create-egregore 0.19.21 → 0.19.23

package/runtime/pi/bin/handoff-run.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 # handoff-run.sh — atomic orchestrator for /handoff.
 #
@@ -25,7 +25,7 @@ set -euo pipefail
 #      and returns a subgraph snapshot in the result JSON
 #   6. Commits + pushes memory repo (with orphan-stash dance if needed)
 #   7. Publishes HTML artifact via bin/publish-artifact.sh
-#   8. Sends Telegram notification via bin/notify.sh (if recipient)
+#   8. Creates an exact notification proposal via bin/notify.sh (never sends)
 #   9. Emits ONE status line and ONE JSON blob on stdout
 #
 # Exit codes:
@@ -122,88 +122,63 @@ if [ ! -s "$ABS_FILE" ]; then
   exit 1
 fi
 
-# --- Canonical capture contract -----------------------------------------
-# /handoff is the addressed door into the shared capture engine. Persist the
-# same schema/mode fields used by /wrap and SessionEnd so filesystem and graph
-# retrieval can distinguish captures without inferring from directory names.
-if ! grep -qiE '^(capture_schema:|\*\*[Cc]apture [Ss]chema\*\*:)' "$ABS_FILE"; then
-  CAPTURE_KIND=""
-  if ! grep -qiE '^(kind:|\*\*[Kk]ind\*\*:)' "$ABS_FILE"; then
-    CAPTURE_KIND="addressed"
-  fi
-  if [ "$(head -1 "$ABS_FILE")" = "---" ]; then
-    awk -v kind="$CAPTURE_KIND" '
-      NR == 1 {
-        print
-        print "capture_schema: egregore-capture/v1"
-        print "capture_mode: addressed"
-        if (kind != "") print "kind: " kind
-        next
-      }
-      { print }
-    ' "$ABS_FILE" > "$ABS_FILE.new" && mv "$ABS_FILE.new" "$ABS_FILE"
-  else
-    awk -v kind="$CAPTURE_KIND" '
-      !injected && /^\*\*[Aa]uthor\*\*:/ {
-        print
-        print "**Capture Schema**: egregore-capture/v1"
-        print "**Capture Mode**: addressed"
-        if (kind != "") print "**Kind**: " kind
-        injected=1
-        next
-      }
-      { print }
-      END {
-        if (!injected) {
-          print "**Capture Schema**: egregore-capture/v1"
-          print "**Capture Mode**: addressed"
-          if (kind != "") print "**Kind**: " kind
-        }
-      }
-    ' "$ABS_FILE" > "$ABS_FILE.new" && mv "$ABS_FILE.new" "$ABS_FILE"
-  fi
-fi
+# --- Canonical metadata boundary ----------------------------------------
+# Callers are allowed to send prose-only markdown, but persisted handoffs are
+# not. Normalize every input to the same frontmatter contract before indexing
+# or rendering so title/author/recipient cannot disappear at the adapter seam.
+HAS_FRONTMATTER=0
+[ "$(head -1 "$ABS_FILE")" = "---" ] && HAS_FRONTMATTER=1
 
-# --- Inject **To**: line if --recipient given and body omits it -----
-# index-handoff.sh parses recipients from the file body. Skills
-# normally write the To line themselves, but callers that invoke
-# handoff-run.sh directly often skip it. Inject after the Author
-# line so the graph gets the HANDED_TO edge.
-if [ -n "$RECIPIENT" ] && ! grep -qi "^\*\*[Tt]o\*\*:" "$ABS_FILE"; then
-  awk -v r="$RECIPIENT" '
-    !injected && /^\*\*[Aa]uthor\*\*:/ {
-      print
-      print "**To**: " r
-      injected=1
-      next
-    }
-    { print }
-  ' "$ABS_FILE" > "$ABS_FILE.new" && mv "$ABS_FILE.new" "$ABS_FILE"
-fi
+_has_frontmatter_key() {
+  [ "$HAS_FRONTMATTER" = "1" ] && sed -n '2,/^---$/p' "$ABS_FILE" | grep -qiE "^${1}:"
+}
 
-# --- Persist lifecycle intent in the canonical handoff file -------------
-if ! grep -qiE '^(intent:|\*\*[Ii]ntent\*\*:)' "$ABS_FILE"; then
-  if [ "$(head -1 "$ABS_FILE")" = "---" ]; then
-    awk -v intent="$INTENT" '
-      NR == 1 { print; print "intent: " intent; next }
-      { print }
-    ' "$ABS_FILE" > "$ABS_FILE.new" && mv "$ABS_FILE.new" "$ABS_FILE"
-  else
-    awk -v intent="$INTENT" '
-      !injected && /^\*\*[Aa]uthor\*\*:/ {
-        print
-        print "**Intent**: " intent
-        injected=1
-        next
-      }
-      { print }
-      END {
-        if (!injected) print "**Intent**: " intent
-      }
-    ' "$ABS_FILE" > "$ABS_FILE.new" && mv "$ABS_FILE.new" "$ABS_FILE"
-  fi
+MISSING_SCHEMA=0;    _has_frontmatter_key capture_schema || MISSING_SCHEMA=1
+MISSING_MODE=0;      _has_frontmatter_key capture_mode || MISSING_MODE=1
+MISSING_KIND=0;      _has_frontmatter_key kind || MISSING_KIND=1
+MISSING_FROM=0;      _has_frontmatter_key from || _has_frontmatter_key author || MISSING_FROM=1
+MISSING_DATE=0;      _has_frontmatter_key date || MISSING_DATE=1
+MISSING_TOPIC=0;     _has_frontmatter_key topic || MISSING_TOPIC=1
+MISSING_INTENT=0;    _has_frontmatter_key intent || MISSING_INTENT=1
+MISSING_RECIPIENT=0
+if [ -n "$RECIPIENT" ]; then
+  _has_frontmatter_key addressed_to || _has_frontmatter_key to || MISSING_RECIPIENT=1
 fi
 
+awk \
+  -v has_frontmatter="$HAS_FRONTMATTER" \
+  -v schema="$MISSING_SCHEMA" -v mode="$MISSING_MODE" -v kind="$MISSING_KIND" \
+  -v from="$MISSING_FROM" -v date_missing="$MISSING_DATE" \
+  -v topic_missing="$MISSING_TOPIC" -v intent_missing="$MISSING_INTENT" \
+  -v recipient_missing="$MISSING_RECIPIENT" \
+  -v author="$AUTHOR" -v date="$TODAY" -v topic="$TOPIC" \
+  -v intent="$INTENT" -v recipient="$RECIPIENT" '
+  function metadata() {
+    if (schema) print "capture_schema: egregore-capture/v1"
+    if (mode) print "capture_mode: addressed"
+    if (kind) print "kind: addressed"
+    if (from) print "from: " author
+    if (recipient_missing) print "addressed_to: " recipient
+    if (date_missing) print "date: " date
+    if (topic_missing) print "topic: " topic
+    if (intent_missing) print "intent: " intent
+  }
+  BEGIN {
+    if (!has_frontmatter) {
+      print "---"
+      metadata()
+      print "---"
+      print ""
+    }
+  }
+  has_frontmatter && NR == 1 {
+    print
+    metadata()
+    next
+  }
+  { print }
+' "$ABS_FILE" > "$ABS_FILE.new" && mv "$ABS_FILE.new" "$ABS_FILE"
+
 # --- Append repo state ---------------------------------------------------
 # --no-pr skips `gh pr list` (~400–600ms per repo). A detached PR backfill
 # after the parallel phase rewrites `—` → `#N` and re-pushes memory.
@@ -231,14 +206,14 @@ awk -v line="$IDX_LINE" '
   END { if (!inserted) print line }
 ' "$INDEX" > "$INDEX.new" && mv "$INDEX.new" "$INDEX"
 
-# --- Parallel stage: graph + memory + (publish → notify) ----------------
+# --- Parallel stage: graph + memory + (publish → notification proposal) -
 #
 # Three independent branches fork here and join before we emit the result:
 #   A. Graph index     — reads ABS_FILE, writes Session node to Neo4j, and
 #                        returns the handoff's neighborhood as subgraph JSON.
 #   B. Memory push     — commits + pushes memory repo (orphan-stash dance).
-#   C. Publish+notify  — publishes HTML artifact, then (if recipient is set)
-#                        sends Telegram with the artifact URL embedded.
+#   C. Publish+plan    — publishes HTML artifact, then creates an immutable
+#                        notification proposal with the artifact URL embedded.
 #
 # Each branch writes its result to a tmpfile. Wall-clock is max(A,B,C).
 #
@@ -251,7 +226,7 @@ MEMORY_DIR="$SCRIPT_DIR/memory"
 TMPD=$(mktemp -d -t handoff-run-XXXXXX)
 trap 'rm -rf "$TMPD"' EXIT
 
-# Extract briefing text once (used by publish and notify) so we don't
+# Extract briefing text once (used by publish and the proposal) so we don't
 # re-awk the same file inside multiple workers.
 BRIEFING_LEAD=$(awk '/^## Briefing/{found=1; next} found && /^##/{exit} found && NF{print}' "$ABS_FILE" 2>/dev/null \
   | head -2 | tr '\n' ' ' | cut -c1-200 || true)
@@ -390,19 +365,27 @@ PID_MEMORY=$!
     fi
     EMISSARY_API_URL="${EMISSARY_API_URL:-https://egregore-production-55f2.up.railway.app/api/v1/emissary}"
 
-    if [ -n "$EMISSARY_TOKEN" ]; then
+    # /handoff is an internal team primitive, not an implicit public-emissary
+    # composer. Use the emissary route only for an explicit recipient, and make
+    # that artifact directed-private. Recipient-less handoffs fall through to
+    # the org-scoped publisher (connected) or opt-in relay (local).
+    if [ -n "$EMISSARY_TOKEN" ] && [ -n "$RECIPIENT" ]; then
       # Step 1: render the handoff to HTML locally using egregore-artifacts.
       # Same renderer + template publish-artifact.sh uses today — handoffs
       # keep their familiar look.
       RENDERED_HTML="$TMPD/handoff.html"
       RENDER_OK=0
       LOCAL_CLI="$SCRIPT_DIR/packages/egregore-artifacts/bin/cli.js"
+      FIDELITY_ARGS=(--verify-fidelity)
+      if [ "$RENDER_TYPE" = "composed" ]; then
+        FIDELITY_ARGS+=(--source "$ABS_FILE")
+      fi
       if [ "${EGREGORE_USE_PUBLISHED:-0}" != "1" ] && [ -f "$LOCAL_CLI" ] && [ -d "$SCRIPT_DIR/packages/egregore-artifacts/node_modules/react" ]; then
-        if node "$LOCAL_CLI" "$RENDER_TYPE" "${RENDER_SRC:-$ABS_FILE}" --output "$RENDERED_HTML" >/dev/null 2>&1; then
+        if node "$LOCAL_CLI" "$RENDER_TYPE" "${RENDER_SRC:-$ABS_FILE}" "${FIDELITY_ARGS[@]}" --output "$RENDERED_HTML" >/dev/null 2>"$TMPD/render-error"; then
           RENDER_OK=1
         fi
       else
-        if npx egregore-artifacts "$RENDER_TYPE" "${RENDER_SRC:-$ABS_FILE}" --output "$RENDERED_HTML" >/dev/null 2>&1; then
+        if npx -y egregore-artifacts@latest "$RENDER_TYPE" "${RENDER_SRC:-$ABS_FILE}" "${FIDELITY_ARGS[@]}" --output "$RENDERED_HTML" >/dev/null 2>"$TMPD/render-error"; then
           RENDER_OK=1
         fi
       fi
@@ -422,12 +405,8 @@ PID_MEMORY=$!
             DISPLAY_NAME=$(head -1 "$PERSON_FILE" | sed 's/^# //')
           fi
 
-          # addressed_to: only set if there's a recipient
-          ADDRESSED_TO="[]"
-          if [ -n "$RECIPIENT" ]; then
-            RECIP_HANDLE=$(echo "$RECIPIENT" | tr '[:upper:]' '[:lower:]' | awk '{print $1}')
-            ADDRESSED_TO=$(jq -nc --arg h "$RECIP_HANDLE" --arg d "$RECIPIENT" '[{"handle":$h,"display":$d}]')
-          fi
+          RECIP_HANDLE=$(echo "$RECIPIENT" | tr '[:upper:]' '[:lower:]' | awk '{print $1}')
+          ADDRESSED_TO=$(jq -nc --arg h "$RECIP_HANDLE" --arg d "$RECIPIENT" '[{"handle":$h,"display":$d}]')
 
           CLAIM=$(echo "$BRIEFING_LEAD" | cut -c1-200)
 
@@ -456,8 +435,8 @@ PID_MEMORY=$!
               body: { prose: $prose },
               audience: {
                 addressed_to: $addressed,
-                visible_to: "public",
-                extendable_by: "anyone"
+                visible_to: $addressed,
+                extendable_by: $addressed
               },
               parents: [],
               render_mode: "custom",
@@ -475,16 +454,35 @@ PID_MEMORY=$!
     fi
   fi
 
-  # Fallback: if the emissary publish didn't produce a URL (no token, no
-  # network, size cap, render failure), fire the legacy publish-artifact.sh
-  # so handoffs still get a Telegram-able URL.
+  # Fallback: if a directed emissary publish didn't produce a URL—or this is a
+  # recipient-less team handoff—use publish-artifact.sh. Connected mode is
+  # authenticated and org-scoped; local mode's public relay is opt-in.
+  PUBLISH_RC=0
   if [ -z "$V1URL" ] && [ "$NO_PUBLISH" = "0" ] && [ -x "$SCRIPT_DIR/bin/publish-artifact.sh" ]; then
     AURL=$(bash "$SCRIPT_DIR/bin/publish-artifact.sh" "$RENDER_TYPE" "${RENDER_SRC:-$ABS_FILE}" \
+      --verify-fidelity \
+      --source "$ABS_FILE" \
       --title "$TOPIC" \
       --author "$AUTHOR" \
-      --description "$BRIEFING_LEAD" 2>/dev/null || echo "")
+      --description "$BRIEFING_LEAD" 2>"$TMPD/publish-error") || PUBLISH_RC=$?
   fi
 
+  PS="published"
+  if [ "$NO_PUBLISH" = "1" ]; then
+    PS="disabled"
+  elif [ -n "$V1URL" ] || [ -n "$AURL" ]; then
+    PS="published"
+  elif [ "$PUBLISH_RC" = "4" ]; then
+    PS="relay-off"
+  elif [ "$PUBLISH_RC" = "3" ]; then
+    PS="hosting-off"
+  elif grep -q 'Handoff fidelity check failed' "$TMPD/render-error" "$TMPD/publish-error" 2>/dev/null; then
+    PS="fidelity-failed"
+  else
+    PS="failed"
+  fi
+  echo "$PS" > "$TMPD/publish"
+
   # Prefer v1 (emissary-rendered) URL when available; fall back to the
   # legacy egregore-artifacts URL only if the v1 publish failed.
   NOTIFY_URL=""
@@ -497,6 +495,7 @@ PID_MEMORY=$!
   fi
 
   NS="skipped"
+  echo '{}' > "$TMPD/notify-plan"
   if [ "$NO_NOTIFY" = "0" ]; then
     if [ -n "$NOTIFY_URL" ]; then
       MSG_NOTIFY="Handoff from ${AUTHOR}: ${TOPIC}
@@ -510,21 +509,19 @@ View: ${NOTIFY_URL}"
 \"${BRIEFING_SHORT}\""
     fi
 
-    # Always notify. With a recipient (connected mode) → DM. Otherwise → group.
-    # Self-handoffs still post to the group so they're visible on /activity
-    # and in the Telegram feed — a handoff without a Telegram beat is invisible.
-    if [ -n "$RECIPIENT" ] && [ "$MODE" = "connected" ]; then
-      NR=$(bash "$SCRIPT_DIR/bin/notify.sh" send "$RECIPIENT" "$MSG_NOTIFY" 2>/dev/null || echo "Failed")
+    # Resolve the exact destination, but never approve or dispatch here. The
+    # interactive harness must show this proposal in a separate checkpoint.
+    if [ -n "$RECIPIENT" ]; then
+      NR=$(bash "$SCRIPT_DIR/bin/notify.sh" plan send "$RECIPIENT" "$MSG_NOTIFY" 2>/dev/null || echo '{}')
     else
-      NR=$(bash "$SCRIPT_DIR/bin/notify.sh" group "$MSG_NOTIFY" 2>/dev/null || echo "Failed")
+      NR=$(bash "$SCRIPT_DIR/bin/notify.sh" plan group "$MSG_NOTIFY" 2>/dev/null || echo '{}')
     fi
 
-    if echo "$NR" | grep -qi "^Sent"; then
-      NS="sent"
-    elif echo "$NR" | grep -qi "^Failed"; then
-      NS="failed"
+    if printf '%s' "$NR" | jq -e '.status == "approval_required"' >/dev/null 2>&1; then
+      NS="approval_required"
+      printf '%s\n' "$NR" > "$TMPD/notify-plan"
     else
-      NS="unknown"
+      NS="unavailable"
     fi
   fi
   echo "$NS" > "$TMPD/notify"
@@ -574,6 +571,9 @@ fi
 MEMORY_STATUS=$(cat "$TMPD/memory"   2>/dev/null || echo "skipped")
 ARTIFACT_URL=$(cat "$TMPD/artifact"  2>/dev/null || echo "")
 NOTIFY_STATUS=$(cat "$TMPD/notify"   2>/dev/null || echo "skipped")
+NOTIFY_PLAN=$(cat "$TMPD/notify-plan" 2>/dev/null || echo "{}")
+PUBLISH_STATUS=$(cat "$TMPD/publish" 2>/dev/null || echo "skipped")
+[ -z "$PUBLISH_STATUS" ] && PUBLISH_STATUS="skipped"
 ARTIFACTS_ARR=$(cat "$TMPD/artifacts" 2>/dev/null || echo "[]")
 [ -z "$ARTIFACTS_ARR" ] && ARTIFACTS_ARR="[]"
 
@@ -594,16 +594,10 @@ fi
 STATUS_BITS=("saved")
 [ "$GRAPH_STATUS"  = "ok" ]    && STATUS_BITS+=("graphed")
 [ "$MEMORY_STATUS" = "ok" ]    && STATUS_BITS+=("pushed")
-if [ "$NOTIFY_STATUS" = "sent" ]; then
-  if [ -n "$RECIPIENT" ]; then
-    STATUS_BITS+=("${RECIPIENT} notified")
-  else
-    STATUS_BITS+=("group notified")
-  fi
-elif [ "$NOTIFY_STATUS" = "unknown" ] && [ -n "$RECIPIENT" ]; then
-  STATUS_BITS+=("${RECIPIENT} relayed to group")
-fi
+[ "$NOTIFY_STATUS" = "approval_required" ] && STATUS_BITS+=("notify approval pending")
 [ -n "$ARTIFACT_URL" ]         && STATUS_BITS+=("published")
+[ "$PUBLISH_STATUS" = "relay-off" ] && STATUS_BITS+=("not published")
+[ "$PUBLISH_STATUS" = "fidelity-failed" ] && STATUS_BITS+=("artifact fidelity failed")
 
 STATUS_LINE=""
 for bit in "${STATUS_BITS[@]}"; do
@@ -625,7 +619,9 @@ jq -cn \
   --arg graphStatus "$GRAPH_STATUS" \
   --arg memoryStatus "$MEMORY_STATUS" \
   --arg notifyStatus "$NOTIFY_STATUS" \
+  --argjson notifyPlan "$NOTIFY_PLAN" \
   --arg artifactUrl "$ARTIFACT_URL" \
+  --arg publishStatus "$PUBLISH_STATUS" \
   --arg recipient "$RECIPIENT" \
   --arg topic "$TOPIC" \
   --arg author "$AUTHOR" \
@@ -640,7 +636,9 @@ jq -cn \
     graphStatus:$graphStatus,
     memoryStatus:$memoryStatus,
     notifyStatus:$notifyStatus,
+    notifyPlan:$notifyPlan,
     artifactUrl:$artifactUrl,
+    publishStatus:$publishStatus,
     recipient:$recipient,
     topic:$topic,
     author:$author,

package/runtime/pi/bin/handoff-save-egregore.sh

@@ -1,13 +1,14 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # handoff-save-egregore.sh — background save+auto-merge for the core repo after a handoff.
 #
 # /handoff renders its card first, then fires this detached. The user never waits on git.
 #
 # Behavior:
 #   - If nothing to save (clean working tree + up-to-date with origin) → exit silently.
-#   - If on develop/main/master → create dev/{author}/handoff-{YYYY-MM-DD} branch from origin/develop.
-#   - Commit all changes, rebase onto origin/develop, push.
-#   - If push succeeds: create PR to develop (or reuse existing), then:
+#   - If on the configured base (or another protected branch) → create a
+#     dev/{author}/handoff-{YYYY-MM-DD} branch from origin/{base}.
+#   - Commit all changes, rebase onto origin/{base}, push.
+#   - If push succeeds: create a PR to the configured base (or reuse existing), then:
 #     - Markdown-only diff → `gh pr merge --auto --merge` (auto-merges when checks pass).
 #     - Code/config present → leave PR open for review (no auto-merge).
 #
@@ -45,9 +46,19 @@ while [ $# -gt 0 ]; do
 done
 
 case "$KIND" in
-  autosave) MSG_PREFIX="Auto-save" ; PR_BODY="Auto-saved session content (non-coding). No explicit /save needed." ;;
-  *)        MSG_PREFIX="Handoff"   ; PR_BODY="Auto-created by /handoff. Session work for:" ;;
+  autosave)
+    MSG_PREFIX="Auto-save"
+    PR_WHAT="Save session content captured by the opted-in autosave workflow."
+    PR_WHY="This preserves unattended non-coding work without requiring an explicit /save."
+    ;;
+  *)
+    MSG_PREFIX="Handoff"
+    PR_WHAT="Save core-repository session work captured when the handoff was created."
+    PR_WHY="The handoff records shared context immediately; this companion PR keeps the originating checkout's work from remaining only local."
+    ;;
 esac
+PR_BODY=$(printf '## What\n\n- %s\n\n## Why\n\n%s Topic: `%s`.\n\n## Verification\n\nNot verified — background %s save; review code or configuration changes before merging.\n\n🤖 Saved via `bin/handoff-save-egregore.sh`\n' \
+  "$PR_WHAT" "$PR_WHY" "$TOPIC" "$KIND")
 
 [ -n "$AUTHOR" ] || { echo "handoff-save-egregore: missing author" >&2; exit 1; }
 
@@ -56,6 +67,22 @@ SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
 [ -z "$REPO_DIR" ] && REPO_DIR="$SCRIPT_DIR"
 cd "$REPO_DIR" || exit 1
 
+# Resolve the target checkout's configured integration branch. SCRIPT_DIR points
+# at the framework that owns this helper, while CONFIG must follow --repo-dir so
+# sandboxed and installed instances read their own egregore.json.
+CONFIG="$REPO_DIR/egregore.json"
+[ -f "$SCRIPT_DIR/bin/lib/config.sh" ] || {
+  echo "handoff-save-egregore: base-branch resolver is unavailable" >&2
+  exit 1
+}
+# shellcheck source=bin/lib/config.sh
+. "$SCRIPT_DIR/bin/lib/config.sh" 2>/dev/null || exit 1
+if ! BASE_BRANCH=$(_get_base_branch); then
+  echo "handoff-save-egregore: could not resolve the configured base branch" >&2
+  exit 1
+fi
+BASE_REF="origin/$BASE_BRANCH"
+
 # Shared safe-staging guard — never auto-commit stray sibling-repo gitlinks.
 # shellcheck source=bin/lib/git-safe.sh
 . "$SCRIPT_DIR/bin/lib/git-safe.sh" 2>/dev/null || true
@@ -65,7 +92,7 @@ type git_add_guarded >/dev/null 2>&1 || git_add_guarded() { git add -A 2>/dev/nu
 # shellcheck source=bin/lib/noncode.sh
 . "$SCRIPT_DIR/bin/lib/noncode.sh" 2>/dev/null || true
 type noncode_blockers >/dev/null 2>&1 || noncode_blockers() {
-  git -C "${2:-.}" diff "${1:-origin/develop}...HEAD" --name-only 2>/dev/null | grep -v '\.md$' | head -1 || true
+  git -C "${2:-.}" diff "${1:-$BASE_REF}...HEAD" --name-only 2>/dev/null | grep -v '\.md$' | head -1 || true
 }
 
 # --- Early exit if nothing to do -----------------------------------------
@@ -75,9 +102,12 @@ DIRTY=0
 CURRENT_BRANCH=$(git branch --show-current 2>/dev/null || echo "")
 AHEAD=0
 if [ -n "$CURRENT_BRANCH" ]; then
-  # Count commits ahead of origin/develop on the current branch (works from any
-  # dev/* branch or from develop itself).
-  AHEAD=$(git rev-list --count "origin/develop..HEAD" 2>/dev/null || echo 0)
+  # A missing remote base is not evidence that there is nothing to save. The
+  # former `|| echo 0` made a main-only instance silently discard clean,
+  # committed topic work because origin/develop did not exist.
+  if ! AHEAD=$(git rev-list --count "$BASE_REF..HEAD" 2>/dev/null); then
+    AHEAD=1
+  fi
 fi
 
 if [ "$DIRTY" = "0" ] && [ "$AHEAD" = "0" ]; then
@@ -85,18 +115,18 @@ if [ "$DIRTY" = "0" ] && [ "$AHEAD" = "0" ]; then
 fi
 
 # --- Protect the protected branches: create a working branch if needed --
-case "$CURRENT_BRANCH" in
-  develop|main|master|"")
-    SLUG_DATE=$(date +%Y-%m-%d)
-    # --branch-suffix keeps concurrent rescues distinct (e.g. per-checkout
-    # hash from the autosave sweep) — same-name pushes wedge on non-FF.
-    NEW_BRANCH="dev/${AUTHOR}/${KIND}-${SLUG_DATE}${BRANCH_SUFFIX:+-$BRANCH_SUFFIX}"
-    git fetch origin develop --quiet 2>/dev/null || true
-    git checkout -b "$NEW_BRANCH" origin/develop --quiet 2>/dev/null || \
-      git checkout "$NEW_BRANCH" --quiet 2>/dev/null || exit 0
-    CURRENT_BRANCH="$NEW_BRANCH"
-    ;;
-esac
+if [ -z "$CURRENT_BRANCH" ] || [ "$CURRENT_BRANCH" = "$BASE_BRANCH" ] \
+   || [ "$CURRENT_BRANCH" = "develop" ] || [ "$CURRENT_BRANCH" = "main" ] \
+   || [ "$CURRENT_BRANCH" = "master" ]; then
+  SLUG_DATE=$(date +%Y-%m-%d)
+  # --branch-suffix keeps concurrent rescues distinct (e.g. per-checkout
+  # hash from the autosave sweep) — same-name pushes wedge on non-FF.
+  NEW_BRANCH="dev/${AUTHOR}/${KIND}-${SLUG_DATE}${BRANCH_SUFFIX:+-$BRANCH_SUFFIX}"
+  git fetch origin "$BASE_BRANCH" --quiet 2>/dev/null || true
+  git checkout -b "$NEW_BRANCH" "$BASE_REF" --quiet 2>/dev/null || \
+    git checkout "$NEW_BRANCH" --quiet 2>/dev/null || exit 0
+  CURRENT_BRANCH="$NEW_BRANCH"
+fi
 
 # --- Commit whatever is uncommitted --------------------------------------
 if [ -n "$(git status --porcelain 2>/dev/null)" ]; then
@@ -104,11 +134,11 @@ if [ -n "$(git status --porcelain 2>/dev/null)" ]; then
   git commit -m "${MSG_PREFIX}: ${TOPIC}" --quiet 2>/dev/null || true
 fi
 
-# --- Rebase onto develop, fall back to merge if rebase conflicts ---------
-git fetch origin develop --quiet 2>/dev/null || true
-if ! git rebase origin/develop --quiet 2>/dev/null; then
+# --- Rebase onto the configured base, fall back to merge on conflicts ----
+git fetch origin "$BASE_BRANCH" --quiet 2>/dev/null || true
+if ! git rebase "$BASE_REF" --quiet 2>/dev/null; then
   git rebase --abort 2>/dev/null || true
-  if ! git merge origin/develop --quiet -m "Sync with develop" 2>/dev/null; then
+  if ! git merge "$BASE_REF" --quiet -m "Sync with $BASE_BRANCH" 2>/dev/null; then
     # Conflicts we can't auto-resolve. Leave the branch as-is; the user will see it
     # next session or when they run /save explicitly.
     git merge --abort 2>/dev/null || true
@@ -128,7 +158,7 @@ fi
 LEDGER="${EGREGORE_AUTOSAVE_LOG:-$HOME/.egregore/autosave.log}"
 ledger_write() { # pr outcome
   local n_files
-  n_files=$(git diff origin/develop...HEAD --name-only 2>/dev/null | grep -c . || echo 0)
+  n_files=$(git diff "$BASE_REF...HEAD" --name-only 2>/dev/null | grep -c . || echo 0)
   mkdir -p "$(dirname "$LEDGER")" 2>/dev/null || true
   printf '%s|%s|%s|%s|%s|%s|%s\n' \
     "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$KIND" "$REPO_DIR" "$CURRENT_BRANCH" \
@@ -145,15 +175,15 @@ EXISTING_BASE=$(echo "$EXISTING" | jq -r '.baseRefName // empty' 2>/dev/null)
 
 if [ -n "$EXISTING_NUMBER" ]; then
   PR_NUMBER="$EXISTING_NUMBER"
-  if [ "$EXISTING_BASE" != "develop" ]; then
-    gh pr edit "$PR_NUMBER" --base develop >/dev/null 2>&1 || true
+  if [ "$EXISTING_BASE" != "$BASE_BRANCH" ]; then
+    gh pr edit "$PR_NUMBER" --base "$BASE_BRANCH" >/dev/null 2>&1 || true
   fi
 else
   PR_URL=$(gh pr create \
-    --base develop \
+    --base "$BASE_BRANCH" \
     --head "$CURRENT_BRANCH" \
     --title "${MSG_PREFIX}: ${TOPIC}" \
-    --body "${PR_BODY} ${TOPIC}" \
+    --body "$PR_BODY" \
     2>/dev/null || echo "")
   PR_NUMBER=$(echo "$PR_URL" | grep -oE '[0-9]+$' || echo "")
 fi
@@ -167,7 +197,7 @@ fi
 # pending; on a repo with no branch protection it always errors. Fall back to
 # an immediate merge so non-coding PRs never sit open.
 OUTCOME="open"
-NON_CODE_BLOCKER=$(noncode_blockers origin/develop .)
+NON_CODE_BLOCKER=$(noncode_blockers "$BASE_REF" .)
 if [ -z "$NON_CODE_BLOCKER" ]; then
   if [ "$PUBLISH" = "gate" ]; then
     OUTCOME="staged"

package/runtime/pi/bin/index-handoff.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 # Index a single handoff file into the Neo4j graph.
@@ -119,11 +119,12 @@ AUTHOR="$(md_field 'Author')"
 AUTHOR_HANDLE="$(echo "$AUTHOR" | sed 's/[[:space:]]*→.*//' | awk '{print tolower($1)}')"
 [ -z "$AUTHOR_HANDLE" ] && AUTHOR_HANDLE="unknown"
 
-# Recipients: try markdown header (To or For), then YAML (to or for)
+# Recipients: try markdown header, then canonical/legacy YAML names.
 RECIPIENTS_RAW="$(md_field 'To')"
 [ -z "$RECIPIENTS_RAW" ] && RECIPIENTS_RAW="$(md_field 'For')"
 [ -z "$RECIPIENTS_RAW" ] && RECIPIENTS_RAW="$(yaml_extract 'to')"
 [ -z "$RECIPIENTS_RAW" ] && RECIPIENTS_RAW="$(yaml_extract 'for')"
+[ -z "$RECIPIENTS_RAW" ] && RECIPIENTS_RAW="$(yaml_extract 'addressed_to')"
 # Also extract from "From: author → recipient" pattern
 if [ -z "$RECIPIENTS_RAW" ] && echo "$AUTHOR" | grep -q '→' 2>/dev/null; then
   RECIPIENTS_RAW="$(echo "$AUTHOR" | sed 's/.*→[[:space:]]*//')"

package/runtime/pi/bin/ingest-graph.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 # Validate, plan, or apply a durable ingestion manifest to the organization graph.

package/runtime/pi/bin/ingest.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 set -euo pipefail
 
 # Org-scoped intake plane. Shared manifests live in memory/; normalized bodies

package/runtime/pi/bin/lib/artifact-id.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 # artifact-id.sh — Deterministic artifact IDs for memory files.
 #
 # Emits `{prefix}-{12 hex}` where prefix is derived from the file extension