schemaVersion: "1.0"
kind: "aiox.enterprise.upgrade-manifest"

entitlement:
  required: true
  envVar: "AIOX_ENTERPRISE_KEY"
  testFixtureEnvVar: "AIOX_ENTERPRISE_TEST_FIXTURE"
  status: "not-checked"

groups:
  - id: "config"
    description: "Enterprise product and sync configuration."
    defaultPolicy: "merge-yaml"
  - id: "ide-surfaces"
    description: "IDE agent, command, hook, skill, and rule surfaces."
    defaultPolicy: "copy-if-missing"
  - id: "workspace-templates"
    description: "Workspace templates only; business-owned runtime data is preserved."
    defaultPolicy: "copy-if-missing"
  - id: "workspace-scripts"
    description: "Workspace helper scripts and system configuration."
    defaultPolicy: "hash-overwrite-with-backup"
  - id: "services"
    description: "Explicit Enterprise services only; no recursive services/** import."
    defaultPolicy: "copy-if-missing"
  - id: "squads"
    description: "Explicit squad bundles by squad slug."
    defaultPolicy: "copy-if-missing"
  - id: "governance"
    description: "Repository governance surfaces and validation rules."
    defaultPolicy: "copy-if-missing"
  - id: "docs"
    description: "Reference docs that do not contain project-local stories or runtime evidence."
    defaultPolicy: "copy-if-missing"

blockedPaths:
  - pattern: ".env*"
    action: "preserve"
    severity: "critical"
    reason: "Environment files can contain secrets and are project-owned."
  - pattern: "workspace/businesses/**"
    action: "preserve"
    severity: "critical"
    reason: "Business workspace data belongs to the target project."
  - pattern: "outputs/**"
    action: "preserve"
    severity: "high"
    reason: "Generated outputs are local runtime artifacts."
  - pattern: "docs/stories/**"
    action: "preserve"
    severity: "high"
    reason: "Story backlog is project-owned."
  - pattern: ".git/**"
    action: "deny"
    severity: "critical"
    reason: "Git internals must never be copied from Enterprise source."
  - pattern: "node_modules/**"
    action: "deny"
    severity: "critical"
    reason: "Dependencies must be installed, never migrated as files."
  - pattern: "**/*secret*"
    action: "deny"
    severity: "critical"
    reason: "Potential secret-bearing file."
  - pattern: "**/*credential*"
    action: "deny"
    severity: "critical"
    reason: "Potential credential-bearing file."
  - pattern: "**/*pii*"
    action: "deny"
    severity: "critical"
    reason: "Potential PII-bearing file."
  - pattern: "**/*founder*"
    action: "deny"
    severity: "high"
    reason: "Founder-specific data is not part of generic Enterprise migration."

allowlist:
  - path: "enterprise-config.yaml"
    group: "config"
    policy: "merge-yaml"
    required: true
    reason: "Enterprise product metadata and version gate."
  - path: ".aiox-sync.yaml"
    group: "config"
    policy: "merge-yaml"
    required: true
    reason: "Enterprise IDE sync policy."
  - path: "scripts/hub-sync.js"
    group: "workspace-scripts"
    policy: "hash-overwrite-with-backup"
    required: true
    reason: "Enterprise sync runtime used by apply/rollback slices."
  - path: "scripts/enterprise-sync.js"
    group: "workspace-scripts"
    policy: "hash-overwrite-with-backup"
    reason: "Enterprise distribution sync helper."
  - path: "scripts/enterprise-sanitize.js"
    group: "workspace-scripts"
    policy: "hash-overwrite-with-backup"
    reason: "Enterprise sanitization helper."
  - path: "workspace/_templates/**"
    group: "workspace-templates"
    policy: "copy-if-missing"
    reason: "Templates are reusable and do not carry target business data."
  - path: "workspace/scripts/**"
    group: "workspace-scripts"
    policy: "hash-overwrite-with-backup"
    reason: "Workspace automation can be upgraded with backups."
  - path: "services/service-catalog.yaml"
    group: "services"
    policy: "merge-yaml"
    reason: "Catalog is explicit metadata, not recursive service import."
  - path: "services/registry-engine/**"
    group: "services"
    policy: "copy-if-missing"
    reason: "Registry engine is an explicit Enterprise service."
  - path: "squads/repo-ops/**"
    group: "squads"
    policy: "copy-if-missing"
    reason: "Repo Ops is an explicit Enterprise squad bundle."
  - path: "squads/visual-knowledge-squad/**"
    group: "squads"
    policy: "copy-if-missing"
    reason: "Visual Knowledge is an explicit Enterprise squad bundle."
  - path: ".claude/agents/**"
    group: "ide-surfaces"
    policy: "copy-if-missing"
    reason: "Claude agent surface."
  - path: ".claude/commands/**"
    group: "ide-surfaces"
    policy: "copy-if-missing"
    reason: "Claude command surface."
  - path: ".claude/skills/**"
    group: "ide-surfaces"
    policy: "copy-if-missing"
    reason: "Claude skill surface."
  - path: ".claude/rules/**"
    group: "ide-surfaces"
    policy: "copy-if-missing"
    reason: "Claude rules surface."
  - path: ".codex/agents/**"
    group: "ide-surfaces"
    policy: "copy-if-missing"
    reason: "Codex local agent surface."
  - path: ".codex/skills/**"
    group: "ide-surfaces"
    policy: "copy-if-missing"
    reason: "Codex local skill surface."
  - path: ".grok/agents/**"
    group: "ide-surfaces"
    policy: "copy-if-missing"
    reason: "Grok Build agent surface."
  - path: ".grok/skills/**"
    group: "ide-surfaces"
    policy: "copy-if-missing"
    reason: "Grok Build skill surface."
  - path: ".grok/hooks/**"
    group: "ide-surfaces"
    policy: "copy-if-missing"
    reason: "Grok Build hooks (authority, synapse, precompact)."
  - path: ".grok/rules/**"
    group: "ide-surfaces"
    policy: "copy-if-missing"
    reason: "Grok Build always-on rules."
  - path: ".grok/config.toml"
    group: "ide-surfaces"
    policy: "copy-if-missing"
    reason: "Grok Build project config."
  - path: ".grok/roles/**"
    group: "ide-surfaces"
    policy: "copy-if-missing"
    reason: "Grok Build subagent role defaults."
  - path: ".grok/personas/**"
    group: "ide-surfaces"
    policy: "copy-if-missing"
    reason: "Grok Build persona overlays."
  - path: ".grok/README.md"
    group: "ide-surfaces"
    policy: "copy-if-missing"
    reason: "Grok Build integration documentation."
  - path: ".agents/agents/**"
    group: "ide-surfaces"
    policy: "copy-if-missing"
    reason: "Generic agent projection surface."
  - path: ".agents/skills/**"
    group: "ide-surfaces"
    policy: "copy-if-missing"
    reason: "Generic skill projection surface."
  - path: ".github/CODEOWNERS"
    group: "governance"
    policy: "copy-if-missing"
    reason: "Enterprise ownership policy is copied only if the target has none."
  - path: "docs/reference/**"
    group: "docs"
    policy: "copy-if-missing"
    reason: "Reference docs are reusable and separate from project stories."
  - path: "docs/guides/**"
    group: "docs"
    policy: "copy-if-missing"
    reason: "Enterprise usage guides."
  - path: "docs/schemas/**"
    group: "docs"
    policy: "copy-if-missing"
    reason: "Reusable Enterprise schemas."