review_existing" && params.evidenceGate === "open" && params.followupCommand
+        ? params.followupCommand
+        : params.command;
+    const currentState = params.path === "create_profile"
+        ? `missing_profile:${params.assetName}:${params.syncTarget}`
+        : params.path === "bind_asset"
+            ? `profile_exists:asset_unbound:${params.assetName}:${params.syncTarget}`
+            : `profile_exists:asset_bound:${params.assetName}:${params.syncTarget}`;
+    const reason = params.path === "create_profile"
+        ? "Create the local organization/project/asset route before manager review, rollout, or runtime sync."
+        : params.path === "bind_asset"
+            ? "Bind the selected workflow asset and sync target into the existing organization profile before rollout review."
+            : params.evidenceGate === "open"
+                ? "The organization route exists, but active dogfood evidence must be reviewed or converted into a follow-up before rollout, sync, or evolution."
+                : "The organization route exists; review current gates before rollout or runtime sync.";
+    return {
+        currentState,
+        primaryAction,
+        decision,
+        evidenceGate: params.evidenceGate,
+        reason,
+        allowedNow: [
+            `Inspect workflow asset lineage: dna assets lineage ${params.assetName}.`,
+            params.evidenceGate === "open"
+                ? `Review active dogfood evidence: dna assets lifecycle ${params.assetName}.`
+                : `Review asset adoption posture: dna assets adoption ${params.assetName}.`,
+            `Run the recommended organization action: ${params.command}.`,
+            "Use dna org review after the route is represented.",
+        ],
+        blockedNow: [
+            params.evidenceGate === "open"
+                ? "Runtime sync is blocked while active dogfood evidence remains open or untriaged."
+                : "Runtime sync is blocked until manager review and rollout readiness pass.",
+            "Evolution marker mutation is blocked until evidence-backed suggestions are reviewed and accepted.",
+            "Dashboard and Obsidian/wiki are not organization state or runtime truth.",
+            "Vercel deployment is not a substitute for organization rollout or runtime sync.",
+        ],
+        reviewPath: params.reviewPath,
+    };
+}
+function buildManagerSummary(review) {
+    const assetGates = review.projects.flatMap((project) => project.assetGates.map((gate) => ({
+        project: project.name,
+        asset: gate.asset,
+        assetVersion: gate.assetVersion,
+        contentHash: gate.contentHash,
+        evidencePosture: gate.evidencePosture,
+        reviewRefs: gate.reviewRefs,
+        reviewEvidence: gate.reviewEvidence,
+        reviewCommand: gate.reviewCommand,
+        syncTargets: gate.syncTargets,
+        syncReady: gate.syncReady,
+        evidenceGate: gate.evidenceGate,
+        bindingStatus: gate.bindingStatus,
+        nextCommand: gate.nextCommand,
+        reason: gate.reason,
+    })));
+    const readyAssets = assetGates
+        .filter((gate) => gate.syncReady)
+        .map((gate) => ({ project: gate.project, asset: gate.asset, targets: gate.syncTargets }));
+    const blockedAssets = assetGates
+        .filter((gate) => !gate.syncReady)
+        .map((gate) => ({
+        project: gate.project,
+        asset: gate.asset,
+        reason: gate.reason,
+        nextCommand: gate.nextCommand,
+    }));
+    const assetPortfolio = buildAssetPortfolio(assetGates);
+    const syncTargets = [...new Set(review.projects.flatMap((project) => project.syncTargets))];
+    const readyTargets = syncTargets
+        .map((target) => ({
+        target,
+        command: rolloutCommandForTarget(target),
+        assets: readyAssets
+            .filter((asset) => asset.targets.includes(target))
+            .map((asset) => ({ project: asset.project, asset: asset.asset })),
+    }))
+        .filter((target) => target.assets.length > 0);
+    const blockedTargets = syncTargets
+        .map((target) => ({
+        target,
+        assets: assetGates
+            .filter((gate) => gate.syncTargets.includes(target) && !gate.syncReady)
+            .map((gate) => ({ project: gate.project, asset: gate.asset, nextCommand: gate.nextCommand })),
+    }))
+        .filter((target) => target.assets.length > 0);
+    const hasOpenEvidence = assetGates.some((gate) => gate.evidenceGate === "open");
+    const hasMissingConfiguration = assetGates.some((gate) => !gate.syncReady && gate.evidenceGate !== "open" && gate.nextCommand.startsWith("dna init --template "));
+    const hasInactiveBinding = assetGates.some((gate) => !gate.syncReady && gate.evidenceGate !== "open" && gate.reason.includes("binding is not active"));
+    const status = hasMissingConfiguration || blockedAssets.length > 0
+        ? hasOpenEvidence ? "review_required" : "blocked"
+        : "ready";
+    const decision = hasOpenEvidence
+        ? "review_evidence_before_rollout"
+        : hasMissingConfiguration
+            ? "configure_assets_before_rollout"
+            : hasInactiveBinding
+                ? "activate_bindings_before_rollout"
+                : "ready_to_rollout";
+    const primaryGate = [...assetGates].sort((a, b) => orgRouteAssetRank(a) - orgRouteAssetRank(b) || a.asset.localeCompare(b.asset))[0];
+    const primaryCommand = decision === "configure_assets_before_rollout"
+        ? "dna org configure-plan"
+        : decision === "review_evidence_before_rollout"
+            ? primaryGate?.nextCommand ?? `dna assets suggestions ${WORKFLOW_ASSET_IDS.default}`
+            : decision === "activate_bindings_before_rollout"
+                ? primaryGate?.nextCommand ?? "dna org review"
+                : "dna org rollout";
+    const primaryAsset = primaryGate?.asset ?? blockedAssets[0]?.asset ?? readyAssets[0]?.asset ?? WORKFLOW_ASSET_IDS.default;
+    const primaryFollowup = activeEvidenceFollowupRoute(primaryAsset);
+    const primaryNextAsset = decision === "review_evidence_before_rollout" && primaryCommand !== `dna assets suggestions ${primaryAsset}`
+        ? primaryFollowup.assetName
+        : undefined;
+    const primaryTarget = blockedAssets.length > 0
+        ? primaryGate?.syncTargets[0]
+        : readyAssets[0]?.targets[0];
+    const currentStage = decision === "configure_assets_before_rollout"
+        ? "configure"
+        : decision === "review_evidence_before_rollout"
+            ? "improve"
+            : decision === "activate_bindings_before_rollout"
+                ? "organize"
+                : "rollout";
+    const evidenceStatus = review.totals.dogfoodEvidenceModules === 0
+        ? "unknown"
+        : hasOpenEvidence || review.totals.dogfoodEvidenceRemaining > 0
+            ? "open"
+            : "clear";
+    const unfinishedWork = buildUnfinishedWorkReview({
+        decision,
+        primaryAsset,
+        primaryCommand,
+        assets: assetGates,
+    });
+    const decisionPacket = {
+        currentState: `${readyAssets.length}/${review.totals.declaredAssets} ready, ${blockedAssets.length} blocked, evidence=${evidenceStatus}`,
+        primaryAction: primaryCommand,
+        risk: managerRisk({ decision, hasOpenEvidence, hasMissingConfiguration, hasInactiveBinding }),
+        allowedNow: managerAllowedNow({ decision, primaryCommand, primaryAsset }),
+        blockedNow: managerBlockedNow({
+            decision,
+            hasOpenEvidence,
+            hasMissingConfiguration,
+            hasInactiveBinding,
+            blockedAssets: blockedAssets.length,
+        }),
+        reason: managerDecisionReason({
+            decision,
+            readyAssets: readyAssets.length,
+            declaredAssets: review.totals.declaredAssets,
+            blockedAssets: blockedAssets.length,
+            dogfoodRemaining: review.totals.dogfoodEvidenceRemaining,
+        }),
+        unfinishedWork,
+    };
+    const managerChoices = buildManagerChoices({
+        decision,
+        primaryCommand,
+        primaryAsset,
+        primaryTarget,
+        hasOpenEvidence,
+        hasMissingConfiguration,
+        hasInactiveBinding,
+        readyTargets,
+    });
+    return {
+        status,
+        decision,
+        headline: `${readyAssets.length}/${review.totals.declaredAssets} declared asset(s) ready for sync; ${blockedAssets.length} blocked.`,
+        primaryCommand,
+        decisionPacket,
+        unfinishedWork,
+        operatingRoute: buildOrgOperatingRoute({
+            asset: primaryAsset,
+            nextAsset: primaryNextAsset,
+            syncTarget: primaryTarget,
+            currentStage,
+            currentCommand: primaryCommand,
+        }),
+        readyAssets,
+        blockedAssets,
+        assetPortfolio,
+        readyTargets,
+        blockedTargets,
+        dogfoodEvidence: {
+            status: evidenceStatus,
+            modules: review.totals.dogfoodEvidenceModules,
+            pass: review.totals.dogfoodEvidencePass,
+            remaining: review.totals.dogfoodEvidenceRemaining,
+        },
+        improvementPrinciple: {
+            command: `dna assets suggestions ${primaryAsset}`,
+            rule: "Dogfood problems become reviewed workflow assets; repeated workflow-template gaps become shared dna core infrastructure.",
+            templateBoundary: "A concrete project problem should become a reviewed template version or reusable workflow asset before rollout or sync.",
+            infraBoundary: "If multiple templates need the same support, add or reuse dna core capability instead of copy-pasting prompt logic into each workflow.",
+        },
+        releaseGate: buildOrgReleaseGate(),
+        managerChoices,
+        managerPath: buildManagerPath({
+            decision,
+            primaryCommand,
+            choices: managerChoices,
+        }),
+        nextCommands: [...new Set([
+                primaryCommand,
+                ...review.nextActions.map((action) => action.split(": ").slice(1).join(": ")).filter(Boolean),
+                "dna org rollout",
+                "dna org review",
+            ])],
+        mutationBoundary: "Manager summary is read-only. It does not configure assets, bind organizations, sync runtime artifacts, deploy web surfaces, or replace the detailed organization review.",
+    };
+}
+function withManagerSummary(review) {
+    return {
+        ...review,
+        managerSummary: buildManagerSummary(review),
+    };
+}
+function orgReceiptGuardrails() {
+    return [
+        "Organization review receipt is local projection evidence only; cloud_authority=false.",
+        "Internal-ready candidates come from local org review and rollout gates, not org-private SaaS visibility.",
+        "Org-private publication requires dna templates publish plus Supabase auth/RLS/audit/storage contracts; this receipt only prepares operator commands.",
+        "This receipt does not imply online org auth, permissions, backend persistence, or cloud storage.",
+        "dna sync installs, distributes, and injects artifacts only; it does not execute workflows.",
+        "Online may project this receipt, but the local dna CLI/core remains the source for org review and rollout truth.",
+    ];
+}
+function orgPrivatePublicationBoundaries() {
+    return [
+        "Publication plan is local readiness guidance only; it does not publish, list, revoke, or persist org-private assets.",
+        "internal_ready remains an adoption candidate state until dna templates publish succeeds against authenticated Supabase Edge Functions.",
+        "Org-private visibility must come from Supabase auth, RLS, storage, permission checks, and audit records, never from the static marketplace catalog.",
+        "Published workflow assets remain installable through local dna commands; online and Supabase do not execute workflows or make allow/warn/block/validate decisions.",
+    ];
+}
+function orgReviewReceiptRef(receiptPathHint) {
+    return {
+        label: "Local org review receipt",
+        path: receiptPathHint,
+        kind: "org_review_receipt",
+        description: "Manager-facing local organization review source for publication handoff; it is not install, approval, publication, execution, or runtime authority.",
+    };
+}
+function localOrgReviewReceiptEvidence(params) {
+    return {
+        mode: "local_org_review_receipt",
+        authority: "manager_review_handoff_only",
+        receipt_command: params.receiptCommand,
+        receipt_path_hint: params.receiptPathHint,
+        boundaries: [
+            "Local org review receipt evidence is a manager review handoff only; it does not publish, list, revoke, install, approve, or execute workflow assets.",
+            "Supabase auth, RLS, scoped tokens, storage, and audit receipts remain required before org_private lifecycle claims.",
+            "Local dna/dna-hook remain runtime truth for allow/warn/block/validate decisions.",
+        ],
+    };
+}
+function serializedReviewEvidence(evidence) {
+    return evidence.map((entry) => ({
+        mode: entry.mode,
+        authority: entry.authority,
+        receipt_command: entry.receiptCommand,
+        receipt_path_hint: entry.receiptPathHint,
+        boundaries: entry.boundaries,
+    }));
+}
+function buildOrgPrivatePublicationPlan(params) {
+    const receiptPathHint = ".dna/reports/org-review-receipt.json";
+    const receiptCommand = `dna org receipt --json > ${receiptPathHint}`;
+    const receiptAuthorityBoundary = "Org-private publication plan proves local review readiness only; it does not prove Supabase membership, RLS permission checks, audit persistence, local install, workflow execution, or runtime policy authority.";
+    const postPublicationLocalGates = [
+        "dna org review",
+        "dna org rollout",
+        "dna sync --dry-run",
+        "dna sync",
+        "dna report package --json",
+    ];
+    const prerequisites = [
+        "Run dna org receipt --json and keep the emitted receipt as source evidence for publication.",
+        "Deploy publish-template and list-template-publications Edge Functions from the Supabase deploy plan.",
+        "Deploy revoke-template-publication before treating org-private publication lifecycle as complete.",
+        "Use a CLI API token scoped to the same organization/project with template:publish for publish/revoke and template:read for listing.",
+        "Endpoint can come from INTENTDNA_CLOUD_URL, SUPABASE_URL, a linked Supabase project ref, or an explicit --endpoint.",
+        "Run the generated dry-run commands before live publish/list/revoke; dry-run performs no network request.",
+        "Keep org-private catalog visibility in SaaS-backed tables with audit records; do not add org_private to the static marketplace catalog.",
+    ];
+    const blockers = [
+        "Live publish/list/revoke smoke requires Supabase project credentials, deployed Edge Functions, organization/project rows, memberships, and scoped CLI API tokens.",
+        "This local receipt cannot prove non-member read denial, unauthorized publish denial, or unpublish audit insertion until live RLS/function tests run.",
+    ];
+    if (!params.review) {
+        return {
+            status: "missing_profile",
+            authority: "local_publication_readiness_only",
+            receipt_authority_boundary: receiptAuthorityBoundary,
+            receipt_command: receiptCommand,
+            receipt_path_hint: receiptPathHint,
+            post_publication_local_gates: postPublicationLocalGates,
+            candidates: [],
+            blockers: ["No organization profile exists, so no local asset can be prepared for org-private publication.", ...blockers],
+            prerequisites,
+            boundaries: orgPrivatePublicationBoundaries(),
+        };
+    }
+    const projectsByName = new Map(params.review.projects.map((project) => [project.name, project]));
+    const candidates = params.readyAssets.map((asset) => {
+        const project = projectsByName.get(asset.project);
+        const projectId = project?.id ?? asset.project;
+        const publishCommand = `dna templates publish --org ${params.review.profile.organization.id} --project ${projectId} --template ${asset.asset} --receipt ${receiptPathHint}`;
+        const publicationsCommand = `dna templates publications --org ${params.review.profile.organization.id} --project ${projectId} --template ${asset.asset}`;
+        const revokeCommand = `dna templates revoke --org ${params.review.profile.organization.id} --project ${projectId} --publication-id <publication-id>`;
+        const dryRunCommands = [
+            `${publishCommand} --dry-run --json`,
+            `${publicationsCommand} --dry-run --json`,
+            `${revokeCommand} --dry-run --json`,
+        ];
+        const syncCommand = asset.syncTargets.some((target) => target === "codex" || target === "codex_cli") ? "dna sync --codex" : "dna sync";
+        const reviewRefs = [orgReviewReceiptRef(receiptPathHint), ...asset.reviewRefs];
+        const reviewEvidence = [
+            localOrgReviewReceiptEvidence({ receiptCommand, receiptPathHint }),
+            ...serializedReviewEvidence(asset.reviewEvidence),
+        ];
+        return {
+            organization: {
+                id: params.review.profile.organization.id,
+                name: params.review.profile.organization.name,
+            },
+            project: {
+                id: projectId,
+                name: asset.project,
+            },
+            asset: asset.asset,
+            asset_version: asset.assetVersion,
+            content_hash: asset.contentHash,
+            sync_targets: asset.syncTargets,
+            publish_ready: true,
+            publish_command: publishCommand,
+            publications_command: publicationsCommand,
+            revoke_command: revokeCommand,
+            dry_run_commands: dryRunCommands,
+            local_review_route: [
+                `dna assets inspect ${asset.asset} --evidence`,
+                `dna org review`,
+                `dna org rollout`,
+                syncCommand,
+            ],
+            source_receipt: receiptPathHint,
+            review_refs: reviewRefs,
+            review_evidence: reviewEvidence,
+            blockers,
+        };
+    });
+    return {
+        status: candidates.length > 0 ? "ready_for_operator" : "blocked",
+        authority: "local_publication_readiness_only",
+        receipt_authority_boundary: receiptAuthorityBoundary,
+        receipt_command: receiptCommand,
+        receipt_path_hint: receiptPathHint,
+        post_publication_local_gates: postPublicationLocalGates,
+        candidates,
+        blockers: candidates.length > 0
+            ? blockers
+            : ["No sync-ready local assets are available for internal-ready publication guidance yet.", ...blockers],
+        prerequisites,
+        boundaries: orgPrivatePublicationBoundaries(),
+    };
+}
+function buildOrgReviewReceipt(profilePath, review, rollout) {
+    const managerSummary = review ? buildManagerSummary(review) : undefined;
+    const readyAssets = rollout.assets.filter((asset) => asset.syncReady);
+    const orgPrivatePublicationPlan = buildOrgPrivatePublicationPlan({
+        review,
+        readyAssets,
+    });
+    const publicationCandidateByAsset = new Map(orgPrivatePublicationPlan.candidates.map((candidate) => [
+        `${candidate.project.name}:${candidate.asset}`,
+        candidate,
+    ]));
+    const internalReadyCandidates = readyAssets
+        .map((asset) => ({
+        organization_id: review?.profile.organization.id ?? "",
+        project_id: publicationCandidateByAsset.get(`${asset.project}:${asset.asset}`)?.project.id ?? asset.project,
+        project: asset.project,
+        asset: asset.asset,
+        asset_version: asset.assetVersion,
+        content_hash: asset.contentHash,
+        sync_targets: asset.syncTargets,
+        publish_ready: true,
+        publish_command: publicationCandidateByAsset.get(`${asset.project}:${asset.asset}`)?.publish_command
+            ?? `dna templates publish --org <organization-id> --project <project-id> --template ${asset.asset} --receipt .dna/reports/org-review-receipt.json`,
+        publications_command: publicationCandidateByAsset.get(`${asset.project}:${asset.asset}`)?.publications_command
+            ?? `dna templates publications --org <organization-id> --project <project-id> --template ${asset.asset}`,
+        revoke_command: publicationCandidateByAsset.get(`${asset.project}:${asset.asset}`)?.revoke_command
+            ?? "dna templates revoke --org <organization-id> --project <project-id> --publication-id <publication-id>",
+        dry_run_commands: publicationCandidateByAsset.get(`${asset.project}:${asset.asset}`)?.dry_run_commands
+            ?? [
+                `dna templates publish --org <organization-id> --project <project-id> --template ${asset.asset} --receipt .dna/reports/org-review-receipt.json --dry-run --json`,
+                `dna templates publications --org <organization-id> --project <project-id> --template ${asset.asset} --dry-run --json`,
+                "dna templates revoke --org <organization-id> --project <project-id> --publication-id <publication-id> --dry-run --json",
+            ],
+        local_review_route: publicationCandidateByAsset.get(`${asset.project}:${asset.asset}`)?.local_review_route
+            ?? [
+                `dna assets inspect ${asset.asset} --evidence`,
+                "dna org review",
+                "dna org rollout",
+                asset.syncTargets.some((target) => target === "codex" || target === "codex_cli") ? "dna sync --codex" : "dna sync",
+            ],
+        source_receipt: orgPrivatePublicationPlan.receipt_path_hint,
+        review_refs: publicationCandidateByAsset.get(`${asset.project}:${asset.asset}`)?.review_refs ?? asset.reviewRefs,
+        review_evidence: publicationCandidateByAsset.get(`${asset.project}:${asset.asset}`)?.review_evidence ?? serializedReviewEvidence(asset.reviewEvidence),
+        blockers: orgPrivatePublicationPlan.blockers,
+        reason: "Local org review marks this asset sync-ready; online may project it as an internal-ready adoption candidate only.",
+    }));
+    return {
+        schema_version: "intentdna.org_review_receipt.v1",
+        generated_at: new Date().toISOString(),
+        mode: "local_org_review_receipt",
+        status: review ? managerSummary?.status ?? "review_required" : "missing_profile",
+        cloud_authority: false,
+        organization: review ? {
+            id: review.profile.organization.id,
+            name: review.profile.organization.name,
+        } : undefined,
+        profile_path: profilePath,
+        summary: {
+            projects: review?.totals.projects ?? 0,
+            declared_assets: review?.totals.declaredAssets ?? 0,
+            configured_assets: review?.totals.configuredAssets ?? 0,
+            missing_assets: review?.totals.missingAssets ?? 0,
+            ready_assets: rollout.summary.readyAssets,
+            blocked_assets: rollout.summary.blockedAssets,
+            sync_targets: rollout.summary.syncTargets,
+            internal_ready_candidates: internalReadyCandidates.length,
+        },
+        asset_portfolio_summary: {
+            rollout_maturity: managerSummary?.assetPortfolio.rolloutMaturity ?? "unknown",
+            active_assets: managerSummary?.assetPortfolio.active.length ?? 0,
+            stale_assets: managerSummary?.assetPortfolio.stale.length ?? 0,
+            blocked_assets: managerSummary?.assetPortfolio.blocked.length ?? rollout.summary.blockedAssets,
+            evidence_gaps: managerSummary?.assetPortfolio.evidenceGaps.length ?? 0,
+            upgrade_risks: managerSummary?.assetPortfolio.upgradeRisks.length ?? 0,
+            publish_ready_assets: internalReadyCandidates.length,
+            local_authority: "manager_review_projection_only",
+            boundary: "Asset portfolio summary is local manager review projection only; it does not publish org_private assets, prove SaaS membership, install workflow assets, or authorize runtime sync.",
+        },
+        projects: review?.projects.map((project) => ({
+            id: project.id,
+            name: project.name,
+            path: project.path,
+            declared_assets: project.plannedAssets,
+            configured_assets: project.configuredAssets,
+            missing_assets: project.missingAssets,
+            sync_targets: project.syncTargets,
+            asset_gates: project.assetGates.map((gate) => ({
+                asset: gate.asset,
+                asset_version: gate.assetVersion,
+                content_hash: gate.contentHash,
+                evidence_posture: gate.evidencePosture,
+                review_refs: gate.reviewRefs,
+                review_evidence: gate.reviewEvidence.map((evidence) => ({
+                    mode: evidence.mode,
+                    authority: evidence.authority,
+                    receipt_command: evidence.receiptCommand,
+                    receipt_path_hint: evidence.receiptPathHint,
+                    boundaries: evidence.boundaries,
+                })),
+                review_command: gate.reviewCommand,
+                binding_status: gate.bindingStatus,
+                configured: gate.configured,
+                configuration_posture: gate.configurationPosture,
+                evidence_gate: gate.evidenceGate,
+                sync_ready: gate.syncReady,
+                sync_targets: gate.syncTargets,
+                next_command: gate.nextCommand,
+                reason: gate.reason,
+            })),
+        })) ?? [],
+        sync_targets: rollout.distributionPlan.targets,
+        asset_gates: rollout.assets,
+        asset_portfolio: managerSummary?.assetPortfolio,
+        unfinished_work: managerSummary?.unfinishedWork,
+        blockers: rollout.blockers,
+        internal_ready_candidates: internalReadyCandidates,
+        org_private_publication_plan: orgPrivatePublicationPlan,
+        next_commands: rollout.nextCommands,
+        guardrails: orgReceiptGuardrails(),
+    };
+}
+function writeOrgReceipt(receipt) {
+    process.stderr.write("Organization review receipt\n");
+    process.stderr.write(`Schema: ${receipt.schema_version}\n`);
+    process.stderr.write(`Status: ${receipt.status}\n`);
+    process.stderr.write(`Cloud authority: ${String(receipt.cloud_authority)}\n`);
+    if (receipt.organization)
+        process.stderr.write(`Organization: ${receipt.organization.name}\n`);
+    process.stderr.write(`Projects: ${receipt.summary.projects}\n`);
+    process.stderr.write(`Declared assets: ${receipt.summary.declared_assets}\n`);
+    process.stderr.write(`Ready assets: ${receipt.summary.ready_assets}\n`);
+    process.stderr.write(`Blocked assets: ${receipt.summary.blocked_assets}\n`);
+    process.stderr.write(`Internal-ready candidates: ${receipt.summary.internal_ready_candidates}\n`);
+    process.stderr.write(`Org-private publication plan: ${receipt.org_private_publication_plan.status}\n`);
+    process.stderr.write(`Receipt command: ${receipt.org_private_publication_plan.receipt_command}\n`);
+    process.stderr.write("\nPublication candidates:\n");
+    if (receipt.org_private_publication_plan.candidates.length === 0) {
+        process.stderr.write("  - none\n");
+    }
+    else {
+        for (const candidate of receipt.org_private_publication_plan.candidates) {
+            const version = candidate.asset_version ? ` version=${candidate.asset_version}` : "";
+            process.stderr.write(`  - ${candidate.project.name}/${candidate.asset}:${version} publish_ready=${candidate.publish_ready ? "yes" : "no"}\n`);
+            process.stderr.write(`    publish: ${candidate.publish_command}\n`);
+            process.stderr.write(`    list: ${candidate.publications_command}\n`);
+            process.stderr.write(`    revoke: ${candidate.revoke_command}\n`);
+            process.stderr.write(`    dry-run: ${candidate.dry_run_commands.join(" | ")}\n`);
+            process.stderr.write(`    local route: ${candidate.local_review_route.join(" -> ")}\n`);
+            process.stderr.write(`    source receipt: ${candidate.source_receipt}\n`);
+            if (candidate.review_refs.length > 0) {
+                process.stderr.write(`    review refs: ${candidate.review_refs.map((ref) => `${ref.label ?? ref.kind}:${ref.path}`).join(" | ")}\n`);
+            }
+            if (candidate.review_evidence.length > 0) {
+                process.stderr.write(`    review evidence: ${candidate.review_evidence.map((evidence) => `${evidence.authority}:${evidence.receipt_command}`).join(" | ")}\n`);
+            }
+        }
+    }
+    process.stderr.write("\nPublication blockers:\n");
+    for (const blocker of receipt.org_private_publication_plan.blockers)
+        process.stderr.write(`  - ${blocker}\n`);
+    process.stderr.write("\nPublication boundaries:\n");
+    for (const boundary of receipt.org_private_publication_plan.boundaries)
+        process.stderr.write(`  - ${boundary}\n`);
+    process.stderr.write("\nGuardrails:\n");
+    for (const guardrail of receipt.guardrails)
+        process.stderr.write(`  - ${guardrail}\n`);
+    process.stderr.write("\nNext commands:\n");
+    for (const command of receipt.next_commands.slice(0, 8))
+        process.stderr.write(`  - ${command}\n`);
+}
+async function buildOrgIntake(opts) {
+    const profile = await readOrganizationProfile({ projectDir: opts.projectDir });
+    const assetName = await preferredAssetName(opts);
+    const asset = await findWorkflowAsset(assetName, { projectDir: opts.projectDir });
+    const evidence = asset?.status.evidencePosture === "dogfood_linked"
+        ? await buildWorkflowAssetEvidenceIndex(assetName, { projectDir: opts.projectDir })
+        : undefined;
+    const evidenceOpen = evidence
+        ? evidence.totals.continue > 0 || evidence.totals.blocked > 0 || evidence.totals.requestChanges > 0 || evidence.totals.remaining > 0
+        : false;
+    const evidenceGate = evidence ? evidenceOpen ? "open" : "clear" : "unknown";
+    const assets = await listWorkflowAssets({ projectDir: opts.projectDir });
+    const followup = evidenceOpen ? activeEvidenceFollowupReviewRoute(assetName, assets, evidence) : undefined;
+    const organization = opts.name?.trim() || profile.profile?.organization.name || "My Org";
+    const project = preferredProjectName(opts);
+    const syncTarget = opts.syncTarget?.trim() || syncTargetFromDescription(opts.description) || "codex";
+    const status = opts.status && isOrganizationAssetStatus(opts.status) ? opts.status : "active";
+    const hasAsset = projectHasAsset(profile.profile, project, assetName);
+    const hasSyncTarget = projectHasSyncTarget(profile.profile, project, syncTarget);
+    const command = !profile.profile
+        ? orgInitCommand({ name: organization, project, asset: assetName, syncTarget })
+        : hasAsset && hasSyncTarget
+            ? "dna org review"
+            : orgBindCommand({ project: opts.project?.trim(), asset: assetName, status, syncTarget });
+    const path = !profile.profile ? "create_profile" : hasAsset && hasSyncTarget ? "review_existing" : "bind_asset";
+    const warnings = [];
+    if (!asset)
+        warnings.push(`Workflow asset is not in the local catalog yet: ${assetName}`);
+    if (profile.profile && !hasAsset)
+        warnings.push(`Organization profile exists, but ${assetName} is not bound to the selected project yet.`);
+    if (profile.profile && hasAsset && !hasSyncTarget)
+        warnings.push(`Asset ${assetName} is bound, but sync target ${syncTarget} is not declared yet.`);
+    const reviewPath = [...new Set([
+            "dna assets library",
+            evidenceOpen ? `dna assets lifecycle ${assetName}` : `dna assets lineage ${assetName}`,
+            ...(followup ? [
+                followup.currentCommand,
+                followup.diffCommand,
+                followup.adoptionCommand,
+            ] : []),
+            command,
+            "dna org review",
+            `dna guide ${assetName} --brief`,
+        ])];
+    return {
+        mode: "organization_intake",
+        input: {
+            description: opts.description?.trim() || undefined,
+            organization,
+            project,
+            asset: assetName,
+            syncTarget,
+        },
+        current: {
+            profilePath: profile.path,
+            configured: profile.profile !== undefined,
+            organization: profile.profile?.organization.name,
+            projects: profile.profile?.projects.length ?? 0,
+            syncTargets: profileSyncTargets(profile.profile),
+        },
+        asset: asset ? {
+            name: asset.name,
+            status: asset.status.managementStatus,
+            evidence: asset.status.evidencePosture,
+            cascade: asset.status.cascadePosture,
+            evolution: asset.status.evolutionPosture,
+            configured: asset.status.configured,
+            positioning: asset.positioning,
+        } : undefined,
+        recommendation: {
+            path,
+            command,
+            reason: path === "create_profile"
+                ? "No organization profile exists yet, so create the local organization/project binding before adoption or sync."
+                : path === "bind_asset"
+                    ? "An organization profile exists, but the selected asset or sync target still needs to be bound."
+                    : "The selected asset and sync target are already represented; review the current system state next.",
+            writes: path !== "review_existing",
+        },
+        setupPlan: {
+            principle: "Organization setup is a reviewable route from asset choice to manager gates and explicit runtime distribution.",
+            phases: [
+                {
+                    id: "asset",
+                    label: "Select workflow asset",
+                    command: `dna assets lineage ${assetName}`,
+                    purpose: "Understand asset origin, cascade, evidence, and evolution posture before binding it to a project.",
+                    writes: false,
+                    owner: "user",
+                },
+                {
+                    id: "profile",
+                    label: path === "create_profile"
+                        ? "Create organization profile"
+                        : path === "bind_asset"
+                            ? "Bind asset to organization"
+                            : "Review existing organization",
+                    command,
+                    purpose: path === "review_existing"
+                        ? "Confirm the existing organization profile already represents this asset and sync target."
+                        : "Record the organization/project/asset/sync-target relationship locally before runtime sync.",
+                    writes: path !== "review_existing",
+                    owner: "manager",
+                },
+                {
+                    id: "configure",
+                    label: evidenceOpen ? "Save unfinished-work draft" : "Configure project asset",
+                    command: followup?.currentCommand ?? `dna init --template ${assetName}`,
+                    purpose: evidenceOpen
+                        ? "Continue the reviewed unfinished-work draft route from open dogfood evidence before configuring, rollout, runtime sync, or marker mutation; this does not replace the source asset automatically."
+                        : "Create the project DNA config for the selected asset before runtime artifacts are generated.",
+                    writes: followup?.currentWrites ?? true,
+                    owner: "dna_core",
+                },
+                {
+                    id: "review",
+                    label: "Review system state",
+                    command: "dna org review",
+                    purpose: "Show configured assets, evidence gates, sync readiness, and next actions for managers.",
+                    writes: false,
+                    owner: "manager",
+                },
+                {
+                    id: "rollout",
+                    label: "Check rollout readiness",
+                    command: "dna org rollout",
+                    purpose: "Produce target-level ready/partial/blocked distribution plans before any sync command.",
+                    writes: false,
+                    owner: "manager",
+                },
+                {
+                    id: "sync",
+                    label: "Sync harness surface",
+                    command: rolloutCommandForTarget(syncTarget),
+                    purpose: "Generate Codex or Claude runtime artifacts only after organization gates pass.",
+                    writes: true,
+                    owner: "runtime",
+                },
+                {
+                    id: "deploy",
+                    label: "Deploy public surface",
+                    command: "dna release deploy-plan",
+                    purpose: "Plan Vercel CLI deployment and deployed URL verification only when web, dashboard, blog, or other public deployed surfaces changed.",
+                    writes: false,
+                    owner: "release",
+                },
+            ],
+            boundaries: [
+                "Organization intake is read-only until the recommended command is explicitly run.",
+                "dna CLI/core/runtime owns organization bindings and governance decisions.",
+                "Claude Code and Codex are sync targets, not places where governance truth is edited.",
+                "Obsidian/wiki remains internal project memory and does not define product runtime state.",
+                "Vercel deployment is separate from org rollout and is required only for changed web/public deployed surfaces.",
+            ],
+        },
+        entryPacket: buildOrgEntryPacket({
+            path,
+            command,
+            assetName,
+            syncTarget,
+            evidenceGate,
+            followupCommand: followup?.currentCommand,
+            reviewPath,
+        }),
+        reviewPath,
+        mutationBoundary: "Read-only organization intake; no .dna/org.yaml, asset binding, runtime sync, dashboard state, or policy truth is changed.",
+        warnings,
+        nextCommands: [...new Set([
+                command,
+                evidenceOpen ? `dna assets lifecycle ${assetName}` : `dna assets lineage ${assetName}`,
+                ...(followup ? [followup.currentCommand] : []),
+                "dna org review",
+                `dna guide ${assetName} --brief`,
+            ])],
+    };
+}
+function buildOrgRolloutPlan(profilePath, review) {
+    if (!review) {
+        return {
+            mode: "organization_rollout_plan",
+            profilePath,
+            status: "missing_profile",
+            operatingRoute: buildOrgOperatingRoute({
+                currentStage: "organize",
+                currentCommand: `dna org intake --asset ${WORKFLOW_ASSET_IDS.default} --sync-target codex`,
+            }),
+            summary: {
+                projects: 0,
+                declaredAssets: 0,
+                readyAssets: 0,
+                blockedAssets: 0,
+                syncTargets: [],
+            },
+            assets: [],
+            distributionPlan: {
+                targets: [],
+                deploymentBoundary: "Vercel CLI deployment is separate from workflow runtime rollout and is required only when web/public deployed surfaces changed.",
+                guidance: [
+                    "Create an organization profile before runtime distribution.",
+                    "Use dna org rollout again before any sync command.",
+                ],
+            },
+            releaseGate: buildOrgReleaseGate(),
+            rolloutCommands: [],
+            blockers: ["No organization profile exists, so there is no governed asset distribution plan yet."],
+            nextCommands: [
+                `dna org intake --asset ${WORKFLOW_ASSET_IDS.default} --sync-target codex`,
+                `dna org init --name <organization> --project <project> --asset ${WORKFLOW_ASSET_IDS.default} --sync-target codex`,
+            ],
+            mutationBoundary: "Read-only rollout plan; no organization profile, project config, runtime sync, dashboard state, or policy truth is changed.",
+        };
+    }
+    const assets = review.projects.flatMap((project) => project.assetGates.map((gate) => ({
+        project: project.name,
+        asset: gate.asset,
+        assetVersion: gate.assetVersion,
+        contentHash: gate.contentHash,
+        evidencePosture: gate.evidencePosture,
+        reviewRefs: gate.reviewRefs,
+        reviewEvidence: gate.reviewEvidence,
+        reviewCommand: gate.reviewCommand,
+        bindingStatus: gate.bindingStatus,
+        configured: gate.configured,
+        evidenceGate: gate.evidenceGate,
+        syncReady: gate.syncReady,
+        syncTargets: gate.syncTargets,
+        nextCommand: gate.nextCommand,
+        reason: gate.reason,
+    })));
+    const syncTargets = [...new Set(review.projects.flatMap((project) => project.syncTargets))];
+    const readyAssets = assets.filter((asset) => asset.syncReady);
+    const blockedAssets = assets.filter((asset) => !asset.syncReady);
+    const targetPlans = buildDistributionPlan(syncTargets, assets);
+    const rolloutCommands = [...new Set(targetPlans
+            .filter((target) => target.status === "ready")
+            .map((target) => target.command))];
+    const blockers = [
+        ...blockedAssets.map((asset) => `${asset.project}/${asset.asset}: ${asset.reason} Next: ${asset.nextCommand}`),
+        ...review.projects.filter((project) => project.syncTargets.length === 0).map((project) => `${project.name}: no sync target declared.`),
+    ];
+    const hasOpenEvidence = blockedAssets.some((asset) => asset.evidenceGate === "open");
+    const hasMissingConfiguredAssets = blockedAssets.some((asset) => asset.evidenceGate !== "open" &&
+        !asset.configured &&
+        asset.nextCommand.startsWith("dna init --template "));
+    const hasInactiveBindings = blockedAssets.some((asset) => asset.evidenceGate !== "open" &&
+        asset.configured &&
+        asset.nextCommand.startsWith("dna org bind "));
+    const evidenceFirstBlockedAssets = [...blockedAssets].sort((a, b) => orgRouteAssetRank(a) - orgRouteAssetRank(b) || a.asset.localeCompare(b.asset));
+    const nextCommands = blockers.length > 0
+        ? [...new Set(hasOpenEvidence
+                ? evidenceFirstBlockedAssets.map((asset) => asset.nextCommand).concat(hasMissingConfiguredAssets ? "dna org configure-plan" : [], "dna org review")
+                : hasMissingConfiguredAssets
+                    ? ["dna org configure-plan", "dna org configure-plan --apply", "dna org review"]
+                    : blockedAssets.map((asset) => asset.nextCommand).concat("dna org review"))]
+        : [...new Set([...rolloutCommands, "dna org review"])];
+    const currentCommand = nextCommands[0] ?? rolloutCommands[0] ?? "dna org review";
+    const currentStage = blockers.length > 0
+        ? hasOpenEvidence
+            ? "improve"
+            : hasMissingConfiguredAssets
+                ? "configure"
+                : hasInactiveBindings
+                    ? "organize"
+                    : "improve"
+        : "sync";
+    const routePrimary = [...assets].sort((a, b) => orgRouteAssetRank(a) - orgRouteAssetRank(b) || a.asset.localeCompare(b.asset))[0];
+    const routeAsset = routePrimary?.asset ?? blockedAssets[0]?.asset ?? readyAssets[0]?.asset ?? WORKFLOW_ASSET_IDS.default;
+    const routeFollowup = activeEvidenceFollowupRoute(routeAsset);
+    const routeNextAsset = hasOpenEvidence && routePrimary?.nextCommand !== `dna assets suggestions ${routeAsset}`
+        ? routeFollowup.assetName
+        : undefined;
+    const routeTarget = routePrimary?.syncTargets[0] ?? blockedAssets[0]?.syncTargets[0] ?? readyAssets[0]?.syncTargets[0] ?? syncTargets[0] ?? "codex";
+    return {
+        mode: "organization_rollout_plan",
+        profilePath: review.profilePath,
+        organization: review.profile.organization.name,
+        status: blockers.length > 0 || readyAssets.length === 0 ? "blocked" : "ready",
+        operatingRoute: buildOrgOperatingRoute({
+            asset: routeAsset,
+            nextAsset: routeNextAsset,
+            syncTarget: routeTarget,
+            currentStage,
+            currentCommand,
+        }),
+        summary: {
+            projects: review.totals.projects,
+            declaredAssets: review.totals.declaredAssets,
+            readyAssets: readyAssets.length,
+            blockedAssets: blockedAssets.length,
+            syncTargets,
+        },
+        assets,
+        distributionPlan: {
+            targets: targetPlans,
+            deploymentBoundary: "Vercel CLI deployment is separate from workflow runtime rollout and is required only when web/public deployed surfaces changed.",
+            guidance: [
+                "Run only rollout commands whose target status is ready.",
+                "Resolve blocked assets before broad organization distribution.",
+                "Dashboard or blog/public surface changes require Vercel CLI deployment and deployed URL verification; CLI/core/runtime rollout does not.",
+            ],
+        },
+        releaseGate: buildOrgReleaseGate(),
+        rolloutCommands,
+        blockers,
+        nextCommands,
+        mutationBoundary: "Read-only rollout plan; no organization profile, project config, runtime sync, dashboard state, or policy truth is changed.",
+    };
+}
+function buildOrgConfigurePlan(profilePath, review) {
+    if (!review) {
+        return {
+            mode: "organization_configure_plan",
+            profilePath,
+            status: "missing_profile",
+            summary: {
+                projects: 0,
+                declaredAssets: 0,
+                missingAssets: 0,
+                configuredAssets: 0,
+            },
+            items: [],
+            commands: [],
+            afterAll: [
+                `dna org intake --asset ${WORKFLOW_ASSET_IDS.default} --sync-target codex`,
+                `dna org init --name <organization> --project <project> --asset ${WORKFLOW_ASSET_IDS.default} --sync-target codex`,
+            ],
+            mutationBoundary: "Read-only configuration plan; no organization profile, project config, runtime sync, dashboard state, or policy truth is changed.",
+        };
+    }
+    const items = review.projects.flatMap((project) => project.assetGates
+        .filter((gate) => !gate.configured && gate.configurationPosture !== "missing")
+        .map((gate) => {
+        const action = gate.evidenceGate === "open" ? "followup" : "configure";
+        return {
+            action,
+            project: project.name,
+            asset: gate.asset,
+            bindingStatus: gate.bindingStatus,
+            configured: gate.configured,
+            evidenceGate: gate.evidenceGate,
+            command: action === "followup" ? gate.nextCommand : `dna init --template ${gate.asset}`,
+            afterConfigure: action === "followup"
+                ? [
+                    `dna assets inspect ${gate.asset}-active-followup --evidence`,
+                    `dna assets adoption ${gate.asset}-active-followup`,
+                    "dna org rollout",
+                    "dna org review",
+                ]
+                : [
+                    `dna assets governance ${gate.asset}`,
+                    `dna assets adoption ${gate.asset}`,
+                    "dna org rollout",
+                    "dna org review",
+                ],
+            writes: action === "configure",
+            reason: action === "followup"
+                ? "Dogfood evidence is open, so save and review an unfinished-work draft before configuring this older asset version."
+                : gate.reason,
+        };
+    }));
+    const commands = [...new Set(items.filter((item) => item.writes).map((item) => item.command))];
+    return {
+        mode: "organization_configure_plan",
+        profilePath: review.profilePath,
+        organization: review.profile.organization.name,
+        status: items.length > 0 ? "ready" : "nothing_to_configure",
+        summary: {
+            projects: review.totals.projects,
+            declaredAssets: review.totals.declaredAssets,
+            missingAssets: review.totals.missingAssets,
+            configuredAssets: review.totals.configuredAssets,
+        },
+        items,
+        commands,
+        afterAll: items.length > 0
+            ? ["dna org rollout", "dna org review"]
+            : ["dna org review", "dna guide --brief"],
+        mutationBoundary: "Read-only configuration plan; it lists explicit dna init commands but does not write .dna/configs, sync runtime artifacts, mutate dashboard state, or change policy truth.",
+    };
+}
+function buildOrgStatusPacket(profilePath, review) {
+    if (!review) {
+        const primaryCommand = `dna org intake --asset ${WORKFLOW_ASSET_IDS.default} --sync-target codex`;
+        return {
+            mode: "organization_status",
+            profilePath,
+            configured: false,
+            status: "missing_profile",
+            current: {
+                projects: 0,
+                declaredAssets: 0,
+                configuredAssets: 0,
+                missingAssets: 0,
+                syncTargets: [],
+            },
+            primaryCommand,
+            operatingRoute: buildOrgOperatingRoute({
+                currentStage: "organize",
+                currentCommand: primaryCommand,
+            }),
+            firstRunPath: [
+                {
+                    id: "preview",
+                    label: "Preview route",
+                    command: primaryCommand,
+                    writes: false,
+                    purpose: "Inspect the recommended organization, project, asset, and sync target route before writing state.",
+                },
+                {
+                    id: "create",
+                    label: "Create profile",
+                    command: `dna org init --name <organization> --project <project> --asset ${WORKFLOW_ASSET_IDS.default} --sync-target codex`,
+                    writes: true,
+                    purpose: "Create the local .dna/org.yaml route after the preview looks correct.",
+                },
+                {
+                    id: "review",
+                    label: "Review system",
+                    command: "dna org review",
+                    writes: false,
+                    purpose: "Review declared workflow assets, evidence gates, sync readiness, and manager next actions.",
+                },
+                {
+                    id: "navigate",
+                    label: "Navigate route",
+                    command: "dna guide --brief",
+                    writes: false,
+                    purpose: "Show the simple user-facing route from workflow description to asset review, rollout, sync, and deploy gate.",
+                },
+            ],
+            releaseGate: buildOrgReleaseGate(),
+            boundaries: [
+                "org status is read-only and does not create organization state.",
+                "Obsidian/wiki is internal memory, not organization state or product runtime truth.",
+                "Dashboard is a read-only projection and should not become the workflow builder or policy source of truth.",
+                "Claude Code and Codex are sync targets; dna owns the governance route.",
+                "Runtime sync waits for org review and rollout readiness.",
+            ],
+            nextCommands: [
+                primaryCommand,
+                `dna org init --name <organization> --project <project> --asset ${WORKFLOW_ASSET_IDS.default} --sync-target codex`,
+                "dna guide --brief",
+            ],
+            mutationBoundary: "Read-only organization status; no .dna/org.yaml, workflow asset, runtime sync, dashboard state, deploy, or policy truth is changed.",
+        };
+    }
+    const managerSummary = buildManagerSummary(review);
+    return {
+        mode: "organization_status",
+        profilePath: review.profilePath,
+        configured: true,
+        status: managerSummary.status,
+        current: {
+            organization: review.profile.organization.name,
+            projects: review.totals.projects,
+            declaredAssets: review.totals.declaredAssets,
+            configuredAssets: review.totals.configuredAssets,
+            missingAssets: review.totals.missingAssets,
+            syncTargets: [...new Set(review.projects.flatMap((project) => project.syncTargets))],
+        },
+        primaryCommand: managerSummary.primaryCommand,
+        operatingRoute: managerSummary.operatingRoute,
+        managerSummary,
+        releaseGate: managerSummary.releaseGate,
+        boundaries: managerSummary.operatingRoute.boundaries,
+        nextCommands: managerSummary.nextCommands,
+        mutationBoundary: "Read-only organization status; use dna org review for full manager details and dna org rollout before runtime sync.",
+    };
+}
+async function applyOrgConfigurePlan(plan, projectDir) {
+    if (plan.status === "missing_profile") {
+        plan.apply = {
+            requested: true,
+            exitCode: 2,
+            results: [],
+            nextCommands: plan.afterAll,
+        };
+        return 2;
+    }
+    const uniqueItems = [...new Map(plan.items.filter((item) => item.writes).map((item) => [item.asset, item])).values()];
+    const results = [];
+    for (const item of uniqueItems) {
+        try {
+            const result = await createConfigFromTemplate({
+                template: item.asset,
+                projectDir,
+            });
+            results.push({
+                project: item.project,
+                asset: item.asset,
+                command: item.command,
+                status: "created",
+                path: result.path,
+                namespace: result.namespace,
+            });
+        }
+        catch (err) {
+            results.push({
+                project: item.project,
+                asset: item.asset,
+                command: item.command,
+                status: "failed",
+                error: err instanceof Error ? err.message : String(err),
+            });
+        }
+    }
+    const exitCode = results.some((result) => result.status === "failed") ? 1 : 0;
+    plan.apply = {
+        requested: true,
+        exitCode,
+        results,
+        nextCommands: exitCode === 0 ? ["dna org rollout", "dna org review"] : ["dna org configure-plan", "dna org review"],
+    };
+    return exitCode;
+}
+function writeProfileMissing(path) {
+    process.stderr.write("No local organization profile found.\n");
+    process.stderr.write(`Expected: ${path}\n`);
+    process.stderr.write("Start with a read-only setup preview before writing .dna/org.yaml.\n");
+    process.stderr.write("\nFirst-run path:\n");
+    process.stderr.write(`  - preview: dna org intake --asset ${WORKFLOW_ASSET_IDS.default} --sync-target codex\n`);
+    process.stderr.write(`  - create: dna org init --name <organization> --project <project> --asset ${WORKFLOW_ASSET_IDS.default} --sync-target codex\n`);
+    process.stderr.write("  - review: dna org review\n");
+    process.stderr.write("  - navigate: dna guide --brief\n");
+    process.stderr.write("\nBoundaries:\n");
+    process.stderr.write("  - org status is read-only and does not create organization state.\n");
+    process.stderr.write("  - Obsidian/wiki is internal memory, not organization state.\n");
+    process.stderr.write("  - Runtime sync waits for org review and rollout readiness.\n");
+}
+function writeOrgStatus(packet) {
+    process.stderr.write("Organization status\n");
+    process.stderr.write(`Mode: ${packet.mode}\n`);
+    process.stderr.write(`Profile: ${packet.configured ? "configured" : "missing"} (${packet.profilePath})\n`);
+    if (packet.current.organization)
+        process.stderr.write(`Organization: ${packet.current.organization}\n`);
+    process.stderr.write(`Status: ${packet.status}\n`);
+    process.stderr.write(`Projects: ${packet.current.projects}\n`);
+    process.stderr.write(`Declared assets: ${packet.current.declaredAssets}\n`);
+    process.stderr.write(`Configured assets: ${packet.current.configuredAssets}\n`);
+    process.stderr.write(`Missing assets: ${packet.current.missingAssets}\n`);
+    process.stderr.write(`Sync targets: ${packet.current.syncTargets.length > 0 ? packet.current.syncTargets.join(", ") : "none"}\n`);
+    process.stderr.write(`Primary command: ${packet.primaryCommand}\n`);
+    process.stderr.write(`Mutation boundary: ${packet.mutationBoundary}\n`);
+    writeOperatingRoute(packet.operatingRoute);
+    if (packet.firstRunPath) {
+        process.stderr.write("\nFirst-run path:\n");
+        for (const step of packet.firstRunPath) {
+            process.stderr.write(`  - ${step.id}. ${step.label} writes=${step.writes ? "yes" : "no"}\n`);
+            process.stderr.write(`    command: ${step.command}\n`);
+            process.stderr.write(`    purpose: ${step.purpose}\n`);
+        }
+    }
+    if (packet.managerSummary) {
+        process.stderr.write("\nManager summary:\n");
+        process.stderr.write(`  Status: ${packet.managerSummary.status}\n`);
+        process.stderr.write(`  Decision: ${packet.managerSummary.decision}\n`);
+        process.stderr.write(`  Headline: ${packet.managerSummary.headline}\n`);
+        process.stderr.write(`  Primary command: ${packet.managerSummary.primaryCommand}\n`);
+        process.stderr.write(`  Dogfood evidence: ${packet.managerSummary.dogfoodEvidence.status} (${packet.managerSummary.dogfoodEvidence.pass}/${packet.managerSummary.dogfoodEvidence.modules} PASS, remaining=${packet.managerSummary.dogfoodEvidence.remaining})\n`);
+        process.stderr.write(`  Portfolio maturity: ${packet.managerSummary.assetPortfolio.rolloutMaturity}\n`);
+        process.stderr.write(`  Active assets: ${packet.managerSummary.assetPortfolio.active.length}\n`);
+        process.stderr.write(`  Stale assets: ${packet.managerSummary.assetPortfolio.stale.length}\n`);
+        process.stderr.write(`  Blocked assets: ${packet.managerSummary.assetPortfolio.blocked.length}\n`);
+        process.stderr.write(`  Evidence gaps: ${packet.managerSummary.assetPortfolio.evidenceGaps.length}\n`);
+        process.stderr.write(`  Upgrade risks: ${packet.managerSummary.assetPortfolio.upgradeRisks.length}\n`);
+        writeAssetPortfolioGuide("  ");
+    }
+    process.stderr.write("\nBoundaries:\n");
+    for (const boundary of packet.boundaries)
+        process.stderr.write(`  - ${boundary}\n`);
+    process.stderr.write("\nNext commands:\n");
+    for (const command of packet.nextCommands.slice(0, 8))
+        process.stderr.write(`  - ${command}\n`);
+    process.stderr.write("\n");
+    writeReleaseGate(packet.releaseGate);
+}
+function writeConfigurePlan(plan) {
+    process.stderr.write("Organization configure plan\n");
+    process.stderr.write(`Mode: ${plan.mode}\n`);
+    process.stderr.write(`Profile: ${plan.profilePath}\n`);
+    if (plan.organization)
+        process.stderr.write(`Organization: ${plan.organization}\n`);
+    process.stderr.write(`Status: ${plan.status}\n`);
+    process.stderr.write(`Projects: ${plan.summary.projects}\n`);
+    process.stderr.write(`Declared assets: ${plan.summary.declaredAssets}\n`);
+    process.stderr.write(`Configured assets: ${plan.summary.configuredAssets}\n`);
+    process.stderr.write(`Missing configured assets: ${plan.summary.missingAssets}\n`);
+    process.stderr.write(`Mutation boundary: ${plan.mutationBoundary}\n`);
+    process.stderr.write("\nAssets to configure:\n");
+    if (plan.items.length === 0) {
+        process.stderr.write("  - none\n");
+    }
+    else {
+        for (const item of plan.items) {
+            process.stderr.write(`  - ${item.project}/${item.asset}: binding=${item.bindingStatus} evidence=${item.evidenceGate}\n`);
+            process.stderr.write(`    action: ${item.action}\n`);
+            process.stderr.write(`    command: ${item.command}\n`);
+            process.stderr.write(`    writes: ${item.writes ? "yes" : "no"}\n`);
+            process.stderr.write(`    reason: ${item.reason}\n`);
+            process.stderr.write(`    after ${item.action}:\n`);
+            for (const command of item.afterConfigure)
+                process.stderr.write(`      - ${command}\n`);
+        }
+    }
+    process.stderr.write("\nConfiguration commands:\n");
+    if (plan.commands.length === 0) {
+        process.stderr.write("  - none\n");
+    }
+    else {
+        for (const command of plan.commands)
+            process.stderr.write(`  - ${command}\n`);
+    }
+    process.stderr.write("\nAfter all configured:\n");
+    for (const command of plan.afterAll)
+        process.stderr.write(`  - ${command}\n`);
+    if (plan.apply) {
+        process.stderr.write("\nApply results:\n");
+        if (plan.apply.results.length === 0) {
+            process.stderr.write("  - none\n");
+        }
+        else {
+            for (const result of plan.apply.results) {
+                process.stderr.write(`  - ${result.project}/${result.asset}: ${result.status}\n`);
+                process.stderr.write(`    command: ${result.command}\n`);
+                if (result.path)
+                    process.stderr.write(`    path: ${result.path}\n`);
+                if (result.namespace)
+                    process.stderr.write(`    namespace: ${result.namespace}\n`);
+                if (result.error)
+                    process.stderr.write(`    error: ${result.error}\n`);
+            }
+        }
+        process.stderr.write(`  exit_code: ${plan.apply.exitCode}\n`);
+        process.stderr.write("  next commands:\n");
+        for (const command of plan.apply.nextCommands)
+            process.stderr.write(`    - ${command}\n`);
+    }
+}
+function writeOrgIntake(packet) {
+    process.stderr.write("Organization intake\n");
+    process.stderr.write(`Mode: ${packet.mode}\n`);
+    if (packet.input.description)
+        process.stderr.write(`Description: ${packet.input.description}\n`);
+    process.stderr.write(`Organization: ${packet.input.organization}\n`);
+    process.stderr.write(`Project: ${packet.input.project}\n`);
+    process.stderr.write(`Workflow asset: ${packet.input.asset}\n`);
+    process.stderr.write(`Sync target: ${packet.input.syncTarget}\n`);
+    process.stderr.write(`Profile: ${packet.current.configured ? "configured" : "missing"} (${packet.current.profilePath})\n`);
+    process.stderr.write(`Recommended path: ${packet.recommendation.path}\n`);
+    process.stderr.write(`Recommended command: ${packet.recommendation.command}\n`);
+    process.stderr.write(`Writes: ${packet.recommendation.writes ? "yes" : "no"}\n`);
+    process.stderr.write(`Reason: ${packet.recommendation.reason}\n`);
+    process.stderr.write(`Mutation boundary: ${packet.mutationBoundary}\n`);
+    process.stderr.write("\nEntry packet:\n");
+    process.stderr.write(`  current: ${packet.entryPacket.currentState}\n`);
+    process.stderr.write(`  decision: ${packet.entryPacket.decision}\n`);
+    process.stderr.write(`  evidence gate: ${packet.entryPacket.evidenceGate}\n`);
+    process.stderr.write(`  primary action: ${packet.entryPacket.primaryAction}\n`);
+    process.stderr.write(`  reason: ${packet.entryPacket.reason}\n`);
+    process.stderr.write("  allowed now:\n");
+    for (const item of packet.entryPacket.allowedNow)
+        process.stderr.write(`    - ${item}\n`);
+    process.stderr.write("  blocked now:\n");
+    for (const item of packet.entryPacket.blockedNow)
+        process.stderr.write(`    - ${item}\n`);
+    process.stderr.write("  review path:\n");
+    for (const command of packet.entryPacket.reviewPath)
+        process.stderr.write(`    - ${command}\n`);
+    process.stderr.write("\nSetup plan:\n");
+    process.stderr.write(`  - principle: ${packet.setupPlan.principle}\n`);
+    for (const phase of packet.setupPlan.phases) {
+        process.stderr.write(`  - ${phase.id}. ${phase.label}\n`);
+        process.stderr.write(`    command: ${phase.command}\n`);
+        process.stderr.write(`    owner: ${phase.owner}\n`);
+        process.stderr.write(`    writes: ${phase.writes ? "yes" : "no"}\n`);
+        process.stderr.write(`    purpose: ${phase.purpose}\n`);
+    }
+    process.stderr.write("  - boundaries:\n");
+    for (const boundary of packet.setupPlan.boundaries)
+        process.stderr.write(`    - ${boundary}\n`);
+    if (packet.asset) {
+        process.stderr.write("\nAsset posture:\n");
+        process.stderr.write(`  - ${packet.asset.name}: ${packet.asset.status}, evidence=${packet.asset.evidence}, cascade=${packet.asset.cascade}, evolution=${packet.asset.evolution}, configured=${packet.asset.configured ? "yes" : "no"}\n`);
+        if (packet.asset.positioning)
+            process.stderr.write(`    why: ${packet.asset.positioning}\n`);
+    }
+    if (packet.warnings.length > 0) {
+        process.stderr.write("\nWarnings:\n");
+        for (const warning of packet.warnings)
+            process.stderr.write(`  - ${warning}\n`);
+    }
+    process.stderr.write("\nReview path:\n");
+    for (const command of packet.reviewPath)
+        process.stderr.write(`  - ${command}\n`);
+    process.stderr.write("\nNext commands:\n");
+    for (const command of packet.nextCommands)
+        process.stderr.write(`  - ${command}\n`);
+}
+function writeOperatingRoute(route) {
+    process.stderr.write("\nOperating route:\n");
+    process.stderr.write(`  - spine: ${route.spine.join(" -> ")}\n`);
+    process.stderr.write(`  - current: ${route.currentStage}\n`);
+    process.stderr.write(`  - command: ${route.currentCommand}\n`);
+    process.stderr.write(`  - principle: ${route.principle}\n`);
+    process.stderr.write("  - boundaries:\n");
+    for (const boundary of route.boundaries)
+        process.stderr.write(`    - ${boundary}\n`);
+}
+function writeReleaseGate(gate, indent = "") {
+    process.stderr.write(`${indent}Release gate:\n`);
+    process.stderr.write(`${indent}  status: ${gate.status}\n`);
+    process.stderr.write(`${indent}  command: ${gate.command}\n`);
+    process.stderr.write(`${indent}  deploy and verify when: ${gate.deployAndVerifyWhen}\n`);
+    process.stderr.write(`${indent}  required when:\n`);
+    for (const item of gate.requiredWhen)
+        process.stderr.write(`${indent}    - ${item}\n`);
+    process.stderr.write(`${indent}  not required for:\n`);
+    for (const item of gate.notRequiredFor)
+        process.stderr.write(`${indent}    - ${item}\n`);
+    process.stderr.write(`${indent}  verification:\n`);
+    for (const item of gate.verification)
+        process.stderr.write(`${indent}    - ${item}\n`);
+    process.stderr.write(`${indent}  boundary: ${gate.boundary}\n`);
+}
+function writeAssetPortfolioGuide(indent = "") {
+    process.stderr.write(`${indent}Asset portfolio guide:\n`);
+    process.stderr.write(`${indent}  - active: asset currently bound for manager review; still needs clear evidence and rollout before runtime distribution.\n`);
+    process.stderr.write(`${indent}  - stale: older or non-active candidate for the same project; compare before promotion, pause, or removal.\n`);
+    process.stderr.write(`${indent}  - blocked: asset cannot roll out or sync yet; follow its next command and review command.\n`);
+    process.stderr.write(`${indent}  - evidence gaps: missing or open evidence that must be reviewed before broad rollout.\n`);
+    process.stderr.write(`${indent}  - upgrade risks: version or follow-up changes that need explicit diff/adoption review.\n`);
+    process.stderr.write(`${indent}  - boundary: this is local dna manager review only; it does not create org_private SaaS visibility, publish templates, install assets, sync runtime artifacts, or approve workflow execution.\n`);
+}
+function writeRolloutPlan(plan) {
+    process.stderr.write("Organization rollout plan\n");
+    process.stderr.write(`Mode: ${plan.mode}\n`);
+    process.stderr.write(`Profile: ${plan.profilePath}\n`);
+    if (plan.organization)
+        process.stderr.write(`Organization: ${plan.organization}\n`);
+    process.stderr.write(`Status: ${plan.status}\n`);
+    process.stderr.write(`Projects: ${plan.summary.projects}\n`);
+    process.stderr.write(`Declared assets: ${plan.summary.declaredAssets}\n`);
+    process.stderr.write(`Ready assets: ${plan.summary.readyAssets}\n`);
+    process.stderr.write(`Blocked assets: ${plan.summary.blockedAssets}\n`);
+    process.stderr.write(`Sync targets: ${plan.summary.syncTargets.length > 0 ? plan.summary.syncTargets.join(", ") : "none"}\n`);
+    process.stderr.write(`Mutation boundary: ${plan.mutationBoundary}\n`);
+    writeOperatingRoute(plan.operatingRoute);
+    process.stderr.write("\nAssets:\n");
+    if (plan.assets.length === 0) {
+        process.stderr.write("  - none\n");
+    }
+    else {
+        for (const asset of plan.assets) {
+            process.stderr.write(`  - ${asset.project}/${asset.asset}: binding=${asset.bindingStatus} configured=${asset.configured ? "yes" : "no"} evidence=${asset.evidenceGate} sync_ready=${asset.syncReady ? "yes" : "no"} targets=${asset.syncTargets.length > 0 ? asset.syncTargets.join(",") : "none"}\n`);
+            process.stderr.write(`    next: ${asset.nextCommand}\n`);
+            process.stderr.write(`    reason: ${asset.reason}\n`);
+            if (asset.reviewEvidence.length > 0) {
+                for (const evidence of asset.reviewEvidence) {
+                    process.stderr.write(`    review receipt: ${evidence.receiptCommand}\n`);
+                    process.stderr.write(`    receipt path: ${evidence.receiptPathHint}\n`);
+                }
+            }
+        }
+    }
+    process.stderr.write("\nBlockers:\n");
+    if (plan.blockers.length === 0) {
+        process.stderr.write("  - none\n");
+    }
+    else {
+        for (const blocker of plan.blockers)
+            process.stderr.write(`  - ${blocker}\n`);
+    }
+    process.stderr.write("\nDistribution plan:\n");
+    process.stderr.write(`  - deployment boundary: ${plan.distributionPlan.deploymentBoundary}\n`);
+    if (plan.distributionPlan.targets.length === 0) {
+        process.stderr.write("  - targets: none\n");
+    }
+    else {
+        for (const target of plan.distributionPlan.targets) {
+            process.stderr.write(`  - ${target.target}: ${target.status} command=${target.command} ready=${target.readyAssets.length} blocked=${target.blockedAssets.length}\n`);
+            for (const blocked of target.blockedAssets.slice(0, 5)) {
+                process.stderr.write(`    blocked: ${blocked.project}/${blocked.asset} next=${blocked.nextCommand}\n`);
+            }
+        }
+    }
+    for (const guidance of plan.distributionPlan.guidance) {
+        process.stderr.write(`    guidance: ${guidance}\n`);
+    }
+    process.stderr.write("\n");
+    writeReleaseGate(plan.releaseGate);
+    process.stderr.write("\nRollout commands:\n");
+    if (plan.rolloutCommands.length === 0) {
+        process.stderr.write("  - none\n");
+    }
+    else {
+        for (const command of plan.rolloutCommands)
+            process.stderr.write(`  - ${command}\n`);
+    }
+    process.stderr.write("\nNext commands:\n");
+    for (const command of plan.nextCommands)
+        process.stderr.write(`  - ${command}\n`);
+}
+function writeReview(review, title) {
+    const managerSummary = buildManagerSummary(review);
+    process.stderr.write(`${title}\n`);
+    process.stderr.write(`Profile: ${review.profilePath}\n`);
+    process.stderr.write(`Organization: ${review.profile.organization.name} (${review.profile.organization.id})\n`);
+    process.stderr.write("\nManager summary:\n");
+    process.stderr.write(`  Status: ${managerSummary.status}\n`);
+    process.stderr.write(`  Decision: ${managerSummary.decision}\n`);
+    process.stderr.write(`  Headline: ${managerSummary.headline}\n`);
+    process.stderr.write(`  Primary command: ${managerSummary.primaryCommand}\n`);
+    process.stderr.write(`  Dogfood evidence: ${managerSummary.dogfoodEvidence.status} (${managerSummary.dogfoodEvidence.pass}/${managerSummary.dogfoodEvidence.modules} PASS, remaining=${managerSummary.dogfoodEvidence.remaining})\n`);
+    process.stderr.write(`  Portfolio maturity: ${managerSummary.assetPortfolio.rolloutMaturity}\n`);
+    process.stderr.write(`  Active assets: ${managerSummary.assetPortfolio.active.length}\n`);
+    process.stderr.write(`  Stale assets: ${managerSummary.assetPortfolio.stale.length}\n`);
+    process.stderr.write(`  Blocked assets: ${managerSummary.assetPortfolio.blocked.length}\n`);
+    process.stderr.write(`  Evidence gaps: ${managerSummary.assetPortfolio.evidenceGaps.length}\n`);
+    process.stderr.write(`  Upgrade risks: ${managerSummary.assetPortfolio.upgradeRisks.length}\n`);
+    writeAssetPortfolioGuide("  ");
+    if (managerSummary.unfinishedWork) {
+        process.stderr.write("  Unfinished work review:\n");
+        process.stderr.write(`    status: ${managerSummary.unfinishedWork.status}\n`);
+        process.stderr.write(`    source asset: ${managerSummary.unfinishedWork.sourceAsset}\n`);
+        process.stderr.write(`    draft asset: ${managerSummary.unfinishedWork.draftAsset}\n`);
+        process.stderr.write(`    label: ${managerSummary.unfinishedWork.plainLanguage.label}\n`);
+        process.stderr.write(`    purpose: ${managerSummary.unfinishedWork.plainLanguage.purpose}\n`);
+        process.stderr.write(`    improvement: ${managerSummary.unfinishedWork.plainLanguage.workflowImprovement}\n`);
+        process.stderr.write("    preserves:\n");
+        for (const item of managerSummary.unfinishedWork.plainLanguage.preserves)
+            process.stderr.write(`      - ${item}\n`);
+        process.stderr.write("    required before use:\n");
+        for (const item of managerSummary.unfinishedWork.plainLanguage.requiredBeforeUse)
+            process.stderr.write(`      - ${item}\n`);
+        process.stderr.write(`    current command: ${managerSummary.unfinishedWork.currentCommand}\n`);
+        process.stderr.write(`    writes: ${managerSummary.unfinishedWork.writes ? "yes" : "no"}\n`);
+        process.stderr.write(`    authority: ${managerSummary.unfinishedWork.localAuthority}\n`);
+        for (const boundary of managerSummary.unfinishedWork.boundaries)
+            process.stderr.write(`    boundary: ${boundary}\n`);
+        process.stderr.write(`    not allowed to imply: ${managerSummary.unfinishedWork.notAllowedToImply.join(", ")}\n`);
+    }
+    process.stderr.write("  Improvement principle:\n");
+    process.stderr.write(`    command: ${managerSummary.improvementPrinciple.command}\n`);
+    process.stderr.write(`    rule: ${managerSummary.improvementPrinciple.rule}\n`);
+    process.stderr.write(`    template boundary: ${managerSummary.improvementPrinciple.templateBoundary}\n`);
+    process.stderr.write(`    infra boundary: ${managerSummary.improvementPrinciple.infraBoundary}\n`);
+    process.stderr.write(`  Mutation boundary: ${managerSummary.mutationBoundary}\n`);
+    writeReleaseGate(managerSummary.releaseGate, "  ");
+    process.stderr.write("  Manager choices:\n");
+    for (const choice of managerSummary.managerChoices) {
+        process.stderr.write(`    - ${choice.id}: ${choice.status} writes=${choice.writes ? "yes" : "no"}\n`);
+        process.stderr.write(`      command: ${choice.command}\n`);
+        process.stderr.write(`      why: ${choice.reason}\n`);
+        process.stderr.write(`      next: ${choice.next}\n`);
+    }
+    process.stderr.write("  Manager path:\n");
+    for (const step of managerSummary.managerPath) {
+        process.stderr.write(`    - ${step.id}: ${step.status} owner=${step.owner} writes=${step.writes ? "yes" : "no"}\n`);
+        process.stderr.write(`      command: ${step.command}\n`);
+        process.stderr.write(`      why: ${step.purpose}\n`);
+        process.stderr.write(`      next: ${step.next}\n`);
+    }
+    process.stderr.write("  Decision packet:\n");
+    process.stderr.write(`    current: ${managerSummary.decisionPacket.currentState}\n`);
+    process.stderr.write(`    primary action: ${managerSummary.decisionPacket.primaryAction}\n`);
+    process.stderr.write(`    risk: ${managerSummary.decisionPacket.risk}\n`);
+    process.stderr.write(`    reason: ${managerSummary.decisionPacket.reason}\n`);
+    process.stderr.write("    allowed now:\n");
+    for (const item of managerSummary.decisionPacket.allowedNow)
+        process.stderr.write(`      - ${item}\n`);
+    process.stderr.write("    blocked now:\n");
+    for (const item of managerSummary.decisionPacket.blockedNow)
+        process.stderr.write(`      - ${item}\n`);
+    writeOperatingRoute(managerSummary.operatingRoute);
+    process.stderr.write("  Asset portfolio:\n");
+    process.stderr.write(`    rollout maturity: ${managerSummary.assetPortfolio.rolloutMaturity}\n`);
+    process.stderr.write("    active:\n");
+    if (managerSummary.assetPortfolio.active.length === 0) {
+        process.stderr.write("      - none\n");
+    }
+    else {
+        for (const asset of managerSummary.assetPortfolio.active) {
+            const version = asset.version ? ` version=${asset.version}` : "";
+            process.stderr.write(`      - ${asset.project}/${asset.asset}:${version} rollout=${asset.rollout} evidence=${asset.evidence} posture=${asset.evidencePosture} targets=${asset.targets.join(", ") || "none"}\n`);
+            process.stderr.write(`        review: ${asset.reviewCommand}\n`);
+            for (const evidence of asset.reviewEvidence) {
+                process.stderr.write(`        review receipt: ${evidence.receiptCommand}\n`);
+                process.stderr.write(`        receipt path: ${evidence.receiptPathHint}\n`);
+            }
+            if (asset.reviewRefs.length > 0) {
+                process.stderr.write(`        refs: ${asset.reviewRefs.map((ref) => `${ref.kind}:${ref.path}`).join(", ")}\n`);
+            }
+        }
+    }
+    process.stderr.write("    stale:\n");
+    if (managerSummary.assetPortfolio.stale.length === 0) {
+        process.stderr.write("      - none\n");
+    }
+    else {
+        for (const asset of managerSummary.assetPortfolio.stale) {
+            const version = asset.version ? ` version=${asset.version}` : "";
+            process.stderr.write(`      - ${asset.project}/${asset.asset}:${version} ${asset.reason} next=${asset.nextCommand}\n`);
+            process.stderr.write(`        review: ${asset.reviewCommand}\n`);
+            for (const evidence of asset.reviewEvidence) {
+                process.stderr.write(`        review receipt: ${evidence.receiptCommand}\n`);
+                process.stderr.write(`        receipt path: ${evidence.receiptPathHint}\n`);
+            }
+        }
+    }
+    process.stderr.write("    evidence gaps:\n");
+    if (managerSummary.assetPortfolio.evidenceGaps.length === 0) {
+        process.stderr.write("      - none\n");
+    }
+    else {
+        for (const gap of managerSummary.assetPortfolio.evidenceGaps) {
+            const version = gap.version ? ` version=${gap.version}` : "";
+            process.stderr.write(`      - ${gap.project}/${gap.asset}:${version} gate=${gap.evidenceGate} posture=${gap.evidencePosture} next=${gap.nextCommand}\n`);
+            if (gap.reviewRefs.length > 0) {
+                process.stderr.write(`        refs: ${gap.reviewRefs.map((ref) => `${ref.kind}:${ref.path}`).join(", ")}\n`);
+            }
+        }
+    }
+    process.stderr.write("    blocked:\n");
+    if (managerSummary.assetPortfolio.blocked.length === 0) {
+        process.stderr.write("      - none\n");
+    }
+    else {
+        for (const asset of managerSummary.assetPortfolio.blocked) {
+            const version = asset.version ? ` version=${asset.version}` : "";
+            process.stderr.write(`      - ${asset.project}/${asset.asset}:${version} ${asset.reason} next=${asset.nextCommand}\n`);
+            process.stderr.write(`        review: ${asset.reviewCommand}\n`);
+            for (const evidence of asset.reviewEvidence) {
+                process.stderr.write(`        review receipt: ${evidence.receiptCommand}\n`);
+                process.stderr.write(`        receipt path: ${evidence.receiptPathHint}\n`);
+            }
+        }
+    }
+    process.stderr.write("    upgrade risks:\n");
+    if (managerSummary.assetPortfolio.upgradeRisks.length === 0) {
+        process.stderr.write("      - none\n");
+    }
+    else {
+        for (const risk of managerSummary.assetPortfolio.upgradeRisks) {
+            const version = risk.version ? ` version=${risk.version}` : "";
+            process.stderr.write(`      - ${risk.project}/${risk.asset}:${version} ${risk.reason} next=${risk.nextCommand}\n`);
+            process.stderr.write(`        review: ${risk.reviewCommand}\n`);
+            for (const evidence of risk.reviewEvidence) {
+                process.stderr.write(`        review receipt: ${evidence.receiptCommand}\n`);
+                process.stderr.write(`        receipt path: ${evidence.receiptPathHint}\n`);
+            }
+        }
+    }
+    process.stderr.write("  Ready targets:\n");
+    if (managerSummary.readyTargets.length === 0) {
+        process.stderr.write("    - none\n");
+    }
+    else {
+        for (const target of managerSummary.readyTargets)
+            process.stderr.write(`    - ${target.target}: ${target.command} assets=${target.assets.map((asset) => `${asset.project}/${asset.asset}`).join(", ")}\n`);
+    }
+    process.stderr.write("  Blocked targets:\n");
+    if (managerSummary.blockedTargets.length === 0) {
+        process.stderr.write("    - none\n");
+    }
+    else {
+        for (const target of managerSummary.blockedTargets)
+            process.stderr.write(`    - ${target.target}: ${target.assets.map((asset) => `${asset.project}/${asset.asset}`).join(", ")}\n`);
+    }
+    process.stderr.write("  Blocked assets:\n");
+    if (managerSummary.blockedAssets.length === 0) {
+        process.stderr.write("    - none\n");
+    }
+    else {
+        for (const asset of managerSummary.blockedAssets.slice(0, 8)) {
+            process.stderr.write(`    - ${asset.project}/${asset.asset}: ${asset.nextCommand}\n`);
+            process.stderr.write(`      reason: ${asset.reason}\n`);
+        }
+    }
+    process.stderr.write("  Next commands:\n");
+    for (const command of managerSummary.nextCommands.slice(0, 8))
+        process.stderr.write(`    - ${command}\n`);
+    process.stderr.write("\nTotals:\n");
+    process.stderr.write(`Projects: ${review.totals.projects}\n`);
+    process.stderr.write(`Declared assets: ${review.totals.declaredAssets}\n`);
+    process.stderr.write(`Configured assets: ${review.totals.configuredAssets}\n`);
+    process.stderr.write(`Missing assets: ${review.totals.missingAssets}\n`);
+    process.stderr.write(`Sync targets: ${review.totals.syncTargets}\n`);
+    process.stderr.write(`Dogfood evidence modules: ${review.totals.dogfoodEvidenceModules}\n`);
+    process.stderr.write(`Dogfood evidence PASS: ${review.totals.dogfoodEvidencePass}\n`);
+    process.stderr.write(`Dogfood evidence remaining: ${review.totals.dogfoodEvidenceRemaining}\n`);
+    process.stderr.write("\nProjects:\n");
+    for (const project of review.projects) {
+        process.stderr.write(`  - ${project.name} (${project.id}) path=${project.path}\n`);
+        process.stderr.write(`    assets: ${project.plannedAssets.length > 0 ? project.plannedAssets.join(", ") : "none"}\n`);
+        process.stderr.write(`    configured: ${project.configuredAssets.length > 0 ? project.configuredAssets.join(", ") : "none"}\n`);
+        process.stderr.write(`    missing: ${project.missingAssets.length > 0 ? project.missingAssets.join(", ") : "none"}\n`);
+        process.stderr.write(`    sync targets: ${project.syncTargets.length > 0 ? project.syncTargets.join(", ") : "none"}\n`);
+        if (project.assetGates.length > 0) {
+            process.stderr.write("    asset gates:\n");
+            for (const gate of project.assetGates) {
+                process.stderr.write(`      - ${gate.asset}: binding=${gate.bindingStatus} configured=${gate.configured ? "yes" : "no"} evidence=${gate.evidenceGate} sync_ready=${gate.syncReady ? "yes" : "no"}\n`);
+                process.stderr.write(`        next: ${gate.nextCommand}\n`);
+                process.stderr.write(`        reason: ${gate.reason}\n`);
+            }
+        }
+    }
+    if (review.nextActions.length === 0) {
+        process.stderr.write("\nNo next actions.\n");
+        return;
+    }
+    process.stderr.write("\nNext actions:\n");
+    for (const action of review.nextActions.slice(0, 12)) {
+        process.stderr.write(`  - ${action}\n`);
+    }
+    if (review.nextActions.length > 12) {
+        process.stderr.write(`  ... ${review.nextActions.length - 12} more item(s). Use --json for the full review payload.\n`);
+    }
+}
+function writeBindResult(result) {
+    process.stderr.write(`Bound organization asset: ${result.asset}\n`);
+    process.stderr.write(`Profile: ${result.path}\n`);
+    process.stderr.write(`Project: ${result.projectId}\n`);
+    process.stderr.write(`Status: ${result.status}\n`);
+    process.stderr.write(`Asset binding: ${result.addedAsset ? "added" : "updated"}\n`);
+    if (result.addedSyncTargets.length > 0) {
+        process.stderr.write(`Added sync targets: ${result.addedSyncTargets.join(", ")}\n`);
+    }
+    process.stderr.write("\nBinding guidance:\n");
+    process.stderr.write(`  - effect: ${result.guidance.bindingEffect}\n`);
+    process.stderr.write(`  - review: ${result.guidance.reviewCommand}\n`);
+    process.stderr.write(`  - rollout: ${result.guidance.rolloutCommand}\n`);
+    process.stderr.write(`  - boundary: ${result.guidance.replacementBoundary}\n`);
+    process.stderr.write("\nNext commands:\n");
+    process.stderr.write(`  - dna org review\n`);
+    process.stderr.write(`  - dna assets governance ${result.asset}\n`);
+    process.stderr.write(`  - dna init --template ${result.asset}\n`);
+}
+export async function runOrg(opts) {
+    const subcommand = opts.subcommand || "status";
+    if (subcommand === "intake") {
+        const packet = await buildOrgIntake(opts);
+        if (opts.json) {
+            process.stdout.write(JSON.stringify(packet, null, 2) + "\n");
+            return 0;
+        }
+        writeOrgIntake(packet);
+        return 0;
+    }
+    if (subcommand === "configure-plan") {
+        const profile = await readOrganizationProfile({ projectDir: opts.projectDir });
+        const review = profile.profile ? await reviewOrganization({ projectDir: opts.projectDir }) : undefined;
+        const plan = buildOrgConfigurePlan(profile.path, review);
+        const exitCode = opts.apply ? await applyOrgConfigurePlan(plan, opts.projectDir ?? process.cwd()) : 0;
+        if (opts.json) {
+            process.stdout.write(JSON.stringify(plan, null, 2) + "\n");
+            return exitCode;
+        }
+        writeConfigurePlan(plan);
+        return exitCode;
+    }
+    if (subcommand === "rollout" || subcommand === "route") {
+        const profile = await readOrganizationProfile({ projectDir: opts.projectDir });
+        const review = profile.profile ? await reviewOrganization({ projectDir: opts.projectDir }) : undefined;
+        const plan = buildOrgRolloutPlan(profile.path, review);
+        if (opts.json) {
+            process.stdout.write(JSON.stringify(plan, null, 2) + "\n");
+            return 0;
+        }
+        writeRolloutPlan(plan);
+        return 0;
+    }
+    if (subcommand === "receipt") {
+        const profile = await readOrganizationProfile({ projectDir: opts.projectDir });
+        const review = profile.profile ? await reviewOrganization({ projectDir: opts.projectDir }) : undefined;
+        const rollout = buildOrgRolloutPlan(profile.path, review);
+        const receipt = buildOrgReviewReceipt(profile.path, review, rollout);
+        if (opts.json) {
+            process.stdout.write(JSON.stringify(receipt, null, 2) + "\n");
+            return 0;
+        }
+        writeOrgReceipt(receipt);
+        return 0;
+    }
+    if (subcommand === "init") {
+        const orgName = opts.name?.trim();
+        if (!orgName) {
+            process.stderr.write("Usage: dna org init --name <organization> [--project <project>] [--asset <asset>] [--sync-target <target>] [--json]\n");
+            return 2;
+        }
+        const result = await createOrganizationProfile({
+            orgName,
+            projectName: opts.project,
+            asset: opts.asset,
+            syncTarget: opts.syncTarget,
+            projectDir: opts.projectDir,
+        });
+        const review = await reviewOrganization({ projectDir: opts.projectDir });
+        if (opts.json) {
+            process.stdout.write(JSON.stringify({ path: result.path, profile: result.profile, review: review ? withManagerSummary(review) : review }, null, 2) + "\n");
+            return 0;
+        }
+        process.stderr.write(`Created organization profile: ${result.path}\n`);
+        if (review)
+            writeReview(review, "Organization status");
+        return 0;
+    }
+    if (subcommand === "bind") {
+        const asset = opts.asset?.trim();
+        if (!asset) {
+            process.stderr.write("Usage: dna org bind --asset <asset> [--project <project>] [--status planned|active|paused] [--sync-target <target>] [--json]\n");
+            return 2;
+        }
+        if (opts.status && !isOrganizationAssetStatus(opts.status)) {
+            process.stderr.write(`Invalid org asset status: ${opts.status}. Expected one of planned, active, paused.\n`);
+            return 2;
+        }
+        const result = await bindOrganizationAsset({
+            asset,
+            project: opts.project,
+            status: opts.status,
+            syncTarget: opts.syncTarget,
+            projectDir: opts.projectDir,
+        });
+        if (!result) {
+            const profile = await readOrganizationProfile({ projectDir: opts.projectDir });
+            if (!profile.profile) {
+                writeProfileMissing(profile.path);
+                return 2;
+            }
+            process.stderr.write(`Project not found for binding: ${opts.project}\n`);
+            return 2;
+        }
+        const review = await reviewOrganization({ projectDir: opts.projectDir });
+        if (opts.json) {
+            process.stdout.write(JSON.stringify({ result, review: review ? withManagerSummary(review) : review }, null, 2) + "\n");
+            return 0;
+        }
+        writeBindResult(result);
+        if (review)
+            writeReview(review, "Organization status");
+        return 0;
+    }
+    if (subcommand === "status" || subcommand === "review") {
+        const profile = await readOrganizationProfile({ projectDir: opts.projectDir });
+        if (!profile.profile) {
+            const packet = buildOrgStatusPacket(profile.path, undefined);
+            if (opts.json) {
+                process.stdout.write(JSON.stringify(packet, null, 2) + "\n");
+                return 0;
+            }
+            if (subcommand === "status") {
+                writeOrgStatus(packet);
+            }
+            else {
+                writeProfileMissing(profile.path);
+            }
+            return subcommand === "review" ? 2 : 0;
+        }
+        const review = await reviewOrganization({ projectDir: opts.projectDir });
+        if (!review) {
+            process.stderr.write(`Organization profile is unreadable: ${profile.path}\n`);
+            return 2;
+        }
+        if (opts.json) {
+            process.stdout.write(JSON.stringify(subcommand === "status" ? buildOrgStatusPacket(profile.path, review) : withManagerSummary(review), null, 2) + "\n");
+            return 0;
+        }
+        if (subcommand === "status") {
+            writeOrgStatus(buildOrgStatusPacket(profile.path, review));
+        }
+        else {
+            writeReview(review, "Organization review");
+        }
+        return 0;
+    }
+    process.stderr.write("Usage: dna org <intake|rollout|init|bind|status|review> [description] [--name <organization>] [--project <project>] [--asset <asset>] [--status planned|active|paused] [--sync-target <target>] [--json]\n");
+    return 2;
+}