create-egregore 0.19.30 → 0.19.32

package/assets/egregore-launcher.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// egregore-launcher-version: 0.19.30
+// egregore-launcher-version: 0.19.32
 //
 // egregore — launch and browse Egregore instances from your terminal.
 // Installed by create-egregore. Reads ~/.egregore/instances.json.
@@ -33,7 +33,7 @@ const crypto = require("node:crypto");
 const { spawnSync, spawn } = require("node:child_process");
 const readline = require("node:readline");
 
-const VERSION = "0.19.30";
+const VERSION = "0.19.32";
 const REGISTRY = path.join(os.homedir(), ".egregore", "instances.json");
 const DEFAULT_FILE = path.join(os.homedir(), ".egregore", "default");
 const UPDATE_CACHE_FILE = path.join(os.homedir(), ".egregore", "update-check.json");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-egregore",
-  "version": "0.19.30",
+  "version": "0.19.32",
   "description": "Set up Egregore for your team in one command — installs the egregore launcher and your choice of Claude Code, Codex, or Pi.",
   "license": "MIT",
   "bin": {

package/runtime/codex/.codex/skills/create-skill/SKILL.md

@@ -0,0 +1,29 @@
+---
+name: create-skill
+description: 'Create a skill your org owns — scaffolded in this Egregore, protected from framework updates, shared with teammates via /save.'
+---
+
+<!-- generated-by: bin/codex-sync-skills.sh -->
+
+# Egregore create-skill Adapter
+
+This is fallback coverage for a long-tail Egregore workflow that has not been
+ported to a hand-written Codex-native skill yet.
+
+Use the project shell and filesystem directly. Do not invoke Claude Code
+commands. Translate interactive choices to structured Codex question tooling
+when it is available; otherwise render compact numbered choices with an
+`Other:` option and wait for the user.
+
+1. Read `.claude/skills/create-skill/SKILL.md` for the workflow details.
+2. Run the referenced `bin/` scripts directly from Codex.
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
+   calls when `egregore.json` declares `"mode": "local"`.
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
+   handoffs.

package/runtime/codex/.codex/skills/slack-connect/SKILL.md

@@ -0,0 +1,29 @@
+---
+name: slack-connect
+description: 'Fallback Codex adapter for the Egregore slack-connect workflow.'
+---
+
+<!-- generated-by: bin/codex-sync-skills.sh -->
+
+# Egregore slack-connect Adapter
+
+This is fallback coverage for a long-tail Egregore workflow that has not been
+ported to a hand-written Codex-native skill yet.
+
+Use the project shell and filesystem directly. Do not invoke Claude Code
+commands. Translate interactive choices to structured Codex question tooling
+when it is available; otherwise render compact numbered choices with an
+`Other:` option and wait for the user.
+
+1. Read `.claude/skills/slack-connect/SKILL.md` for the workflow details.
+2. Run the referenced `bin/` scripts directly from Codex.
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
+   calls when `egregore.json` declares `"mode": "local"`.
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
+   handoffs.

package/runtime/codex/.codex/spec-manifest.json

@@ -29,7 +29,7 @@
     {
       "section": "On Launch — MANDATORY FIRST ACTION",
       "action": "replace",
-      "sourceHash": "3def4421213a",
+      "sourceHash": "233d160f9ca8",
       "note": "Claude SessionStart hook does not run on Codex; the egregore launcher renders the card via bin/codex-session-start.sh before the session. Greeting-replay instruction dropped (card is already on screen)."
     },
     {
@@ -41,7 +41,7 @@
     {
       "section": "Config Files",
       "action": "keep",
-      "sourceHash": "8d7f1bd0f2d9",
+      "sourceHash": "4ca75fe428ca",
       "note": "Kept verbatim — shell facts, runtime-neutral."
     },
     {
@@ -101,7 +101,7 @@
     {
       "section": "Command Awareness",
       "action": "keep",
-      "sourceHash": "d6fe47a75c00",
+      "sourceHash": "905ad739e18c",
       "note": "Prepended the Codex command surface (skill tokens, native vs adapter split, $save abstraction); disambiguation map kept with /x -> $x token rendering. Tokens with no Codex skill (e.g. /loop, a Claude Code harness feature) are left as-is."
     },
     {

package/runtime/codex/AGENTS.md

@@ -216,7 +216,7 @@ If the startup card output contains `onboarding_needed`, invoke the `$onboarding
 
 ## Config Files
 
-- **`egregore.json`** — committed. Non-secret org config: `org_name`, `github_org`, `memory_repo`, `slug`, `mode`. `api_url` is connected-mode only. Optional `boundary { posture, read[], locked }` sets the org's isolation posture (see Environment Isolation). **Never put secrets here.**
+- **`egregore.json`** — committed. Non-secret org config: `org_name`, `github_org`, `memory_repo`, `slug`, `mode`. `api_url` is connected-mode only. Optional `boundary { posture, read[], locked }` sets the org's isolation posture (see Environment Isolation). Optional `owned_skills[]` names org-authored skills in `.claude/skills/` that `$update` must never overwrite (created via `$create-skill`). **Never put secrets here.**
 - **`.env`** — gitignored. Personal secrets. Local mode: `GITHUB_TOKEN` only. Connected mode: `GITHUB_TOKEN` + `EGREGORE_API_KEY`. **Never use `source .env`** — use `grep '^KEY=' .env | cut -d'=' -f2-`.
 
 In connected mode, infrastructure credentials (Neo4j, Telegram) live on the API server only — `bin/graph.sh` and `bin/notify.sh` route through the API gateway.
@@ -395,9 +395,10 @@ Invoke commands from user intent — don't wait for the slash. Each command file
 **Knowledge** — `$search` `$deep-reflect` `$archive` `$note` `$add` `$meeting` `$ingest` `$scroll` `$mock` `$audit`
 **Identity** — `$me` (view profile or set display name)
 **Coordination** — `$ask` `$quest` `$issue` `$invite` `$delete-user` `$announce`
-**Connectors** — `$telegram-connect` (Telegram group setup) `$teams-connect` (Microsoft Teams channel setup)
+**Connectors** — `$notion-connect` (Notion workspace) `$telegram-connect` (Telegram group setup) `$teams-connect` (Microsoft Teams channel setup)
 **Git** — `$branch` `$commit` `$push` `$pr` `$save` `$review-pr` `$contribute`
 **Spirits** — `$summon` (persistent agent processes)
+**Skills** — `$create-skill` (org-owned skill: scaffold, protect from updates, share)
 **Infra** — `$setup` `$update` `$pull` `$env` `$infra` `$sync-repos` `$release` `$checkup`
 
 **Disambiguation:**
@@ -410,11 +411,12 @@ Invoke commands from user intent — don't wait for the slash. Each command file
 - Tasks: `$todo` (personal) · `$quest` (team exploration) · `$issue` (something broken)
 - Questions: `$ask [person]` (async) · just ask (agent answers from context)
 - Ingestion: `$ingest <file-or-folder>` (org-scoped corpus intake) · `$ingest meeting` · `$ingest user-interview` · `$ingest google` · ambiguous → ask which type
-- Connectors: `$telegram-connect` (Telegram group) · `$teams-connect` (MS Teams channel) · `$ingest` (bring content in)
+- Connectors: `$notion-connect` (Notion workspace) · `$telegram-connect` (Telegram group) · `$teams-connect` (MS Teams channel) · `$ingest` (bring content in) · `$ingest notion` (promote Notion docs)
 - Identity: `$me` — "who am I", "call me oz"
 - People: `$invite` (add) · `$delete-user` (remove)
 - PRs: `$pr` (create) · `$review-pr` (review)
 - Contributing: `$contribute` (upstream framework) · `$save` (org repo) · `$issue` (report bug)
+- Skills: `$create-skill` (new org-owned skill) · `$contribute` (change a framework skill for everyone)
 - Agents: `$summon` (design through questions) · `/loop` (quick recurring schedule)
 - Announcements: `$announce` (broadcast to group) · `$handoff` (structured to a person) · `bin/notify.sh send` (DM one person)
 

package/runtime/codex/bin/ingest-surface.html

@@ -143,6 +143,14 @@ __EGREGORE_DESIGN_CSS__
     .button { border-radius: 99px; padding: 11px 18px; border: 1px solid var(--border); background: var(--card-bg); color: var(--dark); }
     .button.primary { border-color: var(--terracotta); background: var(--terracotta); color: var(--paper); }
     .button:disabled { cursor: not-allowed; color: var(--warm-gray); border-color: var(--border); background: var(--card-bg); }
+    .connectors { margin-top: 18px; padding-top: 16px; border-top: 1px solid var(--border); }
+    .connectors-head { display: flex; justify-content: space-between; align-items: baseline; }
+    .connectors-head h3 { font-size: 13px; font-weight: 600; color: var(--dark); }
+    .connector-row { display: flex; gap: 10px; margin-top: 10px; flex-wrap: wrap; }
+    .connector { display: flex; flex-direction: column; gap: 3px; text-align: left; border: 1px solid var(--border); border-radius: 12px; padding: 12px 16px; background: var(--card-bg); color: var(--dark); min-width: 180px; }
+    .connector:hover { border-color: var(--terracotta); }
+    .connector span { color: var(--muted); font-size: 12px; }
+    .connector-note { margin-top: 10px; color: var(--muted); font-size: 12px; line-height: 1.5; }
     .status { border-left: 2px solid var(--terracotta); padding: 10px 12px; color: var(--muted); font-size: 12px; line-height: 1.5; }
     .status.error { border-color: var(--danger); color: var(--danger); }
     .status.done { border-color: var(--success); color: var(--success); }
@@ -198,6 +206,11 @@ __EGREGORE_DESIGN_CSS__
         </div>
         <input id="file-input" type="file" multiple>
         <input id="folder-input" type="file" webkitdirectory multiple>
+        <div class="connectors hidden" id="connectors">
+          <div class="connectors-head"><h3>Or bring a connected source</h3><span class="step">guided setup</span></div>
+          <div class="connector-row" id="connector-row"></div>
+          <p class="connector-note">Setup continues in the terminal — the agent walks you through authorization, and your tokens stay on this machine.</p>
+        </div>
       </section>
 
       <section class="panel hidden" id="review-panel">
@@ -273,6 +286,59 @@ __EGREGORE_DESIGN_CSS__
       document.getElementById('completion').classList.remove('hidden');
       document.title = 'Return to the terminal — Egregore';
     }
+    var connectorMeta = {
+      google: { label: 'Google Workspace', detail: 'Gmail, Drive, Calendar — multiple accounts' },
+      notion: { label: 'Notion', detail: 'Pages and databases' }
+    };
+    function showConnectorCompletion(provider) {
+      var meta = connectorMeta[provider] || { label: provider };
+      var account = (capabilities.connector_accounts || {})[provider] || '';
+      document.getElementById('completion-kicker').textContent = account
+        ? 'Already connected'
+        : 'Guided setup continues in the terminal';
+      document.getElementById('completion-copy').textContent = account
+        ? meta.label + ' is already connected as ' + account + '. Back in the terminal, your agent can add another account or start bringing material in.'
+        : 'Your agent is waiting there to connect ' + meta.label + ' — it walks you through authorization step by step. Tokens stay on this machine.';
+      document.getElementById('completion-source').textContent = account || meta.label;
+      document.getElementById('completion-files').textContent = account ? 'connected' : 'connected source';
+      document.getElementById('completion-outcome').textContent = account ? meta.label : 'guided setup';
+      document.querySelector('.shell').classList.add('hidden');
+      document.getElementById('completion').classList.remove('hidden');
+      document.title = 'Return to the terminal — Egregore';
+    }
+    function chooseConnector(provider) {
+      if (busy) return;
+      busy = true;
+      post('/api/connector', {
+        method: 'POST',
+        headers: {'Content-Type': 'application/json'},
+        body: JSON.stringify({ provider: provider })
+      }).then(function (result) {
+        if (result.redirect) {
+          // The CLI pre-started the OAuth listener — continue this same tab
+          // straight into the sign-in page.
+          window.location.href = result.redirect;
+          return;
+        }
+        showConnectorCompletion(provider);
+      }).catch(function (err) {
+        busy = false;
+        setStatus(err.message, 'error');
+        statusBox.classList.remove('hidden');
+      });
+    }
+    (function renderConnectors() {
+      var list = (capabilities.connectors || []).filter(function (p) { return connectorMeta[p]; });
+      if (!list.length) return;
+      var row = document.getElementById('connector-row');
+      row.innerHTML = list.map(function (p) {
+        return '<button class="connector" type="button" data-provider="' + p + '"><strong>' + connectorMeta[p].label + '</strong><span>' + connectorMeta[p].detail + '</span></button>';
+      }).join('');
+      row.querySelectorAll('.connector').forEach(function (btn) {
+        btn.addEventListener('click', function () { chooseConnector(btn.dataset.provider); });
+      });
+      document.getElementById('connectors').classList.remove('hidden');
+    })();
     function choose(files) {
       var seen = new Set();
       selected = Array.from(files).filter(function (file) {

package/runtime/codex/bin/ingest.py

@@ -23,6 +23,11 @@ from datetime import datetime, timezone
 from pathlib import Path
 from xml.etree import ElementTree
 
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+import doc_segment  # noqa: E402  (same-directory module, path set above)
+import pdf_extract  # noqa: E402
+import source_profile  # noqa: E402
+
 
 ROOT = Path(__file__).resolve().parent.parent
 CONFIG = ROOT / "egregore.json"
@@ -99,31 +104,32 @@ def parse_boundaries(items: list[str]) -> dict[str, str]:
     return dict(sorted(result.items()))
 
 
-def read_text(path: Path) -> tuple[str | None, str | None, str | None]:
+def read_text(path: Path) -> tuple[str | None, str | None, str | None, dict | None]:
+    """Extract text. Returns (text, error, extractor, detail).
+
+    `detail` carries per-page extraction facts for formats that have pages, so the
+    manifest records which pages needed OCR and which remain sparse or blank.
+    """
     ext = path.suffix.lower()
     try:
         if ext in TEXT_EXTS:
-            return path.read_text(encoding="utf-8", errors="replace"), None, "builtin-text"
+            return path.read_text(encoding="utf-8", errors="replace"), None, "builtin-text", None
         if ext in HTML_EXTS:
             raw = path.read_text(encoding="utf-8", errors="replace")
             raw = re.sub(r"(?is)<(script|style).*?>.*?</\1>", " ", raw)
-            return html.unescape(re.sub(r"(?s)<[^>]+>", " ", raw)), None, "builtin-html"
+            return html.unescape(re.sub(r"(?s)<[^>]+>", " ", raw)), None, "builtin-html", None
         if ext == ".docx":
             with zipfile.ZipFile(path) as archive:
                 raw = archive.read("word/document.xml")
             root = ElementTree.fromstring(raw)
-            return "\n".join(t.text or "" for t in root.iter() if t.tag.endswith("}t")), None, "builtin-docx"
+            text = "\n".join(t.text or "" for t in root.iter() if t.tag.endswith("}t"))
+            return text, None, "builtin-docx", None
         if ext == ".pdf":
-            tool = shutil.which("pdftotext")
-            if not tool:
-                return None, "pdf requires a text-layer or runtime-native extraction", None
-            proc = subprocess.run([tool, str(path), "-"], check=False, capture_output=True, text=True)
-            if proc.returncode:
-                return None, f"pdftotext failed ({proc.returncode})", None
-            return proc.stdout, None, "pdftotext"
+            result = pdf_extract.extract(path)
+            return result.text, result.error, result.extractor, (result.report or None)
     except (OSError, ValueError, zipfile.BadZipFile, ElementTree.ParseError) as exc:
-        return None, str(exc), None
-    return None, f"unsupported extension {ext or '(none)'}", None
+        return None, str(exc), None, None
+    return None, f"unsupported extension {ext or '(none)'}", None, None
 
 
 def chunks(text: str, limit: int = 7000) -> list[str]:
@@ -146,6 +152,23 @@ def chunks(text: str, limit: int = 7000) -> list[str]:
     return result
 
 
+def publisher_profile() -> dict | None:
+    """Load the instance's publisher profile, if one is configured.
+
+    Resolution is recorded as evidence only. It never overrides a boundary the
+    operator set: deriving a region is an inference, and an inference must not
+    silently replace a stated fact.
+    """
+    override = os.environ.get("EGREGORE_PUBLISHER_PROFILE")
+    path = Path(override) if override else (metadata_root() / "publisher-profile.json")
+    if not path.is_file():
+        return None
+    try:
+        return json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError):
+        return None
+
+
 def source_dir(source_id: str) -> Path:
     return metadata_root() / "sources" / slug(source_id)
 
@@ -200,6 +223,7 @@ def add_path(args: argparse.Namespace) -> dict:
     existing_manifest = load_manifest(directory)
     previous = {d["id"]: d for d in existing_manifest.get("documents", [])}
     now = datetime.now(timezone.utc).isoformat()
+    profile = publisher_profile()
     ingested = unchanged = metadata_updated = skipped = pruned = 0
     errors: list[dict] = []
     seen_paths: set[str] = set()
@@ -224,8 +248,10 @@ def add_path(args: argparse.Namespace) -> dict:
             text, error = registered["text"], None
             extraction = {"kind": "runtime", "extractor": registered["extractor"]}
         else:
-            text, error, extractor = read_text(path)
+            text, error, extractor, detail = read_text(path)
             extraction = {"kind": "local", "extractor": extractor} if extractor else None
+            if extraction and detail:
+                extraction["pages"] = detail
         if error or text is None or not text.strip():
             skipped += 1
             errors.append({"path": relative, "error": error or "empty extracted text"})
@@ -255,13 +281,49 @@ def add_path(args: argparse.Namespace) -> dict:
         ):
             unchanged += 1
             continue
-        document_chunks = chunks(text)
+        # Segment before chunking so no passage straddles two works. A document
+        # holding a single work yields one segment, and chunking is unchanged.
+        segments = doc_segment.segment(text)
+        document_chunks: list[tuple[str, doc_segment.Segment]] = []
+        for seg in segments:
+            for piece in chunks(seg.text(text)):
+                document_chunks.append((piece, seg))
+
         chunk_rows = []
         body = []
-        for index, content in enumerate(document_chunks, 1):
+        for index, (content, seg) in enumerate(document_chunks, 1):
             chunk_id = f"{doc_id}-c{index:04d}-{digest(content, 8)}"
-            chunk_rows.append({"id": chunk_id, "index": index, "sha256": hashlib.sha256(content.encode()).hexdigest()})
+            row = {"id": chunk_id, "index": index, "sha256": hashlib.sha256(content.encode()).hexdigest()}
+            if seg.kind != "article" or seg.label:
+                row["segment"] = {"kind": seg.kind, **({"label": seg.label} if seg.label else {})}
+            chunk_rows.append(row)
             body.append(f"## Chunk {index:04d}\n\n<!-- ingest-chunk: {chunk_id} -->\n\n{content}")
+
+        structure = {
+            "segments": len([s for s in segments if s.kind == "article"]),
+            "summary": doc_segment.summarise(segments),
+        }
+        derived_year = doc_segment.publication_year(segments)
+        if derived_year:
+            structure["publication_year"] = derived_year
+            structure["year_source"] = "running_head"
+
+        # Fill in boundaries the operator left blank, when the instance supplies a
+        # profile that can work them out from where the document came from. People
+        # dumping a folder of documents will not type these in, and a boundary that
+        # is absent filters nothing. A derived value is marked as derived: anything
+        # downstream can tell it apart from one a person stated, and weigh it by the
+        # confidence recorded alongside. An operator's value is never overwritten.
+        provenance = None
+        doc_boundaries = dict(boundaries)
+        if profile:
+            resolved = source_profile.resolve(profile, filename=relative)
+            if resolved.publisher_class or resolved.notes:
+                provenance = resolved.as_dict()
+            key = source_profile.boundary_key(profile)
+            if key and resolved.zone and key not in doc_boundaries:
+                doc_boundaries[key] = resolved.zone
+                provenance = {**(provenance or {}), "applied_boundary": key, "derived": True}
         out_path = docs_dir / f"{doc_id}.md"
         frontmatter = {
             "id": doc_id,
@@ -274,8 +336,10 @@ def add_path(args: argparse.Namespace) -> dict:
             "normalized_content_hash": normalized_hash,
             "revision": content_hash[:16],
             "status": "unverified",
-            "boundaries": boundaries,
+            "boundaries": doc_boundaries,
             "extraction": extraction,
+            "structure": structure,
+            "provenance": provenance,
             "ingested_at": now,
         }
         yaml_lines = ["---"] + [f"{key}: {json.dumps(value, ensure_ascii=False)}" for key, value in frontmatter.items()] + ["---", ""]
@@ -292,7 +356,9 @@ def add_path(args: argparse.Namespace) -> dict:
             "bytes": size_bytes,
             "chunks": chunk_rows,
             "extraction": extraction,
-            "boundaries": boundaries,
+            "structure": structure,
+            "provenance": provenance,
+            "boundaries": doc_boundaries,
             "status": "unverified",
             "ingested_at": now,
         }

package/runtime/codex/bin/ingest.sh

@@ -204,8 +204,56 @@ cmd_search() {
     (.[] | "\n### " + (.title // .file) + "\n" + .file + "\n\n" + (.snippet // ""))'
 }
 
+cmd_select() {
+  # Stitch the Google sign-in into the picker itself: when the shim ships and
+  # no account is connected yet, pre-start the OAuth listener and hand its
+  # consent URL to the surface — clicking Google then continues the SAME tab
+  # into sign-in instead of bouncing through the terminal. Already connected:
+  # pass the account so the page says so honestly. Everything degrades to the
+  # terminal-guided flow when the URL isn't ready in time.
+  local auth_urls="{}" accounts="{}" auth_pid="" auth_log="" result status=0
+  if [ -x "$ROOT/bin/connector-google.sh" ]; then
+    local active_account
+    active_account="$(jq -r '.google_account // empty' "$ROOT/.egregore-state.json" 2>/dev/null)"
+    if [ -n "$active_account" ]; then
+      accounts="$(jq -cn --arg a "$active_account" '{google: $a}')"
+    else
+      auth_log="$(mktemp)"
+      bash "$ROOT/bin/connector-google.sh" auth --print-url > "$auth_log" 2>/dev/null &
+      auth_pid=$!
+      local waited=0 url=""
+      while [ "$waited" -lt 15 ]; do
+        url="$(head -1 "$auth_log" 2>/dev/null | jq -r '.auth_url // empty' 2>/dev/null)"
+        [ -n "$url" ] && break
+        sleep 1; waited=$((waited + 1))
+      done
+      if [ -n "$url" ]; then
+        auth_urls="$(jq -cn --arg u "$url" '{google: $u}')"
+      fi
+    fi
+  fi
+  result="$(EGREGORE_CONNECTOR_AUTH_URLS="$auth_urls" EGREGORE_CONNECTOR_ACCOUNTS="$accounts" python3 "$SURFACE" "$@")" || status=$?
+  if [ -n "$auth_pid" ]; then
+    if [ "$(printf '%s' "$result" | jq -r '.auth // empty' 2>/dev/null)" = "in-browser" ]; then
+      # The user is on Google's consent page in their tab; the listener
+      # finishes the token exchange. Wait for it and fold in the outcome.
+      if wait "$auth_pid" 2>/dev/null; then
+        result="$(printf '%s' "$result" | jq -c '. + {auth: "connected"}')"
+      else
+        result="$(printf '%s' "$result" | jq -c '. + {auth: "failed"}')"
+      fi
+    else
+      kill "$auth_pid" 2>/dev/null || true
+      wait "$auth_pid" 2>/dev/null || true
+    fi
+  fi
+  [ -n "$auth_log" ] && rm -f "$auth_log"
+  printf '%s\n' "$result"
+  return "$status"
+}
+
 case "${1:-}" in
-  select) shift; python3 "$SURFACE" "$@" ;;
+  select) shift; cmd_select "$@" ;;
   add) shift; cmd_add "$@" ;;
   add-selection) shift; cmd_add_selection "$@" ;;
   register-extraction) shift; python3 "$PY" register-extraction "$@" ;;

package/runtime/codex/bin/ingest_graph.py

@@ -13,9 +13,10 @@ from typing import Any
 
 ROOT = Path(__file__).resolve().parent.parent
 CORPUS_SCHEMA = "egregore-ingest-corpus/v1"
+CONNECTOR_SCHEMA = "egregore-connector-lifecycle/v1"
 KNOWLEDGE_SCHEMA = "egregore-knowledge-projection/v1"
 PLAN_SCHEMA = "egregore-ingest-graph-plan/v2"
-SOURCE_KINDS = {"meeting", "interview", "google", "corpus", "document"}
+SOURCE_KINDS = {"meeting", "interview", "google", "notion", "corpus", "document"}
 SOURCE_RELATIONS = {"INVOLVES", "CONDUCTED_BY"}
 ARTIFACT_RELATIONS = {"RELATES_TO", "SUPERSEDES"}
 ARTIFACT_LABELS = {
@@ -438,6 +439,8 @@ def source_shape(kind: str) -> tuple[str, str]:
         return "Interview:KnowledgeSource", "FROM_INTERVIEW"
     if kind == "google":
         return "Artifact:KnowledgeSource", "DERIVED_FROM"
+    if kind == "notion":
+        return "Artifact:KnowledgeSource", "DERIVED_FROM"
     if kind == "corpus":
         return "IngestSource:KnowledgeSource", "DERIVED_FROM"
     return "IngestDocument:Document:KnowledgeSource", "DERIVED_FROM"
@@ -728,7 +731,84 @@ RETURN a.id""",
     }
 
 
+def connector_manifest(value: dict[str, Any]) -> bool:
+    return value.get("schema") == CONNECTOR_SCHEMA
+
+
+def connector_plan(value: dict[str, Any], path: Path) -> dict[str, Any]:
+    """Project connector lifecycle: which providers this org has connected,
+    which accounts are authorized on each, and which ingest sources arrived
+    through which account. Connected mode only — the plan is executed by the
+    same runner as corpus plans and is idempotent (MERGE throughout)."""
+    provider = required_string(value.get("provider"), "provider")
+    if provider not in ("google", "notion"):
+        raise ContractError(f"unsupported connector provider: {provider}")
+    accounts = value.get("accounts")
+    if not isinstance(accounts, list) or not accounts:
+        raise ContractError("accounts must be a non-empty list")
+    recorded = required_string(value.get("recorded_at"), "recorded_at")
+    source_id = str(value.get("source_id") or "")
+    queries: list[dict[str, Any]] = []
+    queries.append(
+        query(
+            """MERGE (c:Connector {id: $provider})
+SET c.provider = $provider,
+    c.updatedAt = datetime($recorded)
+RETURN c.id""",
+            {"provider": provider, "recorded": recorded},
+        )
+    )
+    for entry in accounts:
+        if not isinstance(entry, dict):
+            raise ContractError("each account must be an object")
+        email = required_string(entry.get("email"), "accounts[].email")
+        status = str(entry.get("status") or "authorized")
+        if status not in ("authorized", "revoked"):
+            raise ContractError(f"unsupported account status: {status}")
+        account_id = f"{provider}:{email.lower()}"
+        queries.append(
+            query(
+                """MERGE (a:SourceAccount {id: $id})
+SET a.email = $email,
+    a.provider = $provider,
+    a.status = $status,
+    a.updatedAt = datetime($recorded)
+FOREACH (_ IN CASE WHEN $status = 'authorized' AND a.authorizedAt IS NULL THEN [1] ELSE [] END |
+  SET a.authorizedAt = datetime($recorded)
+)
+WITH a
+MATCH (c:Connector {id: $provider})
+MERGE (a)-[:ON]->(c)
+WITH a
+OPTIONAL MATCH (s:IngestSource {id: $sourceId})
+FOREACH (_ IN CASE WHEN s IS NULL OR $sourceId = '' THEN [] ELSE [1] END |
+  MERGE (s)-[v:VIA_ACCOUNT]->(a)
+  SET v.recordedAt = datetime($recorded)
+)
+RETURN a.id""",
+                {
+                    "id": account_id,
+                    "email": email,
+                    "provider": provider,
+                    "status": status,
+                    "recorded": recorded,
+                    "sourceId": source_id,
+                },
+            )
+        )
+    return {
+        "schema": PLAN_SCHEMA,
+        "schema_family": "connector-lifecycle",
+        "manifest_id": f"connector:{provider}",
+        "source": {"kind": "connector", "id": provider},
+        "query_count": len(queries),
+        "queries": queries,
+    }
+
+
 def build_plan(value: dict[str, Any], path: Path) -> dict[str, Any]:
+    if connector_manifest(value):
+        return connector_plan(value, path)
     if corpus_manifest(value):
         return corpus_plan(value, path)
     return knowledge_plan(value, path)