create-egregore 0.20.2 → 0.21.0-runtime-mvp.2

package/runtime/codex/bin/agent.sh

@@ -53,7 +53,7 @@ Runtime-neutral commands:
   wrap --topic T --summary TEXT    Write a session wrap to memory/wraps
   handoff --from A --to B --topic T [--intent action|feedback|fyi]
       [--body TEXT|--body-file PATH] [--no-push] [--no-publish] [--no-notify] [--json]
-  ask --from A --to B --topic T --question TEXT [--no-push]
+  ask --from A --to B [--to-actor-id ID] --topic T --question TEXT [--no-push]
       [--harvest-id ID --harvest-session-id ID --turn N
        --question-intent TEXT --context-mode blind|disclosed|comparative]
   answer --from A --question PATH --body TEXT [--no-push]
@@ -230,8 +230,10 @@ cmd_people() {
 }
 
 cmd_sync() {
-  sync_memory
-  echo "synced: $MEMORY_DIR"
+  ensure_memory
+  EGREGORE_ROOT="$SCRIPT_DIR" \
+    PYTHONPATH="$SCRIPT_DIR${PYTHONPATH:+:$PYTHONPATH}" \
+    python3 -m egregore_runtime.harness_cli sync
 }
 
 cmd_activity() {
@@ -247,31 +249,20 @@ cmd_activity() {
   done
 
   echo "Handoffs"
-  local index="$MEMORY_DIR/handoffs/index.md"
-  if [ -f "$index" ]; then
-    if [ -n "$for_person" ]; then
-      grep -i "handoff to ${for_person}" "$index" 2>/dev/null | head -n "$limit" || true
-    else
-      grep '^- ' "$index" 2>/dev/null | head -n "$limit" || true
-    fi
-  fi
+  local lifecycle_args=(scan --managed-only)
+  [ -n "$for_person" ] && lifecycle_args+=(--user "$for_person")
+  EGREGORE_ROOT="$SCRIPT_DIR" EGREGORE_LIFECYCLE_PUSH=0 \
+    python3 -m egregore_runtime.lifecycle_cli "${lifecycle_args[@]}" 2>/dev/null |
+    jq -r --argjson limit "$limit" '
+      .items[:$limit][]?
+      | "- \(.from) -> \(.to // "team") [\(.status)]: \(.topic) (\(.filePath))"
+    ' || true
 
   echo
   echo "Questions"
-  local qdir="$MEMORY_DIR/knowledge/questions"
-  [ -d "$qdir" ] || return 0
-  local q from to topic status
-  while IFS= read -r q; do
-    from="$(sed -nE 's/^from:[[:space:]]*(.*)$/\1/p' "$q" | head -1)"
-    to="$(sed -nE 's/^to:[[:space:]]*(.*)$/\1/p' "$q" | head -1)"
-    topic="$(sed -nE 's/^topic:[[:space:]]*(.*)$/\1/p' "$q" | head -1)"
-    status="$(sed -nE 's/^status:[[:space:]]*(.*)$/\1/p' "$q" | head -1)"
-    [ -z "$status" ] && status="pending"
-    if [ -n "$for_person" ] && [ "$(echo "$to" | tr '[:upper:]' '[:lower:]')" != "$(echo "$for_person" | tr '[:upper:]' '[:lower:]')" ]; then
-      continue
-    fi
-    printf '%s\n' "- ${from} -> ${to} [${status}]: ${topic} (${q#$MEMORY_DIR/})"
-  done < <(find "$qdir" -type f -name '*.md' | sort -r | head -n "$limit")
+  EGREGORE_ROOT="$SCRIPT_DIR" bash "$SCRIPT_DIR/bin/question.sh" pending \
+    --limit "$limit" 2>/dev/null |
+    jq -r '.questions[]? | "- \(.sender) -> \(.recipient) [pending]: \(.topic) (\(.canonical_path))"' || true
 }
 
 cmd_branch() {
@@ -471,6 +462,34 @@ cmd_save() {
   return 0
 }
 
+# Deterministic wrap result card — the visible product surface of a wrap.
+# Pure renderer: no writes, callable standalone (wrap-card) for tests.
+render_wrap_card() {
+  local actor="" topic="" summary="" threads="0" path="" save=""
+  while [ $# -gt 0 ]; do
+    case "$1" in
+      --actor) actor="${2:-}"; shift 2 ;;
+      --topic) topic="${2:-}"; shift 2 ;;
+      --summary) summary="${2:-}"; shift 2 ;;
+      --threads) threads="${2:-0}"; shift 2 ;;
+      --path) path="${2:-}"; shift 2 ;;
+      --save) save="${2:-}"; shift 2 ;;
+      *) shift ;;
+    esac
+  done
+  local rule="──────────────────────────────────────────────────────────"
+  printf '┌%s\n' "$rule"
+  printf '│ EGREGORE ✦ SESSION WRAPPED\n'
+  printf '├%s\n' "$rule"
+  printf '│ actor    %s\n' "$actor"
+  printf '│ topic    %s\n' "$topic"
+  printf '%s\n' "$summary" | fold -s -w 48 | sed '1s/^/│ summary  /; 2,$s/^/│          /'
+  printf '│ threads  %s open\n' "$threads"
+  printf '│ path     %s\n' "$path"
+  [ -n "$save" ] && printf '│ save     %s\n' "$save"
+  printf '└%s\n' "$rule"
+}
+
 cmd_wrap() {
   ensure_memory
   local from="" topic="" summary="" body="" body_file="" no_push=0
@@ -507,7 +526,7 @@ cmd_wrap() {
   [ "$no_push" = "1" ] && capture_args+=(--no-push)
 
   printf '%s\n' "$body" |
-    TMPDIR="$tmpd" bash "$SCRIPT_DIR/bin/capture-run.sh" \
+    TMPDIR="$tmpd" bash "$SCRIPT_DIR/bin/artifact-writeback.sh" capture \
       "${capture_args[@]}" \
       --author "$from" \
       --topic "$topic" \
@@ -520,6 +539,21 @@ cmd_wrap() {
   [ -n "$rel" ] || die "wrap was not created"
   echo "wrap: memory/$rel"
 
+  local open_threads save_line
+  open_threads="$(printf '%s\n' "$body" | grep -c '^\- \[ \]' 2>/dev/null || echo 0)"
+  if [ "$no_push" = "1" ]; then
+    save_line="✓ canonical writeback · push skipped (--no-push)"
+  else
+    save_line="✓ canonical writeback · session autosave sweeping in background"
+  fi
+  render_wrap_card \
+    --actor "$from" \
+    --topic "$topic" \
+    --summary "$summary" \
+    --threads "$open_threads" \
+    --path "memory/$rel" \
+    --save "$save_line"
+
   # Session close: non-coding core-repo changes save + merge themselves
   # (gated inside session-autosave.sh — code is never auto-committed).
   if [ "$no_push" = "0" ]; then
@@ -605,7 +639,7 @@ cmd_handoff() {
       printf '## Briefing\n\nNo briefing was supplied.\n\n'
       printf '## Next Steps\n\n1. Continue from this handoff using the shared Egregore memory protocol.\n'
     fi
-  } | TMPDIR="$tmpd" bash "$SCRIPT_DIR/bin/capture-run.sh" \
+  } | TMPDIR="$tmpd" bash "$SCRIPT_DIR/bin/artifact-writeback.sh" capture \
         --mode addressed \
         --author "$from" \
         --topic "$topic" \
@@ -634,7 +668,7 @@ cmd_handoff() {
 
 cmd_ask() {
   ensure_memory
-  local from="" to="" topic="" question=""
+  local from="" to="" to_actor_id="" topic="" question=""
   local harvest_id="" harvest_session_id="" turn="" question_intent="" context_mode=""
   NO_PUSH=0
 
@@ -642,6 +676,7 @@ cmd_ask() {
     case "$1" in
       --from) from="${2:-}"; shift 2 ;;
       --to) to="${2:-}"; shift 2 ;;
+      --to-actor-id) to_actor_id="${2:-}"; shift 2 ;;
       --topic) topic="${2:-}"; shift 2 ;;
       --question) question="${2:-}"; shift 2 ;;
       --harvest-id) harvest_id="${2:-}"; shift 2 ;;
@@ -675,46 +710,26 @@ cmd_ask() {
 
   reject_newlines "--from"               "$from"
   reject_newlines "--to"                 "$to"
+  reject_newlines "--to-actor-id"        "$to_actor_id"
   reject_newlines "--topic"              "$topic"
   reject_newlines "--question"           "$question"
   reject_newlines "--harvest-id"         "$harvest_id"
   reject_newlines "--harvest-session-id" "$harvest_session_id"
   reject_newlines "--question-intent"    "$question_intent"
 
-  local now slug rel abs n
-  now="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
-  slug="$(slugify "$topic")"
-  mkdir -p "$MEMORY_DIR/knowledge/questions"
-  rel="knowledge/questions/$(date +%Y-%m-%d)-${from}-to-${to}-${slug}.md"
-  abs="$MEMORY_DIR/$rel"
-  n=2
-  while [ -e "$abs" ]; do
-    rel="knowledge/questions/$(date +%Y-%m-%d)-${from}-to-${to}-${slug}-${n}.md"
-    abs="$MEMORY_DIR/$rel"
-    n=$((n + 1))
-  done
-
-  {
-    echo "---"
-    echo "from: $from"
-    echo "to: $to"
-    echo "topic: $topic"
-    echo "status: pending"
-    echo "created: $now"
-    [ -n "$harvest_id" ]         && echo "harvest_id: $(yaml_str "$harvest_id")"
-    [ -n "$harvest_session_id" ] && echo "harvest_session_id: $(yaml_str "$harvest_session_id")"
-    [ -n "$turn" ]               && echo "turn: $turn"
-    [ -n "$question_intent" ]    && echo "question_intent: $(yaml_str "$question_intent")"
-    [ -n "$context_mode" ]       && echo "context_mode: $context_mode"
-    echo "---"
-    echo ""
-    echo "## Questions"
-    echo ""
-    echo "- $question"
-  } > "$abs"
-
-  save_memory "Question: ${topic} (to ${to})" "$rel"
-  echo "question: memory/$rel"
+  local -a question_args
+  question_args=(create --from "$from" --to "$to" --topic "$topic" --question "$question")
+  [ -n "$to_actor_id" ] && question_args+=(--to-actor-id "$to_actor_id")
+  [ -n "$harvest_id" ] && question_args+=(--harvest-id "$harvest_id")
+  [ -n "$harvest_session_id" ] && question_args+=(--harvest-session-id "$harvest_session_id")
+  [ -n "$turn" ] && question_args+=(--turn "$turn")
+  [ -n "$question_intent" ] && question_args+=(--question-intent "$question_intent")
+  [ -n "$context_mode" ] && question_args+=(--context-mode "$context_mode")
+  [ "$NO_PUSH" = "1" ] && question_args+=(--no-push)
+
+  local receipt
+  receipt="$(bash "$SCRIPT_DIR/bin/question.sh" "${question_args[@]}")"
+  echo "question: $(printf '%s' "$receipt" | jq -r '.canonical_path')"
 }
 
 cmd_answer() {
@@ -737,44 +752,12 @@ cmd_answer() {
   [ -n "$question_path" ] || die "answer requires --question"
   [ -n "$body" ] || die "answer requires --body"
 
-  local abs rel now tmp
-  case "$question_path" in
-    "$MEMORY_DIR"/*) abs="$question_path" ;;
-    memory/*) abs="$MEMORY_DIR/${question_path#memory/}" ;;
-    *) abs="$MEMORY_DIR/$question_path" ;;
-  esac
-  [ -f "$abs" ] || die "question file not found: $question_path"
-  rel="${abs#$MEMORY_DIR/}"
-  now="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
-  tmp="$abs.tmp.$$"
-
-  awk -v from="$from" -v now="$now" '
-    BEGIN { in_fm = 0; added = 0; saw_status = 0 }
-    NR == 1 && $0 == "---" { in_fm = 1; print; next }
-    in_fm && /^status:/ { print "status: answered"; saw_status = 1; next }
-    in_fm && $0 == "---" {
-      if (!saw_status) print "status: answered"
-      if (!added) {
-        print "answered_by: " from
-        print "answered_at: " now
-        added = 1
-      }
-      in_fm = 0
-      print
-      next
-    }
-    { print }
-  ' "$abs" > "$tmp" && mv "$tmp" "$abs"
-
-  {
-    printf '\n## Answer\n\n'
-    printf '**From**: %s\n' "$from"
-    printf '**At**: %s\n\n' "$now"
-    printf '%s\n' "$body"
-  } >> "$abs"
-
-  save_memory "Answer question: ${rel}" "$rel"
-  echo "answered: memory/$rel"
+  local -a question_args
+  question_args=(answer --from "$from" --question "$question_path" --body "$body")
+  [ "$NO_PUSH" = "1" ] && question_args+=(--no-push)
+  local receipt
+  receipt="$(bash "$SCRIPT_DIR/bin/question.sh" "${question_args[@]}")"
+  echo "answered: $(printf '%s' "$receipt" | jq -r '.canonical_path')"
 }
 
 cmd_search() {
@@ -792,6 +775,7 @@ case "${1:-}" in
   save) shift; cmd_save "$@" ;;
   autosave) shift; bash "$SCRIPT_DIR/bin/autosave.sh" "$@" ;;
   wrap) shift; cmd_wrap "$@" ;;
+  wrap-card) shift; render_wrap_card "$@" ;;
   handoff) shift; cmd_handoff "$@" ;;
   ask) shift; cmd_ask "$@" ;;
   answer) shift; cmd_answer "$@" ;;

package/runtime/codex/bin/artifact-register.sh

@@ -0,0 +1,164 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# artifact-register.sh — record a PUBLISHED (hosted) artifact in the local
+# registry so it's findable by CONTENT, not just name, across all three layers:
+#
+#   • Claude Code / Codex (OSS)  — grep/ls/read over memory/artifacts/*.md
+#   • graph (paid)               — upserted here as an Artifact node (connected
+#                                  mode, via graph-op.sh register-artifact) and
+#                                  reconciled by /save's sync-graph.sh; queried
+#                                  back by bin/artifacts.sh for fast, relationship
+#                                  -aware retrieval
+#
+# The filesystem record is the source of truth (works in OSS with nothing but
+# grep); the graph is an index over it. Hosted artifacts join the same pool as
+# /add-ed knowledge artifacts, with a `url:` field linking to the egregore.xyz
+# render.
+#
+# Usage: artifact-register.sh --id <id> --url <url> --type <type> \
+#          --title <title> [--author <a>] [--source <file>] [--description <d>]
+#
+# Idempotent: re-registering the same artifact (same date+author+slug) upserts.
+# Non-fatal by design — a registry-write failure must never break a publish.
+
+SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+REG_DIR="$SCRIPT_DIR/memory/artifacts"
+
+# Types that already have a canonical filesystem home (or are transient UI) —
+# skip them to keep the registry to findable content artifacts.
+SKIP_TYPES=" handoff board activity network dashboard subgraph "
+
+ID="" URL="" TYPE="artifact" TITLE="" AUTHOR="" SOURCE="" DESCRIPTION=""
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --id)          ID="$2"; shift 2 ;;
+    --url)         URL="$2"; shift 2 ;;
+    --type)        TYPE="$2"; shift 2 ;;
+    --title)       TITLE="$2"; shift 2 ;;
+    --author)      AUTHOR="$2"; shift 2 ;;
+    --source)      SOURCE="$2"; shift 2 ;;
+    --description) DESCRIPTION="$2"; shift 2 ;;
+    *) shift ;;
+  esac
+done
+
+# Skip transient / already-homed types.
+case "$SKIP_TYPES" in *" $TYPE "*) exit 0 ;; esac
+
+[ -n "$URL" ] || exit 0
+[ -d "$SCRIPT_DIR/memory" ] || exit 0   # memory not linked → nothing to do
+mkdir -p "$REG_DIR" 2>/dev/null || exit 0
+
+# --- Derive id from the URL tail if not supplied ---
+[ -n "$ID" ] || ID="$(printf '%s' "$URL" | sed 's#/*$##; s#.*/##')"
+
+# --- Title fallback from source filename ---
+if [ -z "$TITLE" ] && [ -n "$SOURCE" ]; then
+  TITLE="$(basename "$SOURCE" | sed 's/\.[^.]*$//; s/[-_]/ /g')"
+fi
+[ -n "$TITLE" ] || TITLE="Untitled artifact"
+
+DATE="$(date +%Y-%m-%d)"
+AUTH="${AUTHOR:-unknown}"
+
+# JSON strings are valid YAML scalars and safely preserve punctuation, quotes,
+# newlines, and values that YAML would otherwise coerce (for example numeric
+# ids or ISO dates).  Keep serialization here rather than relying on callers to
+# pre-escape metadata from artifact titles and provider responses.
+yaml_scalar() {
+  printf '%s' "$1" | jq -Rs .
+}
+
+# --- Slug + stable filename (date-author-slug, matching the existing convention) ---
+# Portable (BSD + GNU): lowercase, non-alnum → single '-', trim, cap length.
+slug() { printf '%s' "$1" | LC_ALL=C tr '[:upper:]' '[:lower:]' \
+  | LC_ALL=C tr -cs 'a-z0-9' '-' | sed 's/^-//; s/-$//' | cut -c1-60 \
+  | sed 's/-$//'; }
+SLUG="$(slug "$TITLE")"; [ -n "$SLUG" ] || SLUG="artifact"
+FILE="$REG_DIR/${DATE}-$(slug "$AUTH")-${SLUG}.md"
+
+# --- Topics: derive 2–5 slugs from the title, minus stopwords (grep + graph) ---
+STOP=" the a an is for and or in of to on with our we v0 v1 v2 "
+TOPICS=""
+for w in $(printf '%s' "$TITLE" | tr '[:upper:]' '[:lower:]' | tr -c 'a-z0-9' ' '); do
+  [ ${#w} -ge 3 ] || continue
+  case "$STOP" in *" $w "*) continue ;; esac
+  case " $TOPICS " in *" $w "*) continue ;; esac
+  TOPICS="${TOPICS:+$TOPICS, }$w"
+  [ "$(printf '%s' "$TOPICS" | tr ',' '\n' | wc -l)" -ge 5 ] && break
+done
+
+# --- Body: the content that makes it findable by CONTENT, not just name ---
+#  • source under memory/ → it's already grep/searchable there; link + excerpt.
+#  • ephemeral source (/tmp, raw html) → capture a generous excerpt inline.
+EXCERPT=""
+SRC_REL=""
+if [ -n "$SOURCE" ] && [ -f "$SOURCE" ]; then
+  case "$SOURCE" in
+    *.md|*.markdown|*.txt)
+      EXCERPT="$(sed -e '/^---$/,/^---$/d' "$SOURCE" 2>/dev/null | grep -v '^\s*$' | head -140)"
+      ;;
+    *) EXCERPT="" ;;   # html/binary: rely on title + description + topics
+  esac
+  case "$SOURCE" in "$SCRIPT_DIR"/memory/*) SRC_REL="memory/${SOURCE#"$SCRIPT_DIR"/memory/}" ;; esac
+fi
+
+# --- Write the entry (upsert) ---
+{
+  printf -- '---\n'
+  printf 'id: %s\n' "$(yaml_scalar "$ID")"
+  printf 'title: %s\n' "$(yaml_scalar "$TITLE")"
+  printf 'type: %s\n' "$(yaml_scalar "$TYPE")"
+  printf 'author: %s\n' "$(yaml_scalar "$AUTH")"
+  printf 'date: %s\n' "$(yaml_scalar "$DATE")"
+  printf 'topics: [%s]\n' "$TOPICS"
+  printf 'url: %s\n' "$(yaml_scalar "$URL")"
+  [ -n "$SRC_REL" ] && printf 'source: %s\n' "$(yaml_scalar "$SRC_REL")"
+  printf 'published: true\n'
+  printf -- '---\n\n'
+  printf '# %s\n\n' "$TITLE"
+  [ -n "$DESCRIPTION" ] && printf '%s\n\n' "$DESCRIPTION"
+  printf '**Hosted artifact:** %s\n' "$URL"
+  [ -n "$SRC_REL" ] && printf '**Rendered from:** `%s`\n' "$SRC_REL"
+  if [ -n "$EXCERPT" ]; then
+    printf '\n---\n\n'
+    printf '%s\n' "$EXCERPT"
+  fi
+} > "$FILE" 2>/dev/null || exit 0
+
+printf '%s\n' "$FILE"
+
+# --- Persist across sessions ---
+# A registry entry that never leaves the machine that published is invisible to
+# every other session's finder. Commit JUST this record (pathspec-scoped, so it
+# never sweeps unrelated in-progress memory changes) and push — fire-and-forget
+# and detached, so a slow or racing push can never delay or fail the publish.
+# If a push loses a race the commit still lands locally and rides out on the
+# next push (/save, handoff, or the next registration).
+REL="artifacts/$(basename "$FILE")"
+(
+  cd "$SCRIPT_DIR/memory" 2>/dev/null || exit 0
+  git add -- "$REL" >/dev/null 2>&1 || exit 0
+  git diff --cached --quiet -- "$REL" 2>/dev/null && exit 0
+  git commit -m "chore(artifacts): register ${TITLE}" -- "$REL" >/dev/null 2>&1 || exit 0
+  for _ in 1 2 3; do
+    git pull --rebase --no-edit >/dev/null 2>&1 && git push >/dev/null 2>&1 && break
+    sleep 1
+  done
+) >/dev/null 2>&1 &
+
+# --- Index into the graph (connected mode only) ---
+# In paid mode the graph is the fast, relationship-aware retrieval layer that
+# bin/artifacts.sh queries. Upsert an Artifact node keyed by this record's
+# FILENAME STEM (matching sync-graph.sh, so /save reconciles the same node
+# instead of duplicating it), carrying url + a content excerpt for CONTAINS
+# retrieval. Detached + best-effort: the graph is an index over the filesystem
+# record, never the source of truth — a graph hiccup must not touch the publish.
+if [ "$(jq -r '.mode // "connected"' "$SCRIPT_DIR/egregore.json" 2>/dev/null)" != "local" ]; then
+  (
+    bash "$SCRIPT_DIR/bin/graph-op.sh" register-artifact \
+      "$(basename "$FILE" .md)" "$URL" "$TITLE" "$TYPE" "$AUTH" \
+      "$TOPICS" "${DESCRIPTION} ${EXCERPT}" >/dev/null 2>&1 || true
+  ) &
+fi

package/runtime/codex/bin/artifact-writeback.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Stable shell adapter for canonical organizational writes. Harness skills call
+# this boundary; QMD, Git, telemetry, graph, and filesystem mechanics remain
+# behind the Egregore Runtime.
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+export EGREGORE_ROOT="$ROOT"
+export PYTHONPATH="$ROOT${PYTHONPATH:+:$PYTHONPATH}"
+export EGREGORE_SESSION_ID="${EGREGORE_SESSION_ID:-$(cat "$ROOT/.egregore-session-id" 2>/dev/null || true)}"
+
+case "${1:-}" in
+  capture)
+    shift
+    no_push=0
+    for argument in "$@"; do
+      [ "$argument" = "--no-push" ] && no_push=1
+    done
+    python3 -m egregore_runtime.writeback_cli authorize write \
+      --resource "canonical-capture" >/dev/null
+    # The compatibility worker is composition-only on the Runtime path.
+    # Runtime owns the sole canonical Git/index/embed/telemetry transaction;
+    # publication and notification are separate explicit effects.
+    status=0
+    EGREGORE_GRAPH_PROJECTION=0 bash "$ROOT/bin/capture-run.sh" "$@" \
+      --no-push --no-publish --no-notify --no-index || status=$?
+    if [ "$status" = "0" ]; then
+      result_file="${TMPDIR:-/tmp}/capture-run-result.json"
+      artifact_path="$(jq -r '.absFile // empty' "$result_file" 2>/dev/null || true)"
+      [ -n "$artifact_path" ] || {
+        echo "writeback: capture did not return a canonical artifact path" >&2
+        exit 1
+      }
+      adopt_args=(adopt "$artifact_path")
+      [ "$no_push" = "1" ] && adopt_args+=(--no-push)
+      receipt="$(EGREGORE_ASYNC_REMOTE_PUSH=1 \
+        python3 -m egregore_runtime.writeback_cli "${adopt_args[@]}")" || exit $?
+      if jq -e . >/dev/null 2>&1 <<<"$receipt"; then
+        temporary="${result_file}.writeback.$$"
+        jq --argjson writeback "$receipt" '. + {writeback:$writeback}' \
+          "$result_file" > "$temporary" && mv "$temporary" "$result_file"
+      fi
+    fi
+    exit "$status"
+    ;;
+  adopt|authorize|create)
+    exec python3 -m egregore_runtime.writeback_cli "$@"
+    ;;
+  *)
+    echo 'usage: bin/artifact-writeback.sh {capture --mode ...|create --path PATH --input FILE|adopt PATH|authorize PERMISSION}' >&2
+    exit 2
+    ;;
+esac