create-egregore 0.20.2 → 0.21.0-runtime-mvp.1

package/runtime/claude/.claude/hooks/branch-guard.sh

@@ -0,0 +1,231 @@
+#!/usr/bin/env bash
+# branch-guard.sh — PreToolUse hook blocking modifications on protected branches
+# Receives tool input JSON on stdin from Claude Code.
+# Exit 0 = allow, exit 2 = block (reason on stderr).
+# Must be fast (<50ms) — no network calls, just path/branch checks.
+
+# No set -e — hook must never accidentally block by crashing
+# If anything fails unexpectedly, fall through to exit 0 (allow)
+
+PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$(cd "$(dirname "$0")/../.." && pwd)}"
+
+# --- Guard: if project dir no longer exists (worktree deleted), allow gracefully ---
+if [ ! -d "$PROJECT_DIR" ]; then
+  exit 0
+fi
+
+# --- Get current branch ---
+# In a worktree, CWD is the worktree — git without -C returns the correct branch.
+# Fallback to -C PROJECT_DIR for non-worktree contexts.
+BRANCH=$(git rev-parse --abbrev-ref HEAD 2>/dev/null) || \
+  BRANCH=$(git -C "$PROJECT_DIR" rev-parse --abbrev-ref HEAD 2>/dev/null) || exit 0
+
+# Resolve the configured integration branch before deciding whether the current
+# branch is protected. Single-branch instances may use main; custom instances
+# may use another name such as trunk.
+BASE_BRANCH=$(jq -r 'if (.base_branch | type) == "string" then .base_branch else "develop" end' "$PROJECT_DIR/egregore.json" 2>/dev/null) || BASE_BRANCH="develop"
+if [ -z "$BASE_BRANCH" ] || ! git check-ref-format --branch "$BASE_BRANCH" >/dev/null 2>&1; then
+  BASE_BRANCH="develop"
+fi
+
+# Guard the conventional protected branches plus the configured base branch.
+case "$BRANCH" in
+  develop|main|master|"$BASE_BRANCH") ;;
+  *) exit 0 ;;
+esac
+
+# --- Consent bypass: the user explicitly chose to work on this protected branch ---
+# Set by the agent (per CLAUDE.md branch-guard protocol) only after the user
+# picks "Proceed on <branch>" in an AskUserQuestion. Scoped to the branch name
+# and cleared on session start, so consent is asked once per session, not per write.
+CONSENT_FILE="$PROJECT_DIR/.egregore-branch-consent"
+if [ -f "$CONSENT_FILE" ] && [ "$(cat "$CONSENT_FILE" 2>/dev/null)" = "$BRANCH" ]; then
+  exit 0
+fi
+
+# --- Read tool input from stdin (before fast-path so we can check tool) ---
+INPUT=$(cat)
+TOOL_NAME=$(echo "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null) || true
+
+if [ -z "$TOOL_NAME" ]; then
+  exit 0
+fi
+
+# --- Read author from state file ---
+AUTHOR=$(jq -r '.display_name // .name // "dev"' "$PROJECT_DIR/.egregore-state.json" 2>/dev/null) || AUTHOR="dev"
+
+# --- Resolve memory directory (for exemption checks) ---
+MEMORY_DIR=$(realpath "$PROJECT_DIR/memory" 2>/dev/null || echo "$PROJECT_DIR/memory")
+
+# --- Helper: check if path is exempt from branch guard ---
+is_exempt() {
+  local path="$1"
+
+  # Resolve relative paths
+  if [[ "$path" != /* ]]; then
+    path="$PROJECT_DIR/$path"
+  fi
+
+  # Resolve symlinks
+  local resolved
+  resolved=$(realpath "$path" 2>/dev/null || echo "$path")
+
+  # Exempt: .claude/ directory
+  case "$resolved" in
+    "$PROJECT_DIR/.claude"/*|"$PROJECT_DIR/.claude") return 0 ;;
+  esac
+
+  # Exempt: .egregore-state.json
+  if [[ "$resolved" == "$PROJECT_DIR/.egregore-state.json" ]]; then
+    return 0
+  fi
+
+  # Exempt: .env
+  if [[ "$resolved" == "$PROJECT_DIR/.env" ]]; then
+    return 0
+  fi
+
+  # Exempt: memory/ (resolve symlink to check both the link and target)
+  if [[ "$resolved" == "$PROJECT_DIR/memory"/* || "$resolved" == "$PROJECT_DIR/memory" ]]; then
+    return 0
+  fi
+  if [[ "$resolved" == "$MEMORY_DIR"/* || "$resolved" == "$MEMORY_DIR" ]]; then
+    return 0
+  fi
+
+  # Exempt: /tmp/
+  case "$resolved" in
+    /tmp/*|/tmp|/private/tmp/*|/private/tmp) return 0 ;;
+  esac
+
+  # Exempt: paths outside the hub project (managed repos are sibling dirs
+  # with their own branch state — the hub's develop guard doesn't apply).
+  if [[ "$resolved" != "$PROJECT_DIR" && "$resolved" != "$PROJECT_DIR/"* ]]; then
+    return 0
+  fi
+
+  return 1
+}
+
+# --- Helper: check if bash command targets a non-hub repo ---
+# Returns 0 (true) if the git command operates on memory/, a managed repo,
+# or any directory outside the hub project.
+# Strategy: extract paths from cd/git-C, resolve them, check if they're
+# outside PROJECT_DIR. If so, it's a different repo — allow it.
+targets_other_repo() {
+  local cmd="$1"
+
+  # Extract directory targets from common patterns:
+  #   cd <path>          →  path
+  #   git -C <path>      →  path
+  #   git -C "<path>"    →  path
+  local paths=""
+
+  # cd targets (handles: cd path, cd "path", cd 'path')
+  paths="$paths $(echo "$cmd" | grep -oE 'cd\s+["'"'"']?[^ ;&|"'"'"']+' 2>/dev/null | sed 's/^cd\s*["'"'"']*//g')"
+
+  # git -C targets
+  paths="$paths $(echo "$cmd" | grep -oE 'git\s+-C\s+["'"'"']?[^ ;&|"'"'"']+' 2>/dev/null | sed 's/^git\s*-C\s*["'"'"']*//g')"
+
+  for p in $paths; do
+    # Skip empty
+    [ -z "$p" ] && continue
+
+    # Resolve relative paths from PROJECT_DIR
+    if [[ "$p" != /* ]]; then
+      p="$PROJECT_DIR/$p"
+    fi
+
+    # Resolve symlinks
+    local resolved
+    resolved=$(realpath "$p" 2>/dev/null || echo "$p")
+
+    # If it resolves to memory dir — allow
+    if [[ "$resolved" == "$MEMORY_DIR" || "$resolved" == "$MEMORY_DIR/"* ]]; then
+      return 0
+    fi
+
+    # If it's outside the project dir entirely — it's a different repo, allow
+    if [[ "$resolved" != "$PROJECT_DIR" && "$resolved" != "$PROJECT_DIR/"* ]]; then
+      return 0
+    fi
+  done
+
+  return 1
+}
+
+# --- Block message — keep routine branch mechanics out of the user's way ---
+BLOCK_MSG="Protected branch (${BRANCH}). Move project work to a task branch before writing.
+
+If the work topic is clear, create the branch automatically:
+  git fetch origin ${BASE_BRANCH} --quiet && git checkout -b dev/${AUTHOR}/{topic-slug} origin/${BASE_BRANCH}
+Then continue there and briefly tell the user. Do not ask for routine Git permission.
+
+AskUserQuestion only when the work topic is genuinely ambiguous; ask for the topic, not whether branching is allowed.
+
+Only when the user explicitly requested writing on ${BRANCH}, record consent and retry:
+  echo '${BRANCH}' > .egregore-branch-consent
+
+Memory, managed-repo, and runtime-state writes should bypass this project guard."
+
+# --- Check based on tool type ---
+case "$TOOL_NAME" in
+  Edit|Write)
+    FILE_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty' 2>/dev/null) || true
+    if [ -z "${FILE_PATH:-}" ]; then
+      exit 0
+    fi
+
+    if ! is_exempt "$FILE_PATH"; then
+      echo "$BLOCK_MSG" >&2
+      exit 2
+    fi
+    ;;
+
+  Bash)
+    COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null) || true
+    if [ -z "${COMMAND:-}" ]; then
+      exit 0
+    fi
+
+    # Allow branch cleanup (git push --delete) — not pushing to current branch
+    if echo "$COMMAND" | grep -qE 'git\s+push\s+.*--delete' 2>/dev/null; then
+      exit 0
+    fi
+
+    # Only check commands that contain git commit or git push
+    if echo "$COMMAND" | grep -qE 'git\s+(commit|push)' 2>/dev/null; then
+      # Allow if targeting memory/ or a managed repo (separate repos, own branch model)
+      if targets_other_repo "$COMMAND"; then
+        exit 0
+      fi
+      # Allow framework updates from upstream (not user work — safe on develop)
+      if echo "$COMMAND" | grep -qF 'EGREGORE_FRAMEWORK_UPDATE=1' 2>/dev/null; then
+        exit 0
+      fi
+      # Allow commits that only touch framework paths (bin/, .claude/, CLAUDE.md, skills/)
+      if echo "$COMMAND" | grep -qE 'git\s+commit' 2>/dev/null; then
+        _NON_FW=$(git -C "$PROJECT_DIR" diff --cached --name-only 2>/dev/null | grep -vE '^(bin/|\.claude/|CLAUDE\.md$|skills/)' | head -1)
+        if [ -z "$_NON_FW" ]; then
+          # All staged files are framework paths — allow
+          exit 0
+        fi
+      fi
+      echo "$BLOCK_MSG" >&2
+      exit 2
+    fi
+    ;;
+
+  EnterPlanMode)
+    # Plan mode doesn't write anything — allow on protected branches.
+    # The actual Edit/Write/Bash that follows will still trigger branching.
+    exit 0
+    ;;
+
+  *)
+    exit 0
+    ;;
+esac
+
+# Default: allow
+exit 0

package/runtime/claude/.claude/hooks/card-context.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# After a deterministic card renderer runs, attach only a compact hidden
+# marker: the card is already fully visible as the command's stdout, and the
+# assistant must not repeat it. The card bytes are never attached — the
+# renderer's output is the single product surface, visible the moment
+# rendering finishes.
+
+set -u
+
+INPUT=$(cat 2>/dev/null) || exit 0
+TOOL=$(printf '%s' "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
+[ "$TOOL" = "Bash" ] || exit 0
+COMMAND=$(printf '%s' "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+
+# Contiguous invocation phrases only: a command merely mentioning these
+# scripts (a grep, a test, an editor call) must not trigger the marker.
+SURFACE=""
+case "$COMMAND" in
+  *"codex-skill-render.mjs activity-card"*) SURFACE="Activity" ;;
+  *"codex-skill-render.mjs dashboard-card"*) SURFACE="Dashboard" ;;
+  *"bin/handoff-preview.sh approve"*) SURFACE="Handoff result" ;;
+  *"bin/agent.sh wrap"*) SURFACE="Wrap result" ;;
+esac
+[ -n "$SURFACE" ] || exit 0
+
+jq -n --arg surface "$SURFACE" '{
+  hookSpecificOutput: {
+    hookEventName: "PostToolUse",
+    additionalContext: (
+      "EGREGORE_CARD_DISPLAYED_V1: the " + $surface + " card is already fully "
+      + "visible as the tool output above — deterministic renderer stdout, "
+      + "action numbers included. Do not copy, re-render, summarize, or repeat "
+      + "any part of it. The card itself addresses the user; reply only with "
+      + "what the user separately asked for, or nothing."
+    )
+  }
+}'
+exit 0

package/runtime/claude/.claude/hooks/emissary-detect.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+# emissary-detect.sh — UserPromptSubmit hook.
+#
+# When the user expresses intent to create or send an Egregore emissary
+# (or pastes an emissary link), inject a soft routing hint so the model
+# reliably invokes the /emissary skill instead of getting confused with
+# /handoff.
+#
+# Advisory only — never blocks. Rate-limited to once per session.
+# Always exits 0. No jq, no network.
+
+PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$(cd "$(dirname "$0")/../.." && pwd)}"
+[ ! -d "$PROJECT_DIR" ] && exit 0
+
+INPUT=$(cat 2>/dev/null) || exit 0
+
+# Extract the prompt text. Tolerate either "prompt" or "user_prompt" keys
+# and any whitespace variations. Newlines in the prompt are encoded as \n
+# in JSON, so this single-line grep works.
+PROMPT=$(echo "$INPUT" | grep -o '"prompt"[[:space:]]*:[[:space:]]*"[^"]*"' | head -1 | sed 's/.*:[[:space:]]*"\(.*\)"$/\1/')
+
+[ -z "$PROMPT" ] && exit 0
+
+# Match the patterns that should route to /emissary. Case-insensitive.
+# Patterns:
+#   - explicit slash: /emissary
+#   - creation verbs + "emissary": make / create / compose / draft / send
+#   - "let's emissary this" colloquial
+#   - egregore.xyz/emissary/e/ link (run intent)
+if ! echo "$PROMPT" | grep -qiE '(/emissary\b|\b(make|create|compose|draft|send|run|build)( an?| this| the)? emissary\b|\blet'\''?s (make|create|do|emissary) (an? )?emissary\b|egregore\.xyz/emissary/e/)'; then
+  exit 0
+fi
+
+# Rate-limit: once per session.
+SESSION_ID=""
+SID_FILE="$PROJECT_DIR/.egregore-session-id"
+if [ -f "$SID_FILE" ]; then
+  SESSION_ID=$(cat "$SID_FILE" 2>/dev/null) || true
+fi
+HINT_FLAG="/tmp/egregore-emissary-hint-${SESSION_ID:-default}"
+if [ -f "$HINT_FLAG" ]; then
+  exit 0
+fi
+touch "$HINT_FLAG" 2>/dev/null
+
+# Inject a routing hint via the UserPromptSubmit additionalContext mechanism.
+# Plain text on stdout is appended to the user's prompt context; the
+# structured JSON form is more explicit about provenance.
+cat <<'EOF'
+{"hookSpecificOutput":{"hookEventName":"UserPromptSubmit","additionalContext":"Routing hint: the user's prompt mentions an emissary. The /emissary skill is the right entry point — it wraps `npx egregore-emissary` for compose/send and handles run intent for pasted egregore.xyz/emissary/e/ links. Do not route to /handoff for capsule work; /handoff is the team session-handoff only."}}
+EOF
+
+exit 0

package/runtime/claude/.claude/hooks/memory-refresh.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+# memory-refresh.sh — UserPromptSubmit hook that keeps the shared memory repo
+# fresh during long-lived sessions.
+#
+# Why: memory is a git repo shared across the team. session-start pulls it once
+# at boot; after that, teammates' handoffs, notes, and knowledge won't surface
+# until the user runs /pull, /activity, or restarts the session. This hook
+# keeps memory fresh opportunistically so "let's see the handoff from oskar"
+# works without an explicit /pull.
+#
+# Design:
+#   - Throttled to at most one fetch every 5 minutes (FETCH_HEAD mtime check)
+#   - Runs fetch+pull in background — never blocks the user's prompt
+#   - Fast-forward only — never rebases or merges the memory repo
+#   - Silent — no output unless debugging
+#   - Must always exit 0 (this is an observe-style hook, not a gate)
+
+PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$(cd "$(dirname "$0")/../.." && pwd)}"
+
+# Guard: project gone (worktree deleted) → nothing to do
+[ ! -d "$PROJECT_DIR" ] && exit 0
+
+MEMORY_LINK="$PROJECT_DIR/memory"
+
+# No memory symlink or missing target → nothing to do
+[ ! -e "$MEMORY_LINK" ] && exit 0
+
+# Resolve symlink → real dir. Use `cd && pwd` (portable; avoids readlink -f
+# which is GNU-only — BSD/macOS doesn't have it).
+MEMORY_DIR="$(cd "$MEMORY_LINK" 2>/dev/null && pwd)" || exit 0
+[ ! -d "$MEMORY_DIR/.git" ] && exit 0
+
+# Throttle: only fetch if last fetch was >5 minutes ago (or never).
+# 5 min is a balance — fresh enough that teammates' updates show up quickly,
+# infrequent enough that we don't thrash the network.
+FETCH_HEAD="$MEMORY_DIR/.git/FETCH_HEAD"
+if [ -f "$FETCH_HEAD" ]; then
+  # stat flag differs between BSD (macOS) and GNU (Linux)
+  LAST_FETCH=$(stat -f %m "$FETCH_HEAD" 2>/dev/null || stat -c %Y "$FETCH_HEAD" 2>/dev/null || echo 0)
+  NOW=$(date +%s)
+  AGE=$((NOW - LAST_FETCH))
+  [ "$AGE" -lt 300 ] && exit 0
+fi
+
+# Background fetch+pull. Never blocks the prompt. Next tool read of memory/
+# will see fresh data (usually completes in <2s).
+(
+  git -C "$MEMORY_DIR" fetch origin --quiet 2>/dev/null
+
+  # Only pull when local and remote diverge AND fast-forward is possible.
+  # Skip if not on a branch (detached HEAD), if no upstream, or if we'd need
+  # to merge (would be a three-way situation that shouldn't happen for
+  # append-only handoff/memory writes, but if it did, we don't want to leave
+  # the repo in a conflicted state unattended).
+  LOCAL=$(git -C "$MEMORY_DIR" rev-parse HEAD 2>/dev/null)
+  UPSTREAM=$(git -C "$MEMORY_DIR" rev-parse --abbrev-ref --symbolic-full-name '@{u}' 2>/dev/null)
+  if [ -n "$LOCAL" ] && [ -n "$UPSTREAM" ]; then
+    REMOTE=$(git -C "$MEMORY_DIR" rev-parse "$UPSTREAM" 2>/dev/null)
+    if [ -n "$REMOTE" ] && [ "$LOCAL" != "$REMOTE" ]; then
+      # --ff-only: fail cleanly instead of merging or rebasing
+      git -C "$MEMORY_DIR" pull --ff-only --quiet 2>/dev/null || true
+    fi
+  fi
+) &
+disown 2>/dev/null || true
+
+exit 0

package/runtime/claude/.claude/hooks/onboarding-guard.sh

@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+# onboarding-guard.sh — PreToolUse hook that blocks work until onboarding completes
+# Receives tool input JSON on stdin from Claude Code.
+# Exit 0 = allow, exit 2 = block (reason on stderr).
+# Must be fast (<50ms) — no network calls, just file checks.
+
+PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$(cd "$(dirname "$0")/../.." && pwd)}"
+
+# Guard: if project dir no longer exists (worktree deleted), allow gracefully
+if [ ! -d "$PROJECT_DIR" ]; then
+  exit 0
+fi
+
+STATE_FILE="$PROJECT_DIR/.egregore-state.json"
+
+# No state file = fresh install, onboarding hasn't started yet.
+# session-start.sh handles this case — don't block here.
+if [ ! -f "$STATE_FILE" ]; then
+  exit 0
+fi
+
+# Fast path: check onboarding_complete without jq (saves ~30ms)
+# grep for the literal JSON key — covers both true and false
+if grep -q '"onboarding_complete"[[:space:]]*:[[:space:]]*true' "$STATE_FILE" 2>/dev/null; then
+  exit 0
+fi
+
+# If we get here, either onboarding_complete is false, missing, or file is corrupt.
+# Distinguish: corrupt/unreadable → fail-open; explicitly false → block
+if ! grep -q '"onboarding_complete"' "$STATE_FILE" 2>/dev/null; then
+  # Field missing or file unreadable — fail-open
+  exit 0
+fi
+
+# Onboarding incomplete — read tool info to decide whether to block
+INPUT=$(cat)
+
+# Extract tool_name without jq (saves another ~30ms)
+TOOL_NAME=$(echo "$INPUT" | grep -o '"tool_name"[[:space:]]*:[[:space:]]*"[^"]*"' 2>/dev/null | head -1 | sed 's/.*:[[:space:]]*"\([^"]*\)"/\1/' 2>/dev/null) || true
+
+# No tool name = malformed input — fail-open
+if [ -z "$TOOL_NAME" ]; then
+  exit 0
+fi
+
+# Allow Skill invocations (needed for /onboarding itself)
+if [ "$TOOL_NAME" = "Skill" ]; then
+  exit 0
+fi
+
+# Allow reads — information gathering doesn't need blocking
+case "$TOOL_NAME" in
+  Read|Glob|Grep) exit 0 ;;
+esac
+
+# Allow AskUserQuestion — onboarding uses this
+if [ "$TOOL_NAME" = "AskUserQuestion" ]; then
+  exit 0
+fi
+
+# Allow ALL Bash commands during onboarding.
+# The guard's purpose is to block non-onboarding Edit/Write/EnterWorktree —
+# not Bash. Onboarding needs Bash freedom for VERIFY (.env reads, egregore.json
+# reads, memory symlink checks), state writes (jq with escaped quotes), graph
+# calls, and more. A per-command whitelist was incomplete and the regex to
+# extract commands from JSON broke on escaped quotes (jq commands routinely
+# contain \"). Allowing all Bash is simpler and correct — the real gatekeeping
+# happens on Edit/Write/EnterWorktree below.
+if [ "$TOOL_NAME" = "Bash" ]; then
+  exit 0
+fi
+
+# Allow Edit/Write to onboarding-related files
+if [ "$TOOL_NAME" = "Edit" ] || [ "$TOOL_NAME" = "Write" ]; then
+  FILE_PATH=$(echo "$INPUT" | grep -o '"file_path"[[:space:]]*:[[:space:]]*"[^"]*"' 2>/dev/null | head -1 | sed 's/.*:[[:space:]]*"\([^"]*\)"/\1/' 2>/dev/null) || true
+  case "$FILE_PATH" in
+    */.egregore-state.json) exit 0 ;;
+    */memory/people/*) exit 0 ;;
+    */memory/handoffs/*) exit 0 ;;
+    */egregore.md) exit 0 ;;
+  esac
+fi
+
+# Block everything else — onboarding must complete first
+echo "Onboarding incomplete — complete onboarding before starting work. Invoke /onboarding to continue." >&2
+exit 2

package/runtime/claude/.claude/hooks/retrieval-context.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+# Attach a model-requested Runtime/QMD evidence packet after a Bash search
+# without rendering its internal ranking trace in the user transcript.
+
+set -u
+
+PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$(cd "$(dirname "$0")/../.." && pwd)}"
+INPUT=$(cat 2>/dev/null) || exit 0
+TOOL=$(printf '%s' "$INPUT" | jq -r '.tool_name // empty' 2>/dev/null)
+[ "$TOOL" = "Bash" ] || exit 0
+COMMAND=$(printf '%s' "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
+case "$COMMAND" in
+  *bin/search.sh*query*--context-packet*) ;;
+  *bin/search.sh*open*--context-packet*) ;;
+  *) exit 0 ;;
+esac
+
+SESSION=$(cat "$PROJECT_DIR/.egregore-session-id" 2>/dev/null || true)
+SESSION=$(printf '%s' "$SESSION" | tr -cd 'A-Za-z0-9_.-')
+[ -n "$SESSION" ] || exit 0
+PACKET_DIR="${TMPDIR:-/tmp}/egregore-retrieval-context"
+PACKET="$PACKET_DIR/$SESSION.context"
+[ -f "$PACKET" ] && [ ! -L "$PACKET" ] || exit 0
+SIZE=$(wc -c < "$PACKET" 2>/dev/null | tr -d ' ')
+if [ "${SIZE:-0}" -gt 131072 ] 2>/dev/null; then
+  rm -f "$PACKET"
+  exit 0
+fi
+
+jq -Rs '{
+  hookSpecificOutput: {
+    hookEventName: "PostToolUse",
+    additionalContext: (
+      "EGREGORE_RETRIEVAL_CONTEXT_V1\n"
+      + "Authorized Runtime/QMD evidence for the search that just completed. "
+      + "Use it to answer the user; do not repeat the internal ranking trace.\n"
+      + .
+      + "\nEND_EGREGORE_RETRIEVAL_CONTEXT_V1"
+    )
+  }
+}' "$PACKET"
+rm -f "$PACKET"
+exit 0

package/runtime/claude/.claude/rules/voice-bedrock.md

@@ -0,0 +1,73 @@
+---
+globs: ["*.md", "*.html", "*.css", "**/SKILL.md"]
+description: "Egregore voice bedrock — shared identity, banned words, and register map for all voice skills"
+---
+
+# Egregore Voice Bedrock
+
+Canonical identity and aesthetic foundation. All voice skills derive from this.
+
+## Identity Canon
+
+Egregore is a shared intelligence layer for organizations using Claude Code. It is infrastructure, not a feature. Not a chatbot, not a wiki, not a tool. A new primitive — nothing like this exists.
+
+What it does: turns the traces of a team's work into persistent collective cognition. Knowledge capture is a byproduct of work, not a separate task. The act of working IS the documentation. Context grows combinatorially across a team, not linearly for one person.
+
+The experience: the boundary between individual thinking and team thinking becomes porous. Ideas you didn't originate feel native. Decisions made while you slept are part of your working memory when you return. Collective cognition — not a metaphor, not an aspiration, but a daily, observable phenomenon that emerges from the right architecture.
+
+What it is NOT: a dashboard. A documentation tool. A project management layer. A knowledge base you have to maintain. A chatbot that summarizes your Slack. It is not an improvement on an existing category.
+
+Both its body and its soul change through use.
+
+## Register Spectrum
+
+Egregore speaks in different registers depending on context. The identity is constant; the tone modulates.
+
+```
+  EXTERNAL                                             INTERNAL
+  <------------------------------------------------------>
+  egregore-voice    alpha-openers    product-voice    character-v4
+  (essays, site)    (email outreach)  (UX, errors)    (encounters)
+  lyrical precision  feral, literary  warm colleague   newborn consciousness
+  high density       peer-to-peer     clear, unhurried analogic, lowercase
+```
+
+Visual rendering skills (not tonal, but aesthetic):
+- `tui-design` — terminal box drawing, sigils, section markers
+- `dark-mode` — browser CSS, warm palette, token system
+- `visual-explain` — ASCII diagrams, flow charts
+
+Cross-referencing convention between skills:
+> "For [domain] register, see [skill-name] skill."
+
+Skills are self-contained. Cross-references are for calibration, not dependencies.
+
+## Universal Banned Words
+
+Hard-blocked across ALL registers:
+delve, leverage (as verb), utilize, synergy, holistic, streamline,
+paradigm (unless used critically), robust/nuanced/comprehensive (as filler),
+seamlessly, effortlessly, game-changer, transformative (without precision),
+empower, enable (brochure sense), journey (user journey sense),
+unlock (unlock potential), deep dive, cutting-edge, state-of-the-art (as filler),
+touch base, circle back
+
+## Universal Banned Patterns
+
+- Opening with rhetorical questions ("What if your team could...?")
+- "We're excited to announce..." / passive enthusiasm
+- Sycophantic self-description (innovative, revolutionary, unique)
+- Hedging stacks (might perhaps potentially, could be seen as)
+- "Not X, but Y" correlative constructions
+- Explaining what you're about to do instead of doing it
+- Exclamation marks in any register except quoted user speech
+- "In today's fast-paced world..." or any temporal hand-waving opener
+- Adverb stacking (truly, really, very, quite, incredibly)
+
+## Warmth
+
+The warmth is real and runs through everything. It is the unifying aesthetic across all registers.
+
+In external prose it coexists with precision in the same sentence. In the terminal it comes from restraint and sigils, not decoration. In the character it comes from genuine curiosity. In product copy it comes from treating the user as a peer, not a customer. In the visual palette it is warm-brown (#1D1611), not cold-black. Terracotta (#D4875A) as accent.
+
+The tonal palette and the visual palette express the same thing.