@cohortapp/agent-sdk 2.10.0 → 2.11.1

package/scripts/daemon/prompt-builder-preamble.test.mjs

@@ -0,0 +1,210 @@
+/**
+ * prompt-builder-preamble.test.mjs — the fallback preamble must not FABRICATE
+ * authority.
+ *
+ * WHAT BROKE
+ *   `buildFallbackPreamble()` used to hardcode an autonomy grant:
+ *     "<Agent> sends autonomously: all internal messages, external operational
+ *      messages, candidate comms, follow-ups, calendar coordination"
+ *   read from nowhere. It fires when CLAUDE.md is unreadable OR its extracted
+ *   sections total <= 200 chars — i.e. on a freshly scaffolded repo that has
+ *   never had autonomy bands set — while driving a real `claude --print` session
+ *   that can send real messages. It also stated "You are <name>, <title> at
+ *   <company>" with `company` interpolated unconditionally.
+ *
+ * WHAT THESE TESTS PIN
+ *   1. GROUNDED PATH — with a real config/agent.json + config/company.json + a
+ *      GENERATED policies/action-classification.yaml, every band in the preamble
+ *      comes from those files.
+ *   2. EMPTY PATH — with the scaffold's UNCONFIGURED config and no generated
+ *      policy, the preamble asserts NO employer, NO autonomy grant, and says
+ *      draft-not-send. Nothing is invented.
+ *   3. The hand-written TEMPLATE action-classification.yaml (which grants "fully
+ *      autonomous executive operator" to every seat) is treated as ABSENT.
+ *
+ * Run: node --test scripts/daemon/prompt-builder-preamble.test.mjs
+ */
+
+"use strict";
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import {
+  buildFallbackPreamble,
+  loadSeatAutonomyPolicy,
+  renderAutonomySection,
+} from "./prompt-builder.mjs";
+
+/** A repo root with whatever files the case needs. */
+function seat(files) {
+  const root = mkdtempSync(join(tmpdir(), "seat-"));
+  for (const [rel, body] of Object.entries(files)) {
+    const abs = join(root, rel);
+    mkdirSync(join(abs, ".."), { recursive: true });
+    writeFileSync(abs, body);
+  }
+  return root;
+}
+
+const SCAFFOLD_AGENT = JSON.stringify({
+  firstName: "UNCONFIGURED",
+  lastName: "AGENT",
+  fullName: "Unconfigured Agent",
+  title: "Unconfigured Role",
+  company: "",
+  principal: { firstName: "", fullName: "", title: "" },
+  responsibilities: [],
+  operatingPrinciples: [],
+});
+const SCAFFOLD_COMPANY = JSON.stringify({ name: "UNCONFIGURED", description: "", products: [] });
+
+const REAL_AGENT = JSON.stringify({
+  firstName: "Robin",
+  lastName: "Okafor",
+  fullName: "Robin Okafor",
+  title: "VP Operations",
+  altitude: "vp",
+  company: "",
+  principal: { firstName: "Dana", fullName: "Dana Lee", title: "CEO" },
+  responsibilities: ["Run the ops cadence"],
+  operatingPrinciples: ["Close the loop on every commitment"],
+});
+const REAL_COMPANY = JSON.stringify({ name: "Meridian Freight", description: "Regional logistics." });
+
+/** What scripts/setup/generate-autonomy.mjs writes — note archetype + delegation_breadth. */
+const GENERATED_POLICY = `
+archetype: operations@vp
+autonomy_default: execute
+delegation_breadth: moderate
+action_levels:
+  execute_autonomous:
+    examples:
+      - Reschedule internal meetings
+  approval_preferred:
+    examples:
+      - Send a quote to a customer
+  escalate:
+    examples:
+      - Sign a supplier contract
+    escalate_to:
+      - principal
+decision_rights:
+  - id: dr-1
+    scope: Carrier selection
+    authority: decide
+`;
+
+/** The hand-written framework TEMPLATE — no archetype, no delegation_breadth. */
+const TEMPLATE_POLICY = `
+action_levels:
+  execute_autonomous:
+    description: Operational actions the agent executes on its own authority.
+    examples:
+      - Send emails in the agent's voice to any recipient
+      - Send candidate communications (outreach, scheduling, offers, rejections)
+`;
+
+// ── 1. GROUNDED PATH ────────────────────────────────────────────────────────
+
+test("grounded: identity, employer and every autonomy band come from the real files", () => {
+  const root = seat({
+    "config/agent.json": REAL_AGENT,
+    "config/company.json": REAL_COMPANY,
+    "policies/action-classification.yaml": GENERATED_POLICY,
+  });
+  const out = buildFallbackPreamble(root);
+
+  assert.match(out, /You are Robin Okafor, VP Operations at Meridian Freight\./);
+  assert.match(out, /You report to Dana Lee, CEO\./);
+  assert.match(out, /Close the loop on every commitment/, "operating principles come from config");
+
+  assert.match(out, /generated for archetype operations@vp/);
+  assert.match(out, /You act on your own authority: Reschedule internal meetings/);
+  assert.match(out, /You get agreement first: Send a quote to a customer/);
+  assert.match(out, /You escalate and do NOT act alone: Sign a supplier contract/);
+  assert.match(out, /Escalate to: principal/);
+  assert.match(out, /Decision right — Carrier selection \(decide\)/);
+
+  // The fabricated grant is gone, verbatim.
+  assert.doesNotMatch(out, /sends autonomously/i);
+  assert.doesNotMatch(out, /all internal messages, external operational messages/i);
+  assert.doesNotMatch(out, /Full autonomy, full accountability/i);
+
+  rmSync(root, { recursive: true, force: true });
+});
+
+// ── 2. EMPTY PATH — nothing configured means nothing asserted ────────────────
+
+test("empty: an unconfigured seat gets NO employer and NO autonomy grant", () => {
+  const root = seat({
+    "config/agent.json": SCAFFOLD_AGENT,
+    "config/company.json": SCAFFOLD_COMPANY,
+  });
+  const out = buildFallbackPreamble(root);
+
+  // No invented employer anywhere — including the scaffold's own sentinel.
+  assert.doesNotMatch(out, /UNCONFIGURED/);
+  assert.doesNotMatch(out, / at \./, "no dangling 'at <blank>' clause");
+
+  // No grant of any kind.
+  assert.doesNotMatch(out, /sends autonomously/i);
+  assert.doesNotMatch(out, /You act on your own authority/);
+  assert.doesNotMatch(out, /escalates only/i);
+
+  // Fail closed, and say why.
+  assert.match(out, /NO AUTONOMY POLICY IS CONFIGURED FOR THIS SEAT/);
+  assert.match(out, /Draft, do not send/);
+  assert.match(out, /Nothing here grants that\./);
+
+  rmSync(root, { recursive: true, force: true });
+});
+
+test("empty: a repo with NO config at all still produces a safe, non-fabricated preamble", () => {
+  const root = seat({});
+  const out = buildFallbackPreamble(root);
+  assert.doesNotMatch(out, /You are .* at /, "no identity is asserted");
+  assert.match(out, /NO AUTONOMY POLICY IS CONFIGURED/);
+  assert.match(out, /Draft, do not send/);
+  rmSync(root, { recursive: true, force: true });
+});
+
+// ── 3. The template is NOT ground truth ─────────────────────────────────────
+
+test("the framework TEMPLATE action-classification.yaml is treated as ABSENT", () => {
+  const root = seat({
+    "config/agent.json": REAL_AGENT,
+    "config/company.json": REAL_COMPANY,
+    "policies/action-classification.yaml": TEMPLATE_POLICY,
+  });
+  assert.equal(loadSeatAutonomyPolicy(root), null, "no archetype/delegation_breadth ⇒ not this seat's policy");
+
+  const out = buildFallbackPreamble(root);
+  assert.match(out, /NO AUTONOMY POLICY IS CONFIGURED FOR THIS SEAT/);
+  assert.doesNotMatch(
+    out,
+    /Send candidate communications/,
+    "the template's maximal grant must never reach a prompt",
+  );
+  rmSync(root, { recursive: true, force: true });
+});
+
+test("a GENERATED policy whose bands are all empty grants nothing", () => {
+  const section = renderAutonomySection({
+    archetype: "ops@vp",
+    delegation_breadth: "narrow",
+    action_levels: { execute_autonomous: { examples: [] }, approval_preferred: {}, escalate: {} },
+    decision_rights: [],
+  });
+  assert.match(section, /declares no bands/);
+  assert.match(section, /draft, do not send/i);
+});
+
+test("loadSeatAutonomyPolicy never throws on malformed YAML", () => {
+  const root = seat({ "policies/action-classification.yaml": "::: not: [valid" });
+  assert.equal(loadSeatAutonomyPolicy(root), null);
+  rmSync(root, { recursive: true, force: true });
+});

package/scripts/daemon/prompt-builder.mjs

@@ -5,8 +5,9 @@
 
 import { readFileSync, readdirSync } from "fs";
 import { join } from "path";
+import { createRequire } from "node:module";
 import { compileContext } from "./context-compiler.mjs";
-import { loadPersonaBlock } from "../../lib/identity/persona.mjs";
+import { renderPersona } from "../../lib/identity/persona.mjs";
 import { wrapExternalContent } from "../../lib/security/external-content.mjs";
 import { isEnabled as orgEnabled } from "../../lib/org/client.mjs";
 import { recall as orgRecall } from "../../lib/org/knowledge.mjs";
@@ -14,12 +15,22 @@ import { outcomeSourceShareable } from "./session-outcomes.mjs";
 
 const AGENT_REPO_DIR = process.env.AGENT_DIR || join(new URL(".", import.meta.url).pathname, "../..");
 
-// Load agent identity from canonical SOT for use in prompts and fallback preamble.
+// js-yaml, synchronously. The autonomy policy is read on the fallback-preamble
+// path, which is sync by contract; the org-config reader below can afford the
+// dynamic import, this cannot. js-yaml is a declared dependency of this package.
+const _require = createRequire(import.meta.url);
+const yaml = _require("js-yaml");
+
+// Load agent identity from canonical SOT. Used for the backlog-item owner label.
+// The fallback carries ONLY a generic first name — it used to also carry
+// `company: "the company"` and a fabricated principal, which is a claim about
+// the seat that nothing read. Identity for prompts goes through
+// renderSeatPersona() below, which omits an unset field rather than filling it.
 function loadAgent() {
   try {
     return JSON.parse(readFileSync(join(AGENT_REPO_DIR, "config/agent.json"), "utf-8"));
   } catch {
-    return { firstName: "Agent", fullName: "Agent", title: "agent", company: "the company", principal: { firstName: "principal", fullName: "the principal", title: "principal" } };
+    return { firstName: "agent" };
   }
 }
 
@@ -128,10 +139,94 @@ let cachedPreamble = null;
 // back to a generic-assistant register.
 let cachedPersona = null;
 
+/**
+ * A config value the operator has not filled in yet.
+ *
+ * The scaffold does not ship empty strings for everything — it ships SENTINELS:
+ * config/company.json has `"name": "UNCONFIGURED"`, config/agent.json has
+ * `"firstName": "UNCONFIGURED"`, `"fullName": "Unconfigured Agent"`,
+ * `"title": "Unconfigured Role"`. lib/identity/persona.mjs#renderPersona omits
+ * EMPTY fields, which is right, but a sentinel is not empty — so an untouched
+ * scaffold rendered "You are Unconfigured Agent, Unconfigured Role at
+ * UNCONFIGURED." into a live prompt. Treat the sentinel as absence.
+ *
+ * @param {*} v
+ * @returns {string} the trimmed value, or "" when absent/sentinel
+ */
+function configuredStr(v) {
+  const s = typeof v === "string" ? v.trim() : "";
+  if (!s) return "";
+  if (/^unconfigured\b/i.test(s)) return "";
+  return s;
+}
+
+/**
+ * Strip scaffold sentinels out of config/agent.json before it is rendered, so
+ * `renderPersona`'s omit-when-unset rule actually fires on a fresh repo.
+ * @param {object} a
+ * @returns {object}
+ */
+function scrubAgentConfig(a) {
+  const src = a && typeof a === "object" ? a : {};
+  const out = { ...src };
+  for (const k of ["firstName", "lastName", "fullName", "title", "company", "companyDescription", "persona", "background", "bio"]) {
+    if (k in out) out[k] = configuredStr(out[k]);
+  }
+  // A surname with no first name and no full name is not an identity — better
+  // to render no name at all than "You are AGENT." (the scaffold ships
+  // firstName "UNCONFIGURED" / lastName "AGENT").
+  if (!out.firstName && !out.fullName) out.lastName = "";
+  if (src.principal && typeof src.principal === "object") {
+    const p = { ...src.principal };
+    for (const k of ["firstName", "lastName", "fullName", "title"]) p[k] = configuredStr(p[k]);
+    out.principal = p;
+  }
+  return out;
+}
+
+/** Same, for config/company.json. */
+function scrubCompanyConfig(c) {
+  const src = c && typeof c === "object" ? c : {};
+  const out = { ...src };
+  for (const k of ["name", "legalName", "description", "tagline", "industry", "stage"]) {
+    if (k in out) out[k] = configuredStr(out[k]);
+  }
+  return out;
+}
+
+/** Read + scrub both config files. Never throws. @returns {{agent:object, company:object}} */
+function readSeatConfig(root) {
+  const read = (rel) => {
+    try { return JSON.parse(readFileSync(join(root, rel), "utf-8")); } catch { return {}; }
+  };
+  return {
+    agent: scrubAgentConfig(read("config/agent.json")),
+    company: scrubCompanyConfig(read("config/company.json")),
+  };
+}
+
+/**
+ * Render the persona block for a seat — config/agent.json + config/company.json
+ * through lib/identity/persona.mjs#renderPersona, with scaffold sentinels
+ * scrubbed first so an unconfigured field is OMITTED rather than asserted.
+ *
+ * @param {string} root agent repo root
+ * @param {object} [opts] forwarded to renderPersona
+ * @returns {string} "" when nothing is configured
+ */
+export function renderSeatPersona(root, opts = {}) {
+  try {
+    const { agent, company } = readSeatConfig(root);
+    return renderPersona(agent, company, opts) || "";
+  } catch {
+    return "";
+  }
+}
+
 /** Render (once per process) the persona block from config/agent.json. */
 function loadPersona() {
   if (cachedPersona !== null) return cachedPersona;
-  cachedPersona = loadPersonaBlock(AGENT_REPO_DIR) || "";
+  cachedPersona = renderSeatPersona(AGENT_REPO_DIR);
   return cachedPersona;
 }
 
@@ -148,7 +243,7 @@ function loadPreamble() {
     cachedPreamble = extractPreamble(raw);
   } catch (err) {
     console.error(`[prompt-builder] Failed to read CLAUDE.md: ${err.message}`);
-    cachedPreamble = FALLBACK_PREAMBLE;
+    cachedPreamble = fallbackPreamble();
   }
   return cachedPreamble;
 }
@@ -196,44 +291,172 @@ function extractPreamble(raw) {
 
   // If extraction got something reasonable, use it; otherwise fall back
   if (extracted.length > 200) return extracted;
-  return FALLBACK_PREAMBLE;
+  return fallbackPreamble();
+}
+
+/**
+ * Read the seat's GENERATED autonomy policy, or null.
+ *
+ * Provenance check, not just a file check. `policies/action-classification.yaml`
+ * exists in two very different shapes:
+ *
+ *   - the hand-written TEMPLATE that ships with the framework, whose header says
+ *     "the agent is a fully autonomous executive operator" for every seat; and
+ *   - the per-seat artefact `scripts/setup/generate-autonomy.mjs` renders from
+ *     `lib/autonomy.mjs#buildActionClassification` for THIS agent's archetype
+ *     (function × altitude), which is the only one that describes a real grant.
+ *
+ * Only the generated artefact carries `archetype` + `delegation_breadth`, so we
+ * require both. A template copy is treated as ABSENT — inheriting another
+ * seat's maximal grant is precisely the fabrication this function exists to stop.
+ *
+ * Never throws; returns null on any read/parse failure.
+ *
+ * @param {string} [root=AGENT_REPO_DIR]
+ * @returns {object|null}
+ */
+export function loadSeatAutonomyPolicy(root = AGENT_REPO_DIR) {
+  try {
+    const raw = readFileSync(join(root, "policies/action-classification.yaml"), "utf-8");
+    const doc = yaml.load(raw);
+    if (!doc || typeof doc !== "object") return null;
+    if (!doc.archetype || !doc.delegation_breadth) return null;
+    return doc;
+  } catch {
+    return null;
+  }
+}
+
+/** Clean string[] from a config list; drops blanks. */
+function strList(v, max = 12) {
+  if (!Array.isArray(v)) return [];
+  return v.map((x) => (typeof x === "string" ? x.trim() : "")).filter(Boolean).slice(0, max);
+}
+
+/**
+ * Render what this seat may actually do, from the generated policy — or, when
+ * no policy has been generated, a fail-closed restraint.
+ *
+ * WHY THIS REPLACED A LITERAL
+ *   The previous text granted the seat authority to send, unreviewed, "all
+ *   internal messages, external operational messages, candidate comms,
+ *   follow-ups, calendar coordination" and to escalate only four narrow
+ *   categories. NONE of that was read from anywhere. It is a GOVERNANCE claim,
+ *   not a naming one, and it fired on exactly the population least entitled to
+ *   it: this preamble is used when CLAUDE.md is unreadable OR its extracted
+ *   sections total <= 200 chars, i.e. on a freshly scaffolded repo that has
+ *   never had autonomy bands set — while driving a real `claude --print`
+ *   session that can send real messages.
+ *
+ *   So: bands come from the seat's generated policy or they are not asserted.
+ *   With no policy the correct posture is LESS authority, not more — the
+ *   preamble says draft-and-confirm and says why. That is a statement about the
+ *   ABSENCE of a configured grant, not an invented grant.
+ *
+ * @param {object|null} policy result of loadSeatAutonomyPolicy()
+ * @returns {string}
+ */
+export function renderAutonomySection(policy) {
+  if (!policy) {
+    return [
+      "Authority (NO AUTONOMY POLICY IS CONFIGURED FOR THIS SEAT):",
+      "- `policies/action-classification.yaml` has not been generated for you (run `maestro upgrade`, which runs scripts/setup/generate-autonomy.mjs).",
+      "- Until it has been, assume NO standing authority to act outward. Draft, do not send. Prepare the message, document or calendar change and put it in front of your principal for a decision.",
+      "- Do not make commitments, send outbound communications, or take irreversible actions on your own authority on the strength of this prompt. Nothing here grants that.",
+    ].join("\n");
+  }
+
+  const levels = (policy.action_levels && typeof policy.action_levels === "object") ? policy.action_levels : {};
+  const green = strList(levels.execute_autonomous && levels.execute_autonomous.examples);
+  const amber = strList(levels.approval_preferred && levels.approval_preferred.examples);
+  const red = strList(levels.escalate && levels.escalate.examples);
+  const escalateTo = strList(levels.escalate && levels.escalate.escalate_to, 4);
+  const rights = Array.isArray(policy.decision_rights) ? policy.decision_rights.slice(0, 8) : [];
+
+  const out = [
+    `Authority (from policies/action-classification.yaml, generated for archetype ${policy.archetype}):`,
+  ];
+  if (policy.autonomy_default) out.push(`- Default posture: ${policy.autonomy_default}`);
+  if (green.length) out.push(`- You act on your own authority: ${green.join("; ")}`);
+  if (amber.length) out.push(`- You get agreement first: ${amber.join("; ")}`);
+  if (red.length) out.push(`- You escalate and do NOT act alone: ${red.join("; ")}`);
+  if (escalateTo.length) out.push(`- Escalate to: ${escalateTo.join(", ")}`);
+  for (const d of rights) {
+    if (!d || typeof d !== "object") continue;
+    const scope = typeof d.scope === "string" ? d.scope.trim() : "";
+    const authority = typeof d.authority === "string" ? d.authority.trim() : "";
+    if (!scope) continue;
+    out.push(`- Decision right — ${scope}${authority ? ` (${authority})` : ""}`);
+  }
+  // A generated policy with every band empty asserts nothing. Say so rather
+  // than implying the empty bands are a grant.
+  if (out.length === 1) {
+    out.push("- The generated policy declares no bands. Treat that as no standing authority: draft, do not send.");
+  }
+  return out.join("\n");
+}
+
+/**
+ * Preamble used ONLY when CLAUDE.md is unreadable or effectively empty.
+ *
+ * Everything seat-specific is rendered from the source of truth:
+ *   identity/company/responsibilities/operating principles → config/agent.json +
+ *   config/company.json via lib/identity/persona.mjs#renderPersona (which omits
+ *   an unset field rather than faking it);
+ *   authority → the seat's generated action-classification policy.
+ *
+ * What remains hardcoded is framework craft doctrine that makes NO claim about
+ * this seat's employer or its authority, so it is honest on any deployment.
+ *
+ * @returns {string}
+ */
+export function buildFallbackPreamble(root = AGENT_REPO_DIR) {
+  const parts = [];
+
+  // Identity, company, responsibilities and operating principles — all from
+  // config. Voice rules are omitted here because buildPrompt() already leads
+  // with the full persona block; this is the degraded path, not a second copy.
+  const persona = renderSeatPersona(root, { includeVoiceRules: false });
+  if (persona) parts.push(persona);
+
+  parts.push(renderAutonomySection(loadSeatAutonomyPolicy(root)));
+
+  parts.push(
+    [
+      "How you work:",
+      "- Follow-through over brilliance — track every commitment until it closes",
+      "- Concise over comprehensive — sharp recommendations, not exhaustive reports",
+      "- Evidence over opinion — cite sources, and say when you do not know",
+      "- Audit everything — every action is logged",
+    ].join("\n"),
+  );
+
+  parts.push(
+    [
+      "Document Sharing (CRITICAL):",
+      "- NEVER reference local file paths in outbound communications",
+      "- Upload to shared storage or generate a branded PDF for sharing",
+      "- Inline short content directly in messages",
+      "- Never attach raw .md or .yaml files",
+    ].join("\n"),
+  );
+
+  return parts.join("\n\n");
+}
+
+// Computed lazily (and cached) rather than at module load: the autonomy policy
+// and config/agent.json are read from disk, and a test that points AGENT_DIR at
+// a fixture must not be beaten to it by import-time evaluation.
+let _fallbackPreamble = null;
+function fallbackPreamble() {
+  if (_fallbackPreamble === null) _fallbackPreamble = buildFallbackPreamble();
+  return _fallbackPreamble;
 }
 
-// Generic preamble derived from config/agent.json. This is only used when
-// CLAUDE.md is unreadable; ordinarily the daemon pulls the full identity
-// block straight from the agent's CLAUDE.md.
-function buildFallbackPreamble() {
-  const a = loadAgent();
-  const principal = a.principal || {};
-  const principalName = principal.fullName || "the principal";
-  const principalTitle = principal.title || "principal";
-  // "<title> to <principal>" only reads correctly for assistant-shaped titles;
-  // for a functional seat ("SVP AI Systems & Agent Platform") it turns the role
-  // into a service relationship. State the seat, then the reporting line.
-  return `You are ${a.fullName}, ${a.title} at ${a.company}. You report to ${principalName}, ${principalTitle}.
-You operate as the autonomous executive command layer for the company.
-
-${a.companyDescription || a.company}.
-
-Operating Principles:
-1. Follow-through over brilliance — track every commitment until it closes
-2. Concise over comprehensive — sharp recommendations, not exhaustive reports
-3. Evidence over opinion — cite sources
-4. Bias to action — act decisively on operational matters; escalate only strategic commitments
-5. Audit everything — every action is logged
-6. Full autonomy, full accountability
-
-Autonomy Model:
-- ${a.firstName} sends autonomously: all internal messages, external operational messages, candidate comms, follow-ups, calendar coordination
-- ${a.firstName} escalates only: binding legal/financial obligations, regulatory submissions, acquisition deal terms, public statements
-
-Document Sharing (CRITICAL):
-- NEVER reference local file paths in outbound communications
-- Upload to Google Drive or generate branded PDF for sharing
-- Inline short content directly in messages
-- Never attach raw .md or .yaml files`;
+/** For tests: drop the cached fallback preamble. */
+export function _resetFallbackPreamble() {
+  _fallbackPreamble = null;
 }
-const FALLBACK_PREAMBLE = buildFallbackPreamble();
 
 /**
  * Proactive self-learning habit (WS3). Injected near the top of every reactive /
@@ -531,7 +754,7 @@ function buildBacklogContext(queueItem) {
   lines.push(`Title: ${queueItem.title || "untitled"}`);
   lines.push(`Status: ${queueItem.status || "open"}`);
   lines.push(`Priority: ${queueItem.priority || "normal"}`);
-  lines.push(`Owner: ${queueItem.owner || loadAgent().firstName.toLowerCase()}`);
+  lines.push(`Owner: ${queueItem.owner || configuredStr(loadAgent().firstName).toLowerCase() || "agent"}`);
   if (queueItem.source) lines.push(`Source: ${queueItem.source}`);
   if (queueItem.source_ref) lines.push(`Source ref: ${queueItem.source_ref}`);
   // ── what to act ON, and with WHAT ────────────────────────────────────────

package/scripts/daemon/prompt-builder.test.mjs

@@ -215,18 +215,18 @@ test("buildPrompt caps the number of injected org facts (bounded)", async () =>
 test("buildPrompt states the acknowledgement was sent when it actually was", async () => {
   const prompt = await buildPrompt(ITEM, CLASS, {
     type: "inbox",
-    holdingMessage: "Understood — let me dig into this.",
+    holdingMessage: "Understood — I'm digging into this now (the noted issues). I want to get this right, so I'll come back to you here with a full answer — usually within 10-20 minutes — and you'll hear from me either way.",
     holdingSent: true,
   });
   assert.match(prompt, /A HOLDING MESSAGE has ALREADY been sent/);
-  assert.ok(prompt.includes("Understood — let me dig into this."));
+  assert.ok(prompt.includes("Understood — I'm digging into this now (the noted issues). I want to get this right, so I'll come back to you here with a full answer — usually within 10-20 minutes — and you'll hear from me either way."));
   assert.ok(!/DELIVERY FAILED/.test(prompt), "no failure framing on a delivered ack");
 });
 
 test("buildPrompt does NOT claim delivery when the acknowledgement failed to send", async () => {
   const prompt = await buildPrompt(ITEM, CLASS, {
     type: "inbox",
-    holdingMessage: "Understood — let me dig into this.",
+    holdingMessage: "Understood — I'm digging into this now (the noted issues). I want to get this right, so I'll come back to you here with a full answer — usually within 10-20 minutes — and you'll hear from me either way.",
     holdingSent: false,
   });
   // The lie: telling the session a human already heard from us when they did not.
@@ -242,13 +242,13 @@ test("buildPrompt does NOT claim delivery when the acknowledgement failed to sen
   assert.match(prompt, /DELIVERY FAILED/);
   assert.match(prompt, /received NOTHING/);
   // The composed text is still shown — it is what the sender would have seen.
-  assert.ok(prompt.includes("Understood — let me dig into this."));
+  assert.ok(prompt.includes("Understood — I'm digging into this now (the noted issues). I want to get this right, so I'll come back to you here with a full answer — usually within 10-20 minutes — and you'll hear from me either way."));
 });
 
 test("buildPrompt treats an unspecified holdingSent as delivered (back-compat)", async () => {
   const prompt = await buildPrompt(ITEM, CLASS, {
     type: "inbox",
-    holdingMessage: "Understood — let me dig into this.",
+    holdingMessage: "Understood — I'm digging into this now (the noted issues). I want to get this right, so I'll come back to you here with a full answer — usually within 10-20 minutes — and you'll hear from me either way.",
   });
   assert.match(prompt, /A HOLDING MESSAGE has ALREADY been sent/);
 });

package/scripts/daemon/responder.mjs

@@ -901,6 +901,15 @@ export async function sendQuickResponse(item, classResult, routed = null) {
       via: delivered.via,
       ...(delivered.channel ? { channel: delivered.channel } : {}),
       ...(delivered.draft_path ? { draft_path: delivered.draft_path } : {}),
+      // PROPAGATE THE PERMANENCE. `deliver` marks a failure the send-gate refused
+      // (FORBIDDEN_SCOPE) or hq declared unroutable (NOT_FOUND/BAD_REQUEST) as
+      // `permanent` with the RPC `code`. Without carrying these up, the caller
+      // (agent-daemon.answerItem) could not tell a transient blip from an
+      // impossible send, so it fell through to a full autonomous session — which
+      // then posted UNRELATED work into a channel this seat was just told it may
+      // not write to. The daemon uses `permanent` to escalate instead of spawn.
+      ...(delivered.permanent ? { permanent: true } : {}),
+      ...(delivered.code ? { code: delivered.code } : {}),
       ...(delivered.error ? { error: delivered.error } : {}),
     };