create-egregore 0.20.1 → 0.20.3

package/runtime/prime/bin/attendant.sh

@@ -1,19 +1,16 @@
 #!/usr/bin/env bash
-# The attendant — Egregore's ambient listener. A per-instance daemon that
-# watches for work Claude Code sessions leave behind when they die without
-# ceremony (terminal closed, laptop shut) and captures it:
+# The attendant — Egregore's per-instance background daemon. It pre-pays the
+# launch path and keeps projections fresh. It never writes on a user's behalf:
 #
-#   ripcord    dead session + no handoff → deterministic auto-handoff to
-#              memory/handoffs/ (kind: ripcord), assembled from the session
-#              transcript + git state. No model, no API calls.
-#   auto-push  dirty/unpushed dev|feature|bugfix branches in this repo's
-#              worktrees, once no session is active → commit + push the
-#              branch. Never merges, never touches develop/main.
+#   warm       fetch refs, replay the graph cache, bake the context seed every
+#              few minutes so session start finds everything hot.
+#   lifecycle  run the handoff lifecycle job (Connected) on its own cadence.
+#   weaver     trigger the Thread projection once no session is active.
 #
-# In-harness hooks (SessionEnd, PreCompact) die with the process; the
-# attendant lives outside it. The signal is Claude Code's own transcript
-# files (~/.claude/projects/<key>/*.jsonl), written continuously regardless
-# of how a session ends: transcript gone stale + work on disk = pull the cord.
+# Ambient capture — ripcord notes and branch auto-push — was removed on
+# 2026-09-03: a session that ends without /handoff or /wrap leaves nothing
+# behind. Claude Code's transcript files (~/.claude/projects/<key>/*.jsonl)
+# are read only to tell whether a session is still active.
 #
 # Usage:
 #   bash bin/attendant.sh ensure   # spawn daemon if not running (fire-and-forget from session-start)
@@ -23,7 +20,7 @@
 #   bash bin/attendant.sh stop     # kill the daemon
 #
 # Env overrides (mainly for tests):
-#   ATTENDANT_STALE_MIN   minutes of transcript silence = dead session (default 12)
+#   ATTENDANT_STALE_MIN   minutes of transcript silence = no active session (default 12)
 #   ATTENDANT_DRY_RUN=1   log actions, mutate nothing
 #   ATTENDANT_HOME        state dir (default ~/.egregore/attendant)
 #   CLAUDE_PROJECTS_DIR   transcript root (default ~/.claude/projects)
@@ -41,8 +38,6 @@ fi
 CONFIG="$MAIN_DIR/egregore.json"
 MEMORY_DIR="${EGREGORE_MEMORY_DIR:-$MAIN_DIR/memory}"
 STALE_MIN="${ATTENDANT_STALE_MIN:-12}"
-MAX_AGE_MIN=1440                 # ignore transcripts older than 24h
-RIPCORD_MIN_BYTES=20000          # skip trivial sessions
 DRY_RUN="${ATTENDANT_DRY_RUN:-0}"
 CLAUDE_PROJECTS="${CLAUDE_PROJECTS_DIR:-$HOME/.claude/projects}"
 
@@ -52,7 +47,6 @@ STATE_DIR="${ATTENDANT_HOME:-$HOME/.egregore/attendant}"
 PIDFILE="$STATE_DIR/$KEY.pid"
 VERSIONFILE="$STATE_DIR/$KEY.version"
 LOGFILE="$STATE_DIR/$KEY.log"
-JOURNAL="$STATE_DIR/$KEY.journal"
 mkdir -p "$STATE_DIR"
 
 # Munged project key, same rule Claude Code uses for ~/.claude/projects dirs.
@@ -86,9 +80,8 @@ _trigger_auto_thread() {
   [ -f "$runner" ] || return 0
   [ "$DRY_RUN" = "1" ] && dry_arg="--dry-run"
 
-  # Projection is downstream of capture. Run it detached so a slow or broken
-  # renderer can never delay ripcord persistence or branch auto-save. The
-  # runner's atomic lock coalesces ripcord + end-of-sweep triggers.
+  # Run the projection detached so a slow or broken renderer can never delay
+  # the sweep. The runner's atomic lock coalesces overlapping triggers.
   (
     if ! bash "$runner" \
       --repo-dir "$MAIN_DIR" \
@@ -99,23 +92,6 @@ _trigger_auto_thread() {
   ) >> "$LOGFILE" 2>&1 &
 }
 
-# Personal off switch for ambient capture. ripcord_enabled=false disables BOTH
-# ripcord notes and auto-push of dirty worktrees — a user who opts out of
-# ambient capture must not find silent commits either. The attendant's other
-# duties (graph cache, context seed, handoff lifecycle) are unaffected.
-# NOTE: jq's `//` treats false as empty (the auto_update:false gotcha), so the
-# test compares the raw value, never `.key // true`.
-_capture_enabled() {
-  [ "$(jq -r '.ripcord_enabled' "$MAIN_DIR/.egregore-state.json" 2>/dev/null)" != "false" ]
-}
-
-_author() {
-  local a
-  a=$(jq -r '.github_username // empty' "$MAIN_DIR/.egregore-state.json" 2>/dev/null)
-  [ -z "$a" ] && a=$(git -C "$MAIN_DIR" config user.name 2>/dev/null | tr ' ' '-' | tr '[:upper:]' '[:lower:]')
-  echo "${a:-unknown}"
-}
-
 # --- Session liveness ------------------------------------------------------
 
 _transcript_dirs() {
@@ -132,264 +108,6 @@ _active_session() {
   return 1
 }
 
-_stale_transcripts() {
-  local d
-  for d in $(_transcript_dirs); do
-    find "$d" -maxdepth 1 -name '*.jsonl' -mmin "+$STALE_MIN" -mmin "-$MAX_AGE_MIN" -size "+${RIPCORD_MIN_BYTES}c" 2>/dev/null
-  done
-}
-
-# --- Ripcord ---------------------------------------------------------------
-
-_last_prompts() {
-  # Last few human prompts from a transcript, cleaned of harness noise.
-  jq -r 'select(.type=="user") | .message.content
-         | if type=="string" then .
-           else ([.[]? | select(.type?=="text") | .text] | join(" ")) end' "$1" 2>/dev/null \
-    | grep -v -e '^\s*$' -e 'system-reminder' -e '<command-' -e 'tool_use_error' -e '^Caveat:' -e '<task-notification' \
-              -e '<local-command-caveat' -e '</local-command-caveat>' -e '<bash-input>' -e '<bash-stdout>' -e '<bash-stderr>' \
-    | tail -5 | cut -c1-300
-}
-
-_slugify() {
-  printf '%s' "$1" \
-    | tr '[:upper:]' '[:lower:]' \
-    | sed 's/<[^>]*>/ /g; s/[`*_#|:;,.!?()[\]{}"'"'"']/ /g; s/[^a-z0-9]/-/g; s/--*/-/g; s/^-//; s/-$//' \
-    | cut -c1-72 \
-    | sed 's/-$//'
-}
-
-_prompt_topic_slug() {
-  local prompts="$1"
-  local line clean lower slug score best_score=0 best_slug=""
-
-  while IFS= read -r line; do
-    [ -z "$line" ] && continue
-    lower=$(printf '%s' "$line" | tr '[:upper:]' '[:lower:]')
-    case "$lower" in
-      start|*request\ interrupted*|*system-reminder*|*local-command-caveat*|*bash-input*|*bash-stdout*|*bash-stderr*|*tool_use_error*)
-        continue
-        ;;
-    esac
-
-    clean=$(printf '%s' "$line" | sed 's/^>[[:space:]]*//; s/<[^>]*>/ /g; s/[|`*_#]/ /g')
-    slug=$(_slugify "$clean")
-    [ -z "$slug" ] && continue
-    [ "${#slug}" -lt 8 ] && continue
-
-    score=${#slug}
-    case "$slug" in
-      *handoff*|*emissary*|*harvest*|*ssh*|*pr*|*review*|*egregore*|*invite*|*deploy*|*release*)
-        score=$((score + 20))
-        ;;
-    esac
-
-    if [ "$score" -gt "$best_score" ]; then
-      best_score="$score"
-      best_slug="$slug"
-    fi
-  done <<EOF
-$prompts
-EOF
-
-  printf '%s\n' "$best_slug"
-}
-
-_branch_topic_slug() {
-  local gitsum="$1"
-  local author="$2"
-  local branch rest score best_score=0 best_slug=""
-
-  while IFS= read -r branch; do
-    [ -z "$branch" ] && continue
-    case "$branch" in
-      develop|main|master) continue ;;
-      dev/"$author"/*) rest="${branch#dev/$author/}"; score=90 ;;
-      feature/*|bugfix/*|hotfix/*) rest="${branch#*/}"; score=80 ;;
-      dev/*/*) rest="${branch#dev/}"; rest="${rest#*/}"; score=60 ;;
-      */*) rest="${branch#*/}"; score=50 ;;
-      *) rest="$branch"; score=40 ;;
-    esac
-
-    rest=$(_slugify "$rest")
-    [ -z "$rest" ] && continue
-    if [ "$score" -gt "$best_score" ]; then
-      best_score="$score"
-      best_slug="$rest"
-    fi
-  done <<EOF
-$(printf '%s\n' "$gitsum" | awk -F'`' '/^- `/{print $2}')
-EOF
-
-  printf '%s\n' "$best_slug"
-}
-
-_ripcord_topic_slug() {
-  local prompts="$1"
-  local gitsum="$2"
-  local author="$3"
-  local slug
-
-  slug=$(_prompt_topic_slug "$prompts")
-  [ -z "$slug" ] && slug=$(_branch_topic_slug "$gitsum" "$author")
-  [ -z "$slug" ] && slug="session"
-  printf '%s\n' "$slug"
-}
-
-_topic_from_slug() {
-  printf '%s\n' "$1" | tr '-' ' '
-}
-
-_git_summary() {
-  # Branch + dirty/unpushed state for the main checkout and every worktree.
-  local wt branch dirty ahead
-  git -C "$MAIN_DIR" worktree list --porcelain 2>/dev/null | awk '/^worktree /{print $2}' | while read -r wt; do
-    branch=$(git -C "$wt" branch --show-current 2>/dev/null)
-    [ -z "$branch" ] && continue
-    dirty=$(git -C "$wt" status --porcelain 2>/dev/null | wc -l | tr -d ' ')
-    ahead=$(git -C "$wt" rev-list --count '@{u}..HEAD' 2>/dev/null || echo "?")
-    if [ "$dirty" != "0" ] || { [ "$ahead" != "0" ] && [ "$ahead" != "?" ]; }; then
-      echo "- \`$branch\` — $dirty uncommitted, $ahead unpushed ($(basename "$wt"))"
-      git -C "$wt" status --porcelain 2>/dev/null | head -8 | sed 's/^/    /'
-    fi
-  done
-}
-
-_ripcord() {
-  local transcript="$1" base author date_ym date_d slug topic file prompts gitsum
-  base=$(basename "$transcript" .jsonl)
-
-  _capture_enabled || return 0
-
-  grep -q "$base" "$JOURNAL" 2>/dev/null && return 0
-  # Session already ended with ceremony? Then the attendant has no business
-  # here. Scan only the tail — a session that merely *read* the /handoff or
-  # /save skill text mid-way would otherwise false-positive.
-  if tail -c 300000 "$transcript" 2>/dev/null | grep -q -e 'handoff-run.sh' -e 'wraps/'; then
-    echo "ripcord-skip $base (explicit handoff/wrap)" >> "$JOURNAL"
-    return 0
-  fi
-
-  author=$(_author)
-  prompts=$(_last_prompts "$transcript")
-  gitsum=$(_git_summary)
-
-  # Nothing on disk and nothing said — not worth a handoff.
-  if [ -z "$gitsum" ] && [ -z "$prompts" ]; then
-    echo "ripcord-skip $base (no work found)" >> "$JOURNAL"
-    return 0
-  fi
-
-  slug=$(_ripcord_topic_slug "$prompts" "$gitsum" "$author")
-  topic=$(_topic_from_slug "$slug")
-
-  date_ym=$(date '+%Y-%m'); date_d=$(date '+%d')
-  file="$MEMORY_DIR/handoffs/$date_ym/${date_d}-${author}-ripcord-${slug}.md"
-
-  if [ "$DRY_RUN" = "1" ]; then
-    log "DRY ripcord → $file"
-    _trigger_auto_thread "ripcord"
-    return 0
-  fi
-
-  mkdir -p "$(dirname "$file")"
-  {
-    echo "---"
-    echo "date: $(date '+%Y-%m-%d')"
-    echo "author: $author"
-    echo "to: $author"
-    echo "kind: ripcord"
-    echo "status: draft"
-    echo "topic: $topic"
-    echo "---"
-    echo ""
-    echo "# Ripcord: $topic"
-    echo ""
-    echo "Automatic capture — this session ended without an explicit handoff."
-    echo "Assembled by the attendant from the flight recorder (transcript + git state)."
-    echo ""
-    if [ -n "$gitsum" ]; then
-      echo "## Where the work lives"
-      echo ""
-      echo "$gitsum"
-      echo ""
-    fi
-    if [ -n "$prompts" ]; then
-      echo "## Last things the user asked for"
-      echo ""
-      echo "$prompts" | sed 's/^/> /'
-      echo ""
-    fi
-    echo "## Pick it up"
-    echo ""
-    echo "Check out the branch above and run \`/activity\` for surrounding context."
-    echo "Session transcript id: \`$base\` ($(date -r "$transcript" '+%Y-%m-%d %H:%M' 2>/dev/null))"
-  } > "$file"
-
-  # Commit + push memory (retry for concurrent pushers; tolerate no remote).
-  local rel="${file#"$MEMORY_DIR"/}"
-  git -C "$MEMORY_DIR" add "$rel" 2>/dev/null
-  git -C "$MEMORY_DIR" commit -q -m "Ripcord: auto-handoff for $author ($slug)" 2>/dev/null
-  if git -C "$MEMORY_DIR" remote get-url origin >/dev/null 2>&1; then
-    local i
-    for i in 1 2 3; do
-      git -C "$MEMORY_DIR" pull --rebase origin main --quiet 2>/dev/null && \
-        git -C "$MEMORY_DIR" push origin main --quiet 2>/dev/null && break
-      sleep 2
-    done
-  fi
-  bash "$MAIN_DIR/bin/index-handoff.sh" "$rel" >/dev/null 2>&1 || true
-
-  echo "ripcord $base $rel" >> "$JOURNAL"
-  log "ripcord → memory/$rel"
-  _trigger_auto_thread "ripcord"
-}
-
-# --- Auto-push -------------------------------------------------------------
-
-_auto_push() {
-  _capture_enabled || return 0
-  local wt branch dirty ahead upstream
-  git -C "$MAIN_DIR" worktree list --porcelain 2>/dev/null | awk '/^worktree /{print $2}' | while read -r wt; do
-    branch=$(git -C "$wt" branch --show-current 2>/dev/null)
-    case "$branch" in dev/*|feature/*|bugfix/*) ;; *) continue ;; esac
-    # Mid-rebase/merge — never touch.
-    local gd; gd=$(git -C "$wt" rev-parse --git-dir 2>/dev/null)
-    { [ -d "$gd/rebase-merge" ] || [ -d "$gd/rebase-apply" ] || [ -f "$gd/MERGE_HEAD" ]; } && continue
-
-    dirty=$(git -C "$wt" status --porcelain 2>/dev/null | wc -l | tr -d ' ')
-    # Only act on work that has itself gone quiet (nothing modified recently).
-    if [ "$dirty" != "0" ]; then
-      local fresh
-      fresh=$(git -C "$wt" status --porcelain 2>/dev/null | sed 's/^...//' | head -50 | while read -r f; do
-        find "$wt/$f" -mmin "-$STALE_MIN" 2>/dev/null | head -1
-      done | head -1)
-      [ -n "$fresh" ] && continue
-      if [ "$DRY_RUN" = "1" ]; then log "DRY auto-commit $branch ($dirty files, $wt)"; else
-        git -C "$wt" add -A 2>/dev/null
-        git -C "$wt" commit -q -m "chore(attendant): ripcord auto-save
-
-Uncommitted work captured after the session went quiet.
-
-Co-Authored-By: Egregore Attendant <noreply@egregore.xyz>" 2>/dev/null
-        log "auto-commit $branch ($dirty files)"
-      fi
-    fi
-
-    upstream=$(git -C "$wt" rev-parse --abbrev-ref '@{u}' 2>/dev/null || true)
-    if [ -z "$upstream" ]; then
-      ahead=$(git -C "$wt" rev-list --count origin/develop..HEAD 2>/dev/null || echo 0)
-    else
-      ahead=$(git -C "$wt" rev-list --count '@{u}..HEAD' 2>/dev/null || echo 0)
-    fi
-    if [ "${ahead:-0}" != "0" ]; then
-      if [ "$DRY_RUN" = "1" ]; then log "DRY auto-push $branch ($ahead commits)"; else
-        git -C "$wt" push -u origin "$branch" --quiet 2>/dev/null && log "auto-push $branch ($ahead commits)"
-      fi
-    fi
-  done
-}
-
 # --- Warm: pre-pay the launch path -------------------------------------------
 # Session-start's cost is network: git fetches + the greeting's graph queries.
 # The attendant pays them in the background every WARM_MIN minutes so launch
@@ -594,11 +312,6 @@ cmd_sweep() {
     log "sweep: session active — standing by"
     return 0
   fi
-  local t
-  for t in $(_stale_transcripts); do
-    _ripcord "$t"
-  done
-  _auto_push
   _trigger_auto_thread "sweep"
 }
 
@@ -632,7 +345,7 @@ cmd_ensure() {
   fi
   # Atomic spawn gate: the pidfile check above is check-then-spawn, so two
   # concurrent cold starts could both reach here and launch two daemons that
-  # overlap for a full cycle (lifecycle jobs, ripcord, auto-push). mkdir is
+  # overlap for a full cycle (lifecycle jobs, warm, projection). mkdir is
   # the portable atomic primitive; a crashed spawner's stale lock breaks
   # after 5 minutes. Losing the race means someone else is spawning — done.
   local _spawn_lock="$STATE_DIR/$KEY.spawn-lock"

package/runtime/prime/bin/autosave.sh

@@ -28,17 +28,6 @@ set -uo pipefail
 SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
 STATE_FILE="$SCRIPT_DIR/.egregore-state.json"
 
-# The attendant runs against the MAIN checkout and reads its state file, so
-# ambient-capture settings must be written there — a worktree keeps its own
-# copy, and writing the flag into it would silently do nothing.
-MAIN_STATE_DIR="$SCRIPT_DIR"
-if [ -f "$SCRIPT_DIR/.git" ]; then
-  _WT_GITDIR=$(sed 's/^gitdir: //' "$SCRIPT_DIR/.git" 2>/dev/null || true)
-  [ -n "$_WT_GITDIR" ] && MAIN_STATE_DIR=$(cd "$_WT_GITDIR/../../.." 2>/dev/null && pwd || echo "$SCRIPT_DIR")
-fi
-MAIN_STATE_FILE="$MAIN_STATE_DIR/.egregore-state.json"
-[ -f "$MAIN_STATE_FILE" ] || MAIN_STATE_FILE="$STATE_FILE"
-
 [ -f "$STATE_FILE" ] || echo '{}' > "$STATE_FILE"
 
 # NB: jq's `//` swallows false — status would show "on" for enabled:false.
@@ -53,11 +42,6 @@ set_key() { # key value(json-encoded)
   jq ".$1 = $2" "$STATE_FILE" > "$STATE_FILE.tmp" && mv "$STATE_FILE.tmp" "$STATE_FILE"
 }
 
-_set_main() { # key value(json-encoded) — writes where the attendant reads
-  jq ".$1 = $2" "$MAIN_STATE_FILE" > "$MAIN_STATE_FILE.tmp" \
-    && mv "$MAIN_STATE_FILE.tmp" "$MAIN_STATE_FILE"
-}
-
 status() {
   local enabled scope publish
   enabled=$(get '.autosave_enabled' 'false')
@@ -66,7 +50,6 @@ status() {
   echo "autosave: $([ "$enabled" = "true" ] && echo on || echo "off (opt-in — 'autosave on' to join the experiment)")"
   echo "scope:    $scope  (all = handoffs + artifacts + docs · handoffs = memory repo only)"
   echo "publish:  $publish  (gate = PRs wait for your merge · auto = merge to develop automatically)"
-  echo "ripcord:  $(jq -r 'if (.ripcord_enabled != null) then (.ripcord_enabled|tostring) else "true" end' "$MAIN_STATE_FILE" 2>/dev/null || echo true)  (crash-recovery notes + branch auto-push when a session dies without /wrap)"
 }
 
 case "${1:-status}" in
@@ -78,15 +61,6 @@ case "${1:-status}" in
       all|handoffs) set_key autosave_scope "\"$2\"" && echo "scope: $2" ;;
       *) echo "usage: autosave.sh scope all|handoffs" >&2; exit 2 ;;
     esac ;;
-  ripcord)
-    # Ambient crash-recovery capture (the attendant): ripcord notes AND
-    # auto-push of dirty task branches. Separate from the autosave
-    # experiment above — this one defaults ON.
-    case "${2:-}" in
-      on)  _set_main ripcord_enabled true  && echo "ripcord: on — dead sessions leave a recovery note" ;;
-      off) _set_main ripcord_enabled false && echo "ripcord: off — no ambient notes, no branch auto-push" ;;
-      *) echo "usage: autosave.sh ripcord on|off" >&2; exit 2 ;;
-    esac ;;
   publish)
     case "${2:-}" in
       gate|auto) set_key autosave_publish "\"$2\"" && echo "publish: $2" ;;
@@ -108,5 +82,5 @@ case "${1:-status}" in
         echo "✗ PR #$n did not merge (conflict with develop?) — it stays open"
       fi
     done ;;
-  *) echo "usage: autosave.sh [status|on|off|scope all|handoffs|publish gate|auto|merge|ripcord on|off]" >&2; exit 2 ;;
+  *) echo "usage: autosave.sh [status|on|off|scope all|handoffs|publish gate|auto|merge]" >&2; exit 2 ;;
 esac

package/runtime/prime/bin/codex-render-spec.mjs

@@ -193,7 +193,7 @@ The integration branch is \`develop\` unless top-level \`egregore.json.base_bran
 
 **Fallback:** If \`bin/agent.sh branch\` fails, resolve \`{base}\` with
 \`_get_base_branch\`, then use
-\`git checkout -b dev/{author}/{slug} origin/{base}\`.
+\`git checkout --no-track -b dev/{author}/{slug} origin/{base}\`.
 
 4. Update graph (fire-and-forget): \`bash bin/graph-op.sh set-topic "$(cat .egregore-session-id 2>/dev/null)" "topic from slug" "dev/author/slug" 2>/dev/null &\`
 
@@ -259,9 +259,11 @@ The \`.codex/hooks/branch-guard.js\` PreToolUse hook (launcher \`--enable hooks\
   Wait for the reply, then branch.
 - **The user explicitly requested the protected branch** → that request is consent. Record it with \`echo '{branch}' > .egregore-branch-consent\`, then retry. Never create the marker merely to silence the hook.
 
-Memory, managed-repo, and runtime-state writes bypass the project guard — if one triggers it, correct the target/context instead of asking for consent.
+If this Codex build does not support hooks, keep the same rule.
 
-If this Codex build does not support hooks, follow the same discipline as a standing instruction: never write or commit on the configured base, develop, main, or master.
+**History:** Do not merge, cherry-pick, or rebase another task merely to read
+it; use \`gh pr view/diff\`, \`git show\`, or a temporary worktree. Integrate
+only for dependencies. Deletion needs no rewrite unless purging secrets.
 
 ### Onboarding exception
 

package/runtime/prime/bin/codex-session-start.sh

@@ -71,9 +71,9 @@ source "$SCRIPT_DIR/bin/lib/git-sync.sh" >/dev/null 2>/dev/null
 # Warm-state parity with the Claude SessionStart path: hand context.sh the
 # pre-baked snapshot and route greeting reads through the warm graph cache.
 # The attendant daemon is deliberately NOT started from the Codex/Pi path —
-# its dead-session detection reads Claude transcripts only, so a live Codex
-# or Pi session with 12 quiet minutes would look dead and could have its
-# unfinished work ripcorded/auto-pushed. Codex sessions still benefit from
+# its session-liveness check reads Claude transcripts only, so a live Codex
+# or Pi session with 12 quiet minutes would look idle and its sweep would
+# run mid-work. Codex sessions still benefit from
 # any snapshot a Claude session's attendant maintains; runtime-neutral
 # liveness tracking is the prerequisite for starting the daemon here.
 if [ -n "${_ATT_KEY:-}" ]; then

package/runtime/prime/bin/contribute-guard.sh

@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+set -u
+
+SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+CONFIG="$SCRIPT_DIR/egregore.json"
+EXPECTED_REPO=""
+
+usage() {
+  echo "usage: bash bin/contribute-guard.sh [--config <path>] [--expect <owner/repo>]" >&2
+  exit 2
+}
+
+fail() {
+  echo "contribute: $1" >&2
+  exit "${2:-2}"
+}
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --config)
+      [ $# -ge 2 ] || usage
+      CONFIG="$2"
+      shift 2
+      ;;
+    --expect)
+      [ $# -ge 2 ] || usage
+      EXPECTED_REPO="$2"
+      shift 2
+      ;;
+    --help|-h)
+      usage
+      ;;
+    *)
+      usage
+      ;;
+  esac
+done
+
+[ -f "$CONFIG" ] || fail "cannot read configuration at $CONFIG; refusing to select an upstream target"
+
+UPSTREAM_URL=$(jq -er '
+  if has("upstream_url") then
+    if .upstream_url == null then ""
+    elif (.upstream_url | type) == "string" then .upstream_url
+    else error("upstream_url must be a string")
+    end
+  else ""
+  end
+' "$CONFIG" 2>/dev/null) ||
+  fail "configuration is invalid; refusing to select an upstream target"
+
+if [ "$UPSTREAM_URL" = "none" ]; then
+  fail 'disabled because upstream_url is "none"; this checkout is a framework source, so use the save workflow for its configured integration branch' 3
+fi
+
+[ -n "$UPSTREAM_URL" ] || UPSTREAM_URL="https://github.com/egregore-labs/egregore.git"
+
+case "$UPSTREAM_URL" in
+  https://github.com/*/*)
+    UPSTREAM_REPO="${UPSTREAM_URL#*github.com/}"
+    ;;
+  git@github.com:*/*)
+    UPSTREAM_REPO="${UPSTREAM_URL#git@github.com:}"
+    ;;
+  *)
+    fail "unsupported upstream_url '$UPSTREAM_URL'; expected a GitHub repository URL"
+    ;;
+esac
+
+UPSTREAM_REPO="${UPSTREAM_REPO%/}"
+UPSTREAM_REPO="${UPSTREAM_REPO%.git}"
+printf '%s\n' "$UPSTREAM_REPO" | grep -Eq '^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$' ||
+  fail "invalid upstream repository '$UPSTREAM_REPO'; refusing external Git operations"
+
+if [ -n "$EXPECTED_REPO" ] && [ "$EXPECTED_REPO" != "$UPSTREAM_REPO" ]; then
+  fail "target changed from '$EXPECTED_REPO' to '$UPSTREAM_REPO'; refusing external Git operations"
+fi
+
+printf '%s\n' "$UPSTREAM_REPO"

package/runtime/prime/bin/handoff-save-egregore.sh

@@ -135,7 +135,7 @@ if [ -z "$CURRENT_BRANCH" ] || [ "$CURRENT_BRANCH" = "$BASE_BRANCH" ] \
   # hash from the autosave sweep) — same-name pushes wedge on non-FF.
   NEW_BRANCH="dev/${AUTHOR}/${KIND}-${SLUG_DATE}${BRANCH_SUFFIX:+-$BRANCH_SUFFIX}"
   git fetch origin "$BASE_BRANCH" --quiet 2>/dev/null || true
-  git checkout -b "$NEW_BRANCH" "$BASE_REF" --quiet 2>/dev/null || \
+  git checkout --no-track -b "$NEW_BRANCH" "$BASE_REF" --quiet 2>/dev/null || \
     git checkout "$NEW_BRANCH" --quiet 2>/dev/null || exit 0
   CURRENT_BRANCH="$NEW_BRANCH"
 fi

package/runtime/prime/bin/lib/git-sync.sh

@@ -32,6 +32,22 @@ if [ -z "${BASE_BRANCH:-}" ]; then
   fi
 fi
 
+# Migrate task branches created by older Egregore versions. `git branch
+# <task> origin/<base>` implicitly made the task branch track the protected
+# integration branch, so a bare push could target it when push.default was
+# `upstream`. Task branches remain unpublished until the explicit save/push
+# flow creates their same-name remote and sets that as upstream.
+_CURRENT_TASK_BRANCH="$(git branch --show-current 2>/dev/null || true)"
+case "$_CURRENT_TASK_BRANCH" in
+  dev/*|feature/*|bugfix/*)
+    _CURRENT_TASK_UPSTREAM="$(git rev-parse --abbrev-ref '@{upstream}' 2>/dev/null || true)"
+    if [ "$_CURRENT_TASK_UPSTREAM" = "origin/$BASE_BRANCH" ]; then
+      git branch --unset-upstream "$_CURRENT_TASK_BRANCH" >/dev/null 2>&1 || true
+    fi
+    ;;
+esac
+unset _CURRENT_TASK_BRANCH _CURRENT_TASK_UPSTREAM
+
 # --- Ensure pull.rebase is set (prevents "divergent branches" errors) ---
 git config pull.rebase true 2>/dev/null || true
 

package/runtime/prime/bin/lib/greeting.sh

@@ -13,7 +13,7 @@
 #   - Telemetry emit
 #   - First session welcome
 #
-# Inputs:  SCRIPT_DIR, STATE_FILE, CONFIG, CTX_DIR, BRANCH, COMMITS_AHEAD,
+# Inputs:  SCRIPT_DIR, STATE_FILE, CONFIG, CTX_DIR, BRANCH, BASE_BRANCH, COMMITS_AHEAD,
 #          AUTHOR, LOCAL_MODE, MEMORY_SYNCED, SAVED_BRANCH,
 #          HEALTH_*, FRAMEWORK_VERSION, TIME_OF_DAY, EGREGORE_SESSION_ID,
 #          FIRST_SESSION, DISPLAY_NAME_STATE, DASHBOARD_URL
@@ -515,5 +515,5 @@ else
   echo ""
   echo "IMPORTANT: Display the above greeting to the user exactly as-is (preserve the ASCII art formatting and ornamented status) on their first message. Then ask: What are you working on?"
   echo ""
-  echo "BRANCH RULE: When the user responds with what they're working on, your FIRST action is to create a working branch: git fetch origin develop --quiet && git checkout -b dev/{author}/{topic-slug} origin/develop. Do this BEFORE any other work. Derive the topic slug from their description. If they ask a pure question with no work intent, skip branching."
+  echo "BRANCH RULE: When the user responds with what they're working on, your FIRST action is to create a working branch: git fetch origin $BASE_BRANCH --quiet && git checkout --no-track -b dev/{author}/{topic-slug} origin/$BASE_BRANCH. Do this BEFORE any other work. Derive the topic slug from their description. If they ask a pure question with no work intent, skip branching."
 fi

package/runtime/prime/bin/prime-render-spec.mjs

@@ -107,7 +107,7 @@ Read the selected skill's \`SKILL.md\` completely before acting. Codex wording i
 
 The \`egregore\` Python-backed skill exposes the mechanics as kernel functions — \`import egregore\`, then \`egregore.search(query)\`, \`egregore.activity()\`, \`egregore.handoff(to, topic, body)\`, \`egregore.save(message, topic)\`, \`egregore.branch(topic)\`, \`egregore.notify_plan(recipient, message)\`. Prefer these over re-deriving \`bin/\` CLI usage by reading scripts. \`notify_plan\` is proposal-only: approval and dispatch always pass through the explicit human Send / Edit / Cancel checkpoint.
 
-"Get the latest changes" inside a session means \`/reload\` — it re-reads instructions, context files, skills, and extensions from disk. Never \`git pull\`, \`git reset\`, or \`git checkout\` the working branch to pick up updates. When pivoting topics inside a worktree that carries unmerged branch work, create the new branch from the current HEAD, not \`origin/develop\` — branching from origin/develop in such a worktree removes the unmerged files from disk.
+"Get the latest changes" inside a session means \`/reload\` — it re-reads instructions, context files, skills, and extensions from disk. Never \`git pull\`, \`git reset\`, or \`git checkout\` the working branch to pick up updates. When pivoting topics inside a worktree that carries unmerged branch work, create the new branch from the current HEAD, not \`origin/{base}\` — branching from the configured base in such a worktree removes the unmerged files from disk.
 
 Kernel shell escapes can be time-capped by the harness. Egregore \`bin/\` scripts that sync git state or query the connected graph legitimately run 10–120 seconds: run them with a generous timeout (a \`%%bash\` cell, or the longest limit the harness exposes). If a command dies suspiciously fast (~5s) with partial output, treat it as a timeout — rerun once with a longer limit or render the workflow's designed one-line fallback. Never debug data plumbing inside a product workflow. Connected mode works normally here: graph reads and \`bin/search.sh\` enrichment use the instance's configured credentials, and when graph data is degraded say so in one plain line rather than narrating connectivity theories.`, CODEX_COMMAND_LEAD);