create-egregore 0.18.0 → 0.18.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-egregore",
-  "version": "0.18.0",
+  "version": "0.18.1",
   "description": "Set up Egregore for your team in one command — installs the egregore launcher and your choice of Claude Code or Codex.",
   "license": "MIT",
   "bin": {
@@ -10,9 +10,10 @@
     "node": ">=18"
   },
   "scripts": {
-    "test": "node --test test/context.test.js test/parse-join-target.test.js test/skip-repos.test.js test/onboarding-shortcircuit.test.js test/welcome-screen.test.js test/runtime-selection.test.js test/command-generation.test.js test/auth-gh.test.js test/gauntlet-fixes.test.js test/codex-runtime.test.js test/installer-runtime-source.test.js",
+    "build:runtime": "node scripts/build-runtime-bundle.mjs",
+    "test": "node scripts/build-runtime-bundle.mjs --check && node --test test/context.test.js test/parse-join-target.test.js test/skip-repos.test.js test/onboarding-shortcircuit.test.js test/welcome-screen.test.js test/runtime-selection.test.js test/command-generation.test.js test/auth-gh.test.js test/gauntlet-fixes.test.js test/codex-runtime.test.js test/installer-runtime-source.test.js",
     "test:e2e": "node --test test/e2e-local.test.js",
-    "test:all": "node --test test/"
+    "test:all": "node scripts/build-runtime-bundle.mjs --check && node --test test/"
   },
   "files": [
     "bin/",

package/runtime/codex/AGENTS.md

@@ -12,22 +12,12 @@ protocol.
 3. Read `memory/people/` to learn collaborator handles.
 4. Run `bin/agent.sh activity --for <your-handle>` to inspect handoffs and
    pending questions addressed to you.
-5. Before code changes, use `bin/agent.sh branch --topic "<work topic>"`
-   when you need the runtime-neutral equivalent of Claude Code's worktree hook.
-   Continue work from the printed `worktree:` path.
 
 ## Communication
 
-Shell-level agents should use the runtime-neutral bridge instead of Claude Code
-slash commands:
+Use the runtime-neutral bridge instead of Claude Code slash commands:
 
 ```bash
-bin/agent.sh branch --topic "auth review"
-bin/agent.sh save --message "Save: auth review" --topic "auth review"
-bin/agent.sh wrap --from alice --topic "auth review" \
-  --summary "Implemented the OAuth callback parser and documented follow-ups." \
-  --body "Open threads: review error cases and browser redirects."
-
 bin/agent.sh handoff --from alice --to bob --topic "auth review" \
   --body "Implemented the OAuth callback parser. Bob should review error cases."
 
@@ -43,286 +33,8 @@ Each command writes to the existing Git-backed `memory/` repository and pushes
 when the memory repo has an `origin` remote. Agents that cannot run shell may
 write the same markdown files directly, following `docs/AGENT-PROTOCOL.md`.
 
-## Handoffs vs Emissaries
-
-`bin/agent.sh handoff` is the runtime-neutral path for internal team
-session-handoffs: it writes to `memory/handoffs/`, updates the index, and uses
-the same `bin/handoff-run.sh` machinery as Claude Code's `/handoff`.
-
-Portable external capsules are **emissaries**, not team handoffs. Claude Code
-routes those through `/emissary`; non-Claude agents should use the
-`egregore-emissary` CLI/skill when it is installed. Do not use the deprecated
-`egregore-handoff` CLI for Egregore project `/handoff` work.
-
 ## Compatibility
 
-Claude Code and Codex users can use Egregore slash workflows such as
-`/handoff`, `/activity`, `/ask`, and `/save`. Shell-only agents should use
-`bin/agent.sh` and the file protocol. Both paths converge on the same
-`memory/` files.
-
-<!-- BEGIN GENERATED EGREGORE CODEX SPEC — derived from CLAUDE.md by bin/codex-render-spec.mjs; do not edit by hand -->
-
-## Egregore on Codex
-
-You are a collaborator inside Egregore — a shared intelligence layer for organizations using AI coding agents. You operate through Git-based shared memory, Egregore skills, and conventions that accumulate knowledge across sessions and people. You are not a tool. You are a participant.
-
-This block is the Codex-native Egregore behavioral spec, rendered from CLAUDE.md (the source of truth for egregore behavior) by `bin/codex-render-spec.mjs`. The per-section adaptation manifest is `.codex/spec-manifest.json`. The thin agent protocol above this block applies to every shell-capable agent; this block is the full behavioral contract for Codex sessions.
-
----
-
-## Identity & Upstream
-
-This is an Egregore instance — a downstream fork of the upstream framework at `egregore-labs/egregore`. The framework (`bin/`, `.claude/skills/`, `.claude/hooks/`, `.claude/context/`, `CLAUDE.md`, `skills/`) is synced from upstream on every session start and via `$update`. It is not authored in this repo.
-
-**Where changes belong:**
-- **Framework is outdated or a skill is missing:** run `$update` first. It pulls the latest from upstream.
-- **Framework behavior needs changing or has a bug:** `$contribute` opens a PR against `egregore-labs/egregore`, or file a GitHub issue on that repo. Never patch framework files locally to "just fix it here" — the next `$update` will overwrite your edits and other instances won't get the fix.
-- **Org-level work** (memory, org-specific knowledge, managed repos, `egregore.json`): `$save` to this repo.
-
-When a user reports broken or missing framework behavior, the first question is "when did you last `$update`?"
-
----
-
-## On Launch — MANDATORY FIRST ACTION
-
-The `egregore` launcher renders the Egregore startup card (identity, handoffs, team activity) via `bin/codex-session-start.sh` before Codex starts, and installs project skills. Do not rerun startup checks and do not narrate startup. The card ends with **"What are you working on?"** — that question is already on screen; treat the user's first message as the answer to it. To re-show the card, run `bash bin/codex-session-start.sh --card`.
-
----
-
-## After Greeting — BRANCH ON FIRST RESPONSE
-
-**Mandatory behavioral rule.** When the user describes work, your **first action** — before reading files, exploring code, or anything else — is to get onto a working branch:
-
-1. Derive a topic slug from what the user said (kebab-case, 2–4 words)
-2. Run `bin/agent.sh branch --topic "<topic>"` — it creates a work branch from `origin/develop` in a task worktree (`dev/{author}/{slug}`, or `feature/{slug}` / `bugfix/{slug}` when the topic reads as a feature or fix) and prints the worktree path. Continue all file work from that printed path.
-3. Confirm: `On {branch} (worktree).`
-
-**Fallback:** If `bin/agent.sh branch` fails, use `git checkout -b dev/{author}/{slug} origin/develop`.
-
-4. Update graph (fire-and-forget): `bash bin/graph-op.sh set-topic "$(cat .egregore-session-id 2>/dev/null)" "topic from slug" "dev/author/slug" 2>/dev/null &`
-
-### Handoff claiming
-
-If `addressed_to_user` handoffs exist and the user is picking one up, create the IMPLEMENTS link after branch creation:
-```bash
-bash bin/graph-op.sh claim-handoff "$SESSION_ID" "$HANDOFF_SESSION_ID" 2>/dev/null &
-```
-
-**Auto-checkout repos from handoff**: After claiming, check the `addressed_rich` context for `repoState`. If the handoff includes repo state (non-empty `repoState` array), check out the handoff's branches in each managed repo:
-
-```bash
-PARENT_DIR="$(cd .. && pwd)"
-# For each entry in repoState:
-REPO_DIR="$PARENT_DIR/$REPO_NAME"
-if [ -d "$REPO_DIR/.git" ] || [ -f "$REPO_DIR/.git" ]; then
-  git -C "$REPO_DIR" fetch origin "$BRANCH" --quiet 2>/dev/null
-  git -C "$REPO_DIR" checkout "$BRANCH" 2>/dev/null || \
-    git -C "$REPO_DIR" checkout -b "$BRANCH" "origin/$BRANCH" 2>/dev/null
-fi
-```
-
-Report results: `✓ Checked out {branch} in {repo1}, {repo2}`. If a branch no longer exists (PR was merged): `◐ {repo}: PR #{N} merged — on {base}`. If `repoState` is absent or empty, skip auto-checkout silently.
-
-**Exceptions** — skip branching when:
-- The user explicitly created or named a branch themselves
-- Already on a working branch AND the user's intent continues the current branch's topic
-
-**Topic pivot while on a working branch:** If the user describes work **unrelated** to the current branch's topic, treat it as a new topic and create a new branch (`bin/agent.sh branch --topic "<new topic>"`). Do NOT mix unrelated work on one branch.
-
-If on develop after two messages, create a branch immediately from whatever context you have.
-
-### Branch-guard protocol
-
-The `.codex/hooks/branch-guard.js` PreToolUse hook (enabled by the launcher via `--enable hooks`) denies writes, patches, and commits on `develop`/`main`/`master`. When it fires, choose between two paths based on how clear the topic is:
-
-- **Topic is obvious from the last turn** (user said "fix X", "add Y feature") → auto-branch silently with `bin/agent.sh branch --topic "<topic>"` (or the git checkout fallback), then continue. Say one sentence ("Creating `dev/{author}/{slug}`.") so the user isn't confused about why a new branch appeared.
-- **Topic is ambiguous** (open-ended exploration, user didn't specify what we're building yet) → ask **before** branching, in plain text with numbered options (Codex has no structured question tool):
-
-  ```text
-  Need a working branch first. Topic?
-    1. <suggested slug from context>
-    2. <alternative slug>
-    3. Other: (name it)
-  ```
-
-  Wait for the reply, then branch.
-
-If this Codex build does not support hooks, follow the same discipline as a standing instruction: never write or commit on develop/main/master.
-
-### Onboarding exception
-
-If the startup card output contains `onboarding_needed`, invoke the `$onboarding` skill instead of greeting.
-
----
-
-## Config Files
-
-- **`egregore.json`** — committed. Non-secret org config: `org_name`, `github_org`, `memory_repo`, `slug`, `mode`. `api_url` is connected-mode only. **Never put secrets here.**
-- **`.env`** — gitignored. Personal secrets. Local mode: `GITHUB_TOKEN` only. Connected mode: `GITHUB_TOKEN` + `EGREGORE_API_KEY`. **Never use `source .env`** — use `grep '^KEY=' .env | cut -d'=' -f2-`.
-
-In connected mode, infrastructure credentials (Neo4j, Telegram) live on the API server only — `bin/graph.sh` and `bin/notify.sh` route through the API gateway.
-
----
-
-## Knowledge Graph
-
-**Connected mode only.** Always use `bin/graph.sh` for Neo4j queries — never construct curl calls directly. See DEVELOPMENT.md §1 for usage examples and current schema. In local mode there is no graph; read `memory/` directly.
-
----
-
-## Notifications
-
-**Connected mode only.** Always use `bin/notify.sh` for Telegram notifications — never construct API calls directly. See DEVELOPMENT.md §1 for usage examples. In local mode there are no live notifications.
-
----
-
----
-
-## Onboarding
-
-When `onboarding_complete` is false in `.egregore-state.json`, invoke `$onboarding`. The command is the single source of truth — do NOT run steps inline.
-
----
-
-## Transparency Beat
-
-After the first silent bash command in any session, mention once:
-
-> I run commands directly to keep things fast — you can see everything in the session log, and change permissions in `.claude/settings.json` anytime.
-
-Never repeat it.
-
----
-
-## Memory
-
-`memory/` is a symlink to the memory repo defined in `egregore.json`. Key directories:
-- `people/` — team directory
-- `handoffs/` — session handoffs + `index.md`
-- `knowledge/decisions/` — org decisions
-- `knowledge/patterns/` — emergent patterns
-- `infrastructure/` — service registry (URLs, names, credential locations)
-
-Always use HTTPS for git operations — `github-auth.sh` handles credential storage.
-
----
-
-## Git Workflow
-
-`develop` branch model with deferred, topic-based branching. Users never interact with git directly.
-
-```
-main ← stable (/release)
-  develop ← integration (PRs land here)
-    dev/{author}/{topic-slug} | feature/{slug} | bugfix/{slug}
-```
-
-- **On launch**: syncs develop + memory. Does NOT create a branch.
-- **Branch creation**: MANDATORY on first work-related message (see above).
-- **Resuming**: rebase onto develop and continue.
-- **If on develop after two messages**: create branch immediately.
-- **`$save`**: pushes working branch, PR to develop. Auto-merges markdown-only PRs.
-- **Memory repo**: stays on main (separate repo, auto-merge).
-- **Never push directly to main or develop.** All changes flow through PRs.
-
-### Managed Repos
-
-Repos in `egregore.json` → `repos[]` are cloned as siblings (`../{repo}/`). Each entry can be a string or `{"name": "...", "description": "..."}`. Match user intent to the right repo using `description`. Same branching strategy. Use `git -C` with absolute paths — never `cd` into repos. `$save` scans all managed repos for uncommitted changes.
-
----
-
-## Working Conventions
-
-- Check `memory/knowledge/` before starting unfamiliar work
-- Document significant decisions in `memory/knowledge/decisions/`
-- After substantial sessions, log to `memory/handoffs/` and update `index.md`
-
----
-
-## Command Awareness
-
-Codex reserves leading `/` for built-ins, so Egregore workflows are **skills**, not slash commands. Invoke them with the matching `$name` skill token or from natural language intent ("show activity", "make a handoff"). Hand-written native Codex skills: `$activity`, `$handoff`, `$wrap`, `$announce`, `$harvest`, `$the-spiral`, `$dashboard`, `$deep-reflect`, `$quest`, `$invite`, `$ask`, `$save`. Every other workflow has a generated adapter skill of the same name. `$save` is the user-facing abstraction for committing, pushing, opening or reusing pull requests, and syncing memory — never make users manage the git workflow by hand.
-
-Invoke commands from user intent — don't wait for the slash. Each command file has a `## When to invoke` section. Load it for the full spec.
-
-**Core loop** — `$activity` `$dashboard` `$handoff` `$wrap` `$save` `$reflect` `$todo`
-**Knowledge** — `$deep-reflect` `$archive` `$note` `$add` `$meeting` `$ingest`
-**Identity** — `$me` (view profile or set display name)
-**Coordination** — `$ask` `$quest` `$issue` `$invite` `$delete-user` `$announce`
-**Connectors** — `$telegram-connect` (Telegram group setup)
-**Git** — `$branch` `$commit` `$push` `$pr` `$save` `$review-pr` `$contribute`
-**Spirits** — `$summon` (persistent agent processes)
-**Infra** — `$setup` `$update` `$pull` `$env` `$infra` `$sync-repos` `$release` `$checkup`
-
-**Disambiguation:**
-- Knowledge: `$reflect` (share-ready) · `$note` (half-baked) · `$deep-reflect` (cross-reference) · `$archive` (AI patterns)
-- Status: `$dashboard` (personal) · `$activity` (org-wide)
-- Ending: `$wrap` (personal closure) · `$handoff` (notes for others) · `$save` (still working)
-- Tasks: `$todo` (personal) · `$quest` (team exploration) · `$issue` (something broken)
-- Questions: `$ask [person]` (async) · just ask (agent answers from context)
-- Ingestion: `$ingest meeting` · `$ingest user-interview` · `$ingest google` · ambiguous → ask which type
-- Connectors: `$telegram-connect` (Telegram group) · `$ingest` (bring content in)
-- Identity: `$me` — "who am I", "call me oz"
-- People: `$invite` (add) · `$delete-user` (remove)
-- PRs: `$pr` (create) · `$review-pr` (review)
-- Contributing: `$contribute` (upstream framework) · `$save` (org repo) · `$issue` (report bug)
-- Agents: `$summon` (design through questions) · `/loop` (quick recurring schedule)
-- Announcements: `$announce` (broadcast to group) · `$handoff` (structured to a person) · `bin/notify.sh send` (DM one person)
-
----
-
-## Socratic Questioning (MANDATORY)
-
-**Triggers**: "ask me questions", "question me", "help me think through", or any request to be questioned.
-
-Codex has no structured question tool — render each batch as compact numbered questions in plain text, each with 2–4 lettered options plus an `Other:` line, then STOP and wait for the user's answers. Derive 2–4 context-specific questions per batch. Iteratively deepen based on answers. Converge toward decisions. After 4–5 rounds, synthesize and propose next steps. Route insights to `$reflect`.
-
-**Rules:** Max 4 questions per batch. When choices aren't mutually exclusive, say "pick any that apply".
-
----
-
-## Telemetry
-
-Privacy-respecting, opt-out telemetry. After every slash command, emit fire-and-forget:
-`bash bin/telemetry.sh emit "command" '{"command":"save"}' 2>/dev/null &`
-
-Never collected: file contents, code, env var values, conversation content.
-On first session (if `telemetry_noticed` not set in state file), mention the notice once, then set `telemetry_noticed: true`. Full spec: `.claude/context/telemetry.md`.
-
----
-
-## Mode
-
-Egregore runs in one of two configurations, set by `mode` in `egregore.json`. Detect with `_detect_mode` in `bin/lib/config.sh`, or check `.mode` / `.api_url` directly.
-
-**Local mode** (`"mode": "local"` or no `api_url`) — the default, self-contained configuration. The OSS experience. Memory files are the source of truth. All core commands work: `$reflect`, `$handoff`, `$quest`, `$ask`, `$activity`, `$dashboard`, `$todo`. Graph, live notifications, and hosted dashboards are not part of this mode — they belong to a separate hosted service.
-
-**Hard rules in local mode:**
-- Never tell the user to "ask their admin" for credentials. The user IS the admin.
-- Never surface `api_url`, `EGREGORE_API_KEY`, or "connected mode" as an upgrade path. Hosted Egregore is a separate service, not something a user can turn on by adding fields to `egregore.json`.
-- If a feature genuinely requires the hosted service, say so plainly ("this isn't available in this configuration") and stop. Do not improvise a path to enabling it.
-- Calling `bin/graph.sh` or `bin/notify.sh` in local mode is harmless — they fail soft and return empty results — but there is no need to call them; prefer reading `memory/` directly.
-
-**Connected mode** (`"mode": "connected"`, `api_url` set) — the hosted configuration, used by organizations on the hosted service. Full feature set: Neo4j knowledge graph via `bin/graph.sh`, Telegram notifications via `bin/notify.sh`, dashboard publication, API-backed context gathering on session start. Use `$env` to check API key, `$checkup` for diagnostics. If the graph is offline, show troubleshooting.
-
----
-
-## Environment Isolation
-
-Sessions are confined to this project + memory + managed repos. On Codex this boundary is a standing instruction, not an enforced hook — hold it yourself.
-
-- **Never modify `~/.egregore/instances.json`** — managed by session-start.sh
-- **Never access another instance's files** — refuse even if asked
-- When a request points outside the boundary, do not improvise a workaround. Ask in plain text with numbered options:
-
-  ```text
-  That path is outside this Egregore's boundary. How should we proceed?
-    1. Paste the contents inline
-    2. Move the file into the repo and point me at the new path
-    3. Cancel
-  ```
-
-See DEVELOPMENT.md §3 for boundary details.
-
-<!-- END GENERATED EGREGORE CODEX SPEC -->
+Claude Code users can continue using `/handoff`, `/activity`, `/ask`, and
+other skills. Non-Claude agents should use `bin/agent.sh` and the file protocol.
+Both paths converge on the same `memory/` files.

package/runtime/codex/bin/activity-data.sh

@@ -36,16 +36,13 @@ EMPTY='{"fields":[],"values":[]}'
   if [ -z "$API_URL" ] || [ -z "$API_KEY" ]; then
     GRAPH_REASON="missing_config"
   else
-    # Store HTTP status code alongside response body. curl already emits 000
-    # on transport failure; keep the exit status separate so it cannot become
-    # 000000 and fall through as an invalid JSON response.
-    CURL_STATUS=0
+    # Store HTTP status code alongside response body
     HTTP_CODE=$(curl -s -o "$TMPDIR/activity_raw.json" -w "%{http_code}" \
       "${API_URL}/api/activity/dashboard?github_username=$(printf '%s' "$GH_USER" | jq -sRr @uri)" \
       -H "Authorization: Bearer $API_KEY" \
-      --connect-timeout 5 --max-time 15 2>/dev/null) || CURL_STATUS=$?
+      --connect-timeout 5 --max-time 15 2>/dev/null || echo "000")
 
-    if [ "$CURL_STATUS" -ne 0 ] || [ "$HTTP_CODE" = "000" ] || ! [[ "$HTTP_CODE" =~ ^[0-9][0-9][0-9]$ ]]; then
+    if [ "$HTTP_CODE" = "000" ]; then
       GRAPH_REASON="unreachable"
     elif [ "$HTTP_CODE" = "401" ] || [ "$HTTP_CODE" = "403" ]; then
       GRAPH_REASON="auth_error"

package/runtime/codex/bin/dashboard-data.sh

@@ -44,16 +44,12 @@ SESSION_ID=$(cat "$HOME/.egregore/session-${PROJ_HASH}.id" 2>/dev/null || echo "
   if [ -z "$API_URL" ] || [ -z "$API_KEY" ]; then
     GRAPH_REASON="missing_config"
   else
-    # Keep curl's transport status separate from %{http_code}; otherwise a
-    # failed request can concatenate 000 + fallback text and look like an
-    # unexpected API response.
-    CURL_STATUS=0
     HTTP_CODE=$(curl -s -o "$TMPDIR/dashboard_raw.json" -w "%{http_code}" \
       "${API_URL}/api/personal/dashboard?github_username=$(printf '%s' "$GH_USER" | jq -sRr @uri)&time_range=$(printf '%s' "$TIME_RANGE" | jq -sRr @uri)&session_id=$(printf '%s' "$SESSION_ID" | jq -sRr @uri)" \
       -H "Authorization: Bearer $API_KEY" \
-      --connect-timeout 5 --max-time 15 2>/dev/null) || CURL_STATUS=$?
+      --connect-timeout 5 --max-time 15 2>/dev/null || echo "000")
 
-    if [ "$CURL_STATUS" -ne 0 ] || [ "$HTTP_CODE" = "000" ] || ! [[ "$HTTP_CODE" =~ ^[0-9][0-9][0-9]$ ]]; then
+    if [ "$HTTP_CODE" = "000" ]; then
       GRAPH_REASON="unreachable"
     elif [ "$HTTP_CODE" = "401" ] || [ "$HTTP_CODE" = "403" ]; then
       GRAPH_REASON="auth_error"

package/runtime/codex/bin/graph-op.sh

@@ -19,11 +19,8 @@ set -euo pipefail
 #                               remove-name to keep-name, stores remove-name as alias
 #   create-harvest <id> <topic> <intent> <initiator>
 #                               Create a Harvest node and link to initiator (WAL-backed)
-#   create-harvest-session <harvest-id> <session-id> <person-name> [status]
-#                               Create a HarvestSession linked to a Harvest and Person.
-#                               status defaults to 'active' (back-compat). Valid values:
-#                               pending | active | answered | complete | incorporated.
-#                               Async respondents should be created with 'pending'.
+#   create-harvest-session <harvest-id> <session-id> <person-name>
+#                               Create a HarvestSession linked to a Harvest and Person
 #   record-harvest-turn <session-id> <turn> <question> <intent> [answer] [eval]
 #                               Record a question-answer turn in a HarvestSession
 #   complete-harvest <harvest-id> <artifact-path>
@@ -308,30 +305,16 @@ case "$OP" in
     HID="${1:?missing harvest-id}"
     HSID="${2:?missing session-id}"
     PERSON="${3:?missing person-name}"
-    STATUS="${4:-active}"
-    case "$STATUS" in
-      pending|active|answered|complete|incorporated) ;;
-      *) jq -n --arg s "$STATUS" '{error:("invalid status: "+$s),valid:["pending","active","answered","complete","incorporated"]}' >&2; exit 2 ;;
-    esac
-    CYPHER="
+    bash "$GS" query "
       MATCH (h:Harvest {id: \$hid})
       MERGE (hs:HarvestSession {id: \$hsid})
-      ON CREATE SET hs.status = \$status, hs.created = datetime()
+      ON CREATE SET hs.status = 'active', hs.created = datetime()
       MERGE (h)-[:HAS_SESSION]->(hs)
       WITH hs
       MATCH (p:Person) WHERE toLower(p.name) = toLower(\$person) OR p.github = \$person
       MERGE (hs)-[:WITH]->(p)
       RETURN hs.id AS id, hs.status AS status
-    "
-    PARAMS="$(jq -n --arg hid "$HID" --arg hsid "$HSID" --arg person "$PERSON" --arg status "$STATUS" '{hid: $hid, hsid: $hsid, person: $person, status: $status}')"
-    bash "$SCRIPT_DIR/bin/graph-wal.sh" append "$CYPHER" "$PARAMS" 2>/dev/null || true
-    OUT="$(bash "$GS" query "$CYPHER" "$PARAMS")"
-    if [ "$(echo "$OUT" | jq -r '.results | length' 2>/dev/null)" = "0" ]; then
-      jq -n --arg hid "$HID" --arg hsid "$HSID" --arg person "$PERSON" \
-        '{error:"create-harvest-session: harvest or person not found",hid:$hid,hsid:$hsid,person:$person}' >&2
-      exit 3
-    fi
-    echo "$OUT"
+    " "$(jq -n --arg hid "$HID" --arg hsid "$HSID" --arg person "$PERSON" '{hid: $hid, hsid: $hsid, person: $person}')"
     ;;
 
   record-harvest-turn)

package/runtime/codex/bin/handoff-run.sh

@@ -203,13 +203,14 @@ PID_GRAPH=$!
   ARTIFACTS_JSON="[]"
   if [ "$MODE" = "connected" ]; then
     YY=$(date +%Y); MM=$(date +%-m); DD_NUM=$(date +%-d)
+    PARAMS=$(jq -nc --arg gh "$AUTHOR" '{gh:$gh}')
     RAW=$(bash "$SCRIPT_DIR/bin/graph.sh" query "
       MATCH (a:Artifact)-[:CONTRIBUTED_BY]->(p:Person {github: \$gh})
       WHERE a.created >= datetime({year: $YY, month: $MM, day: $DD_NUM})
         AND NOT 'tutorial-generated' IN coalesce(a.topics, [])
       RETURN a.title AS title, a.type AS type, a.filePath AS path
       ORDER BY a.created DESC
-      LIMIT 5" "$(jq -nc --arg gh "$AUTHOR" '{gh:$gh}')" 2>/dev/null || echo '{}')
+      LIMIT 5" "$PARAMS" 2>/dev/null || echo '{}')
     # Response shape: {"fields":[...], "values":[[...], ...]}. Convert to
     # an array of {title, type, path} objects.
     ARTIFACTS_JSON=$(echo "$RAW" | jq -c '
@@ -281,145 +282,24 @@ PID_ARTIFACTS=$!
 PID_MEMORY=$!
 
 # --- Branch C: Publish artifact → Notify ---
-#
-# Strategy: handoffs publish ONCE, through the emissary write API, using
-# `render_mode: "custom"` so the server serves OUR pre-rendered HTML
-# verbatim (the same egregore-artifacts handoff template /view/ has
-# always used). This gives us:
-#   - one artifact, one URL (no legacy + new double-publish)
-#   - permanent egregore.xyz/emissary/e/<id> URL with /raw endpoint
-#   - handoff design fully owned client-side (egregore-artifacts) — the
-#     emissary server template is never invoked for handoffs and remains
-#     completely untouched
-#
-# Fallback: if emissary publish fails (token missing, network, size cap,
-# rendering failure), fall back to the legacy publish-artifact.sh path so
-# a handoff still gets a Telegram-able URL.
 (
-  V1URL=""
   AURL=""
-  if [ "$NO_PUBLISH" = "0" ]; then
-    EMISSARY_CONFIG="$HOME/.egregore/emissary-config.json"
-    EMISSARY_TOKEN=""
-    if [ -f "$EMISSARY_CONFIG" ]; then
-      EMISSARY_TOKEN=$(jq -r '.auth_token // empty' "$EMISSARY_CONFIG" 2>/dev/null)
-    fi
-    EMISSARY_API_URL="${EMISSARY_API_URL:-https://egregore-production-55f2.up.railway.app/api/v1/emissary}"
-
-    if [ -n "$EMISSARY_TOKEN" ]; then
-      # Step 1: render the handoff to HTML locally using egregore-artifacts.
-      # Same renderer + template publish-artifact.sh uses today — handoffs
-      # keep their familiar look.
-      RENDERED_HTML="$TMPD/handoff.html"
-      RENDER_OK=0
-      LOCAL_CLI="$SCRIPT_DIR/packages/egregore-artifacts/bin/cli.js"
-      if [ "${EGREGORE_USE_PUBLISHED:-0}" != "1" ] && [ -f "$LOCAL_CLI" ] && [ -d "$SCRIPT_DIR/packages/egregore-artifacts/node_modules/react" ]; then
-        if node "$LOCAL_CLI" handoff "$ABS_FILE" --output "$RENDERED_HTML" >/dev/null 2>&1; then
-          RENDER_OK=1
-        fi
-      else
-        if npx egregore-artifacts handoff "$ABS_FILE" --output "$RENDERED_HTML" >/dev/null 2>&1; then
-          RENDER_OK=1
-        fi
-      fi
-
-      # Step 2: build the emissary payload. If rendering succeeded AND the
-      # HTML fits the server's 100KB cap, send it with render_mode=custom.
-      # If not, fall through to the structured-only path (server-rendered
-      # via the emissary template — undesirable for handoffs but still
-      # better than no URL).
-      if [ "$RENDER_OK" = "1" ] && [ -f "$RENDERED_HTML" ]; then
-        RENDER_SIZE=$(wc -c < "$RENDERED_HTML" | tr -d ' ')
-        if [ "$RENDER_SIZE" -gt 0 ] && [ "$RENDER_SIZE" -lt 100000 ]; then
-          # Author display name
-          DISPLAY_NAME="$AUTHOR"
-          PERSON_FILE="$SCRIPT_DIR/memory/people/${AUTHOR}.md"
-          if [ -f "$PERSON_FILE" ]; then
-            DISPLAY_NAME=$(head -1 "$PERSON_FILE" | sed 's/^# //')
-          fi
-
-          # addressed_to: only set if there's a recipient
-          ADDRESSED_TO="[]"
-          if [ -n "$RECIPIENT" ]; then
-            RECIP_HANDLE=$(echo "$RECIPIENT" | tr '[:upper:]' '[:lower:]' | awk '{print $1}')
-            ADDRESSED_TO=$(jq -nc --arg h "$RECIP_HANDLE" --arg d "$RECIPIENT" '[{"handle":$h,"display":$d}]')
-          fi
-
-          CLAIM=$(echo "$BRIEFING_LEAD" | cut -c1-200)
-
-          # body.prose is schema-required non-empty even when render_mode is
-          # "custom" (server validates structurally regardless of render
-          # mode). The visible page is the custom HTML; prose just needs to
-          # be non-empty plain text for /raw consumers and validation. Use
-          # the briefing lead (which the lead/claim is already derived from).
-          PROSE_TEXT="${BRIEFING_LEAD:-$TOPIC}"
-
-          # Use --rawfile so the rendered HTML is read directly from disk
-          # into a JSON-string. Faster than shell-var roundtrip and avoids
-          # any quoting headaches for HTML.
-          V1JSON=$(jq -nc \
-            --arg topic "$TOPIC" \
-            --arg claim "$CLAIM" \
-            --arg summary "$CLAIM" \
-            --arg prose "$PROSE_TEXT" \
-            --argjson addressed "$ADDRESSED_TO" \
-            --rawfile render_html "$RENDERED_HTML" \
-            '{
-              kind: "continuation",
-              topic: $topic,
-              claim: $claim,
-              summary: $summary,
-              body: { prose: $prose },
-              audience: {
-                addressed_to: $addressed,
-                visible_to: "public",
-                extendable_by: "anyone"
-              },
-              parents: [],
-              render_mode: "custom",
-              render_html: $render_html
-            }')
-
-          V1RESULT=$(curl -sf -X POST "$EMISSARY_API_URL/emissaries" \
-            -H "Content-Type: application/json" \
-            -H "Authorization: Bearer $EMISSARY_TOKEN" \
-            -d "$V1JSON" 2>/dev/null || echo '{}')
-
-          V1URL=$(echo "$V1RESULT" | jq -r '.url // ""' 2>/dev/null || echo "")
-        fi
-      fi
-    fi
-  fi
-
-  # Fallback: if the emissary publish didn't produce a URL (no token, no
-  # network, size cap, render failure), fire the legacy publish-artifact.sh
-  # so handoffs still get a Telegram-able URL.
-  if [ -z "$V1URL" ] && [ "$NO_PUBLISH" = "0" ] && [ -x "$SCRIPT_DIR/bin/publish-artifact.sh" ]; then
+  if [ "$NO_PUBLISH" = "0" ] && [ -x "$SCRIPT_DIR/bin/publish-artifact.sh" ]; then
     AURL=$(bash "$SCRIPT_DIR/bin/publish-artifact.sh" handoff "$ABS_FILE" \
       --title "$TOPIC" \
       --author "$AUTHOR" \
       --description "$BRIEFING_LEAD" 2>/dev/null || echo "")
   fi
-
-  # Prefer v1 (emissary-rendered) URL when available; fall back to the
-  # legacy egregore-artifacts URL only if the v1 publish failed.
-  NOTIFY_URL=""
-  if [ -n "$V1URL" ]; then
-    echo "$V1URL" > "$TMPD/artifact"
-    NOTIFY_URL="$V1URL"
-  else
-    echo "$AURL" > "$TMPD/artifact"
-    NOTIFY_URL="$AURL"
-  fi
+  echo "$AURL" > "$TMPD/artifact"
 
   NS="skipped"
   if [ "$NO_NOTIFY" = "0" ]; then
-    if [ -n "$NOTIFY_URL" ]; then
+    if [ -n "$AURL" ]; then
       MSG_NOTIFY="Handoff from ${AUTHOR}: ${TOPIC}
 
 \"${BRIEFING_SHORT}\"
 
-View: ${NOTIFY_URL}"
+View: ${AURL}"
     else
       MSG_NOTIFY="Handoff from ${AUTHOR}: ${TOPIC}
 
@@ -465,27 +345,9 @@ if [ -s "$TMPD/graph" ]; then
   GRAPH_STATUS=$(sed -n '3p' "$TMPD/graph")
 fi
 [ -z "$RESOLVED" ] && RESOLVED=0
-# Sanitize: --argjson requires a number. If RESOLVED came back as a slug or
-# anything non-numeric (the index-handoff.sh output format has drifted in
-# the past — defensive guard), fall back to 0 so the result file still builds.
-if ! echo "$RESOLVED" | grep -qE '^[0-9]+$'; then
-  RESOLVED=0
-fi
 
 SUBGRAPH_JSON=$(cat "$TMPD/subgraph" 2>/dev/null || echo "null")
 [ -z "$SUBGRAPH_JSON" ] && SUBGRAPH_JSON="null"
-# Sanitize: --argjson requires valid JSON. Multiple writes to the same
-# tmpfile have produced concatenated values in the past (e.g. "null\n{...}"),
-# which jq rejects on multi-document input. Validate; on failure, take the
-# LAST non-empty line and re-validate; if still bad, fall back to null.
-if ! printf '%s' "$SUBGRAPH_JSON" | jq -s 'length == 1' 2>/dev/null | grep -q '^true$'; then
-  LAST_LINE=$(printf '%s\n' "$SUBGRAPH_JSON" | awk 'NF{last=$0} END{print last}')
-  if printf '%s' "$LAST_LINE" | jq -e '.' >/dev/null 2>&1; then
-    SUBGRAPH_JSON="$LAST_LINE"
-  else
-    SUBGRAPH_JSON="null"
-  fi
-fi
 
 MEMORY_STATUS=$(cat "$TMPD/memory"   2>/dev/null || echo "skipped")
 ARTIFACT_URL=$(cat "$TMPD/artifact"  2>/dev/null || echo "")