create-egregore 0.20.2 → 0.21.0-runtime-mvp.2

package/runtime/prime/.codex/skills/view/SKILL.md

@@ -1,156 +1,160 @@
 ---
 name: view
-description: 'Render Egregore data and documents as branded browser artifacts. Use when the user invokes /view or $view, asks to show something visually, open it in a browser, make a document readable or presentable, render a quest/handoff/activity/board/network, or synthesize a visual artifact from a topic.'
+description: 'Render Egregore data and documents as branded local browser artifacts. Use for $view, requests to show something visually, open it in a browser, make a document presentable, render a quest/handoff/activity/board/network, or synthesize a visual artifact from a topic. Publishing is a separate explicit SHARE action.'
 ---
 
 # Egregore View
 
-Native Codex Egregore skill. Use only inside an Egregore checkout.
-
-Resolve a file or live Egregore surface, render it with the in-repo artifact
-tooling, open it, and report the concrete output path. Run the workflow inline;
-do not invoke Claude Code commands or delegate through Loom.
+Native Codex Egregore skill. Resolve authorized content, render locally, open
+the result, and report its concrete path. Run inline; Codex does not route
+through Loom or minion.
 
 ## Structured UX parity
 
-The visible result is the browser artifact and a compact receipt. Preserve the
-typed artifact templates, designed document composition, exact file path, and
-stable board URL when available. Do not replace the artifact with a prose
-summary or expose raw renderer output.
-
-## Resolve the request
-
-1. Verify `bin/agent.sh` exists. If not, say this is not an Egregore checkout.
-2. Parse an optional type followed by a name:
-   - `quest` from `memory/quests/`
-   - `handoff` from `memory/handoffs/` recursively
-   - `activity`, `board`, or `network` with no source file
-   - `document` for any markdown file
-3. Treat an argument containing `/` or ending in `.md` as a direct path. Use it
-   if it exists and infer the type from its directory.
-4. With no explicit type, search in this order: quests, handoffs, knowledge.
-   Prefer exact basename matches, then case-insensitive partial matches. For
-   handoffs, prefer the newest matching dated path.
-5. If several files match, use structured Codex question tooling when
-   available; otherwise ask one concise plain-text question listing the paths.
-6. If no file matches and the input is a topic or question, synthesize a
-   temporary markdown document from relevant memory, repository files, and
-   conversation context at
-   `/tmp/egregore-artifacts/synthesized-<slug>.md`. If the input clearly names
-   a missing file, report it as missing instead of inventing a document.
-
-## Select the renderer
-
-Prefer the checked-out package so local changes are exercised and no package
-download is needed:
+Preserve typed artifact templates, designed document composition, the exact
+local file path, and an approved hosted URL when one was actually returned.
+Never replace the browser artifact with prose or expose raw renderer output.
+
+## Source boundary
+
+Resolve deictic requests from the current conversation before organizational
+retrieval. When `this`, `that`, `it`, or `the above` unambiguously refers to
+the single artifact just created, accepted, or shown, reuse its full content
+already in context and stage it verbatim. If that content is collapsed or the
+prior receipt supplies only a canonical path, open that exact path once through
+`bin/search.sh open`; do not run `bin/search.sh query` to rediscover a known
+artifact.
+
+Resolve organizational sources from the attached authorized
+`EGREGORE_ORG_CONTEXT_V1` block first. Reuse its opened content and do not
+repeat retrieval or reopen it merely for verification. Stage attached content
+as a temporary render source.
+
+When the requested organizational source is absent, run Runtime Observe once:
+
+```bash
+bash bin/search.sh query "<artifact name and optional type>" -n 6
+bash bin/search.sh open "<selected memory/... path>"
+```
+
+Open only a selected returned canonical path and write it to a temporary render
+source. Never scan `memory/`, call QMD or Graph, or pass a raw canonical path to
+the renderer. A direct `memory/...` request still goes through
+`bin/search.sh open`. An explicit non-memory path inside the current repository
+may be rendered as a repository document, but is not organizational memory.
+
+If several authorized results match, ask one concise choice question. If no
+specific file exists and the request is a topic, synthesize only from the
+attached context or one Observe result. Read repository code only when the user
+explicitly requested codebase synthesis.
+
+## Artifact types
+
+- `quest` and `handoff` — infer from the authorized canonical path, render the
+  staged content with the matching typed template.
+- `document` — any authorized markdown or explicit repository document.
+- `activity`, `board`, and `network` — use the renderer's typed Runtime-backed
+  live surface without pre-scanning memory.
+
+## Local renderer
+
+Prefer the checked-out renderer and always run Node through Egregore's runtime
+adapter. A source checkout must never fall through to a stale global renderer:
 
 ```bash
-RENDER="npx egregore-artifacts@latest"
 if [ -f packages/egregore-artifacts/bin/cli.js ] && \
    [ -d packages/egregore-artifacts/node_modules/react ]; then
-  RENDER="node packages/egregore-artifacts/bin/cli.js"
+  RENDER=(bash bin/node-run.sh packages/egregore-artifacts/bin/cli.js)
+elif [ -f packages/egregore-artifacts/bin/cli.js ]; then
+  echo "The checked-out artifact renderer is missing its local dependencies." >&2
+  exit 1
+elif command -v egregore-artifacts >/dev/null 2>&1; then
+  RENDER=(bash bin/node-run.sh "$(command -v egregore-artifacts)")
+else
+  echo "The local artifact renderer is not installed for this instance." >&2
+  exit 1
 fi
 ```
 
-If the local package exists without dependencies, install its dependencies or
-use the `npx` fallback. Do not block a render on optional connected services.
-
-## Render typed artifacts
+Do not run `npx`, install packages, or contact a package registry as a hidden
+fallback. Do not probe alternate renderers with `--help`; invoke the selected
+renderer exactly once and use its reported HTML path rather than guessing it.
 
 Run the matching command:
 
 ```bash
-$RENDER quest <quest-file>
-$RENDER handoff <handoff-file>
-$RENDER activity
-$RENDER board
-$RENDER network
-$RENDER document <markdown-file>
+"${RENDER[@]}" quest <staged-source>
+"${RENDER[@]}" handoff <staged-source>
+"${RENDER[@]}" document <staged-source>
+"${RENDER[@]}" activity
+"${RENDER[@]}" board
+"${RENDER[@]}" network
 ```
 
-Use the renderer's reported HTML path rather than guessing it.
+For documents, use the checked-out generative-UI synthesis graph when present:
+select objective, audience, register, palette, and grammar from the content,
+resolve a brief, and pass `--brief`. Never fetch the design layer; render
+without a brief when it is unavailable.
 
-For documents, walk the generative-UI synthesis graph in
-`packages/design-system/generative-ui/skill/SKILL.md`: select one id each for
-objective, audience, register, palette, and grammar from the document's
-substance, record one line of judgment for each, resolve the brief, and pass it
-with `--brief`. If that layer is unavailable, render without the brief.
+The deterministic renderer already owns its light/dark theme contract. Do not
+invoke or reread a separate visual-theme skill for an ordinary render. Apply
+the Dark Mode contract only while authoring composed HTML or changing renderer
+code.
 
-## Compose flagship documents
+## Explicit composition
 
-Composition is the default for a multi-section strategy, briefing, explainer,
-analysis, decision document, or anything explicitly requested as composed,
-presentable, client-facing, designed, or `--compose`. Use the fast renderer for
-typed artifacts, short utility documents, `--fast`, or `--floor`.
+Compose inline only when the user explicitly asks for `--compose`, a
+designed/flagship artifact, a client-facing treatment, or the design trace.
+Otherwise use the deterministic renderer.
 
 For composition:
 
-1. Read the source document in full.
+1. Use only the staged authorized source.
 2. Copy `.codex/skills/view/assets/compose-scaffold.html` to
    `/tmp/egregore-artifacts/composed-<slug>.html`.
-3. Fill every placeholder and walk the generative-UI graph for the manifest's
-   register, palette, grammar, and trail.
-4. Transform rather than mirror the markdown:
-   - write a two-tone claim-led hero and italic standfirst;
-   - make section headings state findings, not repeat source headings;
-   - choose components by meaning: ledger for Q/A, claims for numbers, panels
-     for options, steps for sequences, feature rows for capability/status,
-     threads for decisions, gap cards for negatives, and a readout for the
-     honest bottom line;
-   - create one anchored navigation item per composed section.
-5. Keep every theme-sensitive color as `var(--token)`. Never emit inline hex
-   colors in composed content. Preserve the scaffold's no-flash theme restore,
-   `<html data-theme>`, and light/auto/dark behavior.
-6. Verify no placeholders remain, open the HTML with the platform browser
-   opener, and report `Renderer: composed (band 5, inline)`.
-
-## Publish the stable board
-
-After `$RENDER board`, publish best-effort only when `egregore.json` declares a
-connected configuration:
+3. Choose editorial or technical register before writing. Preserve technical
+   claims and convert structure, not voice.
+4. Fill every placeholder, choose components by meaning, and create one nav
+   anchor per section.
+5. Keep theme-sensitive colors as `var(--token)` and verify every used token in
+   vellum and nocturne themes.
+6. Open the completed HTML and report
+   `Renderer: composed (band 5, inline)`.
 
-```bash
-_API_URL=$(jq -r '.api_url // empty' egregore.json 2>/dev/null)
-_MODE=$(jq -r '.mode // empty' egregore.json 2>/dev/null)
-if [ -n "$_API_URL" ] && [ "$_MODE" != "local" ]; then
-  ORG_NAME=$(jq -r '.org_name // .slug' egregore.json)
-  bash bin/publish-artifact.sh board memory/board/board.json \
-    --id board \
-    --title "Project Board — $ORG_NAME" \
-    --author "$ORG_NAME" \
-    --description "Latest board for $ORG_NAME" 2>/dev/null &
-fi
-```
+## SHARE is separate
+
+Local render/open is the complete default action. Never publish, replace a
+stable hosted view, or publish linked references because the user asked to
+view something.
+
+Only when the user explicitly requests publishing:
+
+1. Authorize `SHARE` for the exact staged artifact.
+2. Show a Publish / Cancel checkpoint containing organization, destination,
+   title, source, and whether a stable URL will be replaced.
+3. After approval, invoke the Runtime publication adapter once. For the board,
+   the existing stable-id adapter may use `--id board`.
+4. Report a hosted URL only when the adapter actually returns it.
 
-The local artifact remains the successful result if publishing fails. In local
-mode, do not call graph or notification services.
+Notification consent and SHARE consent are separate. A publish approval never
+authorizes a message, and a notification approval never authorizes publishing.
 
 ## Report
 
-Return only the useful receipt after the browser opens:
+After local open:
 
 ```text
 ✓ Artifact opened in browser
   File: /tmp/egregore-artifacts/<rendered-file>.html
 ```
 
-For a connected board, append:
-
-```text
-◆ https://egregore.xyz/view/<org-slug>/board   (stable — refresh for latest)
-```
-
-Emit telemetry best-effort after completion:
-
-```bash
-bash bin/telemetry.sh emit "command" '{"command":"view"}' 2>/dev/null &
-```
+Append a hosted URL only after an approved SHARE action succeeds. Emit
+telemetry best-effort through `bin/telemetry.sh`; telemetry is not publication.
 
 ## Rules
 
-- Keep filesystem resolution sufficient in local mode; the graph is optional.
-- Preserve auto-linked backtick references handled by
-  `bin/publish-references.sh` when publishing markdown.
-- Never install a global renderer package as the first choice.
+- Reuse attached `EGREGORE_ORG_CONTEXT_V1`; Observe at most once if absent.
+- Never bypass Runtime authorization with filesystem, QMD, Graph, or API reads.
+- Never make a hidden network call or package installation.
+- Never publish without a fresh explicit SHARE checkpoint.
 - Never call the deprecated `egregore-handoff` CLI.
-- Never claim publishing succeeded unless a URL was actually returned.

package/runtime/prime/.codex/skills/wrap/SKILL.md

@@ -1,58 +1,62 @@
 ---
 name: wrap
-description: Wrap an Egregore session when the user invokes /wrap or $wrap, or says they are done, wrapping up, or at a stopping point in Codex.
+description: Wrap an Egregore session when the user invokes /wrap or $wrap, or says they are done, wrapping up, or at a stopping point. This creates personal canonical closure; route assigned continuation to $handoff and save-without-closing to $save.
 ---
 
-# Egregore Wrap
+# Egregore wrap
 
-Native Codex Egregore skill. Use this inside an Egregore checkout with
-`bin/agent.sh`. The command routes through `bin/capture-run.sh --mode personal`.
-It writes the personal record first, appends graph and handoff-completion events
-to the local WAL, and reconciles them detached; do not wait for or repeat that
-background work.
+Create one personal session record in `memory/wraps/`. A wrap records the
+current actor's completed work, verification, and open threads. It is not a
+handoff, publication, notification, or automatic completion of another
+artifact.
+
+Canonical Markdown and Git provenance are authoritative. The Egregore Runtime
+owns authorization, ActorContext resolution, persistence, provenance,
+retrieval refresh, background embedding, and content-free telemetry.
 
 ## Flow
 
-1. Synthesize a topic, a one to three sentence summary, and concise open notes
-   from the current session.
-2. If the session has ambiguous or potentially misleading state, confirm with
-   the user. Use structured Codex question tooling when available; otherwise
-   show numbered choices plus `Other:` and wait.
-3. Resolve the author from `.egregore-state.json` `github_username`, then
-   `name`, then git config.
-4. Write the notes to a temp markdown file.
-5. Run:
+1. Reuse the conversation and relevant `EGREGORE_ORG_CONTEXT_V1` evidence. Do
+   not repeat organizational retrieval just to prepare a wrap.
+2. Derive a short topic, a two-to-four sentence summary, completed outcomes,
+   verification, and concise open threads. Never present unverified work as
+   complete.
+3. Confirm once only when the summary is materially ambiguous. Preserve exact
+   user-supplied wrap wording without another approval loop.
+4. If project changes need delivery, invoke `$save` once before wrapping. Do
+   not implement Git mechanics here or save again after the wrap succeeds.
+5. Write a temporary Markdown body with the relevant subset of `Summary`,
+   `Completed`, `Verification`, and `Open Threads`.
+6. Call the Runtime-neutral adapter exactly once:
 
 ```bash
-bin/agent.sh wrap --from "$AUTHOR" --topic "$TOPIC" --summary "$SUMMARY" --body-file "$BODY_FILE"
+bash bin/agent.sh wrap \
+  --topic "$TOPIC" \
+  --summary "$SUMMARY" \
+  --body-file "$BODY_FILE"
 ```
 
-6. If `git status --porcelain` reports repo changes after the wrap, run:
+The adapter performs one canonical transaction:
 
-```bash
-bin/agent.sh save --message "Wrap: $TOPIC" --topic "$TOPIC"
-```
+`authorize → persist Markdown → Git provenance → retrieval update → background embed → telemetry`
+
+Do not call `artifact-writeback.sh`, `capture-run.sh`, Git, QMD, graph,
+telemetry, publication, or notification mechanics directly. On failure, report
+the concise error and stop; never bypass the Runtime boundary.
+
+## Wrap is not handoff lifecycle
 
-7. Report the `memory/wraps/...` path and whether code changes were saved.
+- Use `$handoff` when another person must receive or continue work.
+- A wrap never silently completes, expires, or supersedes a handoff, quest,
+  todo, or thread. Age alone is never completion evidence.
+- Its canonical receipt may be cited by a later, explicitly authorized
+  lifecycle transition, which must verify actor membership, target revision,
+  and typed evidence separately.
+- Open threads remain in the wrap even if promoted through their own Runtime
+  quest/todo/thread action.
 
 ## Output
 
-Structured UX parity is required. Finish with the standard Egregore wrap
-confirmation TUI, not a prose-only summary:
-
-- Use a 72-column outer box with only the four standard line patterns:
-  top rule, separator rule, content line, bottom rule.
-- Header: `WRAP`, author, and date.
-- Body: topic, one compact summary, open threads or "No open threads", and
-  the `memory/wraps/...` path.
-- Footer: saved/pushed status. If code changes were saved, show that. If the
-  wrap only touched memory, say so.
-- Output the box directly, preferably in a `text` fenced block, with no
-  narration before it.
-
-## Rules
-
-- Do not use Claude Code commands.
-- Do not invent finished work. Separate completed work, verification, and open
-  follow-ups.
-- If save fails, report the failure and leave the local commits untouched.
+Return a compact receipt with actor label, topic, summary, open-thread count,
+the `memory/wraps/...` path, and project save/writeback status. Do not claim
+graph, publish, notify, or share effects that did not happen.

package/runtime/prime/.codex/spec-manifest.json

@@ -5,7 +5,7 @@
     {
       "section": "(intro)",
       "action": "replace",
-      "sourceHash": "a33ca691aacf",
+      "sourceHash": "feebbe4543e2",
       "note": "Reframed for Codex: names AGENTS.md as the delivery surface and the manifest; \"organizations using Claude Code\" generalized."
     },
     {
@@ -35,7 +35,7 @@
     {
       "section": "After Greeting — BRANCH ON FIRST RESPONSE",
       "action": "replace",
-      "sourceHash": "3bac01c0a00a",
+      "sourceHash": "58978a357792",
       "note": "EnterWorktree -> bin/agent.sh branch with git checkout fallback; AskUserQuestion -> numbered options in plain text; branch-guard mapped to .codex/hooks/branch-guard.js with instruction fallback; plan-mode note dropped (no plan mode on Codex); /branch + /onboarding -> skill tokens. Handoff claiming and repoState auto-checkout bash kept verbatim (pure git); surrounding prose compressed 2026-08 for the 32 KiB budget, every rule retained."
     },
     {
@@ -45,15 +45,15 @@
       "note": "Kept verbatim — shell facts, runtime-neutral."
     },
     {
-      "section": "Knowledge Graph",
+      "section": "Optional Knowledge Graph Projection",
       "action": "keep",
-      "sourceHash": "b5d9a149f1a6",
-      "note": "Kept verbatim — bin/graph.sh is runtime-neutral."
+      "sourceHash": "557b6fe48eca",
+      "note": "Kept verbatim — graph traversal remains an explicit optional adapter and canonical evidence wins."
     },
     {
       "section": "Egregore Retrieval Beat",
       "action": "keep",
-      "sourceHash": "0c4d4715fb13",
+      "sourceHash": "6c5cbb0d1c9a",
       "note": "Kept verbatim — product attribution applies across runtimes."
     },
     {
@@ -95,13 +95,13 @@
     {
       "section": "Working Conventions",
       "action": "keep",
-      "sourceHash": "2e4ec18b72a6",
+      "sourceHash": "5001a5c9e645",
       "note": "Kept verbatim."
     },
     {
       "section": "Command Awareness",
       "action": "keep",
-      "sourceHash": "be00d1fc715f",
+      "sourceHash": "40ddb59f17b1",
       "note": "Prepended the Codex command surface (skill tokens, native vs adapter split, $save abstraction); disambiguation map kept with /x -> $x token rendering. Tokens with no Codex skill (e.g. /loop, a Claude Code harness feature) are left as-is."
     },
     {
@@ -119,7 +119,7 @@
     {
       "section": "Mode",
       "action": "keep",
-      "sourceHash": "0f74e18fd1b4",
+      "sourceHash": "8a821c2f41c0",
       "note": "Kept; /env and /checkup rendered as $skill tokens."
     },
     {

package/runtime/prime/.prime/agent/APPEND_SYSTEM.md

@@ -88,7 +88,7 @@ Sequence: **intent → safe workspace → relevant context → consequential ass
 When the user continues the current branch's work or asks to resume — sequence: **continuation intent → prior workspace → restored context → open threads → resumed execution**:
 
 - Do not create a new workspace for the same topic. After confirming relevance, say: `I found your previous work on **{topic}** and restored its workspace and context.` Show `Workspace: {branch} (worktree).` secondarily.
-- Retrieve relevant decisions, handoffs, or prior work; keep the Retrieval Beat and `↳ Context restored:` receipt. Never claim context was restored from a branch name alone.
+- Interpret continuation from meaning, not fixed phrases. Reuse sufficient `EGREGORE_ORG_CONTEXT_V1`; otherwise make exactly one `bash bin/search.sh query "<concept>" -n 6 --compact` call. Keep the Retrieval Beat and `↳ Context restored:` receipt. Never infer context from a branch or substitute status dashboards, Git, Graph, or raw memory scans.
 - Name only unresolved items that could change the next move, state the next outcome briefly, and continue without replaying setup.
 
 ### Handoff claiming
@@ -157,22 +157,20 @@ In connected mode, infrastructure credentials (Neo4j, Telegram) live on the API
 
 ---
 
-## Knowledge Graph
+## Optional Knowledge Graph Projection
 
-**Connected mode only.** For the following intents, the named read must be the
-first retrieval action. Run the exact command with its safe default limit before
-opening files, running broad grep, inspecting `graph-op.sh`, or writing Cypher:
+**Connected mode only, explicit opt-in only, and never part of default
+retrieval.** Egregore Runtime Observe backed by the instance-owned QMD adapter
+is the default organizational retrieval path in every mode. Never infer graph
+use from words such as handoff, question, meeting, status, current work, or
+lineage. Those intents still enter Runtime/QMD unless the user explicitly asks
+for graph relationships or a workflow explicitly requests optional Connected
+enrichment.
 
-- current work addressed to someone → `bash bin/graph-op.sh open-handoffs "<user>"`
-- unanswered questions for someone → `bash bin/graph-op.sh pending-questions "<user>"`
-- handoff → implementation → branch/PR/direction → `bash bin/graph-op.sh lineage "<topic>"`
-- company/person/topic across meetings → `bash bin/graph-op.sh meeting-history "<entity-or-topic>"`
-
-A question about calls, meetings, transcripts, demos, or how a conversation
-evolved is always `meeting-history` intent when it names a company, person, or
-topic—even when it does not ask for "current" or "live" state. Pass the shortest
-discriminative entity or topic (for example, `meeting-history "42CAP"`), not the
-whole question.
+For an explicit graph-projection request, use the smallest named read that
+answers it: `open-handoffs`, `pending-questions`, `lineage`, or
+`meeting-history`. Verify projection freshness/coverage and open its canonical
+`evidencePath` before acting. Canonical Markdown wins on disagreement.
 
 Run `catalog` only when the route is unclear. Named reads return bounded stable fields and exact canonical `evidencePath` pointers; open only the returned files needed to answer. When a read reports partial coverage, use `unprojectedPaths` rather than claiming those files are represented in the graph. Use `bin/graph.sh` for unsupported Neo4j queries and never construct curl calls directly. See DEVELOPMENT.md §1 for the schema. In local mode there is no graph; read `memory/` directly.
 
@@ -180,47 +178,52 @@ Run `catalog` only when the route is unclear. Named reads return bounded stable
 
 ## Egregore Retrieval Beat
 
-Egregore's organizational search is a product surface, not indistinguishable
-agent tool use. For each user-directed lookup of organizational knowledge,
-show exactly one visible attribution line:
+For each user-directed organizational lookup, show exactly one visible line:
 
 - memory-only retrieval:
   `⌕ Egregore · searching your organization’s memory`
 - retrieval that actually queries the connected graph:
   `⌕ Egregore Connect · searching your organization’s memory and relationships`
 
-**Visibility is the contract.** Emit the applicable line verbatim as a
+Runtime owns retrieval; no agent feature flag does. `EGREGORE_ORG_CONTEXT_V1`
+is only the schema label. When attached, authorized retrieval is complete:
+never query again that turn, and state any evidence gap. `OPENED_BY_OBSERVE`
+means the evidence is open. A later explicit search starts a new turn.
+
+**Visibility is the contract.** Emit it verbatim as a
 standalone assistant message before the first Bash, Grep, Glob, Read, or other
-retrieval tool call. Shell/tool output does not satisfy this requirement:
-Claude Code and other harnesses may collapse it. Do not paraphrase the line or
-replace it with generic narration such as “I’ll search org memory.”
+retrieval tool call.
+Shell/tool output does not satisfy this requirement. Do not paraphrase the line.
 
-Use the memory form for local/filesystem-only organizational retrieval. Use the
-Connect form when the retrieval route will query the connected graph, including
-automatic graph enrichment in `bin/search.sh query`, a graph-only named read,
-or exploratory Cypher. Emit once for the whole retrieval episode, not once per
-hop. The banner printed by `bin/search.sh` remains a direct-shell fallback and
-does not replace the assistant-visible beat.
+Use the memory form normally; use Connect only for an explicit graph traversal
+that actually runs. Emit once per episode. A `bin/search.sh` banner is only a
+shell fallback and does not replace this visible beat.
 
-**Routing is part of the contract.** For organizational history, decisions,
-handoffs, meetings, people, pricing, strategy, or other shared-memory content,
-the first retrieval action is:
+**Routing:** Organizational recall always enters Egregore Runtime. The model is
+the semantic intent authority, deciding from meaning rather than fixed phrases.
+Observe is optional prefetch; a prefetch miss never means recall is unnecessary.
+Without sufficient attached context, make exactly one Runtime/QMD call:
 
 ```bash
-bash bin/search.sh query "<concept>" -n 6
+bash bin/search.sh query "<concept>" -n 6 --compact
 ```
 
-Do not start by resolving `memory/` to its sibling repository, changing
-directory into that absolute path, or improvising `grep`/`ls` over it. The
-search entry point owns keyword/semantic selection and automatically attaches
-graph state in connected mode. Read or grep the returned `memory/...` source
-paths only after the ranked call when verification needs the full document.
-Native Grep/Glob remain the right first action for repository code, filenames,
-and exact error strings—not organizational recall.
-
-Do not emit the beat for native repository/code search, Git inspection, startup
-context hydration, graph writes, ingestion projection, background sync,
-maintenance, or command-internal queries that are not answering a user lookup.
+Search output is model-internal: show only the retrieval line and receipts —
+never ranked blocks, file/rank/excerpt metadata, or raw JSON.
+
+Do not resolve `memory/` to its sibling repo or start with raw `grep`/`ls`.
+Search owns lexical/semantic selection and attaches no graph by default. Open a
+source only when its excerpt cannot support a necessary claim. For current
+team/person synthesis, retain known organization/member names and choose
+`--recent-days` plus `--min-evidence`. Use native
+Grep/Glob for code and exact errors. `/activity`, `/dashboard`, and `/project`
+display bounded status surfaces only when named or directly requested as a
+card. Questions asking for an explained synthesis of current organizational
+work are Runtime/QMD recall, as is prior-work discovery. Do not run full
+hybrid retrieval on unrelated prompts or infer graph from recall intent.
+
+Do not emit the beat for code search, Git inspection, startup hydration, graph
+writes, ingestion, background sync, maintenance, or internal queries.
 Never name `Egregore Connect` unless a graph read will actually run.
 
 ---
@@ -320,7 +323,7 @@ Repos in `egregore.json` → `repos[]` are cloned as siblings (`../{repo}/`). Ea
 
 ## Working Conventions
 
-- Check memory before starting unfamiliar work — `bash bin/search.sh query "topic"` (hybrid search over all of `memory/`)
+- For unfamiliar org work, use Observe context; if absent, run `bash bin/search.sh query "topic" --compact`.
 - Document significant decisions in `memory/knowledge/decisions/`
 - After substantial sessions, log to `memory/handoffs/` and update `index.md`
 
@@ -352,10 +355,16 @@ Invoke commands from user intent — don't wait for the slash. Each command file
 
 **Disambiguation:**
 - Knowledge: `/reflect` (share-ready) · `/note` (half-baked) · `/deep-reflect` (deep research over memory — questions AND cross-referencing) · `/archive` (AI patterns) · `/audit` (evidence-mined forensic sweep of the org's own record — any target)
-- Finding things — **organizational recall starts with `bash bin/search.sh query`** (ranked filesystem retrieval in OSS; automatic relationship/status enrichment in Connect). Use `bin/graph.sh` named reads first only for a pure relationship/status traversal. Use Grep/Glob first for repository code, filenames, and exact error strings—not shared-memory recall. Do not `cd` into the sibling memory repository.
-- Finding **something you generated** (a scroll, handoff, emissary, decision, any hosted egregore.xyz link): `bash bin/artifacts.sh find <query>`. Every generative surface already records into memory — hosted artifacts self-register into `memory/artifacts/` at publish (and the record is committed+pushed, so it's findable from *any* session, not just the one that made it); handoffs land in `memory/handoffs/`, emissaries in `memory/handoffs/outbound/`, decisions/findings/patterns in `memory/knowledge/`. The finder searches **all** of them, ranks title/topic matches above passing body mentions, tags each hit by type (`[document]`/`[handoff]`/`[emissary]`/`[decision]`), and surfaces the shareable URL. Findable by **content, not just name**, across all three layers — grep-first for OSS, folding in search + graph when available. *"bring me the artifact where I laid out our GTM plan"* → this.
+- Finding things — **organizational recall starts with automatic Observe**.
+  Never query twice in one prompt. Without its context block, use
+  `bash bin/search.sh query`. Use Grep/Glob for code and exact errors, not org
+  recall. Do not `cd` into the sibling memory repository.
+- Finding **something you generated** (a scroll, handoff, emissary, decision, any hosted egregore.xyz link): `bash bin/artifacts.sh find <query>`. Every generative surface records into memory — hosted artifacts self-register into `memory/artifacts/` at publish (committed+pushed, findable from any session); handoffs in `memory/handoffs/`, emissaries in `memory/handoffs/outbound/`, decisions/findings/patterns in `memory/knowledge/`. The finder searches all of them by **content, not just name**, ranks title/topic matches above body mentions, tags hits by type (`[document]`/`[handoff]`/`[emissary]`/`[decision]`), and surfaces the shareable URL — grep-first in OSS, search + graph when available. *"bring me the artifact where I laid out our GTM plan"* → this.
 - Artifacts with questions: `/scroll` (living paper + embedded harvest, updates in place) · `/view` (static render) · `/harvest` (elicitation, no published face) · `/mock` (pre-build walkthrough of decided design — gauge per stop, verdict copy-back)
-- Status: `/dashboard` (personal) · `/activity` (org-wide)
+- Explicit bounded status: `/dashboard` (personal) · `/activity` (org-wide) ·
+  `/project` (named project). These display cards when named or directly
+  requested. Analytical questions about organizational work and specific
+  prior-work continuation route through Runtime/QMD recall.
 - Ending: `/wrap` (personal closure) · `/handoff` (notes for others) · `/save` (still working)
 - Tasks: `/todo` (personal) · `/quest` (team exploration) · `/issue` (something broken)
 - Questions: `/ask [person]` (async) · just ask (agent answers from context)
@@ -405,7 +414,7 @@ Egregore runs in one of two configurations, set by `mode` in `egregore.json`. De
 - If a feature requires the hosted service and has no upsell gate, say so plainly ("this isn't available in this configuration") and stop.
 - Calling `bin/graph.sh` or `bin/notify.sh` in local mode is harmless — they fail soft and return empty results — but there is no need to call them; prefer reading `memory/` directly.
 
-**Connected mode** (`"mode": "connected"`, `api_url` set) — the hosted configuration, used by organizations on the hosted service. Full feature set: Neo4j knowledge graph via `bin/graph.sh`, Telegram notifications via `bin/notify.sh`, dashboard publication, API-backed context gathering on session start. Use `/env` to check API key, `/checkup` for diagnostics. If the graph is offline, show troubleshooting.
+**Connected mode** (`"mode": "connected"`, `api_url` set) — the hosted configuration, used by organizations on the hosted service. Shared control-plane services include accounts, organizations, memberships, invitations, and entitlements. Optional derived graph projection, notifications, and hosted surfaces remain explicit adapters. Local organizational content and retrieval stay local unless a future capability is explicitly enabled. Use `/env` to check API key and `/checkup` for diagnostics.
 
 ---