create-egregore 0.19.7 → 0.19.11

package/runtime/codex/.codex/hooks/branch-guard.js

@@ -48,22 +48,86 @@ function inside(child, parent) {
   return rel === "" || (!!rel && !rel.startsWith("..") && !path.isAbsolute(rel));
 }
 
-function findProjectDir(input) {
-  // Tool payload cwd is the operation location. Codex launchers may keep
-  // EGREGORE_CODEX_PROJECT_DIR pointed at the main checkout even after the
-  // model continues in a task worktree, so using the env var first can make
-  // legitimate worktree writes look like writes on protected develop.
-  const cwd = input.cwd || process.cwd() || process.env.EGREGORE_CODEX_PROJECT_DIR;
-  const top = run("git", ["-C", cwd, "rev-parse", "--show-toplevel"], cwd);
-  if (top) return realish(top);
+function nearestExistingDirectory(candidate) {
+  let cursor = path.resolve(candidate);
+  try {
+    if (fs.existsSync(cursor) && !fs.statSync(cursor).isDirectory()) cursor = path.dirname(cursor);
+  } catch {}
+  while (!fs.existsSync(cursor)) {
+    const parent = path.dirname(cursor);
+    if (parent === cursor) break;
+    cursor = parent;
+  }
+  return cursor;
+}
+
+function gitContext(candidate) {
+  if (!candidate) return null;
+  const probe = nearestExistingDirectory(candidate);
+  const top = run("git", ["-C", probe, "rev-parse", "--show-toplevel"], probe);
+  if (!top) return null;
+  const commonRaw = run("git", ["-C", top, "rev-parse", "--git-common-dir"], top);
+  const common = commonRaw
+    ? realish(path.isAbsolute(commonRaw) ? commonRaw : path.join(top, commonRaw))
+    : realish(path.join(top, ".git"));
+  return { top: realish(top), common };
+}
+
+function shellRetarget(command) {
+  // Only retarget a single operation. Mixed command chains are evaluated from
+  // the hub context so one external `git -C` cannot mask a later project write.
+  if (shellSegments(command).length !== 1) return "";
+  const gitC = String(command || "").match(/(?:^|[;&|]\s*)git\s+-C\s+("[^"]*"|'[^']*'|[^\s;&|]+)/);
+  const cdAnd = String(command || "").match(/^\s*cd\s+("[^"]*"|'[^']*'|[^\s;&|]+)\s*&&/);
+  const raw = (gitC && gitC[1]) || (cdAnd && cdAnd[1]) || "";
+  const target = raw.replace(/^['"]|['"]$/g, "");
+  return /[$`*?]/.test(target) ? "" : target;
+}
+
+function operationCandidate(input, baseDir) {
+  const toolName = input.tool_name || "";
+  const toolInput = input.tool_input || {};
+  const explicitWorkdir = toolInput.workdir || toolInput.cwd || "";
+  let candidate = explicitWorkdir
+    ? (path.isAbsolute(explicitWorkdir) ? explicitWorkdir : path.join(baseDir, explicitWorkdir))
+    : baseDir;
 
-  const envDir = process.env.EGREGORE_CODEX_PROJECT_DIR || "";
-  if (envDir) {
-    const envTop = run("git", ["-C", envDir, "rev-parse", "--show-toplevel"], envDir);
-    return realish(envTop || envDir);
+  if (toolName === "Edit" || toolName === "Write") {
+    const target = toolInput.file_path || toolInput.path || "";
+    if (target) candidate = path.isAbsolute(target) ? target : path.join(candidate, target);
+  } else if (toolName === "Bash") {
+    const target = shellRetarget(toolInput.command || "");
+    if (target) candidate = path.isAbsolute(target) ? target : path.join(candidate, target);
+  }
+
+  return candidate;
+}
+
+function findProjectContext(input) {
+  // The launcher keeps EGREGORE_CODEX_PROJECT_DIR on the hub checkout while
+  // individual tool calls can target a task worktree, memory, or a managed
+  // repo. Compare Git common dirs: a task worktree shares the hub common dir
+  // and must use its own branch; memory/managed repos are separate and exempt.
+  const fallback = input.cwd || process.cwd();
+  const hubSeed = process.env.EGREGORE_CODEX_PROJECT_DIR || fallback;
+  const hub = gitContext(hubSeed);
+  const baseDir = input.cwd || hub?.top || fallback;
+  const candidate = operationCandidate(input, baseDir);
+  const operation = gitContext(candidate);
+
+  if (!hub) return { projectDir: operation?.top || realish(baseDir), external: false };
+  if (operation && operation.common === hub.common) {
+    return { projectDir: operation.top, external: false };
+  }
+  if (operation && operation.common !== hub.common) {
+    return { projectDir: hub.top, external: true };
   }
 
-  return realish(cwd);
+  const resolvedCandidate = realish(candidate);
+  if (!inside(resolvedCandidate, hub.top)) {
+    return { projectDir: hub.top, external: true };
+  }
+  return { projectDir: hub.top, external: false };
 }
 
 function currentBranch(projectDir) {
@@ -95,7 +159,7 @@ function isExemptPath(rawPath, projectDir, memoryDir) {
     if (inside(resolved, target)) return true;
   }
 
-  for (const file of [".egregore-state.json", ".env"]) {
+  for (const file of [".egregore-state.json", ".egregore-branch-consent", ".env"]) {
     if (resolved === realish(path.join(projectDir, file))) return true;
   }
 
@@ -133,12 +197,13 @@ function commandTargetsOtherRepo(command, projectDir, memoryDir) {
 }
 
 function isBranchSetupCommand(command) {
+  if (shellSegments(command).length !== 1) return false;
   return (
-    /\bbin\/agent\.sh\s+branch\b/.test(command) ||
-    /\bgit\s+(checkout|switch)\s+(-b|-c)\b/.test(command) ||
-    /\bgit\s+branch\s+(dev|feature|bugfix)\//.test(command) ||
-    /\bgit\s+worktree\s+add\b/.test(command) ||
-    /\bbin\/worktree\.sh\s+setup\b/.test(command)
+    /^\s*bin\/agent\.sh\s+branch\b/.test(command) ||
+    /^\s*git\s+(checkout|switch)\s+(-b|-c)\b/.test(command) ||
+    /^\s*git\s+branch\s+(dev|feature|bugfix)\//.test(command) ||
+    /^\s*git\s+worktree\s+add\b/.test(command) ||
+    /^\s*bin\/worktree\.sh\s+setup\b/.test(command)
   );
 }
 
@@ -149,7 +214,134 @@ function stagedOnlyFrameworkPaths(projectDir) {
   return files.length > 0 && files.every((file) => /^(bin\/|\.claude\/|\.codex\/|CLAUDE\.md$|AGENTS\.md$|skills\/)/.test(file));
 }
 
+function stripQuotedSegments(command) {
+  let out = "";
+  let quote = null;
+  for (let i = 0; i < String(command || "").length; i++) {
+    const ch = command[i];
+    if (quote) {
+      if (quote === '"' && ch === "\\") i++;
+      else if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === "'" || ch === '"') {
+      quote = ch;
+      out += "x";
+      continue;
+    }
+    out += ch;
+  }
+  return out;
+}
+
+function maskQuotedOperators(command) {
+  let out = "";
+  let quote = null;
+  for (let i = 0; i < String(command || "").length; i++) {
+    const ch = command[i];
+    if (quote) {
+      if (quote === '"' && ch === "\\") {
+        out += ch;
+        if (i + 1 < command.length) out += command[++i];
+        continue;
+      }
+      if (ch === quote) quote = null;
+      out += /[><|;&]/.test(ch) ? " " : ch;
+      continue;
+    }
+    if (ch === "'" || ch === '"') quote = ch;
+    out += ch;
+  }
+  return out;
+}
+
+function shellSegments(command) {
+  const segments = [];
+  let current = "";
+  let quote = null;
+  for (let i = 0; i < String(command || "").length; i++) {
+    const ch = command[i];
+    if (quote) {
+      current += ch;
+      if (quote === '"' && ch === "\\" && i + 1 < command.length) current += command[++i];
+      else if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === "'" || ch === '"') {
+      quote = ch;
+      current += ch;
+      continue;
+    }
+    if (ch === ";" || ch === "|" || ch === "&" || ch === "\n") {
+      if (current.trim()) segments.push(current.trim());
+      current = "";
+      continue;
+    }
+    current += ch;
+  }
+  if (current.trim()) segments.push(current.trim());
+  return segments;
+}
+
+function shellWords(segment) {
+  const words = [];
+  let current = "";
+  let quote = null;
+  for (let i = 0; i < String(segment || "").length; i++) {
+    const ch = segment[i];
+    if (quote) {
+      if (quote === '"' && ch === "\\" && i + 1 < segment.length) current += segment[++i];
+      else if (ch === quote) quote = null;
+      else current += ch;
+      continue;
+    }
+    if (ch === "'" || ch === '"') {
+      quote = ch;
+      continue;
+    }
+    if (/\s/.test(ch)) {
+      if (current) words.push(current);
+      current = "";
+      continue;
+    }
+    if (ch === "\\") {
+      if (i + 1 < segment.length) current += segment[++i];
+      continue;
+    }
+    current += ch;
+  }
+  if (current) words.push(current);
+  return words;
+}
+
+function filesystemMutationStatus(command, projectDir, memoryDir) {
+  const commands = new Set(["rm", "mv", "cp", "mkdir", "rmdir", "touch", "chmod", "chown", "ln", "tee"]);
+  let unsafe = false;
+
+  for (const segment of shellSegments(command)) {
+    const words = shellWords(segment);
+    while (words.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[0])) words.shift();
+    while (words[0] === "sudo" || words[0] === "command" || words[0] === "env") words.shift();
+    if (!words.length) continue;
+
+    const name = path.basename(words.shift());
+    if (!commands.has(name)) continue;
+
+    const args = words.filter((word) => !word.startsWith("-"));
+    let targets = args;
+    if (name === "cp" || name === "ln") targets = args.length ? [args[args.length - 1]] : [];
+    if (name === "chmod" || name === "chown") targets = args.slice(1);
+
+    if (!targets.length || targets.some((target) =>
+      /[$`*?{}]/.test(target) || !isExemptPath(target, projectDir, memoryDir)
+    )) unsafe = true;
+  }
+
+  return { unsafe };
+}
+
 function redirectLooksMutating(command, projectDir, memoryDir) {
+  const visible = maskQuotedOperators(command);
   const redirectPatterns = [
     /(?:^|[\s;|&])(?:\d*)>>?\s*([^&\s;|]+)/g,
     /\|\s*tee\s+(?:-a\s+)?([^&\s;|]+)/g,
@@ -157,7 +349,7 @@ function redirectLooksMutating(command, projectDir, memoryDir) {
 
   for (const pattern of redirectPatterns) {
     let match;
-    while ((match = pattern.exec(command))) {
+    while ((match = pattern.exec(visible))) {
       const target = String(match[1] || "").replace(/^["']|["']$/g, "");
       if (!target || target === "/dev/null" || target.startsWith("$")) continue;
       if (!isExemptPath(target, projectDir, memoryDir)) return true;
@@ -168,18 +360,31 @@ function redirectLooksMutating(command, projectDir, memoryDir) {
 
 function shellLooksMutating(command, projectDir, memoryDir) {
   if (!command.trim()) return false;
-  if (isBranchSetupCommand(command)) return false;
+  const visible = stripQuotedSegments(command);
+  if (isBranchSetupCommand(visible)) return false;
 
   const mutatingPatterns = [
-    /\bgit\s+(add|commit|push|rm|mv|reset|restore|checkout\s+--|clean|rebase|merge|cherry-pick)\b/,
-    /\b(apply_patch|touch|mkdir|rm|mv|cp|chmod|chown|ln)\b/,
-    /\b(sed|perl)\b[^;&|]*\s-i(\s|$)/,
-    /\b(npm|pnpm|yarn|bun)\s+(install|add|remove|update|dedupe|ci)\b/,
-    /\b(go\s+mod\s+tidy|cargo\s+(fmt|fix|update)|rustfmt|prettier\s+--write|eslint\s+--fix)\b/,
+    /(?:^|[;&|(\n]\s*)(?:sudo\s+)?git(?:\s+-C\s+\S+)?\s+(add|commit|push|rm|mv|reset|restore|checkout\s+--|clean|rebase|merge|cherry-pick)\b/,
+    /(?:^|[;&|(\n]\s*)(?:sudo\s+)?apply_patch\b/,
+    /(?:^|[;&|(\n]\s*)(?:sudo\s+)?(sed|perl)\b[^;&|]*\s-i(\s|$)/,
+    /(?:^|[;&|(\n]\s*)(?:sudo\s+)?(npm|pnpm|yarn|bun)\s+(install|add|remove|update|dedupe|ci)\b/,
+    /(?:^|[;&|(\n]\s*)(?:sudo\s+)?(go\s+mod\s+tidy|cargo\s+(fmt|fix|update)|rustfmt|prettier\s+--write|eslint\s+--fix)\b/,
   ];
 
-  if (/\bgit\s+commit\b/.test(command) && stagedOnlyFrameworkPaths(projectDir)) return false;
-  return mutatingPatterns.some((pattern) => pattern.test(command)) || redirectLooksMutating(command, projectDir, memoryDir);
+  const gitCommit = /(?:^|[;&|(\n]\s*)(?:sudo\s+)?git(?:\s+-C\s+\S+)?\s+commit\b/.test(visible);
+  if (gitCommit && stagedOnlyFrameworkPaths(projectDir)) return false;
+
+  const filesystem = filesystemMutationStatus(command, projectDir, memoryDir);
+  return mutatingPatterns.some((pattern) => pattern.test(visible)) ||
+    filesystem.unsafe ||
+    redirectLooksMutating(command, projectDir, memoryDir);
+}
+
+function isConsentCommand(command, branch) {
+  const escaped = branch.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(
+    `^\\s*echo\\s+['"]?${escaped}['"]?\\s*>\\s*(?:\\./)?\\.egregore-branch-consent\\s*$`
+  ).test(String(command || ""));
 }
 
 function deny(reason) {
@@ -194,7 +399,9 @@ function deny(reason) {
 
 function main() {
   const input = parseJson(readStdin());
-  const projectDir = findProjectDir(input);
+  const context = findProjectContext(input);
+  if (context.external) return;
+  const projectDir = context.projectDir;
   const branch = currentBranch(projectDir);
   if (!isProtectedBranch(branch)) return;
 
@@ -211,11 +418,11 @@ function main() {
   const memoryDir = realish(path.join(projectDir, "memory"));
   const author = currentAuthor(projectDir);
   const reason = [
-    `Protected branch (${branch}). Ask the user how to proceed — do NOT auto-branch silently.`,
-    "Offer a choice (numbered or structured): Branch off (default) / Proceed on this branch / Cancel.",
-    `  • Branch off:        bin/agent.sh branch --topic "<work topic>"  (prefix dev/${author}/...)`,
-    `  • Proceed on ${branch}: echo '${branch}' > .egregore-branch-consent  then retry`,
-    "Proceeding records consent for this branch for the rest of the session (cleared on next session start).",
+    `Protected branch (${branch}). Move project work to a task branch before writing.`,
+    `If the work topic is clear, run bin/agent.sh branch --topic "<work topic>" automatically (prefix dev/${author}/...), continue in the printed worktree, and briefly tell the user.`,
+    "Ask only when the work topic is genuinely ambiguous; ask for the topic, not for routine Git permission.",
+    `Only when the user explicitly requested writing on ${branch}, record consent with: echo '${branch}' > .egregore-branch-consent`,
+    "Memory, framework-runtime, and managed-repo writes are exempt and should not trigger this guard.",
   ].join("\n");
 
   if (toolName === "apply_patch") {
@@ -234,6 +441,7 @@ function main() {
 
   if (toolName === "Bash") {
     const command = String(toolInput.command || "");
+    if (isConsentCommand(command, branch)) return;
     if (commandTargetsOtherRepo(command, projectDir, memoryDir)) return;
     if (shellLooksMutating(command, projectDir, memoryDir)) deny(reason);
   }

package/runtime/codex/.codex/skills/activity/SKILL.md

@@ -15,15 +15,27 @@ remain enough to render a useful answer.
 
 1. Verify `bin/agent.sh` exists. If it does not, say this is not an Egregore
    checkout.
-2. Run `bin/agent.sh sync`.
-3. Resolve the requested handle:
+2. If the request is `activity done N`, `activity expire N`, or
+   `activity reopen N`, fetch `bin/activity-data.sh` to a temporary JSON file,
+   map `N` to the corresponding `handoffs_to_me[N-1].sessionId`, and run:
+
+```bash
+bash bin/activity-action.sh <done|expire|reopen> "<session-id>"
+```
+
+Report the resulting topic and state. Never accept a raw session ID from the
+visible command when a numbered activity item is available; the number keeps
+the mutation tied to what the user just saw. In local mode, preserve the
+script's explicit unavailable result.
+3. Run `bin/agent.sh sync`.
+4. Resolve the requested handle:
    - If the user named a person, match it against `memory/people/*.md`.
    - Otherwise use `.egregore-state.json` `github_username`, then git user
      fallback.
-4. Run `bash bin/activity-data.sh [handle]` with network escalation and capture
+5. Run `bash bin/activity-data.sh [handle]` with network escalation and capture
    stdout as JSON. This command performs the graph API call internally; a
    normal sandboxed Codex shell can make a healthy graph look unreachable.
-5. Classify the graph status:
+6. Classify the graph status:
 
 ```bash
 node bin/codex-skill-render.mjs classify-graph --mode connected
@@ -37,7 +49,7 @@ say Codex graph network access was not granted; do not claim the graph itself
 was unreachable. Do not retry for `missing_config`, `auth_error`, or
 `server_error`; render the clear reason instead.
 
-6. Render the card with:
+7. Render the card with:
 
 ```bash
 node bin/codex-skill-render.mjs activity-card <json-file>
@@ -47,7 +59,7 @@ Paste the rendered card exactly in the visible response, preferably in a
 `text` fenced block. Do not paraphrase the card into bullets unless the user
 asks for a summary.
 
-7. Offer one compact focus prompt:
+8. Offer one compact focus prompt:
    - `Handoffs` - open pending handoffs.
    - `Questions` - answer or inspect pending questions.
    - `Recent work` - inspect sessions and wraps.

package/runtime/codex/.codex/skills/deep-reflect/SKILL.md

@@ -1,74 +1,109 @@
 ---
 name: deep-reflect
-description: Cross-reference an insight against the Egregore knowledge base using Codex-native staged analysis when the user invokes /deep-reflect or $deep-reflect.
+description: Deep research over the Egregore org memory — multi-hop, evidence-verified synthesis of what the org collectively knows — when the user invokes /deep-reflect or $deep-reflect.
 ---
 
-# Egregore Deep Reflect
+# Egregore Deep Reflect (v4)
 
-Native Codex Egregore skill. Use this for evidence-based analysis of how a new
-insight relates to the existing knowledge base.
+Native Codex Egregore skill. Ask the org's memory a question and return a
+verified, cited synthesis of what it collectively knows — including what it
+doesn't. `/reflect` captures user thought; `/deep-reflect` researches what the
+org already knows.
 
-## Modes
+Full contracts live in `.claude/skills/deep-reflect/` (`SKILL.md` entry,
+`RESEARCH.md` engine, `ROLES.md` agent roles, `REPORT.md` output). Follow them;
+this file is the Codex-runtime adapter.
 
-- empty request: deep mode.
-- `focused ...`: focused topic mode.
-- `quick ...` or `category: content`: quick mode.
+## Modes
 
-Detect directed questions when the user asks how, why, what something means, or
-about a relationship. Preserve the user's lens while still surfacing important
-signals outside the lens.
+- Question (default): interrogative or bare-topic arguments → "what does the
+  org know about X?"
+- Cross-ref: "cross-reference this" / a declarative insight → "how does this
+  insight sit against existing memory?"
+- Depth: `--brief` (1 hop wave), standard (≤3), `--deep` (≤5). Default is
+  dynamic from the corpus probe.
 
 ## Flow
 
-1. Check `egregore.json` mode first. In local mode, do a lightweight reflection
-   from memory files and do not call graph, batch graph, or notification
-   scripts.
-2. In all modes, run `bin/agent.sh search "$TOPIC" -n 6` — hybrid content
-   recall over the whole memory repo. Feed strong hits into the candidate
-   set; in local mode this is the primary context source.
-3. In connected mode, additionally gather graph context with `bin/graph.sh`
-   and suppress raw JSON. Query recent sessions, active quests, recent
-   artifacts, decisions, the topic landscape, and the full artifact
-   landscape.
-4. If the graph is unavailable or has fewer than about ten artifacts, fall back
-   to lightweight reflection and say why in one line.
-5. Select candidate artifacts. Prefer title, type, topics, quest, author, and
-   date metadata first; fetch file contents only for the selected subset.
-6. Use Codex multi-agent or subagent tooling only if it is available in the
-   current session. If not, run a single-model staged analysis:
-   - candidate selection summary
-   - evidence extraction summary
-   - signal analysis
-   - final synthesis
-7. Classify signals as tension, convergence, gap, dependency, phase shift,
-   redundancy, emergence, reinforcement, or a named custom type.
-8. Write a markdown artifact under `memory/knowledge/deep-reflect/` with
-   frontmatter for run id, mode, lens, author, created time, and selected
-   evidence paths.
-9. In connected mode, write best-effort graph edges with `bin/graph.sh` or
-   `bin/graph-batch.sh`. Use `TENSION_WITH` for conflict signals and
-   `RELATES_TO` for other signals.
-10. Save memory and repo changes with `bin/agent.sh save --message "Deep reflect: $TOPIC" --topic "$TOPIC"`.
+1. Check `egregore.json` mode FIRST. Local mode: full engine over files; never
+   call graph, batch-graph, or notification scripts; zero graph vocabulary in
+   output. Connected: graph adds hop rails and writeback, every graph call
+   non-fatal (`2>/dev/null || true`).
+2. FRAME: corpus probe — 2× `bin/agent.sh search "$TOPIC" --fast -n 20` with
+   different wordings + `bin/artifacts.sh find "$TOPIC"` +
+   `grep -ril "$TOPIC" memory/knowledge/ memory/handoffs/ memory/artifacts/`.
+   N = the union of unique paths; set the wave budget from N per
+   `RESEARCH.md` §Budget; decompose the question into 2-4 sub-questions;
+   print a plan line (`Researching: … · ~N relevant docs · budget M waves ·
+   est ~X min`). Under ~5 relevant docs: say memory is too thin and offer
+   `/reflect` or `/harvest` instead of faking research. If search errors or
+   returns nothing while grep hits, rely on grep and note "recall degraded".
+3. SEED: check `memory/knowledge/research/` for prior runs on the topic —
+   their cited artifacts (frontmatter `artifacts_cited`, older reports use
+   `artifacts_consulted`; resolve filename stems with `find`) are pre-warmed
+   leads, and their `null_regions` gaps get re-audited. Build a frontier of
+   ≤12 docs from search probes, frontmatter topic/quest greps, and index
+   ledgers.
+4. HOP WAVES: the Codex runtime has no Workflow tool — run the foreground
+   staged path from `ROLES.md`: per wave, read 8-12 docs (subagents if the
+   session offers them, otherwise staged single-model passes), extract
+   claims-with-verbatim-excerpts and typed leads (doc links, quests, people,
+   sessions, topic terms, named absences). Dedup against the seen-set, score
+   leads, hop until saturation per `RESEARCH.md` (coverage on every
+   sub-question plus low novelty or zero yield; or budget).
+5. PATTERN: two de-correlated passes. Without subagents true blindness is
+   impossible — degrade deliberately: run the TENSION pass FIRST (grouped by
+   topic), then the convergence pass (chronological), so tension-finding is
+   never anchored by an existing convergence story. Disagreement between
+   passes is a finding, never averaged away.
+6. VERIFY: for every claim, whitespace-normalize the excerpt and re-find it in
+   the cited file (miss = miscite = kill; supported paraphrase = correct the
+   excerpt). The mechanical re-check survives self-verification — it is a
+   grep, not a judgment. Re-attack every gap claim with one extra probe; a
+   found doc refutes the gap and joins the ledger. Evidence older than ~90
+   days gets one `--fast` newer-artifact probe. Report the kill count. When
+   the verifying context is the same one that made the claims, mark the
+   report's provenance `verification: self-checked`.
+7. SYNTHESIZE + PRESENT: stance, not summary — answer first, then ◆ primary /
+   ◇ secondary findings with `memory/...` path citations, tensions, and "what
+   memory doesn't hold" (gaps + the probes that prove them). Confidence is
+   derived from evidence structure (verified + ≥3 independent sources = high;
+   single-source always labeled). Register: analyst, not critic.
+8. CAPTURE (user-gated): Save (default) / Edit first / File follow-ups /
+   Skip. On Save write `memory/knowledge/research/YYYY-MM-DD-author-slug.md`
+   with frontmatter (question, mode, stop_reason, waves, docs_read,
+   claims_killed, builds_on, artifacts_consulted, artifacts_cited,
+   null_regions), then connected-mode best-effort graph writes per the main
+   `REPORT.md` §Writeback (MERGE with filePath — do NOT use
+   `graph-op.sh register-artifact`; `RELATES_TO`/`TENSION_WITH` for verified
+   cross-ref claims only), then
+   `bin/agent.sh save --message "Deep research: $TOPIC" --topic "$TOPIC"`.
+   On Skip: nothing is written except the local run ledger under
+   `.egregore/research-runs/`. Render the TUI box AFTER the gate, reflecting
+   the actual outcome.
 
 ## Output
 
-Lead with the strongest finding, then list primary signals, evidence paths, and
-recommended next action. Keep secondary and ambient signals short.
-
-Structured UX parity is required. Then render the Egregore deep-reflect
-confirmation TUI:
+Render the Egregore deep-reflect confirmation TUI after the capture gate:
 
-- Use a 72-column outer box with standard top/separator/content/bottom lines.
-- Header: `DEEP REFLECT`, author, and date.
-- Body: lens/topic, strongest finding, signal counts by type, selected evidence
-  count, artifact path, and recommended next action.
-- Footer: saved/pushed state. In connected mode include graph-link state when
-  available; in local mode omit graph language.
-- Do not show raw graph JSON or replace the confirmation box with plain prose.
+- 72-column outer box, standard top/separator/content/bottom lines only.
+- Header: `◈ DEEP REFLECT`, author, date.
+- Body: question, ◆/◇ finding counts, confidence, waves · docs read · cited ·
+  claims cut in verification.
+- Footer: actual saved/pushed state; say "graphed" only if the graph write
+  succeeded; in local mode omit graph language entirely.
+- Structured UX parity is required: preserve the rendered deep-reflect TUI
+  box, no preamble, no prose-only replacement, and no raw search or graph
+  output.
+- Never show raw graph JSON; never replace the box with prose.
 
 ## Rules
 
-- Never show raw graph JSON.
-- Do not claim evidence you did not inspect.
-- Keep intermediate summaries explicit so the user can audit the reasoning.
+- Search budget: at most ONE non-`--fast` search probe per run (seed only);
+  `--fast` everywhere else. Count result blocks, never the banner hit count.
+- No claim without a verbatim excerpt that survives re-finding in the file.
+- Absence is a first-class finding — cite the probes that prove it.
+- Don't manufacture significance: "memory holds nothing structural on this"
+  is a valid report.
+- At most ONE clarifying question before the run, plus the capture gate.
 - Do not use Claude Code commands.

package/runtime/codex/.codex/skills/deploy-bridge/SKILL.md

@@ -0,0 +1,25 @@
+---
+name: deploy-bridge
+description: 'Deploy the Telegram bridge (egregore_bridge.py) to the VPS agent box and verify it comes back healthy. Org-internal — the bridge does NOT auto-deploy from develop.'
+---
+
+<!-- generated-by: bin/codex-sync-skills.sh -->
+
+# Egregore deploy-bridge Adapter
+
+This is fallback coverage for a long-tail Egregore workflow that has not been
+ported to a hand-written Codex-native skill yet.
+
+Use the project shell and filesystem directly. Do not invoke Claude Code
+commands. Translate interactive choices to structured Codex question tooling
+when it is available; otherwise render compact numbered choices with an
+`Other:` option and wait for the user.
+
+1. Read `.claude/skills/deploy-bridge/SKILL.md` for the workflow details.
+2. Run the referenced `bin/` scripts directly from Codex.
+3. Treat graph, publish, and notify steps as best-effort unless that workflow
+   explicitly says they are required.
+4. Keep local-mode behavior filesystem-first and avoid graph or notification
+   calls when `egregore.json` declares `"mode": "local"`.
+5. Never call the deprecated `egregore-handoff` CLI for Egregore project
+   handoffs.

package/runtime/codex/.codex/skills/handoff/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: handoff
-description: Create an internal Egregore team handoff when the user invokes /handoff or $handoff, says they are done, asks to hand off work, or wants to pass context to a teammate or future self.
+description: Create an internal Egregore team handoff when the user invokes /handoff or $handoff, asks to hand off work, or wants to pass context to a teammate or future self.
 ---
 
 # Egregore Handoff
@@ -11,6 +11,10 @@ the Egregore scripts. External runnable packets are emissaries; if the user
 asks for one or provides an `egregore.xyz/emissary/e/` link, use the emissary
 tooling instead.
 
+`/handoff` is pure addressed capture. Do not triage incoming handoffs here;
+route “show/close my handoffs” to `$activity`. Personal session closure without
+an addressed recipient belongs to `$wrap`.
+
 ## Flow
 
 1. Run `bin/agent.sh sync`.
@@ -29,7 +33,7 @@ tooling instead.
 
 ```bash
 TMPDIR="$(mktemp -d -t codex-handoff-XXXXXX)"
-TMPDIR="$TMPDIR" bash bin/handoff-run.sh --author "$AUTHOR" --topic "$TOPIC" ${RECIPIENT_ARG} < "$BODY_FILE"
+TMPDIR="$TMPDIR" bash bin/capture-run.sh --mode addressed --author "$AUTHOR" --topic "$TOPIC" ${RECIPIENT_ARG} < "$BODY_FILE"
 ```
 
 Use `--recipient "$RECIPIENT"` only when a clear teammate or future-self