create-egregore 0.19.21 → 0.19.22

package/runtime/pi/bin/agent.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # Runtime-neutral Egregore agent bridge.
 #
 # This script exposes the Git-backed memory protocol without requiring
@@ -19,6 +19,10 @@ if [ -f "$SCRIPT_DIR/bin/lib/worktree-links.sh" ]; then
 fi
 CONFIG="$SCRIPT_DIR/egregore.json"
 MEMORY_DIR="${EGREGORE_MEMORY_DIR:-$SCRIPT_DIR/memory}"
+if [ -f "$SCRIPT_DIR/bin/lib/config.sh" ]; then
+  # shellcheck source=bin/lib/config.sh
+  source "$SCRIPT_DIR/bin/lib/config.sh"
+fi
 
 usage() {
   cat <<'EOF'
@@ -55,6 +59,15 @@ die() {
   exit 1
 }
 
+resolve_base_branch() {
+  local base
+  if ! base=$(_get_base_branch); then
+    echo "agent.sh: could not resolve the configured base branch" >&2
+    return 1
+  fi
+  echo "$base"
+}
+
 slugify() {
   echo "$1" \
     | tr '[:upper:]' '[:lower:]' \
@@ -152,13 +165,16 @@ worktree_for_branch() {
 }
 
 base_ref() {
-  git -C "$MAIN_PROJECT_DIR" fetch origin develop --quiet 2>/dev/null || true
-  if git -C "$MAIN_PROJECT_DIR" show-ref --verify --quiet refs/remotes/origin/develop 2>/dev/null; then
-    echo "origin/develop"
-  elif git -C "$MAIN_PROJECT_DIR" show-ref --verify --quiet refs/heads/develop 2>/dev/null; then
-    echo "develop"
+  local base
+  base="$(resolve_base_branch)" || return 1
+  git -C "$MAIN_PROJECT_DIR" fetch origin "$base" --quiet 2>/dev/null || true
+  if git -C "$MAIN_PROJECT_DIR" show-ref --verify --quiet "refs/remotes/origin/$base" 2>/dev/null; then
+    echo "origin/$base"
+  elif git -C "$MAIN_PROJECT_DIR" show-ref --verify --quiet "refs/heads/$base" 2>/dev/null; then
+    echo "$base"
   else
-    echo "HEAD"
+    echo "agent.sh: configured base branch '$base' does not exist locally or on origin" >&2
+    return 1
   fi
 }
 
@@ -275,7 +291,7 @@ cmd_branch() {
     bugfix) branch="bugfix/${slug}" ;;
   esac
 
-  base="$(base_ref)"
+  base="$(base_ref)" || die "could not find a safe branch point"
 
   if [ -f "$SCRIPT_DIR/.git" ]; then
     if git -C "$SCRIPT_DIR" show-ref --verify --quiet "refs/heads/$branch" 2>/dev/null; then
@@ -326,7 +342,7 @@ ensure_working_branch() {
   slug="$(slugify "$topic")"
   [ -n "$slug" ] || slug="$(date +%Y-%m-%d)"
   branch="dev/${author}/${slug}"
-  base="$(base_ref)"
+  base="$(base_ref)" || die "could not find a safe branch point"
 
   if git -C "$SCRIPT_DIR" show-ref --verify --quiet "refs/heads/$branch" 2>/dev/null; then
     git -C "$SCRIPT_DIR" checkout "$branch" --quiet || die "failed to checkout $branch"
@@ -339,16 +355,17 @@ ensure_working_branch() {
 build_pr_body() {
   # Compliant fallback PR body (spec: .claude/context/pr-format.md) built
   # from the commit log + diff when the calling agent supplies none.
-  local topic="${1:-portable save}" commits stat
-  commits="$(git -C "$SCRIPT_DIR" log --pretty='- %s' "origin/develop..HEAD" 2>/dev/null | head -8)"
+  local topic="${1:-portable save}" base commits stat
+  base="$(resolve_base_branch)" || return 1
+  commits="$(git -C "$SCRIPT_DIR" log --pretty='- %s' "origin/$base..HEAD" 2>/dev/null | head -8)"
   [ -n "$commits" ] || commits="- (commit list unavailable — see the Files tab)"
-  stat="$(git -C "$SCRIPT_DIR" diff --shortstat "origin/develop...HEAD" 2>/dev/null | sed 's/^ *//')"
+  stat="$(git -C "$SCRIPT_DIR" diff --shortstat "origin/$base...HEAD" 2>/dev/null | sed 's/^ *//')"
   printf '## What\n%s\n\n## Why\nShell-agent session save — topic: %s. Body auto-generated by bin/agent.sh; pass --pr-body for a hand-written description.\n\n## Verification\nNot verified — auto-generated skeleton; review the diff before merging.%s\n\n🤖 Saved via bin/agent.sh\n' \
     "$commits" "$topic" "${stat:+ ($stat)}"
 }
 
 cmd_save() {
-  local message="" topic="" no_pr=0 branch pushed="false" committed="false" pr_url="" existing_pr="" pr_number="" non_md="" merged="false" pr_body="" pr_body_file=""
+  local message="" topic="" no_pr=0 branch base pushed="false" committed="false" pr_url="" existing_pr="" pr_number="" non_md="" merged="false" pr_body="" pr_body_file=""
 
   while [ $# -gt 0 ]; do
     case "$1" in
@@ -363,6 +380,7 @@ cmd_save() {
 
   [ -n "$topic" ] || topic="portable save"
   [ -n "$message" ] || message="Save: $topic"
+  base="$(resolve_base_branch)" || die "save stopped before Git changes"
 
   if [ -d "$MEMORY_DIR" ]; then
     save_memory "$message" "."
@@ -397,11 +415,11 @@ cmd_save() {
         pr_body="$(cat "$pr_body_file")"
       fi
       [ -n "$pr_body" ] || pr_body="$(build_pr_body "$topic")"
-      pr_url="$(gh pr create --base develop --head "$branch" --title "$message" --body "$pr_body" 2>/dev/null || true)"
+      pr_url="$(gh pr create --base "$base" --head "$branch" --title "$message" --body "$pr_body" 2>/dev/null || true)"
     fi
   fi
 
-  # Non-coding saves auto-merge to develop (same rule as /save and the
+  # Non-coding saves auto-merge to the configured base (same rule as /save and the
   # handoff helper; policy in bin/lib/noncode.sh). `--auto` needs repo
   # auto-merge + pending required checks; without branch protection it always
   # errors, so fall back to a direct merge.
@@ -409,10 +427,10 @@ cmd_save() {
     # shellcheck source=bin/lib/noncode.sh
     . "$SCRIPT_DIR/bin/lib/noncode.sh" 2>/dev/null || true
     type noncode_blockers >/dev/null 2>&1 || noncode_blockers() {
-      git -C "${2:-.}" diff "${1:-origin/develop}...HEAD" --name-only 2>/dev/null | grep -v '\.md$' | head -1 || true
+      git -C "${2:-.}" diff "${1:-origin/$base}...HEAD" --name-only 2>/dev/null | grep -v '\.md$' | head -1 || true
     }
     pr_number="${pr_url##*/}"
-    non_code="$(noncode_blockers origin/develop "$SCRIPT_DIR")"
+    non_code="$(noncode_blockers "origin/$base" "$SCRIPT_DIR")"
     if [ -z "$non_code" ] && [ -n "$pr_number" ]; then
       if gh pr merge "$pr_number" --auto --merge >/dev/null 2>&1 \
          || gh pr merge "$pr_number" --merge >/dev/null 2>&1; then
@@ -425,7 +443,7 @@ cmd_save() {
   echo "commit: $committed"
   echo "push: $pushed"
   [ -n "$pr_url" ] && echo "pr: $pr_url"
-  [ "$merged" = "true" ] && echo "merge: non-coding, merged to develop"
+  [ "$merged" = "true" ] && echo "merge: non-coding, merged to $base"
   return 0
 }
 
@@ -569,7 +587,8 @@ cmd_handoff() {
   echo "result: $result_out"
 
   # Parity with the Claude /handoff skill: save core-repo session work in the
-  # background (non-coding diffs auto-merge to develop, code stays in a PR).
+  # background (non-coding diffs auto-merge to the configured base; code stays
+  # in a PR).
   if [ "$NO_PUSH" = "0" ]; then
     ( bash "$SCRIPT_DIR/bin/handoff-save-egregore.sh" "$from" "$topic" --repo-dir "$SCRIPT_DIR" >/dev/null 2>&1 & ) >/dev/null 2>&1
   fi

package/runtime/pi/bin/attendant.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # The attendant — Egregore's ambient listener. A per-instance daemon that
 # watches for work Claude Code sessions leave behind when they die without
 # ceremony (terminal closed, laptop shut) and captures it:
@@ -426,7 +426,13 @@ LIFECYCLE_MARKER="$STATE_DIR/$KEY.handoff-lifecycle-ts"
 
 _handoff_lifecycle() {
   local now last mode api_url api_key result
-  [ "$(jq -r '.features.handoff_lifecycle // true' "$CONFIG" 2>/dev/null)" = "true" ] || return 0
+  # Read the raw value, not `// true` — jq's `//` returns its right-hand side
+  # for null *and false*, so `{"features":{"handoff_lifecycle":false}}` used to
+  # resolve to "true" and the opt-out did nothing. Absent key still means on.
+  case "$(jq -r '.features.handoff_lifecycle | tojson' "$CONFIG" 2>/dev/null)" in
+    null|true) ;;
+    *) return 0 ;;
+  esac
   [ -f "$MAIN_DIR/bin/handoff-lifecycle-job.sh" ] || return 0
 
   mode=$(jq -r '.mode // "connected"' "$CONFIG" 2>/dev/null)

package/runtime/pi/bin/autosave.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # autosave.sh — per-user autosave settings. The consent surface for ambient
 # session capture (see bin/session-autosave.sh, docs/autosave.md).
 #

package/runtime/pi/bin/capture-reconcile.sh

@@ -1,9 +1,10 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 # Detached reconciliation worker for explicit captures.
 # The foreground path only appends to graph-wal.sh; this worker pays network
-# latency, retries queued writes, and sends completion notifications.
+# latency and retries queued writes. It may propose completion notifications,
+# but detached reconciliation never approves or dispatches them.
 
 SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
 MODE="$(jq -r '.mode // "connected"' "$SCRIPT_DIR/egregore.json" 2>/dev/null || echo connected)"
@@ -32,6 +33,7 @@ CLAIM_CYPHER='
   MATCH (impl:Session {id: $sessionId})-[r:IMPLEMENTS]->(ho:Session)-[:BY]->(origin:Person)
   WHERE ho.handoffStatus = "done"
     AND r.completionNotifiedAt IS NULL
+    AND r.completionNotifyProposedAt IS NULL
     AND (r.completionNotifyClaimedAt IS NULL
          OR r.completionNotifyClaimedAt < datetime() - duration("PT1H"))
   SET r.completionNotifyClaimedAt = datetime()
@@ -46,11 +48,11 @@ while IFS=$'\t' read -r handoff_id topic recipient; do
   message="${AUTHOR:-A teammate} completed your handoff '${topic:-$handoff_id}'"
   [ -n "$SUMMARY" ] && message="${message} — $(printf '%s' "$SUMMARY" | tr '\n' ' ' | cut -c1-180)"
 
-  notify_result="$(bash "$SCRIPT_DIR/bin/notify.sh" send "$recipient" "$message" 2>/dev/null || echo Failed)"
-  if printf '%s' "$notify_result" | grep -qi '^Sent'; then
+  notify_result="$(bash "$SCRIPT_DIR/bin/notify.sh" plan send "$recipient" "$message" 2>/dev/null || echo '{}')"
+  if printf '%s' "$notify_result" | jq -e '.status == "approval_required"' >/dev/null 2>&1; then
     bash "$SCRIPT_DIR/bin/graph.sh" query '
       MATCH (impl:Session {id: $sessionId})-[r:IMPLEMENTS]->(ho:Session {id: $handoffId})
-      SET r.completionNotifiedAt = datetime(),
+      SET r.completionNotifyProposedAt = datetime(),
           r.completionNotifyClaimedAt = null
       RETURN ho.id AS id
     ' "$(jq -nc --arg sessionId "$SESSION_ID" --arg handoffId "$handoff_id" \
@@ -59,7 +61,7 @@ while IFS=$'\t' read -r handoff_id topic recipient; do
     bash "$SCRIPT_DIR/bin/graph.sh" query '
       MATCH (impl:Session {id: $sessionId})-[r:IMPLEMENTS]->(ho:Session {id: $handoffId})
       SET r.completionNotifyClaimedAt = null,
-          r.completionNotifyFailedAt = datetime()
+          r.completionNotifyProposalFailedAt = datetime()
       RETURN ho.id AS id
     ' "$(jq -nc --arg sessionId "$SESSION_ID" --arg handoffId "$handoff_id" \
       '{sessionId:$sessionId,handoffId:$handoffId}')" >/dev/null 2>&1 || true

package/runtime/pi/bin/capture-run.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 # Shared capture engine for the three ways an Egregore session leaves a trace.

package/runtime/pi/bin/codex-install-skills.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # Make Egregore's project-local Codex skills available without duplicating
 # them in CODEX_HOME.
 set -euo pipefail

package/runtime/pi/bin/codex-render-spec.mjs

@@ -179,11 +179,18 @@ const ON_LAUNCH_BODY = `The \`egregore\` launcher renders the Egregore startup c
 
 const AFTER_GREETING_BODY = `**Mandatory behavioral rule.** When the user describes work, your **first action** — before reading files, exploring code, or anything else — is to get onto a working branch:
 
+The integration branch is \`develop\` by default. When top-level
+\`egregore.json.base_branch\` is set, that configured branch replaces
+\`develop\` as the branch point, rebase target, PR base, and protected
+integration branch.
+
 1. Derive a topic slug from what the user said (kebab-case, 2–4 words)
-2. Run \`bin/agent.sh branch --topic "<topic>"\` — it creates a work branch from \`origin/develop\` in a task worktree (\`dev/{author}/{slug}\`, or \`feature/{slug}\` / \`bugfix/{slug}\` when the topic reads as a feature or fix) and prints the worktree path. Continue all file work from that printed path.
+2. Run \`bin/agent.sh branch --topic "<topic>"\` — it resolves the configured base and creates a work branch from \`origin/{base}\` in a task worktree (\`dev/{author}/{slug}\`, or \`feature/{slug}\` / \`bugfix/{slug}\` when the topic reads as a feature or fix). Continue all file work from the printed path.
 3. Confirm: \`On {branch} (worktree).\`
 
-**Fallback:** If \`bin/agent.sh branch\` fails, use \`git checkout -b dev/{author}/{slug} origin/develop\`.
+**Fallback:** If \`bin/agent.sh branch\` fails, resolve \`{base}\` with
+\`_get_base_branch\`, then use
+\`git checkout -b dev/{author}/{slug} origin/{base}\`.
 
 4. Update graph (fire-and-forget): \`bash bin/graph-op.sh set-topic "$(cat .egregore-session-id 2>/dev/null)" "topic from slug" "dev/author/slug" 2>/dev/null &\`
 
@@ -215,11 +222,11 @@ Report results: \`✓ Checked out {branch} in {repo1}, {repo2}\`. If a branch no
 
 **Topic pivot while on a working branch:** If the user describes work **unrelated** to the current branch's topic, treat it as a new topic and create a new branch (\`bin/agent.sh branch --topic "<new topic>"\`). Do NOT mix unrelated work on one branch.
 
-If on develop after two messages, create a branch immediately from whatever context you have.
+If still on the configured base branch after two messages, create a branch immediately from whatever context you have.
 
 ### Branch-guard protocol
 
-The \`.codex/hooks/branch-guard.js\` PreToolUse hook (enabled by the launcher via \`--enable hooks\`) protects project writes on \`develop\`/\`main\`/\`master\`. Its block message is operational guidance, not a reason to interrupt the user with routine Git choices:
+The \`.codex/hooks/branch-guard.js\` PreToolUse hook (enabled by the launcher via \`--enable hooks\`) protects project writes on the configured base branch as well as \`develop\`/\`main\`/\`master\`. Its block message is operational guidance, not a reason to interrupt the user with routine Git choices:
 
 - **Topic is clear** (the user said "fix X", "add Y feature") → run \`bin/agent.sh branch --topic "<topic>"\` automatically, continue in the printed worktree, and say one short sentence so the branch change is visible. Do not ask the user to approve routine branching.
 - **Topic is genuinely ambiguous** → ask only for the topic, using compact numbered options:
@@ -236,7 +243,7 @@ The \`.codex/hooks/branch-guard.js\` PreToolUse hook (enabled by the launcher vi
 
 Memory, managed-repo, and runtime-state writes should bypass the project guard. If one triggers it, correct the operation target/context instead of asking for protected-branch consent.
 
-If this Codex build does not support hooks, follow the same discipline as a standing instruction: never write or commit on develop/main/master.
+If this Codex build does not support hooks, follow the same discipline as a standing instruction: never write or commit on the configured base, develop, main, or master.
 
 ### Onboarding exception
 

package/runtime/pi/bin/codex-session-start.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -o pipefail
 
 # Codex does not run Claude Code SessionStart hooks. This is the runtime-neutral

package/runtime/pi/bin/codex-sync-skills.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
@@ -162,11 +162,15 @@ EOF
   cat <<EOF
 1. Read \`${source}\` for the workflow details.
 2. Run the referenced \`bin/\` scripts directly from Codex.
-3. Treat graph, publish, and notify steps as best-effort unless that workflow
-   explicitly says they are required.
-4. Keep local-mode behavior filesystem-first and avoid graph or notification
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   \`.claude/context/notification-consent.md\`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
    calls when \`egregore.json\` declares \`"mode": "local"\`.
-5. Never call the deprecated \`egregore-handoff\` CLI for Egregore project
+6. Never call the deprecated \`egregore-handoff\` CLI for Egregore project
    handoffs.
 EOF
 }

package/runtime/pi/bin/dashboard-data.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # Fetches personal dashboard data: single API call + parallel git ops.
 # Usage: bash bin/dashboard-data.sh [username] [time_range]
 # Returns a single JSON object with all query results.

package/runtime/pi/bin/graph-batch.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 # Execute multiple Cypher queries in a single HTTP call.

package/runtime/pi/bin/graph-op.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 # Named graph operations — clean interface over raw Cypher.
 # Keeps implementation details out of the TUI.

package/runtime/pi/bin/graph-wal.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # Graph Write-Ahead Log — resilient graph writes with local buffer.
 # Mirrors bin/telemetry.sh architecture.
 #

package/runtime/pi/bin/graph.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)"

package/runtime/pi/bin/handoff-pr-backfill.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # handoff-pr-backfill.sh — fill in PR numbers in a handoff file's ## Repo State
 # table, then re-commit + push the memory repo. Detached fire-and-forget from
 # /handoff's hot path so user-visible latency doesn't include N × `gh pr list`.

package/runtime/pi/bin/handoff-run.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 # handoff-run.sh — atomic orchestrator for /handoff.
 #
@@ -25,7 +25,7 @@ set -euo pipefail
 #      and returns a subgraph snapshot in the result JSON
 #   6. Commits + pushes memory repo (with orphan-stash dance if needed)
 #   7. Publishes HTML artifact via bin/publish-artifact.sh
-#   8. Sends Telegram notification via bin/notify.sh (if recipient)
+#   8. Creates an exact notification proposal via bin/notify.sh (never sends)
 #   9. Emits ONE status line and ONE JSON blob on stdout
 #
 # Exit codes:
@@ -231,14 +231,14 @@ awk -v line="$IDX_LINE" '
   END { if (!inserted) print line }
 ' "$INDEX" > "$INDEX.new" && mv "$INDEX.new" "$INDEX"
 
-# --- Parallel stage: graph + memory + (publish → notify) ----------------
+# --- Parallel stage: graph + memory + (publish → notification proposal) -
 #
 # Three independent branches fork here and join before we emit the result:
 #   A. Graph index     — reads ABS_FILE, writes Session node to Neo4j, and
 #                        returns the handoff's neighborhood as subgraph JSON.
 #   B. Memory push     — commits + pushes memory repo (orphan-stash dance).
-#   C. Publish+notify  — publishes HTML artifact, then (if recipient is set)
-#                        sends Telegram with the artifact URL embedded.
+#   C. Publish+plan    — publishes HTML artifact, then creates an immutable
+#                        notification proposal with the artifact URL embedded.
 #
 # Each branch writes its result to a tmpfile. Wall-clock is max(A,B,C).
 #
@@ -251,7 +251,7 @@ MEMORY_DIR="$SCRIPT_DIR/memory"
 TMPD=$(mktemp -d -t handoff-run-XXXXXX)
 trap 'rm -rf "$TMPD"' EXIT
 
-# Extract briefing text once (used by publish and notify) so we don't
+# Extract briefing text once (used by publish and the proposal) so we don't
 # re-awk the same file inside multiple workers.
 BRIEFING_LEAD=$(awk '/^## Briefing/{found=1; next} found && /^##/{exit} found && NF{print}' "$ABS_FILE" 2>/dev/null \
   | head -2 | tr '\n' ' ' | cut -c1-200 || true)
@@ -390,7 +390,11 @@ PID_MEMORY=$!
     fi
     EMISSARY_API_URL="${EMISSARY_API_URL:-https://egregore-production-55f2.up.railway.app/api/v1/emissary}"
 
-    if [ -n "$EMISSARY_TOKEN" ]; then
+    # /handoff is an internal team primitive, not an implicit public-emissary
+    # composer. Use the emissary route only for an explicit recipient, and make
+    # that artifact directed-private. Recipient-less handoffs fall through to
+    # the org-scoped publisher (connected) or opt-in relay (local).
+    if [ -n "$EMISSARY_TOKEN" ] && [ -n "$RECIPIENT" ]; then
       # Step 1: render the handoff to HTML locally using egregore-artifacts.
       # Same renderer + template publish-artifact.sh uses today — handoffs
       # keep their familiar look.
@@ -422,12 +426,8 @@ PID_MEMORY=$!
             DISPLAY_NAME=$(head -1 "$PERSON_FILE" | sed 's/^# //')
           fi
 
-          # addressed_to: only set if there's a recipient
-          ADDRESSED_TO="[]"
-          if [ -n "$RECIPIENT" ]; then
-            RECIP_HANDLE=$(echo "$RECIPIENT" | tr '[:upper:]' '[:lower:]' | awk '{print $1}')
-            ADDRESSED_TO=$(jq -nc --arg h "$RECIP_HANDLE" --arg d "$RECIPIENT" '[{"handle":$h,"display":$d}]')
-          fi
+          RECIP_HANDLE=$(echo "$RECIPIENT" | tr '[:upper:]' '[:lower:]' | awk '{print $1}')
+          ADDRESSED_TO=$(jq -nc --arg h "$RECIP_HANDLE" --arg d "$RECIPIENT" '[{"handle":$h,"display":$d}]')
 
           CLAIM=$(echo "$BRIEFING_LEAD" | cut -c1-200)
 
@@ -456,8 +456,8 @@ PID_MEMORY=$!
               body: { prose: $prose },
               audience: {
                 addressed_to: $addressed,
-                visible_to: "public",
-                extendable_by: "anyone"
+                visible_to: $addressed,
+                extendable_by: $addressed
               },
               parents: [],
               render_mode: "custom",
@@ -475,15 +475,30 @@ PID_MEMORY=$!
     fi
   fi
 
-  # Fallback: if the emissary publish didn't produce a URL (no token, no
-  # network, size cap, render failure), fire the legacy publish-artifact.sh
-  # so handoffs still get a Telegram-able URL.
+  # Fallback: if a directed emissary publish didn't produce a URL—or this is a
+  # recipient-less team handoff—use publish-artifact.sh. Connected mode is
+  # authenticated and org-scoped; local mode's public relay is opt-in.
+  PUBLISH_RC=0
   if [ -z "$V1URL" ] && [ "$NO_PUBLISH" = "0" ] && [ -x "$SCRIPT_DIR/bin/publish-artifact.sh" ]; then
     AURL=$(bash "$SCRIPT_DIR/bin/publish-artifact.sh" "$RENDER_TYPE" "${RENDER_SRC:-$ABS_FILE}" \
       --title "$TOPIC" \
       --author "$AUTHOR" \
-      --description "$BRIEFING_LEAD" 2>/dev/null || echo "")
+      --description "$BRIEFING_LEAD" 2>/dev/null) || PUBLISH_RC=$?
+  fi
+
+  PS="published"
+  if [ "$NO_PUBLISH" = "1" ]; then
+    PS="disabled"
+  elif [ -n "$V1URL" ] || [ -n "$AURL" ]; then
+    PS="published"
+  elif [ "$PUBLISH_RC" = "4" ]; then
+    PS="relay-off"
+  elif [ "$PUBLISH_RC" = "3" ]; then
+    PS="hosting-off"
+  else
+    PS="failed"
   fi
+  echo "$PS" > "$TMPD/publish"
 
   # Prefer v1 (emissary-rendered) URL when available; fall back to the
   # legacy egregore-artifacts URL only if the v1 publish failed.
@@ -497,6 +512,7 @@ PID_MEMORY=$!
   fi
 
   NS="skipped"
+  echo '{}' > "$TMPD/notify-plan"
   if [ "$NO_NOTIFY" = "0" ]; then
     if [ -n "$NOTIFY_URL" ]; then
       MSG_NOTIFY="Handoff from ${AUTHOR}: ${TOPIC}
@@ -510,21 +526,19 @@ View: ${NOTIFY_URL}"
 \"${BRIEFING_SHORT}\""
     fi
 
-    # Always notify. With a recipient (connected mode) → DM. Otherwise → group.
-    # Self-handoffs still post to the group so they're visible on /activity
-    # and in the Telegram feed — a handoff without a Telegram beat is invisible.
-    if [ -n "$RECIPIENT" ] && [ "$MODE" = "connected" ]; then
-      NR=$(bash "$SCRIPT_DIR/bin/notify.sh" send "$RECIPIENT" "$MSG_NOTIFY" 2>/dev/null || echo "Failed")
+    # Resolve the exact destination, but never approve or dispatch here. The
+    # interactive harness must show this proposal in a separate checkpoint.
+    if [ -n "$RECIPIENT" ]; then
+      NR=$(bash "$SCRIPT_DIR/bin/notify.sh" plan send "$RECIPIENT" "$MSG_NOTIFY" 2>/dev/null || echo '{}')
     else
-      NR=$(bash "$SCRIPT_DIR/bin/notify.sh" group "$MSG_NOTIFY" 2>/dev/null || echo "Failed")
+      NR=$(bash "$SCRIPT_DIR/bin/notify.sh" plan group "$MSG_NOTIFY" 2>/dev/null || echo '{}')
     fi
 
-    if echo "$NR" | grep -qi "^Sent"; then
-      NS="sent"
-    elif echo "$NR" | grep -qi "^Failed"; then
-      NS="failed"
+    if printf '%s' "$NR" | jq -e '.status == "approval_required"' >/dev/null 2>&1; then
+      NS="approval_required"
+      printf '%s\n' "$NR" > "$TMPD/notify-plan"
     else
-      NS="unknown"
+      NS="unavailable"
     fi
   fi
   echo "$NS" > "$TMPD/notify"
@@ -574,6 +588,9 @@ fi
 MEMORY_STATUS=$(cat "$TMPD/memory"   2>/dev/null || echo "skipped")
 ARTIFACT_URL=$(cat "$TMPD/artifact"  2>/dev/null || echo "")
 NOTIFY_STATUS=$(cat "$TMPD/notify"   2>/dev/null || echo "skipped")
+NOTIFY_PLAN=$(cat "$TMPD/notify-plan" 2>/dev/null || echo "{}")
+PUBLISH_STATUS=$(cat "$TMPD/publish" 2>/dev/null || echo "skipped")
+[ -z "$PUBLISH_STATUS" ] && PUBLISH_STATUS="skipped"
 ARTIFACTS_ARR=$(cat "$TMPD/artifacts" 2>/dev/null || echo "[]")
 [ -z "$ARTIFACTS_ARR" ] && ARTIFACTS_ARR="[]"
 
@@ -594,16 +611,9 @@ fi
 STATUS_BITS=("saved")
 [ "$GRAPH_STATUS"  = "ok" ]    && STATUS_BITS+=("graphed")
 [ "$MEMORY_STATUS" = "ok" ]    && STATUS_BITS+=("pushed")
-if [ "$NOTIFY_STATUS" = "sent" ]; then
-  if [ -n "$RECIPIENT" ]; then
-    STATUS_BITS+=("${RECIPIENT} notified")
-  else
-    STATUS_BITS+=("group notified")
-  fi
-elif [ "$NOTIFY_STATUS" = "unknown" ] && [ -n "$RECIPIENT" ]; then
-  STATUS_BITS+=("${RECIPIENT} relayed to group")
-fi
+[ "$NOTIFY_STATUS" = "approval_required" ] && STATUS_BITS+=("notify approval pending")
 [ -n "$ARTIFACT_URL" ]         && STATUS_BITS+=("published")
+[ "$PUBLISH_STATUS" = "relay-off" ] && STATUS_BITS+=("not published")
 
 STATUS_LINE=""
 for bit in "${STATUS_BITS[@]}"; do
@@ -625,7 +635,9 @@ jq -cn \
   --arg graphStatus "$GRAPH_STATUS" \
   --arg memoryStatus "$MEMORY_STATUS" \
   --arg notifyStatus "$NOTIFY_STATUS" \
+  --argjson notifyPlan "$NOTIFY_PLAN" \
   --arg artifactUrl "$ARTIFACT_URL" \
+  --arg publishStatus "$PUBLISH_STATUS" \
   --arg recipient "$RECIPIENT" \
   --arg topic "$TOPIC" \
   --arg author "$AUTHOR" \
@@ -640,7 +652,9 @@ jq -cn \
     graphStatus:$graphStatus,
     memoryStatus:$memoryStatus,
     notifyStatus:$notifyStatus,
+    notifyPlan:$notifyPlan,
     artifactUrl:$artifactUrl,
+    publishStatus:$publishStatus,
     recipient:$recipient,
     topic:$topic,
     author:$author,