syntaur 0.69.0 → 0.71.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "syntaur",
-  "version": "0.69.0",
+  "version": "0.71.0",
   "description": "Project workflow CLI with dashboard, Claude Code plugin, and Codex plugin",
   "homepage": "https://github.com/prong-horn/syntaur#readme",
   "repository": {

package/platforms/claude-code/.claude-plugin/plugin.json

@@ -5,7 +5,7 @@
     "name": "Brennen",
     "email": ""
   },
-  "version": "0.69.0",
+  "version": "0.71.0",
   "skills": [
     "./skills/syntaur-protocol",
     "./skills/grab-assignment",

package/platforms/claude-code/hooks/enforce-boundaries.sh

@@ -56,25 +56,50 @@ if [ -z "$FILE_PATH" ]; then
 fi
 
 # --- Step 7: Check for context file ---
+# context.json is a WORKSPACE MARKER. Its mere presence means "this workspace is
+# under Syntaur enforcement"; its absence means "not a Syntaur workspace → allow".
 CONTEXT_FILE=".syntaur/context.json"
 if [ ! -f "$CONTEXT_FILE" ]; then
-  # No active assignment; allow all writes
+  # No Syntaur workspace; allow all writes (unchanged behavior).
   allow_and_exit
 fi
 
-# --- Step 8: Read context ---
-ASSIGNMENT_DIR=$(jq -r '.assignmentDir // empty' "$CONTEXT_FILE" 2>/dev/null)
-MISSION_DIR=$(jq -r '.projectDir // empty' "$CONTEXT_FILE" 2>/dev/null)
-WORKSPACE_ROOT=$(jq -r '.workspaceRoot // empty' "$CONTEXT_FILE" 2>/dev/null)
+# --- Step 8: Resolve the write boundary from the session's OPEN engagement ---
+# The assignment scalars were demoted out of context.json — the active assignment
+# now lives on the session's engagement. Ask the CLI to resolve it. Parse the
+# PreToolUse stdin payload for the calling session id and pass it explicitly so
+# co-tenant clobbering can't misattribute. If the CLI is unavailable or resolves
+# nothing, ASSIGNMENT_DIR/MISSION_DIR stay empty → we enforce WORKSPACE-ONLY
+# below (we do NOT fail open).
+ASSIGNMENT_DIR=""
+MISSION_DIR=""
+WORKSPACE_ROOT=""
+
+# The cwd holding this context file (its parent's parent: ".syntaur/context.json").
+CONTEXT_DIR="$(cd "$(dirname "$CONTEXT_FILE")/.." 2>/dev/null && pwd)"
+[ -z "$CONTEXT_DIR" ] && CONTEXT_DIR="$(pwd)"
+
+SID=$(echo "$INPUT" | jq -r '.session_id // empty' 2>/dev/null)
+
+if command -v syntaur >/dev/null 2>&1; then
+  BOUNDARY_JSON=$(cd "$CONTEXT_DIR" 2>/dev/null && \
+    syntaur session boundary --json ${SID:+--session-id "$SID"} 2>/dev/null)
+  if [ -n "$BOUNDARY_JSON" ]; then
+    ASSIGNMENT_DIR=$(echo "$BOUNDARY_JSON" | jq -r '.assignmentDir // empty' 2>/dev/null)
+    MISSION_DIR=$(echo "$BOUNDARY_JSON" | jq -r '.projectDir // empty' 2>/dev/null)
+    WORKSPACE_ROOT=$(echo "$BOUNDARY_JSON" | jq -r '.workspaceRoot // empty' 2>/dev/null)
+  fi
+fi
 
-if [ -z "$ASSIGNMENT_DIR" ] || [ -z "$MISSION_DIR" ]; then
-  # Malformed context file; allow (defensive)
-  allow_and_exit
+# Fall back to the context.json workspace marker if the CLI did not surface one
+# (e.g. standalone session with a worktree but no engagement yet).
+if [ -z "$WORKSPACE_ROOT" ]; then
+  WORKSPACE_ROOT=$(jq -r '.workspaceRoot // empty' "$CONTEXT_FILE" 2>/dev/null)
 fi
 
-# --- Step 9: Expand ~ in paths ---
-ASSIGNMENT_DIR="${ASSIGNMENT_DIR/#\~/$HOME}"
-MISSION_DIR="${MISSION_DIR/#\~/$HOME}"
+# --- Step 9: Expand ~ in paths (guarding empties) ---
+[ -n "$ASSIGNMENT_DIR" ] && ASSIGNMENT_DIR="${ASSIGNMENT_DIR/#\~/$HOME}"
+[ -n "$MISSION_DIR" ] && MISSION_DIR="${MISSION_DIR/#\~/$HOME}"
 if [ -n "$WORKSPACE_ROOT" ] && [ "$WORKSPACE_ROOT" != "null" ]; then
   WORKSPACE_ROOT="${WORKSPACE_ROOT/#\~/$HOME}"
 else
@@ -82,14 +107,18 @@ else
 fi
 
 # --- Step 10: Check allowed paths ---
+# NOTE: every prefix test is guarded by a non-empty check so an EMPTY $DIR never
+# globs to "/*" and silently allows the whole filesystem. When no assignment
+# resolves, only the workspace-root (and context file) checks can match → this is
+# WORKSPACE-ONLY enforcement, NOT fail-open.
 
 # Allow: files inside the assignment directory
-if [[ "$FILE_PATH" == "$ASSIGNMENT_DIR"/* ]]; then
+if [ -n "$ASSIGNMENT_DIR" ] && [[ "$FILE_PATH" == "$ASSIGNMENT_DIR"/* ]]; then
   allow_and_exit
 fi
 
 # Allow: files in project resources/ directory (but NOT derived _index.md)
-if [[ "$FILE_PATH" == "$MISSION_DIR/resources/"* ]]; then
+if [ -n "$MISSION_DIR" ] && [[ "$FILE_PATH" == "$MISSION_DIR/resources/"* ]]; then
   BASENAME=$(basename "$FILE_PATH")
   if [[ "$BASENAME" == _* ]]; then
     # Derived file (e.g., _index.md) -- fall through to block
@@ -100,7 +129,7 @@ if [[ "$FILE_PATH" == "$MISSION_DIR/resources/"* ]]; then
 fi
 
 # Allow: files in project memories/ directory (but NOT derived _index.md)
-if [[ "$FILE_PATH" == "$MISSION_DIR/memories/"* ]]; then
+if [ -n "$MISSION_DIR" ] && [[ "$FILE_PATH" == "$MISSION_DIR/memories/"* ]]; then
   BASENAME=$(basename "$FILE_PATH")
   if [[ "$BASENAME" == _* ]]; then
     # Derived file (e.g., _index.md) -- fall through to block
@@ -112,7 +141,7 @@ fi
 
 # Allow: the context file itself
 CONTEXT_ABS="$(cd "$(dirname "$CONTEXT_FILE")" 2>/dev/null && echo "$(pwd)/$(basename "$CONTEXT_FILE")")"
-if [ "$FILE_PATH" = "$CONTEXT_ABS" ]; then
+if [ -n "$CONTEXT_ABS" ] && [ "$FILE_PATH" = "$CONTEXT_ABS" ]; then
   allow_and_exit
 fi
 
@@ -122,7 +151,11 @@ if [ -n "$WORKSPACE_ROOT" ] && [[ "$FILE_PATH" == "$WORKSPACE_ROOT"/* ]]; then
 fi
 
 # --- Step 11: Block the write ---
-REASON="Syntaur write boundary violation: Cannot write to '$FILE_PATH'. Allowed paths: assignment dir ($ASSIGNMENT_DIR), project resources/memories, workspace ($WORKSPACE_ROOT)."
+if [ -n "$ASSIGNMENT_DIR" ]; then
+  REASON="Syntaur write boundary violation: Cannot write to '$FILE_PATH'. Allowed paths: assignment dir ($ASSIGNMENT_DIR), project resources/memories${MISSION_DIR:+ ($MISSION_DIR)}, workspace (${WORKSPACE_ROOT:-none})."
+else
+  REASON="Syntaur write boundary violation: Cannot write to '$FILE_PATH'. No active assignment for this session — writes are restricted to the workspace (${WORKSPACE_ROOT:-none}). Run /grab-assignment to bind an assignment and widen the boundary."
+fi
 
 # Escape for JSON
 REASON_ESCAPED=$(echo "$REASON" | jq -Rs '.' 2>/dev/null)

package/platforms/claude-code/hooks/session-cleanup.sh

@@ -34,12 +34,14 @@ syntaur_bounded_stop || true
 # after the agent walks away. Best-effort, bounded (~3s, no `timeout` on macOS),
 # and migration-gated (`--if-migrated`) so it can't re-derive pre-migration
 # assignments during rollout. Resolves the assignment from the ending session's
-# cwd `.syntaur/context.json`; no-ops silently when none is present.
+# latest engagement (passed via --session-id); no-ops silently when none.
 HOOK_CWD=$(printf '%s' "$INPUT" | jq -r '.cwd // empty' 2>/dev/null)
+HOOK_SID=$(printf '%s' "$INPUT" | jq -r '.session_id // empty' 2>/dev/null)
 syntaur_bounded_recompute() {
   local cpid kpid rc
   [ -n "$HOOK_CWD" ] && [ -f "$HOOK_CWD/.syntaur/context.json" ] || return 0
-  ( cd "$HOOK_CWD" 2>/dev/null && syntaur recompute --if-migrated >/dev/null 2>&1 ) &
+  ( cd "$HOOK_CWD" 2>/dev/null && \
+    syntaur recompute --if-migrated ${HOOK_SID:+--session-id "$HOOK_SID"} >/dev/null 2>&1 ) &
   cpid=$!
   ( sleep 3; kill -KILL "$cpid" 2>/dev/null ) >/dev/null 2>&1 &
   kpid=$!

package/platforms/claude-code/skills/add-memory/SKILL.md

@@ -32,8 +32,9 @@ file-ownership protocol.
 
 ## Step 1: Resolve project
 
-If `.syntaur/context.json` is present and has `projectSlug`, default to that.
-Otherwise ask the user which project to add the memory to.
+If the session has an open engagement with an active assignment (`syntaur
+session resume --json`), default to its `projectSlug`. Otherwise ask the user
+which project to add the memory to.
 
 ## Step 2: Gather inputs
 

package/platforms/claude-code/skills/add-resource/SKILL.md

@@ -30,8 +30,9 @@ CLI-managed file per the file-ownership protocol).
 
 ## Step 1: Resolve project
 
-If `.syntaur/context.json` is present and has `projectSlug`, default to that.
-Otherwise ask the user which project to add the resource to.
+If the session has an open engagement with an active assignment (`syntaur
+session resume --json`), default to its `projectSlug`. Otherwise ask the user
+which project to add the resource to.
 
 ## Step 2: Gather inputs
 

package/platforms/claude-code/skills/bundle-worktree/SKILL.md

@@ -45,9 +45,9 @@ The computed worktree path is **always**
 
 ## Step 2: Pre-flight
 
-- Confirm `.syntaur/context.json` is a bundle context (has `bundleId`,
-  no assignment fields). If it's an assignment context, stop and tell the
-  user to `/grab-bundle <id>` first.
+- Confirm `.syntaur/context.json` is a bundle context (has `bundleId`). If the
+  session is instead bound to an assignment (an open engagement) with no
+  `bundleId`, stop and tell the user to `/grab-bundle <id>` first.
 - Confirm `<repository>/.git` exists.
 - Confirm the branch does NOT already exist. If it does, the CLI will
   surface a `GitWorktreeError` — surface that verbatim.

package/platforms/claude-code/skills/capture-artifacts/SKILL.md

@@ -17,7 +17,7 @@ Attach proof to your work. Reviewers should be able to scroll a single page (`pr
 
 ## Input
 
-No arguments. Reads `.syntaur/context.json` from the current working directory to identify the active assignment.
+No arguments. The active assignment is resolved from the session's open engagement (`.syntaur/context.json` is only a workspace marker, not the assignment source).
 
 ## Step 1: Decide whether to capture
 
@@ -60,7 +60,7 @@ Rules:
 - All other kinds (`screenshot`, `video`, `asciinema`) require `--file`. The CLI rejects nonexistent / non-file paths.
 - `--criterion <index>` is optional — pass the **0-based** index into the `## Acceptance Criteria` checklist when you want to anchor the artifact to a specific criterion.
 - `--transcribe` is video-only and writes a sibling `<id>.transcript.md` (requires `ELEVENLABS_API_KEY` + `ffmpeg`). `proof build` renders the transcript next to the player; clicking a phrase seeks the video.
-- If you have a `.syntaur/context.json` in the cwd, the positional target argument is unnecessary; otherwise pass `--project <slug> <assignment-slug>` or a bare assignment UUID.
+- If this session has an open engagement (active assignment), the positional target argument is unnecessary — the CLI resolves the target from the engagement. Otherwise pass `--project <slug> <assignment-slug>` or a bare assignment UUID.
 
 The CLI copies the file (if any) under `<assignmentDir>/proof/<criterion|untagged>/<id>.<ext>` and inserts a row in `~/.syntaur/syntaur.db`. Output prints the artifact id and absolute path.
 

package/platforms/claude-code/skills/claim-resource/SKILL.md

@@ -29,15 +29,15 @@ Examples:
 
 Extract `<inventory_slug>` (required, first positional), plus optional `--ttl <duration>` and `--for <tag>`.
 
-### Step 2: Pre-check assignment context
+### Step 2: Pre-check workspace context
 
-Read `.syntaur/context.json` from the current working directory. If the file is missing, OR has neither `sessionId` nor any of `projectSlug`/`assignmentSlug`/`assignmentDir`, abort with:
+Read `.syntaur/context.json` (a workspace marker) from the current working directory. If the file is missing, OR carries no workspace markers (`repository`/`branch`/`worktreePath`/`workspaceRoot`) and no `sessionId`, abort with:
 
 > "No active Syntaur context in this workspace. Grab an assignment first (`/grab-assignment <project> <slug>`) or restart the session so the SessionStart hook can populate `.syntaur/context.json`."
 
 This guard exists because writing a leases-only context file would trip `syntaur doctor`'s workspace check.
 
-If `--for` was not provided, derive its value from the context: prefer `assignmentSlug` if present, otherwise `sessionId`.
+If `--for` was not provided, derive its value: prefer the active assignment's slug from the session's open engagement (`syntaur session resume --json`); otherwise fall back to the `sessionId` from the workspace marker.
 
 ### Step 3: Run the claim CLI
 

package/platforms/claude-code/skills/clear-assignment/SKILL.md

@@ -14,7 +14,7 @@ metadata:
 
 # Clear Assignment
 
-Drop the active assignment binding from the current workspace. The assignment itself is left untouched in `~/.syntaur/projects/.../assignments/` — only the local `.syntaur/context.json` pointer is cleared so the session is no longer scoped to it.
+Drop the active assignment binding from the current session. The assignment itself is left untouched in `~/.syntaur/projects/.../assignments/` — only the session's open engagement (the binding that makes it the active assignment) is closed so the session is no longer scoped to it. `.syntaur/context.json` is a workspace marker and is not the binding — it does not hold the active assignment.
 
 This is the inverse of `grab-assignment`. Unlike `complete-assignment`, it does **not** transition lifecycle state, write a handoff, or close out the work. Use it when:
 
@@ -28,17 +28,15 @@ If the assignment is actually done, use `complete-assignment` instead so a hando
 
 Optional flags from the user:
 
-- `--keep-session` — preserve `sessionId` / `transcriptPath` fields in `context.json` (just strip the assignment fields). Default: full delete.
-- `--unassign` — also run `syntaur unassign <slug> --project <project>` so the assignment is no longer claimed by this agent. Default: leave the claim in place (only the local context is cleared).
+- `--unassign` — also run `syntaur unassign <slug> --project <project>` so the assignment is no longer claimed by this agent. Default: leave the claim in place (only the session's engagement is closed).
 
 ## Step 1: Load Context
 
-Read `.syntaur/context.json` from the current working directory.
+The active assignment is resolved from the session's open engagement. Run `syntaur session resume --json` to read it.
 
-- If the file does not exist, tell the user: "No active assignment context to clear." and stop.
-- If the file exists but contains only session fields (`sessionId`, `transcriptPath`) and no `projectSlug` / `assignmentSlug`, tell the user: "No active assignment is bound — only a platform session record exists. Nothing to clear." and stop (unless they explicitly ask to wipe the session record too).
+- If there is no open engagement, tell the user: "No active assignment is bound to this session — nothing to clear." and stop. (`.syntaur/context.json` is only a workspace marker; its presence does not mean an assignment is bound.)
 
-Otherwise extract: `projectSlug`, `assignmentSlug`, `assignmentDir`, `title`.
+From the resolved engagement, note: `projectSlug`, `assignmentSlug`, `assignmentDir`, `title`.
 
 ## Step 2: Confirm with the User
 
@@ -68,29 +66,15 @@ For standalone assignments use the UUID (the folder name) in place of the slug,
 
 `syntaur unassign` clears the assignee on the assignment frontmatter (the inverse of `assign`) and bumps `updated`.
 
-## Step 4: Clear the Context File
+## Step 4: Close the Engagement
 
-Default behavior — delete the file entirely:
+Closing the session's open engagement is what drops the active-assignment binding — that is the operation that "clears" the assignment. The dashboard status PATCH in Step 5 (to `cleared`) closes the open engagement for a live session.
 
-```bash
-rm .syntaur/context.json
-```
-
-If the user passed `--keep-session`, preserve session fields and strip everything else instead:
-
-```bash
-jq '{sessionId, transcriptPath} | with_entries(select(.value != null))' \
-  .syntaur/context.json > .syntaur/context.json.tmp \
-  && mv .syntaur/context.json.tmp .syntaur/context.json
-```
-
-If the resulting file would be empty (`{}`), delete it instead of leaving an empty stub.
-
-Do not delete the `.syntaur/` directory itself — other tooling may use it.
+Do NOT delete or rewrite `.syntaur/context.json` to clear the assignment — it is a workspace marker and no longer carries the active assignment. Leave its repository/branch/worktree, session, and lease fields intact so other tooling keeps recognizing the workspace. Do not delete the `.syntaur/` directory.
 
 ## Step 5: Close Session (optional)
 
-If the Syntaur dashboard is running, mark this session as cleared so the dashboard does not keep showing it as active. Resolve `<session-id>` from *your* running process — prefer `$CLAUDE_CODE_SESSION_ID` (or the peer `OPENCODE_SESSION_ID` / `PI_SESSION_ID`), otherwise run `syntaur session resolve-id`. Only if neither yields an id, fall back to the `sessionId` you captured from the original `context.json` in Step 1 (before deletion) — that scalar is a shared, legacy hint a co-tenant can clobber, so don't treat it as authoritative:
+If the Syntaur dashboard is running, mark this session as cleared so the dashboard does not keep showing it as active (this also closes the session's open engagement). Resolve `<session-id>` from *your* running process — prefer `$CLAUDE_CODE_SESSION_ID` (or the peer `OPENCODE_SESSION_ID` / `PI_SESSION_ID`), otherwise run `syntaur session resolve-id`. Only if neither yields an id, fall back to the legacy `sessionId` scalar in `.syntaur/context.json` — that scalar is a shared, legacy hint a co-tenant can clobber, so don't treat it as authoritative:
 
 ```bash
 curl -s -X PATCH "http://localhost:$(cat ~/.syntaur/dashboard-port 2>/dev/null || echo 4800)/api/agent-sessions/<session-id>/status" \
@@ -100,8 +84,6 @@ curl -s -X PATCH "http://localhost:$(cat ~/.syntaur/dashboard-port 2>/dev/null |
 
 If this fails (e.g., dashboard not running, endpoint not present in the installed version), it is non-critical — silently continue.
 
-Skip this step entirely when `--keep-session` is set.
-
 ## Step 6: Report to User
 
 Summarize:

package/platforms/claude-code/skills/complete-assignment/SKILL.md

@@ -19,11 +19,11 @@ Optional: the user may pass `--complete` to transition directly to `completed` i
 
 ## Step 1: Load Context
 
-Read `.syntaur/context.json` from the current working directory.
+The active assignment is resolved from the session's open engagement. Run `syntaur session resume --json` to read it.
 
-If the file does not exist, tell the user: "No active assignment found. Run `grab-assignment` first."
+If there is no open engagement (no active assignment), tell the user: "No active assignment for this session — grab one first." `.syntaur/context.json` is only a workspace marker; do not read the assignment from it.
 
-Extract: `projectSlug`, `assignmentSlug`, `assignmentDir`, `projectDir`.
+From the resolved engagement, note: `projectSlug`, `assignmentSlug`, `assignmentDir`, `projectDir`.
 
 ## Step 2: Load Playbooks
 

package/platforms/claude-code/skills/create-assignment/SKILL.md

@@ -30,9 +30,9 @@ Expects arguments from the user:
 
 If no title was provided, ask the user what the assignment should be called.
 
-If neither `--project` nor `--one-off` was provided, check `.syntaur/context.json` for an active assignment. If present, default `--project` to that context's `projectSlug` and confirm with the user: "Add this assignment to project `<projectSlug>`?"
+If neither `--project` nor `--one-off` was provided, check for an active assignment via the session's open engagement (`syntaur session resume --json`). If there is one, default `--project` to its `projectSlug` and confirm with the user: "Add this assignment to project `<projectSlug>`?"
 
-If no active context and no project flag, ask the user which project to add it to, or whether it should be a one-off.
+If there is no open engagement and no project flag, ask the user which project to add it to, or whether it should be a one-off.
 
 ## Step 1: Run the CLI
 

package/platforms/claude-code/skills/extend-resource/SKILL.md

@@ -25,9 +25,9 @@ Examples:
 
 Extract `<lease_id>` (first positional) and `--ttl <duration>` (required). If either is missing, abort with a usage message and a hint to call `/list-resources` to see active leases.
 
-### Step 2: Pre-check assignment context
+### Step 2: Pre-check workspace context
 
-Read `.syntaur/context.json` from the current working directory. If the file is missing, OR has neither `sessionId` nor any of `projectSlug`/`assignmentSlug`/`assignmentDir`, abort with:
+Read `.syntaur/context.json` (a workspace marker) from the current working directory. If the file is missing, OR carries no workspace markers (`repository`/`branch`/`worktreePath`/`workspaceRoot`) and no `sessionId`, abort with:
 
 > "No active Syntaur context in this workspace. Grab an assignment first (`/grab-assignment <project> <slug>`) or restart the session so the SessionStart hook can populate `.syntaur/context.json`."
 

package/platforms/claude-code/skills/grab-assignment/SKILL.md

@@ -23,10 +23,16 @@ Expects up to two arguments from the user:
 
 ## Pre-flight Check
 
-Check if `.syntaur/context.json` already exists in the current working directory.
+`.syntaur/context.json` is a WORKSPACE MARKER (repository/branch/worktree/workspaceRoot plus legacy session and bundle fields) — it is NOT the active-assignment source of truth. The active assignment binds via the session's open engagement (established by `track-session` in Step 6).
 
-- If it exists AND contains BOTH `projectSlug` and `assignmentSlug`, it represents an active assignment. Warn the user: "You already have an active assignment: `<assignmentSlug>` in project `<projectSlug>`. Grabbing a new one will replace this context. Proceed?" — stop if the user says no.
-- If it exists but only has session fields (`sessionId`, `transcriptPath`) and no project/assignment, it was populated by the platform's SessionStart hook (Claude Code, etc.) and does NOT represent an active assignment. Proceed silently and merge assignment fields on top in Step 5.
+Check whether this session already has an open engagement — i.e., a different assignment is already active:
+
+```bash
+syntaur session resume --json 2>/dev/null
+```
+
+- If it reports an active assignment, warn the user: "You already have an active assignment: `<assignmentSlug>` in project `<projectSlug>`. Grabbing a new one will rebind this session. Proceed?" — stop if the user says no.
+- If there is no open engagement (no active assignment), proceed. A `.syntaur/context.json` that holds only workspace-marker / session fields is expected — it does not represent an active assignment.
 
 ## Step 1: Discover the Project (project-nested path)
 
@@ -75,25 +81,24 @@ From the assignment frontmatter extract: `title`, `workspace.repository`, `works
 
 If `workspace.repository` and `workspace.worktreePath` are both null, set them to the current working directory. Write boundaries use this path, so it must never be null while an agent is writing code.
 
-## Step 5: Create or Merge Context File
+## Step 5: Create or Merge the Workspace Marker
 
-Merge assignment context into `.syntaur/context.json`. Never overwrite — if the file already exists (e.g., platform SessionStart hook populated `sessionId` / `transcriptPath`), preserve those fields.
+`.syntaur/context.json` is a WORKSPACE MARKER — it records the repository/branch/worktree so tooling can recognize this directory as a Syntaur workspace. It is NOT the active-assignment source of truth: the assignment binds via the session's open engagement (Step 6, `track-session`). Do NOT write `projectSlug` / `assignmentSlug` / `assignmentDir` / `projectDir` / `title` — those scalars are non-authoritative.
+
+Merge workspace markers into `.syntaur/context.json`. Never overwrite — if the file already exists (e.g., platform SessionStart hook populated `sessionId` / `transcriptPath`, or a worktree skill wrote bundle/lease fields), preserve those fields.
 
 ```bash
 mkdir -p .syntaur
 ```
 
-Prepare the assignment payload:
+Prepare the workspace-marker payload:
 
 ```json
 {
-  "projectSlug": "<project-slug or null for standalone>",
-  "assignmentSlug": "<assignment-slug>",
-  "projectDir": "/absolute/path/to/project or null",
-  "assignmentDir": "/absolute/path/to/assignment",
-  "workspaceRoot": "<workspace path or current working directory>",
-  "title": "<assignment title>",
+  "repository": "<workspace.repository or null>",
   "branch": "<workspace.branch or null>",
+  "worktreePath": "<workspace.worktreePath or null>",
+  "workspaceRoot": "<workspace path or current working directory>",
   "grabbedAt": "<ISO 8601 timestamp>"
 }
 ```

package/platforms/claude-code/skills/grab-bundle/SKILL.md

@@ -34,16 +34,20 @@ the user to pick.
 
 ## Pre-flight check
 
-Read `.syntaur/context.json` in the current working directory.
+First check whether this session already has an active assignment via its open
+engagement (`syntaur session resume --json`):
+
+- If it reports an active assignment, warn the user: "You already have an active
+  assignment. Grabbing a bundle will rebind this session. Proceed?" — stop if no.
+
+Then read `.syntaur/context.json` (a workspace marker) in the current working
+directory for bundle bookkeeping:
 
-- If it already contains assignment fields (`projectSlug`/`assignmentSlug`/
-  `assignmentDir`), warn the user: "You already have an active assignment.
-  Grabbing a bundle will replace this context. Proceed?" — stop if no.
 - If it already contains different bundle fields (`bundleId` set to a
   different id), warn: "Context is bound to bundle b:<old>. Switch to b:<new>?"
   — stop if no.
-- If it has only `sessionId` (platform SessionStart hook seeded it), proceed
-  and merge bundle fields on top.
+- A context.json holding only workspace-marker / `sessionId` fields is expected;
+  proceed and merge bundle fields on top.
 
 ## Step 1: Load the bundle
 

package/platforms/claude-code/skills/log-progress/SKILL.md

@@ -39,9 +39,11 @@ records current in real-time, especially after every meaningful action.
 
 ## Step 1: Verify there is an active assignment
 
-Read `.syntaur/context.json` from the current working directory. Extract
-`assignmentDir`. If missing, abort with: "No active assignment. Run
-`grab-assignment` first."
+The active assignment is resolved from the session's open engagement — `syntaur
+progress log` (Step 3) targets it automatically. `.syntaur/context.json` is only
+a workspace marker; do not read the assignment from it. If there is no open
+engagement (no active assignment), the CLI aborts with "No active assignment for
+this session — grab one first." Run `grab-assignment` first.
 
 ## Step 2: Compose the entry
 
@@ -69,7 +71,7 @@ Run:
 syntaur progress log "<your composed entry body>"
 ```
 
-The command resolves the active assignment from `.syntaur/context.json`
+The command resolves the active assignment from the session's open engagement
 (or pass `--assignment <slug> [--project <slug>]` to target one explicitly),
 then atomically:
 

package/platforms/claude-code/skills/plan-assignment/SKILL.md

@@ -20,14 +20,14 @@ Optional: the user may provide focus areas or notes to guide the plan.
 
 ## Step 1: Load Context
 
-Read `.syntaur/context.json` from the current working directory. If the file does not exist, tell the user: "No active assignment found. Run `grab-assignment` first to claim an assignment."
+The active assignment is resolved from the session's open engagement. Run `syntaur session resume --json` to read it. If there is no open engagement (no active assignment), tell the user: "No active assignment for this session — grab one first." and stop. `.syntaur/context.json` is only a workspace marker; do not read the assignment from it.
 
-Extract:
+From the resolved engagement, note:
 - `projectSlug` — the project slug (`null` for standalone assignments)
 - `assignmentSlug` — the assignment slug
 - `assignmentDir` — absolute path to the assignment folder
 - `projectDir` — absolute path to the project folder (may be null for standalone)
-- `workspaceRoot` — absolute path to the workspace (may be null)
+- `workspaceRoot` — absolute path to the workspace (a workspace marker; may be null)
 
 ## Step 2: Load Playbooks
 

package/platforms/claude-code/skills/plan-bundle/SKILL.md

@@ -19,9 +19,10 @@ the bundle's own to track, only the member todos.
 
 ## Step 1: Load context
 
-Read `.syntaur/context.json` from the current working directory. It must
-contain `bundleId` (a bundle context). If it instead has assignment fields,
-stop and tell the user: "Active context is an assignment, not a bundle.
+Read `.syntaur/context.json` (a workspace marker) from the current working
+directory. It must contain `bundleId` (a bundle context). If there is no
+`bundleId` but the session has an open engagement (an active assignment), stop
+and tell the user: "This session is bound to an assignment, not a bundle.
 Use `/plan-assignment` instead, or `/grab-bundle <id>` to switch."
 
 Extract `bundleId`, `bundleScope`, `bundleScopeId`, `todoIds`, `planDir`.

package/platforms/claude-code/skills/replan/SKILL.md

@@ -38,12 +38,15 @@ todos are never deleted.**
 
 ## Step 1: Verify there is an active assignment
 
-Read `.syntaur/context.json` from the current working directory. Extract
-`assignmentSlug`, `projectSlug` (may be null for standalone), and
-`assignmentDir`.
-
-If the file is missing or has no `assignmentSlug`, abort with: "No active
-Syntaur assignment. Run `grab-assignment` first." Do not invent values.
+The active assignment is resolved from the session's open engagement. Run
+`syntaur session resume --json` to read the bound `assignmentSlug`,
+`projectSlug` (may be null for standalone), and `assignmentDir`.
+`.syntaur/context.json` is only a workspace marker — do not read the assignment
+from it.
+
+If there is no open engagement (no active assignment), abort with: "No active
+assignment for this session — grab one first." Run `grab-assignment` first. Do
+not invent values.
 
 ## Step 2: Confirm the prior plan was implemented
 

package/platforms/claude-code/skills/resume-session/SKILL.md

@@ -2,8 +2,9 @@
 name: resume-session
 description: >-
   Re-orient a fresh Syntaur session on the active assignment without
-  re-reading the full transcript. Loads the latest saved session summary,
-  `.syntaur/context.json`, and any open handoff. Use when the user says
+  re-reading the full transcript. Resolves the active assignment from the
+  session's open engagement and loads the latest saved session summary and any
+  open handoff. Use when the user says
   "resume", "pick up where we left off", "continue this assignment", or after
   a compact / new session start. Symmetric counterpart to
   `/save-session-summary`.
@@ -28,15 +29,20 @@ freely; nothing on disk changes.
 - Saving the current session's progress — that's `/save-session-summary` (the
   symmetric write side).
 
-## Step 1: Verify there is an active context
+## Step 1: Verify there is an active assignment
 
 Run `syntaur session resume`. The CLI:
 
-1. Reads `.syntaur/context.json` from the current working directory.
-2. Aborts (exit 1) with a clear message if missing or if no `assignmentDir`
-   is set — telling the user to run `grab-assignment` first.
-3. Otherwise scans `<assignmentDir>/sessions/<sid>/summary.md` and picks the
-   most recently modified.
+1. Resolves the active assignment from the session's OPEN engagement (the
+   assignment this session is currently bound to). `.syntaur/context.json` is
+   only a workspace marker — it identifies the repository/branch/worktree, not
+   the active assignment.
+2. Aborts (exit 1) with a clear message when there is no open engagement —
+   "No active assignment for this session — grab one first" — telling the user
+   to run `grab-assignment`.
+3. Otherwise resolves the assignment dir from the engagement and scans
+   `<assignmentDir>/sessions/<sid>/summary.md`, picking the most recently
+   modified.
 4. Reads `<assignmentDir>/handoff.md` (the canonical single-file handoff per
    assignment, managed by `complete-assignment`) and reports it if its body
    has been written beyond the scaffolded placeholder.

package/platforms/claude-code/skills/save-session-summary/SKILL.md

@@ -26,11 +26,11 @@ mid-assignment continuity** — distinct from `handoff.md`, which is the
 
 ## Step 1: Load Context
 
-Read `.syntaur/context.json` from the current working directory.
+The active assignment is resolved from the session's open engagement. Run `syntaur session resume --json` to read it.
 
-If the file does not exist, tell the user: "No active assignment found. Run `grab-assignment` first." and stop.
+If there is no open engagement (no active assignment), tell the user: "No active assignment for this session — grab one first." and stop. `.syntaur/context.json` is only a workspace marker; do not read the assignment from it.
 
-Extract:
+From the resolved engagement, note:
 - `assignmentDir` (absolute path) — required.
 
 **Do not read the session id from `context.json` for identity.** That scalar is
@@ -86,7 +86,7 @@ printf '%s' "$BODY" | syntaur session save
 # Pass --session-id <id> only to override (e.g. you already have $CLAUDE_CODE_SESSION_ID).
 ```
 
-Resolves the active assignment from `.syntaur/context.json` (or pass
+Resolves the active assignment from the session's open engagement (or pass
 `--assignment <slug> [--project <slug>]`). `--session-id` now defaults to the
 **resolved** session (env → process tree → transcript), falling back to the
 `context.json` hint only as a last resort — so a co-tenant that clobbered the

package/platforms/claude-code/skills/set-workspace/SKILL.md

@@ -35,11 +35,14 @@ implementation code until workspace fields are set.
 
 ## Step 1: Resolve the assignment file
 
-Read `.syntaur/context.json` from the current working directory. Extract
-`assignmentDir`. The target file is `<assignmentDir>/assignment.md`.
+The active assignment is resolved from the session's open engagement — `syntaur
+workspace set` (Step 3) targets it automatically. `.syntaur/context.json` is
+only a workspace marker; do not read the assignment from it.
 
-If no context, abort with: "No active assignment. Run `grab-assignment`
-first."
+If there is no open engagement (no active assignment), the CLI aborts with "No
+active assignment for this session — grab one first." Run `grab-assignment`
+first, or pass `--assignment <slug> [--project <slug>]` to target one
+explicitly.
 
 ## Step 2: Gather inputs
 
@@ -68,8 +71,8 @@ syntaur workspace set \
   --parent-branch <parent>
 ```
 
-Targets the active assignment from `.syntaur/context.json` by default; pass
-`--assignment <slug> [--project <slug>]` to target one explicitly. The command
+Targets the active assignment from the session's open engagement by default;
+pass `--assignment <slug> [--project <slug>]` to target one explicitly. The command
 does the whole safe write in one atomic step:
 
 - **Pre-write validation** — runs the same checks as `syntaur doctor