create-egregore 0.21.0-runtime-mvp.11 → 0.21.0-runtime-mvp.13

package/assets/egregore-launcher.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// egregore-launcher-version: 0.21.0-runtime-mvp.11
+// egregore-launcher-version: 0.21.0-runtime-mvp.13
 //
 // egregore — launch and browse Egregore instances from your terminal.
 // Installed by create-egregore. Reads ~/.egregore/instances.json.
@@ -35,7 +35,7 @@ const crypto = require("node:crypto");
 const { spawnSync, spawn } = require("node:child_process");
 const readline = require("node:readline");
 
-const VERSION = "0.21.0-runtime-mvp.11";
+const VERSION = "0.21.0-runtime-mvp.13";
 const REGISTRY = path.join(os.homedir(), ".egregore", "instances.json");
 const DEFAULT_FILE = path.join(os.homedir(), ".egregore", "default");
 const UPDATE_CACHE_FILE = path.join(os.homedir(), ".egregore", "update-check.json");

package/bin/cli.js

@@ -25,32 +25,10 @@ const {
   ghCliExists,
   tryGhAuthOrLogin,
 } = require("../lib/auth");
-const {
-  hasCodexRuntimeSupport,
-  installCodexRuntime,
-  reportCodexRuntimeSummary,
-} = require("../lib/codex-runtime");
-const {
-  hasClaudeRuntimeSupport,
-  installClaudeRuntime,
-  reportClaudeRuntimeSummary,
-} = require("../lib/claude-runtime");
-const {
-  hasPiRuntimeSupport,
-  installPiRuntime,
-  reportPiRuntimeSummary,
-} = require("../lib/pi-runtime");
-const {
-  hasPrimeRuntimeSupport,
-  installPrimeRuntime,
-  reportPrimeRuntimeSummary,
-} = require("../lib/prime-runtime");
-const {
-  connectEligibility,
-  fetchConnectRuntimePack,
-  installConnectRuntime,
-  reportConnectRuntimeSummary,
-} = require("../lib/connect-runtime");
+// Runtime adapter installers are deliberately NOT imported here: the global
+// CLI never writes framework/Runtime files into registered instances. Fresh
+// installs get their files in lib/setup.js and lib/local.js; existing
+// instances upgrade only through their own Settings prepare → activate flow.
 const {
   install,
   ghApi,
@@ -125,50 +103,15 @@ function assistantLabel(runtime) {
   return "Claude Code";
 }
 
-async function upgradePortableRuntimesForExisting(instances) {
-  for (const inst of instances) {
-    if (!inst || !inst.path || !fs.existsSync(inst.path)) continue;
-    try {
-      // Fetch and validate the private overlay before pruning the old public
-      // bundle. During the one-time ownership migration, an API outage must
-      // leave an existing Connect installation untouched.
-      const eligibility = connectEligibility(inst.path);
-      const connectPack = eligibility.eligible
-        ? await fetchConnectRuntimePack(inst.path)
-        : null;
-      const claudeSummary = installClaudeRuntime(inst.path);
-      const claudeReady = hasClaudeRuntimeSupport(inst.path);
-      reportClaudeRuntimeSummary(claudeSummary, ui, {
-        label: `Claude Code runtime for ${inst.slug || inst.name || path.basename(inst.path)}`,
-        includeConflicts: !claudeReady,
-      });
-      const summary = installCodexRuntime(inst.path);
-      const ready = hasCodexRuntimeSupport(inst.path);
-      reportCodexRuntimeSummary(summary, ui, {
-        label: `Codex runtime for ${inst.slug || inst.name || path.basename(inst.path)}`,
-        includeConflicts: !ready,
-      });
-      const piSummary = installPiRuntime(inst.path);
-      const piReady = hasPiRuntimeSupport(inst.path);
-      reportPiRuntimeSummary(piSummary, ui, {
-        label: `Pi meta-harness for ${inst.slug || inst.name || path.basename(inst.path)}`,
-        includeConflicts: !piReady,
-      });
-      const primeSummary = installPrimeRuntime(inst.path);
-      const primeReady = hasPrimeRuntimeSupport(inst.path);
-      reportPrimeRuntimeSummary(primeSummary, ui, {
-        label: `Prime Agent runtime for ${inst.slug || inst.name || path.basename(inst.path)}`,
-        includeConflicts: !primeReady,
-      });
-      const connectSummary = await installConnectRuntime(inst.path, { validatedPack: connectPack });
-      reportConnectRuntimeSummary(connectSummary, ui, {
-        label: `Connect features for ${inst.slug || inst.name || path.basename(inst.path)}`,
-      });
-    } catch (err) {
-      ui.warn(`Could not refresh shell-runtime support for ${inst.path}: ${err.message}`);
-    }
-  }
-}
+// Runtime ownership contract: refreshing the global CLI updates ONLY the
+// global CLI. Registered instances are never installed into, updated,
+// removed from, or reconciled here — an existing instance crosses into the
+// new Runtime exclusively through its own Settings flow
+// (prepare → confirm → activate), which applies engine and all harness
+// adapters transactionally from one verified candidate. A CLI refresh that
+// sprayed adapters into every registered instance is exactly how a legacy
+// instance became an incoherent mixture of old framework and new hooks
+// (its own upstream sync then reverted the tracked half).
 
 async function chooseRuntime(args) {
   if (args.runtime) {
@@ -210,7 +153,6 @@ async function chooseRuntime(args) {
 }
 
 async function upgradeLauncherFromExisting(instances) {
-  await upgradePortableRuntimesForExisting(instances);
   const inst = instances.find((entry) => entry && entry.path && fs.existsSync(entry.path));
   if (!inst) return null;
   try {
@@ -524,7 +466,6 @@ async function main() {
       ui.error("No installed Egregore instance was found. Run create-egregore without --refresh-launcher.");
       process.exit(1);
     }
-    await upgradePortableRuntimesForExisting(instances);
     const alias = await installLauncherBinary(instances[0].path, ui);
     if (!alias || !alias.binaryPath) {
       ui.error("Could not refresh the Egregore CLI.");

package/lib/setup.js

@@ -577,14 +577,20 @@ async function install(data, ui, targetDir, opts = {}) {
   try { ensurePersonOnboardingWitness(memoryDir, state); } catch {}
 
   // 4c. Overlay the selected harness adapter from the installed npm artifact.
-  // Each adapter shares the same Egregore Runtime while keeping harness files
-  // thin and independently refreshable.
+  // This is the one-time explicit setup write; launches never install
+  // framework files (see the ownership contract at the launch path), and
+  // existing instances change only through their Settings
+  // prepare → confirm → activate flow — which applies ALL FOUR harness
+  // trees from one verified candidate.
   if (preferredRuntime === "claude-code") {
     const claudeRuntime = installClaudeRuntime(egregoreDir);
     reportClaudeRuntimeSummary(claudeRuntime, ui);
   } else if (preferredRuntime === "codex") {
     const codexRuntime = installCodexRuntime(egregoreDir);
     reportCodexRuntimeSummary(codexRuntime, ui);
+    // Codex-native skills are framework code, so they render at setup —
+    // previously they were sprayed at every launch.
+    try { installCodexSkills(egregoreDir); } catch {}
   } else if (preferredRuntime === "pi") {
     const piRuntime = installPiRuntime(egregoreDir);
     reportPiRuntimeSummary(piRuntime, ui);
@@ -1251,50 +1257,16 @@ async function launchOrInstruct(egregoreDir, alias, ui, ctx = {}) {
   ui.info(`Next time, ${launcherNextStep(ui, aliasName)}`);
   console.log("");
 
-  if (runtime === "claude-code") {
-    const claudeRuntime = installClaudeRuntime(egregoreDir);
-    reportClaudeRuntimeSummary(claudeRuntime, ui);
-    if (!hasClaudeRuntimeSupport(egregoreDir)) {
-      ui.warn("Claude Code runtime support is incomplete; refresh this Egregore before launching.");
-      ui.info(`Run ${ui.bold(aliasName)} after updating the checkout.`);
-      console.log("");
-      return;
-    }
-  } else if (runtime === "codex") {
-    const codexRuntime = installCodexRuntime(egregoreDir);
-    reportCodexRuntimeSummary(codexRuntime, ui);
-    if (!hasCodexCoreSupport(egregoreDir)) {
-      ui.warn(codexSupportMessage(egregoreDir));
-      ui.info(`Run ${ui.bold(aliasName)} after updating the checkout.`);
-      console.log("");
-      return;
-    }
-    const skillsInstalled = installCodexSkills(egregoreDir);
-    const cardRendered = await renderCodexStartupCard(egregoreDir);
-    if (!skillsInstalled || !cardRendered) {
-      ui.warn(codexSupportMessage(egregoreDir));
-      ui.info(`Run ${ui.bold(aliasName)} after updating the checkout.`);
-      console.log("");
-      return;
-    }
-  } else if (runtime === "pi") {
-    const piRuntime = installPiRuntime(egregoreDir);
-    reportPiRuntimeSummary(piRuntime, ui);
-    if (!hasPiRuntimeSupport(egregoreDir)) {
-      ui.warn(piSupportMessage(egregoreDir));
-      ui.info(`Run ${ui.bold(aliasName)} after updating the checkout.`);
-      console.log("");
-      return;
-    }
-  } else if (runtime === "prime") {
-    const primeRuntime = installPrimeRuntime(egregoreDir);
-    reportPrimeRuntimeSummary(primeRuntime, ui);
-    if (!hasPrimeRuntimeSupport(egregoreDir)) {
-      ui.warn(primeSupportMessage(egregoreDir));
-      ui.info(`Run ${ui.bold(aliasName)} after updating the checkout.`);
-      console.log("");
-      return;
-    }
+  // Runtime ownership contract: launching NEVER adds, replaces, or removes
+  // framework/Runtime code. Fresh installs received their files during
+  // explicit setup; existing instances change only through their own
+  // Settings prepare → confirm → activate flow. A legacy instance opens
+  // exactly as it is — old framework, old graph retrieval, no commentary.
+  // The one launch-time write kept below is the Codex startup card, which is
+  // rendered presentation state, not framework code; a legacy instance
+  // without the renderer skips it silently.
+  if (runtime === "codex") {
+    try { await renderCodexStartupCard(egregoreDir); } catch {}
   }
 
   const result = spawnSync(binary, runtimeLaunchArgs(runtime, egregoreDir), {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-egregore",
-  "version": "0.21.0-runtime-mvp.11",
+  "version": "0.21.0-runtime-mvp.13",
   "description": "Set up Egregore for your team in one command — installs the egregore launcher and your choice of Claude Code, Codex, or Pi.",
   "license": "MIT",
   "bin": {

package/runtime/claude/.claude/skills/handoff/SKILL.md

@@ -74,6 +74,19 @@ Preserve supplied wording, order, headings, lists, code, and links. For
 generated content, use only the useful subset of Briefing, Current State, Open
 Threads, and Next Steps. Keep it operational and concise.
 
+## Staircase (staging)
+
+A second face for addressed handoffs exists: the staircase, a
+progressive-disclosure page the receiver walks one step at a time and closes
+with a readback (docs/specs/handoff-staircase.md). It is in staging and does
+not change this skill. When the user asks for a staircase and this instance
+has the staging command (.claude/skills/handoff-staircase/SKILL.md, Codex: the
+handoff-staircase adapter; internal to Curve Labs while in staging), route to
+it: it reuses this preview and approval bridge with a composed spec and adds
+one feedback question at the end. Without it, say the staircase is not
+installed here and continue with this skill. When its feedback
+promotes it, the staircase becomes the default here and that command retires.
+
 ## One-command preview
 
 Pipe the exact canonical Markdown once to the private preview bridge. It stores

package/runtime/claude/bin/codex-sync-skills.sh

@@ -26,6 +26,7 @@ NATIVE_SKILLS=(
 )
 
 STRUCTURED_UX_SKILLS=(
+  handoff-staircase
   activity
   dashboard
   handoff

package/runtime/claude/bin/handoff-preview.sh

@@ -13,7 +13,7 @@ usage() {
 usage:
   bash bin/handoff-preview.sh preview --author HANDLE --recipient HANDLE \
     --topic TOPIC --intent action|feedback|fyi \
-    --content-mode supplied|generated < handoff.md
+    --content-mode supplied|generated [--composed SPEC.json] < handoff.md
   bash bin/handoff-preview.sh approve TOKEN
 EOF
 }
@@ -44,7 +44,7 @@ validate_token() {
 }
 
 preview() {
-  local author="" recipient="" topic="" intent="" content_mode=""
+  local author="" recipient="" topic="" intent="" content_mode="" composed=""
   while [ $# -gt 0 ]; do
     case "$1" in
       --author) author="${2:-}"; shift 2 ;;
@@ -52,6 +52,7 @@ preview() {
       --topic) topic="${2:-}"; shift 2 ;;
       --intent) intent="${2:-}"; shift 2 ;;
       --content-mode) content_mode="${2:-}"; shift 2 ;;
+      --composed) composed="${2:-}"; shift 2 ;;
       *) echo "unknown preview option: $1" >&2; usage; exit 2 ;;
     esac
   done
@@ -60,16 +61,25 @@ preview() {
   [ -n "$topic" ] || { echo "handoff preview requires --topic" >&2; exit 2; }
   case "$intent" in action|feedback|fyi) ;; *) echo "invalid handoff intent" >&2; exit 2 ;; esac
   case "$content_mode" in supplied|generated) ;; *) echo "invalid handoff content mode" >&2; exit 2 ;; esac
+  if [ -n "$composed" ]; then
+    # A composed spec (for example a staircase) is a presentation map over the
+    # canonical Markdown. It rides the same private record and is judged by the
+    # same fidelity gate; it never replaces the Markdown as the record.
+    [ "$content_mode" = "generated" ] || { echo "--composed requires --content-mode generated" >&2; exit 2; }
+    [ -s "$composed" ] || { echo "handoff preview --composed file is missing or empty" >&2; exit 2; }
+    jq -e . "$composed" >/dev/null 2>&1 || { echo "handoff preview --composed file is not JSON" >&2; exit 2; }
+  fi
 
   umask 077
   mkdir -p "$STORE_ROOT"
   chmod 700 "$STORE_ROOT"
 
-  local token content_file metadata_file digest
+  local token content_file metadata_file spec_file digest spec_digest
   token="$(new_token)"
   validate_token "$token"
   content_file="$STORE_ROOT/$token.md"
   metadata_file="$STORE_ROOT/$token.json"
+  spec_file="$STORE_ROOT/$token.spec.json"
   cat > "$content_file"
   [ -s "$content_file" ] || {
     rm -f "$content_file"
@@ -77,6 +87,11 @@ preview() {
     exit 2
   }
   digest="$(sha256_file "$content_file")"
+  spec_digest=""
+  if [ -n "$composed" ]; then
+    cp "$composed" "$spec_file"
+    spec_digest="$(sha256_file "$spec_file")"
+  fi
   jq -n \
     --arg author "$author" \
     --arg recipient "$recipient" \
@@ -84,14 +99,25 @@ preview() {
     --arg intent "$intent" \
     --arg contentMode "$content_mode" \
     --arg digest "$digest" \
+    --arg specDigest "$spec_digest" \
     --argjson createdAt "$(date +%s)" \
-    '{author:$author,recipient:$recipient,topic:$topic,intent:$intent,contentMode:$contentMode,digest:$digest,createdAt:$createdAt}' \
+    '{author:$author,recipient:$recipient,topic:$topic,intent:$intent,contentMode:$contentMode,digest:$digest,specDigest:$specDigest,createdAt:$createdAt}' \
     > "$metadata_file"
 
-  if ! bash "$ROOT/bin/node-run.sh" \
+  local render_ok=0
+  if [ -n "$composed" ]; then
+    if bash "$ROOT/bin/node-run.sh" \
+      "$ROOT/packages/egregore-artifacts/bin/cli.js" composed "$spec_file" \
+      --source "$content_file" --verify-fidelity; then
+      render_ok=1
+    fi
+  elif bash "$ROOT/bin/node-run.sh" \
     "$ROOT/packages/egregore-artifacts/bin/cli.js" handoff "$content_file" \
     --verify-fidelity; then
-    rm -f "$content_file" "$metadata_file"
+    render_ok=1
+  fi
+  if [ "$render_ok" != "1" ]; then
+    rm -f "$content_file" "$metadata_file" "$spec_file"
     exit 1
   fi
 
@@ -132,12 +158,26 @@ approve() {
     exit 1
   fi
 
-  local author recipient topic intent content_mode
+  local author recipient topic intent content_mode spec_digest
   author="$(jq -er '.author' "$metadata_file")"
   recipient="$(jq -er '.recipient' "$metadata_file")"
   topic="$(jq -er '.topic' "$metadata_file")"
   intent="$(jq -er '.intent' "$metadata_file")"
   content_mode="$(jq -er '.contentMode' "$metadata_file")"
+  spec_digest="$(jq -r '.specDigest // ""' "$metadata_file")"
+
+  # A previewed composed spec is bound to the same token and the same digest
+  # discipline as the Markdown: approval sends exactly the previewed bytes.
+  local spec_file="$STORE_ROOT/$token.spec.json"
+  if [ -n "$spec_digest" ]; then
+    if [ ! -f "$spec_file" ] || [ "$(sha256_file "$spec_file")" != "$spec_digest" ]; then
+      rmdir "$lock_dir" 2>/dev/null || true
+      echo "handoff preview composed spec is missing or changed after approval was requested" >&2
+      exit 1
+    fi
+  else
+    spec_file=""
+  fi
 
   local result_tmp
   result_tmp="$(mktemp -d -t egregore-handoff-result-XXXXXX)"
@@ -146,6 +186,7 @@ approve() {
     --intent "$intent" --content-mode "$content_mode"
   )
   [ -z "$recipient" ] || args+=(--recipient "$recipient")
+  [ -z "$spec_file" ] || args+=(--composed "$spec_file")
 
   if ! TMPDIR="$result_tmp" bash "$ROOT/bin/artifact-writeback.sh" "${args[@]}" \
     < "$content_file"; then
@@ -153,10 +194,33 @@ approve() {
     exit 1
   fi
 
+  # Persist the composed spec beside the canonical record so the face can be
+  # re-rendered or shared later from memory alone. The record is already
+  # canonical at this point; a spec persistence failure is reported, not
+  # retried, so the approval can never write the record twice.
+  if [ -n "$spec_file" ]; then
+    local record_abs record_rel spec_rel
+    record_abs="$(jq -r '.absFile // empty' "$result_tmp/capture-run-result.json" 2>/dev/null || true)"
+    record_rel="${record_abs#"$ROOT/"}"
+    case "$record_rel" in
+      memory/*.md)
+        spec_rel="${record_rel%.md}.staircase.json"
+        if ! bash "$ROOT/bin/artifact-writeback.sh" create \
+          --path "$spec_rel" --input "$spec_file" >/dev/null; then
+          echo "warning: the canonical record was written but its composed spec could not be persisted at $spec_rel" >&2
+        fi
+        ;;
+      *)
+        echo "warning: the canonical record path is not under memory/; the composed spec was not persisted" >&2
+        ;;
+    esac
+  fi
+
   # Consume the approved token before rendering. A renderer failure must not
   # make a successful canonical write eligible for accidental replay.
   mv "$content_file" "$result_tmp/approved-handoff.md"
   mv "$metadata_file" "$result_tmp/approved-handoff.json"
+  [ -z "$spec_file" ] || mv "$spec_file" "$result_tmp/approved-handoff.staircase.json"
   rmdir "$lock_dir" 2>/dev/null || true
   bash "$ROOT/bin/render-card.sh" \
     --result "$result_tmp/capture-run-result.json"

package/runtime/claude/bin/lib/git-sync.sh

@@ -28,6 +28,10 @@ SYNC_RECEIPT=""
 # shellcheck source=bin/lib/settings-drift.sh
 source "$SCRIPT_DIR/bin/lib/settings-drift.sh"
 
+# Runtime framework ownership (activation record gate for legacy sync).
+# shellcheck source=bin/lib/runtime-owned.sh
+source "$SCRIPT_DIR/bin/lib/runtime-owned.sh"
+
 # The core repo's integration branch: "develop" unless egregore.json sets
 # base_branch. session-start.sh resolves this before sourcing; resolve it here
 # too so the lib stands alone for other callers.
@@ -181,6 +185,14 @@ _apply_framework_update() {
   if [ "$_UPSTREAM_URL" = "none" ] || [ "$_AUTO_UPDATE" != "true" ]; then
     return 0
   fi
+  # Runtime ownership: once this exact instance activated the new Runtime
+  # (activation record with retrieval runtime-qmd), the legacy upstream sync
+  # must never overwrite Runtime-owned framework paths — that fight is how a
+  # launched-then-synced instance became a broken old/new mixture. Rollback
+  # flips the record off runtime-qmd and legacy ownership resumes here.
+  if runtime_owns_framework 2>/dev/null; then
+    return 0
+  fi
   if ! git show-ref --verify --quiet refs/remotes/upstream/main 2>/dev/null; then
     return 0
   fi
@@ -335,6 +347,9 @@ setup_develop() {
     settings_drift_heal
     git merge --ff-only "origin/$BASE_BRANCH" --quiet 2>/dev/null || true
     settings_drift_reapply
+    # Connected mode: reconcile with the control plane (org settings row) —
+    # pull a teammate's confirmed write down, or re-deliver a failed push.
+    settings_drift_pull
     settings_drift_report
   fi
 

package/runtime/claude/bin/lib/greeting.sh

@@ -99,6 +99,12 @@ fi
 if [ "${SETTINGS_ADAPTER_RESTORED:-false}" = "true" ]; then
   echo "  ◇ restored org .claude/settings.json — a generated adapter had replaced it locally"
 fi
+if [ -n "${SETTINGS_SYNCED_FROM_ORG:-}" ]; then
+  echo "  ◇ org settings synced from the control plane (${SETTINGS_SYNCED_FROM_ORG})"
+fi
+if [ -n "${SETTINGS_POSTURE_HELD:-}" ]; then
+  echo "  ◇ boundary posture was set to ${SETTINGS_POSTURE_HELD} elsewhere — relaxing access needs your confirm: bash bin/settings.sh posture ${SETTINGS_POSTURE_HELD}"
+fi
 if [ -n "${UNSHARED_SETTINGS_KEYS:-}" ]; then
   echo "  ◇ org settings changed on this machine (${UNSHARED_SETTINGS_KEYS}) — say \"share settings\" to make them org-wide"
 fi

package/runtime/claude/bin/lib/runtime-owned.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# runtime-owned.sh — does the Runtime own this instance's framework paths?
+#
+# True exactly when THIS instance has an activation record whose retrieval
+# mode is runtime-qmd. Uses the same stable identity as the Python upgrade
+# store and the graph cutover gate: sha256(org_id | main-checkout path),
+# first 16 hex chars, under EGREGORE_UPGRADE_ROOT (default
+# ~/.egregore/runtime/upgrade). No global flag, no pathname guess, no slug,
+# no branch name, no hardcoded organization or version.
+#
+# After a rollback the record's retrieval flips to previous-runtime, so this
+# returns false again and legacy framework ownership resumes automatically.
+#
+# Contract: sourced with SCRIPT_DIR set to the instance root.
+
+runtime_owns_framework() {
+  local org main gd key rec
+  org=$(jq -r '.org_id // empty' "$SCRIPT_DIR/egregore.json" 2>/dev/null)
+  [ -n "$org" ] || return 1
+  main="$SCRIPT_DIR"
+  if [ -f "$SCRIPT_DIR/.git" ]; then
+    gd=$(sed -n 's/^gitdir: //p' "$SCRIPT_DIR/.git" 2>/dev/null)
+    case "$gd" in */.git/worktrees/*) main="${gd%/.git/worktrees/*}" ;; esac
+  fi
+  main=$(cd "$main" 2>/dev/null && pwd -P || printf '%s' "$SCRIPT_DIR")
+  key=$(printf '%s|%s' "$org" "$main" | shasum -a 256 2>/dev/null | cut -c1-16)
+  [ -n "$key" ] || return 1
+  rec="${EGREGORE_UPGRADE_ROOT:-$HOME/.egregore/runtime/upgrade}/${key}/active.json"
+  [ -f "$rec" ] && [ "$(jq -r '.retrieval // empty' "$rec" 2>/dev/null)" = "runtime-qmd" ]
+}

package/runtime/claude/bin/lib/settings-drift.sh

@@ -98,8 +98,88 @@ settings_drift_reapply() {
   _SETTINGS_DRIFT_BASE=""
 }
 
+# ── control-plane sync (Connected mode) ─────────────────────────────────
+# The control plane is authoritative for org settings in Connected mode: a
+# teammate's confirmed CLI write lands in the orgs row immediately, and every
+# session start pulls it down here. One trust rule: an incoming posture that
+# RELAXES local file access is never auto-applied — it is held and surfaced
+# for local confirm; tightening applies immediately. If the server has not
+# moved but the local settings-owned keys have (an offline write whose push
+# failed), the local state is pushed instead.
+_settings_posture_rank() {
+  case "$1" in strict) echo 0 ;; open) echo 2 ;; *) echo 1 ;; esac
+}
+
+export SETTINGS_POSTURE_HELD=""
+export SETTINGS_SYNCED_FROM_ORG=""
+# true once the control plane and the local settings-owned keys agree — the
+# greeting then never asks the user to share what is already org-wide.
+export SETTINGS_CP_SYNCED="false"
+
+settings_drift_pull() {
+  local api_url api_key resp revision applied local_subset server_settings
+  api_url=$(jq -r '.api_url // empty' egregore.json 2>/dev/null)
+  [ -n "$api_url" ] || return 0
+  api_key=$(grep '^EGREGORE_API_KEY=' .env 2>/dev/null | cut -d'=' -f2-)
+  [ -n "$api_key" ] || return 0
+  resp=$(curl -s --max-time 8 -H "Authorization: Bearer $api_key" "$api_url/api/org/settings" 2>/dev/null) || return 0
+  printf '%s' "$resp" | jq -e '.settings' >/dev/null 2>&1 || return 0
+  revision=$(printf '%s' "$resp" | jq -r '.settings_revision // ""')
+  server_settings=$(printf '%s' "$resp" | jq -c '.settings')
+  applied=$(jq -r '.org_settings_revision // ""' .egregore-state.json 2>/dev/null)
+  local_subset=$(jq -c --argjson keys "$_SETTINGS_OWNED_KEYS" \
+    'with_entries(select(.key as $k | $keys | index($k)))' egregore.json 2>/dev/null)
+
+  if [ -n "$revision" ] && [ "$revision" != "$applied" ] && [ "$server_settings" != "{}" ]; then
+    # Server moved: apply it, holding a posture relaxation for local confirm.
+    local incoming_posture local_posture hold="false"
+    incoming_posture=$(printf '%s' "$resp" | jq -r '.settings.boundary.posture // empty')
+    local_posture=$(jq -r '.boundary.posture // "standard"' egregore.json 2>/dev/null)
+    if [ -n "$incoming_posture" ] \
+      && [ "$(_settings_posture_rank "$incoming_posture")" -gt "$(_settings_posture_rank "$local_posture")" ]; then
+      hold="true"
+      SETTINGS_POSTURE_HELD="$incoming_posture"
+      export SETTINGS_POSTURE_HELD
+    fi
+    local merged tmp
+    merged=$(printf '%s' "$server_settings" | jq -c \
+      --argjson keys "$_SETTINGS_OWNED_KEYS" --argjson hold "$hold" --slurpfile cfg egregore.json '
+      . as $s | $cfg[0] as $local |
+      reduce $keys[] as $k ($local;
+        if ($s | has($k)) then
+          if $k == "boundary" and $hold then
+            .boundary = (($s.boundary // {}) + {posture: ($local.boundary.posture // "standard")})
+          else .[$k] = $s[$k] end
+        else del(.[$k]) end)
+    ' 2>/dev/null || true)
+    if [ -n "$merged" ] && printf '%s' "$merged" | jq -e . >/dev/null 2>&1; then
+      tmp=$(mktemp "egregore.json.XXXXXX") || return 0
+      printf '%s\n' "$merged" | jq . > "$tmp" 2>/dev/null && [ -s "$tmp" ] && mv "$tmp" egregore.json || { rm -f "$tmp"; return 0; }
+      SETTINGS_SYNCED_FROM_ORG=$(printf '%s' "$resp" | jq -r '.settings | keys | join(", ")')
+      export SETTINGS_SYNCED_FROM_ORG
+      # A held posture keeps the revision unapplied so the next start retries.
+      if [ "$hold" = "false" ] && [ -f .egregore-state.json ]; then
+        tmp=$(mktemp ".egregore-state.json.XXXXXX") || return 0
+        jq --arg rev "$revision" '.org_settings_revision = $rev' .egregore-state.json > "$tmp" 2>/dev/null \
+          && [ -s "$tmp" ] && mv "$tmp" .egregore-state.json || rm -f "$tmp"
+        SETTINGS_CP_SYNCED="true"; export SETTINGS_CP_SYNCED
+      fi
+    fi
+  elif [ -n "$revision" ] && [ "$revision" = "$applied" ] && [ "$local_subset" != "$server_settings" ]; then
+    # Server unchanged but local settings moved (offline write, failed push):
+    # deliver the local state now. bin/settings.sh owns the push mechanics.
+    if bash bin/settings.sh push >/dev/null 2>&1; then
+      SETTINGS_CP_SYNCED="true"; export SETTINGS_CP_SYNCED
+    fi
+  elif [ "$local_subset" = "$server_settings" ]; then
+    SETTINGS_CP_SYNCED="true"; export SETTINGS_CP_SYNCED
+  fi
+}
+
 settings_drift_report() {
   UNSHARED_SETTINGS_KEYS=""
+  # Control plane already carries these settings — nothing to ask the user.
+  [ "${SETTINGS_CP_SYNCED:-false}" = "true" ] && return 0
   git diff --quiet -- egregore.json 2>/dev/null && return 0
   local tmp_head
   tmp_head=$(mktemp) || return 0

package/runtime/claude/bin/settings.sh

@@ -40,12 +40,47 @@ _save() {
   tmp="$(mktemp "$CONFIG.XXXXXX")" || _die "cannot create temp file" 1
   if jq "$@" "$filter" "$CONFIG" > "$tmp" 2>/dev/null && [ -s "$tmp" ]; then
     mv "$tmp" "$CONFIG"
+    _control_plane_push
   else
     rm -f "$tmp"
     _die "failed to update $CONFIG (invalid jq filter or unwritable file)" 1
   fi
 }
 
+# ── control-plane push (Connected mode) ──────────────────────────────────
+# A confirmed settings write reaches the control plane immediately — no
+# harness session, no git ceremony in the loop. Fail-soft: the file write
+# already landed, and a missed push is reconciled by the next session
+# start's settings sync (bin/lib/settings-drift.sh).
+_control_plane_push() {
+  local api_url api_key payload actor response revision
+  api_url=$(jq -r '.api_url // empty' "$CONFIG" 2>/dev/null)
+  [ -n "$api_url" ] || return 0
+  api_key=$(grep '^EGREGORE_API_KEY=' "$SCRIPT_DIR/.env" 2>/dev/null | cut -d'=' -f2-)
+  [ -n "$api_key" ] || return 0
+  actor=$(jq -r '.github_username // empty' "$SCRIPT_DIR/.egregore-state.json" 2>/dev/null)
+  payload=$(jq -c --arg by "$actor" '{
+    settings: ({boundary, base_branch, people_removed, features, repos, admins, people}
+      | with_entries(select(.value != null))),
+    updated_by: (if $by == "" then null else $by end)
+  }' "$CONFIG" 2>/dev/null)
+  [ -n "$payload" ] || return 0
+  response=$(curl -s --max-time 10 -X PUT "$api_url/api/org/settings" \
+    -H "Authorization: Bearer $api_key" -H "Content-Type: application/json" \
+    --data-binary "$payload" 2>/dev/null) || return 0
+  revision=$(printf '%s' "$response" | jq -r '.settings_revision // empty' 2>/dev/null)
+  if [ -n "$revision" ] && [ -f "$SCRIPT_DIR/.egregore-state.json" ]; then
+    local st
+    st="$(mktemp "$SCRIPT_DIR/.egregore-state.json.XXXXXX")" || return 0
+    if jq --arg rev "$revision" '.org_settings_revision = $rev' "$SCRIPT_DIR/.egregore-state.json" > "$st" 2>/dev/null && [ -s "$st" ]; then
+      mv "$st" "$SCRIPT_DIR/.egregore-state.json"
+    else
+      rm -f "$st"
+    fi
+  fi
+  return 0
+}
+
 _has_repo() { jq -e --arg n "$1" 'any(.repos[]?; (if type=="object" then .name else . end) == $n)' "$CONFIG" >/dev/null; }
 _has_admin() { jq -e --arg h "$1" 'any(.admins[]?; . == $h)' "$CONFIG" >/dev/null; }
 
@@ -559,6 +594,7 @@ case "$DOMAIN" in
   people)  cmd_people "$@" ;;
   privacy) cmd_privacy ;;
   posture) cmd_posture "$@" ;;
+  push)    _control_plane_push ;;
   boundary) cmd_boundary "$@" ;;
   dump)    cmd_dump ;;
   ""|-h|--help|help) usage 0 ;;

package/runtime/claude/egregore_runtime/harness_cli.py

@@ -897,6 +897,9 @@ def _upgrade(args: argparse.Namespace) -> int:
         state = upgrade_module.describe(store.load())
         state["active_version"] = _active_runtime_version(root, store)
         state["instance_hash"] = upgrade_module.instance_key(root)
+        # A live apply journal means a previous candidate application died
+        # mid-transaction; the next activate recovers deterministically.
+        state["interrupted_apply"] = store.load_apply_journal() is not None
         memory_root = (root / "memory").resolve()
         if memory_root.is_dir():
             state["team_sync"] = team_sync(memory_root, fetch=bool(args.fetch)).to_dict()