create-egregore 0.19.21 → 0.19.23

package/runtime/codex/bin/person.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 # One identity spine for .egregore-state.json, memory/people, Supabase, and

package/runtime/codex/bin/publish-artifact.sh

@@ -1,11 +1,13 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 # publish-artifact.sh — Generate HTML artifact + upload to API
 # Usage: publish-artifact.sh <type> <file> [--title "..."] [--author "..."] [--description "..."] [--id "..."] [--raw-html] [--no-references]
 #
 # Connected mode (API key present): publishes to /api/artifacts/publish (permanent, org-scoped)
-# OSS mode (no API key): publishes to /api/artifacts/share (ephemeral, 7-day TTL)
+# OSS mode (no API key): publishes to /api/artifacts/share on a PUBLIC, UNAUTHENTICATED
+#   relay (ephemeral, 7-day TTL). OFF unless the instance opted in — see
+#   "Public-relay opt-in" below and `bin/settings.sh relay on`.
 #
 # --id <slug>: stable artifact ID — re-publishing with the same ID upserts the content
 #              at the same URL (e.g. egregore.xyz/view/{org}/board). Connected mode only;
@@ -18,8 +20,14 @@ set -euo pipefail
 #              Set automatically when publish-references.sh invokes us for a child,
 #              preventing recursion.
 #
-# Outputs artifact URL on success, exits silently on failure.
+# Outputs artifact URL on success, exits silently on soft failure.
 # Designed for fire-and-forget use: `bash bin/publish-artifact.sh handoff file.md &`
+#
+# Exit codes: 0 ok (or soft failure — no URL on stdout) · 1 usage/validation
+#             3 hosting turned off (features.publishing=false)
+#             4 nothing uploaded — public relay not enabled and no org API key,
+#               or egregore.json is missing/unreadable (fail closed)
+#             5 renderer/fidelity validation failed (nothing uploaded)
 
 SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
 CONFIG="$SCRIPT_DIR/egregore.json"
@@ -34,6 +42,8 @@ ARTIFACT_ID=""
 RAW_HTML=0
 SKIP_REFERENCES=0
 PAIR=""
+VERIFY_FIDELITY=0
+FIDELITY_SOURCE=""
 
 while [[ $# -gt 0 ]]; do
   case "$1" in
@@ -42,6 +52,8 @@ while [[ $# -gt 0 ]]; do
     --description) DESCRIPTION="$2"; shift 2 ;;
     --id) ARTIFACT_ID="$2"; shift 2 ;;
     --pair) PAIR="$2"; shift 2 ;;
+    --verify-fidelity) VERIFY_FIDELITY=1; shift ;;
+    --source) FIDELITY_SOURCE="$2"; shift 2 ;;
     --raw-html) RAW_HTML=1; shift ;;
     --no-references) SKIP_REFERENCES=1; shift ;;
     *)
@@ -77,6 +89,15 @@ if [ -f "$SCRIPT_DIR/.env" ]; then
   EGREGORE_USE_PUBLISHED="${EGREGORE_USE_PUBLISHED:-$(grep '^EGREGORE_USE_PUBLISHED=' "$SCRIPT_DIR/.env" 2>/dev/null | cut -d'=' -f2- || true)}"
 fi
 
+# A config we cannot parse is a config we cannot trust. Every routing decision
+# below — authenticated org upload vs. public relay, hosting on vs. off — is
+# read out of this file, so an unreadable one means we cannot tell those apart.
+if [ ! -f "$CONFIG" ] || ! jq -e 'type == "object"' "$CONFIG" >/dev/null 2>&1; then
+  echo "Not published — nothing left this machine." >&2
+  echo "egregore.json is missing or unreadable, so there is no way to tell an authenticated org upload from a public one." >&2
+  exit 4
+fi
+
 API_URL="${EGREGORE_API_URL:-$(jq -r '.api_url // empty' "$CONFIG" 2>/dev/null)}"
 API_KEY="${EGREGORE_API_KEY:-}"
 ORG_SLUG="$(jq -r '.slug // empty' "$CONFIG" 2>/dev/null)"
@@ -92,7 +113,8 @@ if [ -z "${EGREGORE_USE_PUBLISHED:-}" ]; then
   fi
 fi
 
-# Public relay for OSS share endpoint
+# Public relay for OSS share endpoint. Unauthenticated: anything posted here is
+# readable by anyone holding the URL, for 7 days, with nothing in front of it.
 RELAY_URL="https://egregore-production-55f2.up.railway.app"
 
 # --- Artifact hosting off-switch (compliance / privacy) ---
@@ -109,6 +131,24 @@ if [ "$PUBLISHING_ENABLED" = "false" ]; then
   exit 3
 fi
 
+# --- Public-relay opt-in (privacy) ---
+# Without BOTH an api_url and an org API key there is exactly one upload route
+# left: the unauthenticated public relay below. Content must not leave the
+# machine for that route unless a person explicitly enabled it. The gate sits
+# before rendering so the default path generates and uploads nothing.
+#
+# NOTE: use an explicit `== true` test, never jq's `// false`: `//` treats an
+# explicit false like null and silently replaces it with the default.
+if [ -z "$API_URL" ] || [ -z "$API_KEY" ]; then
+  PUBLIC_RELAY_ENABLED="$(jq -r 'if .features.public_relay == true then "true" else "false" end' "$CONFIG" 2>/dev/null || echo "false")"
+  if [ "$PUBLIC_RELAY_ENABLED" != "true" ]; then
+    echo "Not published — nothing left this machine." >&2
+    echo "Without an org API key the only sharing route is a public relay: no auth, anyone with the link can read it, expires after 7 days. It is off unless you turn it on." >&2
+    echo "Turn it on with: bin/settings.sh relay on" >&2
+    exit 4
+  fi
+fi
+
 # --- Prepare HTML ---
 TMP_HTML="/tmp/egregore-artifacts/publish-$$.html"
 mkdir -p /tmp/egregore-artifacts
@@ -130,6 +170,16 @@ else
   if [ -n "$PAIR" ]; then
     RENDER_ARGS+=(--pair "$PAIR")
   fi
+  if [ "$VERIFY_FIDELITY" -eq 1 ]; then
+    RENDER_ARGS+=(--verify-fidelity)
+    if [ "$TYPE" = "composed" ]; then
+      [ -n "$FIDELITY_SOURCE" ] || {
+        echo "Handoff fidelity check requires --source <canonical-handoff.md>" >&2
+        exit 1
+      }
+      RENDER_ARGS+=(--source "$FIDELITY_SOURCE")
+    fi
+  fi
 
   # Prefer the in-repo package copy when it's present AND its dependencies
   # have been installed — that way local edits to packages/egregore-artifacts
@@ -139,15 +189,21 @@ else
   # when a local install is present — useful in the upstream dev repo to
   # dogfood what teammates and OSS users actually run.
   LOCAL_CLI="$SCRIPT_DIR/packages/egregore-artifacts/bin/cli.js"
+  RENDER_ERROR="/tmp/egregore-artifacts/render-error-$$.log"
   if [ "${EGREGORE_USE_PUBLISHED:-0}" != "1" ] && [ -f "$LOCAL_CLI" ] && [ -d "$SCRIPT_DIR/packages/egregore-artifacts/node_modules/react" ]; then
-    if ! node "$LOCAL_CLI" "${RENDER_ARGS[@]}" >/dev/null 2>&1; then
-      exit 0
+    if ! node "$LOCAL_CLI" "${RENDER_ARGS[@]}" >/dev/null 2>"$RENDER_ERROR"; then
+      sed -n '1,4p' "$RENDER_ERROR" >&2
+      rm -f "$RENDER_ERROR"
+      exit 5
     fi
   else
-    if ! npx egregore-artifacts@latest "${RENDER_ARGS[@]}" >/dev/null 2>&1; then
-      exit 0
+    if ! npx -y egregore-artifacts@latest "${RENDER_ARGS[@]}" >/dev/null 2>"$RENDER_ERROR"; then
+      sed -n '1,4p' "$RENDER_ERROR" >&2
+      rm -f "$RENDER_ERROR"
+      exit 5
     fi
   fi
+  rm -f "$RENDER_ERROR"
 fi
 
 if [ ! -f "$TMP_HTML" ]; then

package/runtime/codex/bin/publish-references.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -uo pipefail
 
 # publish-references.sh — Depth-1 auto-publish for referenced memory files.

package/runtime/codex/bin/repo-state.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # repo-state.sh — Capture current branch state across all repos.
 # Outputs a markdown table (## Repo State) for handoff files.
 # Only includes repos on non-base branches or with uncommitted changes.
@@ -71,21 +71,18 @@ check_repo() {
 }
 
 # Check core repo
-CORE_BASE="develop"
-if [ -f "$CONFIG" ]; then
-  # Core repo base: check if develop exists, otherwise main
-  if git -C "$SCRIPT_DIR" show-ref --verify --quiet refs/remotes/origin/develop 2>/dev/null; then
-    CORE_BASE="develop"
-  else
-    CORE_BASE="main"
-  fi
+if ! CORE_BASE=$(_get_base_branch); then
+  echo "repo-state: could not resolve the configured base branch" >&2
+  exit 1
 fi
 check_repo "$CORE_REPO" "$SCRIPT_DIR" "$CORE_BASE"
 
 # Check managed repos
 for REPO in $MANAGED_REPOS; do
   REPO_DIR="$PARENT_DIR/$REPO"
-  BASE=$(_get_base_branch "$REPO" 2>/dev/null || echo "develop")
+  if ! BASE=$(_get_base_branch "$REPO"); then
+    continue
+  fi
   check_repo "$REPO" "$REPO_DIR" "$BASE"
 done
 

package/runtime/codex/bin/search.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # Hybrid search over shared memory — powered by qmd (BM25 + vector + rerank, fully local).
 # Usage:
 #   bash bin/search.sh query "text" [-n N] [--fast|--semantic] [--all]

package/runtime/codex/bin/session-autosave.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # session-autosave.sh — save non-coding session work without an explicit /save.
 #
 # Terminal-close is the design constraint: no single "session end" event is

package/runtime/codex/bin/session-log.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # Graceful session-end adapter: write a structured session log to memory/sessions/.
 # Receives runtime-neutral JSON on stdin from Claude Code or Pi.
 # Runs BEFORE transcript-archive.sh (needs obs buffer + worktree intact).

package/runtime/codex/bin/settings.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 # settings.sh — deterministic config verbs for an Egregore instance.
@@ -10,6 +10,7 @@ set -euo pipefail
 #
 # Usage:
 #   settings.sh hosting status|on|off
+#   settings.sh relay status|on|off
 #   settings.sh repo list | add <name> [description] | remove <name>
 #   settings.sh admin list | add <github-handle> | remove <github-handle>
 #   settings.sh dump                 # full settings snapshot as JSON (for the launcher)
@@ -51,6 +52,7 @@ usage() {
 settings.sh — Egregore instance settings
 
   settings.sh hosting status|on|off
+  settings.sh relay  status|on|off
   settings.sh repo   list | add <name> [description] | remove <name>
   settings.sh admin  list | add <github-handle> | remove <github-handle>
   settings.sh people list | add <github-handle> | remove <github-handle>
@@ -86,6 +88,32 @@ cmd_hosting() {
   esac
 }
 
+# The public share relay is the only upload route when there is no org API
+# key. It is unauthenticated, readable by anyone with the URL, and expires
+# after 7 days, so it is OFF unless explicitly enabled.
+cmd_relay() {
+  local action="${1:-status}"
+  local enabled; enabled="$(jq -r 'if .features.public_relay == true then "true" else "false" end' "$CONFIG" 2>/dev/null || echo "false")"
+  case "$action" in
+    status)
+      if [ "$JSON" = 1 ]; then
+        jq -n --argjson on "$enabled" '{domain:"relay", public_relay:$on}'
+      elif [ "$enabled" = "true" ]; then
+        echo "Public share relay: ON — artifacts published without an org API key upload to a public, unauthenticated URL (expires after 7 days)"
+      else
+        echo "Public share relay: OFF — without an org API key, nothing uploads anywhere"
+      fi ;;
+    on)
+      _save '.features.public_relay = true'
+      echo "Public share relay: ON"
+      echo "  Artifacts published without an org API key now upload to a public, unauthenticated URL that anyone with the link can read for 7 days." ;;
+    off)
+      _save '.features.public_relay = false'
+      echo "Public share relay: OFF — without an org API key, nothing uploads anywhere" ;;
+    *) _die "usage: settings.sh relay status|on|off" 1 ;;
+  esac
+}
+
 cmd_repo() {
   local action="${1:-list}"; shift || true
   case "$action" in
@@ -244,6 +272,7 @@ cmd_dump() {
     org: .org_name,
     slug: .slug,
     hosting: (.features.publishing != false),
+    public_relay: (.features.public_relay == true),
     repos: [.repos[]? | if type=="object" then . else {name:.} end],
     admins: (.admins // []),
     people: $people
@@ -265,10 +294,11 @@ set -- "${_args[@]+"${_args[@]}"}"
 DOMAIN="${1:-}"; shift || true
 case "$DOMAIN" in
   hosting) cmd_hosting "$@" ;;
+  relay)   cmd_relay "$@" ;;
   repo)    cmd_repo "$@" ;;
   admin)   cmd_admin "$@" ;;
   people)  cmd_people "$@" ;;
   dump)    cmd_dump ;;
   ""|-h|--help|help) usage 0 ;;
-  *) _die "unknown settings domain: '$DOMAIN' (try: hosting, repo, admin, people, dump)" 1 ;;
+  *) _die "unknown settings domain: '$DOMAIN' (try: hosting, relay, repo, admin, people, dump)" 1 ;;
 esac

package/runtime/codex/bin/telemetry.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # Egregore telemetry — privacy-respecting product analytics.
 # Mirrors bin/graph.sh and bin/notify.sh patterns.
 #

package/runtime/codex/bin/worktree-create.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # WorktreeCreate hook — replaces EnterWorktree's default behavior.
 # Receives {"name": "<slug>"} on stdin. Must print absolute worktree path to stdout.
 # All diagnostic output goes to stderr or /dev/null — stdout is ONLY for the path.
@@ -33,12 +33,22 @@ AUTHOR=$(jq -r '.github_username // .display_name // "unknown"' "$STATE_FILE" 2>
 BRANCH="dev/${AUTHOR}/${SLUG}"
 WT_PATH="$REPO_ROOT/.claude/worktrees/${SLUG}"
 
-# --- Ensure origin/develop is available ---
-git -C "$REPO_ROOT" fetch origin develop --quiet 2>/dev/null || true
+# --- Resolve and fetch the configured base branch ---
+SCRIPT_DIR="$REPO_ROOT"
+CONFIG="$REPO_ROOT/egregore.json"
+if [ -f "$REPO_ROOT/bin/lib/config.sh" ]; then
+  # shellcheck source=bin/lib/config.sh
+  source "$REPO_ROOT/bin/lib/config.sh"
+fi
+if ! BASE_BRANCH=$(_get_base_branch); then
+  echo "Error: could not resolve the configured base branch" >&2
+  exit 1
+fi
+git -C "$REPO_ROOT" fetch origin "$BASE_BRANCH" --quiet 2>/dev/null || true
 
 # --- Create branch (idempotent — skip if exists) ---
 if ! git -C "$REPO_ROOT" show-ref --verify --quiet "refs/heads/$BRANCH" 2>/dev/null; then
-  git -C "$REPO_ROOT" branch "$BRANCH" origin/develop >/dev/null 2>&1 || {
+  git -C "$REPO_ROOT" branch "$BRANCH" "origin/$BASE_BRANCH" >/dev/null 2>&1 || {
     echo "Error: failed to create branch $BRANCH" >&2
     exit 1
   }

package/runtime/codex/bin/worktree-remove.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # WorktreeRemove hook — handles cleanup when a worktree is removed.
 # Receives {"worktree_path": "<path>"} on stdin. Best-effort, always exit 0.
 

package/runtime/codex/bin/worktree.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # Worktree lifecycle management for Egregore sessions.
 # Each session gets an isolated worktree so parallel sessions don't conflict.
 #

package/runtime/codex/manifest.json

@@ -1,7 +1,7 @@
 {
   "source": "egregore-runtime",
   "policy": "public-safe subset derived from .syncignore; built by scripts/build-runtime-bundle.mjs",
-  "skillCount": 58,
+  "skillCount": 65,
   "skills": [
     "activity",
     "add",
@@ -9,6 +9,8 @@
     "answer",
     "archive",
     "ask",
+    "audit",
+    "autosave",
     "branch",
     "checkup",
     "commit",
@@ -17,7 +19,9 @@
     "dashboard",
     "deep-reflect",
     "delete-user",
+    "demo-mode",
     "deploy-bridge",
+    "design",
     "egregore-voice",
     "emissary",
     "env",
@@ -31,9 +35,11 @@
     "me",
     "meeting",
     "minion",
+    "mock",
     "note",
     "onboarding",
     "pr",
+    "product-voice",
     "project",
     "pull",
     "push",
@@ -49,6 +55,7 @@
     "summon",
     "sync-repos",
     "task",
+    "teams-connect",
     "telegram-connect",
     "telemetry",
     "test",
@@ -64,6 +71,7 @@
   ],
   "files": [
     ".agents/skills",
+    ".claude/context/notification-consent.md",
     ".codex/config.toml",
     ".codex/hooks.json",
     ".codex/hooks/branch-guard.js",
@@ -74,6 +82,8 @@
     ".codex/skills/answer/SKILL.md",
     ".codex/skills/archive/SKILL.md",
     ".codex/skills/ask/SKILL.md",
+    ".codex/skills/audit/SKILL.md",
+    ".codex/skills/autosave/SKILL.md",
     ".codex/skills/branch/SKILL.md",
     ".codex/skills/checkup/SKILL.md",
     ".codex/skills/commit/SKILL.md",
@@ -82,11 +92,14 @@
     ".codex/skills/dashboard/SKILL.md",
     ".codex/skills/deep-reflect/SKILL.md",
     ".codex/skills/delete-user/SKILL.md",
+    ".codex/skills/demo-mode/SKILL.md",
     ".codex/skills/deploy-bridge/SKILL.md",
+    ".codex/skills/design/SKILL.md",
     ".codex/skills/egregore-voice/SKILL.md",
     ".codex/skills/emissary/SKILL.md",
     ".codex/skills/env/SKILL.md",
     ".codex/skills/handoff/SKILL.md",
+    ".codex/skills/harvest/QUESTION_PALETTE.md",
     ".codex/skills/harvest/SKILL.md",
     ".codex/skills/ingest-google/SKILL.md",
     ".codex/skills/ingest-user-interview/SKILL.md",
@@ -96,9 +109,11 @@
     ".codex/skills/me/SKILL.md",
     ".codex/skills/meeting/SKILL.md",
     ".codex/skills/minion/SKILL.md",
+    ".codex/skills/mock/SKILL.md",
     ".codex/skills/note/SKILL.md",
     ".codex/skills/onboarding/SKILL.md",
     ".codex/skills/pr/SKILL.md",
+    ".codex/skills/product-voice/SKILL.md",
     ".codex/skills/project/SKILL.md",
     ".codex/skills/pull/SKILL.md",
     ".codex/skills/push/SKILL.md",
@@ -116,6 +131,7 @@
     ".codex/skills/summon/SKILL.md",
     ".codex/skills/sync-repos/SKILL.md",
     ".codex/skills/task/SKILL.md",
+    ".codex/skills/teams-connect/SKILL.md",
     ".codex/skills/telegram-connect/SKILL.md",
     ".codex/skills/telemetry/SKILL.md",
     ".codex/skills/test/SKILL.md",
@@ -135,6 +151,7 @@
     "bin/activity-data.sh",
     "bin/agent.sh",
     "bin/attendant.sh",
+    "bin/autosave.sh",
     "bin/capture-reconcile.sh",
     "bin/capture-run.sh",
     "bin/codex-install-skills.sh",

package/runtime/pi/.claude/context/notification-consent.md

@@ -0,0 +1,66 @@
+# External notification consent
+
+This protocol applies to every Telegram, Teams, or other external notification
+in every harness. It applies even when the user asked to announce, notify,
+handoff, invite, or message someone, and even when the harness is running with
+broad tool permissions.
+
+## Invariant
+
+Never dispatch an external notification until the human has approved that one
+exact delivery in a dedicated checkpoint. The checkpoint must show:
+
+- the organization;
+- the final recipient or group;
+- every channel that will receive it;
+- the exact final message, including links.
+
+A workflow request, plan approval, batch approval, prior approval, broad
+permission mode, or approval of a related action is not notification consent.
+There is no standing "always allow" choice. One approval authorizes one attempt
+to send one immutable message.
+
+## Required flow
+
+1. Finish the message first. Publish any artifact and insert its real URL
+   before planning; never change the message after preview.
+2. Resolve the exact delivery without sending:
+
+   ```bash
+   PLAN_JSON=$(bash bin/notify.sh plan send "$RECIPIENT" "$MESSAGE")
+   # or
+   PLAN_JSON=$(bash bin/notify.sh plan group "$MESSAGE")
+   ```
+
+3. Read `plan_id` and `digest` from `PLAN_JSON`. Show the organization,
+   recipient, all `channels`/`deliveries`, and exact `message` in a dedicated
+   Send / Edit / Cancel question. Use the harness's structured question UI
+   when available. Otherwise show the same fields in plain text and stop for
+   the user's answer.
+4. Only if the user selects Send for that exact preview:
+
+   ```bash
+   APPROVAL_JSON=$(bash bin/notify.sh approve \
+     "$PLAN_ID" "$DIGEST" APPROVE_EXACT_NOTIFICATION)
+   APPROVAL_TOKEN=$(printf '%s' "$APPROVAL_JSON" | jq -r '.approval_token')
+   bash bin/notify.sh dispatch "$PLAN_ID" "$APPROVAL_TOKEN"
+   ```
+
+5. If the user chooses Edit, cancel the old plan, edit, create a new plan, and
+   preview again. If they choose Cancel, cancel it and do not send. If the plan
+   expires or dispatch fails, create a new plan and obtain new consent; never
+   retry from the old approval.
+
+## Hard rules
+
+- Never call notification API endpoints directly. Use `bin/notify.sh`.
+- Never use legacy `notify.sh send` or `notify.sh group`; they only create a
+  proposal and intentionally cannot dispatch.
+- Never substitute a group when a direct message cannot be delivered.
+- Never add a channel after preview.
+- Never approve or dispatch from a detached/background process, hook, cron
+  job, batch execution, or unattended agent. Those paths may create a plan and
+  report that human approval is pending.
+- Multiple direct recipients require a separate preview and approval for each
+  exact message. A group fanout may use one approval only when every receiving
+  channel is listed in the preview.

package/runtime/pi/.codex/hooks/branch-guard.js

@@ -145,8 +145,19 @@ function currentAuthor(projectDir) {
   }
 }
 
-function isProtectedBranch(branch) {
-  return branch === "develop" || branch === "main" || branch === "master";
+function configuredBaseBranch(projectDir) {
+  try {
+    const raw = fs.readFileSync(path.join(projectDir, "egregore.json"), "utf-8");
+    const value = JSON.parse(raw).base_branch;
+    return typeof value === "string" && value.trim() ? value.trim() : "develop";
+  } catch {
+    return "develop";
+  }
+}
+
+function isProtectedBranch(branch, projectDir) {
+  return branch === configuredBaseBranch(projectDir) ||
+    branch === "develop" || branch === "main" || branch === "master";
 }
 
 function isExemptPath(rawPath, projectDir, memoryDir) {
@@ -403,7 +414,7 @@ function main() {
   if (context.external) return;
   const projectDir = context.projectDir;
   const branch = currentBranch(projectDir);
-  if (!isProtectedBranch(branch)) return;
+  if (!isProtectedBranch(branch, projectDir)) return;
 
   // Consent bypass: the user explicitly chose to work on this protected branch.
   // Written only after they pick "Proceed on <branch>"; cleared on session start,

package/runtime/pi/.codex/skills/add/SKILL.md

@@ -17,9 +17,13 @@ when it is available; otherwise render compact numbered choices with an
 
 1. Read `.claude/skills/add/SKILL.md` for the workflow details.
 2. Run the referenced `bin/` scripts directly from Codex.
-3. Treat graph, publish, and notify steps as best-effort unless that workflow
-   explicitly says they are required.
-4. Keep local-mode behavior filesystem-first and avoid graph or notification
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
    calls when `egregore.json` declares `"mode": "local"`.
-5. Never call the deprecated `egregore-handoff` CLI for Egregore project
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
    handoffs.

package/runtime/pi/.codex/skills/announce/SKILL.md

@@ -22,33 +22,46 @@ bash bin/publish-artifact.sh document "$FILE_PATH" --title "$TITLE" --author "$A
 Use `handoff`, `quest`, or `document` as the artifact type when appropriate.
 Never fabricate a URL.
 
-3. Preview the exact message. Confirm with structured Codex question tooling
-   when available; otherwise render:
+3. Follow `.claude/context/notification-consent.md`. Create a plan without
+   sending:
+
+```bash
+PLAN_JSON=$(bash bin/notify.sh plan group "$MESSAGE")
+```
+
+4. Preview the plan's exact organization, all deliveries/channels, and exact
+   final message. Confirm in a separate checkpoint with structured Codex
+   question tooling when available; otherwise render those fields followed by:
 
 ```text
 Send this announcement?
 1. Send
 2. Edit
-Other:
+3. Cancel
 ```
 
-4. If the user edits, redraft and preview again. If they approve, run:
+5. If the user edits, cancel the old plan, redraft, plan, and preview again.
+   If they cancel, cancel the plan and stop. Only after they select Send for
+   that exact preview, run:
 
 ```bash
-bash bin/notify.sh group "$MESSAGE"
+APPROVAL_JSON=$(bash bin/notify.sh approve "$PLAN_ID" "$DIGEST" APPROVE_EXACT_NOTIFICATION)
+APPROVAL_TOKEN=$(printf '%s' "$APPROVAL_JSON" | jq -r '.approval_token')
+bash bin/notify.sh dispatch "$PLAN_ID" "$APPROVAL_TOKEN"
 ```
 
-5. Emit telemetry in the background:
+6. Emit telemetry in the background:
 
 ```bash
 bash bin/telemetry.sh emit "command" '{"command":"announce"}' >/dev/null 2>&1 &
 ```
 
-6. Confirm whether the group send succeeded.
+7. Confirm whether the exact approved group send succeeded.
 
 ## Rules
 
-- Always preview before sending.
+- The request to announce is not dispatch consent. Always use a dedicated
+  exact-delivery checkpoint.
 - Do not expose notification credentials.
 - Use `bin/notify.sh`; do not call Telegram directly.
 - Do not use Claude Code commands.

package/runtime/pi/.codex/skills/answer/SKILL.md

@@ -17,9 +17,13 @@ when it is available; otherwise render compact numbered choices with an
 
 1. Read `.claude/skills/answer/SKILL.md` for the workflow details.
 2. Run the referenced `bin/` scripts directly from Codex.
-3. Treat graph, publish, and notify steps as best-effort unless that workflow
-   explicitly says they are required.
-4. Keep local-mode behavior filesystem-first and avoid graph or notification
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
    calls when `egregore.json` declares `"mode": "local"`.
-5. Never call the deprecated `egregore-handoff` CLI for Egregore project
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
    handoffs.

package/runtime/pi/.codex/skills/archive/SKILL.md

@@ -33,9 +33,13 @@ reading `.claude/skills/archive/SKILL.md`, reproduce the same visible UX in Code
 
 1. Read `.claude/skills/archive/SKILL.md` for the workflow details.
 2. Run the referenced `bin/` scripts directly from Codex.
-3. Treat graph, publish, and notify steps as best-effort unless that workflow
-   explicitly says they are required.
-4. Keep local-mode behavior filesystem-first and avoid graph or notification
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
    calls when `egregore.json` declares `"mode": "local"`.
-5. Never call the deprecated `egregore-handoff` CLI for Egregore project
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
    handoffs.