create-egregore 0.19.21 → 0.19.23

package/runtime/pi/.codex/skills/ask/SKILL.md

@@ -21,8 +21,8 @@ question, run a topic by someone, or inspect pending questions for themselves.
    tooling when available; otherwise render:
 
 ```text
-Send these questions?
-1. Send as-is
+Save these questions?
+1. Save as-is
 2. Edit
 Other:
 ```
@@ -37,13 +37,20 @@ Add harvest flags only when this ask is part of a harvest:
 `--harvest-id`, `--harvest-session-id`, `--turn`, `--question-intent`, and
 `--context-mode`.
 
-7. In connected mode, notify best-effort with:
+7. In connected mode, follow
+   `.claude/context/notification-consent.md`. Saving the questions is not
+   notification consent. Prepare without sending:
 
 ```bash
-bash bin/notify.sh send "$TARGET" "$AUTHOR has a question about \"$TOPIC\". Ask for \$activity to answer."
+PLAN_JSON=$(bash bin/notify.sh plan send "$TARGET" "$AUTHOR has a question about \"$TOPIC\". Ask for \$activity to answer.")
 ```
 
-8. Report the created `memory/knowledge/questions/...` path.
+Show the exact organization, recipient, channel, and message in a separate
+Send / Edit / Cancel checkpoint. Only a Send response to that preview permits
+one approve + dispatch.
+
+8. Report the created `memory/knowledge/questions/...` path and the truthful
+notification state.
 
 ## Inward Mode
 
@@ -54,6 +61,7 @@ answers.
 
 ## Rules
 
-- Person-targeted asks are asynchronous: store, optionally notify, then stop.
+- Person-targeted asks are asynchronous: store first; notification is a
+  separate exact-consent action.
 - Local mode is filesystem-only; skip graph and notification calls.
 - Do not use Claude Code commands.

package/runtime/pi/.codex/skills/audit/SKILL.md

@@ -0,0 +1,29 @@
+---
+name: audit
+description: 'Fallback Codex adapter for the Egregore audit workflow.'
+---
+
+<!-- generated-by: bin/codex-sync-skills.sh -->
+
+# Egregore audit Adapter
+
+This is fallback coverage for a long-tail Egregore workflow that has not been
+ported to a hand-written Codex-native skill yet.
+
+Use the project shell and filesystem directly. Do not invoke Claude Code
+commands. Translate interactive choices to structured Codex question tooling
+when it is available; otherwise render compact numbered choices with an
+`Other:` option and wait for the user.
+
+1. Read `.claude/skills/audit/SKILL.md` for the workflow details.
+2. Run the referenced `bin/` scripts directly from Codex.
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
+   calls when `egregore.json` declares `"mode": "local"`.
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
+   handoffs.

package/runtime/pi/.codex/skills/autosave/SKILL.md

@@ -0,0 +1,29 @@
+---
+name: autosave
+description: 'View or change your personal autosave settings, and merge staged auto-save PRs. The consent surface for ambient session capture.'
+---
+
+<!-- generated-by: bin/codex-sync-skills.sh -->
+
+# Egregore autosave Adapter
+
+This is fallback coverage for a long-tail Egregore workflow that has not been
+ported to a hand-written Codex-native skill yet.
+
+Use the project shell and filesystem directly. Do not invoke Claude Code
+commands. Translate interactive choices to structured Codex question tooling
+when it is available; otherwise render compact numbered choices with an
+`Other:` option and wait for the user.
+
+1. Read `.claude/skills/autosave/SKILL.md` for the workflow details.
+2. Run the referenced `bin/` scripts directly from Codex.
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
+   calls when `egregore.json` declares `"mode": "local"`.
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
+   handoffs.

package/runtime/pi/.codex/skills/branch/SKILL.md

@@ -17,9 +17,13 @@ when it is available; otherwise render compact numbered choices with an
 
 1. Read `.claude/skills/branch/SKILL.md` for the workflow details.
 2. Run the referenced `bin/` scripts directly from Codex.
-3. Treat graph, publish, and notify steps as best-effort unless that workflow
-   explicitly says they are required.
-4. Keep local-mode behavior filesystem-first and avoid graph or notification
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
    calls when `egregore.json` declares `"mode": "local"`.
-5. Never call the deprecated `egregore-handoff` CLI for Egregore project
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
    handoffs.

package/runtime/pi/.codex/skills/checkup/SKILL.md

@@ -33,9 +33,13 @@ reading `.claude/skills/checkup/SKILL.md`, reproduce the same visible UX in Code
 
 1. Read `.claude/skills/checkup/SKILL.md` for the workflow details.
 2. Run the referenced `bin/` scripts directly from Codex.
-3. Treat graph, publish, and notify steps as best-effort unless that workflow
-   explicitly says they are required.
-4. Keep local-mode behavior filesystem-first and avoid graph or notification
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
    calls when `egregore.json` declares `"mode": "local"`.
-5. Never call the deprecated `egregore-handoff` CLI for Egregore project
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
    handoffs.

package/runtime/pi/.codex/skills/commit/SKILL.md

@@ -17,9 +17,13 @@ when it is available; otherwise render compact numbered choices with an
 
 1. Read `.claude/skills/commit/SKILL.md` for the workflow details.
 2. Run the referenced `bin/` scripts directly from Codex.
-3. Treat graph, publish, and notify steps as best-effort unless that workflow
-   explicitly says they are required.
-4. Keep local-mode behavior filesystem-first and avoid graph or notification
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
    calls when `egregore.json` declares `"mode": "local"`.
-5. Never call the deprecated `egregore-handoff` CLI for Egregore project
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
    handoffs.

package/runtime/pi/.codex/skills/contribute/SKILL.md

@@ -17,9 +17,13 @@ when it is available; otherwise render compact numbered choices with an
 
 1. Read `.claude/skills/contribute/SKILL.md` for the workflow details.
 2. Run the referenced `bin/` scripts directly from Codex.
-3. Treat graph, publish, and notify steps as best-effort unless that workflow
-   explicitly says they are required.
-4. Keep local-mode behavior filesystem-first and avoid graph or notification
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
    calls when `egregore.json` declares `"mode": "local"`.
-5. Never call the deprecated `egregore-handoff` CLI for Egregore project
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
    handoffs.

package/runtime/pi/.codex/skills/dark-mode/SKILL.md

@@ -17,9 +17,13 @@ when it is available; otherwise render compact numbered choices with an
 
 1. Read `.claude/skills/dark-mode/SKILL.md` for the workflow details.
 2. Run the referenced `bin/` scripts directly from Codex.
-3. Treat graph, publish, and notify steps as best-effort unless that workflow
-   explicitly says they are required.
-4. Keep local-mode behavior filesystem-first and avoid graph or notification
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
    calls when `egregore.json` declares `"mode": "local"`.
-5. Never call the deprecated `egregore-handoff` CLI for Egregore project
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
    handoffs.

package/runtime/pi/.codex/skills/delete-user/SKILL.md

@@ -17,9 +17,13 @@ when it is available; otherwise render compact numbered choices with an
 
 1. Read `.claude/skills/delete-user/SKILL.md` for the workflow details.
 2. Run the referenced `bin/` scripts directly from Codex.
-3. Treat graph, publish, and notify steps as best-effort unless that workflow
-   explicitly says they are required.
-4. Keep local-mode behavior filesystem-first and avoid graph or notification
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
    calls when `egregore.json` declares `"mode": "local"`.
-5. Never call the deprecated `egregore-handoff` CLI for Egregore project
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
    handoffs.

package/runtime/pi/.codex/skills/demo-mode/SKILL.md

@@ -0,0 +1,29 @@
+---
+name: demo-mode
+description: 'Fallback Codex adapter for the Egregore demo-mode workflow.'
+---
+
+<!-- generated-by: bin/codex-sync-skills.sh -->
+
+# Egregore demo-mode Adapter
+
+This is fallback coverage for a long-tail Egregore workflow that has not been
+ported to a hand-written Codex-native skill yet.
+
+Use the project shell and filesystem directly. Do not invoke Claude Code
+commands. Translate interactive choices to structured Codex question tooling
+when it is available; otherwise render compact numbered choices with an
+`Other:` option and wait for the user.
+
+1. Read `.claude/skills/demo-mode/SKILL.md` for the workflow details.
+2. Run the referenced `bin/` scripts directly from Codex.
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
+   calls when `egregore.json` declares `"mode": "local"`.
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
+   handoffs.

package/runtime/pi/.codex/skills/deploy-bridge/SKILL.md

@@ -17,9 +17,13 @@ when it is available; otherwise render compact numbered choices with an
 
 1. Read `.claude/skills/deploy-bridge/SKILL.md` for the workflow details.
 2. Run the referenced `bin/` scripts directly from Codex.
-3. Treat graph, publish, and notify steps as best-effort unless that workflow
-   explicitly says they are required.
-4. Keep local-mode behavior filesystem-first and avoid graph or notification
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
    calls when `egregore.json` declares `"mode": "local"`.
-5. Never call the deprecated `egregore-handoff` CLI for Egregore project
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
    handoffs.

package/runtime/pi/.codex/skills/design/SKILL.md

@@ -0,0 +1,29 @@
+---
+name: design
+description: '>'
+---
+
+<!-- generated-by: bin/codex-sync-skills.sh -->
+
+# Egregore design Adapter
+
+This is fallback coverage for a long-tail Egregore workflow that has not been
+ported to a hand-written Codex-native skill yet.
+
+Use the project shell and filesystem directly. Do not invoke Claude Code
+commands. Translate interactive choices to structured Codex question tooling
+when it is available; otherwise render compact numbered choices with an
+`Other:` option and wait for the user.
+
+1. Read `.claude/skills/design/SKILL.md` for the workflow details.
+2. Run the referenced `bin/` scripts directly from Codex.
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
+   calls when `egregore.json` declares `"mode": "local"`.
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
+   handoffs.

package/runtime/pi/.codex/skills/egregore-voice/SKILL.md

@@ -17,9 +17,13 @@ when it is available; otherwise render compact numbered choices with an
 
 1. Read `.claude/skills/egregore-voice/SKILL.md` for the workflow details.
 2. Run the referenced `bin/` scripts directly from Codex.
-3. Treat graph, publish, and notify steps as best-effort unless that workflow
-   explicitly says they are required.
-4. Keep local-mode behavior filesystem-first and avoid graph or notification
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
    calls when `egregore.json` declares `"mode": "local"`.
-5. Never call the deprecated `egregore-handoff` CLI for Egregore project
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
    handoffs.

package/runtime/pi/.codex/skills/emissary/SKILL.md

@@ -33,9 +33,13 @@ reading `.claude/skills/emissary/SKILL.md`, reproduce the same visible UX in Cod
 
 1. Read `.claude/skills/emissary/SKILL.md` for the workflow details.
 2. Run the referenced `bin/` scripts directly from Codex.
-3. Treat graph, publish, and notify steps as best-effort unless that workflow
-   explicitly says they are required.
-4. Keep local-mode behavior filesystem-first and avoid graph or notification
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
    calls when `egregore.json` declares `"mode": "local"`.
-5. Never call the deprecated `egregore-handoff` CLI for Egregore project
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
    handoffs.

package/runtime/pi/.codex/skills/env/SKILL.md

@@ -17,9 +17,13 @@ when it is available; otherwise render compact numbered choices with an
 
 1. Read `.claude/skills/env/SKILL.md` for the workflow details.
 2. Run the referenced `bin/` scripts directly from Codex.
-3. Treat graph, publish, and notify steps as best-effort unless that workflow
-   explicitly says they are required.
-4. Keep local-mode behavior filesystem-first and avoid graph or notification
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
    calls when `egregore.json` declares `"mode": "local"`.
-5. Never call the deprecated `egregore-handoff` CLI for Egregore project
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
    handoffs.

package/runtime/pi/.codex/skills/handoff/SKILL.md

@@ -6,8 +6,8 @@ description: Create an internal Egregore team handoff when the user invokes /han
 # Egregore Handoff
 
 Native Codex Egregore skill. This creates an internal team handoff in
-`memory/handoffs/`, indexes it, publishes it when possible, and notifies through
-the Egregore scripts. External runnable packets are emissaries; if the user
+`memory/handoffs/`, indexes it, publishes it when possible, and may prepare an
+external notification proposal. External runnable packets are emissaries; if the user
 asks for one or provides an `egregore.xyz/emissary/e/` link, use the emissary
 tooling instead.
 
@@ -22,25 +22,85 @@ an addressed recipient belongs to `$wrap`.
    `name`, then git config.
 3. Parse a short topic and optional recipient from the user request. Match the
    recipient against `memory/people/*.md`; omit the recipient when uncertain.
-4. Draft the markdown body with these sections:
+4. Draft the canonical markdown record with frontmatter and these sections:
    - `## Briefing`
    - `## Key Decisions`
    - `## Current State`
    - `## Open Threads`
    - `## Next Steps`
    - `## Entry Points`
-5. Write the body to a temp file, then run one orchestration command:
+   Use this metadata contract even when the user supplied only prose:
+
+```markdown
+---
+capture_schema: egregore-capture/v1
+capture_mode: addressed
+kind: addressed
+from: <author>
+addressed_to: <recipient, if any>
+date: YYYY-MM-DD
+topic: <topic>
+intent: <action | feedback | fyi>
+claim: <one-line claim>
+ask: <what the receiver should do>
+---
+```
+
+5. Compose the HTML view from that record. Markdown is canonical; the JSON is
+   only a presentation map. Give every JSON section a stable `id` and add a
+   top-level `sourceMap` from every authored `##` heading to the section that
+   contains its complete text:
+
+```json
+{
+  "kind": "handoff",
+  "kicker": "Handoff",
+  "topic": "<topic>",
+  "claim": "<one-line claim>",
+  "sourceMap": {
+    "Briefing": "briefing",
+    "Key Decisions": "decisions",
+    "Current State": "current-state",
+    "Open Threads": "open-threads",
+    "Next Steps": "next-steps",
+    "Entry Points": "entry-points"
+  },
+  "sections": [
+    {"id":"briefing","label":"Briefing","component":"prose","body":"<complete Briefing text>"}
+  ]
+}
+```
+
+   Pick richer components when they fit, but copy all authored content into
+   the mapped destination. Never independently summarize the Markdown into the
+   JSON. For command-heavy sections, keep command headings, explanatory text,
+   fenced commands, and expected output verbatim.
+
+6. Render the actual HTML with semantic coverage enabled and show it before
+   publishing. This is the approval surface—not a list of component names:
+
+```bash
+node packages/egregore-artifacts/bin/cli.js composed "$COMPOSED_FILE" \
+  --source "$BODY_FILE" --verify-fidelity
+```
+
+   Stop for confirmation after the browser preview. If validation fails, fix
+   the mapping/content and render again. Skip confirmation only when the user
+   explicitly said to send without preview.
+
+7. After confirmation, run one orchestration command:
 
 ```bash
 TMPDIR="$(mktemp -d -t codex-handoff-XXXXXX)"
-TMPDIR="$TMPDIR" bash bin/capture-run.sh --mode addressed --author "$AUTHOR" --topic "$TOPIC" ${RECIPIENT_ARG} < "$BODY_FILE"
+TMPDIR="$TMPDIR" bash bin/capture-run.sh --mode addressed --author "$AUTHOR" \
+  --topic "$TOPIC" ${RECIPIENT_ARG} --composed "$COMPOSED_FILE" < "$BODY_FILE"
 ```
 
 Use `--recipient "$RECIPIENT"` only when a clear teammate or future-self
-recipient is known. Do not pass `--no-publish` or `--no-notify` unless the user
-explicitly asked for a dry run.
+recipient is known. Do not pass `--no-publish` unless the user explicitly
+asked for a dry run. The runner may plan a notification, but never dispatches.
 
-6. Read `$TMPDIR/handoff-run-result.json` and render:
+8. Read `$TMPDIR/handoff-run-result.json` and render:
 
 ```bash
 node bin/codex-skill-render.mjs handoff-card "$TMPDIR/handoff-run-result.json"
@@ -50,13 +110,20 @@ Paste the rendered card exactly in the visible response, preferably in a
 `text` fenced block. Do not paraphrase the card into bullets unless the user
 asks for a summary.
 
-7. Fire the detached save helper when appropriate:
+9. If the result has `notifyStatus: "approval_required"`, follow
+   `.claude/context/notification-consent.md`. In a separate checkpoint, show
+   the exact organization, recipient/group, every channel/delivery, and exact
+   message from `notifyPlan`; offer Send / Edit / Cancel and wait. Only a Send
+   response to that preview permits one `approve` + `dispatch`. A local direct
+   message never falls back to a group.
+
+10. Fire the detached save helper when appropriate:
 
 ```bash
 ( bash bin/handoff-save-egregore.sh "$AUTHOR" "$TOPIC" >/dev/null 2>&1 & ) >/dev/null 2>&1
 ```
 
-8. Report the `memory/...` path and hosted link from the result JSON when a
+11. Report the `memory/...` path and hosted link from the result JSON when a
    link exists.
 
 ## Rules
@@ -65,7 +132,11 @@ asks for a summary.
 - Do not use Claude Code commands.
 - Keep the briefing concise and operational; include exact files, branches,
   commands, open questions, and verification state when relevant.
+- The artifact is a view of the handoff, never a summary of it. Publishing
+  must fail when any non-empty authored section is unmapped or loses content.
 - Structured UX parity is required: the rendered card is the acknowledgment.
   Do not add a preamble such as "Handoff created successfully." Preserve the
   72-column TUI/card shape, status footer, links below the box, and warning
   placement used by the Egregore handoff workflow.
+- Creating or approving the handoff is not notification consent. Never approve
+  or dispatch from detached work.

package/runtime/pi/.codex/skills/harvest/QUESTION_PALETTE.md

@@ -0,0 +1,76 @@
+# Harvest — Question Palette
+
+> Ask for the kind of judgment the harvest actually needs.
+
+This document is the single canonical home for choosing a question move
+and answer shape from `questionIntent`. `PROCESS.md` owns the conversational
+rhythm and evaluation; `SKILL.md` owns rendered-surface wiring; scrolls
+consume this palette directly. They point here instead of restating it.
+The byte-identical `.codex/skills/harvest/QUESTION_PALETTE.md` file is a
+packaging mirror for Codex and Pi; tests reject drift from this source.
+
+The palette is a decision aid, not a checklist. It never requires a mix or
+minimum number of shapes. An all-`single` surface is correct when every
+question is truly an enumerable fork; it is wrong when rankings, subsets,
+graded positions, or unmapped spaces were flattened into option cards.
+
+## Selection rule
+
+For every question:
+
+1. State the `questionIntent`: what the answer must reveal or change.
+2. Choose the closest intent row below.
+3. Use its move and answer shape when available.
+4. If another shape fits better, record one sentence explaining why.
+5. In a new rendered surface, declare `mode` explicitly. An absent mode
+   falls back to `single` only for backward compatibility.
+
+The author must be able to explain both why the question is being asked
+and why its answer shape fits. There is no shape quota or preset flow.
+
+## Intent → move → answer shape
+
+| Elicitation intent | Question move / answer shape | Guard |
+|---|---|---|
+| Decide among enumerable, mutually exclusive alternatives | Run the **enumerability test**: the author can state the full space. Use option cards, mode `single`, with 2–4 options, an “other, in your own words” escape, honest ± tradeoffs, and at most one argued lean. | If the full space cannot be stated, it is not a single-pick fork. |
+| Place a graded position or intensity between two honest poles | Name the evaluated dimension and both poles concretely. Use mode `spectrum` with 5–7 discrete, fully labeled stops; follow a midpoint with a clarifying probe. | Nothing is preselected. Untouched, midpoint, and UNDECIDED remain distinct. Never use a continuous slider. |
+| Set priority or sequence over a small set | Use mode `rank`; allow ties or top-k when a total order would invent precision. | Keep to at most 5 items. |
+| Compare importance across a longer list | Run **best-worst** as dialogue: show 3–4 items, ask most and least, then rotate subsets. | Do not turn a long list into a rating battery. |
+| Choose a non-exclusive subset | In an artifact, use mode `multi` with an explicit `max`. In live dialogue, walk items one at a time as explicit include / leave-out judgments. | Cap the subset and keep the candidate set small enough to inspect. “Select all that apply” without a cap invites shallow selection. |
+| Allocate relative magnitude or resources | Use mode `weight` with coarse 5–10% steps and an explicit untouched state. | Use at most 5 buckets; do not imply false precision or prefill an even split. |
+| Weight decision dimensions with different ranges | Ask a **swing question**: with every dimension at its worst, which swing to best would the respondent buy first? Continue against the concrete ranges. | Do not substitute context-free importance ratings. |
+| Elicit a quantity plus confidence | Ask, in order: lowest plausible, highest plausible, best guess, then sureness. Prefer frequency framing. | This needs the four-field interval card; until that renderer addition exists, run it conversationally. |
+| Explore an unmapped answer space, rationale, or discovery question | Use an open prompt anchored in the respondent’s own words. Acknowledge the answer, then probe only when it is insufficient. | Ask at most 1–2 probes per question; do not use a bare “why?” when a specific clarifier is available. |
+| Discover tacit taste dimensions before minting a fork | Run a **triad**: present three concrete elements and ask which two are alike and how the third differs. The named difference becomes a candidate axis. | Do not supply the taste taxonomy in advance. |
+| Reach tacit expertise behind a general claim | Run a **critical-incident sequence**: one concrete incident, a co-built timeline, deepening probes, then “what if X had been absent?” | Generalities are elicited through a real case, not requested directly. |
+| Deepen a thin why-note | **Ladder up** with “why does that matter to you?” or **ladder down** with “give me a concrete example.” | Stop after at most 3 consecutive ladder steps. |
+| Verify the interviewer’s interpretation | Run a **mirrored-inference check**: “My read of your position is X — what is wrong in that?” End a harvest with a member check of each respondent’s own synthesis when useful. | Mirror the sharpest reading, including tensions; do not smooth disagreement into affirmation. |
+| Get concrete feedback after abstract forks run dry, or when the respondent asks to see the work | Show only the relevant draft or excerpt in the decisions view and ask an open prompt naming what the answer will change. | This is selective authoring, not a mode: no default per-section controls, no generic ready/not-ready verdict, and no interaction added to the readable face. |
+| Elicit multi-respondent preferences, positions, or estimates | Default to blind independent collection. Freeze one shared artifact and question set when everyone should answer the same inquiry; otherwise adapt only from the seed, RoleSheet, and that respondent’s own prior turns. | Attribute every position and preserve its reasoning. Append pre-seal corrections and let the latest supersede; after sealing, a changed position starts a new round. Never report an anonymous aggregate such as “most of the team thinks.” |
+| Preserve honest nonresponse | Offer explicit `UNDECIDED`, distinct from untouched. | Never force an answer. A scroll may carry it once, then must reframe or demote the question. |
+| Handle an escape-hatch answer that names a missing option | At review, treat it as a candidate option or fork for the next version. | The creator decides whether it enters the pool; never silently coerce it into an existing option. |
+
+## Conversational moves
+
+These moves need no widget. They run inside PROCESS’s generate → evaluate
+rhythm:
+
+- **Ladder up / down** moves between value and concrete example.
+- **Critical incident** reconstructs one real episode before generalizing.
+- **Triad** lets the respondent name the comparison axis.
+- **Best-worst** extracts discrimination from rotating small subsets.
+- **Swing question** ties importance to the actual range of change.
+- **Mirrored-inference check** asks the respondent to correct the model’s
+  strongest interpretation.
+- **One-at-a-time forced choice** replaces an unbounded check-all with
+  inspectable include / leave-out judgments.
+
+## Hard bans
+
+These are lintable rules:
+
+- No agree/disagree, true/false, or yes/no stems — rewrite as explicit alternatives or an item-specific scale.
+- No draggable sliders with a preset thumb; no numbers-only or endpoint-only scales.
+- No batteries of stacked identical gauges; one question per fold-point, adjacent to its motivating prose.
+- Nothing pre-selected, ever — including spectrum position and weight splits; the lean argues, it never pre-picks.
+- No dropdowns in surfaces; >4 genuine options means an unsplit fork — split it.

package/runtime/pi/.codex/skills/harvest/SKILL.md

@@ -49,21 +49,44 @@ best-effort and must never block markdown state.
 4. Clarify the harvest intent when topic, respondents, dimensions, or
    disclosure mode are under-specified. Use structured Codex question tooling
    when available; otherwise ask one numbered question at a time with `Other:`.
-5. Ask situated questions. Each question must have an explicit
-   `question_intent` and must be grounded in the role sheet, seed, or prior
-   answers.
+5. Read `QUESTION_PALETTE.md` completely. Ask situated questions with an
+   explicit `question_intent`, an answer shape that fits it, and grounding in
+   the role sheet, seed, the respondent's own prior answers, or attributed
+   positions allowed by the disclosure setting. Blind mode must not use
+   another respondent's answer content, even invisibly. Record a one-sentence
+   reason when departing from the palette's closest intent row.
 6. Persist every turn immediately with turn number, question, intent, answer,
-   and evaluation. For absent respondents, create async questions with:
+   and evaluation. Apply the palette's satisficing and sycophancy guards when
+   evaluating. For absent respondents, create async questions with:
 
 ```bash
 bin/agent.sh ask --from "$INITIATOR" --to "$RESPONDENT" --topic "$TOPIC" --question "$QUESTION" --harvest-id "$HARVEST_ID" --harvest-session-id "$HARVEST_SESSION_ID" --turn "$TURN" --question-intent "$QUESTION_INTENT" --context-mode "$DISCLOSURE_MODE"
 ```
 
-7. In connected mode, notify async respondents best-effort with
-   `bin/notify.sh send`.
+7. In connected mode, follow `.claude/context/notification-consent.md` for
+   each async respondent: prepare one direct notification, show its exact
+   recipient/channel/message in a separate checkpoint, and dispatch once only
+   after that approval. Selecting respondents is not notification consent and
+   approvals cannot be batched.
 8. Continue until present respondents reach diminishing returns and async
    respondents are either answered, pending, or explicitly skipped.
 
+## Multi-respondent rounds
+
+Preference, estimate, and position intents default to `blind`. When everyone
+should answer the same inquiry, freeze one source version and question set
+before collection and send the identical artifact to each respondent.
+
+While collection is open, a respondent may correct their own response. Append
+the correction, use their latest finalized response as canonical, and count
+distinct finalized respondents rather than submissions. After the declared
+completion condition seals the evidence, it is immutable; a changed position
+starts a new round. There is no automatic second pass after disclosure.
+
+Attribute disclosed positions and preserve their reasoning. Never turn them
+into an anonymous aggregate such as "most of the team thinks." A majority may
+be named with its respondents, but it is not collective alignment.
+
 ## Synthesis
 
 Write `synthesis.md` with:
@@ -102,6 +125,7 @@ render the Egregore harvest TUI instead of a prose-only recap:
 ## Rules
 
 - Ask one question at a time for present respondents.
+- Never impose an answer-shape quota or preset question flow.
 - Make low-confidence role assumptions visible when they shape questions.
 - Local mode skips graph and notification calls.
 - Do not use Claude Code commands.