create-egregore 0.21.6 → 0.22.0

package/runtime/pi/bin/session-record.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# Session-record admission is silent and detached for hooks. Python uses only
+# the standard library. Summarizer flags (all checked against claude --help):
+# Private trails, durable holds, stamps and locks live in $HOME/.egregore/trails.
+# --tools "" --strict-mcp-config --mcp-config '{"mcpServers":{}}'
+# --setting-sources "" --model MODEL --output-format text -p PROMPT
+# Built-in tools, MCP servers, project settings, hooks and plugins are disabled,
+# so the call is a single turn without a separate turn-limit flag.
+# A CLI missing any isolation flag (including the empty --tools allowlist)
+# is never invoked for a build; the record is deterministic instead.
+# Checkpoints only write the record file in the memory working tree. Session
+# end commits and pushes it with this person's earlier uncommitted records.
+# --mode sweep always refreshes local counts in a detached worker. Publication
+# requires an answered offer and enabled recording; only publication is
+# debounced for six hours unless --force is supplied.
+# Publications and hold markers use the same canonical memory lock; holds wait
+# for an active publication, then redact going forward without rewriting history.
+# The one thing a hook prints: at a checkpoint, the session's cost line, once
+# per mark ($200 priced, or ten million Codex input tokens) at the next stop.
+# Descriptor 3 carries the hook's stdout past the silenced streams for it.
+set -uo pipefail
+SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)" || exit 0
+command -v jq >/dev/null 2>&1 || exit 0
+command -v python3 >/dev/null 2>&1 || exit 0
+[ -n "${HOME:-}" ] || exit 0
+exec python3 "$SCRIPT_DIR/bin/lib/session_record.py" record --root "$SCRIPT_DIR" --notice-fd 3 "$@" 3>&1 >/dev/null 2>&1

package/runtime/pi/bin/settings.sh

@@ -23,6 +23,8 @@ set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
 CONFIG="$SCRIPT_DIR/egregore.json"
+# shellcheck source=bin/lib/config.sh
+source "$SCRIPT_DIR/bin/lib/config.sh"
 
 # ── helpers ──────────────────────────────────────────────────────────────
 
@@ -54,7 +56,7 @@ _save() {
 # start's settings sync (bin/lib/settings-drift.sh).
 _control_plane_push() {
   local api_url api_key payload actor response revision
-  api_url=$(jq -r '.api_url // empty' "$CONFIG" 2>/dev/null)
+  api_url=$(_config_api_url) || return 0
   [ -n "$api_url" ] || return 0
   api_key=$(grep '^EGREGORE_API_KEY=' "$SCRIPT_DIR/.env" 2>/dev/null | cut -d'=' -f2- || true)
   [ -n "$api_key" ] || return 0
@@ -70,10 +72,13 @@ _control_plane_push() {
     --data-binary "$payload" 2>/dev/null) || return 0
   revision=$(printf '%s' "$response" | jq -r '.settings_revision // empty' 2>/dev/null)
   if [ -n "$revision" ] && [ -f "$SCRIPT_DIR/.egregore-state.json" ]; then
-    local st
-    st="$(mktemp "$SCRIPT_DIR/.egregore-state.json.XXXXXX")" || return 0
-    if jq --arg rev "$revision" '.org_settings_revision = $rev' "$SCRIPT_DIR/.egregore-state.json" > "$st" 2>/dev/null && [ -s "$st" ]; then
-      mv "$st" "$SCRIPT_DIR/.egregore-state.json"
+    local st state_file
+    # A worktree links the checkout's state file: the rename lands on the
+    # file it points to, so the link stays and the installation keeps one state.
+    state_file="$(realpath "$SCRIPT_DIR/.egregore-state.json" 2>/dev/null)" || state_file="$SCRIPT_DIR/.egregore-state.json"
+    st="$(mktemp "$state_file.XXXXXX")" || return 0
+    if jq --arg rev "$revision" '.org_settings_revision = $rev' "$state_file" > "$st" 2>/dev/null && [ -s "$st" ]; then
+      mv "$st" "$state_file"
     else
       rm -f "$st"
     fi
@@ -394,7 +399,7 @@ _people_file() {
   fi
   ( cd "$SCRIPT_DIR/memory" 2>/dev/null && git add -A people/ 2>/dev/null \
       && git commit -q -m "chore(settings): $op $user in people" 2>/dev/null \
-      && git push -q 2>/dev/null ) || true
+      && bash "$SCRIPT_DIR/bin/memory-push.sh" --repository "$SCRIPT_DIR/memory" --branch main >/dev/null 2>&1 ) || true
 }
 
 cmd_people() {
@@ -469,7 +474,7 @@ set -- "${_args[@]+"${_args[@]}"}"
 # ── privacy & access (read snapshot) ─────────────────────────────────────
 # One composed JSON for the Settings Privacy & access panel. Identity,
 # membership, and capability values come from the Runtime authorization
-# backend (access-status); this shell layer adds only committed boundary
+# backend (access show --json); this shell layer adds only committed boundary
 # config, the personal boundary-local file, isolation state, and honest
 # constant statements. Never includes secrets, tokens, or internal paths.
 
@@ -499,7 +504,7 @@ cmd_privacy() {
   local access posture locked org_reads personal_reads denied digest graph
   access=$(cd "$SCRIPT_DIR" && EGREGORE_ROOT="$SCRIPT_DIR" \
     PYTHONSAFEPATH=1 PYTHONPATH="$SCRIPT_DIR${PYTHONPATH:+:$PYTHONPATH}" \
-    python3 -m egregore_runtime.harness_cli access-status 2>/dev/null) || true
+    python3 -m egregore_runtime.harness_cli access show --json 2>/dev/null) || true
   printf '%s' "$access" | jq -e . >/dev/null 2>&1 || access='{"status":"attention"}'
   posture=$(jq -r '.boundary.posture // "standard"' "$CONFIG" 2>/dev/null || echo standard)
   locked=$(jq -r 'if (.boundary.locked // false) == true then "true" else "false" end' "$CONFIG" 2>/dev/null || echo false)

package/runtime/pi/bin/spirit-discovery-claude.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -eu
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+PYTHONDONTWRITEBYTECODE=1 PYTHONSAFEPATH=1 PYTHONPATH="$ROOT" python3 -c 'from egregore_runtime.spirit_discovery_cli import main; raise SystemExit(main(runtime="claude"))' "$@"

package/runtime/pi/bin/spirit-discovery-codex.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -eu
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+PYTHONDONTWRITEBYTECODE=1 PYTHONSAFEPATH=1 PYTHONPATH="$ROOT" python3 -c 'from egregore_runtime.spirit_discovery_cli import main; raise SystemExit(main(runtime="codex"))' "$@"

package/runtime/pi/bin/spirit-discovery-pi.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -eu
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+PYTHONDONTWRITEBYTECODE=1 PYTHONSAFEPATH=1 PYTHONPATH="$ROOT" python3 -c 'from egregore_runtime.spirit_discovery_cli import main; raise SystemExit(main(runtime="pi"))' "$@"

package/runtime/pi/bin/spirit-discovery-prime.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -eu
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+PYTHONDONTWRITEBYTECODE=1 PYTHONSAFEPATH=1 PYTHONPATH="$ROOT" python3 -c 'from egregore_runtime.spirit_discovery_cli import main; raise SystemExit(main(runtime="prime"))' "$@"

package/runtime/pi/bin/spirit-discovery.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -eu
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+PYTHONDONTWRITEBYTECODE=1 PYTHONSAFEPATH=1 PYTHONPATH="$ROOT" python3 -c 'from egregore_runtime.spirit_discovery_cli import main; raise SystemExit(main(runtime=None))' "$@"

package/runtime/pi/bin/startup-check.sh

@@ -13,7 +13,6 @@ STATE_FILE="$SCRIPT_DIR/.egregore-state.json"
 [ -f "$ENV_FILE" ] || exit 0
 
 # --- Read config ---
-API_URL=$(jq -r '.api_url // empty' "$CONFIG" 2>/dev/null)
 MODE=$(jq -r '.mode // "local"' "$CONFIG" 2>/dev/null)
 CONFIG_SLUG=$(jq -r '.slug // empty' "$CONFIG" 2>/dev/null)
 ORG_NAME=$(jq -r '.org_name // empty' "$CONFIG" 2>/dev/null)
@@ -21,6 +20,7 @@ GITHUB_ORG=$(jq -r '.github_org // empty' "$CONFIG" 2>/dev/null)
 
 # shellcheck source=bin/lib/config.sh
 source "$SCRIPT_DIR/bin/lib/config.sh"
+API_URL=$(_config_api_url)
 
 # Runtime telemetry and diagnostics remain on-device by default. Historical
 # Connected health reporting is retained only as an explicit operator action;

package/runtime/pi/bin/telemetry.sh

@@ -7,6 +7,8 @@ set -euo pipefail
 umask 077
 
 SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
+# shellcheck source=bin/lib/config.sh
+source "$SCRIPT_DIR/bin/lib/config.sh"
 if [ -n "${EGREGORE_TELEMETRY_DIR:-}" ]; then
   BUFFER_DIR="$EGREGORE_TELEMETRY_DIR"
 else
@@ -516,12 +518,16 @@ cmd_export() {
 _resolve_share_target() {
   local requested_endpoint="$1"
   if [ -n "$requested_endpoint" ]; then
-    printf '%s\n' "$requested_endpoint"
-    return
+    # An explicit endpoint never gets the org key (cmd_share adds it only for
+    # the configured sink), so it needs the retired host mapped and nothing
+    # more; any other address goes to cmd_share's scheme check as typed.
+    _hosted_api_target "$requested_endpoint" 2>/dev/null || printf '%s\n' "$requested_endpoint"
+    return 0
   fi
   local api_url="" api_key=""
   if [ -f "$CONFIG" ]; then
-    api_url=$(jq -r '.api_url // empty' "$CONFIG" 2>/dev/null || true)
+    # A refused saved address names no sink: never fall through to the relay.
+    api_url=$(_hosted_api_url "$(jq -r '.api_url // empty' "$CONFIG" 2>/dev/null || true)") || return 0
   fi
   if [ -f "$ENV_FILE" ]; then
     api_key=$(grep '^EGREGORE_API_KEY=' "$ENV_FILE" 2>/dev/null | cut -d'=' -f2- || true)
@@ -691,7 +697,8 @@ cmd_share() {
     : > "$share_file"
   fi
 
-  local curl_args=(-s -o /dev/null -w '%{http_code}' -X POST "$endpoint"
+  # -q first (no ~/.curlrc), --globoff: the endpoint reaches the one host it names.
+  local curl_args=(-q --globoff -s -o /dev/null -w '%{http_code}' -X POST "$endpoint"
     -H "Content-Type: application/x-ndjson" --data-binary "@$share_file" --max-time 15)
   local api_key="" configured_endpoint=""
   configured_endpoint=$(_resolve_share_target "")

package/runtime/pi/bin/test-baseline.sh

@@ -39,6 +39,9 @@ json=false
 head_first=false
 strict_head=false
 timeout=""
+# A suite may declare a longer deadline than --timeout, up to 900 seconds,
+# with a line "# test-baseline: timeout=N" in its first 30 lines.
+child_limit=""
 selected=()
 add_suite() {
   local existing
@@ -147,8 +150,23 @@ run_dir=$(mktemp -d "${TMPDIR:-/tmp}/qa-baseline.XXXXXX") || error "cannot creat
 # Use the physical spelling consistently in Git, logs, and failure normalization.
 run_dir=$(cd -P "$run_dir" && pwd)
 mkdir -p "$run_dir/logs/base" "$run_dir/logs/head" || error "cannot create scratch logs"
-if ! git -C "$SCRIPT_DIR" worktree add --detach --quiet "$run_dir/base" "$base_oid" \
-    > "$run_dir/worktree.out" 2> "$run_dir/worktree.err"; then
+# A worktree another run is adding at the same moment can make Git read its
+# half-written entry ("failed to read .git/worktrees/<name>/commondir"), so a
+# failed add is tried again before it counts as an environment failure.
+add_base_tree() {
+  local attempt
+  for attempt in 1 2 3; do
+    if git -C "$SCRIPT_DIR" worktree add --detach --quiet "$run_dir/base" "$base_oid" \
+        > "$run_dir/worktree.out" 2> "$run_dir/worktree.err"; then
+      return 0
+    fi
+    [ "$attempt" -lt 3 ] || return 1
+    git -C "$SCRIPT_DIR" worktree remove --force "$run_dir/base" >/dev/null 2>&1 || true
+    rm -rf "$run_dir/base"
+    sleep "$attempt"
+  done
+}
+if ! add_base_tree; then
   echo 'test-baseline: cannot create the base worktree:' >&2
   cat "$run_dir/worktree.err" >&2
   exit 2
@@ -169,13 +187,14 @@ run_child() {
   set -m
   (cd "$tree" && exec "$@") < /dev/null > "$log" 2>&1 &
   child_pid=$!
-  if [ -n "$timeout" ]; then
+  local limit="${child_limit:-$timeout}"
+  if [ -n "$limit" ]; then
     watched_pid=$child_pid
     (
       # This watchdog owns a separate group, including its sleep process, so
       # normal completion and external interruption cancel the whole timer.
       set +m
-      if ! sleep "$timeout"; then
+      if ! sleep "$limit"; then
         : > "$run_dir/timer-failed"
       fi
       if kill -0 -- "-$watched_pid" 2>/dev/null; then
@@ -270,6 +289,13 @@ for suite in "${selected[@]}"; do
   note=""
   status=""
   runner=""
+  suite_limit="$timeout"
+  if [ -n "$timeout" ] && [ -f "$SCRIPT_DIR/$suite" ]; then
+    declared=$(head -n 30 "$SCRIPT_DIR/$suite" | sed -n 's/^# test-baseline: timeout=\([1-9][0-9]*\)$/\1/p' | head -n 1)
+    if [ -n "$declared" ] && [ "$declared" -gt "$timeout" ]; then
+      suite_limit=$(( declared > 900 ? 900 : declared ))
+    fi
+  fi
   printf 'test-baseline: suite %s\n' "$suite" >&2
   case "$suite" in
     *.sh) runner=bash ;;
@@ -345,7 +371,9 @@ for suite in "${selected[@]}"; do
         bats) command_args=(bats) ;;
       esac
       printf 'test-baseline: %s %s starting\n' "$side" "$suite" >&2
+      child_limit="$suite_limit"
       run_child "$tree" "$run_dir/logs/$side/$log_name" "${command_args[@]}" "./$suite"
+      child_limit=""
       printf 'test-baseline: %s %s exit=%s seconds=%s timed_out=%s\n' \
         "$side" "$suite" "$run_exit" "$run_seconds" "$run_timed_out" >&2
       failure_lines "$run_dir/logs/$side/$log_name" "$run_dir/$side.lines"
@@ -355,7 +383,7 @@ for suite in "${selected[@]}"; do
         head_exit=$run_exit; head_seconds=$run_seconds; head_timed_out=$run_timed_out
       fi
       if $run_timed_out; then
-        status=blocked; note="$side timed out after ${timeout}s"; break
+        status=blocked; note="$side timed out after ${suite_limit}s"; break
       fi
       if $head_first && [ "$side" = head ] && [ "$head_exit" -eq 0 ]; then break; fi
     done

package/runtime/pi/bin/todo.sh

@@ -3,7 +3,7 @@ set -euo pipefail
 
 ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 export EGREGORE_ROOT="$ROOT"
-export EGREGORE_SESSION_ID="${EGREGORE_SESSION_ID:-$(cat "$ROOT/.egregore-session-id" 2>/dev/null || true)}"
+export EGREGORE_SESSION_ID="${EGREGORE_SESSION_ID:-$(bash "$ROOT/bin/session-id.sh" --root "$ROOT" 2>/dev/null || cat "$ROOT/.egregore-session-id" 2>/dev/null || true)}"
 export PYTHONSAFEPATH=1 PYTHONPATH="$ROOT${PYTHONPATH:+:$PYTHONPATH}"
 
 exec python3 -m egregore_runtime.todo_cli "$@"

package/runtime/pi/bin/worktree-create.sh

@@ -94,52 +94,22 @@ fi
 # egregore.json
 [ -f "$REPO_ROOT/egregore.json" ] && [ ! -f "$WT_PATH/egregore.json" ] && ln -sfn "$REPO_ROOT/egregore.json" "$WT_PATH/egregore.json"
 
+# Installed tools (node_modules, .egregore/tools), so tests and the renderer
+# run without an install step. Same helper as worktree.sh setup, loaded from
+# this script's own bin/. Its one diagnostic, a link git cannot be made to
+# ignore, goes to stderr, keeping stdout the worktree path only.
+# shellcheck source=bin/lib/worktree-links.sh
+source "$(dirname "${BASH_SOURCE[0]}")/lib/worktree-links.sh" && egregore_link_tools "$WT_PATH" "$REPO_ROOT" >&2
+
 # --- Compute boundary for worktree (so isolation hook works) ---
-# session-start.sh doesn't re-run for worktrees, so we compute it here.
-HASH=$(echo -n "$WT_PATH" | md5 2>/dev/null || echo -n "$WT_PATH" | md5sum 2>/dev/null | cut -d' ' -f1)
-BOUNDARY_FILE="/tmp/egregore-boundary-${HASH}.json"
-MEMORY_DIR=""
-[ -L "$WT_PATH/memory" ] && MEMORY_DIR=$(realpath "$WT_PATH/memory" 2>/dev/null || true)
-# Managed repos: include main repo (worktree symlinks resolve there) + sibling repos
-MANAGED_REPOS_JSON="[\"$REPO_ROOT\""
-PARENT_DIR="$(dirname "$REPO_ROOT")"
-_repos=$(jq -r '(.repos[]? // empty) | if type == "object" then .name else . end' "$WT_PATH/egregore.json" 2>/dev/null || true)
-for _r in $_repos; do
-  [[ "$_r" == *".."* ]] && continue
-  _resolved=$(realpath "$PARENT_DIR/$_r" 2>/dev/null || true)
-  [ -z "$_resolved" ] && continue
-  MANAGED_REPOS_JSON="$MANAGED_REPOS_JSON,\"$_resolved\""
-done
-MANAGED_REPOS_JSON="$MANAGED_REPOS_JSON]"
-# Denied paths: shared computation (bin/boundary.sh compute-denied). The main
-# repo is passed as the caller-proven same-instance allowance — this worktree
-# was just created from it and physically shares its git dir — so it stays
-# excluded even on legacy registries whose entries carry no org_id yet.
-DENIED_JSON="[]"
-REGISTRY="$HOME/.egregore/instances.json"
-if [ -f "$REGISTRY" ]; then
-  WT_ORG=$(jq -r '.org_id // empty' "$WT_PATH/egregore.json" 2>/dev/null || true)
-  DENIED_JSON=$(bash "$REPO_ROOT/bin/boundary.sh" compute-denied \
-    "$REGISTRY" "$WT_PATH" "$WT_ORG" "$REPO_ROOT" 2>/dev/null || echo "[]")
-  case "$DENIED_JSON" in "["*) ;; *) DENIED_JSON="[]" ;; esac
-fi
-# Inherit posture, locked, and read roots from the main checkout's boundary
-# cache: a worktree that silently dropped them fell back to `standard` and
-# stopped honoring `locked: true` (found in the 6b.3 enforcement audit).
-MAIN_DIGEST=$(printf '%s' "$REPO_ROOT" | md5 2>/dev/null || printf '%s' "$REPO_ROOT" | md5sum | cut -d' ' -f1)
-MAIN_BOUNDARY="/tmp/egregore-boundary-${MAIN_DIGEST}.json"
-POSTURE_JSON='{}'
-if [ -f "$MAIN_BOUNDARY" ]; then
-  POSTURE_JSON=$(jq -c '{posture: (.posture // "standard"), locked: (.locked // false), read_roots: (.read_roots // [])}' "$MAIN_BOUNDARY" 2>/dev/null || echo '{}')
-fi
-jq -n \
-  --arg project_dir "$WT_PATH" \
-  --arg memory_dir "$MEMORY_DIR" \
-  --argjson managed_repos "$MANAGED_REPOS_JSON" \
-  --argjson denied_paths "$DENIED_JSON" \
-  --argjson inherited "$POSTURE_JSON" \
-  '{project_dir: $project_dir, memory_dir: $memory_dir, managed_repos: $managed_repos, denied_paths: $denied_paths} + $inherited' \
-  > "$BOUNDARY_FILE.tmp" 2>/dev/null && mv "$BOUNDARY_FILE.tmp" "$BOUNDARY_FILE" 2>/dev/null || true
+# session-start.sh doesn't re-run for worktrees, so we compute it here through
+# the shared computation (bin/boundary-guard.cjs write-cache). It recognizes a
+# linked worktree: the main checkout it physically shares a git dir with is the
+# caller-proven same instance (excluded from denied paths even on legacy
+# registries without org_id) and a managed repo, and posture, lock and read
+# roots come from the main checkout's config — a worktree that dropped them
+# fell back to `standard` and stopped honoring `locked: true` (6b.3 audit).
+bash "$REPO_ROOT/bin/node-run.sh" "$REPO_ROOT/bin/boundary-guard.cjs" write-cache "$WT_PATH" >/dev/null 2>&1 || true
 
 # --- Session topic on the graph (fire-and-forget, detached) ---
 # CLAUDE.md used to ask the model to run this after EnterWorktree with a

package/runtime/pi/bin/worktree.sh

@@ -57,6 +57,12 @@ case "$CMD" in
       ln -sfn "$MAIN_DIR/egregore.json" "$WT_PATH/egregore.json"
     fi
 
+    # Installed tools (node_modules, .egregore/tools), through the same helper
+    # as the WorktreeCreate hook; a link git cannot be made to ignore is
+    # reported on stderr.
+    # shellcheck source=bin/lib/worktree-links.sh
+    source "$(dirname "${BASH_SOURCE[0]}")/lib/worktree-links.sh" && egregore_link_tools "$WT_PATH" "$MAIN_DIR"
+
     # Find terminal TTY for statusline matching
     _pid=$$
     _tty=""

package/runtime/pi/docs/spirit-discovery.md

@@ -0,0 +1,96 @@
+# Capability and system discovery
+
+Each harness reads the same evidence through a fixed adapter:
+
+```sh
+bash bin/spirit-discovery-claude.sh capabilities.list
+bash bin/spirit-discovery-codex.sh capabilities.find research
+bash bin/spirit-discovery-pi.sh capabilities.describe tool.spirit-query
+bash bin/spirit-discovery-prime.sh system.explain
+```
+
+Pi and Prime also register `egregore_discover_capabilities`. Prime's Python
+bridge provides `capabilities_list`, `capabilities_find`, `capabilities_describe`,
+`capabilities_explain` and `system_explain`.
+
+The generic `bin/spirit-discovery.sh` selects a runtime only when exactly one
+valid installed snapshot exists. Multiple snapshots produce `ambiguous`; use the
+fixed adapter for your current harness. A runtime label selects installation
+evidence. It confers no permission.
+
+The operations are `capabilities.list`, `capabilities.find <text>`,
+`capabilities.describe <id>`, `capabilities.explain <id>` and
+`system.explain [id]`. `--json` reads the corresponding request from stdin:
+`{"operation":"capabilities.find","query":"research"}`. Only operation-specific
+`operation`, `query` and `id` fields are accepted; duplicate fields are rejected.
+No request selects an actor, endpoint, file, policy or source map.
+Malformed Unicode and excessively nested JSON are rejected with a bounded error
+envelope and no diagnostic traceback.
+
+Responses use `egregore.capability-query/v1`. The `views` array keeps local
+installation evidence separate from optional authenticated Durable host evidence.
+There is no combined ready badge. All responses have `execution_authority: false`.
+Local callability remains false, even when a remote binding says it is callable
+in the remote observed scope.
+
+The local view reads an OSS-only build snapshot at
+`bin/data/capabilities/<runtime>.json`. It checks the snapshot and its referenced
+current files against the existing local installer ownership record. Modified,
+missing, unrecorded, conflicting and unreadable evidence remain explicit. The
+snapshot's internal digest detects inconsistency; it is not publisher authentication.
+Its raw file hash is separately compared with the installer record.
+
+The installed facet covers the enumerated delivered files. A capability with
+unmeasured package/service dependencies is partial even when those files match.
+The runtime import dependency closure is not enumerated; its explicit coverage
+gap remains even when a tool's listed files match. File evidence does not prove
+the whole capability can run.
+The current registry, caller permission, operational success, evaluation evidence
+and adoption of an authenticated release are independent facts and remain unknown
+when no owner supplies them. An org-owned replacement cannot inherit verification
+from the replaced framework files. Source checkouts without installer records
+remain unrecorded. Connect overlays are not enumerated by this OSS reader.
+
+An optional `.egregore/spirit-discovery/binding.json` enables the Durable view.
+This private, regular, unlinked file is provisioned by the operator; discovery
+never creates it. Its exact fields are `schema` (`egregore.discovery-binding/v1`),
+`org_id`, `installation_key`, `actor_id`, `origin`, `remote_runtime_actor_id`,
+`bridge_token_env` and `actor_token_env`. The last two name environment variables;
+they do not contain credentials. The binding must match the current persisted
+Runtime actor and installation. The HTTP response must independently identify the
+freshly authenticated remote Runtime actor. Remote deployment identity currently
+remains unknown. A local filesystem owner can change their own configuration;
+these checks do not sandbox that owner.
+
+Discovery uses the Runtime identity owner's `require_existing` resolution path.
+It requires canonical retained account, actor, membership and organization IDs;
+it cannot migrate, mint, lock or write identity state. The resolver reads only
+bounded config/state files and never opens referenced identity documents. Its
+`profile-config-only-sha256` revision covers configuration, and cannot substitute
+for the ordinary profile revision covering declared identity documents. The
+installation key uses that already validated organization ID without rereading
+config; installation-root and Git-backlink behavior retains its existing scope.
+
+The origin permits HTTPS, or numeric-loopback HTTP for local hosts. Credentials
+are sent only to that fixed origin. Redirects are rejected. A disposable transport
+child bounds the complete HTTP operation, including DNS resolution and trickling
+responses, to seven seconds; response bytes are capped. Credentials travel on
+stdin and never appear in arguments or output. Discovery makes no model/provider
+calls, starts no jobs, probes no capabilities and writes no state.
+
+The remote adapter accepts the exact supported v1 response shape, including
+typed facets, bindings, generation and source evidence, and bounded standard
+JSON Schema with local references. Extra fields, unsupported schema extensions,
+malformed values or expired evidence make the remote view unavailable. Accepted
+native contracts are preserved in full; response-shape validation does not
+independently attest the host's claims or inspect arbitrary prose for secrets.
+
+Local reads use descriptor-relative, no-symlink traversal. Snapshots are capped at
+2 MB, 512 entries and 4096 file references; cumulative inspected payload bytes are
+capped at 16 MB per query. Files exceeding remaining coverage are unreadable for
+that query. Queries report coverage limits rather than interpreting an incomplete
+view as proof of absence.
+
+For source architecture investigation use the separate source-only
+`bin/spirit-map.mjs` workflow. It is not imported by this reader or shipped as an
+installed system authority. Organizational recall continues through Runtime search.

package/runtime/pi/egregore_runtime/__init__.py

@@ -16,6 +16,7 @@ from .contracts import (
     CanonicalArtifact,
     Capability,
     Entitlements,
+    ExecutionAuthority,
     EgregoreProfile,
     EvidenceItem,
     GraphProjection,
@@ -47,7 +48,8 @@ from .contracts import (
 )
 from .errors import AuthorizationDenied, ContextBudgetError, EgregoreRuntimeError
 from .observe import DefaultOrgContextCompiler
-from .policy import ActorGrant, StaticPolicy, all_access_dogfood_policy, scope_allows_path
+from .policy import ActorGrant, StaticPolicy, allows, check, policy_for
+from .access import authorization_inputs, AuthorizationInputs, Principal, PRINCIPAL_KINDS
 from .telemetry import (
     ALLOWED_METRIC_KEYS,
     TELEMETRY_SCHEMA_VERSION,
@@ -140,7 +142,7 @@ from .ingest import (
     LocalQuarantine,
     NormalizedIngest,
 )
-from .runtime import EgregoreRuntime, local_runtime
+from .runtime import EgregoreRuntime, authenticated_member_runtime, local_runtime
 from .questions import (
     QUESTION_SCHEMA_VERSION,
     CanonicalQuestionService,
@@ -200,16 +202,20 @@ from .lifecycle import (
     LifecycleTransition,
     ObligationState,
 )
-from .threads import (
-    THREAD_CONFIRMATION,
-    THREAD_EVENT_SCHEMA_VERSION,
-    THREAD_SCHEMA_VERSION,
-    CanonicalThreadService,
-    ThreadError,
-    ThreadFoldReceipt,
-    ThreadSnapshot,
-    parse_thread_markdown,
-)
+from .optional_modules import optional_module as _optional_module
+
+# Threads are held out of installs (runtime.thread is queued in placement).
+if _optional_module(".threads") is not None:
+    from .threads import (
+        THREAD_CONFIRMATION,
+        THREAD_EVENT_SCHEMA_VERSION,
+        THREAD_SCHEMA_VERSION,
+        CanonicalThreadService,
+        ThreadError,
+        ThreadFoldReceipt,
+        ThreadSnapshot,
+        parse_thread_markdown,
+    )
 from .scrolls import (
     EXACT_SHARE_CONFIRMATION,
     SCROLL_EVENT_SCHEMA_VERSION,