@aitne/daemon 0.1.10 → 0.1.11

package/dist/core/signal-detector.d.ts

@@ -120,6 +120,18 @@ export declare class SignalDetector {
     static normalizeDedupKey(signal: RawSignal): string;
     /** Remove expired entries from the dedup cache */
     private pruneExpiredDedup;
+    /**
+     * Precision matters more than recall here: a match marks the reply
+     * `corrected` (valence `correction`), and the promotion gate treats any
+     * correction as an authoritative directive that promotes a lesson on
+     * FIRST occurrence — one false positive writes a bogus standing
+     * directive into `policies/agent-lessons.md`. So the stop/don't pattern
+     * requires imperative shape (sentence-initial, modulo a couple of
+     * politeness tokens) paired with an agent-action verb, instead of the
+     * old `\b(stop|no)\b.*\b(do|that|…)\b` / bare `don't` catch-alls that
+     * matched benign replies like "No worries, that sounds great" or
+     * "I don't have anything else today".
+     */
     private static isCorrectionContent;
     private findPendingNotificationForReply;
     private resolvePendingNotificationId;

package/dist/core/signal-detector.js

@@ -15,6 +15,26 @@ const MAX_RAW_SIGNALS = 20;
  * this window are suppressed.
  */
 const DEDUP_TTL_MS = 10 * 60 * 1000;
+/**
+ * Reaction emoji that signal disapproval. A 👎 must not be recorded as a
+ * positive behavioral signal — the consolidation LLM only sees the row's
+ * summary, so a mis-valenced reaction would count as positive corroboration
+ * for the very notification the owner disliked. Conservative set: ambiguous
+ * emoji (😢, 😕, …) stay positive-by-default rather than guessing.
+ */
+const NEGATIVE_REACTION_EMOJI = new Set([
+    "👎",
+    "❌",
+    "🚫",
+    "🛑",
+    "😠",
+    "😡",
+    "💢",
+]);
+/** Strip skin-tone modifiers + variation selectors so 👎🏽 matches 👎. */
+function normalizeReactionEmoji(emoji) {
+    return emoji.replace(/[\u{1F3FB}-\u{1F3FF}\u{FE0E}\u{FE0F}]/gu, "").trim();
+}
 /**
  * SignalDetector — collects implicit user feedback signals (no LLM required).
  *
@@ -98,10 +118,12 @@ export class SignalDetector {
         if (params.notificationId) {
             const pendingId = this.resolvePendingNotificationId(params.notificationId);
             this.pendingNotifications.delete(pendingId);
+            const negative = NEGATIVE_REACTION_EMOJI.has(normalizeReactionEmoji(emoji));
             this.recordNotificationOutcome({
                 notificationId: pendingId,
                 reaction: "replied",
-                valence: "positive",
+                valence: negative ? "negative" : "positive",
+                emoji,
                 evidence: {
                     emoji,
                     responseTimeMs,
@@ -283,14 +305,28 @@ export class SignalDetector {
             }
         }
     }
+    /**
+     * Precision matters more than recall here: a match marks the reply
+     * `corrected` (valence `correction`), and the promotion gate treats any
+     * correction as an authoritative directive that promotes a lesson on
+     * FIRST occurrence — one false positive writes a bogus standing
+     * directive into `policies/agent-lessons.md`. So the stop/don't pattern
+     * requires imperative shape (sentence-initial, modulo a couple of
+     * politeness tokens) paired with an agent-action verb, instead of the
+     * old `\b(stop|no)\b.*\b(do|that|…)\b` / bare `don't` catch-alls that
+     * matched benign replies like "No worries, that sounds great" or
+     * "I don't have anything else today".
+     */
     static isCorrectionContent(content) {
         const correctionPatterns = [
-            /shorter|brief|concise/i,
-            /more detail|elaborate|expand/i,
+            /\b(shorter|brief|briefly|concise|concisely|less verbose|too long|too verbose)\b/i,
+            /\b(more detail|elaborate|expand)\b/i,
             /\bin (english|spanish|french|german|portuguese|italian|chinese|japanese|korean|arabic|hindi|russian)\b/i,
-            /bullet points|bulleted list/i,
-            /\b(stop|no)\b.*\b(notify|message|remind|send|doing|do|again|that)\b/i,
-            /\b(do not|don't)\b/i,
+            /\b(bullet points|bulleted list)\b/i,
+            // Imperative "stop/don't/no more <agent action>" at the start of the
+            // reply: optional politeness tokens, a negation/stop verb, then an
+            // agent-action word within the same clause.
+            /^\W*(?:(?:please|pls|just|hey|ok|okay|can you|could you|you can|maybe)\s+){0,2}(?:stop|quit|don['’]t|do not|never|no more)\b[^.!?\n]{0,40}?\b(?:notify(?:ing)?|notifications?|messag(?:e|es|ing)|remind(?:er|ers|ing)?|send(?:ing)?|ping(?:ing)?|dm(?:s|ing)?|post(?:ing)?|repeat(?:ing)?|do(?:ing)?\s+(?:that|this))\b/i,
         ];
         return correctionPatterns.some((pattern) => pattern.test(content));
     }
@@ -389,7 +425,10 @@ export class SignalDetector {
                 return;
             }
             const scopeType = metadata.agentId ? "agent_slug" : "agent";
-            const summary = this.buildOutcomeSummary(params.reaction, metadata);
+            const summary = this.buildOutcomeSummary(params.reaction, metadata, {
+                valence: params.valence,
+                emoji: params.emoji,
+            });
             const evidence = this.sanitizeEvidence({
                 ...params.evidence,
                 userReaction: params.reaction,
@@ -425,20 +464,25 @@ export class SignalDetector {
          SET user_reaction = ?, reacted_at = CURRENT_TIMESTAMP
          WHERE dispatch_id = ?`).run(reaction, dispatchId);
     }
-    buildOutcomeSummary(reaction, metadata) {
+    buildOutcomeSummary(reaction, metadata, opts = {}) {
         const content = metadata.contentSummary
             ? ` "${metadata.contentSummary}"`
             : "";
         const notificationType = metadata.notificationType
             ? ` (${metadata.notificationType})`
             : "";
+        const emojiNote = opts.emoji ? ` (${opts.emoji})` : "";
         const raw = reaction === "ignored"
             ? `Owner did not respond to notification${content}${notificationType}`
             : reaction === "corrected"
                 ? `Owner corrected notification${content}${notificationType}`
                 : reaction === "acted"
                     ? `Owner acted on notification${content}${notificationType}`
-                    : `Owner responded to notification${content}${notificationType}`;
+                    : opts.valence === "negative"
+                        ? `Owner reacted negatively${emojiNote} to notification${content}${notificationType}`
+                        : opts.emoji
+                            ? `Owner reacted${emojiNote} to notification${content}${notificationType}`
+                            : `Owner responded to notification${content}${notificationType}`;
         return redactSensitiveString(raw.replace(/\s+/g, " ").trim()).slice(0, 280);
     }
     sanitizeEvidence(value) {

package/dist/core/skills-compiler-denied-tools.js

@@ -124,7 +124,7 @@ export function buildSameBackendDenyBlock(integrations, sessionBackend) {
         "## Denied tools (per-integration)",
         "",
         "The user has restricted the following connector tools for this session.",
-        "Do NOT invoke them in any flow — including hourly check, morning routine,",
+        "Do NOT invoke them in any flow — including activity scan, morning routine,",
         "or DM responses. If a workflow appears to require one, stop and tell the",
         "user the tool is denied.",
     ];
@@ -157,7 +157,7 @@ function appendCliDenyBlock(content, namespacedDenied) {
         "## Denied tools (do not invoke)",
         "",
         "The user has restricted these connector tools for this integration. Do",
-        "NOT invoke them in any flow — including hourly check, morning routine,",
+        "NOT invoke them in any flow — including activity scan, morning routine,",
         "or DM responses. If a workflow appears to require one, stop and tell",
         "the user the tool is denied.",
         "",

package/dist/core/skills-compiler-skill-index.d.ts

@@ -75,8 +75,8 @@ export declare function refreshSkillIndexBlock(sessionDir: string, backendId: Ba
  * @deprecated DELEGATED-PROXY-API-DESIGN.md §11 — after Phase D no in-tree
  * skill uses `{{> base }}`: mail / external-services unified their bodies
  * during Phase D, and the lone surviving `notion/SKILL.base.md` was
- * removed in Phase 9 (its hourly-check read-only constraint moved to
- * `routine.hourly_check.md` task-flow where the rule applies in every
+ * removed in Phase 9 (its activity-scan read-only constraint moved to
+ * `routine.activity_scan.md` task-flow where the rule applies in every
  * integration mode, including same-backend delegated where the skill
  * body is dropped). The helper is retained for future composition needs;
  * remove the call sites in `materializeClaudeSession` /

package/dist/core/skills-compiler-skill-index.js

@@ -203,8 +203,8 @@ export function refreshSkillIndexBlock(sessionDir, backendId) {
  * @deprecated DELEGATED-PROXY-API-DESIGN.md §11 — after Phase D no in-tree
  * skill uses `{{> base }}`: mail / external-services unified their bodies
  * during Phase D, and the lone surviving `notion/SKILL.base.md` was
- * removed in Phase 9 (its hourly-check read-only constraint moved to
- * `routine.hourly_check.md` task-flow where the rule applies in every
+ * removed in Phase 9 (its activity-scan read-only constraint moved to
+ * `routine.activity_scan.md` task-flow where the rule applies in every
  * integration mode, including same-backend delegated where the skill
  * body is dropped). The helper is retained for future composition needs;
  * remove the call sites in `materializeClaudeSession` /

package/dist/core/skills-compiler-variants.d.ts

@@ -113,5 +113,5 @@ export declare const SKILL_DESCRIPTION_MAX_LENGTH = 280;
  * MUST use {@link skillBodyTouchesReadSensitive} to keep the
  * "literal prefix" decision encapsulated.
  */
-export declare const READ_SENSITIVE_API_PREFIXES: readonly ["/api/apple-calendar", "/api/books", "/api/browser-task", "/api/calendar", "/api/context", "/api/entities", "/api/mail", "/api/mcp/servers", "/api/notion", "/api/observations", "/api/obsidian", "/api/receipts", "/api/travel-bookings"];
+export declare const READ_SENSITIVE_API_PREFIXES: readonly ["/api/apple-calendar", "/api/background-task", "/api/books", "/api/browser-task", "/api/calendar", "/api/context", "/api/entities", "/api/mail", "/api/mcp/servers", "/api/notion", "/api/observations", "/api/obsidian", "/api/receipts", "/api/travel-bookings"];
 export declare function skillBodyTouchesReadSensitive(skillBody: string): boolean;

package/dist/core/skills-compiler-variants.js

@@ -311,6 +311,14 @@ export const SKILL_DESCRIPTION_MAX_LENGTH = 280;
  */
 export const READ_SENSITIVE_API_PREFIXES = [
     "/api/apple-calendar",
+    // BACKGROUND_TASK_RUNNER_DESIGN.md §7 — list / detail reads on the
+    // generic detached-task surface. The artifact JSON (`report` / `brief`
+    // / `draft` / `significance`) carries the user's research / audit
+    // content, so the GETs are ReadSensitive (the POST spawn + clarify +
+    // cancel are Autonomous). A Codex DM session referencing the
+    // `background-task` skill body gets the read-token banner so its
+    // follow-up `GET /:id` read doesn't 401 silently.
+    "/api/background-task",
     "/api/books",
     // BROWSER_TASK_REDESIGN_PLAN.md §3 — list / detail / events / screenshot
     // reads on the open-ended browser sub-agent surface. The screenshot

package/dist/core/skills-compiler.d.ts

@@ -2,6 +2,7 @@ import type DatabaseNs from "better-sqlite3";
 import { type BackendId, type IntegrationKey, type IntegrationState, type ProcessKey } from "@aitne/shared";
 import type { MailAccount } from "../services/mail/provider.js";
 import { type SkillCompilerFile } from "./skills-compiler-tree.js";
+export declare const SLIM_CLI_SKILL_SETS: Partial<Record<ProcessKey, readonly string[]>>;
 interface SessionPromptBundleParams {
     backendId: BackendId;
     sessionDir: string;
@@ -334,39 +335,41 @@ export declare class SkillsCompiler {
     private spliceCurationAnchorsInSkill;
     /**
      * docs/design/appendices/skills-unification.md Phase 1 item 15 — the slim path does NOT
-     * emit a `<skill-index>` block or the skill-discovery preamble. The
-     * fetch_window system prompt is a self-contained operational contract
-     * (one-window-one-curl, no sub-tasks, exactly-one JSON-on-stdout) and
-     * the only skill copied (`observations`) is referenced inline by the
-     * runner-emitted user prompt. Adding the index would mis-signal the
-     * fetcher to scan for skills before executing the acquisition plan.
+     * emit a `<skill-index>` block or the skill-discovery preamble. The slim
+     * system prompt is a self-contained operational contract and its copied
+     * skills are referenced inline by the dispatched user prompt / task-flow.
+     * Adding the index would mis-signal the agent to scan for skills before
+     * executing its mechanical task.
      *
-     * docs/design/appendices/fetch-window-cost-reduction.md Phase 1.5 — slim instruction-file
-     * materializer for `routine.fetch_window` on Codex / Gemini CLI.
+     * fetch-window-cost-reduction.md Phase 1.5 / RESEARCH_CLUSTER_COST_FIX_PLAN.md
+     * F4 — slim instruction-file materializer for a `SLIM_CLI_SKILL_SETS` process
+     * key on Codex / Gemini CLI.
      *
-     * Mirrors the Claude SDK's Phase 1 systemPrompt swap (the same
-     * `agent-assets/system-prompts/routine-fetch-window.md` template is the
-     * single source of truth): write the slim body verbatim as AGENTS.md /
-     * GEMINI.md and copy only the `observations` skill — the
-     * `/api/observations/batch` POST contract is the fetcher's sole
-     * structural assertion. The integration partial inlined by the runner
-     * (`routine-fetch-window-runner.ts:reassemblePrompt`) covers the
-     * per-attempt call shape, so `mail` / `notion` / `external-services` /
-     * `attach` skill bodies are deliberately omitted.
+     * Mirrors the Claude SDK's slim-systemPrompt swap (the same
+     * `agent-assets/system-prompts/<key>.md` template is the single source of
+     * truth, read through the shared `loadSlimSystemPrompt` registry): write the
+     * slim body verbatim as AGENTS.md / GEMINI.md and copy only the key's
+     * `SLIM_CLI_SKILL_SETS` bundle — the wide manifest's other slugs are restated
+     * by the dispatched user prompt / task-flow, so their bodies are omitted.
      *
-     * No safety preamble / character / behavioral-rules / daemon-API
-     * sections — the slim template restates the only rules the fetcher
-     * needs (localhost-only curl, no sub-tasks, no context writes, no
-     * notify, JSON-on-stdout-and-exit). The destructive-action policy layer
-     * (absolute-block list, Codex sandbox, Gemini admin TOML) still applies
-     * unchanged at runtime.
+     * No safety preamble / character / behavioral-rules / daemon-API sections —
+     * the slim template restates the only rules the session needs. The
+     * destructive-action policy layer (absolute-block list, Codex sandbox,
+     * Gemini admin TOML) still applies unchanged at runtime.
      *
      * The `<mcp-servers>` section is appended downstream by
      * `services/mcp/session-materializer.ts:appendMcpSection` exactly as on
-     * the wide path — Phase 3's allowlist filter, when it lands, will scope
-     * that section without further changes here.
+     * the wide path.
      */
-    private materializeFetchWindowCliSession;
+    private materializeSlimCliSession;
+    /**
+     * Copy one built-in skill dir into a slim CLI session, applying the same
+     * adaptation pipeline the wide CLI path runs (brand tokens, partial /
+     * reference includes, integration-mode filter, tool-deny prose, curation
+     * anchors). Frontmatter stays intact (skills-unification.md §R6). A
+     * no-op when the source SKILL.md is absent.
+     */
+    private copySlimSkillDir;
     private materializeCliSession;
 }
 export {};

package/dist/core/skills-compiler.js

@@ -5,7 +5,7 @@ import { composeSkillSet, getProfileForEvent, getProfileForProcess, resolveSkill
 import { applyCharacterBlockRewrite, buildCharacterBlock } from "./character-block.js";
 import { applyOutputLanguagePointerRewrite } from "./output-language-policy.js";
 import { createLogger } from "../logging.js";
-import { loadFetchWindowSystemPrompt } from "./fetch-window-prompt-loader.js";
+import { loadSlimSystemPrompt } from "./slim-system-prompt-loader.js";
 import { substituteIntegrationRoutingTables } from "./management-md.js";
 import { loadCurationDeclaration, } from "./skill-curation/declarations.js";
 import { resolveBuiltinSkillDir } from "./skill-source-paths.js";
@@ -21,18 +21,43 @@ import { cliInstructionFileName, cliSkillsDirName, prependCodexReadSensitiveBann
 // spliceCurationAnchorsInSkill). Not exported — sibling modules carry
 // their own peer loggers; the test suite spies on those.
 const logger = createLogger("skills-compiler");
-// docs/design/appendices/fetch-window-cost-reduction.md Phase 1.5 — single shared constant
-// for the pre-pass process key. Typed as `ProcessKey` (not the inferred
-// string literal) so a rename in `@aitne/shared/process-key.ts` lights up
-// here rather than silently dead-branching the slim materializer.
-const FETCH_WINDOW_PROCESS_KEY = "routine.fetch_window";
-// Single skill kept in the slim fetch_window CLI session: the
-// `observations` SKILL.md is the POST contract for
-// `/api/observations/batch` and the fetcher's only structural assertion.
-// The other skills the wide path inlines (`mail`, `notion`,
-// `external-services`, `attach`) are already restated by the integration
-// partial the runner inlines into the user prompt.
-const FETCH_WINDOW_SLIM_SKILL = "observations";
+// Per-slim-key CLI skill bundle copied into the slim Codex / Gemini session
+// (RESEARCH_CLUSTER_COST_FIX_PLAN.md F4 generalizes fetch-window-cost-reduction.md
+// Phase 1.5). The slim materializer writes the slim system-prompt body — the
+// SAME template the Claude SDK gets, via the shared `slim-system-prompt-loader`
+// registry — as AGENTS.md / GEMINI.md and copies ONLY these skill dirs; the
+// wide manifest's other slugs are restated by the task-flow / user prompt, so
+// inlining them would re-bloat the session.
+//
+// Keys MUST mirror `SLIM_SYSTEM_PROMPT_LOADERS` (drift-guarded by a unit test):
+// a slim system prompt with no CLI skill set — or vice versa — is a wiring bug.
+// Typed `Partial<Record<ProcessKey, …>>` so a key rename in
+// `@aitne/shared/process-key.ts` lights up here rather than dead-branching.
+//   - routine.fetch_window — the `observations` SKILL.md is the
+//     `/api/observations/batch` POST contract and the fetcher's only
+//     structural assertion; the integration partial the runner inlines covers
+//     the rest (`mail` / `notion` / `external-services` / `attach` dropped).
+//   - routine.research_cluster_update — `browser-history` (the
+//     `/api/browser-history/*` curl surface) + `context` (the research-journal
+//     write path); the task-flow inlines the endpoints + journal template.
+export const SLIM_CLI_SKILL_SETS = {
+    "routine.fetch_window": ["observations"],
+    "routine.research_cluster_update": ["browser-history", "context"],
+};
+/**
+ * The slim process key for this session, or null when it is not a slim key.
+ * Accepts the `processKey ?? eventType` union the CLI materializer threads
+ * (an event-type string that is not a registered ProcessKey simply misses the
+ * `in` check). Keyed off `SLIM_CLI_SKILL_SETS`, which the drift guard pins to
+ * `SLIM_SYSTEM_PROMPT_LOADERS`.
+ */
+function slimCliKeyFor(processKeyOrEvent) {
+    if (processKeyOrEvent === undefined)
+        return null;
+    return processKeyOrEvent in SLIM_CLI_SKILL_SETS
+        ? processKeyOrEvent
+        : null;
+}
 /**
  * Materializes backend-specific instruction files for session workdirs
  * by reading directly from the source tree (agent-assets/agent-profiles/ and
@@ -238,15 +263,17 @@ export class SkillsCompiler {
         else {
             this.materializeCliSession(params.sessionDir, profileName, skills, params.backendId, params.processKey ?? params.eventType, profileBodyOverride, params.wikiWorkspaceName);
         }
-        // docs/design/appendices/fetch-window-cost-reduction.md Phase 1.5 — the slim
-        // CLI materializer drops every manifest skill except `observations`.
-        // The Claude path is wide for fetch_window today (Phase 1 swaps only
-        // the system prompt, not the workdir layout). Report what was
-        // actually written so log lines / callers see truth, not the
-        // manifest's pre-narrow list.
-        const effectiveSkills = params.backendId !== "claude"
-            && (params.processKey ?? params.eventType) === FETCH_WINDOW_PROCESS_KEY
-            ? [FETCH_WINDOW_SLIM_SKILL]
+        // fetch-window-cost-reduction.md Phase 1.5 / RESEARCH_CLUSTER_COST_FIX_PLAN.md
+        // F4 — the slim CLI materializer drops every manifest skill except the
+        // key's `SLIM_CLI_SKILL_SETS` bundle. The Claude path stays wide today
+        // (Phase 1/F4 swap only the system prompt + settingSources, not the
+        // workdir layout). Report what was actually written so log lines /
+        // callers see truth, not the manifest's pre-narrow list.
+        const slimCliKey = params.backendId !== "claude"
+            ? slimCliKeyFor(params.processKey ?? params.eventType)
+            : null;
+        const effectiveSkills = slimCliKey
+            ? [...(SLIM_CLI_SKILL_SETS[slimCliKey] ?? [])]
             : skills;
         return { profile: profileName, skills: effectiveSkills };
     }
@@ -689,95 +716,104 @@ export class SkillsCompiler {
     }
     /**
      * docs/design/appendices/skills-unification.md Phase 1 item 15 — the slim path does NOT
-     * emit a `<skill-index>` block or the skill-discovery preamble. The
-     * fetch_window system prompt is a self-contained operational contract
-     * (one-window-one-curl, no sub-tasks, exactly-one JSON-on-stdout) and
-     * the only skill copied (`observations`) is referenced inline by the
-     * runner-emitted user prompt. Adding the index would mis-signal the
-     * fetcher to scan for skills before executing the acquisition plan.
+     * emit a `<skill-index>` block or the skill-discovery preamble. The slim
+     * system prompt is a self-contained operational contract and its copied
+     * skills are referenced inline by the dispatched user prompt / task-flow.
+     * Adding the index would mis-signal the agent to scan for skills before
+     * executing its mechanical task.
      *
-     * docs/design/appendices/fetch-window-cost-reduction.md Phase 1.5 — slim instruction-file
-     * materializer for `routine.fetch_window` on Codex / Gemini CLI.
+     * fetch-window-cost-reduction.md Phase 1.5 / RESEARCH_CLUSTER_COST_FIX_PLAN.md
+     * F4 — slim instruction-file materializer for a `SLIM_CLI_SKILL_SETS` process
+     * key on Codex / Gemini CLI.
      *
-     * Mirrors the Claude SDK's Phase 1 systemPrompt swap (the same
-     * `agent-assets/system-prompts/routine-fetch-window.md` template is the
-     * single source of truth): write the slim body verbatim as AGENTS.md /
-     * GEMINI.md and copy only the `observations` skill — the
-     * `/api/observations/batch` POST contract is the fetcher's sole
-     * structural assertion. The integration partial inlined by the runner
-     * (`routine-fetch-window-runner.ts:reassemblePrompt`) covers the
-     * per-attempt call shape, so `mail` / `notion` / `external-services` /
-     * `attach` skill bodies are deliberately omitted.
+     * Mirrors the Claude SDK's slim-systemPrompt swap (the same
+     * `agent-assets/system-prompts/<key>.md` template is the single source of
+     * truth, read through the shared `loadSlimSystemPrompt` registry): write the
+     * slim body verbatim as AGENTS.md / GEMINI.md and copy only the key's
+     * `SLIM_CLI_SKILL_SETS` bundle — the wide manifest's other slugs are restated
+     * by the dispatched user prompt / task-flow, so their bodies are omitted.
      *
-     * No safety preamble / character / behavioral-rules / daemon-API
-     * sections — the slim template restates the only rules the fetcher
-     * needs (localhost-only curl, no sub-tasks, no context writes, no
-     * notify, JSON-on-stdout-and-exit). The destructive-action policy layer
-     * (absolute-block list, Codex sandbox, Gemini admin TOML) still applies
-     * unchanged at runtime.
+     * No safety preamble / character / behavioral-rules / daemon-API sections —
+     * the slim template restates the only rules the session needs. The
+     * destructive-action policy layer (absolute-block list, Codex sandbox,
+     * Gemini admin TOML) still applies unchanged at runtime.
      *
      * The `<mcp-servers>` section is appended downstream by
      * `services/mcp/session-materializer.ts:appendMcpSection` exactly as on
-     * the wide path — Phase 3's allowlist filter, when it lands, will scope
-     * that section without further changes here.
+     * the wide path.
      */
-    materializeFetchWindowCliSession(sessionDir, backendId) {
+    materializeSlimCliSession(sessionDir, backendId, processKey) {
+        const skillSlugs = SLIM_CLI_SKILL_SETS[processKey];
+        // Defensive: the caller only diverts registered slim keys, but guard so a
+        // future divert bug fails loud rather than writing an empty session.
+        if (skillSlugs === undefined)
+            return;
+        const slim = loadSlimSystemPrompt(processKey);
+        if (slim === null)
+            return; // Unreachable for registered keys; satisfies the type.
         mkdirSync(sessionDir, { recursive: true });
-        const slim = loadFetchWindowSystemPrompt();
         writeFileSync(join(sessionDir, cliInstructionFileName(backendId)), slim, "utf-8");
-        // Copy ONLY the `observations` skill dir. The wide path's prune step
-        // is replaced by an explicit single-slug list — `pruneStaleBuiltinSkillDirs`
+        // Copy ONLY the key's slim skill dirs. The wide path's prune step is
+        // replaced by the explicit slug list — `pruneStaleBuiltinSkillDirs`
         // removes any other built-in skill dir that a prior re-materialization
         // (e.g. a fallback-driven wide path on the same workdir) may have left.
         const cliSkillsRoot = cliSkillsDirName(backendId);
         if (cliSkillsRoot === null)
-            return; // Claude-only — fetch_window slim runs on Claude SDK natively.
+            return; // Claude-only — slim keys run on Claude SDK natively.
         const skillsRoot = this.getSourceSkillsRoot();
         const destSkillsRoot = join(sessionDir, cliSkillsRoot, "skills");
         mkdirSync(destSkillsRoot, { recursive: true });
-        pruneStaleBuiltinSkillDirs(destSkillsRoot, skillsRoot, [FETCH_WINDOW_SLIM_SKILL]);
-        const src = resolveBuiltinSkillDir(skillsRoot, FETCH_WINDOW_SLIM_SKILL);
+        pruneStaleBuiltinSkillDirs(destSkillsRoot, skillsRoot, [...skillSlugs]);
+        for (const slug of skillSlugs) {
+            this.copySlimSkillDir(destSkillsRoot, skillsRoot, slug, backendId);
+        }
+    }
+    /**
+     * Copy one built-in skill dir into a slim CLI session, applying the same
+     * adaptation pipeline the wide CLI path runs (brand tokens, partial /
+     * reference includes, integration-mode filter, tool-deny prose, curation
+     * anchors). Frontmatter stays intact (skills-unification.md §R6). A
+     * no-op when the source SKILL.md is absent.
+     */
+    copySlimSkillDir(destSkillsRoot, skillsRoot, slug, backendId) {
+        const src = resolveBuiltinSkillDir(skillsRoot, slug);
         const skillMdPath = join(src, "SKILL.md");
         if (!existsSync(skillMdPath))
             return;
-        const destDir = join(destSkillsRoot, FETCH_WINDOW_SLIM_SKILL);
+        const destDir = join(destSkillsRoot, slug);
         cpSync(src, destDir, { recursive: true });
         substituteBrandTokensInDir(destDir);
-        // No `substituteWikiWorkspaceTokensInDir` — fetch_window never touches
-        // wiki workspace state, and the resolver is a no-op for non-wiki
-        // process keys anyway.
+        // No `substituteWikiWorkspaceTokensInDir` — no slim key touches wiki
+        // workspace state, and the resolver is a no-op for non-wiki keys anyway.
         let adapted = substituteBrandTokens(readFileSync(skillMdPath, "utf-8"));
-        // observations/SKILL.md ships no `{{> base }}` or `{{> ref:* }}`
-        // directives today, but run the resolvers anyway so a future curation
+        // Run the partial / reference resolvers even on bodies that ship no
+        // `{{> base }}` / `{{> ref:* }}` directives today, so a future curation
         // edit cannot silently drop content. Idempotent on plain content.
         adapted = substituteBrandTokens(renderPartialIncludes(adapted, join(src, "SKILL.base.md")));
         adapted = substituteBrandTokens(renderReferenceIncludes(adapted, src));
-        // Mode-conditional filter — observations/SKILL.md carries
-        // `<!-- mode:<predicate>:notion -->` markers (lines 273-345 today)
-        // because the source / consume contract differs across `direct` /
-        // `delegated-same` / `delegated-cross` / `native` / `disabled`. The
-        // wide path applies this filter at `materializeCliSession`; the
-        // slim path must match so the agent doesn't get every mode's prose
-        // for every integration. Idempotent on bodies that lack markers.
+        // Mode-conditional filter — skills (e.g. observations/SKILL.md) carry
+        // `<!-- mode:<predicate>:<integration> -->` markers because the
+        // source / consume contract differs across `direct` / `delegated-same` /
+        // `delegated-cross` / `native` / `disabled`. The wide path applies this
+        // at `materializeCliSession`; the slim path must match so the agent
+        // doesn't get every mode's prose. Idempotent on bodies that lack markers.
         adapted = applyIntegrationModeFilter(adapted, this.integrations, backendId);
-        // Tool-deny policy stays in force — even though the fetcher is fed a
-        // narrow allowlist, the soft-enforcement prose lands in the body
-        // BEFORE the CLI frontmatter strip so it's not lost.
-        adapted = applyAllDeniedToolsForSkill(adapted, FETCH_WINDOW_SLIM_SKILL, backendId, this.integrations);
-        // docs/design/appendices/skills-unification.md Phase 1 §R6 — frontmatter stays intact
-        // across all backends. `adaptSkillForCli` is gone; the source body's
-        // YAML preamble flows through verbatim.
+        // Tool-deny policy stays in force — even with a narrow allowlist, the
+        // soft-enforcement prose lands in the body BEFORE the CLI frontmatter
+        // strip so it's not lost.
+        adapted = applyAllDeniedToolsForSkill(adapted, slug, backendId, this.integrations);
         writeFileSync(join(destDir, "SKILL.md"), adapted, "utf-8");
-        this.spliceCurationAnchorsInSkill(destDir, FETCH_WINDOW_SLIM_SKILL);
+        this.spliceCurationAnchorsInSkill(destDir, slug);
     }
     materializeCliSession(sessionDir, profileName, skillSlugs, backendId, processKey, profileBodyOverride, wikiWorkspaceName) {
-        // docs/design/appendices/fetch-window-cost-reduction.md Phase 1.5 — divert
-        // `routine.fetch_window` to a slim materializer that mirrors the
-        // Claude SDK's Phase 1 systemPrompt swap. Custom bang commands cannot
-        // reach this branch (they bind to `messaging.custom_command`), so
+        // fetch-window-cost-reduction.md Phase 1.5 / RESEARCH_CLUSTER_COST_FIX_PLAN.md
+        // F4 — divert a slim process key to the slim materializer that mirrors the
+        // Claude SDK's slim-systemPrompt swap. Custom bang commands cannot reach
+        // this branch (they bind to `messaging.custom_command`), so
         // `profileBodyOverride` is intentionally NOT forwarded.
-        if (processKey === FETCH_WINDOW_PROCESS_KEY) {
-            this.materializeFetchWindowCliSession(sessionDir, backendId);
+        const slimKey = slimCliKeyFor(processKey);
+        if (slimKey) {
+            this.materializeSlimCliSession(sessionDir, backendId, slimKey);
             return;
         }
         // docs/design/appendices/skills-unification.md Phase 1 — directory-based skill delivery.

package/dist/core/skills-manifest.d.ts

@@ -106,6 +106,43 @@ export declare function resolveSkillManifestForProcess(processKey: ProcessKey, o
     db?: Database.Database | null;
     messageText?: string | null;
 }): string[];
+/**
+ * Event-type / process-key families whose sessions do NOT receive the
+ * owner's user-authored skill library (`<contextDir>/policies/skills/`).
+ *
+ * User skills are general assistant extensions the owner writes for their
+ * conversational agent; `syncAllUserSkills` provisions them into a session
+ * workdir ON TOP of the process key's built-in manifest. Narrow-persona
+ * sessions run under dedicated profiles with tight, purpose-built manifests
+ * — dumping the full user-skill library into them is pure cold-start cost +
+ * attention dilution and never load-bearing (their work is fully covered by
+ * the built-in bundle, and the wiki/research skills are themselves
+ * built-ins, not user-authored).
+ *
+ * Excluded families:
+ *   - `wiki.*`             — the wiki-agent persona (ingest_url / compile /
+ *                            ask / lint / trace / connect).
+ *   - `routine.research_*` — the browser-history research routines
+ *                            (cluster_update / offer_dm / dispatch /
+ *                            wiki_summary).
+ *
+ * Everything else (the conversational DM agent, DM-tone scheduled sessions,
+ * the daily/weekly/monthly routines, setup, knowledge import, git/github
+ * observers, scheduled tasks) keeps the prior "every user skill, every
+ * session" behaviour.
+ */
+export declare const USER_SKILL_EXCLUDED_PREFIXES: readonly string[];
+/**
+ * Whether a session for `eventTypeOrProcessKey` should be provisioned with
+ * the owner's user-authored skills. Keyed on the SAME string the skill
+ * manifest resolves against (`processKey ?? eventType`) so the gate and the
+ * built-in manifest agree on what a session is.
+ *
+ * Gates the `syncAllUserSkills` call at every materialisation chokepoint
+ * (`createSessionWorkdir`, `ensureSessionWorkdir`, and the backend-fallback
+ * re-materialiser). See `USER_SKILL_EXCLUDED_PREFIXES`.
+ */
+export declare function eventTypeAcceptsUserSkills(eventTypeOrProcessKey: string): boolean;
 export declare function getProfileForEvent(eventType: string): string;
 export declare function getSkillsForEvent(eventType: string): string[];
 export declare function getProfileForProcess(processKey: ProcessKey): string;