create-egregore 0.21.6 → 0.22.0

package/runtime/claude/bin/boundary-hook.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+# boundary-hook.sh — runtime-neutral PreToolUse entry for the instance wall.
+# Usage: boundary-hook.sh claude|codex   (hook JSON on stdin)
+# Claude Code reaches it through .claude/hooks/boundary-check.sh, Codex
+# through .codex/hooks.json. The policy lives in bin/boundary-guard.cjs; this
+# file only starts it and keeps the exit contract: 0 allows, 2 blocks with the
+# reason on stderr. A hook host treats any other status as a non-blocking
+# error, so every failure to start or finish the check becomes a denial here.
+
+deny() {
+  echo "Environment isolation: the boundary check could not run ($1), so this action is blocked. Ask the user to install Node 22 or run /update, then restart the session." >&2
+  exit 2
+}
+
+missing() {
+  echo "Environment isolation: boundary guard missing ($1) — run /update, then restart the session. Every action is blocked until the guard is back." >&2
+  exit 2
+}
+
+BIN_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" || deny "its directory cannot be resolved"
+ROOT="$(dirname "$BIN_DIR")"
+GUARD="$BIN_DIR/boundary-guard.cjs"
+case "${1:-claude}" in
+  codex) PROJECT_DIR="${EGREGORE_CODEX_PROJECT_DIR:-$ROOT}" ;;
+  *) PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$ROOT}" ;;
+esac
+[ -f "$GUARD" ] || missing "bin/boundary-guard.cjs"
+
+NODE_BIN="$(command -v node 2>/dev/null || true)"
+if [ -z "$NODE_BIN" ] && [ -f "$BIN_DIR/node-run.sh" ]; then
+  NODE_BIN="$(bash "$BIN_DIR/node-run.sh" -e 'process.stdout.write(process.execPath)' 2>/dev/null || true)"
+fi
+[ -n "$NODE_BIN" ] || deny "Node is missing"
+
+# The check runs with no inherited Node options: a preload cannot replace it.
+env -u NODE_OPTIONS "$NODE_BIN" "$GUARD" --project-dir "$PROJECT_DIR"
+status=$?
+case "$status" in
+  0|2) exit "$status" ;;
+  *) deny "it exited with status $status" ;;
+esac

package/runtime/claude/bin/boundary.sh

@@ -23,41 +23,17 @@ if [[ "${1:-}" == "--help" || "${1:-}" == "-h" ]]; then
 fi
 
 SCRIPT_DIR="$(cd "$(dirname "$0")/.." && pwd)"
-
-# --- Load boundary file ---
-# Boundary file is written by session-start.sh at /tmp/egregore-boundary-{hash}.json
-# Hash is md5 of the project directory path for uniqueness
-load_boundary() {
-  local hash
-  hash=$(echo -n "$SCRIPT_DIR" | md5 2>/dev/null || echo -n "$SCRIPT_DIR" | md5sum 2>/dev/null | cut -d' ' -f1)
-  BOUNDARY_FILE="/tmp/egregore-boundary-${hash}.json"
-
-  if [ ! -f "$BOUNDARY_FILE" ]; then
-    # No boundary file — fall back to project dir only
-    PROJECT_DIR="$SCRIPT_DIR"
-    MEMORY_DIR=""
-    MANAGED_REPOS=""
-    DENIED_PATHS=""
-    return
-  fi
-
-  PROJECT_DIR=$(jq -r '.project_dir // empty' "$BOUNDARY_FILE" 2>/dev/null)
-  MEMORY_DIR=$(jq -r '.memory_dir // empty' "$BOUNDARY_FILE" 2>/dev/null)
-  MANAGED_REPOS=$(jq -r '.managed_repos[]? // empty' "$BOUNDARY_FILE" 2>/dev/null)
-  DENIED_PATHS=$(jq -r '.denied_paths[]? // empty' "$BOUNDARY_FILE" 2>/dev/null)
-}
-
-# --- Resolve path to absolute ---
-resolve_path() {
-  local path="$1"
-  # Expand ~ to $HOME
-  path="${path/#\~/$HOME}"
-  # Resolve to absolute
-  if [[ "$path" != /* ]]; then
-    path="$SCRIPT_DIR/$path"
+# The isolation policy (boundary cache, instance identity, core boundary, hard
+# tier) has one implementation, shared by every runtime's pre-action check:
+# bin/boundary-guard.cjs. `check` and `compute-denied` delegate to it.
+GUARD="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/boundary-guard.cjs"
+
+guard() {
+  if [ ! -f "$GUARD" ]; then
+    echo "boundary.sh: $GUARD is missing" >&2
+    return 1
   fi
-  # Resolve symlinks and ../ components
-  realpath "$path" 2>/dev/null || echo "$path"
+  bash "$(dirname "$GUARD")/node-run.sh" "$GUARD" "$@"
 }
 
 # --- Check if path is within an allowed directory ---
@@ -67,91 +43,6 @@ path_starts_with() {
   [[ "$path" == "$prefix" || "$path" == "$prefix/"* ]]
 }
 
-# --- Is a resolved path covered by a denied entry? ---
-# Self-scope carve-out, per entry: an ENCLOSING denied checkout (different or
-# unproven organization identity) never covers the project's own files — the
-# enclosing tree stays denied while the project stays usable. A denied entry
-# nested INSIDE the project is still enforced: residence under the project
-# proves nothing about identity.
-denied_covers() {
-  local resolved="$1" denied
-  local in_project=1
-  if [ -n "${PROJECT_DIR:-}" ] && path_starts_with "$resolved" "$PROJECT_DIR"; then
-    in_project=0
-  fi
-  for denied in $DENIED_PATHS; do
-    if path_starts_with "$resolved" "$denied"; then
-      if [ "$in_project" = "0" ] && path_starts_with "$PROJECT_DIR" "$denied"; then
-        continue
-      fi
-      echo "$denied"
-      return 0
-    fi
-  done
-  return 1
-}
-
-# --- MODE: check <path> ---
-check_path() {
-  local target="$1"
-  local resolved
-  resolved=$(resolve_path "$target")
-
-  load_boundary
-
-  # Always-allowed system paths
-  if path_starts_with "$resolved" "/tmp"; then return 0; fi
-  if path_starts_with "$resolved" "$HOME/.claude"; then return 0; fi
-  if path_starts_with "$resolved" "/usr"; then return 0; fi
-  if path_starts_with "$resolved" "/etc"; then return 0; fi
-  if path_starts_with "$resolved" "/var"; then return 0; fi
-  if path_starts_with "$resolved" "/bin"; then return 0; fi
-  if path_starts_with "$resolved" "/sbin"; then return 0; fi
-  if path_starts_with "$resolved" "/opt"; then return 0; fi
-
-  # Explicitly denied paths (other instances) — per-entry self-scope carve-out
-  local covering
-  if covering=$(denied_covers "$resolved"); then
-    echo "BLOCKED: $resolved is inside another Egregore instance ($covering)"
-    return 1
-  fi
-
-  # Allow instance registry (read-only, needed for multi-instance features)
-  if path_starts_with "$resolved" "$HOME/.egregore"; then
-    return 0
-  fi
-
-  # Allowed: project directory
-  if [ -n "$PROJECT_DIR" ] && path_starts_with "$resolved" "$PROJECT_DIR"; then
-    return 0
-  fi
-
-  # Allowed: memory directory (resolved symlink target)
-  if [ -n "$MEMORY_DIR" ] && path_starts_with "$resolved" "$MEMORY_DIR"; then
-    return 0
-  fi
-
-  # Allowed: managed repos
-  for repo_path in $MANAGED_REPOS; do
-    if path_starts_with "$resolved" "$repo_path"; then
-      return 0
-    fi
-  done
-
-  # Allowed: parent directory (for sibling repo operations like git clone)
-  local parent_dir
-  parent_dir="$(dirname "$PROJECT_DIR")"
-  if path_starts_with "$resolved" "$parent_dir"; then
-    # But NOT if it resolves into a denied path (denied_covers already ran
-    # above and returns first, so reaching here means no covering entry)
-    return 0
-  fi
-
-  # Default: block
-  echo "BLOCKED: $resolved is outside the session boundary"
-  return 1
-}
-
 # --- MODE: validate-repos ---
 validate_repos() {
   local config="$SCRIPT_DIR/egregore.json"
@@ -193,40 +84,6 @@ validate_repos() {
   return $exit_code
 }
 
-# --- MODE: compute-denied <registry> <project_dir> [org_id] [allow_path] ---
-# Emits the denied_paths JSON array for a session boundary: every registered
-# instance not proven to share this project's identity. An entry is excluded
-# only when one of these proofs holds:
-#   - it IS the project (.path == project_dir)
-#   - caller-proven same instance: .path == allow_path, passed only when the
-#     caller holds a stronger proof (worktree-create passes the enclosing repo
-#     whose git dir this worktree physically shares)
-#   - registry-proven same organization: both the project's org_id and the
-#     entry's org_id are present and equal
-# No path relationship proves identity: not ancestry, not residence under the
-# project's own .claude/worktrees (legitimate task worktrees are covered by
-# matching org_id or the caller-proven allowance), and a slug is presentation,
-# not identity. Entries with a different or missing org_id stay denied (fail
-# closed) — the enforcement layers' self-scope carve-out keeps a nested
-# project usable while its unproven enclosing tree stays denied, and a denied
-# entry nested inside the project is still enforced.
-compute_denied() {
-  local registry="$1" project_dir="$2" org_id="${3:-}" allow_path="${4:-}"
-  if [ ! -f "$registry" ]; then
-    echo "[]"
-    return 0
-  fi
-  jq --arg self "$project_dir" \
-     --arg org "$org_id" \
-     --arg allow "$allow_path" \
-    '[.[]
-      | select(.path != $self)
-      | select(if $allow == "" then true else (.path != $allow) end)
-      | select(if $org == "" then true else ((.org_id // "") != $org) end)
-      | .path]' \
-    "$registry" 2>/dev/null || echo "[]"
-}
-
 # --- Main ---
 case "${1:-}" in
   check)
@@ -234,17 +91,20 @@ case "${1:-}" in
       echo "Usage: boundary.sh check <path>"
       exit 1
     fi
-    check_path "$2"
+    guard check "$2" --project-dir "$SCRIPT_DIR"
     ;;
   validate-repos)
     validate_repos
     ;;
   compute-denied)
+    # Every registered instance not proven to share <project_dir>'s identity
+    # (computeDenied in bin/boundary-guard.cjs). Exits 1 when the registry
+    # exists but cannot be read: callers fail closed, never read it as [].
     if [ -z "${2:-}" ] || [ -z "${3:-}" ]; then
       echo "Usage: boundary.sh compute-denied <registry> <project_dir> [org_id] [allow_path]"
       exit 1
     fi
-    compute_denied "$2" "$3" "${4:-}" "${5:-}"
+    guard compute-denied "$2" "$3" "${4:-}" "${5:-}"
     ;;
   *)
     echo "Usage: boundary.sh {check <path>|validate-repos|compute-denied <registry> <project_dir> [org_id] [allow_path]}"

package/runtime/claude/bin/capture-run.sh

@@ -60,7 +60,7 @@ Usage:
   capture-run.sh --mode personal|baseline --author HANDLE --topic TOPIC
     --summary SUMMARY [--session-id ID] [--branch BRANCH] [--date ISO]
     [--duration TEXT] [--open-threads-json JSON] [--no-push]
-    [--async-push] [--no-reconcile] < details.md
+    [--async-push] [--no-reconcile] [--replace-session] < details.md
 EOF
 }
 
@@ -139,6 +139,11 @@ OPEN_THREADS_JSON="[]"
 NO_PUSH=0
 ASYNC_PUSH=0
 NO_RECONCILE=0
+REPLACE_SESSION=0
+RECORD_METADATA=""
+RECORD_ROOT="$SCRIPT_DIR"
+RECORD_FOLDER=""
+RECORD_STAGING=""
 
 while [ $# -gt 0 ]; do
   case "$1" in
@@ -154,11 +159,32 @@ while [ $# -gt 0 ]; do
     --no-push) NO_PUSH=1; shift ;;
     --async-push) ASYNC_PUSH=1; shift ;;
     --no-reconcile) NO_RECONCILE=1; shift ;;
+    --replace-session) REPLACE_SESSION=1; shift ;;
+    --record-metadata) RECORD_METADATA="${2:-}"; shift 2 ;;
+    --project-root) RECORD_ROOT="${2:-}"; shift 2 ;;
+    --record-folder) RECORD_FOLDER="${2:-}"; shift 2 ;;
+    --staging) RECORD_STAGING="${2:-}"; shift 2 ;;
     --no-index|--no-publish|--no-notify) shift ;; # addressed-only compatibility flags
     *) echo "Unknown capture option: $1" >&2; exit 1 ;;
   esac
 done
 
+# Session records use the same capture entry point with an isolated writer.
+# Replacement, revision guards, staging, and the canonical memory lock apply
+# only to this path; checkpoint records write files without committing.
+if [ "$REPLACE_SESSION" = "1" ] && [ "$CAPTURE_MODE" = "baseline" ]; then
+  RECORD_ARGS=(capture --root "$RECORD_ROOT")
+  if [ -n "$RECORD_METADATA" ]; then
+    RECORD_ARGS+=(--data "$RECORD_METADATA")
+  else
+    RECORD_ARGS+=(--author "$AUTHOR" --topic "$TOPIC" --summary "$SUMMARY"
+      --session-id "$SESSION_ID" --branch "$BRANCH" --date "$CAPTURE_DATE" --duration "$DURATION")
+  fi
+  [ -z "$RECORD_FOLDER" ] || RECORD_ARGS+=("--folder=$RECORD_FOLDER")
+  [ -z "$RECORD_STAGING" ] || RECORD_ARGS+=(--staging "$RECORD_STAGING")
+  exec python3 "$SCRIPT_DIR/bin/lib/session_record.py" "${RECORD_ARGS[@]}"
+fi
+
 AUTHOR="$(printf '%s' "$AUTHOR" | tr -cd 'a-zA-Z0-9_-')"
 [ -n "$AUTHOR" ] || { echo "Missing --author" >&2; exit 1; }
 [ -n "$TOPIC" ] || { echo "Missing --topic" >&2; exit 1; }
@@ -253,7 +279,11 @@ memory_save() {
       local _
       for _ in 1 2 3; do
         git pull --rebase origin main --quiet >/dev/null 2>&1 || true
-        git push origin main --quiet >/dev/null 2>&1 && exit 0
+        if bash "$SCRIPT_DIR/bin/memory-push.sh" --repository "$SCRIPT_DIR/memory" --branch main >/dev/null 2>&1; then
+          exit 0
+        else
+          case "$?" in 75) ;; *) exit 1 ;; esac
+        fi
         sleep 1
       done
       exit 1

package/runtime/claude/bin/codex-render-spec.mjs

@@ -80,12 +80,9 @@ formats: \`docs/AGENT-PROTOCOL.md\`. Follow the generated contract below.
 
 Internal handoffs use \`bin/agent.sh handoff\` (\`memory/handoffs/\` + index,
 via \`bin/handoff-run.sh\`). External capsules use \`egregore-emissary\`.
-Never use deprecated \`egregore-handoff\` for internal handoffs.
-
-## Compatibility
-
-Claude Code follows \`CLAUDE.md\`; other shell agents use the generated
-contract below. All runtimes share canonical memory.`;
+Never use deprecated \`egregore-handoff\` for internal handoffs.`;
+// A "Compatibility" section used to restate the precedence guard above; it was
+// dropped (2026-09) to keep AGENTS.md inside the 32 KiB budget.
 
 function sha(text) {
   return crypto.createHash('sha256').update(text).digest('hex').slice(0, 12);
@@ -130,18 +127,8 @@ attribution line alone. Never re-print ranked results or raw JSON.`;
 const SHELL_PACKET_NOTE = `Search output is model-internal: show only the retrieval line and receipts —
 never ranked blocks, file/rank/excerpt metadata, or raw JSON.`;
 
-// The Command Awareness lifecycle bullet is Claude-surface routing prose; on
-// Codex the same typed-lookup routing arrives through the shared hook
-// contract, and the 32 KiB project-doc budget has no room to restate it.
-// Decided 2026-09: drop the bullet from the render rather than ship a stale
-// hand-reverted AGENTS.md.
-const CLAUDE_LIFECYCLE_BULLET_PREFIX = '- Exact lifecycle questions (';
-
 function transformSearchHygiene(body) {
   return body
-    .split('\n')
-    .filter((line) => !line.startsWith(CLAUDE_LIFECYCLE_BULLET_PREFIX))
-    .join('\n')
     .replaceAll(CLAUDE_PACKET_NOTE, SHELL_PACKET_NOTE)
     .replace(/(\bbin\/search\.sh[^\n]*?) --context-packet\b/g, '$1');
 }
@@ -209,25 +196,7 @@ For continued project work: **continuation intent → prior workspace → restor
 
 ### Handoff claiming
 
-If \`addressed_to_user\` handoffs exist and the user is picking one up, create the IMPLEMENTS link after branch creation:
-\`\`\`bash
-bash bin/graph-op.sh claim-handoff "$SESSION_ID" "$HANDOFF_SESSION_ID" 2>/dev/null &
-\`\`\`
-
-**Auto-checkout repos from handoff**: after claiming, if \`addressed_rich\` carries a non-empty \`repoState\`, check out each entry's branch in its managed repo:
-
-\`\`\`bash
-PARENT_DIR="$(cd .. && pwd)"
-# For each entry in repoState:
-REPO_DIR="$PARENT_DIR/$REPO_NAME"
-if [ -d "$REPO_DIR/.git" ] || [ -f "$REPO_DIR/.git" ]; then
-  git -C "$REPO_DIR" fetch origin "$BRANCH" --quiet 2>/dev/null
-  git -C "$REPO_DIR" checkout "$BRANCH" 2>/dev/null || \\
-    git -C "$REPO_DIR" checkout -b "$BRANCH" "origin/$BRANCH" 2>/dev/null
-fi
-\`\`\`
-
-Report \`✓ Checked out {branch} in {repo1}, {repo2}\`; for a merged-away branch, \`◐ {repo}: PR #{N} merged — on {base}\`. If \`repoState\` is absent or empty, skip silently.
+When the user picks up a handoff addressed to them, follow \`.claude/context/handoff-claiming.md\` after branch creation: it claims the handoff and checks out the branches its \`repoState\` names in each managed repo.
 
 **Exceptions** — skip branching when the user explicitly created or named a branch themselves, or the intent continues the current working branch's topic.
 
@@ -262,7 +231,9 @@ only for dependencies. Deletion needs no rewrite unless purging secrets.
 
 If the startup card output contains \`onboarding_needed\`, invoke the \`$onboarding\` skill instead of greeting.`;
 
-const COMMAND_AWARENESS_PREPEND = `Codex reserves leading \`/\` for built-ins. Invoke Egregore skills with \`$name\` or natural language ("show activity", "make a handoff"). Every framework workflow uses a generated adapter that names its one maintained body under \`.claude/skills/\`. Organization-owned skills may also provide full native implementations. \`$save\` covers committing, pushing, pull requests, and memory sync; users need not manage Git themselves.`;
+const COMMAND_AWARENESS_PREPEND = `Codex reserves leading \`/\` for built-ins. Invoke Egregore skills with \`$name\` or natural language ("show activity", "make a handoff"). Every framework workflow uses a generated adapter that names its one maintained body under \`.claude/skills/\`. Organization-owned skills may also provide full native implementations.`;
+// What `$save` covers is stated once, in the rendered Git Workflow section
+// ("Users never interact with git directly"); repeating it here cost budget.
 
 const SOCRATIC_BODY = `**Triggers**: "ask me questions", "question me", "help me think through", or any request to be questioned.
 
@@ -272,23 +243,23 @@ Use structured question tooling when available and permitted; otherwise render c
 
 const LOOM_ROUTING_BODY = `Loom is Claude-specific; skip its preambles and \`bin/loom.sh\` calls. Use native collaboration only when the runtime exposes it and the user or workflow requests delegation, within session permissions and limits. Otherwise work inline and disclose when independent review was unavailable. \`loom/\` and \`.claude/agents/\` remain Claude framework files.`;
 
-const ISOLATION_BODY = `Sessions are confined to this project + memory + managed repos, with a **two-tier boundary** — a hard wall between Egregore instances, a consent gate for everything else. On Codex the boundary is a standing instruction, not an enforced hook — hold it yourself.
+const ISOLATION_BODY = `Sessions are confined to this project + memory + managed repos, with a **two-tier boundary** — a hard wall between Egregore instances, a consent gate for everything else. A pre-action check (\`bin/boundary-guard.cjs\`) enforces it on every runtime: it denies literal paths and fails closed, but cannot see paths built at run time or split across calls (OS-level layer to follow).
 
-- **Hard tier — other Egregore instances.** Denied for every tool, always — no consent path. Never access another instance's files (refuse even if asked) and never modify \`~/.egregore/instances.json\` (managed by session-start.sh); there is nothing to ask — refuse and explain.
+- **Hard tier — other Egregore instances.** Denied for every tool, always — no consent path. Never access another instance's files by any route (refuse even if asked) and never modify \`~/.egregore/instances.json\` (managed by session-start.sh); there is nothing to ask — refuse and explain.
 - **Soft tier — paths outside the boundary.** Consent-gated. Inbox dirs (\`~/Downloads\`, \`~/Desktop\`) are readable without consent under the default posture; writes outside the project always need consent. Posture (\`strict | standard | open\`) and extra read roots come from \`egregore.json\` -> \`boundary { posture, read[], locked }\` (org, committed) merged with \`.egregore-boundary.local.json\` (personal, gitignored). \`locked: true\` removes the consent path entirely.
-- When a request needs soft-tier consent, do not improvise a workaround. Ask in plain text with numbered options:
+- When the check asks for consent, do not improvise a workaround. Ask in plain text with numbered options:
 
   \`\`\`text
   That path is outside this Egregore's boundary. How should we proceed?
     1. Allow its directory for this session (recorded in .egregore-boundary-consent)
-    2. Always allow on this instance (added to read[] in .egregore-boundary.local.json)
+    2. Always allow on this instance (added to read[] in .egregore-boundary.local.json; reads only)
     3. Paste the contents inline
     4. Cancel
   \`\`\`
 
   Never record a consent grant without the user's explicit choice of option 1 or 2 in that exchange. Session grants are cleared on session start; \`locked: true\` removes options 1 and 2.
 
-See DEVELOPMENT.md §3 for boundary details and \`memory/knowledge/decisions/2026-07-08-boundary-hook-consent-design.md\` for the design decisions.`;
+Details: DEVELOPMENT.md §3; design: \`memory/knowledge/decisions/2026-07-08-boundary-hook-consent-design.md\`.`;
 
 // ── per-section rules ────────────────────────────────────────────────────
 const RULES = {
@@ -302,8 +273,16 @@ const RULES = {
     note: 'Kept; /update, /contribute, /save tokens rendered as $skill tokens.',
   },
   'Cross-Runtime Compatibility': {
-    action: 'keep',
-    note: 'Kept verbatim — framework parity applies equally to Claude Code, Codex, and Pi.',
+    action: 'replace',
+    body: `Share \`bin/\` mechanics through thin Claude/Codex/Pi/Prime adapters. Startup,
+lifecycle, capture, skill and command changes require tracing every runtime,
+parity tests and regenerated specs/bundles before completion.
+
+Discover via \`bash bin/spirit-discovery-codex.sh capabilities.list\` (Pi/Prime:
+registered tool). Follow \`docs/spirit-discovery.md\`: keep seven facets separate;
+generic shell needs one snapshot. Discovery reads code/install evidence, not
+memory, and grants no authority.`,
+    note: 'Compact translation preserves shared mechanics, thin adapters, every-runtime tracing/parity and regeneration, and neutral discovery without authority. Full query/facet and fixed-adapter details remain in shipped docs/spirit-discovery.md. Fits the 32 KiB project-doc budget.',
   },
   'Voice': {
     action: 'keep',
@@ -317,7 +296,7 @@ const RULES = {
   'Before Project Changes — WORKING BRANCH': {
     action: 'replace',
     body: AFTER_GREETING_BODY,
-    note: 'EnterWorktree -> bin/agent.sh branch with git checkout fallback; AskUserQuestion -> numbered options in plain text; branch-guard mapped to .codex/hooks/branch-guard.js with instruction fallback; plan-mode note dropped (no plan mode on Codex); /branch + /onboarding -> skill tokens. Handoff claiming and repoState auto-checkout bash kept verbatim (pure git); surrounding prose compressed 2026-08 for the 32 KiB budget, every rule retained.',
+    note: 'EnterWorktree -> bin/agent.sh branch with git checkout fallback; AskUserQuestion -> numbered options in plain text; branch-guard mapped to .codex/hooks/branch-guard.js with instruction fallback; plan-mode note dropped (no plan mode on Codex); /branch + /onboarding -> skill tokens. Handoff claiming points to the shared .claude/context/handoff-claiming.md procedure; surrounding prose compressed 2026-08 for the 32 KiB budget, every rule retained.',
   },
   'Config Files': { action: 'keep', note: 'Kept verbatim — shell facts, runtime-neutral.' },
   'Optional Knowledge Graph Projection': {
@@ -338,7 +317,6 @@ const RULES = {
     action: 'keep',
     note: 'Kept; slash tokens rendered as $skill tokens. Branch diagram unchanged (code fence).',
   },
-  'Working Conventions': { action: 'keep', note: 'Kept verbatim.' },
   'Command Awareness': {
     action: 'keep',
     prepend: COMMAND_AWARENESS_PREPEND,
@@ -354,7 +332,7 @@ const RULES = {
   'Environment Isolation': {
     action: 'replace',
     body: ISOLATION_BODY,
-    note: 'boundary-check is a Claude PreToolUse hook with no .codex equivalent — two-tier model stated as a standing instruction; AskUserQuestion remediation -> numbered options, now including the two consent-grant options (session grant -> .egregore-boundary-consent, instance grant -> .egregore-boundary.local.json read[]).',
+    note: 'The boundary policy is shared (bin/boundary-guard.cjs): Claude (boundary-check.sh) and Codex (.codex/hooks.json) run it through bin/boundary-hook.sh (PreToolUse), Pi and Prime from their tool_call gate. AskUserQuestion remediation -> numbered options, including the two consent-grant options (session grant -> .egregore-boundary-consent, instance grant -> .egregore-boundary.local.json read[], reads only).',
   },
 };
 

package/runtime/claude/bin/codex-session-start.sh

@@ -26,6 +26,16 @@ rm -f "$SCRIPT_DIR/.egregore-branch-consent" "$MAIN_PROJECT_DIR/.egregore-branch
 rm -f "$SCRIPT_DIR/.egregore-boundary-consent" "$MAIN_PROJECT_DIR/.egregore-boundary-consent" 2>/dev/null
 # Prune abandoned scratch without blocking startup or fresh sibling work.
 ( bash "$SCRIPT_DIR/bin/scratch-sweep.sh" --older-than 60 >/dev/null 2>&1 & ) 2>/dev/null
+# Compute the session boundary the pre-action checks read (Codex hook, Pi and
+# Prime tool_call gate) — the same shared computation Claude's SessionStart
+# runs. If it fails, the checks recompute it themselves instead of failing open.
+bash "$SCRIPT_DIR/bin/node-run.sh" "$SCRIPT_DIR/bin/boundary-guard.cjs" write-cache "$SCRIPT_DIR" >/dev/null 2>&1 || true
+# Registry maintenance shared with Claude's SessionStart: drop entries that are
+# another instance's runtime state (bin/lib/instance-registry.sh).
+if command -v jq >/dev/null 2>&1 && [ -f "$SCRIPT_DIR/bin/lib/instance-registry.sh" ]; then
+  ( ( source "$SCRIPT_DIR/bin/lib/instance-registry.sh" \
+      && egregore_registry_prune "$HOME/.egregore/instances.json" ) >/dev/null 2>&1 & ) 2>/dev/null || true
+fi
 
 if [ -f "$SCRIPT_DIR/bin/lib/worktree-links.sh" ]; then
   source "$SCRIPT_DIR/bin/lib/worktree-links.sh" >/dev/null 2>/dev/null || true
@@ -77,7 +87,12 @@ if [ "$LOCAL_MODE" != "true" ]; then
   fi
 fi
 
+source "$SCRIPT_DIR/bin/lib/startup-restart.sh"
+_STARTUP_HEAD=$(egregore_startup_head)
 source "$SCRIPT_DIR/bin/lib/git-sync.sh" >/dev/null 2>/dev/null
+# A sync that pulled a newer startup finishes on it (bin/lib/startup-restart.sh).
+egregore_startup_restart "$_STARTUP_HEAD" "$SCRIPT_DIR/bin/codex-session-start.sh" "$@"
+unset _STARTUP_HEAD
 source "$SCRIPT_DIR/bin/lib/health-footer.sh"
 source "$SCRIPT_DIR/bin/lib/notices.sh"
 _notice_init
@@ -237,6 +252,10 @@ render_card() {
 case "${1:---card}" in
   --card|card)
     render_card
+    EGREGORE_GREETING_RECORDS_ONLY=1 source "$SCRIPT_DIR/bin/lib/greeting.sh"
+    _print_session_records
+    EGREGORE_HARNESS="${EGREGORE_HARNESS:-codex}" _print_reflexes
+    ( bash "$SCRIPT_DIR/bin/session-record.sh" --mode sweep >/dev/null 2>&1 & ) 2>/dev/null
     ;;
   --prompt|prompt)
     native_tokens="$(bash "$SCRIPT_DIR/bin/codex-sync-skills.sh" --list-native | awk 'BEGIN { sep="" } NF { printf "%s$%s", sep, $0; sep=", " }')"

package/runtime/claude/bin/codex-skill-render.mjs

@@ -148,6 +148,20 @@ function classifyGraph(data, options = {}) {
   };
 }
 
+function spiritRows(data, personal = false) {
+  const rows = firstArray(data, personal ? ['my_spirit_records'] : ['spirit_records']);
+  if (!rows.length && !data.unsupported_native_records && !data.held_records?.length) return [];
+  const lines = [rule(), padLine('SPIRIT RECORDS')];
+  rows.slice(0, 5).forEach((row) => {
+    const state = row.state || {};
+    lines.push(padLine(`${row.producer_principal_id || 'spirit'} · ${state.execution || 'unknown'}`, `outcome ${state.outcome || 'unknown'}`));
+    lines.push(padLine(`verification ${state.verification || 'unknown'} · partial coverage`));
+  });
+  if (data.unsupported_native_records) lines.push(padLine(`${data.unsupported_native_records} unsupported records · metadata unavailable`));
+  if (data.held_records?.length) lines.push(padLine(`${data.held_records.length} held records · details withheld`));
+  return lines;
+}
+
 function renderActivity(data) {
   const graph = classifyGraph(data, { mode: data.mode || 'connected', attempt: 'retry' });
   const org = data.org || data.organization || 'Egregore';
@@ -219,6 +233,8 @@ function renderActivity(data) {
     });
   }
 
+  lines.push(...spiritRows(data));
+
   lines.push(rule());
   if (handoffs.length > 0) {
     lines.push(padLine('Handoff actions: done N · expire N · reopen N'));
@@ -305,6 +321,8 @@ function renderDashboard(data) {
     });
   }
 
+  lines.push(...spiritRows(data, true));
+
   lines.push(rule());
   const total = stats.totalSessions ?? data.local_sessions?.session_count ?? sessions.length;
   const wrapped = stats.wrappedSessions ?? sessions.filter((s) => valueOf(s, ['status', 'type'], '').includes('wrap')).length;

package/runtime/claude/bin/config-get.sh

@@ -4,6 +4,7 @@ set -euo pipefail
 unset GIT_DIR GIT_WORK_TREE GIT_INDEX_FILE GIT_OBJECT_DIRECTORY GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR
 
 # Print one configuration value for skill instructions to name and reuse.
+# api_url prints the address to send requests to (the saved one, resolved).
 # Present-but-empty and non-string values are unset; repo_name defaults to
 # egregore. The composed repo requires a nonempty string github_org.
 # Exit 0 = value printed (or unset), Exit 1 = invalid/unreadable configuration
@@ -35,7 +36,15 @@ fi
 
 case "$1" in
   mode) _detect_mode ;;
-  api_url|github_org|org_name|slug|memory_repo|upstream_url)
+  api_url)
+    # Skills send credentials to this address: never hand them the retired
+    # origin, or an address that is not plain (bin/lib/config.sh
+    # _hosted_api_url). A refused one prints nothing and fails, so the
+    # skill sends nothing.
+    value=$(_hosted_api_url "$(jq -r '.api_url | select(type == "string" and length > 0)' "$CONFIG")") || exit 1
+    if [ -n "$value" ]; then printf '%s\n' "$value"; fi
+    ;;
+  github_org|org_name|slug|memory_repo|upstream_url)
     value=$(jq -r --arg key "$1" '.[$key] | select(type == "string" and length > 0)' "$CONFIG")
     if [ -n "$value" ]; then printf '%s\n' "$value"; fi
     ;;

package/runtime/claude/bin/connect-refresh.sh

@@ -16,6 +16,22 @@ if [ "$MODE" != "connected" ] && [ -z "$API_URL" ]; then
   exit 0
 fi
 
+# The refresh runs whichever create-egregore npx has cached, which may be a
+# release from before the October 2026 security reset: it sends the org key
+# to the saved address exactly as written. Run it only when that address needs
+# no resolving, so it never reaches the retired origin or an address the
+# resolver refuses (bin/lib/config.sh). Those wait for /update, quietly.
+# shellcheck source=lib/config.sh
+source "$SCRIPT_DIR/lib/config.sh" 2>/dev/null || exit 0
+SAVED="$API_URL"
+SAVED="${SAVED#"${SAVED%%[![:space:]]*}"}"
+SAVED="${SAVED%"${SAVED##*[![:space:]]}"}"
+while [ "${SAVED%/}" != "$SAVED" ]; do SAVED="${SAVED%/}"; done
+RESOLVED="$(EGREGORE_ADDRESS_NOTICE=shown _hosted_api_url "$API_URL" 2>/dev/null)" || exit 0
+if [ -z "$RESOLVED" ] || [ "$RESOLVED" != "$SAVED" ]; then
+  exit 0
+fi
+
 LOG_DIR="$ROOT/.egregore"
 mkdir -p "$LOG_DIR" 2>/dev/null || true
 LOG="$LOG_DIR/connect-refresh.log"

package/runtime/claude/bin/corpus_map.py

@@ -799,6 +799,11 @@ def parser() -> argparse.ArgumentParser:
 
 def main() -> int:
     args = parser().parse_args()
+    root = Path(__file__).resolve().parent.parent
+    sys.path.insert(0, str(root))
+    from egregore_runtime.admin_entry import require_admin
+
+    require_admin("The corpus map", root)  # admin-only: it reads the corpus outside the predicate
     return args.func(args)