create-egregore 0.21.0-runtime-mvp.15 → 0.21.0-runtime-mvp.17

package/assets/egregore-launcher.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// egregore-launcher-version: 0.21.0-runtime-mvp.15
+// egregore-launcher-version: 0.21.0-runtime-mvp.17
 //
 // egregore — launch and browse Egregore instances from your terminal.
 // Installed by create-egregore. Reads ~/.egregore/instances.json.
@@ -35,7 +35,7 @@ const crypto = require("node:crypto");
 const { spawnSync, spawn } = require("node:child_process");
 const readline = require("node:readline");
 
-const VERSION = "0.21.0-runtime-mvp.15";
+const VERSION = "0.21.0-runtime-mvp.17";
 const REGISTRY = path.join(os.homedir(), ".egregore", "instances.json");
 const DEFAULT_FILE = path.join(os.homedir(), ".egregore", "default");
 const UPDATE_CACHE_FILE = path.join(os.homedir(), ".egregore", "update-check.json");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-egregore",
-  "version": "0.21.0-runtime-mvp.15",
+  "version": "0.21.0-runtime-mvp.17",
   "description": "Set up Egregore for your team in one command — installs the egregore launcher and your choice of Claude Code, Codex, or Pi.",
   "license": "MIT",
   "bin": {

package/runtime/claude/CLAUDE.md

@@ -228,19 +228,21 @@ For each user-directed organizational lookup, show exactly one visible line:
 - retrieval that actually queries the connected graph:
   `⌕ Egregore Connect · searching your organization’s memory and relationships`
 
-Runtime owns retrieval; no agent feature flag does. `EGREGORE_ORG_CONTEXT_V1`
-is only the schema label. When attached, authorized retrieval is complete:
+When `EGREGORE_ORG_CONTEXT_V1` is attached, authorized retrieval is complete:
 never query again that turn, and state any evidence gap. `OPENED_BY_OBSERVE`
 means the evidence is open. A later explicit search starts a new turn.
 
-**Visibility is the contract.** Emit it verbatim as a
-standalone assistant message before the first Bash, Grep, Glob, Read, or other
-retrieval tool call.
-Shell/tool output does not satisfy this requirement. Do not paraphrase the line.
+**Scope.** Egregore Runtime is for organizational recall only: team memory,
+decisions, handoffs, prior work. Code, files, Git, and tests use the harness's
+normal tools, with no beat and no Runtime call.
 
-Use the memory form normally; use Connect only for an explicit graph traversal
-that actually runs. Emit once per episode. A `bin/search.sh` banner is only a
-shell fallback and does not replace this visible beat.
+**Visibility is the contract.** Emit it verbatim as a standalone assistant
+message before the first tool call that performs the organizational recall
+(the `bin/search.sh` query or a graph read). Tool output does not satisfy it.
+Do not paraphrase the line.
+
+Use Connect only for a graph traversal that actually runs. Emit once per
+episode.
 
 **Routing:** Organizational recall always enters Egregore Runtime. The model is
 the semantic intent authority, deciding from meaning rather than fixed phrases.
@@ -251,20 +253,18 @@ Without sufficient attached context, make exactly one Runtime/QMD call:
 bash bin/search.sh query "<concept>" -n 6 --compact --context-packet
 ```
 
-`--context-packet` keeps the evidence out of the visible transcript and
-attaches it privately; the visible output is the attribution line alone.
-Never re-print ranked results, file/rank/excerpt metadata, or raw JSON.
+`--context-packet` attaches the evidence privately; the visible output is the
+attribution line alone. Never re-print ranked results or raw JSON.
 
 Do not resolve `memory/` to its sibling repo or start with raw `grep`/`ls`.
-Search owns lexical/semantic selection and attaches no graph by default. Open a
-source only when its excerpt cannot support a necessary claim. For current
+Search attaches no graph by default. Open a source only when its excerpt
+cannot support a necessary claim. For current
 team/person synthesis, retain known organization/member names and choose
-`--recent-days` plus `--min-evidence`. Use native
-Grep/Glob for code and exact errors. `/activity`, `/dashboard`, and `/project`
+`--recent-days` plus `--min-evidence`. `/activity`, `/dashboard`, and `/project`
 display bounded status surfaces only when named or directly requested as a
-card. Questions asking for an explained synthesis of current organizational
-work are Runtime/QMD recall, as is prior-work discovery. Do not run full
-hybrid retrieval on unrelated prompts or infer graph from recall intent.
+card. Explained syntheses of current organizational work and prior-work
+discovery are Runtime/QMD recall. Do not run retrieval on unrelated prompts or
+infer graph from recall intent.
 
 Do not emit the beat for code search, Git inspection, startup hydration, graph
 writes, ingestion, background sync, maintenance, or internal queries.

package/runtime/claude/bin/codex-render-spec.mjs

@@ -157,9 +157,8 @@ const NON_SKILL_TOKENS = new Set(['loop', 'fast', 'config', 'clear', 'help']);
 // hook delivers there. Rewrite the fallback command to the stdout form and
 // state the same hygiene contract in shell terms: search output is
 // model-internal; the visible reply carries only the retrieval line.
-const CLAUDE_PACKET_NOTE = `\`--context-packet\` keeps the evidence out of the visible transcript and
-attaches it privately; the visible output is the attribution line alone.
-Never re-print ranked results, file/rank/excerpt metadata, or raw JSON.`;
+const CLAUDE_PACKET_NOTE = `\`--context-packet\` attaches the evidence privately; the visible output is the
+attribution line alone. Never re-print ranked results or raw JSON.`;
 const SHELL_PACKET_NOTE = `Search output is model-internal: show only the retrieval line and receipts —
 never ranked blocks, file/rank/excerpt metadata, or raw JSON.`;
 

package/runtime/claude/egregore_runtime/harness_cli.py

@@ -38,7 +38,7 @@ from .runtime import EgregoreRuntime, local_runtime
 _ORG_CONTEXT_PREFETCH_PATTERN = re.compile(
     "|".join(
         (
-            r"\b(find|locate|dig up|look up|pull up)\b.*\b"
+            r"\b(find|locate|dig up|look up|pull up)\b[^\n]*\b"
             r"(handoff|decision|notes?|docs?|meeting|harvest|quest|reflection)s?\b",
             r"\bdid we (decide|discuss|agree|say|talk about|cover)\b",
             r"\bdo we have (any )?(notes?|docs?|anything|something)( on| about)?\b",
@@ -161,6 +161,26 @@ def _clear_observe_receipt(root: Path, harness: str) -> None:
         pass
 
 
+def _actor_contract_marker_path(
+    root: Path, harness: str, session: str | None = None
+) -> Path:
+    """Gitignored per-session marker: the full actor/retrieval contract was
+    already attached once. Later prompts receive a short reminder instead of
+    the ~4 KB block. bin/pre-compact.sh removes the marker so the first prompt
+    after a compaction re-attaches the full contract.
+
+    ``session`` is the harness's own session id from the hook payload. The
+    Egregore session file in the checkout is shared by every concurrent
+    session there and rewritten by each new one, so keying on it alone made
+    parallel sessions re-attach the full contract on every prompt."""
+
+    session = re.sub(r"[^A-Za-z0-9_.-]", "-", session or _session_id(root))[:120]
+    return (
+        root / ".egregore" / "runtime" / "observe"
+        / f"actor-contract-{harness}-{session}.sent"
+    )
+
+
 def _write_observe_receipt(root: Path, harness: str, prompt: str, context) -> None:
     """Record that this prompt already received useful authorized evidence.
 
@@ -378,6 +398,37 @@ def _query(args: argparse.Namespace) -> int:
     return 0
 
 
+_PASTED_OUTPUT_LINE = re.compile(
+    r"^(?:"
+    r"[ MADRCU?!]{2}\s+\S"          # git status --short / porcelain rows
+    r"|[▶❯»]\s"                     # terminal prompt markers
+    r"|\$\s\S"                      # shell prompt
+    r"|(?:\+\+\+|---|@@)\s"          # unified diff
+    r"|diff --git\b"
+    r"|Traceback \(most recent call last\)"
+    r"|\s+File \"[^\"]+\", line \d+"
+    r"|\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}"  # log timestamps
+    r"|[A-Za-z0-9_./-]+/[A-Za-z0-9_.-]+\.[a-z]{1,6}$"  # a bare path
+    r")"
+)
+
+
+def _looks_like_pasted_output(prompt: str) -> bool:
+    """True for terminal output, diffs, logs, and code blocks pasted into a prompt.
+
+    Those carry words like "handoff", "notes", or "docs" by accident; running a
+    retrieval on them attaches unrelated evidence and costs seconds. The actor
+    context still tells the model to recall once if the prompt truly needs it.
+    """
+
+    if "```" in prompt:
+        return True
+    lines = [line for line in prompt.splitlines() if line.strip()]
+    if len(lines) >= 8:
+        return True
+    return sum(1 for line in lines if _PASTED_OUTPUT_LINE.match(line)) >= 2
+
+
 def prompt_prefetches_org_context(prompt: str) -> bool:
     """Return whether Observe should prefetch likely organizational context.
 
@@ -390,6 +441,7 @@ def prompt_prefetches_org_context(prompt: str) -> bool:
     return bool(
         prompt
         and not _EXPLICIT_SEARCH.search(prompt)
+        and not _looks_like_pasted_output(prompt)
         and (
             _ORG_CONTEXT_PREFETCH_PATTERN.search(prompt)
             or _ORG_RITUAL_CONTEXT_PREFETCH_PATTERN.search(prompt)
@@ -414,8 +466,22 @@ def prompt_requests_actor_context(prompt: str) -> bool:
     return bool(prompt and prompt.strip())
 
 
-def _actor_context_block(runtime: EgregoreRuntime, root: Path, harness: str) -> str:
-    """Render the minimum stable identity needed by harness rituals."""
+_RECALL_ONLY_SCOPE = (
+    "Egregore Runtime is for organizational recall and memory only: team memory, "
+    "decisions, handoffs, meetings, prior work. Code search, file reads, Git, tests, "
+    "and every other task use the harness's normal tools (Grep, Glob, Read, Bash) "
+    "with no retrieval ritual and no Runtime call."
+)
+
+
+def _actor_context_block(
+    runtime: EgregoreRuntime, root: Path, harness: str, *, full: bool = True
+) -> str:
+    """Render the stable identity and the recall contract for harness rituals.
+
+    ``full`` renders the complete contract (once per session); otherwise a
+    short reminder that keeps identity and the recall-only scope in view.
+    """
 
     actor_context = _actor(runtime, root, harness)
     actor = actor_context.actor
@@ -435,6 +501,22 @@ def _actor_context_block(runtime: EgregoreRuntime, root: Path, harness: str) ->
     search_command = 'bash bin/search.sh query "<concept>" -n 6 --compact'
     if harness == "claude":
         search_command += " --context-packet"
+    if not full:
+        return "\n".join(
+            (
+                "EGREGORE_ACTOR_CONTEXT_V1",
+                "Reminder — the full contract was attached earlier in this session.",
+                f"Actor: {actor.display_name} · Actor ID: {actor.actor_id} · "
+                f"Organization ID: {actor_context.profile.org_id} · Runtime root: {root}",
+                _RECALL_ONLY_SCOPE,
+                "When a prompt needs that recall and no EGREGORE_ORG_CONTEXT_V1 block is "
+                f"attached, run exactly one `{search_command}`; exact latest/oldest/open "
+                "handoff questions use `bash bin/search.sh handoffs …` instead.",
+                "`me` and `myself` mean this Actor ID and display name; never infer identity "
+                "from the OS user, Git, or GitHub names.",
+                "END_EGREGORE_ACTOR_CONTEXT_V1",
+            )
+        )
     return "\n".join(
         (
             "EGREGORE_ACTOR_CONTEXT_V1",
@@ -451,6 +533,7 @@ def _actor_context_block(runtime: EgregoreRuntime, root: Path, harness: str) ->
             f"Runtime root: {root}",
             "Run Egregore retrieval and workflow commands from this Runtime root. "
             "Do not fall back to a launch checkout named elsewhere in the session.",
+            _RECALL_ONLY_SCOPE,
             "Organizational retrieval status: NOT_PERFORMED. This actor-only block "
             "does not mean organizational recall is unnecessary.",
             "Interpret the user's intent semantically, without requiring trigger words. "
@@ -687,11 +770,21 @@ def _prompt_hook(args: argparse.Namespace) -> int:
                 args.limit,
             )
         else:
+            hook_session = str(payload.get("session_id") or "").strip() or None
+            marker = _actor_contract_marker_path(root, args.harness, hook_session)
+            full = not marker.exists()
             additional_context = _actor_context_block(
                 runtime,
                 root,
                 args.harness,
+                full=full,
             )
+            if full:
+                try:
+                    marker.parent.mkdir(parents=True, exist_ok=True)
+                    marker.write_text(datetime.now(UTC).isoformat(), encoding="utf-8")
+                except OSError:
+                    pass
     except Exception as exc:  # Hooks are advisory and must never block a prompt.
         additional_context = (
             "Egregore Runtime context was requested but the Local Runtime is unavailable "

package/runtime/codex/.codex/spec-manifest.json

@@ -53,7 +53,7 @@
     {
       "section": "Egregore Retrieval Beat",
       "action": "keep",
-      "sourceHash": "6c5cbb0d1c9a",
+      "sourceHash": "bb2f214689cb",
       "note": "Kept verbatim — product attribution applies across runtimes."
     },
     {

package/runtime/codex/AGENTS.md

@@ -258,19 +258,21 @@ For each user-directed organizational lookup, show exactly one visible line:
 - retrieval that actually queries the connected graph:
   `⌕ Egregore Connect · searching your organization’s memory and relationships`
 
-Runtime owns retrieval; no agent feature flag does. `EGREGORE_ORG_CONTEXT_V1`
-is only the schema label. When attached, authorized retrieval is complete:
+When `EGREGORE_ORG_CONTEXT_V1` is attached, authorized retrieval is complete:
 never query again that turn, and state any evidence gap. `OPENED_BY_OBSERVE`
 means the evidence is open. A later explicit search starts a new turn.
 
-**Visibility is the contract.** Emit it verbatim as a
-standalone assistant message before the first Bash, Grep, Glob, Read, or other
-retrieval tool call.
-Shell/tool output does not satisfy this requirement. Do not paraphrase the line.
+**Scope.** Egregore Runtime is for organizational recall only: team memory,
+decisions, handoffs, prior work. Code, files, Git, and tests use the harness's
+normal tools, with no beat and no Runtime call.
 
-Use the memory form normally; use Connect only for an explicit graph traversal
-that actually runs. Emit once per episode. A `bin/search.sh` banner is only a
-shell fallback and does not replace this visible beat.
+**Visibility is the contract.** Emit it verbatim as a standalone assistant
+message before the first tool call that performs the organizational recall
+(the `bin/search.sh` query or a graph read). Tool output does not satisfy it.
+Do not paraphrase the line.
+
+Use Connect only for a graph traversal that actually runs. Emit once per
+episode.
 
 **Routing:** Organizational recall always enters Egregore Runtime. The model is
 the semantic intent authority, deciding from meaning rather than fixed phrases.
@@ -285,15 +287,14 @@ Search output is model-internal: show only the retrieval line and receipts —
 never ranked blocks, file/rank/excerpt metadata, or raw JSON.
 
 Do not resolve `memory/` to its sibling repo or start with raw `grep`/`ls`.
-Search owns lexical/semantic selection and attaches no graph by default. Open a
-source only when its excerpt cannot support a necessary claim. For current
+Search attaches no graph by default. Open a source only when its excerpt
+cannot support a necessary claim. For current
 team/person synthesis, retain known organization/member names and choose
-`--recent-days` plus `--min-evidence`. Use native
-Grep/Glob for code and exact errors. `$activity`, `$dashboard`, and `$project`
+`--recent-days` plus `--min-evidence`. `$activity`, `$dashboard`, and `$project`
 display bounded status surfaces only when named or directly requested as a
-card. Questions asking for an explained synthesis of current organizational
-work are Runtime/QMD recall, as is prior-work discovery. Do not run full
-hybrid retrieval on unrelated prompts or infer graph from recall intent.
+card. Explained syntheses of current organizational work and prior-work
+discovery are Runtime/QMD recall. Do not run retrieval on unrelated prompts or
+infer graph from recall intent.
 
 Do not emit the beat for code search, Git inspection, startup hydration, graph
 writes, ingestion, background sync, maintenance, or internal queries.

package/runtime/codex/bin/codex-render-spec.mjs

@@ -157,9 +157,8 @@ const NON_SKILL_TOKENS = new Set(['loop', 'fast', 'config', 'clear', 'help']);
 // hook delivers there. Rewrite the fallback command to the stdout form and
 // state the same hygiene contract in shell terms: search output is
 // model-internal; the visible reply carries only the retrieval line.
-const CLAUDE_PACKET_NOTE = `\`--context-packet\` keeps the evidence out of the visible transcript and
-attaches it privately; the visible output is the attribution line alone.
-Never re-print ranked results, file/rank/excerpt metadata, or raw JSON.`;
+const CLAUDE_PACKET_NOTE = `\`--context-packet\` attaches the evidence privately; the visible output is the
+attribution line alone. Never re-print ranked results or raw JSON.`;
 const SHELL_PACKET_NOTE = `Search output is model-internal: show only the retrieval line and receipts —
 never ranked blocks, file/rank/excerpt metadata, or raw JSON.`;
 

package/runtime/codex/egregore_runtime/harness_cli.py

@@ -38,7 +38,7 @@ from .runtime import EgregoreRuntime, local_runtime
 _ORG_CONTEXT_PREFETCH_PATTERN = re.compile(
     "|".join(
         (
-            r"\b(find|locate|dig up|look up|pull up)\b.*\b"
+            r"\b(find|locate|dig up|look up|pull up)\b[^\n]*\b"
             r"(handoff|decision|notes?|docs?|meeting|harvest|quest|reflection)s?\b",
             r"\bdid we (decide|discuss|agree|say|talk about|cover)\b",
             r"\bdo we have (any )?(notes?|docs?|anything|something)( on| about)?\b",
@@ -161,6 +161,26 @@ def _clear_observe_receipt(root: Path, harness: str) -> None:
         pass
 
 
+def _actor_contract_marker_path(
+    root: Path, harness: str, session: str | None = None
+) -> Path:
+    """Gitignored per-session marker: the full actor/retrieval contract was
+    already attached once. Later prompts receive a short reminder instead of
+    the ~4 KB block. bin/pre-compact.sh removes the marker so the first prompt
+    after a compaction re-attaches the full contract.
+
+    ``session`` is the harness's own session id from the hook payload. The
+    Egregore session file in the checkout is shared by every concurrent
+    session there and rewritten by each new one, so keying on it alone made
+    parallel sessions re-attach the full contract on every prompt."""
+
+    session = re.sub(r"[^A-Za-z0-9_.-]", "-", session or _session_id(root))[:120]
+    return (
+        root / ".egregore" / "runtime" / "observe"
+        / f"actor-contract-{harness}-{session}.sent"
+    )
+
+
 def _write_observe_receipt(root: Path, harness: str, prompt: str, context) -> None:
     """Record that this prompt already received useful authorized evidence.
 
@@ -378,6 +398,37 @@ def _query(args: argparse.Namespace) -> int:
     return 0
 
 
+_PASTED_OUTPUT_LINE = re.compile(
+    r"^(?:"
+    r"[ MADRCU?!]{2}\s+\S"          # git status --short / porcelain rows
+    r"|[▶❯»]\s"                     # terminal prompt markers
+    r"|\$\s\S"                      # shell prompt
+    r"|(?:\+\+\+|---|@@)\s"          # unified diff
+    r"|diff --git\b"
+    r"|Traceback \(most recent call last\)"
+    r"|\s+File \"[^\"]+\", line \d+"
+    r"|\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}"  # log timestamps
+    r"|[A-Za-z0-9_./-]+/[A-Za-z0-9_.-]+\.[a-z]{1,6}$"  # a bare path
+    r")"
+)
+
+
+def _looks_like_pasted_output(prompt: str) -> bool:
+    """True for terminal output, diffs, logs, and code blocks pasted into a prompt.
+
+    Those carry words like "handoff", "notes", or "docs" by accident; running a
+    retrieval on them attaches unrelated evidence and costs seconds. The actor
+    context still tells the model to recall once if the prompt truly needs it.
+    """
+
+    if "```" in prompt:
+        return True
+    lines = [line for line in prompt.splitlines() if line.strip()]
+    if len(lines) >= 8:
+        return True
+    return sum(1 for line in lines if _PASTED_OUTPUT_LINE.match(line)) >= 2
+
+
 def prompt_prefetches_org_context(prompt: str) -> bool:
     """Return whether Observe should prefetch likely organizational context.
 
@@ -390,6 +441,7 @@ def prompt_prefetches_org_context(prompt: str) -> bool:
     return bool(
         prompt
         and not _EXPLICIT_SEARCH.search(prompt)
+        and not _looks_like_pasted_output(prompt)
         and (
             _ORG_CONTEXT_PREFETCH_PATTERN.search(prompt)
             or _ORG_RITUAL_CONTEXT_PREFETCH_PATTERN.search(prompt)
@@ -414,8 +466,22 @@ def prompt_requests_actor_context(prompt: str) -> bool:
     return bool(prompt and prompt.strip())
 
 
-def _actor_context_block(runtime: EgregoreRuntime, root: Path, harness: str) -> str:
-    """Render the minimum stable identity needed by harness rituals."""
+_RECALL_ONLY_SCOPE = (
+    "Egregore Runtime is for organizational recall and memory only: team memory, "
+    "decisions, handoffs, meetings, prior work. Code search, file reads, Git, tests, "
+    "and every other task use the harness's normal tools (Grep, Glob, Read, Bash) "
+    "with no retrieval ritual and no Runtime call."
+)
+
+
+def _actor_context_block(
+    runtime: EgregoreRuntime, root: Path, harness: str, *, full: bool = True
+) -> str:
+    """Render the stable identity and the recall contract for harness rituals.
+
+    ``full`` renders the complete contract (once per session); otherwise a
+    short reminder that keeps identity and the recall-only scope in view.
+    """
 
     actor_context = _actor(runtime, root, harness)
     actor = actor_context.actor
@@ -435,6 +501,22 @@ def _actor_context_block(runtime: EgregoreRuntime, root: Path, harness: str) ->
     search_command = 'bash bin/search.sh query "<concept>" -n 6 --compact'
     if harness == "claude":
         search_command += " --context-packet"
+    if not full:
+        return "\n".join(
+            (
+                "EGREGORE_ACTOR_CONTEXT_V1",
+                "Reminder — the full contract was attached earlier in this session.",
+                f"Actor: {actor.display_name} · Actor ID: {actor.actor_id} · "
+                f"Organization ID: {actor_context.profile.org_id} · Runtime root: {root}",
+                _RECALL_ONLY_SCOPE,
+                "When a prompt needs that recall and no EGREGORE_ORG_CONTEXT_V1 block is "
+                f"attached, run exactly one `{search_command}`; exact latest/oldest/open "
+                "handoff questions use `bash bin/search.sh handoffs …` instead.",
+                "`me` and `myself` mean this Actor ID and display name; never infer identity "
+                "from the OS user, Git, or GitHub names.",
+                "END_EGREGORE_ACTOR_CONTEXT_V1",
+            )
+        )
     return "\n".join(
         (
             "EGREGORE_ACTOR_CONTEXT_V1",
@@ -451,6 +533,7 @@ def _actor_context_block(runtime: EgregoreRuntime, root: Path, harness: str) ->
             f"Runtime root: {root}",
             "Run Egregore retrieval and workflow commands from this Runtime root. "
             "Do not fall back to a launch checkout named elsewhere in the session.",
+            _RECALL_ONLY_SCOPE,
             "Organizational retrieval status: NOT_PERFORMED. This actor-only block "
             "does not mean organizational recall is unnecessary.",
             "Interpret the user's intent semantically, without requiring trigger words. "
@@ -687,11 +770,21 @@ def _prompt_hook(args: argparse.Namespace) -> int:
                 args.limit,
             )
         else:
+            hook_session = str(payload.get("session_id") or "").strip() or None
+            marker = _actor_contract_marker_path(root, args.harness, hook_session)
+            full = not marker.exists()
             additional_context = _actor_context_block(
                 runtime,
                 root,
                 args.harness,
+                full=full,
             )
+            if full:
+                try:
+                    marker.parent.mkdir(parents=True, exist_ok=True)
+                    marker.write_text(datetime.now(UTC).isoformat(), encoding="utf-8")
+                except OSError:
+                    pass
     except Exception as exc:  # Hooks are advisory and must never block a prompt.
         additional_context = (
             "Egregore Runtime context was requested but the Local Runtime is unavailable "

package/runtime/pi/.codex/spec-manifest.json

@@ -53,7 +53,7 @@
     {
       "section": "Egregore Retrieval Beat",
       "action": "keep",
-      "sourceHash": "6c5cbb0d1c9a",
+      "sourceHash": "bb2f214689cb",
       "note": "Kept verbatim — product attribution applies across runtimes."
     },
     {

package/runtime/pi/.pi/APPEND_SYSTEM.md

@@ -183,19 +183,21 @@ For each user-directed organizational lookup, show exactly one visible line:
 - retrieval that actually queries the connected graph:
   `⌕ Egregore Connect · searching your organization’s memory and relationships`
 
-Runtime owns retrieval; no agent feature flag does. `EGREGORE_ORG_CONTEXT_V1`
-is only the schema label. When attached, authorized retrieval is complete:
+When `EGREGORE_ORG_CONTEXT_V1` is attached, authorized retrieval is complete:
 never query again that turn, and state any evidence gap. `OPENED_BY_OBSERVE`
 means the evidence is open. A later explicit search starts a new turn.
 
-**Visibility is the contract.** Emit it verbatim as a
-standalone assistant message before the first Bash, Grep, Glob, Read, or other
-retrieval tool call.
-Shell/tool output does not satisfy this requirement. Do not paraphrase the line.
+**Scope.** Egregore Runtime is for organizational recall only: team memory,
+decisions, handoffs, prior work. Code, files, Git, and tests use the harness's
+normal tools, with no beat and no Runtime call.
 
-Use the memory form normally; use Connect only for an explicit graph traversal
-that actually runs. Emit once per episode. A `bin/search.sh` banner is only a
-shell fallback and does not replace this visible beat.
+**Visibility is the contract.** Emit it verbatim as a standalone assistant
+message before the first tool call that performs the organizational recall
+(the `bin/search.sh` query or a graph read). Tool output does not satisfy it.
+Do not paraphrase the line.
+
+Use Connect only for a graph traversal that actually runs. Emit once per
+episode.
 
 **Routing:** Organizational recall always enters Egregore Runtime. The model is
 the semantic intent authority, deciding from meaning rather than fixed phrases.
@@ -210,15 +212,14 @@ Search output is model-internal: show only the retrieval line and receipts —
 never ranked blocks, file/rank/excerpt metadata, or raw JSON.
 
 Do not resolve `memory/` to its sibling repo or start with raw `grep`/`ls`.
-Search owns lexical/semantic selection and attaches no graph by default. Open a
-source only when its excerpt cannot support a necessary claim. For current
+Search attaches no graph by default. Open a source only when its excerpt
+cannot support a necessary claim. For current
 team/person synthesis, retain known organization/member names and choose
-`--recent-days` plus `--min-evidence`. Use native
-Grep/Glob for code and exact errors. `/activity`, `/dashboard`, and `/project`
+`--recent-days` plus `--min-evidence`. `/activity`, `/dashboard`, and `/project`
 display bounded status surfaces only when named or directly requested as a
-card. Questions asking for an explained synthesis of current organizational
-work are Runtime/QMD recall, as is prior-work discovery. Do not run full
-hybrid retrieval on unrelated prompts or infer graph from recall intent.
+card. Explained syntheses of current organizational work and prior-work
+discovery are Runtime/QMD recall. Do not run retrieval on unrelated prompts or
+infer graph from recall intent.
 
 Do not emit the beat for code search, Git inspection, startup hydration, graph
 writes, ingestion, background sync, maintenance, or internal queries.

package/runtime/pi/.pi/spec-manifest.json

@@ -1,8 +1,8 @@
 {
   "generatedBy": "bin/pi-render-spec.mjs",
   "source": "AGENTS.md generated Codex spec",
-  "sourceHash": "76c76679f791",
-  "outputHash": "cf5aa8ffd739",
+  "sourceHash": "496480654dd9",
+  "outputHash": "6eef1a6daeb9",
   "adaptations": [
     "Pi project trust and APPEND_SYSTEM delivery",
     "Pi tool_call branch gate",

package/runtime/pi/AGENTS.md

@@ -258,19 +258,21 @@ For each user-directed organizational lookup, show exactly one visible line:
 - retrieval that actually queries the connected graph:
   `⌕ Egregore Connect · searching your organization’s memory and relationships`
 
-Runtime owns retrieval; no agent feature flag does. `EGREGORE_ORG_CONTEXT_V1`
-is only the schema label. When attached, authorized retrieval is complete:
+When `EGREGORE_ORG_CONTEXT_V1` is attached, authorized retrieval is complete:
 never query again that turn, and state any evidence gap. `OPENED_BY_OBSERVE`
 means the evidence is open. A later explicit search starts a new turn.
 
-**Visibility is the contract.** Emit it verbatim as a
-standalone assistant message before the first Bash, Grep, Glob, Read, or other
-retrieval tool call.
-Shell/tool output does not satisfy this requirement. Do not paraphrase the line.
+**Scope.** Egregore Runtime is for organizational recall only: team memory,
+decisions, handoffs, prior work. Code, files, Git, and tests use the harness's
+normal tools, with no beat and no Runtime call.
 
-Use the memory form normally; use Connect only for an explicit graph traversal
-that actually runs. Emit once per episode. A `bin/search.sh` banner is only a
-shell fallback and does not replace this visible beat.
+**Visibility is the contract.** Emit it verbatim as a standalone assistant
+message before the first tool call that performs the organizational recall
+(the `bin/search.sh` query or a graph read). Tool output does not satisfy it.
+Do not paraphrase the line.
+
+Use Connect only for a graph traversal that actually runs. Emit once per
+episode.
 
 **Routing:** Organizational recall always enters Egregore Runtime. The model is
 the semantic intent authority, deciding from meaning rather than fixed phrases.
@@ -285,15 +287,14 @@ Search output is model-internal: show only the retrieval line and receipts —
 never ranked blocks, file/rank/excerpt metadata, or raw JSON.
 
 Do not resolve `memory/` to its sibling repo or start with raw `grep`/`ls`.
-Search owns lexical/semantic selection and attaches no graph by default. Open a
-source only when its excerpt cannot support a necessary claim. For current
+Search attaches no graph by default. Open a source only when its excerpt
+cannot support a necessary claim. For current
 team/person synthesis, retain known organization/member names and choose
-`--recent-days` plus `--min-evidence`. Use native
-Grep/Glob for code and exact errors. `$activity`, `$dashboard`, and `$project`
+`--recent-days` plus `--min-evidence`. `$activity`, `$dashboard`, and `$project`
 display bounded status surfaces only when named or directly requested as a
-card. Questions asking for an explained synthesis of current organizational
-work are Runtime/QMD recall, as is prior-work discovery. Do not run full
-hybrid retrieval on unrelated prompts or infer graph from recall intent.
+card. Explained syntheses of current organizational work and prior-work
+discovery are Runtime/QMD recall. Do not run retrieval on unrelated prompts or
+infer graph from recall intent.
 
 Do not emit the beat for code search, Git inspection, startup hydration, graph
 writes, ingestion, background sync, maintenance, or internal queries.

package/runtime/pi/bin/codex-render-spec.mjs

@@ -157,9 +157,8 @@ const NON_SKILL_TOKENS = new Set(['loop', 'fast', 'config', 'clear', 'help']);
 // hook delivers there. Rewrite the fallback command to the stdout form and
 // state the same hygiene contract in shell terms: search output is
 // model-internal; the visible reply carries only the retrieval line.
-const CLAUDE_PACKET_NOTE = `\`--context-packet\` keeps the evidence out of the visible transcript and
-attaches it privately; the visible output is the attribution line alone.
-Never re-print ranked results, file/rank/excerpt metadata, or raw JSON.`;
+const CLAUDE_PACKET_NOTE = `\`--context-packet\` attaches the evidence privately; the visible output is the
+attribution line alone. Never re-print ranked results or raw JSON.`;
 const SHELL_PACKET_NOTE = `Search output is model-internal: show only the retrieval line and receipts —
 never ranked blocks, file/rank/excerpt metadata, or raw JSON.`;
 

package/runtime/pi/egregore_runtime/harness_cli.py

@@ -38,7 +38,7 @@ from .runtime import EgregoreRuntime, local_runtime
 _ORG_CONTEXT_PREFETCH_PATTERN = re.compile(
     "|".join(
         (
-            r"\b(find|locate|dig up|look up|pull up)\b.*\b"
+            r"\b(find|locate|dig up|look up|pull up)\b[^\n]*\b"
             r"(handoff|decision|notes?|docs?|meeting|harvest|quest|reflection)s?\b",
             r"\bdid we (decide|discuss|agree|say|talk about|cover)\b",
             r"\bdo we have (any )?(notes?|docs?|anything|something)( on| about)?\b",
@@ -161,6 +161,26 @@ def _clear_observe_receipt(root: Path, harness: str) -> None:
         pass
 
 
+def _actor_contract_marker_path(
+    root: Path, harness: str, session: str | None = None
+) -> Path:
+    """Gitignored per-session marker: the full actor/retrieval contract was
+    already attached once. Later prompts receive a short reminder instead of
+    the ~4 KB block. bin/pre-compact.sh removes the marker so the first prompt
+    after a compaction re-attaches the full contract.
+
+    ``session`` is the harness's own session id from the hook payload. The
+    Egregore session file in the checkout is shared by every concurrent
+    session there and rewritten by each new one, so keying on it alone made
+    parallel sessions re-attach the full contract on every prompt."""
+
+    session = re.sub(r"[^A-Za-z0-9_.-]", "-", session or _session_id(root))[:120]
+    return (
+        root / ".egregore" / "runtime" / "observe"
+        / f"actor-contract-{harness}-{session}.sent"
+    )
+
+
 def _write_observe_receipt(root: Path, harness: str, prompt: str, context) -> None:
     """Record that this prompt already received useful authorized evidence.
 
@@ -378,6 +398,37 @@ def _query(args: argparse.Namespace) -> int:
     return 0
 
 
+_PASTED_OUTPUT_LINE = re.compile(
+    r"^(?:"
+    r"[ MADRCU?!]{2}\s+\S"          # git status --short / porcelain rows
+    r"|[▶❯»]\s"                     # terminal prompt markers
+    r"|\$\s\S"                      # shell prompt
+    r"|(?:\+\+\+|---|@@)\s"          # unified diff
+    r"|diff --git\b"
+    r"|Traceback \(most recent call last\)"
+    r"|\s+File \"[^\"]+\", line \d+"
+    r"|\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}"  # log timestamps
+    r"|[A-Za-z0-9_./-]+/[A-Za-z0-9_.-]+\.[a-z]{1,6}$"  # a bare path
+    r")"
+)
+
+
+def _looks_like_pasted_output(prompt: str) -> bool:
+    """True for terminal output, diffs, logs, and code blocks pasted into a prompt.
+
+    Those carry words like "handoff", "notes", or "docs" by accident; running a
+    retrieval on them attaches unrelated evidence and costs seconds. The actor
+    context still tells the model to recall once if the prompt truly needs it.
+    """
+
+    if "```" in prompt:
+        return True
+    lines = [line for line in prompt.splitlines() if line.strip()]
+    if len(lines) >= 8:
+        return True
+    return sum(1 for line in lines if _PASTED_OUTPUT_LINE.match(line)) >= 2
+
+
 def prompt_prefetches_org_context(prompt: str) -> bool:
     """Return whether Observe should prefetch likely organizational context.
 
@@ -390,6 +441,7 @@ def prompt_prefetches_org_context(prompt: str) -> bool:
     return bool(
         prompt
         and not _EXPLICIT_SEARCH.search(prompt)
+        and not _looks_like_pasted_output(prompt)
         and (
             _ORG_CONTEXT_PREFETCH_PATTERN.search(prompt)
             or _ORG_RITUAL_CONTEXT_PREFETCH_PATTERN.search(prompt)
@@ -414,8 +466,22 @@ def prompt_requests_actor_context(prompt: str) -> bool:
     return bool(prompt and prompt.strip())
 
 
-def _actor_context_block(runtime: EgregoreRuntime, root: Path, harness: str) -> str:
-    """Render the minimum stable identity needed by harness rituals."""
+_RECALL_ONLY_SCOPE = (
+    "Egregore Runtime is for organizational recall and memory only: team memory, "
+    "decisions, handoffs, meetings, prior work. Code search, file reads, Git, tests, "
+    "and every other task use the harness's normal tools (Grep, Glob, Read, Bash) "
+    "with no retrieval ritual and no Runtime call."
+)
+
+
+def _actor_context_block(
+    runtime: EgregoreRuntime, root: Path, harness: str, *, full: bool = True
+) -> str:
+    """Render the stable identity and the recall contract for harness rituals.
+
+    ``full`` renders the complete contract (once per session); otherwise a
+    short reminder that keeps identity and the recall-only scope in view.
+    """
 
     actor_context = _actor(runtime, root, harness)
     actor = actor_context.actor
@@ -435,6 +501,22 @@ def _actor_context_block(runtime: EgregoreRuntime, root: Path, harness: str) ->
     search_command = 'bash bin/search.sh query "<concept>" -n 6 --compact'
     if harness == "claude":
         search_command += " --context-packet"
+    if not full:
+        return "\n".join(
+            (
+                "EGREGORE_ACTOR_CONTEXT_V1",
+                "Reminder — the full contract was attached earlier in this session.",
+                f"Actor: {actor.display_name} · Actor ID: {actor.actor_id} · "
+                f"Organization ID: {actor_context.profile.org_id} · Runtime root: {root}",
+                _RECALL_ONLY_SCOPE,
+                "When a prompt needs that recall and no EGREGORE_ORG_CONTEXT_V1 block is "
+                f"attached, run exactly one `{search_command}`; exact latest/oldest/open "
+                "handoff questions use `bash bin/search.sh handoffs …` instead.",
+                "`me` and `myself` mean this Actor ID and display name; never infer identity "
+                "from the OS user, Git, or GitHub names.",
+                "END_EGREGORE_ACTOR_CONTEXT_V1",
+            )
+        )
     return "\n".join(
         (
             "EGREGORE_ACTOR_CONTEXT_V1",
@@ -451,6 +533,7 @@ def _actor_context_block(runtime: EgregoreRuntime, root: Path, harness: str) ->
             f"Runtime root: {root}",
             "Run Egregore retrieval and workflow commands from this Runtime root. "
             "Do not fall back to a launch checkout named elsewhere in the session.",
+            _RECALL_ONLY_SCOPE,
             "Organizational retrieval status: NOT_PERFORMED. This actor-only block "
             "does not mean organizational recall is unnecessary.",
             "Interpret the user's intent semantically, without requiring trigger words. "
@@ -687,11 +770,21 @@ def _prompt_hook(args: argparse.Namespace) -> int:
                 args.limit,
             )
         else:
+            hook_session = str(payload.get("session_id") or "").strip() or None
+            marker = _actor_contract_marker_path(root, args.harness, hook_session)
+            full = not marker.exists()
             additional_context = _actor_context_block(
                 runtime,
                 root,
                 args.harness,
+                full=full,
             )
+            if full:
+                try:
+                    marker.parent.mkdir(parents=True, exist_ok=True)
+                    marker.write_text(datetime.now(UTC).isoformat(), encoding="utf-8")
+                except OSError:
+                    pass
     except Exception as exc:  # Hooks are advisory and must never block a prompt.
         additional_context = (
             "Egregore Runtime context was requested but the Local Runtime is unavailable "

package/runtime/prime/.codex/spec-manifest.json

@@ -53,7 +53,7 @@
     {
       "section": "Egregore Retrieval Beat",
       "action": "keep",
-      "sourceHash": "6c5cbb0d1c9a",
+      "sourceHash": "bb2f214689cb",
       "note": "Kept verbatim — product attribution applies across runtimes."
     },
     {

package/runtime/prime/.prime/agent/APPEND_SYSTEM.md

@@ -185,19 +185,21 @@ For each user-directed organizational lookup, show exactly one visible line:
 - retrieval that actually queries the connected graph:
   `⌕ Egregore Connect · searching your organization’s memory and relationships`
 
-Runtime owns retrieval; no agent feature flag does. `EGREGORE_ORG_CONTEXT_V1`
-is only the schema label. When attached, authorized retrieval is complete:
+When `EGREGORE_ORG_CONTEXT_V1` is attached, authorized retrieval is complete:
 never query again that turn, and state any evidence gap. `OPENED_BY_OBSERVE`
 means the evidence is open. A later explicit search starts a new turn.
 
-**Visibility is the contract.** Emit it verbatim as a
-standalone assistant message before the first Bash, Grep, Glob, Read, or other
-retrieval tool call.
-Shell/tool output does not satisfy this requirement. Do not paraphrase the line.
+**Scope.** Egregore Runtime is for organizational recall only: team memory,
+decisions, handoffs, prior work. Code, files, Git, and tests use the harness's
+normal tools, with no beat and no Runtime call.
 
-Use the memory form normally; use Connect only for an explicit graph traversal
-that actually runs. Emit once per episode. A `bin/search.sh` banner is only a
-shell fallback and does not replace this visible beat.
+**Visibility is the contract.** Emit it verbatim as a standalone assistant
+message before the first tool call that performs the organizational recall
+(the `bin/search.sh` query or a graph read). Tool output does not satisfy it.
+Do not paraphrase the line.
+
+Use Connect only for a graph traversal that actually runs. Emit once per
+episode.
 
 **Routing:** Organizational recall always enters Egregore Runtime. The model is
 the semantic intent authority, deciding from meaning rather than fixed phrases.
@@ -212,15 +214,14 @@ Search output is model-internal: show only the retrieval line and receipts —
 never ranked blocks, file/rank/excerpt metadata, or raw JSON.
 
 Do not resolve `memory/` to its sibling repo or start with raw `grep`/`ls`.
-Search owns lexical/semantic selection and attaches no graph by default. Open a
-source only when its excerpt cannot support a necessary claim. For current
+Search attaches no graph by default. Open a source only when its excerpt
+cannot support a necessary claim. For current
 team/person synthesis, retain known organization/member names and choose
-`--recent-days` plus `--min-evidence`. Use native
-Grep/Glob for code and exact errors. `/activity`, `/dashboard`, and `/project`
+`--recent-days` plus `--min-evidence`. `/activity`, `/dashboard`, and `/project`
 display bounded status surfaces only when named or directly requested as a
-card. Questions asking for an explained synthesis of current organizational
-work are Runtime/QMD recall, as is prior-work discovery. Do not run full
-hybrid retrieval on unrelated prompts or infer graph from recall intent.
+card. Explained syntheses of current organizational work and prior-work
+discovery are Runtime/QMD recall. Do not run retrieval on unrelated prompts or
+infer graph from recall intent.
 
 Do not emit the beat for code search, Git inspection, startup hydration, graph
 writes, ingestion, background sync, maintenance, or internal queries.

package/runtime/prime/.prime/agent/spec-manifest.json

@@ -1,8 +1,8 @@
 {
   "generatedBy": "bin/prime-render-spec.mjs",
   "source": "AGENTS.md generated Codex spec",
-  "sourceHash": "76c76679f791",
-  "outputHash": "f220a03bc40a",
+  "sourceHash": "496480654dd9",
+  "outputHash": "fa7b0b82de98",
   "adaptations": [
     "Prime Agent APPEND_SYSTEM delivery from .prime/agent/",
     "Prime Agent tool_call branch gate incl. ipython classification",

package/runtime/prime/AGENTS.md

@@ -258,19 +258,21 @@ For each user-directed organizational lookup, show exactly one visible line:
 - retrieval that actually queries the connected graph:
   `⌕ Egregore Connect · searching your organization’s memory and relationships`
 
-Runtime owns retrieval; no agent feature flag does. `EGREGORE_ORG_CONTEXT_V1`
-is only the schema label. When attached, authorized retrieval is complete:
+When `EGREGORE_ORG_CONTEXT_V1` is attached, authorized retrieval is complete:
 never query again that turn, and state any evidence gap. `OPENED_BY_OBSERVE`
 means the evidence is open. A later explicit search starts a new turn.
 
-**Visibility is the contract.** Emit it verbatim as a
-standalone assistant message before the first Bash, Grep, Glob, Read, or other
-retrieval tool call.
-Shell/tool output does not satisfy this requirement. Do not paraphrase the line.
+**Scope.** Egregore Runtime is for organizational recall only: team memory,
+decisions, handoffs, prior work. Code, files, Git, and tests use the harness's
+normal tools, with no beat and no Runtime call.
 
-Use the memory form normally; use Connect only for an explicit graph traversal
-that actually runs. Emit once per episode. A `bin/search.sh` banner is only a
-shell fallback and does not replace this visible beat.
+**Visibility is the contract.** Emit it verbatim as a standalone assistant
+message before the first tool call that performs the organizational recall
+(the `bin/search.sh` query or a graph read). Tool output does not satisfy it.
+Do not paraphrase the line.
+
+Use Connect only for a graph traversal that actually runs. Emit once per
+episode.
 
 **Routing:** Organizational recall always enters Egregore Runtime. The model is
 the semantic intent authority, deciding from meaning rather than fixed phrases.
@@ -285,15 +287,14 @@ Search output is model-internal: show only the retrieval line and receipts —
 never ranked blocks, file/rank/excerpt metadata, or raw JSON.
 
 Do not resolve `memory/` to its sibling repo or start with raw `grep`/`ls`.
-Search owns lexical/semantic selection and attaches no graph by default. Open a
-source only when its excerpt cannot support a necessary claim. For current
+Search attaches no graph by default. Open a source only when its excerpt
+cannot support a necessary claim. For current
 team/person synthesis, retain known organization/member names and choose
-`--recent-days` plus `--min-evidence`. Use native
-Grep/Glob for code and exact errors. `$activity`, `$dashboard`, and `$project`
+`--recent-days` plus `--min-evidence`. `$activity`, `$dashboard`, and `$project`
 display bounded status surfaces only when named or directly requested as a
-card. Questions asking for an explained synthesis of current organizational
-work are Runtime/QMD recall, as is prior-work discovery. Do not run full
-hybrid retrieval on unrelated prompts or infer graph from recall intent.
+card. Explained syntheses of current organizational work and prior-work
+discovery are Runtime/QMD recall. Do not run retrieval on unrelated prompts or
+infer graph from recall intent.
 
 Do not emit the beat for code search, Git inspection, startup hydration, graph
 writes, ingestion, background sync, maintenance, or internal queries.

package/runtime/prime/bin/codex-render-spec.mjs

@@ -157,9 +157,8 @@ const NON_SKILL_TOKENS = new Set(['loop', 'fast', 'config', 'clear', 'help']);
 // hook delivers there. Rewrite the fallback command to the stdout form and
 // state the same hygiene contract in shell terms: search output is
 // model-internal; the visible reply carries only the retrieval line.
-const CLAUDE_PACKET_NOTE = `\`--context-packet\` keeps the evidence out of the visible transcript and
-attaches it privately; the visible output is the attribution line alone.
-Never re-print ranked results, file/rank/excerpt metadata, or raw JSON.`;
+const CLAUDE_PACKET_NOTE = `\`--context-packet\` attaches the evidence privately; the visible output is the
+attribution line alone. Never re-print ranked results or raw JSON.`;
 const SHELL_PACKET_NOTE = `Search output is model-internal: show only the retrieval line and receipts —
 never ranked blocks, file/rank/excerpt metadata, or raw JSON.`;
 

package/runtime/prime/egregore_runtime/harness_cli.py

@@ -38,7 +38,7 @@ from .runtime import EgregoreRuntime, local_runtime
 _ORG_CONTEXT_PREFETCH_PATTERN = re.compile(
     "|".join(
         (
-            r"\b(find|locate|dig up|look up|pull up)\b.*\b"
+            r"\b(find|locate|dig up|look up|pull up)\b[^\n]*\b"
             r"(handoff|decision|notes?|docs?|meeting|harvest|quest|reflection)s?\b",
             r"\bdid we (decide|discuss|agree|say|talk about|cover)\b",
             r"\bdo we have (any )?(notes?|docs?|anything|something)( on| about)?\b",
@@ -161,6 +161,26 @@ def _clear_observe_receipt(root: Path, harness: str) -> None:
         pass
 
 
+def _actor_contract_marker_path(
+    root: Path, harness: str, session: str | None = None
+) -> Path:
+    """Gitignored per-session marker: the full actor/retrieval contract was
+    already attached once. Later prompts receive a short reminder instead of
+    the ~4 KB block. bin/pre-compact.sh removes the marker so the first prompt
+    after a compaction re-attaches the full contract.
+
+    ``session`` is the harness's own session id from the hook payload. The
+    Egregore session file in the checkout is shared by every concurrent
+    session there and rewritten by each new one, so keying on it alone made
+    parallel sessions re-attach the full contract on every prompt."""
+
+    session = re.sub(r"[^A-Za-z0-9_.-]", "-", session or _session_id(root))[:120]
+    return (
+        root / ".egregore" / "runtime" / "observe"
+        / f"actor-contract-{harness}-{session}.sent"
+    )
+
+
 def _write_observe_receipt(root: Path, harness: str, prompt: str, context) -> None:
     """Record that this prompt already received useful authorized evidence.
 
@@ -378,6 +398,37 @@ def _query(args: argparse.Namespace) -> int:
     return 0
 
 
+_PASTED_OUTPUT_LINE = re.compile(
+    r"^(?:"
+    r"[ MADRCU?!]{2}\s+\S"          # git status --short / porcelain rows
+    r"|[▶❯»]\s"                     # terminal prompt markers
+    r"|\$\s\S"                      # shell prompt
+    r"|(?:\+\+\+|---|@@)\s"          # unified diff
+    r"|diff --git\b"
+    r"|Traceback \(most recent call last\)"
+    r"|\s+File \"[^\"]+\", line \d+"
+    r"|\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}"  # log timestamps
+    r"|[A-Za-z0-9_./-]+/[A-Za-z0-9_.-]+\.[a-z]{1,6}$"  # a bare path
+    r")"
+)
+
+
+def _looks_like_pasted_output(prompt: str) -> bool:
+    """True for terminal output, diffs, logs, and code blocks pasted into a prompt.
+
+    Those carry words like "handoff", "notes", or "docs" by accident; running a
+    retrieval on them attaches unrelated evidence and costs seconds. The actor
+    context still tells the model to recall once if the prompt truly needs it.
+    """
+
+    if "```" in prompt:
+        return True
+    lines = [line for line in prompt.splitlines() if line.strip()]
+    if len(lines) >= 8:
+        return True
+    return sum(1 for line in lines if _PASTED_OUTPUT_LINE.match(line)) >= 2
+
+
 def prompt_prefetches_org_context(prompt: str) -> bool:
     """Return whether Observe should prefetch likely organizational context.
 
@@ -390,6 +441,7 @@ def prompt_prefetches_org_context(prompt: str) -> bool:
     return bool(
         prompt
         and not _EXPLICIT_SEARCH.search(prompt)
+        and not _looks_like_pasted_output(prompt)
         and (
             _ORG_CONTEXT_PREFETCH_PATTERN.search(prompt)
             or _ORG_RITUAL_CONTEXT_PREFETCH_PATTERN.search(prompt)
@@ -414,8 +466,22 @@ def prompt_requests_actor_context(prompt: str) -> bool:
     return bool(prompt and prompt.strip())
 
 
-def _actor_context_block(runtime: EgregoreRuntime, root: Path, harness: str) -> str:
-    """Render the minimum stable identity needed by harness rituals."""
+_RECALL_ONLY_SCOPE = (
+    "Egregore Runtime is for organizational recall and memory only: team memory, "
+    "decisions, handoffs, meetings, prior work. Code search, file reads, Git, tests, "
+    "and every other task use the harness's normal tools (Grep, Glob, Read, Bash) "
+    "with no retrieval ritual and no Runtime call."
+)
+
+
+def _actor_context_block(
+    runtime: EgregoreRuntime, root: Path, harness: str, *, full: bool = True
+) -> str:
+    """Render the stable identity and the recall contract for harness rituals.
+
+    ``full`` renders the complete contract (once per session); otherwise a
+    short reminder that keeps identity and the recall-only scope in view.
+    """
 
     actor_context = _actor(runtime, root, harness)
     actor = actor_context.actor
@@ -435,6 +501,22 @@ def _actor_context_block(runtime: EgregoreRuntime, root: Path, harness: str) ->
     search_command = 'bash bin/search.sh query "<concept>" -n 6 --compact'
     if harness == "claude":
         search_command += " --context-packet"
+    if not full:
+        return "\n".join(
+            (
+                "EGREGORE_ACTOR_CONTEXT_V1",
+                "Reminder — the full contract was attached earlier in this session.",
+                f"Actor: {actor.display_name} · Actor ID: {actor.actor_id} · "
+                f"Organization ID: {actor_context.profile.org_id} · Runtime root: {root}",
+                _RECALL_ONLY_SCOPE,
+                "When a prompt needs that recall and no EGREGORE_ORG_CONTEXT_V1 block is "
+                f"attached, run exactly one `{search_command}`; exact latest/oldest/open "
+                "handoff questions use `bash bin/search.sh handoffs …` instead.",
+                "`me` and `myself` mean this Actor ID and display name; never infer identity "
+                "from the OS user, Git, or GitHub names.",
+                "END_EGREGORE_ACTOR_CONTEXT_V1",
+            )
+        )
     return "\n".join(
         (
             "EGREGORE_ACTOR_CONTEXT_V1",
@@ -451,6 +533,7 @@ def _actor_context_block(runtime: EgregoreRuntime, root: Path, harness: str) ->
             f"Runtime root: {root}",
             "Run Egregore retrieval and workflow commands from this Runtime root. "
             "Do not fall back to a launch checkout named elsewhere in the session.",
+            _RECALL_ONLY_SCOPE,
             "Organizational retrieval status: NOT_PERFORMED. This actor-only block "
             "does not mean organizational recall is unnecessary.",
             "Interpret the user's intent semantically, without requiring trigger words. "
@@ -687,11 +770,21 @@ def _prompt_hook(args: argparse.Namespace) -> int:
                 args.limit,
             )
         else:
+            hook_session = str(payload.get("session_id") or "").strip() or None
+            marker = _actor_contract_marker_path(root, args.harness, hook_session)
+            full = not marker.exists()
             additional_context = _actor_context_block(
                 runtime,
                 root,
                 args.harness,
+                full=full,
             )
+            if full:
+                try:
+                    marker.parent.mkdir(parents=True, exist_ok=True)
+                    marker.write_text(datetime.now(UTC).isoformat(), encoding="utf-8")
+                except OSError:
+                    pass
     except Exception as exc:  # Hooks are advisory and must never block a prompt.
         additional_context = (
             "Egregore Runtime context was requested but the Local Runtime is unavailable "