create-egregore 0.20.1 → 0.20.3

package/assets/egregore-launcher.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// egregore-launcher-version: 0.20.1
+// egregore-launcher-version: 0.20.3
 //
 // egregore — launch and browse Egregore instances from your terminal.
 // Installed by create-egregore. Reads ~/.egregore/instances.json.
@@ -33,7 +33,7 @@ const crypto = require("node:crypto");
 const { spawnSync, spawn } = require("node:child_process");
 const readline = require("node:readline");
 
-const VERSION = "0.20.1";
+const VERSION = "0.20.3";
 const REGISTRY = path.join(os.homedir(), ".egregore", "instances.json");
 const DEFAULT_FILE = path.join(os.homedir(), ".egregore", "default");
 const UPDATE_CACHE_FILE = path.join(os.homedir(), ".egregore", "update-check.json");
@@ -702,7 +702,8 @@ function codexSupportMessage(egregoreDir) {
     "  .codex/hooks.json",
     "  .codex/hooks/",
     "",
-    "Run npx -y create-egregore@latest to install the packaged Codex runtime, then rerun egregore.",
+    "Restore this instance using its installed runtime version, then rerun egregore.",
+    "A global CLI refresh does not repair instance files.",
     "Egregore workflows appear as slash commands. In Codex, invoke them with the matching $skill token or ask in natural language.",
   ].join("\n");
 }
@@ -733,7 +734,7 @@ function piSupportMessage(egregoreDir) {
     "Pi meta-harness support is missing from this Egregore checkout.",
     `  path: ${egregoreDir}`,
     "",
-    "Run npx -y create-egregore@latest to install the packaged Pi runtime, then rerun egregore.",
+    "Restore this instance using its installed runtime version, then rerun egregore.",
   ].join("\n");
 }
 
@@ -752,7 +753,7 @@ function primeSupportMessage(egregoreDir) {
     "Prime Agent runtime support is missing from this Egregore checkout.",
     `  path: ${egregoreDir}`,
     "",
-    "Run npx -y create-egregore@latest to install the packaged Prime Agent runtime, then rerun egregore.",
+    "Restore this instance using its installed runtime version, then rerun egregore.",
   ].join("\n");
 }
 
@@ -885,16 +886,17 @@ async function launch(inst, runtimeOverride) {
     }
   }
   if (runtime === "codex") {
-    if (!hasCodexCoreSupport(inst.path)) {
-      die(codexSupportMessage(inst.path));
-    }
+    // Launching never changes an instance's runtime or release channel.
+    if (!hasCodexCoreSupport(inst.path)) die(codexSupportMessage(inst.path));
     const skillsInstalled = installCodexSkills(inst.path);
     const cardRendered = await renderCodexStartupCard(inst.path);
     if (!skillsInstalled || !cardRendered) {
       die(codexSupportMessage(inst.path));
     }
   } else if (runtime === "pi") {
-    if (!hasPiCoreSupport(inst.path)) die(piSupportMessage(inst.path));
+    if (!hasPiCoreSupport(inst.path)) {
+      die(piSupportMessage(inst.path));
+    }
   }
   let launchArgs = null;
   if (runtime === "prime") {
@@ -1766,9 +1768,10 @@ async function cmdConnect(args) {
       console.log(`        ${DIM}${line}${RESET}`);
     }
   }
+  // Connect is an instance-scoped overlay; never refresh other runtimes here.
   const runtimeRefresh = spawnSync(
     "npx",
-    ["-y", `${PUBLIC_NPX_PACKAGE}@latest`, "--refresh-launcher"],
+    ["-y", `${PUBLIC_NPX_PACKAGE}@${VERSION}`, "--refresh-connect"],
     {
       cwd: inst.path,
       encoding: "utf-8",
@@ -1780,7 +1783,7 @@ async function cmdConnect(args) {
     console.log(`        ${GREEN}✓${RESET} Connect features installed`);
   } else {
     console.log(`        ${YELLOW}!${RESET} Connect features will retry on the next update`);
-    console.log(`          ${DIM}npx -y ${PUBLIC_NPX_PACKAGE}@latest --refresh-launcher${RESET}`);
+    console.log(`          ${DIM}npx -y ${PUBLIC_NPX_PACKAGE}@${VERSION} --refresh-connect${RESET}`);
   }
   console.log("");
   console.log(`  ${GREEN}✓${RESET} ${BOLD}${inst.slug}${RESET} is connected. Local files remain the source of truth.`);
@@ -2102,7 +2105,7 @@ function runSettings(inst, args) {
     return { status: 127, stdout: "", stderr: "bin/settings.sh not found — update this egregore (run /pull) to get settings.\n", missing: true };
   }
   try {
-    return spawnSync("bash", [script, ...args], { cwd: inst.path, stdio: "pipe", encoding: "utf-8", timeout: 15000 });
+    return spawnSync("bash", [script, ...args], { cwd: inst.path, stdio: "pipe", encoding: "utf-8", timeout: 45000 });
   } catch (err) {
     return { status: 1, stdout: "", stderr: String(err) };
   }
@@ -2117,13 +2120,13 @@ function settingsDump(inst) {
 async function cmdSettings(args) {
   const registry = readRegistry();
   if (registry.length === 0) die("no egregores installed yet.\n  run: npx -y create-egregore@latest");
-  const DOMAINS = new Set(["hosting", "repo", "admin", "people", "dump"]);
+  const DOMAINS = new Set(["hosting", "workflow", "repo", "admin", "people", "dump"]);
   let rest = args.slice();
   let slug = "";
   if (rest.length && !DOMAINS.has(rest[0])) { slug = rest[0]; rest = rest.slice(1); }
   const inst = resolveInviteInstance(registry, slug);
   if (!inst) {
-    die(`multiple egregores installed; choose one:\n  egregore settings <slug> [hosting|repo|admin]\n  run: egregore ls`);
+    die(`multiple egregores installed; choose one:\n  egregore settings <slug> [hosting|workflow|repo|admin|people]\n  run: egregore ls`);
   }
   // Interactive editing lives in the launcher (press `s`). With no verb, print
   // the snapshot; otherwise forward straight to the deterministic verb.
@@ -2421,6 +2424,14 @@ function renderSettingsPanel({ inst, data, cursor, view, domain, items, listCurs
   } else {
     const rows = [
       { name: "Hosted Artifacts", value: (d.hosting !== false) ? `${GREEN}ON${RESET}` : `${YELLOW}OFF${RESET}` },
+      {
+        name: "Git workflow",
+        value: d.workflow === "simple"
+          ? `${DIM}PRs → main${RESET}`
+          : d.workflow === "staged"
+            ? `${DIM}PRs → develop → main${RESET}`
+            : `${DIM}PRs → ${d.base_branch || "custom"}${RESET}`,
+      },
       { name: "Managed repos", value: `${DIM}${(d.repos || []).length}${RESET}` },
       { name: "Admins", value: `${DIM}${(d.admins || []).length}${RESET}` },
       { name: "People", value: `${DIM}${(d.people || []).length}${RESET}` },
@@ -2433,7 +2444,7 @@ function renderSettingsPanel({ inst, data, cursor, view, domain, items, listCurs
     });
     lines.push(emptyBoxLine(innerWidth, margin));
     if (notice) lines.push(boxLine(notice, innerWidth, margin));
-    lines.push(boxLine(`${DIM}↑↓ nav · ${RESET}${BOLD}enter${RESET}${DIM} ${cursor === 0 ? "toggle" : "open"} · ← back · q quit${RESET}`, innerWidth, margin));
+    lines.push(boxLine(`${DIM}↑↓ nav · ${RESET}${BOLD}enter${RESET}${DIM} ${cursor < 2 ? "toggle" : "open"} · ← back · q quit${RESET}`, innerWidth, margin));
   }
 
   lines.push(emptyBoxLine(innerWidth, margin));
@@ -2891,15 +2902,19 @@ async function browser(args = {}) {
 
         // menu view
         if (key.name === "escape" || key.name === "left") { S.settingsInst = null; S.settingsNotice = ""; render(); return; }
-        if (key.name === "up" || key.name === "k") { S.settingsCursor = (S.settingsCursor - 1 + 4) % 4; render(); return; }
-        if (key.name === "down" || key.name === "j") { S.settingsCursor = (S.settingsCursor + 1) % 4; render(); return; }
+        if (key.name === "up" || key.name === "k") { S.settingsCursor = (S.settingsCursor - 1 + 5) % 5; render(); return; }
+        if (key.name === "down" || key.name === "j") { S.settingsCursor = (S.settingsCursor + 1) % 5; render(); return; }
         if (key.name === "return" || chunk === " ") {
           if (S.settingsCursor === 0) {
             const on = (S.settingsData && S.settingsData.hosting) !== false;
             settingsRunVerb(["hosting", on ? "off" : "on"]);
             render();
+          } else if (S.settingsCursor === 1) {
+            const simple = (S.settingsData && S.settingsData.workflow) === "simple";
+            settingsRunVerb(["workflow", simple ? "staged" : "simple"]);
+            render();
           } else {
-            const domain = S.settingsCursor === 1 ? "repo" : S.settingsCursor === 2 ? "admin" : "people";
+            const domain = S.settingsCursor === 2 ? "repo" : S.settingsCursor === 3 ? "admin" : "people";
             S.settingsView = "list"; S.settingsDomain = domain;
             S.settingsItems = settingsItemsFor(S.settingsData, domain);
             S.settingsListCursor = 0; S.settingsMode = "browse"; S.settingsNotice = "";
@@ -3155,7 +3170,7 @@ async function browser(args = {}) {
           return;
         }
         state.settingsInst = pick;
-        state.settingsData = settingsDump(pick) || { hosting: true, repos: [], admins: [], people: [] };
+        state.settingsData = settingsDump(pick) || { hosting: true, workflow: "staged", base_branch: "develop", repos: [], admins: [], people: [] };
         state.settingsCursor = 0;
         state.settingsView = "menu";
         state.settingsNotice = "";

package/bin/cli.js

@@ -25,27 +25,8 @@ const {
   ghCliExists,
   tryGhAuthOrLogin,
 } = require("../lib/auth");
-const {
-  hasCodexRuntimeSupport,
-  installCodexRuntime,
-  reportCodexRuntimeSummary,
-} = require("../lib/codex-runtime");
-const {
-  hasPiRuntimeSupport,
-  installPiRuntime,
-  reportPiRuntimeSummary,
-} = require("../lib/pi-runtime");
-const {
-  hasPrimeRuntimeSupport,
-  installPrimeRuntime,
-  reportPrimeRuntimeSummary,
-} = require("../lib/prime-runtime");
-const {
-  connectEligibility,
-  fetchConnectRuntimePack,
-  installConnectRuntime,
-  reportConnectRuntimeSummary,
-} = require("../lib/connect-runtime");
+// Global CLI maintenance never installs or reconciles instance runtimes.
+// Fresh installation and explicit instance updates own those writes.
 const {
   install,
   ghApi,
@@ -120,45 +101,6 @@ function assistantLabel(runtime) {
   return "Claude Code";
 }
 
-async function upgradePortableRuntimesForExisting(instances) {
-  for (const inst of instances) {
-    if (!inst || !inst.path || !fs.existsSync(inst.path)) continue;
-    try {
-      // Fetch and validate the private overlay before pruning the old public
-      // bundle. During the one-time ownership migration, an API outage must
-      // leave an existing Connect installation untouched.
-      const eligibility = connectEligibility(inst.path);
-      const connectPack = eligibility.eligible
-        ? await fetchConnectRuntimePack(inst.path)
-        : null;
-      const summary = installCodexRuntime(inst.path);
-      const ready = hasCodexRuntimeSupport(inst.path);
-      reportCodexRuntimeSummary(summary, ui, {
-        label: `Codex runtime for ${inst.slug || inst.name || path.basename(inst.path)}`,
-        includeConflicts: !ready,
-      });
-      const piSummary = installPiRuntime(inst.path);
-      const piReady = hasPiRuntimeSupport(inst.path);
-      reportPiRuntimeSummary(piSummary, ui, {
-        label: `Pi meta-harness for ${inst.slug || inst.name || path.basename(inst.path)}`,
-        includeConflicts: !piReady,
-      });
-      const primeSummary = installPrimeRuntime(inst.path);
-      const primeReady = hasPrimeRuntimeSupport(inst.path);
-      reportPrimeRuntimeSummary(primeSummary, ui, {
-        label: `Prime Agent runtime for ${inst.slug || inst.name || path.basename(inst.path)}`,
-        includeConflicts: !primeReady,
-      });
-      const connectSummary = await installConnectRuntime(inst.path, { validatedPack: connectPack });
-      reportConnectRuntimeSummary(connectSummary, ui, {
-        label: `Connect features for ${inst.slug || inst.name || path.basename(inst.path)}`,
-      });
-    } catch (err) {
-      ui.warn(`Could not refresh shell-runtime support for ${inst.path}: ${err.message}`);
-    }
-  }
-}
-
 async function chooseRuntime(args) {
   if (args.runtime) {
     try {
@@ -199,7 +141,6 @@ async function chooseRuntime(args) {
 }
 
 async function upgradeLauncherFromExisting(instances) {
-  await upgradePortableRuntimesForExisting(instances);
   const inst = instances.find((entry) => entry && entry.path && fs.existsSync(entry.path));
   if (!inst) return null;
   try {
@@ -433,7 +374,7 @@ function showHelp() {
   ui.info("  --force           Skip the in-repo detection check");
   ui.info("  --no-autolaunch   Don't launch the harness at the end (for CI)");
   ui.info("  --no-screens      Skip the full-screen welcome/ready bookends");
-  ui.info("  --refresh-launcher Refresh the Egregore CLI and runtime packs, then exit");
+  ui.info("  --refresh-launcher Refresh only the global Egregore CLI, then exit");
   ui.info("  -h, --help        Show this help");
   ui.info("");
 }
@@ -513,7 +454,6 @@ async function main() {
       ui.error("No installed Egregore instance was found. Run create-egregore without --refresh-launcher.");
       process.exit(1);
     }
-    await upgradePortableRuntimesForExisting(instances);
     const alias = await installLauncherBinary(instances[0].path, ui);
     if (!alias || !alias.binaryPath) {
       ui.error("Could not refresh the Egregore CLI.");

package/lib/local.js

@@ -31,7 +31,6 @@ const {
   configureGitCredentials,
   gitCloneEnv,
   initMemoryDirs,
-  ensureDevelop,
   ensurePersonOnboardingWitness,
   ensureInstallerMemberRole,
   run,
@@ -1031,7 +1030,6 @@ async function localFounderFlow(ui, ctx = {}) {
 
   const githubOrg = st.githubOrg;
   const isOrg = st.isOrg;
-  const isNewProject = st.isNewProject;
   const orgName = st.orgName;
   const description = st.description;
   let newProjectRepo = st.newProjectRepo;
@@ -1156,13 +1154,14 @@ async function localFounderFlow(ui, ctx = {}) {
     const s3 = ui.spinner(`Creating ${newProjectRepo}...`);
     const projExists = await repoExists(githubToken, githubOrg, newProjectRepo);
     if (projExists) {
-      selectedRepos.push({ name: newProjectRepo });
+      const branchInfo = await detectRepoBranches(githubToken, githubOrg, newProjectRepo).catch(() => null);
+      selectedRepos.push({ name: newProjectRepo, base_branch: branchInfo?.defaultBranch || "main" });
       s3.stop(`${newProjectRepo} already exists — added to managed repos`);
     } else {
       try {
         await createRepo(githubToken, githubOrg, newProjectRepo, isOrg, description || "");
         if (await waitForRepo(githubToken, githubOrg, newProjectRepo)) {
-          selectedRepos.push({ name: newProjectRepo });
+          selectedRepos.push({ name: newProjectRepo, base_branch: "main" });
           s3.stop(`Created ${newProjectRepo}`);
         } else {
           s3.fail(`${newProjectRepo} creation timed out`);
@@ -1181,6 +1180,7 @@ async function localFounderFlow(ui, ctx = {}) {
     memory_repo: `https://github.com/${githubOrg}/${memoryRepoName}.git`,
     slug: slug,
     repo_name: repoName,
+    base_branch: "main",
     repos: selectedRepos,
     upstream_url: "https://github.com/egregore-labs/egregore.git",
     report_url: "https://xgksfrirtdumacvmfkzj.supabase.co",
@@ -1241,18 +1241,6 @@ async function localFounderFlow(ui, ctx = {}) {
   ui.step(1, totalSteps, "Cloning egregore...");
   cloneRepo(forkUrl, egregoreDir, githubToken, ui, "egregore");
   setGitIdentity(egregoreDir, user);
-  ensureDevelop(egregoreDir);
-  // ensureDevelop only creates develop on the REMOTE (git branch, no checkout),
-  // so the clone is still on main. The egregore operates on develop, so switch
-  // to it now — otherwise local overlays (the codex runtime) get committed to
-  // main and are orphaned when session-start later checks out develop.
-  try {
-    execFileSync("git", ["-C", egregoreDir, "checkout", "develop"], { stdio: "pipe" });
-  } catch {
-    try {
-      execFileSync("git", ["-C", egregoreDir, "checkout", "-b", "develop", "origin/develop"], { stdio: "pipe" });
-    } catch {}
-  }
 
   ui.step(2, totalSteps, "Cloning shared memory...");
   cloneRepo(memoryUrl, memoryDir, githubToken, ui, "memory");
@@ -1356,10 +1344,6 @@ async function localFounderFlow(ui, ctx = {}) {
       const repoUrl = `https://github.com/${githubOrg}/${mrName}.git`;
       cloneRepo(repoUrl, repoDir, githubToken, ui, mrName);
       setGitIdentity(repoDir, user);
-      // New repos get develop branch (our workflow). Existing repos keep their default.
-      if (isNewProject) {
-        ensureDevelop(repoDir);
-      }
     } catch {
       ui.warn(`Could not clone ${mrName} — you may not have access.`);
     }

package/lib/setup.js

@@ -435,7 +435,6 @@ async function install(data, ui, targetDir, opts = {}) {
       }
     }
     try { run("git config credential.helper store", { cwd: egregoreDir }); } catch {}
-    ensureDevelop(egregoreDir);
     ui.success("Cloned egregore");
 
     // Set repo-local git identity from GitHub user (not machine-global config)
@@ -587,7 +586,6 @@ async function install(data, ui, targetDir, opts = {}) {
         }
       }
       try { run("git config credential.helper store", { cwd: repoDir }); } catch {}
-      ensureDevelop(repoDir);
       clonedRepos.push(repoName);
       ui.success(`Cloned ${repoName}`);
     } catch {
@@ -1023,7 +1021,7 @@ function codexSupportMessage(egregoreDir) {
     "  .codex/hooks.json",
     "  .codex/hooks/",
     "",
-    "Run npx -y create-egregore@latest to install the packaged Codex runtime, then rerun egregore.",
+    "Restore this instance using its installed runtime version, then rerun egregore.",
     "Egregore workflows appear as slash commands. In Codex, invoke them with the matching $skill token or ask in natural language.",
   ].join("\n");
 }
@@ -1037,7 +1035,7 @@ function piSupportMessage(egregoreDir) {
     "Pi meta-harness support is missing from this Egregore checkout.",
     `  path: ${egregoreDir}`,
     "",
-    "Run npx -y create-egregore@latest to install the packaged Pi runtime, then rerun egregore.",
+    "Restore this instance using its installed runtime version, then rerun egregore.",
     "Pi loads Egregore through project-local .pi resources and the shared portable skill corpus.",
   ].join("\n");
 }
@@ -1047,7 +1045,7 @@ function primeSupportMessage(egregoreDir) {
     "Prime Agent runtime support is missing from this Egregore checkout.",
     `  path: ${egregoreDir}`,
     "",
-    "Run npx -y create-egregore@latest to install the packaged Prime Agent runtime, then rerun egregore.",
+    "Restore this instance using its installed runtime version, then rerun egregore.",
     "Prime Agent loads Egregore through project-local .prime/agent resources and the shared portable skill corpus.",
   ].join("\n");
 }
@@ -1173,8 +1171,6 @@ async function launchOrInstruct(egregoreDir, alias, ui, ctx = {}) {
   console.log("");
 
   if (runtime === "codex") {
-    const codexRuntime = installCodexRuntime(egregoreDir);
-    reportCodexRuntimeSummary(codexRuntime, ui);
     if (!hasCodexCoreSupport(egregoreDir)) {
       ui.warn(codexSupportMessage(egregoreDir));
       ui.info(`Run ${ui.bold(aliasName)} after updating the checkout.`);
@@ -1190,8 +1186,6 @@ async function launchOrInstruct(egregoreDir, alias, ui, ctx = {}) {
       return;
     }
   } else if (runtime === "pi") {
-    const piRuntime = installPiRuntime(egregoreDir);
-    reportPiRuntimeSummary(piRuntime, ui);
     if (!hasPiRuntimeSupport(egregoreDir)) {
       ui.warn(piSupportMessage(egregoreDir));
       ui.info(`Run ${ui.bold(aliasName)} after updating the checkout.`);
@@ -1199,8 +1193,6 @@ async function launchOrInstruct(egregoreDir, alias, ui, ctx = {}) {
       return;
     }
   } else if (runtime === "prime") {
-    const primeRuntime = installPrimeRuntime(egregoreDir);
-    reportPrimeRuntimeSummary(primeRuntime, ui);
     if (!hasPrimeRuntimeSupport(egregoreDir)) {
       ui.warn(primeSupportMessage(egregoreDir));
       ui.info(`Run ${ui.bold(aliasName)} after updating the checkout.`);
@@ -1311,11 +1303,15 @@ function appendLocalBinToRc(ui) {
  */
 async function installLauncherBinary(egregoreDir, ui) {
   const template = readLauncherTemplate();
-  const candidates = [
-    { dir: "/usr/local/bin", location: "system" },
-    { dir: "/opt/homebrew/bin", location: "system" },
-    { dir: path.join(os.homedir(), ".local", "bin"), location: "user" },
-  ];
+  // An explicit destination must never fall through to machine-wide paths.
+  const configuredBinDir = process.env.EGREGORE_LAUNCHER_BIN_DIR;
+  const candidates = configuredBinDir
+    ? [{ dir: path.resolve(configuredBinDir), location: "user" }]
+    : [
+        { dir: "/usr/local/bin", location: "system" },
+        { dir: "/opt/homebrew/bin", location: "system" },
+        { dir: path.join(os.homedir(), ".local", "bin"), location: "user" },
+      ];
 
   let chosen = null;
   for (const c of candidates) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-egregore",
-  "version": "0.20.1",
+  "version": "0.20.3",
   "description": "Set up Egregore for your team in one command \u2014 installs the egregore launcher and your choice of Claude Code, Codex, or Pi.",
   "license": "MIT",
   "bin": {
@@ -13,7 +13,7 @@
     "build:runtime": "node ../../bin/capability-distribution.mjs generate-skill-view --root ../.. && node scripts/build-runtime-bundle.mjs && node scripts/build-pi-runtime-bundle.mjs && node scripts/build-prime-runtime-bundle.mjs && node ../../api/scripts/build-connect-runtime-pack.mjs",
     "build:pi-runtime": "node scripts/build-pi-runtime-bundle.mjs",
     "build:prime-runtime": "node scripts/build-prime-runtime-bundle.mjs",
-    "test": "node ../../bin/capability-distribution.mjs validate --root ../.. && node scripts/build-runtime-bundle.mjs --check && node scripts/build-pi-runtime-bundle.mjs --check && node scripts/build-prime-runtime-bundle.mjs --check && node ../../bin/prime-render-spec.mjs --check && node ../../bin/pi-render-spec.mjs --check && node ../../api/scripts/build-connect-runtime-pack.mjs --check && node --test test/capability-distribution.test.js test/connect-runtime.test.js test/context.test.js test/path-lookup.test.js test/nixos-portability.test.js test/parse-join-target.test.js test/skip-repos.test.js test/install-origin-guard.test.js test/onboarding-shortcircuit.test.js test/welcome-screen.test.js test/runtime-selection.test.js test/command-generation.test.js test/auth-gh.test.js test/gauntlet-fixes.test.js test/codex-runtime.test.js test/pi-runtime.test.js test/prime-runtime.test.js test/prime-branch-policy.test.js test/prime-bridge-skill.test.js test/prime-session-smoke.test.js test/pi-product-workflows.test.js test/installer-runtime-source.test.js test/scroll-repro.test.js test/launcher-refocus-redraw.test.js test/multiselect-remote-search.test.js test/back-navigation.test.js test/manifest-form.test.js test/launcher-delete.test.js test/launcher-connect.test.js test/installer-connect-choice.test.js test/launcher-connected-status.test.js test/launcher-permissions.test.js test/launcher-update.test.js test/connected-config.test.js",
+    "test": "node ../../bin/capability-distribution.mjs validate --root ../.. && node scripts/build-runtime-bundle.mjs --check && node scripts/build-pi-runtime-bundle.mjs --check && node scripts/build-prime-runtime-bundle.mjs --check && node ../../bin/prime-render-spec.mjs --check && node ../../bin/pi-render-spec.mjs --check && node ../../api/scripts/build-connect-runtime-pack.mjs --check && node --test test/capability-distribution.test.js test/connect-runtime.test.js test/context.test.js test/path-lookup.test.js test/nixos-portability.test.js test/parse-join-target.test.js test/skip-repos.test.js test/install-origin-guard.test.js test/onboarding-shortcircuit.test.js test/welcome-screen.test.js test/runtime-selection.test.js test/command-generation.test.js test/auth-gh.test.js test/gauntlet-fixes.test.js test/codex-runtime.test.js test/pi-runtime.test.js test/prime-runtime.test.js test/prime-branch-policy.test.js test/prime-bridge-skill.test.js test/prime-session-smoke.test.js test/pi-product-workflows.test.js test/installer-runtime-source.test.js test/scroll-repro.test.js test/launcher-refocus-redraw.test.js test/multiselect-remote-search.test.js test/back-navigation.test.js test/manifest-form.test.js test/launcher-delete.test.js test/launcher-connect.test.js test/installer-connect-choice.test.js test/launcher-connected-status.test.js test/launcher-permissions.test.js test/launcher-update.test.js test/connected-config.test.js test/workflow-settings.test.js",
     "test:e2e": "node --test test/e2e-local.test.js",
     "test:all": "node scripts/build-runtime-bundle.mjs --check && node scripts/build-pi-runtime-bundle.mjs --check && node --test test/"
   },

package/runtime/codex/.codex/spec-manifest.json

@@ -11,7 +11,7 @@
     {
       "section": "Identity & Upstream",
       "action": "keep",
-      "sourceHash": "ddcbc0083aff",
+      "sourceHash": "86a2c62ce498",
       "note": "Kept; /update, /contribute, /save tokens rendered as $skill tokens."
     },
     {
@@ -35,7 +35,7 @@
     {
       "section": "After Greeting — BRANCH ON FIRST RESPONSE",
       "action": "replace",
-      "sourceHash": "b13b81aea8f3",
+      "sourceHash": "3bac01c0a00a",
       "note": "EnterWorktree -> bin/agent.sh branch with git checkout fallback; AskUserQuestion -> numbered options in plain text; branch-guard mapped to .codex/hooks/branch-guard.js with instruction fallback; plan-mode note dropped (no plan mode on Codex); /branch + /onboarding -> skill tokens. Handoff claiming and repoState auto-checkout bash kept verbatim (pure git); surrounding prose compressed 2026-08 for the 32 KiB budget, every rule retained."
     },
     {
@@ -89,7 +89,7 @@
     {
       "section": "Git Workflow",
       "action": "keep",
-      "sourceHash": "23df84b5fe80",
+      "sourceHash": "40735c0c09ff",
       "note": "Kept; slash tokens rendered as $skill tokens. Branch diagram unchanged (code fence)."
     },
     {

package/runtime/codex/AGENTS.md

@@ -92,11 +92,20 @@ This block is the Codex-native Egregore behavioral spec, rendered from CLAUDE.md
 
 ## Identity & Upstream
 
-This is an Egregore instance — a downstream fork of the upstream framework at `egregore-labs/egregore`. The framework (`bin/`, `.claude/skills/`, `.claude/hooks/`, `.claude/context/`, `.claude/agents/`, `.pi/`, `loom/`, `CLAUDE.md`, `skills/`) is synced from upstream on every session start and via `$update`. It is not authored in this repo.
+Framework direction comes only from `egregore.json.upstream_url`:
+
+- **Source** — literal `"none"`: framework changes are authored here.
+  `$update` and `$contribute` stop; use `$save`. Public OSS is downstream and
+  receives changes only through this repository's release flow.
+- **Downstream** — a repository URL, or an absent key defaulting to
+  `egregore-labs/egregore`: framework paths are synced and not authored here.
+
+Never infer direction from a repository name or Git remote.
 
 **Where changes belong:**
-- **Framework is outdated or a skill is missing:** run `$update` first. It pulls the latest from upstream.
-- **Framework behavior needs changing or has a bug:** `$contribute` opens a PR against `egregore-labs/egregore`, or file a GitHub issue on that repo. Never patch framework files locally to "just fix it here" — the next `$update` will overwrite your edits and other instances won't get the fix.
+- **Downstream framework is stale:** run `$update`.
+- **Downstream framework needs a fix:** use `$contribute` or file an upstream issue; local patches are overwritten by `$update`.
+- **Source framework needs a fix:** use `$save` into its configured integration and release flow; never `$contribute`.
 - **Org-level work** (memory, org-specific knowledge, managed repos, `egregore.json`): `$save` to this repo.
 
 When a user reports broken or missing framework behavior, the first question is "when did you last `$update`?"
@@ -139,7 +148,7 @@ The integration branch is `develop` unless top-level `egregore.json.base_branch`
 
 **Fallback:** If `bin/agent.sh branch` fails, resolve `{base}` with
 `_get_base_branch`, then use
-`git checkout -b dev/{author}/{slug} origin/{base}`.
+`git checkout --no-track -b dev/{author}/{slug} origin/{base}`.
 
 4. Update graph (fire-and-forget): `bash bin/graph-op.sh set-topic "$(cat .egregore-session-id 2>/dev/null)" "topic from slug" "dev/author/slug" 2>/dev/null &`
 
@@ -205,9 +214,11 @@ The `.codex/hooks/branch-guard.js` PreToolUse hook (launcher `--enable hooks`) p
   Wait for the reply, then branch.
 - **The user explicitly requested the protected branch** → that request is consent. Record it with `echo '{branch}' > .egregore-branch-consent`, then retry. Never create the marker merely to silence the hook.
 
-Memory, managed-repo, and runtime-state writes bypass the project guard — if one triggers it, correct the target/context instead of asking for consent.
+If this Codex build does not support hooks, keep the same rule.
 
-If this Codex build does not support hooks, follow the same discipline as a standing instruction: never write or commit on the configured base, develop, main, or master.
+**History:** Do not merge, cherry-pick, or rebase another task merely to read
+it; use `gh pr view/diff`, `git show`, or a temporary worktree. Integrate
+only for dependencies. Deletion needs no rewrite unless purging secrets.
 
 ### Onboarding exception
 
@@ -355,11 +366,14 @@ branch; `base_branch: "main"` is single-branch mode. Users never interact with
 git directly.
 
 ```
-main ← stable (/release)
-  develop ← integration (PRs land here)
-    dev/{author}/{topic-slug} | feature/{slug} | bugfix/{slug}
+main ← selected `/release` candidates
+develop ← CL integration (available internally)
+  dev/{author}/{topic-slug} | feature/{slug} | bugfix/{slug}
 ```
 
+- **Develop is not release**: merged PRs stay inside CL.
+- **`$release` is selective**: the Release Desk queues exact PR SHAs into a candidate from main. Never merge all of develop.
+- **OSS is separate**: `$sync-public` reviews delivery after private main.
 - **On launch**: syncs the configured base branch + memory. Does NOT create a branch.
 - **Branch creation**: MANDATORY on first work-related message (see above).
 - **Resuming**: rebase onto the configured base branch and continue.

package/runtime/codex/bin/agent.sh

@@ -187,6 +187,15 @@ base_ref() {
   fi
 }
 
+clear_base_upstream() {
+  local repo="$1" branch="$2" base="$3" upstream=""
+  case "$branch" in dev/*|feature/*|bugfix/*) ;; *) return 0 ;; esac
+  upstream="$(git -C "$repo" rev-parse --abbrev-ref "${branch}@{upstream}" 2>/dev/null || true)"
+  if [ "$upstream" = "$base" ]; then
+    git -C "$repo" branch --unset-upstream "$branch" >/dev/null 2>&1 || true
+  fi
+}
+
 cmd_protocol() {
   cat <<'EOF'
 Egregore portable agent protocol
@@ -306,8 +315,9 @@ cmd_branch() {
     if git -C "$SCRIPT_DIR" show-ref --verify --quiet "refs/heads/$branch" 2>/dev/null; then
       git -C "$SCRIPT_DIR" checkout "$branch" --quiet
     else
-      git -C "$SCRIPT_DIR" checkout -b "$branch" "$base" --quiet
+      git -C "$SCRIPT_DIR" checkout --no-track -b "$branch" "$base" --quiet
     fi
+    clear_base_upstream "$SCRIPT_DIR" "$branch" "$base"
     egregore_link_shared_state "$SCRIPT_DIR" "$MAIN_PROJECT_DIR" >/dev/null 2>/dev/null || true
     echo "branch: $branch"
     echo "worktree: $SCRIPT_DIR"
@@ -323,8 +333,9 @@ cmd_branch() {
   fi
 
   if ! git -C "$MAIN_PROJECT_DIR" show-ref --verify --quiet "refs/heads/$branch" 2>/dev/null; then
-    git -C "$MAIN_PROJECT_DIR" branch "$branch" "$base" >/dev/null 2>&1 || die "failed to create branch $branch"
+    git -C "$MAIN_PROJECT_DIR" branch --no-track "$branch" "$base" >/dev/null 2>&1 || die "failed to create branch $branch"
   fi
+  clear_base_upstream "$MAIN_PROJECT_DIR" "$branch" "$base"
 
   wt_path="$MAIN_PROJECT_DIR/.claude/worktrees/$slug"
   if [ -e "$wt_path" ]; then
@@ -356,8 +367,9 @@ ensure_working_branch() {
   if git -C "$SCRIPT_DIR" show-ref --verify --quiet "refs/heads/$branch" 2>/dev/null; then
     git -C "$SCRIPT_DIR" checkout "$branch" --quiet || die "failed to checkout $branch"
   else
-    git -C "$SCRIPT_DIR" checkout -b "$branch" "$base" --quiet || die "failed to create $branch"
+    git -C "$SCRIPT_DIR" checkout --no-track -b "$branch" "$base" --quiet || die "failed to create $branch"
   fi
+  clear_base_upstream "$SCRIPT_DIR" "$branch" "$base"
   echo "$branch"
 }