create-egregore 0.21.6 → 0.22.0

package/runtime/prime/.codex/spec-manifest.json

@@ -16,9 +16,9 @@
     },
     {
       "section": "Cross-Runtime Compatibility",
-      "action": "keep",
-      "sourceHash": "75d02e2603f5",
-      "note": "Kept verbatim — framework parity applies equally to Claude Code, Codex, and Pi."
+      "action": "replace",
+      "sourceHash": "b321c21f213c",
+      "note": "Compact translation preserves shared mechanics, thin adapters, every-runtime tracing/parity and regeneration, and neutral discovery without authority. Full query/facet and fixed-adapter details remain in shipped docs/spirit-discovery.md. Fits the 32 KiB project-doc budget."
     },
     {
       "section": "Voice",
@@ -29,14 +29,14 @@
     {
       "section": "On Launch — MANDATORY FIRST ACTION",
       "action": "replace",
-      "sourceHash": "233d160f9ca8",
+      "sourceHash": "f04b25830984",
       "note": "Claude SessionStart hook does not run on Codex; the egregore launcher renders the card via bin/codex-session-start.sh before the session. Greeting-replay instruction dropped (card is already on screen)."
     },
     {
       "section": "Before Project Changes — WORKING BRANCH",
       "action": "replace",
-      "sourceHash": "094a06f647a4",
-      "note": "EnterWorktree -> bin/agent.sh branch with git checkout fallback; AskUserQuestion -> numbered options in plain text; branch-guard mapped to .codex/hooks/branch-guard.js with instruction fallback; plan-mode note dropped (no plan mode on Codex); /branch + /onboarding -> skill tokens. Handoff claiming and repoState auto-checkout bash kept verbatim (pure git); surrounding prose compressed 2026-08 for the 32 KiB budget, every rule retained."
+      "sourceHash": "658d0e70c090",
+      "note": "EnterWorktree -> bin/agent.sh branch with git checkout fallback; AskUserQuestion -> numbered options in plain text; branch-guard mapped to .codex/hooks/branch-guard.js with instruction fallback; plan-mode note dropped (no plan mode on Codex); /branch + /onboarding -> skill tokens. Handoff claiming points to the shared .claude/context/handoff-claiming.md procedure; surrounding prose compressed 2026-08 for the 32 KiB budget, every rule retained."
     },
     {
       "section": "Config Files",
@@ -47,13 +47,13 @@
     {
       "section": "Optional Knowledge Graph Projection",
       "action": "keep",
-      "sourceHash": "64ee4c75b5fa",
+      "sourceHash": "265da7565f12",
       "note": "Kept verbatim — graph traversal remains an explicit optional adapter and canonical evidence wins."
     },
     {
       "section": "Egregore Retrieval Beat",
       "action": "keep",
-      "sourceHash": "b8fb46453ae7",
+      "sourceHash": "3ca2d81a686c",
       "note": "Kept verbatim — product attribution applies across runtimes."
     },
     {
@@ -77,7 +77,7 @@
     {
       "section": "Memory",
       "action": "keep",
-      "sourceHash": "d75dc9f6d88c",
+      "sourceHash": "023d5186533f",
       "note": "Kept verbatim."
     },
     {
@@ -89,19 +89,13 @@
     {
       "section": "Git Workflow",
       "action": "keep",
-      "sourceHash": "48777b92d7b3",
+      "sourceHash": "ed09c38ab870",
       "note": "Kept; slash tokens rendered as $skill tokens. Branch diagram unchanged (code fence)."
     },
-    {
-      "section": "Working Conventions",
-      "action": "keep",
-      "sourceHash": "e28cdfc77bf3",
-      "note": "Kept verbatim."
-    },
     {
       "section": "Command Awareness",
       "action": "keep",
-      "sourceHash": "187cf8034fb8",
+      "sourceHash": "868860642a07",
       "note": "Prepended the Codex command surface (skill tokens, canonical workflow adapters, org-owned native support, $save abstraction); disambiguation map kept with /x -> $x token rendering. Tokens with no Codex skill (e.g. /loop, a Claude Code harness feature) are left as-is."
     },
     {
@@ -125,8 +119,8 @@
     {
       "section": "Environment Isolation",
       "action": "replace",
-      "sourceHash": "086e2c1d9019",
-      "note": "boundary-check is a Claude PreToolUse hook with no .codex equivalent — two-tier model stated as a standing instruction; AskUserQuestion remediation -> numbered options, now including the two consent-grant options (session grant -> .egregore-boundary-consent, instance grant -> .egregore-boundary.local.json read[])."
+      "sourceHash": "ba57e692a182",
+      "note": "The boundary policy is shared (bin/boundary-guard.cjs): Claude (boundary-check.sh) and Codex (.codex/hooks.json) run it through bin/boundary-hook.sh (PreToolUse), Pi and Prime from their tool_call gate. AskUserQuestion remediation -> numbered options, including the two consent-grant options (session grant -> .egregore-boundary-consent, instance grant -> .egregore-boundary.local.json read[], reads only)."
     }
   ]
 }

package/runtime/prime/.prime/agent/APPEND_SYSTEM.md

@@ -36,13 +36,14 @@ When a user reports broken or missing framework behavior, the first question is
 
 ## Cross-Runtime Compatibility
 
-Framework behavior must work across Claude Code, Codex, and Pi Egregores. Put
-shared mechanics in runtime-neutral `bin/` scripts; keep `.claude/`, `.codex/`,
-and `.pi/` as thin adapters to those mechanics. When changing startup, session
-lifecycle, capture, skills, or commands, trace all three runtime entry points
-and add or update a parity test. Do not call a framework change complete based
-on one runtime alone. Regenerate derived Codex and Pi specifications or runtime
-bundles whenever their sources change.
+Share `bin/` mechanics through thin Claude/Codex/Pi/Prime adapters. Startup,
+lifecycle, capture, skill and command changes require tracing every runtime,
+parity tests and regenerated specs/bundles before completion.
+
+Discover via `bash bin/spirit-discovery-codex.sh capabilities.list` (Pi/Prime:
+registered tool). Follow `docs/spirit-discovery.md`: keep seven facets separate;
+generic shell needs one snapshot. Discovery reads code/install evidence, not
+memory, and grants no authority.
 
 ---
 
@@ -101,25 +102,7 @@ For continued project work: **continuation intent → prior workspace → restor
 
 ### Handoff claiming
 
-If `addressed_to_user` handoffs exist and the user is picking one up, create the IMPLEMENTS link after branch creation:
-```bash
-bash bin/graph-op.sh claim-handoff "$SESSION_ID" "$HANDOFF_SESSION_ID" 2>/dev/null &
-```
-
-**Auto-checkout repos from handoff**: after claiming, if `addressed_rich` carries a non-empty `repoState`, check out each entry's branch in its managed repo:
-
-```bash
-PARENT_DIR="$(cd .. && pwd)"
-# For each entry in repoState:
-REPO_DIR="$PARENT_DIR/$REPO_NAME"
-if [ -d "$REPO_DIR/.git" ] || [ -f "$REPO_DIR/.git" ]; then
-  git -C "$REPO_DIR" fetch origin "$BRANCH" --quiet 2>/dev/null
-  git -C "$REPO_DIR" checkout "$BRANCH" 2>/dev/null || \
-    git -C "$REPO_DIR" checkout -b "$BRANCH" "origin/$BRANCH" 2>/dev/null
-fi
-```
-
-Report `✓ Checked out {branch} in {repo1}, {repo2}`; for a merged-away branch, `◐ {repo}: PR #{N} merged — on {base}`. If `repoState` is absent or empty, skip silently.
+When the user picks up a handoff addressed to them, follow `.claude/context/handoff-claiming.md` after branch creation: it claims the handoff and checks out the branches its `repoState` names in each managed repo.
 
 **Exceptions** — skip branching when the user explicitly created or named a branch themselves, or the intent continues the current working branch's topic.
 
@@ -180,7 +163,7 @@ answers it: `open-handoffs`, `pending-questions`, `lineage`, or
 `meeting-history`. Verify projection freshness/coverage and open its canonical
 `evidencePath` before acting. Canonical Markdown wins on disagreement.
 
-Run `catalog` only when the route is unclear. Named reads return bounded stable fields and exact canonical `evidencePath` pointers; open only the returned files needed to answer. When a read reports partial coverage, use `unprojectedPaths` rather than claiming those files are represented in the graph. Use `bin/graph.sh` for unsupported Neo4j queries and never construct curl calls directly. See DEVELOPMENT.md §1 for the schema. Local recall uses Runtime `find`/`open`.
+Run `catalog` only when the route is unclear. Open only the returned `evidencePath` files needed to answer; on partial coverage, name `unprojectedPaths` instead of claiming them. Use `bin/graph.sh` for unsupported Neo4j queries and never construct curl calls directly (schema: DEVELOPMENT.md §1).
 
 ---
 
@@ -193,60 +176,42 @@ For each user-directed organizational lookup, show exactly one visible line:
 - retrieval that actually queries the connected graph:
   `⌕ Egregore Connect · searching your organization’s memory and relationships`
 
-When `EGREGORE_ORG_CONTEXT_V1` is attached, reuse its authorized evidence.
-For a remaining gap continue a Runtime investigation, preserving earlier findings.
-Follow `.claude/context/retrieval-investigation.md`: the model chooses keyword,
-semantic, hybrid, filename, literal, or date inventory; Runtime owns permissions,
-evidence history, pages and per-prompt limits. Empty results allow refinements
-within the requested dates. Never relax the date boundary to manufacture coverage.
-
-**Scope.** Egregore Runtime is for organizational recall only: team memory,
-decisions, handoffs, prior work. Code, files, Git, and tests use the harness's
-normal tools, with no beat and no Runtime call.
-
 **Visibility is the contract.** Emit it verbatim as a standalone assistant
 message before the first tool call that performs the organizational recall
 (the `bin/search.sh` query or a graph read). Tool output does not satisfy it.
-Do not paraphrase the line.
+Do not paraphrase the line. Emit once per episode.
+Never name `Egregore Connect` unless a graph read will actually run.
 
-Use Connect only for a graph traversal that actually runs. Emit once per
-episode.
+**Scope.** Egregore Runtime is for organizational recall only: team memory,
+decisions, handoffs, prior work. Code, files, Git, and tests use the harness's
+normal tools, with no beat and no Runtime call. Startup hydration, graph
+writes, ingestion, background sync, maintenance, and internal queries get no beat.
 
 **Routing:** Organizational recall always enters Egregore Runtime. The model is
 the semantic intent authority, deciding from meaning rather than fixed phrases.
+Do not run retrieval on unrelated prompts or infer graph from recall intent.
 Prompt hooks attach identity and guidance only; they never retrieve evidence.
-Without attached context, choose the appropriate Runtime operation:
+The full retrieval contract arrives with the session's first prompt as
+`EGREGORE_ACTOR_CONTEXT_V1` (later prompts carry a reminder); follow it.
+When `EGREGORE_ORG_CONTEXT_V1` is attached, reuse its authorized evidence.
+When the full contract is not in your context (a subagent, a missed hook, or
+after a compaction), start with
 
 ```bash
 bash bin/search.sh find "<query>" --kind <kind>
 ```
 
-Choose `filename`, `literal`, or `dates` for canonical file lookups; `keyword`
-for BM25; `semantic` for paraphrases; `hybrid` for combined ranking. No mode
-must run first. Open necessary sources together with `bash bin/search.sh open
-memory/path-a.md memory/path-b.md`. Runtime retains request state; do not write
-JSON operations, episode arguments, or gap explanations for normal retrieval.
-Use `find` for model-led discovery; `query` is a compatibility command. Read
-canonical sources through `search.sh open`, never a raw file-read tool or shell
-read. An adequate excerpt already supports an answer; no extra open is needed.
+and follow `.claude/context/retrieval-investigation.md`.
+Open necessary sources together with `bash bin/search.sh open`; never read
+memory with a raw file tool, `grep` or `ls`. Do not `cd` into the sibling memory repository.
+Never relax the date boundary to manufacture coverage.
 
 Search output is model-internal: show only the retrieval line and receipts —
 never ranked blocks, file/rank/excerpt metadata, or raw JSON.
 
-Do not resolve `memory/` to its sibling repo or start with raw `grep`/`ls`.
-Search attaches no graph by default. Open a source only when its excerpt
-cannot support a necessary claim. For current
-team/person synthesis, retain the requested subject and choose a `recent_days`
-window. Use date filters for a known topic, or a bounded date inventory for
-a recent-work overview. `/activity`, `/dashboard`, and `/project`
-display bounded status surfaces only when named or directly requested as a
-card. Explained syntheses of current organizational work and prior-work
-discovery are Runtime/QMD recall. Do not run retrieval on unrelated prompts or
-infer graph from recall intent.
-
-Do not emit the beat for code search, Git inspection, startup hydration, graph
-writes, ingestion, background sync, maintenance, or internal queries.
-Never name `Egregore Connect` unless a graph read will actually run.
+`/activity`, `/dashboard`, and `/project` display bounded status surfaces only
+when named or directly requested as a card.
+Explained syntheses of current organizational work and prior-work discovery are Runtime/QMD recall.
 
 ---
 
@@ -296,12 +261,15 @@ Never repeat it.
 
 ## Memory
 
-`memory/` is a symlink to the memory repo defined in `egregore.json`. Key directories:
-- `people/` — team directory
-- `handoffs/` — session handoffs + `index.md`
-- `knowledge/decisions/` — org decisions
-- `knowledge/patterns/` — emergent patterns
-- `infrastructure/` — service registry (URLs, names, credential locations)
+`memory/` links to the repo in `egregore.json`:
+- `people/` — team
+- `handoffs/` — handoffs and index
+- `knowledge/decisions/` — decisions
+- `knowledge/patterns/` — patterns
+- `infrastructure/` — services and credential locations
+
+Write memory through its commands, never the files: `/reflect` for decisions, `/handoff` for handoffs.
+
 
 Always use HTTPS for git operations — `github-auth.sh` handles credential storage.
 
@@ -316,9 +284,8 @@ Loom is Claude-specific; skip its preambles and `bin/loom.sh` calls. Use native
 ## Git Workflow
 
 `develop` is the default integration branch. A top-level
-`egregore.json.base_branch` replaces it for instances using another integration
-branch; `base_branch: "main"` is single-branch mode. Users never interact with
-git directly.
+`egregore.json.base_branch` replaces it; `base_branch: "main"` is single-branch
+mode. Users never interact with git directly.
 
 ```
 main ← selected `/release` candidates
@@ -332,10 +299,9 @@ develop ← CL integration (available internally)
 - **On launch**: syncs the configured base branch + memory. Does NOT create a branch.
 - **Branch creation**: required before project changes; read-only work stays put.
 - **Resuming**: rebase onto the configured base branch and continue.
-- **Read-only sessions**: no branch creation based on message count.
 - **`/save`**: pushes the working branch and opens a PR to the configured base. Auto-merges markdown-only PRs.
 - **Memory repo**: stays on main (separate repo, auto-merge).
-- **Never push directly to the configured base, main, or develop.** All changes flow through PRs.
+- **Never push directly to the configured base, main, or develop.** Changes flow through PRs, merged with `bash bin/agent.sh merge <pr>`, never `gh pr merge`; a red check needs a receipt naming each failing job and why.
 
 ### Pull request format (all harnesses)
 
@@ -343,7 +309,7 @@ Every PR body follows `.claude/context/pr-format.md`, enforced by the `pr-format
 
 ### Commit format (all harnesses)
 
-Every commit follows `.claude/context/commit-format.md`: subject `type(scope): imperative summary` (≤ 72 chars, aim ≤ 50, lowercase, same grammar and type set as PR titles), body wrapped at 72 explaining what and why — never how, and git trailers on agent-authored commits (`Egregore-Session: <id>` from `.egregore-session-id`, plus the harness `Co-Authored-By` line). Background scripts commit as `chore(<subsystem>): …`, but a commit carrying real work derives its type/scope from the diff — the transport never masks the work. Git-generated messages (merges, reverts, autosquash fixups) keep their native form. Wording for commits and PRs follows `.claude/context/git-language.md`.
+Every commit follows `.claude/context/commit-format.md`: subject `type(scope): imperative summary` (≤ 72 chars, aim ≤ 50, lowercase, same grammar and type set as PR titles), body wrapped at 72 explaining what and why — never how, and git trailers on agent-authored commits (`Egregore-Session: <id>` from `bash bin/session-id.sh`, plus the harness `Co-Authored-By` line). Background scripts commit as `chore(<subsystem>): …`, but a commit carrying real work derives its type/scope from the diff — the transport never masks the work. Git-generated messages (merges, reverts, autosquash fixups) keep their native form. Wording for commits and PRs follows `.claude/context/git-language.md`.
 
 ### Managed Repos
 
@@ -351,14 +317,6 @@ Repos in `egregore.json` → `repos[]` are cloned as siblings (`../{repo}/`). Ea
 
 ---
 
-## Working Conventions
-
-- For unfamiliar org work, use Observe context; if absent, run `bash bin/search.sh find` with an appropriate lookup kind.
-- Document significant decisions in `memory/knowledge/decisions/`
-- After substantial sessions, log to `memory/handoffs/` and update `index.md`
-
----
-
 ## Command Awareness
 
 Egregore workflows are available as Prime Agent slash commands such as `/activity`, `/handoff`, `/save`, and `/view`. They are registered from the shared skill inventory by `.prime/agent/extensions/egregore.ts`; the duplicate `/skill:name` listings are disabled so each workflow appears once. Natural-language requests work normally — and are the route for any workflow whose name collides with a Prime Agent built-in: **say "update egregore" rather than typing `/update`**, which is Prime Agent's own self-updater. `/save` is the user-facing abstraction for committing, pushing, opening or reusing pull requests, and syncing memory — never make users manage the git workflow by hand.
@@ -373,7 +331,7 @@ Kernel shell escapes can be time-capped by the harness. Egregore `bin/` scripts
 
 Invoke commands from user intent — don't wait for the slash. Each command file has a `## When to invoke` section. Load it for the full spec.
 
-**Core loop** — `/activity` `/dashboard` `/handoff` `/wrap` `/save` `/reflect` `/todo`
+**Core loop** — `/activity` `/dashboard` `/handoff` `/wrap` `/save` `/reflect` `/todo` `/records`
 **Knowledge** — `/search` `/deep-reflect` `/archive` `/note` `/add` `/meeting` `/ingest` `/scroll` `/mock` `/audit`
 **Identity** — `/me` (view profile or set display name)
 **Coordination** — `/ask` `/quest` `/issue` `/invite` `/delete-user` `/announce`
@@ -385,16 +343,10 @@ Invoke commands from user intent — don't wait for the slash. Each command file
 
 **Disambiguation:**
 - Knowledge: `/reflect` (share-ready) · `/note` (half-baked) · `/deep-reflect` (deep research over memory — questions AND cross-referencing) · `/archive` (AI patterns) · `/audit` (evidence-mined forensic sweep of the org's own record — any target)
-- Finding things — **the model chooses organizational retrieval through Runtime**.
-  Reuse equivalent evidence and investigate distinct gaps through the same Runtime.
-  Use `bash bin/search.sh find` or `open` and the shared investigation contract. Use Grep/Glob for code and exact errors, not org
-  recall. Do not `cd` into the sibling memory repository.
-- Finding **something you generated** (a scroll, handoff, emissary, decision, any hosted egregore.xyz link): `bash bin/artifacts.sh find <query>`. Every generative surface records into memory — hosted artifacts self-register into `memory/artifacts/` at publish (committed+pushed, findable from any session); handoffs in `memory/handoffs/`, emissaries in `memory/handoffs/outbound/`, decisions/findings/patterns in `memory/knowledge/`. The finder searches all of them by **content, not just name**, ranks title/topic matches above body mentions, tags hits by type (`[document]`/`[handoff]`/`[emissary]`/`[decision]`), and surfaces the shareable URL — grep-first in OSS, search + graph when available. *"bring me the artifact where I laid out our GTM plan"* → this.
+- Finding things — organizational recall through Runtime (Egregore Retrieval Beat); Grep/Glob for code and exact errors.
+- Finding **something you generated** (a scroll, handoff, emissary, decision, any hosted egregore.xyz link): `bash bin/artifacts.sh find <query>` searches every generated record by content, tags its type and returns the shareable URL. *"bring me the artifact where I laid out our GTM plan"* → this.
 - Artifacts with questions: `/scroll` (living paper + embedded harvest, updates in place) · `/view` (static render) · `/harvest` (elicitation, no published face) · `/mock` (pre-build walkthrough of decided design — gauge per stop, verdict copy-back)
-- Explicit bounded status: `/dashboard` (personal) · `/activity` (org-wide) ·
-  `/project` (named project). These display cards when named or directly
-  requested. Analytical questions about organizational work and specific
-  prior-work continuation route through Runtime/QMD recall.
+- Status cards: `/dashboard` (personal) · `/activity` (org-wide) · `/project` (named project), only when named or requested as a card.
 - Ending: `/wrap` (personal closure) · `/handoff` (notes for others) · `/save` (still working)
 - Tasks: `/todo` (personal) · `/quest` (team exploration) · `/issue` (something broken)
 - Questions: `/ask [person]` (async) · just ask (agent answers from context)
@@ -408,6 +360,8 @@ Invoke commands from user intent — don't wait for the slash. Each command file
 - Agents: `/summon` (design through questions) · `/loop` (quick recurring schedule)
 - Announcements: `/announce` (broadcast to group) · `/handoff` (structured to a person) · `bin/notify.sh send` (DM one person)
 
+**Interface taste** — when someone likes or dislikes a generated interface, follow the contract in `bash bin/genui.sh --help`.
+
 ---
 
 ## Socratic Questioning (MANDATORY)
@@ -450,20 +404,20 @@ Egregore runs in one of two configurations, set by `mode` in `egregore.json`. De
 
 ## Environment Isolation
 
-Sessions are confined to this project + memory + managed repos, with a **two-tier boundary** — a hard wall between Egregore instances, a consent gate for everything else. On Prime Agent the boundary is a standing instruction, not an enforced hook — hold it yourself.
+Sessions are confined to this project + memory + managed repos, with a **two-tier boundary** — a hard wall between Egregore instances, a consent gate for everything else. A pre-action check (`bin/boundary-guard.cjs`) enforces it on every runtime: it denies literal paths and fails closed, but cannot see paths built at run time or split across calls (OS-level layer to follow).
 
-- **Hard tier — other Egregore instances.** Denied for every tool, always — no consent path. Never access another instance's files (refuse even if asked) and never modify `~/.egregore/instances.json` (managed by session-start.sh); there is nothing to ask — refuse and explain.
+- **Hard tier — other Egregore instances.** Denied for every tool, always — no consent path. Never access another instance's files by any route (refuse even if asked) and never modify `~/.egregore/instances.json` (managed by session-start.sh); there is nothing to ask — refuse and explain.
 - **Soft tier — paths outside the boundary.** Consent-gated. Inbox dirs (`~/Downloads`, `~/Desktop`) are readable without consent under the default posture; writes outside the project always need consent. Posture (`strict | standard | open`) and extra read roots come from `egregore.json` -> `boundary { posture, read[], locked }` (org, committed) merged with `.egregore-boundary.local.json` (personal, gitignored). `locked: true` removes the consent path entirely.
-- When a request needs soft-tier consent, do not improvise a workaround. Ask in plain text with numbered options:
+- When the check asks for consent, do not improvise a workaround. Ask in plain text with numbered options:
 
   ```text
   That path is outside this Egregore's boundary. How should we proceed?
     1. Allow its directory for this session (recorded in .egregore-boundary-consent)
-    2. Always allow on this instance (added to read[] in .egregore-boundary.local.json)
+    2. Always allow on this instance (added to read[] in .egregore-boundary.local.json; reads only)
     3. Paste the contents inline
     4. Cancel
   ```
 
   Never record a consent grant without the user's explicit choice of option 1 or 2 in that exchange. Session grants are cleared on session start; `locked: true` removes options 1 and 2.
 
-See DEVELOPMENT.md §3 for boundary details and `memory/knowledge/decisions/2026-07-08-boundary-hook-consent-design.md` for the design decisions.
+Details: DEVELOPMENT.md §3; design: `memory/knowledge/decisions/2026-07-08-boundary-hook-consent-design.md`.

package/runtime/prime/.prime/agent/extensions/egregore.ts

@@ -1,3 +1,4 @@
+import { registerSpiritDiscovery } from "../../../bin/pi-spirit-discovery.mjs";
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { Text } from "@earendil-works/pi-tui";
@@ -9,7 +10,7 @@ import {
   isRuntimeStatePath,
   mutatesOnlyRuntimeState,
 } from "../../../bin/pi-branch-policy.mjs";
-import { registerObserveHook, registerUserCommand } from "../../../bin/pi-observe-context.mjs";
+import { bindNativeSession, registerObserveHook, registerUserCommand } from "../../../bin/pi-observe-context.mjs";
 import {
   activityDataPath,
   captureSessionEnd,
@@ -22,6 +23,8 @@ import {
   renderView,
   workflowPrompt,
 } from "../../../bin/pi-product-workflows.mjs";
+// The instance wall shared with the Claude Code and Codex pre-action hooks.
+import boundaryGuard from "../../../bin/boundary-guard.cjs";
 
 const PROTECTED_BRANCHES = new Set(["main", "master", "develop"]);
 // Prime Agent built-in slash commands (README Commands table) plus
@@ -96,6 +99,7 @@ async function gitContext(pi, candidate) {
 
 export default function egregore(pi) {
   const root = process.cwd();
+  registerSpiritDiscovery(pi, { root, runtime: "prime", Type });
   const skillsDir = join(root, ".codex", "skills");
   let workflowCount = 0;
   let lastSyncAt = 0;
@@ -353,6 +357,9 @@ export default function egregore(pi) {
 
     setBusy(ctx, "Loading team context");
     try {
+      // Bind Prime's own session id before the card's session start, which
+      // maps it to the Egregore id it mints so this session's commits resolve it.
+      bindNativeSession(ctx, "prime", root);
       const card = await renderGreeting(pi, root, ctx.signal, "prime-session-start.sh");
       lastSyncAt = Date.now();
       appendCard("greeting", card);
@@ -384,6 +391,12 @@ export default function egregore(pi) {
   });
 
   pi.on("tool_call", async (event, ctx) => {
+    // Environment isolation first: it covers reads too, and another
+    // instance's files are denied before any branch question arises.
+    // IPython code is scanned for paths the same way as a shell command.
+    const wall = boundaryGuard.toolCallBlock(event, ctx, root);
+    if (wall) return wall;
+
     const isFileWrite = event.toolName === "write" || event.toolName === "edit";
     const command = String(event.input?.command || "");
     // Prime Agent's default surface is the persistent IPython kernel: file

package/runtime/prime/.prime/agent/skills/egregore/SKILL.md

@@ -11,6 +11,8 @@ functions directly instead of grepping `bin/` scripts to reconstruct CLI usage:
 ```python
 import egregore
 
+egregore.capabilities_find("research")     # separate installation and host evidence
+egregore.system_explain()                  # visible owners and evidence gaps
 egregore.search("pricing decision")          # ranked shared-memory recall
 egregore.activity()                          # team activity JSON
 egregore.handoff(to="renc", topic="...", body="...")
@@ -21,21 +23,27 @@ egregore.notify_plan(recipient="renc", message="...")  # proposal ONLY
 
 Use `draft=True` while
 implementation or review continues. After local QA and review pass, use
-`draft=False` to push the final changes and mark the PR ready for CI. Omit
+`draft=False` to push the final changes and mark the PR ready for CI; it
+first runs the checks CI would select on this machine, and if one fails the
+work is pushed, the PR stays a draft and the call raises. Omit
 `draft` for normal non-coding auto-merge; omitting it on an existing PR
 preserves that PR's readiness. These choices follow the work's state and do
 not require a separate permission checkpoint.
 
 Ground rules:
 
-- Every function shells out to the corresponding `bin/` script with a generous
-  internal timeout and returns its text output. `bin/` stays the single
-  mechanics layer — this module contains no logic of its own.
+- Every function shells out to the corresponding `bin/` script and returns
+  text output. Business rules stay in the shared scripts.
+- Normal bridge functions use a generous internal timeout and raise
+  `RuntimeError` with the script's stderr on failure — report the single
+  relevant line, do not debug the plumbing mid-workflow.
+- Discovery functions use the fixed JSON request path through
+  `bin/spirit-discovery-prime.sh --json`, with a 15-second wrapper timeout.
+  Failures return bounded `egregore.capability-query-error/v1` JSON text
+  without stderr diagnostics.
 - `notify_plan` only CREATES a notification plan. Approval and dispatch remain
   subject to the explicit human Send / Edit / Cancel checkpoint: show the plan,
   get the user's approval, then run `bin/notify.sh approve` / `dispatch` with
   the plan's one-use approval token. Never call approve or dispatch without a
   fresh human yes in this conversation.
-- Functions raise `RuntimeError` with the script's stderr on failure — report
-  the single relevant line, do not debug the plumbing mid-workflow.
 - `help()` on the module or any function shows signatures and semantics.

package/runtime/prime/.prime/agent/skills/egregore/src/egregore/__init__.py

@@ -20,6 +20,11 @@ from pathlib import Path
 
 __all__ = [
     "activity",
+    "capabilities_list",
+    "capabilities_find",
+    "capabilities_describe",
+    "capabilities_explain",
+    "system_explain",
     "branch",
     "handoff",
     "instance_root",
@@ -111,13 +116,15 @@ def save(
 
     Set ``draft=True`` while work continues or ``draft=False`` after local
     QA/review to mark ready. ``None`` preserves existing PR readiness.
+    Marking ready first runs the checks CI would select, which can take as
+    long as a CI run, so that save gets the longer limit.
     """
     args = ["bin/agent.sh", "save", "--message", message, "--topic", topic]
     if pr_body:
         args += ["--pr-body", pr_body]
     if draft is not None:
         args += ["--draft" if draft else "--ready"]
-    return _run_script(args, timeout=300)
+    return _run_script(args, timeout=300 if draft is not False else 2 * 60 * 60)
 
 
 def handoff(
@@ -174,3 +181,61 @@ def run() -> str:
         "notify_plan(recipient, message). notify_plan is proposal-only: "
         "approval and dispatch require an explicit human checkpoint."
     )
+
+
+def _discover_capabilities(request: dict) -> str:
+    """Pass bounded JSON to the shared reader; selectors never become argv."""
+    error = json.dumps({
+        "schema": "egregore.capability-query-error/v1",
+        "error": "invalid-or-unavailable-discovery",
+        "execution_authority": False,
+    })
+    try:
+        # ASCII escaping transports even malformed Unicode to the shared
+        # validator. The CLI owns operation, selector and Unicode policy.
+        encoder = json.JSONEncoder(ensure_ascii=True, allow_nan=False)
+        chunks, size = [], 0
+        for chunk in encoder.iterencode(request):
+            size += len(chunk)
+            if size > 4096:
+                return error
+            chunks.append(chunk)
+        result = subprocess.run(
+            ["bash", "bin/spirit-discovery-prime.sh", "--json"],
+            input="".join(chunks), cwd=instance_root(),
+            capture_output=True, encoding="utf-8", timeout=15,
+            start_new_session=True,
+        )
+        if result.returncode != 0:
+            return error
+        value = json.loads(result.stdout)
+        if not isinstance(value, dict) or value.get("schema") != "egregore.capability-query/v1" or value.get("execution_authority") is not False:
+            return error
+        return result.stdout.strip()
+    except (OSError, ValueError, TypeError, UnicodeError, RecursionError, RuntimeError, subprocess.TimeoutExpired):
+        return error
+
+
+def capabilities_list() -> str:
+    """Read this Prime installation's capability evidence; grants no authority."""
+    return _discover_capabilities({"operation": "capabilities.list"})
+
+
+def capabilities_find(query: str) -> str:
+    """Find declared capabilities; installation and permissions stay separate."""
+    return _discover_capabilities({"operation": "capabilities.find", "query": query})
+
+
+def capabilities_describe(identifier: str) -> str:
+    return _discover_capabilities({"operation": "capabilities.describe", "id": identifier})
+
+
+def capabilities_explain(identifier: str) -> str:
+    return _discover_capabilities({"operation": "capabilities.explain", "id": identifier})
+
+
+def system_explain(identifier: str | None = None) -> str:
+    request = {"operation": "system.explain"}
+    if identifier is not None:
+        request["id"] = identifier
+    return _discover_capabilities(request)

package/runtime/prime/.prime/agent/spec-manifest.json

@@ -1,8 +1,8 @@
 {
   "generatedBy": "bin/prime-render-spec.mjs",
   "source": "AGENTS.md generated Codex spec",
-  "sourceHash": "4d6f571881d7",
-  "outputHash": "a05b9fb3f618",
+  "sourceHash": "ef36766dfa7a",
+  "outputHash": "5fe962c7f721",
   "adaptations": [
     "Prime Agent APPEND_SYSTEM delivery from .prime/agent/",
     "Prime Agent tool_call branch gate incl. ipython classification",