syntaur 0.70.0 → 0.72.0

package/platforms/codex/skills/replan/SKILL.md

@@ -38,12 +38,15 @@ todos are never deleted.**
 
 ## Step 1: Verify there is an active assignment
 
-Read `.syntaur/context.json` from the current working directory. Extract
-`assignmentSlug`, `projectSlug` (may be null for standalone), and
-`assignmentDir`.
-
-If the file is missing or has no `assignmentSlug`, abort with: "No active
-Syntaur assignment. Run `grab-assignment` first." Do not invent values.
+The active assignment is resolved from the session's open engagement. Run
+`syntaur session resume --json` to read the bound `assignmentSlug`,
+`projectSlug` (may be null for standalone), and `assignmentDir`.
+`.syntaur/context.json` is only a workspace marker — do not read the assignment
+from it.
+
+If there is no open engagement (no active assignment), abort with: "No active
+assignment for this session — grab one first." Run `grab-assignment` first. Do
+not invent values.
 
 ## Step 2: Confirm the prior plan was implemented
 

package/platforms/codex/skills/resume-session/SKILL.md

@@ -2,8 +2,9 @@
 name: resume-session
 description: >-
   Re-orient a fresh Syntaur session on the active assignment without
-  re-reading the full transcript. Loads the latest saved session summary,
-  `.syntaur/context.json`, and any open handoff. Use when the user says
+  re-reading the full transcript. Resolves the active assignment from the
+  session's open engagement and loads the latest saved session summary and any
+  open handoff. Use when the user says
   "resume", "pick up where we left off", "continue this assignment", or after
   a compact / new session start. Symmetric counterpart to
   `/save-session-summary`.
@@ -28,15 +29,20 @@ freely; nothing on disk changes.
 - Saving the current session's progress — that's `/save-session-summary` (the
   symmetric write side).
 
-## Step 1: Verify there is an active context
+## Step 1: Verify there is an active assignment
 
 Run `syntaur session resume`. The CLI:
 
-1. Reads `.syntaur/context.json` from the current working directory.
-2. Aborts (exit 1) with a clear message if missing or if no `assignmentDir`
-   is set — telling the user to run `grab-assignment` first.
-3. Otherwise scans `<assignmentDir>/sessions/<sid>/summary.md` and picks the
-   most recently modified.
+1. Resolves the active assignment from the session's OPEN engagement (the
+   assignment this session is currently bound to). `.syntaur/context.json` is
+   only a workspace marker — it identifies the repository/branch/worktree, not
+   the active assignment.
+2. Aborts (exit 1) with a clear message when there is no open engagement —
+   "No active assignment for this session — grab one first" — telling the user
+   to run `grab-assignment`.
+3. Otherwise resolves the assignment dir from the engagement and scans
+   `<assignmentDir>/sessions/<sid>/summary.md`, picking the most recently
+   modified.
 4. Reads `<assignmentDir>/handoff.md` (the canonical single-file handoff per
    assignment, managed by `complete-assignment`) and reports it if its body
    has been written beyond the scaffolded placeholder.

package/platforms/codex/skills/save-session-summary/SKILL.md

@@ -26,11 +26,11 @@ mid-assignment continuity** — distinct from `handoff.md`, which is the
 
 ## Step 1: Load Context
 
-Read `.syntaur/context.json` from the current working directory.
+The active assignment is resolved from the session's open engagement. Run `syntaur session resume --json` to read it.
 
-If the file does not exist, tell the user: "No active assignment found. Run `grab-assignment` first." and stop.
+If there is no open engagement (no active assignment), tell the user: "No active assignment for this session — grab one first." and stop. `.syntaur/context.json` is only a workspace marker; do not read the assignment from it.
 
-Extract:
+From the resolved engagement, note:
 - `assignmentDir` (absolute path) — required.
 
 **Do not read the session id from `context.json` for identity.** That scalar is
@@ -86,7 +86,7 @@ printf '%s' "$BODY" | syntaur session save
 # Pass --session-id <id> only to override (e.g. you already have $CLAUDE_CODE_SESSION_ID).
 ```
 
-Resolves the active assignment from `.syntaur/context.json` (or pass
+Resolves the active assignment from the session's open engagement (or pass
 `--assignment <slug> [--project <slug>]`). `--session-id` now defaults to the
 **resolved** session (env → process tree → transcript), falling back to the
 `context.json` hint only as a last resort — so a co-tenant that clobbered the

package/platforms/codex/skills/set-workspace/SKILL.md

@@ -35,11 +35,14 @@ implementation code until workspace fields are set.
 
 ## Step 1: Resolve the assignment file
 
-Read `.syntaur/context.json` from the current working directory. Extract
-`assignmentDir`. The target file is `<assignmentDir>/assignment.md`.
+The active assignment is resolved from the session's open engagement — `syntaur
+workspace set` (Step 3) targets it automatically. `.syntaur/context.json` is
+only a workspace marker; do not read the assignment from it.
 
-If no context, abort with: "No active assignment. Run `grab-assignment`
-first."
+If there is no open engagement (no active assignment), the CLI aborts with "No
+active assignment for this session — grab one first." Run `grab-assignment`
+first, or pass `--assignment <slug> [--project <slug>]` to target one
+explicitly.
 
 ## Step 2: Gather inputs
 
@@ -68,8 +71,8 @@ syntaur workspace set \
   --parent-branch <parent>
 ```
 
-Targets the active assignment from `.syntaur/context.json` by default; pass
-`--assignment <slug> [--project <slug>]` to target one explicitly. The command
+Targets the active assignment from the session's open engagement by default;
+pass `--assignment <slug> [--project <slug>]` to target one explicitly. The command
 does the whole safe write in one atomic step:
 
 - **Pre-write validation** — runs the same checks as `syntaur doctor

package/platforms/codex/skills/syntaur-protocol/SKILL.md

@@ -32,7 +32,7 @@ Respect file ownership boundaries. The Claude Code and Codex plugins enforce the
    - `~/.syntaur/projects/<project>/resources/<slug>.md`
    - `~/.syntaur/projects/<project>/memories/<slug>.md`
 3. **Workspace files** inside the assignment's configured `workspace.worktreePath` / `workspace.repository`.
-4. **Context file:** `.syntaur/context.json` in the current working directory.
+4. **Workspace marker:** `.syntaur/context.json` in the current working directory (repository/branch/worktree markers plus legacy session/lease bookkeeping — not the active-assignment source of truth).
 
 ### Files written only via CLI (never edit directly)
 
@@ -51,16 +51,18 @@ Per-project `agent.md` / `claude.md` do NOT exist in protocol v2.0. Agent-level
 
 ## Current Assignment Context
 
-If `.syntaur/context.json` exists in the current working directory, read it before making changes. Fields you will see:
+The **active assignment** is resolved from the session's OPEN engagement — the assignment this session is currently bound to (established by `syntaur track-session`). It is NOT read from `.syntaur/context.json`. To learn the active assignment, run `syntaur session resume` (or `--json`); to bind a different one, `grab-assignment` (which calls `track-session`).
 
-- `projectSlug` — containing project slug (`null` for standalone assignments)
-- `assignmentSlug` — assignment slug (for standalone, the UUID is the folder name; slug is display-only)
-- `projectDir` — absolute path to the project folder (`null` for standalone)
-- `assignmentDir` — absolute path to the assignment folder
+`.syntaur/context.json` is a WORKSPACE MARKER file — it identifies the workspace directory and carries legacy session and resource-lease bookkeeping. It is NOT authoritative for the active assignment. Read it for workspace markers and leases; do NOT treat `projectSlug` / `assignmentSlug` / `assignmentDir` as the active-assignment source of truth (any such scalars are non-authoritative legacy hints). Fields you may see:
+
+- `repository` — workspace repository (path or remote URL)
+- `branch` — workspace branch, if known
+- `worktreePath` — absolute path to the worktree, if this workspace is a worktree
 - `workspaceRoot` — absolute path to the code workspace
-- `sessionId` — real agent-runtime session id (never a synthesized UUID)
+- `sessionId` — real agent-runtime session id (legacy hint; never a synthesized UUID, and a co-tenant can clobber it — not authoritative for identity)
 - `transcriptPath` — absolute path to the agent's rollout/transcript file, if known
 - `leases` — array of active resource-lease records (managed by `/claim-resource` and `/release-resource`). Entry shape: `{ lease_id, inventory_slug, member_id, expires_at, metadata, claimed_at }`. Leases are NOT auto-released on session end or assignment completion in v1 — call `/release-resource` explicitly (or let the TTL expire).
+- `bundleId` and related bundle fields — present when this workspace is bound to a todo bundle (managed by the bundle skills).
 
 ## Required Reading Order
 

package/platforms/codex/skills/syntaur-protocol/references/file-ownership.md

@@ -64,4 +64,4 @@ When working on code (not protocol files), you may write to files within the wor
 
 - `workspace.worktreePath` or `workspace.repository` defines your code root.
 - You may create and edit source files within that workspace.
-- The `.syntaur/context.json` context file in your working directory is also writable (merge, don't overwrite — the platform SessionStart hook may have populated `sessionId` and `transcriptPath`).
+- The `.syntaur/context.json` workspace-marker file in your working directory is also writable (merge, don't overwrite — the platform SessionStart hook may have populated `sessionId` and `transcriptPath`). It marks the workspace (repository/branch/worktree); it is not the active-assignment source of truth — the active assignment resolves from the session's open engagement.

package/platforms/codex/skills/syntaur-worktree/SKILL.md

@@ -23,8 +23,9 @@ operations:
    transactionally — rolls back the worktree on write failure).
 3. `syntaur assign` + `syntaur start` — claim the assignment for this agent
    and transition to `in_progress`.
-4. Write `.syntaur/context.json` inside the new worktree so the session is
-   bound there.
+4. Write `.syntaur/context.json` (a workspace marker) inside the new worktree,
+   then `syntaur track-session` to bind the session's engagement to the
+   assignment.
 
 ## When NOT to use this skill
 
@@ -82,12 +83,15 @@ syntaur start <assignment> --project <project-slug>   # only if status was pendi
 Skip `start` for any non-`pending` status — never rewind a `review`,
 `completed`, or `failed` assignment.
 
-## Step 5: Bind the new worktree to your session
+## Step 5: Write the workspace marker
 
-`cd` into the new worktree path. Write
-`<worktreePath>/.syntaur/context.json` mirroring the format produced by
-`/grab-assignment` (projectSlug, assignmentSlug, projectDir, assignmentDir,
-workspaceRoot, title, branch, sessionId, transcriptPath, grabbedAt).
+`cd` into the new worktree path. Write `<worktreePath>/.syntaur/context.json`
+mirroring the WORKSPACE-MARKER format produced by `/grab-assignment`:
+`repository`, `branch`, `worktreePath`, `workspaceRoot`, `grabbedAt`, plus
+`sessionId` / `transcriptPath` when known. Do NOT write `projectSlug` /
+`assignmentSlug` / `assignmentDir` / `projectDir` / `title` — context.json is a
+workspace marker, not the active-assignment source. The assignment binds in the
+next step via the session's engagement (`track-session`).
 
 If the runtime exposes a real session id (e.g. Claude Code's
 `~/.claude/sessions/`), include it. Otherwise omit `sessionId` entirely; the

package/platforms/hermes/plugins/syntaur/__init__.py

@@ -57,6 +57,24 @@ def _dashboard_port():
         return "4800"
 
 
+def _resolve_boundary(cwd, session_id=None):
+    """Resolve the write boundary {assignmentDir, projectDir, workspaceRoot} from
+    the session's OPEN engagement via the CLI. context.json is a workspace marker
+    now — the active assignment lives on the engagement, so the enforcer can no
+    longer read assignmentDir/projectDir straight from the file. Returns {} on any
+    failure, which makes is_write_allowed fall back to workspace-only enforcement
+    (never fail-open)."""
+    argv = ["syntaur", "session", "boundary", "--json", "--cwd", cwd]
+    if session_id:
+        argv += ["--session-id", session_id]
+    try:
+        out = subprocess.run(argv, capture_output=True, text=True, timeout=3)
+        data = json.loads(out.stdout or "{}")
+        return data if isinstance(data, dict) else {}
+    except Exception:
+        return {}
+
+
 def _log_violation(reason):
     try:
         sys.stderr.write("[syntaur] " + reason + "\n")
@@ -80,7 +98,14 @@ def _on_pre_tool_call(tool_name=None, args=None, task_id=None, **kwargs):
         cwd = os.getcwd()
         ctx = boundary.load_context(cwd)
         if not ctx:
-            return None
+            return None  # no .syntaur/context.json → not in a workspace → allow
+        # Resolve the real assignment/project boundary from the session's open
+        # engagement and merge it over the workspace markers in context.json.
+        # If nothing resolves, is_write_allowed enforces workspace-only.
+        resolved = _resolve_boundary(cwd, ctx.get("sessionId"))
+        for k in ("assignmentDir", "projectDir", "workspaceRoot"):
+            if resolved.get(k):
+                ctx[k] = resolved[k]
         abs_path = path if os.path.isabs(path) else os.path.join(cwd, path)
         context_file = os.path.join(cwd, ".syntaur", "context.json")
         allowed, reason = boundary.is_write_allowed(abs_path, ctx, context_file)
@@ -129,8 +154,9 @@ def _make_command_handler(cmd):
             except Exception as exc:
                 return "Failed to run syntaur %s: %s" % (" ".join(cmd["argv"]), exc)
         return (
-            'Follow the Syntaur "%s" skill (installed via skills). It derives the active '
-            "assignment/session from .syntaur/context.json." % cmd["skill"]
+            'Follow the Syntaur "%s" skill (installed via skills). It resolves the active '
+            "assignment from the session's open engagement (.syntaur/context.json is a "
+            "workspace marker)." % cmd["skill"]
         )
 
     return handler

package/platforms/hermes/plugins/syntaur/boundary.py

@@ -18,7 +18,16 @@ def _expand_home(p):
 
 
 def load_context(cwd):
-    """Read <cwd>/.syntaur/context.json; return a dict or None (fail-open)."""
+    """Read <cwd>/.syntaur/context.json; return its WORKSPACE-MARKER fields, or
+    None when absent/unparseable (caller treats None as "not in a workspace").
+
+    Deliberately does NOT surface the demoted assignment scalars
+    (assignmentDir/projectDir): the active assignment/project dirs are resolved
+    from the session's open engagement by the caller and merged in. Surfacing
+    stale legacy scalars here would let them leak through on a boundary-resolution
+    failure, so the {}-failure path could wrongly allow writes under a stale dir
+    instead of staying workspace-only.
+    """
     path = os.path.join(cwd, ".syntaur", "context.json")
     try:
         with open(path, "r", encoding="utf-8") as fh:
@@ -37,8 +46,6 @@ def load_context(cwd):
         return _expand_home(v) if v else None
 
     return {
-        "assignmentDir": home("assignmentDir"),
-        "projectDir": home("projectDir"),
         "workspaceRoot": home("workspaceRoot"),
         "sessionId": s("sessionId"),
         "projectSlug": s("projectSlug"),
@@ -67,12 +74,14 @@ def is_write_allowed(abs_file_path, ctx, context_file_abs=None):
     resources/memories (excluding derived `_*` files), equal to the context file,
     or under the workspace root. Otherwise blocked.
     """
-    # Parity with the bash hook (enforce-boundaries.sh:69): enforcement requires
-    # BOTH assignmentDir and projectDir. If either is missing (standalone / old /
-    # partially-written context), fail OPEN — allow everything.
-    if not ctx.get("assignmentDir") or not ctx.get("projectDir"):
-        return True, None
-
+    # context.json is a WORKSPACE MARKER now (the assignment scalars were
+    # demoted); the active assignment resolves from the session's open engagement.
+    # When the caller cannot supply assignmentDir/projectDir (no engagement
+    # resolved), we do NOT fail open — we enforce WORKSPACE-ONLY via the
+    # workspaceRoot marker below. Each dir check is guarded for absence, so a
+    # missing assignmentDir/projectDir simply narrows the allowlist rather than
+    # disabling it. (Assignment-record writes under ~/.syntaur go through the CLI,
+    # not the agent's file tools, so they never hit this hook.)
     f = _norm(abs_file_path)
 
     if ctx.get("assignmentDir") and _is_under(f, ctx["assignmentDir"]):

package/platforms/pi/extensions/syntaur/index.ts

@@ -13,18 +13,30 @@
 // pi.registerCommand(name, { description, handler }) }`. The `tool_call` handler
 // returns `{ block: true, reason }` to DENY a tool call; any other return allows.
 
-import { readFileSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { isAbsolute, resolve, sep } from 'node:path';
 
 export interface SyntaurContext {
-  assignmentDir?: string;
-  projectDir?: string;
+  /** Workspace marker; the only path scalar still authoritative in context.json. */
   workspaceRoot?: string;
   sessionId?: string;
   projectSlug?: string;
 }
 
+/**
+ * The resolved write boundary for a session — mirrors the CLI's
+ * `syntaur session boundary --json` contract. The assignment/project dirs come
+ * from the session's OPEN engagement (NOT context.json, whose assignment scalars
+ * were demoted). `workspaceRoot` is the context.json marker.
+ */
+export interface SyntaurBoundary {
+  assignmentDir?: string;
+  projectDir?: string;
+  workspaceRoot?: string;
+}
+
 /** Expand a leading `~` to the home dir (the only expansion the bash hooks do). */
 function expandHome(p: string): string {
   if (p === '~') return homedir();
@@ -32,7 +44,12 @@ function expandHome(p: string): string {
   return p;
 }
 
-/** Read `<cwd>/.syntaur/context.json`; null when absent/unparseable (fail-open). */
+/**
+ * Read `<cwd>/.syntaur/context.json`. context.json is now a WORKSPACE MARKER —
+ * this only surfaces `workspaceRoot` / `sessionId` / `projectSlug`. The active
+ * assignment/project dirs live on the session's engagement (resolveBoundary).
+ * null when absent/unparseable.
+ */
 export function loadContext(cwd: string): SyntaurContext | null {
   const file = resolve(cwd, '.syntaur', 'context.json');
   let raw: string;
@@ -49,18 +66,50 @@ export function loadContext(cwd: string): SyntaurContext | null {
   }
   const str = (v: unknown): string | undefined =>
     typeof v === 'string' && v.length > 0 ? v : undefined;
-  const assignmentDir = str(data.assignmentDir);
-  const projectDir = str(data.projectDir);
   const workspaceRoot = str(data.workspaceRoot);
   return {
-    assignmentDir: assignmentDir ? expandHome(assignmentDir) : undefined,
-    projectDir: projectDir ? expandHome(projectDir) : undefined,
     workspaceRoot: workspaceRoot ? expandHome(workspaceRoot) : undefined,
     sessionId: str(data.sessionId),
     projectSlug: str(data.projectSlug),
   };
 }
 
+/** True iff `<cwd>/.syntaur/context.json` exists (the Syntaur-workspace marker). */
+export function hasContextFile(cwd: string): boolean {
+  return existsSync(resolve(cwd, '.syntaur', 'context.json'));
+}
+
+/**
+ * Resolve the write boundary from the session's OPEN engagement by shelling out
+ * to the same CLI the bash hooks call: `syntaur session boundary --json`. Returns
+ * a {} boundary (all-empty → workspace-only enforcement) on ANY failure — the CLI
+ * itself never throws, and a missing/old CLI must NOT fail open. Paths are
+ * `~`-expanded for parity with the bash hooks.
+ */
+export function resolveBoundary(cwd: string, sessionId?: string): SyntaurBoundary {
+  const args = ['session', 'boundary', '--json'];
+  if (sessionId) args.push('--session-id', sessionId);
+  let parsed: Record<string, unknown> = {};
+  try {
+    const r = spawnSync('syntaur', args, { cwd, encoding: 'utf-8', timeout: 5000 });
+    if (r.status === 0 && typeof r.stdout === 'string' && r.stdout.trim().length > 0) {
+      parsed = JSON.parse(r.stdout) as Record<string, unknown>;
+    }
+  } catch {
+    /* CLI missing / spawn error / unparseable → empty boundary (workspace-only) */
+  }
+  const str = (v: unknown): string | undefined =>
+    typeof v === 'string' && v.length > 0 ? v : undefined;
+  const assignmentDir = str(parsed.assignmentDir);
+  const projectDir = str(parsed.projectDir);
+  const workspaceRoot = str(parsed.workspaceRoot);
+  return {
+    assignmentDir: assignmentDir ? expandHome(assignmentDir) : undefined,
+    projectDir: projectDir ? expandHome(projectDir) : undefined,
+    workspaceRoot: workspaceRoot ? expandHome(workspaceRoot) : undefined,
+  };
+}
+
 /** True if `child` is strictly under `parent` (mirrors the bash `"$X"/*` test). */
 function isUnder(child: string, parent: string): boolean {
   if (!parent) return false;
@@ -76,31 +125,31 @@ function basename(p: string): string {
 }
 
 /**
- * Decide whether a write to `absFilePath` is allowed under the active assignment.
- * Mirrors `platforms/claude-code/hooks/enforce-boundaries.sh` exactly:
- *  - allow under assignmentDir
+ * Decide whether a write to `absFilePath` is allowed under the resolved boundary.
+ * Mirrors `platforms/claude-code/hooks/enforce-boundaries.sh`:
+ *  - allow under assignmentDir (if resolved)
  *  - allow under projectDir/resources/ and projectDir/memories/ EXCEPT derived `_*` files
  *  - allow the `.syntaur/context.json` file itself (caller passes cwd-resolved path)
  *  - allow under workspaceRoot (if set)
  *  - otherwise block
+ *
+ * CRITICAL: no fail-open. When the boundary has no assignment/project (no open
+ * engagement) but a workspace is known, only the workspace-root (and context
+ * file) gates can match → WORKSPACE-ONLY enforcement. Every `isUnder` check is
+ * already empty-safe (`isUnder` returns false for an empty parent).
  */
 export function isWriteAllowed(
   absFilePath: string,
-  ctx: SyntaurContext,
+  boundary: SyntaurBoundary,
   contextFileAbs?: string,
 ): { allowed: boolean; reason?: string } {
-  // Parity with the bash hook (enforce-boundaries.sh:69): enforcement requires
-  // BOTH assignmentDir and projectDir. If either is missing (standalone / old /
-  // partially-written context), fail OPEN — allow everything.
-  if (!ctx.assignmentDir || !ctx.projectDir) return { allowed: true };
-
   const file = resolve(absFilePath);
 
-  if (ctx.assignmentDir && isUnder(file, ctx.assignmentDir)) return { allowed: true };
+  if (boundary.assignmentDir && isUnder(file, boundary.assignmentDir)) return { allowed: true };
 
-  if (ctx.projectDir) {
-    const resourcesDir = resolve(ctx.projectDir, 'resources');
-    const memoriesDir = resolve(ctx.projectDir, 'memories');
+  if (boundary.projectDir) {
+    const resourcesDir = resolve(boundary.projectDir, 'resources');
+    const memoriesDir = resolve(boundary.projectDir, 'memories');
     for (const dir of [resourcesDir, memoriesDir]) {
       if (isUnder(file, dir) && !basename(file).startsWith('_')) return { allowed: true };
     }
@@ -108,12 +157,14 @@ export function isWriteAllowed(
 
   if (contextFileAbs && file === resolve(contextFileAbs)) return { allowed: true };
 
-  if (ctx.workspaceRoot && isUnder(file, ctx.workspaceRoot)) return { allowed: true };
+  if (boundary.workspaceRoot && isUnder(file, boundary.workspaceRoot)) return { allowed: true };
 
-  const reason =
-    `Syntaur write boundary violation: cannot write to '${file}'. Allowed: assignment dir ` +
-    `(${ctx.assignmentDir ?? 'n/a'}), project resources/memories, workspace ` +
-    `(${ctx.workspaceRoot ?? 'n/a'}).`;
+  const reason = boundary.assignmentDir
+    ? `Syntaur write boundary violation: cannot write to '${file}'. Allowed: assignment dir ` +
+      `(${boundary.assignmentDir}), project resources/memories, workspace ` +
+      `(${boundary.workspaceRoot ?? 'n/a'}).`
+    : `Syntaur write boundary violation: cannot write to '${file}'. No active assignment for ` +
+      `this session — writes are restricted to the workspace (${boundary.workspaceRoot ?? 'n/a'}).`;
   return { allowed: false, reason };
 }
 
@@ -229,11 +280,16 @@ export default function activate(pi: {
     const path = extractWritePath(e.toolName, e.input);
     if (!path) return; // not a write → allow
     const cwd = process.cwd();
+    // context.json presence is the Syntaur-workspace marker. Absent → not a
+    // Syntaur workspace → allow (unchanged). Present → enforce. The assignment
+    // boundary is resolved from the session's OPEN engagement via the CLI — NOT
+    // the demoted context.json scalars. No engagement → workspace-only.
+    if (!hasContextFile(cwd)) return; // not a Syntaur workspace → allow
     const ctx = loadContext(cwd);
-    if (!ctx) return; // no active assignment → allow
+    const boundary = resolveBoundary(cwd, ctx?.sessionId);
     const abs = resolveAbs(path, cwd);
     const contextFileAbs = resolve(cwd, '.syntaur', 'context.json');
-    const { allowed, reason } = isWriteAllowed(abs, ctx, contextFileAbs);
+    const { allowed, reason } = isWriteAllowed(abs, boundary, contextFileAbs);
     if (!allowed) return { block: true, reason };
     return undefined;
   });
@@ -249,7 +305,6 @@ export default function activate(pi: {
       description: cmd.description,
       handler: async (_args: string, ctx: unknown) => {
         if (cmd.kind === 'passthrough' && cmd.argv) {
-          const { spawnSync } = await import('node:child_process');
           const r = spawnSync('syntaur', cmd.argv, { encoding: 'utf-8' });
           notify(ctx, (r.stdout || '') + (r.stderr || '') || `ran: syntaur ${cmd.argv.join(' ')}`);
           return;

package/skills/add-memory/SKILL.md

@@ -32,8 +32,9 @@ file-ownership protocol.
 
 ## Step 1: Resolve project
 
-If `.syntaur/context.json` is present and has `projectSlug`, default to that.
-Otherwise ask the user which project to add the memory to.
+If the session has an open engagement with an active assignment (`syntaur
+session resume --json`), default to its `projectSlug`. Otherwise ask the user
+which project to add the memory to.
 
 ## Step 2: Gather inputs
 

package/skills/add-resource/SKILL.md

@@ -30,8 +30,9 @@ CLI-managed file per the file-ownership protocol).
 
 ## Step 1: Resolve project
 
-If `.syntaur/context.json` is present and has `projectSlug`, default to that.
-Otherwise ask the user which project to add the resource to.
+If the session has an open engagement with an active assignment (`syntaur
+session resume --json`), default to its `projectSlug`. Otherwise ask the user
+which project to add the resource to.
 
 ## Step 2: Gather inputs
 

package/skills/bundle-worktree/SKILL.md

@@ -45,9 +45,9 @@ The computed worktree path is **always**
 
 ## Step 2: Pre-flight
 
-- Confirm `.syntaur/context.json` is a bundle context (has `bundleId`,
-  no assignment fields). If it's an assignment context, stop and tell the
-  user to `/grab-bundle <id>` first.
+- Confirm `.syntaur/context.json` is a bundle context (has `bundleId`). If the
+  session is instead bound to an assignment (an open engagement) with no
+  `bundleId`, stop and tell the user to `/grab-bundle <id>` first.
 - Confirm `<repository>/.git` exists.
 - Confirm the branch does NOT already exist. If it does, the CLI will
   surface a `GitWorktreeError` — surface that verbatim.

package/skills/capture-artifacts/SKILL.md

@@ -17,7 +17,7 @@ Attach proof to your work. Reviewers should be able to scroll a single page (`pr
 
 ## Input
 
-No arguments. Reads `.syntaur/context.json` from the current working directory to identify the active assignment.
+No arguments. The active assignment is resolved from the session's open engagement (`.syntaur/context.json` is only a workspace marker, not the assignment source).
 
 ## Step 1: Decide whether to capture
 
@@ -60,7 +60,7 @@ Rules:
 - All other kinds (`screenshot`, `video`, `asciinema`) require `--file`. The CLI rejects nonexistent / non-file paths.
 - `--criterion <index>` is optional — pass the **0-based** index into the `## Acceptance Criteria` checklist when you want to anchor the artifact to a specific criterion.
 - `--transcribe` is video-only and writes a sibling `<id>.transcript.md` (requires `ELEVENLABS_API_KEY` + `ffmpeg`). `proof build` renders the transcript next to the player; clicking a phrase seeks the video.
-- If you have a `.syntaur/context.json` in the cwd, the positional target argument is unnecessary; otherwise pass `--project <slug> <assignment-slug>` or a bare assignment UUID.
+- If this session has an open engagement (active assignment), the positional target argument is unnecessary — the CLI resolves the target from the engagement. Otherwise pass `--project <slug> <assignment-slug>` or a bare assignment UUID.
 
 The CLI copies the file (if any) under `<assignmentDir>/proof/<criterion|untagged>/<id>.<ext>` and inserts a row in `~/.syntaur/syntaur.db`. Output prints the artifact id and absolute path.
 

package/skills/claim-resource/SKILL.md

@@ -29,15 +29,15 @@ Examples:
 
 Extract `<inventory_slug>` (required, first positional), plus optional `--ttl <duration>` and `--for <tag>`.
 
-### Step 2: Pre-check assignment context
+### Step 2: Pre-check workspace context
 
-Read `.syntaur/context.json` from the current working directory. If the file is missing, OR has neither `sessionId` nor any of `projectSlug`/`assignmentSlug`/`assignmentDir`, abort with:
+Read `.syntaur/context.json` (a workspace marker) from the current working directory. If the file is missing, OR carries no workspace markers (`repository`/`branch`/`worktreePath`/`workspaceRoot`) and no `sessionId`, abort with:
 
 > "No active Syntaur context in this workspace. Grab an assignment first (`/grab-assignment <project> <slug>`) or restart the session so the SessionStart hook can populate `.syntaur/context.json`."
 
 This guard exists because writing a leases-only context file would trip `syntaur doctor`'s workspace check.
 
-If `--for` was not provided, derive its value from the context: prefer `assignmentSlug` if present, otherwise `sessionId`.
+If `--for` was not provided, derive its value: prefer the active assignment's slug from the session's open engagement (`syntaur session resume --json`); otherwise fall back to the `sessionId` from the workspace marker.
 
 ### Step 3: Run the claim CLI