create-egregore 0.19.23 → 0.19.24

package/runtime/codex/bin/lib/dashboard-artifact.sh

@@ -124,19 +124,119 @@ mkdir -p /tmp
 # publish-artifact.sh handles HTML generation internally (npx egregore-artifacts)
 # then uploads. Don't pre-generate HTML — that causes double-wrapping.
 # https:// URLs are universally cmd+clickable across all terminal emulators.
-# publish-artifact.sh may output npx progress lines before the URL — extract just the URL
-_DB_PUBLISH_OUT=$(bash "$SCRIPT_DIR/bin/publish-artifact.sh" document "$_DB_MD" \
-  --title "Session Dashboard" \
-  --author "${GREETING_NAME:-$AUTHOR}" 2>/dev/null || true)
-DASHBOARD_URL=$(echo "$_DB_PUBLISH_OUT" | grep -o 'https://[^ ]*' | tail -1)
-
-# Fallback: generate HTML locally and use file:// URL (offline, no API key, etc.)
-if [ -z "$DASHBOARD_URL" ]; then
-  _DB_HTML="/tmp/egregore-artifacts/dashboard-${EGREGORE_SESSION_ID}.html"
-  mkdir -p /tmp/egregore-artifacts
-  if npx egregore-artifacts@latest document "$_DB_MD" --output "$_DB_HTML" --no-open >/dev/null 2>&1 && [ -f "$_DB_HTML" ]; then
-    DASHBOARD_URL="file://${_DB_HTML}"
+#
+# Connected mode publishes to a STABLE per-user artifact id and runs the
+# render+upload detached: the URL is known up front, so the greeting prints it
+# without paying the ~2s render/upload on the boot path. Content lands moments
+# later; until then (and through the ~5min edge cache) the URL serves the
+# previous session's dashboard, which is an acceptable trade for a greeting
+# link. This also stops every boot from minting a new artifact URL.
+#
+# The id is RANDOM, generated once and persisted in the user's state file —
+# never derived from the username. Dashboard reads are public and unauth'd,
+# so a predictable id (org slug + github handle) would make every teammate's
+# operational dashboard enumerable; and a name-derived id without an org
+# component collides across orgs for multi-org users (artifact ids upsert
+# globally). Random-per-instance gives unguessable AND collision-free.
+_DB_SLUG=$(jq -r '.slug // empty' "$SCRIPT_DIR/egregore.json" 2>/dev/null)
+_DB_STATE="${STATE_FILE:-$SCRIPT_DIR/.egregore-state.json}"
+_DB_ID=$(jq -r '.dashboard_artifact_id // empty' "$_DB_STATE" 2>/dev/null)
+if [ -z "$_DB_ID" ] && [ -f "$_DB_STATE" ]; then
+  # First-id creation is SERIALIZED (mkdir is the portable atomic primitive):
+  # without a lock, two first boots can each persist-then-adopt different ids
+  # and both publish, stranding an orphan stable artifact. The winner creates
+  # exactly one id; the loser re-reads and either adopts it or (readback still
+  # empty) falls through to the legacy synchronous publish for this boot.
+  # A crashed creator's stale lock breaks after 5 minutes.
+  _DB_LOCK="$HOME/.egregore/dashboard-id-$(echo -n "${MAIN_PROJECT_DIR:-$SCRIPT_DIR}" | cksum | cut -d' ' -f1).lock"
+  mkdir -p "$HOME/.egregore" 2>/dev/null
+  if ! mkdir "$_DB_LOCK" 2>/dev/null; then
+    _DB_LOCK_AGE=$(( $(date +%s) - $(stat -f %m "$_DB_LOCK" 2>/dev/null || stat -c %Y "$_DB_LOCK" 2>/dev/null || echo 0) ))
+    # Stale reap by atomic rename, never rmdir+mkdir: two reapers doing
+    # remove-then-recreate can alternately delete each other's FRESH lock and
+    # both proceed. Directory rename is atomic — exactly one reaper's mv
+    # succeeds; the loser (and anyone losing the follow-up mkdir to a fresh
+    # contender) backs off to the read-only path.
+    if [ "$_DB_LOCK_AGE" -gt 300 ] && mv "$_DB_LOCK" "$_DB_LOCK.reap.$$" 2>/dev/null; then
+      rm -rf "$_DB_LOCK.reap.$$" 2>/dev/null
+      mkdir "$_DB_LOCK" 2>/dev/null || _DB_LOCK=""
+    else
+      _DB_LOCK=""
+    fi
+  fi
+  if [ -n "$_DB_LOCK" ]; then
+    # Re-read under the lock — the racing boot may have created the id already.
+    _DB_ID=$(jq -r '.dashboard_artifact_id // empty' "$_DB_STATE" 2>/dev/null)
+    if [ -z "$_DB_ID" ]; then
+      _DB_RAND=$(LC_ALL=C tr -dc 'a-z0-9' < /dev/urandom 2>/dev/null | head -c 16)
+      [ -n "$_DB_RAND" ] || _DB_RAND=$(openssl rand -hex 8 2>/dev/null)
+      if [ -n "$_DB_RAND" ]; then
+        jq --arg id "dashboard-${_DB_RAND}" \
+          '.dashboard_artifact_id = (.dashboard_artifact_id // $id)' "$_DB_STATE" > "$_DB_STATE.tmp.$$" 2>/dev/null \
+          && mv "$_DB_STATE.tmp.$$" "$_DB_STATE" 2>/dev/null || rm -f "$_DB_STATE.tmp.$$" 2>/dev/null
+        _DB_ID=$(jq -r '.dashboard_artifact_id // empty' "$_DB_STATE" 2>/dev/null)
+      fi
+    fi
+    rmdir "$_DB_LOCK" 2>/dev/null || true
+  else
+    # Lost the race — adopt whatever the winner persisted, if it landed yet.
+    _DB_ID=$(jq -r '.dashboard_artifact_id // empty' "$_DB_STATE" 2>/dev/null)
   fi
 fi
+if [ "${LOCAL_MODE:-false}" != "true" ] && [ -n "$_DB_SLUG" ] && [ -n "$_DB_ID" ]; then
+  # Confirmation is BOUND TO THE ID: dashboard_published_id must equal the id
+  # we are about to advertise. A bare boolean could be set by a publish of a
+  # different id (racing first boots) or by publish-artifact's ephemeral-relay
+  # fallback returning some other https URL when the API key is missing —
+  # later boots would then advertise a stable URL nothing was published to.
+  _DB_EXPECTED_URL="https://egregore.xyz/view/${_DB_SLUG}/${_DB_ID}"
+  _DB_CONFIRMED_ID=$(jq -r '.dashboard_published_id // empty' "$_DB_STATE" 2>/dev/null)
+  if [ "$_DB_CONFIRMED_ID" = "$_DB_ID" ]; then
+    # An artifact is confirmed at this exact id — safe to print the URL
+    # immediately and refresh its content detached, off the boot path.
+    DASHBOARD_URL="$_DB_EXPECTED_URL"
+    ( (
+      bash "$SCRIPT_DIR/bin/publish-artifact.sh" document "$_DB_MD" \
+        --id "$_DB_ID" \
+        --title "Session Dashboard" \
+        --author "${GREETING_NAME:-$AUTHOR}" >/dev/null 2>&1 || true
+      rm -f "$_DB_MD"
+    ) >/dev/null 2>&1 & ) 2>/dev/null
+  else
+    # First publish for this id: synchronous, so the greeting never advertises
+    # a URL with nothing behind it (publishing disabled, missing key, renderer
+    # failure, API outage). Confirm only when the returned URL is actually the
+    # stable URL for THIS id — host-agnostic suffix match, so a relay/ephemeral
+    # URL is shown for this boot but never confirms the stable id.
+    _DB_PUBLISH_OUT=$(bash "$SCRIPT_DIR/bin/publish-artifact.sh" document "$_DB_MD" \
+      --id "$_DB_ID" \
+      --title "Session Dashboard" \
+      --author "${GREETING_NAME:-$AUTHOR}" 2>/dev/null || true)
+    DASHBOARD_URL=$(echo "$_DB_PUBLISH_OUT" | grep -o 'https://[^ ]*' | tail -1)
+    case "$DASHBOARD_URL" in
+      */"${_DB_SLUG}/${_DB_ID}")
+        jq --arg id "$_DB_ID" '.dashboard_published_id = $id | del(.dashboard_published)' "$_DB_STATE" > "$_DB_STATE.tmp.$$" 2>/dev/null \
+          && mv "$_DB_STATE.tmp.$$" "$_DB_STATE" 2>/dev/null || rm -f "$_DB_STATE.tmp.$$" 2>/dev/null
+        ;;
+    esac
+    rm -f "$_DB_MD"
+  fi
+else
+  # Local/OSS mode: no stable hosted URL to print early — keep the synchronous
+  # publish (ephemeral relay URL) with the local file:// render as fallback.
+  _DB_PUBLISH_OUT=$(bash "$SCRIPT_DIR/bin/publish-artifact.sh" document "$_DB_MD" \
+    --title "Session Dashboard" \
+    --author "${GREETING_NAME:-$AUTHOR}" 2>/dev/null || true)
+  DASHBOARD_URL=$(echo "$_DB_PUBLISH_OUT" | grep -o 'https://[^ ]*' | tail -1)
+
+  # Fallback: generate HTML locally and use file:// URL (offline, no API key, etc.)
+  if [ -z "$DASHBOARD_URL" ]; then
+    _DB_HTML="/tmp/egregore-artifacts/dashboard-${EGREGORE_SESSION_ID}.html"
+    mkdir -p /tmp/egregore-artifacts
+    if npx egregore-artifacts@latest document "$_DB_MD" --output "$_DB_HTML" --no-open >/dev/null 2>&1 && [ -f "$_DB_HTML" ]; then
+      DASHBOARD_URL="file://${_DB_HTML}"
+    fi
+  fi
 
-rm -f "$_DB_MD"
+  rm -f "$_DB_MD"
+fi

package/runtime/codex/bin/lib/git-sync.sh

@@ -47,10 +47,26 @@ export GIT_HTTP_LOW_SPEED_TIME=10     # for 10 seconds
 # attendant and stays unconditional below.
 _REFS_FRESH="false"
 _ATT_SLUG=$(jq -r '.slug // "egregore"' "$SCRIPT_DIR/egregore.json" 2>/dev/null || echo "egregore")
-_ATT_MARKER="$HOME/.egregore/attendant/${_ATT_SLUG}-$(echo -n "$SCRIPT_DIR" | cksum | cut -d' ' -f1).warm-ts"
+# Key the marker by the MAIN checkout, not this directory: the attendant keys
+# its state by MAIN_DIR, so hashing a worktree path here meant worktree
+# sessions never matched the warm marker and always paid the full fetch round.
+# Worktrees share refs with the main checkout (common git dir), so the skip is
+# equally valid there. session-start.sh provides MAIN_PROJECT_DIR; standalone
+# callers fall back to SCRIPT_DIR (identical for non-worktree checkouts).
+_ATT_KEY="${_ATT_SLUG}-$(echo -n "${MAIN_PROJECT_DIR:-$SCRIPT_DIR}" | cksum | cut -d' ' -f1)"
+_ATT_MARKER="${ATTENDANT_HOME:-$HOME/.egregore/attendant}/${_ATT_KEY}.warm-ts"
 if [ -f "$_ATT_MARKER" ]; then
-  _ATT_AGE=$(( $(date +%s) - $(cat "$_ATT_MARKER" 2>/dev/null || echo 0) ))
-  [ "$_ATT_AGE" -lt 360 ] && _REFS_FRESH="true"
+  # Harden the read: an empty or garbled marker (e.g. caught mid-write) must
+  # degrade to "not fresh", never abort startup with an arithmetic error.
+  _ATT_TS=$(cat "$_ATT_MARKER" 2>/dev/null || echo 0)
+  case "$_ATT_TS" in ''|*[!0-9]*) _ATT_TS=0 ;; esac
+  _ATT_AGE=$(( $(date +%s) - _ATT_TS ))
+  # The attendant warms every ~5min and stamps the marker AFTER its fetches
+  # finish, so a healthy marker's age peaks just above 300s. A 360s threshold
+  # made the skip a coin flip — half of boots paid the full fetch round for
+  # nothing. 600s (2× the warm cycle) means refs are at most ~10min stale at
+  # launch, and the attendant converges them minutes later anyway.
+  [ "$_ATT_AGE" -ge 0 ] && [ "$_ATT_AGE" -lt 600 ] && _REFS_FRESH="true"
 fi
 
 [ "$_REFS_FRESH" != "true" ] && git fetch origin --quiet 2>/dev/null &
@@ -145,6 +161,16 @@ _apply_framework_update() {
   if ! git show-ref --verify --quiet refs/remotes/upstream/main 2>/dev/null; then
     return 0
   fi
+  # Re-sync the base branch right before committing onto it: the warm-marker
+  # fast path can leave origin/$BASE_BRANCH up to ~10min stale, and an update
+  # committed onto a stale base creates divergence that later ff-only syncs
+  # cannot resolve. Only this rare path (upstream set + auto_update on) pays
+  # the fetch. FAIL CLOSED: if the fetch or fast-forward doesn't succeed
+  # (offline, or the base already diverged), skip the update entirely rather
+  # than commit upstream files onto a stale base — the next healthy boot
+  # applies it.
+  git fetch origin "$BASE_BRANCH" --quiet 2>/dev/null || return 0
+  git merge --ff-only "origin/$BASE_BRANCH" --quiet 2>/dev/null || return 0
   # Apply upstream changes — checkout is idempotent, skip diff check
   # (git diff with variable path lists breaks in zsh — no word-splitting)
   for _p in bin/ .claude/commands/ .claude/skills/ .claude/hooks/ .claude/context/ .claude/agents/ loom/ CLAUDE.md skills/; do
@@ -202,9 +228,11 @@ setup_develop() {
   # Sync the base branch (without checkout — safe for concurrent sessions)
   CURRENT_BRANCH=$(git branch --show-current 2>/dev/null) || return 1
 
-  # Update the local ref from remote without switching branches
-  # Use fetch + force-update to handle divergence (e.g., from auto-update commits)
-  git fetch origin "$BASE_BRANCH" --quiet 2>/dev/null || true
+  # Update the local ref from remote without switching branches, using
+  # force-update to handle divergence (e.g., from auto-update commits).
+  # origin/$BASE_BRANCH is already current: either the parallel `git fetch
+  # origin` above ran this boot, or the attendant fetched within the freshness
+  # window. A second fetch here cost ~2s on every boot and never changed refs.
   if [[ "$CURRENT_BRANCH" != "$BASE_BRANCH" ]]; then
     # Safe to force-update when not checked out
     git branch -f "$BASE_BRANCH" "origin/$BASE_BRANCH" 2>/dev/null || true
@@ -295,8 +323,16 @@ if [ "$IS_WORKTREE" = "true" ]; then
   # branch whose commits already landed.
   WORKTREE_STALE="false"
   if [ "$BRANCH" != "?" ] && [ "$BRANCH" != "$BASE_BRANCH" ] && [ "$BRANCH" != "main" ]; then
-    # Check if remote branch still exists
-    if ! git ls-remote --heads origin "$BRANCH" 2>/dev/null | grep -q "$BRANCH"; then
+    # Check if remote branch still exists. When the attendant marker is fresh,
+    # local remote-tracking refs are authoritative (the attendant fetches with
+    # --prune every warm cycle) — answering locally saves a ~2s ls-remote
+    # round-trip on every worktree boot. Cold marker keeps the live query.
+    if [ "$_REFS_FRESH" = "true" ]; then
+      _BRANCH_ON_REMOTE() { git show-ref --verify --quiet "refs/remotes/origin/$BRANCH" 2>/dev/null; }
+    else
+      _BRANCH_ON_REMOTE() { git ls-remote --heads origin "$BRANCH" 2>/dev/null | grep -q "$BRANCH"; }
+    fi
+    if ! _BRANCH_ON_REMOTE; then
       # Remote branch gone — check if it was merged into the base branch
       if git branch -r --merged "origin/$BASE_BRANCH" 2>/dev/null | grep -q "origin/$BRANCH" 2>/dev/null || \
          git merge-base --is-ancestor HEAD "origin/$BASE_BRANCH" 2>/dev/null; then

package/runtime/codex/bin/lib/greeting.sh

@@ -219,7 +219,10 @@ else
 fi
 
 if [ -n "${LOOM_DOCTOR_BRIEF:-}" ]; then
-  printf "  %s\n" "$LOOM_DOCTOR_BRIEF"
+  # Indent every line — printf '  %s' indents only the first line of a
+  # multiline brief, which misaligns the card and hides follow-up warnings
+  # from the fast-path signal-line scraper (it keys on "^  ").
+  printf '%s\n' "$LOOM_DOCTOR_BRIEF" | sed 's/^/  /'
 fi
 
 # --- Creator review gate: pending turns on owned scrolls/surfaces ---
@@ -361,10 +364,18 @@ echo ""
 
 # --- Session context (hidden, for Claude) ---
 CONTEXT_HANDOFFS=$(cat "$CTX_DIR/handoffs" 2>/dev/null || echo "[]")
+CONTEXT_HANDOFFS=$(printf '%s' "$CONTEXT_HANDOFFS" | jq -c 'map(if .preview then .preview |= .[0:80] else . end)' 2>/dev/null || printf '%s' "$CONTEXT_HANDOFFS")
 CONTEXT_ADDRESSED=$(cat "$CTX_DIR/addressed" 2>/dev/null || echo "[]")
 CONTEXT_QUESTS=$(cat "$CTX_DIR/quests" 2>/dev/null || echo "[]")
+CONTEXT_QUESTS=$(printf '%s' "$CONTEXT_QUESTS" | jq -c 'if length > 20 then .[0:20] + ["+\(length - 20) more"] else . end' 2>/dev/null || printf '%s' "$CONTEXT_QUESTS")
 CONTEXT_ACTIVITY=$(cat "$CTX_DIR/activity" 2>/dev/null || echo "")
 CONTEXT_TEAM=$(cat "$CTX_DIR/team" 2>/dev/null || echo "[]")
+# Trim the team blob for greeting injection: 8 most-recent people, drop sort
+# keys, one branch each. This trimmed view is all the session ever sees —
+# CTX_DIR is deleted at the end of this script — a deliberate cap to keep
+# hook stdout inline-sized. Untrimmed this is the single largest field in
+# session-context.
+CONTEXT_TEAM=$(printf '%s' "$CONTEXT_TEAM" | jq -c '.[0:8] | map({name, last_seen, working_on: ((.working_on // "")[0:80]), branches: ((.branches // [])[0:1])})' 2>/dev/null || printf '%s' "$CONTEXT_TEAM")
 CONTEXT_SOUL=$(cat "$CTX_DIR/soul_summary" 2>/dev/null || echo "")
 CONTEXT_LIFECYCLE=$(cat "$CTX_DIR/lifecycle" 2>/dev/null || echo '{"merged_prs":[],"implemented_handoffs":[]}')
 CONTEXT_PULSE=$(cat "$CTX_DIR/pulse_brief" 2>/dev/null || echo '{}')
@@ -404,9 +415,10 @@ Memory: memory/ is a symlink to shared knowledge base. Use bin/graph.sh for Neo4
 SAEOF
 ) 2>/dev/null || true
 
-cat << CTXEOF
-
-<!-- session-context
+# Emit the context JSON compacted (jq -c) — nested blobs arrive pretty-printed
+# from CTX_DIR and the whitespace alone is ~1KB of hook stdout. Fall back to
+# the raw heredoc if jq can't parse (a malformed fragment must not eat context).
+_CTX_JSON=$(cat << CTXEOF
 {
   "framework_version": "$FRAMEWORK_VERSION",
   "time_of_day": "$TIME_OF_DAY",
@@ -421,8 +433,10 @@ cat << CTXEOF
   "momentum": $CONTEXT_METRICS,
   "pulse": $CONTEXT_PULSE
 }
--->
 CTXEOF
+)
+printf '\n<!-- session-context\n%s\n-->\n' \
+  "$(printf '%s' "$_CTX_JSON" | jq -c . 2>/dev/null || printf '%s' "$_CTX_JSON")"
 
 # Include soul file if present
 if [ -f "$SCRIPT_DIR/egregore.md" ]; then
@@ -432,13 +446,14 @@ if [ -f "$SCRIPT_DIR/egregore.md" ]; then
   echo "-->"
 fi
 
-# Include latest soul reflection if present
+# Point at the latest soul reflection instead of inlining it. The full
+# document is several KB; injected verbatim it pushed hook stdout past the
+# harness inline threshold, which turns the greeting into a file the model
+# must Read back — a whole extra API round-trip on every boot.
 if [ -d "$SCRIPT_DIR/memory/soul" ]; then
   LATEST_REFLECTION=$(ls -t "$SCRIPT_DIR/memory/soul/"*.md 2>/dev/null | head -1 || true)
   if [ -n "$LATEST_REFLECTION" ]; then
-    echo "<!-- latest-reflection"
-    cat "$LATEST_REFLECTION"
-    echo "-->"
+    echo "<!-- latest-reflection: memory/soul/$(basename "$LATEST_REFLECTION") — read when org identity, culture, or history context matters -->"
   fi
 fi
 
@@ -480,7 +495,11 @@ if [ "$FIRST_SESSION" = "true" ]; then
   echo ""
   echo "  Welcome! This is your first session."
   echo ""
-  echo "IMPORTANT: Display the above greeting exactly as-is (ASCII art + ornamented status). Then ask the user if they'd like a quick onboarding tour (run /onboarding), or if they want to jump straight in."
+  if [ "${EGREGORE_CARD_SHOWN:-}" = "1" ]; then
+    echo "IMPORTANT: The greeting card is already on screen (rendered by the launcher) — do NOT re-render it. Reply with the greeting-reply block contents, then ask the user if they'd like a quick onboarding tour (run /onboarding), or if they want to jump straight in."
+  else
+    echo "IMPORTANT: Display the above greeting exactly as-is (ASCII art + ornamented status). Then ask the user if they'd like a quick onboarding tour (run /onboarding), or if they want to jump straight in."
+  fi
   # Clear the flag so it only shows once
   jq '.first_session = false' "$STATE_FILE" > "$STATE_FILE.tmp" && mv "$STATE_FILE.tmp" "$STATE_FILE"
 else
@@ -495,7 +514,11 @@ else
   fi
 
   echo ""
-  echo "IMPORTANT: Display the above greeting to the user exactly as-is (preserve the ASCII art formatting and ornamented status) on their first message. Then ask: What are you working on?"
+  if [ "${EGREGORE_CARD_SHOWN:-}" = "1" ]; then
+    echo "IMPORTANT: The greeting card is already on screen (rendered by the launcher) — do NOT re-render it. Reply with the greeting-reply block contents exactly as-is (it may be empty), then ask: What are you working on?"
+  else
+    echo "IMPORTANT: Display the above greeting to the user exactly as-is (preserve the ASCII art formatting and ornamented status) on their first message. Then ask: What are you working on?"
+  fi
   echo ""
   echo "BRANCH RULE: When the user responds with what they're working on, your FIRST action is to create a working branch: git fetch origin develop --quiet && git checkout -b dev/{author}/{topic-slug} origin/develop. Do this BEFORE any other work. Derive the topic slug from their description. If they ask a pure question with no work intent, skip branching."
 fi

package/runtime/codex/bin/lib/identity.sh

@@ -153,21 +153,39 @@ fi
 # --- Validate gh CLI identity matches git identity ---
 # The gh CLI has its own auth (keyring) separate from .env GITHUB_TOKEN.
 # If they diverge, PRs get created under the wrong account.
-if command -v gh &>/dev/null; then
-  GH_CLI_USER=$(gh api user --jq '.login' 2>/dev/null || true)
-  if [ -n "$GH_CLI_USER" ] && [ -n "$AUTHOR" ] && [ "$AUTHOR" != "unknown" ]; then
-    AUTHOR_LC=$(echo "$AUTHOR" | tr '[:upper:]' '[:lower:]')
-    GH_CLI_LC=$(echo "$GH_CLI_USER" | tr '[:upper:]' '[:lower:]')
-    if [ "$AUTHOR_LC" != "$GH_CLI_LC" ]; then
-      echo ""
-      echo "WARNING: Identity mismatch detected."
-      echo "  Git identity (.env):  $AUTHOR"
-      echo "  gh CLI (active):      $GH_CLI_USER"
-      echo "  PRs will be created as '$GH_CLI_USER', not '$AUTHOR'."
-      echo "  Fix: gh auth switch --user $AUTHOR"
-      echo ""
-    fi
+# The `gh api user` round-trip (~1s) is off the boot path: each start reports
+# the marker the previous background check left, then refreshes it detached.
+# A mismatch therefore surfaces one session late — acceptable for a warning
+# about a rare, persistent condition.
+if command -v gh &>/dev/null && [ -n "$AUTHOR" ] && [ "$AUTHOR" != "unknown" ]; then
+  _GH_MISMATCH_FILE="$HOME/.egregore/gh-identity-mismatch-$(echo -n "${MAIN_PROJECT_DIR:-$SCRIPT_DIR}" | cksum | cut -d' ' -f1)"
+  # Marker format: line 1 = the AUTHOR the check ran as, line 2 = the gh login
+  # observed. Warn only when line 1 matches the current AUTHOR — the same
+  # machine/instance can serve different git identities, and Alice's stale
+  # marker must not tell Bob that Bob mismatches Bob.
+  _GH_MARKER_AUTHOR=$(sed -n '1p' "$_GH_MISMATCH_FILE" 2>/dev/null || true)
+  GH_CLI_USER=$(sed -n '2p' "$_GH_MISMATCH_FILE" 2>/dev/null || true)
+  if [ -n "$GH_CLI_USER" ] && [ "$_GH_MARKER_AUTHOR" = "$AUTHOR" ]; then
+    echo ""
+    echo "WARNING: Identity mismatch detected."
+    echo "  Git identity (.env):  $AUTHOR"
+    echo "  gh CLI (active):      $GH_CLI_USER"
+    echo "  PRs will be created as '$GH_CLI_USER', not '$AUTHOR'."
+    echo "  Fix: gh auth switch --user $AUTHOR"
+    echo ""
   fi
+  ( (
+    _GH_LIVE=$(gh api user --jq '.login' 2>/dev/null || true)
+    if [ -n "$_GH_LIVE" ]; then
+      if [ "$(echo "$_GH_LIVE" | tr '[:upper:]' '[:lower:]')" != "$(echo "$AUTHOR" | tr '[:upper:]' '[:lower:]')" ]; then
+        mkdir -p "$HOME/.egregore" 2>/dev/null
+        printf '%s\n%s\n' "$AUTHOR" "$_GH_LIVE" > "$_GH_MISMATCH_FILE.tmp" \
+          && mv "$_GH_MISMATCH_FILE.tmp" "$_GH_MISMATCH_FILE"
+      else
+        rm -f "$_GH_MISMATCH_FILE"
+      fi
+    fi
+  ) >/dev/null 2>&1 & ) 2>/dev/null
 fi
 
 # --- Export telemetry identity env vars ---

package/runtime/codex/bin/person.py

@@ -394,6 +394,15 @@ def reconcile_profile(args: argparse.Namespace) -> dict[str, Any]:
     if not github or not re.fullmatch(r"[A-Za-z0-9-]{1,39}", github):
         raise ValueError("a valid GitHub login is required")
     github_id = int(args.github_id) if args.github_id not in (None, "") else None
+    if github_id is None:
+        # Self-heal: adopt the numeric id the canonical profile already
+        # carries so a caller without --github-id cannot degrade a
+        # github:<id> profile back to github-login form.
+        profile_github_id = str(
+            parse_profile(PEOPLE_DIR / f"{github}.md")["fields"].get("GitHub-ID") or ""
+        ).strip()
+        if profile_github_id.isdigit():
+            github_id = int(profile_github_id)
     person_id = (
         f"github:{github_id}"
         if github_id is not None
@@ -446,6 +455,17 @@ def reconcile(args: argparse.Namespace) -> dict[str, Any]:
         raise ValueError("github_username is required")
     github_id = args.github_id or state.get("github_id")
     github_id = int(github_id) if github_id not in (None, "") else None
+    if github_id is None:
+        # Self-heal pre-migration state: a state file written before the
+        # numeric-id migration carries github_id null and a github-login
+        # person_id, which degraded github:<id> profiles back to login
+        # form on every boot. Adopt the numeric id from the canonical
+        # profile; state.update() below persists it durably.
+        profile_github_id = str(
+            parse_profile(PEOPLE_DIR / f"{github}.md")["fields"].get("GitHub-ID") or ""
+        ).strip()
+        if profile_github_id.isdigit():
+            github_id = int(profile_github_id)
     person_id = (
         f"github:{github_id}" if github_id is not None
         else str(state.get("person_id") or f"github-login:{github.lower()}")

package/runtime/codex/manifest.json

@@ -1,67 +1,33 @@
 {
   "source": "egregore-runtime",
-  "policy": "public-safe subset derived from .syncignore; built by scripts/build-runtime-bundle.mjs",
-  "skillCount": 65,
+  "policy": "available OSS skills selected by capability-distribution.json; Connect is an authenticated additive overlay",
+  "skillCount": 31,
   "skills": [
     "activity",
-    "add",
     "announce",
-    "answer",
     "archive",
-    "ask",
-    "audit",
-    "autosave",
-    "branch",
     "checkup",
-    "commit",
     "contribute",
     "dark-mode",
     "dashboard",
     "deep-reflect",
     "delete-user",
-    "demo-mode",
-    "deploy-bridge",
-    "design",
-    "egregore-voice",
-    "emissary",
-    "env",
     "handoff",
     "harvest",
     "ingest",
-    "ingest-google",
     "ingest-user-interview",
     "invite",
     "issue",
     "me",
     "meeting",
-    "minion",
-    "mock",
     "note",
     "onboarding",
-    "pr",
-    "product-voice",
-    "project",
-    "pull",
-    "push",
     "quest",
-    "quest-suggest",
     "reflect",
-    "review-pr",
     "save",
-    "scroll",
-    "search",
-    "session-view",
-    "setup",
-    "summon",
     "sync-repos",
-    "task",
-    "teams-connect",
-    "telegram-connect",
     "telemetry",
     "test",
-    "the-spiral",
-    "thread",
-    "todo",
     "tui-design",
     "tutorial",
     "update",
@@ -69,6 +35,7 @@
     "visual-explain",
     "wrap"
   ],
+  "availability": "oss",
   "files": [
     ".agents/skills",
     ".claude/context/notification-consent.md",
@@ -77,67 +44,31 @@
     ".codex/hooks/branch-guard.js",
     ".codex/hooks/search-hint.js",
     ".codex/skills/activity/SKILL.md",
-    ".codex/skills/add/SKILL.md",
     ".codex/skills/announce/SKILL.md",
-    ".codex/skills/answer/SKILL.md",
     ".codex/skills/archive/SKILL.md",
-    ".codex/skills/ask/SKILL.md",
-    ".codex/skills/audit/SKILL.md",
-    ".codex/skills/autosave/SKILL.md",
-    ".codex/skills/branch/SKILL.md",
     ".codex/skills/checkup/SKILL.md",
-    ".codex/skills/commit/SKILL.md",
     ".codex/skills/contribute/SKILL.md",
     ".codex/skills/dark-mode/SKILL.md",
     ".codex/skills/dashboard/SKILL.md",
     ".codex/skills/deep-reflect/SKILL.md",
     ".codex/skills/delete-user/SKILL.md",
-    ".codex/skills/demo-mode/SKILL.md",
-    ".codex/skills/deploy-bridge/SKILL.md",
-    ".codex/skills/design/SKILL.md",
-    ".codex/skills/egregore-voice/SKILL.md",
-    ".codex/skills/emissary/SKILL.md",
-    ".codex/skills/env/SKILL.md",
     ".codex/skills/handoff/SKILL.md",
     ".codex/skills/harvest/QUESTION_PALETTE.md",
     ".codex/skills/harvest/SKILL.md",
-    ".codex/skills/ingest-google/SKILL.md",
     ".codex/skills/ingest-user-interview/SKILL.md",
     ".codex/skills/ingest/SKILL.md",
     ".codex/skills/invite/SKILL.md",
     ".codex/skills/issue/SKILL.md",
     ".codex/skills/me/SKILL.md",
     ".codex/skills/meeting/SKILL.md",
-    ".codex/skills/minion/SKILL.md",
-    ".codex/skills/mock/SKILL.md",
     ".codex/skills/note/SKILL.md",
     ".codex/skills/onboarding/SKILL.md",
-    ".codex/skills/pr/SKILL.md",
-    ".codex/skills/product-voice/SKILL.md",
-    ".codex/skills/project/SKILL.md",
-    ".codex/skills/pull/SKILL.md",
-    ".codex/skills/push/SKILL.md",
-    ".codex/skills/quest-suggest/SKILL.md",
     ".codex/skills/quest/SKILL.md",
     ".codex/skills/reflect/SKILL.md",
-    ".codex/skills/review-pr/SKILL.md",
     ".codex/skills/save/SKILL.md",
-    ".codex/skills/scroll/SKILL.md",
-    ".codex/skills/scroll/agents/openai.yaml",
-    ".codex/skills/scroll/assets/shell.html",
-    ".codex/skills/search/SKILL.md",
-    ".codex/skills/session-view/SKILL.md",
-    ".codex/skills/setup/SKILL.md",
-    ".codex/skills/summon/SKILL.md",
     ".codex/skills/sync-repos/SKILL.md",
-    ".codex/skills/task/SKILL.md",
-    ".codex/skills/teams-connect/SKILL.md",
-    ".codex/skills/telegram-connect/SKILL.md",
     ".codex/skills/telemetry/SKILL.md",
     ".codex/skills/test/SKILL.md",
-    ".codex/skills/the-spiral/SKILL.md",
-    ".codex/skills/thread/SKILL.md",
-    ".codex/skills/todo/SKILL.md",
     ".codex/skills/tui-design/SKILL.md",
     ".codex/skills/tutorial/SKILL.md",
     ".codex/skills/update/SKILL.md",