create-egregore 0.20.0 → 0.20.1

package/assets/egregore-launcher.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// egregore-launcher-version: 0.20.0
+// egregore-launcher-version: 0.20.1
 //
 // egregore — launch and browse Egregore instances from your terminal.
 // Installed by create-egregore. Reads ~/.egregore/instances.json.
@@ -33,7 +33,7 @@ const crypto = require("node:crypto");
 const { spawnSync, spawn } = require("node:child_process");
 const readline = require("node:readline");
 
-const VERSION = "0.20.0";
+const VERSION = "0.20.1";
 const REGISTRY = path.join(os.homedir(), ".egregore", "instances.json");
 const DEFAULT_FILE = path.join(os.homedir(), ".egregore", "default");
 const UPDATE_CACHE_FILE = path.join(os.homedir(), ".egregore", "update-check.json");
@@ -1532,9 +1532,31 @@ async function cmdConnect(args) {
   }
   const activation = state.connected_activation || {};
   if (cfg.mode === "connected" && activation.status === "connected") {
+    if (activation.intent_id) {
+      const repaired = await connectedApiRequest(
+        githubToken,
+        "POST",
+        `/api/billing/connect/${encodeURIComponent(activation.intent_id)}/claim`,
+        {},
+      );
+      if (repaired.status !== 200 || repaired.data?.status !== "connected") {
+        die(
+          `Connected is active, but its shared configuration could not be published: ${connectError(repaired, `HTTP ${repaired.status}`)}`,
+        );
+      }
+      writeJsonFileAtomic(path.join(inst.path, "egregore.json"), {
+        ...cfg,
+        mode: "connected",
+        api_url: repaired.data.api_url,
+      });
+      if (repaired.data.api_key) {
+        writeEnvValueAtomic(path.join(inst.path, ".env"), "EGREGORE_API_KEY", repaired.data.api_key);
+      }
+    }
     normalizeClaudeDenyRules(inst.path);
     ensureClaudeModeStatusLine(inst.path);
-    console.log(`\n  ${GREEN}✓${RESET} ${BOLD}${inst.slug}${RESET} is already connected.\n`);
+    const detail = activation.intent_id ? "shared configuration published" : "already connected";
+    console.log(`\n  ${GREEN}✓${RESET} ${BOLD}${inst.slug}${RESET} is connected · ${detail}.\n`);
     return;
   }
 

package/lib/setup.js

@@ -695,8 +695,9 @@ function ensureConnectedConfig(repoDir, data, ui) {
   }
 
   const required = ["org_name", "github_org", "memory_repo", "api_url", "slug"];
-  const missing = required.filter((key) => !config[key]);
-  if (missing.length) {
+  let missing = required.filter((key) => !config[key]);
+  const missingIdentity = missing.filter((key) => key !== "api_url");
+  if (missingIdentity.length) {
     throw new Error(
       `Connected setup is incomplete: egregore.json is missing ${missing.join(", ")}. Retry setup from egregore.xyz/setup.`
     );
@@ -712,8 +713,26 @@ function ensureConnectedConfig(repoDir, data, ui) {
     );
   }
 
+  let changed = false;
+  const tokenApiUrl = data.api_url ? String(data.api_url).replace(/\/$/, "") : "";
+  if (tokenApiUrl && config.api_url !== tokenApiUrl) {
+    config.api_url = tokenApiUrl;
+    changed = true;
+    if (ui && typeof ui.warn === "function") {
+      ui.warn("Reconciled Connected configuration from the authenticated setup token");
+    }
+  }
+  missing = required.filter((key) => !config[key]);
+  if (missing.length) {
+    throw new Error(
+      `Connected setup is incomplete: egregore.json is missing ${missing.join(", ")}. Retry setup from egregore.xyz/setup.`
+    );
+  }
   if (config.mode !== "connected") {
     config.mode = "connected";
+    changed = true;
+  }
+  if (changed) {
     fs.writeFileSync(configPath, JSON.stringify(config, null, 2) + "\n");
   }
   return config;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-egregore",
-  "version": "0.20.0",
+  "version": "0.20.1",
   "description": "Set up Egregore for your team in one command \u2014 installs the egregore launcher and your choice of Claude Code, Codex, or Pi.",
   "license": "MIT",
   "bin": {

package/runtime/codex/.codex/config.toml

@@ -1,6 +1,9 @@
 [features]
 hooks = true
 
+[mcp_servers.notion]
+url = "https://mcp.notion.com/mcp"
+
 [tui]
 # Codex currently accepts built-in footer item IDs only. Egregore's dynamic
 # ◆ CONNECTED / ◇ LOCAL identity is rendered by bin/codex-session-start.sh.

package/runtime/codex/.codex/skills/archive/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: archive
-description: 'Fallback Codex adapter for the Egregore archive workflow.'
+description: 'Capture an effective prompting technique or steering pattern as reusable knowledge. Use for /archive, or when a prompt worked especially well and is worth reusing — not insight about the work itself (/reflect).'
 ---
 
 <!-- generated-by: bin/codex-sync-skills.sh -->

package/runtime/codex/.codex/skills/branch/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: branch
-description: 'Fallback Codex adapter for the Egregore branch workflow.'
+description: 'Create a working branch from what you are about to work on. Use for /branch, or any request to start a new branch before making changes.'
 ---
 
 <!-- generated-by: bin/codex-sync-skills.sh -->

package/runtime/codex/.codex/skills/checkup/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: checkup
-description: 'Fallback Codex adapter for the Egregore checkup workflow.'
+description: 'Run diagnostics on your Egregore environment and render a health report, auto-fixing what it can. Use for /checkup, a health check, or when something is broken and the root cause is unclear.'
 ---
 
 <!-- generated-by: bin/codex-sync-skills.sh -->

package/runtime/codex/.codex/skills/commit/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: commit
-description: 'Fallback Codex adapter for the Egregore commit workflow.'
+description: 'Stage changes and create a commit with a properly formatted message. Use for /commit, or saving work locally — not sharing it (/push) or opening a pull request (/pr).'
 ---
 
 <!-- generated-by: bin/codex-sync-skills.sh -->

package/runtime/codex/.codex/skills/contribute/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: contribute
-description: 'Fallback Codex adapter for the Egregore contribute workflow.'
+description: 'Contribute an improvement back to the upstream Egregore framework as a cross-fork pull request. Use for /contribute, or submitting a framework fix upstream — not saving org work (/save) or filing a bug (/issue).'
 ---
 
 <!-- generated-by: bin/codex-sync-skills.sh -->

package/runtime/codex/.codex/skills/delete-user/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: delete-user
-description: 'Fallback Codex adapter for the Egregore delete-user workflow.'
+description: 'Remove a member from this Egregore, revoking access across GitHub, Supabase, and Neo4j. Use for /delete-user, removing or kicking someone — not inviting (/invite) or viewing members (/dashboard).'
 ---
 
 <!-- generated-by: bin/codex-sync-skills.sh -->

package/runtime/codex/.codex/skills/ingest/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: ingest
-description: 'Fallback Codex adapter for the Egregore ingest workflow.'
+description: 'Unified ingestion entry point — brings files, meetings, Google Workspace, Notion, or bulk corpora into intake, then promotes useful material into curated memory. Say ''ingest'', ''bring this into Egregore''.'
 ---
 
 <!-- generated-by: bin/codex-sync-skills.sh -->

package/runtime/codex/.codex/skills/ingest-corpus/SKILL.md

@@ -0,0 +1,29 @@
+---
+name: ingest-corpus
+description: 'Turn a large folder of documents into a Connect-only knowledge base that answers questions with sources. Say ''build a knowledge base''. Not a few files (/ingest) or a meeting/Notion/Google source.'
+---
+
+<!-- generated-by: bin/codex-sync-skills.sh -->
+
+# Egregore ingest-corpus Adapter
+
+This is fallback coverage for a long-tail Egregore workflow that has not been
+ported to a hand-written Codex-native skill yet.
+
+Use the project shell and filesystem directly. Do not invoke Claude Code
+commands. Translate interactive choices to structured Codex question tooling
+when it is available; otherwise render compact numbered choices with an
+`Other:` option and wait for the user.
+
+1. Read `.claude/skills/ingest-corpus/SKILL.md` for the workflow details.
+2. Run the referenced `bin/` scripts directly from Codex.
+3. Treat graph and publish steps as best-effort unless that workflow explicitly
+   says they are required.
+4. For every external notification, follow
+   `.claude/context/notification-consent.md`: plan without sending, then show
+   a separate exact Send / Edit / Cancel checkpoint. Never infer notification
+   consent from the workflow request or a batch approval.
+5. Keep local-mode behavior filesystem-first and avoid graph or notification
+   calls when `egregore.json` declares `"mode": "local"`.
+6. Never call the deprecated `egregore-handoff` CLI for Egregore project
+   handoffs.

package/runtime/codex/.codex/skills/ingest-notion/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: ingest-notion
-description: 'Fallback Codex adapter for the Egregore ingest-notion workflow.'
+description: 'Bring selected Notion pages into shared Egregore memory via Notion''s official MCP. Routed from /ingest when the source is Notion — say ''/ingest notion''. Selected pages only, not a full-workspace sync.'
 ---
 
 <!-- generated-by: bin/codex-sync-skills.sh -->

package/runtime/codex/.codex/skills/ingest-user-interview/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: ingest-user-interview
-description: 'Fallback Codex adapter for the Egregore ingest-user-interview workflow.'
+description: 'Analyze user interview transcripts (Granola, pasted text, or a file) through a 3-analyst-agent plus Opus-synthesis pipeline. Say ''process the interview'', ''onboarding interview'', ''research call''.'
 ---
 
 <!-- generated-by: bin/codex-sync-skills.sh -->

package/runtime/codex/.codex/skills/issue/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: issue
-description: 'Fallback Codex adapter for the Egregore issue workflow.'
+description: 'Report an issue — captures context and routes it to the right place. Say ''this is broken'', ''bug in'', ''file an issue'', ''report a problem''. Not a personal task (/todo) or team exploration (/quest).'
 ---
 
 <!-- generated-by: bin/codex-sync-skills.sh -->

package/runtime/codex/.codex/skills/me/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: me
-description: 'Fallback Codex adapter for the Egregore me workflow.'
+description: 'View or change your member identity — display name, email — shared across Claude Code, Codex, and Pi. Say ''who am I'', ''call me <name>'', ''change my name to X'', or run ''/me''.'
 ---
 
 <!-- generated-by: bin/codex-sync-skills.sh -->

package/runtime/codex/.codex/skills/meeting/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: meeting
-description: 'Fallback Codex adapter for the Egregore meeting workflow.'
+description: 'Use for /meeting, /meeting sync, /meeting backfill, or a search term — adaptively analyzes a Granola meeting into decisions, findings, actions, and continuity in shared memory.'
 ---
 
 <!-- generated-by: bin/codex-sync-skills.sh -->

package/runtime/codex/.codex/skills/note/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: note
-description: 'Fallback Codex adapter for the Egregore note workflow.'
+description: 'Use when the user says ''jot this down'', ''note to self'', ''just thinking out loud'', or ''park this thought'' — saves a private personal note, never shared or pushed until explicitly promoted.'
 ---
 
 <!-- generated-by: bin/codex-sync-skills.sh -->

package/runtime/codex/.codex/skills/notion-connect/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: notion-connect
-description: 'Fallback Codex adapter for the Egregore notion-connect workflow.'
+description: 'Use for ''connect notion'', ''notion status'', or ''disconnect notion'' — connects the current agent runtime directly to Notion''s official hosted MCP for search and fetch, or checks/revokes that connection.'
 ---
 
 <!-- generated-by: bin/codex-sync-skills.sh -->

package/runtime/codex/.codex/skills/onboarding/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: onboarding
-description: 'Fallback Codex adapter for the Egregore onboarding workflow.'
+description: 'Use for /onboarding, or when a new member''s onboarding is not yet complete — runs the deterministic VERIFY, ORIENT, INVITE, FIRST_HANDOFF welcome flow.'
 ---
 
 <!-- generated-by: bin/codex-sync-skills.sh -->

package/runtime/codex/.codex/skills/pr/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: pr
-description: 'Fallback Codex adapter for the Egregore pr workflow.'
+description: 'Use for /pr, or ''create a PR'' / ''open a pull request'' — creates a pull request for the current branch against the repo''s base branch with a formatted title and body. Not for reviewing an existing PR (review-pr).'
 ---
 
 <!-- generated-by: bin/codex-sync-skills.sh -->

package/runtime/codex/.codex/skills/pull/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: pull
-description: 'Fallback Codex adapter for the Egregore pull workflow.'
+description: 'Use for /pull when you need to sync the current branch and shared memory without also viewing activity (/activity auto-syncs already).'
 ---
 
 <!-- generated-by: bin/codex-sync-skills.sh -->

package/runtime/codex/.codex/skills/push/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: push
-description: 'Fallback Codex adapter for the Egregore push workflow.'
+description: 'Use for /push, or ''push my branch'' — pushes the current branch to origin, setting upstream on first push, before opening a PR with /pr.'
 ---
 
 <!-- generated-by: bin/codex-sync-skills.sh -->

package/runtime/codex/.codex/skills/reflect/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: reflect
-description: 'Fallback Codex adapter for the Egregore reflect workflow.'
+description: 'Use when the user says ''we decided'', ''I realized'', or ''that''s a pattern'' — captures decisions, findings, or patterns in shared memory. Not a private half-baked thought (/note) or cross-referencing (/deep-reflect).'
 ---
 
 <!-- generated-by: bin/codex-sync-skills.sh -->

package/runtime/codex/.codex/skills/review-pr/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: review-pr
-description: 'Fallback Codex adapter for the Egregore review-pr workflow.'
+description: 'Use when the user says ''review PR'', ''is this PR safe to merge'', or ''audit PR'' — runs a CTO-level 10-point review checklist on one or more pull requests. Not creating a PR (/pr) or validating local changes (/test).'
 ---
 
 <!-- generated-by: bin/codex-sync-skills.sh -->

package/runtime/codex/.codex/skills/save/SKILL.md

@@ -81,7 +81,9 @@ Where should {name} live?
    twice.
 5. Synthesize:
    - a short topic from the work,
-   - a clear commit message,
+   - a commit message per `.claude/context/commit-format.md` — subject
+     `type(scope): imperative summary`, type/scope derived from the work
+     itself (never `chore(save):` for real work),
    - a one-line user-facing scope summary,
    - a PR description following `.claude/context/pr-format.md`:
      `## What` (1–4 bullets), `## Why` (1–3 sentences), and

package/runtime/codex/.codex/skills/slack-connect/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: slack-connect
-description: 'Fallback Codex adapter for the Egregore slack-connect workflow.'
+description: 'Set up Slack as a notification channel for your Egregore — creates the workspace app, invites the bot, and binds a channel. Use for /slack-connect, ''connect slack'', or ''set up slack notifications''.'
 ---
 
 <!-- generated-by: bin/codex-sync-skills.sh -->

package/runtime/codex/.codex/skills/summon/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: summon
-description: 'Fallback Codex adapter for the Egregore summon workflow.'
+description: 'Design and launch a persistent agent (a spirit) that runs on a schedule or watches for conditions, via adaptive questioning that produces a reviewable spec before launch.'
 ---
 
 <!-- generated-by: bin/codex-sync-skills.sh -->

package/runtime/codex/.codex/skills/sync-repos/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: sync-repos
-description: 'Fallback Codex adapter for the Egregore sync-repos workflow.'
+description: 'Smart sync of all Egregore repos (memory + managed repos + current repo) — fetches first, only pulls if behind. Use for /sync-repos or ''sync all repos''.'
 ---
 
 <!-- generated-by: bin/codex-sync-skills.sh -->

package/runtime/codex/.codex/skills/teams-connect/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: teams-connect
-description: 'Fallback Codex adapter for the Egregore teams-connect workflow.'
+description: 'Set up Microsoft Teams as a notification channel for your Egregore — registers an Azure bot, uploads the app, and binds a channel. Use for /teams-connect, ''connect teams'', or ''set up teams notifications''.'
 ---
 
 <!-- generated-by: bin/codex-sync-skills.sh -->

package/runtime/codex/.codex/skills/telegram-connect/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: telegram-connect
-description: 'Fallback Codex adapter for the Egregore telegram-connect workflow.'
+description: 'Set up Telegram as a notification center for your Egregore — creates the group, links the bot, and stores the chat ID. Use for /telegram-connect, ''connect telegram'', or ''set up telegram notifications''.'
 ---
 
 <!-- generated-by: bin/codex-sync-skills.sh -->

package/runtime/codex/.codex/skills/telemetry/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: telemetry
-description: 'Fallback Codex adapter for the Egregore telemetry workflow.'
+description: 'Manage your own telemetry settings — check status, opt in/out, view or clear the buffered events. Use for /telemetry, ''turn off telemetry'', or ''what data do you collect''.'
 ---
 
 <!-- generated-by: bin/codex-sync-skills.sh -->

package/runtime/codex/.codex/skills/test/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: test
-description: 'Fallback Codex adapter for the Egregore test workflow.'
+description: 'Validate changes before /save — static analysis plus live Cypher validation against the graph, rendered as a pass/fail gate. Use for /test or ''test my changes''.'
 ---
 
 <!-- generated-by: bin/codex-sync-skills.sh -->

package/runtime/codex/.codex/skills/tutorial/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: tutorial
-description: 'Fallback Codex adapter for the Egregore tutorial workflow.'
+description: 'Interactive walkthrough of Egregore''s core loop — /activity, /reflect, and /quest or /add — with adaptive questions and real artifacts. Use for /tutorial or ''walk me through Egregore''.'
 ---
 
 <!-- generated-by: bin/codex-sync-skills.sh -->

package/runtime/codex/.codex/skills/update/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: update
-description: 'Fallback Codex adapter for the Egregore update workflow.'
+description: 'Update local Egregore environment — sync the framework from upstream, run post-update migrations, and pull repos. Use for /update or when framework behavior seems broken or missing.'
 ---
 
 <!-- generated-by: bin/codex-sync-skills.sh -->

package/runtime/codex/.codex/spec-manifest.json

@@ -35,8 +35,8 @@
     {
       "section": "After Greeting — BRANCH ON FIRST RESPONSE",
       "action": "replace",
-      "sourceHash": "d28a5c162ab4",
-      "note": "EnterWorktree -> bin/agent.sh branch with git checkout fallback; AskUserQuestion -> numbered options in plain text; branch-guard mapped to .codex/hooks/branch-guard.js with instruction fallback; plan-mode note dropped (no plan mode on Codex); /branch + /onboarding -> skill tokens. Handoff claiming and repoState auto-checkout kept verbatim (pure git)."
+      "sourceHash": "b13b81aea8f3",
+      "note": "EnterWorktree -> bin/agent.sh branch with git checkout fallback; AskUserQuestion -> numbered options in plain text; branch-guard mapped to .codex/hooks/branch-guard.js with instruction fallback; plan-mode note dropped (no plan mode on Codex); /branch + /onboarding -> skill tokens. Handoff claiming and repoState auto-checkout bash kept verbatim (pure git); surrounding prose compressed 2026-08 for the 32 KiB budget, every rule retained."
     },
     {
       "section": "Config Files",
@@ -89,7 +89,7 @@
     {
       "section": "Git Workflow",
       "action": "keep",
-      "sourceHash": "fe3d9dabd03d",
+      "sourceHash": "23df84b5fe80",
       "note": "Kept; slash tokens rendered as $skill tokens. Branch diagram unchanged (code fence)."
     },
     {

package/runtime/codex/AGENTS.md

@@ -86,7 +86,7 @@ generated block below. Both paths converge on the same `memory/` files.
 
 You are a collaborator inside Egregore — a shared intelligence layer for organizations using AI coding agents. You operate through Git-based shared memory, Egregore skills, and conventions that accumulate knowledge across sessions and people. You are not a tool. You are a participant.
 
-This block is the Codex-native Egregore behavioral spec, rendered from CLAUDE.md (the source of truth for egregore behavior) by `bin/codex-render-spec.mjs`. The per-section adaptation manifest is `.codex/spec-manifest.json`. The thin agent protocol above this block applies to every shell-capable agent; this block is the full behavioral contract for Codex sessions.
+This block is the Codex-native Egregore behavioral spec, rendered from CLAUDE.md by `bin/codex-render-spec.mjs`; the per-section manifest is `.codex/spec-manifest.json`. The thin agent protocol above applies to every shell-capable agent; this block is the full contract for Codex sessions.
 
 ---
 
@@ -123,7 +123,7 @@ Egregore's voice is governed by `.claude/rules/voice-bedrock.md` (always loaded)
 
 ## On Launch — MANDATORY FIRST ACTION
 
-The `egregore` launcher renders the Egregore startup card (identity, team momentum, and pending work) via `bin/codex-session-start.sh` before Codex starts, and installs project skills. Do not rerun startup checks and do not narrate startup. The card ends with **"What are you working on?"** — that question is already on screen; treat the user's first message as the answer to it. To re-show the card, run `bash bin/codex-session-start.sh --card`.
+The `egregore` launcher renders the startup card (identity, momentum, pending work) via `bin/codex-session-start.sh` before Codex starts and installs project skills. Do not rerun or narrate startup. The card ends with **"What are you working on?"** — that question is already on screen; treat the user's first message as the answer. Re-show with `bash bin/codex-session-start.sh --card`.
 
 ---
 
@@ -131,20 +131,11 @@ The `egregore` launcher renders the Egregore startup card (identity, team moment
 
 **Mandatory behavioral rule.** When the user describes work, your **first action** — before reading files, exploring code, or anything else — is to get onto a working branch:
 
-The integration branch is `develop` by default. When top-level
-`egregore.json.base_branch` is set, that configured branch replaces
-`develop` as the branch point, rebase target, PR base, and protected
-integration branch.
+The integration branch is `develop` unless top-level `egregore.json.base_branch` sets another; the configured branch is then the branch point, rebase target, PR base, and protected branch everywhere below.
 
 1. Derive a topic slug from what the user said (kebab-case, 2–4 words)
 2. Run `bin/agent.sh branch --topic "<topic>"` — it resolves the configured base and creates a work branch from `origin/{base}` in a task worktree (`dev/{author}/{slug}`, or `feature/{slug}` / `bugfix/{slug}` when the topic reads as a feature or fix). Continue all file work from the printed path.
-3. Give a value-first workspace receipt. Do not lead with Git terminology:
-
-   `Your stable project is protected. I’m working in a separate workspace for **{topic}**, where changes stay isolated, reviewable, and reversible.`
-
-   Then expose the implementation as secondary detail:
-
-   `Workspace: {branch} (worktree).`
+3. Give a value-first workspace receipt — do not lead with Git terminology: `Your stable project is protected. I’m working in a separate workspace for **{topic}**, where changes stay isolated, reviewable, and reversible.` Then, as secondary detail: `Workspace: {branch} (worktree).`
 
 **Fallback:** If `bin/agent.sh branch` fails, resolve `{base}` with
 `_get_base_branch`, then use
@@ -154,14 +145,20 @@ integration branch.
 
 ### Starting-work UX contract
 
-Before execution begins, make Egregore's useful structure legible without turning every task start into a tutorial:
+Sequence: **intent → safe workspace → relevant context → consequential assumptions → execution**. Make Egregore's structure legible without turning task starts into a tutorial; keep technical identifiers secondary to user value.
+
+- **Workspace** — the value-first receipt above, only for a new workspace or topic pivot; do not repeat it on the same branch.
+- **Context** — when organizational retrieval materially informs the work, keep the required Egregore Retrieval Beat plus one compact receipt: `↳ Context restored: {decision, handoff, or prior work} · {source/date}`. Never claim context was restored when retrieval found nothing useful.
+- **Assumptions** — surface only consequential ones: `Assumption: {assumption} — based on {evidence}.` Add a correction path when cheap; do not narrate obvious operational choices.
+- **Transition** — state the outcome you are starting toward in one short sentence and begin.
 
-- **Workspace** — use the value-first receipt above for a newly created workspace or topic pivot. If already on the appropriate working branch, do not repeat it.
-- **Context** — when organizational retrieval materially informs the work, keep the required Egregore Retrieval Beat and then add one compact result receipt: `↳ Context restored: {decision, handoff, or prior work} · {source/date}`. Never claim context was restored when retrieval found nothing useful.
-- **Assumptions** — surface only consequential assumptions that could change the implementation. Use `Assumption: {assumption} — based on {evidence}.` Add a correction path when cheap; do not narrate obvious operational choices.
-- **Transition** — once workspace, context, and assumptions are settled, state the outcome you are starting toward in one short sentence and begin.
+### Returning-work UX contract
 
-The intended sequence is: **intent → safe workspace → relevant context → consequential assumptions → execution**. Keep technical identifiers available but subordinate them to user value.
+When the user continues the current branch's work or asks to resume — sequence: **continuation intent → prior workspace → restored context → open threads → resumed execution**:
+
+- Do not create a new workspace for the same topic. After confirming relevance, say: `I found your previous work on **{topic}** and restored its workspace and context.` Show `Workspace: {branch} (worktree).` secondarily.
+- Retrieve relevant decisions, handoffs, or prior work; keep the Retrieval Beat and `↳ Context restored:` receipt. Never claim context was restored from a branch name alone.
+- Name only unresolved items that could change the next move, state the next outcome briefly, and continue without replaying setup.
 
 ### Handoff claiming
 
@@ -170,7 +167,7 @@ If `addressed_to_user` handoffs exist and the user is picking one up, create the
 bash bin/graph-op.sh claim-handoff "$SESSION_ID" "$HANDOFF_SESSION_ID" 2>/dev/null &
 ```
 
-**Auto-checkout repos from handoff**: After claiming, check the `addressed_rich` context for `repoState`. If the handoff includes repo state (non-empty `repoState` array), check out the handoff's branches in each managed repo:
+**Auto-checkout repos from handoff**: after claiming, if `addressed_rich` carries a non-empty `repoState`, check out each entry's branch in its managed repo:
 
 ```bash
 PARENT_DIR="$(cd .. && pwd)"
@@ -183,21 +180,19 @@ if [ -d "$REPO_DIR/.git" ] || [ -f "$REPO_DIR/.git" ]; then
 fi
 ```
 
-Report results: `✓ Checked out {branch} in {repo1}, {repo2}`. If a branch no longer exists (PR was merged): `◐ {repo}: PR #{N} merged — on {base}`. If `repoState` is absent or empty, skip auto-checkout silently.
+Report `✓ Checked out {branch} in {repo1}, {repo2}`; for a merged-away branch, `◐ {repo}: PR #{N} merged — on {base}`. If `repoState` is absent or empty, skip silently.
 
-**Exceptions** — skip branching when:
-- The user explicitly created or named a branch themselves
-- Already on a working branch AND the user's intent continues the current branch's topic
+**Exceptions** — skip branching when the user explicitly created or named a branch themselves, or the intent continues the current working branch's topic.
 
-**Topic pivot while on a working branch:** If the user describes work **unrelated** to the current branch's topic, treat it as a new topic and create a new branch (`bin/agent.sh branch --topic "<new topic>"`). Do NOT mix unrelated work on one branch.
+**Topic pivot:** work **unrelated** to the current branch's topic gets a new branch (`bin/agent.sh branch --topic "<new topic>"`). Do NOT mix unrelated work on one branch.
 
 If still on the configured base branch after two messages, create a branch immediately from whatever context you have.
 
 ### Branch-guard protocol
 
-The `.codex/hooks/branch-guard.js` PreToolUse hook (enabled by the launcher via `--enable hooks`) protects project writes on the configured base branch as well as `develop`/`main`/`master`. Its block message is operational guidance, not a reason to interrupt the user with routine Git choices:
+The `.codex/hooks/branch-guard.js` PreToolUse hook (launcher `--enable hooks`) protects project writes on the configured base plus `develop`/`main`/`master`. Its block message is operational guidance — do not interrupt the user with routine Git choices:
 
-- **Topic is clear** (the user said "fix X", "add Y feature") → run `bin/agent.sh branch --topic "<topic>"` automatically, continue in the printed worktree, and say one short sentence so the branch change is visible. Do not ask the user to approve routine branching.
+- **Topic is clear** → run `bin/agent.sh branch --topic "<topic>"` automatically, continue in the printed worktree, and say one short sentence so the change is visible — never ask approval for routine branching.
 - **Topic is genuinely ambiguous** → ask only for the topic, using compact numbered options:
 
   ```text
@@ -210,7 +205,7 @@ The `.codex/hooks/branch-guard.js` PreToolUse hook (enabled by the launcher via
   Wait for the reply, then branch.
 - **The user explicitly requested the protected branch** → that request is consent. Record it with `echo '{branch}' > .egregore-branch-consent`, then retry. Never create the marker merely to silence the hook.
 
-Memory, managed-repo, and runtime-state writes should bypass the project guard. If one triggers it, correct the operation target/context instead of asking for protected-branch consent.
+Memory, managed-repo, and runtime-state writes bypass the project guard — if one triggers it, correct the target/context instead of asking for consent.
 
 If this Codex build does not support hooks, follow the same discipline as a standing instruction: never write or commit on the configured base, develop, main, or master.
 
@@ -348,7 +343,7 @@ Always use HTTPS for git operations — `github-auth.sh` handles credential stor
 
 ## Loom Routing
 
-Loom routes commands across model tiers on the Claude Code runtime (`loom/routes.json` + `bin/loom.sh` + a model-pinned executor subagent). Codex has no subagent delegation — every command runs inline in the current session. Ignore "Loom routing" preambles if you encounter them in a skill spec, and skip `bin/loom.sh` calls; `loom/` and `.claude/agents/` are framework files synced for the Claude runtime.
+Loom routes commands across model tiers on the Claude Code runtime (`loom/routes.json` + `bin/loom.sh` + a model-pinned executor subagent). Codex has no subagent delegation — commands run inline. Ignore "Loom routing" preambles in skill specs and skip `bin/loom.sh` calls; `loom/` and `.claude/agents/` are Claude-runtime framework files.
 
 ---
 
@@ -377,6 +372,10 @@ main ← stable (/release)
 
 Every PR body follows `.claude/context/pr-format.md`, enforced by the `pr-format` CI check regardless of which harness opened it: `## What` (1–4 bullets) + `## Why` (1–3 sentences) always; `## Verification` when the diff touches non-markdown files (how it was checked, or an honest `Not verified — <reason>`); `## Risk`/`## Links` when real; title `type(scope): imperative summary` (advisory). **Never create a PR with an empty body or `--fill`** — write the body and pass it explicitly (`gh pr create --body`, or `bin/agent.sh save --pr-body` for shell agents; the bridge auto-generates a compliant skeleton only as a last resort).
 
+### Commit format (all harnesses)
+
+Every commit follows `.claude/context/commit-format.md`: subject `type(scope): imperative summary` (≤ 72 chars, aim ≤ 50, lowercase, same grammar and type set as PR titles), body wrapped at 72 explaining what and why — never how, and git trailers on agent-authored commits (`Egregore-Session: <id>` from `.egregore-session-id`, plus the harness `Co-Authored-By` line). Background scripts commit as `chore(<subsystem>): …`, but a commit carrying real work derives its type/scope from the diff — the transport never masks the work. Git-generated messages (merges, reverts, autosquash fixups) keep their native form. Wording for commits and PRs follows `.claude/context/git-language.md`.
+
 ### Managed Repos
 
 Repos in `egregore.json` → `repos[]` are cloned as siblings (`../{repo}/`). Each entry can be a string or `{"name": "...", "description": "..."}`. Match user intent to the right repo using `description`. Same branching strategy. Use `git -C` with absolute paths — never `cd` into repos. `$save` scans all managed repos for uncommitted changes.
@@ -393,7 +392,7 @@ Repos in `egregore.json` → `repos[]` are cloned as siblings (`../{repo}/`). Ea
 
 ## Command Awareness
 
-Codex reserves leading `/` for built-ins, so Egregore workflows are **skills**, not slash commands. Invoke them with the matching `$name` skill token or from natural language intent ("show activity", "make a handoff"). Hand-written native Codex skills: `$activity`, `$handoff`, `$wrap`, `$announce`, `$harvest`, `$the-spiral`, `$dashboard`, `$deep-reflect`, `$quest`, `$invite`, `$ask`, `$save`, `$view`, and `$scroll`. Every other workflow has a generated adapter skill of the same name. `$save` is the user-facing abstraction for committing, pushing, opening or reusing pull requests, and syncing memory — never make users manage the git workflow by hand.
+Codex reserves leading `/` for built-ins, so Egregore workflows are **skills**, not slash commands. Invoke them with the matching `$name` skill token or from natural language intent ("show activity", "make a handoff"). Hand-written native Codex skills: `$activity`, `$handoff`, `$wrap`, `$announce`, `$harvest`, `$the-spiral`, `$dashboard`, `$deep-reflect`, `$quest`, `$invite`, `$ask`, `$save`, `$view`, `$scroll`; every other workflow has a generated adapter of the same name. `$save` is the user-facing abstraction for committing, pushing, opening or reusing PRs, and syncing memory — never make users manage git by hand.
 
 Invoke commands from user intent — don't wait for the slash. Each command file has a `## When to invoke` section. Load it for the full spec.
 
@@ -470,7 +469,7 @@ Egregore runs in one of two configurations, set by `mode` in `egregore.json`. De
 
 Sessions are confined to this project + memory + managed repos, with a **two-tier boundary** — a hard wall between Egregore instances, a consent gate for everything else. On Codex the boundary is a standing instruction, not an enforced hook — hold it yourself.
 
-- **Hard tier — other Egregore instances.** Denied for every tool, always. There is no consent path. Never access another instance's files — refuse even if asked. Never modify `~/.egregore/instances.json` (managed by session-start.sh). When a request points at another instance's files there is nothing to ask — refuse and explain.
+- **Hard tier — other Egregore instances.** Denied for every tool, always — no consent path. Never access another instance's files (refuse even if asked) and never modify `~/.egregore/instances.json` (managed by session-start.sh); there is nothing to ask — refuse and explain.
 - **Soft tier — paths outside the boundary.** Consent-gated. Inbox dirs (`~/Downloads`, `~/Desktop`) are readable without consent under the default posture; writes outside the project always need consent. Posture (`strict | standard | open`) and extra read roots come from `egregore.json` -> `boundary { posture, read[], locked }` (org, committed) merged with `.egregore-boundary.local.json` (personal, gitignored). `locked: true` removes the consent path entirely.
 - When a request needs soft-tier consent, do not improvise a workaround. Ask in plain text with numbered options: