create-egregore 0.21.0-runtime-mvp.11 → 0.21.0-runtime-mvp.12

package/assets/egregore-launcher.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// egregore-launcher-version: 0.21.0-runtime-mvp.11
+// egregore-launcher-version: 0.21.0-runtime-mvp.12
 //
 // egregore — launch and browse Egregore instances from your terminal.
 // Installed by create-egregore. Reads ~/.egregore/instances.json.
@@ -35,7 +35,7 @@ const crypto = require("node:crypto");
 const { spawnSync, spawn } = require("node:child_process");
 const readline = require("node:readline");
 
-const VERSION = "0.21.0-runtime-mvp.11";
+const VERSION = "0.21.0-runtime-mvp.12";
 const REGISTRY = path.join(os.homedir(), ".egregore", "instances.json");
 const DEFAULT_FILE = path.join(os.homedir(), ".egregore", "default");
 const UPDATE_CACHE_FILE = path.join(os.homedir(), ".egregore", "update-check.json");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-egregore",
-  "version": "0.21.0-runtime-mvp.11",
+  "version": "0.21.0-runtime-mvp.12",
   "description": "Set up Egregore for your team in one command — installs the egregore launcher and your choice of Claude Code, Codex, or Pi.",
   "license": "MIT",
   "bin": {

package/runtime/claude/.claude/skills/handoff/SKILL.md

@@ -74,6 +74,19 @@ Preserve supplied wording, order, headings, lists, code, and links. For
 generated content, use only the useful subset of Briefing, Current State, Open
 Threads, and Next Steps. Keep it operational and concise.
 
+## Staircase (staging)
+
+A second face for addressed handoffs exists: the staircase, a
+progressive-disclosure page the receiver walks one step at a time and closes
+with a readback (docs/specs/handoff-staircase.md). It is in staging and does
+not change this skill. When the user asks for a staircase and this instance
+has the staging command (.claude/skills/handoff-staircase/SKILL.md, Codex: the
+handoff-staircase adapter; internal to Curve Labs while in staging), route to
+it: it reuses this preview and approval bridge with a composed spec and adds
+one feedback question at the end. Without it, say the staircase is not
+installed here and continue with this skill. When its feedback
+promotes it, the staircase becomes the default here and that command retires.
+
 ## One-command preview
 
 Pipe the exact canonical Markdown once to the private preview bridge. It stores

package/runtime/claude/bin/codex-sync-skills.sh

@@ -26,6 +26,7 @@ NATIVE_SKILLS=(
 )
 
 STRUCTURED_UX_SKILLS=(
+  handoff-staircase
   activity
   dashboard
   handoff

package/runtime/claude/bin/handoff-preview.sh

@@ -13,7 +13,7 @@ usage() {
 usage:
   bash bin/handoff-preview.sh preview --author HANDLE --recipient HANDLE \
     --topic TOPIC --intent action|feedback|fyi \
-    --content-mode supplied|generated < handoff.md
+    --content-mode supplied|generated [--composed SPEC.json] < handoff.md
   bash bin/handoff-preview.sh approve TOKEN
 EOF
 }
@@ -44,7 +44,7 @@ validate_token() {
 }
 
 preview() {
-  local author="" recipient="" topic="" intent="" content_mode=""
+  local author="" recipient="" topic="" intent="" content_mode="" composed=""
   while [ $# -gt 0 ]; do
     case "$1" in
       --author) author="${2:-}"; shift 2 ;;
@@ -52,6 +52,7 @@ preview() {
       --topic) topic="${2:-}"; shift 2 ;;
       --intent) intent="${2:-}"; shift 2 ;;
       --content-mode) content_mode="${2:-}"; shift 2 ;;
+      --composed) composed="${2:-}"; shift 2 ;;
       *) echo "unknown preview option: $1" >&2; usage; exit 2 ;;
     esac
   done
@@ -60,16 +61,25 @@ preview() {
   [ -n "$topic" ] || { echo "handoff preview requires --topic" >&2; exit 2; }
   case "$intent" in action|feedback|fyi) ;; *) echo "invalid handoff intent" >&2; exit 2 ;; esac
   case "$content_mode" in supplied|generated) ;; *) echo "invalid handoff content mode" >&2; exit 2 ;; esac
+  if [ -n "$composed" ]; then
+    # A composed spec (for example a staircase) is a presentation map over the
+    # canonical Markdown. It rides the same private record and is judged by the
+    # same fidelity gate; it never replaces the Markdown as the record.
+    [ "$content_mode" = "generated" ] || { echo "--composed requires --content-mode generated" >&2; exit 2; }
+    [ -s "$composed" ] || { echo "handoff preview --composed file is missing or empty" >&2; exit 2; }
+    jq -e . "$composed" >/dev/null 2>&1 || { echo "handoff preview --composed file is not JSON" >&2; exit 2; }
+  fi
 
   umask 077
   mkdir -p "$STORE_ROOT"
   chmod 700 "$STORE_ROOT"
 
-  local token content_file metadata_file digest
+  local token content_file metadata_file spec_file digest spec_digest
   token="$(new_token)"
   validate_token "$token"
   content_file="$STORE_ROOT/$token.md"
   metadata_file="$STORE_ROOT/$token.json"
+  spec_file="$STORE_ROOT/$token.spec.json"
   cat > "$content_file"
   [ -s "$content_file" ] || {
     rm -f "$content_file"
@@ -77,6 +87,11 @@ preview() {
     exit 2
   }
   digest="$(sha256_file "$content_file")"
+  spec_digest=""
+  if [ -n "$composed" ]; then
+    cp "$composed" "$spec_file"
+    spec_digest="$(sha256_file "$spec_file")"
+  fi
   jq -n \
     --arg author "$author" \
     --arg recipient "$recipient" \
@@ -84,14 +99,25 @@ preview() {
     --arg intent "$intent" \
     --arg contentMode "$content_mode" \
     --arg digest "$digest" \
+    --arg specDigest "$spec_digest" \
     --argjson createdAt "$(date +%s)" \
-    '{author:$author,recipient:$recipient,topic:$topic,intent:$intent,contentMode:$contentMode,digest:$digest,createdAt:$createdAt}' \
+    '{author:$author,recipient:$recipient,topic:$topic,intent:$intent,contentMode:$contentMode,digest:$digest,specDigest:$specDigest,createdAt:$createdAt}' \
     > "$metadata_file"
 
-  if ! bash "$ROOT/bin/node-run.sh" \
+  local render_ok=0
+  if [ -n "$composed" ]; then
+    if bash "$ROOT/bin/node-run.sh" \
+      "$ROOT/packages/egregore-artifacts/bin/cli.js" composed "$spec_file" \
+      --source "$content_file" --verify-fidelity; then
+      render_ok=1
+    fi
+  elif bash "$ROOT/bin/node-run.sh" \
     "$ROOT/packages/egregore-artifacts/bin/cli.js" handoff "$content_file" \
     --verify-fidelity; then
-    rm -f "$content_file" "$metadata_file"
+    render_ok=1
+  fi
+  if [ "$render_ok" != "1" ]; then
+    rm -f "$content_file" "$metadata_file" "$spec_file"
     exit 1
   fi
 
@@ -132,12 +158,26 @@ approve() {
     exit 1
   fi
 
-  local author recipient topic intent content_mode
+  local author recipient topic intent content_mode spec_digest
   author="$(jq -er '.author' "$metadata_file")"
   recipient="$(jq -er '.recipient' "$metadata_file")"
   topic="$(jq -er '.topic' "$metadata_file")"
   intent="$(jq -er '.intent' "$metadata_file")"
   content_mode="$(jq -er '.contentMode' "$metadata_file")"
+  spec_digest="$(jq -r '.specDigest // ""' "$metadata_file")"
+
+  # A previewed composed spec is bound to the same token and the same digest
+  # discipline as the Markdown: approval sends exactly the previewed bytes.
+  local spec_file="$STORE_ROOT/$token.spec.json"
+  if [ -n "$spec_digest" ]; then
+    if [ ! -f "$spec_file" ] || [ "$(sha256_file "$spec_file")" != "$spec_digest" ]; then
+      rmdir "$lock_dir" 2>/dev/null || true
+      echo "handoff preview composed spec is missing or changed after approval was requested" >&2
+      exit 1
+    fi
+  else
+    spec_file=""
+  fi
 
   local result_tmp
   result_tmp="$(mktemp -d -t egregore-handoff-result-XXXXXX)"
@@ -146,6 +186,7 @@ approve() {
     --intent "$intent" --content-mode "$content_mode"
   )
   [ -z "$recipient" ] || args+=(--recipient "$recipient")
+  [ -z "$spec_file" ] || args+=(--composed "$spec_file")
 
   if ! TMPDIR="$result_tmp" bash "$ROOT/bin/artifact-writeback.sh" "${args[@]}" \
     < "$content_file"; then
@@ -153,10 +194,33 @@ approve() {
     exit 1
   fi
 
+  # Persist the composed spec beside the canonical record so the face can be
+  # re-rendered or shared later from memory alone. The record is already
+  # canonical at this point; a spec persistence failure is reported, not
+  # retried, so the approval can never write the record twice.
+  if [ -n "$spec_file" ]; then
+    local record_abs record_rel spec_rel
+    record_abs="$(jq -r '.absFile // empty' "$result_tmp/capture-run-result.json" 2>/dev/null || true)"
+    record_rel="${record_abs#"$ROOT/"}"
+    case "$record_rel" in
+      memory/*.md)
+        spec_rel="${record_rel%.md}.staircase.json"
+        if ! bash "$ROOT/bin/artifact-writeback.sh" create \
+          --path "$spec_rel" --input "$spec_file" >/dev/null; then
+          echo "warning: the canonical record was written but its composed spec could not be persisted at $spec_rel" >&2
+        fi
+        ;;
+      *)
+        echo "warning: the canonical record path is not under memory/; the composed spec was not persisted" >&2
+        ;;
+    esac
+  fi
+
   # Consume the approved token before rendering. A renderer failure must not
   # make a successful canonical write eligible for accidental replay.
   mv "$content_file" "$result_tmp/approved-handoff.md"
   mv "$metadata_file" "$result_tmp/approved-handoff.json"
+  [ -z "$spec_file" ] || mv "$spec_file" "$result_tmp/approved-handoff.staircase.json"
   rmdir "$lock_dir" 2>/dev/null || true
   bash "$ROOT/bin/render-card.sh" \
     --result "$result_tmp/capture-run-result.json"

package/runtime/claude/bin/lib/git-sync.sh

@@ -335,6 +335,9 @@ setup_develop() {
     settings_drift_heal
     git merge --ff-only "origin/$BASE_BRANCH" --quiet 2>/dev/null || true
     settings_drift_reapply
+    # Connected mode: reconcile with the control plane (org settings row) —
+    # pull a teammate's confirmed write down, or re-deliver a failed push.
+    settings_drift_pull
     settings_drift_report
   fi
 

package/runtime/claude/bin/lib/greeting.sh

@@ -99,6 +99,12 @@ fi
 if [ "${SETTINGS_ADAPTER_RESTORED:-false}" = "true" ]; then
   echo "  ◇ restored org .claude/settings.json — a generated adapter had replaced it locally"
 fi
+if [ -n "${SETTINGS_SYNCED_FROM_ORG:-}" ]; then
+  echo "  ◇ org settings synced from the control plane (${SETTINGS_SYNCED_FROM_ORG})"
+fi
+if [ -n "${SETTINGS_POSTURE_HELD:-}" ]; then
+  echo "  ◇ boundary posture was set to ${SETTINGS_POSTURE_HELD} elsewhere — relaxing access needs your confirm: bash bin/settings.sh posture ${SETTINGS_POSTURE_HELD}"
+fi
 if [ -n "${UNSHARED_SETTINGS_KEYS:-}" ]; then
   echo "  ◇ org settings changed on this machine (${UNSHARED_SETTINGS_KEYS}) — say \"share settings\" to make them org-wide"
 fi

package/runtime/claude/bin/lib/settings-drift.sh

@@ -98,8 +98,88 @@ settings_drift_reapply() {
   _SETTINGS_DRIFT_BASE=""
 }
 
+# ── control-plane sync (Connected mode) ─────────────────────────────────
+# The control plane is authoritative for org settings in Connected mode: a
+# teammate's confirmed CLI write lands in the orgs row immediately, and every
+# session start pulls it down here. One trust rule: an incoming posture that
+# RELAXES local file access is never auto-applied — it is held and surfaced
+# for local confirm; tightening applies immediately. If the server has not
+# moved but the local settings-owned keys have (an offline write whose push
+# failed), the local state is pushed instead.
+_settings_posture_rank() {
+  case "$1" in strict) echo 0 ;; open) echo 2 ;; *) echo 1 ;; esac
+}
+
+export SETTINGS_POSTURE_HELD=""
+export SETTINGS_SYNCED_FROM_ORG=""
+# true once the control plane and the local settings-owned keys agree — the
+# greeting then never asks the user to share what is already org-wide.
+export SETTINGS_CP_SYNCED="false"
+
+settings_drift_pull() {
+  local api_url api_key resp revision applied local_subset server_settings
+  api_url=$(jq -r '.api_url // empty' egregore.json 2>/dev/null)
+  [ -n "$api_url" ] || return 0
+  api_key=$(grep '^EGREGORE_API_KEY=' .env 2>/dev/null | cut -d'=' -f2-)
+  [ -n "$api_key" ] || return 0
+  resp=$(curl -s --max-time 8 -H "Authorization: Bearer $api_key" "$api_url/api/org/settings" 2>/dev/null) || return 0
+  printf '%s' "$resp" | jq -e '.settings' >/dev/null 2>&1 || return 0
+  revision=$(printf '%s' "$resp" | jq -r '.settings_revision // ""')
+  server_settings=$(printf '%s' "$resp" | jq -c '.settings')
+  applied=$(jq -r '.org_settings_revision // ""' .egregore-state.json 2>/dev/null)
+  local_subset=$(jq -c --argjson keys "$_SETTINGS_OWNED_KEYS" \
+    'with_entries(select(.key as $k | $keys | index($k)))' egregore.json 2>/dev/null)
+
+  if [ -n "$revision" ] && [ "$revision" != "$applied" ] && [ "$server_settings" != "{}" ]; then
+    # Server moved: apply it, holding a posture relaxation for local confirm.
+    local incoming_posture local_posture hold="false"
+    incoming_posture=$(printf '%s' "$resp" | jq -r '.settings.boundary.posture // empty')
+    local_posture=$(jq -r '.boundary.posture // "standard"' egregore.json 2>/dev/null)
+    if [ -n "$incoming_posture" ] \
+      && [ "$(_settings_posture_rank "$incoming_posture")" -gt "$(_settings_posture_rank "$local_posture")" ]; then
+      hold="true"
+      SETTINGS_POSTURE_HELD="$incoming_posture"
+      export SETTINGS_POSTURE_HELD
+    fi
+    local merged tmp
+    merged=$(printf '%s' "$server_settings" | jq -c \
+      --argjson keys "$_SETTINGS_OWNED_KEYS" --argjson hold "$hold" --slurpfile cfg egregore.json '
+      . as $s | $cfg[0] as $local |
+      reduce $keys[] as $k ($local;
+        if ($s | has($k)) then
+          if $k == "boundary" and $hold then
+            .boundary = (($s.boundary // {}) + {posture: ($local.boundary.posture // "standard")})
+          else .[$k] = $s[$k] end
+        else del(.[$k]) end)
+    ' 2>/dev/null || true)
+    if [ -n "$merged" ] && printf '%s' "$merged" | jq -e . >/dev/null 2>&1; then
+      tmp=$(mktemp "egregore.json.XXXXXX") || return 0
+      printf '%s\n' "$merged" | jq . > "$tmp" 2>/dev/null && [ -s "$tmp" ] && mv "$tmp" egregore.json || { rm -f "$tmp"; return 0; }
+      SETTINGS_SYNCED_FROM_ORG=$(printf '%s' "$resp" | jq -r '.settings | keys | join(", ")')
+      export SETTINGS_SYNCED_FROM_ORG
+      # A held posture keeps the revision unapplied so the next start retries.
+      if [ "$hold" = "false" ] && [ -f .egregore-state.json ]; then
+        tmp=$(mktemp ".egregore-state.json.XXXXXX") || return 0
+        jq --arg rev "$revision" '.org_settings_revision = $rev' .egregore-state.json > "$tmp" 2>/dev/null \
+          && [ -s "$tmp" ] && mv "$tmp" .egregore-state.json || rm -f "$tmp"
+        SETTINGS_CP_SYNCED="true"; export SETTINGS_CP_SYNCED
+      fi
+    fi
+  elif [ -n "$revision" ] && [ "$revision" = "$applied" ] && [ "$local_subset" != "$server_settings" ]; then
+    # Server unchanged but local settings moved (offline write, failed push):
+    # deliver the local state now. bin/settings.sh owns the push mechanics.
+    if bash bin/settings.sh push >/dev/null 2>&1; then
+      SETTINGS_CP_SYNCED="true"; export SETTINGS_CP_SYNCED
+    fi
+  elif [ "$local_subset" = "$server_settings" ]; then
+    SETTINGS_CP_SYNCED="true"; export SETTINGS_CP_SYNCED
+  fi
+}
+
 settings_drift_report() {
   UNSHARED_SETTINGS_KEYS=""
+  # Control plane already carries these settings — nothing to ask the user.
+  [ "${SETTINGS_CP_SYNCED:-false}" = "true" ] && return 0
   git diff --quiet -- egregore.json 2>/dev/null && return 0
   local tmp_head
   tmp_head=$(mktemp) || return 0

package/runtime/claude/bin/settings.sh

@@ -40,12 +40,47 @@ _save() {
   tmp="$(mktemp "$CONFIG.XXXXXX")" || _die "cannot create temp file" 1
   if jq "$@" "$filter" "$CONFIG" > "$tmp" 2>/dev/null && [ -s "$tmp" ]; then
     mv "$tmp" "$CONFIG"
+    _control_plane_push
   else
     rm -f "$tmp"
     _die "failed to update $CONFIG (invalid jq filter or unwritable file)" 1
   fi
 }
 
+# ── control-plane push (Connected mode) ──────────────────────────────────
+# A confirmed settings write reaches the control plane immediately — no
+# harness session, no git ceremony in the loop. Fail-soft: the file write
+# already landed, and a missed push is reconciled by the next session
+# start's settings sync (bin/lib/settings-drift.sh).
+_control_plane_push() {
+  local api_url api_key payload actor response revision
+  api_url=$(jq -r '.api_url // empty' "$CONFIG" 2>/dev/null)
+  [ -n "$api_url" ] || return 0
+  api_key=$(grep '^EGREGORE_API_KEY=' "$SCRIPT_DIR/.env" 2>/dev/null | cut -d'=' -f2-)
+  [ -n "$api_key" ] || return 0
+  actor=$(jq -r '.github_username // empty' "$SCRIPT_DIR/.egregore-state.json" 2>/dev/null)
+  payload=$(jq -c --arg by "$actor" '{
+    settings: ({boundary, base_branch, people_removed, features, repos, admins, people}
+      | with_entries(select(.value != null))),
+    updated_by: (if $by == "" then null else $by end)
+  }' "$CONFIG" 2>/dev/null)
+  [ -n "$payload" ] || return 0
+  response=$(curl -s --max-time 10 -X PUT "$api_url/api/org/settings" \
+    -H "Authorization: Bearer $api_key" -H "Content-Type: application/json" \
+    --data-binary "$payload" 2>/dev/null) || return 0
+  revision=$(printf '%s' "$response" | jq -r '.settings_revision // empty' 2>/dev/null)
+  if [ -n "$revision" ] && [ -f "$SCRIPT_DIR/.egregore-state.json" ]; then
+    local st
+    st="$(mktemp "$SCRIPT_DIR/.egregore-state.json.XXXXXX")" || return 0
+    if jq --arg rev "$revision" '.org_settings_revision = $rev' "$SCRIPT_DIR/.egregore-state.json" > "$st" 2>/dev/null && [ -s "$st" ]; then
+      mv "$st" "$SCRIPT_DIR/.egregore-state.json"
+    else
+      rm -f "$st"
+    fi
+  fi
+  return 0
+}
+
 _has_repo() { jq -e --arg n "$1" 'any(.repos[]?; (if type=="object" then .name else . end) == $n)' "$CONFIG" >/dev/null; }
 _has_admin() { jq -e --arg h "$1" 'any(.admins[]?; . == $h)' "$CONFIG" >/dev/null; }
 
@@ -559,6 +594,7 @@ case "$DOMAIN" in
   people)  cmd_people "$@" ;;
   privacy) cmd_privacy ;;
   posture) cmd_posture "$@" ;;
+  push)    _control_plane_push ;;
   boundary) cmd_boundary "$@" ;;
   dump)    cmd_dump ;;
   ""|-h|--help|help) usage 0 ;;

package/runtime/codex/.codex/skills/handoff/SKILL.md

@@ -70,6 +70,19 @@ Preserve supplied wording, order, headings, lists, code, and links. For
 generated content, use only the useful subset of Briefing, Current State, Open
 Threads, and Next Steps. Keep it operational and concise.
 
+## Staircase (staging)
+
+A second face for addressed handoffs exists: the staircase, a
+progressive-disclosure page the receiver walks one step at a time and closes
+with a readback (docs/specs/handoff-staircase.md). It is in staging and does
+not change this skill. When the user asks for a staircase and this instance
+has the staging command (.claude/skills/handoff-staircase/SKILL.md, Codex: the
+handoff-staircase adapter; internal to Curve Labs while in staging), route to
+it: it reuses this preview and approval bridge with a composed spec and adds
+one feedback question at the end. Without it, say the staircase is not
+installed here and continue with this skill. When its feedback
+promotes it, the staircase becomes the default here and that command retires.
+
 ## One-command preview
 
 Pipe the exact canonical Markdown once to the private preview bridge. It stores

package/runtime/codex/bin/codex-sync-skills.sh

@@ -26,6 +26,7 @@ NATIVE_SKILLS=(
 )
 
 STRUCTURED_UX_SKILLS=(
+  handoff-staircase
   activity
   dashboard
   handoff

package/runtime/codex/bin/handoff-preview.sh

@@ -13,7 +13,7 @@ usage() {
 usage:
   bash bin/handoff-preview.sh preview --author HANDLE --recipient HANDLE \
     --topic TOPIC --intent action|feedback|fyi \
-    --content-mode supplied|generated < handoff.md
+    --content-mode supplied|generated [--composed SPEC.json] < handoff.md
   bash bin/handoff-preview.sh approve TOKEN
 EOF
 }
@@ -44,7 +44,7 @@ validate_token() {
 }
 
 preview() {
-  local author="" recipient="" topic="" intent="" content_mode=""
+  local author="" recipient="" topic="" intent="" content_mode="" composed=""
   while [ $# -gt 0 ]; do
     case "$1" in
       --author) author="${2:-}"; shift 2 ;;
@@ -52,6 +52,7 @@ preview() {
       --topic) topic="${2:-}"; shift 2 ;;
       --intent) intent="${2:-}"; shift 2 ;;
       --content-mode) content_mode="${2:-}"; shift 2 ;;
+      --composed) composed="${2:-}"; shift 2 ;;
       *) echo "unknown preview option: $1" >&2; usage; exit 2 ;;
     esac
   done
@@ -60,16 +61,25 @@ preview() {
   [ -n "$topic" ] || { echo "handoff preview requires --topic" >&2; exit 2; }
   case "$intent" in action|feedback|fyi) ;; *) echo "invalid handoff intent" >&2; exit 2 ;; esac
   case "$content_mode" in supplied|generated) ;; *) echo "invalid handoff content mode" >&2; exit 2 ;; esac
+  if [ -n "$composed" ]; then
+    # A composed spec (for example a staircase) is a presentation map over the
+    # canonical Markdown. It rides the same private record and is judged by the
+    # same fidelity gate; it never replaces the Markdown as the record.
+    [ "$content_mode" = "generated" ] || { echo "--composed requires --content-mode generated" >&2; exit 2; }
+    [ -s "$composed" ] || { echo "handoff preview --composed file is missing or empty" >&2; exit 2; }
+    jq -e . "$composed" >/dev/null 2>&1 || { echo "handoff preview --composed file is not JSON" >&2; exit 2; }
+  fi
 
   umask 077
   mkdir -p "$STORE_ROOT"
   chmod 700 "$STORE_ROOT"
 
-  local token content_file metadata_file digest
+  local token content_file metadata_file spec_file digest spec_digest
   token="$(new_token)"
   validate_token "$token"
   content_file="$STORE_ROOT/$token.md"
   metadata_file="$STORE_ROOT/$token.json"
+  spec_file="$STORE_ROOT/$token.spec.json"
   cat > "$content_file"
   [ -s "$content_file" ] || {
     rm -f "$content_file"
@@ -77,6 +87,11 @@ preview() {
     exit 2
   }
   digest="$(sha256_file "$content_file")"
+  spec_digest=""
+  if [ -n "$composed" ]; then
+    cp "$composed" "$spec_file"
+    spec_digest="$(sha256_file "$spec_file")"
+  fi
   jq -n \
     --arg author "$author" \
     --arg recipient "$recipient" \
@@ -84,14 +99,25 @@ preview() {
     --arg intent "$intent" \
     --arg contentMode "$content_mode" \
     --arg digest "$digest" \
+    --arg specDigest "$spec_digest" \
     --argjson createdAt "$(date +%s)" \
-    '{author:$author,recipient:$recipient,topic:$topic,intent:$intent,contentMode:$contentMode,digest:$digest,createdAt:$createdAt}' \
+    '{author:$author,recipient:$recipient,topic:$topic,intent:$intent,contentMode:$contentMode,digest:$digest,specDigest:$specDigest,createdAt:$createdAt}' \
     > "$metadata_file"
 
-  if ! bash "$ROOT/bin/node-run.sh" \
+  local render_ok=0
+  if [ -n "$composed" ]; then
+    if bash "$ROOT/bin/node-run.sh" \
+      "$ROOT/packages/egregore-artifacts/bin/cli.js" composed "$spec_file" \
+      --source "$content_file" --verify-fidelity; then
+      render_ok=1
+    fi
+  elif bash "$ROOT/bin/node-run.sh" \
     "$ROOT/packages/egregore-artifacts/bin/cli.js" handoff "$content_file" \
     --verify-fidelity; then
-    rm -f "$content_file" "$metadata_file"
+    render_ok=1
+  fi
+  if [ "$render_ok" != "1" ]; then
+    rm -f "$content_file" "$metadata_file" "$spec_file"
     exit 1
   fi
 
@@ -132,12 +158,26 @@ approve() {
     exit 1
   fi
 
-  local author recipient topic intent content_mode
+  local author recipient topic intent content_mode spec_digest
   author="$(jq -er '.author' "$metadata_file")"
   recipient="$(jq -er '.recipient' "$metadata_file")"
   topic="$(jq -er '.topic' "$metadata_file")"
   intent="$(jq -er '.intent' "$metadata_file")"
   content_mode="$(jq -er '.contentMode' "$metadata_file")"
+  spec_digest="$(jq -r '.specDigest // ""' "$metadata_file")"
+
+  # A previewed composed spec is bound to the same token and the same digest
+  # discipline as the Markdown: approval sends exactly the previewed bytes.
+  local spec_file="$STORE_ROOT/$token.spec.json"
+  if [ -n "$spec_digest" ]; then
+    if [ ! -f "$spec_file" ] || [ "$(sha256_file "$spec_file")" != "$spec_digest" ]; then
+      rmdir "$lock_dir" 2>/dev/null || true
+      echo "handoff preview composed spec is missing or changed after approval was requested" >&2
+      exit 1
+    fi
+  else
+    spec_file=""
+  fi
 
   local result_tmp
   result_tmp="$(mktemp -d -t egregore-handoff-result-XXXXXX)"
@@ -146,6 +186,7 @@ approve() {
     --intent "$intent" --content-mode "$content_mode"
   )
   [ -z "$recipient" ] || args+=(--recipient "$recipient")
+  [ -z "$spec_file" ] || args+=(--composed "$spec_file")
 
   if ! TMPDIR="$result_tmp" bash "$ROOT/bin/artifact-writeback.sh" "${args[@]}" \
     < "$content_file"; then
@@ -153,10 +194,33 @@ approve() {
     exit 1
   fi
 
+  # Persist the composed spec beside the canonical record so the face can be
+  # re-rendered or shared later from memory alone. The record is already
+  # canonical at this point; a spec persistence failure is reported, not
+  # retried, so the approval can never write the record twice.
+  if [ -n "$spec_file" ]; then
+    local record_abs record_rel spec_rel
+    record_abs="$(jq -r '.absFile // empty' "$result_tmp/capture-run-result.json" 2>/dev/null || true)"
+    record_rel="${record_abs#"$ROOT/"}"
+    case "$record_rel" in
+      memory/*.md)
+        spec_rel="${record_rel%.md}.staircase.json"
+        if ! bash "$ROOT/bin/artifact-writeback.sh" create \
+          --path "$spec_rel" --input "$spec_file" >/dev/null; then
+          echo "warning: the canonical record was written but its composed spec could not be persisted at $spec_rel" >&2
+        fi
+        ;;
+      *)
+        echo "warning: the canonical record path is not under memory/; the composed spec was not persisted" >&2
+        ;;
+    esac
+  fi
+
   # Consume the approved token before rendering. A renderer failure must not
   # make a successful canonical write eligible for accidental replay.
   mv "$content_file" "$result_tmp/approved-handoff.md"
   mv "$metadata_file" "$result_tmp/approved-handoff.json"
+  [ -z "$spec_file" ] || mv "$spec_file" "$result_tmp/approved-handoff.staircase.json"
   rmdir "$lock_dir" 2>/dev/null || true
   bash "$ROOT/bin/render-card.sh" \
     --result "$result_tmp/capture-run-result.json"

package/runtime/codex/bin/lib/git-sync.sh

@@ -335,6 +335,9 @@ setup_develop() {
     settings_drift_heal
     git merge --ff-only "origin/$BASE_BRANCH" --quiet 2>/dev/null || true
     settings_drift_reapply
+    # Connected mode: reconcile with the control plane (org settings row) —
+    # pull a teammate's confirmed write down, or re-deliver a failed push.
+    settings_drift_pull
     settings_drift_report
   fi
 

package/runtime/codex/bin/lib/greeting.sh

@@ -99,6 +99,12 @@ fi
 if [ "${SETTINGS_ADAPTER_RESTORED:-false}" = "true" ]; then
   echo "  ◇ restored org .claude/settings.json — a generated adapter had replaced it locally"
 fi
+if [ -n "${SETTINGS_SYNCED_FROM_ORG:-}" ]; then
+  echo "  ◇ org settings synced from the control plane (${SETTINGS_SYNCED_FROM_ORG})"
+fi
+if [ -n "${SETTINGS_POSTURE_HELD:-}" ]; then
+  echo "  ◇ boundary posture was set to ${SETTINGS_POSTURE_HELD} elsewhere — relaxing access needs your confirm: bash bin/settings.sh posture ${SETTINGS_POSTURE_HELD}"
+fi
 if [ -n "${UNSHARED_SETTINGS_KEYS:-}" ]; then
   echo "  ◇ org settings changed on this machine (${UNSHARED_SETTINGS_KEYS}) — say \"share settings\" to make them org-wide"
 fi