create-egregore 0.21.4 → 0.21.6

package/runtime/codex/bin/hosting-ops.sh

@@ -1,248 +1,10 @@
 #!/usr/bin/env bash
+# Retained as an inert compatibility entry point for older installations.
 set -euo pipefail
 set +vx
-umask 077
-unset GIT_DIR GIT_WORK_TREE GIT_INDEX_FILE GIT_OBJECT_DIRECTORY GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR
 
-SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
-CONFIG="${CONFIG:-$SCRIPT_DIR/egregore.json}"
-# shellcheck source=/dev/null
-source "$SCRIPT_DIR/bin/lib/config.sh"
-
-usage() {
-  echo 'Usage: bash bin/hosting-ops.sh status|enable|wait-ready|users <slug>' >&2
-  echo '       bash bin/hosting-ops.sh ssh <slug> [--] <remote command…>' >&2
-  echo '       bash bin/hosting-ops.sh scp <slug> <local file> <remote path>' >&2
-  echo '       bash bin/hosting-ops.sh deploy-template <slug> [--name <version>]' >&2
-  echo '       bash bin/hosting-ops.sh restart-workspace <slug> <workspace id>' >&2
-  echo '       bash bin/hosting-ops.sh user <slug> <github username>' >&2
-  echo '       bash bin/hosting-ops.sh list' >&2
-  exit 2
-}
-
-die() { printf 'hosting-ops: %s\n' "$*" >&2; exit 1; }
-
-[ "$#" -ge 1 ] || usage
-operation="$1"
-shift
-case "$operation" in
-  list) [ "$#" -eq 0 ] || usage ;;
-  status|enable|wait-ready|users) [ "$#" -eq 1 ] || usage ;;
-  user|restart-workspace) [ "$#" -eq 2 ] && [ -n "$2" ] || usage ;;
-  scp) [ "$#" -eq 3 ] && [ -n "$2" ] && [ -n "$3" ] || usage ;;
-  ssh) [ "$#" -ge 2 ] || usage ;;
-  deploy-template)
-    [ "$#" -eq 1 ] || { [ "$#" -eq 3 ] && [ "$2" = --name ] && [ -n "$3" ]; } || usage
-    ;;
-  *) usage ;;
-esac
-slug="${1-}"
-if [ "$operation" != list ]; then
-  # Slugs are URL path/query components, never shell source.
-  case "$slug" in ''|*[!a-zA-Z0-9_-]*) usage ;; esac
-  shift
-fi
-if [ "$operation" = ssh ]; then
-  if [ "${1-}" = -- ]; then shift; fi
-  [ "$#" -ge 1 ] && [ -n "$1" ] || usage
-  # A quoted command is unchanged; separate words use SSH's usual space join.
-  remote_command="$*"
-fi
-if [ "$operation" = restart-workspace ]; then
-  case "$1" in *[!a-zA-Z0-9_-]*) usage ;; esac
-fi
-case "$operation" in
-  ssh|scp|deploy-template|restart-workspace)
-    command -v sshpass >/dev/null 2>&1 || die 'sshpass is required; install via brew install hudochenkov/sshpass/sshpass'
-    ;;
-esac
-
-scratch=$(mktemp -d "${TMPDIR:-/tmp}/hosting-ops.XXXXXX")
-trap 'rm -rf -- "$scratch"' EXIT
-trap 'exit 1' HUP INT TERM
-
-gateway() {
-  bash "$SCRIPT_DIR/bin/api-call.sh" "$@" --auth github || die 'API gateway request failed'
-}
-
-body_error() {
-  jq -er 'if type == "object" then (.error // .detail // (if .status == "error" then "request failed" else empty end)) else empty end | select(. != false and . != "") | if type == "string" then . else tojson end' "$1" 2>/dev/null
-}
-
-check_body() {
-  local detail
-  jq -e 'type == "object"' "$1" >/dev/null 2>&1 || die 'invalid response body'
-  if detail=$(body_error "$1"); then die "$detail"; fi
-}
-
-credentials() {
-  local failure="no hosted VPS or missing credentials for $slug"
-  bash "$SCRIPT_DIR/bin/api-call.sh" GET "/api/hosting/credentials/$slug" --auth github --out "$scratch/credentials.json" 2>/dev/null \
-    || die "$failure"
-  ip=$(jq -r '.ip | select(type == "string")' "$scratch/credentials.json" 2>/dev/null) || die "$failure"
-  vps_password=$(jq -r '.password | select(type == "string")' "$scratch/credentials.json" 2>/dev/null) || die "$failure"
-  [ -n "$ip" ] && [ -n "$vps_password" ] || die "$failure"
-}
-
-vps_ssh() {
-  SSHPASS="$vps_password" sshpass -e ssh -o StrictHostKeyChecking=no "root@$ip" "$@"
-}
-
-vps_scp() {
-  SSHPASS="$vps_password" sshpass -e scp -o StrictHostKeyChecking=no "$1" "root@$ip:$2"
-}
-
-coder_login() {
-  # jq reads the password from stdin, never a --arg value.
-  printf '%s' "$vps_password" | jq -Rs '{email:"admin@egregore.xyz", password:.}' > "$scratch/login.json"
-  vps_ssh "curl -q -sS -H 'Content-Type: application/json' --data-binary @- http://localhost/api/v2/users/login" \
-    < "$scratch/login.json" > "$scratch/login-response.json" 2>/dev/null || die 'Coder login failed'
-  coder_token=$(jq -er '.session_token | select(type == "string" and length > 0)' "$scratch/login-response.json" 2>/dev/null) \
-    || die 'Coder login failed'
-}
-
-curl_config_value() {
-  # Curl config quoting, using builtins so secret values stay off exec argv.
-  local value="$2"
-  value="${value//\\/\\\\}"
-  value="${value//\"/\\\"}"
-  value="${value//$'\n'/\\n}"
-  value="${value//$'\r'/\\r}"
-  value="${value//$'\t'/\\t}"
-  printf '%s = "%s"\n' "$1" "$value"
-}
-
-coder_request() {
-  local code
-  {
-    curl_config_value header "Coder-Session-Token: $coder_token"
-    curl_config_value url "http://localhost/api/v2$2"
-    curl_config_value request "$1"
-    if [ -n "${3-}" ]; then
-      curl_config_value header 'Content-Type: application/json'
-      curl_config_value data "$(cat "$3")"
-    fi
-  } > "$scratch/coder-curl.conf"
-  vps_ssh "curl -q -sS -K - --write-out '\n%{http_code}'" < "$scratch/coder-curl.conf" \
-    > "$scratch/coder-response" 2>/dev/null || die 'Coder request failed'
-  code=$(tail -n 1 "$scratch/coder-response")
-  case "$code" in 2[0-9][0-9]) ;; *) die 'Coder request failed' ;; esac
-  sed '$d' "$scratch/coder-response" > "$scratch/coder.json"
-  jq -e 'type == "object"' "$scratch/coder.json" >/dev/null 2>&1 || die 'Coder request failed'
-  if body_error "$scratch/coder.json" >/dev/null; then die 'Coder request failed'; fi
-}
-
-deploy_template() {
-  local version="$1" api_url
-  vps_ssh 'mkdir -p /tmp/egregore-template' > /dev/null || die 'template directory creation failed'
-  vps_scp "$SCRIPT_DIR/docker/egregore-template/main.tf" /tmp/egregore-template/main.tf > /dev/null || die 'template copy failed'
-  coder_login
-  vps_ssh 'cat /opt/egregore/org-config.json' > "$scratch/org-config.json" || die 'cannot read VPS org config'
-  vps_ssh 'cat /opt/egregore/github-token 2>/dev/null' > "$scratch/github-token" || die 'cannot read VPS GitHub token'
-  api_url=$(bash "$SCRIPT_DIR/bin/config-get.sh" api_url) || die 'cannot read api_url'
-  [ -n "$api_url" ] || die 'api_url is not set'
-  # A JSON object is also a YAML mapping, as accepted by --variables-file.
-  # Do not use secret-valued --var flags: they leak on the remote argv too.
-  jq -e --arg api_url "$api_url" --rawfile github_token "$scratch/github-token" '
-    {egregore_api_key, api_url:$api_url, memory_url, fork_url,
-     ghcr_token:"not-needed", github_token:($github_token | sub("\\n+$"; ""))}
-    | if all(.[]; type == "string") then . else error("missing template variable") end
-  ' "$scratch/org-config.json" > "$scratch/variables.json" 2>/dev/null || die 'VPS template variables are missing or invalid'
-  {
-    printf 'set -euo pipefail\nset +vx\numask 077\nunset CODER_SESSION_TOKEN\nexport CODER_URL=http://localhost\n'
-    # Coder reads its session file; no secret is exported to child processes.
-    printf 'coder_config=$(mktemp -d /tmp/egregore-coder-config.XXXXXX)\n'
-    printf 'trap '\''rm -rf -- "$coder_config"'\'' EXIT\ntrap '\''exit 1'\'' HUP INT TERM\n'
-    printf 'printf "%%s" %q > "$coder_config/session"\n' "$coder_token"
-    printf 'vars_file=$(mktemp /tmp/egregore-template-vars.XXXXXX)\n'
-    printf 'trap '\''rm -f -- "$vars_file"; rm -rf -- "$coder_config"'\'' EXIT\n'
-    # printf is a Bash builtin, so these values never reach an exec argv.
-    printf 'printf "%%s" %q > "$vars_file"\n' "$(cat "$scratch/variables.json")"
-    printf 'coder --global-config "$coder_config" templates push Egregore --directory /tmp/egregore-template --name %q --variables-file "$vars_file" --yes\n' "$version"
-  } > "$scratch/push.sh"
-  vps_ssh bash -s < "$scratch/push.sh" || die 'template push failed'
-  printf 'Template "Egregore" deployed: %s\n' "$version"
-}
-
-restart_workspace() {
-  local workspace_id="$1" template_id active_version attempt stopped=false
-  coder_login
-  coder_request GET "/workspaces/$workspace_id"
-  template_id=$(jq -er '.template_id | select(type == "string" and length > 0)' "$scratch/coder.json") \
-    || die 'workspace has no template_id'
-  printf '%s\n' '{"transition":"stop"}' > "$scratch/build.json"
-  coder_request POST "/workspaces/$workspace_id/builds" "$scratch/build.json"
-  for ((attempt=1; attempt<=24; attempt++)); do
-    sleep 5
-    coder_request GET "/workspaces/$workspace_id"
-    if jq -e '.latest_build.status == "stopped"' "$scratch/coder.json" >/dev/null; then stopped=true; break; fi
-  done
-  [ "$stopped" = true ] || die 'workspace did not stop after 24 checks'
-  coder_request GET "/templates/$template_id"
-  active_version=$(jq -er '.active_version_id | select(type == "string" and length > 0)' "$scratch/coder.json") \
-    || die 'template has no active_version_id'
-  jq -n --arg version "$active_version" '{transition:"start", template_version_id:$version}' > "$scratch/build.json"
-  coder_request POST "/workspaces/$workspace_id/builds" "$scratch/build.json"
-  cat "$scratch/coder.json"
-}
-
-create_users() {
-  local requested="${1-}" username detail response created=0 failed=0
-  gateway GET "/api/admin/org/$slug" > "$scratch/org.json"
-  check_body "$scratch/org.json"
-  jq -er '.members | type == "array"' "$scratch/org.json" >/dev/null || die 'org response has no members'
-  jq -r --arg requested "$requested" '.members[]
-    | select(if $requested == "" then .status == "active" else .github_username == $requested end)
-    | .github_username | select(type == "string" and length > 0)' "$scratch/org.json" > "$scratch/members"
-  while IFS= read -r username; do
-    jq -n --arg name "$username" '{username:$name}' > "$scratch/member.json"
-    detail=''
-    response="$scratch/member-response.json"
-    if ! bash "$SCRIPT_DIR/bin/api-call.sh" POST "/api/hosting/user/$slug" --auth egregore --json-file "$scratch/member.json" \
-        --error-out "$scratch/member-error.json" > "$response" 2>/dev/null; then
-      response="$scratch/member-error.json"
-      detail='API gateway request failed'
-    fi
-    if ! jq -e 'type == "object"' "$response" >/dev/null 2>&1; then
-      detail="${detail:-invalid response body}"
-    else
-      # Only the bounded, operator-facing detail is published, never raw JSON.
-      detail=$(jq -r --arg fallback "$detail" '(.detail | select(. != "")) // $fallback | if type == "string" then . else tojson end | .[:200]' "$response")
-    fi
-    if [ -n "$detail" ]; then
-      printf '✗ %s — error: %s\n' "$username" "$detail"
-      failed=$((failed + 1))
-    else
-      printf '✓ %s — Coder user created (workspace is created on first open)\n' "$username"
-      created=$((created + 1))
-    fi
-  done < "$scratch/members"
-  printf 'Done: %s created, %s failed\n' "$created" "$failed"
-  [ "$failed" -eq 0 ]
-}
-
-case "$operation" in
-  status) gateway GET "/api/hosting/status/$slug" ;;
-  enable) gateway POST "/api/hosting/enable/$slug" ;;
-  list) gateway GET /api/admin/health ;;
-  wait-ready)
-    poll_seconds="${HOSTING_OPS_POLL_SECONDS:-30}"
-    case "$poll_seconds" in ''|*[!0-9]*) usage ;; esac
-    for ((attempt=1; attempt<=10; attempt++)); do
-      # Emit a progress line even when this attempt returns an error body.
-      gateway GET "/api/hosting/status/$slug" > "$scratch/status.json"
-      progress=$(jq -r '"ip: \(.ip // "unknown") — token_stored: \(if has("token_stored") then .token_stored else "unknown" end)"' "$scratch/status.json" 2>/dev/null) || die 'invalid status response'
-      printf 'check %s/10 — %s\n' "$attempt" "$progress"
-      check_body "$scratch/status.json"
-      if jq -e '.coder_ready == true' "$scratch/status.json" >/dev/null; then exit 0; fi
-      if [ "$attempt" -lt 10 ]; then sleep "$poll_seconds"; fi
-    done
-    die 'Coder did not become ready after 10 checks'
-    ;;
-  ssh) credentials; vps_ssh "$remote_command" || die 'SSH command failed' ;;
-  scp) credentials; vps_scp "$1" "$2" || die 'SCP failed' ;;
-  deploy-template) credentials; deploy_template "${2:-$slug-initial}" ;;
-  restart-workspace) credentials; restart_workspace "$1" ;;
-  users) create_users ;;
-  user) create_users "$1" ;;
+printf '%s\n' 'Hosted Coder workspaces have been retired. Use Egregore from your local workspace.' >&2
+case "${1-}" in
+  --help|-h) exit 0 ;;
 esac
+exit 1

package/runtime/codex/bin/lib/framework-update.sh

@@ -33,7 +33,9 @@ _checkout_framework_paths() {
   # A path checkout does not merge, rebase, move HEAD, or consult the user's
   # pull/merge/rebase strategy. Tolerate each missing or failed path separately,
   # preserving the historical overlay behavior while reporting each skip once.
-  for framework_path in bin/ .claude/commands/ .claude/skills/ .claude/hooks/ .claude/context/ .claude/agents/ .pi/ .prime/ loom/ CLAUDE.md skills/; do
+  # The Runtime adapters in bin/ import egregore_runtime/, so the core travels
+  # with them; one without the other leaves recall unable to start.
+  for framework_path in bin/ egregore_runtime/ .claude/commands/ .claude/skills/ .claude/hooks/ .claude/context/ .claude/agents/ .pi/ .prime/ loom/ CLAUDE.md skills/; do
     if ! git -C "$target_dir" checkout upstream/main -- "$framework_path" 2>/dev/null; then
       printf 'update-framework: skipped %s (absent from upstream/main or checkout failed)\n' "$framework_path" >&2
     fi

package/runtime/codex/bin/lib/git-sync.sh

@@ -231,13 +231,13 @@ _apply_framework_update() {
   # committing — an overwrite of local edits is the one outcome the user has
   # to be able to see afterwards, and the commit is the only other record.
   local _changed
-  _changed=$(git status --porcelain bin/ .claude/ .pi/ .prime/ loom/ CLAUDE.md skills/ 2>/dev/null)
+  _changed=$(git status --porcelain bin/ egregore_runtime/ .claude/ .pi/ .prime/ loom/ CLAUDE.md skills/ 2>/dev/null)
   if [ -n "$_changed" ]; then
     FRAMEWORK_UPDATED_COUNT=$(printf '%s\n' "$_changed" | grep -c . || echo 0)
     FRAMEWORK_UPDATED_FILES=$(printf '%s\n' "$_changed" | awk '{print $NF}' | head -3 | tr '\n' ' ')
     git add bin/ .claude/ loom/ CLAUDE.md skills/ 2>/dev/null
     local _runtime_path
-    for _runtime_path in .pi .prime; do
+    for _runtime_path in egregore_runtime .pi .prime; do
       [ ! -e "$_runtime_path" ] || git add -- "$_runtime_path" 2>/dev/null
     done
     EGREGORE_FRAMEWORK_UPDATE=1 git commit -m "chore(sync): update framework from upstream" --quiet 2>/dev/null || true

package/runtime/codex/bin/notify.sh

@@ -32,7 +32,7 @@ SESSION_ID="$(sed -n '1p' "$SCRIPT_DIR/.egregore-session-id" 2>/dev/null || true
 SESSION_ID="${SESSION_ID:-no-session}"
 PROJECT_HASH="$(printf '%s' "$SCRIPT_DIR" | cksum | awk '{print $1}')"
 STATE_DIR="${EGREGORE_NOTIFY_STATE_DIR:-$HOME/.egregore/notifications/$PROJECT_HASH}"
-RELAY_URL="${EGREGORE_NOTIFY_RELAY_URL:-https://egregore-production-55f2.up.railway.app}"
+RELAY_URL="${EGREGORE_NOTIFY_RELAY_URL:-https://api.egregore.xyz}"
 mkdir -p "$STATE_DIR"
 chmod 700 "$STATE_DIR" 2>/dev/null || true
 

package/runtime/codex/bin/post-update.sh

@@ -30,6 +30,19 @@ if [ -d ".claude/skills" ] && [ -d ".claude/commands" ]; then
   fi
 fi
 
+# --- Migration: Runtime core travels with its adapters ---
+# Earlier overlays copied bin/ but not egregore_runtime/, leaving the Runtime
+# adapters without the module they import. The overlay that ran this update
+# was loaded before bin/ changed, so copy the core here: one /update is
+# enough. A Runtime-managed installation owns these files and is left alone.
+if [ ! -e "$SCRIPT_DIR/egregore_runtime" ] && \
+   git -C "$SCRIPT_DIR" cat-file -e 'upstream/main:egregore_runtime' 2>/dev/null && \
+   ! (source "$SCRIPT_DIR/bin/lib/runtime-owned.sh"; runtime_owns_framework); then
+  git -C "$SCRIPT_DIR" checkout upstream/main -- egregore_runtime/
+  echo "  ✓ Added the Runtime core (egregore_runtime/)"
+  MIGRATED=1
+fi
+
 # --- Future migrations go here ---
 # Each migration should:
 # 1. Check if it needs to run (idempotent guard)

package/runtime/codex/bin/publish-artifact.sh

@@ -132,7 +132,7 @@ fi
 
 # Public relay for OSS share endpoint. Unauthenticated: anything posted here is
 # readable by anyone holding the URL, for 7 days, with nothing in front of it.
-RELAY_URL="https://egregore-production-55f2.up.railway.app"
+RELAY_URL="https://api.egregore.xyz"
 
 # --- Artifact hosting off-switch (compliance / privacy) ---
 # An instance can disable ALL egregore.xyz publishing via `bin/settings.sh hosting off`

package/runtime/codex/bin/telemetry.sh

@@ -38,7 +38,6 @@ MAX_BUFFER_BYTES=1048576
 MAX_EVENTS_AFTER_TRUNCATE=500
 SHARE_CONSENT_SECONDS=600
 SCHEMA_VERSION="egregore.telemetry/v1"
-LEGACY_RELAY_URL="https://egregore-production-55f2.up.railway.app/api/telemetry/relay"
 
 ALLOWED_METRICS_JSON='[
   "action","branch","class","command","connector","cost_usd","count",
@@ -516,7 +515,6 @@ cmd_export() {
 
 _resolve_share_target() {
   local requested_endpoint="$1"
-  local allow_legacy_relay="$2"
   if [ -n "$requested_endpoint" ]; then
     printf '%s\n' "$requested_endpoint"
     return
@@ -530,13 +528,11 @@ _resolve_share_target() {
   fi
   if [ -n "$api_url" ] && [ -n "$api_key" ]; then
     printf '%s/api/telemetry/ingest\n' "${api_url%/}"
-  elif [ "$allow_legacy_relay" = "true" ]; then
-    printf '%s\n' "$LEGACY_RELAY_URL"
   fi
 }
 
 cmd_share() {
-  local confirmation="" requested_endpoint="" allow_legacy_relay="false" json_output="false"
+  local confirmation="" requested_endpoint="" json_output="false"
   while [ "$#" -gt 0 ]; do
     case "$1" in
       --confirm)
@@ -548,8 +544,10 @@ cmd_share() {
         shift 2
         ;;
       --legacy-public-relay)
-        allow_legacy_relay="true"
-        shift
+        # The former public relay ran on a retired host; nothing is sent there.
+        echo "The former public relay is retired; nothing was sent." >&2
+        echo "Export locally, or name an explicit --endpoint." >&2
+        return 2
         ;;
       --json)
         json_output="true"
@@ -567,10 +565,9 @@ cmd_share() {
   fi
 
   local endpoint=""
-  endpoint=$(_resolve_share_target "$requested_endpoint" "$allow_legacy_relay")
+  endpoint=$(_resolve_share_target "$requested_endpoint")
   if [ -z "$endpoint" ]; then
     echo "No shared telemetry sink is configured. Export locally, or name an explicit --endpoint." >&2
-    echo "The former public relay remains available only with --legacy-public-relay." >&2
     return 2
   fi
   case "$endpoint" in
@@ -697,7 +694,7 @@ cmd_share() {
   local curl_args=(-s -o /dev/null -w '%{http_code}' -X POST "$endpoint"
     -H "Content-Type: application/x-ndjson" --data-binary "@$share_file" --max-time 15)
   local api_key="" configured_endpoint=""
-  configured_endpoint=$(_resolve_share_target "" "false")
+  configured_endpoint=$(_resolve_share_target "")
   if [ -n "$configured_endpoint" ] && [ "$endpoint" = "$configured_endpoint" ] && [ -f "$ENV_FILE" ]; then
     api_key=$(grep '^EGREGORE_API_KEY=' "$ENV_FILE" 2>/dev/null | cut -d'=' -f2- || true)
   fi

package/runtime/codex/egregore_runtime/contracts.py

@@ -152,6 +152,30 @@ class Entitlements(Serializable):
         return capability in self.capabilities
 
 
+@dataclass(frozen=True, slots=True)
+class ExecutionAuthority(Serializable):
+    """Non-secret attribution for a verified member mandate.
+
+    This records the original verified admission, not the latest authorization
+    decision. It is not a credential or permission. An authenticated resolver
+    must revalidate current authority before each protected operation. Spirit
+    ownership, funding and parent_actor_id confer none of this authority.
+    """
+
+    executor_actor_id: str
+    executor_kind: ActorKind
+    worker_id: str
+    member_account_id: str
+    member_actor_id: str
+    membership_id: str
+    org_id: str
+    grant_id: str
+    binding_id: str
+    audience: str
+    revision: str
+    expires_at: datetime
+
+
 @dataclass(frozen=True, slots=True)
 class ActorContext(Serializable):
     account: AccountIdentity | None
@@ -161,6 +185,13 @@ class ActorContext(Serializable):
     entitlements: Entitlements
     session_id: str
     harness: str
+    execution: ExecutionAuthority | None = None
+
+    def to_dict(self) -> dict[str, Any]:
+        result = Serializable.to_dict(self)
+        if self.execution is None:
+            result.pop("execution")
+        return result
 
 
 @dataclass(frozen=True, slots=True)
@@ -184,6 +215,13 @@ class SourceProvenance(Serializable):
     observed_at: datetime
     source_uri: str | None = None
     imported_by: str | None = None
+    execution: ExecutionAuthority | None = None
+
+    def to_dict(self) -> dict[str, Any]:
+        result = Serializable.to_dict(self)
+        if self.execution is None:
+            result.pop("execution")
+        return result
 
 
 @dataclass(frozen=True, slots=True)