create-egregore 0.19.33 → 0.20.1

package/runtime/pi/bin/pi-branch-policy.mjs

@@ -1,7 +1,11 @@
 import { isAbsolute, relative, resolve } from "node:path";
 
 const MUTATING_COMMANDS = /(^|[;&|]\s*)(?:sudo\s+)?(rm|mv|cp|mkdir|rmdir|touch|chmod|chown|install|tee)\b/;
-const MUTATING_GIT = /(^|[;&|]\s*)(?:sudo\s+)?git\s+(add|commit|push|merge|rebase|cherry-pick|tag|rm|mv)\b/;
+// Global options (-C <path>, -c k=v, --git-dir=…) may sit between `git` and
+// the subcommand. The repo convention actively teaches `git -C <abs-path>`,
+// so a classifier that only matches bare `git commit` misses the shape the
+// model is most likely to emit.
+const MUTATING_GIT = /(^|[;&|]\s*)(?:sudo\s+)?git\s+(?:(?:-C|-c|--git-dir|--work-tree)(?:=\S+|\s+\S+)\s+)*(add|commit|push|merge|rebase|cherry-pick|tag|rm|mv|reset|restore|clean)\b/;
 const MUTATING_PACKAGES = /(^|[;&|]\s*)(?:sudo\s+)?(npm|pnpm|yarn|bun)\s+(install|add|remove|uninstall|update)\b/;
 
 // A `>` only acts as a shell redirect when it sits OUTSIDE quotes. Quoted
@@ -112,6 +116,7 @@ export function isRuntimeStatePath(target, projectDir) {
     rel === ".claude" || rel.startsWith(".claude/") ||
     rel === ".codex" || rel.startsWith(".codex/") ||
     rel === ".pi" || rel.startsWith(".pi/") ||
+    rel === ".prime" || rel.startsWith(".prime/") ||
     rel === ".egregore-state.json" ||
     rel === ".egregore-branch-consent" ||
     rel === ".env";
@@ -162,6 +167,20 @@ export function mutatesOnlyRuntimeState(command, projectDir) {
   return foundTarget;
 }
 
+// The documented escape hatch must itself be runnable, but ONLY as the whole
+// command: an unanchored match lets `git push origin develop && echo 'develop'
+// > .egregore-branch-consent` pass the gate in one call, and the block message
+// teaches that exact echo string. Canonical form mirrors
+// .codex/hooks/branch-guard.js isConsentCommand — anchored, branch escaped,
+// optional ./ prefix — and is shared so the three runtimes cannot drift.
+export function isConsentCommand(command, branch) {
+  if (!branch) return false;
+  const escaped = String(branch).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(
+    `^\\s*echo\\s+['"]?${escaped}['"]?\\s*>\\s*(?:\\./)?\\.egregore-branch-consent\\s*$`
+  ).test(String(command || ""));
+}
+
 export function isMutatingBash(command) {
   if (!command) return false;
   const meaningfulRedirects = stripQuotedSegments(String(command))
@@ -173,3 +192,121 @@ export function isMutatingBash(command) {
     /(^|[^<])>>?\s*[^&]/.test(meaningfulRedirects) ||
     /\bsed\s+[^\n]*\s-i(?:\s|$)/.test(command);
 }
+
+// ---- IPython code classification (Prime Agent) -----------------------------
+// Prime Agent's default tool surface is a persistent IPython kernel: file
+// writes and shell escapes arrive as Python code, not bash tool calls. This
+// classifier is deliberately static and therefore porous (exec/eval and
+// string-built commands pass); the generated runtime spec carries the
+// standing-instruction discipline as the backstop, and the adversarial test
+// fixtures pin what this actually catches.
+
+// Strip Python string literals so call-name detection ignores docstrings and
+// string content. Triple quotes first, then single-line quotes; f-string
+// prefixes fall out naturally because only the quoted part is replaced.
+function stripPythonStrings(code) {
+  return String(code)
+    .replace(/[rbuf]{0,2}("""|''')[\s\S]*?\1/gi, '""')
+    .replace(/[rbuf]{0,2}"(?:\\.|[^"\\\n])*"/gi, '""')
+    .replace(/[rbuf]{0,2}'(?:\\.|[^'\\\n])*'/gi, "''");
+}
+
+function pythonShellCommands(code) {
+  const shell = [];
+  const lines = String(code).split("\n");
+  const first = (lines[0] || "").trim();
+  if (/^%%(bash|sh|script\s+(ba)?sh)\b/.test(first)) {
+    shell.push(lines.slice(1).join("\n"));
+    return { shell, rest: "" };
+  }
+  if (/^%%writefile\b/.test(first)) {
+    const target = first.replace(/^%%writefile\s+(-a\s+)?/, "").trim();
+    return { shell: [`tee ${target || "unknown-target"}`], rest: "" };
+  }
+  const rest = [];
+  for (const line of lines) {
+    const bang = line.match(/^\s*!(.+)$/);
+    const sysMagic = line.match(/^\s*%(?:system|sx)\s+(.+)$/);
+    if (bang) shell.push(bang[1]);
+    else if (sysMagic) shell.push(sysMagic[1]);
+    else rest.push(line);
+  }
+  return { shell, rest: rest.join("\n") };
+}
+
+const PY_MUTATING_CALLS =
+  /\b(?:os\.(?:remove|unlink|rename|replace|rmdir|removedirs|makedirs|mkdir|symlink|link|chmod|chown|truncate)|shutil\.(?:copy|copy2|copyfile|copytree|move|rmtree|make_archive|unpack_archive))\s*\(/;
+const PY_WRITE_METHODS = /\.\s*(?:write_text|write_bytes|unlink|touch|mkdir|rmdir|hardlink_to|symlink_to)\s*\(/;
+const PY_OPEN_WRITE =
+  /\bopen\s*\(\s*[^,]+,\s*(?:mode\s*=\s*)?['"](?:[wax]|r\+)[rwxab+]*['"]/;
+const PY_OPEN_MODE_KWARG = /\bopen\s*\([^)]*mode\s*=\s*['"](?:[wax]|r\+)[rwxab+]*['"]/;
+
+function pythonSubprocessArgv(code) {
+  const argvs = [];
+  const calls =
+    /\b(?:subprocess\.(?:run|call|check_call|check_output|Popen)|os\.system|os\.popen)\s*\(\s*(\[[^\]]*\]|[rbuf]{0,2}["'](?:\\.|[^"'\\\n])*["'])/g;
+  let match;
+  while ((match = calls.exec(String(code)))) {
+    const arg = match[1];
+    if (arg.startsWith("[")) {
+      const words = [...arg.matchAll(/["']((?:\\.|[^"'\\])*)["']/g)].map((m) => m[1]);
+      if (words.length) argvs.push(words.join(" "));
+    } else {
+      argvs.push(arg.replace(/^[rbuf]{0,2}["']/i, "").replace(/["']$/, ""));
+    }
+  }
+  return argvs;
+}
+
+// Classify IPython cell code. Returns true when the code statically performs a
+// repo mutation that should meet the protected-branch gate. Mutations that
+// target only Egregore runtime state (memory/, dot-dirs, consent files) are
+// exempt when the target is statically extractable, mirroring
+// mutatesOnlyRuntimeState for bash.
+export function isMutatingIpython(code, projectDir) {
+  if (!code) return false;
+  const { shell, rest } = pythonShellCommands(code);
+  for (const cmd of shell) {
+    if (isMutatingBash(cmd) && !(projectDir && mutatesOnlyRuntimeState(cmd, projectDir))) return true;
+  }
+  if (!rest) return false;
+
+  for (const argv of pythonSubprocessArgv(rest)) {
+    if (isMutatingBash(argv) && !(projectDir && mutatesOnlyRuntimeState(argv, projectDir))) return true;
+  }
+
+  const stripped = stripPythonStrings(rest);
+  if (PY_MUTATING_CALLS.test(stripped) || PY_WRITE_METHODS.test(stripped)) {
+    // Exempt when every extractable string target is runtime state. The
+    // mutated location differs by call: copy/move/rename mutate their LAST
+    // argument (the destination); remove/rmtree/mkdir mutate their first.
+    if (projectDir) {
+      const DEST_LAST = /^(?:copy|copy2|copyfile|copytree|move|rename|replace|symlink|link)$/;
+      const targets = [...String(rest).matchAll(
+        /\b(?:os|shutil)\.(\w+)\s*\(([^)]*)\)/g
+      )].flatMap((m) => {
+        const args = [...m[2].matchAll(/["']((?:\\.|[^"'\\])*)["']/g)].map((s) => s[1]);
+        if (!args.length) return [];
+        return [DEST_LAST.test(m[1]) ? args[args.length - 1] : args[0]];
+      });
+      const pathTargets = [...String(rest).matchAll(
+        /Path\s*\(\s*[rbuf]{0,2}["']((?:\\.|[^"'\\\n])*)["']\s*\)\s*\.\s*(?:write_text|write_bytes|unlink|touch|mkdir|rmdir)/g
+      )].map((m) => m[1]);
+      const all = [...targets, ...pathTargets];
+      if (all.length && all.every((t) => isRuntimeStatePath(t, projectDir))) return false;
+    }
+    return true;
+  }
+
+  if (PY_OPEN_WRITE.test(rest) || PY_OPEN_MODE_KWARG.test(rest)) {
+    if (projectDir) {
+      const openTargets = [...String(rest).matchAll(
+        /\bopen\s*\(\s*[rbuf]{0,2}["']((?:\\.|[^"'\\\n])*)["']\s*,\s*(?:mode\s*=\s*)?["'](?:[wax]|r\+)/g
+      )].map((m) => m[1]);
+      if (openTargets.length && openTargets.every((t) => isRuntimeStatePath(t, projectDir))) return false;
+    }
+    return true;
+  }
+
+  return false;
+}

package/runtime/pi/bin/pi-product-workflows.mjs

@@ -2,6 +2,7 @@
 
 import {
   existsSync,
+  mkdirSync,
   mkdtempSync,
   readFileSync,
   readdirSync,
@@ -141,12 +142,37 @@ export async function renderView(pi, root, request, signal) {
   return { text, file, type: request.type };
 }
 
-export async function renderGreeting(pi, root, signal) {
-  const script = join(root, "bin", "pi-session-start.sh");
-  if (!existsSync(script)) throw new Error("Pi startup renderer is missing");
+export async function renderGreeting(pi, root, signal, startScript = "pi-session-start.sh") {
+  const script = join(root, "bin", startScript);
+  if (!existsSync(script)) throw new Error("Egregore startup renderer is missing");
   return checkedExec(pi, "bash", [script, "--card"], { signal, timeout: 45000 }, "Egregore startup");
 }
 
+// Raw JSON from the most recent activity-data.sh run, so follow-up focus
+// turns can receive the data inline instead of re-running the script inside
+// a harness surface that may cap command time (Prime's kernel kills execs at
+// ~5s, truncating the 10-20s data script to a partial fragment).
+let lastActivityData = "";
+export function lastActivityJson() {
+  return lastActivityData;
+}
+
+// Stable on-disk copy of the same data. Focus turns point the model at this
+// path instead of an inline excerpt: a file read is one fast kernel call,
+// never truncated, and removes any reason to re-run the data script.
+export function activityDataPath(root) {
+  return join(root, ".egregore", "activity-data.json");
+}
+
+function persistActivityData(root, json) {
+  try {
+    mkdirSync(join(root, ".egregore"), { recursive: true });
+    writeFileSync(activityDataPath(root), json);
+  } catch {
+    // Cache only — rendering proceeds from memory when the disk write fails.
+  }
+}
+
 export async function renderActivity(pi, root, signal, options = {}) {
   if (options.sync !== false) {
     await checkedExec(
@@ -177,6 +203,8 @@ export async function renderActivity(pi, root, signal, options = {}) {
     { signal, timeout: 120000 },
     "Activity refresh",
   );
+  lastActivityData = String(json || "");
+  persistActivityData(root, lastActivityData);
   const temp = mkdtempSync(join(tmpdir(), "egregore-pi-activity-"));
   const input = join(temp, "activity.json");
   try {
@@ -276,7 +304,7 @@ export async function createHandoff(pi, root, params, signal) {
   }
 }
 
-export async function captureSessionEnd(pi, root, sessionFile, signal) {
+export async function captureSessionEnd(pi, root, sessionFile, signal, runtime = "pi") {
   const sessionIdFile = join(root, ".egregore-session-id");
   if (!existsSync(sessionIdFile)) return false;
   const sessionId = cleanArgs(readFileSync(sessionIdFile, "utf8"));
@@ -287,7 +315,7 @@ export async function captureSessionEnd(pi, root, sessionFile, signal) {
   writeFileSync(input, JSON.stringify({
     session_id: sessionId,
     transcript_path: cleanArgs(sessionFile),
-    runtime: "pi",
+    runtime,
   }));
 
   try {
@@ -353,11 +381,11 @@ export async function publishScroll(pi, root, params, signal) {
   };
 }
 
-export function workflowPrompt(name, args, extra = "") {
+export function workflowPrompt(name, args, extra = "", spec = { runtimeName: "Pi", specPath: ".pi/APPEND_SYSTEM.md" }) {
   const userArgs = cleanArgs(args);
   return [
     `Run the Egregore /${name} workflow now.`,
-    `Read .codex/skills/${name}/SKILL.md completely and adapt Codex-specific wording to Pi using .pi/APPEND_SYSTEM.md.`,
+    `Read .codex/skills/${name}/SKILL.md completely and adapt Codex-specific wording to ${spec.runtimeName} using ${spec.specPath}.`,
     "Work quietly: do not narrate progress, expose raw command output, or repeat tool results.",
     "Use the fewest targeted reads and commands that preserve the workflow contract.",
     userArgs ? `User arguments: ${userArgs}` : "",

package/runtime/pi/bin/pi-render-spec.mjs

@@ -40,24 +40,57 @@ function replaceSection(markdown, heading, body) {
   return `${markdown.slice(0, start)}${marker}\n\n${body}${markdown.slice(end)}`;
 }
 
+// Keep an inherited section and put runtime-specific framing in front of it.
+// Command Awareness is the case that matters: the canonical category rows and
+// disambiguation map live in CLAUDE.md, and a full replace here silently
+// shipped a truncated copy that drifted for months. The Codex spec opens the
+// section with its own skills-not-slash-commands paragraph, which is wrong for
+// a runtime that does have slash commands, so that one paragraph is dropped.
+function prependToSection(markdown, heading, body, dropLeadParagraphStartingWith) {
+  const marker = `## ${heading}`;
+  const start = markdown.indexOf(marker);
+  if (start < 0) throw new Error(`missing section in AGENTS.md: ${heading}`);
+  const rest = markdown.slice(start + marker.length);
+  const boundary = rest.search(/\n\n---\n\n## /);
+  const end = boundary < 0 ? markdown.length : start + marker.length + boundary;
+  let inherited = markdown.slice(start + marker.length, end).trim();
+  if (dropLeadParagraphStartingWith) {
+    if (!inherited.startsWith(dropLeadParagraphStartingWith)) {
+      throw new Error(`pi/prime-render-spec: "${heading}" no longer opens with "${dropLeadParagraphStartingWith}" — the Codex wording moved; update this adaptation`);
+    }
+    inherited = inherited.slice(inherited.indexOf("\n\n") + 2).trim();
+  }
+  return replaceSection(markdown, heading, `${body}\n\n${inherited}`);
+}
+
+const CODEX_COMMAND_LEAD = "Codex reserves leading";
+
 function adapt(sourceSpec) {
-  let text = sourceSpec
-    .replaceAll("Egregore on Codex", "Egregore on Pi")
-    .replaceAll("Codex-native", "Pi-native")
-    .replaceAll("Codex sessions", "Pi sessions")
-    .replaceAll("On Codex", "On Pi")
-    .replaceAll("from Codex", "from Pi")
-    .replaceAll("inside Codex", "inside Pi")
-    .replaceAll("Codex has no", "Pi has no built-in")
-    .replaceAll("normal sandboxed Codex shell", "the Pi shell")
-    .replaceAll("Codex graph network access", "Pi graph network access")
-    .replaceAll("structured Codex question tooling", "Pi UI question tooling")
-    .replaceAll("structured Codex", "structured Pi")
-    .replaceAll("bin/codex-session-start.sh", "bin/pi-session-start.sh")
-    .replaceAll(".codex/hooks/branch-guard.js", ".pi/extensions/egregore.ts")
-    .replaceAll("PreToolUse hook (enabled by the launcher via `--enable hooks`)", "`tool_call` gate (loaded after Pi project trust)")
-    .replaceAll("If this Codex build does not support hooks", "If Pi project resources are disabled")
-    .replaceAll("change permissions in `.claude/settings.json` anytime", "review or disable project resources in `.pi/` anytime")
+  // Anchored replacements: every `from` string MUST exist in the generated
+  // Codex spec. A missing anchor once no-opped silently (the tool_call gate
+  // wording vanished from this file for a whole PR cycle before a test caught
+  // it) — now it fails the render loudly so the anchor gets updated alongside
+  // the Codex text that moved.
+  const ANCHORED = [
+    ["Egregore on Codex", "Egregore on Pi"],
+    ["Codex-native", "Pi-native"],
+    ["Codex sessions", "Pi sessions"],
+    ["On Codex", "On Pi"],
+    ["Codex has no", "Pi has no built-in"],
+    ["bin/codex-session-start.sh", "bin/pi-session-start.sh"],
+    [".codex/hooks/branch-guard.js", ".pi/extensions/egregore.ts"],
+    ["PreToolUse hook (launcher `--enable hooks`)", "`tool_call` gate (loaded after Pi project trust)"],
+    ["If this Codex build does not support hooks", "If Pi project resources are disabled"],
+    ["change permissions in `.claude/settings.json` anytime", "review or disable project resources in `.pi/` anytime"],
+  ];
+  let text = sourceSpec;
+  for (const [from, to] of ANCHORED) {
+    if (!text.includes(from)) {
+      throw new Error(`pi-render-spec: anchor not found in generated Codex spec: "${from}" — the Codex wording moved; update this replacement`);
+    }
+    text = text.replaceAll(from, to);
+  }
+  text = text
     .replace(/`\$([a-z][a-z0-9-]*)/g, "`/$1")
     .replace(/\$([a-z][a-z0-9-]*)/g, "/$1");
 
@@ -67,16 +100,9 @@ This appendix is generated from the reviewed shell-runtime translation of \`CLAU
 
   text = replaceSection(text, "On Launch — MANDATORY FIRST ACTION", `The project-local Pi extension renders the Egregore startup card (identity, handoffs, team activity) inside Pi via \`bin/pi-session-start.sh\`. This works for direct \`pi\` launches and launcher-managed sessions. Do not rerun startup checks and do not narrate startup. The card ends with **"What are you working on?"** — that question is already on screen; treat the user's first message as the answer to it. To re-show the card outside Pi, run \`bash bin/pi-session-start.sh --card\`.`);
 
-  text = replaceSection(text, "Command Awareness", `Egregore workflows are available as Pi slash commands such as \`/activity\`, \`/handoff\`, \`/save\`, and \`/view\`. They are registered from the shared skill inventory by \`.pi/extensions/egregore.ts\`. Pi also exposes the underlying Agent Skills as \`/skill:name\`, and natural-language requests work normally. \`/save\` is the user-facing abstraction for committing, pushing, opening or reusing pull requests, and syncing memory — never make users manage the git workflow by hand.
-
-Invoke commands from user intent — don't wait for the slash. Read the selected skill's \`SKILL.md\` completely before acting. Codex wording inside the shared portable skills means the shell-capable runtime adapter; in Pi, run referenced \`bin/\` scripts directly, use ordinary Pi shell/network access, ignore Codex approval-channel wording, and render compact numbered questions when no Pi UI question surface is available.
+  text = prependToSection(text, "Command Awareness", `Egregore workflows are available as Pi slash commands such as \`/activity\`, \`/handoff\`, \`/save\`, and \`/view\`. They are registered from the shared skill inventory by \`.pi/extensions/egregore.ts\`. Pi also exposes the underlying Agent Skills as \`/skill:name\`, and natural-language requests work normally. \`/save\` is the user-facing abstraction for committing, pushing, opening or reusing pull requests, and syncing memory — never make users manage the git workflow by hand.
 
-**Core loop** — \`/activity\` \`/dashboard\` \`/handoff\` \`/wrap\` \`/save\` \`/reflect\` \`/todo\`
-**Knowledge** — \`/search\` \`/deep-reflect\` \`/archive\` \`/note\` \`/add\` \`/meeting\` \`/ingest\` \`/scroll\`
-**Identity** — \`/me\`
-**Coordination** — \`/ask\` \`/quest\` \`/issue\` \`/invite\` \`/delete-user\` \`/announce\`
-**Git** — \`/branch\` \`/commit\` \`/push\` \`/pr\` \`/save\` \`/review-pr\` \`/contribute\`
-**Infra** — \`/setup\` \`/update\` \`/pull\` \`/env\` \`/infra\` \`/sync-repos\` \`/release\` \`/checkup\``);
+Read the selected skill's \`SKILL.md\` completely before acting. Codex wording inside the shared portable skills means the shell-capable runtime adapter; in Pi, run referenced \`bin/\` scripts directly, use ordinary Pi shell/network access, ignore Codex approval-channel wording, and render compact numbered questions when no Pi UI question surface is available.`, CODEX_COMMAND_LEAD);
 
   return `# Egregore on Pi\n\nThis file is generated by \`bin/pi-render-spec.mjs\`; do not edit it by hand.\n\n${text}\n`;
 }

package/runtime/pi/bin/session-autosave.sh

@@ -29,6 +29,12 @@
 
 set -uo pipefail
 
+# shellcheck source=bin/lib/git-message.sh
+. "$(cd "$(dirname "$0")" && pwd)/lib/git-message.sh" 2>/dev/null || true
+type egregore_commit >/dev/null 2>&1 || egregore_commit() {
+  local gd="$1" m="$3"; shift 3; git -C "$gd" commit -m "$m" "$@"
+}
+
 DIR=""
 AUTHOR=""
 DEBOUNCE=0
@@ -118,7 +124,7 @@ fi
 if git -C "$DIR/memory" rev-parse --git-dir >/dev/null 2>&1; then
   if [ -n "$(git -C "$DIR/memory" status --porcelain 2>/dev/null)" ]; then
     git -C "$DIR/memory" add -A >/dev/null 2>&1 || true
-    git -C "$DIR/memory" commit -m "Auto-save: session content" --quiet 2>/dev/null || true
+    egregore_commit "$DIR/memory" "$DIR" "chore(autosave): save session work" --quiet 2>/dev/null || true
   fi
   if [ -n "$(git -C "$DIR/memory" log origin/main..HEAD --oneline 2>/dev/null)" ]; then
     for _try in 1 2 3; do

package/runtime/pi/bin/settings.sh

@@ -232,7 +232,7 @@ _people_file() {
     rm -f "$f"
   fi
   ( cd "$SCRIPT_DIR/memory" 2>/dev/null && git add -A people/ 2>/dev/null \
-      && git commit -q -m "settings: people $op $user" 2>/dev/null \
+      && git commit -q -m "chore(settings): $op $user in people" 2>/dev/null \
       && git push -q 2>/dev/null ) || true
 }
 

package/runtime/pi/manifest.json

@@ -1,7 +1,7 @@
 {
   "source": "egregore-pi-meta-harness",
   "policy": "Pi-native lifecycle layer over the available OSS Codex skill corpus",
-  "skillCount": 43,
+  "skillCount": 47,
   "skills": [
     "activity",
     "announce",
@@ -19,12 +19,15 @@
     "handoff",
     "harvest",
     "ingest",
+    "ingest-corpus",
+    "ingest-notion",
     "ingest-user-interview",
     "invite",
     "issue",
     "me",
     "meeting",
     "note",
+    "notion-connect",
     "onboarding",
     "pr",
     "pull",
@@ -36,6 +39,7 @@
     "slack-connect",
     "summon",
     "sync-repos",
+    "teams-connect",
     "telegram-connect",
     "telemetry",
     "test",
@@ -70,6 +74,8 @@
     ".codex/skills/handoff/SKILL.md",
     ".codex/skills/harvest/QUESTION_PALETTE.md",
     ".codex/skills/harvest/SKILL.md",
+    ".codex/skills/ingest-corpus/SKILL.md",
+    ".codex/skills/ingest-notion/SKILL.md",
     ".codex/skills/ingest-user-interview/SKILL.md",
     ".codex/skills/ingest/SKILL.md",
     ".codex/skills/invite/SKILL.md",
@@ -77,6 +83,7 @@
     ".codex/skills/me/SKILL.md",
     ".codex/skills/meeting/SKILL.md",
     ".codex/skills/note/SKILL.md",
+    ".codex/skills/notion-connect/SKILL.md",
     ".codex/skills/onboarding/SKILL.md",
     ".codex/skills/pr/SKILL.md",
     ".codex/skills/pull/SKILL.md",
@@ -88,6 +95,7 @@
     ".codex/skills/slack-connect/SKILL.md",
     ".codex/skills/summon/SKILL.md",
     ".codex/skills/sync-repos/SKILL.md",
+    ".codex/skills/teams-connect/SKILL.md",
     ".codex/skills/telegram-connect/SKILL.md",
     ".codex/skills/telemetry/SKILL.md",
     ".codex/skills/test/SKILL.md",
@@ -138,6 +146,7 @@
     "bin/lib/context.sh",
     "bin/lib/dashboard-artifact.sh",
     "bin/lib/ensure-develop.sh",
+    "bin/lib/git-message.sh",
     "bin/lib/git-sync.sh",
     "bin/lib/greeting.sh",
     "bin/lib/hash.sh",

package/runtime/prime/.claude/context/notification-consent.md

@@ -0,0 +1,66 @@
+# External notification consent
+
+This protocol applies to every Telegram, Teams, or other external notification
+in every harness. It applies even when the user asked to announce, notify,
+handoff, invite, or message someone, and even when the harness is running with
+broad tool permissions.
+
+## Invariant
+
+Never dispatch an external notification until the human has approved that one
+exact delivery in a dedicated checkpoint. The checkpoint must show:
+
+- the organization;
+- the final recipient or group;
+- every channel that will receive it;
+- the exact final message, including links.
+
+A workflow request, plan approval, batch approval, prior approval, broad
+permission mode, or approval of a related action is not notification consent.
+There is no standing "always allow" choice. One approval authorizes one attempt
+to send one immutable message.
+
+## Required flow
+
+1. Finish the message first. Publish any artifact and insert its real URL
+   before planning; never change the message after preview.
+2. Resolve the exact delivery without sending:
+
+   ```bash
+   PLAN_JSON=$(bash bin/notify.sh plan send "$RECIPIENT" "$MESSAGE")
+   # or
+   PLAN_JSON=$(bash bin/notify.sh plan group "$MESSAGE")
+   ```
+
+3. Read `plan_id` and `digest` from `PLAN_JSON`. Show the organization,
+   recipient, all `channels`/`deliveries`, and exact `message` in a dedicated
+   Send / Edit / Cancel question. Use the harness's structured question UI
+   when available. Otherwise show the same fields in plain text and stop for
+   the user's answer.
+4. Only if the user selects Send for that exact preview:
+
+   ```bash
+   APPROVAL_JSON=$(bash bin/notify.sh approve \
+     "$PLAN_ID" "$DIGEST" APPROVE_EXACT_NOTIFICATION)
+   APPROVAL_TOKEN=$(printf '%s' "$APPROVAL_JSON" | jq -r '.approval_token')
+   bash bin/notify.sh dispatch "$PLAN_ID" "$APPROVAL_TOKEN"
+   ```
+
+5. If the user chooses Edit, cancel the old plan, edit, create a new plan, and
+   preview again. If they choose Cancel, cancel it and do not send. If the plan
+   expires or dispatch fails, create a new plan and obtain new consent; never
+   retry from the old approval.
+
+## Hard rules
+
+- Never call notification API endpoints directly. Use `bin/notify.sh`.
+- Never use legacy `notify.sh send` or `notify.sh group`; they only create a
+  proposal and intentionally cannot dispatch.
+- Never substitute a group when a direct message cannot be delivered.
+- Never add a channel after preview.
+- Never approve or dispatch from a detached/background process, hook, cron
+  job, batch execution, or unattended agent. Those paths may create a plan and
+  report that human approval is pending.
+- Multiple direct recipients require a separate preview and approval for each
+  exact message. A group fanout may use one approval only when every receiving
+  channel is listed in the preview.

package/runtime/prime/.codex/config.toml

@@ -0,0 +1,20 @@
+[features]
+hooks = true
+
+[mcp_servers.notion]
+url = "https://mcp.notion.com/mcp"
+
+[tui]
+# Codex currently accepts built-in footer item IDs only. Egregore's dynamic
+# ◆ CONNECTED / ◇ LOCAL identity is rendered by bin/codex-session-start.sh.
+status_line = [
+  "model-with-reasoning",
+  "git-branch",
+  "current-dir",
+  "context-remaining",
+  "five-hour-limit",
+  "weekly-limit",
+  "permissions",
+  "approval-mode",
+]
+status_line_use_colors = true