create-egregore 0.19.33 → 0.20.1

package/runtime/pi/bin/ingest.py

@@ -23,10 +23,12 @@ from datetime import datetime, timezone
 from pathlib import Path
 from xml.etree import ElementTree
 
-sys.path.insert(0, str(Path(__file__).resolve().parent))
+sys.path.append(str(Path(__file__).resolve().parent))
+import catalogue as catalogue_module  # noqa: E402
 import doc_segment  # noqa: E402  (same-directory module, path set above)
 import pdf_extract  # noqa: E402
 import source_profile  # noqa: E402
+import text_repair  # noqa: E402
 
 
 ROOT = Path(__file__).resolve().parent.parent
@@ -152,6 +154,65 @@ def chunks(text: str, limit: int = 7000) -> list[str]:
     return result
 
 
+# Catalogue columns that carry provenance, by what they mean rather than by
+# what any one organisation calls them. A profile's `map` already renames its
+# own columns to these, so no further configuration is needed.
+CATALOGUE_URL_FIELDS = ("url", "source_url", "link")
+CATALOGUE_INSTITUTION_FIELDS = ("institution", "publisher", "source_type", "source")
+
+
+def catalogue_provenance(catalogued: dict) -> tuple:
+    """The URL and institution a catalogue records for a document.
+
+    The resolver has always accepted these and ranks both above a filename,
+    because a filename is what someone happened to save a file as. Ingest
+    passed only the filename, so the stronger evidence sitting in the row it
+    had just read went unused.
+
+    Measured on a real archive that was not a marginal loss. Seventy articles
+    downloaded from two journal indexes were saved under bare article titles,
+    carrying no publisher token to match. The profile had rules for both
+    indexes and the catalogue named the index for every one of them, and still
+    nothing matched — the one input that could have identified them was the one
+    input never passed.
+    """
+    if not catalogued:
+        return "", ""
+    url = next((str(catalogued[f]) for f in CATALOGUE_URL_FIELDS if catalogued.get(f)), "")
+    institution = next(
+        (str(catalogued[f]) for f in CATALOGUE_INSTITUTION_FIELDS if catalogued.get(f)), "")
+    return url, institution
+
+
+def find_publisher_profile() -> Path | None:
+    """Where this instance's publisher profile is, if it has one.
+
+    The profile is what assigns a zone and a trust tier to each document, and
+    zone is a hard retrieval boundary. Ingesting without it produces a corpus
+    where every document is unplaced, so every later question is refused — a
+    failure that looks like an empty archive rather than a missing setting.
+
+    So this looks in the places a profile actually lives rather than in one
+    fixed path. An instance keeps its ontology under memory/knowledge/tools/,
+    not beside its intake metadata, and requiring an environment variable to
+    bridge that gap means the common case is the broken one.
+    """
+    override = os.environ.get("EGREGORE_PUBLISHER_PROFILE")
+    if override:
+        path = Path(override)
+        return path if path.is_file() else None
+
+    candidates = [metadata_root() / "publisher-profile.json"]
+    memory = Path("memory")
+    if memory.is_dir():
+        candidates.extend(sorted(memory.glob("knowledge/tools/*/publisher-profile.json")))
+        candidates.append(memory / "publisher-profile.json")
+    for path in candidates:
+        if path.is_file():
+            return path
+    return None
+
+
 def publisher_profile() -> dict | None:
     """Load the instance's publisher profile, if one is configured.
 
@@ -159,9 +220,8 @@ def publisher_profile() -> dict | None:
     operator set: deriving a region is an inference, and an inference must not
     silently replace a stated fact.
     """
-    override = os.environ.get("EGREGORE_PUBLISHER_PROFILE")
-    path = Path(override) if override else (metadata_root() / "publisher-profile.json")
-    if not path.is_file():
+    path = find_publisher_profile()
+    if path is None:
         return None
     try:
         return json.loads(path.read_text(encoding="utf-8"))
@@ -223,8 +283,31 @@ def add_path(args: argparse.Namespace) -> dict:
     existing_manifest = load_manifest(directory)
     previous = {d["id"]: d for d in existing_manifest.get("documents", [])}
     now = datetime.now(timezone.utc).isoformat()
+    profile_path = find_publisher_profile()
     profile = publisher_profile()
+    if profile is None:
+        # Said once, plainly, because the alternative is a corpus that ingests
+        # cleanly and then refuses every question with no indication why.
+        print("ingest: no publisher-profile.json found — documents will carry no zone "
+              "or trust tier, and a zoneless document can never be served. Put one "
+              "under memory/knowledge/tools/<ontology>/ or set "
+              "EGREGORE_PUBLISHER_PROFILE.", file=sys.stderr)
+    catalogue = catalogue_module.load(
+        profile or {}, base=profile_path.parent if profile_path else None
+    )
+    repair_map = text_repair.load_mapping(profile or {})
     ingested = unchanged = metadata_updated = skipped = pruned = 0
+    # How often progress is written. The manifest used to be saved once, after
+    # every file, so an interrupted run lost everything it had extracted — on a
+    # 921-document folder that was two and a half hours of OCR with nothing to
+    # show. Documents already on disk were re-extracted because nothing recorded
+    # them. Writing periodically means an interruption costs at most this many.
+    checkpoint_every = int(os.environ.get("EGREGORE_INGEST_CHECKPOINT", "25") or 0)
+    since_checkpoint = 0
+    # Read before the loop rather than after it, so a checkpoint writes the real
+    # deletion records instead of dropping them. Pruning still happens later; a
+    # mid-run save simply carries forward what the previous run recorded.
+    tombstones = existing_manifest.get("tombstones", [])
     errors: list[dict] = []
     seen_paths: set[str] = set()
 
@@ -252,6 +335,15 @@ def add_path(args: argparse.Namespace) -> dict:
             extraction = {"kind": "local", "extractor": extractor} if extractor else None
             if extraction and detail:
                 extraction["pages"] = detail
+        # Fix characters the document's own font encoding got wrong, before
+        # anything downstream indexes or quotes them.
+        repaired = None
+        if text and repair_map:
+            outcome = text_repair.repair(text, repair_map)
+            if outcome.replaced:
+                text = outcome.text
+                repaired = outcome.as_report()
+
         if error or text is None or not text.strip():
             skipped += 1
             errors.append({"path": relative, "error": error or "empty extracted text"})
@@ -283,6 +375,9 @@ def add_path(args: argparse.Namespace) -> dict:
             continue
         # Segment before chunking so no passage straddles two works. A document
         # holding a single work yields one segment, and chunking is unchanged.
+        if repaired and extraction:
+            extraction["repair"] = repaired
+
         segments = doc_segment.segment(text)
         document_chunks: list[tuple[str, doc_segment.Segment]] = []
         for seg in segments:
@@ -314,12 +409,37 @@ def add_path(args: argparse.Namespace) -> dict:
         # is absent filters nothing. A derived value is marked as derived: anything
         # downstream can tell it apart from one a person stated, and weigh it by the
         # confidence recorded alongside. An operator's value is never overwritten.
+        # Evidence strongest first: what the operator stated, then what the
+        # organisation's own catalogue records, then what can be inferred from
+        # the document's origin. A weaker source never overwrites a stronger one.
         provenance = None
         doc_boundaries = dict(boundaries)
+        catalogued = catalogue_module.lookup(catalogue, relative)
+
+        if catalogued:
+            provenance = {"from_catalogue": {k: v for k, v in catalogued.items()}}
+            for field_name, value in catalogued.items():
+                if field_name in ("zone", "crop", "topic", "customer", "jurisdiction", "project"):
+                    if field_name not in doc_boundaries:
+                        doc_boundaries[field_name] = value
+                        provenance["applied_boundary"] = field_name
+            if catalogued.get("year"):
+                structure.setdefault("publication_year", catalogued["year"])
+                structure["year_source"] = structure.get("year_source") or "catalogue"
+            if catalogued.get("tier"):
+                provenance["tier"] = catalogued["tier"]
+            provenance["confidence"] = "high"
+
         if profile:
-            resolved = source_profile.resolve(profile, filename=relative)
+            catalogue_url, catalogue_institution = catalogue_provenance(catalogued)
+            resolved = source_profile.resolve(
+                profile, url=catalogue_url, institution=catalogue_institution,
+                filename=relative)
             if resolved.publisher_class or resolved.notes:
-                provenance = resolved.as_dict()
+                inferred = resolved.as_dict()
+                # Keep the inference visible even when the catalogue answered,
+                # so a disagreement between the two is inspectable.
+                provenance = {**inferred, **(provenance or {})} if provenance else inferred
             key = source_profile.boundary_key(profile)
             if key and resolved.zone and key not in doc_boundaries:
                 doc_boundaries[key] = resolved.zone
@@ -362,12 +482,18 @@ def add_path(args: argparse.Namespace) -> dict:
             "status": "unverified",
             "ingested_at": now,
         }
+        since_checkpoint += 1
+        if checkpoint_every and since_checkpoint >= checkpoint_every:
+            # A crash between the document write and this one costs re-extraction
+            # of at most `checkpoint_every` files, never the whole run.
+            write_manifest(directory, source_id, org, args, boundaries, base, now,
+                           previous, tombstones, errors)
+            since_checkpoint = 0
         if existing and existing.get("content_hash") == content_hash:
             metadata_updated += 1
         else:
             ingested += 1
 
-    tombstones = existing_manifest.get("tombstones", [])
     if args.prune:
         if not input_path.is_dir():
             raise ValueError("--prune requires a directory snapshot")
@@ -389,11 +515,23 @@ def add_path(args: argparse.Namespace) -> dict:
     # Current documents always win over historical deletion records.
     tombstones = [row for row in tombstones if row["id"] not in previous]
 
+    write_manifest(directory, source_id, org, args, boundaries, base, now,
+                   previous, tombstones, errors)
+    return {"org": org, "source": source_id, "ingested": ingested, "unchanged": unchanged, "metadata_updated": metadata_updated, "skipped": skipped, "pruned": pruned, "documents": len(previous), "metadata_root": str(directory), "data_root": str(docs_dir)}
+
+
+def write_manifest(directory, source_id, org, args, boundaries, base, now,
+                   previous, tombstones, errors) -> None:
+    """Persist progress. Called periodically during a run and once at the end.
+
+    One writer for both so a checkpoint and a completed run cannot record the
+    corpus differently.
+    """
     source_record = {
         "id": source_id,
         "org": org,
-        "name": args.name or source_id,
-        "kind": args.kind,
+        "name": getattr(args, "name", None) or source_id,
+        "kind": getattr(args, "kind", None),
         "boundaries": boundaries,
         "root_hint": base.name,
         "updated_at": now,
@@ -410,7 +548,6 @@ def add_path(args: argparse.Namespace) -> dict:
             "errors": errors,
         },
     )
-    return {"org": org, "source": source_id, "ingested": ingested, "unchanged": unchanged, "metadata_updated": metadata_updated, "skipped": skipped, "pruned": pruned, "documents": len(previous), "metadata_root": str(directory), "data_root": str(docs_dir)}
 
 
 def cmd_add(args: argparse.Namespace) -> int:
@@ -418,6 +555,191 @@ def cmd_add(args: argparse.Namespace) -> int:
     return 0
 
 
+def rewrite_frontmatter(path: Path, updates: dict) -> bool:
+    """Replace named frontmatter fields in place, leaving the text untouched.
+
+    A document's placement lives in two files — the manifest record and this
+    document's own frontmatter — and a reader may consult either. Updating one
+    and not the other produces a corpus that disagrees with itself, which is
+    worse than the stale value it replaced.
+
+    Only the named lines are rewritten. The body is never reparsed, so nothing
+    that survived extraction can be lost by a maintenance pass.
+    """
+    try:
+        text = path.read_text(encoding="utf-8")
+    except OSError:
+        return False
+    lines = text.split("\n")
+    if not lines or lines[0].strip() != "---":
+        return False
+    try:
+        close = next(i for i in range(1, len(lines)) if lines[i].strip() == "---")
+    except StopIteration:
+        return False
+    remaining = dict(updates)
+    for i in range(1, close):
+        key = lines[i].split(":", 1)[0].strip()
+        if key in remaining:
+            lines[i] = f"{key}: {json.dumps(remaining.pop(key), ensure_ascii=False)}"
+    # A field the original write omitted is appended rather than dropped, so a
+    # document ingested before a field existed still gains it.
+    for key, value in remaining.items():
+        lines.insert(close, f"{key}: {json.dumps(value, ensure_ascii=False)}")
+        close += 1
+    atomic_text(path, "\n".join(lines))
+    return True
+
+
+def reresolve_source(args: argparse.Namespace) -> dict:
+    """Re-derive placement for documents already ingested.
+
+    Placement is written once, at ingest, and never revisited. That is right
+    for content — the text of a document does not change because a rule did —
+    but wrong for the rules themselves. Correcting a publisher profile changed
+    nothing about the corpus it governs: `add` skips on the content hash and
+    returns before it ever consults the profile, so it reported every document
+    unchanged while the corrected rule went unapplied. The only way to apply a
+    fix was to re-extract thousands of documents, redoing OCR to recompute a
+    field that depends on nothing but the filename.
+
+    So this re-runs the resolver alone. No file is reopened, no text is
+    re-extracted; the stored path is all the resolver ever needed.
+
+    Evidence precedence is the same as at ingest, and is the reason this is
+    safe to run at any time: a value the operator stated, or one the
+    organisation's own catalogue recorded, is never overwritten by an
+    inference. Only a placement this resolver derived — or the absence of one —
+    is open to revision.
+    """
+    config = load_config()
+    source_id = slug(args.source)
+    directory = source_dir(source_id)
+    manifest = load_manifest(directory)
+    records = manifest.get("documents") or []
+    if not records:
+        return {"source": source_id, "error": "no manifest, or no documents in it",
+                "metadata_root": str(directory)}
+
+    profile = publisher_profile()
+    if profile is None:
+        return {"source": source_id,
+                "error": "no publisher-profile.json found — nothing to resolve against"}
+    key = source_profile.boundary_key(profile)
+    if not key:
+        return {"source": source_id, "error": "profile declares no boundary key"}
+
+    docs_dir = data_root() / "sources" / source_id / "documents"
+    placed = rezoned = identified = unchanged = protected = missing = 0
+    changes: list = []
+
+    for record in records:
+        relative = record.get("source_path")
+        if not relative:
+            unchanged += 1
+            continue
+        boundaries = dict(record.get("boundaries") or {})
+        provenance = dict(record.get("provenance") or {})
+        catalogued = provenance.get("from_catalogue") or {}
+
+        # The same evidence the original ingest had, re-read from the record so
+        # a document identified only by its catalogue row resolves here too.
+        catalogue_url, catalogue_institution = catalogue_provenance(catalogued)
+        resolved = source_profile.resolve(
+            profile, url=catalogue_url, institution=catalogue_institution,
+            filename=relative)
+
+        # Placement and identification are decided separately. A document can
+        # become identifiable — a journal index naming its publisher — without
+        # that saying anything about which region it applies to, and reporting
+        # only the placement would call that document unchanged when the thing
+        # that decides how far to trust it has just been settled.
+        current = boundaries.get(key)
+        # Anything the operator stated or the catalogue recorded outranks an
+        # inference and is left exactly as it is.
+        derived_here = (provenance.get("derived") is True
+                        and provenance.get("applied_boundary") == key)
+        zone_open = not ((current and not derived_here) or catalogued.get(key))
+        zone_changes = bool(zone_open and resolved.zone and resolved.zone != current)
+
+        # A tier the catalogue stated is likewise not ours to revise.
+        class_open = not catalogued.get("tier")
+        class_changes = bool(
+            class_open and resolved.publisher_class
+            and (resolved.publisher_class != provenance.get("publisher_class")
+                 or resolved.tier != provenance.get("tier")))
+
+        if not zone_changes and not class_changes:
+            if not zone_open and not class_open:
+                protected += 1
+            elif current and not zone_open:
+                protected += 1
+            else:
+                unchanged += 1
+            continue
+
+        # The fresh resolution replaces the recorded inference whenever either
+        # half moved. Refreshing only on a class change once left a re-zoned
+        # document carrying the confidence and notes of the resolution it no
+        # longer had — a record that reported an inferred national zone with
+        # the confidence of a precise one.
+        updated_provenance = dict(provenance)
+        updated_provenance.update(resolved.as_dict())
+        if class_changes:
+            identified += 1
+        if catalogued:
+            updated_provenance["from_catalogue"] = catalogued
+        if zone_changes:
+            updated_provenance["applied_boundary"] = key
+            updated_provenance["derived"] = True
+            boundaries[key] = resolved.zone
+            if current:
+                rezoned += 1
+            else:
+                placed += 1
+
+        changes.append({"id": record["id"], "source_path": relative,
+                        "zone": {"from": current, "to": boundaries.get(key)},
+                        "class": {"from": provenance.get("publisher_class"),
+                                  "to": updated_provenance.get("publisher_class")},
+                        "matched_by": resolved.matched_by})
+
+        if args.dry_run:
+            continue
+        record["boundaries"] = boundaries
+        record["provenance"] = updated_provenance
+        file_path = record.get("file_path")
+        target = (data_root() / file_path) if file_path else (docs_dir / f"{record['id']}.md")
+        if not rewrite_frontmatter(target, {"boundaries": boundaries,
+                                            "provenance": updated_provenance}):
+            missing += 1
+
+    if not args.dry_run and (placed or rezoned or identified):
+        manifest["documents"] = sorted(records, key=lambda d: d["id"])
+        atomic_json(directory / "manifest.json", manifest)
+
+    return {
+        "org": slug(config.get("slug") or "egregore"),
+        "source": source_id,
+        "dry_run": bool(args.dry_run),
+        "documents": len(records),
+        "placed": placed,
+        "rezoned": rezoned,
+        "identified": identified,
+        "unchanged": unchanged,
+        "protected": protected,
+        "frontmatter_not_found": missing,
+        "examples": changes[: max(0, args.examples)],
+        "metadata_root": str(directory),
+    }
+
+
+def cmd_reresolve(args: argparse.Namespace) -> int:
+    result = reresolve_source(args)
+    print(json.dumps(result, indent=2, ensure_ascii=False))
+    return 1 if result.get("error") else 0
+
+
 def selection_relative_path(value: object) -> str:
     if not isinstance(value, str) or not value or "\x00" in value or "\\" in value:
         raise ValueError("selection contains an invalid relative path")
@@ -643,6 +965,15 @@ def parser() -> argparse.ArgumentParser:
     add.add_argument("--boundary", action="append", default=[])
     add.add_argument("--prune", action="store_true", help="tombstone files absent from this authoritative directory snapshot")
     add.set_defaults(func=cmd_add)
+    reresolve = sub.add_parser(
+        "reresolve",
+        help="re-derive placement from the current profile, without re-reading any document")
+    reresolve.add_argument("--source", required=True, help="source id to re-resolve")
+    reresolve.add_argument("--dry-run", action="store_true",
+                           help="report what would change and write nothing")
+    reresolve.add_argument("--examples", type=int, default=10,
+                           help="how many changed documents to list (default 10)")
+    reresolve.set_defaults(func=cmd_reresolve)
     add_selection = sub.add_parser("add-selection")
     add_selection.add_argument("manifest")
     add_selection.set_defaults(func=cmd_add_selection)

package/runtime/pi/bin/lib/context.sh

@@ -370,6 +370,29 @@ fi
   JSON="[]"
   RICH="[]"
   if [ -d "$SCRIPT_DIR/memory/handoffs" ]; then
+    # One definition everywhere: in connected mode the list comes from the
+    # graph's open-handoffs named read (open = pending/unread/read/claimed,
+    # matched by name/github/aliases) — the same definition the dashboard
+    # uses. The file grep below stays as the local-mode/offline fallback.
+    ADDRESSED=""
+    if [ "${LOCAL_MODE:-false}" != "true" ]; then
+      _GRAPH_LIST=$(bash "$SCRIPT_DIR/bin/graph-op.sh" open-handoffs "$AUTHOR" 5 2>/dev/null || true)
+      if echo "$_GRAPH_LIST" | jq -e '.values | length > 0' >/dev/null 2>&1; then
+        ADDRESSED=$(echo "$_GRAPH_LIST" | jq -r '.values[][0]' 2>/dev/null | awk '!seen[$0]++' | while IFS= read -r _SID; do
+          # Two on-disk layouts: dated subdirs (YYYY-MM/DD-slug.md, the id's
+          # own shape) and flat files at the handoffs root. Probe both, else
+          # a graph-listed handoff silently vanishes from the greeting.
+          _MONTH="${_SID:0:7}"
+          _REST="${_SID:8}"
+          _F="$SCRIPT_DIR/memory/handoffs/$_MONTH/$_REST.md"
+          if [ -f "$_F" ]; then
+            echo "$_F"
+          elif [ -f "$SCRIPT_DIR/memory/handoffs/$_SID.md" ]; then
+            echo "$SCRIPT_DIR/memory/handoffs/$_SID.md"
+          fi
+        done | head -5)
+      fi
+    fi
     # Match github username, display name, github_name first word, and people-file name
     # Handoff files may use "to: name", "**To**: name", or "To: name"
     _DISPLAY=$(jq -r '.display_name // empty' "$STATE_FILE" 2>/dev/null)
@@ -387,7 +410,9 @@ fi
       echo "$_GREP_PAT" | grep -qF "$_VARIANT" && continue
       _GREP_PAT="$_GREP_PAT\|[Tt]o[*]*: *$_VARIANT\|[Tt]o[*]*:$_VARIANT"
     done
-    ADDRESSED=$(grep -rli "$_GREP_PAT" "$SCRIPT_DIR/memory/handoffs/" 2>/dev/null | sort -r | head -5 || true)
+    if [ -z "$ADDRESSED" ]; then
+      ADDRESSED=$(grep -rli "$_GREP_PAT" "$SCRIPT_DIR/memory/handoffs/" 2>/dev/null | sort -r | head -5 || true)
+    fi
     JSON="["
     RICH="["
     FIRST=true

package/runtime/pi/bin/lib/git-message.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# git-message.sh — shared commit/PR message mechanics, sourced by composers.
+# Spec: .claude/context/commit-format.md + .claude/context/pr-format.md.
+#
+# Provides:
+#   egregore_session_trailer <hub_dir>
+#       Print "Egregore-Session: <id>" when <hub_dir>/.egregore-session-id
+#       exists; print nothing otherwise. Never fails.
+#   egregore_commit <git_dir> <hub_dir> <message> [git-commit flags…]
+#       git -C <git_dir> commit with the session trailer appended as the
+#       final paragraph (a valid git trailer block) when an id exists.
+#   egregore_pr_skeleton <what> <why> <verification> <footer>
+#       The one source of the skeleton PR body shape.
+
+egregore_session_trailer() {
+  local sid
+  sid="$(cat "${1:-.}/.egregore-session-id" 2>/dev/null || true)"
+  [ -n "$sid" ] && printf 'Egregore-Session: %s' "$sid"
+  return 0
+}
+
+egregore_commit() {
+  local git_dir="$1" hub_dir="$2" msg="$3"
+  shift 3
+  local trailer
+  trailer="$(egregore_session_trailer "$hub_dir")"
+  if [ -n "$trailer" ]; then
+    git -C "$git_dir" commit -m "$msg" -m "$trailer" "$@"
+  else
+    git -C "$git_dir" commit -m "$msg" "$@"
+  fi
+}
+
+egregore_pr_skeleton() {
+  printf '## What\n%s\n\n## Why\n%s\n\n## Verification\n%s\n\n%s\n' \
+    "$1" "$2" "$3" "$4"
+}

package/runtime/pi/bin/lib/git-sync.sh

@@ -185,7 +185,7 @@ _apply_framework_update() {
     FRAMEWORK_UPDATED_COUNT=$(printf '%s\n' "$_changed" | grep -c . || echo 0)
     FRAMEWORK_UPDATED_FILES=$(printf '%s\n' "$_changed" | awk '{print $NF}' | head -3 | tr '\n' ' ')
     git add bin/ .claude/ loom/ CLAUDE.md skills/ 2>/dev/null
-    EGREGORE_FRAMEWORK_UPDATE=1 git commit -m "Auto-update Egregore framework" --quiet 2>/dev/null || true
+    EGREGORE_FRAMEWORK_UPDATE=1 git commit -m "chore(sync): update framework from upstream" --quiet 2>/dev/null || true
     FRAMEWORK_UPDATED="true"
   fi
 }
@@ -214,6 +214,14 @@ fi
 # Named setup_develop for continuity; it operates on $BASE_BRANCH, which is
 # "develop" by default and whatever egregore.json's base_branch says otherwise.
 setup_develop() {
+  # Detached HEAD (CI merge-ref checkouts, bisects): never create or switch
+  # branches here — `git checkout -b $BASE_BRANCH origin/$BASE_BRANCH` would
+  # silently replace the checked-out tree with the base branch. This is how
+  # CI jobs that invoke session-start machinery ended up testing develop
+  # instead of the PR under test. Syncing means updating the base-branch ref,
+  # not claiming HEAD; on a detached HEAD there is nothing safe to do.
+  [ -n "$(git branch --show-current 2>/dev/null)" ] || return 0
+
   # Ensure the base branch exists locally
   if ! git show-ref --verify --quiet "refs/heads/$BASE_BRANCH" 2>/dev/null; then
     if git show-ref --verify --quiet "refs/remotes/origin/$BASE_BRANCH" 2>/dev/null; then
@@ -267,7 +275,7 @@ setup_develop() {
       # Save uncommitted work so nothing is lost (guarded: never auto-commit
       # stray submodule pointers from sibling repos in the checkout)
       git_add_guarded
-      git commit -m "Auto-save: uncommitted work from $CURRENT_BRANCH" --quiet 2>/dev/null || true
+      git commit -m "chore(autosave): save uncommitted work from $CURRENT_BRANCH" --quiet 2>/dev/null || true
       SAVED_BRANCH="$CURRENT_BRANCH"
     fi
 

package/runtime/pi/bin/lib/greeting.sh

@@ -188,7 +188,10 @@ fi
 # Staged auto-saves awaiting the user's merge (the /autosave consent gate).
 # Live gh query so the line persists until the PRs actually merge — the
 # ledger cursor above only reports once. Fail-soft when gh/network is out.
-if command -v gh >/dev/null 2>&1; then
+# Shown only while the autosave experiment is enabled: stale PRs from a
+# disabled experiment should not nag every greeting.
+AUTOSAVE_ON=$(jq -r '.autosave_enabled // false' "$STATE_FILE" 2>/dev/null)
+if [ "$AUTOSAVE_ON" = "true" ] && command -v gh >/dev/null 2>&1; then
   GH_SELF=$(jq -r '.github_username // empty' "$STATE_FILE" 2>/dev/null)
   if [ -n "$GH_SELF" ]; then
     WAITING_AS=$(gh pr list --state open --author "$GH_SELF" --limit 20 \

package/runtime/pi/bin/lib/worktree-links.sh

@@ -52,3 +52,28 @@ egregore_link_shared_state() {
     fi
   done
 }
+
+# Resolve the .env that governs a checkout. A worktree can be missing its .env
+# symlink (created before .env existed, or by a runtime that skipped worktree
+# setup) — self-heal the links, then fall back to the main checkout's .env so
+# credential loading never silently comes up empty. Prints the usable path, or
+# nothing when neither checkout has one. Always returns 0.
+egregore_env_file() {
+  local project_dir="${1:?project dir required}"
+  if [ ! -f "$project_dir/.env" ] && [ -f "$project_dir/.git" ]; then
+    egregore_link_shared_state "$project_dir" 2>/dev/null || true
+  fi
+  if [ -f "$project_dir/.env" ]; then
+    echo "$project_dir/.env"
+    return 0
+  fi
+  if [ -f "$project_dir/.git" ]; then
+    local main_dir
+    main_dir="$(egregore_main_project_dir "$project_dir" 2>/dev/null || true)"
+    if [ -n "$main_dir" ] && [ -f "$main_dir/.env" ]; then
+      echo "$main_dir/.env"
+      return 0
+    fi
+  fi
+  return 0
+}