create-egregore 0.19.33 → 0.20.0

package/runtime/pi/bin/codex-render-spec.mjs

@@ -58,6 +58,12 @@ const AGENTS_PREAMBLE = `# Egregore Agent Protocol
 > \`.pi/APPEND_SYSTEM.md\`, and your workflows are exposed through the
 > project-local \`.pi/\` runtime. Do not follow the Codex-specific block below.
 >
+> **If you are Prime Agent** (the \`prime-agent\` harness): **stop here.** Your
+> authoritative Egregore instructions are loaded from
+> \`.prime/agent/APPEND_SYSTEM.md\`, and your workflows are exposed through the
+> project-local \`.prime/agent/\` runtime. Do not follow the Codex-specific
+> block below.
+>
 > **If you are Codex or another shell-only agent:** this file is yours — continue.
 
 Egregore is no longer only a Claude Code workspace. Claude Code remains the

package/runtime/pi/bin/codex-session-start.sh

@@ -210,7 +210,9 @@ render_card() {
 
   # Staged auto-saves awaiting the user's merge (the autosave consent gate).
   # Live gh query so the line persists until the PRs actually merge.
-  if command -v gh >/dev/null 2>&1; then
+  # Shown only while the autosave experiment is enabled.
+  autosave_on=$(jq -r '.autosave_enabled // false' "$STATE_FILE" 2>/dev/null)
+  if [ "$autosave_on" = "true" ] && command -v gh >/dev/null 2>&1; then
     gh_self=$(jq -r '.github_username // empty' "$STATE_FILE" 2>/dev/null)
     if [ -n "$gh_self" ]; then
       waiting_as=$(gh pr list --state open --author "$gh_self" --limit 20 \

package/runtime/pi/bin/graph-batch.sh

@@ -24,21 +24,40 @@ if [ "$_MODE" = "local" ]; then
   exit 0
 fi
 
-# Load specific variables from .env if it exists (safe extraction, no arbitrary code execution)
-if [ -f "$SCRIPT_DIR/.env" ]; then
-  EGREGORE_API_URL="${EGREGORE_API_URL:-$(grep '^EGREGORE_API_URL=' "$SCRIPT_DIR/.env" 2>/dev/null | cut -d'=' -f2- || true)}"
-  EGREGORE_API_KEY="${EGREGORE_API_KEY:-$(grep '^EGREGORE_API_KEY=' "$SCRIPT_DIR/.env" 2>/dev/null | cut -d'=' -f2- || true)}"
+# Load specific variables from .env if it exists (safe extraction, no arbitrary code execution).
+# A worktree missing its .env symlink resolves through worktree-links.sh, which
+# self-heals the link and falls back to the main checkout's .env.
+_ENV_FILE="$SCRIPT_DIR/.env"
+if [ ! -f "$_ENV_FILE" ] && [ -f "$SCRIPT_DIR/bin/lib/worktree-links.sh" ]; then
+  # shellcheck source=bin/lib/worktree-links.sh
+  source "$SCRIPT_DIR/bin/lib/worktree-links.sh" 2>/dev/null || true
+  _ENV_FILE="$(egregore_env_file "$SCRIPT_DIR" 2>/dev/null || true)"
+fi
+if [ -n "$_ENV_FILE" ] && [ -f "$_ENV_FILE" ]; then
+  EGREGORE_API_URL="${EGREGORE_API_URL:-$(grep '^EGREGORE_API_URL=' "$_ENV_FILE" 2>/dev/null | cut -d'=' -f2- || true)}"
+  EGREGORE_API_KEY="${EGREGORE_API_KEY:-$(grep '^EGREGORE_API_KEY=' "$_ENV_FILE" 2>/dev/null | cut -d'=' -f2- || true)}"
 fi
 
 API_URL="${EGREGORE_API_URL:-$(jq -r '.api_url // empty' "$CONFIG")}"
 API_KEY="${EGREGORE_API_KEY:-}"
 
-if [ -z "$API_URL" ] || [ -z "$API_KEY" ]; then
-  # === OFFLINE MODE: No API key — return empty results (OSS/local) ===
+if [ -z "$API_URL" ]; then
+  # === OFFLINE MODE: no api_url configured (OSS/unconfigured) ===
   echo '{"results":[]}'
   exit 0
 fi
 
+if [ -z "$API_KEY" ]; then
+  # api_url is configured but no key was found — the local-mode gate exited
+  # above, so the org expects a live graph. Faking empty results here hides a
+  # missing .env (e.g. a worktree without its symlink) from every caller.
+  {
+    echo "Error: api_url is configured but EGREGORE_API_KEY is empty (looked in: ${_ENV_FILE:-$SCRIPT_DIR/.env})."
+    echo "  If this is a worktree, its .env symlink may be missing. Run /env to configure."
+  } >&2
+  exit 1
+fi
+
 QUERIES_JSON="${1:?Usage: graph-batch.sh '<json array of queries>'}"
 
 # Wrap the array into the batch request format

package/runtime/pi/bin/graph-op.sh

@@ -708,7 +708,8 @@ case "$OP" in
     fi
     bash "$GS" query "
       MATCH (s:Session)-[:HANDED_TO]->(p:Person)
-      WHERE (
+      WHERE NOT coalesce(p.kind, '') IN ['identity_alias']
+        AND (
         toLower(coalesce(p.name, '')) = toLower(\$user)
         OR toLower(coalesce(p.github, '')) = toLower(\$user)
         OR toLower(coalesce(p.githubUsername, '')) = toLower(\$user)
@@ -718,13 +719,13 @@ case "$OP" in
         AND coalesce(s.handoffStatus, 'pending')
             IN ['pending','unread','read','claimed']
       WITH DISTINCT s
-      OPTIONAL MATCH (s)-[:BY]->(author:Person)
-      WITH s, author,
+      WITH s, head([(s)-[:BY]->(author:Person)
+                    WHERE NOT coalesce(author.kind, '') IN ['identity_alias'] | author.name]) AS authorName,
            CASE WHEN s.date IS NULL THEN null
                 ELSE duration.inDays(date(s.date), date()).days END AS ageDays
       RETURN s.id AS id,
              coalesce(s.topic, s.summary, s.branch) AS topic,
-             coalesce(author.name, s.author, 'unknown') AS author,
+             coalesce(authorName, s.author, 'unknown') AS author,
              toString(s.date) AS date,
              coalesce(s.handoffStatus, 'pending') AS status,
              coalesce(s.handoffIntent, 'unclassified') AS intent,

package/runtime/pi/bin/graph.sh

@@ -21,10 +21,18 @@ if [ "$_MODE" = "local" ]; then
   exit 0
 fi
 
-# Load specific variables from .env if it exists (safe extraction, no arbitrary code execution)
-if [ -f "$SCRIPT_DIR/.env" ]; then
-  EGREGORE_API_URL="${EGREGORE_API_URL:-$(grep '^EGREGORE_API_URL=' "$SCRIPT_DIR/.env" 2>/dev/null | cut -d'=' -f2- || true)}"
-  EGREGORE_API_KEY="${EGREGORE_API_KEY:-$(grep '^EGREGORE_API_KEY=' "$SCRIPT_DIR/.env" 2>/dev/null | cut -d'=' -f2- || true)}"
+# Load specific variables from .env if it exists (safe extraction, no arbitrary code execution).
+# A worktree missing its .env symlink resolves through worktree-links.sh, which
+# self-heals the link and falls back to the main checkout's .env.
+_ENV_FILE="$SCRIPT_DIR/.env"
+if [ ! -f "$_ENV_FILE" ] && [ -f "$SCRIPT_DIR/bin/lib/worktree-links.sh" ]; then
+  # shellcheck source=bin/lib/worktree-links.sh
+  source "$SCRIPT_DIR/bin/lib/worktree-links.sh" 2>/dev/null || true
+  _ENV_FILE="$(egregore_env_file "$SCRIPT_DIR" 2>/dev/null || true)"
+fi
+if [ -n "$_ENV_FILE" ] && [ -f "$_ENV_FILE" ]; then
+  EGREGORE_API_URL="${EGREGORE_API_URL:-$(grep '^EGREGORE_API_URL=' "$_ENV_FILE" 2>/dev/null | cut -d'=' -f2- || true)}"
+  EGREGORE_API_KEY="${EGREGORE_API_KEY:-$(grep '^EGREGORE_API_KEY=' "$_ENV_FILE" 2>/dev/null | cut -d'=' -f2- || true)}"
 fi
 
 # api_url comes from egregore.json (committed, non-secret)
@@ -168,8 +176,26 @@ if [ -n "$API_URL" ] && [ -n "$API_KEY" ]; then
     fi
   }
 
+elif [ -n "$API_URL" ]; then
+  # === CONNECTED CONFIG, MISSING KEY ===
+  # api_url is configured, so the org expects a live graph, but no API key was
+  # found. Faking '{"results":[]}' here made a missing credential (e.g. a
+  # worktree without its .env symlink) indistinguishable from an empty graph —
+  # fail loudly instead. `test` keeps its offline JSON contract: dashboards,
+  # render-card, and startup-check consume it.
+  _missing_credentials() {
+    {
+      echo "Error: api_url is configured but EGREGORE_API_KEY is empty (looked in: ${_ENV_FILE:-$SCRIPT_DIR/.env})."
+      echo "  If this is a worktree, its .env symlink may be missing. Run /env to configure."
+    } >&2
+    exit 1
+  }
+  run_query() { _missing_credentials; }
+  get_schema() { _missing_credentials; }
+  test_connection() { echo '{"status":"offline","reason":"no_api_key"}'; }
+
 else
-  # === OFFLINE MODE: No API key — return empty results (OSS/local) ===
+  # === OFFLINE MODE: no api_url configured (OSS/unconfigured) ===
   run_query() { echo '{"results":[]}'; }
   get_schema() { echo '{}'; }
   test_connection() { echo '{"status":"offline","reason":"no_api_key"}'; }

package/runtime/pi/bin/ingest.py

@@ -23,10 +23,12 @@ from datetime import datetime, timezone
 from pathlib import Path
 from xml.etree import ElementTree
 
-sys.path.insert(0, str(Path(__file__).resolve().parent))
+sys.path.append(str(Path(__file__).resolve().parent))
+import catalogue as catalogue_module  # noqa: E402
 import doc_segment  # noqa: E402  (same-directory module, path set above)
 import pdf_extract  # noqa: E402
 import source_profile  # noqa: E402
+import text_repair  # noqa: E402
 
 
 ROOT = Path(__file__).resolve().parent.parent
@@ -152,6 +154,35 @@ def chunks(text: str, limit: int = 7000) -> list[str]:
     return result
 
 
+def find_publisher_profile() -> Path | None:
+    """Where this instance's publisher profile is, if it has one.
+
+    The profile is what assigns a zone and a trust tier to each document, and
+    zone is a hard retrieval boundary. Ingesting without it produces a corpus
+    where every document is unplaced, so every later question is refused — a
+    failure that looks like an empty archive rather than a missing setting.
+
+    So this looks in the places a profile actually lives rather than in one
+    fixed path. An instance keeps its ontology under memory/knowledge/tools/,
+    not beside its intake metadata, and requiring an environment variable to
+    bridge that gap means the common case is the broken one.
+    """
+    override = os.environ.get("EGREGORE_PUBLISHER_PROFILE")
+    if override:
+        path = Path(override)
+        return path if path.is_file() else None
+
+    candidates = [metadata_root() / "publisher-profile.json"]
+    memory = Path("memory")
+    if memory.is_dir():
+        candidates.extend(sorted(memory.glob("knowledge/tools/*/publisher-profile.json")))
+        candidates.append(memory / "publisher-profile.json")
+    for path in candidates:
+        if path.is_file():
+            return path
+    return None
+
+
 def publisher_profile() -> dict | None:
     """Load the instance's publisher profile, if one is configured.
 
@@ -159,9 +190,8 @@ def publisher_profile() -> dict | None:
     operator set: deriving a region is an inference, and an inference must not
     silently replace a stated fact.
     """
-    override = os.environ.get("EGREGORE_PUBLISHER_PROFILE")
-    path = Path(override) if override else (metadata_root() / "publisher-profile.json")
-    if not path.is_file():
+    path = find_publisher_profile()
+    if path is None:
         return None
     try:
         return json.loads(path.read_text(encoding="utf-8"))
@@ -223,7 +253,19 @@ def add_path(args: argparse.Namespace) -> dict:
     existing_manifest = load_manifest(directory)
     previous = {d["id"]: d for d in existing_manifest.get("documents", [])}
     now = datetime.now(timezone.utc).isoformat()
+    profile_path = find_publisher_profile()
     profile = publisher_profile()
+    if profile is None:
+        # Said once, plainly, because the alternative is a corpus that ingests
+        # cleanly and then refuses every question with no indication why.
+        print("ingest: no publisher-profile.json found — documents will carry no zone "
+              "or trust tier, and a zoneless document can never be served. Put one "
+              "under memory/knowledge/tools/<ontology>/ or set "
+              "EGREGORE_PUBLISHER_PROFILE.", file=sys.stderr)
+    catalogue = catalogue_module.load(
+        profile or {}, base=profile_path.parent if profile_path else None
+    )
+    repair_map = text_repair.load_mapping(profile or {})
     ingested = unchanged = metadata_updated = skipped = pruned = 0
     errors: list[dict] = []
     seen_paths: set[str] = set()
@@ -252,6 +294,15 @@ def add_path(args: argparse.Namespace) -> dict:
             extraction = {"kind": "local", "extractor": extractor} if extractor else None
             if extraction and detail:
                 extraction["pages"] = detail
+        # Fix characters the document's own font encoding got wrong, before
+        # anything downstream indexes or quotes them.
+        repaired = None
+        if text and repair_map:
+            outcome = text_repair.repair(text, repair_map)
+            if outcome.replaced:
+                text = outcome.text
+                repaired = outcome.as_report()
+
         if error or text is None or not text.strip():
             skipped += 1
             errors.append({"path": relative, "error": error or "empty extracted text"})
@@ -283,6 +334,9 @@ def add_path(args: argparse.Namespace) -> dict:
             continue
         # Segment before chunking so no passage straddles two works. A document
         # holding a single work yields one segment, and chunking is unchanged.
+        if repaired and extraction:
+            extraction["repair"] = repaired
+
         segments = doc_segment.segment(text)
         document_chunks: list[tuple[str, doc_segment.Segment]] = []
         for seg in segments:
@@ -314,12 +368,34 @@ def add_path(args: argparse.Namespace) -> dict:
         # is absent filters nothing. A derived value is marked as derived: anything
         # downstream can tell it apart from one a person stated, and weigh it by the
         # confidence recorded alongside. An operator's value is never overwritten.
+        # Evidence strongest first: what the operator stated, then what the
+        # organisation's own catalogue records, then what can be inferred from
+        # the document's origin. A weaker source never overwrites a stronger one.
         provenance = None
         doc_boundaries = dict(boundaries)
+        catalogued = catalogue_module.lookup(catalogue, relative)
+
+        if catalogued:
+            provenance = {"from_catalogue": {k: v for k, v in catalogued.items()}}
+            for field_name, value in catalogued.items():
+                if field_name in ("zone", "crop", "topic", "customer", "jurisdiction", "project"):
+                    if field_name not in doc_boundaries:
+                        doc_boundaries[field_name] = value
+                        provenance["applied_boundary"] = field_name
+            if catalogued.get("year"):
+                structure.setdefault("publication_year", catalogued["year"])
+                structure["year_source"] = structure.get("year_source") or "catalogue"
+            if catalogued.get("tier"):
+                provenance["tier"] = catalogued["tier"]
+            provenance["confidence"] = "high"
+
         if profile:
             resolved = source_profile.resolve(profile, filename=relative)
             if resolved.publisher_class or resolved.notes:
-                provenance = resolved.as_dict()
+                inferred = resolved.as_dict()
+                # Keep the inference visible even when the catalogue answered,
+                # so a disagreement between the two is inspectable.
+                provenance = {**inferred, **(provenance or {})} if provenance else inferred
             key = source_profile.boundary_key(profile)
             if key and resolved.zone and key not in doc_boundaries:
                 doc_boundaries[key] = resolved.zone

package/runtime/pi/bin/lib/context.sh

@@ -370,6 +370,29 @@ fi
   JSON="[]"
   RICH="[]"
   if [ -d "$SCRIPT_DIR/memory/handoffs" ]; then
+    # One definition everywhere: in connected mode the list comes from the
+    # graph's open-handoffs named read (open = pending/unread/read/claimed,
+    # matched by name/github/aliases) — the same definition the dashboard
+    # uses. The file grep below stays as the local-mode/offline fallback.
+    ADDRESSED=""
+    if [ "${LOCAL_MODE:-false}" != "true" ]; then
+      _GRAPH_LIST=$(bash "$SCRIPT_DIR/bin/graph-op.sh" open-handoffs "$AUTHOR" 5 2>/dev/null || true)
+      if echo "$_GRAPH_LIST" | jq -e '.values | length > 0' >/dev/null 2>&1; then
+        ADDRESSED=$(echo "$_GRAPH_LIST" | jq -r '.values[][0]' 2>/dev/null | awk '!seen[$0]++' | while IFS= read -r _SID; do
+          # Two on-disk layouts: dated subdirs (YYYY-MM/DD-slug.md, the id's
+          # own shape) and flat files at the handoffs root. Probe both, else
+          # a graph-listed handoff silently vanishes from the greeting.
+          _MONTH="${_SID:0:7}"
+          _REST="${_SID:8}"
+          _F="$SCRIPT_DIR/memory/handoffs/$_MONTH/$_REST.md"
+          if [ -f "$_F" ]; then
+            echo "$_F"
+          elif [ -f "$SCRIPT_DIR/memory/handoffs/$_SID.md" ]; then
+            echo "$SCRIPT_DIR/memory/handoffs/$_SID.md"
+          fi
+        done | head -5)
+      fi
+    fi
     # Match github username, display name, github_name first word, and people-file name
     # Handoff files may use "to: name", "**To**: name", or "To: name"
     _DISPLAY=$(jq -r '.display_name // empty' "$STATE_FILE" 2>/dev/null)
@@ -387,7 +410,9 @@ fi
       echo "$_GREP_PAT" | grep -qF "$_VARIANT" && continue
       _GREP_PAT="$_GREP_PAT\|[Tt]o[*]*: *$_VARIANT\|[Tt]o[*]*:$_VARIANT"
     done
-    ADDRESSED=$(grep -rli "$_GREP_PAT" "$SCRIPT_DIR/memory/handoffs/" 2>/dev/null | sort -r | head -5 || true)
+    if [ -z "$ADDRESSED" ]; then
+      ADDRESSED=$(grep -rli "$_GREP_PAT" "$SCRIPT_DIR/memory/handoffs/" 2>/dev/null | sort -r | head -5 || true)
+    fi
     JSON="["
     RICH="["
     FIRST=true

package/runtime/pi/bin/lib/greeting.sh

@@ -188,7 +188,10 @@ fi
 # Staged auto-saves awaiting the user's merge (the /autosave consent gate).
 # Live gh query so the line persists until the PRs actually merge — the
 # ledger cursor above only reports once. Fail-soft when gh/network is out.
-if command -v gh >/dev/null 2>&1; then
+# Shown only while the autosave experiment is enabled: stale PRs from a
+# disabled experiment should not nag every greeting.
+AUTOSAVE_ON=$(jq -r '.autosave_enabled // false' "$STATE_FILE" 2>/dev/null)
+if [ "$AUTOSAVE_ON" = "true" ] && command -v gh >/dev/null 2>&1; then
   GH_SELF=$(jq -r '.github_username // empty' "$STATE_FILE" 2>/dev/null)
   if [ -n "$GH_SELF" ]; then
     WAITING_AS=$(gh pr list --state open --author "$GH_SELF" --limit 20 \

package/runtime/pi/bin/lib/worktree-links.sh

@@ -52,3 +52,28 @@ egregore_link_shared_state() {
     fi
   done
 }
+
+# Resolve the .env that governs a checkout. A worktree can be missing its .env
+# symlink (created before .env existed, or by a runtime that skipped worktree
+# setup) — self-heal the links, then fall back to the main checkout's .env so
+# credential loading never silently comes up empty. Prints the usable path, or
+# nothing when neither checkout has one. Always returns 0.
+egregore_env_file() {
+  local project_dir="${1:?project dir required}"
+  if [ ! -f "$project_dir/.env" ] && [ -f "$project_dir/.git" ]; then
+    egregore_link_shared_state "$project_dir" 2>/dev/null || true
+  fi
+  if [ -f "$project_dir/.env" ]; then
+    echo "$project_dir/.env"
+    return 0
+  fi
+  if [ -f "$project_dir/.git" ]; then
+    local main_dir
+    main_dir="$(egregore_main_project_dir "$project_dir" 2>/dev/null || true)"
+    if [ -n "$main_dir" ] && [ -f "$main_dir/.env" ]; then
+      echo "$main_dir/.env"
+      return 0
+    fi
+  fi
+  return 0
+}

package/runtime/pi/bin/pi-branch-policy.mjs

@@ -1,7 +1,11 @@
 import { isAbsolute, relative, resolve } from "node:path";
 
 const MUTATING_COMMANDS = /(^|[;&|]\s*)(?:sudo\s+)?(rm|mv|cp|mkdir|rmdir|touch|chmod|chown|install|tee)\b/;
-const MUTATING_GIT = /(^|[;&|]\s*)(?:sudo\s+)?git\s+(add|commit|push|merge|rebase|cherry-pick|tag|rm|mv)\b/;
+// Global options (-C <path>, -c k=v, --git-dir=…) may sit between `git` and
+// the subcommand. The repo convention actively teaches `git -C <abs-path>`,
+// so a classifier that only matches bare `git commit` misses the shape the
+// model is most likely to emit.
+const MUTATING_GIT = /(^|[;&|]\s*)(?:sudo\s+)?git\s+(?:(?:-C|-c|--git-dir|--work-tree)(?:=\S+|\s+\S+)\s+)*(add|commit|push|merge|rebase|cherry-pick|tag|rm|mv|reset|restore|clean)\b/;
 const MUTATING_PACKAGES = /(^|[;&|]\s*)(?:sudo\s+)?(npm|pnpm|yarn|bun)\s+(install|add|remove|uninstall|update)\b/;
 
 // A `>` only acts as a shell redirect when it sits OUTSIDE quotes. Quoted
@@ -112,6 +116,7 @@ export function isRuntimeStatePath(target, projectDir) {
     rel === ".claude" || rel.startsWith(".claude/") ||
     rel === ".codex" || rel.startsWith(".codex/") ||
     rel === ".pi" || rel.startsWith(".pi/") ||
+    rel === ".prime" || rel.startsWith(".prime/") ||
     rel === ".egregore-state.json" ||
     rel === ".egregore-branch-consent" ||
     rel === ".env";
@@ -162,6 +167,20 @@ export function mutatesOnlyRuntimeState(command, projectDir) {
   return foundTarget;
 }
 
+// The documented escape hatch must itself be runnable, but ONLY as the whole
+// command: an unanchored match lets `git push origin develop && echo 'develop'
+// > .egregore-branch-consent` pass the gate in one call, and the block message
+// teaches that exact echo string. Canonical form mirrors
+// .codex/hooks/branch-guard.js isConsentCommand — anchored, branch escaped,
+// optional ./ prefix — and is shared so the three runtimes cannot drift.
+export function isConsentCommand(command, branch) {
+  if (!branch) return false;
+  const escaped = String(branch).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(
+    `^\\s*echo\\s+['"]?${escaped}['"]?\\s*>\\s*(?:\\./)?\\.egregore-branch-consent\\s*$`
+  ).test(String(command || ""));
+}
+
 export function isMutatingBash(command) {
   if (!command) return false;
   const meaningfulRedirects = stripQuotedSegments(String(command))
@@ -173,3 +192,121 @@ export function isMutatingBash(command) {
     /(^|[^<])>>?\s*[^&]/.test(meaningfulRedirects) ||
     /\bsed\s+[^\n]*\s-i(?:\s|$)/.test(command);
 }
+
+// ---- IPython code classification (Prime Agent) -----------------------------
+// Prime Agent's default tool surface is a persistent IPython kernel: file
+// writes and shell escapes arrive as Python code, not bash tool calls. This
+// classifier is deliberately static and therefore porous (exec/eval and
+// string-built commands pass); the generated runtime spec carries the
+// standing-instruction discipline as the backstop, and the adversarial test
+// fixtures pin what this actually catches.
+
+// Strip Python string literals so call-name detection ignores docstrings and
+// string content. Triple quotes first, then single-line quotes; f-string
+// prefixes fall out naturally because only the quoted part is replaced.
+function stripPythonStrings(code) {
+  return String(code)
+    .replace(/[rbuf]{0,2}("""|''')[\s\S]*?\1/gi, '""')
+    .replace(/[rbuf]{0,2}"(?:\\.|[^"\\\n])*"/gi, '""')
+    .replace(/[rbuf]{0,2}'(?:\\.|[^'\\\n])*'/gi, "''");
+}
+
+function pythonShellCommands(code) {
+  const shell = [];
+  const lines = String(code).split("\n");
+  const first = (lines[0] || "").trim();
+  if (/^%%(bash|sh|script\s+(ba)?sh)\b/.test(first)) {
+    shell.push(lines.slice(1).join("\n"));
+    return { shell, rest: "" };
+  }
+  if (/^%%writefile\b/.test(first)) {
+    const target = first.replace(/^%%writefile\s+(-a\s+)?/, "").trim();
+    return { shell: [`tee ${target || "unknown-target"}`], rest: "" };
+  }
+  const rest = [];
+  for (const line of lines) {
+    const bang = line.match(/^\s*!(.+)$/);
+    const sysMagic = line.match(/^\s*%(?:system|sx)\s+(.+)$/);
+    if (bang) shell.push(bang[1]);
+    else if (sysMagic) shell.push(sysMagic[1]);
+    else rest.push(line);
+  }
+  return { shell, rest: rest.join("\n") };
+}
+
+const PY_MUTATING_CALLS =
+  /\b(?:os\.(?:remove|unlink|rename|replace|rmdir|removedirs|makedirs|mkdir|symlink|link|chmod|chown|truncate)|shutil\.(?:copy|copy2|copyfile|copytree|move|rmtree|make_archive|unpack_archive))\s*\(/;
+const PY_WRITE_METHODS = /\.\s*(?:write_text|write_bytes|unlink|touch|mkdir|rmdir|hardlink_to|symlink_to)\s*\(/;
+const PY_OPEN_WRITE =
+  /\bopen\s*\(\s*[^,]+,\s*(?:mode\s*=\s*)?['"](?:[wax]|r\+)[rwxab+]*['"]/;
+const PY_OPEN_MODE_KWARG = /\bopen\s*\([^)]*mode\s*=\s*['"](?:[wax]|r\+)[rwxab+]*['"]/;
+
+function pythonSubprocessArgv(code) {
+  const argvs = [];
+  const calls =
+    /\b(?:subprocess\.(?:run|call|check_call|check_output|Popen)|os\.system|os\.popen)\s*\(\s*(\[[^\]]*\]|[rbuf]{0,2}["'](?:\\.|[^"'\\\n])*["'])/g;
+  let match;
+  while ((match = calls.exec(String(code)))) {
+    const arg = match[1];
+    if (arg.startsWith("[")) {
+      const words = [...arg.matchAll(/["']((?:\\.|[^"'\\])*)["']/g)].map((m) => m[1]);
+      if (words.length) argvs.push(words.join(" "));
+    } else {
+      argvs.push(arg.replace(/^[rbuf]{0,2}["']/i, "").replace(/["']$/, ""));
+    }
+  }
+  return argvs;
+}
+
+// Classify IPython cell code. Returns true when the code statically performs a
+// repo mutation that should meet the protected-branch gate. Mutations that
+// target only Egregore runtime state (memory/, dot-dirs, consent files) are
+// exempt when the target is statically extractable, mirroring
+// mutatesOnlyRuntimeState for bash.
+export function isMutatingIpython(code, projectDir) {
+  if (!code) return false;
+  const { shell, rest } = pythonShellCommands(code);
+  for (const cmd of shell) {
+    if (isMutatingBash(cmd) && !(projectDir && mutatesOnlyRuntimeState(cmd, projectDir))) return true;
+  }
+  if (!rest) return false;
+
+  for (const argv of pythonSubprocessArgv(rest)) {
+    if (isMutatingBash(argv) && !(projectDir && mutatesOnlyRuntimeState(argv, projectDir))) return true;
+  }
+
+  const stripped = stripPythonStrings(rest);
+  if (PY_MUTATING_CALLS.test(stripped) || PY_WRITE_METHODS.test(stripped)) {
+    // Exempt when every extractable string target is runtime state. The
+    // mutated location differs by call: copy/move/rename mutate their LAST
+    // argument (the destination); remove/rmtree/mkdir mutate their first.
+    if (projectDir) {
+      const DEST_LAST = /^(?:copy|copy2|copyfile|copytree|move|rename|replace|symlink|link)$/;
+      const targets = [...String(rest).matchAll(
+        /\b(?:os|shutil)\.(\w+)\s*\(([^)]*)\)/g
+      )].flatMap((m) => {
+        const args = [...m[2].matchAll(/["']((?:\\.|[^"'\\])*)["']/g)].map((s) => s[1]);
+        if (!args.length) return [];
+        return [DEST_LAST.test(m[1]) ? args[args.length - 1] : args[0]];
+      });
+      const pathTargets = [...String(rest).matchAll(
+        /Path\s*\(\s*[rbuf]{0,2}["']((?:\\.|[^"'\\\n])*)["']\s*\)\s*\.\s*(?:write_text|write_bytes|unlink|touch|mkdir|rmdir)/g
+      )].map((m) => m[1]);
+      const all = [...targets, ...pathTargets];
+      if (all.length && all.every((t) => isRuntimeStatePath(t, projectDir))) return false;
+    }
+    return true;
+  }
+
+  if (PY_OPEN_WRITE.test(rest) || PY_OPEN_MODE_KWARG.test(rest)) {
+    if (projectDir) {
+      const openTargets = [...String(rest).matchAll(
+        /\bopen\s*\(\s*[rbuf]{0,2}["']((?:\\.|[^"'\\\n])*)["']\s*,\s*(?:mode\s*=\s*)?["'](?:[wax]|r\+)/g
+      )].map((m) => m[1]);
+      if (openTargets.length && openTargets.every((t) => isRuntimeStatePath(t, projectDir))) return false;
+    }
+    return true;
+  }
+
+  return false;
+}

package/runtime/pi/bin/pi-product-workflows.mjs

@@ -2,6 +2,7 @@
 
 import {
   existsSync,
+  mkdirSync,
   mkdtempSync,
   readFileSync,
   readdirSync,
@@ -141,12 +142,37 @@ export async function renderView(pi, root, request, signal) {
   return { text, file, type: request.type };
 }
 
-export async function renderGreeting(pi, root, signal) {
-  const script = join(root, "bin", "pi-session-start.sh");
-  if (!existsSync(script)) throw new Error("Pi startup renderer is missing");
+export async function renderGreeting(pi, root, signal, startScript = "pi-session-start.sh") {
+  const script = join(root, "bin", startScript);
+  if (!existsSync(script)) throw new Error("Egregore startup renderer is missing");
   return checkedExec(pi, "bash", [script, "--card"], { signal, timeout: 45000 }, "Egregore startup");
 }
 
+// Raw JSON from the most recent activity-data.sh run, so follow-up focus
+// turns can receive the data inline instead of re-running the script inside
+// a harness surface that may cap command time (Prime's kernel kills execs at
+// ~5s, truncating the 10-20s data script to a partial fragment).
+let lastActivityData = "";
+export function lastActivityJson() {
+  return lastActivityData;
+}
+
+// Stable on-disk copy of the same data. Focus turns point the model at this
+// path instead of an inline excerpt: a file read is one fast kernel call,
+// never truncated, and removes any reason to re-run the data script.
+export function activityDataPath(root) {
+  return join(root, ".egregore", "activity-data.json");
+}
+
+function persistActivityData(root, json) {
+  try {
+    mkdirSync(join(root, ".egregore"), { recursive: true });
+    writeFileSync(activityDataPath(root), json);
+  } catch {
+    // Cache only — rendering proceeds from memory when the disk write fails.
+  }
+}
+
 export async function renderActivity(pi, root, signal, options = {}) {
   if (options.sync !== false) {
     await checkedExec(
@@ -177,6 +203,8 @@ export async function renderActivity(pi, root, signal, options = {}) {
     { signal, timeout: 120000 },
     "Activity refresh",
   );
+  lastActivityData = String(json || "");
+  persistActivityData(root, lastActivityData);
   const temp = mkdtempSync(join(tmpdir(), "egregore-pi-activity-"));
   const input = join(temp, "activity.json");
   try {
@@ -276,7 +304,7 @@ export async function createHandoff(pi, root, params, signal) {
   }
 }
 
-export async function captureSessionEnd(pi, root, sessionFile, signal) {
+export async function captureSessionEnd(pi, root, sessionFile, signal, runtime = "pi") {
   const sessionIdFile = join(root, ".egregore-session-id");
   if (!existsSync(sessionIdFile)) return false;
   const sessionId = cleanArgs(readFileSync(sessionIdFile, "utf8"));
@@ -287,7 +315,7 @@ export async function captureSessionEnd(pi, root, sessionFile, signal) {
   writeFileSync(input, JSON.stringify({
     session_id: sessionId,
     transcript_path: cleanArgs(sessionFile),
-    runtime: "pi",
+    runtime,
   }));
 
   try {
@@ -353,11 +381,11 @@ export async function publishScroll(pi, root, params, signal) {
   };
 }
 
-export function workflowPrompt(name, args, extra = "") {
+export function workflowPrompt(name, args, extra = "", spec = { runtimeName: "Pi", specPath: ".pi/APPEND_SYSTEM.md" }) {
   const userArgs = cleanArgs(args);
   return [
     `Run the Egregore /${name} workflow now.`,
-    `Read .codex/skills/${name}/SKILL.md completely and adapt Codex-specific wording to Pi using .pi/APPEND_SYSTEM.md.`,
+    `Read .codex/skills/${name}/SKILL.md completely and adapt Codex-specific wording to ${spec.runtimeName} using ${spec.specPath}.`,
     "Work quietly: do not narrate progress, expose raw command output, or repeat tool results.",
     "Use the fewest targeted reads and commands that preserve the workflow contract.",
     userArgs ? `User arguments: ${userArgs}` : "",