Shipped the intelligence-authoring rule + intelligence-architect agent, layout tokens, and evidence-driven skill bootstrap (0.7.0)

[dzykovic]

Summary

The engine stops being only a pipeline and starts shipping its own authoring discipline: intelligence-authoring (a rule the model respects while it works, path-scoped to the umbrella so it costs nothing otherwise) and intelligence-architect (an agent that owns the layer's shape — what to split, what to fold, what to delete). Both live in the module beside the meta-skills, so update.sh owns them and they evolve with the engine instead of drifting inside each project. Making that possible required one new engine capability — an engine-shipped artifact cannot hardcode the umbrella's folder name, because the project chooses it, so scoped rules now write paths: ["<umbrella>/**"] and every adapter expands the token on the way out. Finally, INIT's skill guidance is rewritten: it used to hand the bootstrapping agent a catalogue of plausible skill names, which produced registries describing software in general rather than the repository in front of it.

Type of change

• Bug fix (adapters silently shipped whatever tokens a source used; now a single, enforced output gate)
• New adapter
• New helper / skill (finalize_output_file; intelligence-authoring rule + intelligence-architect agent; migrate_to_0_7_0)
• Documentation
• Refactor (no behavior change)

What changed

Area	Change
Rule	<module>/rules/intelligence-authoring.md — which artifact type a piece of knowledge belongs to (a checklist in an agent body is a procedure: it belongs in a skill), why always-on rules must earn their place, why an agent is thin and never restates rules it already receives, why a skill without a verification step is not a skill. Includes the invariant that closes the loop on the defect behind 0.6.0: never state behaviour of a tool you have not verified in its documentation or source.
Agent	<module>/agents/intelligence-architect.md — decides rule vs skill vs agent, always-on vs scoped, split vs fold, what to delete. Carries boundaries and verification only; the rule reaches it on its own.
Layout tokens	<umbrella> → Intelligence, <module> → Intelligence/sync, expanded in frontmatter and body by finalize_output_file (replaces normalize_file_to_lf at every output site). So one source rule lands as Claude paths:, Cursor globs:, Copilot applyTo: carrying the project's real folder name.
update.sh	Owns the module's rules/ and agents/ like it already owns docs/ and the meta-skills: staged from the clone, shown in the diff before the confirmation prompt, then applied. Your <umbrella>/rules and <umbrella>/agents are never touched.
INIT §3.5	Catalogue of skill names replaced by four bars a candidate must clear — repeated (name the instance in the repo as evidence), multi-step and mechanical, verifiable (if nothing proves it worked, it is not a skill), stable (a workaround for a current bug belongs in a rule recording known breakage, not in a skill that makes it permanent). Bootstrap now targets 0–3 skills, with zero stated as a legitimate answer.
Examples	go-api-with-opencode never registered the module's skills/ at all — fixed. All six now register the module's rules/, agents/, skills/.

Breaking change + migration

config.yaml must list the module's rules/ and agents/ under sources — otherwise the engine's own artifacts never reach the IDEs. migrate_to_0_7_0 adds both entries idempotently; nothing else in config.yaml is read or rewritten. sync.sh fails closed (IS_STATUS=needs-update) until the update flow runs — it never migrates. _mig_add_skill_source is generalized to _mig_add_source <config> <section> <entry>, with the old name kept as a shim (a shipped migration is never rewritten).

Verification

• bash intelligence/sync/scripts/sync.sh runs cleanly (IS_STATUS=ok) against all six examples/* (run on Linux via WSL, since Git Bash silently degrades some POSIX behaviour)
• lint_frontmatter produces no new warnings
• shellcheck --severity=warning clean over all engine scripts (it caught an SC2115 rm -rf "$VAR/$VAR" in my new update.sh block — fixed with :?)
• repo-purity mirrored locally: vendored docs identical, VERSION / INIT.md / all six examples stamped 0.7.0
• Documentation updated (README.md, docs/CONVENTIONS.md, docs/ADAPTERS.md, intelligence/sync/INIT.md, CHANGELOG.md with a ### Breaking section carrying verifiable post-conditions)
• Adapter changes tested with an actual IDE — not done; verification is on generated output across all seven channels

End-to-end update from a real 0.6.0 project (local git upstream, update.sh --yes): IS_STATUS=migrated, then every post-condition from the CHANGELOG checked — sources.rules/sources.agents gained exactly one entry each, both engine artifacts present, stamp 0.7.0, the project's own rules/context.md and agents/my-dev.md untouched, and after sync the rule reached .claude/rules/ with zero leaked tokens.

Token expansion, per channel (umbrella deliberately named Intelligence/, capital I): Claude paths: ["Intelligence/**"], Cursor globs: ["Intelligence/**"], Copilot applyTo: "intelligence/**", Pi rule copy, Codex TOML, opencode subagent, and AGENTS.md links — all expanded, grep -rl '<umbrella>\|<module>' across every generated channel returns nothing.

Migration is idempotent: re-running adds no duplicate source entries and reports IS_MIGRATED=0.

Notes for reviewers

• New CI gate: the smoke job now fails if any generated output still contains a literal <umbrella> / <module>. That is the enforcement behind the adapter contract — an adapter that writes a file without finalize_output_file is now caught by the build rather than by a user seeing <umbrella> in their IDE.
• Why a rule and not just docs. CONVENTIONS.md is reference material the model may or may not open; a path-scoped rule is loaded automatically the moment someone touches the layer, and costs nothing the rest of the time. The mechanics stay in CONVENTIONS.md — the rule carries only the judgement.
• Naming. intelligence- is the reserved prefix (the updater prunes what matches it), so the engine's own rule and agent live inside it: intelligence-authoring says what it governs, and intelligence-architect follows the existing <domain>-<role> shape.
• A separate follow-up will fix skills failing to load in Claude/Copilot (argument-hint parsed as a YAML list when unquoted; over-long description). Deliberately not in this branch.

[Copilot]

Pull request overview

This PR releases intelligence-sync 0.7.0, adding engine-owned “authoring discipline” artifacts (a scoped rule + an architect agent) and introducing <umbrella> / <module> layout tokens that are expanded at adapter output time to avoid hardcoding the umbrella folder name.

Changes:

• Add engine-owned rules/ + agents/ to the module, update bootstrap/INIT and examples to register them as sources.
• Introduce finalize_output_file() to expand layout tokens and normalize line endings; update built-in adapters to use it.
• Add a 0.7.0 migration and CI enforcement to ensure engine artifacts reach outputs and no literal tokens leak.

Reviewed changes

Copilot reviewed 28 out of 28 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
README.md	Documents module now shipping rules/ and agents/ directories.
intelligence/sync/scripts/VERSION	Bumps engine version to 0.7.0.
intelligence/sync/scripts/update.sh	Stages/applies engine-owned rules/ + agents/ during updates and shows diffs.
intelligence/sync/scripts/sync.sh	Exports repo-relative layout token values for adapters to expand.
intelligence/sync/scripts/lib/migrations.sh	Adds 0.7.0 migration and generalizes source registration helper.
intelligence/sync/scripts/lib/common.sh	Adds finalize_output_file() and switches bundle handling to use it.
intelligence/sync/scripts/adapters/pi.sh	Uses finalize_output_file() on generated outputs.
intelligence/sync/scripts/adapters/opencode.sh	Uses finalize_output_file() on generated outputs.
intelligence/sync/scripts/adapters/cursor.sh	Uses finalize_output_file() on generated outputs.
intelligence/sync/scripts/adapters/copilot.sh	Uses finalize_output_file() on generated outputs.
intelligence/sync/scripts/adapters/codex.sh	Uses finalize_output_file() on generated outputs.
intelligence/sync/scripts/adapters/claude.sh	Uses finalize_output_file() on generated outputs.
intelligence/sync/scripts/adapters/agents.sh	Uses exported layout token values and finalizes AGENTS.md.
intelligence/sync/rules/intelligence-authoring.md	New engine-owned, umbrella-scoped authoring discipline rule using layout tokens.
intelligence/sync/INIT.md	Updates bootstrap guidance and registers module rules/ + agents/ sources.
intelligence/sync/docs/CONVENTIONS.md	Documents module-shipped rule/agent and layout token system.
intelligence/sync/docs/ADAPTERS.md	Documents finalize_output_file() and layout token requirements for adapters.
intelligence/sync/agents/intelligence-architect.md	New engine-owned agent for designing/pruning the intelligence layer.
examples/with-remote-skills/config.yaml	Updates to 0.7.0 and adds module rules/ + agents/ sources.
examples/platform-with-submodules/config.yaml	Updates to 0.7.0 and adds module rules/ + agents/ sources.
examples/go-api/config.yaml	Updates to 0.7.0 and adds module rules/ + agents/ sources.
examples/go-api-with-pi-and-codex/config.yaml	Updates to 0.7.0 and adds module rules/ + agents/ sources.
examples/go-api-with-opencode/config.yaml	Updates to 0.7.0 and adds module rules/ + agents/ sources.
examples/dotnet-api-with-react-frontend/config.yaml	Updates to 0.7.0 and adds module rules/ + agents/ sources.
docs/CONVENTIONS.md	Mirrors the module conventions updates (rule/agent + layout tokens).
docs/ADAPTERS.md	Mirrors the module adapter docs updates (finalize + tokens).
CHANGELOG.md	Adds 0.7.0 release notes, including breaking change + postconditions.
.github/workflows/ci.yml	Adds CI gate to ensure engine artifacts reach outputs and no tokens leak.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[dzykovic]

Right, and it was worse than described — migrate_to_0_3_1 already carried the same basename assumption for its skills entry, so a nested umbrella has been registering a source that resolves nowhere since 0.3.1. Both now go through one helper, _mig_umbrella_rel, which asks git for the real repo-relative prefix (git -C "$umbrella" rev-parse --show-prefix) and falls back to basename only when there is no git — which is the flat case anyway.

Verified with an umbrella at platform/intelligence/: migration writes platform/intelligence/sync/rules and platform/intelligence/sync/agents, sync resolves them (IS_STATUS=ok), the engine rule lands in .claude/rules/, and its scope expands to paths: ["platform/intelligence/**"] — previously it would have written intelligence/sync/rules, pointing at nothing.

[dzykovic]

Fixed — the example adapter now calls finalize_output_file after writing each rule, with a comment saying why. A doc that demonstrates the token-leaking call is exactly how the next adapter would ship a literal <umbrella> into someone's IDE. (Both the source docs/ and the vendored intelligence/sync/docs/ copy, which CI asserts are identical.)

[dzykovic]

Fixed — the example adapter now calls finalize_output_file after writing each rule, with a comment saying why. A doc that demonstrates the token-leaking call is exactly how the next adapter would ship a literal <umbrella> into someone's IDE. (Both the source docs/ and the vendored intelligence/sync/docs/ copy, which CI asserts are identical.)