intentdna 1.7.4 → 1.8.0

package/dist/cli/commands/sync.js

@@ -20,14 +20,19 @@ import { findTemplateCatalogEntry } from "../../templates/catalog.js";
 import { compileToMarkdown, injectIntoFile, removeFromFile } from "../../runtime/markdown.js";
 import { syncInjectMarkdownTargets } from "../../runtime/markdown-target-registry.js";
 import { getSyncOutputArtifactMetadata } from "../../runtime/output-artifact-registry.js";
+import { inspectSyncArtifactRegistry, removeSyncArtifacts, writeSyncArtifactRegistry, } from "../../runtime/sync-artifact-registry.js";
 import { compileWorkflow } from "../../compiler/workflow.js";
 import { compileAllRolesToAgentMD, writeAgentMDFiles, removeAgentMDFiles } from "../../runtime/agent-md.js";
+import { createClaudeCoreSyncTargetPlan, executeClaudeCoreSyncTargetPlan, formatClaudeCoreSyncTargetPlanDryRun, removeLegacyBashHooks } from "../../runtime/claude-sync-target.js";
 import { removeWorkflowScripts } from "../../runtime/workflow-runner.js";
 import { compileWorkflowToSkill, compileControllerToSkill, writeSkillFiles, removeSkillFiles } from "../../runtime/skill-adapter.js";
-import { compilePluginSettings, detectEnabledEvents, mergeSettingsFile, recommendHookTimeouts } from "../../runtime/settings-adapter.js";
-import { createCompiledIR, writeCompiledIR } from "../../runtime/plugin-adapter.js";
+import { getControllerKindMetadata } from "../../schema/controller-registry.js";
+import { createCodexSyncTargetPlan, executeCodexSyncTargetPlan, formatCodexSyncTargetPlanSummary, removeCodexSyncTargetArtifacts } from "../../runtime/codex-sync-target.js";
+import { trackedOutputsForSyncTargetPlan } from "../../runtime/sync-target-plan.js";
+import { getPackageVersion } from "../util/version.js";
 import { cascadeDNA } from "../../compiler/cascade.js";
 import { EvolutionEngine } from "../../evolution/index.js";
+import { readOrganizationProfile, reviewOrganization } from "../../organization/index.js";
 const VALID_TARGETS = syncInjectMarkdownTargets();
 /**
  * Detect whether intentdna is running as a Claude Code plugin or standalone binary.
@@ -66,33 +71,6 @@ async function fileExists(path) {
     }
 }
 const DNA_SENTINEL = "intentdna:managed";
-const LEGACY_BASH_HOOKS = [
-    "dna-pre-tool-use.sh",
-    "dna-post-tool-use.sh",
-    "dna-user-prompt-submit.sh",
-    "dna-subagent-stop.sh",
-    "dna-pre-compact.sh",
-    "dna-notification.sh",
-];
-/**
- * Remove legacy bash hook scripts written by previous Intent DNA versions.
- * Only removes files that contain the sentinel comment.
- */
-async function removeLegacyBashHooks(hooksDir) {
-    let removed = 0;
-    for (const file of LEGACY_BASH_HOOKS) {
-        const path = resolve(hooksDir, file);
-        try {
-            const content = await readFile(path, "utf-8");
-            if (content.includes("intentdna:managed")) {
-                await unlink(path);
-                removed++;
-            }
-        }
-        catch { /* File doesn't exist, skip */ }
-    }
-    return removed;
-}
 /**
  * Remove stale DNA-managed files from a directory.
  * Only removes files matching activeNamespaces (dna-{ns}-*).
@@ -193,8 +171,8 @@ async function resolveVariables(rawVars, configPath, options) {
  * Auto-detect DNA config file in current directory (legacy single-config).
  * Priority: .dna/config.yaml > .dna/config.yml > .dna/config.json > .dna.yaml > .dna.yml > .dna.json
  */
-export async function autoDetectConfigs() {
-    return detectDNAConfigs(process.cwd());
+export async function autoDetectConfigs(projectDir = process.cwd()) {
+    return detectDNAConfigs(projectDir);
 }
 /**
  * Read the current package version from package.json.
@@ -292,11 +270,32 @@ async function computeFileHash(filePath) {
     const content = await readFile(filePath, "utf-8");
     return fileSha256(content);
 }
-function trackSyncOutput(trackedOutputs, artifact, path) {
+function trackSyncOutput(trackedOutputs, artifact, path, metadata) {
     if (!getSyncOutputArtifactMetadata(artifact)) {
         throw new Error(`Unknown sync output artifact: ${artifact}`);
     }
-    trackedOutputs.push({ artifact, path: resolve(path) });
+    trackedOutputs.push({ artifact, path, ...metadata });
+}
+function trackSyncTargetPlanOutputs(trackedOutputs, plan, projectDir) {
+    const installMode = "hookInstallMode" in plan && typeof plan.hookInstallMode === "string"
+        ? plan.hookInstallMode
+        : undefined;
+    for (const output of trackedOutputsForSyncTargetPlan(plan)) {
+        const planned = plan.plannedArtifacts.find((artifact) => {
+            if (artifact.outputArtifact !== output.artifact)
+                return false;
+            return artifact.path === output.path || resolve(artifact.path) === resolve(output.path);
+        });
+        const outputPath = resolve(projectDir, output.path);
+        trackSyncOutput(trackedOutputs, output.artifact, outputPath, {
+            kind: planned?.kind,
+            target: plan.target,
+            adapter: plan.target,
+            installMode,
+            ownership: planned?.ownership,
+            trackedByLock: planned?.trackedByLock,
+        });
+    }
 }
 function summarizeSyncOutputs(trackedOutputs, dryRun) {
     if (trackedOutputs.length === 0)
@@ -318,6 +317,122 @@ function lockTrackedOutputPaths(trackedOutputs) {
         .filter((output) => getSyncOutputArtifactMetadata(output.artifact)?.trackedByLock)
         .map((output) => output.path);
 }
+function buildSyncRunJsonResult(opts, projectDir, files, trackedOutputs, registryArtifacts) {
+    const targets = [...new Set(trackedOutputs.map((output) => output.adapter ?? output.target ?? "generic"))].sort();
+    return {
+        schema_version: "intentdna.sync_result.v1",
+        mode: "sync",
+        status: opts.dryRun ? "dry_run" : "synced",
+        dryRun: opts.dryRun === true,
+        projectDir,
+        files,
+        commandEffects: {
+            mutation_performed: opts.dryRun !== true,
+            network_performed: false,
+            runtime_authority: false,
+            syncs_harness: opts.dryRun !== true,
+            executes_workflow: false,
+        },
+        targets,
+        counts: {
+            tracked_outputs: trackedOutputs.length,
+            lock_tracked_outputs: lockTrackedOutputPaths(trackedOutputs).length,
+            registry_artifacts: registryArtifacts,
+        },
+        outputs: trackedOutputs.map((output) => {
+            const metadata = getSyncOutputArtifactMetadata(output.artifact);
+            return {
+                artifact: output.artifact,
+                label: metadata?.label ?? output.artifact,
+                path: output.path,
+                kind: output.kind,
+                target: output.target,
+                adapter: output.adapter,
+                installMode: output.installMode,
+                ownership: output.ownership,
+                trackedByLock: metadata?.trackedByLock === true,
+            };
+        }),
+        registryPath: opts.dryRun ? undefined : resolve(projectDir, ".dna", "sync", "registry.json"),
+        boundaries: [
+            "dna sync installs, distributes, and injects local artifacts only; it does not execute workflows.",
+            "dna-hook and local runtime evidence remain runtime truth for allow/warn/block/validate decisions.",
+            "Online and marketplace surfaces do not become runtime authority from sync output.",
+            "Network upload, Supabase deployment, and trusted cloud ingestion are not performed by dna sync.",
+        ],
+    };
+}
+function canonicalOrganizationSyncTarget(target) {
+    const normalized = target.toLowerCase();
+    if (normalized === "codex" || normalized === "codex_cli")
+        return "codex";
+    if (normalized === "claude" || normalized === "claude_code")
+        return "claude";
+    return normalized;
+}
+function requestedOrganizationSyncTargets(opts) {
+    const targets = new Set();
+    if (opts.codex)
+        targets.add("codex");
+    if (opts.inject || opts.hooksDir || opts.agentsDir || opts.workflowDir || opts.skillsDir || opts.settingsPath) {
+        targets.add("claude");
+    }
+    return targets;
+}
+function syncTargetMatches(requestedTargets, actualTargets) {
+    return actualTargets.some((target) => requestedTargets.has(canonicalOrganizationSyncTarget(target)));
+}
+async function writeOrganizationRolloutGateIfBlocked(opts, projectDir) {
+    const requestedTargets = requestedOrganizationSyncTargets(opts);
+    if (requestedTargets.size === 0)
+        return;
+    const profile = await readOrganizationProfile({ projectDir });
+    if (!profile.profile)
+        return;
+    const profileTargets = profile.profile.projects.flatMap((project) => project.syncTargets);
+    if (!syncTargetMatches(requestedTargets, profileTargets))
+        return;
+    const review = await reviewOrganization({ projectDir });
+    if (!review)
+        return;
+    const blockedGates = review.projects.flatMap((project) => project.assetGates
+        .filter((gate) => !gate.syncReady && syncTargetMatches(requestedTargets, gate.syncTargets))
+        .map((gate) => ({
+        project: project.name,
+        asset: gate.asset,
+        evidenceGate: gate.evidenceGate,
+        syncTargets: gate.syncTargets,
+        nextCommand: gate.nextCommand,
+        reason: gate.reason,
+    })));
+    if (blockedGates.length === 0)
+        return;
+    const blockedTargets = [...new Set(blockedGates.flatMap((gate) => gate.syncTargets
+            .map(canonicalOrganizationSyncTarget)
+            .filter((target) => requestedTargets.has(target))))].sort().join(", ");
+    const primaryCommand = organizationPrimarySyncBlockCommand(blockedGates);
+    process.stderr.write("Organization rollout gate:\n");
+    process.stderr.write(`  Status: blocked for ${blockedTargets}\n`);
+    process.stderr.write(`  Primary command: ${primaryCommand}\n`);
+    process.stderr.write("  Blocked assets:\n");
+    for (const gate of blockedGates.slice(0, 5)) {
+        process.stderr.write(`    - ${gate.project}/${gate.asset}: ${gate.reason}\n`);
+        process.stderr.write(`      next: ${gate.nextCommand}\n`);
+    }
+    process.stderr.write(`  Resolve before sync: ${primaryCommand}\n`);
+    process.stderr.write("  Recheck before sync: dna org rollout\n");
+    process.stderr.write("  Boundary: adapter output below is diagnostic until organization rollout shows the target ready.\n");
+}
+function organizationPrimarySyncBlockCommand(blockedGates) {
+    const hasOpenEvidence = blockedGates.some((gate) => gate.evidenceGate === "open");
+    if (hasOpenEvidence)
+        return blockedGates[0]?.nextCommand ?? "dna org review";
+    const hasMissingConfiguration = blockedGates.some((gate) => gate.evidenceGate !== "open" &&
+        gate.nextCommand.startsWith("dna init --template "));
+    if (hasMissingConfiguration)
+        return "dna org configure-plan";
+    return blockedGates[0]?.nextCommand ?? "dna org review";
+}
 async function generateLockFile(lockPath, dnaSources, outputFiles, provenance, compiledIrHash) {
     const outputs = {};
     for (const f of outputFiles) {
@@ -333,10 +448,152 @@ async function generateLockFile(lockPath, dnaSources, outputFiles, provenance, c
     await mkdir(dirname(lockPath), { recursive: true });
     await writeFileAsync(lockPath, JSON.stringify(lock, null, 2) + "\n", "utf-8");
 }
+function syncRegistryHealth(inspection) {
+    if (!inspection.registry)
+        return "missing_registry";
+    if (inspection.totals.missing > 0 || inspection.totals.drifted > 0 || inspection.totals.untracked > 0) {
+        return "attention_required";
+    }
+    return "ok";
+}
+function syncRegistryCommandEffects() {
+    return {
+        mutation_performed: false,
+        network_performed: false,
+        runtime_authority: false,
+        syncs_harness: false,
+        executes_workflow: false,
+    };
+}
+function syncRegistryBoundaries() {
+    return [
+        "dna sync status and doctor inspect local registry artifacts only.",
+        "They do not execute workflows or make allow/warn/block/validate decisions.",
+        "They do not call Online, Supabase, marketplace, or hidden transport.",
+        "Runtime truth remains local dna/dna-hook and the synced harness artifacts.",
+    ];
+}
+function syncRegistryNextCommands(status) {
+    if (status === "missing_registry")
+        return ["dna sync --dry-run", "dna sync"];
+    if (status === "attention_required")
+        return ["dna sync", "dna sync doctor", "dna sync remove --dry-run"];
+    return ["dna sync doctor", "dna sync remove --dry-run"];
+}
+function printSyncRegistryStatus(json = false, projectDir = process.cwd()) {
+    return inspectSyncArtifactRegistry(projectDir).then((inspection) => {
+        if (json) {
+            const status = syncRegistryHealth(inspection);
+            const packet = {
+                schema_version: "intentdna.sync_status.v1",
+                mode: "sync_registry_status",
+                status,
+                ok: status === "ok",
+                projectDir,
+                commandEffects: syncRegistryCommandEffects(),
+                boundaries: syncRegistryBoundaries(),
+                nextCommands: syncRegistryNextCommands(status),
+                ...inspection,
+            };
+            process.stdout.write(JSON.stringify(packet, null, 2) + "\n");
+            return inspection.registry ? 0 : 1;
+        }
+        if (!inspection.registry) {
+            process.stderr.write(`No sync artifact registry found at ${inspection.registryPath}\n`);
+            process.stderr.write("Run `dna sync` to install runtime artifacts before checking status.\n");
+            return 1;
+        }
+        process.stderr.write("IntentDNA sync artifact status\n");
+        process.stderr.write(`Registry: ${inspection.registryPath}\n`);
+        process.stderr.write(`Synced: ${inspection.registry.syncedAt}\n`);
+        process.stderr.write(`DNA sources: ${inspection.registry.template.sourceDnaIds.join(", ") || "unknown"}\n`);
+        process.stderr.write(`Artifacts: ${inspection.totals.artifacts} total, ${inspection.totals.ok} ok, ${inspection.totals.missing} missing, ${inspection.totals.drifted} drifted, ${inspection.totals.untracked} untracked\n`);
+        for (const artifact of inspection.artifacts) {
+            process.stderr.write(`  - [${artifact.status}] ${artifact.relativePath} (${artifact.kind}, ${artifact.ownership})\n`);
+            if (artifact.status !== "ok")
+                process.stderr.write(`    ${artifact.reason}\n`);
+        }
+        return inspection.totals.missing > 0 || inspection.totals.drifted > 0 ? 1 : 0;
+    });
+}
+async function runSyncRegistryDoctor(json = false, projectDir = process.cwd()) {
+    const inspection = await inspectSyncArtifactRegistry(projectDir);
+    const ok = !!inspection.registry && inspection.totals.missing === 0 && inspection.totals.drifted === 0;
+    if (json) {
+        const status = syncRegistryHealth(inspection);
+        const packet = {
+            schema_version: "intentdna.sync_doctor.v1",
+            mode: "sync_registry_doctor",
+            status,
+            ok,
+            projectDir,
+            commandEffects: syncRegistryCommandEffects(),
+            boundaries: syncRegistryBoundaries(),
+            nextCommands: syncRegistryNextCommands(status),
+            ...inspection,
+        };
+        process.stdout.write(JSON.stringify(packet, null, 2) + "\n");
+        return ok ? 0 : 1;
+    }
+    if (!inspection.registry) {
+        process.stderr.write(`Sync doctor: no registry found at ${inspection.registryPath}\n`);
+        process.stderr.write("Next: run `dna sync` for the target project.\n");
+        return 1;
+    }
+    process.stderr.write(`Sync doctor: ${ok ? "ok" : "attention required"}\n`);
+    process.stderr.write(`Registry: ${inspection.registryPath}\n`);
+    if (ok) {
+        process.stderr.write(`All ${inspection.totals.artifacts} artifact(s) match the last sync.\n`);
+        return 0;
+    }
+    for (const artifact of inspection.artifacts.filter((entry) => entry.status !== "ok")) {
+        process.stderr.write(`  - [${artifact.status}] ${artifact.relativePath}: ${artifact.reason}\n`);
+    }
+    process.stderr.write("Next: rerun `dna sync` to repair drift, or `dna sync remove` to clean safe IntentDNA-owned artifacts.\n");
+    return 1;
+}
+async function runSyncRegistryRemove(opts) {
+    const result = await removeSyncArtifacts({ dryRun: opts.dryRun, projectDir: opts.projectDir });
+    if (opts.json) {
+        process.stdout.write(JSON.stringify(result, null, 2) + "\n");
+        return 0;
+    }
+    process.stderr.write(opts.dryRun ? "Dry-run registry remove plan:\n" : "IntentDNA registry remove:\n");
+    if (result.removed.length === 0) {
+        process.stderr.write("  No safe registry-tracked artifacts removed.\n");
+    }
+    else {
+        for (const path of result.removed)
+            process.stderr.write(`  removed: ${path}\n`);
+    }
+    for (const skipped of result.skipped) {
+        process.stderr.write(`  skipped: ${skipped.path} (${skipped.reason})\n`);
+    }
+    if (result.preservation.kept.length > 0) {
+        process.stderr.write("Preserved files:\n");
+        for (const kept of result.preservation.kept) {
+            process.stderr.write(`  - ${kept.path}\n`);
+            process.stderr.write(`    reason: ${kept.reason}\n`);
+            process.stderr.write(`    why: ${kept.explanation}\n`);
+        }
+        process.stderr.write("Next safe checks:\n");
+        for (const command of result.preservation.nextCommands)
+            process.stderr.write(`  - ${command}\n`);
+    }
+    process.stderr.write(`Boundary: ${result.boundary}.\n`);
+    return 0;
+}
 export async function runSync(opts) {
+    const projectDir = resolve(opts.projectDir ?? process.cwd());
+    if (opts.action === "status")
+        return printSyncRegistryStatus(opts.json, projectDir);
+    if (opts.action === "doctor")
+        return runSyncRegistryDoctor(opts.json, projectDir);
+    if (opts.action === "remove-registry")
+        return runSyncRegistryRemove({ ...opts, projectDir });
     // ── Auto-detect mode: zero-config when no files/outputs specified ──
     if (!opts.remove && opts.files.length === 0) {
-        const autoFiles = await autoDetectConfigs();
+        const autoFiles = await autoDetectConfigs(projectDir);
         if (autoFiles.length > 0) {
             opts.files = autoFiles;
             if (autoFiles.length === 1) {
@@ -351,16 +608,19 @@ export async function runSync(opts) {
             }
         }
     }
-    if (!opts.remove && !opts.inject && !opts.hooksDir && !opts.agentsDir && !opts.workflowDir && !opts.skillsDir && !opts.settingsPath) {
+    if (!opts.remove && opts.codex && !opts.skillsDir) {
+        opts.skillsDir = resolve(projectDir, ".agents", "skills");
+        process.stderr.write("Codex workflow projection: .agents/skills\n");
+    }
+    if (!opts.remove && !opts.inject && !opts.hooksDir && !opts.agentsDir && !opts.workflowDir && !opts.skillsDir && !opts.settingsPath && !opts.codex) {
         // Auto-detect Claude Code environment → fill all outputs
-        const cwd = process.cwd();
-        const hasClaudeDir = await fileExists(resolve(cwd, ".claude"));
-        const hasClaudeMd = await fileExists(resolve(cwd, "CLAUDE.md"));
+        const hasClaudeDir = await fileExists(resolve(projectDir, ".claude"));
+        const hasClaudeMd = await fileExists(resolve(projectDir, "CLAUDE.md"));
         if (hasClaudeDir || hasClaudeMd || opts.files.length > 0) {
-            opts.inject = resolve(cwd, "CLAUDE.md");
-            opts.agentsDir = resolve(cwd, ".claude", "agents");
-            opts.skillsDir = resolve(cwd, ".claude", "skills");
-            opts.settingsPath = resolve(cwd, ".claude", "settings.json");
+            opts.inject = resolve(projectDir, "CLAUDE.md");
+            opts.agentsDir = resolve(projectDir, ".claude", "agents");
+            opts.skillsDir = resolve(projectDir, ".claude", "skills");
+            opts.settingsPath = resolve(projectDir, ".claude", "settings.json");
             process.stderr.write(`Auto-detect: Claude Code → CLAUDE.md + agents + skills + settings\n`);
         }
     }
@@ -373,8 +633,8 @@ export async function runSync(opts) {
     opts.plugin = resolvedMode === "plugin";
     // Handle --remove
     if (opts.remove) {
-        if (!opts.inject && !opts.hooksDir && !opts.agentsDir && !opts.workflowDir && !opts.skillsDir) {
-            process.stderr.write("Error: --inject, --hooks, --agents, --workflow, or --skills is required with --remove\n");
+        if (!opts.inject && !opts.hooksDir && !opts.agentsDir && !opts.workflowDir && !opts.skillsDir && !opts.codex) {
+            process.stderr.write("Error: --inject, --hooks, --agents, --workflow, --skills, or --codex is required with --remove\n");
             return 2;
         }
         if (opts.inject) {
@@ -387,9 +647,9 @@ export async function runSync(opts) {
             }
         }
         if (opts.hooksDir) {
-            const count = await removeLegacyBashHooks(opts.hooksDir);
-            if (count > 0) {
-                process.stderr.write(`Removed ${count} legacy bash hook(s) from ${opts.hooksDir}\n`);
+            const removed = await removeLegacyBashHooks(opts.hooksDir);
+            if (removed.length > 0) {
+                process.stderr.write(`Removed ${removed.length} legacy bash hook(s) from ${opts.hooksDir}\n`);
             }
             else {
                 process.stderr.write(`No legacy bash hooks found in ${opts.hooksDir}\n`);
@@ -422,14 +682,23 @@ export async function runSync(opts) {
                 process.stderr.write(`No Intent DNA skill dirs found in ${opts.skillsDir}\n`);
             }
         }
+        if (opts.codex) {
+            const removed = await removeCodexSyncTargetArtifacts(projectDir);
+            if (removed.length > 0) {
+                process.stderr.write(`Removed ${removed.length} Intent DNA Codex adapter artifact(s)\n`);
+            }
+            else {
+                process.stderr.write("No Intent DNA Codex adapter artifacts found\n");
+            }
+        }
         return 0;
     }
     if (opts.files.length === 0) {
         process.stderr.write("Error: no DNA files specified\n");
         return 2;
     }
-    if (!opts.inject && !opts.hooksDir && !opts.agentsDir && !opts.workflowDir && !opts.skillsDir && !opts.settingsPath) {
-        process.stderr.write("Error: --inject <path>, --hooks <dir>, --agents <dir>, --workflow <dir>, --skills <dir>, or --settings <path> is required\n");
+    if (!opts.inject && !opts.hooksDir && !opts.agentsDir && !opts.workflowDir && !opts.skillsDir && !opts.settingsPath && !opts.codex) {
+        process.stderr.write("Error: --inject <path>, --hooks <dir>, --agents <dir>, --workflow <dir>, --skills <dir>, --settings <path>, or --codex is required\n");
         return 2;
     }
     if (opts.inject && !VALID_TARGETS.includes(opts.target)) {
@@ -437,6 +706,22 @@ export async function runSync(opts) {
         return 2;
     }
     const target = opts.target;
+    opts.files = opts.files.map((file) => resolve(projectDir, file));
+    if (opts.inject)
+        opts.inject = resolve(projectDir, opts.inject);
+    if (opts.hooksDir)
+        opts.hooksDir = resolve(projectDir, opts.hooksDir);
+    if (opts.agentsDir)
+        opts.agentsDir = resolve(projectDir, opts.agentsDir);
+    if (opts.workflowDir)
+        opts.workflowDir = resolve(projectDir, opts.workflowDir);
+    if (opts.skillsDir)
+        opts.skillsDir = resolve(projectDir, opts.skillsDir);
+    if (opts.settingsPath)
+        opts.settingsPath = resolve(projectDir, opts.settingsPath);
+    if (opts.lockFile)
+        opts.lockFile = resolve(projectDir, opts.lockFile);
+    await writeOrganizationRolloutGateIfBlocked(opts, projectDir);
     try {
         // Track all output file paths for lock file generation
         const trackedOutputs = [];
@@ -489,65 +774,32 @@ export async function runSync(opts) {
                     process.stderr.write(`No changes needed in ${opts.inject}\n`);
                 }
             }
-            trackSyncOutput(trackedOutputs, "markdown-injection", opts.inject);
+            trackSyncOutput(trackedOutputs, "markdown-injection", opts.inject, {
+                kind: "markdown_injection",
+                target: "markdown",
+                ownership: "owned_block",
+                trackedByLock: true,
+            });
         }
-        // Step 3.5: Write compiled IR (needed for both plugin and bin mode)
+        // Step 3.5: Execute Claude Code core target plan (compiled IR, MCP, settings hooks)
         {
-            const cwd = process.cwd();
-            const dnas = loadedDNAs;
-            const cascadedForIR = cascadeDNA(dnas);
-            const roles = cascadedForIR.roles;
-            const compiled = createCompiledIR(ir, roles);
-            const irPath = resolve(cwd, ".dna", "compiled", "ir.json");
-            if (opts.dryRun) {
-                JSON.stringify(compiled);
-                process.stderr.write(`Dry-run: would write compiled IR: ${irPath}\n`);
-            }
-            else {
-                const writtenIrPath = await writeCompiledIR(cwd, compiled);
-                process.stderr.write(`Wrote compiled IR: ${writtenIrPath}\n`);
-            }
-            trackSyncOutput(trackedOutputs, "compiled-ir", irPath);
-            // Clean up old bash hooks if they exist
-            const oldHooksDir = resolve(cwd, ".claude", "hooks");
+            const cascadedForCore = cascadeDNA(loadedDNAs);
+            const claudeCorePlan = createClaudeCoreSyncTargetPlan({
+                projectDir,
+                ir,
+                roles: cascadedForCore.roles,
+                mode: opts.plugin ? "plugin" : "bin",
+                settingsPath: opts.settingsPath,
+            });
             if (opts.dryRun) {
-                process.stderr.write(`Dry-run: would clean legacy bash hooks in ${oldHooksDir}\n`);
+                process.stderr.write(formatClaudeCoreSyncTargetPlanDryRun(claudeCorePlan));
             }
             else {
-                const removed = await removeLegacyBashHooks(oldHooksDir);
-                if (removed > 0) {
-                    process.stderr.write(`Cleaned ${removed} legacy bash hook(s) from ${oldHooksDir}\n`);
-                }
-            }
-            // G2/G3: Register built-in DNA MCP server in .claude/.mcp.json
-            const mcpPath = resolve(cwd, ".claude", ".mcp.json");
-            if (opts.dryRun) {
-                process.stderr.write(`Dry-run: would register dna-mcp server in ${mcpPath}\n`);
+                const result = await executeClaudeCoreSyncTargetPlan(claudeCorePlan, projectDir);
+                for (const message of result.messages)
+                    process.stderr.write(`${message}\n`);
             }
-            else {
-                await registerDNAMCPServer(cwd);
-            }
-            trackSyncOutput(trackedOutputs, "mcp-config", mcpPath);
-        }
-        // Step 3.6: Register hooks in settings.json (bin mode only)
-        // Plugin mode: hooks managed by plugin framework — skip settings.json
-        if (!opts.plugin && opts.settingsPath) {
-            const enabledEvents = detectEnabledEvents(ir);
-            if (enabledEvents.length > 0) {
-                const pluginSettings = compilePluginSettings(enabledEvents, 10, recommendHookTimeouts(ir));
-                if (opts.dryRun) {
-                    JSON.stringify(pluginSettings);
-                    process.stderr.write(`Dry-run: would register ${enabledEvents.length} hook event(s) in ${opts.settingsPath}\n`);
-                }
-                else {
-                    await mergeSettingsFile(pluginSettings, opts.settingsPath);
-                    process.stderr.write(`Bin mode: registered ${enabledEvents.length} hook event(s) in ${opts.settingsPath}\n`);
-                }
-                trackSyncOutput(trackedOutputs, "settings-hooks", opts.settingsPath);
-            }
-        }
-        else if (opts.plugin && opts.settingsPath) {
-            process.stderr.write(`Plugin mode: hooks managed by plugin framework (skipping settings.json)\n`);
+            trackSyncTargetPlanOutputs(trackedOutputs, claudeCorePlan, projectDir);
         }
         // Extract active namespaces from loaded DNAs for namespace-scoped cleanup
         const activeNamespaces = loadedDNAs
@@ -572,7 +824,8 @@ export async function runSync(opts) {
                 process.stderr.write(`No roles defined in DNA files\n`);
             }
             else {
-                const results = compileAllRolesToAgentMD(roles, ir);
+                const agentRoles = Object.fromEntries(Object.entries(roles).filter(([, role]) => !["human", "interactive"].includes(role.model?.trim().toLowerCase() ?? "")));
+                const results = compileAllRolesToAgentMD(agentRoles, ir);
                 const written = results.map((result) => resolve(opts.agentsDir, result.fileName));
                 if (opts.dryRun) {
                     process.stderr.write(`Dry-run: would generate ${written.length} agent file(s) in ${opts.agentsDir}\n`);
@@ -585,7 +838,13 @@ export async function runSync(opts) {
                     }
                 }
                 for (const file of written)
-                    trackSyncOutput(trackedOutputs, "agents", file);
+                    trackSyncOutput(trackedOutputs, "agents", file, {
+                        kind: "agent_md",
+                        target: "claude_code",
+                        adapter: "claude_code",
+                        ownership: "intentdna_owned",
+                        trackedByLock: true,
+                    });
             }
         }
         // Step 6: Generate workflow script(s)
@@ -624,13 +883,19 @@ export async function runSync(opts) {
                             await writeWorkflowScript(shellResult, opts.workflowDir);
                             process.stderr.write(`Generated workflow script: ${written}\n`);
                         }
-                        trackSyncOutput(trackedOutputs, "workflows", written);
+                        trackSyncOutput(trackedOutputs, "workflows", written, {
+                            kind: "workflow_script",
+                            target: "generic",
+                            ownership: "intentdna_owned",
+                            trackedByLock: true,
+                        });
                     }
                 }
             }
         }
         // Step 7: Generate skill files from workflows
         if (opts.skillsDir) {
+            const skillSurface = opts.codex ? "codex_cli" : "claude_code";
             // Clean stale DNA-managed skills before regenerating
             if (opts.dryRun) {
                 process.stderr.write(`Dry-run: would clean stale skill dir(s) in ${opts.skillsDir}\n`);
@@ -654,16 +919,15 @@ export async function runSync(opts) {
             }
             const configPath = opts.files.length === 1 ? opts.files[0] : null;
             const variables = await resolveVariables(rawVars, configPath, { dryRun: opts.dryRun });
-            // Step 8: Generate .claude/.mcp.json from MCP dependencies (inside skillsDir block, shares variables)
-            {
+            // Step 8: Generate .claude/.mcp.json only for Claude Code skills.
+            if (skillSurface === "claude_code") {
                 const mcpDeps = {};
                 for (const d of dnas) {
                     if (d.mcp)
                         Object.assign(mcpDeps, d.mcp);
                 }
                 if (Object.keys(mcpDeps).length > 0) {
-                    const cwd = process.cwd();
-                    const mcpJsonPath = resolve(cwd, ".claude", ".mcp.json");
+                    const mcpJsonPath = resolve(projectDir, ".claude", ".mcp.json");
                     if (opts.dryRun) {
                         process.stderr.write(`Dry-run: would write ${Object.keys(mcpDeps).length} MCP server(s) to ${mcpJsonPath}\n`);
                     }
@@ -681,11 +945,19 @@ export async function runSync(opts) {
                 for (const [name, wfDef] of Object.entries(workflows)) {
                     const result = compileWorkflow(wfDef, { workflow_key: name });
                     if (result.ok) {
-                        skillResults.push(compileWorkflowToSkill(result.plan, roles, ir, variables));
+                        skillResults.push(compileWorkflowToSkill(result.plan, roles, ir, variables, { surface: skillSurface }));
+                    }
+                }
+                if (skillSurface === "claude_code") {
+                    for (const [name, controllerDef] of Object.entries(controllers)) {
+                        const controllerKind = getControllerKindMetadata(controllerDef.kind);
+                        if (controllerKind?.supportsSkillGeneration) {
+                            skillResults.push(compileControllerToSkill(name, controllerDef, variables, workflows));
+                        }
                     }
                 }
-                for (const [name, controllerDef] of Object.entries(controllers)) {
-                    skillResults.push(compileControllerToSkill(name, controllerDef, variables, workflows));
+                else if (Object.keys(controllers).length > 0) {
+                    process.stderr.write("codex_cli unsupported: controller_skill_projection\n");
                 }
                 if (skillResults.length > 0) {
                     let written = skillResults.flatMap((result) => {
@@ -708,7 +980,13 @@ export async function runSync(opts) {
                         }
                     }
                     for (const file of written)
-                        trackSyncOutput(trackedOutputs, "skills-controllers", file);
+                        trackSyncOutput(trackedOutputs, "skills-controllers", file, {
+                            kind: "skill_controller",
+                            target: skillSurface,
+                            adapter: skillSurface,
+                            ownership: "intentdna_owned",
+                            trackedByLock: true,
+                        });
                 }
             }
         }
@@ -717,7 +995,26 @@ export async function runSync(opts) {
         const gateCount = ir.pre_execution_gates.length;
         const filterCount = ir.tool_filters.length;
         process.stderr.write(`  ${directiveCount} directives, ${gateCount} gates, ${filterCount} filters\n`);
-        // Step 9: Generate .dna/lock file (only when --lock is specified or outputs exist)
+        // Step 9: Generate Codex CLI adapter artifacts
+        if (opts.codex) {
+            const packageVersion = await getPackageVersion() ?? "0.1.0";
+            const codexPlan = createCodexSyncTargetPlan(ir, {
+                hookInstallMode: opts.codexInstallMode ?? "project_fallback",
+                packageVersion,
+            });
+            if (opts.dryRun) {
+                process.stderr.write(`Dry-run: would write Codex CLI adapter artifacts (${codexPlan.hookInstallMode})\n`);
+                process.stderr.write(formatCodexSyncTargetPlanSummary(codexPlan));
+            }
+            else {
+                const written = await executeCodexSyncTargetPlan(codexPlan, { projectDir, dogfood: opts.codexDogfood });
+                process.stderr.write(`Generated ${written.length} Codex CLI adapter artifact(s)\n`);
+                for (const f of written)
+                    process.stderr.write(`  ${f}\n`);
+            }
+            trackSyncTargetPlanOutputs(trackedOutputs, codexPlan, projectDir);
+        }
+        // Step 10: Generate .dna/lock file (only when --lock is specified or outputs exist)
         if (opts.lockFile && trackedOutputs.length > 0) {
             const lockPath = resolve(opts.lockFile);
             if (opts.dryRun) {
@@ -727,11 +1024,35 @@ export async function runSync(opts) {
                 await generateLockFile(lockPath, opts.files, lockTrackedOutputPaths(trackedOutputs), ir.provenance, ir.compiled_ir_hash);
                 process.stderr.write(`Lock file: ${lockPath}\n`);
             }
-            trackSyncOutput(trackedOutputs, "lock-file", lockPath);
+            trackSyncOutput(trackedOutputs, "lock-file", lockPath, {
+                kind: "sync_lock_file",
+                target: "generic",
+                ownership: "diagnostic",
+                trackedByLock: false,
+            });
+        }
+        let registryArtifacts = 0;
+        if (!opts.dryRun && trackedOutputs.length > 0) {
+            const packageVersion = await getPackageVersion() ?? undefined;
+            const registry = await writeSyncArtifactRegistry({
+                projectDir,
+                dnaVersion: packageVersion,
+                template: {
+                    sourceDnaIds: ir.source_dna_ids,
+                    configFiles: expandedFiles.map((file) => resolve(file)),
+                    compiledIrHash: ir.compiled_ir_hash,
+                },
+                artifacts: trackedOutputs,
+            });
+            registryArtifacts = registry.artifacts.length;
+            process.stderr.write(`Sync artifact registry: ${resolve(projectDir, ".dna", "sync", "registry.json")} (${registry.artifacts.length} artifact(s))\n`);
         }
         if (opts.dryRun || opts.postSummary) {
             summarizeSyncOutputs(trackedOutputs, opts.dryRun === true);
         }
+        if (opts.json) {
+            process.stdout.write(JSON.stringify(buildSyncRunJsonResult(opts, projectDir, expandedFiles.map((file) => resolve(file)), trackedOutputs, registryArtifacts), null, 2) + "\n");
+        }
         return 0;
     }
     catch (err) {
@@ -787,29 +1108,3 @@ async function writeMCPConfig(mcpDeps, mcpJsonPath, variables) {
 function substituteVariables(template, vars) {
     return template.replace(/\{\{(\w+)\}\}/g, (_, key) => vars[key] ?? `{{${key}}}`);
 }
-/**
- * G2/G3: Register the built-in DNA MCP server (dna-mcp) in .claude/.mcp.json.
- * Idempotent: only adds if not already present.
- */
-async function registerDNAMCPServer(cwd) {
-    const mcpJsonPath = resolve(cwd, ".claude", ".mcp.json");
-    let existing = {};
-    try {
-        const raw = await readFile(mcpJsonPath, "utf-8");
-        existing = JSON.parse(raw);
-    }
-    catch { /* doesn't exist yet */ }
-    const mcpServers = (existing.mcpServers ?? {});
-    // Don't overwrite if user already configured it
-    if (mcpServers["intentdna"])
-        return mcpJsonPath;
-    mcpServers["intentdna"] = {
-        command: "dna-mcp",
-        args: ["--project-dir", cwd],
-    };
-    existing.mcpServers = mcpServers;
-    await mkdir(dirname(mcpJsonPath), { recursive: true });
-    await writeFileAsync(mcpJsonPath, JSON.stringify(existing, null, 2) + "\n", "utf-8");
-    process.stderr.write(`MCP: registered dna-mcp server in ${mcpJsonPath}\n`);
-    return mcpJsonPath;
-}