create-egregore 0.19.8 → 0.19.12

package/runtime/codex/.codex/skills/save/SKILL.md

@@ -17,15 +17,37 @@ which branch, commit, push, pull request, or memory sync steps are required.
 ```bash
 git status --short
 git status --short memory 2>/dev/null || true
-git branch --show-current
+BRANCH=$(git branch --show-current)
+AHEAD=0
+OPEN_PR=""
+case "$BRANCH" in
+  dev/*|feature/*|bugfix/*)
+    git fetch origin develop --quiet 2>/dev/null || true
+    AHEAD=$(git rev-list --count "origin/develop..HEAD" 2>/dev/null || echo 0)
+    if command -v gh >/dev/null 2>&1; then
+      OPEN_PR=$(gh pr list --head "$BRANCH" --base develop --state open \
+        --json url --jq '.[0].url // empty' 2>/dev/null || true)
+    fi
+    ;;
+esac
 ```
 
-3. If there are no repo or memory changes, say everything is already saved and
-   stop.
+3. A clean working tree alone does **not** mean the work is fully saved:
+   - If there are repo or memory changes, continue.
+   - If the task branch is ahead of `origin/develop` and `OPEN_PR` is empty,
+     continue even when the tree is clean. The bridge must push any committed
+     work and create the missing PR.
+   - Stop with "everything is already saved" only when there are no repo or
+     memory changes and either the branch has no commits to integrate
+     (`AHEAD=0`) or an open integration PR already exists.
 4. Synthesize:
    - a short topic from the work,
    - a clear commit message,
-   - a one-line user-facing scope summary.
+   - a one-line user-facing scope summary,
+   - a PR description following `.claude/context/pr-format.md`:
+     `## What` (1–4 bullets), `## Why` (1–3 sentences), and
+     `## Verification` (how the change was checked — required when the
+     diff touches non-markdown files; be honest if unverified).
 5. If the scope is ambiguous or includes unrelated changes, ask for one compact
    confirmation. Use structured Codex question tooling when available;
    otherwise render:
@@ -40,11 +62,13 @@ Other:
 6. Run the bridge command:
 
 ```bash
-bin/agent.sh save --message "$MESSAGE" --topic "$TOPIC"
+bin/agent.sh save --message "$MESSAGE" --topic "$TOPIC" --pr-body "$PR_BODY"
 ```
 
 The bridge owns the mechanical workflow: sync memory, ensure a task branch,
 commit repo changes, push, and create or reuse a pull request when available.
+Always pass the synthesized `--pr-body` — the bridge only auto-generates a
+skeleton body as a last resort, and the CI `pr-format` check gates every PR.
 
 7. Parse the output and report only useful user information:
    - branch name,

package/runtime/codex/.codex/skills/scroll/SKILL.md

@@ -18,7 +18,7 @@ small fork. A scroll requires all three legs: face, harvest, and update loop.
 ## Structured UX parity
 
 The browser artifact is the primary output. Preserve both tabs, deep links from
-honest costs into decisions, the versioned copydock fence, stable URL, and local
+honest costs into decisions, the versioned copydock return block, stable URL, and local
 source path. Do not substitute a prose-only summary or expose raw publish output.
 
 ## Route the invocation
@@ -121,13 +121,64 @@ the same `--id`; never mint a new URL for an update. In local mode, publishing
 is unavailable: open the file locally and report the source path without
 suggesting configuration changes.
 
-Add the URL or local path, source location, version, and fence tag to the
+Add the URL or local path, source location, version, and return-block tag to the
 relevant quest's log/artifacts tables. If no quest is relevant, keep the source
 path as the durable record and state it.
 
+## Creator gate — before any absorb
+
+The scroll record `memory/scrolls/<slug>.md` names `creator: <person-slug>` and
+optionally `trusted: [<person-slug>, …]`. A record missing `creator:` is
+backfilled from unambiguous existing attribution, otherwise ask the user once
+and write it — never silently default the gate open.
+
+Derive the paster from the session person (`.egregore-state.json`, then git
+config) — never from the return block's self-declared `respondent:` line, which
+is attribution metadata, not an authorization credential.
+
+If the paster is not the creator and not in `trusted:`, the return is **gated**:
+
+1. Append a `turn-received` event to `memory/scrolls/.events/<slug>.jsonl`
+   (create the file if absent). Event ids are append-if-absent and MUST match
+   the Claude corpus exactly — both runtimes share one event log:
+   `turn.id = respondent + '|' + base_version + '|' + date + '|' + digest`;
+   digest = FNV-1a 32-bit hex over the UTF-8 bytes of
+   `JSON.stringify([respondent, String(base_version), date, sortedAnswers,
+   sortedOpens])` where `sortedAnswers` = answers sorted by fork id, each
+   mapped to the tuple `[fork, pick-or-UNDECIDED, note-or-empty]` (labels are
+   excluded), and `sortedOpens` = opens sorted by prompt id, each mapped to
+   `[prompt, text-or-UNDECIDED]`; every string is NFC-normalized and
+   CRLF→LF-normalized before hashing. Record `submitted_by: <paster>` on the
+   event (event-log metadata only — never projected into a published ledger)
+   and `merged_into: "pending"`.
+2. Do NOT absorb: no `memory/knowledge/decisions/` writes, no spec/plan edits,
+   no face rewrite, no version bump, no republish of new content. Republishing
+   the unchanged current version to acknowledge the turn is allowed and appends
+   no version event.
+3. Notify the creator — connected: `bash bin/notify.sh send <creator>
+   "<paster> answered your scroll <slug> (vN): <digest> — pending your review"`;
+   local: write an addressed handoff in `memory/handoffs/` naming the scroll,
+   paster, base version, digest, and the dispositions below. The contributor
+   may also send the artifact link directly.
+4. Report the gated state and stop.
+
+**Creator review.** The creator disposes in chat: **accept** (absorb into the
+next version), **decline — <reason>** (mandatory nonblank note; refuse a
+decline without one), per-answer overrides (top-level disposition is the
+default, listed answers override; a turn with zero effectively accepted answers
+is a plain decline; a zero-answer turn takes the top-level disposition), or
+**synthesize** (compose one proposal from all pending turns — consensus
+decides, conflicts become new explicit forks — and publish only on creator
+approval). Every disposition appends `turn-reviewed`
+`{type, turn, disposition: accepted|declined, by, date, note?, answers?}` with
+id `review|<turn.id>` before any composition. An accepted turn stays pending
+until a version actually absorbs it. Declined turns are never absorbed, stay
+attributed in the log, and their reason travels with them. The creator's own
+returns and trusted respondents keep the immediate loop below.
+
 ## Update loop
 
-On a returned fence:
+On a returned block (creator or trusted paster — gated returns stop above):
 
 1. **Absorb.** Parse Q/O lines and notes. Write durable decisions with their
    reasoning to `memory/knowledge/decisions/`, update the underlying spec or

package/runtime/codex/.codex/skills/task/SKILL.md

@@ -0,0 +1,25 @@
+---
+name: task
+description: 'Create, import, inspect, approve, answer, or cancel work in the hosted Egregore Agent Desk. Use for `/task`, `$task`, “send this work to the agents,” “start these tasks,” Markdown development batches, or checking hosted task progress. This skill submits work to the hosted pipeline; it does not implement the task in the current local session.'
+---
+
+<!-- generated-by: bin/codex-sync-skills.sh -->
+
+# Egregore task Adapter
+
+This is fallback coverage for a long-tail Egregore workflow that has not been
+ported to a hand-written Codex-native skill yet.
+
+Use the project shell and filesystem directly. Do not invoke Claude Code
+commands. Translate interactive choices to structured Codex question tooling
+when it is available; otherwise render compact numbered choices with an
+`Other:` option and wait for the user.
+
+1. Read `.claude/skills/task/SKILL.md` for the workflow details.
+2. Run the referenced `bin/` scripts directly from Codex.
+3. Treat graph, publish, and notify steps as best-effort unless that workflow
+   explicitly says they are required.
+4. Keep local-mode behavior filesystem-first and avoid graph or notification
+   calls when `egregore.json` declares `"mode": "local"`.
+5. Never call the deprecated `egregore-handoff` CLI for Egregore project
+   handoffs.

package/runtime/codex/.codex/skills/tui-design/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: tui-design
-description: 'Fallback Codex adapter for the Egregore tui-design workflow.'
+description: 'TUI Design System for Egregore slash commands. Use when designing or modifying any command''s terminal output to ensure visual consistency. Triggers on: TUI, terminal output, box drawing, command output formatting, sigils, section markers. Do NOT use for browser rendering (use dark-mode) or external prose (use egregore-voice).'
 ---
 
 <!-- generated-by: bin/codex-sync-skills.sh -->

package/runtime/codex/.codex/skills/wrap/SKILL.md

@@ -6,7 +6,10 @@ description: Wrap an Egregore session when the user invokes /wrap or $wrap, or s
 # Egregore Wrap
 
 Native Codex Egregore skill. Use this inside an Egregore checkout with
-`bin/agent.sh`.
+`bin/agent.sh`. The command routes through `bin/capture-run.sh --mode personal`.
+It writes the personal record first, appends graph and handoff-completion events
+to the local WAL, and reconciles them detached; do not wait for or repeat that
+background work.
 
 ## Flow
 

package/runtime/codex/.codex/spec-manifest.json

@@ -14,6 +14,18 @@
       "sourceHash": "ddcbc0083aff",
       "note": "Kept; /update, /contribute, /save tokens rendered as $skill tokens."
     },
+    {
+      "section": "Cross-Runtime Compatibility",
+      "action": "keep",
+      "sourceHash": "75d02e2603f5",
+      "note": "Kept verbatim — framework parity applies equally to Claude Code, Codex, and Pi."
+    },
+    {
+      "section": "Voice",
+      "action": "keep",
+      "sourceHash": "af73d4eaa7cd",
+      "note": "Kept — all runtimes can consult the shared voice rules and register-specific skills."
+    },
     {
       "section": "On Launch — MANDATORY FIRST ACTION",
       "action": "replace",
@@ -23,19 +35,19 @@
     {
       "section": "After Greeting — BRANCH ON FIRST RESPONSE",
       "action": "replace",
-      "sourceHash": "c71340e68c9e",
+      "sourceHash": "bce266fb848b",
       "note": "EnterWorktree -> bin/agent.sh branch with git checkout fallback; AskUserQuestion -> numbered options in plain text; branch-guard mapped to .codex/hooks/branch-guard.js with instruction fallback; plan-mode note dropped (no plan mode on Codex); /branch + /onboarding -> skill tokens. Handoff claiming and repoState auto-checkout kept verbatim (pure git)."
     },
     {
       "section": "Config Files",
       "action": "keep",
-      "sourceHash": "81b7bf09901b",
+      "sourceHash": "8d7f1bd0f2d9",
       "note": "Kept verbatim — shell facts, runtime-neutral."
     },
     {
       "section": "Knowledge Graph",
       "action": "keep",
-      "sourceHash": "5c0953aee955",
+      "sourceHash": "b5d9a149f1a6",
       "note": "Kept verbatim — bin/graph.sh is runtime-neutral."
     },
     {
@@ -71,7 +83,7 @@
     {
       "section": "Git Workflow",
       "action": "keep",
-      "sourceHash": "d058d1f8da11",
+      "sourceHash": "49fd4625fa1e",
       "note": "Kept; slash tokens rendered as $skill tokens. Branch diagram unchanged (code fence)."
     },
     {
@@ -83,7 +95,7 @@
     {
       "section": "Command Awareness",
       "action": "keep",
-      "sourceHash": "e1db878ccaee",
+      "sourceHash": "ce5eb3015427",
       "note": "Prepended the Codex command surface (skill tokens, native vs adapter split, $save abstraction); disambiguation map kept with /x -> $x token rendering. Tokens with no Codex skill (e.g. /loop, a Claude Code harness feature) are left as-is."
     },
     {
@@ -107,8 +119,8 @@
     {
       "section": "Environment Isolation",
       "action": "replace",
-      "sourceHash": "ed47e96248bd",
-      "note": "boundary-check is a Claude PreToolUse hook with no .codex equivalent — behavior stated as a standing instruction; AskUserQuestion remediation -> numbered options."
+      "sourceHash": "086e2c1d9019",
+      "note": "boundary-check is a Claude PreToolUse hook with no .codex equivalent — two-tier model stated as a standing instruction; AskUserQuestion remediation -> numbered options, now including the two consent-grant options (session grant -> .egregore-boundary-consent, instance grant -> .egregore-boundary.local.json read[])."
     }
   ]
 }

package/runtime/codex/AGENTS.md

@@ -35,7 +35,8 @@ Use the runtime-neutral bridge instead of Claude Code slash commands:
 
 ```bash
 bin/agent.sh branch --topic "auth review"
-bin/agent.sh save --message "Save: auth review" --topic "auth review"
+bin/agent.sh save --message "Save: auth review" --topic "auth review" \
+  --pr-body "$PR_BODY"   # body per .claude/context/pr-format.md (auto-skeleton if omitted)
 bin/agent.sh wrap --from alice --topic "auth review" \
   --summary "Implemented the OAuth callback parser and documented follow-ups." \
   --body "Open threads: review error cases and browser redirects."
@@ -96,6 +97,24 @@ When a user reports broken or missing framework behavior, the first question is
 
 ---
 
+## Cross-Runtime Compatibility
+
+Framework behavior must work across Claude Code, Codex, and Pi Egregores. Put
+shared mechanics in runtime-neutral `bin/` scripts; keep `.claude/`, `.codex/`,
+and `.pi/` as thin adapters to those mechanics. When changing startup, session
+lifecycle, capture, skills, or commands, trace all three runtime entry points
+and add or update a parity test. Do not call a framework change complete based
+on one runtime alone. Regenerate derived Codex and Pi specifications or runtime
+bundles whenever their sources change.
+
+---
+
+## Voice
+
+Egregore's voice is governed by `.claude/rules/voice-bedrock.md` (always loaded). Register-specific skills: `egregore-voice` (external), `product-voice` (internal UX), `character-v4` (encounters), `alpha-openers` (outreach). See voice-bedrock for the full register map.
+
+---
+
 ## On Launch — MANDATORY FIRST ACTION
 
 The `egregore` launcher renders the Egregore startup card (identity, team momentum, and pending work) via `bin/codex-session-start.sh` before Codex starts, and installs project skills. Do not rerun startup checks and do not narrate startup. The card ends with **"What are you working on?"** — that question is already on screen; treat the user's first message as the answer to it. To re-show the card, run `bash bin/codex-session-start.sh --card`.
@@ -146,19 +165,22 @@ If on develop after two messages, create a branch immediately from whatever cont
 
 ### Branch-guard protocol
 
-The `.codex/hooks/branch-guard.js` PreToolUse hook (enabled by the launcher via `--enable hooks`) denies writes, patches, and commits on `develop`/`main`/`master`. When it fires, choose between two paths based on how clear the topic is:
+The `.codex/hooks/branch-guard.js` PreToolUse hook (enabled by the launcher via `--enable hooks`) protects project writes on `develop`/`main`/`master`. Its block message is operational guidance, not a reason to interrupt the user with routine Git choices:
 
-- **Topic is obvious from the last turn** (user said "fix X", "add Y feature") → auto-branch silently with `bin/agent.sh branch --topic "<topic>"` (or the git checkout fallback), then continue. Say one sentence ("Creating `dev/{author}/{slug}`.") so the user isn't confused about why a new branch appeared.
-- **Topic is ambiguous** (open-ended exploration, user didn't specify what we're building yet) → ask **before** branching, in plain text with numbered options (Codex has no structured question tool):
+- **Topic is clear** (the user said "fix X", "add Y feature") → run `bin/agent.sh branch --topic "<topic>"` automatically, continue in the printed worktree, and say one short sentence so the branch change is visible. Do not ask the user to approve routine branching.
+- **Topic is genuinely ambiguous** → ask only for the topic, using compact numbered options:
 
   ```text
-  Need a working branch first. Topic?
+  What should I call this work?
     1. <suggested slug from context>
     2. <alternative slug>
     3. Other: (name it)
   ```
 
   Wait for the reply, then branch.
+- **The user explicitly requested the protected branch** → that request is consent. Record it with `echo '{branch}' > .egregore-branch-consent`, then retry. Never create the marker merely to silence the hook.
+
+Memory, managed-repo, and runtime-state writes should bypass the project guard. If one triggers it, correct the operation target/context instead of asking for protected-branch consent.
 
 If this Codex build does not support hooks, follow the same discipline as a standing instruction: never write or commit on develop/main/master.
 
@@ -170,7 +192,7 @@ If the startup card output contains `onboarding_needed`, invoke the `$onboarding
 
 ## Config Files
 
-- **`egregore.json`** — committed. Non-secret org config: `org_name`, `github_org`, `memory_repo`, `slug`, `mode`. `api_url` is connected-mode only. **Never put secrets here.**
+- **`egregore.json`** — committed. Non-secret org config: `org_name`, `github_org`, `memory_repo`, `slug`, `mode`. `api_url` is connected-mode only. Optional `boundary { posture, read[], locked }` sets the org's isolation posture (see Environment Isolation). **Never put secrets here.**
 - **`.env`** — gitignored. Personal secrets. Local mode: `GITHUB_TOKEN` only. Connected mode: `GITHUB_TOKEN` + `EGREGORE_API_KEY`. **Never use `source .env`** — use `grep '^KEY=' .env | cut -d'=' -f2-`.
 
 In connected mode, infrastructure credentials (Neo4j, Telegram) live on the API server only — `bin/graph.sh` and `bin/notify.sh` route through the API gateway.
@@ -179,7 +201,22 @@ In connected mode, infrastructure credentials (Neo4j, Telegram) live on the API
 
 ## Knowledge Graph
 
-**Connected mode only.** Always use `bin/graph.sh` for Neo4j queries — never construct curl calls directly. See DEVELOPMENT.md §1 for usage examples and current schema. In local mode there is no graph; read `memory/` directly.
+**Connected mode only.** For the following intents, the named read must be the
+first retrieval action. Run the exact command with its safe default limit before
+opening files, running broad grep, inspecting `graph-op.sh`, or writing Cypher:
+
+- current work addressed to someone → `bash bin/graph-op.sh open-handoffs "<user>"`
+- unanswered questions for someone → `bash bin/graph-op.sh pending-questions "<user>"`
+- handoff → implementation → branch/PR/direction → `bash bin/graph-op.sh lineage "<topic>"`
+- company/person/topic across meetings → `bash bin/graph-op.sh meeting-history "<entity-or-topic>"`
+
+A question about calls, meetings, transcripts, demos, or how a conversation
+evolved is always `meeting-history` intent when it names a company, person, or
+topic—even when it does not ask for "current" or "live" state. Pass the shortest
+discriminative entity or topic (for example, `meeting-history "42CAP"`), not the
+whole question.
+
+Run `catalog` only when the route is unclear. Named reads return bounded stable fields and exact canonical `evidencePath` pointers; open only the returned files needed to answer. When a read reports partial coverage, use `unprojectedPaths` rather than claiming those files are represented in the graph. Use `bin/graph.sh` for unsupported Neo4j queries and never construct curl calls directly. See DEVELOPMENT.md §1 for the schema. In local mode there is no graph; read `memory/` directly.
 
 ---
 
@@ -244,6 +281,10 @@ main ← stable (/release)
 - **Memory repo**: stays on main (separate repo, auto-merge).
 - **Never push directly to main or develop.** All changes flow through PRs.
 
+### Pull request format (all harnesses)
+
+Every PR body follows `.claude/context/pr-format.md`, enforced by the `pr-format` CI check regardless of which harness opened it: `## What` (1–4 bullets) + `## Why` (1–3 sentences) always; `## Verification` when the diff touches non-markdown files (how it was checked, or an honest `Not verified — <reason>`); `## Risk`/`## Links` when real; title `type(scope): imperative summary` (advisory). **Never create a PR with an empty body or `--fill`** — write the body and pass it explicitly (`gh pr create --body`, or `bin/agent.sh save --pr-body` for shell agents; the bridge auto-generates a compliant skeleton only as a last resort).
+
 ### Managed Repos
 
 Repos in `egregore.json` → `repos[]` are cloned as siblings (`../{repo}/`). Each entry can be a string or `{"name": "...", "description": "..."}`. Match user intent to the right repo using `description`. Same branching strategy. Use `git -C` with absolute paths — never `cd` into repos. `$save` scans all managed repos for uncommitted changes.
@@ -268,13 +309,13 @@ Invoke commands from user intent — don't wait for the slash. Each command file
 **Knowledge** — `$search` `$deep-reflect` `$archive` `$note` `$add` `$meeting` `$ingest` `$scroll`
 **Identity** — `$me` (view profile or set display name)
 **Coordination** — `$ask` `$quest` `$issue` `$invite` `$delete-user` `$announce`
-**Connectors** — `$telegram-connect` (Telegram group setup)
+**Connectors** — `$telegram-connect` (Telegram group setup) `$teams-connect` (Microsoft Teams channel setup)
 **Git** — `$branch` `$commit` `$push` `$pr` `$save` `$review-pr` `$contribute`
 **Spirits** — `$summon` (persistent agent processes)
 **Infra** — `$setup` `$update` `$pull` `$env` `$infra` `$sync-repos` `$release` `$checkup`
 
 **Disambiguation:**
-- Knowledge: `$reflect` (share-ready) · `$note` (half-baked) · `$deep-reflect` (cross-reference) · `$archive` (AI patterns)
+- Knowledge: `$reflect` (share-ready) · `$note` (half-baked) · `$deep-reflect` (deep research over memory — questions AND cross-referencing) · `$archive` (AI patterns)
 - Finding things — the retrieval layers: **Grep/ls** (Claude Code / Codex file ops — always available, OSS) · **`bin/graph.sh`** (indexed relevance + relationships/status — paid). Use grep proactively; the graph deepens it when connected. (Semantic `$search` is dormant — evals showed it only pays off on massive unstructured data.)
 - Finding **something you generated** (a scroll, handoff, emissary, decision, any hosted egregore.xyz link): `bash bin/artifacts.sh find <query>`. Every generative surface already records into memory — hosted artifacts self-register into `memory/artifacts/` at publish (and the record is committed+pushed, so it's findable from *any* session, not just the one that made it); handoffs land in `memory/handoffs/`, emissaries in `memory/handoffs/outbound/`, decisions/findings/patterns in `memory/knowledge/`. The finder searches **all** of them, ranks title/topic matches above passing body mentions, tags each hit by type (`[document]`/`[handoff]`/`[emissary]`/`[decision]`), and surfaces the shareable URL. Findable by **content, not just name**, across all three layers — grep-first for OSS, folding in search + graph when available. *"bring me the artifact where I laid out our GTM plan"* → this.
 - Artifacts with questions: `$scroll` (living paper + embedded harvest, updates in place) · `$view` (static render) · `$harvest` (elicitation, no published face)
@@ -282,8 +323,8 @@ Invoke commands from user intent — don't wait for the slash. Each command file
 - Ending: `$wrap` (personal closure) · `$handoff` (notes for others) · `$save` (still working)
 - Tasks: `$todo` (personal) · `$quest` (team exploration) · `$issue` (something broken)
 - Questions: `$ask [person]` (async) · just ask (agent answers from context)
-- Ingestion: `$ingest meeting` · `$ingest user-interview` · `$ingest google` · ambiguous → ask which type
-- Connectors: `$telegram-connect` (Telegram group) · `$ingest` (bring content in)
+- Ingestion: `$ingest <file-or-folder>` (org-scoped corpus intake) · `$ingest meeting` · `$ingest user-interview` · `$ingest google` · ambiguous → ask which type
+- Connectors: `$telegram-connect` (Telegram group) · `$teams-connect` (MS Teams channel) · `$ingest` (bring content in)
 - Identity: `$me` — "who am I", "call me oz"
 - People: `$invite` (add) · `$delete-user` (remove)
 - PRs: `$pr` (create) · `$review-pr` (review)
@@ -332,19 +373,22 @@ Egregore runs in one of two configurations, set by `mode` in `egregore.json`. De
 
 ## Environment Isolation
 
-Sessions are confined to this project + memory + managed repos. On Codex this boundary is a standing instruction, not an enforced hook — hold it yourself.
+Sessions are confined to this project + memory + managed repos, with a **two-tier boundary** — a hard wall between Egregore instances, a consent gate for everything else. On Codex the boundary is a standing instruction, not an enforced hook — hold it yourself.
 
-- **Never modify `~/.egregore/instances.json`** — managed by session-start.sh
-- **Never access another instance's files** — refuse even if asked
-- When a request points outside the boundary, do not improvise a workaround. Ask in plain text with numbered options:
+- **Hard tier — other Egregore instances.** Denied for every tool, always. There is no consent path. Never access another instance's files — refuse even if asked. Never modify `~/.egregore/instances.json` (managed by session-start.sh). When a request points at another instance's files there is nothing to ask — refuse and explain.
+- **Soft tier — paths outside the boundary.** Consent-gated. Inbox dirs (`~/Downloads`, `~/Desktop`) are readable without consent under the default posture; writes outside the project always need consent. Posture (`strict | standard | open`) and extra read roots come from `egregore.json` -> `boundary { posture, read[], locked }` (org, committed) merged with `.egregore-boundary.local.json` (personal, gitignored). `locked: true` removes the consent path entirely.
+- When a request needs soft-tier consent, do not improvise a workaround. Ask in plain text with numbered options:
 
   ```text
   That path is outside this Egregore's boundary. How should we proceed?
-    1. Paste the contents inline
-    2. Move the file into the repo and point me at the new path
-    3. Cancel
+    1. Allow its directory for this session (recorded in .egregore-boundary-consent)
+    2. Always allow on this instance (added to read[] in .egregore-boundary.local.json)
+    3. Paste the contents inline
+    4. Cancel
   ```
 
-See DEVELOPMENT.md §3 for boundary details.
+  Never record a consent grant without the user's explicit choice of option 1 or 2 in that exchange. Session grants are cleared on session start; `locked: true` removes options 1 and 2.
+
+See DEVELOPMENT.md §3 for boundary details and `memory/knowledge/decisions/2026-07-08-boundary-hook-consent-design.md` for the design decisions.
 
 <!-- END GENERATED EGREGORE CODEX SPEC -->

package/runtime/codex/bin/activity-data.sh

@@ -9,7 +9,7 @@ trap "rm -rf $TMPDIR" EXIT
 
 # --- Read config ---
 API_URL=$(jq -r '.api_url // empty' "$SCRIPT_DIR/egregore.json" 2>/dev/null)
-API_KEY=$(grep '^EGREGORE_API_KEY=' "$SCRIPT_DIR/.env" 2>/dev/null | cut -d'=' -f2-)
+API_KEY="${EGREGORE_API_KEY:-$(grep '^EGREGORE_API_KEY=' "$SCRIPT_DIR/.env" 2>/dev/null | cut -d'=' -f2-)}"
 ORG=$(jq -r '.org_name // "Egregore"' "$SCRIPT_DIR/egregore.json" 2>/dev/null || echo "Egregore")
 DATE=$(date '+%b %d')
 

package/runtime/codex/bin/agent.sh

@@ -32,9 +32,13 @@ Runtime-neutral commands:
                                    Hybrid recall over shared memory (qmd)
   people                           List known people from memory/people
   branch --topic TEXT              Create or reuse a task branch/worktree
-  save [--message TEXT]            Commit and push current repo + memory changes
+  save [--message TEXT] [--pr-body TEXT|--pr-body-file PATH]
+                                   Commit and push current repo + memory changes;
+                                   PR body follows .claude/context/pr-format.md
+                                   (auto-generated skeleton if not provided)
   wrap --topic T --summary TEXT    Write a session wrap to memory/wraps
-  handoff --from A --to B --topic T [--body TEXT|--body-file PATH] [--no-push] [--no-publish] [--no-notify] [--json]
+  handoff --from A --to B --topic T [--intent action|feedback|fyi]
+      [--body TEXT|--body-file PATH] [--no-push] [--no-publish] [--no-notify] [--json]
   ask --from A --to B --topic T --question TEXT [--no-push]
       [--harvest-id ID --harvest-session-id ID --turn N
        --question-intent TEXT --context-mode blind|disclosed|comparative]
@@ -331,13 +335,26 @@ ensure_working_branch() {
   echo "$branch"
 }
 
+build_pr_body() {
+  # Compliant fallback PR body (spec: .claude/context/pr-format.md) built
+  # from the commit log + diff when the calling agent supplies none.
+  local topic="${1:-portable save}" commits stat
+  commits="$(git -C "$SCRIPT_DIR" log --pretty='- %s' "origin/develop..HEAD" 2>/dev/null | head -8)"
+  [ -n "$commits" ] || commits="- (commit list unavailable — see the Files tab)"
+  stat="$(git -C "$SCRIPT_DIR" diff --shortstat "origin/develop...HEAD" 2>/dev/null | sed 's/^ *//')"
+  printf '## What\n%s\n\n## Why\nShell-agent session save — topic: %s. Body auto-generated by bin/agent.sh; pass --pr-body for a hand-written description.\n\n## Verification\nNot verified — auto-generated skeleton; review the diff before merging.%s\n\n🤖 Saved via bin/agent.sh\n' \
+    "$commits" "$topic" "${stat:+ ($stat)}"
+}
+
 cmd_save() {
-  local message="" topic="" no_pr=0 branch pushed="false" committed="false" pr_url="" existing_pr=""
+  local message="" topic="" no_pr=0 branch pushed="false" committed="false" pr_url="" existing_pr="" pr_number="" non_md="" merged="false" pr_body="" pr_body_file=""
 
   while [ $# -gt 0 ]; do
     case "$1" in
       --message|-m) message="${2:-}"; shift 2 ;;
       --topic) topic="${2:-}"; shift 2 ;;
+      --pr-body) pr_body="${2:-}"; shift 2 ;;
+      --pr-body-file) pr_body_file="${2:-}"; shift 2 ;;
       --no-pr) no_pr=1; shift ;;
       *) die "unknown save option: $1" ;;
     esac
@@ -375,7 +392,31 @@ cmd_save() {
     if [ -n "$existing_pr" ]; then
       pr_url="$existing_pr"
     else
-      pr_url="$(gh pr create --base develop --head "$branch" --title "$message" --body "Saved via bin/agent.sh save." 2>/dev/null || true)"
+      if [ -z "$pr_body" ] && [ -n "$pr_body_file" ] && [ -f "$pr_body_file" ]; then
+        pr_body="$(cat "$pr_body_file")"
+      fi
+      [ -n "$pr_body" ] || pr_body="$(build_pr_body "$topic")"
+      pr_url="$(gh pr create --base develop --head "$branch" --title "$message" --body "$pr_body" 2>/dev/null || true)"
+    fi
+  fi
+
+  # Non-coding saves auto-merge to develop (same rule as /save and the
+  # handoff helper; policy in bin/lib/noncode.sh). `--auto` needs repo
+  # auto-merge + pending required checks; without branch protection it always
+  # errors, so fall back to a direct merge.
+  if [ -n "$pr_url" ]; then
+    # shellcheck source=bin/lib/noncode.sh
+    . "$SCRIPT_DIR/bin/lib/noncode.sh" 2>/dev/null || true
+    type noncode_blockers >/dev/null 2>&1 || noncode_blockers() {
+      git -C "${2:-.}" diff "${1:-origin/develop}...HEAD" --name-only 2>/dev/null | grep -v '\.md$' | head -1 || true
+    }
+    pr_number="${pr_url##*/}"
+    non_code="$(noncode_blockers origin/develop "$SCRIPT_DIR")"
+    if [ -z "$non_code" ] && [ -n "$pr_number" ]; then
+      if gh pr merge "$pr_number" --auto --merge >/dev/null 2>&1 \
+         || gh pr merge "$pr_number" --merge >/dev/null 2>&1; then
+        merged="true"
+      fi
     fi
   fi
 
@@ -383,6 +424,7 @@ cmd_save() {
   echo "commit: $committed"
   echo "push: $pushed"
   [ -n "$pr_url" ] && echo "pr: $pr_url"
+  [ "$merged" = "true" ] && echo "merge: non-coding, merged to develop"
   return 0
 }
 
@@ -413,31 +455,38 @@ cmd_wrap() {
   fi
   [ -n "$body" ] || body="$summary"
 
-  local month rel abs slug now
-  month="$(date +%Y-%m)"
-  slug="$(slugify "$topic")"
-  [ -n "$slug" ] || slug="session"
-  rel="wraps/$month/$(date +%d)-${from}-${slug}.md"
-  abs="$MEMORY_DIR/$rel"
-  now="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
-  mkdir -p "$(dirname "$abs")"
-
-  {
-    printf '# Wrap: %s\n\n' "$topic"
-    printf '**Date**: %s\n' "$(date +%Y-%m-%d)"
-    printf '**Author**: %s\n' "$from"
-    printf '**Wrapped At**: %s\n\n' "$now"
-    printf '## Summary\n\n%s\n\n' "$summary"
-    printf '## Notes\n\n%s\n' "$body"
-  } > "$abs"
-
-  NO_PUSH="$no_push" save_memory "Wrap: $topic" "$rel"
+  local tmpd result rel session_id branch
+  local capture_args=(--mode personal)
+  tmpd="$(mktemp -d -t egregore-agent-wrap-XXXXXX)"
+  trap 'rm -rf "$tmpd"' RETURN
+  session_id="$(cat "$SCRIPT_DIR/.egregore-session-id" 2>/dev/null || true)"
+  branch="$(git -C "$SCRIPT_DIR" branch --show-current 2>/dev/null || true)"
+  [ "$no_push" = "1" ] && capture_args+=(--no-push)
+
+  printf '%s\n' "$body" |
+    TMPDIR="$tmpd" bash "$SCRIPT_DIR/bin/capture-run.sh" \
+      "${capture_args[@]}" \
+      --author "$from" \
+      --topic "$topic" \
+      --summary "$summary" \
+      --session-id "$session_id" \
+      --branch "$branch" >/dev/null
+
+  result="$tmpd/capture-run-result.json"
+  rel="$(jq -r '.file // empty' "$result" 2>/dev/null || true)"
+  [ -n "$rel" ] || die "wrap was not created"
   echo "wrap: memory/$rel"
+
+  # Session close: non-coding core-repo changes save + merge themselves
+  # (gated inside session-autosave.sh — code is never auto-committed).
+  if [ "$no_push" = "0" ]; then
+    ( bash "$SCRIPT_DIR/bin/session-autosave.sh" --dir "$SCRIPT_DIR" >/dev/null 2>&1 & ) >/dev/null 2>&1
+  fi
 }
 
 cmd_handoff() {
   ensure_memory
-  local from="" to="" topic="" body="" body_file="" project=""
+  local from="" to="" topic="" body="" body_file="" project="" intent="action"
   local no_publish=0 no_notify=0 json=0
   NO_PUSH=0
 
@@ -449,6 +498,7 @@ cmd_handoff() {
       --body) body="${2:-}"; shift 2 ;;
       --body-file) body_file="${2:-}"; shift 2 ;;
       --project) project="${2:-}"; shift 2 ;;
+      --intent) intent="${2:-}"; shift 2 ;;
       --no-push) NO_PUSH=1; shift ;;
       --no-publish) no_publish=1; shift ;;
       --no-notify) no_notify=1; shift ;;
@@ -460,6 +510,10 @@ cmd_handoff() {
   [ -z "$from" ] && from="$(person_from_state)"
   [ -n "$from" ] || die "handoff requires --from"
   [ -n "$topic" ] || die "handoff requires --topic"
+  case "$intent" in
+    action|feedback|fyi) ;;
+    *) die "invalid --intent: $intent (action|feedback|fyi)" ;;
+  esac
   if [ -n "$body_file" ]; then
     [ -f "$body_file" ] || die "body file not found: $body_file"
     body="$(cat "$body_file")"
@@ -480,6 +534,7 @@ cmd_handoff() {
   [ -n "$project" ] && project_line="**Project**: $project"
   [ -n "$to" ] && handoff_args+=(--recipient "$to")
   [ -n "$project" ] && handoff_args+=(--project "$project")
+  handoff_args+=(--intent "$intent")
   [ "$NO_PUSH" = "1" ] && handoff_args+=(--no-push)
   [ "$no_publish" = "1" ] && handoff_args+=(--no-publish)
   [ "$no_notify" = "1" ] && handoff_args+=(--no-notify)
@@ -489,10 +544,12 @@ cmd_handoff() {
     printf '**Date**: %s\n' "$today"
     printf '**Author**: %s\n' "$from"
     [ -n "$to" ] && printf '**To**: %s\n' "$to"
+    printf '**Intent**: %s\n' "$intent"
     [ -n "$project_line" ] && printf '%s\n' "$project_line"
     printf '\n## Briefing\n\n%s\n\n' "$body"
     printf '## Next Steps\n\n- Continue from this handoff using the shared Egregore memory protocol.\n'
-  } | TMPDIR="$tmpd" bash "$SCRIPT_DIR/bin/handoff-run.sh" \
+  } | TMPDIR="$tmpd" bash "$SCRIPT_DIR/bin/capture-run.sh" \
+        --mode addressed \
         --author "$from" \
         --topic "$topic" \
         "${handoff_args[@]}" \
@@ -509,6 +566,12 @@ cmd_handoff() {
   [ -s "$stdout_file" ] && sed 's/^/status: /' "$stdout_file"
   echo "handoff: memory/$rel"
   echo "result: $result_out"
+
+  # Parity with the Claude /handoff skill: save core-repo session work in the
+  # background (non-coding diffs auto-merge to develop, code stays in a PR).
+  if [ "$NO_PUSH" = "0" ]; then
+    ( bash "$SCRIPT_DIR/bin/handoff-save-egregore.sh" "$from" "$topic" --repo-dir "$SCRIPT_DIR" >/dev/null 2>&1 & ) >/dev/null 2>&1
+  fi
 }
 
 cmd_ask() {