syntaur 0.70.0 → 0.72.0

package/platforms/claude-code/skills/syntaur-protocol/SKILL.md

@@ -32,7 +32,7 @@ Respect file ownership boundaries. The Claude Code and Codex plugins enforce the
    - `~/.syntaur/projects/<project>/resources/<slug>.md`
    - `~/.syntaur/projects/<project>/memories/<slug>.md`
 3. **Workspace files** inside the assignment's configured `workspace.worktreePath` / `workspace.repository`.
-4. **Context file:** `.syntaur/context.json` in the current working directory.
+4. **Workspace marker:** `.syntaur/context.json` in the current working directory (repository/branch/worktree markers plus legacy session/lease bookkeeping — not the active-assignment source of truth).
 
 ### Files written only via CLI (never edit directly)
 
@@ -51,16 +51,18 @@ Per-project `agent.md` / `claude.md` do NOT exist in protocol v2.0. Agent-level
 
 ## Current Assignment Context
 
-If `.syntaur/context.json` exists in the current working directory, read it before making changes. Fields you will see:
+The **active assignment** is resolved from the session's OPEN engagement — the assignment this session is currently bound to (established by `syntaur track-session`). It is NOT read from `.syntaur/context.json`. To learn the active assignment, run `syntaur session resume` (or `--json`); to bind a different one, `grab-assignment` (which calls `track-session`).
 
-- `projectSlug` — containing project slug (`null` for standalone assignments)
-- `assignmentSlug` — assignment slug (for standalone, the UUID is the folder name; slug is display-only)
-- `projectDir` — absolute path to the project folder (`null` for standalone)
-- `assignmentDir` — absolute path to the assignment folder
+`.syntaur/context.json` is a WORKSPACE MARKER file — it identifies the workspace directory and carries legacy session and resource-lease bookkeeping. It is NOT authoritative for the active assignment. Read it for workspace markers and leases; do NOT treat `projectSlug` / `assignmentSlug` / `assignmentDir` as the active-assignment source of truth (any such scalars are non-authoritative legacy hints). Fields you may see:
+
+- `repository` — workspace repository (path or remote URL)
+- `branch` — workspace branch, if known
+- `worktreePath` — absolute path to the worktree, if this workspace is a worktree
 - `workspaceRoot` — absolute path to the code workspace
-- `sessionId` — real agent-runtime session id (never a synthesized UUID)
+- `sessionId` — real agent-runtime session id (legacy hint; never a synthesized UUID, and a co-tenant can clobber it — not authoritative for identity)
 - `transcriptPath` — absolute path to the agent's rollout/transcript file, if known
 - `leases` — array of active resource-lease records (managed by `/claim-resource` and `/release-resource`). Entry shape: `{ lease_id, inventory_slug, member_id, expires_at, metadata, claimed_at }`. Leases are NOT auto-released on session end or assignment completion in v1 — call `/release-resource` explicitly (or let the TTL expire).
+- `bundleId` and related bundle fields — present when this workspace is bound to a todo bundle (managed by the bundle skills).
 
 ## Required Reading Order
 

package/platforms/claude-code/skills/syntaur-protocol/references/file-ownership.md

@@ -64,4 +64,4 @@ When working on code (not protocol files), you may write to files within the wor
 
 - `workspace.worktreePath` or `workspace.repository` defines your code root.
 - You may create and edit source files within that workspace.
-- The `.syntaur/context.json` context file in your working directory is also writable (merge, don't overwrite — the platform SessionStart hook may have populated `sessionId` and `transcriptPath`).
+- The `.syntaur/context.json` workspace-marker file in your working directory is also writable (merge, don't overwrite — the platform SessionStart hook may have populated `sessionId` and `transcriptPath`). It marks the workspace (repository/branch/worktree); it is not the active-assignment source of truth — the active assignment resolves from the session's open engagement.

package/platforms/claude-code/skills/syntaur-worktree/SKILL.md

@@ -23,8 +23,9 @@ operations:
    transactionally — rolls back the worktree on write failure).
 3. `syntaur assign` + `syntaur start` — claim the assignment for this agent
    and transition to `in_progress`.
-4. Write `.syntaur/context.json` inside the new worktree so the session is
-   bound there.
+4. Write `.syntaur/context.json` (a workspace marker) inside the new worktree,
+   then `syntaur track-session` to bind the session's engagement to the
+   assignment.
 
 ## When NOT to use this skill
 
@@ -82,12 +83,15 @@ syntaur start <assignment> --project <project-slug>   # only if status was pendi
 Skip `start` for any non-`pending` status — never rewind a `review`,
 `completed`, or `failed` assignment.
 
-## Step 5: Bind the new worktree to your session
+## Step 5: Write the workspace marker
 
-`cd` into the new worktree path. Write
-`<worktreePath>/.syntaur/context.json` mirroring the format produced by
-`/grab-assignment` (projectSlug, assignmentSlug, projectDir, assignmentDir,
-workspaceRoot, title, branch, sessionId, transcriptPath, grabbedAt).
+`cd` into the new worktree path. Write `<worktreePath>/.syntaur/context.json`
+mirroring the WORKSPACE-MARKER format produced by `/grab-assignment`:
+`repository`, `branch`, `worktreePath`, `workspaceRoot`, `grabbedAt`, plus
+`sessionId` / `transcriptPath` when known. Do NOT write `projectSlug` /
+`assignmentSlug` / `assignmentDir` / `projectDir` / `title` — context.json is a
+workspace marker, not the active-assignment source. The assignment binds in the
+next step via the session's engagement (`track-session`).
 
 If the runtime exposes a real session id (e.g. Claude Code's
 `~/.claude/sessions/`), include it. Otherwise omit `sessionId` entirely; the

package/platforms/codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "syntaur",
-  "version": "0.70.0",
+  "version": "0.72.0",
   "description": "Run Syntaur project and assignment workflows from Codex, including claiming work, planning, completing handoffs, session/server tracking, save-session-summary continuity, and write-boundary enforcement.",
   "author": {
     "name": "Brennen"

package/platforms/codex/scripts/enforce-boundaries.sh

@@ -45,39 +45,97 @@ if [ -z "$FILE_PATH" ]; then
   allow_and_exit
 fi
 
+# context.json is a WORKSPACE MARKER. Its presence means "Syntaur-enforced
+# workspace"; its absence means "not a Syntaur workspace → allow".
 CONTEXT_FILE=".syntaur/context.json"
 if [ ! -f "$CONTEXT_FILE" ]; then
   allow_and_exit
 fi
 
-ASSIGNMENT_DIR=$(jq -r '.assignmentDir // empty' "$CONTEXT_FILE" 2>/dev/null)
-MISSION_DIR=$(jq -r '.projectDir // empty' "$CONTEXT_FILE" 2>/dev/null)
-WORKSPACE_ROOT=$(jq -r '.workspaceRoot // empty' "$CONTEXT_FILE" 2>/dev/null)
+# Resolve the write boundary from the session's OPEN engagement (the assignment
+# scalars were demoted out of context.json). Codex's PreToolUse stdin MAY carry
+# .session_id; if absent, fall back to the ancestor-pid runtime markers (same
+# scheme as session-cleanup.sh). Pass whatever id we have to the CLI explicitly.
+# If the CLI is unavailable or resolves nothing, ASSIGNMENT_DIR/MISSION_DIR stay
+# empty → WORKSPACE-ONLY enforcement below (NOT fail-open).
+ASSIGNMENT_DIR=""
+MISSION_DIR=""
+WORKSPACE_ROOT=""
+
+CONTEXT_DIR="$(cd "$(dirname "$CONTEXT_FILE")/.." 2>/dev/null && pwd)"
+[ -z "$CONTEXT_DIR" ] && CONTEXT_DIR="$(pwd)"
+
+SID=$(echo "$INPUT" | jq -r '.session_id // empty' 2>/dev/null)
+if [ -z "$SID" ]; then
+  # Fall back to ancestor-pid runtime markers (pid-reuse-guarded by procStart).
+  RUNTIME_DIR="${SYNTAUR_RUNTIME_SESSIONS_DIR:-$HOME/.syntaur/runtime/sessions}"
+  _pid="$PPID"
+  _depth=0
+  while [ "$_depth" -lt 12 ]; do
+    case "$_pid" in
+      '' | *[!0-9]*) break ;;
+    esac
+    [ "$_pid" -le 1 ] && break
+    _marker="$RUNTIME_DIR/$_pid.json"
+    if [ -f "$_marker" ]; then
+      _sid=$(jq -r '.sessionId // empty' "$_marker" 2>/dev/null)
+      _procstart=$(jq -r '.procStart // empty' "$_marker" 2>/dev/null)
+      if [ -n "$_sid" ]; then
+        if [ -n "$_procstart" ]; then
+          _actual=$(ps -o lstart= -p "$_pid" 2>/dev/null | sed 's/^ *//;s/ *$//')
+          if [ -n "$_actual" ] && [ "$_actual" = "$_procstart" ]; then
+            SID="$_sid"
+            break
+          fi
+        else
+          SID="$_sid"
+          break
+        fi
+      fi
+    fi
+    _pid=$(ps -o ppid= -p "$_pid" 2>/dev/null | tr -d ' ')
+    _depth=$((_depth + 1))
+  done
+fi
 
-if [ -z "$ASSIGNMENT_DIR" ] || [ -z "$MISSION_DIR" ]; then
-  allow_and_exit
+if command -v syntaur >/dev/null 2>&1; then
+  BOUNDARY_JSON=$(cd "$CONTEXT_DIR" 2>/dev/null && \
+    syntaur session boundary --json ${SID:+--session-id "$SID"} 2>/dev/null)
+  if [ -n "$BOUNDARY_JSON" ]; then
+    ASSIGNMENT_DIR=$(echo "$BOUNDARY_JSON" | jq -r '.assignmentDir // empty' 2>/dev/null)
+    MISSION_DIR=$(echo "$BOUNDARY_JSON" | jq -r '.projectDir // empty' 2>/dev/null)
+    WORKSPACE_ROOT=$(echo "$BOUNDARY_JSON" | jq -r '.workspaceRoot // empty' 2>/dev/null)
+  fi
 fi
 
-ASSIGNMENT_DIR="${ASSIGNMENT_DIR/#\~/$HOME}"
-MISSION_DIR="${MISSION_DIR/#\~/$HOME}"
+# Fall back to the context.json workspace marker if the CLI did not surface one.
+if [ -z "$WORKSPACE_ROOT" ]; then
+  WORKSPACE_ROOT=$(jq -r '.workspaceRoot // empty' "$CONTEXT_FILE" 2>/dev/null)
+fi
+
+[ -n "$ASSIGNMENT_DIR" ] && ASSIGNMENT_DIR="${ASSIGNMENT_DIR/#\~/$HOME}"
+[ -n "$MISSION_DIR" ] && MISSION_DIR="${MISSION_DIR/#\~/$HOME}"
 if [ -n "$WORKSPACE_ROOT" ] && [ "$WORKSPACE_ROOT" != "null" ]; then
   WORKSPACE_ROOT="${WORKSPACE_ROOT/#\~/$HOME}"
 else
   WORKSPACE_ROOT=""
 fi
 
-if [[ "$FILE_PATH" == "$ASSIGNMENT_DIR"/* ]]; then
+# Every prefix test is guarded so an EMPTY $DIR never globs to "/*" and allows
+# the whole filesystem. No assignment → only workspace-root/context match →
+# WORKSPACE-ONLY enforcement (NOT fail-open).
+if [ -n "$ASSIGNMENT_DIR" ] && [[ "$FILE_PATH" == "$ASSIGNMENT_DIR"/* ]]; then
   allow_and_exit
 fi
 
-if [[ "$FILE_PATH" == "$MISSION_DIR/resources/"* ]]; then
+if [ -n "$MISSION_DIR" ] && [[ "$FILE_PATH" == "$MISSION_DIR/resources/"* ]]; then
   BASENAME=$(basename "$FILE_PATH")
   if [[ "$BASENAME" != _* ]]; then
     allow_and_exit
   fi
 fi
 
-if [[ "$FILE_PATH" == "$MISSION_DIR/memories/"* ]]; then
+if [ -n "$MISSION_DIR" ] && [[ "$FILE_PATH" == "$MISSION_DIR/memories/"* ]]; then
   BASENAME=$(basename "$FILE_PATH")
   if [[ "$BASENAME" != _* ]]; then
     allow_and_exit
@@ -85,7 +143,7 @@ if [[ "$FILE_PATH" == "$MISSION_DIR/memories/"* ]]; then
 fi
 
 CONTEXT_ABS="$(cd "$(dirname "$CONTEXT_FILE")" 2>/dev/null && echo "$(pwd)/$(basename "$CONTEXT_FILE")")"
-if [ "$FILE_PATH" = "$CONTEXT_ABS" ]; then
+if [ -n "$CONTEXT_ABS" ] && [ "$FILE_PATH" = "$CONTEXT_ABS" ]; then
   allow_and_exit
 fi
 
@@ -93,7 +151,11 @@ if [ -n "$WORKSPACE_ROOT" ] && [[ "$FILE_PATH" == "$WORKSPACE_ROOT"/* ]]; then
   allow_and_exit
 fi
 
-REASON="Syntaur write boundary violation: Cannot write to '$FILE_PATH'. Allowed paths: assignment dir ($ASSIGNMENT_DIR), project resources/memories, workspace ($WORKSPACE_ROOT)."
+if [ -n "$ASSIGNMENT_DIR" ]; then
+  REASON="Syntaur write boundary violation: Cannot write to '$FILE_PATH'. Allowed paths: assignment dir ($ASSIGNMENT_DIR), project resources/memories${MISSION_DIR:+ ($MISSION_DIR)}, workspace (${WORKSPACE_ROOT:-none})."
+else
+  REASON="Syntaur write boundary violation: Cannot write to '$FILE_PATH'. No active assignment for this session — writes are restricted to the workspace (${WORKSPACE_ROOT:-none})."
+fi
 REASON_ESCAPED=$(echo "$REASON" | jq -Rs '.' 2>/dev/null)
 if [ -z "$REASON_ESCAPED" ]; then
   REASON_ESCAPED="\"Syntaur write boundary violation\""

package/platforms/codex/scripts/session-cleanup.sh

@@ -31,19 +31,6 @@ if [ ! -f "$CONTEXT_FILE" ]; then
   exit 0
 fi
 
-# Keep derived status fresh on session end — CLI-direct (NO dashboard
-# dependency, unlike the session-stop PATCH below), migration-gated, and bounded
-# (~3s; no `timeout` on stock macOS). Best-effort; never blocks teardown.
-if command -v syntaur >/dev/null 2>&1; then
-  ( cd "$CWD" 2>/dev/null && syntaur recompute --if-migrated >/dev/null 2>&1 ) &
-  syntaur_rc_pid=$!
-  ( sleep 3; kill -KILL "$syntaur_rc_pid" 2>/dev/null ) >/dev/null 2>&1 &
-  syntaur_rc_killer=$!
-  wait "$syntaur_rc_pid" 2>/dev/null || true
-  kill -KILL "$syntaur_rc_killer" 2>/dev/null
-  wait "$syntaur_rc_killer" 2>/dev/null || true
-fi
-
 RUNTIME_DIR="${SYNTAUR_RUNTIME_SESSIONS_DIR:-$HOME/.syntaur/runtime/sessions}"
 
 # Walk the ancestor-pid chain reading runtime markers. Returns the nearest
@@ -84,6 +71,26 @@ resolve_session_from_markers() {
 }
 
 SESSION_ID=$(resolve_session_from_markers || true)
+
+# Keep derived status fresh on session end — keyed on the ending session's EXACT
+# id (the marker-resolved id, else the stdin id for runtimes that provide one).
+# Skip when NEITHER resolves, rather than fall back to ambiguous cwd own-session
+# resolution that could recompute the WRONG assignment in a shared worktree.
+# Runs BEFORE the stop PATCH below, so the engagement is still open. CLI-direct
+# (no dashboard), migration-gated, bounded (~3s; no `timeout` on stock macOS).
+STDIN_SID=$(echo "$INPUT" | jq -r '.session_id // empty' 2>/dev/null)
+RECOMPUTE_SID="${SESSION_ID:-$STDIN_SID}"
+if [ -n "$RECOMPUTE_SID" ] && command -v syntaur >/dev/null 2>&1; then
+  ( cd "$CWD" 2>/dev/null && \
+    syntaur recompute --if-migrated --session-id "$RECOMPUTE_SID" >/dev/null 2>&1 ) &
+  syntaur_rc_pid=$!
+  ( sleep 3; kill -KILL "$syntaur_rc_pid" 2>/dev/null ) >/dev/null 2>&1 &
+  syntaur_rc_killer=$!
+  wait "$syntaur_rc_pid" 2>/dev/null || true
+  kill -KILL "$syntaur_rc_killer" 2>/dev/null
+  wait "$syntaur_rc_killer" 2>/dev/null || true
+fi
+
 MISSION_SLUG=$(jq -r '.projectSlug // empty' "$CONTEXT_FILE" 2>/dev/null)
 
 # No EXACT id — do not risk stopping the wrong co-tenant session.

package/platforms/codex/skills/add-memory/SKILL.md

@@ -32,8 +32,9 @@ file-ownership protocol.
 
 ## Step 1: Resolve project
 
-If `.syntaur/context.json` is present and has `projectSlug`, default to that.
-Otherwise ask the user which project to add the memory to.
+If the session has an open engagement with an active assignment (`syntaur
+session resume --json`), default to its `projectSlug`. Otherwise ask the user
+which project to add the memory to.
 
 ## Step 2: Gather inputs
 

package/platforms/codex/skills/add-resource/SKILL.md

@@ -30,8 +30,9 @@ CLI-managed file per the file-ownership protocol).
 
 ## Step 1: Resolve project
 
-If `.syntaur/context.json` is present and has `projectSlug`, default to that.
-Otherwise ask the user which project to add the resource to.
+If the session has an open engagement with an active assignment (`syntaur
+session resume --json`), default to its `projectSlug`. Otherwise ask the user
+which project to add the resource to.
 
 ## Step 2: Gather inputs
 

package/platforms/codex/skills/bundle-worktree/SKILL.md

@@ -45,9 +45,9 @@ The computed worktree path is **always**
 
 ## Step 2: Pre-flight
 
-- Confirm `.syntaur/context.json` is a bundle context (has `bundleId`,
-  no assignment fields). If it's an assignment context, stop and tell the
-  user to `/grab-bundle <id>` first.
+- Confirm `.syntaur/context.json` is a bundle context (has `bundleId`). If the
+  session is instead bound to an assignment (an open engagement) with no
+  `bundleId`, stop and tell the user to `/grab-bundle <id>` first.
 - Confirm `<repository>/.git` exists.
 - Confirm the branch does NOT already exist. If it does, the CLI will
   surface a `GitWorktreeError` — surface that verbatim.

package/platforms/codex/skills/capture-artifacts/SKILL.md

@@ -17,7 +17,7 @@ Attach proof to your work. Reviewers should be able to scroll a single page (`pr
 
 ## Input
 
-No arguments. Reads `.syntaur/context.json` from the current working directory to identify the active assignment.
+No arguments. The active assignment is resolved from the session's open engagement (`.syntaur/context.json` is only a workspace marker, not the assignment source).
 
 ## Step 1: Decide whether to capture
 
@@ -60,7 +60,7 @@ Rules:
 - All other kinds (`screenshot`, `video`, `asciinema`) require `--file`. The CLI rejects nonexistent / non-file paths.
 - `--criterion <index>` is optional — pass the **0-based** index into the `## Acceptance Criteria` checklist when you want to anchor the artifact to a specific criterion.
 - `--transcribe` is video-only and writes a sibling `<id>.transcript.md` (requires `ELEVENLABS_API_KEY` + `ffmpeg`). `proof build` renders the transcript next to the player; clicking a phrase seeks the video.
-- If you have a `.syntaur/context.json` in the cwd, the positional target argument is unnecessary; otherwise pass `--project <slug> <assignment-slug>` or a bare assignment UUID.
+- If this session has an open engagement (active assignment), the positional target argument is unnecessary — the CLI resolves the target from the engagement. Otherwise pass `--project <slug> <assignment-slug>` or a bare assignment UUID.
 
 The CLI copies the file (if any) under `<assignmentDir>/proof/<criterion|untagged>/<id>.<ext>` and inserts a row in `~/.syntaur/syntaur.db`. Output prints the artifact id and absolute path.
 

package/platforms/codex/skills/claim-resource/SKILL.md

@@ -29,15 +29,15 @@ Examples:
 
 Extract `<inventory_slug>` (required, first positional), plus optional `--ttl <duration>` and `--for <tag>`.
 
-### Step 2: Pre-check assignment context
+### Step 2: Pre-check workspace context
 
-Read `.syntaur/context.json` from the current working directory. If the file is missing, OR has neither `sessionId` nor any of `projectSlug`/`assignmentSlug`/`assignmentDir`, abort with:
+Read `.syntaur/context.json` (a workspace marker) from the current working directory. If the file is missing, OR carries no workspace markers (`repository`/`branch`/`worktreePath`/`workspaceRoot`) and no `sessionId`, abort with:
 
 > "No active Syntaur context in this workspace. Grab an assignment first (`/grab-assignment <project> <slug>`) or restart the session so the SessionStart hook can populate `.syntaur/context.json`."
 
 This guard exists because writing a leases-only context file would trip `syntaur doctor`'s workspace check.
 
-If `--for` was not provided, derive its value from the context: prefer `assignmentSlug` if present, otherwise `sessionId`.
+If `--for` was not provided, derive its value: prefer the active assignment's slug from the session's open engagement (`syntaur session resume --json`); otherwise fall back to the `sessionId` from the workspace marker.
 
 ### Step 3: Run the claim CLI
 

package/platforms/codex/skills/clear-assignment/SKILL.md

@@ -14,7 +14,7 @@ metadata:
 
 # Clear Assignment
 
-Drop the active assignment binding from the current workspace. The assignment itself is left untouched in `~/.syntaur/projects/.../assignments/` — only the local `.syntaur/context.json` pointer is cleared so the session is no longer scoped to it.
+Drop the active assignment binding from the current session. The assignment itself is left untouched in `~/.syntaur/projects/.../assignments/` — only the session's open engagement (the binding that makes it the active assignment) is closed so the session is no longer scoped to it. `.syntaur/context.json` is a workspace marker and is not the binding — it does not hold the active assignment.
 
 This is the inverse of `grab-assignment`. Unlike `complete-assignment`, it does **not** transition lifecycle state, write a handoff, or close out the work. Use it when:
 
@@ -28,17 +28,15 @@ If the assignment is actually done, use `complete-assignment` instead so a hando
 
 Optional flags from the user:
 
-- `--keep-session` — preserve `sessionId` / `transcriptPath` fields in `context.json` (just strip the assignment fields). Default: full delete.
-- `--unassign` — also run `syntaur unassign <slug> --project <project>` so the assignment is no longer claimed by this agent. Default: leave the claim in place (only the local context is cleared).
+- `--unassign` — also run `syntaur unassign <slug> --project <project>` so the assignment is no longer claimed by this agent. Default: leave the claim in place (only the session's engagement is closed).
 
 ## Step 1: Load Context
 
-Read `.syntaur/context.json` from the current working directory.
+The active assignment is resolved from the session's open engagement. Run `syntaur session resume --json` to read it.
 
-- If the file does not exist, tell the user: "No active assignment context to clear." and stop.
-- If the file exists but contains only session fields (`sessionId`, `transcriptPath`) and no `projectSlug` / `assignmentSlug`, tell the user: "No active assignment is bound — only a platform session record exists. Nothing to clear." and stop (unless they explicitly ask to wipe the session record too).
+- If there is no open engagement, tell the user: "No active assignment is bound to this session — nothing to clear." and stop. (`.syntaur/context.json` is only a workspace marker; its presence does not mean an assignment is bound.)
 
-Otherwise extract: `projectSlug`, `assignmentSlug`, `assignmentDir`, `title`.
+From the resolved engagement, note: `projectSlug`, `assignmentSlug`, `assignmentDir`, `title`.
 
 ## Step 2: Confirm with the User
 
@@ -68,29 +66,15 @@ For standalone assignments use the UUID (the folder name) in place of the slug,
 
 `syntaur unassign` clears the assignee on the assignment frontmatter (the inverse of `assign`) and bumps `updated`.
 
-## Step 4: Clear the Context File
+## Step 4: Close the Engagement
 
-Default behavior — delete the file entirely:
+Closing the session's open engagement is what drops the active-assignment binding — that is the operation that "clears" the assignment. The dashboard status PATCH in Step 5 (to `cleared`) closes the open engagement for a live session.
 
-```bash
-rm .syntaur/context.json
-```
-
-If the user passed `--keep-session`, preserve session fields and strip everything else instead:
-
-```bash
-jq '{sessionId, transcriptPath} | with_entries(select(.value != null))' \
-  .syntaur/context.json > .syntaur/context.json.tmp \
-  && mv .syntaur/context.json.tmp .syntaur/context.json
-```
-
-If the resulting file would be empty (`{}`), delete it instead of leaving an empty stub.
-
-Do not delete the `.syntaur/` directory itself — other tooling may use it.
+Do NOT delete or rewrite `.syntaur/context.json` to clear the assignment — it is a workspace marker and no longer carries the active assignment. Leave its repository/branch/worktree, session, and lease fields intact so other tooling keeps recognizing the workspace. Do not delete the `.syntaur/` directory.
 
 ## Step 5: Close Session (optional)
 
-If the Syntaur dashboard is running, mark this session as cleared so the dashboard does not keep showing it as active. Resolve `<session-id>` from *your* running process — prefer `$CLAUDE_CODE_SESSION_ID` (or the peer `OPENCODE_SESSION_ID` / `PI_SESSION_ID`), otherwise run `syntaur session resolve-id`. Only if neither yields an id, fall back to the `sessionId` you captured from the original `context.json` in Step 1 (before deletion) — that scalar is a shared, legacy hint a co-tenant can clobber, so don't treat it as authoritative:
+If the Syntaur dashboard is running, mark this session as cleared so the dashboard does not keep showing it as active (this also closes the session's open engagement). Resolve `<session-id>` from *your* running process — prefer `$CLAUDE_CODE_SESSION_ID` (or the peer `OPENCODE_SESSION_ID` / `PI_SESSION_ID`), otherwise run `syntaur session resolve-id`. Only if neither yields an id, fall back to the legacy `sessionId` scalar in `.syntaur/context.json` — that scalar is a shared, legacy hint a co-tenant can clobber, so don't treat it as authoritative:
 
 ```bash
 curl -s -X PATCH "http://localhost:$(cat ~/.syntaur/dashboard-port 2>/dev/null || echo 4800)/api/agent-sessions/<session-id>/status" \
@@ -100,8 +84,6 @@ curl -s -X PATCH "http://localhost:$(cat ~/.syntaur/dashboard-port 2>/dev/null |
 
 If this fails (e.g., dashboard not running, endpoint not present in the installed version), it is non-critical — silently continue.
 
-Skip this step entirely when `--keep-session` is set.
-
 ## Step 6: Report to User
 
 Summarize:

package/platforms/codex/skills/complete-assignment/SKILL.md

@@ -19,11 +19,11 @@ Optional: the user may pass `--complete` to transition directly to `completed` i
 
 ## Step 1: Load Context
 
-Read `.syntaur/context.json` from the current working directory.
+The active assignment is resolved from the session's open engagement. Run `syntaur session resume --json` to read it.
 
-If the file does not exist, tell the user: "No active assignment found. Run `grab-assignment` first."
+If there is no open engagement (no active assignment), tell the user: "No active assignment for this session — grab one first." `.syntaur/context.json` is only a workspace marker; do not read the assignment from it.
 
-Extract: `projectSlug`, `assignmentSlug`, `assignmentDir`, `projectDir`.
+From the resolved engagement, note: `projectSlug`, `assignmentSlug`, `assignmentDir`, `projectDir`.
 
 ## Step 2: Load Playbooks
 

package/platforms/codex/skills/create-assignment/SKILL.md

@@ -30,9 +30,9 @@ Expects arguments from the user:
 
 If no title was provided, ask the user what the assignment should be called.
 
-If neither `--project` nor `--one-off` was provided, check `.syntaur/context.json` for an active assignment. If present, default `--project` to that context's `projectSlug` and confirm with the user: "Add this assignment to project `<projectSlug>`?"
+If neither `--project` nor `--one-off` was provided, check for an active assignment via the session's open engagement (`syntaur session resume --json`). If there is one, default `--project` to its `projectSlug` and confirm with the user: "Add this assignment to project `<projectSlug>`?"
 
-If no active context and no project flag, ask the user which project to add it to, or whether it should be a one-off.
+If there is no open engagement and no project flag, ask the user which project to add it to, or whether it should be a one-off.
 
 ## Step 1: Run the CLI
 

package/platforms/codex/skills/extend-resource/SKILL.md

@@ -25,9 +25,9 @@ Examples:
 
 Extract `<lease_id>` (first positional) and `--ttl <duration>` (required). If either is missing, abort with a usage message and a hint to call `/list-resources` to see active leases.
 
-### Step 2: Pre-check assignment context
+### Step 2: Pre-check workspace context
 
-Read `.syntaur/context.json` from the current working directory. If the file is missing, OR has neither `sessionId` nor any of `projectSlug`/`assignmentSlug`/`assignmentDir`, abort with:
+Read `.syntaur/context.json` (a workspace marker) from the current working directory. If the file is missing, OR carries no workspace markers (`repository`/`branch`/`worktreePath`/`workspaceRoot`) and no `sessionId`, abort with:
 
 > "No active Syntaur context in this workspace. Grab an assignment first (`/grab-assignment <project> <slug>`) or restart the session so the SessionStart hook can populate `.syntaur/context.json`."
 

package/platforms/codex/skills/grab-assignment/SKILL.md

@@ -23,10 +23,16 @@ Expects up to two arguments from the user:
 
 ## Pre-flight Check
 
-Check if `.syntaur/context.json` already exists in the current working directory.
+`.syntaur/context.json` is a WORKSPACE MARKER (repository/branch/worktree/workspaceRoot plus legacy session and bundle fields) — it is NOT the active-assignment source of truth. The active assignment binds via the session's open engagement (established by `track-session` in Step 6).
 
-- If it exists AND contains BOTH `projectSlug` and `assignmentSlug`, it represents an active assignment. Warn the user: "You already have an active assignment: `<assignmentSlug>` in project `<projectSlug>`. Grabbing a new one will replace this context. Proceed?" — stop if the user says no.
-- If it exists but only has session fields (`sessionId`, `transcriptPath`) and no project/assignment, it was populated by the platform's SessionStart hook (Claude Code, etc.) and does NOT represent an active assignment. Proceed silently and merge assignment fields on top in Step 5.
+Check whether this session already has an open engagement — i.e., a different assignment is already active:
+
+```bash
+syntaur session resume --json 2>/dev/null
+```
+
+- If it reports an active assignment, warn the user: "You already have an active assignment: `<assignmentSlug>` in project `<projectSlug>`. Grabbing a new one will rebind this session. Proceed?" — stop if the user says no.
+- If there is no open engagement (no active assignment), proceed. A `.syntaur/context.json` that holds only workspace-marker / session fields is expected — it does not represent an active assignment.
 
 ## Step 1: Discover the Project (project-nested path)
 
@@ -75,25 +81,24 @@ From the assignment frontmatter extract: `title`, `workspace.repository`, `works
 
 If `workspace.repository` and `workspace.worktreePath` are both null, set them to the current working directory. Write boundaries use this path, so it must never be null while an agent is writing code.
 
-## Step 5: Create or Merge Context File
+## Step 5: Create or Merge the Workspace Marker
 
-Merge assignment context into `.syntaur/context.json`. Never overwrite — if the file already exists (e.g., platform SessionStart hook populated `sessionId` / `transcriptPath`), preserve those fields.
+`.syntaur/context.json` is a WORKSPACE MARKER — it records the repository/branch/worktree so tooling can recognize this directory as a Syntaur workspace. It is NOT the active-assignment source of truth: the assignment binds via the session's open engagement (Step 6, `track-session`). Do NOT write `projectSlug` / `assignmentSlug` / `assignmentDir` / `projectDir` / `title` — those scalars are non-authoritative.
+
+Merge workspace markers into `.syntaur/context.json`. Never overwrite — if the file already exists (e.g., platform SessionStart hook populated `sessionId` / `transcriptPath`, or a worktree skill wrote bundle/lease fields), preserve those fields.
 
 ```bash
 mkdir -p .syntaur
 ```
 
-Prepare the assignment payload:
+Prepare the workspace-marker payload:
 
 ```json
 {
-  "projectSlug": "<project-slug or null for standalone>",
-  "assignmentSlug": "<assignment-slug>",
-  "projectDir": "/absolute/path/to/project or null",
-  "assignmentDir": "/absolute/path/to/assignment",
-  "workspaceRoot": "<workspace path or current working directory>",
-  "title": "<assignment title>",
+  "repository": "<workspace.repository or null>",
   "branch": "<workspace.branch or null>",
+  "worktreePath": "<workspace.worktreePath or null>",
+  "workspaceRoot": "<workspace path or current working directory>",
   "grabbedAt": "<ISO 8601 timestamp>"
 }
 ```

package/platforms/codex/skills/grab-bundle/SKILL.md

@@ -34,16 +34,20 @@ the user to pick.
 
 ## Pre-flight check
 
-Read `.syntaur/context.json` in the current working directory.
+First check whether this session already has an active assignment via its open
+engagement (`syntaur session resume --json`):
+
+- If it reports an active assignment, warn the user: "You already have an active
+  assignment. Grabbing a bundle will rebind this session. Proceed?" — stop if no.
+
+Then read `.syntaur/context.json` (a workspace marker) in the current working
+directory for bundle bookkeeping:
 
-- If it already contains assignment fields (`projectSlug`/`assignmentSlug`/
-  `assignmentDir`), warn the user: "You already have an active assignment.
-  Grabbing a bundle will replace this context. Proceed?" — stop if no.
 - If it already contains different bundle fields (`bundleId` set to a
   different id), warn: "Context is bound to bundle b:<old>. Switch to b:<new>?"
   — stop if no.
-- If it has only `sessionId` (platform SessionStart hook seeded it), proceed
-  and merge bundle fields on top.
+- A context.json holding only workspace-marker / `sessionId` fields is expected;
+  proceed and merge bundle fields on top.
 
 ## Step 1: Load the bundle
 

package/platforms/codex/skills/log-progress/SKILL.md

@@ -39,9 +39,11 @@ records current in real-time, especially after every meaningful action.
 
 ## Step 1: Verify there is an active assignment
 
-Read `.syntaur/context.json` from the current working directory. Extract
-`assignmentDir`. If missing, abort with: "No active assignment. Run
-`grab-assignment` first."
+The active assignment is resolved from the session's open engagement — `syntaur
+progress log` (Step 3) targets it automatically. `.syntaur/context.json` is only
+a workspace marker; do not read the assignment from it. If there is no open
+engagement (no active assignment), the CLI aborts with "No active assignment for
+this session — grab one first." Run `grab-assignment` first.
 
 ## Step 2: Compose the entry
 
@@ -69,7 +71,7 @@ Run:
 syntaur progress log "<your composed entry body>"
 ```
 
-The command resolves the active assignment from `.syntaur/context.json`
+The command resolves the active assignment from the session's open engagement
 (or pass `--assignment <slug> [--project <slug>]` to target one explicitly),
 then atomically:
 

package/platforms/codex/skills/plan-assignment/SKILL.md

@@ -20,14 +20,14 @@ Optional: the user may provide focus areas or notes to guide the plan.
 
 ## Step 1: Load Context
 
-Read `.syntaur/context.json` from the current working directory. If the file does not exist, tell the user: "No active assignment found. Run `grab-assignment` first to claim an assignment."
+The active assignment is resolved from the session's open engagement. Run `syntaur session resume --json` to read it. If there is no open engagement (no active assignment), tell the user: "No active assignment for this session — grab one first." and stop. `.syntaur/context.json` is only a workspace marker; do not read the assignment from it.
 
-Extract:
+From the resolved engagement, note:
 - `projectSlug` — the project slug (`null` for standalone assignments)
 - `assignmentSlug` — the assignment slug
 - `assignmentDir` — absolute path to the assignment folder
 - `projectDir` — absolute path to the project folder (may be null for standalone)
-- `workspaceRoot` — absolute path to the workspace (may be null)
+- `workspaceRoot` — absolute path to the workspace (a workspace marker; may be null)
 
 ## Step 2: Load Playbooks
 

package/platforms/codex/skills/plan-bundle/SKILL.md

@@ -19,9 +19,10 @@ the bundle's own to track, only the member todos.
 
 ## Step 1: Load context
 
-Read `.syntaur/context.json` from the current working directory. It must
-contain `bundleId` (a bundle context). If it instead has assignment fields,
-stop and tell the user: "Active context is an assignment, not a bundle.
+Read `.syntaur/context.json` (a workspace marker) from the current working
+directory. It must contain `bundleId` (a bundle context). If there is no
+`bundleId` but the session has an open engagement (an active assignment), stop
+and tell the user: "This session is bound to an assignment, not a bundle.
 Use `/plan-assignment` instead, or `/grab-bundle <id>` to switch."
 
 Extract `bundleId`, `bundleScope`, `bundleScopeId`, `todoIds`, `planDir`.