create-egregore 0.19.32 → 0.20.0

package/runtime/codex/bin/ingest.py

@@ -23,10 +23,12 @@ from datetime import datetime, timezone
 from pathlib import Path
 from xml.etree import ElementTree
 
-sys.path.insert(0, str(Path(__file__).resolve().parent))
+sys.path.append(str(Path(__file__).resolve().parent))
+import catalogue as catalogue_module  # noqa: E402
 import doc_segment  # noqa: E402  (same-directory module, path set above)
 import pdf_extract  # noqa: E402
 import source_profile  # noqa: E402
+import text_repair  # noqa: E402
 
 
 ROOT = Path(__file__).resolve().parent.parent
@@ -152,6 +154,35 @@ def chunks(text: str, limit: int = 7000) -> list[str]:
     return result
 
 
+def find_publisher_profile() -> Path | None:
+    """Where this instance's publisher profile is, if it has one.
+
+    The profile is what assigns a zone and a trust tier to each document, and
+    zone is a hard retrieval boundary. Ingesting without it produces a corpus
+    where every document is unplaced, so every later question is refused — a
+    failure that looks like an empty archive rather than a missing setting.
+
+    So this looks in the places a profile actually lives rather than in one
+    fixed path. An instance keeps its ontology under memory/knowledge/tools/,
+    not beside its intake metadata, and requiring an environment variable to
+    bridge that gap means the common case is the broken one.
+    """
+    override = os.environ.get("EGREGORE_PUBLISHER_PROFILE")
+    if override:
+        path = Path(override)
+        return path if path.is_file() else None
+
+    candidates = [metadata_root() / "publisher-profile.json"]
+    memory = Path("memory")
+    if memory.is_dir():
+        candidates.extend(sorted(memory.glob("knowledge/tools/*/publisher-profile.json")))
+        candidates.append(memory / "publisher-profile.json")
+    for path in candidates:
+        if path.is_file():
+            return path
+    return None
+
+
 def publisher_profile() -> dict | None:
     """Load the instance's publisher profile, if one is configured.
 
@@ -159,9 +190,8 @@ def publisher_profile() -> dict | None:
     operator set: deriving a region is an inference, and an inference must not
     silently replace a stated fact.
     """
-    override = os.environ.get("EGREGORE_PUBLISHER_PROFILE")
-    path = Path(override) if override else (metadata_root() / "publisher-profile.json")
-    if not path.is_file():
+    path = find_publisher_profile()
+    if path is None:
         return None
     try:
         return json.loads(path.read_text(encoding="utf-8"))
@@ -223,7 +253,19 @@ def add_path(args: argparse.Namespace) -> dict:
     existing_manifest = load_manifest(directory)
     previous = {d["id"]: d for d in existing_manifest.get("documents", [])}
     now = datetime.now(timezone.utc).isoformat()
+    profile_path = find_publisher_profile()
     profile = publisher_profile()
+    if profile is None:
+        # Said once, plainly, because the alternative is a corpus that ingests
+        # cleanly and then refuses every question with no indication why.
+        print("ingest: no publisher-profile.json found — documents will carry no zone "
+              "or trust tier, and a zoneless document can never be served. Put one "
+              "under memory/knowledge/tools/<ontology>/ or set "
+              "EGREGORE_PUBLISHER_PROFILE.", file=sys.stderr)
+    catalogue = catalogue_module.load(
+        profile or {}, base=profile_path.parent if profile_path else None
+    )
+    repair_map = text_repair.load_mapping(profile or {})
     ingested = unchanged = metadata_updated = skipped = pruned = 0
     errors: list[dict] = []
     seen_paths: set[str] = set()
@@ -252,6 +294,15 @@ def add_path(args: argparse.Namespace) -> dict:
             extraction = {"kind": "local", "extractor": extractor} if extractor else None
             if extraction and detail:
                 extraction["pages"] = detail
+        # Fix characters the document's own font encoding got wrong, before
+        # anything downstream indexes or quotes them.
+        repaired = None
+        if text and repair_map:
+            outcome = text_repair.repair(text, repair_map)
+            if outcome.replaced:
+                text = outcome.text
+                repaired = outcome.as_report()
+
         if error or text is None or not text.strip():
             skipped += 1
             errors.append({"path": relative, "error": error or "empty extracted text"})
@@ -283,6 +334,9 @@ def add_path(args: argparse.Namespace) -> dict:
             continue
         # Segment before chunking so no passage straddles two works. A document
         # holding a single work yields one segment, and chunking is unchanged.
+        if repaired and extraction:
+            extraction["repair"] = repaired
+
         segments = doc_segment.segment(text)
         document_chunks: list[tuple[str, doc_segment.Segment]] = []
         for seg in segments:
@@ -314,12 +368,34 @@ def add_path(args: argparse.Namespace) -> dict:
         # is absent filters nothing. A derived value is marked as derived: anything
         # downstream can tell it apart from one a person stated, and weigh it by the
         # confidence recorded alongside. An operator's value is never overwritten.
+        # Evidence strongest first: what the operator stated, then what the
+        # organisation's own catalogue records, then what can be inferred from
+        # the document's origin. A weaker source never overwrites a stronger one.
         provenance = None
         doc_boundaries = dict(boundaries)
+        catalogued = catalogue_module.lookup(catalogue, relative)
+
+        if catalogued:
+            provenance = {"from_catalogue": {k: v for k, v in catalogued.items()}}
+            for field_name, value in catalogued.items():
+                if field_name in ("zone", "crop", "topic", "customer", "jurisdiction", "project"):
+                    if field_name not in doc_boundaries:
+                        doc_boundaries[field_name] = value
+                        provenance["applied_boundary"] = field_name
+            if catalogued.get("year"):
+                structure.setdefault("publication_year", catalogued["year"])
+                structure["year_source"] = structure.get("year_source") or "catalogue"
+            if catalogued.get("tier"):
+                provenance["tier"] = catalogued["tier"]
+            provenance["confidence"] = "high"
+
         if profile:
             resolved = source_profile.resolve(profile, filename=relative)
             if resolved.publisher_class or resolved.notes:
-                provenance = resolved.as_dict()
+                inferred = resolved.as_dict()
+                # Keep the inference visible even when the catalogue answered,
+                # so a disagreement between the two is inspectable.
+                provenance = {**inferred, **(provenance or {})} if provenance else inferred
             key = source_profile.boundary_key(profile)
             if key and resolved.zone and key not in doc_boundaries:
                 doc_boundaries[key] = resolved.zone

package/runtime/codex/bin/lib/context.sh

@@ -370,6 +370,29 @@ fi
   JSON="[]"
   RICH="[]"
   if [ -d "$SCRIPT_DIR/memory/handoffs" ]; then
+    # One definition everywhere: in connected mode the list comes from the
+    # graph's open-handoffs named read (open = pending/unread/read/claimed,
+    # matched by name/github/aliases) — the same definition the dashboard
+    # uses. The file grep below stays as the local-mode/offline fallback.
+    ADDRESSED=""
+    if [ "${LOCAL_MODE:-false}" != "true" ]; then
+      _GRAPH_LIST=$(bash "$SCRIPT_DIR/bin/graph-op.sh" open-handoffs "$AUTHOR" 5 2>/dev/null || true)
+      if echo "$_GRAPH_LIST" | jq -e '.values | length > 0' >/dev/null 2>&1; then
+        ADDRESSED=$(echo "$_GRAPH_LIST" | jq -r '.values[][0]' 2>/dev/null | awk '!seen[$0]++' | while IFS= read -r _SID; do
+          # Two on-disk layouts: dated subdirs (YYYY-MM/DD-slug.md, the id's
+          # own shape) and flat files at the handoffs root. Probe both, else
+          # a graph-listed handoff silently vanishes from the greeting.
+          _MONTH="${_SID:0:7}"
+          _REST="${_SID:8}"
+          _F="$SCRIPT_DIR/memory/handoffs/$_MONTH/$_REST.md"
+          if [ -f "$_F" ]; then
+            echo "$_F"
+          elif [ -f "$SCRIPT_DIR/memory/handoffs/$_SID.md" ]; then
+            echo "$SCRIPT_DIR/memory/handoffs/$_SID.md"
+          fi
+        done | head -5)
+      fi
+    fi
     # Match github username, display name, github_name first word, and people-file name
     # Handoff files may use "to: name", "**To**: name", or "To: name"
     _DISPLAY=$(jq -r '.display_name // empty' "$STATE_FILE" 2>/dev/null)
@@ -387,7 +410,9 @@ fi
       echo "$_GREP_PAT" | grep -qF "$_VARIANT" && continue
       _GREP_PAT="$_GREP_PAT\|[Tt]o[*]*: *$_VARIANT\|[Tt]o[*]*:$_VARIANT"
     done
-    ADDRESSED=$(grep -rli "$_GREP_PAT" "$SCRIPT_DIR/memory/handoffs/" 2>/dev/null | sort -r | head -5 || true)
+    if [ -z "$ADDRESSED" ]; then
+      ADDRESSED=$(grep -rli "$_GREP_PAT" "$SCRIPT_DIR/memory/handoffs/" 2>/dev/null | sort -r | head -5 || true)
+    fi
     JSON="["
     RICH="["
     FIRST=true

package/runtime/codex/bin/lib/greeting.sh

@@ -188,7 +188,10 @@ fi
 # Staged auto-saves awaiting the user's merge (the /autosave consent gate).
 # Live gh query so the line persists until the PRs actually merge — the
 # ledger cursor above only reports once. Fail-soft when gh/network is out.
-if command -v gh >/dev/null 2>&1; then
+# Shown only while the autosave experiment is enabled: stale PRs from a
+# disabled experiment should not nag every greeting.
+AUTOSAVE_ON=$(jq -r '.autosave_enabled // false' "$STATE_FILE" 2>/dev/null)
+if [ "$AUTOSAVE_ON" = "true" ] && command -v gh >/dev/null 2>&1; then
   GH_SELF=$(jq -r '.github_username // empty' "$STATE_FILE" 2>/dev/null)
   if [ -n "$GH_SELF" ]; then
     WAITING_AS=$(gh pr list --state open --author "$GH_SELF" --limit 20 \

package/runtime/codex/bin/lib/worktree-links.sh

@@ -52,3 +52,28 @@ egregore_link_shared_state() {
     fi
   done
 }
+
+# Resolve the .env that governs a checkout. A worktree can be missing its .env
+# symlink (created before .env existed, or by a runtime that skipped worktree
+# setup) — self-heal the links, then fall back to the main checkout's .env so
+# credential loading never silently comes up empty. Prints the usable path, or
+# nothing when neither checkout has one. Always returns 0.
+egregore_env_file() {
+  local project_dir="${1:?project dir required}"
+  if [ ! -f "$project_dir/.env" ] && [ -f "$project_dir/.git" ]; then
+    egregore_link_shared_state "$project_dir" 2>/dev/null || true
+  fi
+  if [ -f "$project_dir/.env" ]; then
+    echo "$project_dir/.env"
+    return 0
+  fi
+  if [ -f "$project_dir/.git" ]; then
+    local main_dir
+    main_dir="$(egregore_main_project_dir "$project_dir" 2>/dev/null || true)"
+    if [ -n "$main_dir" ] && [ -f "$main_dir/.env" ]; then
+      echo "$main_dir/.env"
+      return 0
+    fi
+  fi
+  return 0
+}

package/runtime/codex/manifest.json

@@ -1,7 +1,7 @@
 {
   "source": "egregore-runtime",
   "policy": "available OSS components selected by capability-distribution.json; Connect is an authenticated additive overlay",
-  "skillCount": 43,
+  "skillCount": 46,
   "skills": [
     "activity",
     "announce",
@@ -19,12 +19,14 @@
     "handoff",
     "harvest",
     "ingest",
+    "ingest-notion",
     "ingest-user-interview",
     "invite",
     "issue",
     "me",
     "meeting",
     "note",
+    "notion-connect",
     "onboarding",
     "pr",
     "pull",
@@ -36,6 +38,7 @@
     "slack-connect",
     "summon",
     "sync-repos",
+    "teams-connect",
     "telegram-connect",
     "telemetry",
     "test",
@@ -71,6 +74,7 @@
     ".codex/skills/handoff/SKILL.md",
     ".codex/skills/harvest/QUESTION_PALETTE.md",
     ".codex/skills/harvest/SKILL.md",
+    ".codex/skills/ingest-notion/SKILL.md",
     ".codex/skills/ingest-user-interview/SKILL.md",
     ".codex/skills/ingest/SKILL.md",
     ".codex/skills/invite/SKILL.md",
@@ -78,6 +82,7 @@
     ".codex/skills/me/SKILL.md",
     ".codex/skills/meeting/SKILL.md",
     ".codex/skills/note/SKILL.md",
+    ".codex/skills/notion-connect/SKILL.md",
     ".codex/skills/onboarding/SKILL.md",
     ".codex/skills/pr/SKILL.md",
     ".codex/skills/pull/SKILL.md",
@@ -89,6 +94,7 @@
     ".codex/skills/slack-connect/SKILL.md",
     ".codex/skills/summon/SKILL.md",
     ".codex/skills/sync-repos/SKILL.md",
+    ".codex/skills/teams-connect/SKILL.md",
     ".codex/skills/telegram-connect/SKILL.md",
     ".codex/skills/telemetry/SKILL.md",
     ".codex/skills/test/SKILL.md",
@@ -114,6 +120,7 @@
     "bin/codex-session-start.sh",
     "bin/codex-skill-render.mjs",
     "bin/codex-sync-skills.sh",
+    "bin/connect-refresh.sh",
     "bin/dashboard-data.sh",
     "bin/graph-batch.sh",
     "bin/graph-op.sh",

package/runtime/pi/.codex/skills/ingest-notion/SKILL.md

@@ -0,0 +1,29 @@
+---
+name: ingest-notion
+description: 'Fallback Codex adapter for the Egregore ingest-notion workflow.'
+---
+
+<!-- generated-by: bin/codex-sync-skills.sh -->
+
+# Egregore ingest-notion Adapter
+
+This is fallback coverage for a long-tail Egregore workflow that has not been
+ported to a hand-written Codex-native skill yet.
+
+Use the project shell and filesystem directly. Do not invoke Claude Code
+commands. Translate interactive choices to structured Codex question tooling
+when it is available; otherwise render compact numbered choices with an
+`Other:` option and wait for the user.
+
+1. Read `.claude/skills/ingest-notion/SKILL.md` for the workflow details.
+2. Run the referenced `bin/` scripts directly from Codex.
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
+   calls when `egregore.json` declares `"mode": "local"`.
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
+   handoffs.

package/runtime/pi/.codex/skills/notion-connect/SKILL.md

@@ -0,0 +1,29 @@
+---
+name: notion-connect
+description: 'Fallback Codex adapter for the Egregore notion-connect workflow.'
+---
+
+<!-- generated-by: bin/codex-sync-skills.sh -->
+
+# Egregore notion-connect Adapter
+
+This is fallback coverage for a long-tail Egregore workflow that has not been
+ported to a hand-written Codex-native skill yet.
+
+Use the project shell and filesystem directly. Do not invoke Claude Code
+commands. Translate interactive choices to structured Codex question tooling
+when it is available; otherwise render compact numbered choices with an
+`Other:` option and wait for the user.
+
+1. Read `.claude/skills/notion-connect/SKILL.md` for the workflow details.
+2. Run the referenced `bin/` scripts directly from Codex.
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
+   calls when `egregore.json` declares `"mode": "local"`.
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
+   handoffs.

package/runtime/pi/.codex/skills/teams-connect/SKILL.md

@@ -0,0 +1,29 @@
+---
+name: teams-connect
+description: 'Fallback Codex adapter for the Egregore teams-connect workflow.'
+---
+
+<!-- generated-by: bin/codex-sync-skills.sh -->
+
+# Egregore teams-connect Adapter
+
+This is fallback coverage for a long-tail Egregore workflow that has not been
+ported to a hand-written Codex-native skill yet.
+
+Use the project shell and filesystem directly. Do not invoke Claude Code
+commands. Translate interactive choices to structured Codex question tooling
+when it is available; otherwise render compact numbered choices with an
+`Other:` option and wait for the user.
+
+1. Read `.claude/skills/teams-connect/SKILL.md` for the workflow details.
+2. Run the referenced `bin/` scripts directly from Codex.
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
+   calls when `egregore.json` declares `"mode": "local"`.
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
+   handoffs.

package/runtime/pi/.codex/spec-manifest.json

@@ -35,7 +35,7 @@
     {
       "section": "After Greeting — BRANCH ON FIRST RESPONSE",
       "action": "replace",
-      "sourceHash": "88410d7c6c00",
+      "sourceHash": "d28a5c162ab4",
       "note": "EnterWorktree -> bin/agent.sh branch with git checkout fallback; AskUserQuestion -> numbered options in plain text; branch-guard mapped to .codex/hooks/branch-guard.js with instruction fallback; plan-mode note dropped (no plan mode on Codex); /branch + /onboarding -> skill tokens. Handoff claiming and repoState auto-checkout kept verbatim (pure git)."
     },
     {
@@ -101,7 +101,7 @@
     {
       "section": "Command Awareness",
       "action": "keep",
-      "sourceHash": "905ad739e18c",
+      "sourceHash": "be00d1fc715f",
       "note": "Prepended the Codex command surface (skill tokens, native vs adapter split, $save abstraction); disambiguation map kept with /x -> $x token rendering. Tokens with no Codex skill (e.g. /loop, a Claude Code harness feature) are left as-is."
     },
     {
@@ -119,7 +119,7 @@
     {
       "section": "Mode",
       "action": "keep",
-      "sourceHash": "ae5cbb9c5d30",
+      "sourceHash": "0f74e18fd1b4",
       "note": "Kept; /env and /checkup rendered as $skill tokens."
     },
     {

package/runtime/pi/.pi/APPEND_SYSTEM.md

@@ -355,8 +355,9 @@ Egregore runs in one of two configurations, set by `mode` in `egregore.json`. De
 
 **Hard rules in local mode:**
 - Never tell the user to "ask their admin" for credentials. The user IS the admin.
-- Never surface `api_url`, `EGREGORE_API_KEY`, or "connected mode" as an upgrade path. Hosted Egregore is a separate service, not something a user can turn on by adding fields to `egregore.json`.
-- If a feature genuinely requires the hosted service, say so plainly ("this isn't available in this configuration") and stop. Do not improvise a path to enabling it.
+- Never surface `api_url`, `EGREGORE_API_KEY`, or config edits as an upgrade path. Hosted Egregore is not something a user can turn on by adding fields to `egregore.json`.
+- **The one sanctioned upgrade path is `egregore connect`** (the launcher flow: registers the org, provisions the key, replays the graph). Connect-tier connector skills carry an explicit upsell gate for local instances — deliver their message verbatim, offer the upgrade via `egregore connect` or a clean "not now", and stop on decline. Beyond that gate, do not improvise: no hand-set `api_url`, no partial flows.
+- If a feature requires the hosted service and has no upsell gate, say so plainly ("this isn't available in this configuration") and stop.
 - Calling `bin/graph.sh` or `bin/notify.sh` in local mode is harmless — they fail soft and return empty results — but there is no need to call them; prefer reading `memory/` directly.
 
 **Connected mode** (`"mode": "connected"`, `api_url` set) — the hosted configuration, used by organizations on the hosted service. Full feature set: Neo4j knowledge graph via `bin/graph.sh`, Telegram notifications via `bin/notify.sh`, dashboard publication, API-backed context gathering on session start. Use `/env` to check API key, `/checkup` for diagnostics. If the graph is offline, show troubleshooting.

package/runtime/pi/.pi/extensions/egregore.ts

@@ -2,10 +2,12 @@ import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { Text } from "@earendil-works/pi-tui";
 import { Type } from "typebox";
-import { isMutatingBash, isRuntimeStatePath, mutatesOnlyRuntimeState } from "../../bin/pi-branch-policy.mjs";
+import { isConsentCommand, isMutatingBash, isRuntimeStatePath, mutatesOnlyRuntimeState } from "../../bin/pi-branch-policy.mjs";
 import {
+  activityDataPath,
   captureSessionEnd,
   createHandoff,
+  lastActivityJson,
   parseViewRequest,
   publishScroll,
   renderActivity,
@@ -220,9 +222,21 @@ export default function egregore(pi) {
       const focus = await ctx.ui.select("Focus", ["Handoffs", "Questions", "Recent work", "Dashboard", "Done"]);
       if (!focus || focus === "Done") return;
       const command = focus === "Dashboard" ? "dashboard" : "activity";
+      // Hand the model the complete data the extension already fetched, as a
+      // file: one fast read, never truncated, no reason to re-run the data
+      // script or spelunk renderer sources.
+      const cached = lastActivityJson();
       const prompt = focus === "Dashboard"
         ? workflowPrompt("dashboard", "")
-        : `Continue the Egregore /activity workflow with focus: ${focus.toLowerCase()}. Work quietly and show only the designed result.`;
+        : [
+          `Continue the Egregore /activity workflow with focus: ${focus.toLowerCase()}.`,
+          "Output nothing except the final rendered result — no prose, planning, or narration between commands.",
+          cached
+            ? `The complete activity data is already fresh at ${relative(root, activityDataPath(root))} — read that file in one call; do NOT re-run bin/activity-data.sh, read renderer sources, or run other data commands.`
+            : "",
+          "If required data is missing or a command fails, render the single line '◦ activity data unavailable' and stop — never debug data plumbing inside this workflow.",
+          "Rows without a topic: show the branch name instead; with neither, omit the row — never print (untitled).",
+        ].filter(Boolean).join("\n");
       sendQuietWorkflow(command, "", ctx, { prompt, working: `Opening ${focus.toLowerCase()}…` });
     },
   });
@@ -398,10 +412,7 @@ export default function egregore(pi) {
     // (echo 'develop' into .egregore-branch-consent) contains a redirect and
     // would otherwise be blocked by this very gate.
     if (event.toolName === "bash") {
-      const consentCmd = new RegExp(
-        "^\\s*echo\\s+['\"]?" + branch + "['\"]?\\s*>\\s*\\.egregore-branch-consent\\s*$"
-      );
-      if (consentCmd.test(String(event.input?.command || "").trim())) return;
+      if (isConsentCommand(String(event.input?.command || "").trim(), branch)) return;
     }
 
     const consentFile = join(gitDir, ".egregore-branch-consent");

package/runtime/pi/.pi/spec-manifest.json

@@ -1,8 +1,8 @@
 {
   "generatedBy": "bin/pi-render-spec.mjs",
   "source": "AGENTS.md generated Codex spec",
-  "sourceHash": "02c4d2d275db",
-  "outputHash": "dc9d961b8ce2",
+  "sourceHash": "72d7c3986402",
+  "outputHash": "ac3aab4c039b",
   "adaptations": [
     "Pi project trust and APPEND_SYSTEM delivery",
     "Pi tool_call branch gate",

package/runtime/pi/AGENTS.md

@@ -14,6 +14,12 @@
 > `.pi/APPEND_SYSTEM.md`, and your workflows are exposed through the
 > project-local `.pi/` runtime. Do not follow the Codex-specific block below.
 >
+> **If you are Prime Agent** (the `prime-agent` harness): **stop here.** Your
+> authoritative Egregore instructions are loaded from
+> `.prime/agent/APPEND_SYSTEM.md`, and your workflows are exposed through the
+> project-local `.prime/agent/` runtime. Do not follow the Codex-specific
+> block below.
+>
 > **If you are Codex or another shell-only agent:** this file is yours — continue.
 
 Egregore is no longer only a Claude Code workspace. Claude Code remains the
@@ -395,7 +401,7 @@ Invoke commands from user intent — don't wait for the slash. Each command file
 **Knowledge** — `$search` `$deep-reflect` `$archive` `$note` `$add` `$meeting` `$ingest` `$scroll` `$mock` `$audit`
 **Identity** — `$me` (view profile or set display name)
 **Coordination** — `$ask` `$quest` `$issue` `$invite` `$delete-user` `$announce`
-**Connectors** — `$notion-connect` (Notion workspace) `$telegram-connect` (Telegram group setup) `$teams-connect` (Microsoft Teams channel setup)
+**Connectors** — `$notion-connect` (Notion workspace) `$telegram-connect` (Telegram group setup) `$teams-connect` (Microsoft Teams channel setup) `$slack-connect` (Slack channel setup)
 **Git** — `$branch` `$commit` `$push` `$pr` `$save` `$review-pr` `$contribute`
 **Spirits** — `$summon` (persistent agent processes)
 **Skills** — `$create-skill` (org-owned skill: scaffold, protect from updates, share)
@@ -411,7 +417,7 @@ Invoke commands from user intent — don't wait for the slash. Each command file
 - Tasks: `$todo` (personal) · `$quest` (team exploration) · `$issue` (something broken)
 - Questions: `$ask [person]` (async) · just ask (agent answers from context)
 - Ingestion: `$ingest <file-or-folder>` (org-scoped corpus intake) · `$ingest meeting` · `$ingest user-interview` · `$ingest google` · ambiguous → ask which type
-- Connectors: `$notion-connect` (Notion workspace) · `$telegram-connect` (Telegram group) · `$teams-connect` (MS Teams channel) · `$ingest` (bring content in) · `$ingest notion` (promote Notion docs)
+- Connectors: `$notion-connect` (Notion workspace) · `$telegram-connect` (Telegram group) · `$teams-connect` (MS Teams channel) · `$slack-connect` (Slack channel) · `$ingest` (bring content in) · `$ingest notion` (promote Notion docs)
 - Identity: `$me` — "who am I", "call me oz"
 - People: `$invite` (add) · `$delete-user` (remove)
 - PRs: `$pr` (create) · `$review-pr` (review)
@@ -451,8 +457,9 @@ Egregore runs in one of two configurations, set by `mode` in `egregore.json`. De
 
 **Hard rules in local mode:**
 - Never tell the user to "ask their admin" for credentials. The user IS the admin.
-- Never surface `api_url`, `EGREGORE_API_KEY`, or "connected mode" as an upgrade path. Hosted Egregore is a separate service, not something a user can turn on by adding fields to `egregore.json`.
-- If a feature genuinely requires the hosted service, say so plainly ("this isn't available in this configuration") and stop. Do not improvise a path to enabling it.
+- Never surface `api_url`, `EGREGORE_API_KEY`, or config edits as an upgrade path. Hosted Egregore is not something a user can turn on by adding fields to `egregore.json`.
+- **The one sanctioned upgrade path is `egregore connect`** (the launcher flow: registers the org, provisions the key, replays the graph). Connect-tier connector skills carry an explicit upsell gate for local instances — deliver their message verbatim, offer the upgrade via `egregore connect` or a clean "not now", and stop on decline. Beyond that gate, do not improvise: no hand-set `api_url`, no partial flows.
+- If a feature requires the hosted service and has no upsell gate, say so plainly ("this isn't available in this configuration") and stop.
 - Calling `bin/graph.sh` or `bin/notify.sh` in local mode is harmless — they fail soft and return empty results — but there is no need to call them; prefer reading `memory/` directly.
 
 **Connected mode** (`"mode": "connected"`, `api_url` set) — the hosted configuration, used by organizations on the hosted service. Full feature set: Neo4j knowledge graph via `bin/graph.sh`, Telegram notifications via `bin/notify.sh`, dashboard publication, API-backed context gathering on session start. Use `$env` to check API key, `$checkup` for diagnostics. If the graph is offline, show troubleshooting.

package/runtime/pi/bin/activity-data.sh

@@ -76,15 +76,11 @@ API_PID=$!
 
 # Git/disk: runs in parallel (stays client-side)
 (
-  # Sync
+  # Refresh remote refs only. A data read must never mutate the working
+  # branch: the rebase this block used to run rewrote users' task branches as
+  # a side effect of /activity (observed rewinding a pushed branch mid-session).
+  # Workspace sync belongs to agent.sh sync / the session-start path.
   git -C "$SCRIPT_DIR" fetch origin --quiet 2>/dev/null || true
-  CURRENT=$(git -C "$SCRIPT_DIR" branch --show-current 2>/dev/null || echo "unknown")
-  if [ "$CURRENT" != "develop" ]; then
-    git -C "$SCRIPT_DIR" fetch origin develop:develop --quiet 2>/dev/null || true
-  fi
-  if [[ "$CURRENT" == dev/* ]]; then
-    git -C "$SCRIPT_DIR" rebase develop --quiet >/dev/null 2>&1 || git -C "$SCRIPT_DIR" rebase --abort >/dev/null 2>&1 || true
-  fi
 
   # Memory sync
   if [ -d "$SCRIPT_DIR/memory/.git" ] || [ -L "$SCRIPT_DIR/memory" ]; then

package/runtime/pi/bin/attendant.sh

@@ -99,6 +99,16 @@ _trigger_auto_thread() {
   ) >> "$LOGFILE" 2>&1 &
 }
 
+# Personal off switch for ambient capture. ripcord_enabled=false disables BOTH
+# ripcord notes and auto-push of dirty worktrees — a user who opts out of
+# ambient capture must not find silent commits either. The attendant's other
+# duties (graph cache, context seed, handoff lifecycle) are unaffected.
+# NOTE: jq's `//` treats false as empty (the auto_update:false gotcha), so the
+# test compares the raw value, never `.key // true`.
+_capture_enabled() {
+  [ "$(jq -r '.ripcord_enabled' "$MAIN_DIR/.egregore-state.json" 2>/dev/null)" != "false" ]
+}
+
 _author() {
   local a
   a=$(jq -r '.github_username // empty' "$MAIN_DIR/.egregore-state.json" 2>/dev/null)
@@ -249,6 +259,8 @@ _ripcord() {
   local transcript="$1" base author date_ym date_d slug topic file prompts gitsum
   base=$(basename "$transcript" .jsonl)
 
+  _capture_enabled || return 0
+
   grep -q "$base" "$JOURNAL" 2>/dev/null && return 0
   # Session already ended with ceremony? Then the attendant has no business
   # here. Scan only the tail — a session that merely *read* the /handoff or
@@ -336,6 +348,7 @@ _ripcord() {
 # --- Auto-push -------------------------------------------------------------
 
 _auto_push() {
+  _capture_enabled || return 0
   local wt branch dirty ahead upstream
   git -C "$MAIN_DIR" worktree list --porcelain 2>/dev/null | awk '/^worktree /{print $2}' | while read -r wt; do
     branch=$(git -C "$wt" branch --show-current 2>/dev/null)

package/runtime/pi/bin/autosave.sh

@@ -28,6 +28,17 @@ set -uo pipefail
 SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
 STATE_FILE="$SCRIPT_DIR/.egregore-state.json"
 
+# The attendant runs against the MAIN checkout and reads its state file, so
+# ambient-capture settings must be written there — a worktree keeps its own
+# copy, and writing the flag into it would silently do nothing.
+MAIN_STATE_DIR="$SCRIPT_DIR"
+if [ -f "$SCRIPT_DIR/.git" ]; then
+  _WT_GITDIR=$(sed 's/^gitdir: //' "$SCRIPT_DIR/.git" 2>/dev/null || true)
+  [ -n "$_WT_GITDIR" ] && MAIN_STATE_DIR=$(cd "$_WT_GITDIR/../../.." 2>/dev/null && pwd || echo "$SCRIPT_DIR")
+fi
+MAIN_STATE_FILE="$MAIN_STATE_DIR/.egregore-state.json"
+[ -f "$MAIN_STATE_FILE" ] || MAIN_STATE_FILE="$STATE_FILE"
+
 [ -f "$STATE_FILE" ] || echo '{}' > "$STATE_FILE"
 
 # NB: jq's `//` swallows false — status would show "on" for enabled:false.
@@ -42,6 +53,11 @@ set_key() { # key value(json-encoded)
   jq ".$1 = $2" "$STATE_FILE" > "$STATE_FILE.tmp" && mv "$STATE_FILE.tmp" "$STATE_FILE"
 }
 
+_set_main() { # key value(json-encoded) — writes where the attendant reads
+  jq ".$1 = $2" "$MAIN_STATE_FILE" > "$MAIN_STATE_FILE.tmp" \
+    && mv "$MAIN_STATE_FILE.tmp" "$MAIN_STATE_FILE"
+}
+
 status() {
   local enabled scope publish
   enabled=$(get '.autosave_enabled' 'false')
@@ -50,6 +66,7 @@ status() {
   echo "autosave: $([ "$enabled" = "true" ] && echo on || echo "off (opt-in — 'autosave on' to join the experiment)")"
   echo "scope:    $scope  (all = handoffs + artifacts + docs · handoffs = memory repo only)"
   echo "publish:  $publish  (gate = PRs wait for your merge · auto = merge to develop automatically)"
+  echo "ripcord:  $(jq -r 'if (.ripcord_enabled != null) then (.ripcord_enabled|tostring) else "true" end' "$MAIN_STATE_FILE" 2>/dev/null || echo true)  (crash-recovery notes + branch auto-push when a session dies without /wrap)"
 }
 
 case "${1:-status}" in
@@ -61,6 +78,15 @@ case "${1:-status}" in
       all|handoffs) set_key autosave_scope "\"$2\"" && echo "scope: $2" ;;
       *) echo "usage: autosave.sh scope all|handoffs" >&2; exit 2 ;;
     esac ;;
+  ripcord)
+    # Ambient crash-recovery capture (the attendant): ripcord notes AND
+    # auto-push of dirty task branches. Separate from the autosave
+    # experiment above — this one defaults ON.
+    case "${2:-}" in
+      on)  _set_main ripcord_enabled true  && echo "ripcord: on — dead sessions leave a recovery note" ;;
+      off) _set_main ripcord_enabled false && echo "ripcord: off — no ambient notes, no branch auto-push" ;;
+      *) echo "usage: autosave.sh ripcord on|off" >&2; exit 2 ;;
+    esac ;;
   publish)
     case "${2:-}" in
       gate|auto) set_key autosave_publish "\"$2\"" && echo "publish: $2" ;;
@@ -82,5 +108,5 @@ case "${1:-status}" in
         echo "✗ PR #$n did not merge (conflict with develop?) — it stays open"
       fi
     done ;;
-  *) echo "usage: autosave.sh [status|on|off|scope all|handoffs|publish gate|auto|merge]" >&2; exit 2 ;;
+  *) echo "usage: autosave.sh [status|on|off|scope all|handoffs|publish gate|auto|merge|ripcord on|off]" >&2; exit 2 ;;
 esac