create-egregore 0.21.6 → 0.22.0

package/runtime/pi/egregore_runtime/runtime.py

@@ -7,16 +7,18 @@ composed here and are not part of the harness contract.
 
 from __future__ import annotations
 
-from dataclasses import dataclass
+from dataclasses import dataclass, field
 from datetime import UTC, datetime
 import hashlib
+import json
 import os
 from pathlib import Path
-from typing import Callable, Sequence
+from typing import TYPE_CHECKING, Callable, Sequence
 from uuid import uuid4
 
 from .adapters.qmd import QmdLocalRetriever
-from .admin_gate import AdminGate, document_is_admin
+from .held import document_is_admin, redact
+from .access import authorization_inputs
 from .artifacts import (
     CanonicalArtifactStore,
     CanonicalDocument,
@@ -59,12 +61,21 @@ from .lifecycle import (
     LifecycleRecord,
 )
 from .observe import DefaultOrgContextCompiler
+from .observers import MAX_EVENT_PATHS, Observer, RuntimeEvent
 from .sync_health import grade_retrieval, sync_remedy
-from .policy import all_access_dogfood_policy, scope_allows_path
+from .policy import check, is_admin, policy_for
+from .projection import observer as projection_observer
+from .optional_modules import optional_module
+
+_record = optional_module(".record")
+record_observer = _record.observer if _record is not None else None
 from .sync import LocalGitSyncTransport
 from .telemetry import LocalTelemetrySink, TELEMETRY_SCHEMA_VERSION
 from .writeback import CanonicalArtifactWriteback
 
+if TYPE_CHECKING:
+    from .member_authority import AuthenticatedMemberResolver
+
 
 PolicyFactory = Callable[[ActorContext], ActionAuthorizer]
 
@@ -82,8 +93,20 @@ class EgregoreRuntime:
     policy_factory: PolicyFactory
     lifecycle: CanonicalLifecycleService | None = None
     canonical_root: Path | None = None
-    admin_gate: AdminGate | None = None
     instance_root: Path | None = None
+    observers: list[Observer] = field(default_factory=list)
+
+    def _notify(self, kind, actor, paths):
+        paths = tuple(dict.fromkeys(path for path in paths if path))[:MAX_EVENT_PATHS]
+        if not paths:
+            return
+        event = RuntimeEvent(kind, actor.actor.actor_id, actor.session_id, actor.harness, paths,
+                             execution=actor.execution)
+        for observer in self.observers:
+            try:
+                observer(event)
+            except Exception:
+                pass
 
     def resolve_actor(self, *, session_id: str, harness: str) -> ActorContext:
         return self.identity.resolve(session_id=session_id, harness=harness)
@@ -108,13 +131,15 @@ class EgregoreRuntime:
             retriever=self.retriever,
             telemetry=self.telemetry,
             lifecycle=self.lifecycle,
-            admin_gate=self.admin_gate,
+            memory_root=self.canonical_root,
         )
-        return compiler.observe(
+        context = compiler.observe(
             actor,
             request,
             token_budget=token_budget or actor.profile.default_context_budget,
         )
+        self._notify("observed", actor, (item.canonical_path for item in context.evidence))
+        return context
 
     def retrieval_health(self) -> RetrieverHealth:
         return self.retriever.health()
@@ -236,6 +261,54 @@ class EgregoreRuntime:
     def open_source(self, actor: ActorContext, canonical_path: str) -> str:
         """Authorize, open, and record one canonical source through Runtime."""
 
+        content, artifact_id, canonical = self._served(actor, canonical_path)
+        try:
+            self.telemetry.emit(
+                TelemetryEvent(
+                    schema_version=TELEMETRY_SCHEMA_VERSION,
+                    event_id=f"evt_{uuid4().hex}",
+                    event_type="source.opened",
+                    occurred_at=datetime.now(UTC),
+                    org_id=actor.profile.org_id,
+                    actor_id=actor.actor.actor_id,
+                    session_id=actor.session_id,
+                    org_revision=actor.profile.revision,
+                    index_spec_version=self._index_spec_version(),
+                    metrics={
+                        "opened_count": 1,
+                        "result": "authorized",
+                        "success": True,
+                    },
+                    artifact_ids=(artifact_id,),
+                )
+            )
+        except Exception:
+            # Source access is canonical behavior; telemetry is disposable.
+            pass
+        self._notify("opened", actor, (canonical,))
+        return content
+
+    def serve_source(self, actor: ActorContext, canonical_path: str) -> str:
+        """One canonical source as ``open_source`` serves it (authorized, the admin guard, redacted), without
+        recording it as opened: for a listing that reads many files to show a few (``shown`` records those)."""
+
+        return self._served(actor, canonical_path)[0]
+
+    def shown(self, actor: ActorContext, canonical_paths: Sequence[str]) -> None:
+        """Record that a listing showed the actor what these canonical sources hold, as an observe does."""
+
+        self._notify("observed", actor, canonical_paths)
+
+    def _index_spec_version(self) -> str:
+        """The retriever's index spec: its own constant when it states one, since its health check can be a
+        subprocess (QMD's runs ``qmd status``) that every source open would pay for."""
+
+        known = getattr(self.retriever, "index_spec_version", None)
+        return known if isinstance(known, str) and known else self.retriever.health().index_spec_version
+
+    def _served(self, actor: ActorContext, canonical_path: str) -> tuple[str, str, str]:
+        """(content, stable artifact id, canonical path) of one authorized, redacted canonical source."""
+
         path = canonical_path.strip().replace("\\", "/")
         relative = path.removeprefix("memory/")
         artifact_id = artifact_id_from_path(relative)
@@ -243,13 +316,14 @@ class EgregoreRuntime:
         # stable declared id is resolved from the authorized source and then
         # checked separately before content is returned to the harness.
         decision = self.authorize(actor, Permission.READ)
-        if not decision.allowed or not scope_allows_path(path, decision.scopes):
+        verdict = check(decision, path, "read", root=self.canonical_root)
+        if not verdict.allowed:
             raise AuthorizationDenied("canonical source is outside the actor read scope")
 
         content = self.retriever.open_source(
             RetrievalHit(
                 artifact_id=artifact_id,
-                canonical_path=path,
+                canonical_path=verdict.canonical,
                 rank=1,
                 score=1,
                 retrieval_types=(RetrievalMode.LEX,),
@@ -259,44 +333,31 @@ class EgregoreRuntime:
         # only to organization admins. Repository members can still read the
         # raw Git file — this guards the product surface, not the filesystem.
         if (
-            self.admin_gate is not None
-            and document_is_admin(content)
-            and not self.admin_gate.actor_is_admin(actor)
+            not is_admin(decision) and document_is_admin(content)
         ):
             raise AuthorizationDenied(
                 "this document is admin-marked; Egregore serves it to organization admins only"
             )
         stable_artifact_id = canonical_artifact_id(content, path)
         stable_decision = self.authorize(actor, Permission.READ, (stable_artifact_id,))
-        if not stable_decision.allowed:
+        if not stable_decision.allowed or (
+            stable_decision.resource_ids and stable_artifact_id not in stable_decision.resource_ids
+        ):
             raise AuthorizationDenied(
                 "canonical artifact identity is outside the actor read scope"
             )
-        artifact_id = stable_artifact_id
-        try:
-            self.telemetry.emit(
-                TelemetryEvent(
-                    schema_version=TELEMETRY_SCHEMA_VERSION,
-                    event_id=f"evt_{uuid4().hex}",
-                    event_type="source.opened",
-                    occurred_at=datetime.now(UTC),
-                    org_id=actor.profile.org_id,
-                    actor_id=actor.actor.actor_id,
-                    session_id=actor.session_id,
-                    org_revision=actor.profile.revision,
-                    index_spec_version=self.retriever.health().index_spec_version,
-                    metrics={
-                        "opened_count": 1,
-                        "result": "authorized",
-                        "success": True,
-                    },
-                    artifact_ids=(artifact_id,),
-                )
+        if not check(stable_decision, path, "read", root=self.canonical_root).allowed:
+            raise AuthorizationDenied(
+                "canonical source is outside the current actor read scope"
             )
-        except Exception:
-            # Source access is canonical behavior; telemetry is disposable.
-            pass
-        return content
+        if not is_admin(stable_decision) and document_is_admin(content):
+            raise AuthorizationDenied(
+                "this document is admin-marked; Egregore serves it to organization admins only"
+            )
+        artifact_id = stable_artifact_id
+        # The one packaging: names of the documents held from this reader leave the text.
+        content = redact(stable_decision, content, root=self.canonical_root)
+        return content, artifact_id, verdict.canonical
 
     def write_artifact(
         self,
@@ -304,21 +365,36 @@ class EgregoreRuntime:
         artifact: CanonicalArtifact,
         content: str,
     ) -> WritebackEvent:
-        return self._writeback(actor).write(actor, artifact, content)
+        receipt = self._writeback(actor).write(actor, artifact, content)
+        if receipt.status in (WritebackStatus.ACCEPTED, WritebackStatus.PARTIAL):
+            self._notify("wrote", actor, ("memory/" + receipt.artifact.canonical_path,))
+        return receipt
 
     def write_document(
         self,
         actor: ActorContext,
         document: CanonicalDocument,
+        *,
+        message: str | None = None,
     ) -> WritebackEvent:
-        return self._writeback(actor).write_document(actor, document)
+        """``message``: the commit's own message (a document edit's file, why and trailers); every other
+        write keeps the writeback's."""
+        receipt = self._writeback(actor).write_document(actor, document, **({"message": message} if message else {}))
+        if receipt.status in (WritebackStatus.ACCEPTED, WritebackStatus.PARTIAL):
+            self._notify("wrote", actor, ("memory/" + receipt.artifact.canonical_path,))
+        return receipt
 
     def write_documents(
         self,
         actor: ActorContext,
         documents: tuple[CanonicalDocument, ...],
     ) -> tuple[WritebackEvent, ...]:
-        return self._writeback(actor).write_documents(actor, documents)
+        receipts = self._writeback(actor).write_documents(actor, documents)
+        self._notify("wrote", actor, (
+            "memory/" + receipt.artifact.canonical_path for receipt in receipts
+            if receipt.status in (WritebackStatus.ACCEPTED, WritebackStatus.PARTIAL)
+        ))
+        return receipts
 
     def commit_canonical_files(
         self,
@@ -331,9 +407,12 @@ class EgregoreRuntime:
 
         if self.canonical_root is None:
             raise RuntimeError("canonical file writeback is unavailable")
-        return self._writeback(actor).commit_files(
+        receipt = self._writeback(actor).commit_files(
             actor, paths, memory_root=self.canonical_root, message=message,
         )
+        if receipt.status in (WritebackStatus.ACCEPTED, WritebackStatus.PARTIAL):
+            self._notify("wrote", actor, ("memory/" + path for path in receipt.canonical_paths))
+        return receipt
 
     def register_ingest_manifest(
         self,
@@ -385,7 +464,7 @@ class EgregoreRuntime:
                 aliases.update(str(value) for value in actor.account.provider_aliases.values())
             recipient_aliases = tuple(sorted(value for value in aliases if value.strip()))
         return self.lifecycle.scan(
-            authorized_scopes=decision.scopes,
+            decision=decision,
             artifact_types=artifact_types,
             user=recipient_aliases,
         )
@@ -413,12 +492,8 @@ class EgregoreRuntime:
         matches = [record for record in plan.records if record.artifact_id == target_artifact_id]
         if len(matches) != 1:
             raise LifecycleError("lifecycle target is missing or ambiguous")
-        administer = bool(
-            actor.membership
-            and {role.casefold() for role in actor.membership.roles}
-            & {"admin", "administrator", "owner", "founder"}
-            and self.authorize(actor, Permission.ADMINISTER, (target_artifact_id,)).allowed
-        )
+        admin = self.authorize(actor, Permission.ADMINISTER, (target_artifact_id,))
+        administer = is_admin(admin)
         if self.lifecycle is None:
             raise LifecycleError("canonical lifecycle service is unavailable")
         transition = self.lifecycle.prepare_transition(
@@ -477,6 +552,8 @@ def local_runtime(
     *,
     push_remote: bool = True,
     policy_factory: PolicyFactory | None = None,
+    identity: IdentityResolver | None = None,
+    observers: Sequence[Observer] | None = None,
 ) -> EgregoreRuntime:
     """Compose the Local architecture; all projections remain disposable."""
 
@@ -488,14 +565,12 @@ def local_runtime(
         state_dir=Path.home() / ".egregore" / "runtime" / "lifecycle" / instance_id,
     )
 
-    def dogfood(actor: ActorContext) -> ActionAuthorizer:
-        return all_access_dogfood_policy(
-            org_id=actor.profile.org_id,
-            actor_id=actor.actor.actor_id,
-        )
-
+    active_observers = list(observers) if observers is not None else [
+        *([record_observer(repository_root)] if record_observer is not None else []),
+        projection_observer(repository_root),
+    ]
     return EgregoreRuntime(
-        identity=LocalIdentityResolver(repository_root),
+        identity=identity if identity is not None else LocalIdentityResolver(repository_root),
         retriever=QmdLocalRetriever(
             repository_root=repository_root,
             memory_root=memory_root,
@@ -511,9 +586,43 @@ def local_runtime(
         lifecycle=lifecycle,
         canonical_root=memory_root,
         instance_root=repository_root,
-        policy_factory=policy_factory or dogfood,
-        admin_gate=AdminGate(
-            config_path=repository_root / "egregore.json",
-            memory_root=memory_root,
-        ),
+        observers=active_observers,
+        policy_factory=policy_factory or (lambda actor: policy_for(authorization_inputs(repository_root))),
+    )
+
+
+def authenticated_member_runtime(
+    root: Path,
+    *,
+    identity: AuthenticatedMemberResolver,
+    push_remote: bool = True,
+    policy_factory: PolicyFactory | None = None,
+    observers: Sequence[Observer] = (),
+) -> EgregoreRuntime:
+    """Compose current member authority over Local policy, without Local login.
+
+    The trusted host supplies an authenticated resolver. Missing/unavailable
+    verification never falls back to the machine owner's identity. This factory
+    does not issue grants, connect transports, or grant paid capabilities.
+    """
+    from .member_authority import AuthenticatedMemberResolver, MemberAuthorityPolicy
+
+    if not isinstance(identity, AuthenticatedMemberResolver):
+        raise ValueError("authenticated member identity is required")
+    repository_root = runtime_root(root)
+    # Verify the configured workspace independently of the server response.
+    # Merely presenting a valid grant for another organization cannot select it.
+    try:
+        config = json.loads((repository_root / "egregore.json").read_text())
+        if config.get("org_id") != identity.expected.org_id:
+            raise ValueError("different organization")
+    except (OSError, ValueError, AttributeError):
+        raise ValueError("member authority does not match this workspace") from None
+    base = policy_factory or (lambda actor: policy_for(authorization_inputs(repository_root)))
+    return local_runtime(
+        repository_root, push_remote=push_remote, identity=identity,
+        policy_factory=lambda actor: MemberAuthorityPolicy(identity, base),
+        # Legacy projection refresh resolves Local identity during composition.
+        # Hosts opt into observers only after adapting their authority boundary.
+        observers=observers,
     )

package/runtime/pi/egregore_runtime/sandbox.py

@@ -0,0 +1,194 @@
+"""Sandbox markers, and where per-user state goes when it refuses writes.
+
+A session started outside the ``egregore`` launcher can run inside Codex's
+sandbox or a macOS app sandbox, where the per-user state under ``~/.egregore``
+refuses writes. A sandbox is named only from positive markers, the predicate
+``bin/lib/secret_entry.py`` and ``bin/reflexes/20-sandbox.sh`` also use; a
+failing write alone never names one.
+"""
+
+from __future__ import annotations
+
+from contextlib import suppress
+import errno
+import os
+from pathlib import Path
+import stat
+import tempfile
+from typing import Mapping
+
+# The errors that mean a location refuses writes. Anything else (a file where
+# a directory belongs, a full disk) keeps its own failure: a fallback must not
+# hide an unrelated fault.
+REFUSED = frozenset({errno.EACCES, errno.EPERM, errno.EROFS})
+REMEDY = "start through `egregore` to lift it"
+# The workspace copy ignores itself, so it never reaches a commit in a
+# checkout whose .gitignore predates it.
+IGNORE_EVERYTHING = "# Egregore state for a sandboxed session\n*\n"
+
+
+class FallbackRefused(Exception):
+    """The workspace copy cannot be used; the message says why."""
+
+
+def sandboxed(environment: Mapping[str, str] | None = None) -> bool:
+    """True when CODEX_SANDBOX or APP_SANDBOX_CONTAINER_ID says so."""
+    env = os.environ if environment is None else environment
+    return (str(env.get("CODEX_SANDBOX") or "").lower() not in {"", "none", "false", "0"}
+            or bool(env.get("APP_SANDBOX_CONTAINER_ID")))
+
+
+def reason(error: OSError) -> str:
+    return (error.strerror or type(error).__name__).lower()
+
+
+def write_probe(directory: Path) -> OSError | None:
+    """Create and remove one file where ``directory`` is, or would be created.
+
+    The file goes in the nearest existing ancestor, so the probe creates no
+    directory. A file that cannot be removed fails the probe as surely as one
+    that cannot be created. Returns the error, or None when both succeeded.
+    """
+    anchor = Path(directory)
+    while not os.path.exists(anchor) and anchor.parent != anchor:
+        anchor = anchor.parent
+    try:
+        descriptor, probe = tempfile.mkstemp(prefix=".egregore-write-probe-", dir=anchor)
+    except OSError as error:
+        return error
+    removal: OSError | None = None
+    try:
+        os.close(descriptor)
+    except OSError:
+        pass
+    finally:
+        try:
+            os.unlink(probe)
+        except OSError as error:
+            removal = error
+    return removal
+
+
+def display(path: Path, home: Path | None = None) -> str:
+    """``path`` with the home directory written as ``~``.
+
+    Both the home as given and its resolved form count, so a resolved path
+    under a linked home does not show the physical directory.
+    """
+    try:
+        base = Path(home) if home is not None else Path.home()
+    except (KeyError, OSError, RuntimeError):
+        return str(path)
+    bases = [base]
+    with suppress(OSError, RuntimeError):
+        if base.resolve() != base:
+            bases.append(base.resolve())
+    for candidate in bases:
+        if candidate == candidate.parent:
+            continue
+        try:
+            relative = Path(path).relative_to(candidate)
+        except ValueError:
+            continue
+        return "~" if relative == Path(".") else f"~/{relative.as_posix()}"
+    return str(path)
+
+
+def _ignore_everything(directory: Path, home: Path | None) -> None:
+    """Make ``directory/.gitignore`` a regular file that ignores everything.
+
+    A file that already says so is kept. Anything else (missing, empty,
+    edited, a link, not a file) is replaced through a temporary file and a
+    rename, which replaces a link itself and never writes through it.
+    """
+    ignore = directory / ".gitignore"
+    current = None
+    flags = os.O_RDONLY | getattr(os, "O_NOFOLLOW", 0) | getattr(os, "O_NONBLOCK", 0)
+    with suppress(OSError):
+        descriptor = os.open(ignore, flags)
+        with os.fdopen(descriptor, "rb") as handle:
+            if stat.S_ISREG(os.fstat(handle.fileno()).st_mode):
+                current = handle.read(len(IGNORE_EVERYTHING) + 1)
+    if current == IGNORE_EVERYTHING.encode():
+        return
+    try:
+        descriptor, temporary = tempfile.mkstemp(prefix=".gitignore.", dir=directory)
+    except OSError as error:
+        raise FallbackRefused(f"{display(ignore, home)} cannot be written ({reason(error)})") from error
+    try:
+        with os.fdopen(descriptor, "w", encoding="utf-8") as handle:
+            handle.write(IGNORE_EVERYTHING)
+        os.replace(temporary, ignore)
+    except OSError as error:
+        with suppress(OSError):
+            os.unlink(temporary)
+        raise FallbackRefused(f"{display(ignore, home)} cannot be written ({reason(error)})") from error
+
+
+def _prepare(fallback: Path, workspace: Path, home: Path | None) -> None:
+    """Create ``fallback`` inside ``workspace`` and make it ignore itself.
+
+    Raises FallbackRefused, naming why, when the copy would leave the
+    workspace (through a link under it or outright), or when it cannot be
+    created, marked ignored, or written.
+    """
+    root = Path(workspace)
+    try:
+        relative = Path(fallback).relative_to(root)
+    except ValueError:
+        relative = None
+    if relative is None or not relative.parts:
+        # Never the workspace root itself: its .gitignore would hide the checkout.
+        raise FallbackRefused(f"{display(fallback, home)} is not inside the workspace")
+    current = root
+    for part in relative.parts:
+        current = current / part
+        if os.path.islink(current):
+            raise FallbackRefused(f"{display(current, home)} is a link")
+        try:
+            os.mkdir(current, 0o700)
+        except FileExistsError:
+            if os.path.islink(current) or not os.path.isdir(current):
+                raise FallbackRefused(f"{display(current, home)} is not a directory") from None
+        except OSError as error:
+            raise FallbackRefused(f"{display(current, home)} cannot be created ({reason(error)})") from error
+    try:
+        inside = Path(os.path.realpath(fallback)).is_relative_to(os.path.realpath(root))
+    except (OSError, ValueError):
+        inside = False
+    if not inside:
+        raise FallbackRefused(f"{display(fallback, home)} resolves outside the workspace")
+    _ignore_everything(Path(fallback), home)
+    # An ignore file that already matched proves nothing about new files: a
+    # folder may take subfolders yet refuse files (a macOS deny add_file ACL).
+    error = write_probe(Path(fallback))
+    if error is not None:
+        raise FallbackRefused(f"{display(fallback, home)} is not writable ({reason(error)})")
+
+
+def state_directory(
+    preferred: Path,
+    fallback: Path,
+    *,
+    workspace: Path,
+    environment: Mapping[str, str] | None = None,
+    home: Path | None = None,
+) -> tuple[Path, str | None]:
+    """``preferred``, or ``fallback`` when the first refuses writes; and a warning.
+
+    The fallback is taken only when ``preferred`` refuses writes and the
+    workspace copy can be created inside ``workspace`` and marked ignored.
+    The warning names the cause, the sandbox when a marker is set and the
+    operating system's reason otherwise. When the copy is refused too, the
+    preferred directory stays, and the warning names both failures.
+    """
+    error = write_probe(preferred)
+    if error is None or error.errno not in REFUSED:
+        return preferred, None
+    cause = "sandbox" if sandboxed(environment) else reason(error)
+    refused = f"per-user state at {display(preferred, home)} is not writable ({cause})"
+    try:
+        _prepare(fallback, workspace, home)
+    except FallbackRefused as why:
+        return preferred, f"{refused}; no workspace copy either: {why}"
+    return fallback, f"{refused}; using {display(fallback, home)}"

package/runtime/pi/egregore_runtime/scroll_cli.py

@@ -7,6 +7,7 @@ import json
 import os
 from uuid import uuid4
 
+from . import held
 from .runtime import local_runtime, runtime_root
 from .scratch import read_and_consume
 from .scrolls import CanonicalScrollService, EXACT_SHARE_CONFIRMATION, ScrollError
@@ -45,8 +46,8 @@ def _receipts(rows):
 
 def _show(args):
     actor, service = _context()
-    print(json.dumps({"scroll": _row(service.read(actor, args.slug))}, ensure_ascii=False))
-    return 0
+    row = _row(service.read(actor, args.slug))
+    return held.emit_for(service.runtime, actor, {"scroll": row}, paths=(row["canonical_path"],))
 
 
 def _create(args):
@@ -65,8 +66,9 @@ def _create(args):
         attention_ttl_days=args.ttl_days,
         supersedes=args.supersedes,
     )
-    print(json.dumps({"scroll": _row(snapshot), "writeback": _receipts(receipts)}, ensure_ascii=False))
-    return 0 if all(row.status.value in {"accepted", "partial"} for row in receipts) else 1
+    ok = all(row.status.value in {"accepted", "partial"} for row in receipts)
+    return held.emit_for(service.runtime, actor, {"scroll": _row(snapshot), "writeback": _receipts(receipts)}) or (
+        0 if ok else 1)
 
 
 def _event(args):
@@ -79,24 +81,18 @@ def _event(args):
         face_markdown=read_and_consume(args.face, runtime_root()).decode("utf-8") if args.face else None,
         source_html=args.html,
     )
-    print(
-        json.dumps(
-            {
-                "scroll": _row(receipt.scroll),
-                "event_id": receipt.event_id,
-                "disposition": receipt.disposition,
-                "writeback": _receipts(receipt.receipts),
-            },
-            ensure_ascii=False,
-        )
-    )
-    return 0 if all(row.status.value in {"accepted", "partial"} for row in receipt.receipts) else 1
+    ok = all(row.status.value in {"accepted", "partial"} for row in receipt.receipts)
+    return held.emit_for(service.runtime, actor, {
+        "scroll": _row(receipt.scroll),
+        "event_id": receipt.event_id,
+        "disposition": receipt.disposition,
+        "writeback": _receipts(receipt.receipts),
+    }) or (0 if ok else 1)
 
 
 def _ledger(args):
     actor, service = _context()
-    print(json.dumps(service.project_ledger(actor, args.slug), ensure_ascii=False))
-    return 0
+    return held.emit_for(service.runtime, actor, service.project_ledger(actor, args.slug))
 
 
 def _plan_share(args):
@@ -104,8 +100,7 @@ def _plan_share(args):
     plan = service.plan_share(
         actor, slug=args.slug, html_path=args.html, description=args.description
     )
-    print(json.dumps(plan.to_dict(), ensure_ascii=False))
-    return 0
+    return held.emit_for(service.runtime, actor, plan.to_dict())
 
 
 def _share(args):
@@ -116,18 +111,13 @@ def _share(args):
         digest=args.digest,
         confirmation=args.confirm,
     )
-    print(
-        json.dumps(
-            {
-                "plan_id": receipt.plan_id,
-                "slug": receipt.slug,
-                "url": receipt.url,
-                "writeback": _receipts(receipt.writeback),
-            },
-            ensure_ascii=False,
-        )
-    )
-    return 0 if all(row.status.value in {"accepted", "partial"} for row in receipt.writeback) else 1
+    ok = all(row.status.value in {"accepted", "partial"} for row in receipt.writeback)
+    return held.emit_for(service.runtime, actor, {
+        "plan_id": receipt.plan_id,
+        "slug": receipt.slug,
+        "url": receipt.url,
+        "writeback": _receipts(receipt.writeback),
+    }) or (0 if ok else 1)
 
 
 def _parser():