create-egregore 0.19.22 → 0.19.24

package/runtime/codex/bin/graph.sh

@@ -48,7 +48,27 @@ _millis() {
 # greeting) pay zero network round-trips when warm. TTL in seconds; unset/0
 # disables. Mutating queries are never cached.
 _CACHE_TTL="${EGREGORE_GRAPH_CACHE_TTL:-0}"
-_CACHE_DIR="$HOME/.egregore/graph-cache/$(echo -n "$SCRIPT_DIR" | cksum | cut -d' ' -f1)"
+# Key the cache by the MAIN checkout so worktree sessions hit the same warm
+# cache the attendant maintains (its replay uses the same derivation).
+# Worktrees have .git as a FILE pointing into the main repo's .git/worktrees/.
+# api_url + slug are part of the key so entries never cross tenants when the
+# same checkout is repointed at a different org/API (cache entries are keyed
+# only by query+params below, so the directory must carry the tenant).
+_CACHE_ROOT="$SCRIPT_DIR"
+if [ -f "$SCRIPT_DIR/.git" ]; then
+  _WT_GITDIR=$(sed 's/^gitdir: //' "$SCRIPT_DIR/.git" 2>/dev/null || true)
+  if [ -n "$_WT_GITDIR" ]; then
+    _CACHE_ROOT=$(cd "$_WT_GITDIR/../../.." 2>/dev/null && pwd || echo "$SCRIPT_DIR")
+  fi
+fi
+# The scope is a non-secret fingerprint of the EFFECTIVE endpoint + credential
+# (already resolved above: process env → .env → committed api_url). Committed
+# config alone is not enough — an EGREGORE_API_URL/KEY override or a swapped
+# .env can point this checkout at a different tenant than egregore.json names,
+# and the entry key below carries only query+params. cksum output is a CRC,
+# not a reversible or usable credential.
+_CACHE_SCOPE=$(echo -n "${API_URL:-}|${API_KEY:-}" | cksum | cut -d' ' -f1)
+_CACHE_DIR="$HOME/.egregore/graph-cache/$(echo -n "${_CACHE_ROOT}|${_CACHE_SCOPE}" | cksum | cut -d' ' -f1)"
 
 _cache_key() {
   echo -n "$1|${2:-}" | cksum | cut -d' ' -f1

package/runtime/codex/bin/handoff-run.sh

@@ -12,6 +12,8 @@ set -euo pipefail
 #     [--recipient <name>] \
 #     [--project <name>] \
 #     [--intent <action|feedback|fyi>] \
+#     [--content-mode <supplied|generated>] \
+#     [--include-session-artifacts] \
 #     <<'HANDOFFEOF'
 #   ...full markdown body of the handoff...
 #   HANDOFFEOF
@@ -19,7 +21,7 @@ set -euo pipefail
 # The full file body is read from stdin. The script:
 #   1. Computes the file path: memory/handoffs/YYYY-MM/DD-author-slug.md
 #   2. Writes the file
-#   3. Appends ## Repo State section (from bin/repo-state.sh) if non-empty
+#   3. In generated mode, appends ## Repo State when non-empty
 #   4. Prepends memory/handoffs/index.md with a new entry
 #   5. Runs bin/index-handoff.sh (connected mode only) — creates Session node
 #      and returns a subgraph snapshot in the result JSON
@@ -51,6 +53,8 @@ NO_PUSH=0
 NO_NOTIFY=0
 NO_PUBLISH=0
 COMPOSED=""    # optional house-kit JSON — the agent-composed render spec
+CONTENT_MODE="generated"
+INCLUDE_SESSION_ARTIFACTS=0
 
 while [ $# -gt 0 ]; do
   case "$1" in
@@ -60,6 +64,8 @@ while [ $# -gt 0 ]; do
     --project)    PROJECT="${2:-}";   shift 2 ;;
     --intent)     INTENT="${2:-}";    shift 2 ;;
     --composed)   COMPOSED="${2:-}";  shift 2 ;;
+    --content-mode) CONTENT_MODE="${2:-}"; shift 2 ;;
+    --include-session-artifacts) INCLUDE_SESSION_ARTIFACTS=1; shift ;;
     --no-push)    NO_PUSH=1;          shift ;;
     --no-notify)  NO_NOTIFY=1;        shift ;;
     --no-publish) NO_PUBLISH=1;       shift ;;
@@ -72,7 +78,7 @@ done
 # markdown file is ALWAYS the memory record + graph index either way.
 RENDER_TYPE="handoff"
 RENDER_SRC=""   # resolved to $ABS_FILE after the file is written, unless composed
-if [ -n "$COMPOSED" ] && [ -f "$COMPOSED" ]; then
+if [ "$CONTENT_MODE" = "generated" ] && [ -n "$COMPOSED" ] && [ -f "$COMPOSED" ]; then
   RENDER_TYPE="composed"
   RENDER_SRC="$COMPOSED"
 fi
@@ -83,6 +89,14 @@ case "$INTENT" in
   action|feedback|fyi) ;;
   *) echo "Invalid --intent: $INTENT (action|feedback|fyi)" >&2; exit 1 ;;
 esac
+case "$CONTENT_MODE" in
+  supplied|generated) ;;
+  *) echo "Invalid --content-mode: $CONTENT_MODE (supplied|generated)" >&2; exit 1 ;;
+esac
+if [ "$CONTENT_MODE" = "supplied" ] && [ -n "$COMPOSED" ]; then
+  echo "--composed cannot be used with --content-mode supplied" >&2
+  exit 1
+fi
 
 MODE=$(jq -r '.mode // "connected"' "$CONFIG" 2>/dev/null || echo "connected")
 TODAY=$(date +%Y-%m-%d)
@@ -122,92 +136,73 @@ if [ ! -s "$ABS_FILE" ]; then
   exit 1
 fi
 
-# --- Canonical capture contract -----------------------------------------
-# /handoff is the addressed door into the shared capture engine. Persist the
-# same schema/mode fields used by /wrap and SessionEnd so filesystem and graph
-# retrieval can distinguish captures without inferring from directory names.
-if ! grep -qiE '^(capture_schema:|\*\*[Cc]apture [Ss]chema\*\*:)' "$ABS_FILE"; then
-  CAPTURE_KIND=""
-  if ! grep -qiE '^(kind:|\*\*[Kk]ind\*\*:)' "$ABS_FILE"; then
-    CAPTURE_KIND="addressed"
-  fi
-  if [ "$(head -1 "$ABS_FILE")" = "---" ]; then
-    awk -v kind="$CAPTURE_KIND" '
-      NR == 1 {
-        print
-        print "capture_schema: egregore-capture/v1"
-        print "capture_mode: addressed"
-        if (kind != "") print "kind: " kind
-        next
-      }
-      { print }
-    ' "$ABS_FILE" > "$ABS_FILE.new" && mv "$ABS_FILE.new" "$ABS_FILE"
-  else
-    awk -v kind="$CAPTURE_KIND" '
-      !injected && /^\*\*[Aa]uthor\*\*:/ {
-        print
-        print "**Capture Schema**: egregore-capture/v1"
-        print "**Capture Mode**: addressed"
-        if (kind != "") print "**Kind**: " kind
-        injected=1
-        next
-      }
-      { print }
-      END {
-        if (!injected) {
-          print "**Capture Schema**: egregore-capture/v1"
-          print "**Capture Mode**: addressed"
-          if (kind != "") print "**Kind**: " kind
-        }
-      }
-    ' "$ABS_FILE" > "$ABS_FILE.new" && mv "$ABS_FILE.new" "$ABS_FILE"
-  fi
-fi
+# --- Canonical metadata boundary ----------------------------------------
+# Callers are allowed to send prose-only markdown, but persisted handoffs are
+# not. Normalize every input to the same frontmatter contract before indexing
+# or rendering so title/author/recipient cannot disappear at the adapter seam.
+HAS_FRONTMATTER=0
+[ "$(head -1 "$ABS_FILE")" = "---" ] && HAS_FRONTMATTER=1
 
-# --- Inject **To**: line if --recipient given and body omits it -----
-# index-handoff.sh parses recipients from the file body. Skills
-# normally write the To line themselves, but callers that invoke
-# handoff-run.sh directly often skip it. Inject after the Author
-# line so the graph gets the HANDED_TO edge.
-if [ -n "$RECIPIENT" ] && ! grep -qi "^\*\*[Tt]o\*\*:" "$ABS_FILE"; then
-  awk -v r="$RECIPIENT" '
-    !injected && /^\*\*[Aa]uthor\*\*:/ {
-      print
-      print "**To**: " r
-      injected=1
-      next
-    }
-    { print }
-  ' "$ABS_FILE" > "$ABS_FILE.new" && mv "$ABS_FILE.new" "$ABS_FILE"
-fi
+_has_frontmatter_key() {
+  [ "$HAS_FRONTMATTER" = "1" ] && sed -n '2,/^---$/p' "$ABS_FILE" | grep -qiE "^${1}:"
+}
 
-# --- Persist lifecycle intent in the canonical handoff file -------------
-if ! grep -qiE '^(intent:|\*\*[Ii]ntent\*\*:)' "$ABS_FILE"; then
-  if [ "$(head -1 "$ABS_FILE")" = "---" ]; then
-    awk -v intent="$INTENT" '
-      NR == 1 { print; print "intent: " intent; next }
-      { print }
-    ' "$ABS_FILE" > "$ABS_FILE.new" && mv "$ABS_FILE.new" "$ABS_FILE"
-  else
-    awk -v intent="$INTENT" '
-      !injected && /^\*\*[Aa]uthor\*\*:/ {
-        print
-        print "**Intent**: " intent
-        injected=1
-        next
-      }
-      { print }
-      END {
-        if (!injected) print "**Intent**: " intent
-      }
-    ' "$ABS_FILE" > "$ABS_FILE.new" && mv "$ABS_FILE.new" "$ABS_FILE"
-  fi
+MISSING_SCHEMA=0;    _has_frontmatter_key capture_schema || MISSING_SCHEMA=1
+MISSING_MODE=0;      _has_frontmatter_key capture_mode || MISSING_MODE=1
+MISSING_KIND=0;      _has_frontmatter_key kind || MISSING_KIND=1
+MISSING_FROM=0;      _has_frontmatter_key from || _has_frontmatter_key author || MISSING_FROM=1
+MISSING_DATE=0;      _has_frontmatter_key date || MISSING_DATE=1
+MISSING_TOPIC=0;     _has_frontmatter_key topic || MISSING_TOPIC=1
+MISSING_INTENT=0;    _has_frontmatter_key intent || MISSING_INTENT=1
+MISSING_CONTENT_MODE=0; _has_frontmatter_key content_mode || MISSING_CONTENT_MODE=1
+MISSING_RECIPIENT=0
+if [ -n "$RECIPIENT" ]; then
+  _has_frontmatter_key addressed_to || _has_frontmatter_key to || MISSING_RECIPIENT=1
 fi
 
+awk \
+  -v has_frontmatter="$HAS_FRONTMATTER" \
+  -v schema="$MISSING_SCHEMA" -v mode="$MISSING_MODE" -v kind="$MISSING_KIND" \
+  -v from="$MISSING_FROM" -v date_missing="$MISSING_DATE" \
+  -v topic_missing="$MISSING_TOPIC" -v intent_missing="$MISSING_INTENT" \
+  -v content_mode_missing="$MISSING_CONTENT_MODE" \
+  -v recipient_missing="$MISSING_RECIPIENT" \
+  -v author="$AUTHOR" -v date="$TODAY" -v topic="$TOPIC" \
+  -v intent="$INTENT" -v recipient="$RECIPIENT" -v content_mode="$CONTENT_MODE" '
+  function metadata() {
+    if (schema) print "capture_schema: egregore-capture/v1"
+    if (mode) print "capture_mode: addressed"
+    if (kind) print "kind: addressed"
+    if (from) print "from: " author
+    if (recipient_missing) print "addressed_to: " recipient
+    if (date_missing) print "date: " date
+    if (topic_missing) print "topic: " topic
+    if (intent_missing) print "intent: " intent
+    if (content_mode_missing) print "content_mode: " content_mode
+  }
+  BEGIN {
+    if (!has_frontmatter) {
+      print "---"
+      metadata()
+      print "---"
+      if (content_mode != "supplied") print ""
+    }
+  }
+  has_frontmatter && NR == 1 {
+    print
+    metadata()
+    next
+  }
+  { print }
+' "$ABS_FILE" > "$ABS_FILE.new" && mv "$ABS_FILE.new" "$ABS_FILE"
+
 # --- Append repo state ---------------------------------------------------
 # --no-pr skips `gh pr list` (~400–600ms per repo). A detached PR backfill
 # after the parallel phase rewrites `—` → `#N` and re-pushes memory.
-REPO_STATE=$(bash "$SCRIPT_DIR/bin/repo-state.sh" --no-pr 2>/dev/null || true)
+REPO_STATE=""
+if [ "$CONTENT_MODE" = "generated" ] || [ "$INCLUDE_SESSION_ARTIFACTS" = "1" ]; then
+  REPO_STATE=$(bash "$SCRIPT_DIR/bin/repo-state.sh" --no-pr 2>/dev/null || true)
+fi
 if [ -n "$REPO_STATE" ]; then
   printf '\n%s\n' "$REPO_STATE" >> "$ABS_FILE"
 fi
@@ -401,12 +396,16 @@ PID_MEMORY=$!
       RENDERED_HTML="$TMPD/handoff.html"
       RENDER_OK=0
       LOCAL_CLI="$SCRIPT_DIR/packages/egregore-artifacts/bin/cli.js"
+      FIDELITY_ARGS=(--verify-fidelity)
+      if [ "$RENDER_TYPE" = "composed" ]; then
+        FIDELITY_ARGS+=(--source "$ABS_FILE")
+      fi
       if [ "${EGREGORE_USE_PUBLISHED:-0}" != "1" ] && [ -f "$LOCAL_CLI" ] && [ -d "$SCRIPT_DIR/packages/egregore-artifacts/node_modules/react" ]; then
-        if node "$LOCAL_CLI" "$RENDER_TYPE" "${RENDER_SRC:-$ABS_FILE}" --output "$RENDERED_HTML" >/dev/null 2>&1; then
+        if node "$LOCAL_CLI" "$RENDER_TYPE" "${RENDER_SRC:-$ABS_FILE}" "${FIDELITY_ARGS[@]}" --output "$RENDERED_HTML" >/dev/null 2>"$TMPD/render-error"; then
           RENDER_OK=1
         fi
       else
-        if npx egregore-artifacts "$RENDER_TYPE" "${RENDER_SRC:-$ABS_FILE}" --output "$RENDERED_HTML" >/dev/null 2>&1; then
+        if npx -y egregore-artifacts@latest "$RENDER_TYPE" "${RENDER_SRC:-$ABS_FILE}" "${FIDELITY_ARGS[@]}" --output "$RENDERED_HTML" >/dev/null 2>"$TMPD/render-error"; then
           RENDER_OK=1
         fi
       fi
@@ -481,9 +480,11 @@ PID_MEMORY=$!
   PUBLISH_RC=0
   if [ -z "$V1URL" ] && [ "$NO_PUBLISH" = "0" ] && [ -x "$SCRIPT_DIR/bin/publish-artifact.sh" ]; then
     AURL=$(bash "$SCRIPT_DIR/bin/publish-artifact.sh" "$RENDER_TYPE" "${RENDER_SRC:-$ABS_FILE}" \
+      --verify-fidelity \
+      --source "$ABS_FILE" \
       --title "$TOPIC" \
       --author "$AUTHOR" \
-      --description "$BRIEFING_LEAD" 2>/dev/null) || PUBLISH_RC=$?
+      --description "$BRIEFING_LEAD" 2>"$TMPD/publish-error") || PUBLISH_RC=$?
   fi
 
   PS="published"
@@ -495,6 +496,8 @@ PID_MEMORY=$!
     PS="relay-off"
   elif [ "$PUBLISH_RC" = "3" ]; then
     PS="hosting-off"
+  elif grep -q 'Handoff fidelity check failed' "$TMPD/render-error" "$TMPD/publish-error" 2>/dev/null; then
+    PS="fidelity-failed"
   else
     PS="failed"
   fi
@@ -614,6 +617,7 @@ STATUS_BITS=("saved")
 [ "$NOTIFY_STATUS" = "approval_required" ] && STATUS_BITS+=("notify approval pending")
 [ -n "$ARTIFACT_URL" ]         && STATUS_BITS+=("published")
 [ "$PUBLISH_STATUS" = "relay-off" ] && STATUS_BITS+=("not published")
+[ "$PUBLISH_STATUS" = "fidelity-failed" ] && STATUS_BITS+=("artifact fidelity failed")
 
 STATUS_LINE=""
 for bit in "${STATUS_BITS[@]}"; do

package/runtime/codex/bin/index-handoff.sh

@@ -119,11 +119,12 @@ AUTHOR="$(md_field 'Author')"
 AUTHOR_HANDLE="$(echo "$AUTHOR" | sed 's/[[:space:]]*→.*//' | awk '{print tolower($1)}')"
 [ -z "$AUTHOR_HANDLE" ] && AUTHOR_HANDLE="unknown"
 
-# Recipients: try markdown header (To or For), then YAML (to or for)
+# Recipients: try markdown header, then canonical/legacy YAML names.
 RECIPIENTS_RAW="$(md_field 'To')"
 [ -z "$RECIPIENTS_RAW" ] && RECIPIENTS_RAW="$(md_field 'For')"
 [ -z "$RECIPIENTS_RAW" ] && RECIPIENTS_RAW="$(yaml_extract 'to')"
 [ -z "$RECIPIENTS_RAW" ] && RECIPIENTS_RAW="$(yaml_extract 'for')"
+[ -z "$RECIPIENTS_RAW" ] && RECIPIENTS_RAW="$(yaml_extract 'addressed_to')"
 # Also extract from "From: author → recipient" pattern
 if [ -z "$RECIPIENTS_RAW" ] && echo "$AUTHOR" | grep -q '→' 2>/dev/null; then
   RECIPIENTS_RAW="$(echo "$AUTHOR" | sed 's/.*→[[:space:]]*//')"