create-egregore 0.21.0-runtime-mvp.9 → 0.21.0-runtime-mvp.10

package/assets/egregore-launcher.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// egregore-launcher-version: 0.21.0-runtime-mvp.9
+// egregore-launcher-version: 0.21.0-runtime-mvp.10
 //
 // egregore — launch and browse Egregore instances from your terminal.
 // Installed by create-egregore. Reads ~/.egregore/instances.json.
@@ -35,7 +35,7 @@ const crypto = require("node:crypto");
 const { spawnSync, spawn } = require("node:child_process");
 const readline = require("node:readline");
 
-const VERSION = "0.21.0-runtime-mvp.9";
+const VERSION = "0.21.0-runtime-mvp.10";
 const REGISTRY = path.join(os.homedir(), ".egregore", "instances.json");
 const DEFAULT_FILE = path.join(os.homedir(), ".egregore", "default");
 const UPDATE_CACHE_FILE = path.join(os.homedir(), ".egregore", "update-check.json");
@@ -4046,7 +4046,7 @@ async function browser(args = {}) {
             }
             if (chunk === "s" && proposal && proposal.token) {
               S.settingsAction = "tele-share";
-              S.settingsInput = `Send ${proposal.events} event(s) to ${proposal.target} now? Local events are retained. [y/N]`;
+              S.settingsInput = `Send ${proposal.events} event(s) now? Local events are retained. [y/N]`;
               render(); return;
             }
             if (key.name === "escape" || key.name === "left") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-egregore",
-  "version": "0.21.0-runtime-mvp.9",
+  "version": "0.21.0-runtime-mvp.10",
   "description": "Set up Egregore for your team in one command — installs the egregore launcher and your choice of Claude Code, Codex, or Pi.",
   "license": "MIT",
   "bin": {

package/runtime/claude/bin/search.sh

@@ -235,6 +235,21 @@ cmd_query() {
     } >&2
     return "$query_rc"
   fi
+  # Content-free query telemetry: mode, duration, result count. Never the
+  # query text. This is what makes Runtime/QMD retrieval visible in the
+  # telemetry event list instead of only legacy graph_query rows.
+  local _tele_count _tele_ms
+  _tele_ms=$(( ($(date +%s) - t0) * 1000 ))
+  _tele_count=$(printf '%s' "$out" | jq 'if type == "array" then length elif type == "object" then (.results // [] | length) else empty end' 2>/dev/null || true)
+  if [[ "$_tele_count" =~ ^[0-9]+$ ]]; then
+    bash "$SCRIPT_DIR/bin/telemetry.sh" emit "query" \
+      "$(jq -n --arg mode "$label" --argjson d "$_tele_ms" --argjson c "$_tele_count" \
+        '{mode:$mode, duration_ms:$d, count:$c}')" 2>/dev/null &
+  else
+    bash "$SCRIPT_DIR/bin/telemetry.sh" emit "query" \
+      "$(jq -n --arg mode "$label" --argjson d "$_tele_ms" '{mode:$mode, duration_ms:$d}')" 2>/dev/null &
+  fi
+
   [ "$enrich" = 1 ] && emit="_enrich"
   if [ "$context_packet" = 1 ]; then
     local packet

package/runtime/claude/bin/settings.sh

@@ -146,7 +146,7 @@ cmd_workflow() {
           || _die "cannot switch workflow: origin/main does not exist or could not be reached" 1
         _save '.base_branch = "main"'
       fi
-      echo "Git workflow: SIMPLE — pull requests now target main"
+      echo "Git workflow: SIMPLE — pull requests now target main · /save shares it with the org"
       ;;
     staged)
       if [ "$base" != "develop" ]; then
@@ -160,7 +160,7 @@ cmd_workflow() {
       elif ! jq -e 'has("base_branch")' "$CONFIG" >/dev/null 2>&1; then
         _save '.base_branch = "develop"'
       fi
-      echo "Git workflow: STAGED — pull requests now target develop; releases promote to main"
+      echo "Git workflow: STAGED — pull requests now target develop; releases promote to main · /save shares it with the org"
       ;;
     *) _die "usage: settings.sh workflow status|simple|staged" 1 ;;
   esac
@@ -468,7 +468,7 @@ cmd_posture() {
       if [ "$action" != "$current" ]; then
         _save '.boundary = ((.boundary // {}) + {posture: $p})' --arg p "$action"
       fi
-      echo "Boundary posture: $action"
+      echo "Boundary posture: $action · applies to new sessions · /save shares it with the org"
       ;;
     *) _die "usage: settings.sh posture status|strict|standard|open" 1 ;;
   esac

package/runtime/claude/bin/telemetry.sh

@@ -27,6 +27,10 @@ fi
 BUFFER_FILE="$BUFFER_DIR/telemetry.jsonl"
 LOCK_DIR="$BUFFER_DIR/telemetry.lock"
 SHARE_CONSENT_FILE="$BUFFER_DIR/telemetry-share-consent.json"
+# Exact dataset pinned at proposal time. The confirm step sends this snapshot,
+# so events emitted between proposal and confirm (attendant, other sessions)
+# can never invalidate — or silently join — a disclosed share.
+SHARE_STAGED_FILE="$BUFFER_DIR/telemetry.share-staged.jsonl"
 STATE_FILE="${EGREGORE_STATE_FILE:-$SCRIPT_DIR/.egregore-state.json}"
 CONFIG="${EGREGORE_CONFIG_FILE:-$SCRIPT_DIR/egregore.json}"
 ENV_FILE="${EGREGORE_ENV_FILE:-$SCRIPT_DIR/.env}"
@@ -230,7 +234,8 @@ _validate_metrics() {
 }
 
 _validate_buffer() {
-  [ -s "$BUFFER_FILE" ] || return 0
+  local target="${1:-$BUFFER_FILE}"
+  [ -s "$target" ] || return 0
   jq -e --arg schema "$SCHEMA_VERSION" --argjson allowed "$ALLOWED_METRICS_JSON" '
     def safe_id:
       type == "string" and length > 0 and length <= 256 and
@@ -264,7 +269,7 @@ _validate_buffer() {
       (.data | safe_metrics) and (.ts | type == "string") and
       (.type | safe_id) and (.sid | safe_id) and (.org | safe_id) and (.user | safe_id)
     end
-  ' "$BUFFER_FILE" >/dev/null 2>&1
+  ' "$target" >/dev/null 2>&1
 }
 
 cmd_emit() {
@@ -422,7 +427,7 @@ cmd_clear() {
     echo "Could not acquire the telemetry lock; nothing was cleared." >&2
     return 1
   fi
-  rm -f "$BUFFER_FILE" "$SHARE_CONSENT_FILE"
+  rm -f "$BUFFER_FILE" "$SHARE_CONSENT_FILE" "$SHARE_STAGED_FILE"
   _unlock
   echo "Local telemetry buffer cleared."
 }
@@ -525,31 +530,35 @@ cmd_share() {
     https://*|http://127.0.0.1*|http://localhost*|http://\[::1\]*) ;;
     *) echo "Share endpoint must use https (or loopback http)." >&2; return 2 ;;
   esac
-  if ! _validate_buffer; then
+  # Proposal validates the live buffer it is about to stage; confirm validates
+  # the staged snapshot it is about to send — never the moving buffer.
+  if [ -z "$confirmation" ] && ! _validate_buffer; then
     echo "Share blocked: the local buffer contains an invalid or content-bearing event." >&2
     return 2
   fi
-
-  local count=0 size=0 dataset_sha256=""
-  if [ -s "$BUFFER_FILE" ]; then
-    count=$(grep -c '^{' "$BUFFER_FILE" 2>/dev/null || true)
-    size=$(wc -c < "$BUFFER_FILE" 2>/dev/null | tr -d ' ')
-    dataset_sha256=$(_sha256_file "$BUFFER_FILE")
-  else
-    local empty_file="$BUFFER_DIR/telemetry.empty.$$"
-    mkdir -p "$BUFFER_DIR"
-    : > "$empty_file"
-    dataset_sha256=$(_sha256_file "$empty_file")
-    rm -f "$empty_file"
+  if [ -n "$confirmation" ] && ! _validate_buffer "$SHARE_STAGED_FILE"; then
+    echo "Share blocked: the staged dataset contains an invalid or content-bearing event." >&2
+    return 2
   fi
 
+  local count=0 size=0 dataset_sha256=""
   if [ -z "$confirmation" ]; then
-    local fields="none"
+    mkdir -p "$BUFFER_DIR"
     if [ -s "$BUFFER_FILE" ]; then
+      cp "$BUFFER_FILE" "$SHARE_STAGED_FILE"
+    else
+      : > "$SHARE_STAGED_FILE"
+    fi
+    chmod 600 "$SHARE_STAGED_FILE"
+    count=$(grep -c '^{' "$SHARE_STAGED_FILE" 2>/dev/null || true)
+    size=$(wc -c < "$SHARE_STAGED_FILE" 2>/dev/null | tr -d ' ')
+    dataset_sha256=$(_sha256_file "$SHARE_STAGED_FILE")
+    local fields="none"
+    if [ -s "$SHARE_STAGED_FILE" ]; then
       fields=$(jq -rs '
         [.[].metrics // .[].data // {} | keys[]] | unique |
         if length == 0 then "none" else map("metrics." + .) | join(", ") end
-      ' "$BUFFER_FILE" 2>/dev/null || echo "unable to inspect")
+      ' "$SHARE_STAGED_FILE" 2>/dev/null || echo "unable to inspect")
     fi
     local token token_sha256 expires_at
     token=$(_random_token)
@@ -600,10 +609,14 @@ cmd_share() {
     return 0
   fi
 
-  if [ ! -f "$SHARE_CONSENT_FILE" ]; then
+  if [ ! -f "$SHARE_CONSENT_FILE" ] || [ ! -f "$SHARE_STAGED_FILE" ]; then
     echo "Share blocked: run share without --confirm to inspect and prepare this dataset first." >&2
     return 2
   fi
+  # The staged snapshot is the disclosed dataset: exactly what the proposal
+  # named is what ships, and later buffer growth cannot invalidate it.
+  count=$(grep -c '^{' "$SHARE_STAGED_FILE" 2>/dev/null || true)
+  dataset_sha256=$(_sha256_file "$SHARE_STAGED_FILE")
   local expected_target expected_dataset expected_token expires_at actual_token
   expected_target=$(jq -r '.target // empty' "$SHARE_CONSENT_FILE")
   expected_dataset=$(jq -r '.dataset_sha256 // empty' "$SHARE_CONSENT_FILE")
@@ -611,7 +624,7 @@ cmd_share() {
   expires_at=$(jq -r '.expires_at // 0' "$SHARE_CONSENT_FILE")
   actual_token=$(_sha256_text "$confirmation")
   if [ "$(date +%s)" -gt "$expires_at" ] 2>/dev/null; then
-    rm -f "$SHARE_CONSENT_FILE"
+    rm -f "$SHARE_CONSENT_FILE" "$SHARE_STAGED_FILE"
     echo "Share blocked: confirmation expired; prepare a new share." >&2
     return 2
   fi
@@ -621,7 +634,7 @@ cmd_share() {
   fi
 
   local share_file="$BUFFER_DIR/telemetry.share.$$"
-  if [ -s "$BUFFER_FILE" ]; then
+  if [ -s "$SHARE_STAGED_FILE" ]; then
     jq -c --arg schema "$SCHEMA_VERSION" '
       if .schema_version == $schema then
         {ts:.occurred_at,type:.event_type,sid:.session_id,org:.org_id,user:.actor_id,
@@ -629,7 +642,7 @@ cmd_share() {
            artifact_ids:.artifact_ids,task_id:.task_id,org_revision:.org_revision,
            index_spec_version:.index_spec_version,shared:true})}
       else . end
-    ' "$BUFFER_FILE" > "$share_file"
+    ' "$SHARE_STAGED_FILE" > "$share_file"
   else
     : > "$share_file"
   fi
@@ -646,7 +659,7 @@ cmd_share() {
   http_code=$(curl "${curl_args[@]}" 2>/dev/null || echo "000")
   rm -f "$share_file"
   if [ "$http_code" -ge 200 ] 2>/dev/null && [ "$http_code" -lt 300 ] 2>/dev/null; then
-    rm -f "$SHARE_CONSENT_FILE"
+    rm -f "$SHARE_CONSENT_FILE" "$SHARE_STAGED_FILE"
     echo "Shared $count telemetry events with $endpoint. Local events were retained."
   else
     echo "Share failed (HTTP $http_code). Nothing was removed locally." >&2

package/runtime/codex/bin/search.sh

@@ -235,6 +235,21 @@ cmd_query() {
     } >&2
     return "$query_rc"
   fi
+  # Content-free query telemetry: mode, duration, result count. Never the
+  # query text. This is what makes Runtime/QMD retrieval visible in the
+  # telemetry event list instead of only legacy graph_query rows.
+  local _tele_count _tele_ms
+  _tele_ms=$(( ($(date +%s) - t0) * 1000 ))
+  _tele_count=$(printf '%s' "$out" | jq 'if type == "array" then length elif type == "object" then (.results // [] | length) else empty end' 2>/dev/null || true)
+  if [[ "$_tele_count" =~ ^[0-9]+$ ]]; then
+    bash "$SCRIPT_DIR/bin/telemetry.sh" emit "query" \
+      "$(jq -n --arg mode "$label" --argjson d "$_tele_ms" --argjson c "$_tele_count" \
+        '{mode:$mode, duration_ms:$d, count:$c}')" 2>/dev/null &
+  else
+    bash "$SCRIPT_DIR/bin/telemetry.sh" emit "query" \
+      "$(jq -n --arg mode "$label" --argjson d "$_tele_ms" '{mode:$mode, duration_ms:$d}')" 2>/dev/null &
+  fi
+
   [ "$enrich" = 1 ] && emit="_enrich"
   if [ "$context_packet" = 1 ]; then
     local packet

package/runtime/codex/bin/settings.sh

@@ -146,7 +146,7 @@ cmd_workflow() {
           || _die "cannot switch workflow: origin/main does not exist or could not be reached" 1
         _save '.base_branch = "main"'
       fi
-      echo "Git workflow: SIMPLE — pull requests now target main"
+      echo "Git workflow: SIMPLE — pull requests now target main · /save shares it with the org"
       ;;
     staged)
       if [ "$base" != "develop" ]; then
@@ -160,7 +160,7 @@ cmd_workflow() {
       elif ! jq -e 'has("base_branch")' "$CONFIG" >/dev/null 2>&1; then
         _save '.base_branch = "develop"'
       fi
-      echo "Git workflow: STAGED — pull requests now target develop; releases promote to main"
+      echo "Git workflow: STAGED — pull requests now target develop; releases promote to main · /save shares it with the org"
       ;;
     *) _die "usage: settings.sh workflow status|simple|staged" 1 ;;
   esac
@@ -468,7 +468,7 @@ cmd_posture() {
       if [ "$action" != "$current" ]; then
         _save '.boundary = ((.boundary // {}) + {posture: $p})' --arg p "$action"
       fi
-      echo "Boundary posture: $action"
+      echo "Boundary posture: $action · applies to new sessions · /save shares it with the org"
       ;;
     *) _die "usage: settings.sh posture status|strict|standard|open" 1 ;;
   esac

package/runtime/codex/bin/telemetry.sh

@@ -27,6 +27,10 @@ fi
 BUFFER_FILE="$BUFFER_DIR/telemetry.jsonl"
 LOCK_DIR="$BUFFER_DIR/telemetry.lock"
 SHARE_CONSENT_FILE="$BUFFER_DIR/telemetry-share-consent.json"
+# Exact dataset pinned at proposal time. The confirm step sends this snapshot,
+# so events emitted between proposal and confirm (attendant, other sessions)
+# can never invalidate — or silently join — a disclosed share.
+SHARE_STAGED_FILE="$BUFFER_DIR/telemetry.share-staged.jsonl"
 STATE_FILE="${EGREGORE_STATE_FILE:-$SCRIPT_DIR/.egregore-state.json}"
 CONFIG="${EGREGORE_CONFIG_FILE:-$SCRIPT_DIR/egregore.json}"
 ENV_FILE="${EGREGORE_ENV_FILE:-$SCRIPT_DIR/.env}"
@@ -230,7 +234,8 @@ _validate_metrics() {
 }
 
 _validate_buffer() {
-  [ -s "$BUFFER_FILE" ] || return 0
+  local target="${1:-$BUFFER_FILE}"
+  [ -s "$target" ] || return 0
   jq -e --arg schema "$SCHEMA_VERSION" --argjson allowed "$ALLOWED_METRICS_JSON" '
     def safe_id:
       type == "string" and length > 0 and length <= 256 and
@@ -264,7 +269,7 @@ _validate_buffer() {
       (.data | safe_metrics) and (.ts | type == "string") and
       (.type | safe_id) and (.sid | safe_id) and (.org | safe_id) and (.user | safe_id)
     end
-  ' "$BUFFER_FILE" >/dev/null 2>&1
+  ' "$target" >/dev/null 2>&1
 }
 
 cmd_emit() {
@@ -422,7 +427,7 @@ cmd_clear() {
     echo "Could not acquire the telemetry lock; nothing was cleared." >&2
     return 1
   fi
-  rm -f "$BUFFER_FILE" "$SHARE_CONSENT_FILE"
+  rm -f "$BUFFER_FILE" "$SHARE_CONSENT_FILE" "$SHARE_STAGED_FILE"
   _unlock
   echo "Local telemetry buffer cleared."
 }
@@ -525,31 +530,35 @@ cmd_share() {
     https://*|http://127.0.0.1*|http://localhost*|http://\[::1\]*) ;;
     *) echo "Share endpoint must use https (or loopback http)." >&2; return 2 ;;
   esac
-  if ! _validate_buffer; then
+  # Proposal validates the live buffer it is about to stage; confirm validates
+  # the staged snapshot it is about to send — never the moving buffer.
+  if [ -z "$confirmation" ] && ! _validate_buffer; then
     echo "Share blocked: the local buffer contains an invalid or content-bearing event." >&2
     return 2
   fi
-
-  local count=0 size=0 dataset_sha256=""
-  if [ -s "$BUFFER_FILE" ]; then
-    count=$(grep -c '^{' "$BUFFER_FILE" 2>/dev/null || true)
-    size=$(wc -c < "$BUFFER_FILE" 2>/dev/null | tr -d ' ')
-    dataset_sha256=$(_sha256_file "$BUFFER_FILE")
-  else
-    local empty_file="$BUFFER_DIR/telemetry.empty.$$"
-    mkdir -p "$BUFFER_DIR"
-    : > "$empty_file"
-    dataset_sha256=$(_sha256_file "$empty_file")
-    rm -f "$empty_file"
+  if [ -n "$confirmation" ] && ! _validate_buffer "$SHARE_STAGED_FILE"; then
+    echo "Share blocked: the staged dataset contains an invalid or content-bearing event." >&2
+    return 2
   fi
 
+  local count=0 size=0 dataset_sha256=""
   if [ -z "$confirmation" ]; then
-    local fields="none"
+    mkdir -p "$BUFFER_DIR"
     if [ -s "$BUFFER_FILE" ]; then
+      cp "$BUFFER_FILE" "$SHARE_STAGED_FILE"
+    else
+      : > "$SHARE_STAGED_FILE"
+    fi
+    chmod 600 "$SHARE_STAGED_FILE"
+    count=$(grep -c '^{' "$SHARE_STAGED_FILE" 2>/dev/null || true)
+    size=$(wc -c < "$SHARE_STAGED_FILE" 2>/dev/null | tr -d ' ')
+    dataset_sha256=$(_sha256_file "$SHARE_STAGED_FILE")
+    local fields="none"
+    if [ -s "$SHARE_STAGED_FILE" ]; then
       fields=$(jq -rs '
         [.[].metrics // .[].data // {} | keys[]] | unique |
         if length == 0 then "none" else map("metrics." + .) | join(", ") end
-      ' "$BUFFER_FILE" 2>/dev/null || echo "unable to inspect")
+      ' "$SHARE_STAGED_FILE" 2>/dev/null || echo "unable to inspect")
     fi
     local token token_sha256 expires_at
     token=$(_random_token)
@@ -600,10 +609,14 @@ cmd_share() {
     return 0
   fi
 
-  if [ ! -f "$SHARE_CONSENT_FILE" ]; then
+  if [ ! -f "$SHARE_CONSENT_FILE" ] || [ ! -f "$SHARE_STAGED_FILE" ]; then
     echo "Share blocked: run share without --confirm to inspect and prepare this dataset first." >&2
     return 2
   fi
+  # The staged snapshot is the disclosed dataset: exactly what the proposal
+  # named is what ships, and later buffer growth cannot invalidate it.
+  count=$(grep -c '^{' "$SHARE_STAGED_FILE" 2>/dev/null || true)
+  dataset_sha256=$(_sha256_file "$SHARE_STAGED_FILE")
   local expected_target expected_dataset expected_token expires_at actual_token
   expected_target=$(jq -r '.target // empty' "$SHARE_CONSENT_FILE")
   expected_dataset=$(jq -r '.dataset_sha256 // empty' "$SHARE_CONSENT_FILE")
@@ -611,7 +624,7 @@ cmd_share() {
   expires_at=$(jq -r '.expires_at // 0' "$SHARE_CONSENT_FILE")
   actual_token=$(_sha256_text "$confirmation")
   if [ "$(date +%s)" -gt "$expires_at" ] 2>/dev/null; then
-    rm -f "$SHARE_CONSENT_FILE"
+    rm -f "$SHARE_CONSENT_FILE" "$SHARE_STAGED_FILE"
     echo "Share blocked: confirmation expired; prepare a new share." >&2
     return 2
   fi
@@ -621,7 +634,7 @@ cmd_share() {
   fi
 
   local share_file="$BUFFER_DIR/telemetry.share.$$"
-  if [ -s "$BUFFER_FILE" ]; then
+  if [ -s "$SHARE_STAGED_FILE" ]; then
     jq -c --arg schema "$SCHEMA_VERSION" '
       if .schema_version == $schema then
         {ts:.occurred_at,type:.event_type,sid:.session_id,org:.org_id,user:.actor_id,
@@ -629,7 +642,7 @@ cmd_share() {
            artifact_ids:.artifact_ids,task_id:.task_id,org_revision:.org_revision,
            index_spec_version:.index_spec_version,shared:true})}
       else . end
-    ' "$BUFFER_FILE" > "$share_file"
+    ' "$SHARE_STAGED_FILE" > "$share_file"
   else
     : > "$share_file"
   fi
@@ -646,7 +659,7 @@ cmd_share() {
   http_code=$(curl "${curl_args[@]}" 2>/dev/null || echo "000")
   rm -f "$share_file"
   if [ "$http_code" -ge 200 ] 2>/dev/null && [ "$http_code" -lt 300 ] 2>/dev/null; then
-    rm -f "$SHARE_CONSENT_FILE"
+    rm -f "$SHARE_CONSENT_FILE" "$SHARE_STAGED_FILE"
     echo "Shared $count telemetry events with $endpoint. Local events were retained."
   else
     echo "Share failed (HTTP $http_code). Nothing was removed locally." >&2

package/runtime/pi/bin/search.sh

@@ -235,6 +235,21 @@ cmd_query() {
     } >&2
     return "$query_rc"
   fi
+  # Content-free query telemetry: mode, duration, result count. Never the
+  # query text. This is what makes Runtime/QMD retrieval visible in the
+  # telemetry event list instead of only legacy graph_query rows.
+  local _tele_count _tele_ms
+  _tele_ms=$(( ($(date +%s) - t0) * 1000 ))
+  _tele_count=$(printf '%s' "$out" | jq 'if type == "array" then length elif type == "object" then (.results // [] | length) else empty end' 2>/dev/null || true)
+  if [[ "$_tele_count" =~ ^[0-9]+$ ]]; then
+    bash "$SCRIPT_DIR/bin/telemetry.sh" emit "query" \
+      "$(jq -n --arg mode "$label" --argjson d "$_tele_ms" --argjson c "$_tele_count" \
+        '{mode:$mode, duration_ms:$d, count:$c}')" 2>/dev/null &
+  else
+    bash "$SCRIPT_DIR/bin/telemetry.sh" emit "query" \
+      "$(jq -n --arg mode "$label" --argjson d "$_tele_ms" '{mode:$mode, duration_ms:$d}')" 2>/dev/null &
+  fi
+
   [ "$enrich" = 1 ] && emit="_enrich"
   if [ "$context_packet" = 1 ]; then
     local packet

package/runtime/pi/bin/settings.sh

@@ -146,7 +146,7 @@ cmd_workflow() {
           || _die "cannot switch workflow: origin/main does not exist or could not be reached" 1
         _save '.base_branch = "main"'
       fi
-      echo "Git workflow: SIMPLE — pull requests now target main"
+      echo "Git workflow: SIMPLE — pull requests now target main · /save shares it with the org"
       ;;
     staged)
       if [ "$base" != "develop" ]; then
@@ -160,7 +160,7 @@ cmd_workflow() {
       elif ! jq -e 'has("base_branch")' "$CONFIG" >/dev/null 2>&1; then
         _save '.base_branch = "develop"'
       fi
-      echo "Git workflow: STAGED — pull requests now target develop; releases promote to main"
+      echo "Git workflow: STAGED — pull requests now target develop; releases promote to main · /save shares it with the org"
       ;;
     *) _die "usage: settings.sh workflow status|simple|staged" 1 ;;
   esac
@@ -468,7 +468,7 @@ cmd_posture() {
       if [ "$action" != "$current" ]; then
         _save '.boundary = ((.boundary // {}) + {posture: $p})' --arg p "$action"
       fi
-      echo "Boundary posture: $action"
+      echo "Boundary posture: $action · applies to new sessions · /save shares it with the org"
       ;;
     *) _die "usage: settings.sh posture status|strict|standard|open" 1 ;;
   esac

package/runtime/pi/bin/telemetry.sh

@@ -27,6 +27,10 @@ fi
 BUFFER_FILE="$BUFFER_DIR/telemetry.jsonl"
 LOCK_DIR="$BUFFER_DIR/telemetry.lock"
 SHARE_CONSENT_FILE="$BUFFER_DIR/telemetry-share-consent.json"
+# Exact dataset pinned at proposal time. The confirm step sends this snapshot,
+# so events emitted between proposal and confirm (attendant, other sessions)
+# can never invalidate — or silently join — a disclosed share.
+SHARE_STAGED_FILE="$BUFFER_DIR/telemetry.share-staged.jsonl"
 STATE_FILE="${EGREGORE_STATE_FILE:-$SCRIPT_DIR/.egregore-state.json}"
 CONFIG="${EGREGORE_CONFIG_FILE:-$SCRIPT_DIR/egregore.json}"
 ENV_FILE="${EGREGORE_ENV_FILE:-$SCRIPT_DIR/.env}"
@@ -230,7 +234,8 @@ _validate_metrics() {
 }
 
 _validate_buffer() {
-  [ -s "$BUFFER_FILE" ] || return 0
+  local target="${1:-$BUFFER_FILE}"
+  [ -s "$target" ] || return 0
   jq -e --arg schema "$SCHEMA_VERSION" --argjson allowed "$ALLOWED_METRICS_JSON" '
     def safe_id:
       type == "string" and length > 0 and length <= 256 and
@@ -264,7 +269,7 @@ _validate_buffer() {
       (.data | safe_metrics) and (.ts | type == "string") and
       (.type | safe_id) and (.sid | safe_id) and (.org | safe_id) and (.user | safe_id)
     end
-  ' "$BUFFER_FILE" >/dev/null 2>&1
+  ' "$target" >/dev/null 2>&1
 }
 
 cmd_emit() {
@@ -422,7 +427,7 @@ cmd_clear() {
     echo "Could not acquire the telemetry lock; nothing was cleared." >&2
     return 1
   fi
-  rm -f "$BUFFER_FILE" "$SHARE_CONSENT_FILE"
+  rm -f "$BUFFER_FILE" "$SHARE_CONSENT_FILE" "$SHARE_STAGED_FILE"
   _unlock
   echo "Local telemetry buffer cleared."
 }
@@ -525,31 +530,35 @@ cmd_share() {
     https://*|http://127.0.0.1*|http://localhost*|http://\[::1\]*) ;;
     *) echo "Share endpoint must use https (or loopback http)." >&2; return 2 ;;
   esac
-  if ! _validate_buffer; then
+  # Proposal validates the live buffer it is about to stage; confirm validates
+  # the staged snapshot it is about to send — never the moving buffer.
+  if [ -z "$confirmation" ] && ! _validate_buffer; then
     echo "Share blocked: the local buffer contains an invalid or content-bearing event." >&2
     return 2
   fi
-
-  local count=0 size=0 dataset_sha256=""
-  if [ -s "$BUFFER_FILE" ]; then
-    count=$(grep -c '^{' "$BUFFER_FILE" 2>/dev/null || true)
-    size=$(wc -c < "$BUFFER_FILE" 2>/dev/null | tr -d ' ')
-    dataset_sha256=$(_sha256_file "$BUFFER_FILE")
-  else
-    local empty_file="$BUFFER_DIR/telemetry.empty.$$"
-    mkdir -p "$BUFFER_DIR"
-    : > "$empty_file"
-    dataset_sha256=$(_sha256_file "$empty_file")
-    rm -f "$empty_file"
+  if [ -n "$confirmation" ] && ! _validate_buffer "$SHARE_STAGED_FILE"; then
+    echo "Share blocked: the staged dataset contains an invalid or content-bearing event." >&2
+    return 2
   fi
 
+  local count=0 size=0 dataset_sha256=""
   if [ -z "$confirmation" ]; then
-    local fields="none"
+    mkdir -p "$BUFFER_DIR"
     if [ -s "$BUFFER_FILE" ]; then
+      cp "$BUFFER_FILE" "$SHARE_STAGED_FILE"
+    else
+      : > "$SHARE_STAGED_FILE"
+    fi
+    chmod 600 "$SHARE_STAGED_FILE"
+    count=$(grep -c '^{' "$SHARE_STAGED_FILE" 2>/dev/null || true)
+    size=$(wc -c < "$SHARE_STAGED_FILE" 2>/dev/null | tr -d ' ')
+    dataset_sha256=$(_sha256_file "$SHARE_STAGED_FILE")
+    local fields="none"
+    if [ -s "$SHARE_STAGED_FILE" ]; then
       fields=$(jq -rs '
         [.[].metrics // .[].data // {} | keys[]] | unique |
         if length == 0 then "none" else map("metrics." + .) | join(", ") end
-      ' "$BUFFER_FILE" 2>/dev/null || echo "unable to inspect")
+      ' "$SHARE_STAGED_FILE" 2>/dev/null || echo "unable to inspect")
     fi
     local token token_sha256 expires_at
     token=$(_random_token)
@@ -600,10 +609,14 @@ cmd_share() {
     return 0
   fi
 
-  if [ ! -f "$SHARE_CONSENT_FILE" ]; then
+  if [ ! -f "$SHARE_CONSENT_FILE" ] || [ ! -f "$SHARE_STAGED_FILE" ]; then
     echo "Share blocked: run share without --confirm to inspect and prepare this dataset first." >&2
     return 2
   fi
+  # The staged snapshot is the disclosed dataset: exactly what the proposal
+  # named is what ships, and later buffer growth cannot invalidate it.
+  count=$(grep -c '^{' "$SHARE_STAGED_FILE" 2>/dev/null || true)
+  dataset_sha256=$(_sha256_file "$SHARE_STAGED_FILE")
   local expected_target expected_dataset expected_token expires_at actual_token
   expected_target=$(jq -r '.target // empty' "$SHARE_CONSENT_FILE")
   expected_dataset=$(jq -r '.dataset_sha256 // empty' "$SHARE_CONSENT_FILE")
@@ -611,7 +624,7 @@ cmd_share() {
   expires_at=$(jq -r '.expires_at // 0' "$SHARE_CONSENT_FILE")
   actual_token=$(_sha256_text "$confirmation")
   if [ "$(date +%s)" -gt "$expires_at" ] 2>/dev/null; then
-    rm -f "$SHARE_CONSENT_FILE"
+    rm -f "$SHARE_CONSENT_FILE" "$SHARE_STAGED_FILE"
     echo "Share blocked: confirmation expired; prepare a new share." >&2
     return 2
   fi
@@ -621,7 +634,7 @@ cmd_share() {
   fi
 
   local share_file="$BUFFER_DIR/telemetry.share.$$"
-  if [ -s "$BUFFER_FILE" ]; then
+  if [ -s "$SHARE_STAGED_FILE" ]; then
     jq -c --arg schema "$SCHEMA_VERSION" '
       if .schema_version == $schema then
         {ts:.occurred_at,type:.event_type,sid:.session_id,org:.org_id,user:.actor_id,
@@ -629,7 +642,7 @@ cmd_share() {
            artifact_ids:.artifact_ids,task_id:.task_id,org_revision:.org_revision,
            index_spec_version:.index_spec_version,shared:true})}
       else . end
-    ' "$BUFFER_FILE" > "$share_file"
+    ' "$SHARE_STAGED_FILE" > "$share_file"
   else
     : > "$share_file"
   fi
@@ -646,7 +659,7 @@ cmd_share() {
   http_code=$(curl "${curl_args[@]}" 2>/dev/null || echo "000")
   rm -f "$share_file"
   if [ "$http_code" -ge 200 ] 2>/dev/null && [ "$http_code" -lt 300 ] 2>/dev/null; then
-    rm -f "$SHARE_CONSENT_FILE"
+    rm -f "$SHARE_CONSENT_FILE" "$SHARE_STAGED_FILE"
     echo "Shared $count telemetry events with $endpoint. Local events were retained."
   else
     echo "Share failed (HTTP $http_code). Nothing was removed locally." >&2

package/runtime/prime/bin/search.sh

@@ -235,6 +235,21 @@ cmd_query() {
     } >&2
     return "$query_rc"
   fi
+  # Content-free query telemetry: mode, duration, result count. Never the
+  # query text. This is what makes Runtime/QMD retrieval visible in the
+  # telemetry event list instead of only legacy graph_query rows.
+  local _tele_count _tele_ms
+  _tele_ms=$(( ($(date +%s) - t0) * 1000 ))
+  _tele_count=$(printf '%s' "$out" | jq 'if type == "array" then length elif type == "object" then (.results // [] | length) else empty end' 2>/dev/null || true)
+  if [[ "$_tele_count" =~ ^[0-9]+$ ]]; then
+    bash "$SCRIPT_DIR/bin/telemetry.sh" emit "query" \
+      "$(jq -n --arg mode "$label" --argjson d "$_tele_ms" --argjson c "$_tele_count" \
+        '{mode:$mode, duration_ms:$d, count:$c}')" 2>/dev/null &
+  else
+    bash "$SCRIPT_DIR/bin/telemetry.sh" emit "query" \
+      "$(jq -n --arg mode "$label" --argjson d "$_tele_ms" '{mode:$mode, duration_ms:$d}')" 2>/dev/null &
+  fi
+
   [ "$enrich" = 1 ] && emit="_enrich"
   if [ "$context_packet" = 1 ]; then
     local packet

package/runtime/prime/bin/settings.sh

@@ -146,7 +146,7 @@ cmd_workflow() {
           || _die "cannot switch workflow: origin/main does not exist or could not be reached" 1
         _save '.base_branch = "main"'
       fi
-      echo "Git workflow: SIMPLE — pull requests now target main"
+      echo "Git workflow: SIMPLE — pull requests now target main · /save shares it with the org"
       ;;
     staged)
       if [ "$base" != "develop" ]; then
@@ -160,7 +160,7 @@ cmd_workflow() {
       elif ! jq -e 'has("base_branch")' "$CONFIG" >/dev/null 2>&1; then
         _save '.base_branch = "develop"'
       fi
-      echo "Git workflow: STAGED — pull requests now target develop; releases promote to main"
+      echo "Git workflow: STAGED — pull requests now target develop; releases promote to main · /save shares it with the org"
       ;;
     *) _die "usage: settings.sh workflow status|simple|staged" 1 ;;
   esac
@@ -468,7 +468,7 @@ cmd_posture() {
       if [ "$action" != "$current" ]; then
         _save '.boundary = ((.boundary // {}) + {posture: $p})' --arg p "$action"
       fi
-      echo "Boundary posture: $action"
+      echo "Boundary posture: $action · applies to new sessions · /save shares it with the org"
       ;;
     *) _die "usage: settings.sh posture status|strict|standard|open" 1 ;;
   esac

package/runtime/prime/bin/telemetry.sh

@@ -27,6 +27,10 @@ fi
 BUFFER_FILE="$BUFFER_DIR/telemetry.jsonl"
 LOCK_DIR="$BUFFER_DIR/telemetry.lock"
 SHARE_CONSENT_FILE="$BUFFER_DIR/telemetry-share-consent.json"
+# Exact dataset pinned at proposal time. The confirm step sends this snapshot,
+# so events emitted between proposal and confirm (attendant, other sessions)
+# can never invalidate — or silently join — a disclosed share.
+SHARE_STAGED_FILE="$BUFFER_DIR/telemetry.share-staged.jsonl"
 STATE_FILE="${EGREGORE_STATE_FILE:-$SCRIPT_DIR/.egregore-state.json}"
 CONFIG="${EGREGORE_CONFIG_FILE:-$SCRIPT_DIR/egregore.json}"
 ENV_FILE="${EGREGORE_ENV_FILE:-$SCRIPT_DIR/.env}"
@@ -230,7 +234,8 @@ _validate_metrics() {
 }
 
 _validate_buffer() {
-  [ -s "$BUFFER_FILE" ] || return 0
+  local target="${1:-$BUFFER_FILE}"
+  [ -s "$target" ] || return 0
   jq -e --arg schema "$SCHEMA_VERSION" --argjson allowed "$ALLOWED_METRICS_JSON" '
     def safe_id:
       type == "string" and length > 0 and length <= 256 and
@@ -264,7 +269,7 @@ _validate_buffer() {
       (.data | safe_metrics) and (.ts | type == "string") and
       (.type | safe_id) and (.sid | safe_id) and (.org | safe_id) and (.user | safe_id)
     end
-  ' "$BUFFER_FILE" >/dev/null 2>&1
+  ' "$target" >/dev/null 2>&1
 }
 
 cmd_emit() {
@@ -422,7 +427,7 @@ cmd_clear() {
     echo "Could not acquire the telemetry lock; nothing was cleared." >&2
     return 1
   fi
-  rm -f "$BUFFER_FILE" "$SHARE_CONSENT_FILE"
+  rm -f "$BUFFER_FILE" "$SHARE_CONSENT_FILE" "$SHARE_STAGED_FILE"
   _unlock
   echo "Local telemetry buffer cleared."
 }
@@ -525,31 +530,35 @@ cmd_share() {
     https://*|http://127.0.0.1*|http://localhost*|http://\[::1\]*) ;;
     *) echo "Share endpoint must use https (or loopback http)." >&2; return 2 ;;
   esac
-  if ! _validate_buffer; then
+  # Proposal validates the live buffer it is about to stage; confirm validates
+  # the staged snapshot it is about to send — never the moving buffer.
+  if [ -z "$confirmation" ] && ! _validate_buffer; then
     echo "Share blocked: the local buffer contains an invalid or content-bearing event." >&2
     return 2
   fi
-
-  local count=0 size=0 dataset_sha256=""
-  if [ -s "$BUFFER_FILE" ]; then
-    count=$(grep -c '^{' "$BUFFER_FILE" 2>/dev/null || true)
-    size=$(wc -c < "$BUFFER_FILE" 2>/dev/null | tr -d ' ')
-    dataset_sha256=$(_sha256_file "$BUFFER_FILE")
-  else
-    local empty_file="$BUFFER_DIR/telemetry.empty.$$"
-    mkdir -p "$BUFFER_DIR"
-    : > "$empty_file"
-    dataset_sha256=$(_sha256_file "$empty_file")
-    rm -f "$empty_file"
+  if [ -n "$confirmation" ] && ! _validate_buffer "$SHARE_STAGED_FILE"; then
+    echo "Share blocked: the staged dataset contains an invalid or content-bearing event." >&2
+    return 2
   fi
 
+  local count=0 size=0 dataset_sha256=""
   if [ -z "$confirmation" ]; then
-    local fields="none"
+    mkdir -p "$BUFFER_DIR"
     if [ -s "$BUFFER_FILE" ]; then
+      cp "$BUFFER_FILE" "$SHARE_STAGED_FILE"
+    else
+      : > "$SHARE_STAGED_FILE"
+    fi
+    chmod 600 "$SHARE_STAGED_FILE"
+    count=$(grep -c '^{' "$SHARE_STAGED_FILE" 2>/dev/null || true)
+    size=$(wc -c < "$SHARE_STAGED_FILE" 2>/dev/null | tr -d ' ')
+    dataset_sha256=$(_sha256_file "$SHARE_STAGED_FILE")
+    local fields="none"
+    if [ -s "$SHARE_STAGED_FILE" ]; then
       fields=$(jq -rs '
         [.[].metrics // .[].data // {} | keys[]] | unique |
         if length == 0 then "none" else map("metrics." + .) | join(", ") end
-      ' "$BUFFER_FILE" 2>/dev/null || echo "unable to inspect")
+      ' "$SHARE_STAGED_FILE" 2>/dev/null || echo "unable to inspect")
     fi
     local token token_sha256 expires_at
     token=$(_random_token)
@@ -600,10 +609,14 @@ cmd_share() {
     return 0
   fi
 
-  if [ ! -f "$SHARE_CONSENT_FILE" ]; then
+  if [ ! -f "$SHARE_CONSENT_FILE" ] || [ ! -f "$SHARE_STAGED_FILE" ]; then
     echo "Share blocked: run share without --confirm to inspect and prepare this dataset first." >&2
     return 2
   fi
+  # The staged snapshot is the disclosed dataset: exactly what the proposal
+  # named is what ships, and later buffer growth cannot invalidate it.
+  count=$(grep -c '^{' "$SHARE_STAGED_FILE" 2>/dev/null || true)
+  dataset_sha256=$(_sha256_file "$SHARE_STAGED_FILE")
   local expected_target expected_dataset expected_token expires_at actual_token
   expected_target=$(jq -r '.target // empty' "$SHARE_CONSENT_FILE")
   expected_dataset=$(jq -r '.dataset_sha256 // empty' "$SHARE_CONSENT_FILE")
@@ -611,7 +624,7 @@ cmd_share() {
   expires_at=$(jq -r '.expires_at // 0' "$SHARE_CONSENT_FILE")
   actual_token=$(_sha256_text "$confirmation")
   if [ "$(date +%s)" -gt "$expires_at" ] 2>/dev/null; then
-    rm -f "$SHARE_CONSENT_FILE"
+    rm -f "$SHARE_CONSENT_FILE" "$SHARE_STAGED_FILE"
     echo "Share blocked: confirmation expired; prepare a new share." >&2
     return 2
   fi
@@ -621,7 +634,7 @@ cmd_share() {
   fi
 
   local share_file="$BUFFER_DIR/telemetry.share.$$"
-  if [ -s "$BUFFER_FILE" ]; then
+  if [ -s "$SHARE_STAGED_FILE" ]; then
     jq -c --arg schema "$SCHEMA_VERSION" '
       if .schema_version == $schema then
         {ts:.occurred_at,type:.event_type,sid:.session_id,org:.org_id,user:.actor_id,
@@ -629,7 +642,7 @@ cmd_share() {
            artifact_ids:.artifact_ids,task_id:.task_id,org_revision:.org_revision,
            index_spec_version:.index_spec_version,shared:true})}
       else . end
-    ' "$BUFFER_FILE" > "$share_file"
+    ' "$SHARE_STAGED_FILE" > "$share_file"
   else
     : > "$share_file"
   fi
@@ -646,7 +659,7 @@ cmd_share() {
   http_code=$(curl "${curl_args[@]}" 2>/dev/null || echo "000")
   rm -f "$share_file"
   if [ "$http_code" -ge 200 ] 2>/dev/null && [ "$http_code" -lt 300 ] 2>/dev/null; then
-    rm -f "$SHARE_CONSENT_FILE"
+    rm -f "$SHARE_CONSENT_FILE" "$SHARE_STAGED_FILE"
     echo "Shared $count telemetry events with $endpoint. Local events were retained."
   else
     echo "Share failed (HTTP $http_code). Nothing was removed locally." >&2