create-egregore 0.19.29 → 0.19.31

package/assets/egregore-launcher.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// egregore-launcher-version: 0.19.29
+// egregore-launcher-version: 0.19.31
 //
 // egregore — launch and browse Egregore instances from your terminal.
 // Installed by create-egregore. Reads ~/.egregore/instances.json.
@@ -33,7 +33,7 @@ const crypto = require("node:crypto");
 const { spawnSync, spawn } = require("node:child_process");
 const readline = require("node:readline");
 
-const VERSION = "0.19.29";
+const VERSION = "0.19.31";
 const REGISTRY = path.join(os.homedir(), ".egregore", "instances.json");
 const DEFAULT_FILE = path.join(os.homedir(), ".egregore", "default");
 const UPDATE_CACHE_FILE = path.join(os.homedir(), ".egregore", "update-check.json");
@@ -317,8 +317,12 @@ function writeDefault(slug) {
 }
 
 function resolveBySlug(registry, query) {
-  // Exact slug → exact name → case-insensitive substring (slug ∪ name)
-  let hit = registry.find((e) => e.slug === query);
+  // Exact path → exact slug → exact name → case-insensitive substring (slug ∪ name).
+  // Path first: slugs are repo dir names and can collide across orgs; the
+  // installer targets the instance it just created by absolute path.
+  let hit = registry.find((e) => e.path === query);
+  if (hit) return hit;
+  hit = registry.find((e) => e.slug === query);
   if (hit) return hit;
   hit = registry.find((e) => e.name === query);
   if (hit) return hit;
@@ -1407,9 +1411,11 @@ function backfillSummaryLines(summary) {
 }
 
 async function cmdConnect(args) {
+  const fresh = args.includes("--fresh");
+  const positional = args.filter((a) => !String(a).startsWith("--"));
   const registry = readRegistry();
   if (registry.length === 0) die("no egregores installed yet.\n  run: npx -y create-egregore@latest");
-  const inst = resolveInviteInstance(registry, args[0] || "");
+  const inst = resolveInviteInstance(registry, positional[0] || "");
   if (!inst) {
     die("multiple egregores installed; choose one:\n  egregore connect <slug>\n  run: egregore ls");
   }
@@ -1466,6 +1472,19 @@ async function cmdConnect(args) {
     !intentId ||
     !resumable
   ) {
+    // Local installs may have skipped platform registration (DO_NOT_TRACK
+    // gates it as telemetry). Connect requires it functionally, and choosing
+    // Connect is the consent — register on demand. Idempotent for members of
+    // already-registered orgs; a 409 (registered by someone else) falls
+    // through to the billing-actor check on intent creation.
+    const registration = await connectedApiRequest(githubToken, "POST", "/api/org/register", {
+      org_name: cfg.org_name || inst.slug,
+      github_org: cfg.github_org || "",
+      slug: cfg.slug || inst.slug,
+    });
+    if (registration.status !== 200 && registration.status !== 409) {
+      die(`could not register this Egregore with the platform: ${connectError(registration, `HTTP ${registration.status}`)}`);
+    }
     console.log(`  [1/5] ${DIM}Creating connection intent…${RESET}`);
     const checkout = await connectedApiRequest(
       githubToken,
@@ -1479,6 +1498,7 @@ async function cmdConnect(args) {
           mode: cfg.mode || "local",
           repo_name: cfg.repo_name || "",
           managed_repo_count: Array.isArray(cfg.repos) ? cfg.repos.length : 0,
+          fresh,
         },
       },
       { "X-Idempotency-Key": `cli:${inst.slug}:${crypto.randomUUID()}` },
@@ -1570,24 +1590,30 @@ async function cmdConnect(args) {
   });
   console.log(`  [4/5] ${GREEN}✓${RESET} Connected credential and graph node`);
 
-  const syncScript = path.join(inst.path, "bin", "sync-graph.sh");
-  if (!fs.existsSync(syncScript)) {
-    die("bin/sync-graph.sh is missing. Update the installed Egregore version, then run egregore connect again.");
-  }
-  console.log(`  [5/5] ${CYAN}◦${RESET} Projecting existing memory into the graph…`);
-  console.log(`        ${DIM}Scanning sessions, artifacts, quests, and ingest history${RESET}`);
-  const sync = spawnSync("bash", [syncScript], {
-    cwd: inst.path,
-    encoding: "utf-8",
-    stdio: "pipe",
-    timeout: 10 * 60 * 1000,
-  });
-  if (sync.status !== 0) {
-    const detail = (sync.stderr || sync.stdout || "graph replay failed").trim();
-    die(`Connected is configured, but graph replay did not finish.\n  ${detail}\n  Run egregore connect ${inst.slug} to retry; existing data is unchanged.`);
-  }
   let backfillSummary = { replayed: true };
-  try { backfillSummary = JSON.parse((sync.stdout || "").trim()); } catch {}
+  if (fresh) {
+    // Fresh install — no existing memory to project; skip the replay entirely.
+    console.log(`  [5/5] ${GREEN}✓${RESET} Fresh instance — nothing to project yet`);
+    backfillSummary = { fresh: true, replayed: false };
+  } else {
+    const syncScript = path.join(inst.path, "bin", "sync-graph.sh");
+    if (!fs.existsSync(syncScript)) {
+      die("bin/sync-graph.sh is missing. Update the installed Egregore version, then run egregore connect again.");
+    }
+    console.log(`  [5/5] ${CYAN}◦${RESET} Projecting existing memory into the graph…`);
+    console.log(`        ${DIM}Scanning sessions, artifacts, quests, and ingest history${RESET}`);
+    const sync = spawnSync("bash", [syncScript], {
+      cwd: inst.path,
+      encoding: "utf-8",
+      stdio: "pipe",
+      timeout: 10 * 60 * 1000,
+    });
+    if (sync.status !== 0) {
+      const detail = (sync.stderr || sync.stdout || "graph replay failed").trim();
+      die(`Connected is configured, but graph replay did not finish.\n  ${detail}\n  Run egregore connect ${inst.slug} to retry; existing data is unchanged.`);
+    }
+    try { backfillSummary = JSON.parse((sync.stdout || "").trim()); } catch {}
+  }
 
   let complete;
   for (let attempt = 0; attempt < 3; attempt += 1) {
@@ -1608,9 +1634,11 @@ async function cmdConnect(args) {
     connected_at: new Date().toISOString(),
     backfill_summary: backfillSummary,
   });
-  console.log(`  [5/5] ${GREEN}✓${RESET} Existing memory projected into the graph`);
-  for (const line of backfillSummaryLines(backfillSummary)) {
-    console.log(`        ${DIM}${line}${RESET}`);
+  if (!fresh) {
+    console.log(`  [5/5] ${GREEN}✓${RESET} Existing memory projected into the graph`);
+    for (const line of backfillSummaryLines(backfillSummary)) {
+      console.log(`        ${DIM}${line}${RESET}`);
+    }
   }
   const runtimeRefresh = spawnSync(
     "npx",

package/lib/local.js

@@ -5,7 +5,7 @@
 
 const fs = require("node:fs");
 const path = require("node:path");
-const { execFileSync } = require("node:child_process");
+const { execFileSync, spawnSync } = require("node:child_process");
 const {
   GH_INSTALL_URL,
   ghCliExists,
@@ -1612,9 +1612,43 @@ async function localFounderFlow(ui, ctx = {}) {
     ]);
   }
 
+  await offerConnectUpgrade(egregoreDir, ui, ctx);
   await launchOrInstruct(egregoreDir, alias, ui, ctx);
 }
 
+// ── End-of-setup Connect choice ────────────────────────────────────
+//
+// Same activation the launcher's `c` key runs — delegated to the launcher so
+// there is exactly one connect flow. `--fresh` skips graph backfill: a brand
+// new instance has no memory to project. Declining changes nothing; the
+// launcher offers connect anytime.
+
+const LAUNCHER_JS = path.join(__dirname, "..", "assets", "egregore-launcher.js");
+
+async function offerConnectUpgrade(egregoreDir, ui, ctx = {}) {
+  if (ctx.noAutolaunch || !ui.canInteract()) return;
+  console.log("");
+  const choice = await ui.choose("How should this Egregore run?", [
+    {
+      label: "Local",
+      description: "free · Markdown + Git · connect later anytime with egregore connect",
+      value: "local",
+    },
+    {
+      label: "Egregore Connect",
+      description: "€500/month · shared graph + live notifications · Stripe checkout in your browser",
+      value: "connect",
+    },
+  ]);
+  if (!choice || choice.value !== "connect") return;
+  const result = spawnSync(process.execPath, [LAUNCHER_JS, "connect", egregoreDir, "--fresh"], {
+    stdio: "inherit",
+  });
+  if (result.status !== 0) {
+    ui.warn("Connect didn't finish — your Egregore stays local. Run `egregore connect` to pick it back up.");
+  }
+}
+
 // ── Flow 2: Join (local mode) ──────────────────────────────────────
 
 // Accepts: "org", "org/repo", "https://github.com/org/repo(.git)",
@@ -1817,4 +1851,4 @@ async function localJoinFlow(orgArg, ui, ctx = {}) {
   }
 }
 
-module.exports = { localFounderFlow, localJoinFlow, parseJoinTarget, addCollaborator, getUser, repoExists, createRepo, waitForRepo, retryAsync, ghFallbackNote };
+module.exports = { localFounderFlow, localJoinFlow, parseJoinTarget, addCollaborator, getUser, repoExists, createRepo, waitForRepo, retryAsync, ghFallbackNote, offerConnectUpgrade };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-egregore",
-  "version": "0.19.29",
+  "version": "0.19.31",
   "description": "Set up Egregore for your team in one command — installs the egregore launcher and your choice of Claude Code, Codex, or Pi.",
   "license": "MIT",
   "bin": {
@@ -12,7 +12,7 @@
   "scripts": {
     "build:runtime": "node ../../bin/capability-distribution.mjs generate-skill-view --root ../.. && node scripts/build-runtime-bundle.mjs && node scripts/build-pi-runtime-bundle.mjs && node ../../api/scripts/build-connect-runtime-pack.mjs",
     "build:pi-runtime": "node scripts/build-pi-runtime-bundle.mjs",
-    "test": "node ../../bin/capability-distribution.mjs validate --root ../.. && node scripts/build-runtime-bundle.mjs --check && node scripts/build-pi-runtime-bundle.mjs --check && node ../../api/scripts/build-connect-runtime-pack.mjs --check && node --test test/capability-distribution.test.js test/connect-runtime.test.js test/context.test.js test/path-lookup.test.js test/nixos-portability.test.js test/parse-join-target.test.js test/skip-repos.test.js test/install-origin-guard.test.js test/onboarding-shortcircuit.test.js test/welcome-screen.test.js test/runtime-selection.test.js test/command-generation.test.js test/auth-gh.test.js test/gauntlet-fixes.test.js test/codex-runtime.test.js test/pi-runtime.test.js test/pi-product-workflows.test.js test/installer-runtime-source.test.js test/scroll-repro.test.js test/launcher-refocus-redraw.test.js test/multiselect-remote-search.test.js test/back-navigation.test.js test/manifest-form.test.js test/launcher-delete.test.js test/launcher-connect.test.js test/launcher-connected-status.test.js test/launcher-permissions.test.js test/launcher-update.test.js test/connected-config.test.js",
+    "test": "node ../../bin/capability-distribution.mjs validate --root ../.. && node scripts/build-runtime-bundle.mjs --check && node scripts/build-pi-runtime-bundle.mjs --check && node ../../api/scripts/build-connect-runtime-pack.mjs --check && node --test test/capability-distribution.test.js test/connect-runtime.test.js test/context.test.js test/path-lookup.test.js test/nixos-portability.test.js test/parse-join-target.test.js test/skip-repos.test.js test/install-origin-guard.test.js test/onboarding-shortcircuit.test.js test/welcome-screen.test.js test/runtime-selection.test.js test/command-generation.test.js test/auth-gh.test.js test/gauntlet-fixes.test.js test/codex-runtime.test.js test/pi-runtime.test.js test/pi-product-workflows.test.js test/installer-runtime-source.test.js test/scroll-repro.test.js test/launcher-refocus-redraw.test.js test/multiselect-remote-search.test.js test/back-navigation.test.js test/manifest-form.test.js test/launcher-delete.test.js test/launcher-connect.test.js test/installer-connect-choice.test.js test/launcher-connected-status.test.js test/launcher-permissions.test.js test/launcher-update.test.js test/connected-config.test.js",
     "test:e2e": "node --test test/e2e-local.test.js",
     "test:all": "node scripts/build-runtime-bundle.mjs --check && node scripts/build-pi-runtime-bundle.mjs --check && node --test test/"
   },

package/runtime/codex/.codex/skills/create-skill/SKILL.md

@@ -0,0 +1,29 @@
+---
+name: create-skill
+description: 'Create a skill your org owns — scaffolded in this Egregore, protected from framework updates, shared with teammates via /save.'
+---
+
+<!-- generated-by: bin/codex-sync-skills.sh -->
+
+# Egregore create-skill Adapter
+
+This is fallback coverage for a long-tail Egregore workflow that has not been
+ported to a hand-written Codex-native skill yet.
+
+Use the project shell and filesystem directly. Do not invoke Claude Code
+commands. Translate interactive choices to structured Codex question tooling
+when it is available; otherwise render compact numbered choices with an
+`Other:` option and wait for the user.
+
+1. Read `.claude/skills/create-skill/SKILL.md` for the workflow details.
+2. Run the referenced `bin/` scripts directly from Codex.
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
+   calls when `egregore.json` declares `"mode": "local"`.
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
+   handoffs.

package/runtime/codex/.codex/spec-manifest.json

@@ -29,7 +29,7 @@
     {
       "section": "On Launch — MANDATORY FIRST ACTION",
       "action": "replace",
-      "sourceHash": "3def4421213a",
+      "sourceHash": "233d160f9ca8",
       "note": "Claude SessionStart hook does not run on Codex; the egregore launcher renders the card via bin/codex-session-start.sh before the session. Greeting-replay instruction dropped (card is already on screen)."
     },
     {
@@ -41,7 +41,7 @@
     {
       "section": "Config Files",
       "action": "keep",
-      "sourceHash": "8d7f1bd0f2d9",
+      "sourceHash": "4ca75fe428ca",
       "note": "Kept verbatim — shell facts, runtime-neutral."
     },
     {
@@ -101,7 +101,7 @@
     {
       "section": "Command Awareness",
       "action": "keep",
-      "sourceHash": "d6fe47a75c00",
+      "sourceHash": "905ad739e18c",
       "note": "Prepended the Codex command surface (skill tokens, native vs adapter split, $save abstraction); disambiguation map kept with /x -> $x token rendering. Tokens with no Codex skill (e.g. /loop, a Claude Code harness feature) are left as-is."
     },
     {

package/runtime/codex/AGENTS.md

@@ -216,7 +216,7 @@ If the startup card output contains `onboarding_needed`, invoke the `$onboarding
 
 ## Config Files
 
-- **`egregore.json`** — committed. Non-secret org config: `org_name`, `github_org`, `memory_repo`, `slug`, `mode`. `api_url` is connected-mode only. Optional `boundary { posture, read[], locked }` sets the org's isolation posture (see Environment Isolation). **Never put secrets here.**
+- **`egregore.json`** — committed. Non-secret org config: `org_name`, `github_org`, `memory_repo`, `slug`, `mode`. `api_url` is connected-mode only. Optional `boundary { posture, read[], locked }` sets the org's isolation posture (see Environment Isolation). Optional `owned_skills[]` names org-authored skills in `.claude/skills/` that `$update` must never overwrite (created via `$create-skill`). **Never put secrets here.**
 - **`.env`** — gitignored. Personal secrets. Local mode: `GITHUB_TOKEN` only. Connected mode: `GITHUB_TOKEN` + `EGREGORE_API_KEY`. **Never use `source .env`** — use `grep '^KEY=' .env | cut -d'=' -f2-`.
 
 In connected mode, infrastructure credentials (Neo4j, Telegram) live on the API server only — `bin/graph.sh` and `bin/notify.sh` route through the API gateway.
@@ -395,9 +395,10 @@ Invoke commands from user intent — don't wait for the slash. Each command file
 **Knowledge** — `$search` `$deep-reflect` `$archive` `$note` `$add` `$meeting` `$ingest` `$scroll` `$mock` `$audit`
 **Identity** — `$me` (view profile or set display name)
 **Coordination** — `$ask` `$quest` `$issue` `$invite` `$delete-user` `$announce`
-**Connectors** — `$telegram-connect` (Telegram group setup) `$teams-connect` (Microsoft Teams channel setup)
+**Connectors** — `$notion-connect` (Notion workspace) `$telegram-connect` (Telegram group setup) `$teams-connect` (Microsoft Teams channel setup)
 **Git** — `$branch` `$commit` `$push` `$pr` `$save` `$review-pr` `$contribute`
 **Spirits** — `$summon` (persistent agent processes)
+**Skills** — `$create-skill` (org-owned skill: scaffold, protect from updates, share)
 **Infra** — `$setup` `$update` `$pull` `$env` `$infra` `$sync-repos` `$release` `$checkup`
 
 **Disambiguation:**
@@ -410,11 +411,12 @@ Invoke commands from user intent — don't wait for the slash. Each command file
 - Tasks: `$todo` (personal) · `$quest` (team exploration) · `$issue` (something broken)
 - Questions: `$ask [person]` (async) · just ask (agent answers from context)
 - Ingestion: `$ingest <file-or-folder>` (org-scoped corpus intake) · `$ingest meeting` · `$ingest user-interview` · `$ingest google` · ambiguous → ask which type
-- Connectors: `$telegram-connect` (Telegram group) · `$teams-connect` (MS Teams channel) · `$ingest` (bring content in)
+- Connectors: `$notion-connect` (Notion workspace) · `$telegram-connect` (Telegram group) · `$teams-connect` (MS Teams channel) · `$ingest` (bring content in) · `$ingest notion` (promote Notion docs)
 - Identity: `$me` — "who am I", "call me oz"
 - People: `$invite` (add) · `$delete-user` (remove)
 - PRs: `$pr` (create) · `$review-pr` (review)
 - Contributing: `$contribute` (upstream framework) · `$save` (org repo) · `$issue` (report bug)
+- Skills: `$create-skill` (new org-owned skill) · `$contribute` (change a framework skill for everyone)
 - Agents: `$summon` (design through questions) · `/loop` (quick recurring schedule)
 - Announcements: `$announce` (broadcast to group) · `$handoff` (structured to a person) · `bin/notify.sh send` (DM one person)
 

package/runtime/codex/bin/ingest_graph.py

@@ -15,7 +15,7 @@ ROOT = Path(__file__).resolve().parent.parent
 CORPUS_SCHEMA = "egregore-ingest-corpus/v1"
 KNOWLEDGE_SCHEMA = "egregore-knowledge-projection/v1"
 PLAN_SCHEMA = "egregore-ingest-graph-plan/v2"
-SOURCE_KINDS = {"meeting", "interview", "google", "corpus", "document"}
+SOURCE_KINDS = {"meeting", "interview", "google", "notion", "corpus", "document"}
 SOURCE_RELATIONS = {"INVOLVES", "CONDUCTED_BY"}
 ARTIFACT_RELATIONS = {"RELATES_TO", "SUPERSEDES"}
 ARTIFACT_LABELS = {
@@ -438,6 +438,8 @@ def source_shape(kind: str) -> tuple[str, str]:
         return "Interview:KnowledgeSource", "FROM_INTERVIEW"
     if kind == "google":
         return "Artifact:KnowledgeSource", "DERIVED_FROM"
+    if kind == "notion":
+        return "Artifact:KnowledgeSource", "DERIVED_FROM"
     if kind == "corpus":
         return "IngestSource:KnowledgeSource", "DERIVED_FROM"
     return "IngestDocument:Document:KnowledgeSource", "DERIVED_FROM"

package/runtime/codex/manifest.json

@@ -1,7 +1,7 @@
 {
   "source": "egregore-runtime",
   "policy": "available OSS components selected by capability-distribution.json; Connect is an authenticated additive overlay",
-  "skillCount": 41,
+  "skillCount": 42,
   "skills": [
     "activity",
     "announce",
@@ -10,6 +10,7 @@
     "checkup",
     "commit",
     "contribute",
+    "create-skill",
     "dark-mode",
     "dashboard",
     "deep-reflect",
@@ -60,6 +61,7 @@
     ".codex/skills/checkup/SKILL.md",
     ".codex/skills/commit/SKILL.md",
     ".codex/skills/contribute/SKILL.md",
+    ".codex/skills/create-skill/SKILL.md",
     ".codex/skills/dark-mode/SKILL.md",
     ".codex/skills/dashboard/SKILL.md",
     ".codex/skills/deep-reflect/SKILL.md",

package/runtime/pi/.codex/skills/create-skill/SKILL.md

@@ -0,0 +1,29 @@
+---
+name: create-skill
+description: 'Create a skill your org owns — scaffolded in this Egregore, protected from framework updates, shared with teammates via /save.'
+---
+
+<!-- generated-by: bin/codex-sync-skills.sh -->
+
+# Egregore create-skill Adapter
+
+This is fallback coverage for a long-tail Egregore workflow that has not been
+ported to a hand-written Codex-native skill yet.
+
+Use the project shell and filesystem directly. Do not invoke Claude Code
+commands. Translate interactive choices to structured Codex question tooling
+when it is available; otherwise render compact numbered choices with an
+`Other:` option and wait for the user.
+
+1. Read `.claude/skills/create-skill/SKILL.md` for the workflow details.
+2. Run the referenced `bin/` scripts directly from Codex.
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
+   calls when `egregore.json` declares `"mode": "local"`.
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
+   handoffs.

package/runtime/pi/.codex/spec-manifest.json

@@ -29,7 +29,7 @@
     {
       "section": "On Launch — MANDATORY FIRST ACTION",
       "action": "replace",
-      "sourceHash": "3def4421213a",
+      "sourceHash": "233d160f9ca8",
       "note": "Claude SessionStart hook does not run on Codex; the egregore launcher renders the card via bin/codex-session-start.sh before the session. Greeting-replay instruction dropped (card is already on screen)."
     },
     {
@@ -41,7 +41,7 @@
     {
       "section": "Config Files",
       "action": "keep",
-      "sourceHash": "8d7f1bd0f2d9",
+      "sourceHash": "4ca75fe428ca",
       "note": "Kept verbatim — shell facts, runtime-neutral."
     },
     {
@@ -101,7 +101,7 @@
     {
       "section": "Command Awareness",
       "action": "keep",
-      "sourceHash": "d6fe47a75c00",
+      "sourceHash": "905ad739e18c",
       "note": "Prepended the Codex command surface (skill tokens, native vs adapter split, $save abstraction); disambiguation map kept with /x -> $x token rendering. Tokens with no Codex skill (e.g. /loop, a Claude Code harness feature) are left as-is."
     },
     {

package/runtime/pi/.pi/APPEND_SYSTEM.md

@@ -142,7 +142,7 @@ If the startup card output contains `onboarding_needed`, invoke the `/onboarding
 
 ## Config Files
 
-- **`egregore.json`** — committed. Non-secret org config: `org_name`, `github_org`, `memory_repo`, `slug`, `mode`. `api_url` is connected-mode only. Optional `boundary { posture, read[], locked }` sets the org's isolation posture (see Environment Isolation). **Never put secrets here.**
+- **`egregore.json`** — committed. Non-secret org config: `org_name`, `github_org`, `memory_repo`, `slug`, `mode`. `api_url` is connected-mode only. Optional `boundary { posture, read[], locked }` sets the org's isolation posture (see Environment Isolation). Optional `owned_skills[]` names org-authored skills in `.claude/skills/` that `/update` must never overwrite (created via `/create-skill`). **Never put secrets here.**
 - **`.env`** — gitignored. Personal secrets. Local mode: `GITHUB_TOKEN` only. Connected mode: `GITHUB_TOKEN` + `EGREGORE_API_KEY`. **Never use `source .env`** — use `grep '^KEY=' .env | cut -d'=' -f2-`.
 
 In connected mode, infrastructure credentials (Neo4j, Telegram) live on the API server only — `bin/graph.sh` and `bin/notify.sh` route through the API gateway.

package/runtime/pi/.pi/spec-manifest.json

@@ -1,8 +1,8 @@
 {
   "generatedBy": "bin/pi-render-spec.mjs",
   "source": "AGENTS.md generated Codex spec",
-  "sourceHash": "6247d8070669",
-  "outputHash": "117a6f3cafc3",
+  "sourceHash": "02c4d2d275db",
+  "outputHash": "dc9d961b8ce2",
   "adaptations": [
     "Pi project trust and APPEND_SYSTEM delivery",
     "Pi tool_call branch gate",

package/runtime/pi/AGENTS.md

@@ -216,7 +216,7 @@ If the startup card output contains `onboarding_needed`, invoke the `$onboarding
 
 ## Config Files
 
-- **`egregore.json`** — committed. Non-secret org config: `org_name`, `github_org`, `memory_repo`, `slug`, `mode`. `api_url` is connected-mode only. Optional `boundary { posture, read[], locked }` sets the org's isolation posture (see Environment Isolation). **Never put secrets here.**
+- **`egregore.json`** — committed. Non-secret org config: `org_name`, `github_org`, `memory_repo`, `slug`, `mode`. `api_url` is connected-mode only. Optional `boundary { posture, read[], locked }` sets the org's isolation posture (see Environment Isolation). Optional `owned_skills[]` names org-authored skills in `.claude/skills/` that `$update` must never overwrite (created via `$create-skill`). **Never put secrets here.**
 - **`.env`** — gitignored. Personal secrets. Local mode: `GITHUB_TOKEN` only. Connected mode: `GITHUB_TOKEN` + `EGREGORE_API_KEY`. **Never use `source .env`** — use `grep '^KEY=' .env | cut -d'=' -f2-`.
 
 In connected mode, infrastructure credentials (Neo4j, Telegram) live on the API server only — `bin/graph.sh` and `bin/notify.sh` route through the API gateway.
@@ -395,9 +395,10 @@ Invoke commands from user intent — don't wait for the slash. Each command file
 **Knowledge** — `$search` `$deep-reflect` `$archive` `$note` `$add` `$meeting` `$ingest` `$scroll` `$mock` `$audit`
 **Identity** — `$me` (view profile or set display name)
 **Coordination** — `$ask` `$quest` `$issue` `$invite` `$delete-user` `$announce`
-**Connectors** — `$telegram-connect` (Telegram group setup) `$teams-connect` (Microsoft Teams channel setup)
+**Connectors** — `$notion-connect` (Notion workspace) `$telegram-connect` (Telegram group setup) `$teams-connect` (Microsoft Teams channel setup)
 **Git** — `$branch` `$commit` `$push` `$pr` `$save` `$review-pr` `$contribute`
 **Spirits** — `$summon` (persistent agent processes)
+**Skills** — `$create-skill` (org-owned skill: scaffold, protect from updates, share)
 **Infra** — `$setup` `$update` `$pull` `$env` `$infra` `$sync-repos` `$release` `$checkup`
 
 **Disambiguation:**
@@ -410,11 +411,12 @@ Invoke commands from user intent — don't wait for the slash. Each command file
 - Tasks: `$todo` (personal) · `$quest` (team exploration) · `$issue` (something broken)
 - Questions: `$ask [person]` (async) · just ask (agent answers from context)
 - Ingestion: `$ingest <file-or-folder>` (org-scoped corpus intake) · `$ingest meeting` · `$ingest user-interview` · `$ingest google` · ambiguous → ask which type
-- Connectors: `$telegram-connect` (Telegram group) · `$teams-connect` (MS Teams channel) · `$ingest` (bring content in)
+- Connectors: `$notion-connect` (Notion workspace) · `$telegram-connect` (Telegram group) · `$teams-connect` (MS Teams channel) · `$ingest` (bring content in) · `$ingest notion` (promote Notion docs)
 - Identity: `$me` — "who am I", "call me oz"
 - People: `$invite` (add) · `$delete-user` (remove)
 - PRs: `$pr` (create) · `$review-pr` (review)
 - Contributing: `$contribute` (upstream framework) · `$save` (org repo) · `$issue` (report bug)
+- Skills: `$create-skill` (new org-owned skill) · `$contribute` (change a framework skill for everyone)
 - Agents: `$summon` (design through questions) · `/loop` (quick recurring schedule)
 - Announcements: `$announce` (broadcast to group) · `$handoff` (structured to a person) · `bin/notify.sh send` (DM one person)
 

package/runtime/pi/bin/ingest_graph.py

@@ -15,7 +15,7 @@ ROOT = Path(__file__).resolve().parent.parent
 CORPUS_SCHEMA = "egregore-ingest-corpus/v1"
 KNOWLEDGE_SCHEMA = "egregore-knowledge-projection/v1"
 PLAN_SCHEMA = "egregore-ingest-graph-plan/v2"
-SOURCE_KINDS = {"meeting", "interview", "google", "corpus", "document"}
+SOURCE_KINDS = {"meeting", "interview", "google", "notion", "corpus", "document"}
 SOURCE_RELATIONS = {"INVOLVES", "CONDUCTED_BY"}
 ARTIFACT_RELATIONS = {"RELATES_TO", "SUPERSEDES"}
 ARTIFACT_LABELS = {
@@ -438,6 +438,8 @@ def source_shape(kind: str) -> tuple[str, str]:
         return "Interview:KnowledgeSource", "FROM_INTERVIEW"
     if kind == "google":
         return "Artifact:KnowledgeSource", "DERIVED_FROM"
+    if kind == "notion":
+        return "Artifact:KnowledgeSource", "DERIVED_FROM"
     if kind == "corpus":
         return "IngestSource:KnowledgeSource", "DERIVED_FROM"
     return "IngestDocument:Document:KnowledgeSource", "DERIVED_FROM"

package/runtime/pi/manifest.json

@@ -1,7 +1,7 @@
 {
   "source": "egregore-pi-meta-harness",
   "policy": "Pi-native lifecycle layer over the available OSS Codex skill corpus",
-  "skillCount": 41,
+  "skillCount": 42,
   "skills": [
     "activity",
     "announce",
@@ -10,6 +10,7 @@
     "checkup",
     "commit",
     "contribute",
+    "create-skill",
     "dark-mode",
     "dashboard",
     "deep-reflect",
@@ -59,6 +60,7 @@
     ".codex/skills/checkup/SKILL.md",
     ".codex/skills/commit/SKILL.md",
     ".codex/skills/contribute/SKILL.md",
+    ".codex/skills/create-skill/SKILL.md",
     ".codex/skills/dark-mode/SKILL.md",
     ".codex/skills/dashboard/SKILL.md",
     ".codex/skills/deep-reflect/SKILL.md",