phronesis 1.0.0

package/templates/codex/seed/pm/scale-with-leaders-not-process.md

@@ -0,0 +1,38 @@
+---
+type: codex-principle-seed
+name: scale-with-leaders-not-process
+title: Scale with Leaders, Not Process
+created: 2026-06-24
+exposure: shareable
+stance: adopted
+provenance:
+  authored_by: seed
+---
+
+> **There are two ways to scale an organization — leaders or process. Process is easier, more
+> appealing, and almost always the wrong reach.**
+
+Heavy frameworks, elaborate governance, and layers of process promise to solve scaling with
+structure. What they reliably deliver is a feature factory: people confusing the act of
+managing a process with the act of creating value. The approach that actually produces good
+outcomes is slower and harder — developing leaders who can make judgment calls, coach their
+teams, and push decisions down to the people closest to the problem. Process feels safer than
+trusting humans, which is exactly why organizations keep reaching for it, and exactly why it
+keeps spreading.
+
+This isn't a claim that process is always wrong — some work genuinely needs reliability over
+creativity, and a checklist is the right tool for it. It's a claim about the *default reach*.
+The instinct, when scaling strains, is to add a ritual, a gate, a sync. The better move is
+usually to grow a leader whose judgment you can trust with the ambiguity instead.
+
+*Diagnostic: the next time a scaling problem tempts you toward a new process, ask whether you
+could solve it by developing a leader instead. If the honest answer is yes, the process is a
+substitute for judgment you haven't built yet.*
+
+*Source: Marty Cagan, citing Steve Jobs.*
+
+## Interview Prompt
+
+Where in your organization have you added process to paper over a scaling strain? Could that
+same problem have been solved by developing a leader's judgment instead — and what's stopping
+you from making that trade?

package/templates/codex/seed/pm/solution-discovery-over-problem-validation.md

@@ -0,0 +1,38 @@
+---
+type: codex-principle-seed
+name: solution-discovery-over-problem-validation
+title: Solution Discovery Beats Problem Validation
+created: 2026-06-24
+exposure: shareable
+stance: adopted
+provenance:
+  authored_by: seed
+---
+
+> **The problem is usually known; the solution is where you win or lose — so spend your
+> discovery there.**
+
+Teams over-invest in validating problems the organization already understands — weeks of
+interviews confirming "yes, this is a real problem" while the clock runs. But people don't buy
+the problem; they buy a solution. Many teams can solve the same known problem; the only
+question that matters is whether yours solves it better than the alternatives. That is
+solution discovery — prototyping, testing, iterating toward the version that actually wins —
+and it is consistently the underinvested half.
+
+The discipline has a counterintuitive edge: during discovery, go looking for every reason
+people *won't* use your solution, not for reasons they like it. A prototype test where
+everyone nods is not discovery; it is confirmation bias with extra steps. The fastest way to
+fool yourself is to seek validation; the fastest way to learn is to hunt for the
+disconfirming evidence that would kill the idea, then build the version that survives it.
+
+*Diagnostic: when you catch your team spending more time confirming a problem you already
+understand than exploring solutions to it, you're burning runway on a known answer. And when
+a round of research comes back all praise, ask what you would have had to do to surface the
+reasons people would walk away.*
+
+*Source: Marty Cagan.*
+
+## Interview Prompt
+
+When you test an idea, are you looking for reasons it will work or reasons it won't? Describe
+the last time you went hunting for the evidence that would kill one of your own ideas.

package/templates/codex/seed/pm/tenfold-better-on-a-painful-problem.md

@@ -0,0 +1,40 @@
+---
+type: codex-principle-seed
+name: tenfold-better-on-a-painful-problem
+title: Tenfold Better on a Painful Problem
+created: 2026-06-24
+exposure: shareable
+stance: adopted
+provenance:
+  authored_by: seed
+---
+
+> **A new offering must be a large multiple better on a problem that genuinely hurts — not a
+> marginal improvement on one people tolerate.**
+
+Weigh the value you deliver against the pain a customer goes through to adopt you — finding
+you, trying you, buying you, switching away from whatever they use now, and the ever-present
+option to just do nothing. Because betting on something new carries real risk for the buyer, a
+small edge doesn't clear the bar. As a rule of thumb the gain has to be roughly an order of
+magnitude — tenfold — before the math tips in your favor. Founders who fail in market are
+rarely wrong about the gain; they're wrong about the adoption pain they never honestly
+measured.
+
+This is why "faster, cheaper, better" is not a real position — those describe an increment the
+incumbent can close, not a breakthrough. And the multiple only matters if the underlying
+problem is a painkiller, not a vitamin: a blatant, critical need the customer already feels
+and will pay to make stop, not an aspirational nice-to-have they can postpone forever. Solve a
+tolerated problem a little better and the customer's honest answer is "interesting" — and then
+they do nothing.
+
+*Diagnostic: describe your edge in one sentence. If the best you can say is "faster, cheaper,
+better," you have an improvement, not a breakthrough — and you've probably underpriced what
+adoption really costs. Then ask whether the problem is one people actively try to make stop,
+or one they merely tolerate.*
+
+*Source: Michael Skok.*
+
+## Interview Prompt
+
+For the thing you're building, how much better is it than the real alternative — and is the
+problem it solves something people actively hurt from, or just mildly wish were better?

package/templates/codex-surface/README.md

@@ -0,0 +1,73 @@
+# Phronesis Codex Surface Adapter
+
+This directory is emitted as `domains/<slug>/.codex/` by `phronesis init`.
+It is the Codex Tier 1 surface adapter from change 0028 / core-0034, wired
+against `specs/hooks.md` "Surface adapters".
+
+## Purpose
+
+Codex native lifecycle hooks run the same Phronesis reinforcement scripts as
+Claude Code. The JSON config points each Codex event at a small launcher in
+`./hooks/`; each launcher resolves the installation root and hands off to the
+shared script under `<install>/.phronesis/hooks/`.
+
+Keep `hooks.json` schema-pure. Codex parses hook config strictly: unknown JSON
+fields are fatal at every level, and there is no JSON comment mechanism.
+Documentation belongs in this README or in script comments, never in
+`hooks.json`.
+
+## Root Resolution
+
+Codex has no `$CLAUDE_PROJECT_DIR` equivalent and runs hooks at the session
+working directory. Each launcher marks `PHRONESIS_SURFACE=codex`, resolves the
+installation root with `hooks/_resolve.sh`, then execs the matching shared
+script in `<install>/.phronesis/hooks/`.
+
+The resolver anchors on the launcher location first, then falls back to walking
+up to the nearest `.phronesis/` marker. That keeps the launcher tied to its own
+install even when the session cwd is a subdirectory or another install is nearby.
+
+## Open Target
+
+Open Codex at the domain workspace directory:
+
+```text
+<install>/domains/<slug>
+```
+
+Codex loads `.codex/` only from the opened directory. It does not walk up to a
+parent root, even when the parent is a git root. The 2026-06-21 spike confirmed
+that opening the install root leaves these hooks unloaded.
+
+## Trust Gates
+
+Codex has two trust gates:
+
+1. Trust the project `.codex/` layer.
+2. Enable each hook hash through CLI `/hooks` or the desktop app's
+   Settings -> Coding -> Hooks pane.
+
+Editing `hooks.json` or a launcher changes the hook hash and requires a new
+trust pass. A no-op `phronesis init` should re-emit byte-identical files, so it
+does not force a re-trust.
+
+## Wiring
+
+| Codex event | Launcher | Shared script | Output role |
+|---|---|---|---|
+| `SessionStart` | `.codex/hooks/session-start.sh` | `.phronesis/hooks/session-start.sh` | Due-check `additionalContext` |
+| `UserPromptSubmit` | `.codex/hooks/recall-guard.sh` | `.phronesis/hooks/recall-guard.sh` | Recall guard `additionalContext` |
+| `Stop` | `.codex/hooks/session-sweep.sh` | `.phronesis/hooks/session-sweep.sh` | Capture sweep `decision:block` plus `reason` |
+| `SubagentStop` | `.codex/hooks/session-sweep-subagent.sh` | `.phronesis/hooks/session-sweep.sh` | Subagent sweep variant |
+| `PreCompact` | `.codex/hooks/session-sweep-precompact.sh` | `.phronesis/hooks/session-sweep.sh` | Compaction reminder |
+
+The commands in `hooks.json` are bare relative paths with no arguments. The
+variant is baked into each launcher, so the wiring works whether Codex execs the
+command directly or through a shell.
+
+## Runtime-Free Degrade
+
+Every launcher exits cleanly with no output when no `phronesis` runtime is on
+`PATH` or when its target shared script is missing. That runtime-free no-op
+posture is part of change 0013: missing runtime means an honest gap, not a
+noisy hook failure.

package/templates/codex-surface/hooks/_resolve.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# Phronesis Codex launcher resolver — SOURCED by the .codex/hooks/*.sh launchers (change
+# 0028 / core-0034). Sets PHRONESIS_ROOT to the installation root, or `exit 0` (a clean
+# runtime-free / no-install degrade that the sourcing launcher inherits).
+#
+# Resolution anchors on THIS file's own emitted location — it ships at
+# <root>/domains/{slug}/.codex/hooks/_resolve.sh, a fixed FOUR levels under the install
+# root — so it is independent of the session cwd AND immune to a stray .phronesis/ ancestor
+# (a second checkout, or a domain workspace copied out of its install). A blind
+# walk-up-from-cwd would capture the wrong install in those cases. Only if that fixed anchor
+# does not resolve to an install (e.g. the open target was relocated to a different depth)
+# does it fall back to a nearest-.phronesis walk-up from cwd. The launcher still verifies the
+# target script before exec, so an incomplete install degrades to a clean no-op, never a
+# noisy `env: … No such file` (exit 127).
+command -v phronesis >/dev/null 2>&1 || exit 0
+
+# Bare ${BASH_SOURCE:-$0}, NOT the array-subscript "[0]" form: that subscript is a bashism that
+# dash (the `sh <path>` interpreter on Linux/CI) rejects with "Bad substitution", and this file
+# is SOURCED by a launcher that may itself be running under dash (core-0034 review #1, round 3).
+# Under bash, bare $BASH_SOURCE is array element 0 = THIS file's path (sourced-frame aware).
+# Under POSIX sh it is unset → $0, which in a sourced frame is the *launcher's* $0 — but the
+# launcher is co-located with this resolver in the same .codex/hooks/ dir, so `dirname` lands on
+# that dir either way, and the four-levels-up anchor below is identical.
+__src="${BASH_SOURCE:-$0}"
+__here="$(cd "$(dirname "$__src")" 2>/dev/null && pwd || true)"
+PHRONESIS_ROOT=""
+if [ -n "$__here" ]; then
+  __anchor="$(cd "$__here/../../../.." 2>/dev/null && pwd || true)"
+  if [ -n "$__anchor" ] && [ -d "$__anchor/.phronesis" ]; then PHRONESIS_ROOT="$__anchor"; fi
+fi
+if [ -z "$PHRONESIS_ROOT" ]; then
+  __d="$PWD"
+  while [ "$__d" != "/" ] && [ ! -d "$__d/.phronesis" ]; do __d="$(dirname "$__d")"; done
+  [ -d "$__d/.phronesis" ] && PHRONESIS_ROOT="$__d"
+fi
+[ -n "$PHRONESIS_ROOT" ] || exit 0

package/templates/codex-surface/hooks/recall-guard.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# Phronesis Codex surface launcher → recall-guard (UserPromptSubmit).
+#
+# Resolves the install root via the sibling _resolve.sh (sourced — it anchors on the
+# launcher's own emitted location, so it is cwd-independent and decoy-immune), then hands
+# the event off on stdin to the SHARED, surface-aware recall-guard.sh in
+# <install>/.phronesis/hooks/, marking PHRONESIS_SURFACE=codex. The .codex/hooks.json wires
+# this as a BARE no-arg command path (the variant flag, if any, is baked into the launcher),
+# so the wiring holds whether Codex execs directly or via a shell — one script set, branch
+# on surface (specs/hooks.md §"Surface adapters").
+#
+# Runtime-free / no-install / incomplete-install degrade (change 0013): exit 0, no output —
+# an honest gap, never a noisy error. _resolve.sh exits 0 when phronesis is off PATH or no
+# install resolves; the target-exists check below covers an incomplete install.
+# `set -u` only (no pipefail): no pipelines here, and `set -o pipefail` aborts noisily under
+# a strict POSIX /bin/sh if Codex execs the bare command via `sh <path>` (core-0034 review
+# #2). The exec'd shared script keeps its own bash shebang + pipefail.
+#
+# The source line below uses bare ${BASH_SOURCE:-$0} — NOT the array-subscript "[0]" form: that
+# subscript is a bashism that dash (the `sh <path>` interpreter on Linux/CI) rejects with "Bad
+# substitution" and exits 2 — BEFORE any degrade path — which would defeat the very POSIX-safety
+# the pipefail choice above buys (core-0034 review #1, round 3). Bare $BASH_SOURCE reads array
+# element 0 under bash and is an unset (→ $0) plain var under POSIX sh; both name THIS launcher,
+# and the launcher is co-located with _resolve.sh, so `dirname` lands on the hooks dir either way.
+set -u
+
+. "$(cd "$(dirname "${BASH_SOURCE:-$0}")" 2>/dev/null && pwd || echo /nonexistent)/_resolve.sh" 2>/dev/null || exit 0
+target="$PHRONESIS_ROOT/.phronesis/hooks/recall-guard.sh"
+[ -x "$target" ] || exit 0
+exec env PHRONESIS_SURFACE=codex PHRONESIS_DIR="$PHRONESIS_ROOT" "$target" "$@"

package/templates/codex-surface/hooks/session-start.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+# Phronesis Codex surface launcher → session-start due-check (SessionStart).
+#
+# Resolves the install root via the sibling _resolve.sh (sourced) and hands off to the
+# SHARED session-start.sh, which under PHRONESIS_SURFACE=codex wraps the due-check printout
+# in Codex's hookSpecificOutput.additionalContext shape. See recall-guard.sh for the
+# launcher rationale; see _resolve.sh for the cwd-independent, decoy-immune root resolution.
+#
+# Runtime-free / no-install / incomplete-install degrade (change 0013): exit 0, no output.
+# `set -u` only (no pipefail), and bare ${BASH_SOURCE:-$0} not the "[0]"-subscript form — both
+# keep this POSIX /bin/sh-safe (dash rejects the array subscript with "Bad substitution"); see
+# recall-guard.sh (core-0034 #2 / #1-round-3).
+set -u
+
+. "$(cd "$(dirname "${BASH_SOURCE:-$0}")" 2>/dev/null && pwd || echo /nonexistent)/_resolve.sh" 2>/dev/null || exit 0
+target="$PHRONESIS_ROOT/.phronesis/hooks/session-start.sh"
+[ -x "$target" ] || exit 0
+exec env PHRONESIS_SURFACE=codex PHRONESIS_DIR="$PHRONESIS_ROOT" "$target" "$@"

package/templates/codex-surface/hooks/session-sweep-precompact.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# Phronesis Codex surface launcher → pre-compaction capture reminder (PreCompact).
+#
+# The --advisory variant of the shared session-sweep.sh: it cannot block, so it surfaces a
+# best-effort "review the conversation for unstored context before it compacts" reminder.
+# Under PHRONESIS_SURFACE=codex the shared script emits the reminder as Codex's
+# {"systemMessage":...} (Claude Code takes the raw line). The variant flag is baked in here,
+# not passed through hooks.json, so the command path stays bare. See recall-guard.sh /
+# _resolve.sh for the launcher mechanics.
+#
+# Runtime-free / no-install / incomplete-install degrade (change 0013): exit 0, no output.
+# `set -u` only (no pipefail), and bare ${BASH_SOURCE:-$0} not the "[0]"-subscript form — both
+# keep this POSIX /bin/sh-safe (dash rejects the array subscript with "Bad substitution"); see
+# recall-guard.sh (core-0034 #2 / #1-round-3).
+set -u
+
+. "$(cd "$(dirname "${BASH_SOURCE:-$0}")" 2>/dev/null && pwd || echo /nonexistent)/_resolve.sh" 2>/dev/null || exit 0
+target="$PHRONESIS_ROOT/.phronesis/hooks/session-sweep.sh"
+[ -x "$target" ] || exit 0
+exec env PHRONESIS_SURFACE=codex PHRONESIS_DIR="$PHRONESIS_ROOT" "$target" --advisory "$@"

package/templates/codex-surface/hooks/session-sweep-subagent.sh

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# Phronesis Codex surface launcher → subagent-boundary sweep (SubagentStop).
+#
+# The --lifecycle-only variant of the shared session-sweep.sh: it skips the capture sweep
+# and only closes an open skill-lifecycle record for the subagent boundary. On Codex this is
+# presently inert — Codex mints no invocation_id (no UserPromptExpansion / matchable Skill
+# PreToolUse, so skill-lifecycle telemetry is Level-2 PARTIAL, change 0028 /
+# event-log.md §"Compliance levels") — so there is nothing to close. It is wired with the
+# SAME script Claude Code uses (not a Codex-specific path) so the boundary is handled
+# correctly if Codex later surfaces the lifecycle; it fabricates nothing meanwhile (emission
+# honesty, change 0021). The variant flag is baked in here, not passed through hooks.json, so
+# the command path stays bare. See recall-guard.sh / _resolve.sh for the launcher mechanics.
+#
+# Runtime-free / no-install / incomplete-install degrade (change 0013): exit 0, no output.
+# `set -u` only (no pipefail), and bare ${BASH_SOURCE:-$0} not the "[0]"-subscript form — both
+# keep this POSIX /bin/sh-safe (dash rejects the array subscript with "Bad substitution"); see
+# recall-guard.sh (core-0034 #2 / #1-round-3).
+set -u
+
+. "$(cd "$(dirname "${BASH_SOURCE:-$0}")" 2>/dev/null && pwd || echo /nonexistent)/_resolve.sh" 2>/dev/null || exit 0
+target="$PHRONESIS_ROOT/.phronesis/hooks/session-sweep.sh"
+[ -x "$target" ] || exit 0
+exec env PHRONESIS_SURFACE=codex PHRONESIS_DIR="$PHRONESIS_ROOT" "$target" --lifecycle-only "$@"

package/templates/codex-surface/hooks/session-sweep.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+# Phronesis Codex surface launcher → capture sweep (Stop).
+#
+# Resolves the install root via the sibling _resolve.sh (sourced) and hands the Stop event
+# off on stdin to the SHARED session-sweep.sh. The block-continue output
+# ({"decision":"block","reason":...}) and the stop_hook_active loop guard are identical
+# across Claude Code and Codex (spike 2026-06-21), so the shared script needs no Stop-path
+# branch. See recall-guard.sh for the launcher rationale; _resolve.sh for root resolution.
+#
+# Runtime-free / no-install / incomplete-install degrade (change 0013): exit 0, no output.
+# `set -u` only (no pipefail), and bare ${BASH_SOURCE:-$0} not the "[0]"-subscript form — both
+# keep this POSIX /bin/sh-safe (dash rejects the array subscript with "Bad substitution"); see
+# recall-guard.sh (core-0034 #2 / #1-round-3).
+set -u
+
+. "$(cd "$(dirname "${BASH_SOURCE:-$0}")" 2>/dev/null && pwd || echo /nonexistent)/_resolve.sh" 2>/dev/null || exit 0
+target="$PHRONESIS_ROOT/.phronesis/hooks/session-sweep.sh"
+[ -x "$target" ] || exit 0
+exec env PHRONESIS_SURFACE=codex PHRONESIS_DIR="$PHRONESIS_ROOT" "$target" "$@"

package/templates/codex-surface/hooks.json

@@ -0,0 +1,69 @@
+{
+  "hooks": {
+    "SessionStart": [
+      {
+        "matcher": "startup|resume",
+        "hooks": [
+          {
+            "type": "command",
+            "command": ".codex/hooks/session-start.sh",
+            "timeout": 30,
+            "statusMessage": "phronesis due-check"
+          }
+        ]
+      }
+    ],
+    "UserPromptSubmit": [
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "command": ".codex/hooks/recall-guard.sh",
+            "timeout": 30,
+            "statusMessage": "phronesis recall guard"
+          }
+        ]
+      }
+    ],
+    "Stop": [
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "command": ".codex/hooks/session-sweep.sh",
+            "timeout": 30,
+            "statusMessage": "phronesis capture sweep"
+          }
+        ]
+      }
+    ],
+    "SubagentStop": [
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "command": ".codex/hooks/session-sweep-subagent.sh",
+            "timeout": 30,
+            "statusMessage": "phronesis subagent sweep"
+          }
+        ]
+      }
+    ],
+    "PreCompact": [
+      {
+        "matcher": "",
+        "hooks": [
+          {
+            "type": "command",
+            "command": ".codex/hooks/session-sweep-precompact.sh",
+            "timeout": 30,
+            "statusMessage": "phronesis compaction reminder"
+          }
+        ]
+      }
+    ]
+  }
+}

package/templates/domains/pm/AGENTS.md

@@ -0,0 +1,111 @@
+# AGENTS.md — Phronesis PM door
+
+Canonical session spec for this domain workspace; `CLAUDE.md` and `.cursorrules`
+symlink to it. Keep it ≤8KB: pointers, not current state. If a rule keeps
+getting missed, prune this file or move the rule to a hook.
+
+**What Phronesis is.** One product: a phronesis-grounded Markdown workspace on
+the operator's disk. Per domain: `raw/` source + `compiled/` durable state.
+Shared across the install: `codex/`. Read the tiny always-loaded set, then pull
+on demand. This is the PM door. Language: "one product", "doors" /
+"configurations". Never "umbrella", "vertical", or "platform".
+
+## 1. Operator
+
+[Name], [Role]. Full profile and working preferences: `USER.md` (always read).
+
+## 2. Operating style
+
+- Bring everything the operator has met to bear on what's in front of them. That is the work.
+- Say only what the moment needs. Brevity is judgment, not speed.
+- The operator has told you this before. Find it before you make them say it twice.
+- If you have not read it, you do not know it. Cite what you read; assert no workspace claim you have not read.
+- When the workspace is silent on something it should hold, say so. An honest "nothing yet" beats a confident guess.
+- Catch what matters as it goes by. Don't halt the work to file it.
+- A framework can frame the call. It cannot make it. Read the situation, then decide.
+- Make the call from evidence. "No — and here's why" helps more than hedging.
+- Reach for what this turn needs, no more. The rest keeps.
+
+## 3. Session start
+
+1. **Always read:** this file, `USER.md`, `MEMORY.md`.
+2. **Read if present:** `memory/long-term.md`, today's `memory/YYYY-MM-DD.md`, the installation `codex/INDEX.md`, and the seed/personal codex articles the task calls for.
+3. **List, do not preload:** the generated domain index (if present), `compiled/people/` (door: stakeholders), `compiled/projects/`, `compiled/decisions/`.
+4. **Do not preload:** every stakeholder file, every decision file, the whole codex, or all skills. Pull each on trigger.
+
+## 4. Skills
+
+<!-- skills:begin -->
+| Skill | Directory | Triggers |
+|---|---|---|
+| _generated at init_ | | |
+<!-- skills:end -->
+
+## 5. Ambient behaviors
+
+These fire on cue, not on command. They are the felt presence.
+
+**Recall before advice.** On owned-context/advice prompts or known names/projects/decisions/commitments, search active-domain `compiled/` plus `codex/`, walk links, and lead with workspace truth. If nothing relevant exists, say so, answer generally, and consider capture. Never answer owned-context while the workspace sits unread.
+
+**Capture decisions.** When the operator settles a choice with a reason, catch it for `log_decision`. Do not make them stop and file.
+
+**Capture stakeholders.** When a person arrives with a preference, constraint, or relationship worth keeping, note a short quote plus source. New name: propose a `person` in `compiled/people/` via `enrich_person`; known name: enrich the existing one.
+
+**Surface the conflict.** When a forming decision rhymes with compiled history, pause with the prior decision or insight before commitment — only when the rhyme is real and stakes are live.
+
+**Catch incoming raw.** New material lands in `raw/`. Ingest, then compile through the gate into `compiled/`; untrusted sources stay draft until approval. Cross-linking one source across artifacts is the value.
+
+**Know when to hold.** Not every fact is worth catching, nor every echo worth raising. Do not count motion as progress; "ingested four threads, started eight loops" is noise.
+
+## 6. Mesh principle
+
+Every output feeds the next input. A session that touched real work leaves something true
+behind: a decision caught, a stakeholder understood a little better, a link that wasn't
+there before. Not a tally of edits — one true thing the next session can build on beats ten
+that only move state around. The workspace compounds on what's real, or it bloats on what
+isn't.
+
+## 7. File map
+
+```
+phronesis-installation/
+├── codex/                      Layer 3 · installation-shared, citable from every domain
+│   ├── INDEX.md                on-demand codex map
+│   ├── seed/                   immutable seeded principles
+│   └── personal/               operator-earned and adopted principles
+├── skills/                     installed engine + door skills
+├── .phronesis/                 runtime · hooks/ events/ evals/ connectors/ registry.json
+└── domains/
+    └── pm/                     this door — you are here
+        ├── AGENTS.md           this file · CLAUDE.md and .cursorrules symlink to it
+        ├── USER.md             operator profile · always read
+        ├── MEMORY.md           compound-memory index · always read
+        ├── raw/                Layer 1 · append-only source
+        │   ├── transcripts/ threads/ inbox/ meetings/
+        │   ├── research/       output of the research skill
+        │   └── {connector}/    one dir per active connector
+        ├── compiled/           Layer 2 · durable current state
+        │   ├── people/ projects/ decisions/
+        │   └── commitments/ insights/ organizations/
+        ├── memory/             session-scoped working notes
+        │   └── YYYY-MM-DD.md · long-term.md
+        └── exports/            disposable renders
+```
+
+## 8. Where state lives
+
+Pointers only; read sources for current truth.
+
+- Operator profile/preferences -> `USER.md`.
+- Memory index -> `MEMORY.md`; details live behind links.
+- People/organizations/projects/decisions/commitments/insights -> `compiled/{type-dir}/`. Door terms "stakeholder" and "competitor" are relationships on `person`/`organization`, never `type:`.
+- Claim sources -> `raw/`, cited from compiled objects.
+- Shared principles -> install `codex/` (`seed/` immutable, `personal/` earned); map: `codex/INDEX.md`.
+- Session notes -> `memory/YYYY-MM-DD.md`; durable notes -> `memory/long-term.md`.
+- Skill set/versions -> `.phronesis/registry.json`; triggers/bodies -> `skills/{name}/SKILL.md`; §4 projects both.
+- Hooks/events/connectors/config -> `.phronesis/`.
+- Disposable renders -> `exports/`; never source of truth, never round-trip edits through it.
+
+Do not summarize current state here. No active project, no default, no "this arena is
+empty". Stale always-loaded prose convinces the agent not to retrieve: the one failure
+this file exists to prevent.

package/templates/domains/pm/MEMORY.md

@@ -0,0 +1,7 @@
+# MEMORY — PM door
+
+Always-loaded compound-memory index. One line per remembered fact.
+Format: `- [Title](file.md) — one-line hook`. Detail lives in the linked file;
+this index is the always-loaded surface. Keep it ≤5KB — prune before it grows.
+
+<!-- Compound-memory writes append entries below, grouped by type slug. -->

package/templates/domains/pm/USER.md

@@ -0,0 +1,8 @@
+# USER — [Name]
+
+- Name: [Name]
+- Role: [Role]
+
+Operator profile. Minimal at init; onboarding (deferred) captures preferences,
+product context, and working style. Until then, ask before assuming — do not
+infer the operator's preferences from a blank profile.

package/templates/phronesis-hooks/compile-active-context.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# Phronesis post-compile hook (core-0017 H5): refresh a domain's active-context projection
+# (domains/{domain}/ACTIVE_CONTEXT.md) after a compile commits canonical state. Subscribes
+# to action_type.committed filtered to payload.action_type == compile; the V1 in-pipeline
+# executor fires it synchronously at the commit point (compile accept fires it too, since
+# acceptance emits the same committed event). The committed event arrives as JSON on stdin.
+#
+# It is a MUTATION hook (it writes the tracked projection) — a failure is audited but never
+# blocks the commit. Generated state is never a free-form action write (core-0016 review
+# finding #2), so the refresh runs through the deterministic generator, not a hand-edit.
+#
+# Runtime-free degrade (change 0013): with no phronesis on PATH this exits 0 silently — a
+# compile without the runtime simply leaves the projection for the next runtime pass; the
+# validate-time staleness check is the backstop that flags it stale meanwhile.
+set -uo pipefail
+
+command -v phronesis >/dev/null 2>&1 || exit 0
+
+input="$(cat || true)"
+# The committed payload.path is domains/{domain}/compiled/{type-dir}/{name}.md; the domain
+# is its second segment. node is present wherever phronesis is (the CLI runs on it), so
+# parse the JSON properly instead of regexing it.
+domain="$(printf '%s' "$input" | node -e '
+let d = "";
+process.stdin.on("data", (c) => (d += c)).on("end", () => {
+  try {
+    const ev = JSON.parse(d);
+    const p = String((ev && ev.payload && ev.payload.path) || "");
+    const parts = p.split("/");
+    process.stdout.write(parts[0] === "domains" && parts[1] ? parts[1] : "");
+  } catch {}
+});' 2>/dev/null)"
+[ -n "$domain" ] || exit 0
+
+# cwd is the install root (the executor sets it); --dir makes discovery explicit.
+phronesis active-context refresh --domain "$domain" --dir "$PWD" >/dev/null || true
+
+exit 0