@cohortapp/agent-sdk 2.11.15 → 2.13.0

package/scripts/daemon/agent-daemon.mjs

@@ -42,6 +42,12 @@ function loadAgent() {
   return _agent;
 }
 
+// Self-echo guard (25/27/30 Aug recurrences): the poll lane re-ingested this
+// agent's OWN outbound sends as fresh inbound and fired holding acks at them.
+// The old inline check compared `sender` against "isla-roselli" while real
+// events carry "Isla Roselli" — it never matched. The match now lives in one
+// tested module and every drop is audited to logs/daemon/self-echo-drops.jsonl.
+import { isSelfSender, logSelfEchoDrop } from "./lib/self-echo.mjs";
 import { pollSlack } from "../poller/slack-poller.mjs";
 import { pollGmail } from "../poller/gmail-poller.mjs";
 import { pollCalendar } from "../poller/calendar-poller.mjs";
@@ -71,6 +77,7 @@ import {
   openObligations,
   escalate,
   closeObligation,
+  isPidAlive,
 } from "./assurance.mjs";
 import { recordPoll, recordClassification, recordSession, writeHealthDashboard } from "./health.mjs";
 import { acquireLock, releaseLock, updateLock, scanStaleLocks, acquireThreadLock, claimRequest, hasActiveClaim, sweepStaleItemClaims, sanitiseItemId } from "./session-lock.mjs";
@@ -85,7 +92,15 @@ const RUNG_MECHANISM = Object.fromEntries(RUNGS.map((r) => [r.id, r.mechanism]))
 // work and land it in the org's shared, ACL'd store so the fleet's memory
 // compounds. Fail-open + best-effort — never blocks or throws into the hot path;
 // local SQLite/interaction logs remain the fail-open cache.
-import { isEnabled as orgEnabled, loadOrgConfig, configFromAgent, electResponder, fetchSelfProfile } from "../../lib/org/client.mjs";
+import { isEnabled as orgEnabled, loadOrgConfig, configFromAgent, electResponder, fetchSelfProfile, listMineResult as orgListMineResult } from "../../lib/org/client.mjs";
+// board.mine cache (design §3.5, WP-M6): the daemon writes state/org/board-mine.json
+// every 5 min; the SessionStart primer, session_status and `maestro board mine`
+// read it. The when/what is pure (lib/org/board-mine-cache.mjs); the I/O is here.
+import { shouldRefresh as boardMineShouldRefresh, renderRefresh as renderBoardMineRefresh, cacheTs as boardMineCacheTs, BOARD_MINE_REL } from "../../lib/org/board-mine-cache.mjs";
+import { writeJsonAtomic as writeJsonAtomicFile } from "../../lib/fs-atomic.mjs";
+import { brandingGetFoundation } from "../../lib/org/client.mjs";
+import { shouldRefreshDesign, foundationVersion, isUnversionedFoundation, DESIGN_REFRESH_INTERVAL_MS } from "../../lib/design/refresh-gate.mjs";
+import { syncDesign, readFoundationState, workspaceName as designWorkspaceName } from "../../lib/design/write.mjs";
 import { remember as orgRemember } from "../../lib/org/knowledge.mjs";
 import { sweepSessionOutcomes, resultTextFromStdout } from "./session-outcomes.mjs";
 import { recordWorkStep as orgRecordWorkStep, cohortChannelId, cohortMessageId } from "../../lib/org/work-ledger.mjs";
@@ -117,6 +132,13 @@ import { getHookBus } from "../../lib/hooks/bus.mjs";
 // classifier path below is the mechanism the ladder's `react` effect drives,
 // not a parallel universe.
 import { processOne } from "../../lib/execution/pipeline.mjs";
+// FRONT DOOR (design §3.1/§3.3). When the seat's main session is live, the
+// daemon leaves Cohort inbox items in place for the session to claim instead
+// of spawning `claude --print`; not live → today's dispatch, unchanged. The
+// gate is pure (lib/session/frontdoor.mjs); the assurance sweep reopens a
+// session claim that was neither replied nor done within 20 min.
+import { makeFrontDoorGate } from "../../lib/session/frontdoor.mjs";
+import { sweepSessionInboxForDaemon } from "../../lib/session/inbox-claims.mjs";
 import { defaultEffects, scheduleToQueue } from "../../lib/execution/effects.mjs";
 import { loadReactObligations } from "../../lib/execution/match.mjs";
 import { policyFor } from "../../lib/execution/surface-policy.mjs";
@@ -227,8 +249,13 @@ async function poll() {
  * cohort path can run on its own fast interval (pollCohortFast) without waiting
  * on the 60s full poll. Returns the count of new items processed. Never throws.
  */
+const _frontDoorGate = makeFrontDoorGate({ agentRoot: AGENT_REPO_DIR });
 async function pollService(svc) {
   try {
+    // Front door: a live main session owns this service's inbox — leave it.
+    const fd = _frontDoorGate.check(svc.name);
+    if (fd.changed) console.log(`[daemon] front door for ${svc.name}: ${fd.dispatch ? "daemon dispatches" : "main session owns intake"} (${fd.reason})`);
+    if (!fd.dispatch) return 0;
     const result = await svc.fn();
     // Dedup by raw_ref first: the same Slack message arrives via multiple paths
     // (channel scan, thread scan, events-server JSON) with different item IDs.
@@ -236,12 +263,18 @@ async function pollService(svc) {
     // once regardless of path.
     const seenRefs = new Set();
     const newItems = result.items.filter((item) => {
-      // Skip the agent's own messages — defensive check in case intake filters miss them
-      const sender = (item.sender || "").toLowerCase();
-      const me = loadAgent();
-      const myFirst = (me.firstName || "").toLowerCase();
-      const myFull = (me.fullName || "").toLowerCase().replace(/\s+/g, "-");
-      if (myFirst && (sender === myFirst || sender === myFull)) return false;
+      // SELF-ECHO DROP (ingestion guard #1). The agent's own outbound, echoed
+      // back by a lane, is not inbound. Dropped LOUDLY (audit log) and the inbox
+      // file is retired — without the rename the same echo was re-scanned and
+      // re-considered every tick forever. The old check here compared `sender`
+      // against `fullName` with spaces folded to dashes, which never matched the
+      // real event shape ("Isla Roselli") — the exact reason the 25/27/30 Aug
+      // self-reply loops got past it.
+      if (isSelfSender(item)) {
+        logSelfEchoDrop(item, { stage: "poll", service: svc.name });
+        markProcessed(item, svc.name);
+        return false;
+      }
 
       const lockKey = item.raw_ref || item.id || `${svc.name}-${Date.now()}`;
       if (seenRefs.has(lockKey)) return false;
@@ -278,7 +311,7 @@ async function pollService(svc) {
 // against the 60s poll's own cohort scan (kept as a safety net).
 let _cohortPoller = null;
 let _cohortFastRunning = false;
-async function pollCohortFast() {
+export async function pollCohortFast() {
   if (_cohortFastRunning) return 0;
   if (!_existsSync(join(AGENT_REPO_DIR, "config/org.yaml"))) return 0;
   if (!_cohortPoller) _cohortPoller = makeInboxScanPoller("cohort", { agentRoot: AGENT_REPO_DIR });
@@ -339,6 +372,18 @@ async function processItemTraced(item, service, itemId, trace_id, deps = {}) {
   // regression-prone line in the file.
   enrichItem(item, service);
 
+  // ── SELF-ECHO DROP (guard #2, the choke point) ───────────────────────────
+  // Every entry path — the 60s poll, the fast cohort scan, crash recovery —
+  // crosses this line, so an echo that slipped past a lane's own filter is
+  // still stopped before it can be classified, elected on, acked or answered.
+  // Retiring the file is part of the drop: an un-retired echo is re-delivered
+  // next poll and re-dropped forever, which is noise pretending to be safety.
+  if (isSelfSender(item)) {
+    logSelfEchoDrop(item, { stage: "process", service });
+    markProcessed(item, service);
+    return { ok: true, path: "filtered", reason: "self_echo" };
+  }
+
   // ── THE EXECUTION LADDER, at the front of the chain ──────────────────────
   // Returns `{ handled }`. `handled:true` means the ladder took responsibility
   // for this item — it ignored it (journalled), queued it, delegated it,
@@ -899,6 +944,20 @@ export async function answerItem(item, service, itemId, trace_id, deps = {}, rou
     const ackVerdict = _claudeAvailable()
       ? shouldAcknowledge({ willSpawnSession: true, item, source: "inbox" })
       : { ack: false, reason: "claude-unavailable" };
+    // ── DISPATCH GATE: emitter-class inbound spawns NOTHING ─────────────────
+    // `emitterClass: true` means the gate read the inbound and recognised output
+    // this seat's own machinery class produces — a peer agent's ack-shaped
+    // one-liner, or another daemon's narrator line (progress/failure/terminal).
+    // Suppressing only the ack while still spawning would keep the expensive
+    // half of the 25/27/30 Aug loop: a 15-45 minute session burned answering a
+    // reflex. The gate already audited the refusal
+    // (logs/daemon/dispatch-gate-drops.jsonl); retire the item and stop here.
+    if (!ackVerdict.ack && ackVerdict.emitterClass) {
+      console.log(`[daemon] dispatch gate: no ack, no session for ${itemId} (${ackVerdict.reason})`);
+      counters.bump("dispatch.gate_refused", { service, reason: ackVerdict.reason });
+      markProcessed(item, service);
+      return { ok: true, path: "filtered", reason: ackVerdict.reason };
+    }
     try {
       // The DEBT is opened whether or not we can speak. Those are two different
       // questions and conflating them is what made a whole class of ask
@@ -1712,6 +1771,127 @@ export function _resetDaemonOrgCfgCache() {
   _cachedDaemonOrgCfg = undefined;
 }
 
+/**
+ * Refresh state/org/board-mine.json from hq `board.mine` when the cache is
+ * 5 min old (or absent). Fail-open end to end: an un-enrolled seat writes
+ * nothing; a FAILED read (hq unreachable) keeps the previous items and marks
+ * the document `stale: true` with `itemsAt` (lib/org/board-mine-cache.mjs
+ * renderRefresh) — one bad tick must not blank the primer, session_status
+ * and `maestro board mine` for five minutes. `listMineImpl` may return the
+ * `{ok, items}` shape of listMineResult or a bare array (= ok).
+ * @param {{now?:number, listMineImpl?:Function, force?:boolean}} [deps]
+ * @returns {Promise<{refreshed:boolean, reason:string, count?:number}>}
+ */
+export async function refreshBoardMineCache(deps = {}) {
+  const now = Number.isFinite(deps.now) ? deps.now : Date.now();
+  const path = join(AGENT_REPO_DIR, BOARD_MINE_REL);
+  let cur = null;
+  try { cur = JSON.parse(readFileSync(path, "utf8")); } catch { cur = null; /* absent or corrupt → refresh */ }
+  if (!deps.force && !boardMineShouldRefresh(boardMineCacheTs(cur), now)) return { refreshed: false, reason: "fresh" };
+  const cfg = daemonOrgCfg();
+  if (!orgEnabled(cfg)) return { refreshed: false, reason: "org-disabled" };
+  const conn = configFromAgent(cfg) || {};
+  const result = await (deps.listMineImpl || orgListMineResult)({ base: conn.base, token: conn.token, orgId: conn.orgId });
+  const doc = renderBoardMineRefresh(result, cur, now);
+  writeJsonAtomicFile(path, doc);
+  return { refreshed: true, reason: doc.stale ? "kept-previous" : "written", count: doc.items.length };
+}
+
+/**
+ * Re-sync the workspace brand foundation into DESIGN.md + PRODUCT.md (WP-M7
+ * mechanic 4), in the same idiom as `refreshIntegrationTools` in
+ * `lib/org/mesh.mjs`: a cheap gated poll on the beat, fail-open end to end,
+ * keeping the last-good files when hq is unreachable.
+ *
+ * WHY THIS EXISTS AT ALL. Every design skill on the seat is told to read
+ * `$AGENT_ROOT/DESIGN.md` before it picks a colour or a typeface. A designer
+ * working from a palette a human replaced last week is worse than one with no
+ * palette, because the stale file looks authoritative — so the seat follows the
+ * foundation rather than waiting for someone to re-run the CLI.
+ *
+ * THE GATE IS ASKED TWICE (see `lib/design/refresh-gate.mjs`): once before the
+ * read, with the version unknown, to decide whether to spend a call at all
+ * (15-minute floor); once after, with the version hq returned, to say honestly
+ * WHY this tick refreshed. hq exposes no cheap "has the foundation changed"
+ * etag the way `integration.toolsetVersion` does, so the version comparison can
+ * only happen after a read and the interval is what bounds the reads.
+ *
+ * FAIL-OPEN, AND SILENT ABOUT NOTHING. An un-enrolled seat writes nothing and
+ * says so; a fetch failure keeps the files that are already on disk and logs
+ * the reason. The write itself is byte-idempotent (`syncDesign`), so a steady
+ * foundation never touches an mtime — which is what keeps a git tree clean and
+ * an editor's file watcher quiet on a seat that polls every 15 minutes.
+ *
+ * @param {{now?:number, intervalMs?:number, force?:boolean, getFoundationImpl?:Function, fetchImpl?:Function}} [deps]
+ * @returns {Promise<{refreshed:boolean, reason:string, version?:string|null, written?:string[]}>}
+ */
+export async function refreshDesignFoundation(deps = {}) {
+  const now = Number.isFinite(deps.now) ? deps.now : Date.now();
+  const intervalMs = Number.isFinite(deps.intervalMs) ? deps.intervalMs : DESIGN_REFRESH_INTERVAL_MS;
+  const prior = readFoundationState(AGENT_REPO_DIR);
+  const before = shouldRefreshDesign({
+    lastVersion: prior ? prior.version : null,
+    currentVersion: null,
+    lastAt: prior ? prior.fetchedAt : null,
+    now,
+    intervalMs,
+  });
+  if (!deps.force && !before.refresh) return { refreshed: false, reason: "fresh" };
+
+  const cfg = daemonOrgCfg();
+  if (!orgEnabled(cfg)) return { refreshed: false, reason: "org-disabled" };
+  const conn = configFromAgent(cfg) || {};
+
+  let frame;
+  try {
+    frame = await (deps.getFoundationImpl || brandingGetFoundation)(
+      { historyLimit: 0 },
+      { base: conn.base, token: conn.token, orgId: conn.orgId, fetchImpl: deps.fetchImpl },
+    );
+  } catch (err) {
+    console.warn(`[daemon] design sync: foundation read failed (${err && err.message ? err.message : err}) — keeping the DESIGN.md already on disk`);
+    return { refreshed: false, reason: "fetch-failed" };
+  }
+  if (!frame || !frame.ok || !frame.result || typeof frame.result !== "object" || !frame.result.foundation) {
+    const why = frame && frame.error && frame.error.code ? frame.error.code : "no-foundation";
+    return { refreshed: false, reason: why === "no-foundation" ? "no-foundation" : `error:${why}` };
+  }
+  // A workspace that has never SAVED a foundation reads back hq's own product
+  // defaults with `unversioned: true` — a complete palette that is nobody's
+  // brand. Writing it would ground every design skill on the seat in the wrong
+  // palette, with a generated file's authority behind it. Nothing is written
+  // and nothing already on disk is disturbed; see
+  // refresh-gate.mjs#isUnversionedFoundation.
+  if (isUnversionedFoundation(frame.result)) return { refreshed: false, reason: "unversioned" };
+
+  // The second gate call: now that the version is known, say why this tick ran.
+  const after = shouldRefreshDesign({
+    lastVersion: prior ? prior.version : null,
+    currentVersion: foundationVersion(frame.result),
+    lastAt: prior ? prior.fetchedAt : null,
+    now,
+    intervalMs,
+  });
+
+  let out;
+  try {
+    out = syncDesign({
+      agentRoot: AGENT_REPO_DIR,
+      result: frame.result,
+      now,
+      name: designWorkspaceName(cfg),
+      source: "cohort · branding.getFoundation",
+    });
+  } catch (err) {
+    console.warn(`[daemon] design sync: write failed (${err && err.message ? err.message : err})`);
+    return { refreshed: false, reason: "write-failed" };
+  }
+  if (out.written.length) {
+    console.log(`[daemon] design sync (${after.reason}) → wrote ${out.written.join(", ")}${out.version ? ` — foundation ${out.version}` : ""}`);
+  }
+  return { refreshed: out.written.length > 0, reason: after.reason, version: out.version, written: out.written };
+}
+
 /** Longest completion note we will put on a board comment. */
 const COMPLETION_NOTE_CHARS = 1200;
 
@@ -2179,6 +2359,38 @@ async function sweepBacklog() {
 // Main
 // ---------------------------------------------------------------------------
 
+/**
+ * Daemon singleton ADVISORY — a pidfile check, deliberately not a lock.
+ *
+ * Two live daemons on one AGENT_DIR (the operator's manual run next to the
+ * launchd one) both poll, both sweep, and both narrate; the per-obligation
+ * ownership guard in assurance.sweepObligations bounds the damage, but the
+ * condition itself deserves a LOUD line the moment it starts. This only logs
+ * and counts — it never refuses to start and never exits — because launchd's
+ * KeepAlive restart may race the old process's teardown, and a pidfile that
+ * can veto startup under KeepAlive is a daemon that stays down. A recycled pid
+ * can false-positive; that costs one loud log line, nothing more.
+ */
+function advisePidfileSingleton() {
+  const pidPath = join(AGENT_REPO_DIR, "state", "daemon.pid");
+  try {
+    let prior = null;
+    try { prior = parseInt(readFileSync(pidPath, "utf-8"), 10); } catch { /* no pidfile yet */ }
+    if (Number.isFinite(prior) && prior > 0 && prior !== process.pid && isPidAlive(prior)) {
+      console.error(
+        `[daemon] ⚠ ANOTHER DAEMON MAY BE LIVE: pid ${prior} (from ${pidPath}) is running and also holds ${AGENT_REPO_DIR}. ` +
+        `Two daemons on one AGENT_DIR double-poll and race the obligation ledger — stop one unless this is deliberate.`,
+      );
+      counters.bump("daemon.singleton_advisory", { prior_pid: prior });
+    }
+    mkdirSync(join(AGENT_REPO_DIR, "state"), { recursive: true });
+    writeFileSync(pidPath, `${process.pid}\n`);
+  } catch (err) {
+    // Advisory only — an unwritable pidfile must never stop the daemon booting.
+    console.warn(`[daemon] pidfile advisory unavailable: ${err.message}`);
+  }
+}
+
 async function main() {
   console.log("╔══════════════════════════════════════════════════════════╗");
   console.log(`║          ${(loadAgent().firstName || "Agent").padEnd(8)} Daemon — Reactive Event Processor       ║`);
@@ -2205,6 +2417,11 @@ async function main() {
     // No emergency stop — continue
   }
 
+  // Two-daemon advisory: log loudly if another live daemon already holds this
+  // AGENT_DIR (pidfile check; never blocks startup — see the function's note on
+  // launchd KeepAlive semantics), then record this process as the holder.
+  advisePidfileSingleton();
+
   // Clear orphaned state from prior daemon instances
   const staleCleared = scanStaleLocks();
   if (staleCleared > 0) {
@@ -2242,6 +2459,9 @@ async function main() {
 
   // Initial poll immediately
   await poll();
+  // First board.mine cache write, so the primer has something before the
+  // first health tick (fail-open; an un-enrolled seat writes nothing).
+  refreshBoardMineCache().catch((err) => console.error("[daemon] board-mine cache error:", err.message));
 
   // Poll loop
   setInterval(async () => {
@@ -2254,6 +2474,16 @@ async function main() {
     }
   }, POLL_INTERVAL);
 
+  // Brand foundation → DESIGN.md + PRODUCT.md, every 15 min (WP-M7). Fired once
+  // at boot so a seat that has never synced has its design files before the
+  // first session opens, then on its own interval. Fail-open and never awaited:
+  // the design docs are guidance, and no failure to fetch them may hold up the
+  // poll loop.
+  refreshDesignFoundation().catch((err) => console.error("[daemon] design sync error:", err.message));
+  setInterval(() => {
+    refreshDesignFoundation().catch((err) => console.error("[daemon] design sync error:", err.message));
+  }, DESIGN_REFRESH_INTERVAL_MS);
+
   // Fast reactive cohort scan — drains org-push-fetched DMs in ~2s instead of
   // waiting up to 60s for the full poll. Local YAML only; no API/rate-limit cost.
   setInterval(() => {
@@ -2285,6 +2515,12 @@ async function main() {
       if (claimsSwept > 0) {
         console.log(`[daemon] Swept ${claimsSwept} stale item claims`);
       }
+      // Front door: reopen session claims older than 20 min, due deferrals and
+      // (while the session is live) the daemon's own orphaned .dispatched files.
+      const reopened = sweepSessionInboxForDaemon(AGENT_REPO_DIR).reopened;
+      if (reopened.length > 0) console.log(`[daemon] reopened ${reopened.length} session-claimed inbox item(s): ${reopened.map((r) => `${r.id} (${r.reason})`).join(", ")}`);
+      // board.mine cache — the pure gate says "no" for four of every five ticks.
+      refreshBoardMineCache().catch((err) => console.error("[daemon] board-mine cache error:", err.message));
     } catch (err) {
       console.error("[daemon] Health write error:", err.message);
     }
@@ -2300,18 +2536,21 @@ async function main() {
   }, HEALTH_INTERVAL);
 
   // Graceful shutdown — clean up active.json so next startup doesn't see stale sessions
+  // Exit honours a pre-set process.exitCode: the org-mesh "restart" directive
+  // sets 1 before signalling so launchd's KeepAlive {SuccessfulExit:false}
+  // relaunches the daemon; a plain SIGTERM still exits 0 (stays down).
   process.on("SIGTERM", () => {
     console.log("[daemon] SIGTERM received, shutting down gracefully");
     resetActiveSessions();
     writeHealthDashboard();
-    process.exit(0);
+    process.exit(process.exitCode || 0);
   });
 
   process.on("SIGINT", () => {
     console.log("[daemon] SIGINT received, shutting down");
     resetActiveSessions();
     writeHealthDashboard();
-    process.exit(0);
+    process.exit(process.exitCode || 0);
   });
 
   console.log("[daemon] Running. Ctrl+C to stop.");

package/scripts/daemon/agent-daemon.test.mjs

@@ -903,3 +903,76 @@ test("fastPathClassify: a short directed question skips the classifier; work-req
   assert.ok(daemon.fastPathClassify({ content: "what OS?" }, true));
   assert.equal(daemon.fastPathClassify({ content: "what OS?" }, true, { disableFastPath: true }), null);
 });
+
+// ===========================================================================
+// SELF-ECHO — the agent's own outbound, re-ingested by a poll lane, must be
+// dropped BEFORE it can be classified, elected on, acked or answered. Recurred
+// live 2026-08-25 / 08-27 / 08-30: the old filter normalised the agent's full
+// name to "isla-roselli" while real events carry "Isla Roselli", so the agent
+// said "Looking now." to itself (and, in shared DMs, to another agent's echo).
+// ===========================================================================
+
+test("SELF-ECHO: an echoed own message is dropped at the processItem choke point — file retired, drop audited", async () => {
+  resetState();
+  const selfEcho = await import("./lib/self-echo.mjs");
+  const { writeFileSync: wf } = await import("node:fs");
+  mkdirSync(join(AGENT_DIR, "config"), { recursive: true });
+  wf(join(AGENT_DIR, "config", "agent.json"), JSON.stringify({
+    firstName: "Isla", fullName: "Isla Roselli", memberId: "cmqh0tcml004ihhl6zev6ocb5",
+  }));
+  selfEcho._resetSelfIdentity();
+  try {
+    // The REAL echo shape: display name verbatim, spaces and all.
+    const item = { id: "MSG-SELF", raw_ref: "slack:DSELF:1", channel: "dm/candace", channel_id: "DSELF0001", sender: "Isla Roselli", content: "Both answers — and the second one settles it." };
+    const name = writeLiveItem(item);
+
+    let pipelineTouched = null;
+    const res = await daemon.processItem(item, "slack", {
+      classify: async () => { pipelineTouched = "classify"; return { priority: "high", action: "respond", model: "opus", summary: "x", category: "action_required", directed_at_agent: true }; },
+      isQuickReply: () => { pipelineTouched = "isQuickReply"; return false; },
+      sendQuickResponse: async () => { pipelineTouched = "quick_reply"; return { sent: true }; },
+      sendHoldingMessage: async () => { pipelineTouched = "holding_ack"; return { sent: true, holdingText: "x" }; },
+      dispatch: () => { pipelineTouched = "dispatch"; },
+      claudeAvailable: () => true,
+    });
+
+    assert.equal(res && res.path, "filtered", "the echo is filtered, not answered");
+    assert.equal(res && res.reason, "self_echo");
+    assert.equal(pipelineTouched, null, "no classify, no ack, no reply, no session — the echo never enters the pipeline");
+    assert.deepEqual(inboxFiles(), [`${name}.processed`], "the echo's inbox file is RETIRED — an un-retired echo would be re-scanned and re-dropped every tick forever");
+    const auditPath = join(AGENT_DIR, "logs", "daemon", "self-echo-drops.jsonl");
+    assert.ok(existsSync(auditPath), "every drop leaves an audit row");
+    assert.match(readFileSync(auditPath, "utf-8"), /slack:DSELF:1/, "the audit row names the dropped event");
+  } finally {
+    rmSync(join(AGENT_DIR, "config", "agent.json"), { force: true });
+    selfEcho._resetSelfIdentity();
+  }
+});
+
+test("SELF-ECHO: a genuine colleague's message is untouched by the guard", async () => {
+  resetState();
+  const selfEcho = await import("./lib/self-echo.mjs");
+  const { writeFileSync: wf } = await import("node:fs");
+  mkdirSync(join(AGENT_DIR, "config"), { recursive: true });
+  wf(join(AGENT_DIR, "config", "agent.json"), JSON.stringify({
+    firstName: "Isla", fullName: "Isla Roselli", memberId: "cmqh0tcml004ihhl6zev6ocb5",
+  }));
+  selfEcho._resetSelfIdentity();
+  try {
+    const item = { id: "MSG-COLLEAGUE", raw_ref: "slack:DCOLL:1", channel: "dm/jordan", channel_id: "DCOLL0001", is_dm: true, sender: "Jordan Blake", content: "please draft the board memo" };
+    writeLiveItem(item);
+    let dispatched = false;
+    const res = await daemon.answerItem(item, "slack", "slack:DCOLL:1", "trace-coll", {
+      classify: async () => ({ priority: "critical", action: "respond", model: "opus", summary: "draft board memo", category: "action_required", directed_at_agent: true }),
+      isQuickReply: () => false,
+      sendHoldingMessage: async () => ({ sent: true, holdingText: "Starting on the board memo now." }),
+      dispatch: (_p, _it, _cr, _s, opts) => { dispatched = true; opts.onClose({ ok: true, code: 0 }); },
+      claudeAvailable: () => true,
+    });
+    assert.equal(dispatched, true, "a real colleague's ask still dispatches");
+    assert.equal(res.path, "session");
+  } finally {
+    rmSync(join(AGENT_DIR, "config", "agent.json"), { force: true });
+    selfEcho._resetSelfIdentity();
+  }
+});