@indigoai-us/hq-cli 5.312.2-beta.0 → 5.314.0

package/assets/scaffold/core/scripts/hq-delegate-grant.sh

@@ -1,252 +0,0 @@
-#!/usr/bin/env bash
-# hq-core: public
-# hq-delegate-grant.sh — materialize a delegation's dossier in the vault and
-# write the ACL grants its manifest declares, verifying each one landed.
-#
-# Usage:
-#   core/scripts/hq-delegate-grant.sh --manifest <path> [--yes]
-#
-# Without --yes: prints the full grant plan (prefix, principal, permission —
-# the write grant is a privilege escalation and needs explicit confirmation)
-# and exits 2 without mutating anything. The caller (the /delegate skill)
-# confirms with the user, then re-invokes with --yes.
-#
-# With --yes:
-#   1. hq sync push the project directory so the vault prefix exists
-#   2. hq files share each manifest vaultPrefix to the recipient
-#   3. read each grant back with hq files acl and match grantee + permission
-#   4. advance manifest status building -> granted, stamping verifiedAt
-#
-# Direct ACL grants ONLY — this helper never mints a share-session URL
-# (policy hq-delegate-never-inlines-secrets-or-share-urls).
-#
-# Idempotent: a prefix whose grant already exists is reported, not an error.
-# A failed read-back exits non-zero and leaves manifest status unchanged.
-#
-# Env: HQ_ROOT — HQ root override (default: resolved from script location)
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-HQ_ROOT="${HQ_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
-
-usage() { sed -n '3,25p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'; }
-die()   { echo "hq-delegate-grant: $*" >&2; exit 1; }
-
-command -v jq >/dev/null 2>&1 || die "jq is required but not installed"
-
-MANIFEST="" YES=0
-while [ $# -gt 0 ]; do
-  case "$1" in
-    --manifest) MANIFEST="${2:-}"; shift 2 ;;
-    --yes)      YES=1; shift ;;
-    -h|--help)  usage; exit 0 ;;
-    *) die "unknown argument: $1" ;;
-  esac
-done
-
-[ -n "$MANIFEST" ] || die "--manifest is required"
-[ -f "$MANIFEST" ] || die "manifest not found: $MANIFEST"
-jq -e . "$MANIFEST" >/dev/null 2>&1 || die "manifest is not valid JSON: $MANIFEST"
-
-COMPANY="$(jq -r '.company // empty' "$MANIFEST")"
-PROJECT="$(jq -r '.project.name // empty' "$MANIFEST")"
-PRINCIPAL="$(jq -r '.to.principal // empty' "$MANIFEST")"
-DISPLAY="$(jq -r '.to.displayName // .to.principal // empty' "$MANIFEST")"
-STATUS="$(jq -r '.status // empty' "$MANIFEST")"
-[ -n "$COMPANY" ]   || die "manifest has no company"
-[ -n "$PROJECT" ]   || die "manifest has no project.name"
-[ -n "$PRINCIPAL" ] || die "manifest has no to.principal"
-
-# File-ACL principals must be an email, grp_<id>, or @all — an agentUid is
-# NOT accepted by `hq files share`. For agent recipients, grants flow through
-# a deterministic per-agent delegation group keyed by the full UID digest:
-# grp_dlg<first 32 SHA-256 hex characters>, containing exactly that agent.
-agent_group_id() {
-  local principal="$1" digest
-  if command -v sha256sum >/dev/null 2>&1; then
-    digest="$(printf '%s' "$principal" | sha256sum)"
-  elif command -v shasum >/dev/null 2>&1; then
-    digest="$(printf '%s' "$principal" | shasum -a 256)"
-  else
-    die "sha256 utility is required for agent delegation groups"
-  fi
-  printf 'grp_dlg%.32s' "$digest"
-}
-
-GRANT_PRINCIPAL="$PRINCIPAL"
-case "$PRINCIPAL" in
-  agt_*)
-    TAIL="$(printf '%s' "$PRINCIPAL" | tail -c 9 | tr '[:upper:]' '[:lower:]')"
-    LEGACY_GROUP="grp_dlg-$TAIL"
-    NEXT_GROUP="$(agent_group_id "$PRINCIPAL")"
-    RECORDED_GROUP="$(jq -r '.grantPrincipal // empty' "$MANIFEST")"
-    case "$RECORDED_GROUP" in
-      "$LEGACY_GROUP"|"$NEXT_GROUP") GRANT_PRINCIPAL="$RECORDED_GROUP" ;;
-      *) GRANT_PRINCIPAL="$NEXT_GROUP" ;;
-    esac
-    ;;
-esac
-
-case "$STATUS" in
-  building|granted) ;;
-  *) die "manifest status is '$STATUS' — grants run from 'building' (or re-run from 'granted'), not from there" ;;
-esac
-
-PREFIX_COUNT="$(jq '.vaultPrefixes | length' "$MANIFEST")"
-[ "$PREFIX_COUNT" -gt 0 ] || die "manifest has no vaultPrefixes"
-
-# --- validate every prefix BEFORE touching anything --------------------------
-# Company-relative, trailing-slash folder form. A bare prefix would degrade to
-# a single literal key and grant nothing useful; company-anchored prefixes do
-# not exist in the bucket. Either is a hard error, never a silent grant.
-
-BAD="$(jq -r '.vaultPrefixes[] | .prefix
-  | select((endswith("/") | not) or startswith("companies/") or startswith("/"))' "$MANIFEST")"
-if [ -n "$BAD" ]; then
-  die "prefix violates the hq-files prefix conventions (must be company-relative folder form ending in '/'): $BAD"
-fi
-
-# --- plan (always printed; the only output without --yes) --------------------
-
-echo "Delegation grant plan — company '$COMPANY', recipient '$PRINCIPAL':"
-if [ "$GRANT_PRINCIPAL" != "$PRINCIPAL" ]; then
-  echo "  0. Agent recipient: grants flow through group $GRANT_PRINCIPAL (created if absent, containing exactly $DISPLAY)"
-fi
-echo "  1. Push companies/$COMPANY/projects/$PROJECT/ to the vault (on-conflict keep)"
-jq -r '.vaultPrefixes[] | "  2. Grant \(.permission) on \(.prefix) — \(.reason // "")"' "$MANIFEST"
-WRITE_PREFIXES="$(jq -r '.vaultPrefixes[] | select(.permission == "write") | .prefix' "$MANIFEST")"
-if [ -n "$WRITE_PREFIXES" ]; then
-  echo
-  echo "NOTE: granting 'write' is a privilege escalation. The recipient will be able"
-  echo "to upload, overwrite, and delete under: $(printf '%s ' "$WRITE_PREFIXES")"
-fi
-
-if [ "$YES" -ne 1 ]; then
-  echo
-  echo "hq-delegate-grant: confirmation required — re-run with --yes after the user approves" >&2
-  exit 2
-fi
-
-# --- 1. materialize the dossier AND referenced knowledge in the vault --------
-# (Live finding: granting read on a knowledge prefix is useless if the
-# specific referenced file was never pushed — the recipient's pull succeeds
-# on the prefix and silently misses the file. Push every referenced
-# company-local knowledge/policy path alongside the dossier.)
-
-hq sync push "companies/$COMPANY/projects/$PROJECT/" --company "$COMPANY" --on-conflict keep \
-  || die "vault push failed for companies/$COMPANY/projects/$PROJECT/"
-
-jq -r --arg co "$COMPANY" \
-  '((.knowledge // []) + (.policies // []))[] | select(startswith("companies/" + $co + "/"))' \
-  "$MANIFEST" | while IFS= read -r kpath; do
-  if [ -e "$HQ_ROOT/$kpath" ]; then
-    hq sync push "$kpath" --company "$COMPANY" --on-conflict keep \
-      || die "vault push failed for referenced knowledge: $kpath"
-  else
-    echo "hq-delegate-grant: referenced path missing locally (cannot push): $kpath — the verify probe will fail if it is not already in the vault" >&2
-  fi
-done
-
-# --- 1b. agent recipients: ensure the delegation group exists + contains them
-
-if [ "$GRANT_PRINCIPAL" != "$PRINCIPAL" ]; then
-  # Group creation and add are idempotent-tolerated; confirm that the complete
-  # member list is exactly this agent before any file ACL is shared.
-  hq groups create "$GRANT_PRINCIPAL" --name "Delegation: $DISPLAY" --company "$COMPANY" \
-    || echo "hq-delegate-grant: group create reported an error (may already exist) — continuing" >&2
-  hq groups add "$GRANT_PRINCIPAL" "$PRINCIPAL" --company "$COMPANY" \
-    || echo "hq-delegate-grant: group add reported an error (may already be a member) — continuing" >&2
-  GROUP_MEMBERS="$(NO_COLOR=1 FORCE_COLOR=0 hq groups members "$GRANT_PRINCIPAL" --company "$COMPANY")" \
-    || die "could not verify delegation group membership"
-  MEMBER_IDS="$(printf '%s\n' "$GROUP_MEMBERS" | awk '
-    { gsub(/\033\[[0-9;]*m/, "", $0) }
-    /^PERSON_UID([[:space:]]|$)/ { collecting = 1; next }
-    collecting && NF { print $1 }
-  ')"
-  [ "$MEMBER_IDS" = "$PRINCIPAL" ] || die "delegation group membership does not exactly match recipient"
-fi
-
-# --- 2+3. exact structured read-back; never infer identity from a new row ---
-# Requires the structured CLI contracts. Unsupported/failed reads stop the flow.
-EXPECTED_TYPE="" EXPECTED_ID="" EXPECTED_COMPANY=""
-case "$GRANT_PRINCIPAL" in
-  grp_*) EXPECTED_TYPE=group; EXPECTED_ID="$GRANT_PRINCIPAL" ;;
-  @all) EXPECTED_TYPE=company-wide; EXPECTED_ID="" ;;
-  *)
-    RESOLVE_RC=0
-    RESOLVED="$(hq people resolve "$PRINCIPAL" --company "$COMPANY" --json --membership-only)" || RESOLVE_RC=$?
-    if printf '%s' "$RESOLVED" | jq -e '.status == "found" and (.person.personUid | type == "string") and (.person.companyUid | type == "string")' >/dev/null; then
-      [ "$RESOLVE_RC" -eq 0 ] || die "recipient resolution failed"
-      EXPECTED_TYPE=person
-      EXPECTED_ID="$(printf '%s' "$RESOLVED" | jq -r '.person.personUid')"
-      EXPECTED_COMPANY="$(printf '%s' "$RESOLVED" | jq -r '.person.companyUid')"
-    elif printf '%s' "$RESOLVED" | jq -e '.status == "not_found"' >/dev/null; then
-      case "$PRINCIPAL" in *@*) EXPECTED_TYPE=email; EXPECTED_ID="$(printf '%s' "$PRINCIPAL" | tr '[:upper:]' '[:lower:]' | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')" ;; *) die "unresolved recipient" ;; esac
-    else
-      die "authoritative recipient lookup failed; update hq-cli if --membership-only is unsupported"
-    fi
-    ;;
-esac
-
-read_acl() {
-  local result
-  result="$(hq files acl "$1" --company "$COMPANY" --json)" || return 1
-  printf '%s' "$result" | jq -e --arg prefix "$1" --arg company "$EXPECTED_COMPANY" '
-    .schemaVersion == 1 and
-    (
-      .prefix == $prefix or
-      (($prefix | endswith("/*")) and .prefix == ($prefix | sub("\\*$"; "")))
-    ) and
-    (.companyUid | type == "string") and ($company == "" or .companyUid == $company) and
-    (.direct | type == "array") and (.exists | type == "boolean")
-  ' >/dev/null || { echo "hq-delegate-grant: invalid structured ACL response for $1" >&2; return 1; }
-  printf '%s' "$result"
-}
-
-NOW="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
-i=0
-while [ "$i" -lt "$PREFIX_COUNT" ]; do
-  PFX="$(jq -r ".vaultPrefixes[$i].prefix" "$MANIFEST")"
-  PERM="$(jq -r ".vaultPrefixes[$i].permission" "$MANIFEST")"
-  # Always address the recursive "folder/*" pattern explicitly. Since hq-pro
-  # #3662 (2026-09-23) the server echoes the raw pattern back on read, and a
-  # bare trailing "/" can mean a PRIVATE folder pattern when that flag is on.
-  # A delegation grant is always the recursive share, never a private folder.
-  ACL_PATTERN="${PFX}*"
-  BEFORE="$(read_acl "$ACL_PATTERN")" || die "ACL preflight failed; no share attempted for $PFX"
-  EXPECTED_COMPANY="$(printf '%s' "$BEFORE" | jq -r '.companyUid')"
-  SHARE_RC=0
-  hq files share "$ACL_PATTERN" --with "$GRANT_PRINCIPAL" --permission "$PERM" --company "$COMPANY" || SHARE_RC=$?
-  [ "$SHARE_RC" -eq 0 ] || echo "hq-delegate-grant: share reported an error on $PFX; checking exact grant" >&2
-  landed=0
-  for delay in 0 1 2; do
-    [ "$delay" -eq 0 ] || sleep "$delay"
-    if AFTER="$(read_acl "$ACL_PATTERN")" && printf '%s' "$AFTER" | jq -e \
-      --arg id "$EXPECTED_ID" --arg type "$EXPECTED_TYPE" --arg perm "$PERM" \
-      '.exists and any(.direct[]; .granteeType == $type and .granteeId == $id and .permission == $perm)' >/dev/null; then
-      landed=1
-      break
-    fi
-  done
-  [ "$landed" -eq 1 ] || die "grant outcome unconfirmed for $PRINCIPAL on $PFX; retain this manifest and resume"
-  TMP_MANIFEST="$(mktemp)"
-  jq --argjson i "$i" --arg now "$NOW" --arg id "$EXPECTED_ID" --arg type "$EXPECTED_TYPE" \
-    --arg company "$EXPECTED_COMPANY" --argjson rc "$SHARE_RC" '
-    .vaultPrefixes[$i].verifiedAt = $now |
-    .vaultPrefixes[$i].grantReceipt = {companyUid:$company,granteeType:$type,granteeId:$id,shareExitCode:$rc,verifiedAt:$now}
-  ' "$MANIFEST" > "$TMP_MANIFEST" && mv "$TMP_MANIFEST" "$MANIFEST"
-  echo "hq-delegate-grant: verified $PERM on $PFX for $PRINCIPAL"
-  i=$((i + 1))
-done
-
-# --- 4. advance manifest status ----------------------------------------------
-
-TMP_MANIFEST="$(mktemp)"
-jq --arg now "$NOW" --arg gp "$GRANT_PRINCIPAL" '
-  .status = "granted"
-  | .grantPrincipal = $gp
-  | .vaultPrefixes = [.vaultPrefixes[] | . + {verifiedAt: $now}]
-' "$MANIFEST" > "$TMP_MANIFEST" && mv "$TMP_MANIFEST" "$MANIFEST"
-
-echo "hq-delegate-grant: all $PREFIX_COUNT grants verified — manifest status advanced to 'granted'"

package/assets/scaffold/core/scripts/hq-delegate-pickup.sh

@@ -1,99 +0,0 @@
-#!/usr/bin/env bash
-# hq-core: public
-# hq-delegate-pickup.sh — close the delegation loop with a receipt or a FAILED
-# state (2026-09-07).
-#
-# Why: the delegate pipeline ended at "sent", which is a send receipt, not a
-# delivery receipt. Seven delegations sat at sent/building with no way to tell
-# whether the recipient could act. This script adds the two missing states:
-#
-#   sent --(evidence)--> picked-up      recipient demonstrably has the work
-#   sent --(silence past window)--> failed   nobody picked it up; sender is told why
-#
-# Evidence, checked in order (any one suffices):
-#   1. --ack "<text>"            an explicit acknowledgement (DM reply, chat) —
-#                                recorded verbatim with a timestamp
-#   2. repo branch has a commit by the recipient after sentAt
-#      (manifest.repo.path + repo.branch, author email == to.principal)
-#   3. --evidence "<free text>"  any other proof the operator observed
-#
-# Usage:
-#   hq-delegate-pickup.sh --manifest <path> --ack "<text>"        # record receipt
-#   hq-delegate-pickup.sh --manifest <path> --evidence "<text>"   # record receipt
-#   hq-delegate-pickup.sh --manifest <path> --check [--window-hours N]   # probe repo; fail if silent past window (default 72)
-#   hq-delegate-pickup.sh --manifest <path> --status               # print state line
-#
-# Exit 0: picked-up (or already). Exit 5: failed (window elapsed, no evidence).
-# Exit 6: still waiting (inside window, no evidence). Exit 2: usage/precondition.
-set -uo pipefail
-MANIFEST=""; ACK=""; EVIDENCE=""; CHECK=0; STATUS_ONLY=0; WINDOW="${HQ_DELEGATE_PICKUP_WINDOW_HOURS:-72}"
-while [ $# -gt 0 ]; do
-  case "$1" in
-    --manifest) MANIFEST="$2"; shift 2 ;;
-    --ack) ACK="$2"; shift 2 ;;
-    --evidence) EVIDENCE="$2"; shift 2 ;;
-    --check) CHECK=1; shift ;;
-    --window-hours) WINDOW="$2"; shift 2 ;;
-    --status) STATUS_ONLY=1; shift ;;
-    -h|--help) sed -n 2,28p "$0"; exit 0 ;;
-    *) echo "hq-delegate-pickup: unknown arg $1" >&2; exit 2 ;;
-  esac
-done
-[ -n "$MANIFEST" ] && [ -r "$MANIFEST" ] || { echo "usage: --manifest <path> (--ack|--evidence|--check|--status)" >&2; exit 2; }
-command -v jq >/dev/null 2>&1 || { echo "hq-delegate-pickup: jq required" >&2; exit 2; }
-NOW="${HQ_DELEGATE_NOW:-$(date -u +%Y-%m-%dT%H:%M:%SZ)}"
-STATUS="$(jq -r '.status // empty' "$MANIFEST")"
-SENT_AT="$(jq -r '.sentAt // empty' "$MANIFEST")"
-TO="$(jq -r '.to.principal // empty' "$MANIFEST")"
-NAME="$(jq -r '.to.displayName // .to.principal // "the recipient"' "$MANIFEST")"
-
-if [ "$STATUS_ONLY" = 1 ]; then
-  jq -r '"\(.delegationId) \(.status)" + (if .pickedUpAt then " picked-up " + .pickedUpAt + " via " + (.pickup.kind // "?") else "" end) + (if .failedAt then " failed " + .failedAt + ": " + (.failure.reason // "") else "" end)' "$MANIFEST"
-  exit 0
-fi
-case "$STATUS" in
-  picked-up) echo "hq-delegate-pickup: already picked up ($(jq -r '.pickedUpAt' "$MANIFEST"))"; exit 0 ;;
-  failed) echo "hq-delegate-pickup: already failed ($(jq -r '.failure.reason // ""' "$MANIFEST"))"; exit 5 ;;
-  sent) ;;
-  *) echo "hq-delegate-pickup: manifest status is '$STATUS' — only a 'sent' delegation can be picked up (send it first)" >&2; exit 2 ;;
-esac
-
-record_pickup() { # <kind> <detail>
-  jq --arg now "$NOW" --arg k "$1" --arg d "$2" \
-    '.status = "picked-up" | .pickedUpAt = $now | .pickup = {kind: $k, detail: $d, recordedAt: $now}' \
-    "$MANIFEST" > "$MANIFEST.tmp" && mv "$MANIFEST.tmp" "$MANIFEST"
-  echo "hq-delegate-pickup: $NAME picked up the delegation ($1) — status advanced to 'picked-up'"
-  exit 0
-}
-[ -n "$ACK" ] && record_pickup ack "$ACK"
-[ -n "$EVIDENCE" ] && record_pickup evidence "$EVIDENCE"
-
-[ "$CHECK" = 1 ] || { echo "hq-delegate-pickup: nothing to do (pass --ack, --evidence, --check, or --status)" >&2; exit 2; }
-
-# Evidence 2: a commit by the recipient on the handed-over branch after sentAt.
-REPO="$(jq -r '.repo.path // empty' "$MANIFEST")"
-BRANCH="$(jq -r '.repo.branch // empty' "$MANIFEST")"
-if [ -n "$REPO" ] && [ -d "$REPO" ] && [ -n "$BRANCH" ] && [ -n "$TO" ]; then
-  git -C "$REPO" fetch -q origin "$BRANCH" 2>/dev/null || true
-  ref="origin/$BRANCH"; git -C "$REPO" show-ref --verify --quiet "refs/remotes/$ref" || ref="$BRANCH"
-  c="$(git -C "$REPO" log "$ref" --author="$TO" ${SENT_AT:+--since="$SENT_AT"} --format='%h %ad %s' --date=short -1 2>/dev/null || true)"
-  [ -n "$c" ] && record_pickup commit "$c on $BRANCH"
-fi
-
-# No evidence. Inside the window: waiting. Past it: FAILED, with the reason.
-if [ -n "$SENT_AT" ]; then
-  sent_epoch="$(date -u -d "$SENT_AT" +%s 2>/dev/null || date -u -j -f %Y-%m-%dT%H:%M:%SZ "$SENT_AT" +%s 2>/dev/null || echo 0)"
-  now_epoch="$(date -u -d "$NOW" +%s 2>/dev/null || date -u -j -f %Y-%m-%dT%H:%M:%SZ "$NOW" +%s 2>/dev/null || date +%s)"
-  age_h=$(( (now_epoch - sent_epoch) / 3600 ))
-else
-  age_h=0
-fi
-if [ "$age_h" -lt "$WINDOW" ]; then
-  echo "hq-delegate-pickup: waiting — no pickup evidence from $NAME yet (${age_h}h of a ${WINDOW}h window)"
-  exit 6
-fi
-reason="no pickup evidence from $NAME within ${WINDOW}h of send (${SENT_AT:-unknown}): no acknowledgement, no commit by $TO on ${BRANCH:-the branch}"
-jq --arg now "$NOW" --arg r "$reason" '.status = "failed" | .failedAt = $now | .failure = {reason: $r, recordedAt: $now}' \
-  "$MANIFEST" > "$MANIFEST.tmp" && mv "$MANIFEST.tmp" "$MANIFEST"
-echo "hq-delegate-pickup: FAILED — $reason. Re-send with a direct ask, or hand it to someone else." >&2
-exit 5

package/assets/scaffold/core/scripts/hq-delegate-publish.sh

@@ -1,91 +0,0 @@
-#!/usr/bin/env bash
-# hq-core: public
-# Publish final delegation artifacts and verify their canonical cloud bytes.
-set -euo pipefail
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-HQ_ROOT="${HQ_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
-. "$SCRIPT_DIR/lib/secret-patterns.sh"
-die() { echo "hq-delegate-publish: $*" >&2; exit 1; }
-[ "${1:-}" = --manifest ] && [ -f "${2:-}" ] || die 'usage: --manifest <path>'
-MANIFEST="$2"
-LOCK="$MANIFEST.send-lock"
-if [ "${3:-}" = --lock-held ]; then
-  [ -d "$LOCK" ] || die 'verification lock missing'
-  OWN_LOCK=0
-else
-  [ "$#" -eq 2 ] || die 'usage: --manifest <path>'
-  mkdir "$LOCK" 2>/dev/null || die 'verification or delivery is active; retry after it finishes'
-  OWN_LOCK=1
-fi
-STAGE=""
-trap '[[ -z "$STAGE" ]] || rm -rf "$STAGE"; [ "$OWN_LOCK" -eq 0 ] || rmdir "$LOCK"' EXIT
-COMPANY="$(jq -er '.company' "$MANIFEST")"
-PROJECT="$(jq -er '.project.name' "$MANIFEST")"
-ID="$(jq -er '.delegationId' "$MANIFEST")"
-for part in "$COMPANY" "$PROJECT" "$ID"; do
-  [[ "$part" =~ ^[A-Za-z0-9_-][A-Za-z0-9._-]*$ ]] || die 'unsafe path segment'
-done
-jq -e '.status == "granted" or .status == "verified"' "$MANIFEST" >/dev/null || die 'confirmed grants required'
-if [ "$(jq -r '.mode' "$MANIFEST")" = transfer ]; then
-  jq -e '.ownershipTransferredAt != null' "$MANIFEST" >/dev/null || die 'transfer must finish before publication'
-fi
-REL="companies/$COMPANY/projects/$PROJECT"
-PROJECT_DIR="$HQ_ROOT/$REL"
-BUNDLE="$(cd "$(dirname "$MANIFEST")" && pwd)"
-[ -f "$BUNDLE/BRIEF.md" ] || die 'BRIEF.md missing'
-[ -f "$PROJECT_DIR/prd.json" ] || die 'PRD missing'
-if [ "$(jq -r '.mode' "$MANIFEST")" = transfer ]; then
-  EXPECTED_OWNER="$(jq -r '.to.principal' "$MANIFEST")"
-  jq -e --arg owner "$EXPECTED_OWNER" '.metadata.owner == $owner' "$PROJECT_DIR/prd.json" >/dev/null || die 'local PRD owner does not match recipient'
-fi
-STAGE="$(mktemp -d)"
-atomic_copy() {
-  local target_tmp
-  target_tmp="$(mktemp "${2}.tmp.XXXXXX")"
-  if ! cp "$1" "$target_tmp"; then rm -f "$target_tmp"; return 1; fi
-  mv -f "$target_tmp" "$2"
-}
-DEST="$PROJECT_DIR/delegation/$ID"
-cp "$BUNDLE/BRIEF.md" "$STAGE/BRIEF.md"
-file_hash() {
-  if command -v sha256sum >/dev/null 2>&1; then sha256sum "$1" | cut -d ' ' -f1; else shasum -a 256 "$1" | cut -d ' ' -f1; fi
-}
-# Snapshot final project content, excluding mutable/self-referential receipts.
-: > "$STAGE/hashes"
-for file in "$PROJECT_DIR/prd.json" "$PROJECT_DIR/README.md" "$PROJECT_DIR/journal/delegations.md"; do
-  [ -f "$file" ] || continue
-  jq -cn --arg key "${file#"$HQ_ROOT/"}" --arg value "$(file_hash "$file")" '{key:$key,value:$value}' >> "$STAGE/hashes"
-done
-jq -cn --arg key "$REL/delegation/$ID/BRIEF.md" --arg value "$(file_hash "$STAGE/BRIEF.md")" '{key:$key,value:$value}' >> "$STAGE/hashes"
-jq -s 'from_entries' "$STAGE/hashes" > "$STAGE/checksums"
-jq --slurpfile hashes "$STAGE/checksums" '.checksums=$hashes[0] | .status="granted" | .recipientAccess="unconfirmed" | del(.publication,.verifiedAt,.sentAt,.dmEventId)' "$MANIFEST" > "$STAGE/manifest.json"
-hq_scan_secrets "$STAGE/manifest.json" "$STAGE/BRIEF.md" || die 'unsafe generated dossier'
-if grep -Eq 'share-session/[A-Za-z0-9_-]+' "$STAGE/manifest.json" "$STAGE/BRIEF.md"; then
-  die 'share-session capability in dossier; nothing published'
-fi
-mkdir -p "$DEST"
-atomic_copy "$STAGE/BRIEF.md" "$DEST/BRIEF.md"
-atomic_copy "$STAGE/manifest.json" "$DEST/manifest.json"
-atomic_copy "$STAGE/manifest.json" "$MANIFEST"
-# keep may preserve stale canonical content. Read-back must catch that instead
-# of overwriting concurrent changes merely to make the check pass.
-hq sync push "$REL/" --company "$COMPANY" --on-conflict keep || die 'final dossier push failed; resume publication'
-cp "$STAGE/hashes" "$STAGE/receipts"
-jq -cn --arg key "$REL/delegation/$ID/manifest.json" --arg value "$(file_hash "$DEST/manifest.json")" '{key:$key,value:$value}' >> "$STAGE/receipts"
-while IFS= read -r row; do
-  path="$(printf '%s' "$row" | jq -r '.key')"
-  expected="$(printf '%s' "$row" | jq -r '.value')"
-  matched=0
-  for delay in 0 1 2; do
-    [ "$delay" -eq 0 ] || sleep "$delay"
-    if hq files cat "${path#"companies/$COMPANY/"}" --company "$COMPANY" > "$STAGE/remote"; then
-      if [ "$(file_hash "$STAGE/remote")" = "$expected" ]; then matched=1; break; fi
-    fi
-  done
-  [ "$matched" -eq 1 ] || die "canonical cloud content differs or is unreadable: $path; resolve before sending"
-done < "$STAGE/receipts"
-jq -s 'from_entries' "$STAGE/receipts" > "$STAGE/files"
-jq --arg now "$(date -u +%Y-%m-%dT%H:%M:%SZ)" --arg path "$REL/delegation/$ID/manifest.json" --slurpfile files "$STAGE/files" \
-  '.publication={verifiedAt:$now,manifestPath:$path,files:$files[0]} | .recipientAccess="unconfirmed"' "$MANIFEST" > "$STAGE/updated"
-atomic_copy "$STAGE/updated" "$MANIFEST"
-echo 'hq-delegate-publish: canonical dossier bytes verified as sender; recipient access unconfirmed'

package/assets/scaffold/core/scripts/hq-delegate-repo.sh

@@ -1,158 +0,0 @@
-#!/usr/bin/env bash
-# hq-core: public
-# hq-delegate-repo.sh — code/branch handover for a delegation: make sure the
-# project's branch exists on the remote, record uncommitted work as NOT
-# transferred, and verify the recipient's repository access read-only.
-#
-# Usage:
-#   core/scripts/hq-delegate-repo.sh --manifest <path> [--yes] [--github-user <login>]
-#
-# Behavior (driven by the manifest's repo{} block; no-op when repo is null):
-#   - records remote URL and the branch's headSha into the manifest
-#   - a branch that exists only locally requires confirmation: without --yes
-#     the helper prints the plan and exits 2; with --yes it pushes via an
-#     explicitly anchored `git -C <abs path> push -u origin <branch>`
-#   - dirty/untracked files are captured into repo.dirtyFiles[] and appended
-#     to BRIEF.md as work NOT transferred — never silently dropped
-#   - recipient access is checked read-only via gh when --github-user is
-#     given; otherwise (or on a gh failure) repo.accessVerified stays false
-#     and the brief says so plainly — the helper never claims unverified access
-#   - never touches vaultPrefixes[] and never pushes repo content to the vault
-#
-# Env: HQ_ROOT — HQ root override (default: resolved from script location)
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-HQ_ROOT="${HQ_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
-
-usage() { sed -n '3,22p' "${BASH_SOURCE[0]}" | sed 's/^# \{0,1\}//'; }
-die()   { echo "hq-delegate-repo: $*" >&2; exit 1; }
-
-command -v jq >/dev/null 2>&1 || die "jq is required but not installed"
-
-MANIFEST="" YES=0 GH_USER=""
-while [ $# -gt 0 ]; do
-  case "$1" in
-    --manifest)    MANIFEST="${2:-}"; shift 2 ;;
-    --yes)         YES=1; shift ;;
-    --github-user) GH_USER="${2:-}"; shift 2 ;;
-    -h|--help)     usage; exit 0 ;;
-    *) die "unknown argument: $1" ;;
-  esac
-done
-
-[ -n "$MANIFEST" ] || die "--manifest is required"
-[ -f "$MANIFEST" ] || die "manifest not found: $MANIFEST"
-jq -e . "$MANIFEST" >/dev/null 2>&1 || die "manifest is not valid JSON: $MANIFEST"
-
-BUNDLE_DIR="$(cd "$(dirname "$MANIFEST")" && pwd)"
-BRIEF="$BUNDLE_DIR/BRIEF.md"
-
-# --- no-repo projects skip cleanly -------------------------------------------
-
-if jq -e '.repo == null' "$MANIFEST" >/dev/null; then
-  echo "hq-delegate-repo: project has no repoPath — nothing to hand over"
-  exit 0
-fi
-
-REPO_REL="$(jq -r '.repo.path // empty' "$MANIFEST")"
-BRANCH="$(jq -r '.repo.branch // empty' "$MANIFEST")"
-[ -n "$REPO_REL" ] || die "manifest repo block has no path"
-
-REPO_DIR="$HQ_ROOT/$REPO_REL"
-[ -d "$REPO_DIR/.git" ] || git -C "$REPO_DIR" rev-parse --git-dir >/dev/null 2>&1 \
-  || die "not a git repository: $REPO_DIR"
-
-REMOTE_URL="$(git -C "$REPO_DIR" remote get-url origin 2>/dev/null || true)"
-
-# --- dirty / untracked work is recorded, never dropped -----------------------
-
-DIRTY_JSON="$(git -C "$REPO_DIR" status --porcelain | sed 's/^...//' | jq -R . | jq -cs .)"
-
-# --- branch state -------------------------------------------------------------
-
-BRANCH_PUSHED=false HEAD_SHA=""
-if [ -n "$BRANCH" ]; then
-  git check-ref-format --branch "$BRANCH" >/dev/null 2>&1 || die "invalid branch name in PRD: $BRANCH"
-  LOCAL_SHA="$(git -C "$REPO_DIR" rev-parse --verify --quiet "refs/heads/$BRANCH" || true)"
-  REMOTE_SHA="$(git -C "$REPO_DIR" rev-parse --verify --quiet "refs/remotes/origin/$BRANCH" || true)"
-
-  if [ -n "$REMOTE_SHA" ]; then
-    BRANCH_PUSHED=true
-    HEAD_SHA="$REMOTE_SHA"
-  elif [ -n "$LOCAL_SHA" ]; then
-    echo "Branch handover plan — repo '$REPO_REL':"
-    echo "  branch '$BRANCH' exists only locally ($LOCAL_SHA)"
-    echo "  action: git -C $REPO_DIR push -u origin $BRANCH"
-    if [ "$YES" -ne 1 ]; then
-      echo
-      echo "hq-delegate-repo: confirmation required — re-run with --yes to push the branch" >&2
-      exit 2
-    fi
-    git -C "$REPO_DIR" push -u origin "$BRANCH" \
-      || die "failed to push branch '$BRANCH' to origin"
-    BRANCH_PUSHED=true
-    HEAD_SHA="$LOCAL_SHA"
-  else
-    echo "hq-delegate-repo: branch '$BRANCH' does not exist yet (declared in the PRD, not started) — recording as unpushed"
-  fi
-fi
-
-# --- read-only recipient access check ----------------------------------------
-
-ACCESS_VERIFIED=false ACCESS_NOTE=""
-if [ -n "$GH_USER" ] && [ -n "$REMOTE_URL" ] && command -v gh >/dev/null 2>&1; then
-  # owner/repo from ssh or https remote forms
-  OWNER_REPO="$(printf '%s' "$REMOTE_URL" | sed -E 's#^(git@[^:]+:|https?://[^/]+/)##; s#\.git$##')"
-  if gh api "repos/$OWNER_REPO/collaborators/$GH_USER" >/dev/null 2>&1; then
-    ACCESS_VERIFIED=true
-    ACCESS_NOTE="verified: $GH_USER is a collaborator on $OWNER_REPO"
-  else
-    ACCESS_NOTE="UNVERIFIED: could not confirm $GH_USER has access to $OWNER_REPO — the recipient may need to be invited before they can pull the branch"
-  fi
-else
-  ACCESS_NOTE="UNVERIFIED: recipient repository access was not checked (no GitHub login supplied) — confirm they can reach the repo before assuming so"
-fi
-
-# --- manifest update (repo block only — vaultPrefixes are never touched) -----
-
-TMP_MANIFEST="$(mktemp)"
-jq \
-  --arg remote "$REMOTE_URL" \
-  --arg headSha "$HEAD_SHA" \
-  --argjson dirty "$DIRTY_JSON" \
-  --argjson pushed "$BRANCH_PUSHED" \
-  --argjson access "$ACCESS_VERIFIED" \
-  --arg accessNote "$ACCESS_NOTE" \
-  '.repo.remote = (if $remote == "" then null else $remote end)
-   | .repo.headSha = (if $headSha == "" then null else $headSha end)
-   | .repo.dirtyFiles = $dirty
-   | .repo.branchPushed = $pushed
-   | .repo.accessVerified = $access
-   | .repo.accessNote = $accessNote' \
-  "$MANIFEST" > "$TMP_MANIFEST" && mv "$TMP_MANIFEST" "$MANIFEST"
-
-# --- brief: call out untransferred work and unverified access ----------------
-
-if [ -f "$BRIEF" ]; then
-  DIRTY_COUNT="$(printf '%s' "$DIRTY_JSON" | jq 'length')"
-  if [ "$DIRTY_COUNT" -gt 0 ] || [ "$ACCESS_VERIFIED" != "true" ]; then
-    {
-      echo
-      echo "## Code handover notes"
-      echo
-      if [ "$DIRTY_COUNT" -gt 0 ]; then
-        echo "The delegator's working tree had uncommitted changes that are **not transferred** with this delegation. If something seems missing, these files are why — ask the delegator to commit and push them:"
-        echo
-        printf '%s' "$DIRTY_JSON" | jq -r '.[] | "- `\(.)`"'
-        echo
-      fi
-      if [ "$ACCESS_VERIFIED" != "true" ]; then
-        echo "$ACCESS_NOTE"
-      fi
-    } >> "$BRIEF"
-  fi
-fi
-
-echo "hq-delegate-repo: recorded branch state (pushed=$BRANCH_PUSHED, dirty=$(printf '%s' "$DIRTY_JSON" | jq 'length') files, accessVerified=$ACCESS_VERIFIED)"