create-egregore 0.21.0-runtime-mvp.12 → 0.21.0-runtime-mvp.14

package/assets/egregore-launcher.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// egregore-launcher-version: 0.21.0-runtime-mvp.12
+// egregore-launcher-version: 0.21.0-runtime-mvp.14
 //
 // egregore — launch and browse Egregore instances from your terminal.
 // Installed by create-egregore. Reads ~/.egregore/instances.json.
@@ -35,7 +35,7 @@ const crypto = require("node:crypto");
 const { spawnSync, spawn } = require("node:child_process");
 const readline = require("node:readline");
 
-const VERSION = "0.21.0-runtime-mvp.12";
+const VERSION = "0.21.0-runtime-mvp.14";
 const REGISTRY = path.join(os.homedir(), ".egregore", "instances.json");
 const DEFAULT_FILE = path.join(os.homedir(), ".egregore", "default");
 const UPDATE_CACHE_FILE = path.join(os.homedir(), ".egregore", "update-check.json");
@@ -2673,7 +2673,11 @@ function formatUpgradeLines(inst, st, { candidate = "", retrieval = null } = {})
     + (d.candidate_version ? ` → candidate ${d.candidate_version}` : candidate ? ` → candidate ${candidate} available` : ""));
   lines.push(`Status: ${UPGRADE_STATUS_LABEL[d.status] || d.status}`);
   if (d.candidate_digest) lines.push(`Package digest: sha256 ${String(d.candidate_digest).slice(0, 16)}…`);
-  if (d.failure && d.failure.message) lines.push(`Attention: ${d.failure.message}`);
+  // A recorded failure only needs attention while the transaction is stuck
+  // on it; once a later prepare succeeds the line would contradict "ready".
+  if (d.failure && d.failure.message && (d.status === "failed" || d.status === "interrupted")) {
+    lines.push(`Attention: ${d.failure.message}`);
+  }
   if (d.rollback_version && d.status !== "none") lines.push(`Rollback target: ${d.rollback_version}`);
   const ts = d.team_sync;
   if (ts && ts.label) lines.push(`Team memory: ${ts.label}`);

package/bin/cli.js

@@ -25,32 +25,10 @@ const {
   ghCliExists,
   tryGhAuthOrLogin,
 } = require("../lib/auth");
-const {
-  hasCodexRuntimeSupport,
-  installCodexRuntime,
-  reportCodexRuntimeSummary,
-} = require("../lib/codex-runtime");
-const {
-  hasClaudeRuntimeSupport,
-  installClaudeRuntime,
-  reportClaudeRuntimeSummary,
-} = require("../lib/claude-runtime");
-const {
-  hasPiRuntimeSupport,
-  installPiRuntime,
-  reportPiRuntimeSummary,
-} = require("../lib/pi-runtime");
-const {
-  hasPrimeRuntimeSupport,
-  installPrimeRuntime,
-  reportPrimeRuntimeSummary,
-} = require("../lib/prime-runtime");
-const {
-  connectEligibility,
-  fetchConnectRuntimePack,
-  installConnectRuntime,
-  reportConnectRuntimeSummary,
-} = require("../lib/connect-runtime");
+// Runtime adapter installers are deliberately NOT imported here: the global
+// CLI never writes framework/Runtime files into registered instances. Fresh
+// installs get their files in lib/setup.js and lib/local.js; existing
+// instances upgrade only through their own Settings prepare → activate flow.
 const {
   install,
   ghApi,
@@ -125,50 +103,15 @@ function assistantLabel(runtime) {
   return "Claude Code";
 }
 
-async function upgradePortableRuntimesForExisting(instances) {
-  for (const inst of instances) {
-    if (!inst || !inst.path || !fs.existsSync(inst.path)) continue;
-    try {
-      // Fetch and validate the private overlay before pruning the old public
-      // bundle. During the one-time ownership migration, an API outage must
-      // leave an existing Connect installation untouched.
-      const eligibility = connectEligibility(inst.path);
-      const connectPack = eligibility.eligible
-        ? await fetchConnectRuntimePack(inst.path)
-        : null;
-      const claudeSummary = installClaudeRuntime(inst.path);
-      const claudeReady = hasClaudeRuntimeSupport(inst.path);
-      reportClaudeRuntimeSummary(claudeSummary, ui, {
-        label: `Claude Code runtime for ${inst.slug || inst.name || path.basename(inst.path)}`,
-        includeConflicts: !claudeReady,
-      });
-      const summary = installCodexRuntime(inst.path);
-      const ready = hasCodexRuntimeSupport(inst.path);
-      reportCodexRuntimeSummary(summary, ui, {
-        label: `Codex runtime for ${inst.slug || inst.name || path.basename(inst.path)}`,
-        includeConflicts: !ready,
-      });
-      const piSummary = installPiRuntime(inst.path);
-      const piReady = hasPiRuntimeSupport(inst.path);
-      reportPiRuntimeSummary(piSummary, ui, {
-        label: `Pi meta-harness for ${inst.slug || inst.name || path.basename(inst.path)}`,
-        includeConflicts: !piReady,
-      });
-      const primeSummary = installPrimeRuntime(inst.path);
-      const primeReady = hasPrimeRuntimeSupport(inst.path);
-      reportPrimeRuntimeSummary(primeSummary, ui, {
-        label: `Prime Agent runtime for ${inst.slug || inst.name || path.basename(inst.path)}`,
-        includeConflicts: !primeReady,
-      });
-      const connectSummary = await installConnectRuntime(inst.path, { validatedPack: connectPack });
-      reportConnectRuntimeSummary(connectSummary, ui, {
-        label: `Connect features for ${inst.slug || inst.name || path.basename(inst.path)}`,
-      });
-    } catch (err) {
-      ui.warn(`Could not refresh shell-runtime support for ${inst.path}: ${err.message}`);
-    }
-  }
-}
+// Runtime ownership contract: refreshing the global CLI updates ONLY the
+// global CLI. Registered instances are never installed into, updated,
+// removed from, or reconciled here — an existing instance crosses into the
+// new Runtime exclusively through its own Settings flow
+// (prepare → confirm → activate), which applies engine and all harness
+// adapters transactionally from one verified candidate. A CLI refresh that
+// sprayed adapters into every registered instance is exactly how a legacy
+// instance became an incoherent mixture of old framework and new hooks
+// (its own upstream sync then reverted the tracked half).
 
 async function chooseRuntime(args) {
   if (args.runtime) {
@@ -210,7 +153,6 @@ async function chooseRuntime(args) {
 }
 
 async function upgradeLauncherFromExisting(instances) {
-  await upgradePortableRuntimesForExisting(instances);
   const inst = instances.find((entry) => entry && entry.path && fs.existsSync(entry.path));
   if (!inst) return null;
   try {
@@ -524,7 +466,6 @@ async function main() {
       ui.error("No installed Egregore instance was found. Run create-egregore without --refresh-launcher.");
       process.exit(1);
     }
-    await upgradePortableRuntimesForExisting(instances);
     const alias = await installLauncherBinary(instances[0].path, ui);
     if (!alias || !alias.binaryPath) {
       ui.error("Could not refresh the Egregore CLI.");

package/lib/setup.js

@@ -577,14 +577,20 @@ async function install(data, ui, targetDir, opts = {}) {
   try { ensurePersonOnboardingWitness(memoryDir, state); } catch {}
 
   // 4c. Overlay the selected harness adapter from the installed npm artifact.
-  // Each adapter shares the same Egregore Runtime while keeping harness files
-  // thin and independently refreshable.
+  // This is the one-time explicit setup write; launches never install
+  // framework files (see the ownership contract at the launch path), and
+  // existing instances change only through their Settings
+  // prepare → confirm → activate flow — which applies ALL FOUR harness
+  // trees from one verified candidate.
   if (preferredRuntime === "claude-code") {
     const claudeRuntime = installClaudeRuntime(egregoreDir);
     reportClaudeRuntimeSummary(claudeRuntime, ui);
   } else if (preferredRuntime === "codex") {
     const codexRuntime = installCodexRuntime(egregoreDir);
     reportCodexRuntimeSummary(codexRuntime, ui);
+    // Codex-native skills are framework code, so they render at setup —
+    // previously they were sprayed at every launch.
+    try { installCodexSkills(egregoreDir); } catch {}
   } else if (preferredRuntime === "pi") {
     const piRuntime = installPiRuntime(egregoreDir);
     reportPiRuntimeSummary(piRuntime, ui);
@@ -1251,50 +1257,16 @@ async function launchOrInstruct(egregoreDir, alias, ui, ctx = {}) {
   ui.info(`Next time, ${launcherNextStep(ui, aliasName)}`);
   console.log("");
 
-  if (runtime === "claude-code") {
-    const claudeRuntime = installClaudeRuntime(egregoreDir);
-    reportClaudeRuntimeSummary(claudeRuntime, ui);
-    if (!hasClaudeRuntimeSupport(egregoreDir)) {
-      ui.warn("Claude Code runtime support is incomplete; refresh this Egregore before launching.");
-      ui.info(`Run ${ui.bold(aliasName)} after updating the checkout.`);
-      console.log("");
-      return;
-    }
-  } else if (runtime === "codex") {
-    const codexRuntime = installCodexRuntime(egregoreDir);
-    reportCodexRuntimeSummary(codexRuntime, ui);
-    if (!hasCodexCoreSupport(egregoreDir)) {
-      ui.warn(codexSupportMessage(egregoreDir));
-      ui.info(`Run ${ui.bold(aliasName)} after updating the checkout.`);
-      console.log("");
-      return;
-    }
-    const skillsInstalled = installCodexSkills(egregoreDir);
-    const cardRendered = await renderCodexStartupCard(egregoreDir);
-    if (!skillsInstalled || !cardRendered) {
-      ui.warn(codexSupportMessage(egregoreDir));
-      ui.info(`Run ${ui.bold(aliasName)} after updating the checkout.`);
-      console.log("");
-      return;
-    }
-  } else if (runtime === "pi") {
-    const piRuntime = installPiRuntime(egregoreDir);
-    reportPiRuntimeSummary(piRuntime, ui);
-    if (!hasPiRuntimeSupport(egregoreDir)) {
-      ui.warn(piSupportMessage(egregoreDir));
-      ui.info(`Run ${ui.bold(aliasName)} after updating the checkout.`);
-      console.log("");
-      return;
-    }
-  } else if (runtime === "prime") {
-    const primeRuntime = installPrimeRuntime(egregoreDir);
-    reportPrimeRuntimeSummary(primeRuntime, ui);
-    if (!hasPrimeRuntimeSupport(egregoreDir)) {
-      ui.warn(primeSupportMessage(egregoreDir));
-      ui.info(`Run ${ui.bold(aliasName)} after updating the checkout.`);
-      console.log("");
-      return;
-    }
+  // Runtime ownership contract: launching NEVER adds, replaces, or removes
+  // framework/Runtime code. Fresh installs received their files during
+  // explicit setup; existing instances change only through their own
+  // Settings prepare → confirm → activate flow. A legacy instance opens
+  // exactly as it is — old framework, old graph retrieval, no commentary.
+  // The one launch-time write kept below is the Codex startup card, which is
+  // rendered presentation state, not framework code; a legacy instance
+  // without the renderer skips it silently.
+  if (runtime === "codex") {
+    try { await renderCodexStartupCard(egregoreDir); } catch {}
   }
 
   const result = spawnSync(binary, runtimeLaunchArgs(runtime, egregoreDir), {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-egregore",
-  "version": "0.21.0-runtime-mvp.12",
+  "version": "0.21.0-runtime-mvp.14",
   "description": "Set up Egregore for your team in one command — installs the egregore launcher and your choice of Claude Code, Codex, or Pi.",
   "license": "MIT",
   "bin": {

package/runtime/claude/bin/lib/git-sync.sh

@@ -28,6 +28,10 @@ SYNC_RECEIPT=""
 # shellcheck source=bin/lib/settings-drift.sh
 source "$SCRIPT_DIR/bin/lib/settings-drift.sh"
 
+# Runtime framework ownership (activation record gate for legacy sync).
+# shellcheck source=bin/lib/runtime-owned.sh
+source "$SCRIPT_DIR/bin/lib/runtime-owned.sh"
+
 # The core repo's integration branch: "develop" unless egregore.json sets
 # base_branch. session-start.sh resolves this before sourcing; resolve it here
 # too so the lib stands alone for other callers.
@@ -181,6 +185,14 @@ _apply_framework_update() {
   if [ "$_UPSTREAM_URL" = "none" ] || [ "$_AUTO_UPDATE" != "true" ]; then
     return 0
   fi
+  # Runtime ownership: once this exact instance activated the new Runtime
+  # (activation record with retrieval runtime-qmd), the legacy upstream sync
+  # must never overwrite Runtime-owned framework paths — that fight is how a
+  # launched-then-synced instance became a broken old/new mixture. Rollback
+  # flips the record off runtime-qmd and legacy ownership resumes here.
+  if runtime_owns_framework 2>/dev/null; then
+    return 0
+  fi
   if ! git show-ref --verify --quiet refs/remotes/upstream/main 2>/dev/null; then
     return 0
   fi

package/runtime/claude/bin/lib/greeting.sh

@@ -95,19 +95,15 @@ if [ -n "$SAVED_BRANCH" ]; then
   echo "  ✓ Auto-saved uncommitted work on $SAVED_BRANCH"
 fi
 
-# --- Unshared org-settings drift (launcher writes not yet shared) ---
-if [ "${SETTINGS_ADAPTER_RESTORED:-false}" = "true" ]; then
-  echo "  ◇ restored org .claude/settings.json — a generated adapter had replaced it locally"
-fi
+# --- Org-settings sync receipts. A settings.json heal is logged to
+# .egregore/settings-drift.log, never announced; local settings changes reach
+# the control plane through bin/settings.sh, so there is nothing to ask. ---
 if [ -n "${SETTINGS_SYNCED_FROM_ORG:-}" ]; then
   echo "  ◇ org settings synced from the control plane (${SETTINGS_SYNCED_FROM_ORG})"
 fi
 if [ -n "${SETTINGS_POSTURE_HELD:-}" ]; then
   echo "  ◇ boundary posture was set to ${SETTINGS_POSTURE_HELD} elsewhere — relaxing access needs your confirm: bash bin/settings.sh posture ${SETTINGS_POSTURE_HELD}"
 fi
-if [ -n "${UNSHARED_SETTINGS_KEYS:-}" ]; then
-  echo "  ◇ org settings changed on this machine (${UNSHARED_SETTINGS_KEYS}) — say \"share settings\" to make them org-wide"
-fi
 
 # --- Footer: health + repos + memory (tertiary) ---
 echo "$SEPARATOR"

package/runtime/claude/bin/lib/runtime-owned.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# runtime-owned.sh — does the Runtime own this instance's framework paths?
+#
+# True exactly when THIS instance has an activation record whose retrieval
+# mode is runtime-qmd. Uses the same stable identity as the Python upgrade
+# store and the graph cutover gate: sha256(org_id | main-checkout path),
+# first 16 hex chars, under EGREGORE_UPGRADE_ROOT (default
+# ~/.egregore/runtime/upgrade). No global flag, no pathname guess, no slug,
+# no branch name, no hardcoded organization or version.
+#
+# After a rollback the record's retrieval flips to previous-runtime, so this
+# returns false again and legacy framework ownership resumes automatically.
+#
+# Contract: sourced with SCRIPT_DIR set to the instance root.
+
+runtime_owns_framework() {
+  local org main gd key rec
+  org=$(jq -r '.org_id // empty' "$SCRIPT_DIR/egregore.json" 2>/dev/null)
+  [ -n "$org" ] || return 1
+  main="$SCRIPT_DIR"
+  if [ -f "$SCRIPT_DIR/.git" ]; then
+    gd=$(sed -n 's/^gitdir: //p' "$SCRIPT_DIR/.git" 2>/dev/null)
+    case "$gd" in */.git/worktrees/*) main="${gd%/.git/worktrees/*}" ;; esac
+  fi
+  main=$(cd "$main" 2>/dev/null && pwd -P || printf '%s' "$SCRIPT_DIR")
+  key=$(printf '%s|%s' "$org" "$main" | shasum -a 256 2>/dev/null | cut -c1-16)
+  [ -n "$key" ] || return 1
+  rec="${EGREGORE_UPGRADE_ROOT:-$HOME/.egregore/runtime/upgrade}/${key}/active.json"
+  [ -f "$rec" ] && [ "$(jq -r '.retrieval // empty' "$rec" 2>/dev/null)" = "runtime-qmd" ]
+}

package/runtime/claude/bin/lib/settings-drift.sh

@@ -61,7 +61,11 @@ settings_drift_heal() {
 
   if ! git diff --quiet -- .claude/settings.json 2>/dev/null; then
     if _settings_is_reduced_adapter; then
-      git checkout -- .claude/settings.json 2>/dev/null && SETTINGS_ADAPTER_RESTORED="true"
+      if git checkout -- .claude/settings.json 2>/dev/null; then
+        SETTINGS_ADAPTER_RESTORED="true"
+        mkdir -p .egregore 2>/dev/null && printf '%s restored .claude/settings.json: a generated adapter had replaced the org file\n' \
+          "$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> .egregore/settings-drift.log 2>/dev/null || true
+      fi
     fi
   fi
 

package/runtime/claude/egregore_runtime/harness_cli.py

@@ -897,6 +897,9 @@ def _upgrade(args: argparse.Namespace) -> int:
         state = upgrade_module.describe(store.load())
         state["active_version"] = _active_runtime_version(root, store)
         state["instance_hash"] = upgrade_module.instance_key(root)
+        # A live apply journal means a previous candidate application died
+        # mid-transaction; the next activate recovers deterministically.
+        state["interrupted_apply"] = store.load_apply_journal() is not None
         memory_root = (root / "memory").resolve()
         if memory_root.is_dir():
             state["team_sync"] = team_sync(memory_root, fetch=bool(args.fetch)).to_dict()

package/runtime/claude/egregore_runtime/sync.py

@@ -170,14 +170,80 @@ class LocalGitSyncTransport:
         remote_is_ancestor = self._run(
             "merge-base", "--is-ancestor", remote_revision, "HEAD"
         ).returncode == 0
+        warnings: list[str] = []
         if not remote_is_ancestor:
-            if self._required("status", "--porcelain"):
-                raise GitSyncError(
-                    "canonical Git repository has incoming changes and local "
-                    "working-tree edits; commit or resolve them before sync"
-                )
-            self._required("rebase", remote_revision, timeout=180)
-        return self._status(changed=self._revision() != before)
+            warnings.extend(self._integrate_remote(remote_revision))
+        return self._status(tuple(warnings), changed=self._revision() != before)
+
+    def _integrate_remote(self, remote_revision: str) -> list[str]:
+        """Integrate fetched history into a possibly-dirty canonical checkout.
+
+        Canonical memory has many concurrent writers (sessions, background
+        capture, hosted agents) appending distinct files — incoming history
+        plus local edits is almost never a content conflict, so it must
+        self-heal instead of failing closed. The rebase autostashes local
+        edits and re-applies them; edits git cannot re-apply are parked in
+        the stash (content preserved, surfaced as a warning). Only a rebase
+        that itself conflicts — a genuine same-line collision with local
+        commits — fails closed.
+        """
+        warnings: list[str] = []
+        dirty = bool(self._required("status", "--porcelain"))
+        stashes_before = self._run("stash", "list").stdout.count("\n")
+        arguments = ["rebase"]
+        if dirty:
+            arguments.append("--autostash")
+        result = self._run(*arguments, remote_revision, timeout=180)
+        if result.returncode != 0:
+            self._run("rebase", "--abort")
+            detail = (result.stderr or result.stdout).strip().splitlines()
+            raise GitSyncError(
+                "canonical sync hit a real content conflict while integrating "
+                "incoming changes; resolve it in the memory repository"
+                + (f" ({detail[-1]})" if detail else "")
+            )
+        if dirty and self._run("stash", "list").stdout.count("\n") > stashes_before:
+            # Git kept the whole autostash entry AND left a conflicted
+            # application in the tree. Every local edit is safe inside the
+            # kept stash, so the tree resets to the clean rebased HEAD —
+            # parked edits, never conflict markers in canonical files.
+            self._run("reset", "--hard", "HEAD")
+            warnings.append(
+                "local memory edits could not be re-applied over incoming "
+                "changes and were parked in git stash — recover with "
+                "`git stash pop` in the memory repository"
+            )
+        return warnings
+
+    def _push_with_retry(self, attempts: int = 3) -> list[str]:
+        """Push canonical history, absorbing the many-writer race.
+
+        The memory remote moves constantly (teammates' sessions, background
+        capture, hosted agents). A rejected push is re-integrated with an
+        autostashed rebase and retried — the exact manual recovery this
+        failure class always needed — before anything is reported as failed.
+        """
+        detail = ""
+        for attempt in range(attempts):
+            pushed = self._run("push", "origin", "HEAD", timeout=180)
+            if pushed.returncode == 0:
+                return []
+            detail = (pushed.stderr or pushed.stdout).strip()
+            if attempt == attempts - 1:
+                break
+            branch = self._required("branch", "--show-current")
+            if not branch:
+                break
+            if self._run("fetch", "origin", branch, timeout=180).returncode != 0:
+                break
+            remote_revision = self._remote_revision()
+            if remote_revision is None:
+                break
+            try:
+                self._integrate_remote(remote_revision)
+            except GitSyncError as exc:
+                return [f"remote push failed: {exc}"]
+        return [f"remote push failed: {detail or 'git push failed'}"]
 
     def push(self, *, message: str, paths: Sequence[str] = ()) -> SyncStatus:
         selected = self._relative_paths(paths)
@@ -209,10 +275,7 @@ class LocalGitSyncTransport:
                     if warning := self._push_remote_background():
                         warnings.append(warning)
                 else:
-                    pushed = self._run("push", "origin", "HEAD", timeout=180)
-                    if pushed.returncode != 0:
-                        detail = (pushed.stderr or pushed.stdout).strip()
-                        warnings.append(f"remote push failed: {detail or 'git push failed'}")
+                    warnings.extend(self._push_with_retry())
             else:
                 warnings.append("no origin remote configured; canonical history is local")
         return self._status(warnings)