create-egregore 0.20.2 → 0.21.0-runtime-mvp.2

package/runtime/codex/.codex/skills/view/SKILL.md

@@ -1,156 +1,160 @@
 ---
 name: view
-description: 'Render Egregore data and documents as branded browser artifacts. Use when the user invokes /view or $view, asks to show something visually, open it in a browser, make a document readable or presentable, render a quest/handoff/activity/board/network, or synthesize a visual artifact from a topic.'
+description: 'Render Egregore data and documents as branded local browser artifacts. Use for $view, requests to show something visually, open it in a browser, make a document presentable, render a quest/handoff/activity/board/network, or synthesize a visual artifact from a topic. Publishing is a separate explicit SHARE action.'
 ---
 
 # Egregore View
 
-Native Codex Egregore skill. Use only inside an Egregore checkout.
-
-Resolve a file or live Egregore surface, render it with the in-repo artifact
-tooling, open it, and report the concrete output path. Run the workflow inline;
-do not invoke Claude Code commands or delegate through Loom.
+Native Codex Egregore skill. Resolve authorized content, render locally, open
+the result, and report its concrete path. Run inline; Codex does not route
+through Loom or minion.
 
 ## Structured UX parity
 
-The visible result is the browser artifact and a compact receipt. Preserve the
-typed artifact templates, designed document composition, exact file path, and
-stable board URL when available. Do not replace the artifact with a prose
-summary or expose raw renderer output.
-
-## Resolve the request
-
-1. Verify `bin/agent.sh` exists. If not, say this is not an Egregore checkout.
-2. Parse an optional type followed by a name:
-   - `quest` from `memory/quests/`
-   - `handoff` from `memory/handoffs/` recursively
-   - `activity`, `board`, or `network` with no source file
-   - `document` for any markdown file
-3. Treat an argument containing `/` or ending in `.md` as a direct path. Use it
-   if it exists and infer the type from its directory.
-4. With no explicit type, search in this order: quests, handoffs, knowledge.
-   Prefer exact basename matches, then case-insensitive partial matches. For
-   handoffs, prefer the newest matching dated path.
-5. If several files match, use structured Codex question tooling when
-   available; otherwise ask one concise plain-text question listing the paths.
-6. If no file matches and the input is a topic or question, synthesize a
-   temporary markdown document from relevant memory, repository files, and
-   conversation context at
-   `/tmp/egregore-artifacts/synthesized-<slug>.md`. If the input clearly names
-   a missing file, report it as missing instead of inventing a document.
-
-## Select the renderer
-
-Prefer the checked-out package so local changes are exercised and no package
-download is needed:
+Preserve typed artifact templates, designed document composition, the exact
+local file path, and an approved hosted URL when one was actually returned.
+Never replace the browser artifact with prose or expose raw renderer output.
+
+## Source boundary
+
+Resolve deictic requests from the current conversation before organizational
+retrieval. When `this`, `that`, `it`, or `the above` unambiguously refers to
+the single artifact just created, accepted, or shown, reuse its full content
+already in context and stage it verbatim. If that content is collapsed or the
+prior receipt supplies only a canonical path, open that exact path once through
+`bin/search.sh open`; do not run `bin/search.sh query` to rediscover a known
+artifact.
+
+Resolve organizational sources from the attached authorized
+`EGREGORE_ORG_CONTEXT_V1` block first. Reuse its opened content and do not
+repeat retrieval or reopen it merely for verification. Stage attached content
+as a temporary render source.
+
+When the requested organizational source is absent, run Runtime Observe once:
+
+```bash
+bash bin/search.sh query "<artifact name and optional type>" -n 6
+bash bin/search.sh open "<selected memory/... path>"
+```
+
+Open only a selected returned canonical path and write it to a temporary render
+source. Never scan `memory/`, call QMD or Graph, or pass a raw canonical path to
+the renderer. A direct `memory/...` request still goes through
+`bin/search.sh open`. An explicit non-memory path inside the current repository
+may be rendered as a repository document, but is not organizational memory.
+
+If several authorized results match, ask one concise choice question. If no
+specific file exists and the request is a topic, synthesize only from the
+attached context or one Observe result. Read repository code only when the user
+explicitly requested codebase synthesis.
+
+## Artifact types
+
+- `quest` and `handoff` — infer from the authorized canonical path, render the
+  staged content with the matching typed template.
+- `document` — any authorized markdown or explicit repository document.
+- `activity`, `board`, and `network` — use the renderer's typed Runtime-backed
+  live surface without pre-scanning memory.
+
+## Local renderer
+
+Prefer the checked-out renderer and always run Node through Egregore's runtime
+adapter. A source checkout must never fall through to a stale global renderer:
 
 ```bash
-RENDER="npx egregore-artifacts@latest"
 if [ -f packages/egregore-artifacts/bin/cli.js ] && \
    [ -d packages/egregore-artifacts/node_modules/react ]; then
-  RENDER="node packages/egregore-artifacts/bin/cli.js"
+  RENDER=(bash bin/node-run.sh packages/egregore-artifacts/bin/cli.js)
+elif [ -f packages/egregore-artifacts/bin/cli.js ]; then
+  echo "The checked-out artifact renderer is missing its local dependencies." >&2
+  exit 1
+elif command -v egregore-artifacts >/dev/null 2>&1; then
+  RENDER=(bash bin/node-run.sh "$(command -v egregore-artifacts)")
+else
+  echo "The local artifact renderer is not installed for this instance." >&2
+  exit 1
 fi
 ```
 
-If the local package exists without dependencies, install its dependencies or
-use the `npx` fallback. Do not block a render on optional connected services.
-
-## Render typed artifacts
+Do not run `npx`, install packages, or contact a package registry as a hidden
+fallback. Do not probe alternate renderers with `--help`; invoke the selected
+renderer exactly once and use its reported HTML path rather than guessing it.
 
 Run the matching command:
 
 ```bash
-$RENDER quest <quest-file>
-$RENDER handoff <handoff-file>
-$RENDER activity
-$RENDER board
-$RENDER network
-$RENDER document <markdown-file>
+"${RENDER[@]}" quest <staged-source>
+"${RENDER[@]}" handoff <staged-source>
+"${RENDER[@]}" document <staged-source>
+"${RENDER[@]}" activity
+"${RENDER[@]}" board
+"${RENDER[@]}" network
 ```
 
-Use the renderer's reported HTML path rather than guessing it.
+For documents, use the checked-out generative-UI synthesis graph when present:
+select objective, audience, register, palette, and grammar from the content,
+resolve a brief, and pass `--brief`. Never fetch the design layer; render
+without a brief when it is unavailable.
 
-For documents, walk the generative-UI synthesis graph in
-`packages/design-system/generative-ui/skill/SKILL.md`: select one id each for
-objective, audience, register, palette, and grammar from the document's
-substance, record one line of judgment for each, resolve the brief, and pass it
-with `--brief`. If that layer is unavailable, render without the brief.
+The deterministic renderer already owns its light/dark theme contract. Do not
+invoke or reread a separate visual-theme skill for an ordinary render. Apply
+the Dark Mode contract only while authoring composed HTML or changing renderer
+code.
 
-## Compose flagship documents
+## Explicit composition
 
-Composition is the default for a multi-section strategy, briefing, explainer,
-analysis, decision document, or anything explicitly requested as composed,
-presentable, client-facing, designed, or `--compose`. Use the fast renderer for
-typed artifacts, short utility documents, `--fast`, or `--floor`.
+Compose inline only when the user explicitly asks for `--compose`, a
+designed/flagship artifact, a client-facing treatment, or the design trace.
+Otherwise use the deterministic renderer.
 
 For composition:
 
-1. Read the source document in full.
+1. Use only the staged authorized source.
 2. Copy `.codex/skills/view/assets/compose-scaffold.html` to
    `/tmp/egregore-artifacts/composed-<slug>.html`.
-3. Fill every placeholder and walk the generative-UI graph for the manifest's
-   register, palette, grammar, and trail.
-4. Transform rather than mirror the markdown:
-   - write a two-tone claim-led hero and italic standfirst;
-   - make section headings state findings, not repeat source headings;
-   - choose components by meaning: ledger for Q/A, claims for numbers, panels
-     for options, steps for sequences, feature rows for capability/status,
-     threads for decisions, gap cards for negatives, and a readout for the
-     honest bottom line;
-   - create one anchored navigation item per composed section.
-5. Keep every theme-sensitive color as `var(--token)`. Never emit inline hex
-   colors in composed content. Preserve the scaffold's no-flash theme restore,
-   `<html data-theme>`, and light/auto/dark behavior.
-6. Verify no placeholders remain, open the HTML with the platform browser
-   opener, and report `Renderer: composed (band 5, inline)`.
-
-## Publish the stable board
-
-After `$RENDER board`, publish best-effort only when `egregore.json` declares a
-connected configuration:
+3. Choose editorial or technical register before writing. Preserve technical
+   claims and convert structure, not voice.
+4. Fill every placeholder, choose components by meaning, and create one nav
+   anchor per section.
+5. Keep theme-sensitive colors as `var(--token)` and verify every used token in
+   vellum and nocturne themes.
+6. Open the completed HTML and report
+   `Renderer: composed (band 5, inline)`.
 
-```bash
-_API_URL=$(jq -r '.api_url // empty' egregore.json 2>/dev/null)
-_MODE=$(jq -r '.mode // empty' egregore.json 2>/dev/null)
-if [ -n "$_API_URL" ] && [ "$_MODE" != "local" ]; then
-  ORG_NAME=$(jq -r '.org_name // .slug' egregore.json)
-  bash bin/publish-artifact.sh board memory/board/board.json \
-    --id board \
-    --title "Project Board — $ORG_NAME" \
-    --author "$ORG_NAME" \
-    --description "Latest board for $ORG_NAME" 2>/dev/null &
-fi
-```
+## SHARE is separate
+
+Local render/open is the complete default action. Never publish, replace a
+stable hosted view, or publish linked references because the user asked to
+view something.
+
+Only when the user explicitly requests publishing:
+
+1. Authorize `SHARE` for the exact staged artifact.
+2. Show a Publish / Cancel checkpoint containing organization, destination,
+   title, source, and whether a stable URL will be replaced.
+3. After approval, invoke the Runtime publication adapter once. For the board,
+   the existing stable-id adapter may use `--id board`.
+4. Report a hosted URL only when the adapter actually returns it.
 
-The local artifact remains the successful result if publishing fails. In local
-mode, do not call graph or notification services.
+Notification consent and SHARE consent are separate. A publish approval never
+authorizes a message, and a notification approval never authorizes publishing.
 
 ## Report
 
-Return only the useful receipt after the browser opens:
+After local open:
 
 ```text
 ✓ Artifact opened in browser
   File: /tmp/egregore-artifacts/<rendered-file>.html
 ```
 
-For a connected board, append:
-
-```text
-◆ https://egregore.xyz/view/<org-slug>/board   (stable — refresh for latest)
-```
-
-Emit telemetry best-effort after completion:
-
-```bash
-bash bin/telemetry.sh emit "command" '{"command":"view"}' 2>/dev/null &
-```
+Append a hosted URL only after an approved SHARE action succeeds. Emit
+telemetry best-effort through `bin/telemetry.sh`; telemetry is not publication.
 
 ## Rules
 
-- Keep filesystem resolution sufficient in local mode; the graph is optional.
-- Preserve auto-linked backtick references handled by
-  `bin/publish-references.sh` when publishing markdown.
-- Never install a global renderer package as the first choice.
+- Reuse attached `EGREGORE_ORG_CONTEXT_V1`; Observe at most once if absent.
+- Never bypass Runtime authorization with filesystem, QMD, Graph, or API reads.
+- Never make a hidden network call or package installation.
+- Never publish without a fresh explicit SHARE checkpoint.
 - Never call the deprecated `egregore-handoff` CLI.
-- Never claim publishing succeeded unless a URL was actually returned.

package/runtime/codex/.codex/skills/wrap/SKILL.md

@@ -1,58 +1,62 @@
 ---
 name: wrap
-description: Wrap an Egregore session when the user invokes /wrap or $wrap, or says they are done, wrapping up, or at a stopping point in Codex.
+description: Wrap an Egregore session when the user invokes /wrap or $wrap, or says they are done, wrapping up, or at a stopping point. This creates personal canonical closure; route assigned continuation to $handoff and save-without-closing to $save.
 ---
 
-# Egregore Wrap
+# Egregore wrap
 
-Native Codex Egregore skill. Use this inside an Egregore checkout with
-`bin/agent.sh`. The command routes through `bin/capture-run.sh --mode personal`.
-It writes the personal record first, appends graph and handoff-completion events
-to the local WAL, and reconciles them detached; do not wait for or repeat that
-background work.
+Create one personal session record in `memory/wraps/`. A wrap records the
+current actor's completed work, verification, and open threads. It is not a
+handoff, publication, notification, or automatic completion of another
+artifact.
+
+Canonical Markdown and Git provenance are authoritative. The Egregore Runtime
+owns authorization, ActorContext resolution, persistence, provenance,
+retrieval refresh, background embedding, and content-free telemetry.
 
 ## Flow
 
-1. Synthesize a topic, a one to three sentence summary, and concise open notes
-   from the current session.
-2. If the session has ambiguous or potentially misleading state, confirm with
-   the user. Use structured Codex question tooling when available; otherwise
-   show numbered choices plus `Other:` and wait.
-3. Resolve the author from `.egregore-state.json` `github_username`, then
-   `name`, then git config.
-4. Write the notes to a temp markdown file.
-5. Run:
+1. Reuse the conversation and relevant `EGREGORE_ORG_CONTEXT_V1` evidence. Do
+   not repeat organizational retrieval just to prepare a wrap.
+2. Derive a short topic, a two-to-four sentence summary, completed outcomes,
+   verification, and concise open threads. Never present unverified work as
+   complete.
+3. Confirm once only when the summary is materially ambiguous. Preserve exact
+   user-supplied wrap wording without another approval loop.
+4. If project changes need delivery, invoke `$save` once before wrapping. Do
+   not implement Git mechanics here or save again after the wrap succeeds.
+5. Write a temporary Markdown body with the relevant subset of `Summary`,
+   `Completed`, `Verification`, and `Open Threads`.
+6. Call the Runtime-neutral adapter exactly once:
 
 ```bash
-bin/agent.sh wrap --from "$AUTHOR" --topic "$TOPIC" --summary "$SUMMARY" --body-file "$BODY_FILE"
+bash bin/agent.sh wrap \
+  --topic "$TOPIC" \
+  --summary "$SUMMARY" \
+  --body-file "$BODY_FILE"
 ```
 
-6. If `git status --porcelain` reports repo changes after the wrap, run:
+The adapter performs one canonical transaction:
 
-```bash
-bin/agent.sh save --message "Wrap: $TOPIC" --topic "$TOPIC"
-```
+`authorize → persist Markdown → Git provenance → retrieval update → background embed → telemetry`
+
+Do not call `artifact-writeback.sh`, `capture-run.sh`, Git, QMD, graph,
+telemetry, publication, or notification mechanics directly. On failure, report
+the concise error and stop; never bypass the Runtime boundary.
+
+## Wrap is not handoff lifecycle
 
-7. Report the `memory/wraps/...` path and whether code changes were saved.
+- Use `$handoff` when another person must receive or continue work.
+- A wrap never silently completes, expires, or supersedes a handoff, quest,
+  todo, or thread. Age alone is never completion evidence.
+- Its canonical receipt may be cited by a later, explicitly authorized
+  lifecycle transition, which must verify actor membership, target revision,
+  and typed evidence separately.
+- Open threads remain in the wrap even if promoted through their own Runtime
+  quest/todo/thread action.
 
 ## Output
 
-Structured UX parity is required. Finish with the standard Egregore wrap
-confirmation TUI, not a prose-only summary:
-
-- Use a 72-column outer box with only the four standard line patterns:
-  top rule, separator rule, content line, bottom rule.
-- Header: `WRAP`, author, and date.
-- Body: topic, one compact summary, open threads or "No open threads", and
-  the `memory/wraps/...` path.
-- Footer: saved/pushed status. If code changes were saved, show that. If the
-  wrap only touched memory, say so.
-- Output the box directly, preferably in a `text` fenced block, with no
-  narration before it.
-
-## Rules
-
-- Do not use Claude Code commands.
-- Do not invent finished work. Separate completed work, verification, and open
-  follow-ups.
-- If save fails, report the failure and leave the local commits untouched.
+Return a compact receipt with actor label, topic, summary, open-thread count,
+the `memory/wraps/...` path, and project save/writeback status. Do not claim
+graph, publish, notify, or share effects that did not happen.

package/runtime/codex/.codex/spec-manifest.json

@@ -5,7 +5,7 @@
     {
       "section": "(intro)",
       "action": "replace",
-      "sourceHash": "a33ca691aacf",
+      "sourceHash": "feebbe4543e2",
       "note": "Reframed for Codex: names AGENTS.md as the delivery surface and the manifest; \"organizations using Claude Code\" generalized."
     },
     {
@@ -35,7 +35,7 @@
     {
       "section": "After Greeting — BRANCH ON FIRST RESPONSE",
       "action": "replace",
-      "sourceHash": "3bac01c0a00a",
+      "sourceHash": "58978a357792",
       "note": "EnterWorktree -> bin/agent.sh branch with git checkout fallback; AskUserQuestion -> numbered options in plain text; branch-guard mapped to .codex/hooks/branch-guard.js with instruction fallback; plan-mode note dropped (no plan mode on Codex); /branch + /onboarding -> skill tokens. Handoff claiming and repoState auto-checkout bash kept verbatim (pure git); surrounding prose compressed 2026-08 for the 32 KiB budget, every rule retained."
     },
     {
@@ -45,15 +45,15 @@
       "note": "Kept verbatim — shell facts, runtime-neutral."
     },
     {
-      "section": "Knowledge Graph",
+      "section": "Optional Knowledge Graph Projection",
       "action": "keep",
-      "sourceHash": "b5d9a149f1a6",
-      "note": "Kept verbatim — bin/graph.sh is runtime-neutral."
+      "sourceHash": "557b6fe48eca",
+      "note": "Kept verbatim — graph traversal remains an explicit optional adapter and canonical evidence wins."
     },
     {
       "section": "Egregore Retrieval Beat",
       "action": "keep",
-      "sourceHash": "0c4d4715fb13",
+      "sourceHash": "6c5cbb0d1c9a",
       "note": "Kept verbatim — product attribution applies across runtimes."
     },
     {
@@ -95,13 +95,13 @@
     {
       "section": "Working Conventions",
       "action": "keep",
-      "sourceHash": "2e4ec18b72a6",
+      "sourceHash": "5001a5c9e645",
       "note": "Kept verbatim."
     },
     {
       "section": "Command Awareness",
       "action": "keep",
-      "sourceHash": "be00d1fc715f",
+      "sourceHash": "40ddb59f17b1",
       "note": "Prepended the Codex command surface (skill tokens, native vs adapter split, $save abstraction); disambiguation map kept with /x -> $x token rendering. Tokens with no Codex skill (e.g. /loop, a Claude Code harness feature) are left as-is."
     },
     {
@@ -119,7 +119,7 @@
     {
       "section": "Mode",
       "action": "keep",
-      "sourceHash": "0f74e18fd1b4",
+      "sourceHash": "8a821c2f41c0",
       "note": "Kept; /env and /checkup rendered as $skill tokens."
     },
     {