@indigoai-us/hq-cli 5.312.2-beta.0 → 5.314.0

package/assets/scaffold/core/scripts/lib/portable.sh

@@ -1,211 +0,0 @@
-# shellcheck shell=bash
-# portable.sh — shared OS-portability helpers for hq-core shell scripts.
-#
-# SOURCED, never executed:  . "$ROOT/core/scripts/lib/portable.sh"
-# bash 3.2 safe; works under Linux, macOS, and Windows Git Bash with set -u.
-#
-# Canonicalizes good in-repo dual-implementation patterns:
-#   - work-mesh-lib.sh wm_file_mtime (numeric-probe dual stat)
-#   - archive-old-threads.sh dual stat / date -d | date -v
-#   - compute-checksums.sh Git Bash awareness
-#
-# JSON engines are NOT here — source core/scripts/hook-lib.sh (hq_json_get /
-# hq_json_encode: jq first, then node). This file owns OS primitives + hard-fail
-# jq install messaging only.
-
-# portable_stat_mtime <path>
-#   Print mtime as epoch seconds. Uses BSD-form stat -f first, accepts only a
-#   strictly numeric result (GNU stat -f is filesystem mode and may print text),
-#   then falls through to GNU stat -c. Mirrors work-mesh-lib.sh:215-230.
-#   Returns 1 when both forms fail.
-portable_stat_mtime() {
-  local f="${1:-}" value
-  [ -n "$f" ] || return 1
-  value="$(stat -f %m "$f" 2>/dev/null)" || value=""
-  case "$value" in
-    ''|*[!0-9]*) ;;
-    *) printf '%s' "$value"; return 0 ;;
-  esac
-  value="$(stat -c %Y "$f" 2>/dev/null)" || value=""
-  case "$value" in
-    ''|*[!0-9]*) return 1 ;;
-    *) printf '%s' "$value"; return 0 ;;
-  esac
-}
-
-# portable_sed_inplace <sed-script> <file> [extra sed args...]
-#   In-place sed that works on both GNU sed (sed -i) and BSD sed (sed -i '').
-portable_sed_inplace() {
-  local script="${1:-}"
-  local file="${2:-}"
-  shift 2 2>/dev/null || true
-  [ -n "$script" ] && [ -n "$file" ] || return 1
-  [ -f "$file" ] || return 1
-  # Prefer GNU form; fall back to BSD empty-suffix form.
-  if sed --version >/dev/null 2>&1; then
-    sed -i "$@" -e "$script" "$file"
-  else
-    sed -i '' "$@" -e "$script" "$file"
-  fi
-}
-
-# portable_tmpdir
-#   Print a writable temp directory (no trailing slash). Prefer TMPDIR, else /tmp.
-portable_tmpdir() {
-  local d="${TMPDIR:-/tmp}"
-  # Strip trailing slash except for root.
-  case "$d" in
-    /) printf '%s' "$d" ;;
-    */) printf '%s' "${d%/}" ;;
-    *) printf '%s' "$d" ;;
-  esac
-}
-
-# portable_date_epoch_to_iso <epoch_seconds>
-#   Convert epoch seconds to UTC ISO-8601 (YYYY-MM-DDTHH:MM:SSZ).
-#   Dual: GNU date -d @N / BSD date -r N.
-portable_date_epoch_to_iso() {
-  local epoch="${1:-}"
-  case "$epoch" in
-    ''|*[!0-9]*) return 1 ;;
-  esac
-  date -u -d "@${epoch}" +"%Y-%m-%dT%H:%M:%SZ" 2>/dev/null \
-    || date -u -r "$epoch" +"%Y-%m-%dT%H:%M:%SZ" 2>/dev/null \
-    || return 1
-}
-
-# portable_user
-#   Print a filename-safe user key from USER or USERNAME (Git Bash often lacks USER).
-portable_user() {
-  local u="${USER:-${USERNAME:-unknown}}"
-  # shellcheck disable=SC2001
-  u="$(printf '%s' "$u" | sed 's/[^[:alnum:]_.-]/_/g')"
-  [ -n "$u" ] || u="unknown"
-  printf '%s' "$u"
-}
-
-# portable_jq_install_hint
-#   Print multi-line per-OS jq install guidance to stdout.
-portable_jq_install_hint() {
-  # Single multi-OS line so portability lint does not flag brew-only messages.
-  printf '%s\n' "Install jq: Windows: winget install jqlang.jq | choco install jq | scoop install jq; Linux: sudo apt install jq | sudo dnf install jq; macOS: brew install jq"
-}
-
-# require_jq
-#   Return 0 if jq is on PATH. Otherwise print install guidance to stderr and
-#   return 1. Caller decides whether to die. Does not implement JSON parse.
-require_jq() {
-  if command -v jq >/dev/null 2>&1; then
-    return 0
-  fi
-  printf 'jq is required but not installed.\n' >&2
-  portable_jq_install_hint >&2
-  return 1
-}
-
-# portable_native_path <path>
-#   Print a path a native (non-MSYS) Windows binary can open. Git Bash mktemp
-#   and $TMPDIR often yield /tmp/... which Node's hq.exe cannot read, so
-#   --body-file looks empty. cygpath -m produces C:/... mixed paths. On
-#   POSIX hosts this is identity. Empty input returns 1.
-portable_native_path() {
-  local p="${1:-}"
-  [ -n "$p" ] || return 1
-  if command -v cygpath >/dev/null 2>&1; then
-    cygpath -m "$p" 2>/dev/null || printf '%s' "$p"
-    return 0
-  fi
-  printf '%s' "$p"
-}
-
-# portable_qmd_models_dir
-#   Print qmd's GGUF cache directory (no trailing slash). Override with
-#   QMD_MODELS_DIR. Otherwise XDG_CACHE_HOME/qmd/models, then
-#   HOME/.cache/qmd/models, then USERPROFILE/.cache/qmd/models (Windows).
-portable_qmd_models_dir() {
-  local d
-  if [ -n "${QMD_MODELS_DIR:-}" ]; then
-    d="$QMD_MODELS_DIR"
-  elif [ -n "${XDG_CACHE_HOME:-}" ]; then
-    d="$XDG_CACHE_HOME/qmd/models"
-  elif [ -n "${HOME:-}" ]; then
-    d="$HOME/.cache/qmd/models"
-  elif [ -n "${USERPROFILE:-}" ]; then
-    d="$USERPROFILE/.cache/qmd/models"
-    if command -v cygpath >/dev/null 2>&1; then
-      d="$(cygpath -u "$d" 2>/dev/null || printf '%s' "$d")"
-    fi
-  else
-    return 1
-  fi
-  case "$d" in
-    */) d="${d%/}" ;;
-  esac
-  printf '%s' "$d"
-}
-
-# portable_qmd_embed_model_ready
-#   Return 0 when a usable GGUF already sits in the qmd models dir so
-#   vsearch/query/embed will not start a multi-hundred-MB download. A file
-#   named by QMD_EMBED_MODEL (basename after the last /) counts; otherwise
-#   any *.gguf of at least 1 MiB counts. Missing dir or tiny placeholders
-#   return 1.
-portable_qmd_embed_model_ready() {
-  local dir want f sz
-  dir="$(portable_qmd_models_dir)" || return 1
-  [ -d "$dir" ] || return 1
-  if [ -n "${QMD_EMBED_MODEL:-}" ]; then
-    want="${QMD_EMBED_MODEL##*/}"
-    if [ -n "$want" ] && [ -f "$dir/$want" ]; then
-      sz="$(wc -c < "$dir/$want" | tr -d '[:space:]')"
-      case "$sz" in
-        ''|*[!0-9]*) ;;
-        *) [ "$sz" -ge 1048576 ] && return 0 ;;
-      esac
-    fi
-  fi
-  for f in "$dir"/*.gguf; do
-    [ -f "$f" ] || continue
-    sz="$(wc -c < "$f" | tr -d '[:space:]')"
-    case "$sz" in
-      ''|*[!0-9]*) continue ;;
-    esac
-    [ "$sz" -ge 1048576 ] && return 0
-  done
-  return 1
-}
-
-# portable_qmd_cmd_would_download_model <command>
-#   Return 0 when a shell command would invoke qmd vsearch, query, embed, or
-#   pull — the subcommands that auto-download GGUF models on first use.
-#   First non-flag argument after a qmd token is the subcommand, so
-#   `qmd search "how to vsearch"` is NOT a match.
-portable_qmd_cmd_would_download_model() {
-  local cmd="${1:-}"
-  [ -n "$cmd" ] || return 1
-  case "$cmd" in
-    *qmd*) ;;
-    *) return 1 ;;
-  esac
-  printf '%s\n' "$cmd" | awk '
-    BEGIN { found = 0 }
-    {
-      n = split($0, raw, /[[:space:];|&]+/)
-      for (i = 1; i <= n; i++) {
-        tok = raw[i]
-        if (tok == "") continue
-        base = tok
-        sub(/^.*\//, "", base)
-        if (base == "qmd" || base == "qmd.exe") {
-          j = i + 1
-          while (j <= n && raw[j] ~ /^-/) j++
-          if (j <= n && raw[j] ~ /^(vsearch|query|embed|pull)$/) {
-            found = 1
-            exit
-          }
-        }
-      }
-    }
-    END { exit found ? 0 : 1 }
-  '
-}

package/assets/scaffold/core/scripts/lib/secret-patterns.sh

@@ -1,58 +0,0 @@
-# shellcheck shell=bash
-# hq-core: public
-# secret-patterns.sh — shared secret-detection patterns for hq-core shell scripts.
-#
-# SOURCED, never executed:  . "$ROOT/core/scripts/lib/secret-patterns.sh"
-# bash 3.2 safe; no associative arrays.
-#
-# Single source of truth for the secret-shaped patterns that generated
-# artifacts (delegation manifests, briefs, pickup prompts, DM payloads) are
-# scanned against before they are written to disk or transmitted. Mirrors the
-# runtime PreToolUse hook at .claude/hooks/detect-secrets.sh — a regression
-# test (core/scripts/tests/hq-delegate-bundle.test.sh) asserts this list stays
-# a superset of the hook's, so the two cannot silently drift.
-#
-# Entries are "<extended-regex>:<human name>". The regex part may not contain
-# a colon; the name may.
-#
-# Entries are the bare token patterns. SECRET_PATTERN_BOUNDARY below is
-# prepended at match time -- keep them in this form so they stay comparable
-# verbatim with the runtime hook's array (see the drift test named above).
-
-# Left token boundary. Without it the sk- pattern matches mid-word and ordinary
-# HQ filenames (a-ri|sk-..., hq-ta|sk-..., controller-di|sk-...) scan as
-# credentials. Mirrors SECRET_BOUNDARY in .claude/hooks/detect-secrets.sh.
-SECRET_PATTERN_BOUNDARY='(^|[^a-zA-Z0-9])'
-
-SECRET_PATTERNS=(
-  "sk-[a-zA-Z0-9._-]{20,}:OpenAI/Stripe key"
-  "ghp_[a-zA-Z0-9]{36,}:GitHub PAT"
-  "AKIA[0-9A-Z]{16}:AWS access key"
-  "xox[bpsa]-[a-zA-Z0-9-]+:Slack token"
-  "Bearer [a-zA-Z0-9._-]{20,}:Bearer token"
-  "-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----:Private key"
-  "glpat-[a-zA-Z0-9_-]{20,}:GitLab PAT"
-  "gho_[a-zA-Z0-9]{36,}:GitHub OAuth token"
-  "github_pat_[a-zA-Z0-9_]{22,}:Fine-grained GitHub PAT"
-  "eyJ[a-zA-Z0-9_-]{20,}\.[a-zA-Z0-9_-]{20,}\.[a-zA-Z0-9_-]{10,}:JWT"
-)
-
-# hq_scan_secrets <file>...
-#   Scan files for secret-shaped content. Prints "pattern: <name> in <file>"
-#   to stderr for every hit (never the matched value itself) and returns 1 if
-#   anything matched, 0 when all files are clean. Missing files are skipped.
-hq_scan_secrets() {
-  local hit=0 f entry pattern name
-  for f in "$@"; do
-    [ -f "$f" ] || continue
-    for entry in "${SECRET_PATTERNS[@]}"; do
-      pattern="${SECRET_PATTERN_BOUNDARY}${entry%%:*}"
-      name="${entry#*:}"
-      if grep -Eq -- "$pattern" "$f" 2>/dev/null; then
-        echo "secret-scan: pattern '$name' matched in $f" >&2
-        hit=1
-      fi
-    done
-  done
-  return "$hit"
-}

package/assets/scaffold/core/scripts/ontology-audience-grant.sh

@@ -1,81 +0,0 @@
-#!/usr/bin/env bash
-# ontology-audience-grant.sh — grant each scoped audience folder to exactly the
-# people in its audience, and prove every grant by readback.
-# Spec: core/knowledge/public/hq-core/ontology-local-spec.md
-#
-# Usage: ontology-audience-grant.sh --company <co> [--dry-run]
-#
-# For every signals/@{key}/_audience.yaml under companies/<co>/:
-#   - grants read on signals/@{key}/, ontology/facts/@{key}/, and each
-#     sources/{channel}/@{key}/ that exists, to each principal that is an
-#     active company member (non-members are skipped with a warning);
-#   - one prefix grant per principal per folder, never per file;
-#   - each grant is the recursive shared glob `<folder>/*` (a bare `<folder>/`
-#     is a private create-only folder since hq-pro #3662);
-#   - reads every grant back with `hq files acl --json`; a missing grant exits 3.
-# Company-audience paths get @all read on signals/{type}/ and
-# ontology/facts/@company/ only. Nothing else under ontology/, signals/,
-# sources/ is granted to @all.
-# Local-only companies (company.yaml cloud: false or absent cloud_uid) exit 0
-# with "local-only, no grants".
-set -uo pipefail
-HQ="${HQ_BIN:-hq}"
-root="${HQ_ROOT:-$(cd "$(dirname "$0")/../.." && pwd)}"
-co="" dry=0
-while [ $# -gt 0 ]; do
-  case "$1" in --company) co="$2"; shift 2 ;; --dry-run) dry=1; shift ;; *) echo "unknown flag $1" >&2; exit 2 ;; esac
-done
-[ -n "$co" ] || { echo "usage: ontology-audience-grant.sh --company <co> [--dry-run]" >&2; exit 2; }
-C="$root/companies/$co"; [ -d "$C" ] || { echo "no company $co" >&2; exit 2; }
-
-cloud=no
-grep -Eq '^cloud:[[:space:]]*true' "$C/company.yaml" 2>/dev/null && cloud=yes
-if [ "$cloud" = no ] && [ -f "$root/companies/manifest.yaml" ]; then
-  # manifest: companies:\n  <co>:\n    cloud_uid: ...  (two-space company keys)
-  awk -v co="$co" '/^  [^ #][^:]*:/{inco=($1==co":")} inco && /^    cloud_uid:[[:space:]]*[^[:space:]]/{f=1} END{exit !f}' "$root/companies/manifest.yaml" && cloud=yes
-fi
-[ "$cloud" = yes ] || { echo "local-only, no grants"; exit 0; }
-
-members="$("$HQ" members --company "$co" list 2>/dev/null | awk 'NR>1{print tolower($1)}')"
-[ -n "$members" ] || { echo "could not list members of $co" >&2; exit 3; }
-
-granted=0 skipped=0 failed=0
-grant() { # <folder/> <principal>
-  # Grant the recursive shared glob `<folder>/*`, never the bare `<folder>/`:
-  # since hq-pro #3662 a bare trailing slash is a private create-only folder
-  # (read on it exposes no children) and ACL reads echo the pattern verbatim.
-  local p="${1%/}/*" who="$2"
-  if [ "$dry" = 1 ]; then echo "would grant read $p -> $who"; return 0; fi
-  "$HQ" files --company "$co" share "$p" --with "$who" --permission read >/dev/null 2>&1 || true
-  if "$HQ" files --company "$co" acl "$p" --json 2>/dev/null | jq -e --arg w "$who" \
-      '.direct[]? | select((.granteeId==$w) or ($w=="@all" and .granteeType=="company-wide")) | select(.permission=="read" or .permission=="write" or .permission=="admin")' >/dev/null; then
-    granted=$((granted+1)); echo "granted read $p -> $who"
-  else
-    failed=$((failed+1)); echo "READBACK FAILED: $p -> $who" >&2
-  fi
-}
-
-for aud in "$C"/signals/@*/_audience.yaml; do
-  [ -f "$aud" ] || continue
-  key="$(basename "$(dirname "$aud")")"; key="${key#@}"
-  principals="$(sed -n 's/^principals:[[:space:]]*\[\(.*\)\]/\1/p' "$aud" | tr ',' '\n' | sed 's/^[[:space:]]*//;s/[[:space:]]*$//' | awk '/@/ { print tolower($0); next } { print }' | grep -v '^$')"
-  prefixes="signals/@$key/"
-  [ -d "$C/ontology/facts/@$key" ] && prefixes="$prefixes ontology/facts/@$key/"
-  for d in "$C"/sources/*/@"$key"; do [ -d "$d" ] && prefixes="$prefixes sources/$(basename "$(dirname "$d")")/@$key/"; done
-  for who in $principals; do
-    # prs_/agt_ principals come from the source's own vault ACL (e.g. meeting
-    # attendees), so they are already company identities; emails must be members.
-    case "$who" in
-      prs_*|agt_*) ;;
-      *) if ! printf '%s\n' "$members" | grep -qxF "$who"; then echo "skip $who (not a member of $co)" >&2; skipped=$((skipped+1)); continue; fi ;;
-    esac
-    for p in $prefixes; do grant "$p" "$who"; done
-  done
-done
-[ -d "$C/ontology/facts/@company" ] && grant "ontology/facts/@company/" "@all"
-for t in action_item commitment decision risk question key_point participant_contribution summary; do
-  [ -d "$C/signals/$t" ] && grant "signals/$t/" "@all"
-done
-
-echo "audience grants for $co: $granted granted, $skipped skipped, $failed failed"
-[ "$failed" -eq 0 ] || exit 3

package/assets/scaffold/core/scripts/ontology-brief.mjs

@@ -1,93 +0,0 @@
-#!/usr/bin/env node
-// ontology-brief.mjs — render a company brief from the reader's LOCAL tree.
-// Spec: core/knowledge/public/hq-core/ontology-local-spec.md
-//
-// Usage: node core/scripts/ontology-brief.mjs --company <co> [--hq-root <p>] [--days N] [--top N] [--json]
-//
-// Reads ontology/entities/, every ontology/facts/@*/ and signals/{type}/ +
-// signals/@*/{type}/ present locally. Sync pull only delivers what the reader
-// may read, so the brief shows exactly their visible facts and signals.
-// Writes nothing. Prints markdown (default) or JSON. Exit 0 with an empty brief
-// ("no local ontology") when nothing is there.
-import fs from "node:fs";
-import path from "node:path";
-
-const TYPES = ["decision", "commitment", "risk", "question", "action_item", "key_point", "participant_contribution", "summary"];
-const args = process.argv.slice(2);
-const opt = { days: 14, top: 10, json: false };
-for (let i = 0; i < args.length; i++) {
-  const k = args[i];
-  if (k === "--company") opt.company = args[++i];
-  else if (k === "--hq-root") opt.root = args[++i];
-  else if (k === "--days") opt.days = Number(args[++i]);
-  else if (k === "--top") opt.top = Number(args[++i]);
-  else if (k === "--json") opt.json = true;
-  else { console.error(`ontology-brief: unknown flag ${k}`); process.exit(2); }
-}
-if (!opt.company) { console.error("usage: ontology-brief.mjs --company <co> [--days N] [--top N] [--json]"); process.exit(2); }
-opt.root = opt.root || process.env.HQ_ROOT || path.resolve(path.dirname(new URL(import.meta.url).pathname), "../..");
-const C = path.join(opt.root, "companies", opt.company);
-if (!fs.existsSync(C)) { console.error(`ontology-brief: no company ${opt.company}`); process.exit(2); }
-
-function fm(file) {
-  const t = fs.readFileSync(file, "utf8");
-  const m = t.match(/^---\n([\s\S]*?)\n---\n?([\s\S]*)$/);
-  const out = { _body: (m ? m[2] : t).trim() };
-  if (m) for (const line of m[1].split("\n")) {
-    const mm = line.match(/^([A-Za-z_]+):\s*(.*)$/);
-    if (mm) out[mm[1]] = mm[2].trim().replace(/^"(.*)"$/, "$1");
-  }
-  return out;
-}
-const walk = (dir, pred) => {
-  if (!fs.existsSync(dir)) return [];
-  const out = [];
-  for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
-    const p = path.join(dir, e.name);
-    if (e.isDirectory()) { if (!e.name.startsWith("_")) out.push(...walk(p, pred)); }
-    else if (pred(p)) out.push(p);
-  }
-  return out;
-};
-
-const entities = walk(path.join(C, "ontology", "entities"), p => p.endsWith(".md")).map(f => fm(f));
-const cutoff = Date.now() - opt.days * 86400e3;
-const signals = walk(path.join(C, "signals"), p => p.endsWith(".md") && !p.includes(`${path.sep}_`))
-  .map(f => ({ ...fm(f), _scope: f.includes(`${path.sep}signals${path.sep}@`) ? "scoped" : "company" }))
-  .filter(s => TYPES.includes(s.type));
-const recent = signals.filter(s => !s.created_at || Date.parse(s.created_at) >= cutoff)
-  .sort((a, b) => (b.created_at || "").localeCompare(a.created_at || ""));
-const facts = new Map(); // slug -> [{scope, line}]
-for (const f of walk(path.join(C, "ontology", "facts"), p => p.endsWith(".md"))) {
-  const d = fm(f); const scope = f.includes(`${path.sep}@company${path.sep}`) ? "company" : "scoped";
-  const slug = d.entity || path.basename(f, ".md");
-  for (const line of d._body.split("\n").filter(l => l.startsWith("- "))) {
-    if (!facts.has(slug)) facts.set(slug, []);
-    facts.get(slug).push({ scope, line: line.slice(2) });
-  }
-}
-const hot = entities.map(e => ({ ...e, _facts: facts.get(e.slug) || [] }))
-  .sort((a, b) => (b._facts.length - a._facts.length) || ((+b.signal_count || 0) - (+a.signal_count || 0)))
-  .slice(0, opt.top);
-
-if (opt.json) {
-  console.log(JSON.stringify({ company: opt.company, entities: entities.length, signals: signals.length,
-    recent: recent.slice(0, opt.top * 2).map(s => ({ type: s.type, scope: s._scope, text: s.canonical_content || s._body })),
-    hot: hot.map(e => ({ name: e.canonical_name, type: e.type, facts: e._facts })) }));
-  process.exit(0);
-}
-if (!entities.length && !signals.length) { console.log(`# ${opt.company} — no local ontology yet\n\nNothing under ontology/ or signals/ that you can see.`); process.exit(0); }
-const out = [`# ${opt.company} — company brief (local)`, "", `${entities.length} entities · ${signals.length} signals you can see · last ${opt.days} days`, "", "## Recent Signals"];
-for (const t of TYPES) {
-  const rows = recent.filter(s => s.type === t).slice(0, 5);
-  if (!rows.length) continue;
-  out.push("", `### ${t.replace("_", " ")}`);
-  for (const s of rows) out.push(`- ${s.canonical_content || s._body} _(${s._scope})_`);
-}
-out.push("", "## Entities");
-for (const e of hot) {
-  out.push("", `### ${e.canonical_name} — ${e.type}`);
-  if (!e._facts.length) out.push("- no facts you can see");
-  for (const f of e._facts.slice(0, 6)) out.push(`- ${f.line} _(${f.scope})_`);
-}
-console.log(out.join("\n"));

package/assets/scaffold/core/scripts/ontology-candidate.sh

@@ -1,100 +0,0 @@
-#!/usr/bin/env bash
-# ontology-candidate.sh — write one signal or entity candidate for the ontology
-# worker to garden. Deterministic, no model call. Spec:
-# core/knowledge/public/hq-core/ontology-local-spec.md
-#
-# Usage:
-#   ontology-candidate.sh write --company <co> --kind signal|entity --type <t> \
-#     --audience <company|email[,email...]> --source-ref <ref> \
-#     (--body-file <path> | --body <text>) [--created-by <email>]
-#   ontology-candidate.sh key <company|email[,email...]>   # print the audience key
-#
-# Exit 0: written, already present (no-op), or capture disabled for the company.
-# Exit 2: bad usage, unknown type, or empty body.
-set -euo pipefail
-
-root="${HQ_ROOT:-$(cd "$(dirname "$0")/../.." && pwd)}"
-here="$(cd "$(dirname "$0")" && pwd)"
-
-SIGNAL_TYPES="action_item commitment decision risk question key_point participant_contribution summary"
-ENTITY_TYPES="person project company concept"
-
-die() { echo "ontology-candidate: $*" >&2; exit 2; }
-
-sha() { if command -v sha256sum >/dev/null 2>&1; then sha256sum | awk '{print $1}'; else shasum -a 256 | awk '{print $1}'; fi; }
-
-normalize_audience() { # stdout: sorted, lowercased, trimmed, comma-joined
-  # Emails are lowercased; person/agent uids (prs_…, agt_…) keep their case.
-  printf '%s' "$1" | tr ',' '\n' | sed 's/^[[:space:]]*//;s/[[:space:]]*$//' \
-    | awk '/@/ { print tolower($0); next } { print }' \
-    | grep -v '^$' | LC_ALL=C sort -u | paste -sd, -
-}
-
-audience_key() {
-  local a; a="$(printf '%s' "$1" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')"
-  [ -n "$a" ] || die "empty audience"
-  if [ "$(printf '%s' "$a" | tr '[:upper:]' '[:lower:]')" = "company" ]; then echo company; return; fi
-  printf '%s' "$(normalize_audience "$a")" | sha | cut -c1-16
-}
-
-cmd="${1:-}"; shift || true
-case "$cmd" in
-  key) audience_key "${1:-}"; exit 0 ;;
-  write) ;;
-  *) die "usage: ontology-candidate.sh write|key ..." ;;
-esac
-
-co="" kind="" type="" audience="" ref="" body="" body_file="" by="${HQ_USER_EMAIL:-}"
-while [ $# -gt 0 ]; do
-  case "$1" in
-    --company) co="$2"; shift 2 ;;
-    --kind) kind="$2"; shift 2 ;;
-    --type) type="$2"; shift 2 ;;
-    --audience) audience="$2"; shift 2 ;;
-    --source-ref) ref="$2"; shift 2 ;;
-    --body) body="$2"; shift 2 ;;
-    --body-file) body_file="$2"; shift 2 ;;
-    --created-by) by="$2"; shift 2 ;;
-    *) die "unknown flag $1" ;;
-  esac
-done
-[ -n "$co" ] && [ -n "$kind" ] && [ -n "$type" ] && [ -n "$audience" ] && [ -n "$ref" ] || die "missing required flag"
-[ -n "$body_file" ] && { [ -f "$body_file" ] || die "no body file $body_file"; body="$(cat "$body_file")"; }
-body="$(printf '%s' "$body" | tr '\n' ' ' | sed 's/[[:space:]]\{1,\}/ /g;s/^ //;s/ $//')"
-[ -n "$body" ] || die "empty body"
-
-case "$kind" in
-  signal) allowed="$SIGNAL_TYPES"; flag=signals_capture; store=signals ;;
-  entity) allowed="$ENTITY_TYPES"; flag=ontology_capture; store=ontology ;;
-  *) die "kind must be signal or entity" ;;
-esac
-case " $allowed " in *" $type "*) ;; *) die "unknown $kind type '$type' (allowed: $allowed)" ;; esac
-
-enabled="$(HQ_ROOT="$root" bash "$here/knowledge-prefs.sh" get "$co" "$flag")" || exit 2
-if [ "$enabled" != "true" ]; then echo "disabled for $co ($flag=false)"; exit 0; fi
-
-key="$(audience_key "$audience")"
-norm_body="$(printf '%s' "$body" | tr '[:upper:]' '[:lower:]')"
-id="$(printf '%s\n%s\n%s\n%s' "$kind" "$type" "$key" "$norm_body" | sha)"
-
-dir="$root/companies/$co/$store/_candidates/$(date -u +%Y-%m-%d)"
-# Idempotent across days: the same candidate already written (pending or done) is a no-op.
-if find "$root/companies/$co/$store/_candidates" -name "$id.md" 2>/dev/null | grep -q .; then
-  echo "exists $id"; exit 0
-fi
-mkdir -p "$dir"
-{
-  echo "---"
-  echo "kind: $kind"
-  echo "type: $type"
-  echo "audience_key: $key"
-  if [ "$key" != "company" ]; then
-    echo "audience: [$(normalize_audience "$audience" | sed 's/,/, /g')]"
-  fi
-  echo "source_ref: \"$ref\""
-  [ -n "$by" ] && echo "created_by: $by"
-  echo "created_at: $(date -u +%Y-%m-%dT%H:%M:%SZ)"
-  echo "---"
-  echo "$body"
-} > "$dir/$id.md.tmp" && mv "$dir/$id.md.tmp" "$dir/$id.md"
-echo "wrote $store/_candidates/$(basename "$dir")/$id.md"