@cohortapp/agent-sdk 2.11.15 → 2.13.0

package/scripts/collective/hook-runner.test.mjs

@@ -24,11 +24,14 @@ function tmpRoot() {
   mkdirSync(join(root, "config"), { recursive: true });
   return root;
 }
-function run(event, input, root) {
+function run(event, input, root, extraEnv = {}) {
+  const env = { ...process.env, MAESTRO_COLLECTIVE_ROOT: root };
+  delete env.MAESTRO_DAEMON; // never inherit a daemon marker from the runner's own environment
+  Object.assign(env, extraEnv);
   return spawnSync(process.execPath, [RUNNER, event], {
     input: JSON.stringify(input),
     encoding: "utf8",
-    env: { ...process.env, MAESTRO_COLLECTIVE_ROOT: root },
+    env,
   });
 }
 
@@ -88,3 +91,83 @@ test("disabled config → fully silent no-op", () => {
     assert.equal(r.stdout.trim(), "");
   } finally { rmSync(root, { recursive: true, force: true }); }
 });
+
+// ── WP-M4: the front-door primer (identity block + session status) ─────────
+
+test("prime: injects the identity block + one-line session status + handoff/board counts when the repo has an identity", () => {
+  const root = tmpRoot();
+  try {
+    writeFileSync(join(root, "config", "agent.json"), JSON.stringify({
+      firstName: "Alex", fullName: "Alex Rivera", title: "Chief of Staff", company: "Acme",
+      principal: { fullName: "Jordan Lee", title: "CEO" }, repoSlug: "alex-ai",
+    }));
+    mkdirSync(join(root, "state", "session", "handoffs"), { recursive: true });
+    mkdirSync(join(root, "state", "org"), { recursive: true });
+    writeFileSync(join(root, "state", "session", "heartbeat.json"), JSON.stringify({ pid: 1, name: "alex-main", ts: Date.now() }));
+    writeFileSync(join(root, "state", "session", "handoffs", "t1.json"), "{}");
+    writeFileSync(join(root, "state", "session", "handoffs", "t2.json"), "{}");
+    writeFileSync(join(root, "state", "org", "board-mine.json"), JSON.stringify({ items: [{ itemId: "i1" }], fetchedAt: new Date().toISOString() }));
+    const r = run("prime", { session_id: "me", cwd: "/x/maestro" }, root);
+    assert.equal(r.status, 0);
+    const payload = JSON.parse(r.stdout);
+    const ctx = payload.hookSpecificOutput.additionalContext;
+    assert.match(ctx, /maestro:identity/);
+    assert.match(ctx, /Alex Rivera/);
+    assert.match(ctx, /Chief of Staff/);
+    assert.match(ctx, /`alex-main`/);
+    assert.match(ctx, /Session status: main session alex-main live/);
+    assert.match(ctx, /2 open handoffs/);
+    assert.match(ctx, /1 board item/);
+  } finally { rmSync(root, { recursive: true, force: true }); }
+});
+
+test("prime: identity primer and memory digest are emitted together in ONE hook frame", () => {
+  const root = tmpRoot();
+  try {
+    writeFileSync(join(root, "config", "agent.json"), JSON.stringify({ firstName: "Alex", fullName: "Alex Rivera" }));
+    register(root, { sessionId: "other", cwd: "/x/openclaw", intent: "research" });
+    appendCards(root, [{ kind: "decision", title: "Shipped billing", salience: 0.9, ts: new Date().toISOString() }], { sessionId: "prev" });
+    const r = run("prime", { session_id: "me", cwd: "/x/maestro" }, root);
+    assert.equal(r.status, 0);
+    const frames = r.stdout.trim().split("\n").filter(Boolean);
+    assert.equal(frames.length, 1, "exactly one JSON frame on stdout");
+    const ctx = JSON.parse(frames[0]).hookSpecificOutput.additionalContext;
+    assert.match(ctx, /maestro:collective-digest/);
+    assert.match(ctx, /Shipped billing/);
+    assert.match(ctx, /maestro:identity/);
+    assert.match(ctx, /Session status: main session not running/);
+  } finally { rmSync(root, { recursive: true, force: true }); }
+});
+
+test("prime: a denylisted cwd gets neither memory nor identity", () => {
+  const root = tmpRoot();
+  try {
+    writeFileSync(join(root, "config", "collective.yaml"), "repoDenylist: [client-secret]\n");
+    writeFileSync(join(root, "config", "agent.json"), JSON.stringify({ firstName: "Alex", fullName: "Alex Rivera" }));
+    const r = run("prime", { session_id: "me", cwd: "/work/client-secret" }, root);
+    assert.equal(r.status, 0);
+    assert.equal(r.stdout.trim(), "");
+  } finally { rmSync(root, { recursive: true, force: true }); }
+});
+
+test("prime: the daemon's own `claude --print` children (MAESTRO_DAEMON=1) get the memory digest but NOT the identity primer", () => {
+  const root = tmpRoot();
+  try {
+    writeFileSync(join(root, "config", "agent.json"), JSON.stringify({ firstName: "Alex", fullName: "Alex Rivera" }));
+    // No digest material → a daemon child is fully silent.
+    const quiet = run("prime", { session_id: "d1", cwd: "/x/maestro" }, root, { MAESTRO_DAEMON: "1" });
+    assert.equal(quiet.status, 0);
+    assert.equal(quiet.stdout.trim(), "", "no identity block for a daemon child");
+    // With digest material → the digest still flows, the identity block still does not.
+    register(root, { sessionId: "other", cwd: "/x/openclaw", intent: "research" });
+    appendCards(root, [{ kind: "decision", title: "Shipped billing", salience: 0.9, ts: new Date().toISOString() }], { sessionId: "prev" });
+    const r = run("prime", { session_id: "d2", cwd: "/x/maestro" }, root, { MAESTRO_DAEMON: "1" });
+    assert.equal(r.status, 0);
+    const ctx = JSON.parse(r.stdout).hookSpecificOutput.additionalContext;
+    assert.match(ctx, /Shipped billing/);
+    assert.ok(!/maestro:identity/.test(ctx), "identity primer is skipped for daemon children");
+    // An interactive session on the same repo still gets it.
+    const i = run("prime", { session_id: "i1", cwd: "/x/maestro" }, root);
+    assert.match(JSON.parse(i.stdout).hookSpecificOutput.additionalContext, /maestro:identity/);
+  } finally { rmSync(root, { recursive: true, force: true }); }
+});

package/scripts/daemon/agent-daemon-board-mine.test.mjs

@@ -0,0 +1,96 @@
+/**
+ * agent-daemon-board-mine.test.mjs — the daemon caches hq `board.mine` to
+ * state/org/board-mine.json every 5 minutes (design §3.5, WP-M6).
+ *
+ * Drives the REAL refreshBoardMineCache with an injected listMine and a fixed
+ * clock under a tmp AGENT_DIR. Same `imapflow` loader stub as the other
+ * daemon tests.
+ */
+
+import { test, before } from "node:test";
+import assert from "node:assert/strict";
+import { register } from "node:module";
+import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, existsSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+const loaderSrc = `
+export async function resolve(specifier, context, next) {
+  if (specifier === "imapflow") return { url: "imapflow-stub:main", shortCircuit: true };
+  return next(specifier, context);
+}
+export async function load(url, context, next) {
+  if (url === "imapflow-stub:main") return { format: "module", shortCircuit: true, source: "export class ImapFlow {}" };
+  return next(url, context);
+}
+`;
+register(`data:text/javascript,${encodeURIComponent(loaderSrc)}`);
+
+const AGENT_DIR = mkdtempSync(join(tmpdir(), "maestro-daemon-board-mine-"));
+process.env.AGENT_DIR = AGENT_DIR;
+process.env.MAESTRO_DAEMON_NO_AUTOSTART = "1";
+
+const NOW = Date.parse("2026-09-08T12:00:00Z");
+const CACHE = join(AGENT_DIR, "state", "org", "board-mine.json");
+
+let daemon;
+before(async () => {
+  mkdirSync(join(AGENT_DIR, "config"), { recursive: true });
+  mkdirSync(join(AGENT_DIR, "state", "sessions", "locks"), { recursive: true });
+  writeFileSync(join(AGENT_DIR, "config", "org.yaml"), "org:\n  cohort:\n    enabled: true\n    base: https://os.example.test\n    token: nlk_test_token\n    orgId: org_test\n");
+  writeFileSync(join(AGENT_DIR, "config", "agent.json"), JSON.stringify({ firstName: "Nova", lastName: "Reyes" }));
+  const url = new URL("./agent-daemon.mjs", import.meta.url);
+  daemon = await import(`${url.href}?boardmine=${Math.random()}`);
+});
+
+test("first call writes state/org/board-mine.json as {ts, items} from listMine; a call inside 5 min is a no-op; one at 5 min refreshes", async () => {
+  const calls = [];
+  const listMineImpl = async (o) => { calls.push(o); return [{ itemId: "i1", title: "Do X", col: "todo" }, null, "junk"]; };
+  const first = await daemon.refreshBoardMineCache({ now: NOW, listMineImpl });
+  assert.deepEqual(first, { refreshed: true, reason: "written", count: 1 });
+  assert.ok(existsSync(CACHE));
+  const doc = JSON.parse(readFileSync(CACHE, "utf8"));
+  assert.deepEqual(doc, { ts: "2026-09-08T12:00:00.000Z", items: [{ itemId: "i1", title: "Do X", col: "todo" }] });
+  assert.equal(calls.length, 1);
+  assert.equal(calls[0].base, "https://os.example.test", "the daemon's org.yaml connection is what listMine gets");
+  assert.equal(calls[0].orgId, "org_test");
+
+  const soon = await daemon.refreshBoardMineCache({ now: NOW + 4 * 60_000, listMineImpl });
+  assert.deepEqual(soon, { refreshed: false, reason: "fresh" });
+  assert.equal(calls.length, 1, "no hq call inside the interval");
+
+  const later = await daemon.refreshBoardMineCache({ now: NOW + 5 * 60_000, listMineImpl: async () => ({ ok: true, items: [] }) });
+  assert.deepEqual(later, { refreshed: true, reason: "written", count: 0 });
+  assert.deepEqual(JSON.parse(readFileSync(CACHE, "utf8")), { ts: "2026-09-08T12:05:00.000Z", items: [] }, "an empty board is a real answer");
+});
+
+test("hq unreachable for one tick: the last known good items are KEPT and the document is marked stale with itemsAt; the next good read clears it", async () => {
+  await daemon.refreshBoardMineCache({ now: NOW + 10 * 60_000, listMineImpl: async () => [{ itemId: "keep-me" }] });
+  const failed = await daemon.refreshBoardMineCache({ now: NOW + 15 * 60_000, listMineImpl: async () => ({ ok: false, items: [], error: "http 503" }) });
+  assert.deepEqual(failed, { refreshed: true, reason: "kept-previous", count: 1 });
+  const doc = JSON.parse(readFileSync(CACHE, "utf8"));
+  assert.deepEqual(doc, { ts: "2026-09-08T12:15:00.000Z", items: [{ itemId: "keep-me" }], stale: true, itemsAt: "2026-09-08T12:10:00.000Z", error: "http 503" });
+  const ok = await daemon.refreshBoardMineCache({ now: NOW + 20 * 60_000, listMineImpl: async () => ({ ok: true, items: [{ itemId: "fresh" }] }) });
+  assert.deepEqual(ok, { refreshed: true, reason: "written", count: 1 });
+  assert.deepEqual(JSON.parse(readFileSync(CACHE, "utf8")), { ts: "2026-09-08T12:20:00.000Z", items: [{ itemId: "fresh" }] });
+});
+
+test("a corrupt cache is refreshed; force bypasses the interval; the tick-loop call never throws when listMine rejects", async () => {
+  writeFileSync(CACHE, "{not json");
+  const r = await daemon.refreshBoardMineCache({ now: NOW + 30 * 60_000, listMineImpl: async () => [{ itemId: "z" }] });
+  assert.equal(r.refreshed, true);
+  const forced = await daemon.refreshBoardMineCache({ now: NOW + 30 * 60_000 + 1, force: true, listMineImpl: async () => [{ itemId: "y" }] });
+  assert.equal(forced.refreshed, true);
+  assert.deepEqual(JSON.parse(readFileSync(CACHE, "utf8")).items, [{ itemId: "y" }]);
+  await assert.rejects(daemon.refreshBoardMineCache({ now: NOW + 40 * 60_000, listMineImpl: async () => { throw new Error("boom"); } }), /boom/);
+  assert.deepEqual(JSON.parse(readFileSync(CACHE, "utf8")).items, [{ itemId: "y" }], "a failed refresh leaves the previous cache in place");
+});
+
+test("an un-enrolled seat (org disabled) writes nothing", async () => {
+  writeFileSync(join(AGENT_DIR, "config", "org.yaml"), "org:\n  cohort:\n    enabled: false\n");
+  daemon._resetDaemonOrgCfgCache();
+  rmSync(CACHE, { force: true });
+  const r = await daemon.refreshBoardMineCache({ now: NOW + 60 * 60_000, listMineImpl: async () => [{ itemId: "no" }] });
+  assert.deepEqual(r, { refreshed: false, reason: "org-disabled" });
+  assert.ok(!existsSync(CACHE));
+});

package/scripts/daemon/agent-daemon-design.test.mjs

@@ -0,0 +1,238 @@
+/**
+ * agent-daemon-design.test.mjs — the daemon re-syncs the brand foundation into
+ * DESIGN.md + PRODUCT.md, polled every 15 minutes and rewritten when the
+ * foundation's version moves (WP-M7 mechanic 4).
+ *
+ * Drives the REAL `refreshDesignFoundation` with an injected
+ * `branding.getFoundation` and a fixed clock under a tmp AGENT_DIR — the same
+ * shape as `agent-daemon-board-mine.test.mjs`, including its `imapflow` loader
+ * stub, because importing the daemon module pulls the whole seat in.
+ *
+ * The four claims: the 15-minute gate bounds the reads; a moved version is
+ * detected and named on the poll that sees it; an un-enrolled seat writes
+ * nothing; and no failure of hq's can blank a DESIGN.md already on disk.
+ */
+
+import { test, before } from "node:test";
+import assert from "node:assert/strict";
+import { register } from "node:module";
+import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, existsSync, statSync, utimesSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+const loaderSrc = `
+export async function resolve(specifier, context, next) {
+  if (specifier === "imapflow") return { url: "imapflow-stub:main", shortCircuit: true };
+  return next(specifier, context);
+}
+export async function load(url, context, next) {
+  if (url === "imapflow-stub:main") return { format: "module", shortCircuit: true, source: "export class ImapFlow {}" };
+  return next(url, context);
+}
+`;
+register(`data:text/javascript,${encodeURIComponent(loaderSrc)}`);
+
+const AGENT_DIR = mkdtempSync(join(tmpdir(), "maestro-daemon-design-"));
+process.env.AGENT_DIR = AGENT_DIR;
+process.env.MAESTRO_DAEMON_NO_AUTOSTART = "1";
+
+const NOW = Date.parse("2026-09-08T12:00:00Z");
+const FIFTEEN_MIN = 15 * 60_000;
+const DESIGN = join(AGENT_DIR, "DESIGN.md");
+const PRODUCT = join(AGENT_DIR, "PRODUCT.md");
+const STATE = join(AGENT_DIR, "state", "design", "foundation.json");
+
+const FIXTURE = JSON.parse(readFileSync(new URL("../../lib/design/fixtures/foundation.json", import.meta.url), "utf8"));
+
+const frame = (over = {}) => ({
+  ok: true,
+  result: {
+    foundation: FIXTURE,
+    version: { id: "bv_01HQZ", seq: 7, label: "V2.7" },
+    headVersionId: "bv_01HQZ",
+    isHead: true,
+    unversioned: false,
+    history: [],
+    ...over,
+  },
+});
+
+let daemon;
+before(async () => {
+  mkdirSync(join(AGENT_DIR, "config"), { recursive: true });
+  mkdirSync(join(AGENT_DIR, "state", "sessions", "locks"), { recursive: true });
+  writeFileSync(
+    join(AGENT_DIR, "config", "org.yaml"),
+    "org:\n  cohort:\n    enabled: true\n    base: https://os.example.test\n    token: nlk_test_token\n    orgId: org_test\n    orgName: Northwind\n",
+  );
+  writeFileSync(join(AGENT_DIR, "config", "agent.json"), JSON.stringify({ firstName: "Nova", lastName: "Reyes" }));
+  const url = new URL("./agent-daemon.mjs", import.meta.url);
+  daemon = await import(`${url.href}?design=${Math.random()}`);
+});
+
+test("the first tick writes DESIGN.md + PRODUCT.md from the seat's own connection", async () => {
+  const calls = [];
+  const getFoundationImpl = async (params, o) => { calls.push({ params, o }); return frame(); };
+
+  const first = await daemon.refreshDesignFoundation({ now: NOW, getFoundationImpl });
+  assert.equal(first.refreshed, true);
+  assert.equal(first.reason, "never", "the gate's own words for a seat that had never synced");
+  assert.deepEqual(first.written, ["DESIGN.md", "PRODUCT.md"]);
+  assert.equal(first.version, "bv_01HQZ");
+
+  assert.equal(calls.length, 1);
+  assert.deepEqual(calls[0].params, { historyLimit: 0 });
+  assert.equal(calls[0].o.base, "https://os.example.test", "the daemon's org.yaml connection is what the read gets");
+  assert.equal(calls[0].o.orgId, "org_test");
+
+  assert.match(readFileSync(DESIGN, "utf8"), /^---\nname: "Northwind"\n/);
+  assert.match(readFileSync(PRODUCT, "utf8"), /# Northwind — product voice/);
+  assert.equal(statSync(DESIGN).mode & 0o777, 0o644);
+  assert.equal(JSON.parse(readFileSync(STATE, "utf8")).version, "bv_01HQZ");
+});
+
+test("a tick inside 15 minutes spends no hq call at all", async () => {
+  let calls = 0;
+  const getFoundationImpl = async () => { calls += 1; return frame(); };
+  const soon = await daemon.refreshDesignFoundation({ now: NOW + 14 * 60_000, getFoundationImpl });
+  assert.deepEqual(soon, { refreshed: false, reason: "fresh" });
+  assert.equal(calls, 0, "the gate is asked BEFORE the read, which is the point of it");
+});
+
+test("a tick at 15 minutes reads, finds nothing changed, and touches no file", async () => {
+  const old = new Date(NOW - 86_400_000);
+  utimesSync(DESIGN, old, old);
+  utimesSync(PRODUCT, old, old);
+  const before = [statSync(DESIGN).mtimeMs, statSync(PRODUCT).mtimeMs];
+
+  let calls = 0;
+  const at = await daemon.refreshDesignFoundation({ now: NOW + FIFTEEN_MIN, getFoundationImpl: async () => { calls += 1; return frame(); } });
+  assert.equal(calls, 1, "the interval is what bounds the reads — hq has no cheap etag for this");
+  assert.equal(at.refreshed, false, "an unchanged foundation is not a refresh");
+  assert.equal(at.reason, "interval");
+  assert.deepEqual([statSync(DESIGN).mtimeMs, statSync(PRODUCT).mtimeMs], before, "not one mtime moved");
+});
+
+test("a moved foundation is picked up on the next poll, and named 'version-changed' not 'interval'", async () => {
+  // The honest bound: hq exposes no cheap "has the foundation changed?" etag
+  // the way `integration.toolsetVersion` does, so a version change can only be
+  // SEEN by a read, and the 15-minute gate is what bounds the reads. What the
+  // gate's second call buys is a truthful reason — the daemon logs why this
+  // tick rewrote the file, and "the palette moved" is not "the timer fired".
+  const moved = JSON.parse(JSON.stringify(FIXTURE));
+  moved.colors[2].value = "#0f172a";
+  const r = await daemon.refreshDesignFoundation({
+    now: NOW + 2 * FIFTEEN_MIN,
+    getFoundationImpl: async () => frame({ foundation: moved, headVersionId: "bv_02", version: { id: "bv_02", seq: 8, label: "V2.8" } }),
+  });
+
+  assert.equal(r.refreshed, true);
+  assert.equal(r.reason, "version-changed", "not 'interval' — the gate's second call names the real cause");
+  assert.ok(r.written.includes("DESIGN.md"));
+  assert.match(readFileSync(DESIGN, "utf8"), /primary-moss: "#0f172a"/);
+  assert.match(readFileSync(DESIGN, "utf8"), /\*\*Version:\*\* V2\.8/);
+  assert.equal(JSON.parse(readFileSync(STATE, "utf8")).version, "bv_02");
+});
+
+test("a forced tick inside the interval still sees a version change for what it is", async () => {
+  const moved = JSON.parse(JSON.stringify(FIXTURE));
+  moved.colors[2].value = "#334155";
+  const r = await daemon.refreshDesignFoundation({
+    now: NOW + 2 * FIFTEEN_MIN + 60_000, // one minute later: the gate would say "fresh"
+    force: true,
+    getFoundationImpl: async () => frame({ foundation: moved, headVersionId: "bv_03", version: { id: "bv_03", seq: 9, label: "V2.9" } }),
+  });
+  assert.equal(r.reason, "version-changed");
+  assert.ok(r.written.includes("DESIGN.md"));
+});
+
+test("a fetch failure keeps the DESIGN.md already on disk — fail-open, never blanked", async () => {
+  const good = readFileSync(DESIGN, "utf8");
+  const old = new Date(NOW - 86_400_000);
+  utimesSync(DESIGN, old, old);
+  const mtime = statSync(DESIGN).mtimeMs;
+  const now = NOW + 4 * FIFTEEN_MIN;
+
+  const thrown = await daemon.refreshDesignFoundation({ now, getFoundationImpl: async () => { throw new Error("ECONNREFUSED"); } });
+  assert.deepEqual(thrown, { refreshed: false, reason: "fetch-failed" });
+
+  const errored = await daemon.refreshDesignFoundation({ now, getFoundationImpl: async () => ({ ok: false, error: { code: "UNAUTHORIZED", message: "bad token" } }) });
+  assert.deepEqual(errored, { refreshed: false, reason: "error:UNAUTHORIZED" });
+
+  const empty = await daemon.refreshDesignFoundation({ now, getFoundationImpl: async () => ({ ok: true, result: { foundation: null, headVersionId: null } }) });
+  assert.deepEqual(empty, { refreshed: false, reason: "no-foundation" });
+
+  assert.equal(readFileSync(DESIGN, "utf8"), good, "three failures, and the last-good file is byte-identical");
+  assert.equal(statSync(DESIGN).mtimeMs, mtime);
+});
+
+test("an org-disabled seat writes nothing and spends no call", async () => {
+  const dir = mkdtempSync(join(tmpdir(), "maestro-daemon-design-off-"));
+  try {
+    mkdirSync(join(dir, "config"), { recursive: true });
+    mkdirSync(join(dir, "state", "sessions", "locks"), { recursive: true });
+    writeFileSync(join(dir, "config", "org.yaml"), "org:\n  cohort:\n    enabled: false\n");
+    writeFileSync(join(dir, "config", "agent.json"), JSON.stringify({ firstName: "Nova" }));
+
+    const prev = process.env.AGENT_DIR;
+    process.env.AGENT_DIR = dir;
+    let off;
+    try {
+      const url = new URL("./agent-daemon.mjs", import.meta.url);
+      off = await import(`${url.href}?designoff=${Math.random()}`);
+    } finally {
+      process.env.AGENT_DIR = prev;
+    }
+
+    let calls = 0;
+    const r = await off.refreshDesignFoundation({ now: NOW, getFoundationImpl: async () => { calls += 1; return frame(); } });
+    assert.deepEqual(r, { refreshed: false, reason: "org-disabled" });
+    assert.equal(calls, 0);
+    assert.ok(!existsSync(join(dir, "DESIGN.md")));
+    assert.ok(!existsSync(join(dir, "state", "design", "foundation.json")));
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("force skips the gate but nothing else — an unchanged foundation still writes nothing", async () => {
+  // Re-establish the on-disk files from the CURRENT head, then force a second
+  // read one second later: the gate would have said "fresh", the read happens
+  // anyway, and the byte comparison still refuses to touch the files.
+  const now = NOW + 5 * FIFTEEN_MIN;
+  await daemon.refreshDesignFoundation({ now, force: true, getFoundationImpl: async () => frame() });
+  let calls = 0;
+  const r = await daemon.refreshDesignFoundation({ now: now + 1_000, force: true, getFoundationImpl: async () => { calls += 1; return frame(); } });
+  assert.equal(calls, 1, "a forced tick reads even though the gate would have said 'fresh'");
+  assert.deepEqual(r.written, [], "and still writes nothing when the bytes already match");
+  assert.equal(r.refreshed, false);
+});
+
+test("a workspace that never saved a foundation gets nothing written — not hq's stock defaults", async () => {
+  // hq NEVER returns a null foundation: an org with no saved one reads back
+  // `dsDefaults()` (a complete, plausible palette that is nobody's brand) with
+  // `unversioned: true`. Writing it would ground the seat's design skills in
+  // another product's palette, with a generated file's authority behind it.
+  const dir = mkdtempSync(join(tmpdir(), "maestro-daemon-design-unver-"));
+  const prevAgent = process.env.AGENT_DIR;
+  try {
+    mkdirSync(join(dir, "config"), { recursive: true });
+    writeFileSync(
+      join(dir, "config", "org.yaml"),
+      "org:\n  cohort:\n    enabled: true\n    base: https://os.example.test\n    token: nlk_test_token\n    orgId: org_test\n    orgName: Northwind\n",
+    );
+    process.env.AGENT_DIR = dir;
+    const mod = await import(`${new URL("./agent-daemon.mjs", import.meta.url).href}?unver=${Math.random()}`);
+    const r = await mod.refreshDesignFoundation({
+      now: NOW,
+      getFoundationImpl: async () => frame({ headVersionId: null, version: null, unversioned: true }),
+    });
+    assert.deepEqual(r, { refreshed: false, reason: "unversioned" });
+    assert.ok(!existsSync(join(dir, "DESIGN.md")), "no DESIGN.md invented from stock defaults");
+    assert.ok(!existsSync(join(dir, "PRODUCT.md")));
+    assert.ok(!existsSync(join(dir, "state", "design", "foundation.json")));
+  } finally {
+    process.env.AGENT_DIR = prevAgent;
+    rmSync(dir, { recursive: true, force: true });
+  }
+});

package/scripts/daemon/agent-daemon-frontdoor.test.mjs

@@ -0,0 +1,60 @@
+/**
+ * agent-daemon-frontdoor.test.mjs — the daemon steps back from the Cohort
+ * inbox while the main session is live (design §3.1).
+ *
+ * Drives the REAL fast cohort scan (pollCohortFast → pollService) with a live
+ * heartbeat planted under the tmp AGENT_DIR and a fresh inbox item: the item
+ * must be left exactly as it arrived (no lock, no rename, no classification).
+ * The not-live branch is the pre-existing dispatch path, which would reach the
+ * Haiku classifier — it is covered by the pure gate tests instead.
+ *
+ * Same `imapflow` loader stub as agent-daemon.test.mjs.
+ */
+
+import { test, before } from "node:test";
+import assert from "node:assert/strict";
+import { register } from "node:module";
+import { mkdtempSync, mkdirSync, writeFileSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+const loaderSrc = `
+export async function resolve(specifier, context, next) {
+  if (specifier === "imapflow") return { url: "imapflow-stub:main", shortCircuit: true };
+  return next(specifier, context);
+}
+export async function load(url, context, next) {
+  if (url === "imapflow-stub:main") return { format: "module", shortCircuit: true, source: "export class ImapFlow {}" };
+  return next(url, context);
+}
+`;
+register(`data:text/javascript,${encodeURIComponent(loaderSrc)}`);
+
+const AGENT_DIR = mkdtempSync(join(tmpdir(), "maestro-daemon-frontdoor-"));
+process.env.AGENT_DIR = AGENT_DIR;
+process.env.MAESTRO_DAEMON_NO_AUTOSTART = "1";
+
+let daemon;
+before(async () => {
+  mkdirSync(join(AGENT_DIR, "config"), { recursive: true });
+  mkdirSync(join(AGENT_DIR, "state", "inbox", "cohort"), { recursive: true });
+  mkdirSync(join(AGENT_DIR, "state", "session"), { recursive: true });
+  mkdirSync(join(AGENT_DIR, "state", "sessions", "locks"), { recursive: true });
+  writeFileSync(join(AGENT_DIR, "config", "org.yaml"), "org:\n  cohort:\n    enabled: true\n");
+  writeFileSync(join(AGENT_DIR, "config", "agent.json"), JSON.stringify({ firstName: "Nova", lastName: "Reyes" }));
+  const url = new URL("./agent-daemon.mjs", import.meta.url);
+  daemon = await import(`${url.href}?frontdoor=${Math.random()}`);
+});
+
+test("live main session: pollCohortFast leaves a fresh cohort item untouched for the session", async () => {
+  writeFileSync(join(AGENT_DIR, "state", "session", "heartbeat.json"), JSON.stringify({ pid: process.pid, ts: new Date().toISOString() }));
+  const name = "2026-09-08T10-00-00-000Z-cohort-fd1.yaml";
+  writeFileSync(join(AGENT_DIR, "state", "inbox", "cohort", name), [
+    'id: "cohort-fd1"', 'service: "cohort"', 'channel: "dm/olivia"', 'channel_id: "ch1"', 'channel_kind: "DM"',
+    'sender: "Olivia Chen"', 'timestamp: "2026-09-08T10:00:00.000Z"', 'subject: ""', "content: |", "  hello", 'raw_ref: "cohort-fd1"', "",
+  ].join("\n"));
+  const n = await daemon.pollCohortFast();
+  assert.equal(n, 0, "nothing dispatched by the daemon");
+  assert.deepEqual(readdirSync(join(AGENT_DIR, "state", "inbox", "cohort")), [name], "the item is still a fresh .yaml");
+  assert.deepEqual(readdirSync(join(AGENT_DIR, "state", "sessions", "locks")), [], "no per-item lock taken");
+});