create-egregore 0.21.6 → 0.22.0

package/runtime/pi/egregore_runtime/admin_entry.py

@@ -0,0 +1,56 @@
+"""Admin-only entries refuse a non-admin grant before they read anything.
+
+Corpus and data-room builders and hosted-index maintenance read or hand over
+memory wholesale, outside the per-path predicate, so they are admin-only
+channels: the entry asks the one policy whether this session's read grant is
+an admin's and stops otherwise. There is no operator-only class; running in
+your own checkout is not a grant. Shell and Node entries run the
+``egregore_runtime.admin_entry`` module with the surface name (exit 5 on refusal).
+"""
+
+from __future__ import annotations
+
+import os
+import sys
+from pathlib import Path
+
+REFUSED = 5
+
+
+def refusal(surface: str) -> str:
+    return (f"{surface} is for organization admins, and this session's grant is not an admin's; "
+            "nothing was read. Admins are the GitHub handles listed under `admins` in egregore.json.")
+
+
+def admin_session(root: Path | str | None = None, harness: str | None = None) -> bool:
+    """True only when the policy names this session's actor an admin; fails closed."""
+    from .contracts import Permission
+    from .policy import is_admin
+    from .runtime import local_runtime, runtime_root
+
+    try:
+        runtime = local_runtime(runtime_root(root), push_remote=False)
+        actor = runtime.resolve_actor(session_id=os.environ.get("EGREGORE_SESSION_ID") or "admin-entry",
+                                      harness=harness or os.environ.get("EGREGORE_RUNTIME") or "shell")
+        return is_admin(runtime.authorize(actor, Permission.READ))
+    except Exception:
+        return False
+
+
+def require_admin(surface: str, root: Path | str | None = None) -> None:
+    if not admin_session(root):
+        print(refusal(surface), file=sys.stderr)
+        raise SystemExit(REFUSED)
+
+
+def main(argv: list[str] | None = None) -> int:
+    args = sys.argv[1:] if argv is None else argv
+    surface = args[0] if args else "This command"
+    if admin_session():
+        return 0
+    print(refusal(surface), file=sys.stderr)
+    return REFUSED
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/runtime/pi/egregore_runtime/artifacts.py

@@ -18,12 +18,14 @@ import unicodedata
 from dataclasses import dataclass, field, replace
 from datetime import UTC, date, datetime
 from pathlib import Path, PurePosixPath
-from typing import Any, Mapping, Protocol, runtime_checkable
+from typing import Any, Callable, Mapping, Protocol, runtime_checkable
 
-from .contracts import ArtifactRelationship, CanonicalArtifact, SourceProvenance
+from .contracts import ActorKind, ArtifactRelationship, CanonicalArtifact, ExecutionAuthority, SourceProvenance
 
 
 ARTIFACT_SCHEMA_VERSION = "egregore-artifact/v1"
+# Names frontmatter keys whose block value the reader could not represent.
+UNPARSED_FRONTMATTER = "unparsed frontmatter"
 _FRONTMATTER_KEY = re.compile(r"^([A-Za-z][A-Za-z0-9_-]*):(?:[ \t]*(.*))?$")
 # Existing hosted artifact ids are URL-safe opaque tokens and may begin with
 # ``-`` or ``_``.  Keep those stable during explicit v1 migration.
@@ -54,6 +56,9 @@ class CanonicalDocument:
     replaces_existing: bool = False
     # Optimistic concurrency for a mutable lifecycle update; never serialized.
     expected_revision: str | None = None
+    # Stricter optimistic concurrency: the SHA-256 of the stored file's full
+    # bytes (header included), checked under the write lock; never serialized.
+    expected_sha256: str | None = None
 
 
 @runtime_checkable
@@ -156,33 +161,136 @@ def _parse_scalar(raw: str) -> Any:
     return value
 
 
-def split_frontmatter(markdown: str) -> tuple[dict[str, Any], str]:
-    """Parse the deterministic JSON-in-YAML subset used by v1 and legacy scalars.
+class _Unsupported(Exception):
+    """A frontmatter block outside the supported YAML subset."""
+
+
+def _indent(line: str) -> int:
+    return len(line) - len(line.lstrip(" "))
+
+
+def _dash(text: str) -> bool:
+    return text == "-" or text.startswith("- ")
+
+
+def _block_scalar(raw: str) -> Any:
+    """A scalar inside a block. A plain value carrying a YAML comment is refused
+    rather than read with the comment as data (``- oz # owner``)."""
+
+    if raw.startswith("#") or " #" in raw or "\t#" in raw:  # YAML: whitespace, then "#"
+        try:
+            return json.loads(raw)
+        except json.JSONDecodeError:
+            raise _Unsupported from None
+    return _parse_scalar(raw)
+
+
+def _block(lines: list[str], index: int, indent: int) -> tuple[Any, int]:
+    """One block-style YAML value at ``indent``: a list of scalars or a mapping."""
+
+    if _dash(lines[index][indent:]):
+        items = []
+        while index < len(lines) and _indent(lines[index]) == indent and _dash(lines[index][indent:]):
+            item = lines[index][indent + 1:].strip()
+            index += 1
+            if not item or (index < len(lines) and _indent(lines[index]) > indent):
+                raise _Unsupported  # an empty or nested list item
+            items.append(_block_scalar(item))
+        return items, index
+    mapping: dict[str, Any] = {}
+    while index < len(lines) and _indent(lines[index]) == indent and not _dash(lines[index][indent:]):
+        match = _FRONTMATTER_KEY.match(lines[index][indent:])
+        if match is None or match.group(1) in mapping:
+            raise _Unsupported
+        key, raw = match.group(1), (match.group(2) or "").strip()
+        index += 1
+        child = _indent(lines[index]) if index < len(lines) else -1
+        nested = child > indent or (child == indent and _dash(lines[index][indent:]))
+        if raw:
+            if nested or raw[:1] in {"|", ">"}:
+                raise _Unsupported  # a multi-line scalar
+            mapping[key] = _block_scalar(raw)
+        elif nested:
+            mapping[key], index = _block(lines, index, child)
+        else:
+            mapping[key] = None
+    if index < len(lines) and _indent(lines[index]) > indent:
+        raise _Unsupported
+    return mapping, index
 
-    JSON values are valid YAML and let the runtime round-trip nested provenance
-    without a YAML dependency.  Unknown indented legacy fields are ignored and
-    preserved in the original file until an explicit migration/write occurs.
-    """
 
+def _parse_frontmatter(markdown: str) -> tuple[dict[str, Any], str, tuple[str, ...]]:
     normalized = markdown.replace("\r\n", "\n").replace("\r", "\n")
     if not normalized.startswith("---\n"):
-        return {}, normalized
+        return {}, normalized, ()
     closing = normalized.find("\n---\n", 4)
     if closing < 0:
         raise ArtifactSchemaError("incomplete frontmatter block")
-    raw_header = normalized[4:closing]
+    # Only a comment at column 0 is dropped: inside a block, a "#" line may be
+    # content (a literal block), so it stays and makes that block unsupported.
+    numbered = [(number, line) for number, line in enumerate(normalized[4:closing].splitlines(), 2)
+                if line.strip() and not line.startswith("#")]
+    lines = [line for _, line in numbered]
     result: dict[str, Any] = {}
-    for line_number, line in enumerate(raw_header.splitlines(), 2):
-        if not line.strip() or line.lstrip().startswith("#") or line[:1].isspace():
+    unparsed: list[str] = []
+    index = 0
+    while index < len(lines):
+        line = lines[index]
+        if line[:1].isspace():
+            index += 1  # an indented line no key above it could own
             continue
         match = _FRONTMATTER_KEY.match(line)
         if match is None:
-            raise ArtifactSchemaError(f"invalid frontmatter line {line_number}")
+            raise ArtifactSchemaError(f"invalid frontmatter line {numbered[index][0]}")
         key, raw = match.groups()
         if key in result:
             raise ArtifactSchemaError(f"duplicate frontmatter key: {key}")
         result[key] = _parse_scalar(raw or "")
-    return result, normalized[closing + 5 :]
+        index += 1
+        if index < len(lines) and lines[index][:1].isspace():
+            # A block value under this key. Keep the one-line reading when the
+            # block is outside the subset, and name the key so no write drops it.
+            following = index
+            while following < len(lines) and lines[following][:1].isspace():
+                following += 1
+            if (raw or "").strip():
+                unparsed.append(key)
+            else:
+                try:
+                    value, stop = _block(lines, index, _indent(lines[index]))
+                    if stop != following:
+                        raise _Unsupported
+                    result[key] = value
+                except _Unsupported:
+                    unparsed.append(key)
+            index = following
+    return result, normalized[closing + 5 :], tuple(unparsed)
+
+
+def split_frontmatter(markdown: str) -> tuple[dict[str, Any], str]:
+    """Parse the deterministic JSON-in-YAML subset used by v1 and legacy records.
+
+    JSON values are valid YAML and let the runtime round-trip nested provenance
+    without a YAML dependency. Legacy block values (an indented list of
+    scalars, or a mapping of them) are read too. Anything else under a key
+    keeps its one-line reading; ``unparsed_frontmatter`` names those keys so a
+    write never drops them.
+    """
+
+    fields, body, _ = _parse_frontmatter(markdown)
+    return fields, body
+
+
+def unparsed_frontmatter(markdown: str) -> tuple[str, ...]:
+    """Keys whose block value is outside the supported subset."""
+
+    return _parse_frontmatter(markdown)[2]
+
+
+def _refuse_unparsed(warnings: tuple[str, ...]) -> None:
+    unread = next((note for note in warnings if note.startswith(UNPARSED_FRONTMATTER)), None)
+    if unread:
+        raise ArtifactSchemaError(f"{unread}; rewriting this record would drop them")
 
 
 def _as_strings(value: Any) -> tuple[str, ...]:
@@ -263,6 +371,11 @@ def _infer_type(fields: Mapping[str, Any], canonical_path: str) -> str:
     return "artifact"
 
 
+def plain_revision(markdown: str) -> str:
+    """Version of a plain canonical file: a hash of its exact text."""
+    return "sha256:" + hashlib.sha256(markdown.encode("utf-8")).hexdigest()[:16]
+
+
 def store_managed_reason(markdown: str) -> str | None:
     """Say why raw Markdown belongs to the artifact store, or None if it does not.
 
@@ -303,6 +416,34 @@ def _relationships(value: Any) -> tuple[ArtifactRelationship, ...]:
     return tuple(rows)
 
 
+def _execution_provenance(value: Any) -> ExecutionAuthority | None:
+    """Read bounded historical attribution, never usable as a credential."""
+    if value is None:
+        return None
+    text_fields = (
+        "executor_actor_id", "worker_id", "member_account_id", "member_actor_id",
+        "membership_id", "org_id", "grant_id", "binding_id", "audience", "revision",
+    )
+    if not isinstance(value, Mapping) or set(value) != {*text_fields, "executor_kind", "expires_at"}:
+        raise ArtifactSchemaError("invalid execution provenance")
+    if any(not isinstance(value[key], str) or not re.fullmatch(r"[A-Za-z0-9._:-]{1,160}", value[key])
+           for key in text_fields):
+        raise ArtifactSchemaError("invalid execution provenance reference")
+    try:
+        kind = ActorKind(value["executor_kind"])
+        if kind not in {ActorKind.AGENT, ActorKind.SERVICE}:
+            raise ValueError("invalid executor kind")
+        expires = datetime.fromisoformat(str(value["expires_at"]).replace("Z", "+00:00"))
+        if expires.tzinfo is None:
+            raise ValueError("timezone required")
+    except (ValueError, TypeError):
+        raise ArtifactSchemaError("invalid execution provenance") from None
+    return ExecutionAuthority(
+        **{key: value[key] for key in text_fields},
+        executor_kind=kind, expires_at=expires,
+    )
+
+
 def _provenance(value: Any) -> tuple[SourceProvenance, ...]:
     if value is None:
         return ()
@@ -326,6 +467,7 @@ def _provenance(value: Any) -> tuple[SourceProvenance, ...]:
                 observed_at=_datetime(item["observed_at"], field_name="provenance.observed_at"),
                 source_uri=str(item["source_uri"]) if item.get("source_uri") else None,
                 imported_by=str(item["imported_by"]) if item.get("imported_by") else None,
+                execution=_execution_provenance(item.get("execution")),
             )
         )
     return tuple(rows)
@@ -356,6 +498,11 @@ def validate_artifact(artifact: CanonicalArtifact, body: str) -> CanonicalArtifa
         raise ArtifactSchemaError("content_hash does not match the normalized Markdown body")
     if any(not row.relation or not row.target_id for row in artifact.relationships):
         raise ArtifactSchemaError("relationships require relation and target_id")
+    for source in artifact.provenance:
+        if source.execution is not None:
+            if not isinstance(source.execution, ExecutionAuthority):
+                raise ArtifactSchemaError("invalid execution provenance")
+            _execution_provenance(source.execution.to_dict())
     return replace(
         artifact,
         canonical_path=canonical_path,
@@ -382,7 +529,7 @@ def parse_canonical_markdown(
     """
 
     path = canonical_relative_path(canonical_path)
-    fields, raw_body = split_frontmatter(markdown)
+    fields, raw_body, unparsed = _parse_frontmatter(markdown)
     body = normalize_markdown_body(raw_body)
     schema = fields.get("schema_version") or fields.get("schema")
     is_v1 = schema == ARTIFACT_SCHEMA_VERSION
@@ -406,6 +553,7 @@ def parse_canonical_markdown(
         or fields.get("date")
         or fields.get("ingested_at")
         or fields.get("started")
+        or fields.get("created")
         or (default_created_at if not is_v1 else None)
     )
     if created_raw is None:
@@ -482,6 +630,8 @@ def parse_canonical_markdown(
         if key in fields:
             policy_hints[key] = fields[key]
     warnings = () if is_v1 else ("legacy frontmatter migrated in memory; source file was not rewritten",)
+    if unparsed:
+        warnings += (f"{UNPARSED_FRONTMATTER}: {', '.join(unparsed)}",)
     return CanonicalDocument(
         artifact=artifact,
         body=body,
@@ -533,7 +683,7 @@ class LocalMarkdownArtifactStore:
         root: Path,
         *,
         mutable_types: frozenset[str] = frozenset(
-            {"scroll", "thread", "question", "quest", "todo", "issue"}
+            {"scroll", "thread", "question", "quest", "todo", "issue", "design"}
         ),
     ):
         self.root = root.resolve()
@@ -567,8 +717,18 @@ class LocalMarkdownArtifactStore:
                 # stale digest, decides whether that replacement is legitimate.
                 recompute_digest=document.replaces_existing,
             )
+            identical = (artifact.artifact_type not in self.mutable_types and not document.replaces_existing
+                         and existing.artifact.content_hash == artifact.content_hash and document.migrated_from is None)
+            if not identical:
+                # The reader keeps only a one-line reading of an unparsed key,
+                # so replacing a stored file that has one would drop the rest.
+                # Refusing here, in the check, stops a batch before any write.
+                _refuse_unparsed(existing.warnings)
             if document.expected_revision is not None and existing.artifact.revision != document.expected_revision:
                 raise ArtifactConflictError("canonical source revision changed; reopen before retrying")
+            if (document.expected_sha256 is not None
+                    and hashlib.sha256(target.read_bytes()).hexdigest() != document.expected_sha256):
+                raise ArtifactConflictError("canonical source changed; reopen before retrying")
             if existing.artifact.artifact_id != artifact.artifact_id:
                 raise ArtifactConflictError("artifact path belongs to a different stable id")
             if artifact.artifact_type not in self.mutable_types and not document.replaces_existing:
@@ -579,6 +739,7 @@ class LocalMarkdownArtifactStore:
                         return target
                 else:
                     raise ArtifactConflictError(f"{artifact.artifact_type} artifacts are append-only")
+        _refuse_unparsed(document.warnings)  # a document built from such a read drops them too
         return target
 
     @contextmanager
@@ -612,6 +773,51 @@ class LocalMarkdownArtifactStore:
                 raise ArtifactConflictError("canonical source changed during identity transfer")
             return self._persist(document)
 
+    def replace_plain_if_unchanged(self, canonical_path: str, expected_revision: str, text: str) -> Path:
+        """Replace a plain canonical Markdown file while its bytes still match.
+
+        For files that carry no artifact envelope (people pages, ledgers, older
+        notes). ``expected_revision`` is ``sha256:`` plus the first 16 hex of the
+        current file. A file the store manages is refused: those go through a
+        document write so their envelope stays valid.
+        """
+        with self._write_lock(canonical_path):
+            target = self._target(canonical_path)
+            if not target.is_file():
+                raise ArtifactConflictError("canonical source disappeared; reopen before retrying")
+            current = target.read_text(encoding="utf-8")
+            if plain_revision(current) != expected_revision:
+                raise ArtifactConflictError("canonical source revision changed; reopen before retrying")
+            for markdown in (current, text):
+                reason = store_managed_reason(markdown)
+                if reason is not None:
+                    raise ArtifactConflictError(f"this file is store-managed ({reason}); write it as a document")
+            temporary = target.with_name(f".{target.name}.{os.getpid()}.tmp")
+            temporary.write_text(text, encoding="utf-8")
+            temporary.replace(target)
+            return target
+
+    def restore_if(self, canonical_path: str, previous: str, holds: Callable[[str], bool]) -> bool:
+        """Put ``previous`` back while the file still holds a write nothing versioned.
+
+        ``holds`` says whether the current text is that write. Under the same
+        lock as every store write. True when the file holds ``previous`` again
+        (or never left it); False when it moved on, so nothing was touched.
+        """
+        with self._write_lock(canonical_path):
+            target = self._target(canonical_path)
+            if not target.is_file():
+                return False
+            current = target.read_text(encoding="utf-8")
+            if current == previous:
+                return True
+            if not holds(current):
+                return False
+            temporary = target.with_name(f".{target.name}.{os.getpid()}.tmp")
+            temporary.write_text(previous, encoding="utf-8")
+            temporary.replace(target)
+            return True
+
     def _persist(self, document: CanonicalDocument) -> Path:
         target = self.check_write(document)
         artifact = validate_artifact(document.artifact, document.body)

package/runtime/pi/egregore_runtime/contracts.py

@@ -204,6 +204,14 @@ class PolicyDecision(Serializable):
     resource_ids: tuple[str, ...] = ()
     scopes: tuple[str, ...] = ()
     reasons: tuple[str, ...] = ()
+    audience: str = "member"
+    scope: str = "read"
+    read_prefixes: tuple[str, ...] = ()
+    write_prefixes: tuple[str, ...] = ()
+    append_prefixes: tuple[str, ...] = ()
+    holds_epoch: str = ""
+    released: tuple[str, ...] = ()
+    memory_revision: str = ""
 
 
 @dataclass(frozen=True, slots=True)
@@ -550,6 +558,8 @@ class ArtifactWriteback(Protocol):
         self,
         actor: ActorContext,
         document: "CanonicalDocument",
+        *,
+        message: str | None = None,
     ) -> WritebackEvent: ...
 
     def write_documents(
@@ -559,12 +569,29 @@ class ArtifactWriteback(Protocol):
     ) -> Sequence[WritebackEvent]: ...
 
 
+class CommitMessage(str):
+    """A commit's subject (and body) that names its own trailers, as ``Key: value`` lines.
+
+    It is a string, so every transport can commit it as text. The Git transport
+    writes ``trailers`` as the message's one trailer paragraph and adds only the
+    provenance trailers they do not name. The caller keeps every value on one line.
+    """
+
+    trailers: tuple[str, ...]
+
+    def __new__(cls, text: str, trailers: Sequence[str] = ()) -> "CommitMessage":
+        made = super().__new__(cls, text)
+        made.trailers = tuple(trailers)
+        return made
+
+
 @runtime_checkable
 class SyncTransport(Protocol):
     def status(self) -> SyncStatus: ...
 
     def pull(self) -> SyncStatus: ...
 
+    # ``message`` may be a CommitMessage that carries its own trailers.
     def push(self, *, message: str, paths: Sequence[str] = ()) -> SyncStatus: ...
 
 

package/runtime/pi/egregore_runtime/eligibility.py

@@ -15,7 +15,7 @@ from typing import Any, Callable
 from .contracts import TemporalScope
 from .errors import AuthorizationDenied, EgregoreRuntimeError
 from .lifecycle import AuthorityState
-from .policy import scope_allows_path
+from .policy import check
 
 ELIGIBILITY_VERSION = 'egregore-eligibility/v1'
 MAX_DOCUMENTS = 50_000
@@ -51,7 +51,7 @@ class EligibilitySnapshot:
                 'documents': [document.to_wire() for document in self.documents]}
 
 
-def build_eligibility(retriever, request, *, actor, admin_gate=None, lifecycle=None,
+def build_eligibility(retriever, request, *, actor, decision, lifecycle=None,
                       path_filter: Callable[[str], bool] | None = None,
                       metadata_filter: Callable[[str, Any], bool] | None = None):
     """Read current scoped files once and fence the resulting view by revision.
@@ -66,20 +66,13 @@ def build_eligibility(retriever, request, *, actor, admin_gate=None, lifecycle=N
     root = retriever.memory_root.resolve()
     rows = []
     warnings = []
-    is_admin = admin_gate is None or admin_gate.actor_is_admin(actor)
     for path in sorted(root.rglob('*.md')):
         canonical = 'memory/' + path.relative_to(root).as_posix()
-        if not scope_allows_path(canonical, request.authorized_scopes):
-            continue
-        resolved = path.resolve()
-        if not path.is_file() or not resolved.is_relative_to(root):
-            continue
-        if not scope_allows_path('memory/' + resolved.relative_to(root).as_posix(), request.authorized_scopes):
+        verdict = check(decision, canonical, "read", root=root)
+        if not verdict.allowed or not verdict.resolved.is_file():
             continue
         if path_filter and not path_filter(canonical):
             continue
-        if not is_admin and admin_gate.path_is_admin(canonical):
-            continue
         metadata = retriever.describe_source(canonical)
         if request.allowed_artifact_ids and metadata.artifact_id not in request.allowed_artifact_ids:
             continue
@@ -98,7 +91,7 @@ def build_eligibility(retriever, request, *, actor, admin_gate=None, lifecycle=N
         try:
             lifecycle_by_path, _ = lifecycle.resolve_paths(
                 [row.canonical_path for row in rows], source_revision=revision,
-                authorized_scopes=request.authorized_scopes,
+                decision=decision,
                 allowed_artifact_ids=request.allowed_artifact_ids)
         except Exception as error:
             # Preserve Observe's advisory lifecycle fallback, but do not claim

package/runtime/pi/egregore_runtime/episode_binding.py

@@ -13,11 +13,11 @@ import fcntl
 import hashlib
 import json
 import os
-from pathlib import Path
 import secrets
 import time
 
 from .errors import EgregoreRuntimeError
+from .installation import installation_root
 
 MAX_QUESTION_BYTES = 262144
 
@@ -25,9 +25,20 @@ class EpisodeBindingError(EgregoreRuntimeError):
     pass
 
 
+def _store(root):
+    """One binding store per installation, shared by its main checkout and task worktrees.
+
+    A prompt is bound from wherever its hook runs (Claude keeps CLAUDE_PROJECT_DIR
+    at the launch checkout after the session enters a worktree, and a prompt that
+    names a worktree moves the hook there); its tools, a subagent's included, run
+    in whichever checkout they stand in. All of them must see one current prompt.
+    """
+    return installation_root(root) / ".egregore/runtime/bindings"
+
+
 def _directory(root):
-    directory = Path(root) / ".egregore/runtime/bindings"
-    if not directory.resolve().is_relative_to(Path(root).resolve()):
+    directory = _store(root)
+    if not directory.resolve().is_relative_to(installation_root(root)):
         raise EpisodeBindingError("episode bindings must remain inside this instance")
     directory.mkdir(parents=True, exist_ok=True, mode=0o700)
     os.chmod(directory, 0o700)
@@ -148,7 +159,7 @@ def resolve(root, episode_id):
 
 
 def requires_binding(root):
-    directory = Path(root) / ".egregore/runtime/bindings"
+    directory = _store(root)
     return directory.exists() and any(directory.glob("*.current"))
 
 
@@ -168,7 +179,7 @@ def resolve_native(root, *, harness, session_id):
     if not session_id or len(session_id) > 200:
         raise EpisodeBindingError('native session identity is required')
     conversation = _key(f'{harness}:{session_id}')
-    path = Path(root) / '.egregore/runtime/bindings' / (conversation + '.current')
+    path = _store(root) / (conversation + '.current')
     if not path.exists():
         return None
     current = _load(path)

package/runtime/pi/egregore_runtime/github_issues.py

@@ -13,7 +13,7 @@ from urllib.parse import urlencode
 from uuid import uuid4
 
 from .contracts import Permission
-from .policy import scope_allows_path
+from .policy import allows, action_for
 from .issue_markers import artifact_url, issue_request_id, observation_id, request_id
 
 REPO = re.compile(r"[A-Za-z0-9][A-Za-z0-9-]{0,38}/(?!(?:\.|\.\.)$)[A-Za-z0-9_.-]{1,100}")
@@ -76,7 +76,7 @@ class GitHubIssues:
             permissions += [Permission.WRITE, Permission.SHARE]
         for permission in permissions:
             decision = self.runtime.authorize(self.actor, permission, (f"github:{self.repo}:issues",))
-            if not decision.allowed or not scope_allows_path("memory/knowledge/issues/", decision.scopes):
+            if not decision.allowed or not allows(decision, "memory/knowledge/issues/", action_for(decision.permission), root=self.runtime.canonical_root):
                 raise PermissionError(f"GitHub issues {permission.value} denied or whole issue namespace not authorized")
 
     def number(self, reference):

package/runtime/pi/egregore_runtime/handoff_lookup.py

@@ -23,10 +23,10 @@ from pathlib import Path
 from typing import Any, Iterable
 
 from .artifacts import split_frontmatter
-from .contracts import ActorContext, Permission
+from .contracts import ActorContext, Permission, PolicyDecision
 from .errors import AuthorizationDenied
 from .identity import organization_member_presentations
-from .policy import scope_allows_path
+from .policy import check
 from .questions import actor_aliases
 
 _CLOSED_STATUSES = frozenset(
@@ -72,13 +72,13 @@ def _occurred_at(fields: Any, path_stem: str) -> str:
     return f"0000-00-00T00:00:00Z:{path_stem}"
 
 
-def _member_terms(root: Path, actor: ActorContext, name: str) -> frozenset[str]:
-    """Stable-identity terms for a NAMED member (addressing resolution)."""
+def _member_terms(root: Path, actor: ActorContext, name: str, decision: PolicyDecision) -> frozenset[str]:
+    """Stable-identity terms for a NAMED member (addressing resolution), from readable profiles."""
 
     needle = name.strip().removeprefix("@").casefold()
     if not needle:
         return frozenset()
-    for member in organization_member_presentations(root, actor):
+    for member in organization_member_presentations(root, actor, decision=decision):
         values = {
             str(member.display_name).casefold(),
             *(str(alias).casefold() for alias in member.aliases),
@@ -113,16 +113,6 @@ class HandoffLookupService:
         decision = self.runtime.authorize(actor, Permission.READ)
         if not decision.allowed:
             raise AuthorizationDenied("; ".join(decision.reasons))
-        scopes = tuple(decision.scopes)
-
-        gate = getattr(self.runtime, "admin_gate", None)
-        admin_visible = True
-        if gate is not None:
-            try:
-                admin_visible = bool(gate.actor_is_admin(actor))
-            except Exception:
-                admin_visible = False
-
         recipient_terms = self._terms(actor, addressed_to)
         sender_terms = self._terms(actor, sent_by)
 
@@ -135,12 +125,11 @@ class HandoffLookupService:
                 continue
             relative = path.relative_to(self.memory_root).as_posix()
             canonical = f"memory/{relative}"
-            if not scope_allows_path(canonical, scopes):
-                continue
-            if not admin_visible and gate is not None and gate.path_is_admin(canonical):
+            verdict = check(decision, canonical, "read", root=self.memory_root)
+            if not verdict.allowed:
                 continue
             try:
-                fields, _ = split_frontmatter(path.read_text(encoding="utf-8"))
+                fields, _ = split_frontmatter(verdict.resolved.read_text(encoding="utf-8"))
             except (OSError, ValueError):
                 continue
             status = (_scalar(fields, "status") or "active").casefold()
@@ -181,7 +170,7 @@ class HandoffLookupService:
             return None
         if who.strip().casefold() in ("me", "self", actor.actor.actor_id.casefold()):
             return _self_terms(actor)
-        return _member_terms(self.root, actor, who)
+        return _member_terms(self.root, actor, who, self.runtime.authorize(actor, Permission.READ))
 
     @staticmethod
     def _addressed_match(text: str, terms: frozenset[str]) -> bool: