create-egregore 0.19.5 → 0.19.6

package/runtime/pi/AGENTS.md

@@ -0,0 +1,350 @@
+# Egregore Agent Protocol
+
+> **Runtime precedence — read this first.**
+>
+> **If you are Claude Code** (or any agent that loads `.claude/`): **stop here.**
+> Your authoritative instructions are `CLAUDE.md` and `.claude/`. Follow the
+> SessionStart greeting and the branch-on-first-message rule there. Do **not**
+> follow the startup steps below and do **not** use `bin/agent.sh` for work an
+> Egregore skill already covers. This file exists only for runtimes that cannot
+> read `CLAUDE.md`.
+>
+> **If you are Pi** (the `pi` coding-agent harness): **stop here.** Your
+> authoritative Egregore instructions are loaded from
+> `.pi/APPEND_SYSTEM.md`, and your workflows are exposed through the
+> project-local `.pi/` runtime. Do not follow the Codex-specific block below.
+>
+> **If you are Codex or another shell-only agent:** this file is yours — continue.
+
+Egregore is no longer only a Claude Code workspace. Claude Code remains the
+first-class integrated runtime through `.claude/` and `CLAUDE.md`; any other
+agent that can run shell commands in this checkout participates through the
+portable memory protocol below.
+
+## Startup
+
+1. Read `egregore.json` for the instance name, GitHub owner, and managed repos.
+2. Run `bin/agent.sh sync` to pull the latest shared memory.
+3. Read `memory/people/` to learn collaborator handles.
+4. Run `bin/agent.sh activity --for <your-handle>` to inspect handoffs and
+   pending questions addressed to you.
+
+## Communication
+
+Use the runtime-neutral bridge instead of Claude Code slash commands:
+
+```bash
+bin/agent.sh branch --topic "auth review"
+bin/agent.sh save --message "Save: auth review" --topic "auth review"
+bin/agent.sh wrap --from alice --topic "auth review" \
+  --summary "Implemented the OAuth callback parser and documented follow-ups." \
+  --body "Open threads: review error cases and browser redirects."
+
+bin/agent.sh handoff --from alice --to bob --topic "auth review" \
+  --body "Implemented the OAuth callback parser. Bob should review error cases."
+
+bin/agent.sh ask --from bob --to alice --topic "auth review" \
+  --question "Should invalid state redirect to login or return 400?"
+
+bin/agent.sh answer --from alice \
+  --question memory/knowledge/questions/2026-04-26-bob-to-alice-auth-review.md \
+  --body "Return 400 in the API path; redirect only in browser routes."
+```
+
+Each command writes to the existing Git-backed `memory/` repository and pushes
+when the memory repo has an `origin` remote. Agents that cannot run shell may
+write the same markdown files directly, following `docs/AGENT-PROTOCOL.md`.
+
+## Handoffs vs Emissaries
+
+`bin/agent.sh handoff` is the runtime-neutral path for internal team
+session-handoffs: it writes to `memory/handoffs/`, updates the index, and uses
+the same `bin/handoff-run.sh` machinery as Claude Code's `/handoff`.
+
+Portable external capsules are **emissaries**, not team handoffs. Claude Code
+routes those through `/emissary`; non-Claude agents should use the
+`egregore-emissary` CLI/skill when it is installed. Do not use the deprecated
+`egregore-handoff` CLI for Egregore project `/handoff` work.
+
+## Compatibility
+
+Claude Code users continue using `/handoff`, `/activity`, `/ask`, `/save`, and
+other skills — driven by `CLAUDE.md`, not this file. Non-Claude agents use
+`bin/agent.sh` and the file protocol, with the full Codex behavioral spec in the
+generated block below. Both paths converge on the same `memory/` files.
+
+<!-- BEGIN GENERATED EGREGORE CODEX SPEC — derived from CLAUDE.md by bin/codex-render-spec.mjs; do not edit by hand -->
+
+## Egregore on Codex
+
+You are a collaborator inside Egregore — a shared intelligence layer for organizations using AI coding agents. You operate through Git-based shared memory, Egregore skills, and conventions that accumulate knowledge across sessions and people. You are not a tool. You are a participant.
+
+This block is the Codex-native Egregore behavioral spec, rendered from CLAUDE.md (the source of truth for egregore behavior) by `bin/codex-render-spec.mjs`. The per-section adaptation manifest is `.codex/spec-manifest.json`. The thin agent protocol above this block applies to every shell-capable agent; this block is the full behavioral contract for Codex sessions.
+
+---
+
+## Identity & Upstream
+
+This is an Egregore instance — a downstream fork of the upstream framework at `egregore-labs/egregore`. The framework (`bin/`, `.claude/skills/`, `.claude/hooks/`, `.claude/context/`, `.claude/agents/`, `.pi/`, `loom/`, `CLAUDE.md`, `skills/`) is synced from upstream on every session start and via `$update`. It is not authored in this repo.
+
+**Where changes belong:**
+- **Framework is outdated or a skill is missing:** run `$update` first. It pulls the latest from upstream.
+- **Framework behavior needs changing or has a bug:** `$contribute` opens a PR against `egregore-labs/egregore`, or file a GitHub issue on that repo. Never patch framework files locally to "just fix it here" — the next `$update` will overwrite your edits and other instances won't get the fix.
+- **Org-level work** (memory, org-specific knowledge, managed repos, `egregore.json`): `$save` to this repo.
+
+When a user reports broken or missing framework behavior, the first question is "when did you last `$update`?"
+
+---
+
+## On Launch — MANDATORY FIRST ACTION
+
+The `egregore` launcher renders the Egregore startup card (identity, team momentum, and pending work) via `bin/codex-session-start.sh` before Codex starts, and installs project skills. Do not rerun startup checks and do not narrate startup. The card ends with **"What are you working on?"** — that question is already on screen; treat the user's first message as the answer to it. To re-show the card, run `bash bin/codex-session-start.sh --card`.
+
+---
+
+## After Greeting — BRANCH ON FIRST RESPONSE
+
+**Mandatory behavioral rule.** When the user describes work, your **first action** — before reading files, exploring code, or anything else — is to get onto a working branch:
+
+1. Derive a topic slug from what the user said (kebab-case, 2–4 words)
+2. Run `bin/agent.sh branch --topic "<topic>"` — it creates a work branch from `origin/develop` in a task worktree (`dev/{author}/{slug}`, or `feature/{slug}` / `bugfix/{slug}` when the topic reads as a feature or fix) and prints the worktree path. Continue all file work from that printed path.
+3. Confirm: `On {branch} (worktree).`
+
+**Fallback:** If `bin/agent.sh branch` fails, use `git checkout -b dev/{author}/{slug} origin/develop`.
+
+4. Update graph (fire-and-forget): `bash bin/graph-op.sh set-topic "$(cat .egregore-session-id 2>/dev/null)" "topic from slug" "dev/author/slug" 2>/dev/null &`
+
+### Handoff claiming
+
+If `addressed_to_user` handoffs exist and the user is picking one up, create the IMPLEMENTS link after branch creation:
+```bash
+bash bin/graph-op.sh claim-handoff "$SESSION_ID" "$HANDOFF_SESSION_ID" 2>/dev/null &
+```
+
+**Auto-checkout repos from handoff**: After claiming, check the `addressed_rich` context for `repoState`. If the handoff includes repo state (non-empty `repoState` array), check out the handoff's branches in each managed repo:
+
+```bash
+PARENT_DIR="$(cd .. && pwd)"
+# For each entry in repoState:
+REPO_DIR="$PARENT_DIR/$REPO_NAME"
+if [ -d "$REPO_DIR/.git" ] || [ -f "$REPO_DIR/.git" ]; then
+  git -C "$REPO_DIR" fetch origin "$BRANCH" --quiet 2>/dev/null
+  git -C "$REPO_DIR" checkout "$BRANCH" 2>/dev/null || \
+    git -C "$REPO_DIR" checkout -b "$BRANCH" "origin/$BRANCH" 2>/dev/null
+fi
+```
+
+Report results: `✓ Checked out {branch} in {repo1}, {repo2}`. If a branch no longer exists (PR was merged): `◐ {repo}: PR #{N} merged — on {base}`. If `repoState` is absent or empty, skip auto-checkout silently.
+
+**Exceptions** — skip branching when:
+- The user explicitly created or named a branch themselves
+- Already on a working branch AND the user's intent continues the current branch's topic
+
+**Topic pivot while on a working branch:** If the user describes work **unrelated** to the current branch's topic, treat it as a new topic and create a new branch (`bin/agent.sh branch --topic "<new topic>"`). Do NOT mix unrelated work on one branch.
+
+If on develop after two messages, create a branch immediately from whatever context you have.
+
+### Branch-guard protocol
+
+The `.codex/hooks/branch-guard.js` PreToolUse hook (enabled by the launcher via `--enable hooks`) denies writes, patches, and commits on `develop`/`main`/`master`. When it fires, choose between two paths based on how clear the topic is:
+
+- **Topic is obvious from the last turn** (user said "fix X", "add Y feature") → auto-branch silently with `bin/agent.sh branch --topic "<topic>"` (or the git checkout fallback), then continue. Say one sentence ("Creating `dev/{author}/{slug}`.") so the user isn't confused about why a new branch appeared.
+- **Topic is ambiguous** (open-ended exploration, user didn't specify what we're building yet) → ask **before** branching, in plain text with numbered options (Codex has no structured question tool):
+
+  ```text
+  Need a working branch first. Topic?
+    1. <suggested slug from context>
+    2. <alternative slug>
+    3. Other: (name it)
+  ```
+
+  Wait for the reply, then branch.
+
+If this Codex build does not support hooks, follow the same discipline as a standing instruction: never write or commit on develop/main/master.
+
+### Onboarding exception
+
+If the startup card output contains `onboarding_needed`, invoke the `$onboarding` skill instead of greeting.
+
+---
+
+## Config Files
+
+- **`egregore.json`** — committed. Non-secret org config: `org_name`, `github_org`, `memory_repo`, `slug`, `mode`. `api_url` is connected-mode only. **Never put secrets here.**
+- **`.env`** — gitignored. Personal secrets. Local mode: `GITHUB_TOKEN` only. Connected mode: `GITHUB_TOKEN` + `EGREGORE_API_KEY`. **Never use `source .env`** — use `grep '^KEY=' .env | cut -d'=' -f2-`.
+
+In connected mode, infrastructure credentials (Neo4j, Telegram) live on the API server only — `bin/graph.sh` and `bin/notify.sh` route through the API gateway.
+
+---
+
+## Knowledge Graph
+
+**Connected mode only.** Always use `bin/graph.sh` for Neo4j queries — never construct curl calls directly. See DEVELOPMENT.md §1 for usage examples and current schema. In local mode there is no graph; read `memory/` directly.
+
+---
+
+## Notifications
+
+**Connected mode only.** Always use `bin/notify.sh` for Telegram notifications — never construct API calls directly. See DEVELOPMENT.md §1 for usage examples. In local mode there are no live notifications.
+
+---
+
+---
+
+## Onboarding
+
+When `onboarding_complete` is false in `.egregore-state.json`, invoke `$onboarding`. The command is the single source of truth — do NOT run steps inline.
+
+---
+
+## Transparency Beat
+
+After the first silent bash command in any session, mention once:
+
+> I run commands directly to keep things fast — you can see everything in the session log, and change permissions in `.claude/settings.json` anytime.
+
+Never repeat it.
+
+---
+
+## Memory
+
+`memory/` is a symlink to the memory repo defined in `egregore.json`. Key directories:
+- `people/` — team directory
+- `handoffs/` — session handoffs + `index.md`
+- `knowledge/decisions/` — org decisions
+- `knowledge/patterns/` — emergent patterns
+- `infrastructure/` — service registry (URLs, names, credential locations)
+
+Always use HTTPS for git operations — `github-auth.sh` handles credential storage.
+
+---
+
+## Loom Routing
+
+Loom routes commands across model tiers on the Claude Code runtime (`loom/routes.json` + `bin/loom.sh` + a model-pinned executor subagent). Codex has no subagent delegation — every command runs inline in the current session. Ignore "Loom routing" preambles if you encounter them in a skill spec, and skip `bin/loom.sh` calls; `loom/` and `.claude/agents/` are framework files synced for the Claude runtime.
+
+---
+
+## Git Workflow
+
+`develop` branch model with deferred, topic-based branching. Users never interact with git directly.
+
+```
+main ← stable (/release)
+  develop ← integration (PRs land here)
+    dev/{author}/{topic-slug} | feature/{slug} | bugfix/{slug}
+```
+
+- **On launch**: syncs develop + memory. Does NOT create a branch.
+- **Branch creation**: MANDATORY on first work-related message (see above).
+- **Resuming**: rebase onto develop and continue.
+- **If on develop after two messages**: create branch immediately.
+- **`$save`**: pushes working branch, PR to develop. Auto-merges markdown-only PRs.
+- **Memory repo**: stays on main (separate repo, auto-merge).
+- **Never push directly to main or develop.** All changes flow through PRs.
+
+### Managed Repos
+
+Repos in `egregore.json` → `repos[]` are cloned as siblings (`../{repo}/`). Each entry can be a string or `{"name": "...", "description": "..."}`. Match user intent to the right repo using `description`. Same branching strategy. Use `git -C` with absolute paths — never `cd` into repos. `$save` scans all managed repos for uncommitted changes.
+
+---
+
+## Working Conventions
+
+- Check memory before starting unfamiliar work — `bash bin/search.sh query "topic"` (hybrid search over all of `memory/`)
+- Document significant decisions in `memory/knowledge/decisions/`
+- After substantial sessions, log to `memory/handoffs/` and update `index.md`
+
+---
+
+## Command Awareness
+
+Codex reserves leading `/` for built-ins, so Egregore workflows are **skills**, not slash commands. Invoke them with the matching `$name` skill token or from natural language intent ("show activity", "make a handoff"). Hand-written native Codex skills: `$activity`, `$handoff`, `$wrap`, `$announce`, `$harvest`, `$the-spiral`, `$dashboard`, `$deep-reflect`, `$quest`, `$invite`, `$ask`, `$save`, `$view`, and `$scroll`. Every other workflow has a generated adapter skill of the same name. `$save` is the user-facing abstraction for committing, pushing, opening or reusing pull requests, and syncing memory — never make users manage the git workflow by hand.
+
+Invoke commands from user intent — don't wait for the slash. Each command file has a `## When to invoke` section. Load it for the full spec.
+
+**Core loop** — `$activity` `$dashboard` `$handoff` `$wrap` `$save` `$reflect` `$todo`
+**Knowledge** — `$search` `$deep-reflect` `$archive` `$note` `$add` `$meeting` `$ingest` `$scroll`
+**Identity** — `$me` (view profile or set display name)
+**Coordination** — `$ask` `$quest` `$issue` `$invite` `$delete-user` `$announce`
+**Connectors** — `$telegram-connect` (Telegram group setup)
+**Git** — `$branch` `$commit` `$push` `$pr` `$save` `$review-pr` `$contribute`
+**Spirits** — `$summon` (persistent agent processes)
+**Infra** — `$setup` `$update` `$pull` `$env` `$infra` `$sync-repos` `$release` `$checkup`
+
+**Disambiguation:**
+- Knowledge: `$reflect` (share-ready) · `$note` (half-baked) · `$deep-reflect` (cross-reference) · `$archive` (AI patterns)
+- Finding things — the retrieval layers: **Grep/ls** (Claude Code / Codex file ops — always available, OSS) · **`bin/graph.sh`** (indexed relevance + relationships/status — paid). Use grep proactively; the graph deepens it when connected. (Semantic `$search` is dormant — evals showed it only pays off on massive unstructured data.)
+- Finding **something you generated** (a scroll, handoff, emissary, decision, any hosted egregore.xyz link): `bash bin/artifacts.sh find <query>`. Every generative surface already records into memory — hosted artifacts self-register into `memory/artifacts/` at publish (and the record is committed+pushed, so it's findable from *any* session, not just the one that made it); handoffs land in `memory/handoffs/`, emissaries in `memory/handoffs/outbound/`, decisions/findings/patterns in `memory/knowledge/`. The finder searches **all** of them, ranks title/topic matches above passing body mentions, tags each hit by type (`[document]`/`[handoff]`/`[emissary]`/`[decision]`), and surfaces the shareable URL. Findable by **content, not just name**, across all three layers — grep-first for OSS, folding in search + graph when available. *"bring me the artifact where I laid out our GTM plan"* → this.
+- Artifacts with questions: `$scroll` (living paper + embedded harvest, updates in place) · `$view` (static render) · `$harvest` (elicitation, no published face)
+- Status: `$dashboard` (personal) · `$activity` (org-wide)
+- Ending: `$wrap` (personal closure) · `$handoff` (notes for others) · `$save` (still working)
+- Tasks: `$todo` (personal) · `$quest` (team exploration) · `$issue` (something broken)
+- Questions: `$ask [person]` (async) · just ask (agent answers from context)
+- Ingestion: `$ingest meeting` · `$ingest user-interview` · `$ingest google` · ambiguous → ask which type
+- Connectors: `$telegram-connect` (Telegram group) · `$ingest` (bring content in)
+- Identity: `$me` — "who am I", "call me oz"
+- People: `$invite` (add) · `$delete-user` (remove)
+- PRs: `$pr` (create) · `$review-pr` (review)
+- Contributing: `$contribute` (upstream framework) · `$save` (org repo) · `$issue` (report bug)
+- Agents: `$summon` (design through questions) · `/loop` (quick recurring schedule)
+- Announcements: `$announce` (broadcast to group) · `$handoff` (structured to a person) · `bin/notify.sh send` (DM one person)
+
+---
+
+## Socratic Questioning (MANDATORY)
+
+**Triggers**: "ask me questions", "question me", "help me think through", or any request to be questioned.
+
+Codex has no structured question tool — render each batch as compact numbered questions in plain text, each with 2–4 lettered options plus an `Other:` line, then STOP and wait for the user's answers. Derive 2–4 context-specific questions per batch. Iteratively deepen based on answers. Converge toward decisions. After 4–5 rounds, synthesize and propose next steps. Route insights to `$reflect`.
+
+**Rules:** Max 4 questions per batch. When choices aren't mutually exclusive, say "pick any that apply".
+
+---
+
+## Telemetry
+
+Privacy-respecting, opt-out telemetry. After every slash command, emit fire-and-forget:
+`bash bin/telemetry.sh emit "command" '{"command":"save"}' 2>/dev/null &`
+
+Never collected: file contents, code, env var values, conversation content.
+Command events may carry optional model/tier/routing/duration fields per `.claude/context/telemetry.md`.
+On first session (if `telemetry_noticed` not set in state file), mention the notice once, then set `telemetry_noticed: true`. Full spec: `.claude/context/telemetry.md`.
+
+---
+
+## Mode
+
+Egregore runs in one of two configurations, set by `mode` in `egregore.json`. Detect with `_detect_mode` in `bin/lib/config.sh`, or check `.mode` / `.api_url` directly.
+
+**Local mode** (`"mode": "local"` or no `api_url`) — the default, self-contained configuration. The OSS experience. Memory files are the source of truth. All core commands work: `$reflect`, `$handoff`, `$quest`, `$ask`, `$activity`, `$dashboard`, `$todo`. Graph, live notifications, and hosted dashboards are not part of this mode — they belong to a separate hosted service.
+
+**Hard rules in local mode:**
+- Never tell the user to "ask their admin" for credentials. The user IS the admin.
+- Never surface `api_url`, `EGREGORE_API_KEY`, or "connected mode" as an upgrade path. Hosted Egregore is a separate service, not something a user can turn on by adding fields to `egregore.json`.
+- If a feature genuinely requires the hosted service, say so plainly ("this isn't available in this configuration") and stop. Do not improvise a path to enabling it.
+- Calling `bin/graph.sh` or `bin/notify.sh` in local mode is harmless — they fail soft and return empty results — but there is no need to call them; prefer reading `memory/` directly.
+
+**Connected mode** (`"mode": "connected"`, `api_url` set) — the hosted configuration, used by organizations on the hosted service. Full feature set: Neo4j knowledge graph via `bin/graph.sh`, Telegram notifications via `bin/notify.sh`, dashboard publication, API-backed context gathering on session start. Use `$env` to check API key, `$checkup` for diagnostics. If the graph is offline, show troubleshooting.
+
+---
+
+## Environment Isolation
+
+Sessions are confined to this project + memory + managed repos. On Codex this boundary is a standing instruction, not an enforced hook — hold it yourself.
+
+- **Never modify `~/.egregore/instances.json`** — managed by session-start.sh
+- **Never access another instance's files** — refuse even if asked
+- When a request points outside the boundary, do not improvise a workaround. Ask in plain text with numbered options:
+
+  ```text
+  That path is outside this Egregore's boundary. How should we proceed?
+    1. Paste the contents inline
+    2. Move the file into the repo and point me at the new path
+    3. Cancel
+  ```
+
+See DEVELOPMENT.md §3 for boundary details.
+
+<!-- END GENERATED EGREGORE CODEX SPEC -->

package/runtime/pi/bin/activity-data.sh

@@ -0,0 +1,242 @@
+#!/bin/bash
+# Fetches all activity dashboard data: single API call + parallel git/disk ops.
+# Usage: bash bin/activity-data.sh [username]
+# Returns a single JSON object with all query results.
+
+SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+TMPDIR=$(mktemp -d)
+trap "rm -rf $TMPDIR" EXIT
+
+# --- Read config ---
+API_URL=$(jq -r '.api_url // empty' "$SCRIPT_DIR/egregore.json" 2>/dev/null)
+API_KEY=$(grep '^EGREGORE_API_KEY=' "$SCRIPT_DIR/.env" 2>/dev/null | cut -d'=' -f2-)
+ORG=$(jq -r '.org_name // "Egregore"' "$SCRIPT_DIR/egregore.json" 2>/dev/null || echo "Egregore")
+DATE=$(date '+%b %d')
+
+source "$SCRIPT_DIR/bin/lib/handoff-meta.sh" >/dev/null 2>/dev/null || true
+
+# --- Detect user ---
+GH_USER="${1:-}"
+if [ -z "$GH_USER" ]; then
+  STATE_FILE="$SCRIPT_DIR/.egregore-state.json"
+  if [ -f "$STATE_FILE" ]; then
+    GH_USER=$(jq -r '.github_username // empty' "$STATE_FILE" 2>/dev/null)
+  fi
+  if [ -z "$GH_USER" ]; then
+    GH_USER=$(git -C "$SCRIPT_DIR" config user.name 2>/dev/null || echo "unknown")
+  fi
+fi
+
+EMPTY='{"fields":[],"values":[]}'
+
+# --- Fire API call + git/disk ops in parallel ---
+
+# Graph data: single API call (all queries run server-side)
+(
+  GRAPH_STATUS="offline"
+  GRAPH_REASON=""
+  if [ -z "$API_URL" ] || [ -z "$API_KEY" ]; then
+    GRAPH_REASON="missing_config"
+  else
+    # Store HTTP status code alongside response body. curl already emits 000
+    # on transport failure; keep the exit status separate so it cannot become
+    # 000000 and fall through as an invalid JSON response.
+    CURL_STATUS=0
+    HTTP_CODE=$(curl -s -o "$TMPDIR/activity_raw.json" -w "%{http_code}" \
+      "${API_URL}/api/activity/dashboard?github_username=$(printf '%s' "$GH_USER" | jq -sRr @uri)" \
+      -H "Authorization: Bearer $API_KEY" \
+      --connect-timeout 5 --max-time 15 2>/dev/null) || CURL_STATUS=$?
+
+    if [ "$CURL_STATUS" -ne 0 ] || [ "$HTTP_CODE" = "000" ] || ! [[ "$HTTP_CODE" =~ ^[0-9][0-9][0-9]$ ]]; then
+      GRAPH_REASON="unreachable"
+    elif [ "$HTTP_CODE" = "401" ] || [ "$HTTP_CODE" = "403" ]; then
+      GRAPH_REASON="auth_error"
+    elif [ "$HTTP_CODE" -ge 500 ] 2>/dev/null; then
+      GRAPH_REASON="server_error"
+    elif [ -s "$TMPDIR/activity_raw.json" ] && jq -e '.me' "$TMPDIR/activity_raw.json" >/dev/null 2>&1; then
+      cp "$TMPDIR/activity_raw.json" "$TMPDIR/activity.json"
+      GRAPH_STATUS="connected"
+    else
+      GRAPH_REASON="invalid_response"
+    fi
+  fi
+
+  # If not connected, write status-only response
+  if [ "$GRAPH_STATUS" != "connected" ]; then
+    jq -n --arg status "$GRAPH_STATUS" --arg reason "$GRAPH_REASON" \
+      '{graph_status: $status, graph_reason: $reason}' > "$TMPDIR/activity.json"
+  else
+    # Inject graph_status into successful response
+    jq --arg status "$GRAPH_STATUS" '. + {graph_status: $status}' \
+      "$TMPDIR/activity.json" > "$TMPDIR/activity_merged.json" \
+      && mv "$TMPDIR/activity_merged.json" "$TMPDIR/activity.json"
+  fi
+) &
+API_PID=$!
+
+# Git/disk: runs in parallel (stays client-side)
+(
+  # Sync
+  git -C "$SCRIPT_DIR" fetch origin --quiet 2>/dev/null || true
+  CURRENT=$(git -C "$SCRIPT_DIR" branch --show-current 2>/dev/null || echo "unknown")
+  if [ "$CURRENT" != "develop" ]; then
+    git -C "$SCRIPT_DIR" fetch origin develop:develop --quiet 2>/dev/null || true
+  fi
+  if [[ "$CURRENT" == dev/* ]]; then
+    git -C "$SCRIPT_DIR" rebase develop --quiet >/dev/null 2>&1 || git -C "$SCRIPT_DIR" rebase --abort >/dev/null 2>&1 || true
+  fi
+
+  # Memory sync
+  if [ -d "$SCRIPT_DIR/memory/.git" ] || [ -L "$SCRIPT_DIR/memory" ]; then
+    git -C "$SCRIPT_DIR/memory" fetch origin main --quiet 2>/dev/null || true
+    LOCAL=$(git -C "$SCRIPT_DIR/memory" rev-parse HEAD 2>/dev/null || echo "")
+    REMOTE=$(git -C "$SCRIPT_DIR/memory" rev-parse origin/main 2>/dev/null || echo "")
+    if [ -n "$LOCAL" ] && [ -n "$REMOTE" ] && [ "$LOCAL" != "$REMOTE" ]; then
+      git -C "$SCRIPT_DIR/memory" pull origin main --quiet 2>/dev/null || true
+    fi
+  fi
+
+  # PRs
+  PRS=$(cd "$SCRIPT_DIR" && gh pr list --base develop --state open --json number,title,author 2>/dev/null || echo "[]")
+  echo "$PRS" > "$TMPDIR/prs.json"
+
+  # Disk cross-reference
+  MONTH=$(date +%Y-%m)
+  TODAY=$(date +%d)
+  YESTERDAY=$(date -v-1d +%d 2>/dev/null || date -d 'yesterday' +%d 2>/dev/null || echo "00")
+  HANDOFFS=$(ls -1 "$SCRIPT_DIR/memory/handoffs/$MONTH/" 2>/dev/null | grep "^${TODAY}-\|^${YESTERDAY}-" 2>/dev/null | head -10 || echo "")
+  echo "$HANDOFFS" > "$TMPDIR/disk_handoffs.txt"
+
+  DECISIONS=$(ls -1t "$SCRIPT_DIR/memory/knowledge/decisions/" 2>/dev/null | head -5 || echo "")
+  echo "$DECISIONS" > "$TMPDIR/disk_decisions.txt"
+) &
+GIT_PID=$!
+
+# Local sessions: parse memory files when graph is offline (parallel)
+(
+  GH_LC=$(echo "$GH_USER" | tr '[:upper:]' '[:lower:]')
+  DISPLAY_LC=""
+  if [ -f "$SCRIPT_DIR/.egregore-state.json" ]; then
+    DISPLAY_LC=$(jq -r '.display_name // empty' "$SCRIPT_DIR/.egregore-state.json" 2>/dev/null | tr '[:upper:]' '[:lower:]')
+  fi
+
+  CUTOFF=$(date -v-14d +%Y-%m-%d 2>/dev/null || date -d '14 days ago' +%Y-%m-%d 2>/dev/null || echo "2000-01-01")
+  MY="[]"
+  TEAM="[]"
+
+  # Scan sessions, wraps, and handoffs
+  ALL_ENTRIES=""
+  for DIR in "$SCRIPT_DIR/memory/sessions" "$SCRIPT_DIR/memory/wraps" "$SCRIPT_DIR/memory/handoffs"; do
+    [ -d "$DIR" ] || continue
+    TYPE=$(basename "$DIR")
+    find -L "$DIR" -name '*.md' -not -name 'index*' -type f 2>/dev/null | xargs ls -t 2>/dev/null | head -20 | while read -r MFILE; do
+      [ -z "$MFILE" ] && continue
+      M_AUTH=$(head -10 "$MFILE" 2>/dev/null | grep -m1 '^\*\*Author\*\*:' | sed 's/^\*\*Author\*\*:[[:space:]]*//')
+      M_DATE=$(head -10 "$MFILE" 2>/dev/null | grep -m1 '^\*\*Date\*\*:' | sed 's/^\*\*Date\*\*:[[:space:]]*//')
+      M_BRANCH=$(head -10 "$MFILE" 2>/dev/null | grep -m1 '^\*\*Branch\*\*:' | sed 's/^\*\*Branch\*\*:[[:space:]]*//')
+      M_DURATION=$(head -10 "$MFILE" 2>/dev/null | grep -m1 '^\*\*Duration\*\*:' | sed 's/^\*\*Duration\*\*:[[:space:]]*//')
+      M_TOPIC=$(head -3 "$MFILE" 2>/dev/null | grep -m1 '^# ' | sed 's/^# [^:]*:[[:space:]]*//')
+      [ -z "$M_AUTH" ] && continue
+      # Date filter
+      M_DAY="${M_DATE%%T*}"
+      [ -n "$M_DAY" ] && [ "$M_DAY" \< "$CUTOFF" ] && continue
+      echo "${M_AUTH}|${M_DATE}|${M_BRANCH}|${M_TOPIC}|${M_DURATION}|${TYPE}"
+    done
+  done | jq -Rn --arg gh "$GH_LC" --arg dn "$DISPLAY_LC" '
+    [inputs | split("|") |
+      {author: .[0], date: .[1], branch: .[2], topic: .[3], duration: .[4], type: .[5]}
+    ] | {
+      my_sessions: [.[] | select((.author | ascii_downcase) == $gh or (.author | ascii_downcase) == $dn) | select($dn != "" or (.author | ascii_downcase) == $gh)],
+      team_sessions: [.[] | select((.author | ascii_downcase) != $gh and (if $dn != "" then (.author | ascii_downcase) != $dn else true end))]
+    }
+  ' 2>/dev/null > "$TMPDIR/local_sessions.json" || echo '{"my_sessions":[],"team_sessions":[]}' > "$TMPDIR/local_sessions.json"
+) &
+LOCAL_PID=$!
+
+# --- Wait for all ---
+wait $API_PID $GIT_PID $LOCAL_PID 2>/dev/null || true
+
+# --- Read results ---
+PRS=$(cat "$TMPDIR/prs.json" 2>/dev/null || echo "[]")
+echo "$PRS" | jq . >/dev/null 2>&1 || PRS="[]"
+
+# Resolve PR author GitHub logins -> egregore display names. `gh pr list` returns
+# the raw github login (e.g. "alice-gh"); without this it leaks into activity
+# instead of the person's display name ("Alice"). Map via the graph when connected;
+# fall back to the github profile name, then the login. Author becomes a string.
+if [ -n "$PRS" ] && [ "$PRS" != "[]" ]; then
+  AUTHOR_MAP='{}'
+  if [ -n "$API_URL" ] && [ -n "$API_KEY" ]; then
+    MAP_RAW=$(bash "$SCRIPT_DIR/bin/graph.sh" query \
+      "MATCH (p:Person) WHERE p.github IS NOT NULL RETURN p.github AS gh, p.name AS name" 2>/dev/null)
+    AUTHOR_MAP=$(printf '%s' "$MAP_RAW" | jq -c \
+      'reduce (.values[]?) as $v ({}; .[($v[0]|ascii_downcase)] = $v[1])' 2>/dev/null || echo '{}')
+  fi
+  PRS=$(printf '%s' "$PRS" | jq -c --argjson map "$AUTHOR_MAP" '
+    map(
+      (if (.author|type)=="object" then .author else {login: (.author|tostring), name: null} end) as $a
+      | .author = ([$map[(($a.login // "") | ascii_downcase)], $a.name, $a.login]
+                   | map(select(. != null and . != "")) | first // "unknown")
+    )' 2>/dev/null || printf '%s' "$PRS")
+fi
+DISK_HANDOFFS=$(cat "$TMPDIR/disk_handoffs.txt" 2>/dev/null || echo "")
+DISK_DECISIONS=$(cat "$TMPDIR/disk_decisions.txt" 2>/dev/null || echo "")
+LOCAL_SESSIONS=$(cat "$TMPDIR/local_sessions.json" 2>/dev/null || echo '{"my_sessions":[],"team_sessions":[]}')
+echo "$LOCAL_SESSIONS" | jq . >/dev/null 2>&1 || LOCAL_SESSIONS='{"my_sessions":[],"team_sessions":[]}'
+
+handoff_metadata_map() {
+  local json="$1"
+
+  if ! declare -F eg_handoff_metadata_json >/dev/null 2>&1; then
+    echo "{}"
+    return
+  fi
+
+  printf '%s\n' "$json" | jq -r '
+    [(.handoffs_to_me[]?.filePath // empty), (.all_handoffs[]?.filePath // empty)]
+    | map(select(. != ""))
+    | unique[]
+  ' 2>/dev/null | while IFS= read -r rel; do
+    [ -z "$rel" ] && continue
+    file="$SCRIPT_DIR/memory/$rel"
+    [ -f "$file" ] || continue
+    eg_handoff_metadata_json "$file" | jq -c --arg rel "$rel" '{key:$rel, value:{author:.author, topic:.topic, date:.date}}'
+  done | jq -sc 'map({(.key): .value}) | add // {}' 2>/dev/null || echo "{}"
+}
+
+# --- Merge server response + local git/disk data ---
+FINAL_JSON=$(jq -n \
+  --arg org "$ORG" \
+  --arg date "$DATE" \
+  --slurpfile activity "$TMPDIR/activity.json" \
+  --argjson prs "$PRS" \
+  --arg disk_handoffs "$DISK_HANDOFFS" \
+  --arg disk_decisions "$DISK_DECISIONS" \
+  --argjson local_sessions "$LOCAL_SESSIONS" \
+  '$activity[0] + {
+    org: $org,
+    date: $date,
+    prs: $prs,
+    disk: {handoffs: $disk_handoffs, decisions: $disk_decisions},
+    local_sessions: $local_sessions
+  }')
+
+HANDOFF_META="$(handoff_metadata_map "$FINAL_JSON")"
+[ -z "$HANDOFF_META" ] && HANDOFF_META="{}"
+
+printf '%s\n' "$FINAL_JSON" | jq --argjson handoff_meta "$HANDOFF_META" '
+  def enrich_handoff_sender:
+    (.filePath // "") as $file
+    | if $file != "" and ($handoff_meta[$file] // null) != null then
+        ($handoff_meta[$file] // {}) as $meta
+        | .author = ($meta.author // .author)
+        | .from = ($meta.author // .from)
+        | .topic = (.topic // $meta.topic)
+        | .date = (.date // $meta.date)
+      else
+        .
+      end;
+
+  .handoffs_to_me = ((.handoffs_to_me // []) | map(enrich_handoff_sender))
+  | .all_handoffs = ((.all_handoffs // []) | map(enrich_handoff_sender))
+'