Pin the D1 heads and cover the adapter modules

Why: Dev has to test the split modules and refuse a core import of a sibling library.
Evidence: bash scripts/lint-boundaries.sh printed boundaries ok. Full make test follows on this pin.
Impact: test-libs runs the intent, native, sqlite, and command modules. The sibling allowlist is empty.
Refs: D1
Co-authored-by: Cursor <cursoragent@cursor.com>

.task/feature-agent-stack-d1.md

@@ -6,11 +6,12 @@
 
 - 权威仓：ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Agent-System-Dev.git；目标分支：main；R0（initial_base_sha）= 954ea44478ceac73d205c3a68b5de522847fb6cf
 - 工作区：/home/weichen/projects/Agent-System-Dev-wt-feature-agent-stack-d1（worktree）；分支：feature/agent-stack-d1
-- 授权与交付终点：<本次允许的动作与终点；未授权事项写明>
+- 授权与交付终点：合入 Intent、Native、Squad、Backend、Dev 的 feature/agent-stack-d1，然后在本 worktree 运行 make task-finish。不改分支保护、不发版、不改写历史。不改模块路径，不删除嵌套 gitlink。
 
 ## 目标与非目标
 
-<预期结果、受影响入口/模块/契约；明确不做什么。>
+- 目标：按提案第 3 节把三库解耦。Native 删掉 intentgate，契约并进 exec，Options 拆成嵌入子结构。Squad 核心只留端口；native、intent、sqlite、命令各自成模块。三库各自给出 schema 样例和往返测试。Backend 改走 adapters/native。Dev 的 test-libs 覆盖新模块，核心 go list -deps 不得看见兄弟库，agent-intent 只许 adapters/intent 和 Backend internal/intentgate 导入。
+- 非目标：不改模块路径，不删除嵌套 gitlink，不做 go.work、AgentSpec 迁移、workflow 退役，也不做意图校验器的 Registry 作用域改动。N10、N20、N22、Q20、Q21、I3、I5 以及后续 N1/Q1/I1 不在本批。
 
 ## 同步记录
 

Makefile

@@ -108,6 +108,10 @@ test-libs:
 	cd deps/agent-intent && GOWORK=off go vet ./... && GOWORK=off go test -count=1 ./...
 	cd deps/agent-native && GOWORK=off go vet ./... && GOWORK=off go test -count=1 ./...
 	cd deps/agent-squad && GOWORK=off go vet ./... && GOWORK=off go test -count=1 ./...
+	cd deps/agent-squad/adapters/intent && GOWORK=off go vet ./... && GOWORK=off go test -count=1 ./...
+	cd deps/agent-squad/adapters/native && GOWORK=off go vet ./... && GOWORK=off go test -count=1 ./...
+	cd deps/agent-squad/adapters/sqlite && GOWORK=off go vet ./... && GOWORK=off go test -count=1 ./...
+	cd deps/agent-squad/cmd/agent-squad && GOWORK=off go vet ./... && GOWORK=off go test -count=1 ./...
 
 plugin-new:
 	@test -n "$(NAME)" || (echo "用法：make plugin-new NAME=<id>"; exit 2)

policy/lib-deps-allowlist.txt

@@ -1,16 +1,3 @@
 # 三个库之间的包导入现状。新增配对会使 scripts/lint-boundaries.sh 失败；
 # 已经消失的配对只告警，提示从本文件删除。每行：导入方包 被导入包。
-agent-native/adapters/intentgate agent-intent/intent
+# D1 之后核心模块不再导入兄弟库。适配器在各自 go.mod 里，不进入这条棘轮。
-agent-squad/cli agent-intent/intent
-agent-squad/cli agent-native/exec
-agent-squad/cli agent-native/runtime/llm
-agent-squad/platform agent-native/runtime
-agent-squad/platform agent-native/runtime/llm
-agent-squad/squad agent-native/adapters/native
-agent-squad/squad agent-native/exec
-agent-squad/squad agent-native/runtime/llm
-agent-squad/squad agent-native/runtime/mcp
-agent-squad/squad agent-native/runtime/subagent
-agent-squad/squad agent-native/runtime/tools
-agent-squad/squadintent agent-intent/intent
-agent-squad/squadintent agent-native/exec

scripts/lint-boundaries.sh

@@ -54,7 +54,7 @@ for dir in deps/agent-intent deps/agent-native deps/agent-squad; do
     done
   done
 done | sort -u >"$observed"
-grep -v -e '^#' -e '^$' "$allow" | sort -u >"$recorded"
+grep -v -e '^#' -e '^$' "$allow" | sort -u >"$recorded" || true
 new_pairs=$(comm -13 "$recorded" "$observed" || true)
 if [ -n "$new_pairs" ]; then
   echo "boundary: new sibling-library import pairs" >&2
@@ -67,6 +67,32 @@ if [ -n "$stale_pairs" ]; then
   echo "$stale_pairs" >&2
 fi
 
+# 核心模块的依赖图不得出现兄弟库。go list ./... 不进入带 go.mod 的子目录。
+for dir in deps/agent-intent deps/agent-native deps/agent-squad; do
+  mod=$(awk '/^module /{print $2; exit}' "$root/$dir/go.mod")
+  deps_out=$(cd "$root/$dir" && GOWORK=off go list -deps ./...) || fail=1
+  for sib in "${siblings[@]}"; do
+    [ "$sib" = "$mod" ] && continue
+    if printf '%s\n' "$deps_out" | grep -E -q "^(${sib}|${sib}/)"; then
+      echo "boundary: $mod core depends on $sib" >&2
+      fail=1
+    fi
+  done
+done
+
+# agent-intent 只许被小队意图适配器和后端识别适配器导入。
+while IFS= read -r f; do
+  grep -q '"agent-intent/' "$f" || continue
+  case "$f" in
+    */deps/agent-squad/adapters/intent/*|*/modules/backend/internal/intentgate/*) ;;
+    *)
+      echo "boundary: $f imports agent-intent" >&2
+      fail=1
+      ;;
+  esac
+done < <(find "$root/deps/agent-native" "$root/deps/agent-squad" "$root/modules/backend" \
+  -path '*/deps/*' -prune -o -name '*.go' -print)
+
 if [ "$fail" -ne 0 ]; then
   exit 1
 fi