create-egregore 0.21.0-runtime-mvp.20 → 0.21.0-runtime-mvp.22

package/assets/egregore-launcher.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// egregore-launcher-version: 0.21.0-runtime-mvp.20
+// egregore-launcher-version: 0.21.0-runtime-mvp.22
 //
 // egregore — launch and browse Egregore instances from your terminal.
 // Installed by create-egregore. Reads ~/.egregore/instances.json.
@@ -35,7 +35,7 @@ const crypto = require("node:crypto");
 const { spawnSync, spawn } = require("node:child_process");
 const readline = require("node:readline");
 
-const VERSION = "0.21.0-runtime-mvp.20";
+const VERSION = "0.21.0-runtime-mvp.22";
 const REGISTRY = path.join(os.homedir(), ".egregore", "instances.json");
 const DEFAULT_FILE = path.join(os.homedir(), ".egregore", "default");
 const UPDATE_CACHE_FILE = path.join(os.homedir(), ".egregore", "update-check.json");
@@ -2341,8 +2341,18 @@ function connectedModeSuffix(instPath) {
 function packagedUpgradeScript() {
   const seeded = process.env.EGREGORE_RUNTIME_PACKAGED_BRIDGE;
   if (seeded !== undefined) return seeded || null;
-  const script = path.join(__dirname, "..", "runtime", "claude", "bin", "runtime-upgrade.sh");
-  return fs.existsSync(script) ? script : null;
+  // The launcher is copied into a PATH directory as a standalone executable,
+  // so __dirname normally points at /usr/local/bin or ~/.local/bin rather than
+  // the npm package that supplied it. installLauncherBinary keeps the matching
+  // Runtime engine in a versioned per-user directory outside every Egregore
+  // checkout. The package-adjacent fallback keeps direct source/package runs
+  // working without a separate install step.
+  const runtimeBase = process.env.EGREGORE_LAUNCHER_RUNTIME_DIR
+    || path.join(os.homedir(), ".egregore", "launcher-runtime");
+  const installed = path.join(runtimeBase, VERSION, "claude", "bin", "runtime-upgrade.sh");
+  if (fs.existsSync(installed)) return installed;
+  const adjacent = path.join(__dirname, "..", "runtime", "claude", "bin", "runtime-upgrade.sh");
+  return fs.existsSync(adjacent) ? adjacent : null;
 }
 
 function resolveUpgradeBridge(inst) {
@@ -2489,20 +2499,33 @@ function formatTelemetryLines(status) {
 function upgradeStatus(inst, { fetch = false } = {}) {
   const args = ["status"]; if (fetch) args.push("--fetch");
   const r = runUpgrade(inst, args);
-  if (!r || r.status !== 0 || !r.stdout) return null;
-  try { return JSON.parse(r.stdout); } catch { return null; }
+  if (!r || r.status !== 0 || !r.stdout) {
+    const detail = String((r && (r.stderr || r.stdout)) || "Runtime status probe failed")
+      .trim().split("\n")[0];
+    return { status: "unavailable", failure: { message: detail } };
+  }
+  try { return JSON.parse(r.stdout); } catch {
+    return { status: "unavailable", failure: { message: "Runtime status returned an unreadable response" } };
+  }
 }
 
 function upgradeStatusAsync(inst, cb) {
   const bridge = resolveUpgradeBridge(inst);
-  if (!bridge) return cb(null);
-  let buf = "";
+  if (!bridge) return cb({ status: "unavailable", failure: { message: "No Runtime update engine is installed" } });
+  let buf = ""; let err = "";
   try {
-    const child = spawn("bash", [bridge.script, "status"], { cwd: inst.path, stdio: ["ignore", "pipe", "ignore"], env: { ...process.env, ...bridge.env } });
+    const child = spawn("bash", [bridge.script, "status"], { cwd: inst.path, stdio: ["ignore", "pipe", "pipe"], env: { ...process.env, ...bridge.env } });
     child.stdout.on("data", (d) => { buf += d; });
-    child.on("close", () => { try { cb(JSON.parse(buf)); } catch { cb(null); } });
-    child.on("error", () => cb(null));
-  } catch { cb(null); }
+    child.stderr.on("data", (d) => { err += d; });
+    child.on("close", (code) => {
+      if (code === 0) {
+        try { cb(JSON.parse(buf)); return; } catch {}
+      }
+      const detail = String(err || buf || "Runtime status probe failed").trim().split("\n")[0];
+      cb({ status: "unavailable", failure: { message: detail } });
+    });
+    child.on("error", (error) => cb({ status: "unavailable", failure: { message: error.message } }));
+  } catch (error) { cb({ status: "unavailable", failure: { message: error.message } }); }
 }
 
 // Local retrieval health for the settings surface. Package-update state,
@@ -2622,6 +2645,7 @@ const UPGRADE_STATUS_LABEL = {
   active: "active",
   cancelled: "cancelled",
   "rolled-back": "rolled back",
+  unavailable: "unavailable",
 };
 
 // Settings-row truth for the Runtime update line. The row must say outright
@@ -2635,6 +2659,7 @@ function runtimeUpdateRowValue(st, candidate) {
     if (candidate && candidate !== v) return `${v} active ${YELLOW}· update available ${candidate}${RESET}`;
     return `${GREEN}${v} active${RESET}${candidate ? `${DIM} · up to date${RESET}` : ""}`;
   }
+  if (st.status === "unavailable") return `${YELLOW}update unavailable${RESET}`;
   if (st.status === "ready-to-activate") return `${GREEN}${upgradeSummary(st)}${RESET}`;
   if (st.status === "failed" || st.status === "interrupted") return `${YELLOW}${upgradeSummary(st)}${RESET}`;
   if (st.status === "preparing" || st.status === "pending") return `${DIM}${upgradeSummary(st)}${RESET}`;
@@ -2675,7 +2700,7 @@ function formatUpgradeLines(inst, st, { candidate = "", retrieval = null } = {})
   if (d.candidate_digest) lines.push(`Package digest: sha256 ${String(d.candidate_digest).slice(0, 16)}…`);
   // A recorded failure only needs attention while the transaction is stuck
   // on it; once a later prepare succeeds the line would contradict "ready".
-  if (d.failure && d.failure.message && (d.status === "failed" || d.status === "interrupted")) {
+  if (d.failure && d.failure.message && (["failed", "interrupted", "unavailable"].includes(d.status))) {
     lines.push(`Attention: ${d.failure.message}`);
   }
   if (d.rollback_version && d.status !== "none") lines.push(`Rollback target: ${d.rollback_version}`);
@@ -2750,6 +2775,7 @@ async function cmdSettingsRuntime(inst, args) {
     const st = upgradeStatus(inst, { fetch: fetchFlag });
     if (st === null) { process.stderr.write("Runtime update state is unavailable for this egregore.\n"); process.exitCode = 1; return; }
     emit(st);
+    if (st.status === "unavailable") process.exitCode = 1;
     if (action === "review" || (st.status !== "active" && st.status !== "none")) {
       process.stdout.write("\nWhat stays:\n");
       for (const s of UPGRADE_STAYS) process.stdout.write(`  · ${s}\n`);

package/bin/cli.js

@@ -471,6 +471,10 @@ async function main() {
       ui.error("Could not refresh the Egregore CLI.");
       process.exit(1);
     }
+    if (!alias.runtimeBridgePath || !fs.existsSync(alias.runtimeBridgePath)) {
+      ui.error("Could not refresh the Runtime update engine.");
+      process.exit(1);
+    }
     ui.success(`Egregore CLI is current at ${alias.binaryPath}`);
     return;
   }

package/lib/setup.js

@@ -1283,6 +1283,7 @@ async function launchOrInstruct(egregoreDir, alias, ui, ctx = {}) {
 // browser, better rendering, and richer keybinds.
 const LAUNCHER_TEMPLATE_JS = path.join(__dirname, "..", "assets", "egregore-launcher.js");
 const LAUNCHER_TEMPLATE_SH = path.join(__dirname, "..", "assets", "egregore-launcher.sh");
+const LAUNCHER_RUNTIME_TEMPLATE = path.join(__dirname, "..", "runtime", "claude");
 
 function readLauncherTemplate() {
   // Prefer the Node launcher; fall back to bash only if the .js is missing.
@@ -1294,6 +1295,50 @@ function currentTemplatePath() {
   return fs.existsSync(LAUNCHER_TEMPLATE_JS) ? LAUNCHER_TEMPLATE_JS : LAUNCHER_TEMPLATE_SH;
 }
 
+function launcherRuntimeRoot(version) {
+  const base = process.env.EGREGORE_LAUNCHER_RUNTIME_DIR
+    || path.join(os.homedir(), ".egregore", "launcher-runtime");
+  return version ? path.join(base, version) : null;
+}
+
+function launcherRuntimeBridge(version) {
+  const root = launcherRuntimeRoot(version);
+  return root ? path.join(root, "claude", "bin", "runtime-upgrade.sh") : null;
+}
+
+// The PATH launcher is a copied standalone file, not an npm shim, so it cannot
+// reach runtime/ through __dirname after installation. Keep the matching
+// upgrade engine in a versioned per-user directory. This is deliberately
+// outside registered Egregore checkouts: refreshing the global CLI must never
+// spray framework files into an instance or dirty its Git working tree.
+function installLauncherRuntime(version, ui) {
+  const destination = launcherRuntimeRoot(version);
+  const bridge = launcherRuntimeBridge(version);
+  if (!destination || !fs.existsSync(LAUNCHER_RUNTIME_TEMPLATE)) return null;
+  if (bridge && fs.existsSync(bridge)) return bridge;
+
+  const parent = path.dirname(destination);
+  const temporary = path.join(parent, `.${path.basename(destination)}.tmp-${process.pid}`);
+  try {
+    fs.mkdirSync(parent, { recursive: true, mode: 0o700 });
+    fs.rmSync(temporary, { recursive: true, force: true });
+    fs.mkdirSync(temporary, { recursive: true, mode: 0o700 });
+    fs.cpSync(LAUNCHER_RUNTIME_TEMPLATE, path.join(temporary, "claude"), {
+      recursive: true,
+      dereference: false,
+    });
+    const stagedBridge = path.join(temporary, "claude", "bin", "runtime-upgrade.sh");
+    if (!fs.existsSync(stagedBridge)) throw new Error("packaged runtime-upgrade.sh is missing");
+    fs.rmSync(destination, { recursive: true, force: true });
+    fs.renameSync(temporary, destination);
+    return bridge;
+  } catch (err) {
+    try { fs.rmSync(temporary, { recursive: true, force: true }); } catch {}
+    ui.warn(`Could not install the Runtime update engine: ${err.message}`);
+    return null;
+  }
+}
+
 // Parse a semver from a version-stamp comment. Accepts both styles so we can
 // upgrade a bash launcher to the Node launcher across a major line:
 //   # egregore-launcher-version: X.Y.Z   (bash)
@@ -1400,6 +1445,8 @@ function appendLocalBinToRc(ui) {
  */
 async function installLauncherBinary(egregoreDir, ui) {
   const template = readLauncherTemplate();
+  const templateVer = launcherVersion(template);
+  const packagedBridge = installLauncherRuntime(templateVer, ui);
   // Tests, containers, and managed installations can pin the launcher to an
   // isolated directory.  When explicitly configured, never fall through to a
   // machine-wide path: isolation is the reason the override exists.
@@ -1444,7 +1491,7 @@ async function installLauncherBinary(egregoreDir, ui) {
         try { fs.chmodSync(binaryPath, 0o755); } catch {}
         if (chosen.location === "user" && !dirOnPath(chosen.dir)) appendLocalBinToRc(ui);
         removeShadowingEgregoreAliases(ui);
-        return { aliasName: "egregore", binaryPath, location: chosen.location, replaced: false };
+        return { aliasName: "egregore", binaryPath, location: chosen.location, replaced: false, runtimeBridgePath: packagedBridge };
       }
 
       // Different content — decide upgrade vs preserve via version stamps.
@@ -1458,18 +1505,18 @@ async function installLauncherBinary(egregoreDir, ui) {
           ui.success(`Upgraded ${ui.dim("egregore")} at ${binaryPath} ${ui.dim(`(${existingVer} → ${templateVer})`)}`);
           if (chosen.location === "user" && !dirOnPath(chosen.dir)) appendLocalBinToRc(ui);
           removeShadowingEgregoreAliases(ui);
-          return { aliasName: "egregore", binaryPath, location: chosen.location, replaced: true };
+          return { aliasName: "egregore", binaryPath, location: chosen.location, replaced: true, runtimeBridgePath: packagedBridge };
         }
         if (compareVersions(templateVer, existingVer) < 0) {
           // Template is older — don't downgrade. Warn lightly.
           ui.warn(`Existing ${binaryPath} (v${existingVer}) is newer than this installer's template (v${templateVer}) — leaving it alone.`);
           removeShadowingEgregoreAliases(ui);
-          return { aliasName: "egregore", binaryPath, location: chosen.location, replaced: false };
+          return { aliasName: "egregore", binaryPath, location: chosen.location, replaced: false, runtimeBridgePath: launcherRuntimeBridge(existingVer) };
         }
         // Equal stamps but different content → user edited the file. Don't clobber.
         ui.warn(`Existing ${binaryPath} has been edited locally — not overwriting.`);
         ui.info(`  To reset: cp ${currentTemplatePath()} ${binaryPath}`);
-        return { aliasName: "egregore", binaryPath, location: chosen.location, replaced: false };
+        return { aliasName: "egregore", binaryPath, location: chosen.location, replaced: false, runtimeBridgePath: packagedBridge };
       }
 
       // No version stamp on existing. If it looks like one of OUR old
@@ -1485,11 +1532,11 @@ async function installLauncherBinary(egregoreDir, ui) {
         ui.success(`Upgraded ${ui.dim("egregore")} at ${binaryPath} ${ui.dim(`(pre-0.4.1 → ${templateVer})`)}`);
         if (chosen.location === "user" && !dirOnPath(chosen.dir)) appendLocalBinToRc(ui);
         removeShadowingEgregoreAliases(ui);
-        return { aliasName: "egregore", binaryPath, location: chosen.location, replaced: true };
+        return { aliasName: "egregore", binaryPath, location: chosen.location, replaced: true, runtimeBridgePath: packagedBridge };
       }
       ui.warn(`Existing ${binaryPath} doesn't look like an egregore launcher — not overwriting.`);
       ui.info(`  If you meant to install: rm ${binaryPath} and re-run create-egregore.`);
-      return { aliasName: "egregore", binaryPath, location: chosen.location, replaced: false };
+      return { aliasName: "egregore", binaryPath, location: chosen.location, replaced: false, runtimeBridgePath: null };
     } catch {
       // Fall through to write
     }
@@ -1509,7 +1556,7 @@ async function installLauncherBinary(egregoreDir, ui) {
 
   removeShadowingEgregoreAliases(ui);
   ui.success(`Installed ${ui.dim("egregore")} at ${binaryPath}`);
-  return { aliasName: "egregore", binaryPath, location: chosen.location, replaced };
+  return { aliasName: "egregore", binaryPath, location: chosen.location, replaced, runtimeBridgePath: packagedBridge };
 }
 
 // Strip legacy `alias egregore=...` lines from common shell rc files. These

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-egregore",
-  "version": "0.21.0-runtime-mvp.20",
+  "version": "0.21.0-runtime-mvp.22",
   "description": "Set up Egregore for your team in one command — installs the egregore launcher and your choice of Claude Code, Codex, or Pi.",
   "license": "MIT",
   "bin": {

package/runtime/claude/bin/runtime-identity.sh

@@ -6,7 +6,12 @@ set -euo pipefail
 # legacy Local instances create opaque local IDs once. Network failure remains
 # non-fatal to startup and is retried next session.
 
-ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+RUNTIME_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+# A launcher-carried bridge runs outside the selected instance. Keep code
+# rooted in the packaged Runtime while resolving and persisting identity in
+# exactly the instance the launcher selected.
+ROOT="${EGREGORE_INSTANCE_ROOT:-$RUNTIME_ROOT}"
+ROOT="$(cd "$ROOT" && pwd)"
 CONFIG="$ROOT/egregore.json"
 STATE="$ROOT/.egregore-state.json"
 
@@ -34,7 +39,9 @@ case "${1:-ensure}" in
     resolved && exit 0
     mode="$(jq -r 'if (.mode // "local") == "connected" or (.api_url // "") != "" then "connected" else "local" end' "$CONFIG" 2>/dev/null || echo local)"
     if [ "$mode" = "local" ]; then
-      EGREGORE_ROOT="$ROOT" python3 -m egregore_runtime.identity_cli initialize-local >/dev/null
+      EGREGORE_ROOT="$ROOT" \
+        PYTHONPATH="$RUNTIME_ROOT${PYTHONPATH:+:$PYTHONPATH}" \
+        python3 -m egregore_runtime.identity_cli initialize-local >/dev/null
     else
       api_url="$(jq -r '.api_url // empty' "$CONFIG" 2>/dev/null)"
       api_key="$(grep '^EGREGORE_API_KEY=' "$ROOT/.env" 2>/dev/null | cut -d= -f2-)"
@@ -58,7 +65,9 @@ case "${1:-ensure}" in
         --argjson organization "$control_plane" \
         --argjson roster "$roster" \
         '{organization:$organization,roster:$roster}' | \
-        EGREGORE_ROOT="$ROOT" python3 -m egregore_runtime.identity_cli \
+        EGREGORE_ROOT="$ROOT" \
+          PYTHONPATH="$RUNTIME_ROOT${PYTHONPATH:+:$PYTHONPATH}" \
+          python3 -m egregore_runtime.identity_cli \
           reconcile-records >/dev/null
     fi
     resolved

package/runtime/claude/bin/runtime-upgrade.sh

@@ -28,13 +28,35 @@ _runtime() {
     python3 -m egregore_runtime.harness_cli "$@"
 }
 
+_ensure_identity() {
+  # Pre-Runtime instances can predate stable organization identity. Resolve it
+  # through the existing verified Local/Connected migration before computing
+  # the instance-scoped upgrade key; never infer identity from path or slug.
+  if jq -e '
+    .org_id | type == "string" and length > 0
+  ' "$INSTANCE_ROOT/egregore.json" >/dev/null 2>&1; then
+    return 0
+  fi
+  EGREGORE_INSTANCE_ROOT="$INSTANCE_ROOT" \
+    PYTHONPATH="$SCRIPT_DIR${PYTHONPATH:+:$PYTHONPATH}" \
+    bash "$SCRIPT_DIR/bin/runtime-identity.sh" ensure
+}
+
+_run_upgrade() {
+  _ensure_identity || {
+    echo "Runtime update could not resolve this Egregore's stable identity." >&2
+    return 1
+  }
+  _runtime upgrade "$@"
+}
+
 case "${1:-}" in
-  status)   shift; _runtime upgrade status "$@" ;;
-  init)     shift; _runtime upgrade init "$@" ;;
-  prepare)  shift; _runtime upgrade prepare "$@" ;;
-  activate) shift; _runtime upgrade activate "$@" ;;
-  cancel)   shift; _runtime upgrade cancel "$@" ;;
-  rollback) shift; _runtime upgrade rollback "$@" ;;
+  status)   shift; _run_upgrade status "$@" ;;
+  init)     shift; _run_upgrade init "$@" ;;
+  prepare)  shift; _run_upgrade prepare "$@" ;;
+  activate) shift; _run_upgrade activate "$@" ;;
+  cancel)   shift; _run_upgrade cancel "$@" ;;
+  rollback) shift; _run_upgrade rollback "$@" ;;
   team-sync) shift; _runtime team-sync "$@" ;;
   *)
     echo "usage: bash bin/runtime-upgrade.sh {status|init --candidate <version>|prepare|activate|cancel|rollback|team-sync}" >&2

package/runtime/codex/bin/runtime-identity.sh

@@ -6,7 +6,12 @@ set -euo pipefail
 # legacy Local instances create opaque local IDs once. Network failure remains
 # non-fatal to startup and is retried next session.
 
-ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+RUNTIME_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+# A launcher-carried bridge runs outside the selected instance. Keep code
+# rooted in the packaged Runtime while resolving and persisting identity in
+# exactly the instance the launcher selected.
+ROOT="${EGREGORE_INSTANCE_ROOT:-$RUNTIME_ROOT}"
+ROOT="$(cd "$ROOT" && pwd)"
 CONFIG="$ROOT/egregore.json"
 STATE="$ROOT/.egregore-state.json"
 
@@ -34,7 +39,9 @@ case "${1:-ensure}" in
     resolved && exit 0
     mode="$(jq -r 'if (.mode // "local") == "connected" or (.api_url // "") != "" then "connected" else "local" end' "$CONFIG" 2>/dev/null || echo local)"
     if [ "$mode" = "local" ]; then
-      EGREGORE_ROOT="$ROOT" python3 -m egregore_runtime.identity_cli initialize-local >/dev/null
+      EGREGORE_ROOT="$ROOT" \
+        PYTHONPATH="$RUNTIME_ROOT${PYTHONPATH:+:$PYTHONPATH}" \
+        python3 -m egregore_runtime.identity_cli initialize-local >/dev/null
     else
       api_url="$(jq -r '.api_url // empty' "$CONFIG" 2>/dev/null)"
       api_key="$(grep '^EGREGORE_API_KEY=' "$ROOT/.env" 2>/dev/null | cut -d= -f2-)"
@@ -58,7 +65,9 @@ case "${1:-ensure}" in
         --argjson organization "$control_plane" \
         --argjson roster "$roster" \
         '{organization:$organization,roster:$roster}' | \
-        EGREGORE_ROOT="$ROOT" python3 -m egregore_runtime.identity_cli \
+        EGREGORE_ROOT="$ROOT" \
+          PYTHONPATH="$RUNTIME_ROOT${PYTHONPATH:+:$PYTHONPATH}" \
+          python3 -m egregore_runtime.identity_cli \
           reconcile-records >/dev/null
     fi
     resolved

package/runtime/codex/bin/runtime-upgrade.sh

@@ -28,13 +28,35 @@ _runtime() {
     python3 -m egregore_runtime.harness_cli "$@"
 }
 
+_ensure_identity() {
+  # Pre-Runtime instances can predate stable organization identity. Resolve it
+  # through the existing verified Local/Connected migration before computing
+  # the instance-scoped upgrade key; never infer identity from path or slug.
+  if jq -e '
+    .org_id | type == "string" and length > 0
+  ' "$INSTANCE_ROOT/egregore.json" >/dev/null 2>&1; then
+    return 0
+  fi
+  EGREGORE_INSTANCE_ROOT="$INSTANCE_ROOT" \
+    PYTHONPATH="$SCRIPT_DIR${PYTHONPATH:+:$PYTHONPATH}" \
+    bash "$SCRIPT_DIR/bin/runtime-identity.sh" ensure
+}
+
+_run_upgrade() {
+  _ensure_identity || {
+    echo "Runtime update could not resolve this Egregore's stable identity." >&2
+    return 1
+  }
+  _runtime upgrade "$@"
+}
+
 case "${1:-}" in
-  status)   shift; _runtime upgrade status "$@" ;;
-  init)     shift; _runtime upgrade init "$@" ;;
-  prepare)  shift; _runtime upgrade prepare "$@" ;;
-  activate) shift; _runtime upgrade activate "$@" ;;
-  cancel)   shift; _runtime upgrade cancel "$@" ;;
-  rollback) shift; _runtime upgrade rollback "$@" ;;
+  status)   shift; _run_upgrade status "$@" ;;
+  init)     shift; _run_upgrade init "$@" ;;
+  prepare)  shift; _run_upgrade prepare "$@" ;;
+  activate) shift; _run_upgrade activate "$@" ;;
+  cancel)   shift; _run_upgrade cancel "$@" ;;
+  rollback) shift; _run_upgrade rollback "$@" ;;
   team-sync) shift; _runtime team-sync "$@" ;;
   *)
     echo "usage: bash bin/runtime-upgrade.sh {status|init --candidate <version>|prepare|activate|cancel|rollback|team-sync}" >&2

package/runtime/pi/bin/runtime-identity.sh

@@ -6,7 +6,12 @@ set -euo pipefail
 # legacy Local instances create opaque local IDs once. Network failure remains
 # non-fatal to startup and is retried next session.
 
-ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+RUNTIME_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+# A launcher-carried bridge runs outside the selected instance. Keep code
+# rooted in the packaged Runtime while resolving and persisting identity in
+# exactly the instance the launcher selected.
+ROOT="${EGREGORE_INSTANCE_ROOT:-$RUNTIME_ROOT}"
+ROOT="$(cd "$ROOT" && pwd)"
 CONFIG="$ROOT/egregore.json"
 STATE="$ROOT/.egregore-state.json"
 
@@ -34,7 +39,9 @@ case "${1:-ensure}" in
     resolved && exit 0
     mode="$(jq -r 'if (.mode // "local") == "connected" or (.api_url // "") != "" then "connected" else "local" end' "$CONFIG" 2>/dev/null || echo local)"
     if [ "$mode" = "local" ]; then
-      EGREGORE_ROOT="$ROOT" python3 -m egregore_runtime.identity_cli initialize-local >/dev/null
+      EGREGORE_ROOT="$ROOT" \
+        PYTHONPATH="$RUNTIME_ROOT${PYTHONPATH:+:$PYTHONPATH}" \
+        python3 -m egregore_runtime.identity_cli initialize-local >/dev/null
     else
       api_url="$(jq -r '.api_url // empty' "$CONFIG" 2>/dev/null)"
       api_key="$(grep '^EGREGORE_API_KEY=' "$ROOT/.env" 2>/dev/null | cut -d= -f2-)"
@@ -58,7 +65,9 @@ case "${1:-ensure}" in
         --argjson organization "$control_plane" \
         --argjson roster "$roster" \
         '{organization:$organization,roster:$roster}' | \
-        EGREGORE_ROOT="$ROOT" python3 -m egregore_runtime.identity_cli \
+        EGREGORE_ROOT="$ROOT" \
+          PYTHONPATH="$RUNTIME_ROOT${PYTHONPATH:+:$PYTHONPATH}" \
+          python3 -m egregore_runtime.identity_cli \
           reconcile-records >/dev/null
     fi
     resolved

package/runtime/pi/bin/runtime-upgrade.sh

@@ -28,13 +28,35 @@ _runtime() {
     python3 -m egregore_runtime.harness_cli "$@"
 }
 
+_ensure_identity() {
+  # Pre-Runtime instances can predate stable organization identity. Resolve it
+  # through the existing verified Local/Connected migration before computing
+  # the instance-scoped upgrade key; never infer identity from path or slug.
+  if jq -e '
+    .org_id | type == "string" and length > 0
+  ' "$INSTANCE_ROOT/egregore.json" >/dev/null 2>&1; then
+    return 0
+  fi
+  EGREGORE_INSTANCE_ROOT="$INSTANCE_ROOT" \
+    PYTHONPATH="$SCRIPT_DIR${PYTHONPATH:+:$PYTHONPATH}" \
+    bash "$SCRIPT_DIR/bin/runtime-identity.sh" ensure
+}
+
+_run_upgrade() {
+  _ensure_identity || {
+    echo "Runtime update could not resolve this Egregore's stable identity." >&2
+    return 1
+  }
+  _runtime upgrade "$@"
+}
+
 case "${1:-}" in
-  status)   shift; _runtime upgrade status "$@" ;;
-  init)     shift; _runtime upgrade init "$@" ;;
-  prepare)  shift; _runtime upgrade prepare "$@" ;;
-  activate) shift; _runtime upgrade activate "$@" ;;
-  cancel)   shift; _runtime upgrade cancel "$@" ;;
-  rollback) shift; _runtime upgrade rollback "$@" ;;
+  status)   shift; _run_upgrade status "$@" ;;
+  init)     shift; _run_upgrade init "$@" ;;
+  prepare)  shift; _run_upgrade prepare "$@" ;;
+  activate) shift; _run_upgrade activate "$@" ;;
+  cancel)   shift; _run_upgrade cancel "$@" ;;
+  rollback) shift; _run_upgrade rollback "$@" ;;
   team-sync) shift; _runtime team-sync "$@" ;;
   *)
     echo "usage: bash bin/runtime-upgrade.sh {status|init --candidate <version>|prepare|activate|cancel|rollback|team-sync}" >&2

package/runtime/prime/bin/runtime-identity.sh

@@ -6,7 +6,12 @@ set -euo pipefail
 # legacy Local instances create opaque local IDs once. Network failure remains
 # non-fatal to startup and is retried next session.
 
-ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+RUNTIME_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+# A launcher-carried bridge runs outside the selected instance. Keep code
+# rooted in the packaged Runtime while resolving and persisting identity in
+# exactly the instance the launcher selected.
+ROOT="${EGREGORE_INSTANCE_ROOT:-$RUNTIME_ROOT}"
+ROOT="$(cd "$ROOT" && pwd)"
 CONFIG="$ROOT/egregore.json"
 STATE="$ROOT/.egregore-state.json"
 
@@ -34,7 +39,9 @@ case "${1:-ensure}" in
     resolved && exit 0
     mode="$(jq -r 'if (.mode // "local") == "connected" or (.api_url // "") != "" then "connected" else "local" end' "$CONFIG" 2>/dev/null || echo local)"
     if [ "$mode" = "local" ]; then
-      EGREGORE_ROOT="$ROOT" python3 -m egregore_runtime.identity_cli initialize-local >/dev/null
+      EGREGORE_ROOT="$ROOT" \
+        PYTHONPATH="$RUNTIME_ROOT${PYTHONPATH:+:$PYTHONPATH}" \
+        python3 -m egregore_runtime.identity_cli initialize-local >/dev/null
     else
       api_url="$(jq -r '.api_url // empty' "$CONFIG" 2>/dev/null)"
       api_key="$(grep '^EGREGORE_API_KEY=' "$ROOT/.env" 2>/dev/null | cut -d= -f2-)"
@@ -58,7 +65,9 @@ case "${1:-ensure}" in
         --argjson organization "$control_plane" \
         --argjson roster "$roster" \
         '{organization:$organization,roster:$roster}' | \
-        EGREGORE_ROOT="$ROOT" python3 -m egregore_runtime.identity_cli \
+        EGREGORE_ROOT="$ROOT" \
+          PYTHONPATH="$RUNTIME_ROOT${PYTHONPATH:+:$PYTHONPATH}" \
+          python3 -m egregore_runtime.identity_cli \
           reconcile-records >/dev/null
     fi
     resolved

package/runtime/prime/bin/runtime-upgrade.sh

@@ -28,13 +28,35 @@ _runtime() {
     python3 -m egregore_runtime.harness_cli "$@"
 }
 
+_ensure_identity() {
+  # Pre-Runtime instances can predate stable organization identity. Resolve it
+  # through the existing verified Local/Connected migration before computing
+  # the instance-scoped upgrade key; never infer identity from path or slug.
+  if jq -e '
+    .org_id | type == "string" and length > 0
+  ' "$INSTANCE_ROOT/egregore.json" >/dev/null 2>&1; then
+    return 0
+  fi
+  EGREGORE_INSTANCE_ROOT="$INSTANCE_ROOT" \
+    PYTHONPATH="$SCRIPT_DIR${PYTHONPATH:+:$PYTHONPATH}" \
+    bash "$SCRIPT_DIR/bin/runtime-identity.sh" ensure
+}
+
+_run_upgrade() {
+  _ensure_identity || {
+    echo "Runtime update could not resolve this Egregore's stable identity." >&2
+    return 1
+  }
+  _runtime upgrade "$@"
+}
+
 case "${1:-}" in
-  status)   shift; _runtime upgrade status "$@" ;;
-  init)     shift; _runtime upgrade init "$@" ;;
-  prepare)  shift; _runtime upgrade prepare "$@" ;;
-  activate) shift; _runtime upgrade activate "$@" ;;
-  cancel)   shift; _runtime upgrade cancel "$@" ;;
-  rollback) shift; _runtime upgrade rollback "$@" ;;
+  status)   shift; _run_upgrade status "$@" ;;
+  init)     shift; _run_upgrade init "$@" ;;
+  prepare)  shift; _run_upgrade prepare "$@" ;;
+  activate) shift; _run_upgrade activate "$@" ;;
+  cancel)   shift; _run_upgrade cancel "$@" ;;
+  rollback) shift; _run_upgrade rollback "$@" ;;
   team-sync) shift; _runtime team-sync "$@" ;;
   *)
     echo "usage: bash bin/runtime-upgrade.sh {status|init --candidate <version>|prepare|activate|cancel|rollback|team-sync}" >&2