create-egregore 0.20.2 → 0.21.0-runtime-mvp.2

package/runtime/codex/bin/lib/context.sh

@@ -95,6 +95,24 @@ if [ -n "${CTX_SEED_TAR:-}" ] && [ -f "${CTX_SEED_TAR:-}" ]; then
       fi
     fi
   fi
+  # Record why a fresh bake was not used — seed misses silently cost a full
+  # live gather, so the reason must be observable in startup traces.
+  if [ "$CTX_SEED_USED" != "true" ]; then
+    _SEED_REASON="tar-extract"
+    if [ "$_SEED_TS" != "0" ] || [ -n "$_SEED_AUTHOR" ]; then
+      if [ "$_SEED_AUTHOR" != "$AUTHOR" ]; then _SEED_REASON="author"
+      elif [ "$_SEED_MODE" != "${LOCAL_MODE:-false}" ]; then _SEED_REASON="mode"
+      elif [ "$_SEED_CONFIG" != "$_NOW_CONFIG" ]; then _SEED_REASON="config"
+      elif [ "$_SEED_SCOPE" != "$_NOW_SCOPE" ]; then _SEED_REASON="scope"
+      elif [ "$_SEED_SCHEMA" != "$_NOW_SCHEMA" ]; then _SEED_REASON="schema"
+      elif [ "$_SEED_AGE" -lt 0 ] || [ "$_SEED_AGE" -ge 900 ]; then _SEED_REASON="age:${_SEED_AGE}s"
+      else _SEED_REASON="completeness"
+      fi
+    fi
+    type egregore_trace_mark >/dev/null 2>&1 && egregore_trace_mark "context:seed-rejected:${_SEED_REASON}"
+  else
+    type egregore_trace_mark >/dev/null 2>&1 && egregore_trace_mark "context:seed-accepted"
+  fi
   rm -rf "$_SEED_TMP"
 fi
 
@@ -370,28 +388,21 @@ fi
   JSON="[]"
   RICH="[]"
   if [ -d "$SCRIPT_DIR/memory/handoffs" ]; then
-    # One definition everywhere: in connected mode the list comes from the
-    # graph's open-handoffs named read (open = pending/unread/read/claimed,
-    # matched by name/github/aliases) — the same definition the dashboard
-    # uses. The file grep below stays as the local-mode/offline fallback.
+    # One definition everywhere: Egregore Runtime folds canonical lifecycle
+    # state for both Local and Connected instances. Graph is an optional
+    # projection and must never become the startup/default retrieval path.
     ADDRESSED=""
-    if [ "${LOCAL_MODE:-false}" != "true" ]; then
-      _GRAPH_LIST=$(bash "$SCRIPT_DIR/bin/graph-op.sh" open-handoffs "$AUTHOR" 5 2>/dev/null || true)
-      if echo "$_GRAPH_LIST" | jq -e '.values | length > 0' >/dev/null 2>&1; then
-        ADDRESSED=$(echo "$_GRAPH_LIST" | jq -r '.values[][0]' 2>/dev/null | awk '!seen[$0]++' | while IFS= read -r _SID; do
-          # Two on-disk layouts: dated subdirs (YYYY-MM/DD-slug.md, the id's
-          # own shape) and flat files at the handoffs root. Probe both, else
-          # a graph-listed handoff silently vanishes from the greeting.
-          _MONTH="${_SID:0:7}"
-          _REST="${_SID:8}"
-          _F="$SCRIPT_DIR/memory/handoffs/$_MONTH/$_REST.md"
-          if [ -f "$_F" ]; then
-            echo "$_F"
-          elif [ -f "$SCRIPT_DIR/memory/handoffs/$_SID.md" ]; then
-            echo "$SCRIPT_DIR/memory/handoffs/$_SID.md"
-          fi
-        done | head -5)
-      fi
+    _RUNTIME_STATUS=$(bash "$SCRIPT_DIR/bin/activity-data.sh" 2>/dev/null || true)
+    if echo "$_RUNTIME_STATUS" | jq -e '.handoffs_to_me | type == "array"' >/dev/null 2>&1; then
+      ADDRESSED=$(echo "$_RUNTIME_STATUS" | jq -r '.handoffs_to_me[0:5][]?.filePath // empty' 2>/dev/null | while IFS= read -r _REL; do
+        _F=""
+        if [[ "$_REL" == memory/* ]]; then
+          _F="$SCRIPT_DIR/$_REL"
+        elif [[ "$_REL" == handoffs/* ]]; then
+          _F="$SCRIPT_DIR/memory/$_REL"
+        fi
+        [ -n "$_F" ] && [ -f "$_F" ] && printf '%s\n' "$_F"
+      done)
     fi
     # Match github username, display name, github_name first word, and people-file name
     # Handoff files may use "to: name", "**To**: name", or "To: name"
@@ -410,6 +421,8 @@ fi
       echo "$_GREP_PAT" | grep -qF "$_VARIANT" && continue
       _GREP_PAT="$_GREP_PAT\|[Tt]o[*]*: *$_VARIANT\|[Tt]o[*]*:$_VARIANT"
     done
+    # Compatibility fallback for an unavailable Runtime. It reads canonical
+    # Markdown directly and never calls graph or a control-plane retrieval API.
     if [ -z "$ADDRESSED" ]; then
       ADDRESSED=$(grep -rli "$_GREP_PAT" "$SCRIPT_DIR/memory/handoffs/" 2>/dev/null | sort -r | head -5 || true)
     fi
@@ -509,12 +522,20 @@ fi
 
 # 7. Graph health (background — zero added latency, runs in parallel; seeded)
 [ "$CTX_SEED_USED" != "true" ] && (
-  if [ "$LOCAL_MODE" = "true" ]; then
+  if [ "$LOCAL_MODE" = "true" ] || ! _graph_projection_enabled; then
     echo "skip"
-  elif bash "$SCRIPT_DIR/bin/graph.sh" test 2>/dev/null | grep -q "Connected"; then
-    echo "ok"
   else
-    echo "fail"
+    _GRAPH_TEST=$(bash "$SCRIPT_DIR/bin/graph.sh" test 2>/dev/null)
+    if printf '%s' "$_GRAPH_TEST" | grep -q "runtime_qmd_active"; then
+      # Not a failure: the activated Runtime/QMD does not use graph
+      # retrieval — the greeting already carries that receipt, so /checkup
+      # nagging here would be false alarm.
+      echo "skip"
+    elif printf '%s' "$_GRAPH_TEST" | grep -q "Connected"; then
+      echo "ok"
+    else
+      echo "fail"
+    fi
   fi
 ) > "$CTX_DIR/graph_health" 2>/dev/null &
 

package/runtime/codex/bin/lib/git-sync.sh

@@ -21,6 +21,8 @@
 FRAMEWORK_UPDATED="false"
 FRAMEWORK_UPDATED_COUNT=0
 FRAMEWORK_UPDATED_FILES=""
+HEALTH_RETRIEVAL="skip"
+SYNC_RECEIPT=""
 
 # The core repo's integration branch: "develop" unless egregore.json sets
 # base_branch. session-start.sh resolves this before sourcing; resolve it here
@@ -115,6 +117,7 @@ fi
 
 # Wait for all fetches
 wait 2>/dev/null || true
+type egregore_trace_mark >/dev/null 2>&1 && egregore_trace_mark "sync:fetch-join(refs_fresh=$_REFS_FRESH)"
 
 # --- Auto-update framework from upstream (deferred) ---
 # Moved AFTER setup_develop() so framework commits land on develop, not on
@@ -278,6 +281,17 @@ setup_develop() {
     COMMITS_AHEAD=$(git rev-list "origin/main..$BASE_BRANCH" --count 2>/dev/null || echo "0")
   fi
 
+  # Read-only invocations (tests, card/prompt renders exercised outside a
+  # real session start) stop here: the ref updates above are working-tree
+  # safe, but autosave commits, branch pushes, and parking the checkout on
+  # the base branch mutate a live repo out from under whatever session owns
+  # it.
+  if [ "${EGREGORE_GIT_SYNC_READONLY:-0}" = "1" ]; then
+    ACTION="ready"
+    SAVED_BRANCH=""
+    return 0
+  fi
+
   # Always start from the base branch
   # Every session begins there. Claude creates a fresh topic branch
   # (dev/{author}/{topic-slug}) when the user says what they're working on.
@@ -397,15 +411,65 @@ if [ "$IS_WORKTREE" != "true" ] && [ "$BASE_BRANCH_READY" = "true" ]; then
   _apply_framework_update 2>/dev/null || true
 fi
 
-# --- Sync memory (symlink or direct directory — both valid) ---
+# --- Synchronize canonical memory and retrieval readiness ---
+type egregore_trace_mark >/dev/null 2>&1 && egregore_trace_mark "sync:branch-setup"
 if [ -d "$SCRIPT_DIR/memory/.git" ]; then
-  MEM_LOCAL=$(git -C "$SCRIPT_DIR/memory" rev-parse HEAD 2>/dev/null || echo "")
-  MEM_REMOTE=$(git -C "$SCRIPT_DIR/memory" rev-parse origin/main 2>/dev/null || echo "")
-  if [ -n "$MEM_LOCAL" ] && [ -n "$MEM_REMOTE" ] && [ "$MEM_LOCAL" != "$MEM_REMOTE" ]; then
-    git -C "$SCRIPT_DIR/memory" pull origin main --quiet 2>/dev/null || true
+  # Runtime owns the whole receipt: canonical Git state gates the synchronous
+  # lexical refresh, then semantic construction is scheduled in the
+  # background. Capture stderr as part of a visible failure instead of turning
+  # a failed pull into a false "memory synced" state.
+  # When the attendant's warm marker proved a successful fetch round within
+  # the freshness window, the memory remote-tracking ref is already current —
+  # let the Runtime sync reuse it instead of fetching a second time. Boots
+  # without that proof keep the Runtime's own fetch as the canonical gate.
+  _SYNC_FETCH_FRESH=0
+  [ "${_REFS_FRESH:-false}" = "true" ] && _SYNC_FETCH_FRESH=1
+  SYNC_RECEIPT=$(EGREGORE_ROOT="$SCRIPT_DIR" \
+    PYTHONPATH="$SCRIPT_DIR${PYTHONPATH:+:$PYTHONPATH}" \
+    EGREGORE_SYNC_FETCH_FRESH="$_SYNC_FETCH_FRESH" \
+    python3 -m egregore_runtime.harness_cli sync --json 2>&1) || true
+  if printf '%s' "$SYNC_RECEIPT" | jq -e '.schema_version == "egregore-runtime-sync/v1"' >/dev/null 2>&1; then
+    if [ "$(printf '%s' "$SYNC_RECEIPT" | jq -r '.canonical_current')" = "true" ]; then
+      MEMORY_SYNCED="true"
+    else
+      MEMORY_SYNCED="false"
+      HEALTH_GIT="fail"
+    fi
+    if [ "$(printf '%s' "$SYNC_RECEIPT" | jq -r '.status')" = "ready" ]; then
+      HEALTH_RETRIEVAL="ok"
+    else
+      HEALTH_RETRIEVAL="fail"
+    fi
+  else
+    # Import/runtime failures are still retained as the startup receipt and
+    # surfaced through health; never call this synchronized.
+    MEMORY_SYNCED="false"
+    HEALTH_GIT="fail"
+    HEALTH_RETRIEVAL="fail"
+  fi
+
+  # Canonical synchronization and local retrieval readiness are independent
+  # health dimensions. A dirty or diverged memory repository must keep Git
+  # red, but it does not invalidate a BM25 index that is aligned with the
+  # exact local canonical snapshot. Consult the typed health surface after a
+  # failed/degraded sync so the greeting does not report retrieval unavailable
+  # when QMD can safely answer from that snapshot. Semantic warming is healthy.
+  if [ "$HEALTH_RETRIEVAL" != "ok" ]; then
+    RETRIEVAL_HEALTH=$(EGREGORE_ROOT="$SCRIPT_DIR" \
+      PYTHONPATH="$SCRIPT_DIR${PYTHONPATH:+:$PYTHONPATH}" \
+      python3 -m egregore_runtime.harness_cli status --json 2>/dev/null) || true
+    if printf '%s' "$RETRIEVAL_HEALTH" | jq -e '
+      .available == true
+      and .canonical_state_ready == true
+      and .bm25_ready == true
+      and .index_source_revision != null
+      and .index_source_revision == .source_revision
+    ' >/dev/null 2>&1; then
+      HEALTH_RETRIEVAL="ok"
+    fi
   fi
-  MEMORY_SYNCED="true"
 fi
+type egregore_trace_mark >/dev/null 2>&1 && egregore_trace_mark "sync:memory-retrieval"
 
 # --- Sync managed repos ---
 # Managed repos sync silently — they are a CLI concern and never render in the

package/runtime/codex/bin/lib/greeting.sh

@@ -103,7 +103,7 @@ if [ "$LOCAL_MODE" = "true" ]; then
   # Local mode: only check github + git, skip api-key/graph/telegram
   HAS_FAILURE="false"
   FAILED_SERVICES=""
-  for pair in "github:$HEALTH_GITHUB" "git:$HEALTH_GIT"; do
+  for pair in "github:$HEALTH_GITHUB" "git:$HEALTH_GIT" "retrieval:${HEALTH_RETRIEVAL:-skip}"; do
     svc="${pair%%:*}"
     svc_status="${pair#*:}"
     if [ "$svc_status" = "fail" ]; then
@@ -125,7 +125,7 @@ else
   # Connected mode: check all services
   HAS_FAILURE="false"
   FAILED_SERVICES=""
-  for pair in "github:$HEALTH_GITHUB" "git:$HEALTH_GIT" "api-key:$HEALTH_APIKEY" "graph:$HEALTH_GRAPH" "telegram:$HEALTH_TELEGRAM"; do
+  for pair in "github:$HEALTH_GITHUB" "git:$HEALTH_GIT" "retrieval:${HEALTH_RETRIEVAL:-skip}" "api-key:$HEALTH_APIKEY" "graph:$HEALTH_GRAPH" "telegram:$HEALTH_TELEGRAM"; do
     svc="${pair%%:*}"
     svc_status="${pair#*:}"
     if [ "$svc_status" = "fail" ]; then
@@ -141,7 +141,11 @@ else
     FOOTER_LEFT="  ✓ ready"
     FOOTER_RIGHT=""
     if [ "$MEMORY_SYNCED" = "true" ]; then
-      FOOTER_RIGHT="◆ memory synced"
+      if [ "${HEALTH_RETRIEVAL:-skip}" = "ok" ]; then
+        FOOTER_RIGHT="◆ memory + recall ready"
+      else
+        FOOTER_RIGHT="◆ memory synced · recall unavailable"
+      fi
     fi
 
     FL_LEN=${#FOOTER_LEFT}
@@ -152,6 +156,31 @@ else
   fi
 fi
 
+# Runtime update summary — cached durable state only, never a live probe, so
+# session start stays fast. One compact line; silent when nothing is staged.
+# Keyed by stable org identity composed with the main installation path
+# (mirrors egregore_runtime.upgrade.instance_key); no org_id → no summary.
+_UPGRADE_ORG=$(jq -r '.org_id // empty' "$SCRIPT_DIR/egregore.json" 2>/dev/null)
+_UPGRADE_MAIN=$(cd "${MAIN_PROJECT_DIR:-$SCRIPT_DIR}" 2>/dev/null && pwd -P || true)
+if [ -n "$_UPGRADE_ORG" ] && [ -n "$_UPGRADE_MAIN" ]; then
+  _UPGRADE_HASH=$(printf '%s|%s' "$_UPGRADE_ORG" "$_UPGRADE_MAIN" | shasum -a 256 2>/dev/null | cut -c1-16)
+  _UPGRADE_DIR="${EGREGORE_UPGRADE_ROOT:-$HOME/.egregore/runtime/upgrade}/${_UPGRADE_HASH}"
+  if [ -f "$_UPGRADE_DIR/active.json" ] \
+    && [ "$(jq -r '.retrieval // empty' "$_UPGRADE_DIR/active.json" 2>/dev/null)" = "runtime-qmd" ]; then
+    _UPGRADE_VER=$(jq -r '.active_version // "?"' "$_UPGRADE_DIR/active.json" 2>/dev/null)
+    echo "  ◆ runtime ${_UPGRADE_VER} active · organizational retrieval: Runtime/QMD"
+  elif [ -f "$_UPGRADE_DIR/state.json" ]; then
+    case "$(jq -r '.status // empty' "$_UPGRADE_DIR/state.json" 2>/dev/null)" in
+      preparing)
+        echo "  ◐ runtime update preparing in background — egregore settings" ;;
+      ready-to-activate)
+        echo "  ● runtime update ready to activate — egregore settings" ;;
+      failed)
+        echo "  ⚠ runtime update needs attention — egregore settings" ;;
+    esac
+  fi
+fi
+
 # Framework update trail — an auto-update overwrites every framework path from
 # upstream, local edits included. It used to surface as the footer word
 # "updated" in local mode and as nothing at all in connected mode, which is not
@@ -282,7 +311,7 @@ _print_pending_scroll_turns() {
           | select(if $mode == "scroll" then true else (is_applied($events; $turn.id) | not) end)]
       | length
     ' --arg mode scroll "$file" 2>/dev/null) || continue
-    [[ "$count" =~ ^[0-9]+$ ]] || return 0
+    [[ "$count" =~ ^[0-9]+$ ]] || continue
     [ "$count" -gt 0 ] && rows+="${safe_slug}"$'\t'"${count}"$'\n'
   done
 
@@ -326,7 +355,7 @@ _print_pending_scroll_turns() {
           | select((is_declined($events; $received; $turn.id) | not))]
       | length
     ' --arg mode harvest "$file" 2>/dev/null) || continue
-    [[ "$count" =~ ^[0-9]+$ ]] || return 0
+    [[ "$count" =~ ^[0-9]+$ ]] || continue
     [ "$count" -gt 0 ] && rows+="${safe_slug}"$'\t'"${count}"$'\n'
   done
 

package/runtime/codex/bin/lib/handoff-meta.sh

@@ -0,0 +1,97 @@
+# shellcheck shell=bash
+# Shared handoff metadata extraction for legacy markdown headers and YAML front matter.
+
+eg_handoff_md_field() {
+  local file="$1"
+  local key="$2"
+  local val
+
+  val="$(grep -m1 "^\*\*${key}\*\*:" "$file" 2>/dev/null | sed "s/^\*\*${key}\*\*:[[:space:]]*//" | xargs 2>/dev/null || true)"
+  if [ -z "$val" ]; then
+    val="$(grep -m1 "^\*\*${key}:\*\*" "$file" 2>/dev/null | sed "s/^\*\*${key}:\*\*[[:space:]]*//" | xargs 2>/dev/null || true)"
+  fi
+
+  printf '%s\n' "$val"
+}
+
+eg_handoff_yaml_field() {
+  local file="$1"
+  local key="$2"
+
+  sed -n '/^---$/,/^---$/p' "$file" 2>/dev/null \
+    | grep -m1 "^${key}:" 2>/dev/null \
+    | sed "s/^${key}:[[:space:]]*//" \
+    | sed 's/^"//; s/"$//' \
+    | sed "s/^'//; s/'$//" \
+    | xargs 2>/dev/null || true
+}
+
+eg_handoff_author_from_filename() {
+  local file="$1"
+  local name
+
+  name="$(basename "$file" .md)"
+  if [[ "$name" =~ ^[0-9]{2}-([^-]+)- ]]; then
+    printf '%s\n' "${BASH_REMATCH[1]}"
+  elif [[ "$name" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}-([^-]+)- ]]; then
+    printf '%s\n' "${BASH_REMATCH[1]}"
+  fi
+}
+
+eg_handoff_date_from_filename() {
+  local file="$1"
+  local name dir day
+
+  name="$(basename "$file" .md)"
+  dir="$(basename "$(dirname "$file")")"
+  if [[ "$dir" =~ ^[0-9]{4}-[0-9]{2}$ && "$name" =~ ^([0-9]{2})- ]]; then
+    day="${BASH_REMATCH[1]}"
+    printf '%s-%s\n' "$dir" "$day"
+  elif [[ "$name" =~ ^([0-9]{4}-[0-9]{2}-[0-9]{2})- ]]; then
+    printf '%s\n' "${BASH_REMATCH[1]}"
+  fi
+}
+
+eg_handoff_author() {
+  local file="$1"
+  local author
+
+  author="$(eg_handoff_md_field "$file" "Author")"
+  [ -z "$author" ] && author="$(eg_handoff_md_field "$file" "From")"
+  [ -z "$author" ] && author="$(grep -m1 '^From:' "$file" 2>/dev/null | sed 's/^From:[[:space:]]*//' | xargs 2>/dev/null || true)"
+  [ -z "$author" ] && author="$(eg_handoff_yaml_field "$file" "author")"
+  [ -z "$author" ] && author="$(eg_handoff_yaml_field "$file" "from")"
+  [ -z "$author" ] && author="$(eg_handoff_author_from_filename "$file")"
+
+  printf '%s\n' "$author" | sed 's/[[:space:]]*→.*//' | xargs 2>/dev/null || true
+}
+
+eg_handoff_topic() {
+  local file="$1"
+  local topic
+
+  topic="$(grep -m1 '^# ' "$file" 2>/dev/null | sed 's/^# //; s/^Handoff:[[:space:]]*//' | xargs 2>/dev/null || true)"
+  [ -z "$topic" ] && topic="$(eg_handoff_yaml_field "$file" "topic")"
+  printf '%s\n' "$topic"
+}
+
+eg_handoff_date() {
+  local file="$1"
+  local date
+
+  date="$(eg_handoff_md_field "$file" "Date")"
+  [ -z "$date" ] && date="$(grep -m1 '^Date:' "$file" 2>/dev/null | sed 's/^Date:[[:space:]]*//' | xargs 2>/dev/null || true)"
+  [ -z "$date" ] && date="$(eg_handoff_yaml_field "$file" "date")"
+  [ -z "$date" ] && date="$(eg_handoff_date_from_filename "$file")"
+  printf '%s\n' "$date"
+}
+
+eg_handoff_metadata_json() {
+  local file="$1"
+
+  jq -cn \
+    --arg author "$(eg_handoff_author "$file")" \
+    --arg topic "$(eg_handoff_topic "$file")" \
+    --arg date "$(eg_handoff_date "$file")" \
+    '{author:$author, topic:$topic, date:$date}'
+}

package/runtime/codex/bin/lib/worktree-links.sh

@@ -47,6 +47,12 @@ egregore_link_shared_state() {
 
     if [ -L "$dst" ]; then
       ln -sfn "$src" "$dst" 2>/dev/null || true
+    elif [ -f "$dst" ] && cmp -s "$src" "$dst"; then
+      # Older atomic writers could replace a shared-state symlink with an
+      # identical private file. Exact equality makes this repair lossless;
+      # differing files are left untouched for explicit reconciliation.
+      rm -f "$dst" 2>/dev/null || continue
+      ln -s "$src" "$dst" 2>/dev/null || true
     elif [ ! -e "$dst" ]; then
       ln -s "$src" "$dst" 2>/dev/null || true
     fi

package/runtime/codex/bin/node-run.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Resolve a working Node executable without trusting a broken version-manager
+# shim. Skills call this adapter instead of embedding Volta/NVM paths.
+working_node() {
+  local candidate
+  candidate="$(command -v node 2>/dev/null || true)"
+  if [ -n "$candidate" ] && "$candidate" --version >/dev/null 2>&1; then
+    printf '%s\n' "$candidate"
+    return 0
+  fi
+
+  for root in \
+    "${VOLTA_HOME:-$HOME/.volta}/tools/image/node" \
+    "${NVM_DIR:-$HOME/.nvm}/versions/node"
+  do
+    [ -d "$root" ] || continue
+    while IFS= read -r candidate; do
+      if [ -x "$candidate" ] && "$candidate" --version >/dev/null 2>&1; then
+        printf '%s\n' "$candidate"
+        return 0
+      fi
+    done < <(find "$root" -type f -path '*/bin/node' 2>/dev/null)
+  done
+
+  for candidate in /opt/homebrew/bin/node /usr/local/bin/node /usr/bin/node; do
+    if [ -x "$candidate" ] && "$candidate" --version >/dev/null 2>&1; then
+      printf '%s\n' "$candidate"
+      return 0
+    fi
+  done
+  return 1
+}
+
+NODE_BIN="$(working_node || true)"
+if [ -z "$NODE_BIN" ]; then
+  echo "egregore: Node is unavailable; install Node 22, then retry" >&2
+  exit 126
+fi
+
+exec "$NODE_BIN" "$@"

package/runtime/codex/bin/notification.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+EGREGORE_ROOT="$ROOT" PYTHONPATH="$ROOT${PYTHONPATH:+:$PYTHONPATH}" \
+  exec python3 -m egregore_runtime.notification_cli "$@"

package/runtime/codex/bin/observe-context.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+# Compile authorized organizational context for harness UserPromptSubmit hooks.
+# Input: the harness hook JSON on stdin. Output: a hook additionalContext JSON
+# envelope, or nothing when the prompt is not organizational recall.
+
+set -u
+
+ROOT="${EGREGORE_ROOT:-${CLAUDE_PROJECT_DIR:-$(cd "$(dirname "$0")/.." && pwd)}}"
+HARNESS="${1:-shell}"
+
+EGREGORE_ROOT="$ROOT" \
+EGREGORE_RUNTIME="$HARNESS" \
+PYTHONPATH="$ROOT${PYTHONPATH:+:$PYTHONPATH}" \
+  python3 -m egregore_runtime.harness_cli prompt-hook --harness "$HARNESS" || true

package/runtime/codex/bin/onboarding.sh

@@ -0,0 +1,6 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+export EGREGORE_ROOT="${EGREGORE_ROOT:-$ROOT}"
+exec python3 -m egregore_runtime.onboarding_cli "$@"

package/runtime/codex/bin/person.py

@@ -104,6 +104,10 @@ def display_slug(value: str) -> str:
 
 
 def atomic_text(path: Path, text: str) -> None:
+    # Worktrees and transient harness clones share personal state through a
+    # symlink to the primary instance. Replace the target, never the link.
+    if path.is_symlink():
+        path = path.resolve()
     path.parent.mkdir(parents=True, exist_ok=True)
     fd, temp_name = tempfile.mkstemp(prefix=path.name + ".", dir=path.parent)
     try:

package/runtime/codex/bin/person.sh

@@ -1,8 +1,8 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-# One identity spine for .egregore-state.json, memory/people, Supabase, and
-# Neo4j. GitHub's numeric id is the durable key when available.
+# Provider-independent identity spine for local state, canonical people files,
+# and the shared control plane. Neo4j is an optional derived projection.
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 SCRIPT_DIR="$ROOT"
@@ -18,6 +18,13 @@ usage() {
   exit 2
 }
 
+authorize_identity() {
+  permission="$1"
+  resource="$2"
+  EGREGORE_ROOT="$ROOT" python3 -m egregore_runtime.identity_cli \
+    authorize-self "$permission" "$resource" >/dev/null
+}
+
 remote_config() {
   api_url="${EGREGORE_API_URL:-$(_config_val api_url)}"
   api_key="${EGREGORE_API_KEY:-$(_load_env_var EGREGORE_API_KEY)}"
@@ -46,6 +53,12 @@ sync_remote_identity() {
       --max-time 10 2>/dev/null || true)"
     api_status="$(printf '%s' "$api_result" | jq -r '.status // "failed"' 2>/dev/null || echo failed)"
     platform_user_id="$(printf '%s' "$api_result" | jq -r '.user_id // empty' 2>/dev/null || true)"
+    if [ "$api_status" = "ok" ]; then
+      if ! printf '%s' "$api_result" | EGREGORE_ROOT="$ROOT" \
+        python3 -m egregore_runtime.identity_cli >/dev/null 2>&1; then
+        api_status="identity-reconcile-failed"
+      fi
+    fi
   fi
 
   # A removed membership is terminal until an admin explicitly re-invites
@@ -82,8 +95,11 @@ sync_remote_identity() {
     platformUserId:$platformUserId
   }')"
 
-  graph_status="failed"
-  if graph_result="$(bash "$ROOT/bin/graph.sh" query "
+  graph_enabled="${EGREGORE_GRAPH_PROJECTION:-0}"
+  graph_status="disabled"
+  if [ "$graph_enabled" = "1" ]; then
+    graph_status="failed"
+    if graph_result="$(bash "$ROOT/bin/graph.sh" query "
     OPTIONAL MATCH (legacy:Person)
     WHERE NOT coalesce(legacy.kind, '') IN ['external', 'identity_alias']
       AND coalesce(legacy.status, 'active') = 'active'
@@ -140,11 +156,12 @@ sync_remote_identity() {
     MATCH (o:Org {id: \$_org})
     MERGE (p)-[:MEMBER_OF]->(o)
     RETURN p.personId AS personId
-  " "$params" 2>/dev/null)"; then
-    if printf '%s' "$graph_result" | jq -e \
-      --arg personId "$(printf '%s' "$identity" | jq -r .person_id)" \
-      '.values[0][0] == $personId' >/dev/null 2>&1; then
-      graph_status="synced"
+    " "$params" 2>/dev/null)"; then
+      if printf '%s' "$graph_result" | jq -e \
+        --arg personId "$(printf '%s' "$identity" | jq -r .person_id)" \
+        '.values[0][0] == $personId' >/dev/null 2>&1; then
+        graph_status="synced"
+      fi
     fi
   fi
 
@@ -188,7 +205,9 @@ sync_remote_identity() {
 
   status="synced"
   [ "$api_status" = "ok" ] || status="partial"
-  [ "$graph_status" = "synced" ] || status="partial"
+  if [ "$graph_enabled" = "1" ] && [ "$graph_status" != "synced" ]; then
+    status="partial"
+  fi
   printf '%s' "$identity" | jq \
     --arg status "$status" \
     --arg supabase "$api_status" \
@@ -366,6 +385,7 @@ command="${1:-}"
 [ -n "$command" ] || usage
 
 if [ "$command" = "show" ]; then
+  authorize_identity read "identity:self"
   jq '{
     person_id,
     display_name,
@@ -382,6 +402,7 @@ if [ "$command" = "show" ]; then
 fi
 
 if [ "$command" = "backfill" ]; then
+  authorize_identity administer "identity:roster"
   backfill_people "$@"
   exit $?
 fi
@@ -413,6 +434,13 @@ case "$command" in
   *) usage ;;
 esac
 
+# Bootstrap reconciliation is allowed to establish the first ActorContext;
+# every explicit self-service mutation must authorize before provider lookup,
+# canonical profile writes, control-plane reconciliation, or projection.
+if [ "$command" = "set-name" ] || [ "$command" = "set-email" ]; then
+  authorize_identity administer "identity:self"
+fi
+
 github_args=()
 state_github="$(jq -r '.github_username // empty' "$STATE" 2>/dev/null)"
 if command -v gh >/dev/null 2>&1; then
@@ -437,8 +465,13 @@ fi
 if [ "$(jq -r '.onboarding_complete // false' "$STATE" 2>/dev/null)" = "true" ]; then
   onboard_args=(--onboarded)
 fi
+# macOS still ships Bash 3.2, where expanding an empty array under `set -u`
+# raises "unbound variable". Disable nounset only for this argument expansion;
+# every value remains passed as a separately quoted argument.
+set +u
 identity="$(python3 "$PERSON_PY" sync-local \
   "${display_args[@]}" "${github_args[@]}" "${email_args[@]}" "${onboard_args[@]}")"
+set -u
 
 if [ "$(_detect_mode)" = "local" ]; then
   printf '%s' "$identity" | jq '. + {status:"synced-local",supabase:"unavailable",graph:"unavailable"}'