create-egregore 0.21.0-runtime-mvp.10 → 0.21.0-runtime-mvp.12

package/assets/egregore-launcher.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// egregore-launcher-version: 0.21.0-runtime-mvp.10
+// egregore-launcher-version: 0.21.0-runtime-mvp.12
 //
 // egregore — launch and browse Egregore instances from your terminal.
 // Installed by create-egregore. Reads ~/.egregore/instances.json.
@@ -35,7 +35,7 @@ const crypto = require("node:crypto");
 const { spawnSync, spawn } = require("node:child_process");
 const readline = require("node:readline");
 
-const VERSION = "0.21.0-runtime-mvp.10";
+const VERSION = "0.21.0-runtime-mvp.12";
 const REGISTRY = path.join(os.homedir(), ".egregore", "instances.json");
 const DEFAULT_FILE = path.join(os.homedir(), ".egregore", "default");
 const UPDATE_CACHE_FILE = path.join(os.homedir(), ".egregore", "update-check.json");

package/lib/claude-runtime.js

@@ -76,6 +76,24 @@ function copyFile(src, dest) {
   try { fs.chmodSync(dest, fs.statSync(src).mode & 0o777); } catch {}
 }
 
+// The generated settings adapter may replace a stale template settings.json —
+// one carrying nothing the adapter lacks — but an org's customized settings
+// (extra hook events or permission allows, e.g. PreCompact/Stop) are
+// authoritative and are never adopted, even when clean and tracked.
+function settingsSafeToAdopt(destFile, srcFile) {
+  try {
+    const local = JSON.parse(fs.readFileSync(destFile, "utf8"));
+    const bundle = JSON.parse(fs.readFileSync(srcFile, "utf8"));
+    const bundleHooks = bundle.hooks || {};
+    const extraHooks = Object.keys(local.hooks || {}).filter((k) => !(k in bundleHooks));
+    const bundleAllow = new Set(bundle.permissions?.allow || []);
+    const extraAllow = (local.permissions?.allow || []).filter((entry) => !bundleAllow.has(entry));
+    return extraHooks.length === 0 && extraAllow.length === 0;
+  } catch {
+    return false;
+  }
+}
+
 // One-time ownership migration for pre-bundle Claude installs. A clean,
 // tracked path is part of the cloned framework template and may be adopted by
 // the package. Dirty/untracked paths are user work and remain untouched.
@@ -153,7 +171,11 @@ function installClaudeRuntime(egregoreDir) {
       summary.skipped += 1; record();
     } else if (previousHash && currentHash === previousHash) {
       copyFile(src, dest); summary.updated += 1; record();
-    } else if (!previousHash && isCleanTrackedFrameworkFile(egregoreDir, rel)) {
+    } else if (
+      !previousHash
+      && (rel.replaceAll("\\", "/") !== ".claude/settings.json" || settingsSafeToAdopt(dest, src))
+      && isCleanTrackedFrameworkFile(egregoreDir, rel)
+    ) {
       copyFile(src, dest); summary.updated += 1; record();
     } else {
       summary.conflicted += 1; summary.conflicts.push(rel);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-egregore",
-  "version": "0.21.0-runtime-mvp.10",
+  "version": "0.21.0-runtime-mvp.12",
   "description": "Set up Egregore for your team in one command — installs the egregore launcher and your choice of Claude Code, Codex, or Pi.",
   "license": "MIT",
   "bin": {

package/runtime/claude/.claude/skills/handoff/SKILL.md

@@ -74,6 +74,19 @@ Preserve supplied wording, order, headings, lists, code, and links. For
 generated content, use only the useful subset of Briefing, Current State, Open
 Threads, and Next Steps. Keep it operational and concise.
 
+## Staircase (staging)
+
+A second face for addressed handoffs exists: the staircase, a
+progressive-disclosure page the receiver walks one step at a time and closes
+with a readback (docs/specs/handoff-staircase.md). It is in staging and does
+not change this skill. When the user asks for a staircase and this instance
+has the staging command (.claude/skills/handoff-staircase/SKILL.md, Codex: the
+handoff-staircase adapter; internal to Curve Labs while in staging), route to
+it: it reuses this preview and approval bridge with a composed spec and adds
+one feedback question at the end. Without it, say the staircase is not
+installed here and continue with this skill. When its feedback
+promotes it, the staircase becomes the default here and that command retires.
+
 ## One-command preview
 
 Pipe the exact canonical Markdown once to the private preview bridge. It stores

package/runtime/claude/bin/codex-sync-skills.sh

@@ -26,6 +26,7 @@ NATIVE_SKILLS=(
 )
 
 STRUCTURED_UX_SKILLS=(
+  handoff-staircase
   activity
   dashboard
   handoff

package/runtime/claude/bin/handoff-preview.sh

@@ -13,7 +13,7 @@ usage() {
 usage:
   bash bin/handoff-preview.sh preview --author HANDLE --recipient HANDLE \
     --topic TOPIC --intent action|feedback|fyi \
-    --content-mode supplied|generated < handoff.md
+    --content-mode supplied|generated [--composed SPEC.json] < handoff.md
   bash bin/handoff-preview.sh approve TOKEN
 EOF
 }
@@ -44,7 +44,7 @@ validate_token() {
 }
 
 preview() {
-  local author="" recipient="" topic="" intent="" content_mode=""
+  local author="" recipient="" topic="" intent="" content_mode="" composed=""
   while [ $# -gt 0 ]; do
     case "$1" in
       --author) author="${2:-}"; shift 2 ;;
@@ -52,6 +52,7 @@ preview() {
       --topic) topic="${2:-}"; shift 2 ;;
       --intent) intent="${2:-}"; shift 2 ;;
       --content-mode) content_mode="${2:-}"; shift 2 ;;
+      --composed) composed="${2:-}"; shift 2 ;;
       *) echo "unknown preview option: $1" >&2; usage; exit 2 ;;
     esac
   done
@@ -60,16 +61,25 @@ preview() {
   [ -n "$topic" ] || { echo "handoff preview requires --topic" >&2; exit 2; }
   case "$intent" in action|feedback|fyi) ;; *) echo "invalid handoff intent" >&2; exit 2 ;; esac
   case "$content_mode" in supplied|generated) ;; *) echo "invalid handoff content mode" >&2; exit 2 ;; esac
+  if [ -n "$composed" ]; then
+    # A composed spec (for example a staircase) is a presentation map over the
+    # canonical Markdown. It rides the same private record and is judged by the
+    # same fidelity gate; it never replaces the Markdown as the record.
+    [ "$content_mode" = "generated" ] || { echo "--composed requires --content-mode generated" >&2; exit 2; }
+    [ -s "$composed" ] || { echo "handoff preview --composed file is missing or empty" >&2; exit 2; }
+    jq -e . "$composed" >/dev/null 2>&1 || { echo "handoff preview --composed file is not JSON" >&2; exit 2; }
+  fi
 
   umask 077
   mkdir -p "$STORE_ROOT"
   chmod 700 "$STORE_ROOT"
 
-  local token content_file metadata_file digest
+  local token content_file metadata_file spec_file digest spec_digest
   token="$(new_token)"
   validate_token "$token"
   content_file="$STORE_ROOT/$token.md"
   metadata_file="$STORE_ROOT/$token.json"
+  spec_file="$STORE_ROOT/$token.spec.json"
   cat > "$content_file"
   [ -s "$content_file" ] || {
     rm -f "$content_file"
@@ -77,6 +87,11 @@ preview() {
     exit 2
   }
   digest="$(sha256_file "$content_file")"
+  spec_digest=""
+  if [ -n "$composed" ]; then
+    cp "$composed" "$spec_file"
+    spec_digest="$(sha256_file "$spec_file")"
+  fi
   jq -n \
     --arg author "$author" \
     --arg recipient "$recipient" \
@@ -84,14 +99,25 @@ preview() {
     --arg intent "$intent" \
     --arg contentMode "$content_mode" \
     --arg digest "$digest" \
+    --arg specDigest "$spec_digest" \
     --argjson createdAt "$(date +%s)" \
-    '{author:$author,recipient:$recipient,topic:$topic,intent:$intent,contentMode:$contentMode,digest:$digest,createdAt:$createdAt}' \
+    '{author:$author,recipient:$recipient,topic:$topic,intent:$intent,contentMode:$contentMode,digest:$digest,specDigest:$specDigest,createdAt:$createdAt}' \
     > "$metadata_file"
 
-  if ! bash "$ROOT/bin/node-run.sh" \
+  local render_ok=0
+  if [ -n "$composed" ]; then
+    if bash "$ROOT/bin/node-run.sh" \
+      "$ROOT/packages/egregore-artifacts/bin/cli.js" composed "$spec_file" \
+      --source "$content_file" --verify-fidelity; then
+      render_ok=1
+    fi
+  elif bash "$ROOT/bin/node-run.sh" \
     "$ROOT/packages/egregore-artifacts/bin/cli.js" handoff "$content_file" \
     --verify-fidelity; then
-    rm -f "$content_file" "$metadata_file"
+    render_ok=1
+  fi
+  if [ "$render_ok" != "1" ]; then
+    rm -f "$content_file" "$metadata_file" "$spec_file"
     exit 1
   fi
 
@@ -132,12 +158,26 @@ approve() {
     exit 1
   fi
 
-  local author recipient topic intent content_mode
+  local author recipient topic intent content_mode spec_digest
   author="$(jq -er '.author' "$metadata_file")"
   recipient="$(jq -er '.recipient' "$metadata_file")"
   topic="$(jq -er '.topic' "$metadata_file")"
   intent="$(jq -er '.intent' "$metadata_file")"
   content_mode="$(jq -er '.contentMode' "$metadata_file")"
+  spec_digest="$(jq -r '.specDigest // ""' "$metadata_file")"
+
+  # A previewed composed spec is bound to the same token and the same digest
+  # discipline as the Markdown: approval sends exactly the previewed bytes.
+  local spec_file="$STORE_ROOT/$token.spec.json"
+  if [ -n "$spec_digest" ]; then
+    if [ ! -f "$spec_file" ] || [ "$(sha256_file "$spec_file")" != "$spec_digest" ]; then
+      rmdir "$lock_dir" 2>/dev/null || true
+      echo "handoff preview composed spec is missing or changed after approval was requested" >&2
+      exit 1
+    fi
+  else
+    spec_file=""
+  fi
 
   local result_tmp
   result_tmp="$(mktemp -d -t egregore-handoff-result-XXXXXX)"
@@ -146,6 +186,7 @@ approve() {
     --intent "$intent" --content-mode "$content_mode"
   )
   [ -z "$recipient" ] || args+=(--recipient "$recipient")
+  [ -z "$spec_file" ] || args+=(--composed "$spec_file")
 
   if ! TMPDIR="$result_tmp" bash "$ROOT/bin/artifact-writeback.sh" "${args[@]}" \
     < "$content_file"; then
@@ -153,10 +194,33 @@ approve() {
     exit 1
   fi
 
+  # Persist the composed spec beside the canonical record so the face can be
+  # re-rendered or shared later from memory alone. The record is already
+  # canonical at this point; a spec persistence failure is reported, not
+  # retried, so the approval can never write the record twice.
+  if [ -n "$spec_file" ]; then
+    local record_abs record_rel spec_rel
+    record_abs="$(jq -r '.absFile // empty' "$result_tmp/capture-run-result.json" 2>/dev/null || true)"
+    record_rel="${record_abs#"$ROOT/"}"
+    case "$record_rel" in
+      memory/*.md)
+        spec_rel="${record_rel%.md}.staircase.json"
+        if ! bash "$ROOT/bin/artifact-writeback.sh" create \
+          --path "$spec_rel" --input "$spec_file" >/dev/null; then
+          echo "warning: the canonical record was written but its composed spec could not be persisted at $spec_rel" >&2
+        fi
+        ;;
+      *)
+        echo "warning: the canonical record path is not under memory/; the composed spec was not persisted" >&2
+        ;;
+    esac
+  fi
+
   # Consume the approved token before rendering. A renderer failure must not
   # make a successful canonical write eligible for accidental replay.
   mv "$content_file" "$result_tmp/approved-handoff.md"
   mv "$metadata_file" "$result_tmp/approved-handoff.json"
+  [ -z "$spec_file" ] || mv "$spec_file" "$result_tmp/approved-handoff.staircase.json"
   rmdir "$lock_dir" 2>/dev/null || true
   bash "$ROOT/bin/render-card.sh" \
     --result "$result_tmp/capture-run-result.json"

package/runtime/claude/bin/lib/git-sync.sh

@@ -24,6 +24,10 @@ FRAMEWORK_UPDATED_FILES=""
 HEALTH_RETRIEVAL="skip"
 SYNC_RECEIPT=""
 
+# Settings drift healer + unshared-settings reporting (see the lib header).
+# shellcheck source=bin/lib/settings-drift.sh
+source "$SCRIPT_DIR/bin/lib/settings-drift.sh"
+
 # The core repo's integration branch: "develop" unless egregore.json sets
 # base_branch. session-start.sh resolves this before sourcing; resolve it here
 # too so the lib stands alone for other callers.
@@ -324,8 +328,17 @@ setup_develop() {
       return 1
     fi
   else
-    # Already on it — fetch couldn't update a checked-out branch, so pull
+    # Already on it — fetch couldn't update a checked-out branch, so pull.
+    # Launcher/installer settings drift blocks this merge and the refusal
+    # is otherwise silent; heal it first, re-apply the launcher's intent
+    # after (bin/lib/settings-drift.sh).
+    settings_drift_heal
     git merge --ff-only "origin/$BASE_BRANCH" --quiet 2>/dev/null || true
+    settings_drift_reapply
+    # Connected mode: reconcile with the control plane (org settings row) —
+    # pull a teammate's confirmed write down, or re-deliver a failed push.
+    settings_drift_pull
+    settings_drift_report
   fi
 
   # Never report the intended branch as the actual branch. A checkout can fail

package/runtime/claude/bin/lib/greeting.sh

@@ -95,6 +95,20 @@ if [ -n "$SAVED_BRANCH" ]; then
   echo "  ✓ Auto-saved uncommitted work on $SAVED_BRANCH"
 fi
 
+# --- Unshared org-settings drift (launcher writes not yet shared) ---
+if [ "${SETTINGS_ADAPTER_RESTORED:-false}" = "true" ]; then
+  echo "  ◇ restored org .claude/settings.json — a generated adapter had replaced it locally"
+fi
+if [ -n "${SETTINGS_SYNCED_FROM_ORG:-}" ]; then
+  echo "  ◇ org settings synced from the control plane (${SETTINGS_SYNCED_FROM_ORG})"
+fi
+if [ -n "${SETTINGS_POSTURE_HELD:-}" ]; then
+  echo "  ◇ boundary posture was set to ${SETTINGS_POSTURE_HELD} elsewhere — relaxing access needs your confirm: bash bin/settings.sh posture ${SETTINGS_POSTURE_HELD}"
+fi
+if [ -n "${UNSHARED_SETTINGS_KEYS:-}" ]; then
+  echo "  ◇ org settings changed on this machine (${UNSHARED_SETTINGS_KEYS}) — say \"share settings\" to make them org-wide"
+fi
+
 # --- Footer: health + repos + memory (tertiary) ---
 echo "$SEPARATOR"
 

package/runtime/claude/bin/lib/settings-drift.sh

@@ -0,0 +1,196 @@
+#!/usr/bin/env bash
+# settings-drift.sh — heal launcher/installer settings drift around the
+# base-branch fast-forward, and surface unshared org-settings changes.
+#
+# Two org-config surfaces accumulate legitimate local modifications outside
+# any session: .claude/settings.json (the installer's generated public-safe
+# adapter can replace the org's richer committed file) and egregore.json
+# (launcher settings verbs: posture, workflow, people removals). Local
+# modifications to files a fast-forward also changes make git refuse the
+# merge — and that refusal used to be silently swallowed, leaving the
+# checkout behind with no explanation.
+#
+# Contract (sourced; caller provides $BASE_BRANCH and runs from the repo
+# root):
+#   settings_drift_heal      — before the ff-merge. Restores settings.json
+#                              only when the local copy is a reduced
+#                              generated adapter (its hook events and
+#                              permission allows are a subset of the
+#                              committed file's). Snapshots egregore.json
+#                              and returns it to HEAD so the merge can run.
+#   settings_drift_reapply   — after the ff-merge. Re-applies the snapshot's
+#                              changed settings-owned keys on top of the
+#                              incoming egregore.json.
+#   settings_drift_report    — sets UNSHARED_SETTINGS_KEYS to the
+#                              settings-owned keys where the working file
+#                              differs from HEAD, for the greeting.
+#
+# Anything dirty beyond these two files is user work and is never touched.
+
+_SETTINGS_OWNED_KEYS='["boundary","base_branch","people_removed","features","repos","admins","people"]'
+_SETTINGS_DRIFT_SNAPSHOT=""
+_SETTINGS_DRIFT_BASE=""
+# Read by bin/lib/greeting.sh after git-sync completes.
+export SETTINGS_ADAPTER_RESTORED="false"
+export UNSHARED_SETTINGS_KEYS=""
+
+# The generated adapter only ever removes relative to the org file: fewer
+# hook events, fewer permission allows. A local settings.json that carries
+# anything the committed file lacks is user work and stays untouched.
+_settings_is_reduced_adapter() {
+  local tmp_head
+  tmp_head=$(mktemp) || return 1
+  if ! git show "HEAD:.claude/settings.json" > "$tmp_head" 2>/dev/null; then
+    rm -f "$tmp_head"
+    return 1
+  fi
+  jq -es '
+    .[0] as $local | .[1] as $head |
+    ($local != $head) and
+    ((($local.hooks // {}) | keys) - (($head.hooks // {}) | keys) | length == 0) and
+    ((($local.permissions.allow // []) - ($head.permissions.allow // [])) | length == 0)
+  ' .claude/settings.json "$tmp_head" >/dev/null 2>&1
+  local verdict=$?
+  rm -f "$tmp_head"
+  return "$verdict"
+}
+
+settings_drift_heal() {
+  git rev-parse -q --verify "origin/$BASE_BRANCH" >/dev/null 2>&1 || return 0
+  [ "$(git rev-parse HEAD 2>/dev/null)" = "$(git rev-parse "origin/$BASE_BRANCH" 2>/dev/null)" ] && return 0
+
+  if ! git diff --quiet -- .claude/settings.json 2>/dev/null; then
+    if _settings_is_reduced_adapter; then
+      git checkout -- .claude/settings.json 2>/dev/null && SETTINGS_ADAPTER_RESTORED="true"
+    fi
+  fi
+
+  if ! git diff --quiet -- egregore.json 2>/dev/null; then
+    _SETTINGS_DRIFT_SNAPSHOT=$(cat egregore.json 2>/dev/null || true)
+    _SETTINGS_DRIFT_BASE=$(git show "HEAD:egregore.json" 2>/dev/null || true)
+    if [ -n "$_SETTINGS_DRIFT_SNAPSHOT" ] && [ -n "$_SETTINGS_DRIFT_BASE" ] \
+      && printf '%s' "$_SETTINGS_DRIFT_SNAPSHOT" | jq -e . >/dev/null 2>&1; then
+      git checkout -- egregore.json 2>/dev/null || _SETTINGS_DRIFT_SNAPSHOT=""
+    else
+      _SETTINGS_DRIFT_SNAPSHOT=""
+    fi
+  fi
+}
+
+settings_drift_reapply() {
+  [ -n "$_SETTINGS_DRIFT_SNAPSHOT" ] || return 0
+  local tmp_local tmp_base merged
+  tmp_local=$(mktemp) && tmp_base=$(mktemp) || return 0
+  printf '%s' "$_SETTINGS_DRIFT_SNAPSHOT" > "$tmp_local"
+  printf '%s' "$_SETTINGS_DRIFT_BASE" > "$tmp_base"
+  merged=$(jq -s --argjson keys "$_SETTINGS_OWNED_KEYS" '
+    .[0] as $incoming | .[1] as $local | .[2] as $base |
+    reduce $keys[] as $k ($incoming;
+      if ($local[$k] // null) != ($base[$k] // null) then
+        if ($local | has($k)) then .[$k] = $local[$k] else del(.[$k]) end
+      else . end)
+  ' egregore.json "$tmp_local" "$tmp_base" 2>/dev/null || true)
+  rm -f "$tmp_local" "$tmp_base"
+  if [ -n "$merged" ] && printf '%s' "$merged" | jq -e . >/dev/null 2>&1; then
+    printf '%s\n' "$merged" > egregore.json
+  fi
+  _SETTINGS_DRIFT_SNAPSHOT=""
+  _SETTINGS_DRIFT_BASE=""
+}
+
+# ── control-plane sync (Connected mode) ─────────────────────────────────
+# The control plane is authoritative for org settings in Connected mode: a
+# teammate's confirmed CLI write lands in the orgs row immediately, and every
+# session start pulls it down here. One trust rule: an incoming posture that
+# RELAXES local file access is never auto-applied — it is held and surfaced
+# for local confirm; tightening applies immediately. If the server has not
+# moved but the local settings-owned keys have (an offline write whose push
+# failed), the local state is pushed instead.
+_settings_posture_rank() {
+  case "$1" in strict) echo 0 ;; open) echo 2 ;; *) echo 1 ;; esac
+}
+
+export SETTINGS_POSTURE_HELD=""
+export SETTINGS_SYNCED_FROM_ORG=""
+# true once the control plane and the local settings-owned keys agree — the
+# greeting then never asks the user to share what is already org-wide.
+export SETTINGS_CP_SYNCED="false"
+
+settings_drift_pull() {
+  local api_url api_key resp revision applied local_subset server_settings
+  api_url=$(jq -r '.api_url // empty' egregore.json 2>/dev/null)
+  [ -n "$api_url" ] || return 0
+  api_key=$(grep '^EGREGORE_API_KEY=' .env 2>/dev/null | cut -d'=' -f2-)
+  [ -n "$api_key" ] || return 0
+  resp=$(curl -s --max-time 8 -H "Authorization: Bearer $api_key" "$api_url/api/org/settings" 2>/dev/null) || return 0
+  printf '%s' "$resp" | jq -e '.settings' >/dev/null 2>&1 || return 0
+  revision=$(printf '%s' "$resp" | jq -r '.settings_revision // ""')
+  server_settings=$(printf '%s' "$resp" | jq -c '.settings')
+  applied=$(jq -r '.org_settings_revision // ""' .egregore-state.json 2>/dev/null)
+  local_subset=$(jq -c --argjson keys "$_SETTINGS_OWNED_KEYS" \
+    'with_entries(select(.key as $k | $keys | index($k)))' egregore.json 2>/dev/null)
+
+  if [ -n "$revision" ] && [ "$revision" != "$applied" ] && [ "$server_settings" != "{}" ]; then
+    # Server moved: apply it, holding a posture relaxation for local confirm.
+    local incoming_posture local_posture hold="false"
+    incoming_posture=$(printf '%s' "$resp" | jq -r '.settings.boundary.posture // empty')
+    local_posture=$(jq -r '.boundary.posture // "standard"' egregore.json 2>/dev/null)
+    if [ -n "$incoming_posture" ] \
+      && [ "$(_settings_posture_rank "$incoming_posture")" -gt "$(_settings_posture_rank "$local_posture")" ]; then
+      hold="true"
+      SETTINGS_POSTURE_HELD="$incoming_posture"
+      export SETTINGS_POSTURE_HELD
+    fi
+    local merged tmp
+    merged=$(printf '%s' "$server_settings" | jq -c \
+      --argjson keys "$_SETTINGS_OWNED_KEYS" --argjson hold "$hold" --slurpfile cfg egregore.json '
+      . as $s | $cfg[0] as $local |
+      reduce $keys[] as $k ($local;
+        if ($s | has($k)) then
+          if $k == "boundary" and $hold then
+            .boundary = (($s.boundary // {}) + {posture: ($local.boundary.posture // "standard")})
+          else .[$k] = $s[$k] end
+        else del(.[$k]) end)
+    ' 2>/dev/null || true)
+    if [ -n "$merged" ] && printf '%s' "$merged" | jq -e . >/dev/null 2>&1; then
+      tmp=$(mktemp "egregore.json.XXXXXX") || return 0
+      printf '%s\n' "$merged" | jq . > "$tmp" 2>/dev/null && [ -s "$tmp" ] && mv "$tmp" egregore.json || { rm -f "$tmp"; return 0; }
+      SETTINGS_SYNCED_FROM_ORG=$(printf '%s' "$resp" | jq -r '.settings | keys | join(", ")')
+      export SETTINGS_SYNCED_FROM_ORG
+      # A held posture keeps the revision unapplied so the next start retries.
+      if [ "$hold" = "false" ] && [ -f .egregore-state.json ]; then
+        tmp=$(mktemp ".egregore-state.json.XXXXXX") || return 0
+        jq --arg rev "$revision" '.org_settings_revision = $rev' .egregore-state.json > "$tmp" 2>/dev/null \
+          && [ -s "$tmp" ] && mv "$tmp" .egregore-state.json || rm -f "$tmp"
+        SETTINGS_CP_SYNCED="true"; export SETTINGS_CP_SYNCED
+      fi
+    fi
+  elif [ -n "$revision" ] && [ "$revision" = "$applied" ] && [ "$local_subset" != "$server_settings" ]; then
+    # Server unchanged but local settings moved (offline write, failed push):
+    # deliver the local state now. bin/settings.sh owns the push mechanics.
+    if bash bin/settings.sh push >/dev/null 2>&1; then
+      SETTINGS_CP_SYNCED="true"; export SETTINGS_CP_SYNCED
+    fi
+  elif [ "$local_subset" = "$server_settings" ]; then
+    SETTINGS_CP_SYNCED="true"; export SETTINGS_CP_SYNCED
+  fi
+}
+
+settings_drift_report() {
+  UNSHARED_SETTINGS_KEYS=""
+  # Control plane already carries these settings — nothing to ask the user.
+  [ "${SETTINGS_CP_SYNCED:-false}" = "true" ] && return 0
+  git diff --quiet -- egregore.json 2>/dev/null && return 0
+  local tmp_head
+  tmp_head=$(mktemp) || return 0
+  if ! git show "HEAD:egregore.json" > "$tmp_head" 2>/dev/null; then
+    rm -f "$tmp_head"
+    return 0
+  fi
+  UNSHARED_SETTINGS_KEYS=$(jq -rs --argjson keys "$_SETTINGS_OWNED_KEYS" '
+    .[0] as $local | .[1] as $head |
+    [$keys[] | select(($local[.] // null) != ($head[.] // null))] | join(", ")
+  ' egregore.json "$tmp_head" 2>/dev/null || true)
+  rm -f "$tmp_head"
+  export UNSHARED_SETTINGS_KEYS
+}

package/runtime/claude/bin/settings.sh

@@ -40,12 +40,47 @@ _save() {
   tmp="$(mktemp "$CONFIG.XXXXXX")" || _die "cannot create temp file" 1
   if jq "$@" "$filter" "$CONFIG" > "$tmp" 2>/dev/null && [ -s "$tmp" ]; then
     mv "$tmp" "$CONFIG"
+    _control_plane_push
   else
     rm -f "$tmp"
     _die "failed to update $CONFIG (invalid jq filter or unwritable file)" 1
   fi
 }
 
+# ── control-plane push (Connected mode) ──────────────────────────────────
+# A confirmed settings write reaches the control plane immediately — no
+# harness session, no git ceremony in the loop. Fail-soft: the file write
+# already landed, and a missed push is reconciled by the next session
+# start's settings sync (bin/lib/settings-drift.sh).
+_control_plane_push() {
+  local api_url api_key payload actor response revision
+  api_url=$(jq -r '.api_url // empty' "$CONFIG" 2>/dev/null)
+  [ -n "$api_url" ] || return 0
+  api_key=$(grep '^EGREGORE_API_KEY=' "$SCRIPT_DIR/.env" 2>/dev/null | cut -d'=' -f2-)
+  [ -n "$api_key" ] || return 0
+  actor=$(jq -r '.github_username // empty' "$SCRIPT_DIR/.egregore-state.json" 2>/dev/null)
+  payload=$(jq -c --arg by "$actor" '{
+    settings: ({boundary, base_branch, people_removed, features, repos, admins, people}
+      | with_entries(select(.value != null))),
+    updated_by: (if $by == "" then null else $by end)
+  }' "$CONFIG" 2>/dev/null)
+  [ -n "$payload" ] || return 0
+  response=$(curl -s --max-time 10 -X PUT "$api_url/api/org/settings" \
+    -H "Authorization: Bearer $api_key" -H "Content-Type: application/json" \
+    --data-binary "$payload" 2>/dev/null) || return 0
+  revision=$(printf '%s' "$response" | jq -r '.settings_revision // empty' 2>/dev/null)
+  if [ -n "$revision" ] && [ -f "$SCRIPT_DIR/.egregore-state.json" ]; then
+    local st
+    st="$(mktemp "$SCRIPT_DIR/.egregore-state.json.XXXXXX")" || return 0
+    if jq --arg rev "$revision" '.org_settings_revision = $rev' "$SCRIPT_DIR/.egregore-state.json" > "$st" 2>/dev/null && [ -s "$st" ]; then
+      mv "$st" "$SCRIPT_DIR/.egregore-state.json"
+    else
+      rm -f "$st"
+    fi
+  fi
+  return 0
+}
+
 _has_repo() { jq -e --arg n "$1" 'any(.repos[]?; (if type=="object" then .name else . end) == $n)' "$CONFIG" >/dev/null; }
 _has_admin() { jq -e --arg h "$1" 'any(.admins[]?; . == $h)' "$CONFIG" >/dev/null; }
 
@@ -559,6 +594,7 @@ case "$DOMAIN" in
   people)  cmd_people "$@" ;;
   privacy) cmd_privacy ;;
   posture) cmd_posture "$@" ;;
+  push)    _control_plane_push ;;
   boundary) cmd_boundary "$@" ;;
   dump)    cmd_dump ;;
   ""|-h|--help|help) usage 0 ;;

package/runtime/claude/egregore_runtime/issue_cli.py

@@ -61,7 +61,7 @@ def _snapshot(runtime, actor, service, permission: Permission = Permission.READ)
 
 
 def _resolve(runtime, actor, service, reference: str) -> IssueSnapshot:
-    rows, _ = _snapshot(runtime, actor)
+    rows, _ = _snapshot(runtime, actor, service)
     return service.resolve(rows, reference)
 
 
@@ -72,7 +72,7 @@ def _write_result(issue: IssueSnapshot, receipt) -> int:
 
 def _list(args):
     _, runtime, actor, service = _context()
-    rows, _ = _snapshot(runtime, actor)
+    rows, _ = _snapshot(runtime, actor, service)
     selected = rows if args.status == "all" else tuple(
         row for row in rows if row.status == args.status
     )
@@ -89,7 +89,7 @@ def _show(args):
 
 def _search(args):
     _, runtime, actor, service = _context()
-    rows, _ = _snapshot(runtime, actor)
+    rows, _ = _snapshot(runtime, actor, service)
     terms = tuple(part for part in args.term.casefold().split() if part)
 
     def matches(row: IssueSnapshot) -> bool:

package/runtime/claude/manifest.json

@@ -184,6 +184,7 @@
     "bin/lib/metrics.sh",
     "bin/lib/noncode.sh",
     "bin/lib/permissions.sh",
+    "bin/lib/settings-drift.sh",
     "bin/lib/time.sh",
     "bin/lib/worktree-links.sh",
     "bin/node-run.sh",

package/runtime/codex/.codex/skills/handoff/SKILL.md

@@ -70,6 +70,19 @@ Preserve supplied wording, order, headings, lists, code, and links. For
 generated content, use only the useful subset of Briefing, Current State, Open
 Threads, and Next Steps. Keep it operational and concise.
 
+## Staircase (staging)
+
+A second face for addressed handoffs exists: the staircase, a
+progressive-disclosure page the receiver walks one step at a time and closes
+with a readback (docs/specs/handoff-staircase.md). It is in staging and does
+not change this skill. When the user asks for a staircase and this instance
+has the staging command (.claude/skills/handoff-staircase/SKILL.md, Codex: the
+handoff-staircase adapter; internal to Curve Labs while in staging), route to
+it: it reuses this preview and approval bridge with a composed spec and adds
+one feedback question at the end. Without it, say the staircase is not
+installed here and continue with this skill. When its feedback
+promotes it, the staircase becomes the default here and that command retires.
+
 ## One-command preview
 
 Pipe the exact canonical Markdown once to the private preview bridge. It stores

package/runtime/codex/bin/codex-sync-skills.sh

@@ -26,6 +26,7 @@ NATIVE_SKILLS=(
 )
 
 STRUCTURED_UX_SKILLS=(
+  handoff-staircase
   activity
   dashboard
   handoff