create-egregore 0.19.21 → 0.19.22

package/assets/egregore-launcher.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// egregore-launcher-version: 0.19.21
+// egregore-launcher-version: 0.19.22
 //
 // egregore — launch and browse Egregore instances from your terminal.
 // Installed by create-egregore. Reads ~/.egregore/instances.json.
@@ -33,7 +33,7 @@ const crypto = require("node:crypto");
 const { spawnSync, spawn } = require("node:child_process");
 const readline = require("node:readline");
 
-const VERSION = "0.19.21";
+const VERSION = "0.19.22";
 const REGISTRY = path.join(os.homedir(), ".egregore", "instances.json");
 const DEFAULT_FILE = path.join(os.homedir(), ".egregore", "default");
 const UPDATE_CACHE_FILE = path.join(os.homedir(), ".egregore", "update-check.json");
@@ -435,7 +435,33 @@ function piTrustArgs() {
 }
 
 function commandExists(bin) {
-  return spawnSync("which", [bin], { stdio: "pipe" }).status === 0;
+  if (typeof bin !== "string" || bin.length === 0) return false;
+  const pathValue = process.env.PATH || process.env.Path || process.env.path || "";
+  const separator = process.platform === "win32" ? ";" : ":";
+  const names =
+    process.platform === "win32" && !path.extname(bin)
+      ? (process.env.PATHEXT || ".COM;.EXE;.BAT;.CMD")
+          .split(";")
+          .filter(Boolean)
+          .map((extension) => `${bin}${extension.toLowerCase()}`)
+      : [bin];
+
+  return pathValue.split(separator).some((entry) => {
+    const directory = entry ? entry.replace(/^"(.*)"$/, "$1") : process.cwd();
+    return names.some((name) => {
+      const candidate = path.join(directory, name);
+      try {
+        if (!fs.statSync(candidate).isFile()) return false;
+        fs.accessSync(
+          candidate,
+          process.platform === "win32" ? fs.constants.F_OK : fs.constants.X_OK,
+        );
+        return true;
+      } catch {
+        return false;
+      }
+    });
+  });
 }
 
 function runtimeChoiceDescription(runtime, inst, stored) {

package/bin/cli.js

@@ -44,6 +44,7 @@ const {
   redactToken,
 } = require("../lib/setup");
 const { detectContext, isWritable, isSystemDir } = require("../lib/context");
+const { commandExists } = require("../lib/path-lookup");
 
 const API_URL = process.env.EGREGORE_API_URL || "https://egregore-production-55f2.up.railway.app";
 const INSTANCES_FILE = path.join(os.homedir(), ".egregore", "instances.json");
@@ -97,7 +98,7 @@ function detectCwdEgregore(cwd) {
 }
 
 function binaryOnPath(bin) {
-  return spawnSync("which", [bin], { stdio: "pipe" }).status === 0;
+  return commandExists(bin);
 }
 
 function assistantLabel(runtime) {
@@ -406,7 +407,6 @@ async function preflight() {
   // Verify prerequisites before starting. Fast fail with specific fix hints
   // beats discovering missing tools mid-install. Claude Code is checked
   // separately at auto-exec time since users can install it after.
-  const { spawnSync } = require("node:child_process");
   const checks = [
     { bin: "git",    hint: "install Xcode command-line tools or https://git-scm.com" },
     { bin: "jq",     hint: "brew install jq  (or https://stedolan.github.io/jq/)" },
@@ -417,8 +417,7 @@ async function preflight() {
     missing.push({ bin: "node >=18", hint: `you're on Node ${process.versions.node}; upgrade at https://nodejs.org` });
   }
   for (const c of checks) {
-    const r = spawnSync("which", [c.bin], { stdio: "pipe" });
-    if (r.status !== 0) missing.push(c);
+    if (!commandExists(c.bin)) missing.push(c);
   }
   if (missing.length === 0) return;
 

package/lib/auth.js

@@ -5,6 +5,7 @@
 
 const https = require("node:https");
 const { spawnSync } = require("node:child_process");
+const { commandExists } = require("./path-lookup");
 
 /**
  * Try to get a token from the user's `gh` CLI, if installed and authenticated.
@@ -31,8 +32,7 @@ function envGhAuth() {
 
 function ghCliExists() {
   if (process.env.EGREGORE_SKIP_GH === "1") return false;
-  const which = spawnSync("which", ["gh"], { stdio: "pipe" });
-  return which.status === 0;
+  return commandExists("gh");
 }
 
 function canUseInteractiveBrowserFlow() {
@@ -46,8 +46,7 @@ const GH_INSTALL_URL = "https://cli.github.com";
 // and repos vary too much for a single command, so we point at the canonical
 // page there (and always print GH_INSTALL_URL alongside on every platform).
 function _has(b) {
-  try { return spawnSync("which", [b], { stdio: "pipe" }).status === 0; }
-  catch { return false; }
+  return commandExists(b);
 }
 
 // True on a machine with no way to open a browser (server / SSH). macOS and

package/lib/path-lookup.js

@@ -0,0 +1,59 @@
+"use strict";
+
+const fs = require("node:fs");
+const path = require("node:path");
+
+function executableFile(candidate, platform) {
+  try {
+    if (!fs.statSync(candidate).isFile()) return false;
+    fs.accessSync(
+      candidate,
+      platform === "win32" ? fs.constants.F_OK : fs.constants.X_OK,
+    );
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function executableNames(command, env, platform) {
+  if (platform !== "win32" || path.extname(command)) return [command];
+  const pathExt = env.PATHEXT || ".COM;.EXE;.BAT;.CMD";
+  return pathExt
+    .split(";")
+    .filter(Boolean)
+    .map((extension) => `${command}${extension.toLowerCase()}`);
+}
+
+/**
+ * Resolve a command from PATH without relying on the external `which` utility.
+ *
+ * NixOS provides declared executables through PATH but does not guarantee
+ * `which` is installed. Keeping this lookup in Node also avoids spawning a
+ * subprocess for every prerequisite and harness check.
+ */
+function commandExists(command, options = {}) {
+  if (typeof command !== "string" || command.length === 0) return false;
+
+  const env = options.env || process.env;
+  const platform = options.platform || process.platform;
+  const cwd = options.cwd || process.cwd();
+  const separator = platform === "win32" ? ";" : ":";
+  const pathValue = env.PATH || env.Path || env.path || "";
+  const names = executableNames(command, env, platform);
+  const hasPathSeparator =
+    path.isAbsolute(command) || command.includes("/") || command.includes("\\");
+
+  if (hasPathSeparator) {
+    return names.some((name) =>
+      executableFile(path.isAbsolute(name) ? name : path.resolve(cwd, name), platform),
+    );
+  }
+
+  return pathValue.split(separator).some((entry) => {
+    const directory = entry ? entry.replace(/^"(.*)"$/, "$1") : cwd;
+    return names.some((name) => executableFile(path.join(directory, name), platform));
+  });
+}
+
+module.exports = { commandExists };

package/lib/setup.js

@@ -17,6 +17,7 @@ const {
   installPiRuntime,
   reportPiRuntimeSummary,
 } = require("./pi-runtime");
+const { commandExists } = require("./path-lookup");
 
 const https = require("node:https");
 
@@ -154,6 +155,45 @@ function slugifyName(name) {
     .replace(/^-|-$/g, "");
 }
 
+/**
+ * Choose an install directory without ever adopting an unrelated checkout.
+ *
+ * Most Egregore forks are named "egregore", so deriving the target only from
+ * the fork basename makes different organizations collide in the same parent
+ * directory. If that default path is already a Git checkout with another
+ * origin, leave it untouched and use egregore-{org-slug}. The fallback must
+ * also be absent or point at the requested fork; otherwise stop rather than
+ * guessing at another path.
+ */
+function resolveEgregoreInstallDir(base, forkUrl, slug) {
+  const forkDirName = forkUrl.split("/").pop().replace(/\.git$/, "");
+  const requestedDir = path.join(base, forkDirName);
+  const requestedGitPath = path.join(requestedDir, ".git");
+
+  if (!fs.existsSync(requestedGitPath) || gitRemoteMatches(requestedDir, forkUrl)) {
+    return { egregoreDir: requestedDir, redirectedFrom: null };
+  }
+
+  const safeSlug = slugifyName(slug) || "instance";
+  const fallbackDir = path.join(base, `egregore-${safeSlug}`);
+  if (path.resolve(fallbackDir) === path.resolve(requestedDir)) {
+    throw new Error(
+      `Refusing to install into ${requestedDir}: its Git origin does not match ${forkUrl}`
+    );
+  }
+
+  if (fs.existsSync(fallbackDir)) {
+    const fallbackGitPath = path.join(fallbackDir, ".git");
+    if (!fs.existsSync(fallbackGitPath) || !gitRemoteMatches(fallbackDir, forkUrl)) {
+      throw new Error(
+        `Refusing to install into ${fallbackDir}: the fallback path already belongs to another checkout or directory`
+      );
+    }
+  }
+
+  return { egregoreDir: fallbackDir, redirectedFrom: requestedDir };
+}
+
 function normalizeUsageType(data = {}) {
   if (data.usage_type === "founder_group" || data.usage_type === "joiner_group") {
     return data.usage_type;
@@ -341,8 +381,17 @@ async function install(data, ui, targetDir, opts = {}) {
   const preferredRuntime = normalizeRuntime(opts.runtime);
 
   // Directory name from fork URL (what git clone would use), e.g. "egregore"
-  const forkDirName = fork_url.split("/").pop().replace(/\.git$/, "");
-  const egregoreDir = path.join(base, forkDirName);
+  let forkDirName = fork_url.split("/").pop().replace(/\.git$/, "");
+  const {
+    egregoreDir,
+    redirectedFrom,
+  } = resolveEgregoreInstallDir(base, fork_url, slug || github_org || org_name);
+  if (redirectedFrom) {
+    forkDirName = path.basename(egregoreDir);
+    ui.warn(
+      `${redirectedFrom} belongs to another Git origin — leaving it untouched and installing at ${egregoreDir}`
+    );
+  }
   const memoryDirName = memory_url
     .split("/")
     .pop()
@@ -953,10 +1002,6 @@ function installCodexSkills(egregoreDir) {
   return false;
 }
 
-function commandExists(bin) {
-  return spawnSync("which", [bin], { stdio: "pipe" }).status === 0;
-}
-
 function registerInstance(slug, name, egregoreDir, runtime) {
   const registryDir = path.join(os.homedir(), ".egregore");
   const registryFile = path.join(registryDir, "instances.json");
@@ -1433,5 +1478,6 @@ module.exports = {
   initMemoryDirs,
   ensureDevelop,
   ensureConnectedConfig,
+  resolveEgregoreInstallDir,
   run,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-egregore",
-  "version": "0.19.21",
+  "version": "0.19.22",
   "description": "Set up Egregore for your team in one command — installs the egregore launcher and your choice of Claude Code, Codex, or Pi.",
   "license": "MIT",
   "bin": {
@@ -12,7 +12,7 @@
   "scripts": {
     "build:runtime": "node scripts/build-runtime-bundle.mjs && node scripts/build-pi-runtime-bundle.mjs",
     "build:pi-runtime": "node scripts/build-pi-runtime-bundle.mjs",
-    "test": "node scripts/build-runtime-bundle.mjs --check && node scripts/build-pi-runtime-bundle.mjs --check && node --test test/context.test.js test/parse-join-target.test.js test/skip-repos.test.js test/onboarding-shortcircuit.test.js test/welcome-screen.test.js test/runtime-selection.test.js test/command-generation.test.js test/auth-gh.test.js test/gauntlet-fixes.test.js test/codex-runtime.test.js test/pi-runtime.test.js test/pi-product-workflows.test.js test/installer-runtime-source.test.js test/scroll-repro.test.js test/launcher-refocus-redraw.test.js test/multiselect-remote-search.test.js test/back-navigation.test.js test/manifest-form.test.js test/launcher-delete.test.js test/launcher-connect.test.js test/launcher-connected-status.test.js test/launcher-permissions.test.js test/launcher-update.test.js test/connected-config.test.js",
+    "test": "node scripts/build-runtime-bundle.mjs --check && node scripts/build-pi-runtime-bundle.mjs --check && node --test test/context.test.js test/path-lookup.test.js test/nixos-portability.test.js test/parse-join-target.test.js test/skip-repos.test.js test/install-origin-guard.test.js test/onboarding-shortcircuit.test.js test/welcome-screen.test.js test/runtime-selection.test.js test/command-generation.test.js test/auth-gh.test.js test/gauntlet-fixes.test.js test/codex-runtime.test.js test/pi-runtime.test.js test/pi-product-workflows.test.js test/installer-runtime-source.test.js test/scroll-repro.test.js test/launcher-refocus-redraw.test.js test/multiselect-remote-search.test.js test/back-navigation.test.js test/manifest-form.test.js test/launcher-delete.test.js test/launcher-connect.test.js test/launcher-connected-status.test.js test/launcher-permissions.test.js test/launcher-update.test.js test/connected-config.test.js",
     "test:e2e": "node --test test/e2e-local.test.js",
     "test:all": "node scripts/build-runtime-bundle.mjs --check && node scripts/build-pi-runtime-bundle.mjs --check && node --test test/"
   },

package/runtime/codex/.claude/context/notification-consent.md

@@ -0,0 +1,66 @@
+# External notification consent
+
+This protocol applies to every Telegram, Teams, or other external notification
+in every harness. It applies even when the user asked to announce, notify,
+handoff, invite, or message someone, and even when the harness is running with
+broad tool permissions.
+
+## Invariant
+
+Never dispatch an external notification until the human has approved that one
+exact delivery in a dedicated checkpoint. The checkpoint must show:
+
+- the organization;
+- the final recipient or group;
+- every channel that will receive it;
+- the exact final message, including links.
+
+A workflow request, plan approval, batch approval, prior approval, broad
+permission mode, or approval of a related action is not notification consent.
+There is no standing "always allow" choice. One approval authorizes one attempt
+to send one immutable message.
+
+## Required flow
+
+1. Finish the message first. Publish any artifact and insert its real URL
+   before planning; never change the message after preview.
+2. Resolve the exact delivery without sending:
+
+   ```bash
+   PLAN_JSON=$(bash bin/notify.sh plan send "$RECIPIENT" "$MESSAGE")
+   # or
+   PLAN_JSON=$(bash bin/notify.sh plan group "$MESSAGE")
+   ```
+
+3. Read `plan_id` and `digest` from `PLAN_JSON`. Show the organization,
+   recipient, all `channels`/`deliveries`, and exact `message` in a dedicated
+   Send / Edit / Cancel question. Use the harness's structured question UI
+   when available. Otherwise show the same fields in plain text and stop for
+   the user's answer.
+4. Only if the user selects Send for that exact preview:
+
+   ```bash
+   APPROVAL_JSON=$(bash bin/notify.sh approve \
+     "$PLAN_ID" "$DIGEST" APPROVE_EXACT_NOTIFICATION)
+   APPROVAL_TOKEN=$(printf '%s' "$APPROVAL_JSON" | jq -r '.approval_token')
+   bash bin/notify.sh dispatch "$PLAN_ID" "$APPROVAL_TOKEN"
+   ```
+
+5. If the user chooses Edit, cancel the old plan, edit, create a new plan, and
+   preview again. If they choose Cancel, cancel it and do not send. If the plan
+   expires or dispatch fails, create a new plan and obtain new consent; never
+   retry from the old approval.
+
+## Hard rules
+
+- Never call notification API endpoints directly. Use `bin/notify.sh`.
+- Never use legacy `notify.sh send` or `notify.sh group`; they only create a
+  proposal and intentionally cannot dispatch.
+- Never substitute a group when a direct message cannot be delivered.
+- Never add a channel after preview.
+- Never approve or dispatch from a detached/background process, hook, cron
+  job, batch execution, or unattended agent. Those paths may create a plan and
+  report that human approval is pending.
+- Multiple direct recipients require a separate preview and approval for each
+  exact message. A group fanout may use one approval only when every receiving
+  channel is listed in the preview.

package/runtime/codex/.codex/hooks/branch-guard.js

@@ -145,8 +145,19 @@ function currentAuthor(projectDir) {
   }
 }
 
-function isProtectedBranch(branch) {
-  return branch === "develop" || branch === "main" || branch === "master";
+function configuredBaseBranch(projectDir) {
+  try {
+    const raw = fs.readFileSync(path.join(projectDir, "egregore.json"), "utf-8");
+    const value = JSON.parse(raw).base_branch;
+    return typeof value === "string" && value.trim() ? value.trim() : "develop";
+  } catch {
+    return "develop";
+  }
+}
+
+function isProtectedBranch(branch, projectDir) {
+  return branch === configuredBaseBranch(projectDir) ||
+    branch === "develop" || branch === "main" || branch === "master";
 }
 
 function isExemptPath(rawPath, projectDir, memoryDir) {
@@ -403,7 +414,7 @@ function main() {
   if (context.external) return;
   const projectDir = context.projectDir;
   const branch = currentBranch(projectDir);
-  if (!isProtectedBranch(branch)) return;
+  if (!isProtectedBranch(branch, projectDir)) return;
 
   // Consent bypass: the user explicitly chose to work on this protected branch.
   // Written only after they pick "Proceed on <branch>"; cleared on session start,

package/runtime/codex/.codex/skills/add/SKILL.md

@@ -17,9 +17,13 @@ when it is available; otherwise render compact numbered choices with an
 
 1. Read `.claude/skills/add/SKILL.md` for the workflow details.
 2. Run the referenced `bin/` scripts directly from Codex.
-3. Treat graph, publish, and notify steps as best-effort unless that workflow
-   explicitly says they are required.
-4. Keep local-mode behavior filesystem-first and avoid graph or notification
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
    calls when `egregore.json` declares `"mode": "local"`.
-5. Never call the deprecated `egregore-handoff` CLI for Egregore project
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
    handoffs.

package/runtime/codex/.codex/skills/announce/SKILL.md

@@ -22,33 +22,46 @@ bash bin/publish-artifact.sh document "$FILE_PATH" --title "$TITLE" --author "$A
 Use `handoff`, `quest`, or `document` as the artifact type when appropriate.
 Never fabricate a URL.
 
-3. Preview the exact message. Confirm with structured Codex question tooling
-   when available; otherwise render:
+3. Follow `.claude/context/notification-consent.md`. Create a plan without
+   sending:
+
+```bash
+PLAN_JSON=$(bash bin/notify.sh plan group "$MESSAGE")
+```
+
+4. Preview the plan's exact organization, all deliveries/channels, and exact
+   final message. Confirm in a separate checkpoint with structured Codex
+   question tooling when available; otherwise render those fields followed by:
 
 ```text
 Send this announcement?
 1. Send
 2. Edit
-Other:
+3. Cancel
 ```
 
-4. If the user edits, redraft and preview again. If they approve, run:
+5. If the user edits, cancel the old plan, redraft, plan, and preview again.
+   If they cancel, cancel the plan and stop. Only after they select Send for
+   that exact preview, run:
 
 ```bash
-bash bin/notify.sh group "$MESSAGE"
+APPROVAL_JSON=$(bash bin/notify.sh approve "$PLAN_ID" "$DIGEST" APPROVE_EXACT_NOTIFICATION)
+APPROVAL_TOKEN=$(printf '%s' "$APPROVAL_JSON" | jq -r '.approval_token')
+bash bin/notify.sh dispatch "$PLAN_ID" "$APPROVAL_TOKEN"
 ```
 
-5. Emit telemetry in the background:
+6. Emit telemetry in the background:
 
 ```bash
 bash bin/telemetry.sh emit "command" '{"command":"announce"}' >/dev/null 2>&1 &
 ```
 
-6. Confirm whether the group send succeeded.
+7. Confirm whether the exact approved group send succeeded.
 
 ## Rules
 
-- Always preview before sending.
+- The request to announce is not dispatch consent. Always use a dedicated
+  exact-delivery checkpoint.
 - Do not expose notification credentials.
 - Use `bin/notify.sh`; do not call Telegram directly.
 - Do not use Claude Code commands.

package/runtime/codex/.codex/skills/answer/SKILL.md

@@ -17,9 +17,13 @@ when it is available; otherwise render compact numbered choices with an
 
 1. Read `.claude/skills/answer/SKILL.md` for the workflow details.
 2. Run the referenced `bin/` scripts directly from Codex.
-3. Treat graph, publish, and notify steps as best-effort unless that workflow
-   explicitly says they are required.
-4. Keep local-mode behavior filesystem-first and avoid graph or notification
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
    calls when `egregore.json` declares `"mode": "local"`.
-5. Never call the deprecated `egregore-handoff` CLI for Egregore project
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
    handoffs.

package/runtime/codex/.codex/skills/archive/SKILL.md

@@ -33,9 +33,13 @@ reading `.claude/skills/archive/SKILL.md`, reproduce the same visible UX in Code
 
 1. Read `.claude/skills/archive/SKILL.md` for the workflow details.
 2. Run the referenced `bin/` scripts directly from Codex.
-3. Treat graph, publish, and notify steps as best-effort unless that workflow
-   explicitly says they are required.
-4. Keep local-mode behavior filesystem-first and avoid graph or notification
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
    calls when `egregore.json` declares `"mode": "local"`.
-5. Never call the deprecated `egregore-handoff` CLI for Egregore project
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
    handoffs.

package/runtime/codex/.codex/skills/ask/SKILL.md

@@ -21,8 +21,8 @@ question, run a topic by someone, or inspect pending questions for themselves.
    tooling when available; otherwise render:
 
 ```text
-Send these questions?
-1. Send as-is
+Save these questions?
+1. Save as-is
 2. Edit
 Other:
 ```
@@ -37,13 +37,20 @@ Add harvest flags only when this ask is part of a harvest:
 `--harvest-id`, `--harvest-session-id`, `--turn`, `--question-intent`, and
 `--context-mode`.
 
-7. In connected mode, notify best-effort with:
+7. In connected mode, follow
+   `.claude/context/notification-consent.md`. Saving the questions is not
+   notification consent. Prepare without sending:
 
 ```bash
-bash bin/notify.sh send "$TARGET" "$AUTHOR has a question about \"$TOPIC\". Ask for \$activity to answer."
+PLAN_JSON=$(bash bin/notify.sh plan send "$TARGET" "$AUTHOR has a question about \"$TOPIC\". Ask for \$activity to answer.")
 ```
 
-8. Report the created `memory/knowledge/questions/...` path.
+Show the exact organization, recipient, channel, and message in a separate
+Send / Edit / Cancel checkpoint. Only a Send response to that preview permits
+one approve + dispatch.
+
+8. Report the created `memory/knowledge/questions/...` path and the truthful
+notification state.
 
 ## Inward Mode
 
@@ -54,6 +61,7 @@ answers.
 
 ## Rules
 
-- Person-targeted asks are asynchronous: store, optionally notify, then stop.
+- Person-targeted asks are asynchronous: store first; notification is a
+  separate exact-consent action.
 - Local mode is filesystem-only; skip graph and notification calls.
 - Do not use Claude Code commands.

package/runtime/codex/.codex/skills/audit/SKILL.md

@@ -0,0 +1,29 @@
+---
+name: audit
+description: 'Fallback Codex adapter for the Egregore audit workflow.'
+---
+
+<!-- generated-by: bin/codex-sync-skills.sh -->
+
+# Egregore audit Adapter
+
+This is fallback coverage for a long-tail Egregore workflow that has not been
+ported to a hand-written Codex-native skill yet.
+
+Use the project shell and filesystem directly. Do not invoke Claude Code
+commands. Translate interactive choices to structured Codex question tooling
+when it is available; otherwise render compact numbered choices with an
+`Other:` option and wait for the user.
+
+1. Read `.claude/skills/audit/SKILL.md` for the workflow details.
+2. Run the referenced `bin/` scripts directly from Codex.
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
+   calls when `egregore.json` declares `"mode": "local"`.
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
+   handoffs.

package/runtime/codex/.codex/skills/autosave/SKILL.md

@@ -0,0 +1,29 @@
+---
+name: autosave
+description: 'View or change your personal autosave settings, and merge staged auto-save PRs. The consent surface for ambient session capture.'
+---
+
+<!-- generated-by: bin/codex-sync-skills.sh -->
+
+# Egregore autosave Adapter
+
+This is fallback coverage for a long-tail Egregore workflow that has not been
+ported to a hand-written Codex-native skill yet.
+
+Use the project shell and filesystem directly. Do not invoke Claude Code
+commands. Translate interactive choices to structured Codex question tooling
+when it is available; otherwise render compact numbered choices with an
+`Other:` option and wait for the user.
+
+1. Read `.claude/skills/autosave/SKILL.md` for the workflow details.
+2. Run the referenced `bin/` scripts directly from Codex.
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
+   calls when `egregore.json` declares `"mode": "local"`.
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
+   handoffs.

package/runtime/codex/.codex/skills/branch/SKILL.md

@@ -17,9 +17,13 @@ when it is available; otherwise render compact numbered choices with an
 
 1. Read `.claude/skills/branch/SKILL.md` for the workflow details.
 2. Run the referenced `bin/` scripts directly from Codex.
-3. Treat graph, publish, and notify steps as best-effort unless that workflow
-   explicitly says they are required.
-4. Keep local-mode behavior filesystem-first and avoid graph or notification
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
    calls when `egregore.json` declares `"mode": "local"`.
-5. Never call the deprecated `egregore-handoff` CLI for Egregore project
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
    handoffs.

package/runtime/codex/.codex/skills/checkup/SKILL.md

@@ -33,9 +33,13 @@ reading `.claude/skills/checkup/SKILL.md`, reproduce the same visible UX in Code
 
 1. Read `.claude/skills/checkup/SKILL.md` for the workflow details.
 2. Run the referenced `bin/` scripts directly from Codex.
-3. Treat graph, publish, and notify steps as best-effort unless that workflow
-   explicitly says they are required.
-4. Keep local-mode behavior filesystem-first and avoid graph or notification
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
    calls when `egregore.json` declares `"mode": "local"`.
-5. Never call the deprecated `egregore-handoff` CLI for Egregore project
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
    handoffs.

package/runtime/codex/.codex/skills/commit/SKILL.md

@@ -17,9 +17,13 @@ when it is available; otherwise render compact numbered choices with an
 
 1. Read `.claude/skills/commit/SKILL.md` for the workflow details.
 2. Run the referenced `bin/` scripts directly from Codex.
-3. Treat graph, publish, and notify steps as best-effort unless that workflow
-   explicitly says they are required.
-4. Keep local-mode behavior filesystem-first and avoid graph or notification
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
    calls when `egregore.json` declares `"mode": "local"`.
-5. Never call the deprecated `egregore-handoff` CLI for Egregore project
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
    handoffs.